diff --git a/.github/workflows/demo-deploy-action.yml b/.github/workflows/demo-deploy-action.yml
index fea5d780d6..fd84d2a35d 100644
--- a/.github/workflows/demo-deploy-action.yml
+++ b/.github/workflows/demo-deploy-action.yml
@@ -1,10 +1,10 @@
 name: 'Demo-Deploy'
 
 on:
-  pull_request:
-    types:
-      - closed
-    branches: [ main ]
+#  pull_request:
+#    types:
+#      - closed
+#    branches: [ main ]
 
 jobs:
   update-version:
@@ -144,12 +144,12 @@ jobs:
         with:
           build: npm i -D cypress
           install: false
-          wait-on: 'http://localhost:8080/config, http://localhost:8544'
+          wait-on: 'http://pitc.okr.localhost:8080/config, http://pitc.okr.localhost:4200, http://localhost:8544'
           wait-on-timeout: 120
           browser: chrome
           headed: true
           working-directory: frontend
-          config: baseUrl=http://localhost:8080
+          config: baseUrl=http://pitc.okr.localhost:8080
 
       - uses: actions/upload-artifact@v4
         if: always()
diff --git a/.github/workflows/frontend-test-action.yml b/.github/workflows/frontend-test-action.yml
index 812c7a8698..327883ec41 100644
--- a/.github/workflows/frontend-test-action.yml
+++ b/.github/workflows/frontend-test-action.yml
@@ -45,9 +45,9 @@ jobs:
               --name my_keycloak \
               -e KEYCLOAK_ADMIN=admin \
               -e KEYCLOAK_ADMIN_PASSWORD=keycloak \
-              -v ./docker/config/realm-export.json:/opt/keycloak/data/import/realm.json \
+              -v ./docker/config/realm-export-pitc.json:/opt/keycloak/data/import/realm-pitc.json \
               -p 8544:8080 \
-              quay.io/keycloak/keycloak:23.0.1 \
+              quay.io/keycloak/keycloak:24.0.2 \
               start-dev --import-realm
 
       - name: start backend
@@ -58,10 +58,16 @@ jobs:
         with:
           working-directory: frontend
           start: npm start
-          wait-on: 'http://localhost:8080/config, http://localhost:4200, http://localhost:8544'
+          wait-on: 'http://pitc.okr.localhost:8080/config, http://pitc.okr.localhost:4200, http://localhost:8544'
           wait-on-timeout: 120
           browser: chrome
           headed: true
 
+      - uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: cypress-screenshots
+          path: frontend/cypress/screenshots
+
       - name: remove docker containers
         run: docker ps -aq | xargs -r docker rm -f
diff --git a/.github/workflows/staging-deploy-action.yml b/.github/workflows/staging-deploy-action.yml
index db1d79e9ed..386dc904b0 100644
--- a/.github/workflows/staging-deploy-action.yml
+++ b/.github/workflows/staging-deploy-action.yml
@@ -1,10 +1,10 @@
 name: 'Staging-Deploy'
 
 on:
-  pull_request:
-    types:
-      - closed
-    branches: [ main ]
+#  pull_request:
+#    types:
+#      - closed
+#    branches: [ main ]
 
 jobs:
   update-version:
diff --git a/.gitignore b/.gitignore
index da6e9b987e..678f62ef45 100644
--- a/.gitignore
+++ b/.gitignore
@@ -31,3 +31,4 @@ sonar-project.properties
 /frontend/cypress/downloads/
 /frontend/cypress/screenshots/
 /toolchains.xml
+/backend/src/main/resources/db/okr_schema.sql
diff --git a/.run/OkrApplication-E2E.run.xml b/.run/OkrApplication-E2E.run.xml
index aa7706165a..0e6d57f321 100644
--- a/.run/OkrApplication-E2E.run.xml
+++ b/.run/OkrApplication-E2E.run.xml
@@ -1,7 +1,7 @@
 <component name="ProjectRunConfigurationManager">
   <configuration default="false" name="OkrApplication-E2E" type="SpringBootApplicationConfigurationType" factoryName="Spring Boot">
     <option name="ACTIVE_PROFILES" value="integration-test" />
-    <option name="ALTERNATIVE_JRE_PATH" value="$USER_HOME$/.sdkman/candidates/java/current" />
+    <option name="ALTERNATIVE_JRE_PATH" value="azul-17" />
     <option name="ALTERNATIVE_JRE_PATH_ENABLED" value="true" />
     <module name="backend" />
     <option name="SPRING_BOOT_MAIN_CLASS" value="ch.puzzle.okr.OkrApplication" />
diff --git a/README.md b/README.md
index c916054b86..17414fae16 100644
--- a/README.md
+++ b/README.md
@@ -4,10 +4,17 @@ This is an open source application for managing OKRs, developed by the team of a
 
 This project contains two parts:
 
+## Setup
+Add subdomains to hosts file:
+```shell
+sudo sh -c 'echo "127.0.0.1       pitc.okr.localhost\n127.0.0.1       acme.okr.localhost" >> /etc/hosts'
+```
+
 ## Frontend
 
 [Frontend description](frontend/README.md)
 
+
 ## Backend
 [Backend description](backend/README.md)
 
@@ -20,7 +27,7 @@ Path to folder from repository root `cd docker`
 Type `docker-compose up` in terminal to start up the docker container, `docker-compose down` to shut the container down.
 
 ## Users
-All users 
+All users PITC
 ```json
 {
   "gl": {
@@ -65,3 +72,25 @@ All users
   }
 }
 ```
+All users ACME
+```json
+{
+  "gl": {
+    "username": "gl-acme",
+    "password": "gl",
+    "name": "Jaya Norris"
+  },
+  "bl": {
+    "username": "bl-acme",
+    "password": "bl",
+    "name": "Esha Harris"
+  },
+  "member": {
+    "username": "member-acme",
+    "password": "member",
+    "name": "Abraham Woodard"
+  }
+}
+```
+
+
diff --git a/backend/pom.xml b/backend/pom.xml
index 0ce9c55b21..492da5166e 100644
--- a/backend/pom.xml
+++ b/backend/pom.xml
@@ -6,11 +6,11 @@
     <parent>
         <groupId>ch.puzzle.okr</groupId>
         <artifactId>parent</artifactId>
-        <version>2.0.136-SNAPSHOT</version>
+        <version>2.0.160-SNAPSHOT</version>
     </parent>
 
     <artifactId>backend</artifactId>
-    <version>2.0.136-SNAPSHOT</version>
+    <version>2.0.160-SNAPSHOT</version>
     <name>backend</name>
     <description>Puzzle OKR Tool</description>
 
@@ -107,7 +107,6 @@
                     <excludes>
                         <exclude>ch/puzzle/okr/models/**</exclude>
                         <exclude>ch/puzzle/okr/dto/**</exclude>
-                        <exclude>ch/puzzle/okr/mapper/**</exclude>
                         <exclude>ch/puzzle/okr/OkrApplication.*</exclude>
                         <exclude>ch/puzzle/okr/Constants.java</exclude>
                         <exclude>ch/puzzle/okr/ErrorKey.java</exclude>
@@ -252,6 +251,8 @@
             <id>build-for-docker</id>
             <properties>
                 <maven.test.skip>true</maven.test.skip>
+                <maven.test.skip>true</maven.test.skip>
+                <maven.formatter.skip>true</maven.formatter.skip>
                 <spring.profiles.active>prod</spring.profiles.active>
             </properties>
             <build>
diff --git a/backend/src/main/java/ch/puzzle/okr/Constants.java b/backend/src/main/java/ch/puzzle/okr/Constants.java
index 38220a0e91..dcc7bb8a03 100644
--- a/backend/src/main/java/ch/puzzle/okr/Constants.java
+++ b/backend/src/main/java/ch/puzzle/okr/Constants.java
@@ -13,8 +13,10 @@ private Constants() {
     public static final String ACTION = "Action";
     public static final String ALIGNMENT = "Alignment";
     public static final String COMPLETED = "Completed";
-    public static final String ORGANISATION = "Organisation";
     public static final String QUARTER = "Quarter";
     public static final String TEAM = "Team";
     public static final String USER = "User";
+    public static final String USER_TEAM = "UserTeam";
+
+    public static final String BACK_LOG_QUARTER_LABEL = "Backlog";
 }
diff --git a/backend/src/main/java/ch/puzzle/okr/ErrorKey.java b/backend/src/main/java/ch/puzzle/okr/ErrorKey.java
index 415a76da20..f5a67168eb 100644
--- a/backend/src/main/java/ch/puzzle/okr/ErrorKey.java
+++ b/backend/src/main/java/ch/puzzle/okr/ErrorKey.java
@@ -4,5 +4,5 @@ public enum ErrorKey {
     ATTRIBUTE_NULL, ATTRIBUTE_CHANGED, ATTRIBUTE_SET_FORBIDDEN, ATTRIBUTE_NOT_SET, ATTRIBUTE_CANNOT_CHANGE,
     ATTRIBUTE_MUST_BE_DRAFT, KEY_RESULT_CONVERSION, ALREADY_EXISTS_SAME_NAME, CONVERT_TOKEN, DATA_HAS_BEEN_UPDATED,
     MODEL_NULL, MODEL_WITH_ID_NOT_FOUND, NOT_AUTHORIZED_TO_READ, NOT_AUTHORIZED_TO_WRITE, NOT_AUTHORIZED_TO_DELETE,
-    TOKEN_NULL
+    TOKEN_NULL, TRIED_TO_DELETE_LAST_ADMIN, TRIED_TO_REMOVE_LAST_OKR_CHAMPION
 }
diff --git a/backend/src/main/java/ch/puzzle/okr/FlywayMultitenantConfig.java b/backend/src/main/java/ch/puzzle/okr/FlywayMultitenantConfig.java
new file mode 100644
index 0000000000..8ef156dd9a
--- /dev/null
+++ b/backend/src/main/java/ch/puzzle/okr/FlywayMultitenantConfig.java
@@ -0,0 +1,22 @@
+package ch.puzzle.okr;
+
+import ch.puzzle.okr.multitenancy.FlywayMultitenantMigrationInitializer;
+import org.springframework.boot.autoconfigure.flyway.FlywayMigrationStrategy;
+import org.springframework.cache.interceptor.KeyGenerator;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+
+@Configuration
+public class FlywayMultitenantConfig {
+
+    @Bean
+    public FlywayMigrationStrategy cleanMigrateStrategy(FlywayMultitenantMigrationInitializer flywayMigration) {
+        return flyway -> flywayMigration.migrateFlyway();
+    }
+
+    @Bean("customKeyGenerator")
+    public KeyGenerator keyGenerator() {
+        return new UserKeyGenerator();
+    }
+
+}
\ No newline at end of file
diff --git a/backend/src/main/java/ch/puzzle/okr/OkrApplication.java b/backend/src/main/java/ch/puzzle/okr/OkrApplication.java
index c718c0f533..830bac19ad 100644
--- a/backend/src/main/java/ch/puzzle/okr/OkrApplication.java
+++ b/backend/src/main/java/ch/puzzle/okr/OkrApplication.java
@@ -1,16 +1,16 @@
 package ch.puzzle.okr;
 
-import ch.puzzle.okr.service.clientconfig.ClientCustomizationProperties;
-import org.springframework.boot.SpringApplication;
 import org.springframework.boot.autoconfigure.SpringBootApplication;
-import org.springframework.boot.context.properties.EnableConfigurationProperties;
+import org.springframework.boot.builder.SpringApplicationBuilder;
 import org.springframework.scheduling.annotation.EnableScheduling;
 
 @SpringBootApplication
 @EnableScheduling
-@EnableConfigurationProperties(ClientCustomizationProperties.class)
 public class OkrApplication {
     public static void main(String[] args) {
-        SpringApplication.run(OkrApplication.class, args);
+
+        new SpringApplicationBuilder(OkrApplication.class) //
+                .initializers(new OkrApplicationContextInitializer()) //
+                .run(args);
     }
 }
diff --git a/backend/src/main/java/ch/puzzle/okr/OkrApplicationContextInitializer.java b/backend/src/main/java/ch/puzzle/okr/OkrApplicationContextInitializer.java
new file mode 100644
index 0000000000..285adea577
--- /dev/null
+++ b/backend/src/main/java/ch/puzzle/okr/OkrApplicationContextInitializer.java
@@ -0,0 +1,21 @@
+package ch.puzzle.okr;
+
+import ch.puzzle.okr.multitenancy.HibernateContext;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.context.ApplicationContextInitializer;
+import org.springframework.context.ConfigurableApplicationContext;
+import org.springframework.context.annotation.Configuration;
+
+@Configuration
+public class OkrApplicationContextInitializer implements ApplicationContextInitializer<ConfigurableApplicationContext> {
+
+    private static final Logger logger = LoggerFactory.getLogger(OkrApplicationContextInitializer.class);
+
+    @Override
+    public void initialize(ConfigurableApplicationContext applicationContext) {
+        logger.info("Loading hibernate configuration from application properties");
+        HibernateContext.extractAndSetHibernateConfig(applicationContext.getEnvironment());
+    }
+
+}
\ No newline at end of file
diff --git a/backend/src/main/java/ch/puzzle/okr/SecurityConfig.java b/backend/src/main/java/ch/puzzle/okr/SecurityConfig.java
index 7bd87b4c2f..051f3309f0 100644
--- a/backend/src/main/java/ch/puzzle/okr/SecurityConfig.java
+++ b/backend/src/main/java/ch/puzzle/okr/SecurityConfig.java
@@ -1,20 +1,41 @@
 package ch.puzzle.okr;
 
+import com.nimbusds.jose.proc.SecurityContext;
+import com.nimbusds.jwt.proc.ConfigurableJWTProcessor;
+import com.nimbusds.jwt.proc.DefaultJWTProcessor;
+import com.nimbusds.jwt.proc.JWTClaimsSetAwareJWSKeySelector;
+import com.nimbusds.jwt.proc.JWTProcessor;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
+import org.springframework.beans.factory.annotation.Value;
+import org.springframework.context.ApplicationEventPublisher;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
 import org.springframework.core.annotation.Order;
 import org.springframework.http.HttpStatus;
+import org.springframework.security.authentication.AuthenticationEventPublisher;
+import org.springframework.security.authentication.DefaultAuthenticationEventPublisher;
 import org.springframework.security.config.Customizer;
 import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
 import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
 import org.springframework.security.config.annotation.web.configurers.HeadersConfigurer;
+import org.springframework.security.oauth2.core.DelegatingOAuth2TokenValidator;
+import org.springframework.security.oauth2.core.OAuth2TokenValidator;
+import org.springframework.security.oauth2.jwt.Jwt;
+import org.springframework.security.oauth2.jwt.JwtDecoder;
+import org.springframework.security.oauth2.jwt.JwtValidators;
+import org.springframework.security.oauth2.jwt.NimbusJwtDecoder;
 import org.springframework.security.web.SecurityFilterChain;
 import org.springframework.security.web.authentication.HttpStatusEntryPoint;
 import org.springframework.security.web.authentication.www.BasicAuthenticationFilter;
-import org.springframework.security.web.header.writers.*;
+import org.springframework.security.web.header.writers.CrossOriginOpenerPolicyHeaderWriter;
+import org.springframework.security.web.header.writers.CrossOriginResourcePolicyHeaderWriter;
+import org.springframework.security.web.header.writers.StaticHeadersWriter;
+
+import static org.springframework.security.web.header.writers.CrossOriginEmbedderPolicyHeaderWriter.CrossOriginEmbedderPolicy.REQUIRE_CORP;
+import static org.springframework.security.web.header.writers.ReferrerPolicyHeaderWriter.ReferrerPolicy.NO_REFERRER;
+import static org.springframework.security.web.header.writers.XXssProtectionHeaderWriter.HeaderValue.ENABLED_MODE_BLOCK;
 
 @Configuration
 @EnableWebSecurity
@@ -22,9 +43,17 @@
 public class SecurityConfig {
     private static final Logger logger = LoggerFactory.getLogger(SecurityConfig.class);
 
+    private static final CrossOriginOpenerPolicyHeaderWriter.CrossOriginOpenerPolicy OPENER_SAME_ORIGIN = CrossOriginOpenerPolicyHeaderWriter.CrossOriginOpenerPolicy.SAME_ORIGIN;
+    private static final CrossOriginResourcePolicyHeaderWriter.CrossOriginResourcePolicy RESOURCE_SAME_ORIGIN = CrossOriginResourcePolicyHeaderWriter.CrossOriginResourcePolicy.SAME_ORIGIN;
+
+    private String connectSrc;
+
     @Bean
     @Order(1) // Must be First order! Otherwise unauthorized Requests are sent to Controllers
-    public SecurityFilterChain apiSecurityFilterChain(HttpSecurity http) throws Exception {
+    public SecurityFilterChain apiSecurityFilterChain(HttpSecurity http, @Value("${connect.src}") String connectSrc)
+            throws Exception {
+
+        this.connectSrc = connectSrc;
         setHeaders(http);
         http.addFilterAfter(new ForwardFilter(), BasicAuthenticationFilter.class);
         logger.debug("*** apiSecurityFilterChain reached");
@@ -41,32 +70,64 @@ public SecurityFilterChain securityHeadersFilter(HttpSecurity http) throws Excep
         return setHeaders(http).build();
     }
 
+    @Bean
+    JWTProcessor<SecurityContext> jwtProcessor(JWTClaimsSetAwareJWSKeySelector<SecurityContext> keySelector) {
+        ConfigurableJWTProcessor<SecurityContext> jwtProcessor = new DefaultJWTProcessor<>();
+        jwtProcessor.setJWTClaimsSetAwareJWSKeySelector(keySelector);
+        return jwtProcessor;
+    }
+
+    @Bean
+    JwtDecoder jwtDecoder(JWTProcessor<SecurityContext> jwtProcessor, OAuth2TokenValidator<Jwt> jwtValidator) {
+        NimbusJwtDecoder decoder = new NimbusJwtDecoder(jwtProcessor);
+        OAuth2TokenValidator<Jwt> validator = new DelegatingOAuth2TokenValidator<>(JwtValidators.createDefault(),
+                jwtValidator);
+        decoder.setJwtValidator(validator);
+        return decoder;
+    }
+
     private HttpSecurity setHeaders(HttpSecurity http) throws Exception {
-        http.headers(h -> h
-                .contentSecurityPolicy(e -> e.policyDirectives("default-src 'self';"
-                        + "script-src 'self' 'unsafe-inline';" + "        style-src 'self' 'unsafe-inline';"
-                        + "        object-src 'none';" + "        base-uri 'self';"
-                        + "        connect-src 'self' https://sso.puzzle.ch http://localhost:8544;"
-                        + "        font-src 'self';" + "        frame-src 'self';" + "        img-src 'self' data: ;"
-                        + "        manifest-src 'self';" + "        media-src 'self';" + "        worker-src 'none';"))
-                .crossOriginEmbedderPolicy(coepCustomizer -> coepCustomizer
-                        .policy(CrossOriginEmbedderPolicyHeaderWriter.CrossOriginEmbedderPolicy.REQUIRE_CORP))
-                .crossOriginOpenerPolicy(coopCustomizer -> coopCustomizer
-                        .policy(CrossOriginOpenerPolicyHeaderWriter.CrossOriginOpenerPolicy.SAME_ORIGIN))
-                .crossOriginResourcePolicy(corpCustomizer -> corpCustomizer
-                        .policy(CrossOriginResourcePolicyHeaderWriter.CrossOriginResourcePolicy.SAME_ORIGIN))
-                .addHeaderWriter(new StaticHeadersWriter("X-Permitted-Cross-Domain-Policies", "none")));
-        return http.headers(headers -> headers.frameOptions(HeadersConfigurer.FrameOptionsConfig::deny)
-                .xssProtection(e -> e.headerValue(XXssProtectionHeaderWriter.HeaderValue.ENABLED_MODE_BLOCK))
-                .httpStrictTransportSecurity(e -> e.includeSubDomains(true).maxAgeInSeconds(31536000))
-                .referrerPolicy(referrer -> referrer.policy(ReferrerPolicyHeaderWriter.ReferrerPolicy.NO_REFERRER))
-                .permissionsPolicy(
-                        permissions -> permissions.policy("accelerometer=(), ambient-light-sensor=(), autoplay=(), "
-                                + "battery=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(), encrypted-media=(), "
-                                + "execution-while-not-rendered=(), execution-while-out-of-viewport=(), fullscreen=(),"
-                                + " geolocation=(), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), "
-                                + "midi=(), navigation-override=(), payment=(), picture-in-picture=(),"
-                                + " publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(self), "
-                                + "usb=(), web-share=(), xr-spatial-tracking=()")));
+        return http.headers(headers -> headers
+                .contentSecurityPolicy(c -> c.policyDirectives(okrContentSecurityPolicy()))
+                .crossOriginEmbedderPolicy(c -> c.policy(REQUIRE_CORP))
+                .crossOriginOpenerPolicy(c -> c.policy(OPENER_SAME_ORIGIN))
+                .crossOriginResourcePolicy(c -> c.policy(RESOURCE_SAME_ORIGIN))
+                .addHeaderWriter(new StaticHeadersWriter("X-Permitted-Cross-Domain-Policies", "none"))
+                .frameOptions(HeadersConfigurer.FrameOptionsConfig::deny)
+                .xssProtection(c -> c.headerValue(ENABLED_MODE_BLOCK))
+                .httpStrictTransportSecurity(c -> c.includeSubDomains(true).maxAgeInSeconds(31536000))
+                .referrerPolicy(c -> c.policy(NO_REFERRER)).permissionsPolicy(c -> c.policy(okrPermissionPolicy())));
+    }
+
+    private String okrContentSecurityPolicy() {
+        return "default-src 'self';" //
+                + "script-src 'self' 'unsafe-inline';" //
+                + "        style-src 'self' 'unsafe-inline';" //
+                + "        object-src 'none';" //
+                + "        base-uri 'self';" //
+                + "        connect-src 'self' " + connectSrc + ";" //
+                + "        font-src 'self';" //
+                + "        frame-src 'self';" //
+                + "        img-src 'self' data: ;" //
+                + "        manifest-src 'self';" //
+                + "        media-src 'self';" //
+                + "        worker-src 'none';"; //
+    }
+
+    private String okrPermissionPolicy() {
+        return "accelerometer=(), ambient-light-sensor=(), autoplay=(), "
+                + "battery=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(), encrypted-media=(), "
+                + "execution-while-not-rendered=(), execution-while-out-of-viewport=(), fullscreen=(),"
+                + " geolocation=(), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), "
+                + "midi=(), navigation-override=(), payment=(), picture-in-picture=(),"
+                + " publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(self), "
+                + "usb=(), web-share=(), xr-spatial-tracking=()";
     }
+
+    @Bean
+    public AuthenticationEventPublisher authenticationEventPublisher(
+            ApplicationEventPublisher applicationEventPublisher) {
+        return new DefaultAuthenticationEventPublisher(applicationEventPublisher);
+    }
+
 }
\ No newline at end of file
diff --git a/backend/src/main/java/ch/puzzle/okr/SpringCachingConfig.java b/backend/src/main/java/ch/puzzle/okr/SpringCachingConfig.java
index d5a9d50418..62bae32213 100644
--- a/backend/src/main/java/ch/puzzle/okr/SpringCachingConfig.java
+++ b/backend/src/main/java/ch/puzzle/okr/SpringCachingConfig.java
@@ -1,5 +1,7 @@
 package ch.puzzle.okr;
 
+import ch.puzzle.okr.models.User;
+import ch.puzzle.okr.multitenancy.TenantContext;
 import org.springframework.cache.CacheManager;
 import org.springframework.cache.annotation.EnableCaching;
 import org.springframework.cache.concurrent.ConcurrentMapCacheManager;
@@ -11,10 +13,13 @@
 public class SpringCachingConfig {
 
     public static final String AUTHORIZATION_USER_CACHE = "authorizationUsers";
-    public static final String USER_CACHE = "users";
 
     @Bean
     public CacheManager cacheManager() {
-        return new ConcurrentMapCacheManager(AUTHORIZATION_USER_CACHE, USER_CACHE);
+        return new ConcurrentMapCacheManager(AUTHORIZATION_USER_CACHE);
+    }
+
+    public static String cacheKey(User user) {
+        return TenantContext.getCurrentTenant() + "_" + user.getEmail();
     }
 }
\ No newline at end of file
diff --git a/backend/src/main/java/ch/puzzle/okr/UserKeyGenerator.java b/backend/src/main/java/ch/puzzle/okr/UserKeyGenerator.java
new file mode 100644
index 0000000000..144a056e30
--- /dev/null
+++ b/backend/src/main/java/ch/puzzle/okr/UserKeyGenerator.java
@@ -0,0 +1,16 @@
+package ch.puzzle.okr;
+
+import ch.puzzle.okr.models.User;
+import ch.puzzle.okr.multitenancy.TenantContext;
+import org.springframework.cache.interceptor.KeyGenerator;
+
+import java.lang.reflect.Method;
+import java.text.MessageFormat;
+
+public class UserKeyGenerator implements KeyGenerator {
+    @Override
+    public Object generate(Object target, Method method, Object... params) {
+        User user = (User) params[0];
+        return MessageFormat.format("{0}{1}{2}", TenantContext.getCurrentTenant(), user.getEmail(), user.getId());
+    }
+}
\ No newline at end of file
diff --git a/backend/src/main/java/ch/puzzle/okr/controller/CacheController.java b/backend/src/main/java/ch/puzzle/okr/controller/CacheController.java
index 4afc3cfb66..ee46548003 100644
--- a/backend/src/main/java/ch/puzzle/okr/controller/CacheController.java
+++ b/backend/src/main/java/ch/puzzle/okr/controller/CacheController.java
@@ -24,13 +24,6 @@ public void emptyAuthorizationUsersCache() {
         cacheService.emptyAuthorizationUsersCache();
     }
 
-    @Operation(summary = "Delete users cache", description = "Delete users cache")
-    @ApiResponses(value = { @ApiResponse(responseCode = "200", description = "Users cache deleted") })
-    @PostMapping("emptyUsersCache")
-    public void emptyUsersCache() {
-        cacheService.emptyUsersCache();
-    }
-
     @Operation(summary = "Delete all caches", description = "Delete all caches")
     @ApiResponses(value = { @ApiResponse(responseCode = "200", description = "All caches deleted") })
     @PostMapping("emptyAllCaches")
diff --git a/backend/src/main/java/ch/puzzle/okr/controller/ClientConfigController.java b/backend/src/main/java/ch/puzzle/okr/controller/ClientConfigController.java
index e784aaf236..ec45e2f782 100644
--- a/backend/src/main/java/ch/puzzle/okr/controller/ClientConfigController.java
+++ b/backend/src/main/java/ch/puzzle/okr/controller/ClientConfigController.java
@@ -1,15 +1,13 @@
 package ch.puzzle.okr.controller;
 
-import ch.puzzle.okr.ForwardFilter;
 import ch.puzzle.okr.dto.ClientConfigDto;
 import ch.puzzle.okr.service.clientconfig.ClientConfigService;
 import jakarta.servlet.http.HttpServletRequest;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
 import org.springframework.http.HttpStatus;
 import org.springframework.http.ResponseEntity;
 import org.springframework.stereotype.Controller;
-import org.springframework.web.bind.annotation.*;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.RequestMapping;
 
 @Controller
 public class ClientConfigController {
@@ -21,8 +19,9 @@ public ClientConfigController(ClientConfigService configService) {
     }
 
     @GetMapping("/config")
-    public ResponseEntity<ClientConfigDto> getConfig() {
-        return ResponseEntity.status(HttpStatus.OK).body(configService.getConfigBasedOnActiveEnv());
+    public ResponseEntity<ClientConfigDto> getConfig(HttpServletRequest request) {
+        return ResponseEntity.status(HttpStatus.OK)
+                .body(configService.getConfigBasedOnActiveEnv(request.getServerName()));
     }
 
     @RequestMapping(value = "/**/{[path:[^\\.]*}")
diff --git a/backend/src/main/java/ch/puzzle/okr/controller/OrganisationController.java b/backend/src/main/java/ch/puzzle/okr/controller/OrganisationController.java
deleted file mode 100644
index b35a897261..0000000000
--- a/backend/src/main/java/ch/puzzle/okr/controller/OrganisationController.java
+++ /dev/null
@@ -1,50 +0,0 @@
-package ch.puzzle.okr.controller;
-
-import ch.puzzle.okr.dto.OrganisationDto;
-import ch.puzzle.okr.mapper.OrganisationMapper;
-import ch.puzzle.okr.service.authorization.OrganisationAuthorizationService;
-import io.swagger.v3.oas.annotations.Operation;
-import io.swagger.v3.oas.annotations.media.Content;
-import io.swagger.v3.oas.annotations.media.Schema;
-import io.swagger.v3.oas.annotations.responses.ApiResponse;
-import io.swagger.v3.oas.annotations.responses.ApiResponses;
-import org.springframework.http.HttpStatus;
-import org.springframework.http.ResponseEntity;
-import org.springframework.web.bind.annotation.*;
-
-import java.util.List;
-
-@RestController
-@RequestMapping("api/v1/organisations")
-public class OrganisationController {
-    private final OrganisationAuthorizationService organisationAuthorizationService;
-    private final OrganisationMapper organisationMapper;
-
-    public OrganisationController(OrganisationAuthorizationService organisationAuthorizationService,
-            OrganisationMapper organisationMapper) {
-        this.organisationAuthorizationService = organisationAuthorizationService;
-        this.organisationMapper = organisationMapper;
-    }
-
-    @Operation(summary = "Get all active Organisations", description = "Get all active Organisations")
-    @ApiResponses(value = {
-            @ApiResponse(responseCode = "200", description = "Returned all active Organisations", content = {
-                    @Content(mediaType = "application/json", schema = @Schema(implementation = OrganisationDto.class)) }),
-            @ApiResponse(responseCode = "401", description = "Not authorized to read organisations", content = @Content) })
-    @GetMapping
-    public ResponseEntity<List<OrganisationDto>> getActiveOrganisations() {
-        return ResponseEntity.status(HttpStatus.OK).body(
-                organisationAuthorizationService.getEntities().stream().map(this.organisationMapper::toDto).toList());
-    }
-
-    @Operation(summary = "Get Organisations of team", description = "Get all Organisations of team")
-    @ApiResponses(value = {
-            @ApiResponse(responseCode = "200", description = "Returned all Organisations of team", content = {
-                    @Content(mediaType = "application/json", schema = @Schema(implementation = OrganisationDto.class)) }),
-            @ApiResponse(responseCode = "401", description = "Not authorized to read organisations of team", content = @Content) })
-    @GetMapping("/{id}")
-    public ResponseEntity<List<OrganisationDto>> getOrganisationsByTeam(@PathVariable Long id) {
-        return ResponseEntity.status(HttpStatus.OK).body(organisationAuthorizationService.getEntitiesByTeam(id).stream()
-                .map(this.organisationMapper::toDto).toList());
-    }
-}
diff --git a/backend/src/main/java/ch/puzzle/okr/controller/OverviewController.java b/backend/src/main/java/ch/puzzle/okr/controller/OverviewController.java
index 9f8f8449bd..ff8dfe009d 100644
--- a/backend/src/main/java/ch/puzzle/okr/controller/OverviewController.java
+++ b/backend/src/main/java/ch/puzzle/okr/controller/OverviewController.java
@@ -1,8 +1,6 @@
 package ch.puzzle.okr.controller;
 
-import ch.puzzle.okr.dto.overview.DashboardDto;
 import ch.puzzle.okr.dto.overview.OverviewDto;
-import ch.puzzle.okr.mapper.DashboardMapper;
 import ch.puzzle.okr.mapper.OverviewMapper;
 import ch.puzzle.okr.service.authorization.OverviewAuthorizationService;
 import io.swagger.v3.oas.annotations.Operation;
@@ -23,14 +21,12 @@
 @RequestMapping("api/v2/overview")
 public class OverviewController {
     private final OverviewMapper overviewMapper;
-    private final DashboardMapper dashboardMapper;
     private final OverviewAuthorizationService overviewAuthorizationService;
 
-    public OverviewController(OverviewMapper overviewMapper, OverviewAuthorizationService overviewAuthorizationService,
-            DashboardMapper dashboardMapper) {
+    public OverviewController(OverviewMapper overviewMapper,
+            OverviewAuthorizationService overviewAuthorizationService) {
         this.overviewMapper = overviewMapper;
         this.overviewAuthorizationService = overviewAuthorizationService;
-        this.dashboardMapper = dashboardMapper;
     }
 
     @Operation(summary = "Get all teams and their objectives", description = "Get a List of teams with their objectives")
@@ -41,14 +37,11 @@ public OverviewController(OverviewMapper overviewMapper, OverviewAuthorizationSe
             @ApiResponse(responseCode = "401", description = "Not authorized to read teams with their objectives", content = @Content),
             @ApiResponse(responseCode = "404", description = "The quarter or one of the teams were not found", content = @Content) })
     @GetMapping("")
-    public ResponseEntity<DashboardDto> getOverview(
+    public ResponseEntity<List<OverviewDto>> getOverview(
             @RequestParam(required = false, defaultValue = "", name = "team") List<Long> teamFilter,
             @RequestParam(required = false, defaultValue = "", name = "quarter") Long quarterFilter,
             @RequestParam(required = false, defaultValue = "", name = "objectiveQuery") String objectiveQuery) {
-        boolean hasWriteAllAccess = overviewAuthorizationService.hasWriteAllAccess();
-        return ResponseEntity.status(HttpStatus.OK)
-                .body(dashboardMapper.toDto(overviewMapper.toDto(
-                        overviewAuthorizationService.getFilteredOverview(quarterFilter, teamFilter, objectiveQuery)),
-                        hasWriteAllAccess));
+        return ResponseEntity.status(HttpStatus.OK).body(overviewMapper
+                .toDto(overviewAuthorizationService.getFilteredOverview(quarterFilter, teamFilter, objectiveQuery)));
     }
 }
diff --git a/backend/src/main/java/ch/puzzle/okr/controller/TeamController.java b/backend/src/main/java/ch/puzzle/okr/controller/TeamController.java
index 9d14cb427b..ccaad22741 100644
--- a/backend/src/main/java/ch/puzzle/okr/controller/TeamController.java
+++ b/backend/src/main/java/ch/puzzle/okr/controller/TeamController.java
@@ -1,6 +1,7 @@
 package ch.puzzle.okr.controller;
 
 import ch.puzzle.okr.dto.TeamDto;
+import ch.puzzle.okr.dto.UserDto;
 import ch.puzzle.okr.mapper.TeamMapper;
 import ch.puzzle.okr.models.Team;
 import ch.puzzle.okr.service.authorization.TeamAuthorizationService;
@@ -34,9 +35,7 @@ public TeamController(TeamAuthorizationService teamAuthorizationService, TeamMap
             @Content(mediaType = "application/json", schema = @Schema(implementation = TeamDto.class)) }), })
     @GetMapping
     public List<TeamDto> getAllTeams() {
-        List<Long> userTeamIds = teamAuthorizationService.getUserTeamIds();
-        return teamAuthorizationService.getAllTeams().stream().map(team -> teamMapper.toDto(team, userTeamIds))
-                .toList();
+        return teamAuthorizationService.getAllTeams().stream().map(teamMapper::toDto).toList();
     }
 
     @Operation(summary = "Create Team", description = "Create a new Team")
@@ -49,7 +48,7 @@ public List<TeamDto> getAllTeams() {
     public ResponseEntity<TeamDto> createTeam(
             @io.swagger.v3.oas.annotations.parameters.RequestBody(description = "The Team as json to create a new Team.", required = true) @RequestBody TeamDto teamDto) {
         Team createdTeam = teamAuthorizationService.createEntity(teamMapper.toTeam(teamDto));
-        return ResponseEntity.status(HttpStatus.CREATED).body(teamMapper.toDto(createdTeam, List.of()));
+        return ResponseEntity.status(HttpStatus.CREATED).body(teamMapper.toDto(createdTeam));
     }
 
     @Operation(summary = "Update Team", description = "Update a Team by ID.")
@@ -64,7 +63,7 @@ public ResponseEntity<TeamDto> updateTeam(
             @Parameter(description = "The ID for updating a Team.", required = true) @PathVariable long id,
             @RequestBody TeamDto teamDto) {
         Team updatedTeam = teamAuthorizationService.updateEntity(teamMapper.toTeam(teamDto), id);
-        return ResponseEntity.status(OK).body(teamMapper.toDto(updatedTeam, List.of()));
+        return ResponseEntity.status(OK).body(teamMapper.toDto(updatedTeam));
     }
 
     @Operation(summary = "Delete Team by ID", description = "Delete Team by ID")
@@ -76,4 +75,40 @@ public void deleteTeamById(
             @Parameter(description = "The ID of an Team to delete it.", required = true) @PathVariable long id) {
         teamAuthorizationService.deleteEntity(id);
     }
+
+    @Operation(summary = "Add users to a team", description = "Add users to a team")
+    @ApiResponses(value = { @ApiResponse(responseCode = "200", description = "Added users to team"),
+            @ApiResponse(responseCode = "401", description = "Not authorized to add users to the team", content = @Content),
+            @ApiResponse(responseCode = "404", description = "Did not find the Team with requested ID") })
+    @PutMapping("/{id}/addusers")
+    public void addUsersToTeam(
+            @Parameter(description = "The ID of an Team to add to users to it.", required = true) @PathVariable long id,
+            @RequestBody List<UserDto> userDtoList) {
+        var userIds = userDtoList.stream().map(UserDto::id).toList();
+        teamAuthorizationService.addUsersToTeam(id, userIds);
+    }
+
+    @Operation(summary = "Remove User from Team", description = "Remove User with given UserID from Team")
+    @ApiResponses(value = { @ApiResponse(responseCode = "200", description = "Removed User from Team"),
+            @ApiResponse(responseCode = "401", description = "Not authorized to remove user from team", content = @Content),
+            @ApiResponse(responseCode = "404", description = "Did not find the Team with requested ID") })
+    @PutMapping("/{id}/user/{userId}/removeuser")
+    public void removeUserFromTeam(
+            @Parameter(description = "The ID of an team to remove the user from it.", required = true) @PathVariable long id,
+            @Parameter(description = "The User ID to remove from the team.", required = true) @PathVariable long userId) {
+        teamAuthorizationService.removeUserFromTeam(id, userId);
+    }
+
+    @Operation(summary = "Update or add team membership", description = "If user is already member of this team, isAdmin is set. otherwise new team membership "
+            + "is added with isAdmin true or false")
+    @ApiResponses(value = { @ApiResponse(responseCode = "200", description = "Update or add team membership"),
+            @ApiResponse(responseCode = "401", description = "Not authorized to update or add team membership", content = @Content),
+            @ApiResponse(responseCode = "404", description = "Did not find the Team with requested ID") })
+    @PutMapping("/{id}/user/{userId}/updateaddteammembership/{isAdmin}")
+    public void updateOrAddTeamMembership(
+            @Parameter(description = "The ID of an team to update or add membership", required = true) @PathVariable long id,
+            @Parameter(description = "The User ID to update or add membership", required = true) @PathVariable long userId,
+            @Parameter(description = "The parameter if user should be admin or not", required = true) @PathVariable boolean isAdmin) {
+        teamAuthorizationService.updateOrAddTeamMembership(id, userId, isAdmin);
+    }
 }
diff --git a/backend/src/main/java/ch/puzzle/okr/controller/UserController.java b/backend/src/main/java/ch/puzzle/okr/controller/UserController.java
index 2a45432e3c..bc6d772a9a 100644
--- a/backend/src/main/java/ch/puzzle/okr/controller/UserController.java
+++ b/backend/src/main/java/ch/puzzle/okr/controller/UserController.java
@@ -1,14 +1,21 @@
 package ch.puzzle.okr.controller;
 
+import ch.puzzle.okr.dto.NewUserDto;
 import ch.puzzle.okr.dto.UserDto;
 import ch.puzzle.okr.mapper.UserMapper;
+import ch.puzzle.okr.service.authorization.AuthorizationService;
 import ch.puzzle.okr.service.authorization.UserAuthorizationService;
 import io.swagger.v3.oas.annotations.Operation;
+import io.swagger.v3.oas.annotations.Parameter;
 import io.swagger.v3.oas.annotations.media.Content;
 import io.swagger.v3.oas.annotations.media.Schema;
 import io.swagger.v3.oas.annotations.responses.ApiResponse;
 import io.swagger.v3.oas.annotations.responses.ApiResponses;
 import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.PathVariable;
+import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.PutMapping;
+import org.springframework.web.bind.annotation.RequestBody;
 import org.springframework.web.bind.annotation.RequestMapping;
 import org.springframework.web.bind.annotation.RestController;
 
@@ -19,10 +26,13 @@
 public class UserController {
 
     private final UserAuthorizationService userAuthorizationService;
+    private final AuthorizationService authorizationService;
     private final UserMapper userMapper;
 
-    public UserController(UserAuthorizationService userAuthorizationService, UserMapper userMapper) {
+    public UserController(UserAuthorizationService userAuthorizationService, AuthorizationService authorizationService,
+            UserMapper userMapper) {
         this.userAuthorizationService = userAuthorizationService;
+        this.authorizationService = authorizationService;
         this.userMapper = userMapper;
     }
 
@@ -34,4 +44,45 @@ public List<UserDto> getAllUsers() {
         return userAuthorizationService.getAllUsers().stream().map(userMapper::toDto).toList();
     }
 
+    @Operation(summary = "Get Current User", description = "Get all current logged in user.")
+    @ApiResponses(value = {
+            @ApiResponse(responseCode = "200", description = "Returned current logged in user.", content = {
+                    @Content(mediaType = "application/json", schema = @Schema(implementation = UserDto.class)) }), })
+    @GetMapping(path = "/current")
+    public UserDto getCurrentUser() {
+        var currentUser = this.authorizationService.updateOrAddAuthorizationUser().user();
+        return userMapper.toDto(currentUser);
+    }
+
+    @Operation(summary = "Get User by ID", description = "Get user by given ID.")
+    @ApiResponses(value = { @ApiResponse(responseCode = "200", description = "Returned user", content = {
+            @Content(mediaType = "application/json", schema = @Schema(implementation = UserDto.class)) }), })
+    @GetMapping(path = "/{id}")
+    public UserDto getUserById(
+            @Parameter(description = "The ID for requested user.", required = true) @PathVariable long id) {
+        var user = this.userAuthorizationService.getById(id);
+        return userMapper.toDto(user);
+    }
+
+    @Operation(summary = "Set OKR Champion property for user", description = "Sets the property okrChampion of user to true or false")
+    @ApiResponses(value = { @ApiResponse(responseCode = "200", description = "Returned user", content = {
+            @Content(mediaType = "application/json", schema = @Schema(implementation = UserDto.class)) }), })
+    @PutMapping(path = "/{id}/isokrchampion/{isOkrChampion}")
+    public UserDto setOkrChampion(
+            @Parameter(description = "The ID for requested user.", required = true) @PathVariable long id,
+            @Parameter(description = "okrChampion property of user is set to this flag.", required = true) @PathVariable boolean isOkrChampion) {
+        var user = this.userAuthorizationService.setIsOkrChampion(id, isOkrChampion);
+        return userMapper.toDto(user);
+    }
+
+    @Operation(summary = "Create users", description = "Creates a user entity for every user in the method body")
+    @ApiResponses(value = { @ApiResponse(responseCode = "200", description = "Returned users", content = {
+            @Content(mediaType = "application/json", schema = @Schema(implementation = UserDto.class)) }), })
+    @PostMapping(path = "/createall")
+    public List<UserDto> createUsers(
+            @io.swagger.v3.oas.annotations.parameters.RequestBody(description = "The users to create", required = true) @RequestBody List<NewUserDto> newUserDtoList) {
+        var createdUsers = this.userAuthorizationService.createUsers(userMapper.toUserList(newUserDtoList));
+        return userMapper.toDtos(createdUsers);
+    }
+
 }
diff --git a/backend/src/main/java/ch/puzzle/okr/converter/JwtConverterFactory.java b/backend/src/main/java/ch/puzzle/okr/converter/JwtConverterFactory.java
deleted file mode 100644
index 3fa7136ca7..0000000000
--- a/backend/src/main/java/ch/puzzle/okr/converter/JwtConverterFactory.java
+++ /dev/null
@@ -1,37 +0,0 @@
-package ch.puzzle.okr.converter;
-
-import ch.puzzle.okr.models.User;
-import org.springframework.context.ApplicationContext;
-import org.springframework.core.convert.converter.Converter;
-import org.springframework.security.oauth2.jwt.Jwt;
-import org.springframework.stereotype.Component;
-
-import java.util.List;
-
-@Component
-public class JwtConverterFactory {
-
-    private final ApplicationContext appContext;
-    private Converter<Jwt, List<String>> jwtOrganisationConverter;
-    private Converter<Jwt, User> jwtUserConverter;
-
-    public JwtConverterFactory(ApplicationContext appContext) {
-        this.appContext = appContext;
-    }
-
-    public synchronized Converter<Jwt, List<String>> getJwtOrganisationConverter() {
-        if (jwtOrganisationConverter == null) {
-            // place to load configured converter instead of default converter
-            jwtOrganisationConverter = appContext.getBean(JwtOrganisationConverter.class);
-        }
-        return jwtOrganisationConverter;
-    }
-
-    public synchronized Converter<Jwt, User> getJwtUserConverter() {
-        if (jwtUserConverter == null) {
-            // place to load configured converter instead of default converter
-            jwtUserConverter = appContext.getBean(JwtUserConverter.class);
-        }
-        return jwtUserConverter;
-    }
-}
diff --git a/backend/src/main/java/ch/puzzle/okr/converter/JwtOrganisationConverter.java b/backend/src/main/java/ch/puzzle/okr/converter/JwtOrganisationConverter.java
deleted file mode 100644
index 4ef9d275f8..0000000000
--- a/backend/src/main/java/ch/puzzle/okr/converter/JwtOrganisationConverter.java
+++ /dev/null
@@ -1,40 +0,0 @@
-package ch.puzzle.okr.converter;
-
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-import org.springframework.beans.factory.annotation.Value;
-import org.springframework.core.convert.converter.Converter;
-import org.springframework.security.oauth2.jwt.Jwt;
-import org.springframework.stereotype.Component;
-import org.springframework.util.CollectionUtils;
-
-import java.util.Collection;
-import java.util.List;
-import java.util.Map;
-
-@Component
-public class JwtOrganisationConverter implements Converter<Jwt, List<String>> {
-
-    private static final Logger logger = LoggerFactory.getLogger(JwtOrganisationConverter.class);
-
-    @Value("${okr.jwt.claim.realm}")
-    private String claimRealm;
-    @Value("${okr.jwt.claim.organisations}")
-    private String claimOrganisations;
-    @Value("${okr.jwt.claim.organisation.name.prefix}")
-    private String organisationNamePrefix;
-
-    @Override
-    public List<String> convert(Jwt token) {
-        Map<String, Collection<String>> realmAccess = token.getClaim(claimRealm);
-        logger.debug("realmAccess {}", realmAccess);
-        if (!CollectionUtils.isEmpty(realmAccess)) {
-            Collection<String> organisations = realmAccess.get(claimOrganisations);
-            if (!CollectionUtils.isEmpty(organisations)) {
-                return organisations.stream().filter(o -> o.startsWith(organisationNamePrefix)).toList();
-            }
-        }
-        logger.warn("empty list of realms or organisations {}", realmAccess);
-        return List.of();
-    }
-}
diff --git a/backend/src/main/java/ch/puzzle/okr/converter/JwtUserConverter.java b/backend/src/main/java/ch/puzzle/okr/converter/JwtUserConverter.java
deleted file mode 100644
index 056b320758..0000000000
--- a/backend/src/main/java/ch/puzzle/okr/converter/JwtUserConverter.java
+++ /dev/null
@@ -1,46 +0,0 @@
-package ch.puzzle.okr.converter;
-
-import ch.puzzle.okr.ErrorKey;
-import ch.puzzle.okr.exception.OkrResponseStatusException;
-import ch.puzzle.okr.models.User;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-import org.springframework.beans.factory.annotation.Value;
-import org.springframework.core.convert.converter.Converter;
-import org.springframework.security.oauth2.jwt.Jwt;
-import org.springframework.stereotype.Component;
-
-import java.util.Map;
-
-import static ch.puzzle.okr.Constants.USER;
-import static org.springframework.http.HttpStatus.BAD_REQUEST;
-
-@Component
-public class JwtUserConverter implements Converter<Jwt, User> {
-
-    private static final Logger logger = LoggerFactory.getLogger(JwtUserConverter.class);
-
-    @Value("${okr.jwt.user.username}")
-    private String username;
-    @Value("${okr.jwt.user.firstname}")
-    private String firstname;
-    @Value("${okr.jwt.user.lastname}")
-    private String lastname;
-    @Value("${okr.jwt.user.email}")
-    private String email;
-
-    @Override
-    public User convert(Jwt token) {
-        Map<String, Object> claims = token.getClaims();
-        logger.debug("claims {}", claims);
-
-        try {
-            return User.Builder.builder().withUsername(claims.get(username).toString())
-                    .withFirstname(claims.get(firstname).toString()).withLastname(claims.get(lastname).toString())
-                    .withEmail(claims.get(email).toString()).build();
-        } catch (Exception e) {
-            logger.warn("can not convert user from claims {}", claims);
-            throw new OkrResponseStatusException(BAD_REQUEST, ErrorKey.CONVERT_TOKEN, USER);
-        }
-    }
-}
diff --git a/backend/src/main/java/ch/puzzle/okr/dto/ClientConfigDto.java b/backend/src/main/java/ch/puzzle/okr/dto/ClientConfigDto.java
index 876be7aa0f..702a4de5c4 100644
--- a/backend/src/main/java/ch/puzzle/okr/dto/ClientConfigDto.java
+++ b/backend/src/main/java/ch/puzzle/okr/dto/ClientConfigDto.java
@@ -1,7 +1,7 @@
 package ch.puzzle.okr.dto;
 
-import java.util.HashMap;
+import java.util.Map;
 
 public record ClientConfigDto(String activeProfile, String issuer, String clientId, String favicon, String logo,
-        String title, HashMap<String, String> customStyles) {
+        String triangles, String backgroundLogo, String title, Map<String, String> customStyles) {
 }
diff --git a/backend/src/main/java/ch/puzzle/okr/dto/NewUserDto.java b/backend/src/main/java/ch/puzzle/okr/dto/NewUserDto.java
new file mode 100644
index 0000000000..5874453023
--- /dev/null
+++ b/backend/src/main/java/ch/puzzle/okr/dto/NewUserDto.java
@@ -0,0 +1,4 @@
+package ch.puzzle.okr.dto;
+
+public record NewUserDto(String firstname, String lastname, String email) {
+}
diff --git a/backend/src/main/java/ch/puzzle/okr/dto/OrganisationDto.java b/backend/src/main/java/ch/puzzle/okr/dto/OrganisationDto.java
deleted file mode 100644
index 58a7a41974..0000000000
--- a/backend/src/main/java/ch/puzzle/okr/dto/OrganisationDto.java
+++ /dev/null
@@ -1,6 +0,0 @@
-package ch.puzzle.okr.dto;
-
-import ch.puzzle.okr.models.OrganisationState;
-
-public record OrganisationDto(Long id, int version, String orgName, OrganisationState state) {
-}
diff --git a/backend/src/main/java/ch/puzzle/okr/dto/TeamDto.java b/backend/src/main/java/ch/puzzle/okr/dto/TeamDto.java
index 7b72652ced..1f980d4662 100644
--- a/backend/src/main/java/ch/puzzle/okr/dto/TeamDto.java
+++ b/backend/src/main/java/ch/puzzle/okr/dto/TeamDto.java
@@ -1,6 +1,4 @@
 package ch.puzzle.okr.dto;
 
-import java.util.List;
-
-public record TeamDto(Long id, int version, String name, List<OrganisationDto> organisations, boolean filterIsActive) {
+public record TeamDto(Long id, int version, String name, boolean writeable) {
 }
diff --git a/backend/src/main/java/ch/puzzle/okr/dto/UserDto.java b/backend/src/main/java/ch/puzzle/okr/dto/UserDto.java
index 3d25fc02eb..119a7554cd 100644
--- a/backend/src/main/java/ch/puzzle/okr/dto/UserDto.java
+++ b/backend/src/main/java/ch/puzzle/okr/dto/UserDto.java
@@ -1,5 +1,7 @@
 package ch.puzzle.okr.dto;
 
-public record UserDto(Long id, int version, String username, String firstname, String lastname, String email,
-        boolean isWriteable) {
+import java.util.List;
+
+public record UserDto(Long id, int version, String firstname, String lastname, String email,
+        List<UserTeamDto> userTeamList, boolean isOkrChampion) {
 }
diff --git a/backend/src/main/java/ch/puzzle/okr/dto/UserTeamDto.java b/backend/src/main/java/ch/puzzle/okr/dto/UserTeamDto.java
new file mode 100644
index 0000000000..cab26f8fc2
--- /dev/null
+++ b/backend/src/main/java/ch/puzzle/okr/dto/UserTeamDto.java
@@ -0,0 +1,4 @@
+package ch.puzzle.okr.dto;
+
+public record UserTeamDto(Long id, int version, TeamDto team, boolean isTeamAdmin) {
+}
diff --git a/backend/src/main/java/ch/puzzle/okr/dto/overview/OverviewDto.java b/backend/src/main/java/ch/puzzle/okr/dto/overview/OverviewDto.java
index f1f941b12d..fe22794e63 100644
--- a/backend/src/main/java/ch/puzzle/okr/dto/overview/OverviewDto.java
+++ b/backend/src/main/java/ch/puzzle/okr/dto/overview/OverviewDto.java
@@ -2,5 +2,5 @@
 
 import java.util.List;
 
-public record OverviewDto(OverviewTeamDto team, List<OverviewObjectiveDto> objectives) {
+public record OverviewDto(OverviewTeamDto team, List<OverviewObjectiveDto> objectives, boolean writeable) {
 }
diff --git a/backend/src/main/java/ch/puzzle/okr/dto/overview/OverviewTeamDto.java b/backend/src/main/java/ch/puzzle/okr/dto/overview/OverviewTeamDto.java
index 4a1b7f65cb..bc222491ff 100644
--- a/backend/src/main/java/ch/puzzle/okr/dto/overview/OverviewTeamDto.java
+++ b/backend/src/main/java/ch/puzzle/okr/dto/overview/OverviewTeamDto.java
@@ -1,4 +1,4 @@
 package ch.puzzle.okr.dto.overview;
 
-public record OverviewTeamDto(Long id, int version, String name, boolean writable, boolean hasInActiveOrganisations) {
+public record OverviewTeamDto(Long id, String name) {
 }
diff --git a/backend/src/main/java/ch/puzzle/okr/exception/ConnectionProviderException.java b/backend/src/main/java/ch/puzzle/okr/exception/ConnectionProviderException.java
new file mode 100644
index 0000000000..043a1ff300
--- /dev/null
+++ b/backend/src/main/java/ch/puzzle/okr/exception/ConnectionProviderException.java
@@ -0,0 +1,7 @@
+package ch.puzzle.okr.exception;
+
+public class ConnectionProviderException extends RuntimeException {
+    public ConnectionProviderException(String message) {
+        super(message);
+    }
+}
diff --git a/backend/src/main/java/ch/puzzle/okr/mapper/DashboardMapper.java b/backend/src/main/java/ch/puzzle/okr/mapper/DashboardMapper.java
deleted file mode 100644
index 7f1a14f6af..0000000000
--- a/backend/src/main/java/ch/puzzle/okr/mapper/DashboardMapper.java
+++ /dev/null
@@ -1,15 +0,0 @@
-package ch.puzzle.okr.mapper;
-
-import ch.puzzle.okr.dto.overview.DashboardDto;
-import ch.puzzle.okr.dto.overview.OverviewDto;
-import org.springframework.stereotype.Component;
-
-import java.util.List;
-
-@Component
-public class DashboardMapper {
-
-    public DashboardDto toDto(List<OverviewDto> overviews, Boolean adminAccess) {
-        return new DashboardDto(adminAccess, overviews);
-    }
-}
diff --git a/backend/src/main/java/ch/puzzle/okr/mapper/OrganisationMapper.java b/backend/src/main/java/ch/puzzle/okr/mapper/OrganisationMapper.java
deleted file mode 100644
index 284d628444..0000000000
--- a/backend/src/main/java/ch/puzzle/okr/mapper/OrganisationMapper.java
+++ /dev/null
@@ -1,19 +0,0 @@
-package ch.puzzle.okr.mapper;
-
-import ch.puzzle.okr.dto.OrganisationDto;
-import ch.puzzle.okr.models.Organisation;
-import org.springframework.stereotype.Component;
-
-@Component
-public class OrganisationMapper {
-
-    public OrganisationDto toDto(Organisation organisation) {
-        return new OrganisationDto(organisation.getId(), organisation.getVersion(), organisation.getOrgName(),
-                organisation.getState());
-    }
-
-    public Organisation toOrganisation(OrganisationDto organisationDto) {
-        return Organisation.Builder.builder().withId(organisationDto.id()).withVersion(organisationDto.version())
-                .withOrgName(organisationDto.orgName()).withState(organisationDto.state()).build();
-    }
-}
diff --git a/backend/src/main/java/ch/puzzle/okr/mapper/OverviewMapper.java b/backend/src/main/java/ch/puzzle/okr/mapper/OverviewMapper.java
index b778776bb4..2051b17b89 100644
--- a/backend/src/main/java/ch/puzzle/okr/mapper/OverviewMapper.java
+++ b/backend/src/main/java/ch/puzzle/okr/mapper/OverviewMapper.java
@@ -4,7 +4,6 @@
 import ch.puzzle.okr.dto.overview.*;
 import ch.puzzle.okr.exception.OkrResponseStatusException;
 import ch.puzzle.okr.models.overview.Overview;
-import ch.puzzle.okr.service.business.OrganisationBusinessService;
 import org.springframework.stereotype.Component;
 
 import java.util.ArrayList;
@@ -18,10 +17,7 @@
 
 @Component
 public class OverviewMapper {
-    private final OrganisationBusinessService organisationBusinessService;
-
-    public OverviewMapper(OrganisationBusinessService organisationBusinessService) {
-        this.organisationBusinessService = organisationBusinessService;
+    public OverviewMapper() {
     }
 
     public List<OverviewDto> toDto(List<Overview> overviews) {
@@ -67,11 +63,8 @@ private OverviewDto createOverviewDto(Overview overview) {
         if (isValidId(overview.getOverviewId().getObjectiveId())) {
             objectives.add(createObjectiveDto(overview));
         }
-        return new OverviewDto(
-                new OverviewTeamDto(overview.getOverviewId().getTeamId(), overview.getTeamVersion(),
-                        overview.getTeamName(), overview.isWriteable(),
-                        organisationBusinessService.teamHasInActiveOrganisations(overview.getOverviewId().getTeamId())),
-                objectives);
+        return new OverviewDto(new OverviewTeamDto(overview.getOverviewId().getTeamId(), overview.getTeamName()),
+                objectives, overview.isWriteable());
     }
 
     private OverviewObjectiveDto createObjectiveDto(Overview overview) {
diff --git a/backend/src/main/java/ch/puzzle/okr/mapper/TeamMapper.java b/backend/src/main/java/ch/puzzle/okr/mapper/TeamMapper.java
index 7b04acc674..792bc027e6 100644
--- a/backend/src/main/java/ch/puzzle/okr/mapper/TeamMapper.java
+++ b/backend/src/main/java/ch/puzzle/okr/mapper/TeamMapper.java
@@ -1,34 +1,21 @@
 package ch.puzzle.okr.mapper;
 
-import ch.puzzle.okr.dto.OrganisationDto;
 import ch.puzzle.okr.dto.TeamDto;
-import ch.puzzle.okr.models.Organisation;
 import ch.puzzle.okr.models.Team;
-import ch.puzzle.okr.service.business.TeamBusinessService;
 import org.springframework.stereotype.Component;
 
-import java.util.List;
-
 @Component
 public class TeamMapper {
 
-    private final OrganisationMapper organisationMapper;
-
-    public TeamMapper(OrganisationMapper organisationMapper) {
-        this.organisationMapper = organisationMapper;
+    public TeamMapper() {
     }
 
-    public TeamDto toDto(Team team, List<Long> userTeamIds) {
-        List<OrganisationDto> organisationDTOs = team.getAuthorizationOrganisation().stream()
-                .map(organisationMapper::toDto).toList();
-        boolean filterIsActive = userTeamIds.contains(team.getId());
-        return new TeamDto(team.getId(), team.getVersion(), team.getName(), organisationDTOs, filterIsActive);
+    public TeamDto toDto(Team team) {
+        return new TeamDto(team.getId(), team.getVersion(), team.getName(), team.isWriteable());
     }
 
     public Team toTeam(TeamDto teamDto) {
-        List<Organisation> organisations = teamDto.organisations().stream().map(organisationMapper::toOrganisation)
-                .toList();
         return Team.Builder.builder().withId(teamDto.id()).withVersion(teamDto.version()).withName(teamDto.name())
-                .withAuthorizationOrganisation(organisations).build();
+                .build();
     }
 }
diff --git a/backend/src/main/java/ch/puzzle/okr/mapper/UserMapper.java b/backend/src/main/java/ch/puzzle/okr/mapper/UserMapper.java
index b35e2b6a36..8d2f3c1892 100644
--- a/backend/src/main/java/ch/puzzle/okr/mapper/UserMapper.java
+++ b/backend/src/main/java/ch/puzzle/okr/mapper/UserMapper.java
@@ -1,13 +1,45 @@
 package ch.puzzle.okr.mapper;
 
+import ch.puzzle.okr.dto.NewUserDto;
 import ch.puzzle.okr.dto.UserDto;
+import ch.puzzle.okr.dto.UserTeamDto;
 import ch.puzzle.okr.models.User;
 import org.springframework.stereotype.Component;
 
+import java.util.List;
+import java.util.stream.Collectors;
+
 @Component
 public class UserMapper {
+
+    private final TeamMapper teamMapper;
+
+    public UserMapper(TeamMapper teamMapper) {
+        this.teamMapper = teamMapper;
+    }
+
+    public List<UserDto> toDtos(List<User> userList) {
+        return userList.stream().map(this::toDto).toList();
+    }
+
     public UserDto toDto(User user) {
-        return new UserDto(user.getId(), user.getVersion(), user.getUsername(), user.getFirstname(), user.getLastname(),
-                user.getEmail(), user.isWriteable());
+        var userTeams = user.getUserTeamList().stream().map(
+                ut -> new UserTeamDto(ut.getId(), user.getVersion(), teamMapper.toDto(ut.getTeam()), ut.isTeamAdmin()))
+                .collect(Collectors.toList());
+
+        return new UserDto(user.getId(), user.getVersion(), user.getFirstname(), user.getLastname(), user.getEmail(),
+                userTeams, user.isOkrChampion());
+    }
+
+    public List<User> toUserList(List<NewUserDto> newUserList) {
+        return newUserList.stream().map(this::toUser).toList();
+    }
+
+    public User toUser(NewUserDto newUserDto) {
+        var user = new User();
+        user.setFirstname(newUserDto.firstname());
+        user.setLastname(newUserDto.lastname());
+        user.setEmail(newUserDto.email());
+        return user;
     }
 }
diff --git a/backend/src/main/java/ch/puzzle/okr/mapper/checkin/CheckInMetricMapper.java b/backend/src/main/java/ch/puzzle/okr/mapper/checkin/CheckInMetricMapper.java
index 6be967682b..814adc85f2 100644
--- a/backend/src/main/java/ch/puzzle/okr/mapper/checkin/CheckInMetricMapper.java
+++ b/backend/src/main/java/ch/puzzle/okr/mapper/checkin/CheckInMetricMapper.java
@@ -15,16 +15,29 @@ public CheckInMetricMapper(KeyResultBusinessService keyResultBusinessService) {
     }
 
     public CheckInMetricDto toDto(CheckInMetric checkInMetric) {
-        return new CheckInMetricDto(checkInMetric.getId(), checkInMetric.getVersion(), checkInMetric.getChangeInfo(),
-                checkInMetric.getInitiatives(), checkInMetric.getConfidence(), checkInMetric.getKeyResult().getId(),
-                checkInMetric.getCreatedOn(), checkInMetric.getModifiedOn(), checkInMetric.getValue(),
+        return new CheckInMetricDto(checkInMetric.getId(), //
+                checkInMetric.getVersion(), //
+                checkInMetric.getChangeInfo(), //
+                checkInMetric.getInitiatives(), //
+                checkInMetric.getConfidence(), //
+                checkInMetric.getKeyResult().getId(), //
+                checkInMetric.getCreatedOn(), //
+                checkInMetric.getModifiedOn(), //
+                checkInMetric.getValue(), //
                 checkInMetric.isWriteable());
     }
 
     public CheckIn toCheckInMetric(CheckInMetricDto checkInMetricDto) {
-        return CheckInMetric.Builder.builder().withValue(checkInMetricDto.value()).withId(checkInMetricDto.id())
-                .withVersion(checkInMetricDto.version()).withChangeInfo(checkInMetricDto.changeInfo())
-                .withInitiatives(checkInMetricDto.initiatives()).withConfidence(checkInMetricDto.confidence())
-                .withKeyResult(keyResultBusinessService.getEntityById(checkInMetricDto.keyResultId())).build();
+        return CheckInMetric.Builder.builder() //
+                .withValue(checkInMetricDto.value()) //
+                .withId(checkInMetricDto.id()) //
+                .withVersion(checkInMetricDto.version()) //
+                .withChangeInfo(checkInMetricDto.changeInfo()) //
+                .withInitiatives(checkInMetricDto.initiatives()) //
+                .withConfidence(checkInMetricDto.confidence()) //
+                .withCreatedOn(checkInMetricDto.createdOn()) //
+                .withModifiedOn(checkInMetricDto.modifiedOn()) //
+                .withKeyResult(keyResultBusinessService.getEntityById(checkInMetricDto.keyResultId())) //
+                .build();
     }
 }
diff --git a/backend/src/main/java/ch/puzzle/okr/mapper/checkin/CheckInOrdinalMapper.java b/backend/src/main/java/ch/puzzle/okr/mapper/checkin/CheckInOrdinalMapper.java
index d468e59c2b..f64b9c81c4 100644
--- a/backend/src/main/java/ch/puzzle/okr/mapper/checkin/CheckInOrdinalMapper.java
+++ b/backend/src/main/java/ch/puzzle/okr/mapper/checkin/CheckInOrdinalMapper.java
@@ -15,16 +15,28 @@ public CheckInOrdinalMapper(KeyResultBusinessService keyResultBusinessService) {
     }
 
     public CheckInOrdinalDto toDto(CheckInOrdinal checkInOrdinal) {
-        return new CheckInOrdinalDto(checkInOrdinal.getId(), checkInOrdinal.getVersion(),
-                checkInOrdinal.getChangeInfo(), checkInOrdinal.getInitiatives(), checkInOrdinal.getConfidence(),
-                checkInOrdinal.getKeyResult().getId(), checkInOrdinal.getCreatedOn(), checkInOrdinal.getModifiedOn(),
-                checkInOrdinal.getZone(), checkInOrdinal.isWriteable());
+        return new CheckInOrdinalDto(checkInOrdinal.getId(), checkInOrdinal.getVersion(), //
+                checkInOrdinal.getChangeInfo(), //
+                checkInOrdinal.getInitiatives(), //
+                checkInOrdinal.getConfidence(), //
+                checkInOrdinal.getKeyResult().getId(), //
+                checkInOrdinal.getCreatedOn(), //
+                checkInOrdinal.getModifiedOn(), //
+                checkInOrdinal.getZone(), //
+                checkInOrdinal.isWriteable());
     }
 
     public CheckIn toCheckInOrdinal(CheckInOrdinalDto checkInOrdinalDto) {
-        return CheckInOrdinal.Builder.builder().withZone(checkInOrdinalDto.value()).withId(checkInOrdinalDto.id())
-                .withVersion(checkInOrdinalDto.version()).withChangeInfo(checkInOrdinalDto.changeInfo())
-                .withInitiatives(checkInOrdinalDto.initiatives()).withConfidence(checkInOrdinalDto.confidence())
-                .withKeyResult(keyResultBusinessService.getEntityById(checkInOrdinalDto.keyResultId())).build();
+        return CheckInOrdinal.Builder.builder() //
+                .withZone(checkInOrdinalDto.value()) //
+                .withId(checkInOrdinalDto.id()) //
+                .withVersion(checkInOrdinalDto.version()) //
+                .withChangeInfo(checkInOrdinalDto.changeInfo()) //
+                .withInitiatives(checkInOrdinalDto.initiatives()) //
+                .withConfidence(checkInOrdinalDto.confidence()) //
+                .withCreatedOn(checkInOrdinalDto.createdOn()) //
+                .withModifiedOn(checkInOrdinalDto.modifiedOn()) //
+                .withKeyResult(keyResultBusinessService.getEntityById(checkInOrdinalDto.keyResultId())) //
+                .build();
     }
 }
diff --git a/backend/src/main/java/ch/puzzle/okr/mapper/keyresult/KeyResultMapper.java b/backend/src/main/java/ch/puzzle/okr/mapper/keyresult/KeyResultMapper.java
index fc79118fa0..9078dbd04d 100644
--- a/backend/src/main/java/ch/puzzle/okr/mapper/keyresult/KeyResultMapper.java
+++ b/backend/src/main/java/ch/puzzle/okr/mapper/keyresult/KeyResultMapper.java
@@ -27,9 +27,9 @@ public KeyResultMapper(KeyResultOrdinalMapper keyResultOrdinalMapper, KeyResultM
 
     public KeyResultDto toDto(KeyResult keyResult, List<Action> actionList) {
         if (keyResult instanceof KeyResultMetric keyResultMetric) {
-            return keyResultMetricMapper.toKeyResultMetricDto(keyResultMetric, actionList);
+            return keyResultMetricMapper.toDto(keyResultMetric, actionList);
         } else if (keyResult instanceof KeyResultOrdinal keyResultOrdinal) {
-            return keyResultOrdinalMapper.toKeyResultOrdinalDto(keyResultOrdinal, actionList);
+            return keyResultOrdinalMapper.toDto(keyResultOrdinal, actionList);
         } else {
             throw new ResponseStatusException(BAD_REQUEST,
                     String.format("The KeyResult %s can't be converted to a metric or ordinal KeyResult", keyResult));
diff --git a/backend/src/main/java/ch/puzzle/okr/mapper/keyresult/KeyResultMetricMapper.java b/backend/src/main/java/ch/puzzle/okr/mapper/keyresult/KeyResultMetricMapper.java
index bc8bdd8fe9..e285304f06 100644
--- a/backend/src/main/java/ch/puzzle/okr/mapper/keyresult/KeyResultMetricMapper.java
+++ b/backend/src/main/java/ch/puzzle/okr/mapper/keyresult/KeyResultMetricMapper.java
@@ -31,43 +31,65 @@ public KeyResultMetricMapper(UserBusinessService userBusinessService,
         this.actionMapper = actionMapper;
     }
 
-    public KeyResultDto toKeyResultMetricDto(KeyResultMetric keyResult, List<Action> actionList) {
-        KeyResultUserDto ownerDto = new KeyResultUserDto(keyResult.getOwner().getId(),
-                keyResult.getOwner().getFirstname(), keyResult.getOwner().getLastname());
-        KeyResultQuarterDto quarterDto = new KeyResultQuarterDto(keyResult.getObjective().getQuarter().getId(),
-                keyResult.getObjective().getQuarter().getLabel(), keyResult.getObjective().getQuarter().getStartDate(),
+    public KeyResultDto toDto(KeyResultMetric keyResult, List<Action> actionList) {
+        KeyResultUserDto ownerDto = new KeyResultUserDto( //
+                keyResult.getOwner().getId(), //
+                keyResult.getOwner().getFirstname(), //
+                keyResult.getOwner().getLastname());
+
+        KeyResultQuarterDto quarterDto = new KeyResultQuarterDto( //
+                keyResult.getObjective().getQuarter().getId(), //
+                keyResult.getObjective().getQuarter().getLabel(), //
+                keyResult.getObjective().getQuarter().getStartDate(), //
                 keyResult.getObjective().getQuarter().getEndDate());
-        KeyResultObjectiveDto objectiveDto = new KeyResultObjectiveDto(keyResult.getObjective().getId(),
-                keyResult.getObjective().getState().toString(), quarterDto);
+
+        KeyResultObjectiveDto objectiveDto = new KeyResultObjectiveDto( //
+                keyResult.getObjective().getId(), //
+                keyResult.getObjective().getState().toString(), //
+                quarterDto);
+
         KeyResultLastCheckInMetricDto lastCheckInDto = getLastCheckInDto(keyResult.getId());
 
-        return new KeyResultMetricDto(keyResult.getId(), keyResult.getVersion(), keyResult.getKeyResultType(),
-                keyResult.getTitle(), keyResult.getDescription(), keyResult.getBaseline(), keyResult.getStretchGoal(),
-                keyResult.getUnit(), ownerDto, objectiveDto, lastCheckInDto, keyResult.getCreatedOn(),
-                keyResult.getModifiedOn(), keyResult.isWriteable(),
+        return new KeyResultMetricDto( //
+                keyResult.getId(), //
+                keyResult.getVersion(), //
+                keyResult.getKeyResultType(), //
+                keyResult.getTitle(), //
+                keyResult.getDescription(), //
+                keyResult.getBaseline(), //
+                keyResult.getStretchGoal(), //
+                keyResult.getUnit(), //
+                ownerDto, objectiveDto, //
+                lastCheckInDto, //
+                keyResult.getCreatedOn(), //
+                keyResult.getModifiedOn(), //
+                keyResult.isWriteable(), //
                 actionList.stream().map(actionMapper::toDto).toList());
     }
 
     public KeyResult toKeyResultMetric(KeyResultMetricDto keyResultMetricDto) {
-        return KeyResultMetric.Builder.builder().withBaseline(keyResultMetricDto.baseline())
-                .withStretchGoal(keyResultMetricDto.stretchGoal()).withUnit(keyResultMetricDto.unit())
-                .withId(keyResultMetricDto.id()).withVersion(keyResultMetricDto.version())
-                .withObjective(objectiveBusinessService.getEntityById(keyResultMetricDto.objective().id()))
-                .withTitle(keyResultMetricDto.title()).withDescription(keyResultMetricDto.description())
-                .withOwner(userBusinessService.getOwnerById(keyResultMetricDto.owner().id()))
-                .withModifiedOn(keyResultMetricDto.modifiedOn()).build();
+        return KeyResultMetric.Builder.builder() //
+                .withBaseline(keyResultMetricDto.baseline()) //
+                .withStretchGoal(keyResultMetricDto.stretchGoal()) //
+                .withUnit(keyResultMetricDto.unit()) //
+                .withId(keyResultMetricDto.id()) //
+                .withVersion(keyResultMetricDto.version()) //
+                .withObjective(objectiveBusinessService.getEntityById(keyResultMetricDto.objective().id())) //
+                .withTitle(keyResultMetricDto.title()) //
+                .withDescription(keyResultMetricDto.description()) //
+                .withOwner(userBusinessService.getUserById(keyResultMetricDto.owner().id())) //
+                .withCreatedOn(keyResultMetricDto.createdOn()) //
+                .withModifiedOn(keyResultMetricDto.modifiedOn()) //
+                .build();
     }
 
     public KeyResultLastCheckInMetricDto getLastCheckInDto(Long keyResultId) {
         CheckIn lastCheckIn = checkInBusinessService.getLastCheckInByKeyResultId(keyResultId);
-        KeyResultLastCheckInMetricDto lastCheckInDto;
         if (lastCheckIn == null) {
-            lastCheckInDto = null;
-        } else {
-            lastCheckInDto = new KeyResultLastCheckInMetricDto(lastCheckIn.getId(), lastCheckIn.getVersion(),
-                    ((CheckInMetric) lastCheckIn).getValue(), lastCheckIn.getConfidence(), lastCheckIn.getCreatedOn(),
-                    lastCheckIn.getChangeInfo(), lastCheckIn.getInitiatives());
+            return null;
         }
-        return lastCheckInDto;
+        return new KeyResultLastCheckInMetricDto(lastCheckIn.getId(), lastCheckIn.getVersion(),
+                ((CheckInMetric) lastCheckIn).getValue(), lastCheckIn.getConfidence(), lastCheckIn.getCreatedOn(),
+                lastCheckIn.getChangeInfo(), lastCheckIn.getInitiatives());
     }
 }
diff --git a/backend/src/main/java/ch/puzzle/okr/mapper/keyresult/KeyResultOrdinalMapper.java b/backend/src/main/java/ch/puzzle/okr/mapper/keyresult/KeyResultOrdinalMapper.java
index e28407185a..e62c93b482 100644
--- a/backend/src/main/java/ch/puzzle/okr/mapper/keyresult/KeyResultOrdinalMapper.java
+++ b/backend/src/main/java/ch/puzzle/okr/mapper/keyresult/KeyResultOrdinalMapper.java
@@ -31,43 +31,66 @@ public KeyResultOrdinalMapper(UserBusinessService userBusinessService,
         this.actionMapper = actionMapper;
     }
 
-    public KeyResultDto toKeyResultOrdinalDto(KeyResultOrdinal keyResult, List<Action> actionList) {
-        KeyResultUserDto ownerDto = new KeyResultUserDto(keyResult.getOwner().getId(),
-                keyResult.getOwner().getFirstname(), keyResult.getOwner().getLastname());
-        KeyResultQuarterDto quarterDto = new KeyResultQuarterDto(keyResult.getObjective().getQuarter().getId(),
-                keyResult.getObjective().getQuarter().getLabel(), keyResult.getObjective().getQuarter().getStartDate(),
+    public KeyResultDto toDto(KeyResultOrdinal keyResult, List<Action> actionList) {
+        KeyResultUserDto ownerDto = new KeyResultUserDto( //
+                keyResult.getOwner().getId(), //
+                keyResult.getOwner().getFirstname(), //
+                keyResult.getOwner().getLastname());
+
+        KeyResultQuarterDto quarterDto = new KeyResultQuarterDto( //
+                keyResult.getObjective().getQuarter().getId(), //
+                keyResult.getObjective().getQuarter().getLabel(), //
+                keyResult.getObjective().getQuarter().getStartDate(), //
                 keyResult.getObjective().getQuarter().getEndDate());
-        KeyResultObjectiveDto objectiveDto = new KeyResultObjectiveDto(keyResult.getObjective().getId(),
-                keyResult.getObjective().getState().toString(), quarterDto);
+
+        KeyResultObjectiveDto objectiveDto = new KeyResultObjectiveDto( //
+                keyResult.getObjective().getId(), //
+                keyResult.getObjective().getState().toString(), //
+                quarterDto);
+
         KeyResultLastCheckInOrdinalDto lastCheckInDto = getLastCheckInDto(keyResult.getId());
 
-        return new KeyResultOrdinalDto(keyResult.getId(), keyResult.getVersion(), keyResult.getKeyResultType(),
-                keyResult.getTitle(), keyResult.getDescription(), keyResult.getCommitZone(), keyResult.getTargetZone(),
-                keyResult.getStretchZone(), ownerDto, objectiveDto, lastCheckInDto, keyResult.getCreatedOn(),
-                keyResult.getModifiedOn(), keyResult.isWriteable(),
+        return new KeyResultOrdinalDto( //
+                keyResult.getId(), //
+                keyResult.getVersion(), //
+                keyResult.getKeyResultType(), //
+                keyResult.getTitle(), //
+                keyResult.getDescription(), //
+                keyResult.getCommitZone(), //
+                keyResult.getTargetZone(), //
+                keyResult.getStretchZone(), //
+                ownerDto, //
+                objectiveDto, //
+                lastCheckInDto, //
+                keyResult.getCreatedOn(), //
+                keyResult.getModifiedOn(), //
+                keyResult.isWriteable(), //
                 actionList.stream().map(actionMapper::toDto).toList());
     }
 
     public KeyResult toKeyResultOrdinal(KeyResultOrdinalDto keyResultOrdinalDto) {
-        return KeyResultOrdinal.Builder.builder().withCommitZone(keyResultOrdinalDto.commitZone())
-                .withTargetZone(keyResultOrdinalDto.targetZone()).withStretchZone(keyResultOrdinalDto.stretchZone())
-                .withId(keyResultOrdinalDto.id()).withVersion(keyResultOrdinalDto.version())
-                .withObjective(objectiveBusinessService.getEntityById(keyResultOrdinalDto.objective().id()))
-                .withTitle(keyResultOrdinalDto.title()).withDescription(keyResultOrdinalDto.description())
-                .withOwner(userBusinessService.getOwnerById(keyResultOrdinalDto.owner().id()))
-                .withModifiedOn(keyResultOrdinalDto.modifiedOn()).build();
+        return KeyResultOrdinal.Builder.builder() //
+                .withCommitZone(keyResultOrdinalDto.commitZone()) //
+                .withTargetZone(keyResultOrdinalDto.targetZone()) //
+                .withStretchZone(keyResultOrdinalDto.stretchZone()) //
+                .withId(keyResultOrdinalDto.id()) //
+                .withVersion(keyResultOrdinalDto.version()) //
+                .withObjective(objectiveBusinessService.getEntityById(keyResultOrdinalDto.objective().id())) //
+                .withTitle(keyResultOrdinalDto.title()) //
+                .withDescription(keyResultOrdinalDto.description()) //
+                .withOwner(userBusinessService.getUserById(keyResultOrdinalDto.owner().id())) //
+                .withCreatedOn(keyResultOrdinalDto.createdOn()) //
+                .withModifiedOn(keyResultOrdinalDto.modifiedOn()) //
+                .build();
     }
 
     public KeyResultLastCheckInOrdinalDto getLastCheckInDto(Long keyResultId) {
         CheckIn lastCheckIn = checkInBusinessService.getLastCheckInByKeyResultId(keyResultId);
-        KeyResultLastCheckInOrdinalDto lastCheckInDto;
         if (lastCheckIn == null) {
-            lastCheckInDto = null;
-        } else {
-            lastCheckInDto = new KeyResultLastCheckInOrdinalDto(lastCheckIn.getId(), lastCheckIn.getVersion(),
-                    ((CheckInOrdinal) lastCheckIn).getZone(), lastCheckIn.getConfidence(), lastCheckIn.getCreatedOn(),
-                    lastCheckIn.getChangeInfo(), lastCheckIn.getInitiatives());
+            return null;
         }
-        return lastCheckInDto;
+        return new KeyResultLastCheckInOrdinalDto(lastCheckIn.getId(), lastCheckIn.getVersion(),
+                ((CheckInOrdinal) lastCheckIn).getZone(), lastCheckIn.getConfidence(), lastCheckIn.getCreatedOn(),
+                lastCheckIn.getChangeInfo(), lastCheckIn.getInitiatives());
     }
 }
diff --git a/backend/src/main/java/ch/puzzle/okr/mapper/role/DefaultRoleMapper.java b/backend/src/main/java/ch/puzzle/okr/mapper/role/DefaultRoleMapper.java
deleted file mode 100644
index 64d567f68a..0000000000
--- a/backend/src/main/java/ch/puzzle/okr/mapper/role/DefaultRoleMapper.java
+++ /dev/null
@@ -1,52 +0,0 @@
-package ch.puzzle.okr.mapper.role;
-
-import ch.puzzle.okr.models.User;
-import ch.puzzle.okr.models.authorization.AuthorizationRole;
-import org.springframework.beans.factory.annotation.Value;
-import org.springframework.stereotype.Component;
-
-import java.util.ArrayList;
-import java.util.Arrays;
-import java.util.List;
-import java.util.Objects;
-
-import static ch.puzzle.okr.models.authorization.AuthorizationRole.*;
-
-@Component
-public class DefaultRoleMapper implements RoleMapper {
-    private static final String DELIMITER = ",";
-
-    @Value("${okr.organisation.name.1stLevel}")
-    private String firstLevelOrganisationName;
-    @Value("${okr.organisation.name.2ndLevel}")
-    private String secondLevelOrganisationName;
-    @Value("${okr.user.champion.usernames}")
-    private String okrChampionUsernames;
-
-    @Override
-    public List<AuthorizationRole> mapAuthorizationRoles(List<String> organisationNames, User user) {
-        List<AuthorizationRole> roles = new ArrayList<>();
-        if (hasFirstLevelOrganisationName(organisationNames) || isOkrChampion(user)) {
-            roles.addAll(List.of(READ_ALL_DRAFT, WRITE_ALL));
-        } else if (hasSecondLevelOrganisationName(organisationNames)) {
-            roles.addAll(List.of(READ_TEAMS_DRAFT, WRITE_ALL_TEAMS));
-        } else {
-            roles.addAll(List.of(READ_TEAM_DRAFT, WRITE_TEAM));
-        }
-        roles.add(READ_ALL_PUBLISHED);
-        return roles;
-    }
-
-    private boolean hasFirstLevelOrganisationName(List<String> organisationNames) {
-        return organisationNames.contains(firstLevelOrganisationName);
-    }
-
-    private boolean hasSecondLevelOrganisationName(List<String> organisationNames) {
-        return organisationNames.contains(secondLevelOrganisationName);
-    }
-
-    private boolean isOkrChampion(User user) {
-        String[] champions = okrChampionUsernames.split(DELIMITER);
-        return Arrays.stream(champions).anyMatch(c -> Objects.equals(c, user.getUsername()));
-    }
-}
diff --git a/backend/src/main/java/ch/puzzle/okr/mapper/role/RoleMapper.java b/backend/src/main/java/ch/puzzle/okr/mapper/role/RoleMapper.java
deleted file mode 100644
index 6517342c06..0000000000
--- a/backend/src/main/java/ch/puzzle/okr/mapper/role/RoleMapper.java
+++ /dev/null
@@ -1,10 +0,0 @@
-package ch.puzzle.okr.mapper.role;
-
-import ch.puzzle.okr.models.User;
-import ch.puzzle.okr.models.authorization.AuthorizationRole;
-
-import java.util.List;
-
-public interface RoleMapper {
-    List<AuthorizationRole> mapAuthorizationRoles(List<String> organisationNames, User user);
-}
diff --git a/backend/src/main/java/ch/puzzle/okr/mapper/role/RoleMapperFactory.java b/backend/src/main/java/ch/puzzle/okr/mapper/role/RoleMapperFactory.java
deleted file mode 100644
index 452b45128d..0000000000
--- a/backend/src/main/java/ch/puzzle/okr/mapper/role/RoleMapperFactory.java
+++ /dev/null
@@ -1,22 +0,0 @@
-package ch.puzzle.okr.mapper.role;
-
-import org.springframework.context.ApplicationContext;
-import org.springframework.stereotype.Component;
-
-@Component
-public class RoleMapperFactory {
-    private final ApplicationContext appContext;
-    private RoleMapper roleMapper;
-
-    public RoleMapperFactory(ApplicationContext appContext) {
-        this.appContext = appContext;
-    }
-
-    public synchronized RoleMapper getRoleMapper() {
-        if (roleMapper == null) {
-            // place to load configured role mapper instead of default role mapper
-            roleMapper = appContext.getBean(DefaultRoleMapper.class);
-        }
-        return roleMapper;
-    }
-}
diff --git a/backend/src/main/java/ch/puzzle/okr/models/Organisation.java b/backend/src/main/java/ch/puzzle/okr/models/Organisation.java
deleted file mode 100644
index 63220b9c1b..0000000000
--- a/backend/src/main/java/ch/puzzle/okr/models/Organisation.java
+++ /dev/null
@@ -1,141 +0,0 @@
-package ch.puzzle.okr.models;
-
-import jakarta.persistence.*;
-import jakarta.validation.constraints.NotBlank;
-import jakarta.validation.constraints.NotNull;
-import jakarta.validation.constraints.Size;
-
-import java.util.List;
-import java.util.Objects;
-
-@Entity
-public class Organisation {
-
-    @Id
-    @GeneratedValue(strategy = GenerationType.AUTO, generator = "sequence_organisation")
-    @SequenceGenerator(name = "sequence_organisation", allocationSize = 1)
-    private Long id;
-
-    @Version
-    private int version;
-
-    @NotNull
-    @NotBlank
-    private String orgName;
-
-    @ManyToMany(mappedBy = "authorizationOrganisation", fetch = FetchType.EAGER)
-    private List<Team> teams;
-
-    @Enumerated(EnumType.STRING)
-    @NotNull
-    private OrganisationState state;
-
-    public Organisation() {
-    }
-
-    private Organisation(Builder builder) {
-        id = builder.id;
-        version = builder.version;
-        setOrgName(builder.orgName);
-        setTeams(builder.teams);
-        setState(builder.state);
-    }
-
-    public Long getId() {
-        return id;
-    }
-
-    public int getVersion() {
-        return version;
-    }
-
-    public String getOrgName() {
-        return orgName;
-    }
-
-    public void setOrgName(String name) {
-        this.orgName = name;
-    }
-
-    public List<Team> getTeams() {
-        return teams;
-    }
-
-    public void setTeams(List<Team> teams) {
-        this.teams = teams;
-    }
-
-    public OrganisationState getState() {
-        return this.state;
-    }
-
-    public void setState(OrganisationState state) {
-        this.state = state;
-    }
-
-    @Override
-    public boolean equals(Object o) {
-        if (this == o)
-            return true;
-        if (o == null || getClass() != o.getClass())
-            return false;
-        Organisation that = (Organisation) o;
-        return Objects.equals(id, that.id) && version == that.version && Objects.equals(orgName, that.orgName);
-    }
-
-    @Override
-    public int hashCode() {
-        return Objects.hash(id, version, orgName, teams);
-    }
-
-    @Override
-    public String toString() {
-        return "Organisation{" + "id=" + id + ", version=" + version + ", orgName='" + orgName + '}';
-    }
-
-    public static final class Builder {
-        private Long id;
-        private int version;
-        private String orgName;
-
-        private List<Team> teams;
-
-        private OrganisationState state;
-
-        private Builder() {
-        }
-
-        public static Builder builder() {
-            return new Builder();
-        }
-
-        public Builder withId(Long id) {
-            this.id = id;
-            return this;
-        }
-
-        public Builder withVersion(int version) {
-            this.version = version;
-            return this;
-        }
-
-        public Builder withOrgName(String name) {
-            this.orgName = name;
-            return this;
-        }
-
-        public Builder withState(OrganisationState state) {
-            this.state = state;
-            return this;
-        }
-
-        public Builder withTeams(List<Team> teams) {
-            this.teams = teams;
-            return this;
-        }
-
-        public Organisation build() {
-            return new Organisation(this);
-        }
-    }
-}
diff --git a/backend/src/main/java/ch/puzzle/okr/models/OrganisationState.java b/backend/src/main/java/ch/puzzle/okr/models/OrganisationState.java
deleted file mode 100644
index ba6976c05a..0000000000
--- a/backend/src/main/java/ch/puzzle/okr/models/OrganisationState.java
+++ /dev/null
@@ -1,5 +0,0 @@
-package ch.puzzle.okr.models;
-
-public enum OrganisationState {
-    ACTIVE, INACTIVE
-}
diff --git a/backend/src/main/java/ch/puzzle/okr/models/Team.java b/backend/src/main/java/ch/puzzle/okr/models/Team.java
index 43526bad16..0099a9ba43 100644
--- a/backend/src/main/java/ch/puzzle/okr/models/Team.java
+++ b/backend/src/main/java/ch/puzzle/okr/models/Team.java
@@ -4,6 +4,7 @@
 import jakarta.validation.constraints.NotBlank;
 import jakarta.validation.constraints.NotNull;
 import jakarta.validation.constraints.Size;
+
 import java.util.List;
 import java.util.Objects;
 
@@ -22,9 +23,8 @@ public class Team implements WriteableInterface {
     @Version
     private int version;
 
-    @ManyToMany(fetch = FetchType.EAGER)
-    @JoinTable(name = "team_organisation", joinColumns = @JoinColumn(name = "team_id"), inverseJoinColumns = @JoinColumn(name = "organisation_id"))
-    private List<Organisation> authorizationOrganisation;
+    @OneToMany(fetch = FetchType.LAZY, mappedBy = "team", cascade = CascadeType.ALL)
+    private List<UserTeam> userTeamList;
 
     private transient boolean writeable;
 
@@ -35,7 +35,7 @@ private Team(Builder builder) {
         id = builder.id;
         version = builder.version;
         setName(builder.name);
-        setAuthorizationOrganisation(builder.authorizationOrganisation);
+        setUserTeamList(builder.userTeamList);
     }
 
     public Long getId() {
@@ -54,12 +54,12 @@ public void setName(String name) {
         this.name = name;
     }
 
-    public List<Organisation> getAuthorizationOrganisation() {
-        return authorizationOrganisation;
+    public List<UserTeam> getUserTeamList() {
+        return userTeamList;
     }
 
-    public void setAuthorizationOrganisation(List<Organisation> authorizationOrganisation) {
-        this.authorizationOrganisation = authorizationOrganisation;
+    public void setUserTeamList(List<UserTeam> userTeamList) {
+        this.userTeamList = userTeamList;
     }
 
     @Override
@@ -98,7 +98,7 @@ public static final class Builder {
         private int version;
         private String name;
 
-        private List<Organisation> authorizationOrganisation;
+        private List<UserTeam> userTeamList;
 
         private Builder() {
         }
@@ -122,8 +122,8 @@ public Builder withName(String name) {
             return this;
         }
 
-        public Builder withAuthorizationOrganisation(List<Organisation> authOrg) {
-            this.authorizationOrganisation = authOrg;
+        public Builder withUserTeamList(List<UserTeam> userTeamList) {
+            this.userTeamList = userTeamList;
             return this;
         }
 
diff --git a/backend/src/main/java/ch/puzzle/okr/models/User.java b/backend/src/main/java/ch/puzzle/okr/models/User.java
index a9195f2f61..5bfa5e425b 100644
--- a/backend/src/main/java/ch/puzzle/okr/models/User.java
+++ b/backend/src/main/java/ch/puzzle/okr/models/User.java
@@ -5,12 +5,15 @@
 import jakarta.validation.constraints.NotBlank;
 import jakarta.validation.constraints.NotNull;
 import jakarta.validation.constraints.Size;
+
+import java.util.ArrayList;
+import java.util.List;
 import java.util.Objects;
 
 @Entity
 // table cannot be named "user" since it is a reserved keyword of Postgres
 @Table(name = "person")
-public class User implements WriteableInterface {
+public class User {
     @Id
     @GeneratedValue(strategy = GenerationType.AUTO, generator = "sequence_person")
     @SequenceGenerator(name = "sequence_person", allocationSize = 1)
@@ -19,12 +22,6 @@ public class User implements WriteableInterface {
     @Version
     private int version;
 
-    @Column(unique = true)
-    @NotBlank(message = MessageKey.ATTRIBUTE_NOT_BLANK)
-    @NotNull(message = MessageKey.ATTRIBUTE_NOT_NULL)
-    @Size(min = 2, max = 20, message = MessageKey.ATTRIBUTE_SIZE_BETWEEN)
-    private String username;
-
     @NotBlank(message = MessageKey.ATTRIBUTE_NOT_BLANK)
     @NotNull(message = MessageKey.ATTRIBUTE_NOT_NULL)
     @Size(min = 2, max = 50, message = MessageKey.ATTRIBUTE_SIZE_BETWEEN)
@@ -35,13 +32,18 @@ public class User implements WriteableInterface {
     @Size(min = 2, max = 50, message = MessageKey.ATTRIBUTE_SIZE_BETWEEN)
     private String lastname;
 
+    @Column(unique = true, nullable = false)
     @Email(message = MessageKey.ATTRIBUTE_NOT_VALID)
     @NotBlank(message = MessageKey.ATTRIBUTE_NOT_BLANK)
     @NotNull(message = MessageKey.ATTRIBUTE_NOT_NULL)
     @Size(min = 2, max = 250, message = MessageKey.ATTRIBUTE_SIZE_BETWEEN)
     private String email;
 
-    private transient boolean writeable;
+    @OneToMany(fetch = FetchType.EAGER, mappedBy = "user", cascade = CascadeType.ALL)
+    private List<UserTeam> userTeamList = new ArrayList<>();
+
+    @Column(nullable = false, columnDefinition = "boolean default false")
+    private boolean isOkrChampion = false;
 
     public User() {
     }
@@ -49,10 +51,11 @@ public User() {
     private User(Builder builder) {
         id = builder.id;
         version = builder.version;
-        setUsername(builder.username);
         setFirstname(builder.firstname);
         setLastname(builder.lastname);
         setEmail(builder.email);
+        setUserTeamList(builder.userTeamList);
+        setOkrChampion(builder.isOkrChampion);
     }
 
     public Long getId() {
@@ -63,14 +66,6 @@ public int getVersion() {
         return version;
     }
 
-    public String getUsername() {
-        return username;
-    }
-
-    public void setUsername(String username) {
-        this.username = username;
-    }
-
     public String getFirstname() {
         return firstname;
     }
@@ -95,21 +90,26 @@ public void setEmail(String email) {
         this.email = email;
     }
 
-    @Override
-    public boolean isWriteable() {
-        return writeable;
+    public List<UserTeam> getUserTeamList() {
+        return userTeamList;
     }
 
-    @Override
-    public void setWriteable(boolean writeable) {
-        this.writeable = writeable;
+    public void setUserTeamList(List<UserTeam> userTeamList) {
+        this.userTeamList = userTeamList;
+    }
+
+    public boolean isOkrChampion() {
+        return isOkrChampion;
+    }
+
+    public void setOkrChampion(boolean okrChampion) {
+        isOkrChampion = okrChampion;
     }
 
     @Override
     public String toString() {
-        return "User{" + "id=" + id + ", version=" + version + ", username='" + username + '\'' + ", firstname='"
-                + firstname + '\'' + ", lastname='" + lastname + '\'' + ", email='" + email + '\'' + ", writeable="
-                + writeable + '}';
+        return "User{" + "id=" + id + ", version=" + version + ", firstname='" + firstname + '\'' + ", lastname='"
+                + lastname + '\'' + ", email='" + email + '\'' + ", isOkrChampion='" + isOkrChampion + '\'' + '}';
     }
 
     @Override
@@ -120,23 +120,23 @@ public boolean equals(Object o) {
             return false;
         User user = (User) o;
         return Objects.equals(id, user.id) && Objects.equals(version, user.version)
-                && Objects.equals(username, user.username) && Objects.equals(firstname, user.firstname)
-                && Objects.equals(lastname, user.lastname) && Objects.equals(email, user.email)
-                && Objects.equals(writeable, user.writeable);
+                && Objects.equals(firstname, user.firstname) && Objects.equals(lastname, user.lastname)
+                && Objects.equals(email, user.email) && Objects.equals(isOkrChampion, user.isOkrChampion);
     }
 
     @Override
     public int hashCode() {
-        return Objects.hash(id, version, username, firstname, lastname, email, writeable);
+        return Objects.hash(id, version, firstname, lastname, email, isOkrChampion);
     }
 
     public static final class Builder {
         private Long id;
         private int version;
-        private String username;
         private String firstname;
         private String lastname;
         private String email;
+        private List<UserTeam> userTeamList;
+        private boolean isOkrChampion;
 
         private Builder() {
         }
@@ -155,11 +155,6 @@ public Builder withVersion(int version) {
             return this;
         }
 
-        public Builder withUsername(String username) {
-            this.username = username;
-            return this;
-        }
-
         public Builder withFirstname(String firstname) {
             this.firstname = firstname;
             return this;
@@ -175,6 +170,16 @@ public Builder withEmail(String email) {
             return this;
         }
 
+        public Builder withUserTeamList(List<UserTeam> userTeamList) {
+            this.userTeamList = userTeamList;
+            return this;
+        }
+
+        public Builder withOkrChampion(boolean isOkrChampion) {
+            this.isOkrChampion = isOkrChampion;
+            return this;
+        }
+
         public User build() {
             return new User(this);
         }
diff --git a/backend/src/main/java/ch/puzzle/okr/models/UserTeam.java b/backend/src/main/java/ch/puzzle/okr/models/UserTeam.java
new file mode 100644
index 0000000000..3f14e7c811
--- /dev/null
+++ b/backend/src/main/java/ch/puzzle/okr/models/UserTeam.java
@@ -0,0 +1,146 @@
+package ch.puzzle.okr.models;
+
+import jakarta.persistence.*;
+
+import java.util.Objects;
+
+@Entity
+@Table(name = "person_team")
+public class UserTeam {
+
+    @Id
+    @GeneratedValue(strategy = GenerationType.AUTO, generator = "sequence_person_team")
+    @SequenceGenerator(name = "sequence_person_team", allocationSize = 1)
+    private Long id;
+
+    @Version
+    private int version;
+
+    @ManyToOne()
+    @JoinColumn(name = "person_id")
+    private User user;
+
+    @ManyToOne()
+    @JoinColumn(name = "team_id")
+    private Team team;
+
+    @Column(nullable = false, columnDefinition = "boolean default false")
+    private boolean isTeamAdmin = false;
+
+    private UserTeam() {
+    }
+
+    private UserTeam(Builder builder) {
+        this.id = builder.id;
+        this.version = builder.version;
+        this.user = builder.user;
+        this.team = builder.team;
+        this.isTeamAdmin = builder.isTeamAdmin;
+    }
+
+    public Long getId() {
+        return id;
+    }
+
+    public void setId(Long id) {
+        this.id = id;
+    }
+
+    public int getVersion() {
+        return version;
+    }
+
+    public void setVersion(int version) {
+        this.version = version;
+    }
+
+    public User getUser() {
+        return user;
+    }
+
+    public void setUser(User user) {
+        this.user = user;
+    }
+
+    public Team getTeam() {
+        return team;
+    }
+
+    public void setTeam(Team team) {
+        this.team = team;
+    }
+
+    public boolean isTeamAdmin() {
+        return isTeamAdmin;
+    }
+
+    public void setTeamAdmin(boolean teamAdmin) {
+        isTeamAdmin = teamAdmin;
+    }
+
+    @Override
+    public boolean equals(Object o) {
+        if (this == o) {
+            return true;
+        }
+        if (o == null || getClass() != o.getClass()) {
+            return false;
+        }
+        UserTeam userTeam = (UserTeam) o;
+        return version == userTeam.version && isTeamAdmin == userTeam.isTeamAdmin && Objects.equals(id, userTeam.id)
+                && Objects.equals(user, userTeam.user) && Objects.equals(team, userTeam.team);
+    }
+
+    @Override
+    public int hashCode() {
+        return Objects.hash(id, version, user, team, isTeamAdmin);
+    }
+
+    @Override
+    public String toString() {
+        return "UserTeam{" + "id=" + id + ", version=" + version + ", user=" + user + ", team=" + team
+                + ", isTeamAdmin=" + isTeamAdmin + '}';
+    }
+
+    public static class Builder {
+        private Long id;
+        private int version;
+        private User user;
+        private Team team;
+        private boolean isTeamAdmin;
+
+        public static Builder builder() {
+            return new Builder();
+        }
+
+        public Builder withId(Long id) {
+            this.id = id;
+            return this;
+        }
+
+        public Builder withVersion(int version) {
+            this.version = version;
+            return this;
+        }
+
+        public Builder withUser(User user) {
+            this.user = user;
+            return this;
+        }
+
+        public Builder withTeam(Team team) {
+            this.team = team;
+            return this;
+        }
+
+        public Builder withTeamAdmin(boolean isAdmin) {
+            this.isTeamAdmin = isAdmin;
+            return this;
+        }
+
+        public UserTeam build() {
+            return new UserTeam(this);
+        }
+    }
+
+}
diff --git a/backend/src/main/java/ch/puzzle/okr/models/authorization/AuthorizationRole.java b/backend/src/main/java/ch/puzzle/okr/models/authorization/AuthorizationRole.java
deleted file mode 100644
index 443f61992d..0000000000
--- a/backend/src/main/java/ch/puzzle/okr/models/authorization/AuthorizationRole.java
+++ /dev/null
@@ -1,6 +0,0 @@
-package ch.puzzle.okr.models.authorization;
-
-public enum AuthorizationRole {
-    READ_ALL_DRAFT, READ_ALL_PUBLISHED, READ_TEAMS_DRAFT, READ_TEAM_DRAFT, //
-    WRITE_ALL, WRITE_ALL_TEAMS, WRITE_TEAM
-}
diff --git a/backend/src/main/java/ch/puzzle/okr/models/authorization/AuthorizationUser.java b/backend/src/main/java/ch/puzzle/okr/models/authorization/AuthorizationUser.java
index 4850048ca1..829ba69765 100644
--- a/backend/src/main/java/ch/puzzle/okr/models/authorization/AuthorizationUser.java
+++ b/backend/src/main/java/ch/puzzle/okr/models/authorization/AuthorizationUser.java
@@ -4,6 +4,17 @@
 
 import java.util.List;
 
-public record AuthorizationUser(User user, List<Long> userTeamIds, List<Long> firstLevelTeamIds,
-        List<AuthorizationRole> roles) {
+public record AuthorizationUser(User user) {
+    public List<Long> extractTeamIds() {
+        return this.user.getUserTeamList().stream().map(userTeam -> userTeam.getTeam().getId()).toList();
+    }
+
+    public boolean isUserMemberInTeam(Long teamId) {
+        return this.user.getUserTeamList().stream().anyMatch(ut -> ut.getTeam().getId().equals(teamId));
+    }
+
+    public boolean isUserAdminInTeam(Long teamId) {
+        return this.user.getUserTeamList().stream()
+                .anyMatch(ut -> ut.isTeamAdmin() && ut.getTeam().getId().equals(teamId));
+    }
 }
diff --git a/backend/src/main/java/ch/puzzle/okr/multitenancy/CurrentTenantIdentifierResolverImpl.java b/backend/src/main/java/ch/puzzle/okr/multitenancy/CurrentTenantIdentifierResolverImpl.java
new file mode 100644
index 0000000000..d3f7b26f7e
--- /dev/null
+++ b/backend/src/main/java/ch/puzzle/okr/multitenancy/CurrentTenantIdentifierResolverImpl.java
@@ -0,0 +1,16 @@
+package ch.puzzle.okr.multitenancy;
+
+import org.hibernate.context.spi.CurrentTenantIdentifierResolver;
+
+public class CurrentTenantIdentifierResolverImpl implements CurrentTenantIdentifierResolver {
+
+    @Override
+    public String resolveCurrentTenantIdentifier() {
+        return TenantContext.getCurrentTenant();
+    }
+
+    @Override
+    public boolean validateExistingCurrentSessions() {
+        return true;
+    }
+}
\ No newline at end of file
diff --git a/backend/src/main/java/ch/puzzle/okr/multitenancy/FlywayMultitenantMigrationInitializer.java b/backend/src/main/java/ch/puzzle/okr/multitenancy/FlywayMultitenantMigrationInitializer.java
new file mode 100644
index 0000000000..d58c195c77
--- /dev/null
+++ b/backend/src/main/java/ch/puzzle/okr/multitenancy/FlywayMultitenantMigrationInitializer.java
@@ -0,0 +1,37 @@
+package ch.puzzle.okr.multitenancy;
+
+import jakarta.persistence.EntityNotFoundException;
+import org.flywaydb.core.Flyway;
+import org.springframework.beans.factory.annotation.Value;
+import org.springframework.stereotype.Component;
+
+@Component
+public class FlywayMultitenantMigrationInitializer {
+    private final TenantConfigProviderInterface tenantConfigProvider;
+    private final String[] scriptLocations;
+
+    public FlywayMultitenantMigrationInitializer(TenantConfigProviderInterface tenantConfigProvider,
+            final @Value("${spring.flyway.locations}") String[] scriptLocations) {
+        this.tenantConfigProvider = tenantConfigProvider;
+        this.scriptLocations = scriptLocations;
+    }
+
+    public void migrateFlyway() {
+        this.tenantConfigProvider.getTenantConfigs().forEach((tenantConfig) -> {
+            TenantConfigProvider.DataSourceConfig dataSourceConfig = this.tenantConfigProvider
+                    .getTenantConfigById(tenantConfig.tenantId())
+                    .map(TenantConfigProvider.TenantConfig::dataSourceConfig).orElseThrow(
+                            () -> new EntityNotFoundException("Cannot find tenant for configuring flyway migration"));
+
+            Flyway tenantSchemaFlyway = Flyway.configure() //
+                    .dataSource(dataSourceConfig.url(), dataSourceConfig.name(), dataSourceConfig.password()) //
+                    .locations(scriptLocations) //
+                    .baselineOnMigrate(Boolean.TRUE) //
+                    .schemas(dataSourceConfig.schema()) //
+                    .load();
+
+            tenantSchemaFlyway.migrate();
+        });
+
+    }
+}
\ No newline at end of file
diff --git a/backend/src/main/java/ch/puzzle/okr/multitenancy/HibernateContext.java b/backend/src/main/java/ch/puzzle/okr/multitenancy/HibernateContext.java
new file mode 100644
index 0000000000..42e068ece0
--- /dev/null
+++ b/backend/src/main/java/ch/puzzle/okr/multitenancy/HibernateContext.java
@@ -0,0 +1,77 @@
+package ch.puzzle.okr.multitenancy;
+
+import org.springframework.core.env.ConfigurableEnvironment;
+
+import java.util.Properties;
+
+public class HibernateContext {
+    public static final String HIBERNATE_CONNECTION_URL = "hibernate.connection.url";
+    public static final String HIBERNATE_CONNECTION_USERNAME = "hibernate.connection.username";
+    public static final String HIBERNATE_CONNECTION_PASSWORD = "hibernate.connection.password";
+    public static final String HIBERNATE_MULTITENANCY = "hibernate.multiTenancy";
+
+    public static String SPRING_DATASOURCE_URL = "spring.datasource.url";
+    public static String SPRING_DATASOURCE_USERNAME = "spring.datasource.username";
+    public static String SPRING_DATASOURCE_PASSWORD = "spring.datasource.password";
+
+    public record DbConfig(String url, String username, String password, String multiTenancy) {
+
+        public boolean isValid() {
+            return !hasNullValues() && !hasEmptyValues();
+        }
+
+        private boolean hasNullValues() {
+            return url() == null || username() == null || password() == null || multiTenancy() == null;
+        }
+
+        private boolean hasEmptyValues() {
+            return url().isBlank() || username().isBlank() || password().isBlank() || multiTenancy().isBlank();
+        }
+    }
+
+    private static DbConfig cachedHibernateConfig;
+
+    public static void setHibernateConfig(DbConfig dbConfig) {
+        if (dbConfig == null || !dbConfig.isValid()) {
+            throw new RuntimeException("Invalid hibernate configuration " + dbConfig);
+        }
+        cachedHibernateConfig = dbConfig;
+    }
+
+    public static void extractAndSetHibernateConfig(ConfigurableEnvironment environment) {
+        DbConfig dbConfig = extractHibernateConfig(environment);
+        HibernateContext.setHibernateConfig(dbConfig);
+    }
+
+    private static DbConfig extractHibernateConfig(ConfigurableEnvironment environment) {
+        String url = environment.getProperty(HibernateContext.HIBERNATE_CONNECTION_URL);
+        String username = environment.getProperty(HibernateContext.HIBERNATE_CONNECTION_USERNAME);
+        String password = environment.getProperty(HibernateContext.HIBERNATE_CONNECTION_PASSWORD);
+        String multiTenancy = environment.getProperty(HibernateContext.HIBERNATE_MULTITENANCY);
+        return new DbConfig(url, username, password, multiTenancy);
+    }
+
+    // for testing
+    public static void resetHibernateConfig() {
+        cachedHibernateConfig = null;
+    }
+
+    public static Properties getHibernateConfig() {
+        if (cachedHibernateConfig == null) {
+            throw new RuntimeException("No cached hibernate configuration found");
+        }
+        return getConfigAsProperties(cachedHibernateConfig);
+    }
+
+    private static Properties getConfigAsProperties(DbConfig dbConfig) {
+        Properties properties = new Properties();
+        properties.put(HibernateContext.HIBERNATE_CONNECTION_URL, dbConfig.url());
+        properties.put(HibernateContext.HIBERNATE_CONNECTION_USERNAME, dbConfig.username());
+        properties.put(HibernateContext.HIBERNATE_CONNECTION_PASSWORD, dbConfig.password());
+        properties.put(HibernateContext.HIBERNATE_MULTITENANCY, dbConfig.multiTenancy());
+        properties.put(HibernateContext.SPRING_DATASOURCE_URL, dbConfig.url());
+        properties.put(HibernateContext.SPRING_DATASOURCE_USERNAME, dbConfig.username());
+        properties.put(HibernateContext.SPRING_DATASOURCE_PASSWORD, dbConfig.password());
+        return properties;
+    }
+}
diff --git a/backend/src/main/java/ch/puzzle/okr/multitenancy/SchemaMultiTenantConnectionProvider.java b/backend/src/main/java/ch/puzzle/okr/multitenancy/SchemaMultiTenantConnectionProvider.java
new file mode 100644
index 0000000000..05ff90ce53
--- /dev/null
+++ b/backend/src/main/java/ch/puzzle/okr/multitenancy/SchemaMultiTenantConnectionProvider.java
@@ -0,0 +1,115 @@
+package ch.puzzle.okr.multitenancy;
+
+import ch.puzzle.okr.exception.ConnectionProviderException;
+import org.hibernate.cfg.AvailableSettings;
+import org.hibernate.engine.jdbc.connections.internal.DriverManagerConnectionProviderImpl;
+import org.hibernate.engine.jdbc.connections.spi.AbstractMultiTenantConnectionProvider;
+import org.hibernate.engine.jdbc.connections.spi.ConnectionProvider;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import java.sql.Connection;
+import java.sql.SQLException;
+import java.text.MessageFormat;
+import java.util.*;
+
+import static ch.puzzle.okr.multitenancy.TenantContext.DEFAULT_TENANT_ID;
+
+public class SchemaMultiTenantConnectionProvider extends AbstractMultiTenantConnectionProvider<String> {
+
+    private static final Logger logger = LoggerFactory.getLogger(SchemaMultiTenantConnectionProvider.class);
+
+    final Map<String, ConnectionProvider> connectionProviderMap;
+
+    public SchemaMultiTenantConnectionProvider() {
+        this.connectionProviderMap = new HashMap<>();
+    }
+
+    @Override
+    public Connection getConnection(String tenantIdentifier) throws SQLException {
+        Connection connection = super.getConnection(tenantIdentifier);
+        return getConnection(tenantIdentifier, connection);
+    }
+
+    protected Connection getConnection(String tenantIdentifier, Connection connection) throws SQLException {
+        String schema = convertTenantIdToSchemaName(tenantIdentifier);
+        logger.debug("Setting schema to {}", schema);
+
+        connection.createStatement().execute(String.format("SET SCHEMA '%s';", schema));
+        return connection;
+    }
+
+    private String convertTenantIdToSchemaName(String tenantIdentifier) {
+        return Objects.equals(tenantIdentifier, DEFAULT_TENANT_ID) ? tenantIdentifier
+                : MessageFormat.format("okr_{0}", tenantIdentifier);
+    }
+
+    @Override
+    protected ConnectionProvider getAnyConnectionProvider() {
+        return getConnectionProvider(DEFAULT_TENANT_ID);
+    }
+
+    @Override
+    protected ConnectionProvider selectConnectionProvider(String tenantIdentifier) {
+        return getConnectionProvider(tenantIdentifier);
+    }
+
+    protected ConnectionProvider getConnectionProvider(String tenantIdentifier) {
+        return Optional.ofNullable(tenantIdentifier) //
+                .map(connectionProviderMap::get) //
+                .orElseGet(() -> createNewConnectionProvider(tenantIdentifier));
+    }
+
+    private ConnectionProvider createNewConnectionProvider(String tenantIdentifier) {
+        return Optional.ofNullable(tenantIdentifier) //
+                .map(this::createConnectionProvider) //
+                .map(connectionProvider -> {
+                    connectionProviderMap.put(tenantIdentifier, connectionProvider);
+                    return connectionProvider;
+                }) //
+                .orElseThrow(() -> new ConnectionProviderException(
+                        String.format("Cannot create new connection provider for tenant: %s", tenantIdentifier)));
+    }
+
+    private ConnectionProvider createConnectionProvider(String tenantIdentifier) {
+        return Optional.ofNullable(tenantIdentifier) //
+                .map(this::getHibernatePropertiesForTenantIdentifier) //
+                .map(this::initConnectionProvider) //
+                .orElse(null);
+    }
+
+    protected Properties getHibernatePropertiesForTenantIdentifier(String tenantIdentifier) {
+        Properties properties = getHibernateProperties();
+        if (properties == null || properties.isEmpty()) {
+            throw new RuntimeException("Cannot load hibernate properties from application.properties)");
+        }
+        if (!Objects.equals(tenantIdentifier, DEFAULT_TENANT_ID)) {
+            properties.put(AvailableSettings.DEFAULT_SCHEMA, MessageFormat.format("okr_{0}", tenantIdentifier));
+        }
+        return properties;
+    }
+
+    private ConnectionProvider initConnectionProvider(Properties hibernateProperties) {
+        Map<String, Object> configProperties = convertPropertiesToMap(hibernateProperties);
+        DriverManagerConnectionProviderImpl connectionProvider = getDriverManagerConnectionProviderImpl();
+        connectionProvider.configure(configProperties);
+        return connectionProvider;
+    }
+
+    protected DriverManagerConnectionProviderImpl getDriverManagerConnectionProviderImpl() {
+        return new DriverManagerConnectionProviderImpl();
+    }
+
+    private Map<String, Object> convertPropertiesToMap(Properties properties) {
+        Map<String, Object> configProperties = new HashMap<>();
+        for (String key : properties.stringPropertyNames()) {
+            String value = properties.getProperty(key);
+            configProperties.put(key, value);
+        }
+        return configProperties;
+    }
+
+    protected Properties getHibernateProperties() {
+        return HibernateContext.getHibernateConfig();
+    }
+}
\ No newline at end of file
diff --git a/backend/src/main/java/ch/puzzle/okr/multitenancy/TenantConfigProvider.java b/backend/src/main/java/ch/puzzle/okr/multitenancy/TenantConfigProvider.java
new file mode 100644
index 0000000000..97521d9d7a
--- /dev/null
+++ b/backend/src/main/java/ch/puzzle/okr/multitenancy/TenantConfigProvider.java
@@ -0,0 +1,74 @@
+package ch.puzzle.okr.multitenancy;
+
+import org.springframework.beans.factory.annotation.Value;
+import org.springframework.core.env.Environment;
+import org.springframework.stereotype.Component;
+
+import java.text.MessageFormat;
+import java.util.*;
+
+@Component
+public class TenantConfigProvider implements TenantConfigProviderInterface {
+    private static final String EMAIL_DELIMITER = ",";
+    private final Map<String, TenantConfig> tenantConfigs = new HashMap<>();
+    private final Environment env;
+
+    public TenantConfigProvider(final @Value("${okr.tenant-ids}") String[] tenantIds, Environment env) {
+        this.env = env;
+        for (String tenantId : tenantIds) {
+            OauthConfig c = readOauthConfig(tenantId);
+            tenantConfigs.put(tenantId,
+                    createTenantConfig(c.jwkSetUri(), c.frontendClientIssuerUrl(), c.frontendClientId(), tenantId));
+        }
+    }
+
+    private OauthConfig readOauthConfig(String tenantId) {
+        return new OauthConfig(
+                env.getProperty(MessageFormat.format("okr.tenants.{0}.security.oauth2.resourceserver.jwt.jwk-set-uri",
+                        tenantId)),
+                env.getProperty(MessageFormat.format("okr.tenants.{0}.security.oauth2.frontend.issuer-url", tenantId)),
+                env.getProperty(MessageFormat.format("okr.tenants.{0}.security.oauth2.frontend.client-id", tenantId)));
+    }
+
+    private TenantConfig createTenantConfig(String jwkSetUriTemplate, String frontendClientIssuerUrl,
+            String frontendClientId, String tenantId) {
+        return new TenantConfig(tenantId, getOkrChampionEmailsFromTenant(tenantId), jwkSetUriTemplate,
+                frontendClientIssuerUrl, frontendClientId, this.readDataSourceConfig(tenantId));
+    }
+
+    private String[] getOkrChampionEmailsFromTenant(String tenantId) {
+        return Arrays.stream(env.getProperty(MessageFormat.format("okr.tenants.{0}.user.champion.emails", tenantId), "")
+                .split(EMAIL_DELIMITER)).map(String::trim).toArray(String[]::new);
+    }
+
+    public List<TenantConfig> getTenantConfigs() {
+        return this.tenantConfigs.values().stream().toList();
+    }
+
+    private DataSourceConfig readDataSourceConfig(String tenantId) {
+        return new DataSourceConfig(env.getProperty("okr.datasource.driver-class-name"),
+                env.getProperty(MessageFormat.format("okr.tenants.{0}.datasource.url", tenantId)),
+                env.getProperty(MessageFormat.format("okr.tenants.{0}.datasource.username", tenantId)),
+                env.getProperty(MessageFormat.format("okr.tenants.{0}.datasource.password", tenantId)),
+                env.getProperty(MessageFormat.format("okr.tenants.{0}.datasource.schema", tenantId)));
+    }
+
+    public Optional<TenantConfig> getTenantConfigById(String tenantId) {
+        return Optional.ofNullable(this.tenantConfigs.get(tenantId));
+    }
+
+    public Optional<String> getJwkSetUri(String tenantId) {
+        return getTenantConfigById(tenantId).map(TenantConfig::jwkSetUri);
+    }
+
+    public record TenantConfig(String tenantId, String[] okrChampionEmails, String jwkSetUri, String issuerUrl,
+            String clientId, DataSourceConfig dataSourceConfig) {
+    }
+
+    public record DataSourceConfig(String driverClassName, String url, String name, String password, String schema) {
+
+    }
+
+    public record OauthConfig(String jwkSetUri, String frontendClientIssuerUrl, String frontendClientId) {
+    }
+}
\ No newline at end of file
diff --git a/backend/src/main/java/ch/puzzle/okr/multitenancy/TenantConfigProviderInterface.java b/backend/src/main/java/ch/puzzle/okr/multitenancy/TenantConfigProviderInterface.java
new file mode 100644
index 0000000000..70fbd8a6db
--- /dev/null
+++ b/backend/src/main/java/ch/puzzle/okr/multitenancy/TenantConfigProviderInterface.java
@@ -0,0 +1,13 @@
+package ch.puzzle.okr.multitenancy;
+
+import java.util.List;
+import java.util.Optional;
+
+public interface TenantConfigProviderInterface {
+    List<TenantConfigProvider.TenantConfig> getTenantConfigs();
+
+    Optional<TenantConfigProvider.TenantConfig> getTenantConfigById(String tenantId);
+
+    Optional<String> getJwkSetUri(String tenantId);
+
+}
diff --git a/backend/src/main/java/ch/puzzle/okr/multitenancy/TenantContext.java b/backend/src/main/java/ch/puzzle/okr/multitenancy/TenantContext.java
new file mode 100644
index 0000000000..7c560ecf8c
--- /dev/null
+++ b/backend/src/main/java/ch/puzzle/okr/multitenancy/TenantContext.java
@@ -0,0 +1,21 @@
+package ch.puzzle.okr.multitenancy;
+
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import java.util.Optional;
+
+public class TenantContext {
+    public static final String DEFAULT_TENANT_ID = "public";
+    private static final Logger logger = LoggerFactory.getLogger(TenantContext.class);
+    private static final ThreadLocal<String> CURRENT_TENANT = new ThreadLocal<>();
+
+    public static String getCurrentTenant() {
+        return Optional.ofNullable(CURRENT_TENANT.get()).orElse(DEFAULT_TENANT_ID);
+    }
+
+    public static void setCurrentTenant(String tenant) {
+        logger.debug("Setting current TenantContext to tenant: {}", tenant);
+        CURRENT_TENANT.set(tenant);
+    }
+}
\ No newline at end of file
diff --git a/backend/src/main/java/ch/puzzle/okr/multitenancy/customization/TenantClientCustomization.java b/backend/src/main/java/ch/puzzle/okr/multitenancy/customization/TenantClientCustomization.java
new file mode 100644
index 0000000000..b7dc7e004f
--- /dev/null
+++ b/backend/src/main/java/ch/puzzle/okr/multitenancy/customization/TenantClientCustomization.java
@@ -0,0 +1,7 @@
+package ch.puzzle.okr.multitenancy.customization;
+
+import java.util.Map;
+
+public record TenantClientCustomization(String favicon, String logo, String triangles, String backgroundLogo,
+        String title, Map<String, String> customStyles) {
+}
diff --git a/backend/src/main/java/ch/puzzle/okr/multitenancy/customization/TenantClientCustomizationProvider.java b/backend/src/main/java/ch/puzzle/okr/multitenancy/customization/TenantClientCustomizationProvider.java
new file mode 100644
index 0000000000..2c74a9ae07
--- /dev/null
+++ b/backend/src/main/java/ch/puzzle/okr/multitenancy/customization/TenantClientCustomizationProvider.java
@@ -0,0 +1,80 @@
+package ch.puzzle.okr.multitenancy.customization;
+
+import org.springframework.beans.factory.annotation.Value;
+import org.springframework.core.env.Environment;
+import org.springframework.stereotype.Component;
+
+import java.io.Serializable;
+import java.text.MessageFormat;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.Optional;
+
+@Component
+public class TenantClientCustomizationProvider {
+    private static final String CUSTOM_STYLES_PREFIX = "okr.tenants.{0}.clientcustomization.customstyles";
+    private static final String TOPBAR_BACKGROUND_COLOR = ".okr-topbar-background-color";
+    private static final String BANNER_BACKGROUND_COLOR = ".okr-banner-background-color";
+
+    private final Map<String, TenantClientCustomization> tenantCustomizations = new HashMap<>();
+    private final List<String> customCssStyles = List.of(TOPBAR_BACKGROUND_COLOR, BANNER_BACKGROUND_COLOR);
+    private final Environment env;
+
+    record CssConfigItem(String cssName, String cssValue) implements Serializable {
+    }
+
+    public TenantClientCustomizationProvider(final @Value("${okr.tenant-ids}") String[] tenantIds, Environment env) {
+        this.env = env;
+        for (String tenantId : tenantIds) {
+            readClientCustomizationConfig(tenantId);
+            tenantCustomizations.put(tenantId, readClientCustomizationConfig(tenantId));
+        }
+    }
+
+    private TenantClientCustomization readClientCustomizationConfig(String tenantId) {
+        return new TenantClientCustomization(
+                env.getProperty(MessageFormat.format("okr.tenants.{0}.clientcustomization.favicon", tenantId)),
+                env.getProperty(MessageFormat.format("okr.tenants.{0}.clientcustomization.logo", tenantId)),
+                env.getProperty(MessageFormat.format("okr.tenants.{0}.clientcustomization.triangles", tenantId)),
+                env.getProperty(MessageFormat.format("okr.tenants.{0}.clientcustomization.background-logo", tenantId)),
+                env.getProperty(MessageFormat.format("okr.tenants.{0}.clientcustomization.title", tenantId)),
+                getCustomCssStyles(tenantId) //
+        );
+    }
+
+    private Map<String, String> getCustomCssStyles(String tenantId) {
+        Map<String, String> styles = new HashMap<>();
+        for (String customStyle : customCssStyles) {
+            String propertyName = formatWithTenant(CUSTOM_STYLES_PREFIX + customStyle, tenantId);
+            CssConfigItem cssPropertyNameAndValue = getCssPropertyNameAndValue(propertyName, tenantId);
+            styles.put(cssPropertyNameAndValue.cssName(), cssPropertyNameAndValue.cssValue());
+        }
+        return styles;
+    }
+
+    private CssConfigItem getCssPropertyNameAndValue(String propertyName, String tenantId) {
+        String cssName = extractCssNameFromPropertyName(propertyName, tenantId);
+        String cssValue = env.getProperty(formatWithTenant(propertyName, tenantId));
+        return new CssConfigItem(cssName, cssValue);
+    }
+
+    public Optional<TenantClientCustomization> getTenantClientCustomizationsById(String tenantId) {
+        return Optional.ofNullable(this.tenantCustomizations.get(tenantId));
+    }
+
+    String extractCssNameFromPropertyName(String propertyName, String tenantId) {
+        String prefix = formatWithTenant(CUSTOM_STYLES_PREFIX, tenantId);
+        int startPrefix = propertyName.indexOf(prefix);
+        if (startPrefix == -1) {
+            throw new IllegalArgumentException(propertyName + " is not a valid property name client customization");
+        }
+
+        int startCssPropertyName = startPrefix + prefix.length() + 1;
+        return propertyName.substring(startCssPropertyName);
+    }
+
+    private String formatWithTenant(String stringWithTenantPlaceholder, String tenantId) {
+        return MessageFormat.format(stringWithTenantPlaceholder, tenantId);
+    }
+}
\ No newline at end of file
diff --git a/backend/src/main/java/ch/puzzle/okr/repository/OrganisationRepository.java b/backend/src/main/java/ch/puzzle/okr/repository/OrganisationRepository.java
deleted file mode 100644
index 560ebba5c4..0000000000
--- a/backend/src/main/java/ch/puzzle/okr/repository/OrganisationRepository.java
+++ /dev/null
@@ -1,21 +0,0 @@
-package ch.puzzle.okr.repository;
-
-import ch.puzzle.okr.models.Organisation;
-import ch.puzzle.okr.models.OrganisationState;
-import org.springframework.data.jpa.repository.Query;
-import org.springframework.data.repository.CrudRepository;
-import org.springframework.data.repository.query.Param;
-
-import java.util.List;
-
-public interface OrganisationRepository extends CrudRepository<Organisation, Long> {
-
-    Organisation findByOrgName(String name);
-
-    boolean existsOrganisationByOrgName(String name);
-
-    @Query(value = "SELECT * FROM organisation LEFT JOIN team_organisation ON organisation.id=team_organisation.organisation_id WHERE team_organisation.team_id = :id", nativeQuery = true)
-    List<Organisation> findOrganisationsByTeamId(@Param("id") Long id);
-
-    List<Organisation> findOrganisationsByState(OrganisationState state);
-}
diff --git a/backend/src/main/java/ch/puzzle/okr/repository/UserRepository.java b/backend/src/main/java/ch/puzzle/okr/repository/UserRepository.java
index 716ec10100..2bf83e1f1d 100644
--- a/backend/src/main/java/ch/puzzle/okr/repository/UserRepository.java
+++ b/backend/src/main/java/ch/puzzle/okr/repository/UserRepository.java
@@ -3,8 +3,11 @@
 import ch.puzzle.okr.models.User;
 import org.springframework.data.repository.CrudRepository;
 
+import java.util.List;
 import java.util.Optional;
 
 public interface UserRepository extends CrudRepository<User, Long> {
-    Optional<User> findByUsername(String username);
+    Optional<User> findByEmail(String email);
+
+    List<User> findByIsOkrChampion(boolean okrChampion);
 }
diff --git a/backend/src/main/java/ch/puzzle/okr/repository/UserTeamRepository.java b/backend/src/main/java/ch/puzzle/okr/repository/UserTeamRepository.java
new file mode 100644
index 0000000000..c0a9736eb0
--- /dev/null
+++ b/backend/src/main/java/ch/puzzle/okr/repository/UserTeamRepository.java
@@ -0,0 +1,7 @@
+package ch.puzzle.okr.repository;
+
+import ch.puzzle.okr.models.UserTeam;
+import org.springframework.data.repository.CrudRepository;
+
+public interface UserTeamRepository extends CrudRepository<UserTeam, Long> {
+}
diff --git a/backend/src/main/java/ch/puzzle/okr/security/AuthenticationEvents.java b/backend/src/main/java/ch/puzzle/okr/security/AuthenticationEvents.java
new file mode 100644
index 0000000000..067de50dc6
--- /dev/null
+++ b/backend/src/main/java/ch/puzzle/okr/security/AuthenticationEvents.java
@@ -0,0 +1,23 @@
+package ch.puzzle.okr.security;
+
+import ch.puzzle.okr.multitenancy.TenantContext;
+import org.springframework.context.event.EventListener;
+import org.springframework.security.authentication.event.AuthenticationSuccessEvent;
+import org.springframework.security.oauth2.jwt.Jwt;
+import org.springframework.stereotype.Component;
+
+@Component
+public class AuthenticationEvents {
+    private final JwtHelper jwtHelper;
+
+    public AuthenticationEvents(JwtHelper jwtHelper) {
+        this.jwtHelper = jwtHelper;
+    }
+
+    @EventListener
+    public void onSuccess(AuthenticationSuccessEvent success) {
+        Jwt token = (Jwt) success.getAuthentication().getPrincipal();
+
+        TenantContext.setCurrentTenant(jwtHelper.getTenantFromToken(token));
+    }
+}
\ No newline at end of file
diff --git a/backend/src/main/java/ch/puzzle/okr/security/JwtHelper.java b/backend/src/main/java/ch/puzzle/okr/security/JwtHelper.java
new file mode 100644
index 0000000000..fe15d284f1
--- /dev/null
+++ b/backend/src/main/java/ch/puzzle/okr/security/JwtHelper.java
@@ -0,0 +1,117 @@
+package ch.puzzle.okr.security;
+
+import ch.puzzle.okr.ErrorKey;
+import ch.puzzle.okr.exception.OkrResponseStatusException;
+import ch.puzzle.okr.models.User;
+import ch.puzzle.okr.multitenancy.TenantConfigProvider;
+import ch.puzzle.okr.security.helper.ClaimHelper;
+import ch.puzzle.okr.security.helper.TokenHelper;
+import com.nimbusds.jwt.JWTClaimsSet;
+import jakarta.persistence.EntityNotFoundException;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.beans.factory.annotation.Value;
+import org.springframework.security.oauth2.jwt.Jwt;
+import org.springframework.stereotype.Component;
+
+import java.text.MessageFormat;
+import java.util.Arrays;
+import java.util.List;
+import java.util.Map;
+import java.util.Optional;
+import java.util.function.Function;
+
+import static ch.puzzle.okr.Constants.USER;
+import static org.springframework.http.HttpStatus.BAD_REQUEST;
+
+@Component
+public class JwtHelper {
+    public static final String CLAIM_TENANT = "tenant";
+    public static final String CLAIM_ISS = "iss";
+    public static final String ERROR_MESSAGE = "Missing `" + CLAIM_TENANT + "` and '" + CLAIM_ISS
+            + "' claims in JWT token!";
+
+    private static final Logger logger = LoggerFactory.getLogger(JwtHelper.class);
+
+    private final TenantConfigProvider tenantConfigProvider;
+    private final String firstname;
+    private final String lastname;
+    private final String email;
+
+    public JwtHelper(TenantConfigProvider tenantConfigProvider,
+            @Value("${okr.jwt.claim.firstname}") final String tokenClaimsKeyFirstname,
+            @Value("${okr.jwt.claim.lastname}") final String tokenClaimsKeyLastname,
+            @Value("${okr.jwt.claim.email}") final String tokenClaimsKeyEmail) {
+        this.tenantConfigProvider = tenantConfigProvider;
+        this.firstname = tokenClaimsKeyFirstname;
+        this.lastname = tokenClaimsKeyLastname;
+        this.email = tokenClaimsKeyEmail;
+    }
+
+    public User getUserFromJwt(Jwt token) {
+        Map<String, Object> claims = token.getClaims();
+        logger.debug("claims {}", claims);
+
+        try {
+            return User.Builder.builder() //
+                    .withFirstname(claims.get(firstname).toString()) //
+                    .withLastname(claims.get(lastname).toString()) //
+                    .withEmail(claims.get(email).toString()) //
+                    .build();
+        } catch (Exception e) {
+            logger.warn("can not convert user from claims {}", claims);
+            throw new OkrResponseStatusException(BAD_REQUEST, ErrorKey.CONVERT_TOKEN, USER);
+        }
+    }
+
+    public String getTenantFromToken(Jwt token) {
+        TokenHelper helper = new TokenHelper();
+        List<Function<Jwt, Optional<String>>> getTenantFromTokenFunctions = Arrays.asList( //
+                helper::getTenantFromTokenUsingClaimIss, //
+                helper::getTenantFromTokenUsingClaimTenant //
+        );
+
+        return getFirstMatchingTenantUsingListOfHelperFunctions(token, getTenantFromTokenFunctions);
+    }
+
+    private String getFirstMatchingTenantUsingListOfHelperFunctions(Jwt token,
+            List<Function<Jwt, Optional<String>>> getTenantFunctions) {
+
+        return getTenantFunctions.stream() //
+                .map(func -> func.apply(token)) //
+                .filter(Optional::isPresent) //
+                .map(Optional::get) //
+                .map(this::getMatchingTenantFromConfigOrThrow) //
+                .findFirst() //
+                .orElseThrow(() -> new RuntimeException(ERROR_MESSAGE));
+    }
+
+    public String getTenantFromJWTClaimsSet(JWTClaimsSet claimSet) {
+        ClaimHelper helper = new ClaimHelper();
+        List<Function<JWTClaimsSet, Optional<String>>> getTenantFromClaimsSetFunctions = Arrays.asList( //
+                helper::getTenantFromClaimsSetUsingClaimIss, //
+                helper::getTenantFromClaimsSetUsingClaimTenant //
+        );
+
+        return getFirstMatchingTenantUsingListOfHelperFunctions(claimSet, getTenantFromClaimsSetFunctions);
+    }
+
+    private String getFirstMatchingTenantUsingListOfHelperFunctions(JWTClaimsSet claimSet,
+            List<Function<JWTClaimsSet, Optional<String>>> getTenantFunctions) {
+
+        return getTenantFunctions.stream() //
+                .map(func -> func.apply(claimSet)) //
+                .filter(Optional::isPresent) //
+                .map(Optional::get) //
+                .map(this::getMatchingTenantFromConfigOrThrow).findFirst() //
+                .orElseThrow(() -> new RuntimeException(ERROR_MESSAGE));
+    }
+
+    private String getMatchingTenantFromConfigOrThrow(String tenant) {
+        // Ensure we return only tenants for realms which really exist
+        return this.tenantConfigProvider.getTenantConfigById(tenant)
+                .orElseThrow(() -> new EntityNotFoundException(MessageFormat.format("Cannot find tenant {0}", tenant)))
+                .tenantId();
+    }
+
+}
\ No newline at end of file
diff --git a/backend/src/main/java/ch/puzzle/okr/security/TenantJWSKeySelector.java b/backend/src/main/java/ch/puzzle/okr/security/TenantJWSKeySelector.java
new file mode 100644
index 0000000000..f900296174
--- /dev/null
+++ b/backend/src/main/java/ch/puzzle/okr/security/TenantJWSKeySelector.java
@@ -0,0 +1,57 @@
+package ch.puzzle.okr.security;
+
+import ch.puzzle.okr.multitenancy.TenantConfigProvider;
+import com.nimbusds.jose.JWSHeader;
+import com.nimbusds.jose.KeySourceException;
+import com.nimbusds.jose.proc.JWSAlgorithmFamilyJWSKeySelector;
+import com.nimbusds.jose.proc.JWSKeySelector;
+import com.nimbusds.jose.proc.SecurityContext;
+import com.nimbusds.jwt.JWTClaimsSet;
+import com.nimbusds.jwt.proc.JWTClaimsSetAwareJWSKeySelector;
+import org.springframework.stereotype.Component;
+
+import java.net.URL;
+import java.security.Key;
+import java.util.List;
+import java.util.Map;
+import java.util.concurrent.ConcurrentHashMap;
+
+@Component
+public class TenantJWSKeySelector implements JWTClaimsSetAwareJWSKeySelector<SecurityContext> {
+
+    private final TenantConfigProvider tenantConfigProvider;
+
+    private final Map<String, JWSKeySelector<SecurityContext>> selectors = new ConcurrentHashMap<>();
+    private final JwtHelper jwtHelper;
+
+    public TenantJWSKeySelector(final TenantConfigProvider tenantConfigProvider, JwtHelper jwtHelper) {
+        this.tenantConfigProvider = tenantConfigProvider;
+        this.jwtHelper = jwtHelper;
+    }
+
+    @Override
+    public List<? extends Key> selectKeys(JWSHeader jwsHeader, JWTClaimsSet jwtClaimsSet,
+            SecurityContext securityContext) throws KeySourceException {
+
+        return this.selectors.computeIfAbsent(toTenant(jwtClaimsSet), this::fromTenant) //
+                .selectJWSKeys(jwsHeader, securityContext);
+    }
+
+    private String toTenant(JWTClaimsSet claimSet) {
+        return jwtHelper.getTenantFromJWTClaimsSet(claimSet);
+    }
+
+    private JWSKeySelector<SecurityContext> fromTenant(String tenantId) {
+        return this.tenantConfigProvider.getJwkSetUri(tenantId)//
+                .map(this::fromUri) //
+                .orElseThrow(() -> new IllegalArgumentException("unknown tenant"));
+    }
+
+    JWSKeySelector<SecurityContext> fromUri(String uri) {
+        try {
+            return JWSAlgorithmFamilyJWSKeySelector.fromJWKSetURL(new URL(uri));
+        } catch (Exception ex) {
+            throw new IllegalArgumentException(ex);
+        }
+    }
+}
\ No newline at end of file
diff --git a/backend/src/main/java/ch/puzzle/okr/security/TenantJwtIssuerValidator.java b/backend/src/main/java/ch/puzzle/okr/security/TenantJwtIssuerValidator.java
new file mode 100644
index 0000000000..1dadd96b3f
--- /dev/null
+++ b/backend/src/main/java/ch/puzzle/okr/security/TenantJwtIssuerValidator.java
@@ -0,0 +1,44 @@
+package ch.puzzle.okr.security;
+
+import ch.puzzle.okr.multitenancy.TenantConfigProvider;
+import org.springframework.security.oauth2.core.OAuth2TokenValidator;
+import org.springframework.security.oauth2.core.OAuth2TokenValidatorResult;
+import org.springframework.security.oauth2.jwt.Jwt;
+import org.springframework.security.oauth2.jwt.JwtIssuerValidator;
+import org.springframework.stereotype.Component;
+
+import java.util.Map;
+import java.util.concurrent.ConcurrentHashMap;
+
+@Component
+public class TenantJwtIssuerValidator implements OAuth2TokenValidator<Jwt> {
+    private final TenantConfigProvider tenantConfigProvider;
+
+    private final Map<String, JwtIssuerValidator> validators = new ConcurrentHashMap<>();
+
+    private final JwtHelper jwtHelper;
+
+    public TenantJwtIssuerValidator(TenantConfigProvider tenantConfigProvider, JwtHelper jwtHelper) {
+        this.tenantConfigProvider = tenantConfigProvider;
+        this.jwtHelper = jwtHelper;
+    }
+
+    @Override
+    public OAuth2TokenValidatorResult validate(Jwt token) {
+        String tenant = jwtHelper.getTenantFromToken(token);
+        JwtIssuerValidator validator = validators.computeIfAbsent(tenant, this::createValidatorForTenant);
+        return validator.validate(token);
+    }
+
+    private JwtIssuerValidator createValidatorForTenant(String tenant) {
+        return this.tenantConfigProvider.getTenantConfigById(tenant) //
+                .map(TenantConfigProvider.TenantConfig::issuerUrl) //
+                .map(this::createValidator) //
+                .orElseThrow(() -> new IllegalArgumentException("unknown tenant"));
+    }
+
+    JwtIssuerValidator createValidator(String issuer) {
+        return new JwtIssuerValidator(issuer);
+    }
+
+}
\ No newline at end of file
diff --git a/backend/src/main/java/ch/puzzle/okr/security/helper/ClaimHelper.java b/backend/src/main/java/ch/puzzle/okr/security/helper/ClaimHelper.java
new file mode 100644
index 0000000000..9ceb7a4034
--- /dev/null
+++ b/backend/src/main/java/ch/puzzle/okr/security/helper/ClaimHelper.java
@@ -0,0 +1,51 @@
+package ch.puzzle.okr.security.helper;
+
+import com.nimbusds.jwt.JWTClaimsSet;
+
+import java.text.ParseException;
+import java.util.Optional;
+
+import static ch.puzzle.okr.security.JwtHelper.CLAIM_ISS;
+import static ch.puzzle.okr.security.JwtHelper.CLAIM_TENANT;
+import static ch.puzzle.okr.security.helper.JwtStatusLogger.logStatus;
+import static ch.puzzle.okr.security.helper.UrlHelper.extractTenantFromIssUrl;
+
+public class ClaimHelper {
+
+    public Optional<String> getTenantFromClaimsSetUsingClaimTenant(JWTClaimsSet claimSet) {
+        try {
+            return getTenant(claimSet);
+        } catch (ParseException e) {
+            logStatus(CLAIM_TENANT, claimSet, e);
+            return Optional.empty();
+        }
+    }
+
+    private Optional<String> getTenant(JWTClaimsSet claimSet) throws ParseException {
+        String tenant = claimSet.getStringClaim(CLAIM_TENANT);
+        logStatus(CLAIM_TENANT, claimSet, tenant);
+        return Optional.ofNullable(tenant);
+    }
+
+    public Optional<String> getTenantFromClaimsSetUsingClaimIss(JWTClaimsSet claimSet) {
+        try {
+            return getIssUrl(claimSet).flatMap(url -> getTenant(claimSet, url));
+        } catch (ParseException e) {
+            logStatus(CLAIM_ISS, claimSet, e);
+            return Optional.empty();
+        }
+    }
+
+    private Optional<String> getIssUrl(JWTClaimsSet claimSet) throws ParseException {
+        String issUrl = claimSet.getStringClaim(CLAIM_ISS);
+        logStatus(CLAIM_ISS, claimSet, issUrl);
+        return Optional.ofNullable(issUrl);
+    }
+
+    private Optional<String> getTenant(JWTClaimsSet claimSet, String issUrl) {
+        Optional<String> tenant = extractTenantFromIssUrl(issUrl);
+        logStatus(CLAIM_ISS, claimSet, tenant.isPresent());
+        return tenant;
+    }
+
+}
diff --git a/backend/src/main/java/ch/puzzle/okr/security/helper/JwtStatusLogger.java b/backend/src/main/java/ch/puzzle/okr/security/helper/JwtStatusLogger.java
new file mode 100644
index 0000000000..ca5d678458
--- /dev/null
+++ b/backend/src/main/java/ch/puzzle/okr/security/helper/JwtStatusLogger.java
@@ -0,0 +1,34 @@
+package ch.puzzle.okr.security.helper;
+
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import java.text.ParseException;
+
+public class JwtStatusLogger {
+
+    private static final Logger logger = LoggerFactory.getLogger(ClaimHelper.class);
+
+    public static void logStatus(String claim, Object context, String result) {
+        logStatus(claim, context, result != null);
+    }
+
+    public static void logStatus(String claim, Object context, boolean isOk) {
+        if (isOk) {
+            logger.info("Tenant: get claim '{}' from {}{}", claim, context.getClass().getSimpleName(),
+                    statusToSymbol(isOk));
+        } else {
+            logger.warn("Tenant: get claim '{}' from {}{}", claim, context.getClass().getSimpleName(),
+                    statusToSymbol(isOk));
+        }
+    }
+
+    public static void logStatus(String claim, Object context, ParseException e) {
+        logger.warn("Tenant: get claim '{}' from {}{}", claim, context.getClass().getSimpleName(),
+                statusToSymbol(false), e);
+    }
+
+    private static String statusToSymbol(boolean isOk) {
+        return isOk ? " | OK" : " | FAILED";
+    }
+}
diff --git a/backend/src/main/java/ch/puzzle/okr/security/helper/TokenHelper.java b/backend/src/main/java/ch/puzzle/okr/security/helper/TokenHelper.java
new file mode 100644
index 0000000000..513241cb06
--- /dev/null
+++ b/backend/src/main/java/ch/puzzle/okr/security/helper/TokenHelper.java
@@ -0,0 +1,39 @@
+package ch.puzzle.okr.security.helper;
+
+import org.springframework.security.oauth2.jwt.Jwt;
+
+import java.util.Optional;
+
+import static ch.puzzle.okr.security.JwtHelper.CLAIM_ISS;
+import static ch.puzzle.okr.security.JwtHelper.CLAIM_TENANT;
+import static ch.puzzle.okr.security.helper.JwtStatusLogger.logStatus;
+import static ch.puzzle.okr.security.helper.UrlHelper.extractTenantFromIssUrl;
+
+public class TokenHelper {
+
+    public Optional<String> getTenantFromTokenUsingClaimTenant(Jwt token) {
+        return getTenant(token);
+    }
+
+    private Optional<String> getTenant(Jwt token) {
+        String tenant = token.getClaimAsString(CLAIM_TENANT); // can return null
+        logStatus(CLAIM_TENANT, token, tenant);
+        return Optional.ofNullable(tenant);
+    }
+
+    public Optional<String> getTenantFromTokenUsingClaimIss(Jwt token) {
+        return getIssUrl(token).flatMap(url -> getTenant(token, url));
+    }
+
+    private Optional<String> getIssUrl(Jwt token) {
+        String issUrl = token.getClaimAsString(CLAIM_ISS); // can return null
+        logStatus(CLAIM_ISS, token, issUrl);
+        return Optional.ofNullable(issUrl);
+    }
+
+    private Optional<String> getTenant(Jwt token, String issUrl) {
+        Optional<String> tenant = extractTenantFromIssUrl(issUrl);
+        logStatus(CLAIM_ISS, token, tenant.isPresent());
+        return tenant;
+    }
+}
diff --git a/backend/src/main/java/ch/puzzle/okr/security/helper/UrlHelper.java b/backend/src/main/java/ch/puzzle/okr/security/helper/UrlHelper.java
new file mode 100644
index 0000000000..5857e4fa01
--- /dev/null
+++ b/backend/src/main/java/ch/puzzle/okr/security/helper/UrlHelper.java
@@ -0,0 +1,14 @@
+package ch.puzzle.okr.security.helper;
+
+import java.util.Optional;
+
+public class UrlHelper {
+
+    public static Optional<String> extractTenantFromIssUrl(String issUrl) {
+        if (issUrl == null)
+            return Optional.empty();
+        String[] issUrlParts = issUrl.split("/");
+        String tenant = issUrlParts[issUrlParts.length - 1];
+        return Optional.of(tenant);
+    }
+}
diff --git a/backend/src/main/java/ch/puzzle/okr/service/CacheService.java b/backend/src/main/java/ch/puzzle/okr/service/CacheService.java
index 7e98916bbf..de907468c1 100644
--- a/backend/src/main/java/ch/puzzle/okr/service/CacheService.java
+++ b/backend/src/main/java/ch/puzzle/okr/service/CacheService.java
@@ -9,7 +9,6 @@
 import org.springframework.stereotype.Service;
 
 import static ch.puzzle.okr.SpringCachingConfig.AUTHORIZATION_USER_CACHE;
-import static ch.puzzle.okr.SpringCachingConfig.USER_CACHE;
 
 @EnableScheduling
 @Service
@@ -29,12 +28,6 @@ public void emptyAuthorizationUsersCache() {
         logger.info("emptying authorization users cache");
     }
 
-    @CacheEvict(value = USER_CACHE, allEntries = true)
-    @Scheduled(fixedRateString = "${caching.users.TTL}")
-    public void emptyUsersCache() {
-        logger.info("emptying users cache");
-    }
-
     public void emptyAllCaches() {
         cacheManager.getCacheNames().forEach(cacheName -> {
             cacheManager.getCache(cacheName).clear();
diff --git a/backend/src/main/java/ch/puzzle/okr/service/authorization/ActionAuthorizationService.java b/backend/src/main/java/ch/puzzle/okr/service/authorization/ActionAuthorizationService.java
index 6bf975be3e..a6a54a4de4 100644
--- a/backend/src/main/java/ch/puzzle/okr/service/authorization/ActionAuthorizationService.java
+++ b/backend/src/main/java/ch/puzzle/okr/service/authorization/ActionAuthorizationService.java
@@ -27,7 +27,7 @@ public List<Action> getActionsByKeyResult(KeyResult keyResult) {
     }
 
     public List<Action> createEntities(List<Action> actionList) {
-        AuthorizationUser authorizationUser = authorizationService.getAuthorizationUser();
+        AuthorizationUser authorizationUser = authorizationService.updateOrAddAuthorizationUser();
         actionList.forEach(action -> hasRoleCreateOrUpdate(action, authorizationUser));
         List<Action> savedActions = actionBusinessService.createEntities(actionList);
         savedActions.forEach(action -> action.setWriteable(true));
@@ -35,7 +35,7 @@ public List<Action> createEntities(List<Action> actionList) {
     }
 
     public List<Action> updateEntities(List<Action> actionList) {
-        AuthorizationUser authorizationUser = authorizationService.getAuthorizationUser();
+        AuthorizationUser authorizationUser = authorizationService.updateOrAddAuthorizationUser();
         actionList.forEach(action -> hasRoleCreateOrUpdate(action, authorizationUser));
         List<Action> updatedActions = actionBusinessService.updateEntities(actionList);
         updatedActions.forEach(action -> action.setWriteable(true));
@@ -43,7 +43,7 @@ public List<Action> updateEntities(List<Action> actionList) {
     }
 
     public void deleteActionByActionId(Long actionId) {
-        AuthorizationUser authorizationUser = authorizationService.getAuthorizationUser();
+        AuthorizationUser authorizationUser = authorizationService.updateOrAddAuthorizationUser();
         authorizationService.hasRoleDeleteByActionId(actionId, authorizationUser);
         actionBusinessService.deleteEntityById(actionId);
     }
diff --git a/backend/src/main/java/ch/puzzle/okr/service/authorization/AuthorizationRegistrationService.java b/backend/src/main/java/ch/puzzle/okr/service/authorization/AuthorizationRegistrationService.java
index 8f95370b2c..fc1213b565 100644
--- a/backend/src/main/java/ch/puzzle/okr/service/authorization/AuthorizationRegistrationService.java
+++ b/backend/src/main/java/ch/puzzle/okr/service/authorization/AuthorizationRegistrationService.java
@@ -1,53 +1,69 @@
 package ch.puzzle.okr.service.authorization;
 
-import ch.puzzle.okr.converter.JwtConverterFactory;
-import ch.puzzle.okr.mapper.role.RoleMapperFactory;
 import ch.puzzle.okr.models.User;
 import ch.puzzle.okr.models.authorization.AuthorizationUser;
+import ch.puzzle.okr.multitenancy.TenantConfigProvider;
+import ch.puzzle.okr.multitenancy.TenantContext;
 import ch.puzzle.okr.service.business.UserBusinessService;
-import ch.puzzle.okr.service.persistence.TeamPersistenceService;
-import org.springframework.beans.factory.annotation.Value;
+import jakarta.persistence.EntityNotFoundException;
 import org.springframework.cache.annotation.Cacheable;
-import org.springframework.security.oauth2.jwt.Jwt;
 import org.springframework.stereotype.Service;
 
-import java.util.List;
-
 import static ch.puzzle.okr.SpringCachingConfig.AUTHORIZATION_USER_CACHE;
 
 @Service
 public class AuthorizationRegistrationService {
 
-    @Value("${okr.organisation.name.1stLevel}")
-    private String firstLevelOrganisationName;
-
     private final UserBusinessService userBusinessService;
-    private final TeamPersistenceService teamPersistenceService;
-    private final JwtConverterFactory jwtConverterFactory;
-    private final RoleMapperFactory roleMapperFactory;
+    private final TenantConfigProvider tenantConfigProvider;
+
+    private final UserUpdateHelper helper = new UserUpdateHelper();
 
     public AuthorizationRegistrationService(UserBusinessService userBusinessService,
-            TeamPersistenceService teamPersistenceService, JwtConverterFactory jwtConverterFactory,
-            RoleMapperFactory roleMapperFactory) {
+            TenantConfigProvider tenantConfigProvider) {
         this.userBusinessService = userBusinessService;
-        this.teamPersistenceService = teamPersistenceService;
-        this.jwtConverterFactory = jwtConverterFactory;
-        this.roleMapperFactory = roleMapperFactory;
+        this.tenantConfigProvider = tenantConfigProvider;
     }
 
-    @Cacheable(value = AUTHORIZATION_USER_CACHE, key = "#user.username")
-    public AuthorizationUser registerAuthorizationUser(User user, Jwt token) {
-        List<String> organisationNames = jwtConverterFactory.getJwtOrganisationConverter().convert(token);
-        return new AuthorizationUser(userBusinessService.getOrCreateUser(user), getTeamIds(organisationNames),
-                getFirstLevelTeamIds(),
-                roleMapperFactory.getRoleMapper().mapAuthorizationRoles(organisationNames, user));
+    @Cacheable(value = AUTHORIZATION_USER_CACHE, key = "T(ch.puzzle.okr.SpringCachingConfig).cacheKey(#userFromToken)")
+    public AuthorizationUser updateOrAddAuthorizationUser(User userFromToken) {
+        var userFromDB = userBusinessService.getOrCreateUser(userFromToken);
+        var userFromDBWithTokenData = setFirstLastNameFromToken(userFromDB, userFromToken);
+        var userFromDBWithTokenAndPropertiesData = setOkrChampionFromProperties(userFromDBWithTokenData);
+        userBusinessService.saveUser(userFromDBWithTokenAndPropertiesData);
+        return new AuthorizationUser(userFromDBWithTokenAndPropertiesData);
     }
 
-    private List<Long> getTeamIds(List<String> organisationNames) {
-        return teamPersistenceService.findTeamIdsByOrganisationNames(organisationNames);
+    // firstname and lastname comes from JWT token
+    private User setFirstLastNameFromToken(User userFromDB, User userFromToken) {
+        return helper.setFirstLastNameFromToken(userFromDB, userFromToken);
     }
 
-    private List<Long> getFirstLevelTeamIds() {
-        return teamPersistenceService.findTeamIdsByOrganisationName(firstLevelOrganisationName);
+    // okr champion is set in application properties
+    private User setOkrChampionFromProperties(User user) {
+        TenantConfigProvider.TenantConfig tenantConfig = this.tenantConfigProvider
+                .getTenantConfigById(TenantContext.getCurrentTenant())
+                .orElseThrow(() -> new EntityNotFoundException("Cannot find tenant"));
+
+        return helper.setOkrChampionFromProperties(user, tenantConfig);
     }
+
+    public static class UserUpdateHelper {
+
+        public User setOkrChampionFromProperties(User user, TenantConfigProvider.TenantConfig tenantConfig) {
+            for (var mail : tenantConfig.okrChampionEmails()) {
+                if (mail.trim().equals(user.getEmail())) {
+                    user.setOkrChampion(true);
+                }
+            }
+            return user;
+        }
+
+        public User setFirstLastNameFromToken(User userFromDB, User userFromToken) {
+            userFromDB.setFirstname(userFromToken.getFirstname());
+            userFromDB.setLastname(userFromToken.getLastname());
+            return userFromDB;
+        }
+    }
+
 }
diff --git a/backend/src/main/java/ch/puzzle/okr/service/authorization/AuthorizationService.java b/backend/src/main/java/ch/puzzle/okr/service/authorization/AuthorizationService.java
index df9ff25a9f..699213eb37 100644
--- a/backend/src/main/java/ch/puzzle/okr/service/authorization/AuthorizationService.java
+++ b/backend/src/main/java/ch/puzzle/okr/service/authorization/AuthorizationService.java
@@ -1,6 +1,5 @@
 package ch.puzzle.okr.service.authorization;
 
-import ch.puzzle.okr.converter.JwtConverterFactory;
 import ch.puzzle.okr.exception.OkrResponseStatusException;
 import ch.puzzle.okr.models.Action;
 import ch.puzzle.okr.models.Objective;
@@ -9,6 +8,7 @@
 import ch.puzzle.okr.models.authorization.AuthorizationUser;
 import ch.puzzle.okr.models.checkin.CheckIn;
 import ch.puzzle.okr.models.keyresult.KeyResult;
+import ch.puzzle.okr.security.JwtHelper;
 import ch.puzzle.okr.service.persistence.ActionPersistenceService;
 import ch.puzzle.okr.service.persistence.ObjectivePersistenceService;
 import org.springframework.security.core.Authentication;
@@ -19,7 +19,6 @@
 
 import static ch.puzzle.okr.Constants.*;
 import static ch.puzzle.okr.ErrorKey.*;
-import static ch.puzzle.okr.models.authorization.AuthorizationRole.*;
 
 @Service
 public class AuthorizationService {
@@ -27,51 +26,44 @@ public class AuthorizationService {
     private final AuthorizationRegistrationService authorizationRegistrationService;
     private final ObjectivePersistenceService objectivePersistenceService;
     private final ActionPersistenceService actionPersistenceService;
-    private final JwtConverterFactory jwtConverterFactory;
+    private final JwtHelper jwtHelper;
 
     public AuthorizationService(AuthorizationRegistrationService authorizationRegistrationService,
             ObjectivePersistenceService objectivePersistenceService, ActionPersistenceService actionPersistenceService,
-            JwtConverterFactory jwtConverterFactory) {
+            JwtHelper jwtHelper) {
         this.authorizationRegistrationService = authorizationRegistrationService;
         this.actionPersistenceService = actionPersistenceService;
         this.objectivePersistenceService = objectivePersistenceService;
-        this.jwtConverterFactory = jwtConverterFactory;
+        this.jwtHelper = jwtHelper;
     }
 
-    public static boolean hasRoleReadTeamsDraft(AuthorizationUser user) {
-        return user.roles().contains(READ_TEAMS_DRAFT);
-    }
-
-    public static boolean hasRoleReadTeamDraft(AuthorizationUser user) {
-        return user.roles().contains(READ_TEAM_DRAFT);
-    }
-
-    public static boolean hasRoleReadAllPublished(AuthorizationUser user) {
-        return user.roles().contains(READ_ALL_PUBLISHED);
-    }
-
-    public static boolean hasRoleReadAllDraft(AuthorizationUser user) {
-        return user.roles().contains(READ_ALL_DRAFT);
-    }
-
-    public static boolean hasRoleWriteAll(AuthorizationUser user) {
-        return user.roles().contains(WRITE_ALL);
+    public static boolean hasRoleWriteForTeam(AuthorizationUser authorizationUser, Long teamId) {
+        if (hasRoleWriteAndReadAll(authorizationUser)) {
+            return true;
+        }
+        return authorizationUser.isUserAdminInTeam(teamId);
     }
 
-    public static boolean hasRoleWriteAllTeams(AuthorizationUser user) {
-        return user.roles().contains(WRITE_ALL_TEAMS);
+    public static void checkRoleWriteAndReadAll(AuthorizationUser user,
+            OkrResponseStatusException notAuthorizedException) {
+        if (hasRoleWriteAndReadAll(user)) {
+            return;
+        }
+        throw notAuthorizedException;
     }
 
-    public static boolean hasRoleWriteTeam(AuthorizationUser user) {
-        return user.roles().contains(WRITE_TEAM);
+    public static boolean hasRoleWriteAndReadAll(AuthorizationUser user) {
+        return user.user().isOkrChampion();
     }
 
-    public AuthorizationUser getAuthorizationUser() {
+    public AuthorizationUser updateOrAddAuthorizationUser() {
         SecurityContext securityContext = SecurityContextHolder.getContext();
         Authentication authentication = securityContext.getAuthentication();
         Jwt token = (Jwt) authentication.getPrincipal();
-        User user = jwtConverterFactory.getJwtUserConverter().convert(token);
-        return authorizationRegistrationService.registerAuthorizationUser(user, token);
+
+        User user = jwtHelper.getUserFromJwt(token);
+
+        return authorizationRegistrationService.updateOrAddAuthorizationUser(user);
     }
 
     public void hasRoleReadByObjectiveId(Long objectiveId, AuthorizationUser authorizationUser) {
@@ -91,7 +83,7 @@ public void hasRoleReadByCheckInId(Long checkInId, AuthorizationUser authorizati
 
     public void hasRoleCreateOrUpdate(Objective objective, AuthorizationUser authorizationUser) {
 
-        hasRoleWrite(authorizationUser, objective.getTeam(),
+        hasRoleWriteForTeam(authorizationUser, objective.getTeam(),
                 OkrResponseStatusException.of(NOT_AUTHORIZED_TO_WRITE, OBJECTIVE));
     }
 
@@ -99,7 +91,7 @@ public void hasRoleCreateOrUpdate(KeyResult keyResult, AuthorizationUser authori
         Objective objective = objectivePersistenceService.findObjectiveById(keyResult.getObjective().getId(),
                 authorizationUser, OkrResponseStatusException.of(NOT_AUTHORIZED_TO_READ, KEY_RESULT));
 
-        hasRoleWrite(authorizationUser, objective.getTeam(),
+        hasRoleWriteForTeam(authorizationUser, objective.getTeam(),
                 OkrResponseStatusException.of(NOT_AUTHORIZED_TO_WRITE, KEY_RESULT));
     }
 
@@ -107,32 +99,32 @@ public void hasRoleCreateOrUpdate(CheckIn checkIn, AuthorizationUser authorizati
         Objective objective = objectivePersistenceService.findObjectiveByKeyResultId(checkIn.getKeyResult().getId(),
                 authorizationUser, OkrResponseStatusException.of(NOT_AUTHORIZED_TO_READ, CHECK_IN));
 
-        hasRoleWrite(authorizationUser, objective.getTeam(),
+        hasRoleWriteForTeam(authorizationUser, objective.getTeam(),
                 OkrResponseStatusException.of(NOT_AUTHORIZED_TO_WRITE, CHECK_IN));
     }
 
-    public boolean isWriteable(Objective objective, AuthorizationUser authorizationUser) {
-        return isWriteable(authorizationUser, objective.getTeam());
+    public boolean hasRoleWriteForTeam(Objective objective, AuthorizationUser authorizationUser) {
+        return hasRoleWriteForTeam(authorizationUser, objective.getTeam());
     }
 
-    public boolean isWriteable(KeyResult keyResult, AuthorizationUser authorizationUser) {
+    public boolean hasRoleWriteForTeam(KeyResult keyResult, AuthorizationUser authorizationUser) {
         Objective objective = objectivePersistenceService.findObjectiveById(keyResult.getObjective().getId(),
                 authorizationUser, OkrResponseStatusException.of(NOT_AUTHORIZED_TO_READ, KEY_RESULT));
-        return isWriteable(authorizationUser, objective.getTeam());
+        return hasRoleWriteForTeam(authorizationUser, objective.getTeam());
     }
 
-    public boolean isWriteable(CheckIn checkIn, AuthorizationUser authorizationUser) {
+    public boolean hasRoleWriteForTeam(CheckIn checkIn, AuthorizationUser authorizationUser) {
         Objective objective = objectivePersistenceService.findObjectiveByKeyResultId(checkIn.getKeyResult().getId(),
                 authorizationUser, OkrResponseStatusException.of(NOT_AUTHORIZED_TO_READ, CHECK_IN));
 
-        return isWriteable(authorizationUser, objective.getTeam());
+        return hasRoleWriteForTeam(authorizationUser, objective.getTeam());
     }
 
     public void hasRoleCreateOrUpdateByObjectiveId(Long objectiveId, AuthorizationUser authorizationUser) {
         Objective objective = objectivePersistenceService.findObjectiveById(objectiveId, authorizationUser,
                 OkrResponseStatusException.of(NOT_AUTHORIZED_TO_READ, OBJECTIVE));
 
-        hasRoleWrite(authorizationUser, objective.getTeam(),
+        hasRoleWriteForTeam(authorizationUser, objective.getTeam(),
                 OkrResponseStatusException.of(NOT_AUTHORIZED_TO_WRITE, OBJECTIVE));
     }
 
@@ -140,7 +132,7 @@ public void hasRoleDeleteByObjectiveId(Long objectiveId, AuthorizationUser autho
         Objective objective = objectivePersistenceService.findObjectiveById(objectiveId, authorizationUser,
                 OkrResponseStatusException.of(NOT_AUTHORIZED_TO_READ, OBJECTIVE));
 
-        hasRoleWrite(authorizationUser, objective.getTeam(),
+        hasRoleWriteForTeam(authorizationUser, objective.getTeam(),
                 OkrResponseStatusException.of(NOT_AUTHORIZED_TO_DELETE, OBJECTIVE));
     }
 
@@ -148,13 +140,13 @@ public void hasRoleDeleteByKeyResultId(Long keyResultId, AuthorizationUser autho
         Objective objective = objectivePersistenceService.findObjectiveByKeyResultId(keyResultId, authorizationUser,
                 OkrResponseStatusException.of(NOT_AUTHORIZED_TO_READ, KEY_RESULT));
 
-        hasRoleWrite(authorizationUser, objective.getTeam(),
+        hasRoleWriteForTeam(authorizationUser, objective.getTeam(),
                 OkrResponseStatusException.of(NOT_AUTHORIZED_TO_DELETE, KEY_RESULT));
     }
 
     public void hasRoleDeleteByActionId(Long actionId, AuthorizationUser authorizationUser) {
         Action action = actionPersistenceService.findById(actionId);
-        hasRoleWrite(authorizationUser, action.getKeyResult().getObjective().getTeam(),
+        hasRoleWriteForTeam(authorizationUser, action.getKeyResult().getObjective().getTeam(),
                 OkrResponseStatusException.of(NOT_AUTHORIZED_TO_DELETE, ACTION));
 
     }
@@ -163,28 +155,19 @@ public void hasRoleDeleteByCheckInId(Long checkInId, AuthorizationUser authoriza
         Objective objective = objectivePersistenceService.findObjectiveByCheckInId(checkInId, authorizationUser,
                 OkrResponseStatusException.of(NOT_AUTHORIZED_TO_READ, CHECK_IN));
 
-        hasRoleWrite(authorizationUser, objective.getTeam(),
+        hasRoleWriteForTeam(authorizationUser, objective.getTeam(),
                 OkrResponseStatusException.of(NOT_AUTHORIZED_TO_DELETE, CHECK_IN));
     }
 
-    private void hasRoleWrite(AuthorizationUser authorizationUser, Team team,
+    private void hasRoleWriteForTeam(AuthorizationUser authorizationUser, Team team,
             OkrResponseStatusException notAuthorizedException) {
-        if (isWriteable(authorizationUser, team)) {
+        if (hasRoleWriteForTeam(authorizationUser, team)) {
             return;
         }
         throw notAuthorizedException;
     }
 
-    private boolean isWriteable(AuthorizationUser authorizationUser, Team team) {
-        return isWriteable(authorizationUser, team.getId());
-    }
-
-    public boolean isWriteable(AuthorizationUser authorizationUser, Long teamId) {
-        if (hasRoleWriteAll(authorizationUser)) {
-            return true;
-        } else if (hasRoleWriteAllTeams(authorizationUser) && !authorizationUser.firstLevelTeamIds().contains(teamId)) {
-            return true;
-        } else
-            return hasRoleWriteTeam(authorizationUser) && authorizationUser.userTeamIds().contains(teamId);
+    private boolean hasRoleWriteForTeam(AuthorizationUser authorizationUser, Team team) {
+        return hasRoleWriteForTeam(authorizationUser, team.getId());
     }
 }
diff --git a/backend/src/main/java/ch/puzzle/okr/service/authorization/AuthorizationServiceBase.java b/backend/src/main/java/ch/puzzle/okr/service/authorization/AuthorizationServiceBase.java
index a2c4bc366e..51cd7ab046 100644
--- a/backend/src/main/java/ch/puzzle/okr/service/authorization/AuthorizationServiceBase.java
+++ b/backend/src/main/java/ch/puzzle/okr/service/authorization/AuthorizationServiceBase.java
@@ -31,7 +31,7 @@ protected AuthorizationServiceBase(BusinessServiceInterface<ID, T> businessServi
     protected abstract boolean isWriteable(T entity, AuthorizationUser authorizationUser);
 
     public T getEntityById(ID id) {
-        AuthorizationUser authorizationUser = authorizationService.getAuthorizationUser();
+        AuthorizationUser authorizationUser = authorizationService.updateOrAddAuthorizationUser();
         hasRoleReadById(id, authorizationUser);
         T entity = businessService.getEntityById(id);
         entity.setWriteable(isWriteable(entity, authorizationUser));
@@ -39,7 +39,7 @@ public T getEntityById(ID id) {
     }
 
     public T createEntity(T entity) {
-        AuthorizationUser authorizationUser = authorizationService.getAuthorizationUser();
+        AuthorizationUser authorizationUser = authorizationService.updateOrAddAuthorizationUser();
         hasRoleCreateOrUpdate(entity, authorizationUser);
         T savedEntity = businessService.createEntity(entity, authorizationUser);
         savedEntity.setWriteable(true);
@@ -47,7 +47,7 @@ public T createEntity(T entity) {
     }
 
     public T updateEntity(ID id, T entity) {
-        AuthorizationUser authorizationUser = authorizationService.getAuthorizationUser();
+        AuthorizationUser authorizationUser = authorizationService.updateOrAddAuthorizationUser();
         hasRoleCreateOrUpdate(entity, authorizationUser);
         T updatedEntity = businessService.updateEntity(id, entity, authorizationUser);
         updatedEntity.setWriteable(true);
@@ -55,7 +55,7 @@ public T updateEntity(ID id, T entity) {
     }
 
     public void deleteEntityById(ID id) {
-        AuthorizationUser authorizationUser = authorizationService.getAuthorizationUser();
+        AuthorizationUser authorizationUser = authorizationService.updateOrAddAuthorizationUser();
         hasRoleDeleteById(id, authorizationUser);
         businessService.deleteEntityById(id);
     }
diff --git a/backend/src/main/java/ch/puzzle/okr/service/authorization/CheckInAuthorizationService.java b/backend/src/main/java/ch/puzzle/okr/service/authorization/CheckInAuthorizationService.java
index a883311373..bb6196d6f6 100644
--- a/backend/src/main/java/ch/puzzle/okr/service/authorization/CheckInAuthorizationService.java
+++ b/backend/src/main/java/ch/puzzle/okr/service/authorization/CheckInAuthorizationService.java
@@ -30,6 +30,6 @@ protected void hasRoleDeleteById(Long id, AuthorizationUser authorizationUser) {
 
     @Override
     protected boolean isWriteable(CheckIn entity, AuthorizationUser authorizationUser) {
-        return getAuthorizationService().isWriteable(entity, authorizationUser);
+        return getAuthorizationService().hasRoleWriteForTeam(entity, authorizationUser);
     }
 }
diff --git a/backend/src/main/java/ch/puzzle/okr/service/authorization/CompletedAuthorizationService.java b/backend/src/main/java/ch/puzzle/okr/service/authorization/CompletedAuthorizationService.java
index 6272041249..a59467a3ca 100644
--- a/backend/src/main/java/ch/puzzle/okr/service/authorization/CompletedAuthorizationService.java
+++ b/backend/src/main/java/ch/puzzle/okr/service/authorization/CompletedAuthorizationService.java
@@ -17,13 +17,13 @@ public CompletedAuthorizationService(CompletedBusinessService completedBusinessS
     }
 
     public Completed createCompleted(Completed completed) {
-        AuthorizationUser authorizationUser = authorizationService.getAuthorizationUser();
+        AuthorizationUser authorizationUser = authorizationService.updateOrAddAuthorizationUser();
         authorizationService.hasRoleCreateOrUpdateByObjectiveId(completed.getObjective().getId(), authorizationUser);
         return completedBusinessService.createCompleted(completed);
     }
 
     public void deleteCompletedByObjectiveId(Long objectiveId) {
-        AuthorizationUser authorizationUser = authorizationService.getAuthorizationUser();
+        AuthorizationUser authorizationUser = authorizationService.updateOrAddAuthorizationUser();
         authorizationService.hasRoleDeleteByObjectiveId(objectiveId, authorizationUser);
         completedBusinessService.deleteCompletedByObjectiveId(objectiveId);
     }
diff --git a/backend/src/main/java/ch/puzzle/okr/service/authorization/KeyResultAuthorizationService.java b/backend/src/main/java/ch/puzzle/okr/service/authorization/KeyResultAuthorizationService.java
index edcced39f2..a2197e89b5 100644
--- a/backend/src/main/java/ch/puzzle/okr/service/authorization/KeyResultAuthorizationService.java
+++ b/backend/src/main/java/ch/puzzle/okr/service/authorization/KeyResultAuthorizationService.java
@@ -38,11 +38,11 @@ protected void hasRoleDeleteById(Long id, AuthorizationUser authorizationUser) {
 
     @Override
     protected boolean isWriteable(KeyResult entity, AuthorizationUser authorizationUser) {
-        return getAuthorizationService().isWriteable(entity, authorizationUser);
+        return getAuthorizationService().hasRoleWriteForTeam(entity, authorizationUser);
     }
 
     public List<CheckIn> getAllCheckInsByKeyResult(Long keyResultId) {
-        AuthorizationUser authorizationUser = getAuthorizationService().getAuthorizationUser();
+        AuthorizationUser authorizationUser = getAuthorizationService().updateOrAddAuthorizationUser();
         getAuthorizationService().hasRoleReadByKeyResultId(keyResultId, authorizationUser);
         List<CheckIn> checkIns = getBusinessService().getAllCheckInsByKeyResult(keyResultId);
         setRoleCreateOrUpdateCheckIn(checkIns, authorizationUser);
@@ -56,7 +56,7 @@ public KeyResult updateEntity(Long id, KeyResult keyResult) {
     }
 
     public KeyResultWithActionList updateEntities(Long id, KeyResult entity, List<Action> actionList) {
-        AuthorizationUser authorizationUser = getAuthorizationService().getAuthorizationUser();
+        AuthorizationUser authorizationUser = getAuthorizationService().updateOrAddAuthorizationUser();
         hasRoleCreateOrUpdate(entity, authorizationUser);
         KeyResultWithActionList updatedEntities = getBusinessService().updateEntities(id, entity, actionList);
         updatedEntities.keyResult().setWriteable(true);
@@ -70,7 +70,7 @@ public boolean isImUsed(Long id, KeyResult keyResult) {
 
     private void setRoleCreateOrUpdateCheckIn(List<CheckIn> checkIns, AuthorizationUser authorizationUser) {
         if (!CollectionUtils.isEmpty(checkIns)) {
-            boolean isWriteable = getAuthorizationService().isWriteable(checkIns.get(0), authorizationUser);
+            boolean isWriteable = getAuthorizationService().hasRoleWriteForTeam(checkIns.get(0), authorizationUser);
             checkIns.forEach(c -> c.setWriteable(isWriteable));
         }
     }
diff --git a/backend/src/main/java/ch/puzzle/okr/service/authorization/ObjectiveAuthorizationService.java b/backend/src/main/java/ch/puzzle/okr/service/authorization/ObjectiveAuthorizationService.java
index bb213bf2d8..22dd21de0c 100644
--- a/backend/src/main/java/ch/puzzle/okr/service/authorization/ObjectiveAuthorizationService.java
+++ b/backend/src/main/java/ch/puzzle/okr/service/authorization/ObjectiveAuthorizationService.java
@@ -14,7 +14,7 @@ public ObjectiveAuthorizationService(ObjectiveBusinessService objectiveBusinessS
     }
 
     public Objective duplicateEntity(Long id, Objective objective) {
-        AuthorizationUser authorizationUser = getAuthorizationService().getAuthorizationUser();
+        AuthorizationUser authorizationUser = getAuthorizationService().updateOrAddAuthorizationUser();
         hasRoleCreateOrUpdate(objective, authorizationUser);
         return getBusinessService().duplicateObjective(id, objective, authorizationUser);
     }
@@ -36,7 +36,7 @@ protected void hasRoleDeleteById(Long id, AuthorizationUser authorizationUser) {
 
     @Override
     protected boolean isWriteable(Objective entity, AuthorizationUser authorizationUser) {
-        return getAuthorizationService().isWriteable(entity, authorizationUser);
+        return getAuthorizationService().hasRoleWriteForTeam(entity, authorizationUser);
     }
 
     public boolean isImUsed(Objective objective) {
diff --git a/backend/src/main/java/ch/puzzle/okr/service/authorization/OrganisationAuthorizationService.java b/backend/src/main/java/ch/puzzle/okr/service/authorization/OrganisationAuthorizationService.java
deleted file mode 100644
index 80e61bef37..0000000000
--- a/backend/src/main/java/ch/puzzle/okr/service/authorization/OrganisationAuthorizationService.java
+++ /dev/null
@@ -1,42 +0,0 @@
-package ch.puzzle.okr.service.authorization;
-
-import ch.puzzle.okr.exception.OkrResponseStatusException;
-import ch.puzzle.okr.models.Organisation;
-import ch.puzzle.okr.models.authorization.AuthorizationUser;
-import ch.puzzle.okr.service.business.OrganisationBusinessService;
-import org.springframework.stereotype.Service;
-
-import java.util.List;
-
-import static ch.puzzle.okr.Constants.ORGANISATION;
-import static ch.puzzle.okr.ErrorKey.NOT_AUTHORIZED_TO_READ;
-import static ch.puzzle.okr.service.authorization.AuthorizationService.hasRoleWriteAll;
-
-@Service
-public class OrganisationAuthorizationService {
-    private final OrganisationBusinessService organisationBusinessService;
-    private final AuthorizationService authorizationService;
-
-    public OrganisationAuthorizationService(OrganisationBusinessService organisationBusinessService,
-            AuthorizationService authorizationService) {
-        this.organisationBusinessService = organisationBusinessService;
-        this.authorizationService = authorizationService;
-    }
-
-    public List<Organisation> getEntities() {
-        checkUserAuthorization(OkrResponseStatusException.of(NOT_AUTHORIZED_TO_READ, ORGANISATION));
-        return organisationBusinessService.getActiveOrganisations();
-    }
-
-    public List<Organisation> getEntitiesByTeam(Long id) {
-        checkUserAuthorization(OkrResponseStatusException.of(NOT_AUTHORIZED_TO_READ, ORGANISATION));
-        return organisationBusinessService.getOrganisationsByTeam(id);
-    }
-
-    private void checkUserAuthorization(OkrResponseStatusException exception) {
-        AuthorizationUser authorizationUser = authorizationService.getAuthorizationUser();
-        if (!hasRoleWriteAll(authorizationUser)) {
-            throw exception;
-        }
-    }
-}
diff --git a/backend/src/main/java/ch/puzzle/okr/service/authorization/OverviewAuthorizationService.java b/backend/src/main/java/ch/puzzle/okr/service/authorization/OverviewAuthorizationService.java
index c29550a00f..3f4487b31b 100644
--- a/backend/src/main/java/ch/puzzle/okr/service/authorization/OverviewAuthorizationService.java
+++ b/backend/src/main/java/ch/puzzle/okr/service/authorization/OverviewAuthorizationService.java
@@ -10,7 +10,7 @@
 import java.util.List;
 import java.util.Map;
 
-import static ch.puzzle.okr.service.authorization.AuthorizationService.hasRoleWriteAll;
+import static ch.puzzle.okr.service.authorization.AuthorizationService.hasRoleWriteAndReadAll;
 
 @Service
 public class OverviewAuthorizationService {
@@ -25,7 +25,7 @@ public OverviewAuthorizationService(OverviewBusinessService overviewBusinessServ
     }
 
     public List<Overview> getFilteredOverview(Long quarterId, List<Long> teamIds, String objectiveQuery) {
-        AuthorizationUser authorizationUser = authorizationService.getAuthorizationUser();
+        AuthorizationUser authorizationUser = authorizationService.updateOrAddAuthorizationUser();
         List<Overview> overviews = overviewBusinessService.getFilteredOverview(quarterId, teamIds, objectiveQuery,
                 authorizationUser);
         setRoleCreateOrUpdateTeam(overviews, authorizationUser);
@@ -54,11 +54,11 @@ private boolean hasOverviewTeamIdAndObjectiveId(Overview overview) {
     }
 
     public boolean hasWriteAllAccess() {
-        AuthorizationUser authorizationUser = authorizationService.getAuthorizationUser();
-        return hasRoleWriteAll(authorizationUser);
+        AuthorizationUser authorizationUser = authorizationService.updateOrAddAuthorizationUser();
+        return hasRoleWriteAndReadAll(authorizationUser);
     }
 
     private boolean isWriteable(AuthorizationUser authorizationUser, Overview overview) {
-        return authorizationService.isWriteable(authorizationUser, overview.getOverviewId().getTeamId());
+        return AuthorizationService.hasRoleWriteForTeam(authorizationUser, overview.getOverviewId().getTeamId());
     }
 }
diff --git a/backend/src/main/java/ch/puzzle/okr/service/authorization/TeamAuthorizationService.java b/backend/src/main/java/ch/puzzle/okr/service/authorization/TeamAuthorizationService.java
index a164681f58..33e2cecd33 100644
--- a/backend/src/main/java/ch/puzzle/okr/service/authorization/TeamAuthorizationService.java
+++ b/backend/src/main/java/ch/puzzle/okr/service/authorization/TeamAuthorizationService.java
@@ -10,7 +10,7 @@
 import java.util.List;
 
 import static ch.puzzle.okr.Constants.TEAM;
-import static ch.puzzle.okr.service.authorization.AuthorizationService.hasRoleWriteAll;
+import static ch.puzzle.okr.service.authorization.AuthorizationService.hasRoleWriteAndReadAll;
 
 @Service
 public class TeamAuthorizationService {
@@ -24,40 +24,61 @@ public TeamAuthorizationService(TeamBusinessService teamBusinessService,
     }
 
     public Team createEntity(Team entity) {
-        checkUserAuthorization(OkrResponseStatusException.of(ErrorKey.NOT_AUTHORIZED_TO_WRITE, TEAM));
-        Team savedTeam = teamBusinessService.createTeam(entity);
+        // everybody is allowed to create a new team
+        Team savedTeam = teamBusinessService.createTeam(entity, authorizationService.updateOrAddAuthorizationUser());
         savedTeam.setWriteable(true);
         return savedTeam;
     }
 
     public Team updateEntity(Team entity, Long id) {
-        checkUserAuthorization(OkrResponseStatusException.of(ErrorKey.NOT_AUTHORIZED_TO_WRITE, TEAM));
+        checkUserAuthorization(OkrResponseStatusException.of(ErrorKey.NOT_AUTHORIZED_TO_WRITE, TEAM), entity.getId());
         Team updatedTeam = teamBusinessService.updateTeam(entity, id);
         updatedTeam.setWriteable(true);
         return updatedTeam;
     }
 
     public void deleteEntity(Long id) {
-        checkUserAuthorization(OkrResponseStatusException.of(ErrorKey.NOT_AUTHORIZED_TO_DELETE, TEAM));
+        checkUserAuthorization(OkrResponseStatusException.of(ErrorKey.NOT_AUTHORIZED_TO_DELETE, TEAM), id);
         teamBusinessService.deleteTeam(id);
     }
 
-    private void checkUserAuthorization(OkrResponseStatusException exception) {
-        AuthorizationUser authorizationUser = authorizationService.getAuthorizationUser();
-        if (!hasRoleWriteAll(authorizationUser)) {
-            throw exception;
+    public void addUsersToTeam(long entityId, List<Long> userIdList) {
+        checkUserAuthorization(OkrResponseStatusException.of(ErrorKey.NOT_AUTHORIZED_TO_WRITE, TEAM), entityId);
+        teamBusinessService.addUsersToTeam(entityId, userIdList);
+    }
+
+    private void checkUserAuthorization(OkrResponseStatusException exception, Long teamId) {
+        if (isUserWriteAllowed(teamId)) {
+            return;
         }
+        throw exception;
     }
 
-    public List<Long> getUserTeamIds() {
-        return this.authorizationService.getAuthorizationUser().userTeamIds();
+    public boolean isUserWriteAllowed(Long teamId) {
+        AuthorizationUser authorizationUser = authorizationService.updateOrAddAuthorizationUser();
+        if (hasRoleWriteAndReadAll(authorizationUser)) {
+            return true;
+        }
+        return authorizationUser.isUserAdminInTeam(teamId);
     }
 
     public List<Team> getAllTeams() {
-        AuthorizationUser authorizationUser = authorizationService.getAuthorizationUser();
-        boolean isWritable = hasRoleWriteAll(authorizationUser);
+        AuthorizationUser authorizationUser = authorizationService.updateOrAddAuthorizationUser();
         List<Team> allTeams = teamBusinessService.getAllTeams(authorizationUser);
-        allTeams.forEach(team -> team.setWriteable(isWritable));
+        allTeams.forEach(team -> team.setWriteable(isUserWriteAllowed(team.getId())));
         return allTeams;
     }
+
+    public void removeUserFromTeam(long entityId, long userId) {
+        // user is allowed to remove own membership of any team
+        if (userId != authorizationService.updateOrAddAuthorizationUser().user().getId()) {
+            checkUserAuthorization(OkrResponseStatusException.of(ErrorKey.NOT_AUTHORIZED_TO_WRITE, TEAM), entityId);
+        }
+        teamBusinessService.removeUserFromTeam(entityId, userId);
+    }
+
+    public void updateOrAddTeamMembership(long entityId, long userId, boolean isAdmin) {
+        checkUserAuthorization(OkrResponseStatusException.of(ErrorKey.NOT_AUTHORIZED_TO_WRITE, TEAM), entityId);
+        teamBusinessService.updateOrAddTeamMembership(entityId, userId, isAdmin);
+    }
 }
diff --git a/backend/src/main/java/ch/puzzle/okr/service/authorization/UserAuthorizationService.java b/backend/src/main/java/ch/puzzle/okr/service/authorization/UserAuthorizationService.java
index 24daa70404..2cd0a29259 100644
--- a/backend/src/main/java/ch/puzzle/okr/service/authorization/UserAuthorizationService.java
+++ b/backend/src/main/java/ch/puzzle/okr/service/authorization/UserAuthorizationService.java
@@ -1,30 +1,61 @@
 package ch.puzzle.okr.service.authorization;
 
+import ch.puzzle.okr.ErrorKey;
+import ch.puzzle.okr.exception.OkrResponseStatusException;
 import ch.puzzle.okr.models.User;
-import ch.puzzle.okr.models.authorization.AuthorizationUser;
+import ch.puzzle.okr.models.UserTeam;
 import ch.puzzle.okr.service.business.UserBusinessService;
 import org.springframework.stereotype.Service;
 
 import java.util.List;
 
-import static ch.puzzle.okr.service.authorization.AuthorizationService.hasRoleWriteAll;
+import static ch.puzzle.okr.Constants.USER;
 
 @Service
 public class UserAuthorizationService {
     private final UserBusinessService userBusinessService;
     private final AuthorizationService authorizationService;
 
-    public UserAuthorizationService(UserBusinessService userBusinessService,
-            AuthorizationService authorizationService) {
+    private final TeamAuthorizationService teamAuthorizationService;
+
+    public UserAuthorizationService(UserBusinessService userBusinessService, AuthorizationService authorizationService,
+            TeamAuthorizationService teamAuthorizationService) {
         this.userBusinessService = userBusinessService;
         this.authorizationService = authorizationService;
+        this.teamAuthorizationService = teamAuthorizationService;
     }
 
     public List<User> getAllUsers() {
-        AuthorizationUser authorizationUser = authorizationService.getAuthorizationUser();
-        boolean isWritable = hasRoleWriteAll(authorizationUser);
-        List<User> allUsers = userBusinessService.getAllUsers();
-        allUsers.forEach(user -> user.setWriteable(isWritable));
+        var allUsers = userBusinessService.getAllUsers();
+        allUsers.forEach(this::setTeamWritableForUser);
         return allUsers;
     }
+
+    private void setTeamWritableForUser(User user) {
+        user.getUserTeamList().forEach(this::setTeamWritableForUserTeam);
+    }
+
+    private void setTeamWritableForUserTeam(UserTeam userTeam) {
+        var team = userTeam.getTeam();
+        team.setWriteable(teamAuthorizationService.isUserWriteAllowed(team.getId()));
+    }
+
+    public User getById(long id) {
+        var user = userBusinessService.getUserById(id);
+        setTeamWritableForUser(user);
+        return user;
+    }
+
+    public User setIsOkrChampion(long id, boolean isOkrChampion) {
+        var user = userBusinessService.getUserById(id);
+        AuthorizationService.checkRoleWriteAndReadAll(authorizationService.updateOrAddAuthorizationUser(),
+                OkrResponseStatusException.of(ErrorKey.NOT_AUTHORIZED_TO_WRITE, USER));
+        return userBusinessService.setIsOkrChampion(user, isOkrChampion);
+    }
+
+    public List<User> createUsers(List<User> userList) {
+        AuthorizationService.checkRoleWriteAndReadAll(authorizationService.updateOrAddAuthorizationUser(),
+                OkrResponseStatusException.of(ErrorKey.NOT_AUTHORIZED_TO_WRITE, USER));
+        return userBusinessService.createUsers(userList);
+    }
 }
diff --git a/backend/src/main/java/ch/puzzle/okr/service/business/OrganisationBusinessService.java b/backend/src/main/java/ch/puzzle/okr/service/business/OrganisationBusinessService.java
deleted file mode 100644
index d73e39e4d4..0000000000
--- a/backend/src/main/java/ch/puzzle/okr/service/business/OrganisationBusinessService.java
+++ /dev/null
@@ -1,65 +0,0 @@
-package ch.puzzle.okr.service.business;
-
-import ch.puzzle.okr.mapper.CnAttributesMapper;
-import ch.puzzle.okr.models.Organisation;
-import ch.puzzle.okr.models.OrganisationState;
-import ch.puzzle.okr.service.persistence.OrganisationPersistenceService;
-import org.springframework.beans.factory.annotation.Value;
-import org.springframework.ldap.core.LdapTemplate;
-import org.springframework.ldap.query.LdapQuery;
-import org.springframework.ldap.query.LdapQueryBuilder;
-import org.springframework.scheduling.annotation.Scheduled;
-import org.springframework.stereotype.Service;
-
-import java.util.ArrayList;
-import java.util.List;
-
-@Service
-public class OrganisationBusinessService {
-
-    private final OrganisationPersistenceService persistenceService;
-    private final LdapTemplate ldapTemplate;
-
-    private final CnAttributesMapper cnAttributesMapper;
-
-    @Value("${okr.jwt.claim.organisation.name.prefix}")
-    private String orgPrefix;
-
-    public OrganisationBusinessService(LdapTemplate ldapTemplate, OrganisationPersistenceService persistenceService,
-            CnAttributesMapper cnAttributesMapper) {
-        this.ldapTemplate = ldapTemplate;
-        this.persistenceService = persistenceService;
-        this.cnAttributesMapper = cnAttributesMapper;
-    }
-
-    @Scheduled(cron = "0 0 2 * * *")
-    public void importOrgFromLDAP() {
-        LdapQuery query = LdapQueryBuilder.query().countLimit(10000).base("ou=groups").where("objectClass")
-                .is("groupOfNames").and("cn").like(String.format("%s*", orgPrefix));
-        List<String> organisations = ldapTemplate.search(query, cnAttributesMapper);
-        for (String org : organisations) {
-            persistenceService.saveIfNotExists(
-                    Organisation.Builder.builder().withOrgName(org).withState(OrganisationState.ACTIVE).build());
-        }
-        List<Organisation> existingOrganisations = persistenceService.findAll();
-        List<String> existingOrganisationNames = new ArrayList<>(
-                existingOrganisations.stream().map(Organisation::getOrgName).toList());
-        existingOrganisationNames.removeAll(organisations);
-        for (String orgName : existingOrganisationNames) {
-            persistenceService.updateOrganisationStateToInactive(orgName);
-        }
-    }
-
-    public List<Organisation> getActiveOrganisations() {
-        return persistenceService.getActiveOrganisations();
-    }
-
-    public boolean teamHasInActiveOrganisations(Long teamId) {
-        return !getOrganisationsByTeam(teamId).stream()
-                .filter(organisation -> organisation.getState() == OrganisationState.INACTIVE).toList().isEmpty();
-    }
-
-    public List<Organisation> getOrganisationsByTeam(Long teamId) {
-        return persistenceService.getOrganisationsByTeamId(teamId);
-    }
-}
diff --git a/backend/src/main/java/ch/puzzle/okr/service/business/OverviewBusinessService.java b/backend/src/main/java/ch/puzzle/okr/service/business/OverviewBusinessService.java
index fea6ea6791..da721f6c27 100644
--- a/backend/src/main/java/ch/puzzle/okr/service/business/OverviewBusinessService.java
+++ b/backend/src/main/java/ch/puzzle/okr/service/business/OverviewBusinessService.java
@@ -45,38 +45,23 @@ private List<Overview> sortOverview(List<Overview> overviews, AuthorizationUser
         return overviews;
     }
 
-    record OverviewComparator(AuthorizationUser authorizationUser) implements Comparator<Overview> {
+    private record OverviewComparator(AuthorizationUser authorizationUser) implements Comparator<Overview> {
 
         @Override
         public int compare(Overview o1, Overview o2) {
-            boolean containsUserTeam1 = authorizationUser.userTeamIds().contains(o1.getOverviewId().getTeamId());
-            boolean containsUserTeam2 = authorizationUser.userTeamIds().contains(o2.getOverviewId().getTeamId());
-            boolean containsFirstLevelTeam1 = authorizationUser.firstLevelTeamIds()
-                    .contains(o1.getOverviewId().getTeamId());
-            boolean containsFirstLevelTeam2 = authorizationUser.firstLevelTeamIds()
-                    .contains(o2.getOverviewId().getTeamId());
+            boolean containsUserTeam1 = authorizationUser.isUserMemberInTeam(o1.getOverviewId().getTeamId());
+            boolean containsUserTeam2 = authorizationUser.isUserMemberInTeam(o2.getOverviewId().getTeamId());
 
-            return compare(o1, o2, containsUserTeam1, containsUserTeam2, containsFirstLevelTeam1,
-                    containsFirstLevelTeam2);
-        }
-
-        public int compare(Overview o1, Overview o2, boolean containsUserTeam1, boolean containsUserTeam2,
-                boolean containsFirstLevelTeam1, boolean containsFirstLevelTeam2) {
             if (containsUserTeam1 != containsUserTeam2) {
                 return containsUserTeam1 ? -1 : 1;
             }
-            if (containsFirstLevelTeam1 != containsFirstLevelTeam2) {
-                return containsFirstLevelTeam1 ? -1 : 1;
-            }
             if (!Objects.equals(o1.getTeamName(), o2.getTeamName())) {
                 return o1.getTeamName().compareTo(o2.getTeamName());
             }
-            if (!Objects.equals(o1.getObjectiveCreatedOn(), o2.getObjectiveCreatedOn())) {
-                return o1.getObjectiveCreatedOn().compareTo(o2.getObjectiveCreatedOn());
+            if (Objects.equals(o1.getObjectiveCreatedOn(), o2.getObjectiveCreatedOn())) {
+                return o1.getOverviewId().compareTo(o2.getOverviewId());
             }
-            return o1.getOverviewId().compareTo(o2.getOverviewId());
+            return o1.getObjectiveCreatedOn().compareTo(o2.getObjectiveCreatedOn());
         }
-
     }
-
 }
diff --git a/backend/src/main/java/ch/puzzle/okr/service/business/QuarterBusinessService.java b/backend/src/main/java/ch/puzzle/okr/service/business/QuarterBusinessService.java
index 1fbb86f4fd..5f6c35053b 100644
--- a/backend/src/main/java/ch/puzzle/okr/service/business/QuarterBusinessService.java
+++ b/backend/src/main/java/ch/puzzle/okr/service/business/QuarterBusinessService.java
@@ -16,6 +16,8 @@
 import java.util.List;
 import java.util.Map;
 
+import static ch.puzzle.okr.Constants.BACK_LOG_QUARTER_LABEL;
+
 @Service
 public class QuarterBusinessService {
     private static final Logger logger = LoggerFactory.getLogger(QuarterBusinessService.class);
@@ -42,7 +44,7 @@ public Quarter getQuarterById(Long quarterId) {
 
     public List<Quarter> getQuarters() {
         List<Quarter> mostCurrentQuarterList = quarterPersistenceService.getMostCurrentQuarters();
-        Quarter backlog = quarterPersistenceService.findByLabel("Backlog");
+        Quarter backlog = quarterPersistenceService.findByLabel(BACK_LOG_QUARTER_LABEL);
         mostCurrentQuarterList.add(0, backlog);
         return mostCurrentQuarterList;
     }
diff --git a/backend/src/main/java/ch/puzzle/okr/service/business/TeamBusinessService.java b/backend/src/main/java/ch/puzzle/okr/service/business/TeamBusinessService.java
index d8603ccf22..f05a069673 100644
--- a/backend/src/main/java/ch/puzzle/okr/service/business/TeamBusinessService.java
+++ b/backend/src/main/java/ch/puzzle/okr/service/business/TeamBusinessService.java
@@ -1,10 +1,18 @@
 package ch.puzzle.okr.service.business;
 
+import ch.puzzle.okr.ErrorKey;
+import ch.puzzle.okr.exception.OkrResponseStatusException;
 import ch.puzzle.okr.models.Team;
+import ch.puzzle.okr.models.User;
+import ch.puzzle.okr.models.UserTeam;
 import ch.puzzle.okr.models.authorization.AuthorizationUser;
 import ch.puzzle.okr.service.CacheService;
 import ch.puzzle.okr.service.persistence.TeamPersistenceService;
+import ch.puzzle.okr.service.persistence.UserPersistenceService;
+import ch.puzzle.okr.service.persistence.UserTeamPersistenceService;
 import ch.puzzle.okr.service.validation.TeamValidationService;
+import jakarta.transaction.Transactional;
+import org.springframework.http.HttpStatus;
 import org.springframework.stereotype.Service;
 
 import java.util.ArrayList;
@@ -19,16 +27,23 @@ public class TeamBusinessService {
 
     private final ObjectiveBusinessService objectiveBusinessService;
 
+    private final UserPersistenceService userPersistenceService;
+
+    private final UserTeamPersistenceService userTeamPersistenceService;
+
     private final TeamValidationService validator;
     private final CacheService cacheService;
 
     public TeamBusinessService(TeamPersistenceService teamPersistenceService,
             ObjectiveBusinessService objectiveBusinessService, TeamValidationService validator,
-            CacheService cacheService) {
+            CacheService cacheService, UserPersistenceService userPersistenceService,
+            UserTeamPersistenceService userTeamPersistenceService) {
         this.teamPersistenceService = teamPersistenceService;
         this.objectiveBusinessService = objectiveBusinessService;
+        this.userPersistenceService = userPersistenceService;
         this.validator = validator;
         this.cacheService = cacheService;
+        this.userTeamPersistenceService = userTeamPersistenceService;
     }
 
     public Team getTeamById(Long teamId) {
@@ -36,10 +51,16 @@ public Team getTeamById(Long teamId) {
         return teamPersistenceService.findById(teamId);
     }
 
-    public Team createTeam(Team team) {
+    @Transactional
+    // Creates a new team. Current authorization user is added as admin user in team.
+    public Team createTeam(Team team, AuthorizationUser authorizationUser) {
         validator.validateOnCreate(team);
         cacheService.emptyAuthorizationUsersCache();
-        return teamPersistenceService.save(team);
+        var savedTeam = teamPersistenceService.save(team);
+        var currentUser = authorizationUser.user();
+        addTeamMembership(savedTeam.getId(), true, currentUser, currentUser.getUserTeamList());
+        userPersistenceService.save(currentUser);
+        return savedTeam;
     }
 
     public Team updateTeam(Team team, Long id) {
@@ -48,14 +69,28 @@ public Team updateTeam(Team team, Long id) {
         return teamPersistenceService.save(team);
     }
 
+    @Transactional
     public void deleteTeam(Long id) {
         validator.validateOnDelete(id);
         objectiveBusinessService.getEntitiesByTeamId(id)
                 .forEach(objective -> objectiveBusinessService.deleteEntityById(objective.getId()));
+        deleteUserTeamList(id);
         cacheService.emptyAuthorizationUsersCache();
         teamPersistenceService.deleteById(id);
     }
 
+    private void deleteUserTeamList(Long id) {
+        var team = teamPersistenceService.findById(id);
+        // remove userTeam from each user, otherwise they are still in the session and are not deleted
+        team.getUserTeamList().forEach(userTeam -> {
+            var user = userTeam.getUser();
+            user.getUserTeamList().remove(userTeam);
+        });
+        userTeamPersistenceService.deleteAll(team.getUserTeamList());
+        team.setUserTeamList(List.of());
+        cacheService.emptyAuthorizationUsersCache();
+    }
+
     public List<Team> getAllTeams(AuthorizationUser authorizationUser) {
         List<Team> teams = teamPersistenceService.findAll();
         List<Team> mutableTeams = new ArrayList<>(teams);
@@ -67,26 +102,87 @@ private List<Team> sortTeams(List<Team> teams, AuthorizationUser authorizationUs
         return teams;
     }
 
+    @Transactional
+    public void addUsersToTeam(long teamId, List<Long> userIdList) {
+        var team = teamPersistenceService.findById(teamId);
+        for (var userId : userIdList) {
+            var user = userPersistenceService.findById(userId);
+            var userTeam = UserTeam.Builder.builder().withTeam(team).withUser(user).withTeamAdmin(false).build();
+            user.getUserTeamList().add(userTeam);
+            userPersistenceService.save(user);
+        }
+        cacheService.emptyAuthorizationUsersCache();
+    }
+
+    @Transactional
+    public void removeUserFromTeam(long teamId, long userId) {
+        var user = userPersistenceService.findById(userId);
+        var team = this.teamPersistenceService.findById(teamId);
+
+        checkTeamHasAtLeastOneAdmin(team, user);
+
+        var userTeamList = user.getUserTeamList();
+        var userTeamToRemove = userTeamList.stream().filter(ut -> ut.getTeam().getId() == teamId).findFirst()
+                .orElseThrow(() -> new OkrResponseStatusException(HttpStatus.BAD_REQUEST,
+                        "No team found to remove from userTeam list"));
+        userTeamList.remove(userTeamToRemove);
+        team.getUserTeamList().remove(userTeamToRemove);
+        userTeamPersistenceService.delete(userTeamToRemove);
+        userPersistenceService.save(user);
+        cacheService.emptyAuthorizationUsersCache();
+    }
+
+    private void checkTeamHasAtLeastOneAdmin(Team team, User user) {
+        team.getUserTeamList().stream()
+                .filter(ut -> ut.isTeamAdmin() && !Objects.equals(ut.getUser().getId(), user.getId())).findAny()
+                .orElseThrow(() -> new OkrResponseStatusException(HttpStatus.BAD_REQUEST,
+                        ErrorKey.TRIED_TO_DELETE_LAST_ADMIN));
+    }
+
+    @Transactional
+    public void updateOrAddTeamMembership(long teamId, long userId, boolean isAdmin) {
+        var user = userPersistenceService.findById(userId);
+        List<UserTeam> userTeamList = user.getUserTeamList();
+        for (var ut : userTeamList) {
+            if (ut.getTeam().getId().equals(teamId)) {
+                updateTeamMembership(isAdmin, ut, user);
+                return;
+            }
+        }
+        // if user has no membership to this team, it is added.
+        addTeamMembership(teamId, isAdmin, user, userTeamList);
+        userPersistenceService.save(user);
+        cacheService.emptyAuthorizationUsersCache();
+    }
+
+    private void updateTeamMembership(boolean isAdmin, UserTeam ut, User user) {
+        if (!isAdmin) {
+            checkTeamHasAtLeastOneAdmin(ut.getTeam(), user);
+        }
+        ut.setTeamAdmin(isAdmin);
+        userPersistenceService.save(user);
+        cacheService.emptyAuthorizationUsersCache();
+    }
+
+    private void addTeamMembership(long teamId, boolean isAdmin, User user, List<UserTeam> userTeamList) {
+        var team = teamPersistenceService.findById(teamId);
+        var userTeam = UserTeam.Builder.builder().withTeam(team).withTeamAdmin(isAdmin).withUser(user).build();
+        userTeamList.add(userTeam);
+    }
+
     private record TeamComparator(AuthorizationUser authorizationUser) implements Comparator<Team> {
         @Override
         public int compare(Team t1, Team t2) {
-            boolean isUserTeam1 = authorizationUser.userTeamIds().contains(t1.getId());
-            boolean isUserTeam2 = authorizationUser.userTeamIds().contains(t2.getId());
-            boolean isFirstLevelTeam1 = authorizationUser.firstLevelTeamIds().contains(t1.getId());
-            boolean isFirstLevelTeam2 = authorizationUser.firstLevelTeamIds().contains(t2.getId());
-
-            if (isUserTeam1 == isUserTeam2) {
-                if (isFirstLevelTeam1 == isFirstLevelTeam2) {
-                    if (Objects.equals(t1.getName(), t2.getName())) {
-                        return t1.getId().compareTo(t2.getId());
-                    } else {
-                        return t1.getName().compareTo(t2.getName());
-                    }
-                } else {
-                    return isFirstLevelTeam1 && !isFirstLevelTeam2 ? -1 : 1;
-                }
+            boolean isUserTeam1 = authorizationUser.isUserMemberInTeam(t1.getId());
+            boolean isUserTeam2 = authorizationUser.isUserMemberInTeam(t2.getId());
+
+            if (isUserTeam1 != isUserTeam2) {
+                return isUserTeam1 ? -1 : 1;
+            }
+            if (Objects.equals(t1.getName(), t2.getName())) {
+                return t1.getId().compareTo(t2.getId());
             }
-            return isUserTeam1 && !isUserTeam2 ? -1 : 1;
+            return t1.getName().compareTo(t2.getName());
         }
     }
 }
diff --git a/backend/src/main/java/ch/puzzle/okr/service/business/UserBusinessService.java b/backend/src/main/java/ch/puzzle/okr/service/business/UserBusinessService.java
index b4aea5498f..6155e4fd0d 100644
--- a/backend/src/main/java/ch/puzzle/okr/service/business/UserBusinessService.java
+++ b/backend/src/main/java/ch/puzzle/okr/service/business/UserBusinessService.java
@@ -1,11 +1,18 @@
 package ch.puzzle.okr.service.business;
 
+import ch.puzzle.okr.ErrorKey;
+import ch.puzzle.okr.exception.OkrResponseStatusException;
 import ch.puzzle.okr.models.User;
+import ch.puzzle.okr.service.CacheService;
 import ch.puzzle.okr.service.persistence.UserPersistenceService;
 import ch.puzzle.okr.service.validation.UserValidationService;
+import jakarta.transaction.Transactional;
+import org.springframework.http.HttpStatus;
 import org.springframework.stereotype.Service;
 
 import java.util.List;
+import java.util.Objects;
+import java.util.stream.StreamSupport;
 
 @Service
 public class UserBusinessService {
@@ -14,16 +21,20 @@ public class UserBusinessService {
 
     private final UserValidationService validationService;
 
-    public UserBusinessService(UserPersistenceService userPersistenceService, UserValidationService validationService) {
+    private final CacheService cacheService;
+
+    public UserBusinessService(UserPersistenceService userPersistenceService, UserValidationService validationService,
+            CacheService cacheService) {
         this.userPersistenceService = userPersistenceService;
         this.validationService = validationService;
+        this.cacheService = cacheService;
     }
 
     public List<User> getAllUsers() {
         return userPersistenceService.findAll();
     }
 
-    public User getOwnerById(Long ownerId) {
+    public User getUserById(Long ownerId) {
         return userPersistenceService.findById(ownerId);
     }
 
@@ -31,4 +42,31 @@ public User getOrCreateUser(User user) {
         validationService.validateOnGetOrCreate(user);
         return userPersistenceService.getOrCreateUser(user);
     }
+
+    public User setIsOkrChampion(User user, boolean okrChampion) {
+        if (!okrChampion) {
+            checkAtLeastOneOkrChampionExists(user);
+        }
+        user.setOkrChampion(okrChampion);
+        cacheService.emptyAuthorizationUsersCache();
+        return userPersistenceService.save(user);
+    }
+
+    // checks if at least one okr champion remains after removing given one
+    private void checkAtLeastOneOkrChampionExists(User user) {
+        var champions = userPersistenceService.findAllOkrChampions();
+        champions.stream().filter(c -> c.isOkrChampion() && !Objects.equals(c.getId(), user.getId())).findAny()
+                .orElseThrow(() -> new OkrResponseStatusException(HttpStatus.BAD_REQUEST,
+                        ErrorKey.TRIED_TO_REMOVE_LAST_OKR_CHAMPION));
+    }
+
+    public User saveUser(User user) {
+        return userPersistenceService.save(user);
+    }
+
+    @Transactional
+    public List<User> createUsers(List<User> userList) {
+        var userIter = userPersistenceService.saveAll(userList);
+        return StreamSupport.stream(userIter.spliterator(), false).toList();
+    }
 }
diff --git a/backend/src/main/java/ch/puzzle/okr/service/clientconfig/ClientConfigService.java b/backend/src/main/java/ch/puzzle/okr/service/clientconfig/ClientConfigService.java
index f06c7ca325..16f4c1c4da 100644
--- a/backend/src/main/java/ch/puzzle/okr/service/clientconfig/ClientConfigService.java
+++ b/backend/src/main/java/ch/puzzle/okr/service/clientconfig/ClientConfigService.java
@@ -1,31 +1,90 @@
 package ch.puzzle.okr.service.clientconfig;
 
 import ch.puzzle.okr.dto.ClientConfigDto;
+import ch.puzzle.okr.multitenancy.TenantConfigProvider;
+import ch.puzzle.okr.multitenancy.customization.TenantClientCustomization;
+import ch.puzzle.okr.multitenancy.customization.TenantClientCustomizationProvider;
+import jakarta.persistence.EntityNotFoundException;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 import org.springframework.beans.factory.annotation.Value;
 import org.springframework.stereotype.Service;
 
+import java.text.MessageFormat;
+import java.util.Optional;
+
 @Service
 public class ClientConfigService {
 
-    @Value("${spring.security.oauth2.resourceserver.jwt.issuer-uri}")
-    private String issuer;
+    private static final Logger logger = LoggerFactory.getLogger(ClientConfigService.class);
+    private final TenantClientCustomizationProvider tenantClientCustomizationProvider;
+    private final TenantConfigProvider tenantConfigProvider;
 
     @Value("${spring.profiles.active}")
     private String activeProfile;
 
-    @Value("${spring.security.oauth2.resourceserver.opaquetoken.client-id}")
-    private String clientId;
+    public ClientConfigService(final TenantClientCustomizationProvider clientCustomizationProvider,
+            final TenantConfigProvider tenantConfigProvider) {
+        this.tenantConfigProvider = tenantConfigProvider;
+        this.tenantClientCustomizationProvider = clientCustomizationProvider;
+    }
+
+    public ClientConfigDto getConfigBasedOnActiveEnv(String hostName) {
+        String subdomain = hostName.split("\\.")[0];
+        String domainPrefixByHyphen = hostName.split("-")[0];
+
+        Optional<TenantConfigProvider.TenantConfig> tenantConfig = getTenantConfig(hostName, subdomain,
+                domainPrefixByHyphen);
 
-    private final ClientCustomizationProperties clientCustomizationProperties;
+        if (tenantConfig.isEmpty()) {
+            throw new EntityNotFoundException(
+                    MessageFormat.format("Could not find tenant config for subdomain:{0}", subdomain));
+        }
 
-    public ClientConfigService(ClientCustomizationProperties clientCustomizationProperties) {
-        this.clientCustomizationProperties = clientCustomizationProperties;
+        Optional<TenantClientCustomization> tenantClientCustomization = getTenantClientCustomization(hostName,
+                subdomain, domainPrefixByHyphen);
+
+        if (tenantClientCustomization.isEmpty()) {
+            throw new EntityNotFoundException(
+                    MessageFormat.format("Could not find tenant client customization for subdomain:{0}", subdomain));
+        }
+
+        return new ClientConfigDto(activeProfile, //
+                tenantConfig.get().issuerUrl(), //
+                tenantConfig.get().clientId(), //
+                tenantClientCustomization.get().favicon(), //
+                tenantClientCustomization.get().logo(), //
+                tenantClientCustomization.get().triangles(), //
+                tenantClientCustomization.get().backgroundLogo(), //
+                tenantClientCustomization.get().title(), //
+                tenantClientCustomization.get().customStyles()); //
     }
 
-    public ClientConfigDto getConfigBasedOnActiveEnv() {
-        return new ClientConfigDto(activeProfile, issuer, clientId, this.clientCustomizationProperties.getFavicon(),
-                this.clientCustomizationProperties.getLogo(), this.clientCustomizationProperties.getTitle(),
-                this.clientCustomizationProperties.getCustomStyles());
+    private Optional<TenantConfigProvider.TenantConfig> getTenantConfig(String hostname, String... tenantsFromUrl) {
+        for (String tenant : tenantsFromUrl) {
+            Optional<TenantConfigProvider.TenantConfig> tenantConfig = tenantConfigProvider.getTenantConfigById(tenant);
+            if (tenantConfig.isPresent()) {
+                logger.info("get config for " + tenant + ": OK");
+                return tenantConfig;
+            }
+            logger.info("get config found for " + tenant + ": failed");
+        }
+        logger.info("no config found for " + hostname + ": failed");
+        return Optional.empty();
     }
 
+    private Optional<TenantClientCustomization> getTenantClientCustomization(String hostname,
+            String... tenantsFromUrl) {
+        for (String tenant : tenantsFromUrl) {
+            Optional<TenantClientCustomization> tenantCustomization = tenantClientCustomizationProvider
+                    .getTenantClientCustomizationsById(tenant);
+            if (tenantCustomization.isPresent()) {
+                logger.info("get client customization for " + tenant + ": OK");
+                return tenantCustomization;
+            }
+            logger.info("get client customization for " + tenant + ": failed");
+        }
+        logger.info("no client customization found for " + hostname + ": failed");
+        return Optional.empty();
+    }
 }
diff --git a/backend/src/main/java/ch/puzzle/okr/service/clientconfig/ClientCustomizationProperties.java b/backend/src/main/java/ch/puzzle/okr/service/clientconfig/ClientCustomizationProperties.java
deleted file mode 100644
index a992b4d8ab..0000000000
--- a/backend/src/main/java/ch/puzzle/okr/service/clientconfig/ClientCustomizationProperties.java
+++ /dev/null
@@ -1,45 +0,0 @@
-package ch.puzzle.okr.service.clientconfig;
-
-import org.springframework.boot.context.properties.ConfigurationProperties;
-
-import java.util.HashMap;
-
-@ConfigurationProperties("okr.clientcustomization")
-public class ClientCustomizationProperties {
-    private String favicon;
-    private String logo;
-    private String title;
-    private HashMap<String, String> customStyles = new HashMap<>();
-
-    public void setCustomStyles(HashMap<String, String> customStyles) {
-        this.customStyles = customStyles;
-    }
-
-    public String getFavicon() {
-        return favicon;
-    }
-
-    public void setFavicon(String favicon) {
-        this.favicon = favicon;
-    }
-
-    public String getLogo() {
-        return logo;
-    }
-
-    public void setLogo(String logo) {
-        this.logo = logo;
-    }
-
-    public HashMap<String, String> getCustomStyles() {
-        return customStyles;
-    }
-
-    public String getTitle() {
-        return title;
-    }
-
-    public void setTitle(String title) {
-        this.title = title;
-    }
-}
diff --git a/backend/src/main/java/ch/puzzle/okr/service/persistence/AuthorizationCriteria.java b/backend/src/main/java/ch/puzzle/okr/service/persistence/AuthorizationCriteria.java
index fd95d0e682..50649665db 100644
--- a/backend/src/main/java/ch/puzzle/okr/service/persistence/AuthorizationCriteria.java
+++ b/backend/src/main/java/ch/puzzle/okr/service/persistence/AuthorizationCriteria.java
@@ -9,18 +9,16 @@
 import java.util.List;
 
 import static ch.puzzle.okr.models.State.*;
-import static ch.puzzle.okr.service.authorization.AuthorizationService.*;
+import static ch.puzzle.okr.service.authorization.AuthorizationService.hasRoleWriteAndReadAll;
 import static java.lang.String.format;
 
 @Component
 public class AuthorizationCriteria<T> {
 
     private static final String PARAM_ALL_DRAFT_STATE = "allDraftState";
-    private static final String PARAM_FIRST_LEVEL_TEAM_IDS = "firstLevelTeamIds";
     private static final String PARAM_OBJECTIVE_QUERY = "objectiveQuery";
     private static final String PARAM_PUBLISHED_STATES = "publishedStates";
     private static final String PARAM_TEAM_DRAFT_STATE = "teamDraftState";
-    private static final String PARAM_TEAMS_DRAFT_STATE = "teamsDraftState";
     private static final String PARAM_TEAM_IDS = "teamIds";
     private static final String PARAM_USER_TEAM_IDS = "userTeamIds";
 
@@ -48,20 +46,15 @@ public String appendObjective(AuthorizationUser user) {
 
     private String append(AuthorizationUser user, String alias, String stateColumn, String teamIdColumn) {
         StringBuilder sb = new StringBuilder(256);
-        if (hasRoleReadAllDraft(user)) {
+        if (hasRoleWriteAndReadAll(user)) {
             sb.append(format(" or %s.%s=:%s", alias, stateColumn, PARAM_ALL_DRAFT_STATE));
-        }
-        if (hasRoleReadAllPublished(user)) {
-            sb.append(format(" or %s.%s IN (:%s)", alias, stateColumn, PARAM_PUBLISHED_STATES));
-        }
-        if (hasRoleReadTeamDraft(user)) {
-            sb.append(format(" or %s.%s=:%s and %s.%s IN (:%s)", alias, stateColumn, PARAM_TEAM_DRAFT_STATE, alias,
+        } else {
+            // users can read draft state of teams with admin role
+            sb.append(format(" or (%s.%s=:%s and %s.%s IN (:%s))", alias, stateColumn, PARAM_TEAM_DRAFT_STATE, alias,
                     teamIdColumn, PARAM_USER_TEAM_IDS));
         }
-        if (hasRoleReadTeamsDraft(user)) {
-            sb.append(format(" or %s.%s=:%s and %s.%s NOT IN (:%s)", alias, stateColumn, PARAM_TEAMS_DRAFT_STATE, alias,
-                    teamIdColumn, PARAM_FIRST_LEVEL_TEAM_IDS));
-        }
+        // all users can read published state
+        sb.append(format(" or %s.%s IN (:%s)", alias, stateColumn, PARAM_PUBLISHED_STATES));
         if (!sb.isEmpty()) {
             sb.delete(0, 4).insert(0, " and (").append(")");
         }
@@ -80,20 +73,13 @@ public void setParameters(TypedQuery<T> typedQuery, List<Long> teamIds, String o
     }
 
     public void setParameters(TypedQuery<T> typedQuery, AuthorizationUser user) {
-        if (hasRoleReadAllDraft(user)) {
+        if (hasRoleWriteAndReadAll(user)) {
             typedQuery.setParameter(PARAM_ALL_DRAFT_STATE, DRAFT);
-        }
-        if (hasRoleReadAllPublished(user)) {
-            typedQuery.setParameter(PARAM_PUBLISHED_STATES, List.of(ONGOING, SUCCESSFUL, NOTSUCCESSFUL));
-        }
-        if (hasRoleReadTeamDraft(user)) {
+        } else {
             typedQuery.setParameter(PARAM_TEAM_DRAFT_STATE, DRAFT);
-            typedQuery.setParameter(PARAM_USER_TEAM_IDS, user.userTeamIds());
-        }
-        if (hasRoleReadTeamsDraft(user)) {
-            typedQuery.setParameter(PARAM_TEAMS_DRAFT_STATE, DRAFT);
-            typedQuery.setParameter(PARAM_FIRST_LEVEL_TEAM_IDS, user.firstLevelTeamIds());
+            typedQuery.setParameter(PARAM_USER_TEAM_IDS, user.extractTeamIds());
         }
+        typedQuery.setParameter(PARAM_PUBLISHED_STATES, List.of(ONGOING, SUCCESSFUL, NOTSUCCESSFUL));
     }
 
     private static boolean shouldAddTeamFilter(List<Long> teamIds) {
diff --git a/backend/src/main/java/ch/puzzle/okr/service/persistence/OrganisationPersistenceService.java b/backend/src/main/java/ch/puzzle/okr/service/persistence/OrganisationPersistenceService.java
deleted file mode 100644
index cf76da6f0e..0000000000
--- a/backend/src/main/java/ch/puzzle/okr/service/persistence/OrganisationPersistenceService.java
+++ /dev/null
@@ -1,44 +0,0 @@
-package ch.puzzle.okr.service.persistence;
-
-import ch.puzzle.okr.models.Organisation;
-import ch.puzzle.okr.models.OrganisationState;
-import ch.puzzle.okr.repository.OrganisationRepository;
-import org.springframework.stereotype.Service;
-
-import java.util.List;
-
-import static ch.puzzle.okr.Constants.ORGANISATION;
-
-@Service
-public class OrganisationPersistenceService extends PersistenceBase<Organisation, Long, OrganisationRepository> {
-
-    protected OrganisationPersistenceService(OrganisationRepository repository) {
-        super(repository);
-    }
-
-    @Override
-    public String getModelName() {
-        return ORGANISATION;
-    }
-
-    public Organisation saveIfNotExists(Organisation org) {
-        if (!getRepository().existsOrganisationByOrgName(org.getOrgName())) {
-            return getRepository().save(org);
-        }
-        return null;
-    }
-
-    public void updateOrganisationStateToInactive(String orgName) {
-        Organisation orgInactive = getRepository().findByOrgName(orgName);
-        orgInactive.setState(OrganisationState.INACTIVE);
-        getRepository().save(orgInactive);
-    }
-
-    public List<Organisation> getOrganisationsByTeamId(Long teamId) {
-        return getRepository().findOrganisationsByTeamId(teamId);
-    }
-
-    public List<Organisation> getActiveOrganisations() {
-        return getRepository().findOrganisationsByState(OrganisationState.ACTIVE);
-    }
-}
diff --git a/backend/src/main/java/ch/puzzle/okr/service/persistence/UserPersistenceService.java b/backend/src/main/java/ch/puzzle/okr/service/persistence/UserPersistenceService.java
index 73a6b3fbdd..6d5befc699 100644
--- a/backend/src/main/java/ch/puzzle/okr/service/persistence/UserPersistenceService.java
+++ b/backend/src/main/java/ch/puzzle/okr/service/persistence/UserPersistenceService.java
@@ -2,13 +2,12 @@
 
 import ch.puzzle.okr.models.User;
 import ch.puzzle.okr.repository.UserRepository;
-import org.springframework.cache.annotation.Cacheable;
 import org.springframework.stereotype.Service;
 
+import java.util.List;
 import java.util.Optional;
 
 import static ch.puzzle.okr.Constants.USER;
-import static ch.puzzle.okr.SpringCachingConfig.USER_CACHE;
 
 @Service
 public class UserPersistenceService extends PersistenceBase<User, Long, UserRepository> {
@@ -21,9 +20,27 @@ public String getModelName() {
         return USER;
     }
 
-    @Cacheable(value = USER_CACHE, key = "#user.username")
     public synchronized User getOrCreateUser(User user) {
-        Optional<User> savedUser = getRepository().findByUsername(user.getUsername());
+        Optional<User> savedUser = getRepository().findByEmail(user.getEmail());
         return savedUser.orElseGet(() -> getRepository().save(user));
     }
+
+    public Optional<User> findByEmail(String email) {
+        return getRepository().findByEmail(email);
+    }
+
+    public User save(User user) {
+        if (user.getUserTeamList() == null) {
+            user.setUserTeamList(List.of());
+        }
+        return getRepository().save(user);
+    }
+
+    public List<User> findAllOkrChampions() {
+        return getRepository().findByIsOkrChampion(true);
+    }
+
+    public Iterable<User> saveAll(List<User> userList) {
+        return getRepository().saveAll(userList);
+    }
 }
diff --git a/backend/src/main/java/ch/puzzle/okr/service/persistence/UserTeamPersistenceService.java b/backend/src/main/java/ch/puzzle/okr/service/persistence/UserTeamPersistenceService.java
new file mode 100644
index 0000000000..326feabe4d
--- /dev/null
+++ b/backend/src/main/java/ch/puzzle/okr/service/persistence/UserTeamPersistenceService.java
@@ -0,0 +1,29 @@
+package ch.puzzle.okr.service.persistence;
+
+import ch.puzzle.okr.models.UserTeam;
+import ch.puzzle.okr.repository.UserTeamRepository;
+import org.springframework.stereotype.Service;
+
+import java.util.List;
+
+import static ch.puzzle.okr.Constants.USER_TEAM;
+
+@Service
+public class UserTeamPersistenceService extends PersistenceBase<UserTeam, Long, UserTeamRepository> {
+    protected UserTeamPersistenceService(UserTeamRepository repository) {
+        super(repository);
+    }
+
+    public void delete(UserTeam userTeam) {
+        getRepository().delete(userTeam);
+    }
+
+    public void deleteAll(List<UserTeam> userTeamList) {
+        getRepository().deleteAll(userTeamList);
+    }
+
+    @Override
+    public String getModelName() {
+        return USER_TEAM;
+    }
+}
diff --git a/backend/src/main/java/ch/puzzle/okr/service/validation/ObjectiveValidationService.java b/backend/src/main/java/ch/puzzle/okr/service/validation/ObjectiveValidationService.java
index a8fa5f59de..72f518c738 100644
--- a/backend/src/main/java/ch/puzzle/okr/service/validation/ObjectiveValidationService.java
+++ b/backend/src/main/java/ch/puzzle/okr/service/validation/ObjectiveValidationService.java
@@ -76,7 +76,7 @@ private void throwExceptionWhenNotDraftInBacklogQuarter(Objective model) {
     }
 
     private boolean isInvalidBacklogObjective(Objective model) {
-        return model.getQuarter().getLabel().equals("Backlog") //
+        return model.getQuarter().getLabel().equals(BACK_LOG_QUARTER_LABEL) //
                 && model.getQuarter().getStartDate() == null //
                 && model.getQuarter().getEndDate() == null //
                 && (model.getState() != State.DRAFT);
diff --git a/backend/src/main/java/ch/puzzle/okr/service/validation/QuarterValidationService.java b/backend/src/main/java/ch/puzzle/okr/service/validation/QuarterValidationService.java
index e129abac70..baa9df7252 100644
--- a/backend/src/main/java/ch/puzzle/okr/service/validation/QuarterValidationService.java
+++ b/backend/src/main/java/ch/puzzle/okr/service/validation/QuarterValidationService.java
@@ -10,6 +10,8 @@
 
 import java.util.List;
 
+import static ch.puzzle.okr.Constants.BACK_LOG_QUARTER_LABEL;
+
 @Service
 public class QuarterValidationService
         extends ValidationBase<Quarter, Long, QuarterRepository, QuarterPersistenceService> {
@@ -29,7 +31,7 @@ public void validateOnUpdate(Long id, Quarter model) {
     }
 
     public static void throwExceptionWhenStartEndDateQuarterIsNull(Quarter model) {
-        if (!model.getLabel().equals("Backlog")) {
+        if (!model.getLabel().equals(BACK_LOG_QUARTER_LABEL)) {
             if (model.getStartDate() == null) {
                 throw new OkrResponseStatusException(HttpStatus.BAD_REQUEST, ErrorKey.ATTRIBUTE_NULL,
                         List.of("StartDate", model.getLabel()));
diff --git a/backend/src/main/resources/application-demo.properties b/backend/src/main/resources/application-demo.properties
index edc02179a2..df1d6b0278 100644
--- a/backend/src/main/resources/application-demo.properties
+++ b/backend/src/main/resources/application-demo.properties
@@ -4,7 +4,22 @@ logging.level.org.springframework=debug
 spring.security.oauth2.resourceserver.opaquetoken.client-id=pitc_okr_demo
 
 # flyway fill database with demo data
-spring.flyway.locations=classpath:db/migration,classpath:db/data-migration-demo,classpath:db/callback
+spring.flyway.locations=classpath:db/migration
 
-okr.user.champion.usernames=peggimann
-okr.clientcustomization.customstyles.okr-topbar-background-color=#fa8072
+# pit client customization
+okr.tenants.pitc.clientcustomization.logo=assets/images/okr-logo.svg
+okr.tenants.pitc.clientcustomization.triangles=assets/images/triangles-okr-header.svg
+okr.tenants.pitc.clientcustomization.background-logo=assets/images/puzzle-p.svg
+okr.tenants.pitc.clientcustomization.favicon=assets/favicon.png
+okr.tenants.pitc.clientcustomization.title=Puzzle OKR
+okr.tenants.pitc.clientcustomization.customstyles.okr-topbar-background-color=#1e5a96
+okr.tenants.pitc.clientcustomization.customstyles.okr-banner-background-color=#dcedf9
+
+# acme client customization
+okr.tenants.acme.clientcustomization.logo=assets/images/okr-logo-acme.svg
+okr.tenants.acme.clientcustomization.triangles=assets/images/triangles-okr-acme-header.svg
+okr.tenants.acme.clientcustomization.background-logo=assets/images/acme.svg
+okr.tenants.acme.clientcustomization.favicon=assets/favicon-acme.png
+okr.tenants.acme.clientcustomization.title=ACME OKR
+okr.tenants.acme.clientcustomization.customstyles.okr-topbar-background-color=#738290
+okr.tenants.acme.clientcustomization.customstyles.okr-banner-background-color=#F2F2F2
diff --git a/backend/src/main/resources/application-dev.properties b/backend/src/main/resources/application-dev.properties
index 24f3f259d7..b995d8a397 100644
--- a/backend/src/main/resources/application-dev.properties
+++ b/backend/src/main/resources/application-dev.properties
@@ -9,8 +9,53 @@ logging.level.org.springframework.security=DEBUG
 # flyway fill database with data
 spring.flyway.locations=classpath:db/migration,classpath:db/data-migration,classpath:db/callback
 
-spring.security.oauth2.resourceserver.jwt.issuer-uri=http://localhost:8544/realms/pitc
-spring.security.oauth2.resourceserver.jwt.jwk-set-uri=http://localhost:8544/realms/pitc/protocol/openid-connect/certs
-spring.security.oauth2.resourceserver.opaquetoken.client-id=pitc_okr_staging
+# TENANT Configuration
+okr.tenant-ids=pitc,acme
+okr.datasource.driver-class-name=org.postgresql.Driver
 
-okr.user.champion.usernames=member
+# security
+connect.src=http://localhost:8544 http://localhost:8545
+
+# hibernate
+hibernate.connection.url=jdbc:postgresql://localhost:5432/okr
+hibernate.connection.username=user
+hibernate.connection.password=pwd
+hibernate.multiTenancy=SCHEMA
+
+# pitc
+okr.tenants.pitc.datasource.url=jdbc:postgresql://localhost:5432/okr
+okr.tenants.pitc.datasource.username=pitc
+okr.tenants.pitc.datasource.password=pwd
+okr.tenants.pitc.datasource.schema=okr_pitc
+okr.tenants.pitc.user.champion.emails=gl@gl.com
+okr.tenants.pitc.security.oauth2.resourceserver.jwt.jwk-set-uri=http://localhost:8544/realms/pitc/protocol/openid-connect/certs
+okr.tenants.pitc.security.oauth2.frontend.issuer-url=http://localhost:8544/realms/pitc
+okr.tenants.pitc.security.oauth2.frontend.client-id=pitc_okr_staging
+
+# acme
+okr.tenants.acme.datasource.url=jdbc:postgresql://localhost:5432/okr
+okr.tenants.acme.datasource.username=acme
+okr.tenants.acme.datasource.password=pwd
+okr.tenants.acme.datasource.schema=okr_acme
+okr.tenants.acme.user.champion.emails=gl@acme.com
+okr.tenants.acme.security.oauth2.resourceserver.jwt.jwk-set-uri=http://localhost:8545/realms/acme/protocol/openid-connect/certs
+okr.tenants.acme.security.oauth2.frontend.issuer-url=http://localhost:8545/realms/acme
+okr.tenants.acme.security.oauth2.frontend.client-id=acme_okr_staging
+
+# pit client customization
+okr.tenants.pitc.clientcustomization.logo=assets/images/okr-logo.svg
+okr.tenants.pitc.clientcustomization.triangles=assets/images/triangles-okr-header.svg
+okr.tenants.pitc.clientcustomization.background-logo=assets/images/puzzle-p.svg
+okr.tenants.pitc.clientcustomization.favicon=assets/favicon.png
+okr.tenants.pitc.clientcustomization.title=Puzzle OKR
+okr.tenants.pitc.clientcustomization.customstyles.okr-topbar-background-color=#1e5a96
+okr.tenants.pitc.clientcustomization.customstyles.okr-banner-background-color=#dcedf9
+
+# acme client customization
+okr.tenants.acme.clientcustomization.logo=assets/images/okr-logo-acme.svg
+okr.tenants.acme.clientcustomization.triangles=assets/images/triangles-okr-acme-header.svg
+okr.tenants.acme.clientcustomization.background-logo=assets/images/acme.svg
+okr.tenants.acme.clientcustomization.favicon=assets/favicon-acme.png
+okr.tenants.acme.clientcustomization.title=ACME OKR
+okr.tenants.acme.clientcustomization.customstyles.okr-topbar-background-color=#738290
+okr.tenants.acme.clientcustomization.customstyles.okr-banner-background-color=#F2F2F2
diff --git a/backend/src/main/resources/application-integration-test.properties b/backend/src/main/resources/application-integration-test.properties
index 047e3568ce..44769ffd8a 100644
--- a/backend/src/main/resources/application-integration-test.properties
+++ b/backend/src/main/resources/application-integration-test.properties
@@ -1,9 +1,4 @@
 
-spring.datasource.driver-class-name=org.h2.Driver
-spring.datasource.url=jdbc:h2:mem:db;DB_CLOSE_DELAY=-1
-spring.datasource.username=user
-spring.datasource.password=sa
-
 # show actions from entity manager
 #spring.jpa.show-sql=true
 #spring.jpa.properties.hibernate.format_sql=true
@@ -11,13 +6,57 @@ spring.datasource.password=sa
 # debug options
 logging.level.ch.puzzle.okr=DEBUG
 logging.level.org.springframework.security=DEBUG
+logging.level.org.flywaydb.core=DEBUG
+# logging.level.org.springframework.boot.autoconfigure: DEBUG
 
 # flyway fill database with data
 spring.flyway.locations=classpath:db/h2-db/database-h2-schema,classpath:db/h2-db/data-test-h2
 
-spring.security.oauth2.resourceserver.jwt.issuer-uri=http://localhost:8544/realms/pitc
-spring.security.oauth2.resourceserver.jwt.jwk-set-uri=http://localhost:8544/realms/pitc/protocol/openid-connect/certs
-spring.security.oauth2.resourceserver.opaquetoken.client-id=pitc_okr_staging
+# TENANT Configuration
+okr.tenant-ids=pitc,acme
+okr.datasource.driver-class-name=org.h2.Driver
+
+# security
+connect.src=http://localhost:8544 http://localhost:8545
+
+# hibernate
+hibernate.connection.url=jdbc:h2:mem:db;DB_CLOSE_DELAY=-1;
+hibernate.connection.username=user
+hibernate.connection.password=sa
+hibernate.multiTenancy=SCHEMA
+
+# pitc
+okr.tenants.pitc.datasource.url=jdbc:h2:mem:db;DB_CLOSE_DELAY=-1;INIT=CREATE SCHEMA IF NOT EXISTS okr_pitc
+okr.tenants.pitc.datasource.username=user
+okr.tenants.pitc.datasource.password=sa
+okr.tenants.pitc.datasource.schema=okr_pitc
+okr.tenants.pitc.user.champion.emails=peggimann@puzzle.ch,wunderland@puzzle.ch
+okr.tenants.pitc.security.oauth2.resourceserver.jwt.jwk-set-uri=http://localhost:8544/realms/pitc/protocol/openid-connect/certs
+okr.tenants.pitc.security.oauth2.frontend.issuer-url=http://localhost:8544/realms/pitc
+okr.tenants.pitc.security.oauth2.frontend.client-id=pitc_okr_staging
+
+# acme
+okr.tenants.acme.datasource.url=jdbc:h2:mem:db;DB_CLOSE_DELAY=-1;INIT=CREATE SCHEMA IF NOT EXISTS okr_acme
+okr.tenants.acme.datasource.username=user
+okr.tenants.acme.datasource.password=sa
+okr.tenants.acme.datasource.schema=okr_acme
+okr.tenants.acme.user.champion.emails=peggimann@puzzle.ch,wunderland@puzzle.ch
+okr.tenants.acme.security.oauth2.resourceserver.jwt.jwk-set-uri=http://localhost:8544/realms/pitc/protocol/openid-connect/certs
+okr.tenants.acme.security.oauth2.frontend.issuer-url=http://localhost:8544/realms/pitc
+okr.tenants.acme.security.oauth2.frontend.client-id=acme_okr_staging
+
+# pit client customization
+okr.tenants.pitc.clientcustomization.logo=assets/images/okr-logo.svg
+okr.tenants.pitc.clientcustomization.triangles=assets/images/triangles-okr-header.svg
+okr.tenants.pitc.clientcustomization.background-logo=assets/images/puzzle-p.svg
+okr.tenants.pitc.clientcustomization.favicon=assets/favicon.png
+okr.tenants.pitc.clientcustomization.title=Puzzle OKR
+okr.tenants.pitc.clientcustomization.customstyles.okr-topbar-background-color=#1e5a96
 
-# OKR Tool
-okr.user.champion.usernames=peggimann,alice
+# acme client customization
+okr.tenants.acme.clientcustomization.logo=assets/images/okr-logo-acme.svg
+okr.tenants.acme.clientcustomization.triangles=assets/images/triangles-okr-acme-header.svg
+okr.tenants.acme.clientcustomization.background-logo=assets/images/acme.svg
+okr.tenants.acme.clientcustomization.favicon=assets/favicon-acme.png
+okr.tenants.acme.clientcustomization.title=ACME OKR
+okr.tenants.acme.clientcustomization.customstyles.okr-topbar-background-color=#738290
\ No newline at end of file
diff --git a/backend/src/main/resources/application-staging.properties b/backend/src/main/resources/application-staging.properties
index a4f58cfba7..84be0e2da6 100644
--- a/backend/src/main/resources/application-staging.properties
+++ b/backend/src/main/resources/application-staging.properties
@@ -1,7 +1,55 @@
 # logging level for staging
 logging.level.org.springframework=debug
 
-spring.security.oauth2.resourceserver.opaquetoken.client-id=pitc_okr_staging
+connect.src=http://localhost:8544 http://localhost:8545
 
+
+hibernate.connection.url=jdbc:postgresql://okr-dev-db:5432/okr
+hibernate.connection.username=user
+hibernate.connection.password=pwd
+hibernate.multiTenancy=SCHEMA
+
+
+# TENANT Configuration
+okr.tenant-ids=pitc,acme
+okr.datasource.driver-class-name=org.postgresql.Driver
 okr.user.champion.usernames=peggimann
-okr.clientcustomization.customstyles.okr-topbar-background-color=#ab31ad
\ No newline at end of file
+
+# pitc
+okr.tenants.pitc.datasource.url=jdbc:postgresql://okr-dev-db:5432/okr
+okr.tenants.pitc.datasource.username=user
+okr.tenants.pitc.datasource.password=pwd
+okr.tenants.pitc.datasource.schema=okr_pitc
+okr.tenants.pitc.user.champion.emails=gl@gl.com
+okr.tenants.pitc.security.oauth2.resourceserver.jwt.jwk-set-uri=http://localhost:8544/realms/pitc/protocol/openid-connect/certs
+okr.tenants.pitc.security.oauth2.frontend.issuer-url=http://localhost:8544/realms/pitc
+okr.tenants.pitc.security.oauth2.frontend.client-id=pitc_okr_staging
+
+
+# acme
+okr.tenants.acme.datasource.url=jdbc:postgresql://okr-dev-db:5432/okr
+okr.tenants.acme.datasource.username=user
+okr.tenants.acme.datasource.password=pwd
+okr.tenants.acme.datasource.schema=okr_acme
+okr.tenants.acme.user.champion.emails=gl@gl.com
+okr.tenants.acme.security.oauth2.resourceserver.jwt.jwk-set-uri=http://localhost:8545/realms/acme/protocol/openid-connect/certs
+okr.tenants.acme.security.oauth2.frontend.issuer-url=http://localhost:8545/realms/acme
+okr.tenants.acme.security.oauth2.frontend.client-id=acme_okr_staging
+
+# pit client customization
+okr.tenants.pitc.clientcustomization.logo=assets/images/okr-logo.svg
+okr.tenants.pitc.clientcustomization.triangles=assets/images/triangles-okr-header.svg
+okr.tenants.pitc.clientcustomization.background-logo=assets/images/puzzle-p.svg
+okr.tenants.pitc.clientcustomization.favicon=assets/favicon.png
+okr.tenants.pitc.clientcustomization.title=Puzzle OKR
+okr.tenants.pitc.clientcustomization.customstyles.okr-topbar-background-color=#1e5a96
+okr.tenants.pitc.clientcustomization.customstyles.okr-banner-background-color=#dcedf9
+
+# acme client customization
+okr.tenants.acme.clientcustomization.logo=assets/images/okr-logo-acme.svg
+okr.tenants.acme.clientcustomization.triangles=assets/images/triangles-okr-acme-header.svg
+okr.tenants.acme.clientcustomization.background-logo=assets/images/acme.svg
+okr.tenants.acme.clientcustomization.favicon=assets/favicon-acme.png
+okr.tenants.acme.clientcustomization.title=ACME OKR
+okr.tenants.acme.clientcustomization.customstyles.okr-topbar-background-color=#738290
+okr.tenants.acme.clientcustomization.customstyles.okr-banner-background-color=#F2F2F2
\ No newline at end of file
diff --git a/backend/src/main/resources/application.properties b/backend/src/main/resources/application.properties
index f9d7743cf1..8f56d0e783 100644
--- a/backend/src/main/resources/application.properties
+++ b/backend/src/main/resources/application.properties
@@ -3,9 +3,7 @@ spring.profiles.active=prod
 spring.mvc.pathmatch.matching-strategy=ant_path_matcher
 
 # database connection
-spring.datasource.url=jdbc:postgresql://localhost:5432/okr
-spring.datasource.username=user
-spring.datasource.password=pwd
+# spring.autoconfigure.exclude=org.springframework.boot.autoconfigure.jdbc.DataSourceAutoConfiguration
 
 # flyway location
 spring.flyway.locations=classpath:db/migration
@@ -39,18 +37,17 @@ spring.jpa.hibernate.ddl-auto=none
 spring.jpa.open-in-view=false
 
 # OKR Tool
-okr.organisation.name.1stLevel=org_gl
-okr.organisation.name.2ndLevel=org_bl
-
-okr.user.champion.usernames=
-
 okr.jwt.claim.realm=pitc
 okr.jwt.claim.organisations=roles
 okr.jwt.claim.organisation.name.prefix=org_
-okr.jwt.user.username=preferred_username
-okr.jwt.user.firstname=given_name
-okr.jwt.user.lastname=family_name
-okr.jwt.user.email=email
+okr.jwt.claim.username=preferred_username
+okr.jwt.claim.firstname=given_name
+okr.jwt.claim.lastname=family_name
+okr.jwt.claim.email=email
+
+spring.jpa.properties.hibernate.multiTenancy=SCHEMA
+spring.jpa.properties.hibernate.tenant_identifier_resolver=ch.puzzle.okr.multitenancy.CurrentTenantIdentifierResolverImpl
+spring.jpa.properties.hibernate.multi_tenant_connection_provider=ch.puzzle.okr.multitenancy.SchemaMultiTenantConnectionProvider
 
 okr.clientcustomization.favicon=assets/favicon.png
 okr.clientcustomization.logo=assets/images/okr-logo.svg
@@ -58,3 +55,6 @@ okr.clientcustomization.title=Puzzle OKR
 
 okr.quarter.business.year.start=7
 okr.quarter.label.format=GJ xx/yy-Qzz
+
+# security
+connect.src=https://sso.puzzle.ch
\ No newline at end of file
diff --git a/backend/src/main/resources/db/data-migration-demo/afterMigrate__0_initialData.sql b/backend/src/main/resources/db/data-migration-demo/afterMigrate__0_initialData.sql
index 4ca65b6503..0217f691c9 100644
--- a/backend/src/main/resources/db/data-migration-demo/afterMigrate__0_initialData.sql
+++ b/backend/src/main/resources/db/data-migration-demo/afterMigrate__0_initialData.sql
@@ -6,8 +6,6 @@ truncate table completed cascade;
 truncate table objective cascade;
 truncate table person cascade;
 truncate table quarter cascade;
-truncate table team_organisation;
-truncate table organisation cascade;
 truncate table team cascade;
 
 -- fill quarter with dummy labels. correct labels are updated via callback sql scripts
@@ -22,56 +20,50 @@ values (1, '1'), -- last past quarter
        (8, '8'), -- future quarter
        (999, 'Backlog');
 
-insert into person (id, email, firstname, lastname, username, version)
-values (1, 'peggimann@puzzle.ch', 'Paco', 'Eggimann', 'peggimann', 1),
-       (11, 'wunderland@puzzle.ch', 'Alice', 'Wunderland', 'alice', 1),
-       (21, 'baumeister@puzzle.ch', 'Bob', 'Baumeister', 'bob', 1),
-       (31, 'peterson@puzzle.ch', 'Findus', 'Peterson', 'findus', 1),
-       (41, 'egiman@puzzle.ch', 'Paco', 'Egiman', 'paco', 1),
-       (51, 'papierer@puzzle.ch', 'Robin', 'Papierer', 'robin', 1);
+insert into person (id, email, firstname, lastname, version, is_okr_champion)
+values (1, 'peggimann@puzzle.ch', 'Paco', 'Eggimann', 1, TRUE),
+       (2, 'leimgruber@puzzle.ch', 'Philipp', 'Leimgruber', 1, TRUE),
+       (3, 'brantschen@puzzle.ch', 'Jean-Claude', 'Brantschen', 1, TRUE),
+       (4, 'endtner@puzzle.ch', 'Janik', 'Endtner', 1, TRUE),
+       (11, 'wunderland@puzzle.ch', 'Alice', 'Wunderland', 1, FALSE),
+       (21, 'baumeister@puzzle.ch', 'Bob', 'Baumeister', 1, FALSE),
+       (31, 'peterson@puzzle.ch', 'Findus', 'Peterson', 1, FALSE),
+       (51, 'papierer@puzzle.ch', 'Robin', 'Papierer', 1, FALSE),
+       (61, 'gl@gl.com', 'gl', 'gl', 1, TRUE);
 
 insert into team (id, name, version)
 values (4, '/BBT', 1),
        (5, 'Puzzle ITC', 1),
        (6, 'LoremIpsum', 1),
+       (7, 'Mobility', 1),
        (8, 'we are cube.³', 1);
 
-insert into organisation (id, org_name, state, version)
-values (1, 'org_bl', 'ACTIVE', 1),
-       (2, 'org_de', 'ACTIVE', 1),
-       (3, 'org_gl', 'ACTIVE', 1),
-       (4, 'org_pl', 'ACTIVE', 1),
-       (5, 'org_pv', 'ACTIVE', 1),
-       (6, 'org_ux', 'ACTIVE', 1),
-       (7, 'org_zh', 'ACTIVE', 1),
-       (8, 'org_sys', 'ACTIVE', 1),
-       (9, 'org_azubi', 'ACTIVE', 1),
-       (10, 'org_de_gl', 'ACTIVE', 1),
-       (11, 'org_de_gs', 'ACTIVE', 1),
-       (12, 'org_devtre', 'ACTIVE', 1),
-       (13, 'org_racoon', 'ACTIVE', 1),
-       (14, 'org_tqm_qm', 'ACTIVE', 1),
-       (15, 'org_devruby', 'ACTIVE', 1),
-       (16, 'org_midcicd', 'ACTIVE', 1),
-       (17, 'org_verkauf', 'ACTIVE', 1),
-       (18, 'org_finanzen', 'ACTIVE', 1),
-       (19, 'org_mobility', 'ACTIVE', 1),
-       (20, 'org_personal', 'ACTIVE', 1),
-       (21, 'org_security', 'ACTIVE', 1),
-       (22, 'org_marketing', 'ACTIVE', 1),
-       (23, 'org_openshift', 'ACTIVE', 1),
-       (24, 'org_ausbildung', 'ACTIVE', 1),
-       (25, 'org_backoffice', 'ACTIVE', 1),
-       (26, 'org_branch_sec', 'ACTIVE', 1),
-       (27, 'org_standort_zh', 'ACTIVE', 1),
-       (28, 'org_midcontainer', 'ACTIVE', 1);
-
-insert into team_organisation (team_id, organisation_id)
-values (5, 3),
-       (8, 6),
-       (4, 9),
-       (6, 19),
-       (8, 19);
+insert into person_team (id, version, person_id, team_id, is_team_admin)
+        -- peggimann@puzzle.ch
+VALUES (1, 1, 1, 4, TRUE),
+       (2, 1, 1, 5, FALSE),
+       (3, 1, 1, 7, FALSE),
+       -- wunderland@puzzle.ch
+       (4, 1, 11, 6, FALSE),
+       -- baumeister@puzzle.ch
+       (5, 1, 21, 8, FALSE),
+       -- peterson@puzzle.ch
+       (6, 1, 31, 8, TRUE),
+       -- papierer@puzzle.ch
+       (8, 1, 51, 6, TRUE),
+       -- gl@gl.ch
+       (9, 1, 61, 5, TRUE),
+       (10, 1, 61, 6, FALSE),
+        -- leimgruber@puzzle.ch
+       (11, 1, 2, 5, FALSE),
+       (12, 1, 2, 7, TRUE),
+       -- brantschen@puzzle.ch
+       (13, 1, 3, 5, FALSE),
+       (14, 1, 3, 7, FALSE),
+       -- endtner@puzzle.ch
+       (15, 1, 4, 5, FALSE),
+       (16, 1, 4, 7, FALSE);
+;
 
 insert into objective (id, description, modified_on, title, created_by_id, quarter_id, team_id, state, modified_by_id,
                        created_on, version)
diff --git a/backend/src/main/resources/db/data-migration/V3_0_100__update_quarter_labels_if_needed.sql b/backend/src/main/resources/db/data-migration/V3_0_100__update_quarter_labels_if_needed.sql
new file mode 100644
index 0000000000..bc23f8869d
--- /dev/null
+++ b/backend/src/main/resources/db/data-migration/V3_0_100__update_quarter_labels_if_needed.sql
@@ -0,0 +1,31 @@
+DO
+$$
+    DECLARE
+        last_date date;
+    BEGIN
+        select max(start_date) from quarter INTO last_date;
+
+        if (last_date < TO_DATE('2024-07-01', 'YY-MM-DD')) then
+            raise notice 'update all quarters%', '';
+
+            UPDATE quarter SET start_date = null;
+            UPDATE quarter SET end_date = null;
+            UPDATE quarter q SET label = 'label-' || q.id WHERE id < 999;
+
+            UPDATE quarter SET label = 'GJ 24/25-Q1', start_date = '2024-07-01', end_date = '2024-09-30' WHERE id = 1;
+            UPDATE quarter SET label = 'GJ 23/24-Q4', start_date = '2024-04-01', end_date = '2024-06-30' WHERE id = 2;
+            UPDATE quarter SET label = 'GJ 23/24-Q3', start_date = '2024-01-01', end_date = '2024-03-31' WHERE id = 3;
+            UPDATE quarter SET label = 'GJ 23/24-Q2', start_date = '2023-10-01', end_date = '2023-12-31' WHERE id = 4;
+            UPDATE quarter SET label = 'GJ 23/24-Q1', start_date = '2023-07-01', end_date = '2023-09-30' WHERE id = 5;
+            UPDATE quarter SET label = 'GJ 22/23-Q4', start_date = '2023-04-01', end_date = '2023-06-30' WHERE id = 6;
+            UPDATE quarter SET label = 'GJ 22/23-Q3', start_date = '2023-01-01', end_date = '2023-03-31' WHERE id = 7;
+            UPDATE quarter SET label = 'GJ 22/23-Q2', start_date = '2022-10-01', end_date = '2022-12-31' WHERE id = 8;
+        else
+            raise notice 'quarters are up to date';
+        end if;
+    END
+$$;
+
+
+
+
diff --git a/backend/src/main/resources/db/data-migration/V3_0_99__changeTeammanagementData.sql b/backend/src/main/resources/db/data-migration/V3_0_99__changeTeammanagementData.sql
new file mode 100644
index 0000000000..730d73a07c
--- /dev/null
+++ b/backend/src/main/resources/db/data-migration/V3_0_99__changeTeammanagementData.sql
@@ -0,0 +1,26 @@
+-- add gl@gl.com as a user. we set it as champion in dev application properties
+/*
+INSERT INTO person (id, email, firstname, lastname, version, is_okr_champion)
+VALUES (61, 'gl@gl.com', 'Jaya', 'Norris', 1, FALSE);
+*/
+-- map existing users to teams
+INSERT INTO person_team (id, version, person_id, team_id, is_team_admin)
+        -- peggimann@puzzle.ch
+VALUES (1, 1, 1, 4, TRUE),
+       (2, 1, 1, 5, FALSE),
+       -- wunderland@puzzle.ch
+       (3, 1, 11, 6, FALSE),
+       -- baumeister@puzzle.ch
+       (4, 1, 21, 8, FALSE),
+       -- peterson@puzzle.ch
+       (5, 1, 31, 8, TRUE),
+       -- egiman@puzzlech
+       (6, 1, 41, 4, FALSE),
+       -- papierer@puzzle.ch
+       (7, 1, 51, 6, TRUE)
+       -- gl@gl.ch
+  --     (8, 1, 61, 5, TRUE),
+  --     (9, 1, 61, 6, FALSE)
+;
+
+ALTER SEQUENCE sequence_person_team RESTART WITH 1000;
\ No newline at end of file
diff --git a/backend/src/main/resources/db/h2-db/data-test-h2/V100_0_0__TestData.sql b/backend/src/main/resources/db/h2-db/data-test-h2/V100_0_0__TestData.sql
index f9f2c1dea7..24cb7b36cf 100644
--- a/backend/src/main/resources/db/h2-db/data-test-h2/V100_0_0__TestData.sql
+++ b/backend/src/main/resources/db/h2-db/data-test-h2/V100_0_0__TestData.sql
@@ -22,14 +22,16 @@ ALTER SEQUENCE sequence_organisation RESTART WITH 200;
 ALTER SEQUENCE sequence_person RESTART WITH 200;
 ALTER SEQUENCE sequence_quarter RESTART WITH 200;
 ALTER SEQUENCE sequence_team RESTART WITH 200;
+ALTER SEQUENCE sequence_person_team RESTART WITH 200;
 
-insert into person (id, version, email, firstname, lastname, username)
-values (1, 1, 'peggimann@puzzle.ch', 'Paco', 'Eggimann', 'peggimann'),
-       (11, 1, 'wunderland@puzzle.ch', 'Alice', 'Wunderland', 'alice'),
-       (21, 1, 'baumeister@puzzle.ch', 'Bob', 'Baumeister', 'bob'),
-       (31, 1, 'peterson@puzzle.ch', 'Findus', 'Peterson', 'findus'),
-       (41, 1, 'egiman@puzzle.ch', 'Paco', 'Egiman', 'paco'),
-       (51, 1, 'papierer@puzzle.ch', 'Robin', 'Papierer', 'robin');
+INSERT INTO person (id, version, email, firstname, lastname, is_okr_champion)
+VALUES (1, 1, 'peggimann@puzzle.ch', 'Paco', 'Eggimann', FALSE),
+       (11, 1, 'wunderland@puzzle.ch', 'Alice', 'Wunderland', FALSE),
+       (21, 1, 'baumeister@puzzle.ch', 'Bob', 'Baumeister', FALSE),
+       (31, 1, 'peterson@puzzle.ch', 'Findus', 'Peterson', FALSE),
+       (41, 1, 'egiman@puzzle.ch', 'Paco', 'Egiman', FALSE),
+       (51, 1, 'papierer@puzzle.ch', 'Robin', 'Papierer', FALSE),
+       (61, 1, 'gl@gl.com', 'Jaya', 'Norris', TRUE);
 
 CREATE ALIAS INIT_QUARTER_DATA FOR 'ch.puzzle.okr.util.quarter.generate.h2.QuarterFunction.initQuarterData';
 CREATE ALIAS CURRENT_QUARTER_LABEL FOR 'ch.puzzle.okr.util.quarter.generate.h2.QuarterFunction.currentQuarterLabel';
@@ -44,7 +46,7 @@ call INIT_QUARTER_DATA();
 insert into quarter (id, label, start_date, end_date)
 values (2, CURRENT_QUARTER_LABEL(), CURRENT_QUARTER_START_DATE(), CURRENT_QUARTER_END_DATE()),
        (3, NEXT_QUARTER_LABEL(), NEXT_QUARTER_START_DATE(), NEXT_QUARTER_END_DATE()),
-       (99, 'GJ ForTests', '2000-07-01', '2000-09-30'),
+       (998, 'GJ ForTests', '2000-07-01', '2000-09-30'),
        (999, 'Backlog', null, null);
 
 insert into team (id, version, name)
@@ -53,6 +55,25 @@ values (4, 1, '/BBT'),
        (5, 1, 'Puzzle ITC'),
        (6, 1, 'LoremIpsum');
 
+-- map existing users to teams
+INSERT INTO person_team (id, version, person_id, team_id, is_team_admin)
+-- peggimann@puzzle.ch
+VALUES (1, 1, 1, 4, TRUE),
+       (2, 1, 1, 5, FALSE),
+       -- wunderland@puzzle.ch
+       (3, 1, 11, 6, FALSE),
+       -- baumeister@puzzle.ch
+       (4, 1, 21, 8, FALSE),
+       -- peterson@puzzle.ch
+       (5, 1, 31, 8, TRUE),
+       -- egiman@puzzlech
+       (6, 1, 41, 4, FALSE),
+       -- papierer@puzzle.ch
+       (7, 1, 51, 6, TRUE),
+       -- gl@gl.ch
+       (8, 1, 61, 5, TRUE),
+       (9, 1, 61, 6, FALSE);
+
 insert into objective (id, version, description, modified_on, progress, title, created_by_id, quarter_id, team_id, state,
                               modified_by_id, created_on)
 values (4, 1, '', '2023-07-25 08:17:51.309958', 66, 'Build a company culture that kills the competition.', 1, 2, 5,
@@ -126,21 +147,6 @@ insert into completed (id, version, objective_id, comment) values
        (2,1, 6, 'War leider nicht moeglich'),
        (3,1, 10, 'Schade');
 
-insert into organisation (id, version, org_name, state) values
-       (1,1, 'org_gl', 'ACTIVE'),
-       (2,1, 'org_bl', 'ACTIVE'),
-       (3,1, 'org_mobility', 'ACTIVE'),
-       (4,1, 'org_azubi', 'ACTIVE'),
-       (5,1, 'org_inactive', 'INACTIVE');
-
-insert into team_organisation (team_id, organisation_id) values
-       (6, 3),
-       (4, 5),
-       (5, 1),
-       (6, 2),
-       (8, 2),
-       (8, 5);
-
 insert into action (id, version, action, priority, is_checked, key_result_id) values
                                                       (1,  1, 'Neues Haus', 1, true, 8),
                                                       (2,  1, 'Neue Katze', 2, true, 8),
diff --git a/backend/src/main/resources/db/h2-db/database-h2-schema/V1_0_0__current-db-schema-for-testing.sql b/backend/src/main/resources/db/h2-db/database-h2-schema/V1_0_0__current-db-schema-for-testing.sql
index 51fbbfc187..cd6cfe0ed7 100644
--- a/backend/src/main/resources/db/h2-db/database-h2-schema/V1_0_0__current-db-schema-for-testing.sql
+++ b/backend/src/main/resources/db/h2-db/database-h2-schema/V1_0_0__current-db-schema-for-testing.sql
@@ -16,10 +16,10 @@ create table if not exists person
     email     varchar(250) not null,
     firstname varchar(50)  not null,
     lastname  varchar(50)  not null,
-    username  varchar(20)  not null,
+    is_okr_champion BOOLEAN DEFAULT FALSE,
     primary key (id),
-    constraint uk_person_username
-        unique (username)
+    constraint uk_person_email
+        unique (email)
 );
 
 
@@ -242,3 +242,22 @@ create table if not exists team_organisation
     constraint fk_team_organisation_team
         foreign key (team_id) references team
 );
+
+CREATE SEQUENCE IF NOT EXISTS sequence_team;
+
+CREATE TABLE person_team
+(
+    is_team_admin BOOLEAN DEFAULT FALSE NOT NULL,
+    version       INTEGER               NOT NULL,
+    id            BIGINT                NOT NULL,
+    person_id     BIGINT,
+    team_id       BIGINT,
+    PRIMARY KEY (id)
+);
+
+ALTER TABLE IF EXISTS person_team
+    ADD CONSTRAINT FK_person_team_team FOREIGN KEY (team_id) REFERENCES team;
+ALTER TABLE IF EXISTS person_team
+    ADD CONSTRAINT FK_person_team_person FOREIGN KEY (person_id) REFERENCES person;
+
+CREATE SEQUENCE IF NOT EXISTS sequence_person_team;
diff --git a/backend/src/main/resources/db/migration/V2_0_1__objectiveCeeatedByCreatedOnState.sql b/backend/src/main/resources/db/migration/V2_0_1__objectiveCeeatedByCreatedOnState.sql
index 2ae6a451e6..f93a9822e3 100644
--- a/backend/src/main/resources/db/migration/V2_0_1__objectiveCeeatedByCreatedOnState.sql
+++ b/backend/src/main/resources/db/migration/V2_0_1__objectiveCeeatedByCreatedOnState.sql
@@ -10,7 +10,7 @@ BEGIN
               FROM information_schema.columns
               WHERE table_name='objective' and column_name='owner_id')
     THEN
-        ALTER TABLE "public"."objective" RENAME COLUMN "owner_id" TO "created_by_id";
+        ALTER TABLE "objective" RENAME COLUMN "owner_id" TO "created_by_id";
     END IF;
 END $$;
 
diff --git a/backend/src/main/resources/db/migration/V2_0_2__keyResultRefactoringDropAttrsAddNew.sql b/backend/src/main/resources/db/migration/V2_0_2__keyResultRefactoringDropAttrsAddNew.sql
index 3234864360..01aed8a363 100644
--- a/backend/src/main/resources/db/migration/V2_0_2__keyResultRefactoringDropAttrsAddNew.sql
+++ b/backend/src/main/resources/db/migration/V2_0_2__keyResultRefactoringDropAttrsAddNew.sql
@@ -6,9 +6,9 @@ $$
                   WHERE table_name = 'key_result'
                     and column_name = 'basis_value')
         THEN
-            ALTER TABLE "public"."key_result"
+            ALTER TABLE "key_result"
                 RENAME COLUMN "basis_value" TO "baseline";
-            ALTER TABLE "public"."key_result"
+            ALTER TABLE "key_result"
                 RENAME COLUMN "target_value" TO "stretch_goal";
             ALTER TABLE key_result RENAME unit to unit_old;
             Alter TABLE key_result ADD COLUMN if not exists unit varchar(30);
diff --git a/backend/src/main/resources/db/migration/V3_0_0__changeTeammanagement.sql b/backend/src/main/resources/db/migration/V3_0_0__changeTeammanagement.sql
new file mode 100644
index 0000000000..78e8d6eca1
--- /dev/null
+++ b/backend/src/main/resources/db/migration/V3_0_0__changeTeammanagement.sql
@@ -0,0 +1,29 @@
+ALTER TABLE person
+    DROP COLUMN IF EXISTS username;
+
+ALTER TABLE person
+    ADD CONSTRAINT UK_person_email UNIQUE (email);
+
+DROP TABLE IF EXISTS team_organisation;
+DROP TABLE IF EXISTS organisation;
+
+CREATE SEQUENCE IF NOT EXISTS sequence_team;
+
+CREATE TABLE person_team
+(
+    is_team_admin BOOLEAN DEFAULT FALSE NOT NULL,
+    version       INTEGER               NOT NULL,
+    id            BIGINT                NOT NULL,
+    person_id     BIGINT,
+    team_id       BIGINT,
+    PRIMARY KEY (id)
+);
+
+ALTER TABLE IF EXISTS person_team
+    ADD CONSTRAINT FK_person_team_team FOREIGN KEY (team_id) REFERENCES team;
+ALTER TABLE IF EXISTS person_team
+    ADD CONSTRAINT FK_person_team_person FOREIGN KEY (person_id) REFERENCES person;
+
+ALTER TABLE person ADD COLUMN is_okr_champion BOOLEAN DEFAULT FALSE;
+
+CREATE SEQUENCE IF NOT EXISTS sequence_person_team;
\ No newline at end of file
diff --git a/backend/src/test/java/ch/puzzle/okr/SpringCachingConfigTest.java b/backend/src/test/java/ch/puzzle/okr/SpringCachingConfigTest.java
new file mode 100644
index 0000000000..aa87d01441
--- /dev/null
+++ b/backend/src/test/java/ch/puzzle/okr/SpringCachingConfigTest.java
@@ -0,0 +1,73 @@
+package ch.puzzle.okr;
+
+import ch.puzzle.okr.models.User;
+import ch.puzzle.okr.models.authorization.AuthorizationUser;
+import ch.puzzle.okr.multitenancy.TenantContext;
+import ch.puzzle.okr.service.authorization.AuthorizationRegistrationService;
+import ch.puzzle.okr.test.SpringIntegrationTest;
+import ch.puzzle.okr.test.TestHelper;
+import org.junit.jupiter.api.*;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.cache.Cache;
+import org.springframework.cache.CacheManager;
+
+import static ch.puzzle.okr.SpringCachingConfig.AUTHORIZATION_USER_CACHE;
+import static ch.puzzle.okr.test.TestHelper.defaultUser;
+import static org.junit.jupiter.api.Assertions.*;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+
+@SpringIntegrationTest
+class SpringCachingConfigTest {
+
+    @Autowired
+    AuthorizationRegistrationService service;
+    @Autowired
+    CacheManager cacheManager;
+
+    private final User user = defaultUser(null);
+    private final String tenant = TestHelper.SCHEMA_PITC;
+    private final String key = tenant + "_" + user.getEmail();
+
+    @BeforeEach
+    void setUp() {
+        TenantContext.setCurrentTenant(TestHelper.SCHEMA_PITC);
+    }
+
+    @AfterEach
+    void tearDown() {
+        TenantContext.setCurrentTenant(null);
+        cacheManager.getCache(AUTHORIZATION_USER_CACHE).clear();
+    }
+
+    @DisplayName("before calling updateOrAddAuthorizationUser the User is not in the cache")
+    @Test
+    void testUserIsNotCached() {
+        Cache cache = cacheManager.getCache(AUTHORIZATION_USER_CACHE);
+
+        assertNotNull(cache);
+        assertNull(cache.get(key, AuthorizationUser.class));
+    }
+
+    @DisplayName("updateOrAddAuthorizationUser puts the User in the cache with key composed by Tenant and User Email")
+    @Test
+    void testUserIsCached() {
+        Cache cache = cacheManager.getCache(AUTHORIZATION_USER_CACHE);
+
+        service.updateOrAddAuthorizationUser(user);
+
+        assertNotNull(cache);
+        AuthorizationUser expectedUser = new AuthorizationUser(user);
+        AuthorizationUser cachedUser = cache.get(key, AuthorizationUser.class);
+        assertEqualUsers(expectedUser, cachedUser);
+    }
+
+    private void assertEqualUsers(AuthorizationUser expectedAuthorizationUser,
+            AuthorizationUser actualAuthorizationUser) {
+
+        User expcetedUser = expectedAuthorizationUser.user();
+        User actualUser = actualAuthorizationUser.user();
+        assertTrue(expcetedUser.getFirstname().equals(actualUser.getFirstname())
+                && expcetedUser.getLastname().equals(actualUser.getLastname())
+                && expcetedUser.getEmail().equals(actualUser.getEmail()));
+    }
+}
\ No newline at end of file
diff --git a/backend/src/test/java/ch/puzzle/okr/UserKeyGeneratorTest.java b/backend/src/test/java/ch/puzzle/okr/UserKeyGeneratorTest.java
new file mode 100644
index 0000000000..05d38792e5
--- /dev/null
+++ b/backend/src/test/java/ch/puzzle/okr/UserKeyGeneratorTest.java
@@ -0,0 +1,28 @@
+package ch.puzzle.okr;
+
+import ch.puzzle.okr.multitenancy.TenantContext;
+import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+
+import java.lang.reflect.Method;
+
+import static ch.puzzle.okr.test.KeyResultTestHelpers.user;
+
+class UserKeyGeneratorTest {
+
+    @BeforeEach
+    void setUp() {
+        TenantContext.setCurrentTenant(null);
+    }
+
+    @Test
+    void generate_shouldReturnTenantAndUserInfo() {
+        Object notUsedObject = new Object();
+        Method notUsedMethod = notUsedObject.getClass().getEnclosingMethod();
+
+        UserKeyGenerator generator = new UserKeyGenerator();
+        String userKey = (String) generator.generate(notUsedObject, notUsedMethod, user);
+        Assertions.assertEquals("publickaufmann@puzzle.ch1", userKey);
+    }
+}
\ No newline at end of file
diff --git a/backend/src/test/java/ch/puzzle/okr/architecture/OkrArchitectureTest.java b/backend/src/test/java/ch/puzzle/okr/architecture/OkrArchitectureTest.java
index 0607ffd3c1..cde1091ed1 100644
--- a/backend/src/test/java/ch/puzzle/okr/architecture/OkrArchitectureTest.java
+++ b/backend/src/test/java/ch/puzzle/okr/architecture/OkrArchitectureTest.java
@@ -120,7 +120,7 @@ void repositoriesShouldOnlyBeCalledFromPersistenceServicesAndValidationService(S
     }
 
     @ParameterizedTest
-    @ValueSource(strings = { "controller", "service", "converter", "mapper", "repository", "dto", "exception" })
+    @ValueSource(strings = { "controller", "service", "mapper", "repository", "dto", "exception" })
     void classesInRightPackages(String passedName) {
         JavaClasses importedClasses = new ClassFileImporter().importPackages("ch.puzzle.okr");
 
diff --git a/backend/src/test/java/ch/puzzle/okr/controller/CacheControllerIT.java b/backend/src/test/java/ch/puzzle/okr/controller/CacheControllerIT.java
index 435ec84cd9..6fbe6bc0be 100644
--- a/backend/src/test/java/ch/puzzle/okr/controller/CacheControllerIT.java
+++ b/backend/src/test/java/ch/puzzle/okr/controller/CacheControllerIT.java
@@ -33,13 +33,6 @@ void shouldEmptyAuthorisationUsersCache() throws Exception {
         verify(cacheService, times(1)).emptyAuthorizationUsersCache();
     }
 
-    @Test
-    void shouldEmptyUsersCache() throws Exception {
-        mvc.perform(post("/api/v2/caches/emptyUsersCache").with(SecurityMockMvcRequestPostProcessors.csrf()))
-                .andExpect(MockMvcResultMatchers.status().is2xxSuccessful());
-        verify(cacheService, times(1)).emptyUsersCache();
-    }
-
     @Test
     void shouldEmptyAllCaches() throws Exception {
         mvc.perform(post("/api/v2/caches/emptyAllCaches").with(SecurityMockMvcRequestPostProcessors.csrf()))
diff --git a/backend/src/test/java/ch/puzzle/okr/controller/CheckInControllerIT.java b/backend/src/test/java/ch/puzzle/okr/controller/CheckInControllerIT.java
index 9c98bf6130..cbb63560fb 100644
--- a/backend/src/test/java/ch/puzzle/okr/controller/CheckInControllerIT.java
+++ b/backend/src/test/java/ch/puzzle/okr/controller/CheckInControllerIT.java
@@ -2,9 +2,9 @@
 
 import ch.puzzle.okr.mapper.checkin.CheckInMapper;
 import ch.puzzle.okr.models.checkin.Zone;
-import ch.puzzle.okr.models.keyresult.KeyResult;
 import ch.puzzle.okr.models.keyresult.KeyResultMetric;
 import ch.puzzle.okr.models.keyresult.KeyResultOrdinal;
+import ch.puzzle.okr.models.keyresult.KeyResult;
 import ch.puzzle.okr.service.authorization.CheckInAuthorizationService;
 import ch.puzzle.okr.service.business.KeyResultBusinessService;
 import org.hamcrest.core.Is;
@@ -30,7 +30,6 @@
 import static ch.puzzle.okr.test.CheckInTestHelpers.*;
 import static org.mockito.ArgumentMatchers.any;
 import static org.mockito.ArgumentMatchers.anyLong;
-import static org.mockito.Mockito.*;
 import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.*;
 import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.jsonPath;
 
@@ -78,7 +77,7 @@ void shouldGetOrdinalCheckInWithId() throws Exception {
                 .andExpect(jsonPath(JSON_PATH_KEY_RESULT_ID, Is.is(2)))
                 .andExpect(jsonPath(JSON_PATH_MODIFIED_ON, Is.is(LocalDateTime.MAX.toString())))
                 .andExpect(jsonPath(JSON_PATH_CREATED_ON, Is.is(LocalDateTime.MAX.toString())))
-                .andExpect(jsonPath(JSON_PATH_VALUE, Is.is(Zone.COMMIT.toString())));
+                .andExpect(jsonPath(JSON_PATH_ZONE, Is.is(Zone.COMMIT.toString())));
     }
 
     @Test
@@ -125,14 +124,13 @@ void shouldCreateKeyResultMetric() throws Exception {
                 .willReturn(KeyResultMetric.Builder.builder().withId(1L).build());
         BDDMockito.given(checkInAuthorizationService.createEntity(any())).willReturn(checkInMetric);
 
-        mvc.perform(post(CHECK_IN_BASE_URL).contentType(MediaType.APPLICATION_JSON) //
-                .with(SecurityMockMvcRequestPostProcessors.csrf()).content(JSON)) //
-                .andExpect(MockMvcResultMatchers.status().is2xxSuccessful()) //
-                .andExpect(jsonPath(JSON_PATH_ID, Is.is(5))) //
-                .andExpect(jsonPath(JSON_PATH_CHANGE_INFO, Is.is(CHANGE_INFO_1))) //
-                .andExpect(jsonPath(JSON_PATH_INITIATIVES, Is.is(INITIATIVES_1))) //
-                .andExpect(jsonPath(JSON_PATH_CONFIDENCE, Is.is(6))) //
-                .andExpect(jsonPath(JSON_PATH_KEY_RESULT_ID, Is.is(1))) //
+        mvc.perform(post(CHECK_IN_BASE_URL).contentType(MediaType.APPLICATION_JSON)
+                .with(SecurityMockMvcRequestPostProcessors.csrf()).content(JSON))
+                .andExpect(MockMvcResultMatchers.status().is2xxSuccessful()).andExpect(jsonPath(JSON_PATH_ID, Is.is(5)))
+                .andExpect(jsonPath(JSON_PATH_CHANGE_INFO, Is.is(CHANGE_INFO_1)))
+                .andExpect(jsonPath(JSON_PATH_INITIATIVES, Is.is(INITIATIVES_1)))
+                .andExpect(jsonPath(JSON_PATH_CONFIDENCE, Is.is(6)))
+                .andExpect(jsonPath(JSON_PATH_KEY_RESULT_ID, Is.is(1)))
                 .andExpect(jsonPath(JSON_PATH_VALUE, Is.is(46D)));
     }
 
@@ -142,29 +140,14 @@ void shouldCreateKeyResultOrdinal() throws Exception {
                 .willReturn(KeyResultOrdinal.Builder.builder().withId(1L).build());
         BDDMockito.given(checkInAuthorizationService.createEntity(any())).willReturn(checkInOrdinal);
 
-        mvc.perform(post(CHECK_IN_BASE_URL).contentType(MediaType.APPLICATION_JSON) //
-                .with(SecurityMockMvcRequestPostProcessors.csrf()).content(JSON)) //
-                .andExpect(MockMvcResultMatchers.status().is2xxSuccessful()) //
-                .andExpect(jsonPath(JSON_PATH_ID, Is.is(4))) //
-                .andExpect(jsonPath(JSON_PATH_CHANGE_INFO, Is.is(CHANGE_INFO_2))) //
-                .andExpect(jsonPath(JSON_PATH_INITIATIVES, Is.is(INITIATIVES_2))) //
-                .andExpect(jsonPath(JSON_PATH_CONFIDENCE, Is.is(5))) //
-                .andExpect(jsonPath(JSON_PATH_KEY_RESULT_ID, Is.is(2))) //
-                .andExpect(jsonPath(JSON_PATH_VALUE, Is.is(Zone.COMMIT.toString())));
-    }
-
-    @DisplayName("should throw exception when KeyResultType is not Metric and not Ordinal")
-    @Test
-    void shouldThrowExceptionWhenKeyResultTypeIsNotMetricAndNotOrdinal() throws Exception {
-        KeyResult keyResult = mock(KeyResult.class);
-        when(keyResult.getKeyResultType()).thenReturn("a_not_supported_key_result_type");
-        BDDMockito.given(keyResultBusinessService.getEntityById(anyLong())).willReturn(keyResult);
-
-        mvc.perform(post(CHECK_IN_BASE_URL) //
-                .contentType(MediaType.APPLICATION_JSON) //
-                .with(SecurityMockMvcRequestPostProcessors.csrf()) //
-                .content(JSON) //
-        ).andExpect(MockMvcResultMatchers.status().is4xxClientError());
+        mvc.perform(post(CHECK_IN_BASE_URL).contentType(MediaType.APPLICATION_JSON)
+                .with(SecurityMockMvcRequestPostProcessors.csrf()).content(JSON))
+                .andExpect(MockMvcResultMatchers.status().is2xxSuccessful()).andExpect(jsonPath(JSON_PATH_ID, Is.is(4)))
+                .andExpect(jsonPath(JSON_PATH_CHANGE_INFO, Is.is(CHANGE_INFO_2)))
+                .andExpect(jsonPath(JSON_PATH_INITIATIVES, Is.is(INITIATIVES_2)))
+                .andExpect(jsonPath(JSON_PATH_CONFIDENCE, Is.is(5)))
+                .andExpect(jsonPath(JSON_PATH_KEY_RESULT_ID, Is.is(2)))
+                .andExpect(jsonPath(JSON_PATH_ZONE, Is.is(Zone.COMMIT.toString())));
     }
 
     @Test
@@ -178,14 +161,23 @@ void shouldThrowExceptionWhenKeyResultIdMissing() throws Exception {
                 .andExpect(MockMvcResultMatchers.status().is4xxClientError());
     }
 
+    @DisplayName("Should return client error for KeyResult not of type metric or ordinal")
     @Test
-    void shouldDeleteCheckin() throws Exception {
-        BDDMockito.willDoNothing().given(checkInAuthorizationService).deleteEntityById(anyLong());
+    void shouldReturnClientErrorForKeyResultNotOfTypeMetricOrOrdinal() throws Exception {
+        class NonMetricOrOrdinalKeyResult extends KeyResult {
+        }
 
-        mvc.perform(delete(CHECK_IN_5_URL).contentType(MediaType.APPLICATION_JSON)
-                .with(SecurityMockMvcRequestPostProcessors.csrf()).content(JSON_WITHOUT_KEY_RESULT_ID))
-                .andExpect(MockMvcResultMatchers.status().isOk());
+        BDDMockito.given(keyResultBusinessService.getEntityById(anyLong()))
+                .willReturn(new NonMetricOrOrdinalKeyResult());
 
-        verify(this.checkInAuthorizationService).deleteEntityById(anyLong());
+        mvc.perform(post(CHECK_IN_BASE_URL).contentType(MediaType.APPLICATION_JSON)
+                .with(SecurityMockMvcRequestPostProcessors.csrf()).content(JSON))
+                .andExpect(MockMvcResultMatchers.status().is4xxClientError());
+    }
+
+    @Test
+    void shouldDeleteCheckInById() throws Exception {
+        mvc.perform(delete(CHECK_IN_5_URL).with(SecurityMockMvcRequestPostProcessors.csrf()))
+                .andExpect(MockMvcResultMatchers.status().isOk());
     }
 }
diff --git a/backend/src/test/java/ch/puzzle/okr/controller/ClientConfigControllerIT.java b/backend/src/test/java/ch/puzzle/okr/controller/ClientConfigControllerIT.java
index 0be1e46dbe..e6b5244a6b 100644
--- a/backend/src/test/java/ch/puzzle/okr/controller/ClientConfigControllerIT.java
+++ b/backend/src/test/java/ch/puzzle/okr/controller/ClientConfigControllerIT.java
@@ -1,34 +1,60 @@
 package ch.puzzle.okr.controller;
 
+import ch.puzzle.okr.dto.ClientConfigDto;
 import ch.puzzle.okr.service.clientconfig.ClientConfigService;
+import org.hamcrest.Matchers;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.extension.ExtendWith;
+import org.mockito.BDDMockito;
 import org.mockito.junit.jupiter.MockitoExtension;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.boot.test.autoconfigure.web.servlet.WebMvcTest;
 import org.springframework.boot.test.mock.mockito.MockBean;
+import org.springframework.http.MediaType;
 import org.springframework.security.test.context.support.WithMockUser;
-import org.springframework.security.test.web.servlet.request.SecurityMockMvcRequestPostProcessors;
 import org.springframework.test.web.servlet.MockMvc;
 import org.springframework.test.web.servlet.result.MockMvcResultMatchers;
 
-import static org.mockito.Mockito.times;
-import static org.mockito.Mockito.verify;
+import java.util.Map;
+
+import static ch.puzzle.okr.controller.OverviewControllerIT.JSON_PATH_ROOT;
+import static org.mockito.ArgumentMatchers.anyString;
 import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get;
+import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.jsonPath;
 
 @WithMockUser(value = "spring")
 @ExtendWith(MockitoExtension.class)
 @WebMvcTest(ClientConfigController.class)
-class ClientConfigControllerIT {
+public class ClientConfigControllerIT {
+
     @Autowired
     private MockMvc mvc;
     @MockBean
-    private ClientConfigService clientConfigService;
+    private ClientConfigService configService;
 
     @Test
-    void shouldEmptyUsersCache() throws Exception {
-        mvc.perform(get("/config").with(SecurityMockMvcRequestPostProcessors.csrf()))
-                .andExpect(MockMvcResultMatchers.status().is2xxSuccessful());
-        verify(clientConfigService, times(1)).getConfigBasedOnActiveEnv();
+    void shouldGetClientConfig() throws Exception {
+        BDDMockito.given(configService.getConfigBasedOnActiveEnv(anyString())).willReturn(createClientConfigDto());
+
+        mvc.perform(get("/config").contentType(MediaType.APPLICATION_JSON))
+                .andExpect(MockMvcResultMatchers.status().isOk())
+                .andExpect(jsonPath(JSON_PATH_ROOT, Matchers.aMapWithSize(9)))
+                .andExpect(jsonPath("$.activeProfile", Matchers.is("Active_Profile")))
+                .andExpect(jsonPath("$.issuer", Matchers.is("Issuer")))
+                .andExpect(jsonPath("$.clientId", Matchers.is("Client_Id")))
+                .andExpect(jsonPath("$.favicon", Matchers.is("Favicon")))
+                .andExpect(jsonPath("$.logo", Matchers.is("Logo")))
+                .andExpect(jsonPath("$.triangles", Matchers.is("Triangles")))
+                .andExpect(jsonPath("$.backgroundLogo", Matchers.is("Background_Logo")))
+                .andExpect(jsonPath("$.title", Matchers.is("Title")))
+                .andExpect(jsonPath("$.customStyles.font-family", Matchers.is("verdana")))
+                .andExpect(jsonPath("$.customStyles.font-size", Matchers.is("20px")));
     }
-}
\ No newline at end of file
+
+    private ClientConfigDto createClientConfigDto() {
+        Map<String, String> customStyles = Map.of("font-family", "verdana", "font-size", "20px");
+        return new ClientConfigDto("Active_Profile", "Issuer", "Client_Id", "Favicon", "Logo", "Triangles",
+                "Background_Logo", "Title", customStyles);
+    }
+
+}
diff --git a/backend/src/test/java/ch/puzzle/okr/controller/ObjectiveControllerIT.java b/backend/src/test/java/ch/puzzle/okr/controller/ObjectiveControllerIT.java
index f4fbc5d68a..c2d0fde2a8 100644
--- a/backend/src/test/java/ch/puzzle/okr/controller/ObjectiveControllerIT.java
+++ b/backend/src/test/java/ch/puzzle/okr/controller/ObjectiveControllerIT.java
@@ -72,7 +72,7 @@ class ObjectiveControllerIT {
     private static final Objective objective2 = Objective.Builder.builder().withId(7L).withTitle(OBJECTIVE_TITLE_2)
             .build();
     private static final User user = User.Builder.builder().withId(1L).withFirstname("Bob").withLastname("Kaufmann")
-            .withUsername("bkaufmann").withEmail("kaufmann@puzzle.ch").build();
+            .withEmail("kaufmann@puzzle.ch").build();
     private static final Team team = Team.Builder.builder().withId(1L).withName("Team1").build();
     private static final Quarter quarter = Quarter.Builder.builder().withId(1L).withLabel("GJ 22/23-Q2").build();
     private static final Objective fullObjective = Objective.Builder.builder().withId(42L).withTitle("FullObjective")
diff --git a/backend/src/test/java/ch/puzzle/okr/controller/OrganisationControllerIT.java b/backend/src/test/java/ch/puzzle/okr/controller/OrganisationControllerIT.java
deleted file mode 100644
index 055dcec6dc..0000000000
--- a/backend/src/test/java/ch/puzzle/okr/controller/OrganisationControllerIT.java
+++ /dev/null
@@ -1,84 +0,0 @@
-package ch.puzzle.okr.controller;
-
-import ch.puzzle.okr.dto.OrganisationDto;
-import ch.puzzle.okr.mapper.OrganisationMapper;
-import ch.puzzle.okr.models.Organisation;
-import ch.puzzle.okr.models.OrganisationState;
-import ch.puzzle.okr.models.Team;
-import ch.puzzle.okr.service.authorization.OrganisationAuthorizationService;
-import org.hamcrest.core.Is;
-import org.junit.jupiter.api.BeforeEach;
-import org.junit.jupiter.api.Test;
-import org.junit.jupiter.api.extension.ExtendWith;
-import org.mockito.BDDMockito;
-import org.mockito.junit.jupiter.MockitoExtension;
-import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.boot.test.autoconfigure.web.servlet.WebMvcTest;
-import org.springframework.boot.test.mock.mockito.MockBean;
-import org.springframework.http.MediaType;
-import org.springframework.security.test.context.support.WithMockUser;
-import org.springframework.test.web.servlet.MockMvc;
-import org.springframework.test.web.servlet.result.MockMvcResultMatchers;
-
-import java.util.List;
-
-import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get;
-import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.jsonPath;
-
-@WithMockUser(value = "spring")
-@ExtendWith(MockitoExtension.class)
-@WebMvcTest(OrganisationController.class)
-class OrganisationControllerIT {
-
-    /* Team test objects */
-    private static final Team PUZZLE = Team.Builder.builder().withId(1L).withName("PUZZLE ITC").build();
-    private static final Team BBT = Team.Builder.builder().withId(1L).withName("/BBT").build();
-
-    /* Organisation test objects */
-    private static final Organisation organisationPuzzle = Organisation.Builder.builder().withId(1L)
-            .withState(OrganisationState.ACTIVE).withTeams(List.of(PUZZLE)).withVersion(1).withOrgName("org_puzzle")
-            .build();
-
-    private static final Organisation organisationBBT = Organisation.Builder.builder().withId(1L)
-            .withState(OrganisationState.ACTIVE).withTeams(List.of(BBT)).withVersion(1).withOrgName("org_bbt").build();
-
-    private static final OrganisationDto organisationPuzzleDto = new OrganisationDto(1L, 1, "org_puzzle",
-            OrganisationState.ACTIVE);
-
-    private static final OrganisationDto organisationBBTDto = new OrganisationDto(1L, 1, "org_bbt",
-            OrganisationState.ACTIVE);
-    private static final String URL_ORGANISATION = "/api/v1/organisations";
-    @Autowired
-    private MockMvc mvc;
-    @MockBean
-    private OrganisationAuthorizationService organisationAuthorizationService;
-    @MockBean
-    private OrganisationMapper organisationMapper;
-
-    @BeforeEach
-    void setUp() {
-        BDDMockito.given(organisationMapper.toDto(organisationPuzzle)).willReturn(organisationPuzzleDto);
-        BDDMockito.given(organisationMapper.toDto(organisationBBT)).willReturn(organisationBBTDto);
-    }
-
-    @Test
-    void shouldReturnOrganisationsOfBusinessService() throws Exception {
-        BDDMockito.given(organisationAuthorizationService.getEntities())
-                .willReturn(List.of(organisationPuzzle, organisationBBT));
-
-        mvc.perform(get(URL_ORGANISATION).contentType(MediaType.APPLICATION_JSON))
-                .andExpect(MockMvcResultMatchers.status().isOk())
-                .andExpect(jsonPath("$[0].orgName", Is.is(organisationPuzzleDto.orgName())))
-                .andExpect(jsonPath("$[1].orgName", Is.is(organisationBBTDto.orgName())));
-    }
-
-    @Test
-    void shouldReturnOrganisationsOfTeam() throws Exception {
-        BDDMockito.given(organisationAuthorizationService.getEntitiesByTeam(1L))
-                .willReturn(List.of(organisationPuzzle));
-
-        mvc.perform(get(URL_ORGANISATION + "/1").contentType(MediaType.APPLICATION_JSON))
-                .andExpect(MockMvcResultMatchers.status().isOk())
-                .andExpect(jsonPath("$[0].orgName", Is.is(organisationPuzzleDto.orgName())));
-    }
-}
diff --git a/backend/src/test/java/ch/puzzle/okr/controller/OverviewControllerIT.java b/backend/src/test/java/ch/puzzle/okr/controller/OverviewControllerIT.java
index 9750b4fbf9..48b57a8ede 100644
--- a/backend/src/test/java/ch/puzzle/okr/controller/OverviewControllerIT.java
+++ b/backend/src/test/java/ch/puzzle/okr/controller/OverviewControllerIT.java
@@ -1,11 +1,9 @@
 package ch.puzzle.okr.controller;
 
-import ch.puzzle.okr.mapper.DashboardMapper;
 import ch.puzzle.okr.mapper.OverviewMapper;
 import ch.puzzle.okr.models.overview.Overview;
 import ch.puzzle.okr.models.overview.OverviewId;
 import ch.puzzle.okr.service.authorization.OverviewAuthorizationService;
-import ch.puzzle.okr.service.business.OrganisationBusinessService;
 import org.hamcrest.Matchers;
 import org.hamcrest.core.Is;
 import org.junit.jupiter.api.Test;
@@ -41,12 +39,8 @@ class OverviewControllerIT {
     private MockMvc mvc;
     @MockBean
     private OverviewAuthorizationService overviewAuthorizationService;
-    @MockBean
-    OrganisationBusinessService organisationBusinessService;
     // Dashboard and OverviewMapper are required for testing
     @SpyBean
-    private DashboardMapper dashboardMapper;
-    @SpyBean
     private OverviewMapper overviewMapper;
 
     public static final String PUZZLE = "Puzzle";
@@ -56,9 +50,9 @@ class OverviewControllerIT {
     public static final String CHF = "CHF";
     public static final String EUR = "EUR";
     public static final String FTE = "FTE";
-    public static final String JSON_PATH_TEAM_NAME = "$.overviews[0].team.name";
-    public static final String JSON_PATH_TEAM_ID = "$.overviews[0].team.id";
-    public static final String JSON_PATH_OVERVIEWS = "$.overviews";
+    public static final String JSON_PATH_TEAM_NAME = "$[0].team.name";
+    public static final String JSON_PATH_TEAM_ID = "$[0].team.id";
+    public static final String JSON_PATH_ROOT = "$";
 
     static List<Overview> overviewPuzzle = List.of(
             Overview.Builder.builder().withOverviewId(OverviewId.of(1L, 1L, 20L, 20L)).withTeamName(PUZZLE)
@@ -104,18 +98,16 @@ void shouldGetAllTeamsWithObjective() throws Exception {
 
         mvc.perform(get("/api/v2/overview?quarter=2&team=1,2,3,4").contentType(MediaType.APPLICATION_JSON))
                 .andExpect(MockMvcResultMatchers.status().isOk())
-                .andExpect(jsonPath(JSON_PATH_OVERVIEWS, Matchers.hasSize(3)))
-                .andExpect(jsonPath("$.adminAccess", Is.is(true))).andExpect(jsonPath(JSON_PATH_TEAM_ID, Is.is(1)))
+                .andExpect(jsonPath(JSON_PATH_ROOT, Matchers.hasSize(3)))
+                .andExpect(jsonPath(JSON_PATH_TEAM_ID, Is.is(1)))
                 .andExpect(jsonPath(JSON_PATH_TEAM_NAME, Is.is(PUZZLE)))
-                .andExpect(jsonPath("$.overviews[0].objectives[0].id", Is.is(1)))
-                .andExpect(jsonPath("$.overviews[0].objectives[1].id", Is.is(2)))
-                .andExpect(jsonPath("$.overviews[1].team.id", Is.is(2)))
-                .andExpect(jsonPath("$.overviews[1].team.name", Is.is("OKR")))
-                .andExpect(jsonPath("$.overviews[1].objectives[0].id", Is.is(5)))
-                .andExpect(jsonPath("$.overviews[1].objectives[1].id", Is.is(7)))
-                .andExpect(jsonPath("$.overviews[2].team.id", Is.is(3)))
-                .andExpect(jsonPath("$.overviews[2].team.name", Is.is(TEAM_KUCHEN)))
-                .andExpect(jsonPath("$.overviews[2].objectives[0].id", Is.is(8)));
+                .andExpect(jsonPath("$[0].objectives[0].id", Is.is(1)))
+                .andExpect(jsonPath("$[0].objectives[1].id", Is.is(2))).andExpect(jsonPath("$[1].team.id", Is.is(2)))
+                .andExpect(jsonPath("$[1].team.name", Is.is("OKR")))
+                .andExpect(jsonPath("$[1].objectives[0].id", Is.is(5)))
+                .andExpect(jsonPath("$[1].objectives[1].id", Is.is(7))).andExpect(jsonPath("$[2].team.id", Is.is(3)))
+                .andExpect(jsonPath("$[2].team.name", Is.is(TEAM_KUCHEN)))
+                .andExpect(jsonPath("$[2].objectives[0].id", Is.is(8)));
     }
 
     @Test
@@ -126,8 +118,7 @@ void shouldGetAllTeamsWithObjectiveIfNoTeamsExists() throws Exception {
 
         mvc.perform(get("/api/v2/overview").contentType(MediaType.APPLICATION_JSON))
                 .andExpect(MockMvcResultMatchers.status().isOk())
-                .andExpect(jsonPath(JSON_PATH_OVERVIEWS, Matchers.hasSize(0)))
-                .andExpect(jsonPath("$.adminAccess", Is.is(true)));
+                .andExpect(jsonPath(JSON_PATH_ROOT, Matchers.hasSize(0)));
     }
 
     @Test
@@ -139,14 +130,13 @@ void shouldReturnOnlyFilteredObjectivesByQuarterAndTeam() throws Exception {
 
         mvc.perform(get("/api/v2/overview?quarter=2&team=1,3").contentType(MediaType.APPLICATION_JSON))
                 .andExpect(MockMvcResultMatchers.status().isOk())
-                .andExpect(jsonPath(JSON_PATH_OVERVIEWS, Matchers.hasSize(2)))
+                .andExpect(jsonPath(JSON_PATH_ROOT, Matchers.hasSize(2)))
                 .andExpect(jsonPath(JSON_PATH_TEAM_ID, Is.is(1)))
                 .andExpect(jsonPath(JSON_PATH_TEAM_NAME, Is.is(PUZZLE)))
-                .andExpect(jsonPath("$.overviews[0].objectives[0].id", Is.is(1)))
-                .andExpect(jsonPath("$.overviews[0].objectives[1].id", Is.is(2)))
-                .andExpect(jsonPath("$.overviews[1].team.id", Is.is(3)))
-                .andExpect(jsonPath("$.overviews[1].team.name", Is.is(TEAM_KUCHEN)))
-                .andExpect(jsonPath("$.overviews[1].objectives[0].id", Is.is(8)));
+                .andExpect(jsonPath("$[0].objectives[0].id", Is.is(1)))
+                .andExpect(jsonPath("$[0].objectives[1].id", Is.is(2))).andExpect(jsonPath("$[1].team.id", Is.is(3)))
+                .andExpect(jsonPath("$[1].team.name", Is.is(TEAM_KUCHEN)))
+                .andExpect(jsonPath("$[1].objectives[0].id", Is.is(8)));
     }
 
     @Test
@@ -156,9 +146,9 @@ void shouldReturnTeamWithEmptyObjectiveListWhenNoObjectiveInFilteredQuarter() th
 
         mvc.perform(get("/api/v2/overview?quarter=2&team=4").contentType(MediaType.APPLICATION_JSON))
                 .andExpect(MockMvcResultMatchers.status().isOk())
-                .andExpect(jsonPath(JSON_PATH_OVERVIEWS, Matchers.hasSize(1)))
+                .andExpect(jsonPath(JSON_PATH_ROOT, Matchers.hasSize(1)))
                 .andExpect(jsonPath(JSON_PATH_TEAM_ID, Is.is(4)))
                 .andExpect(jsonPath(JSON_PATH_TEAM_NAME, Is.is(TEAM_KUCHEN)))
-                .andExpect(jsonPath("$.overviews[0].objectives.size()", Is.is(0)));
+                .andExpect(jsonPath("$[0].objectives.size()", Is.is(0)));
     }
 }
diff --git a/backend/src/test/java/ch/puzzle/okr/controller/QuarterControllerIT.java b/backend/src/test/java/ch/puzzle/okr/controller/QuarterControllerIT.java
index 76f9f27da6..cfd844139f 100644
--- a/backend/src/test/java/ch/puzzle/okr/controller/QuarterControllerIT.java
+++ b/backend/src/test/java/ch/puzzle/okr/controller/QuarterControllerIT.java
@@ -21,6 +21,8 @@
 import java.util.Collections;
 import java.util.List;
 
+import static ch.puzzle.okr.Constants.BACK_LOG_QUARTER_LABEL;
+import static ch.puzzle.okr.test.TestConstants.BACK_LOG_QUARTER_ID;
 import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get;
 import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.jsonPath;
 
@@ -33,8 +35,8 @@ class QuarterControllerIT {
             .withStartDate(LocalDate.of(2022, 9, 1)).withEndDate(LocalDate.of(2022, 12, 31)).build();
     static Quarter quarter2 = Quarter.Builder.builder().withId(2L).withLabel("GJ 22/23-Q3")
             .withStartDate(LocalDate.of(2023, 1, 1)).withEndDate(LocalDate.of(2023, 3, 31)).build();
-    static Quarter backlogQuarter = Quarter.Builder.builder().withId(199L).withLabel("Backlog").withStartDate(null)
-            .withEndDate(null).build();
+    static Quarter backlogQuarter = Quarter.Builder.builder().withId(BACK_LOG_QUARTER_ID)
+            .withLabel(BACK_LOG_QUARTER_LABEL).withStartDate(null).withEndDate(null).build();
     static List<Quarter> quaterList = Arrays.asList(quarter1, quarter2, backlogQuarter);
 
     @Autowired
@@ -54,7 +56,8 @@ void shouldGetAllQuarters() throws Exception {
                 .andExpect(jsonPath("$[1].id", Is.is(2))).andExpect(jsonPath("$[1].label", Is.is("GJ 22/23-Q3")))
                 .andExpect(jsonPath("$[1].startDate", Is.is(LocalDate.of(2023, 1, 1).toString())))
                 .andExpect(jsonPath("$[1].endDate", Is.is(LocalDate.of(2023, 3, 31).toString())))
-                .andExpect(jsonPath("$[2].id", Is.is(199))).andExpect(jsonPath("$[2].label", Is.is("Backlog")));
+                .andExpect(jsonPath("$[2].id", Is.is((int) BACK_LOG_QUARTER_ID)))
+                .andExpect(jsonPath("$[2].label", Is.is(BACK_LOG_QUARTER_LABEL)));
     }
 
     @Test
diff --git a/backend/src/test/java/ch/puzzle/okr/controller/TeamControllerIT.java b/backend/src/test/java/ch/puzzle/okr/controller/TeamControllerIT.java
index 06105cb08d..999c8cacf1 100644
--- a/backend/src/test/java/ch/puzzle/okr/controller/TeamControllerIT.java
+++ b/backend/src/test/java/ch/puzzle/okr/controller/TeamControllerIT.java
@@ -22,7 +22,6 @@
 import org.springframework.test.web.servlet.result.MockMvcResultMatchers;
 import org.springframework.web.server.ResponseStatusException;
 
-import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Collections;
 import java.util.List;
@@ -41,31 +40,36 @@ class TeamControllerIT {
     private static final String BASE_URL = "/api/v2/teams";
     private static final String URL_TEAM_1 = "/api/v2/teams/1";
     public static final String PUZZLE = "Puzzle";
+    public static final String SUB_URL_USER_5 = "/user/5";
     static Team teamPuzzle = Team.Builder.builder().withId(5L).withName(PUZZLE).build();
     static Team teamOKR = Team.Builder.builder().withId(7L).withName("OKR").build();
     static List<Team> teamList = Arrays.asList(teamPuzzle, teamOKR);
-    static TeamDto teamPuzzleDto = new TeamDto(5L, 3, PUZZLE, new ArrayList<>(), false);
-    static TeamDto teamOkrDto = new TeamDto(7L, 4, "OKR", new ArrayList<>(), false);
+    static TeamDto teamPuzzleDto = new TeamDto(5L, 3, PUZZLE, false);
+    static TeamDto teamOkrDto = new TeamDto(7L, 4, "OKR", false);
 
     private static final String CREATE_NEW_TEAM = """
             {
-               "id": null, "name": "OKR-Team", "organisations": []
+            "id": null, "name": "OKR-Team", "organisations": []
             }
             """;
     private static final String CREATE_NEW_TEAM_WITH_NULL_VALUES = """
             {
-               "id": null, "name": null, "organisations": null
+            "id": null, "name": null, "organisations": null
             }
             """;
     private static final String RESPONSE_NEW_TEAM = """
-            {"id":7,"version":4,"name":"OKR","organisations":[],"filterIsActive":false}""";
+            {"id":7,"version":4,"name":"OKR","writeable":false}""";
 
     private static final String UPDATE_TEAM = """
             {
-                "id": 1, "name": "OKR-Team", "organisations": []
+            "id": 1, "name": "OKR-Team", "organisations": []
             }
             """;
 
+    private static final String ADD_USERS = """
+            [{"id":31,"version":1,"firstname":"Findus","lastname":"Peterson","email":"peterson@puzzle.ch","userTeamList":[{"id":31,"version":1,"team":{"id":8,"version":1,"name":"we are cube.³","isWriteable":false},"isTeamAdmin":true}],"isOkrChampion":false},{"id":41,"version":1,"firstname":"Paco","lastname":"Egiman","email":"egiman@puzzle.ch","userTeamList":[{"id":41,"version":1,"team":{"id":4,"version":1,"name":"/BBT","isWriteable":false},"isTeamAdmin":false}],"isOkrChampion":false}]
+            """;
+
     @Autowired
     private MockMvc mvc;
     @MockBean
@@ -75,8 +79,8 @@ class TeamControllerIT {
 
     @BeforeEach
     void setUp() {
-        BDDMockito.given(teamMapper.toDto(teamPuzzle, List.of())).willReturn(teamPuzzleDto);
-        BDDMockito.given(teamMapper.toDto(teamOKR, List.of())).willReturn(teamOkrDto);
+        BDDMockito.given(teamMapper.toDto(teamPuzzle)).willReturn(teamPuzzleDto);
+        BDDMockito.given(teamMapper.toDto(teamOKR)).willReturn(teamOkrDto);
     }
 
     @Test
@@ -93,8 +97,8 @@ void shouldGetAllTeams() throws Exception {
     void shouldGetAllTeamsWhenNoQuarterParamIsPassed() throws Exception {
         BDDMockito.given(teamAuthorizationService.getAllTeams()).willReturn(teamList);
         mvc.perform(get(BASE_URL).contentType(MediaType.APPLICATION_JSON)).andExpectAll();
-        BDDMockito.verify(teamMapper).toDto(teamOKR, List.of());
-        BDDMockito.verify(teamMapper).toDto(teamPuzzle, List.of());
+        BDDMockito.verify(teamMapper).toDto(teamOKR);
+        BDDMockito.verify(teamMapper).toDto(teamPuzzle);
     }
 
     @Test
@@ -127,11 +131,10 @@ void shouldReturnResponseStatusExceptionWhenCreatingObjectiveWithNullValues() th
 
     @Test
     void shouldReturnUpdatedTeam() throws Exception {
-        TeamDto teamDto = new TeamDto(1L, 0, "OKR-Team", new ArrayList<>(), false);
-        Team team = Team.Builder.builder().withId(1L).withName("OKR-Team")
-                .withAuthorizationOrganisation(new ArrayList<>()).build();
+        TeamDto teamDto = new TeamDto(1L, 0, "OKR-Team", false);
+        Team team = Team.Builder.builder().withId(1L).withName("OKR-Team").build();
 
-        BDDMockito.given(teamMapper.toDto(any(), any())).willReturn(teamDto);
+        BDDMockito.given(teamMapper.toDto(any())).willReturn(teamDto);
         BDDMockito.given(teamAuthorizationService.updateEntity(any(), anyLong())).willReturn(team);
 
         mvc.perform(put(URL_TEAM_1).contentType(MediaType.APPLICATION_JSON).content(UPDATE_TEAM)
@@ -174,4 +177,24 @@ void throwExceptionWhenOTeamWithIdCantBeFoundWhileDeleting() throws Exception {
         mvc.perform(delete(URL_TEAM_1).with(SecurityMockMvcRequestPostProcessors.csrf()))
                 .andExpect(MockMvcResultMatchers.status().isNotFound());
     }
+
+    @Test
+    void addUsersToTeam_shouldReturnOk() throws Exception {
+        mvc.perform(put(URL_TEAM_1 + "/addusers").contentType(MediaType.APPLICATION_JSON).content(ADD_USERS)
+                .with(SecurityMockMvcRequestPostProcessors.csrf())).andExpect(MockMvcResultMatchers.status().isOk());
+    }
+
+    @Test
+    void removeUserFromTeam_shouldReturnOk() throws Exception {
+        mvc.perform(put(URL_TEAM_1 + SUB_URL_USER_5 + "/removeuser").contentType(MediaType.APPLICATION_JSON)
+                .content(ADD_USERS).with(SecurityMockMvcRequestPostProcessors.csrf()))
+                .andExpect(MockMvcResultMatchers.status().isOk());
+    }
+
+    @Test
+    void updateOrAddTeamMembership_shouldReturnOk() throws Exception {
+        mvc.perform(put(URL_TEAM_1 + SUB_URL_USER_5 + "/updateaddteammembership/true")
+                .contentType(MediaType.APPLICATION_JSON).content(ADD_USERS)
+                .with(SecurityMockMvcRequestPostProcessors.csrf())).andExpect(MockMvcResultMatchers.status().isOk());
+    }
 }
diff --git a/backend/src/test/java/ch/puzzle/okr/controller/UserControllerIT.java b/backend/src/test/java/ch/puzzle/okr/controller/UserControllerIT.java
index 10511c2346..33d0af9aac 100644
--- a/backend/src/test/java/ch/puzzle/okr/controller/UserControllerIT.java
+++ b/backend/src/test/java/ch/puzzle/okr/controller/UserControllerIT.java
@@ -3,6 +3,8 @@
 import ch.puzzle.okr.dto.UserDto;
 import ch.puzzle.okr.mapper.UserMapper;
 import ch.puzzle.okr.models.User;
+import ch.puzzle.okr.models.authorization.AuthorizationUser;
+import ch.puzzle.okr.service.authorization.AuthorizationService;
 import ch.puzzle.okr.service.authorization.UserAuthorizationService;
 import org.hamcrest.Matchers;
 import org.hamcrest.core.Is;
@@ -16,40 +18,44 @@
 import org.springframework.boot.test.mock.mockito.MockBean;
 import org.springframework.http.MediaType;
 import org.springframework.security.test.context.support.WithMockUser;
+import org.springframework.security.test.web.servlet.request.SecurityMockMvcRequestPostProcessors;
 import org.springframework.test.web.servlet.MockMvc;
 import org.springframework.test.web.servlet.result.MockMvcResultMatchers;
 
+import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Collections;
 import java.util.List;
 
-import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get;
+import static ch.puzzle.okr.controller.ActionControllerIT.SUCCESSFUL_UPDATE_BODY;
+import static org.mockito.ArgumentMatchers.any;
+import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.*;
 import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.jsonPath;
 
 @WithMockUser(value = "spring")
 @ExtendWith(MockitoExtension.class)
 @WebMvcTest(UserController.class)
 class UserControllerIT {
-    private static final String USERNAME_1 = "awunderland";
     private static final String FIRSTNAME_1 = "Alice";
     private static final String LASTNAME_1 = "Wunderland";
     private static final String EMAIL_1 = "wunderland@puzzle.ch";
-    private static final String USERNAME_2 = "bbaumeister";
     private static final String FIRSTNAME_2 = "Bob";
     private static final String LASTNAME_2 = "Baumeister";
     private static final String EMAIL_2 = "baumeister@puzzle.ch";
-    static User userAlice = User.Builder.builder().withId(2L).withUsername(USERNAME_1).withFirstname(FIRSTNAME_1)
-            .withLastname(LASTNAME_1).withEmail(EMAIL_1).build();
-    static User userBob = User.Builder.builder().withId(9L).withUsername(USERNAME_2).withFirstname(FIRSTNAME_2)
-            .withLastname(LASTNAME_2).withEmail(EMAIL_2).build();
+    static User userAlice = User.Builder.builder().withId(2L).withFirstname(FIRSTNAME_1).withLastname(LASTNAME_1)
+            .withEmail(EMAIL_1).build();
+    static User userBob = User.Builder.builder().withId(9L).withFirstname(FIRSTNAME_2).withLastname(LASTNAME_2)
+            .withEmail(EMAIL_2).build();
     static List<User> userList = Arrays.asList(userAlice, userBob);
-    static UserDto userAliceDto = new UserDto(2L, 3, USERNAME_1, FIRSTNAME_1, LASTNAME_1, EMAIL_1, true);
-    static UserDto userBobDto = new UserDto(9L, 4, USERNAME_2, FIRSTNAME_2, LASTNAME_2, EMAIL_2, false);
+    static UserDto userAliceDto = new UserDto(2L, 3, FIRSTNAME_1, LASTNAME_1, EMAIL_1, new ArrayList<>(), false);
+    static UserDto userBobDto = new UserDto(9L, 4, FIRSTNAME_2, LASTNAME_2, EMAIL_2, new ArrayList<>(), false);
     @Autowired
     private MockMvc mvc;
     @MockBean
     private UserAuthorizationService userAuthorizationService;
     @MockBean
+    private AuthorizationService authorizationService;
+    @MockBean
     private UserMapper userMapper;
 
     @BeforeEach
@@ -64,11 +70,9 @@ void shouldGetAllUsers() throws Exception {
 
         mvc.perform(get("/api/v1/users").contentType(MediaType.APPLICATION_JSON))
                 .andExpect(MockMvcResultMatchers.status().isOk()).andExpect(jsonPath("$", Matchers.hasSize(2)))
-                .andExpect(jsonPath("$[0].id", Is.is(2))).andExpect(jsonPath("$[0].username", Is.is(USERNAME_1)))
-                .andExpect(jsonPath("$[0].firstname", Is.is(FIRSTNAME_1)))
+                .andExpect(jsonPath("$[0].id", Is.is(2))).andExpect(jsonPath("$[0].firstname", Is.is(FIRSTNAME_1)))
                 .andExpect(jsonPath("$[0].lastname", Is.is(LASTNAME_1)))
                 .andExpect(jsonPath("$[0].email", Is.is(EMAIL_1))).andExpect(jsonPath("$[1].id", Is.is(9)))
-                .andExpect(jsonPath("$[1].username", Is.is(USERNAME_2)))
                 .andExpect(jsonPath("$[1].firstname", Is.is(FIRSTNAME_2)))
                 .andExpect(jsonPath("$[1].lastname", Is.is(LASTNAME_2)))
                 .andExpect(jsonPath("$[1].email", Is.is(EMAIL_2)));
@@ -81,4 +85,82 @@ void shouldGetAllUsersIfNoUserExists() throws Exception {
         mvc.perform(get("/api/v1/users").contentType(MediaType.APPLICATION_JSON))
                 .andExpect(MockMvcResultMatchers.status().isOk()).andExpect(jsonPath("$", Matchers.hasSize(0)));
     }
+
+    @Test
+    void shouldReturnCurrentUser() throws Exception {
+        BDDMockito.given(authorizationService.updateOrAddAuthorizationUser())
+                .willReturn(new AuthorizationUser(userAlice));
+        BDDMockito.given(userMapper.toDto(userAlice)).willReturn(userAliceDto);
+
+        mvc.perform(get("/api/v1/users/current").contentType(MediaType.APPLICATION_JSON))
+                .andExpect(MockMvcResultMatchers.status().isOk()) //
+                .andExpect(jsonPath("$", Matchers.aMapWithSize(7))) //
+                .andExpect(jsonPath("$.id", Is.is(2))) //
+                .andExpect(jsonPath("$.version", Is.is(3))) //
+                .andExpect(jsonPath("$.firstname", Is.is(FIRSTNAME_1))) //
+                .andExpect(jsonPath("$.lastname", Is.is(LASTNAME_1))) //
+                .andExpect(jsonPath("$.email", Is.is(EMAIL_1))) //
+                .andExpect(jsonPath("$.userTeamList", Matchers.empty())) //
+                .andExpect(jsonPath("$.isOkrChampion", Is.is(false)));
+    }
+
+    @Test
+    void shouldReturnUserById() throws Exception {
+        BDDMockito.given(userAuthorizationService.getById(2)).willReturn(userAlice);
+        BDDMockito.given(userMapper.toDto(userAlice)).willReturn(userAliceDto);
+
+        mvc.perform(get("/api/v1/users/2").contentType(MediaType.APPLICATION_JSON)) //
+                .andExpect(MockMvcResultMatchers.status().isOk()) //
+                .andExpect(jsonPath("$", Matchers.aMapWithSize(7))) //
+                .andExpect(jsonPath("$.id", Is.is(2))) //
+                .andExpect(jsonPath("$.version", Is.is(3))) //
+                .andExpect(jsonPath("$.firstname", Is.is(FIRSTNAME_1))) //
+                .andExpect(jsonPath("$.lastname", Is.is(LASTNAME_1))) //
+                .andExpect(jsonPath("$.email", Is.is(EMAIL_1))) //
+                .andExpect(jsonPath("$.userTeamList", Matchers.empty())) //
+                .andExpect(jsonPath("$.isOkrChampion", Is.is(false)));
+    }
+
+    @Test
+    void shouldSetOkrChampion() throws Exception {
+        BDDMockito.given(userAuthorizationService.setIsOkrChampion(2, true)).willReturn(userAlice);
+        BDDMockito.given(userMapper.toDto(userAlice)).willReturn(userAliceDto);
+
+        mvc.perform(put("/api/v1/users/2/isokrchampion/true") //
+                .content(SUCCESSFUL_UPDATE_BODY) //
+                .contentType(MediaType.APPLICATION_JSON) //
+                .with(SecurityMockMvcRequestPostProcessors.csrf()) //
+        ) //
+                .andExpect(MockMvcResultMatchers.status().isOk()) //
+                .andExpect(jsonPath("$", Matchers.aMapWithSize(7))) //
+                .andExpect(jsonPath("$.id", Is.is(2))) //
+                .andExpect(jsonPath("$.version", Is.is(3))) //
+                .andExpect(jsonPath("$.firstname", Is.is(FIRSTNAME_1))) //
+                .andExpect(jsonPath("$.lastname", Is.is(LASTNAME_1))) //
+                .andExpect(jsonPath("$.email", Is.is(EMAIL_1))) //
+                .andExpect(jsonPath("$.userTeamList", Matchers.empty())) //
+                .andExpect(jsonPath("$.isOkrChampion", Is.is(false)));
+    }
+
+    @Test
+    void shouldCreateUsers() throws Exception {
+        BDDMockito.given(userAuthorizationService.createUsers(any())).willReturn(List.of(userAlice));
+        BDDMockito.given(userMapper.toDtos(List.of(userAlice))).willReturn(List.of(userAliceDto));
+
+        mvc.perform(post("/api/v1/users/createall") //
+                .content(SUCCESSFUL_UPDATE_BODY) //
+                .contentType(MediaType.APPLICATION_JSON) //
+                .with(SecurityMockMvcRequestPostProcessors.csrf()) //
+        ) //
+                .andExpect(MockMvcResultMatchers.status().isOk()) //
+                .andExpect(jsonPath("$", Matchers.hasSize(1))) //
+                .andExpect(jsonPath("$[0].id", Is.is(2))) //
+                .andExpect(jsonPath("$[0].version", Is.is(3))) //
+                .andExpect(jsonPath("$[0].firstname", Is.is(FIRSTNAME_1))) //
+                .andExpect(jsonPath("$[0].lastname", Is.is(LASTNAME_1))) //
+                .andExpect(jsonPath("$[0].email", Is.is(EMAIL_1))) //
+                .andExpect(jsonPath("$[0].userTeamList", Matchers.empty())) //
+                .andExpect(jsonPath("$[0].isOkrChampion", Is.is(false)));
+    }
+
 }
\ No newline at end of file
diff --git a/backend/src/test/java/ch/puzzle/okr/converter/JwtConverterFactoryIT.java b/backend/src/test/java/ch/puzzle/okr/converter/JwtConverterFactoryIT.java
deleted file mode 100644
index 47e7a5f51b..0000000000
--- a/backend/src/test/java/ch/puzzle/okr/converter/JwtConverterFactoryIT.java
+++ /dev/null
@@ -1,34 +0,0 @@
-package ch.puzzle.okr.converter;
-
-import ch.puzzle.okr.models.User;
-import ch.puzzle.okr.test.SpringIntegrationTest;
-import org.junit.jupiter.api.Test;
-import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.core.convert.converter.Converter;
-import org.springframework.security.oauth2.jwt.Jwt;
-
-import java.util.List;
-
-import static org.junit.jupiter.api.Assertions.assertNotNull;
-import static org.junit.jupiter.api.Assertions.assertSame;
-
-@SpringIntegrationTest
-public class JwtConverterFactoryIT {
-
-    @Autowired
-    private JwtConverterFactory jwtConverterFactory;
-
-    @Test
-    void getJwtOrganisationConverter() {
-        Converter<Jwt, List<String>> converter = jwtConverterFactory.getJwtOrganisationConverter();
-        assertNotNull(converter);
-        assertSame(converter, jwtConverterFactory.getJwtOrganisationConverter());
-    }
-
-    @Test
-    void getJwtUserConverter() {
-        Converter<Jwt, User> converter = jwtConverterFactory.getJwtUserConverter();
-        assertNotNull(converter);
-        assertSame(converter, jwtConverterFactory.getJwtUserConverter());
-    }
-}
diff --git a/backend/src/test/java/ch/puzzle/okr/converter/JwtOrganisationConverterTest.java b/backend/src/test/java/ch/puzzle/okr/converter/JwtOrganisationConverterTest.java
deleted file mode 100644
index 1849704357..0000000000
--- a/backend/src/test/java/ch/puzzle/okr/converter/JwtOrganisationConverterTest.java
+++ /dev/null
@@ -1,69 +0,0 @@
-package ch.puzzle.okr.converter;
-
-import org.junit.jupiter.api.BeforeEach;
-import org.junit.jupiter.api.Test;
-import org.springframework.security.oauth2.jwt.Jwt;
-
-import java.util.List;
-
-import static ch.puzzle.okr.test.TestHelper.defaultJwtToken;
-import static org.assertj.core.api.Assertions.assertThat;
-import static org.springframework.test.util.ReflectionTestUtils.setField;
-
-class JwtOrganisationConverterTest {
-    private final JwtOrganisationConverter converter = new JwtOrganisationConverter();
-    private final Jwt jwt = defaultJwtToken();
-
-    @BeforeEach
-    public void setup() {
-        setClaimRealm("pitc");
-        setClaimOrganisations("roles");
-        setOrganisationNamePrefix("org_");
-    }
-
-    @Test
-    void convertShouldReturnOrganisationsWhenValidJwt() {
-        List<String> organisations = converter.convert(jwt);
-
-        assertThat(List.of("org_gl")).hasSameElementsAs(organisations);
-    }
-
-    @Test
-    void convertShouldReturnEmptyListWhenNoClaimRealmSection() {
-        setClaimRealm("foo");
-
-        List<String> organisations = converter.convert(jwt);
-
-        assertThat(List.of()).hasSameElementsAs(organisations);
-    }
-
-    @Test
-    void convertShouldReturnEmptyListWhenNoClaimOrganisationsSection() {
-        setClaimOrganisations("bar");
-
-        List<String> organisations = converter.convert(jwt);
-
-        assertThat(List.of()).hasSameElementsAs(organisations);
-    }
-
-    @Test
-    void convertShouldReturnEmptyListWhenNoRoleNameMatch() {
-        setOrganisationNamePrefix("foo_");
-
-        List<String> organisations = converter.convert(jwt);
-
-        assertThat(List.of()).hasSameElementsAs(organisations);
-    }
-
-    private void setClaimRealm(String claimRealm) {
-        setField(converter, "claimRealm", claimRealm);
-    }
-
-    private void setClaimOrganisations(String claimOrganisations) {
-        setField(converter, "claimOrganisations", claimOrganisations);
-    }
-
-    private void setOrganisationNamePrefix(String roleNamePrefix) {
-        setField(converter, "organisationNamePrefix", roleNamePrefix);
-    }
-}
diff --git a/backend/src/test/java/ch/puzzle/okr/converter/JwtUserConverterTest.java b/backend/src/test/java/ch/puzzle/okr/converter/JwtUserConverterTest.java
deleted file mode 100644
index 438d4c2809..0000000000
--- a/backend/src/test/java/ch/puzzle/okr/converter/JwtUserConverterTest.java
+++ /dev/null
@@ -1,68 +0,0 @@
-package ch.puzzle.okr.converter;
-
-import ch.puzzle.okr.test.TestHelper;
-import ch.puzzle.okr.dto.ErrorDto;
-import ch.puzzle.okr.exception.OkrResponseStatusException;
-import ch.puzzle.okr.models.User;
-import org.junit.jupiter.api.BeforeEach;
-import org.junit.jupiter.api.Test;
-import org.springframework.security.oauth2.jwt.Jwt;
-
-import java.util.List;
-
-import static ch.puzzle.okr.test.TestHelper.defaultJwtToken;
-import static org.assertj.core.api.Assertions.assertThat;
-import static org.junit.jupiter.api.Assertions.*;
-import static org.springframework.http.HttpStatus.BAD_REQUEST;
-import static org.springframework.test.util.ReflectionTestUtils.setField;
-
-class JwtUserConverterTest {
-    private final JwtUserConverter converter = new JwtUserConverter();
-    private final Jwt jwt = defaultJwtToken();
-
-    @BeforeEach
-    public void setup() {
-        setUsername("preferred_username");
-        setFirstname("given_name");
-        setLastname("family_name");
-        setEmail("email");
-    }
-
-    @Test
-    void convertShouldReturnUserWhenValidJwt() {
-        User user = converter.convert(jwt);
-
-        assertEquals(User.Builder.builder().withUsername("bkaufmann").withFirstname("Bob").withLastname("Kaufmann")
-                .withEmail("kaufmann@puzzle.ch").build(), user);
-    }
-
-    @Test
-    void convertShouldThrowExceptionWhenClaimNameDoesNotMatch() {
-        setUsername("foo_name");
-
-        OkrResponseStatusException exception = assertThrows(OkrResponseStatusException.class,
-                () -> converter.convert(jwt));
-
-        List<ErrorDto> expectedErrors = List.of(new ErrorDto("CONVERT_TOKEN", List.of("User")));
-
-        assertEquals(BAD_REQUEST, exception.getStatusCode());
-        assertThat(expectedErrors).hasSameElementsAs(exception.getErrors());
-        assertTrue(TestHelper.getAllErrorKeys(expectedErrors).contains(exception.getReason()));
-    }
-
-    private void setUsername(String claimRealm) {
-        setField(converter, "username", claimRealm);
-    }
-
-    private void setFirstname(String claimRoles) {
-        setField(converter, "firstname", claimRoles);
-    }
-
-    private void setLastname(String roleNamePrefix) {
-        setField(converter, "lastname", roleNamePrefix);
-    }
-
-    private void setEmail(String email) {
-        setField(converter, "email", email);
-    }
-}
diff --git a/backend/src/test/java/ch/puzzle/okr/deserializer/CheckInDeserializerTest.java b/backend/src/test/java/ch/puzzle/okr/deserializer/CheckInDeserializerTest.java
new file mode 100644
index 0000000000..62145a9cc8
--- /dev/null
+++ b/backend/src/test/java/ch/puzzle/okr/deserializer/CheckInDeserializerTest.java
@@ -0,0 +1,192 @@
+package ch.puzzle.okr.deserializer;
+
+import ch.puzzle.okr.dto.checkin.CheckInDto;
+import ch.puzzle.okr.dto.checkin.CheckInMetricDto;
+import ch.puzzle.okr.dto.checkin.CheckInOrdinalDto;
+import ch.puzzle.okr.models.checkin.Zone;
+import ch.puzzle.okr.models.keyresult.KeyResult;
+import ch.puzzle.okr.models.keyresult.KeyResultMetric;
+import ch.puzzle.okr.models.keyresult.KeyResultOrdinal;
+import ch.puzzle.okr.service.business.KeyResultBusinessService;
+import com.fasterxml.jackson.core.JsonParser;
+import com.fasterxml.jackson.databind.DeserializationContext;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.DisplayName;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.mockito.InjectMocks;
+import org.mockito.Mock;
+import org.mockito.junit.jupiter.MockitoExtension;
+import org.springframework.http.HttpStatus;
+import org.springframework.web.server.ResponseStatusException;
+
+import static org.junit.jupiter.api.Assertions.*;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.when;
+
+@ExtendWith(MockitoExtension.class)
+class CheckInDeserializerTest {
+
+    @Mock
+    private KeyResultBusinessService keyResultBusinessService;
+
+    @InjectMocks
+    private CheckInDeserializer checkInDeserializer;
+
+    private ObjectMapper objectMapper;
+
+    @BeforeEach
+    void setUp() {
+        objectMapper = new ObjectMapper();
+    }
+
+    @DisplayName("deserialize() should return CheckInMetricDto for metric json")
+    @Test
+    void deserializeShouldReturnCheckInMetricDtoForMetricJson() throws Exception {
+        // arrange
+        String jsonMetric = """
+                {
+                  "id": 42,
+                  "version": 0,
+                  "changeInfo": "Change_Info",
+                  "initiatives": "Initiatives",
+                  "confidence": 5,
+                  "keyResultId": 1000,
+                  "createdOn": null,
+                  "modifiedOn": null,
+                  "value": 23.0,
+                  "writeable": false
+                }
+                """;
+
+        when(keyResultBusinessService.getEntityById(1000L)) //
+                .thenReturn(KeyResultMetric.Builder.builder() //
+                        .withId(1000L) //
+                        .build());
+
+        JsonParser jsonParser = objectMapper.getFactory().createParser(jsonMetric);
+        DeserializationContext ctxt = mock(DeserializationContext.class);
+
+        // act
+        CheckInDto checkInDto = checkInDeserializer.deserialize(jsonParser, ctxt);
+
+        // assert
+        assertNotNull(checkInDto);
+        assertInstanceOf(CheckInMetricDto.class, checkInDto);
+
+        CheckInMetricDto checkInMetricDto = (CheckInMetricDto) checkInDto;
+        assertCheckInMetricDto(checkInMetricDto);
+    }
+
+    private static void assertCheckInMetricDto(CheckInMetricDto checkInMetricDto) {
+        assertEquals(42L, checkInMetricDto.id());
+        assertEquals("Change_Info", checkInMetricDto.changeInfo());
+        assertEquals("Initiatives", checkInMetricDto.initiatives());
+        assertEquals(5, checkInMetricDto.confidence());
+        assertEquals(1000, checkInMetricDto.keyResultId());
+        assertEquals(23, checkInMetricDto.value());
+    }
+
+    @DisplayName("deserialize() should return CheckInOrdinalDto for ordinal json")
+    @Test
+    void deserializeShouldReturnCheckInOrdinalDtoForOrdinalJson() throws Exception {
+        // arrange
+        String jsonOrdinal = """
+                {
+                  "id": 43,
+                  "version": 0,
+                  "changeInfo": "Change_Info",
+                  "initiatives": "Initiatives",
+                  "confidence": 7,
+                  "keyResultId": 1001,
+                  "createdOn": null,
+                  "modifiedOn": null,
+                  "value": "STRETCH",
+                  "writeable": false
+                }
+                """;
+
+        when(keyResultBusinessService.getEntityById(1001L)) //
+                .thenReturn(KeyResultOrdinal.Builder.builder() //
+                        .withId(1001L) //
+                        .build());
+
+        JsonParser jsonParser = objectMapper.getFactory().createParser(jsonOrdinal);
+        DeserializationContext ctxt = mock(DeserializationContext.class);
+
+        // act
+        CheckInDto checkInDto = checkInDeserializer.deserialize(jsonParser, ctxt);
+
+        // assert
+        assertNotNull(checkInDto);
+        assertInstanceOf(CheckInOrdinalDto.class, checkInDto);
+
+        CheckInOrdinalDto checkInOrdinalDto = (CheckInOrdinalDto) checkInDto;
+        assertCheckInOrdinalDto(checkInOrdinalDto);
+    }
+
+    private void assertCheckInOrdinalDto(CheckInOrdinalDto checkInOrdinalDto) {
+        assertEquals(43L, checkInOrdinalDto.id());
+        assertEquals("Change_Info", checkInOrdinalDto.changeInfo());
+        assertEquals("Initiatives", checkInOrdinalDto.initiatives());
+        assertEquals(7, checkInOrdinalDto.confidence());
+        assertEquals(1001, checkInOrdinalDto.keyResultId());
+        assertEquals(Zone.STRETCH, checkInOrdinalDto.value());
+    }
+
+    @DisplayName("deserialize() should throw ResponseStatusException if KeyResult is of unsupported type")
+    @Test
+    void deserializeShouldThrowResponseStatusExceptionIfKeyResultIsUnsupportedType() throws Exception {
+        // arrange
+        String json = """
+                {
+                  "id": 0,
+                  "keyResultId": 1002
+                }
+                """;
+
+        KeyResult unsupportedKeyResult = new KeyResult() {
+            @Override
+            public String getKeyResultType() {
+                return "not_supported_type";
+            }
+        };
+
+        when(keyResultBusinessService.getEntityById(1002L)).thenReturn(unsupportedKeyResult);
+
+        JsonParser jsonParser = objectMapper.getFactory().createParser(json);
+        DeserializationContext ctxt = mock(DeserializationContext.class);
+
+        // act + assert
+        ResponseStatusException exception = assertThrows(ResponseStatusException.class, () -> {
+            checkInDeserializer.deserialize(jsonParser, ctxt);
+        });
+
+        assertEquals(HttpStatus.BAD_REQUEST, exception.getStatusCode());
+        assertEquals("unsupported checkIn DTO to deserialize", exception.getReason());
+    }
+
+    @DisplayName("deserialize() should throw ResponseStatusException if json has no KeyResult Id")
+    @Test
+    void deserializeShouldThrowResponseStatusExceptionIfJsonHasNoKeyResultId() throws Exception {
+        // arrange
+        String jsonWithoutKeyResultId = """
+                {
+                  "id": 0,
+                  "changeInfo": "THIS_JSON_WILL_NOT_BE_USED"
+                }
+                """;
+
+        JsonParser jsonParser = objectMapper.getFactory().createParser(jsonWithoutKeyResultId);
+        DeserializationContext ctxt = mock(DeserializationContext.class);
+
+        // act + assert
+        ResponseStatusException exception = assertThrows(ResponseStatusException.class, () -> {
+            checkInDeserializer.deserialize(jsonParser, ctxt);
+        });
+
+        assertEquals(HttpStatus.BAD_REQUEST, exception.getStatusCode());
+        assertEquals("missing keyResult ID to deserialize checkIn DTO", exception.getReason());
+    }
+}
\ No newline at end of file
diff --git a/backend/src/test/java/ch/puzzle/okr/deserializer/KeyResultDeserializerTest.java b/backend/src/test/java/ch/puzzle/okr/deserializer/KeyResultDeserializerTest.java
new file mode 100644
index 0000000000..b8ddead732
--- /dev/null
+++ b/backend/src/test/java/ch/puzzle/okr/deserializer/KeyResultDeserializerTest.java
@@ -0,0 +1,224 @@
+package ch.puzzle.okr.deserializer;
+
+import ch.puzzle.okr.dto.keyresult.*;
+import ch.puzzle.okr.models.Unit;
+import com.fasterxml.jackson.core.JsonParser;
+import com.fasterxml.jackson.databind.DeserializationContext;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.DisplayName;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.mockito.InjectMocks;
+import org.mockito.junit.jupiter.MockitoExtension;
+import org.springframework.http.HttpStatus;
+import org.springframework.web.server.ResponseStatusException;
+
+import static org.junit.jupiter.api.Assertions.*;
+import static org.mockito.Mockito.mock;
+
+@ExtendWith(MockitoExtension.class)
+public class KeyResultDeserializerTest {
+
+    @InjectMocks
+    private KeyResultDeserializer keyResultDeserializer;
+
+    private ObjectMapper objectMapper;
+
+    @BeforeEach
+    void setUp() {
+        objectMapper = new ObjectMapper();
+    }
+
+    @DisplayName("deserialize() should return KeyResultMetricDto for metric json")
+    @Test
+    void deserializeShouldReturnKeyResultMetricDtoForMetricJson() throws Exception {
+        // arrange
+        String jsonMetric = """
+                {
+                  "id": 42,
+                  "version": 0,
+                  "keyResultType": "metric",
+                  "title": "TITLE_METRIC",
+                  "description": "BESCHREIBUNG",
+                  "baseline": 1.0,
+                  "stretchGoal": 5.0,
+                  "unit": "NUMBER",
+                  "owner": {
+                    "id": 1000,
+                    "firstname": "Jaya",
+                    "lastname": "Norris"
+                  },
+                  "objective": {
+                    "id": 1000,
+                    "state": "ongoing-icon.svg",
+                    "keyResultQuarterDto": null
+                  },
+                  "lastCheckIn": null,
+                  "createdOn": null,
+                  "modifiedOn": null,
+                  "writeable": false,
+                  "actionList": []
+                }
+                """;
+
+        JsonParser jsonParser = objectMapper.getFactory().createParser(jsonMetric);
+        DeserializationContext ctxt = mock(DeserializationContext.class);
+
+        // act
+        KeyResultDto keyResultDto = keyResultDeserializer.deserialize(jsonParser, ctxt);
+
+        // assert
+        assertNotNull(keyResultDto);
+        assertInstanceOf(KeyResultMetricDto.class, keyResultDto);
+
+        KeyResultMetricDto keyResultMetricDto = (KeyResultMetricDto) keyResultDto;
+        assertKeyResultMetricDto(keyResultMetricDto);
+    }
+
+    private void assertKeyResultMetricDto(KeyResultMetricDto keyResultMetricDto) {
+        assertEquals(42L, keyResultMetricDto.id());
+        assertEquals("metric", keyResultMetricDto.keyResultType());
+        assertEquals("TITLE_METRIC", keyResultMetricDto.title());
+        assertEquals("BESCHREIBUNG", keyResultMetricDto.description());
+        assertEquals(1.0, keyResultMetricDto.baseline());
+        assertEquals(5.0, keyResultMetricDto.stretchGoal());
+        assertEquals(Unit.NUMBER, keyResultMetricDto.unit());
+
+        KeyResultUserDto owner = keyResultMetricDto.owner();
+        assertOwner(owner);
+
+        KeyResultObjectiveDto objective = keyResultMetricDto.objective();
+        assertObjective(objective);
+    }
+
+    private static void assertOwner(KeyResultUserDto owner) {
+        assertNotNull(owner);
+        assertEquals(1000, owner.id());
+        assertEquals("Jaya", owner.firstname());
+        assertEquals("Norris", owner.lastname());
+    }
+
+    private static void assertObjective(KeyResultObjectiveDto objective) {
+        assertNotNull(objective);
+        assertEquals(1000, objective.id());
+    }
+
+    @DisplayName("deserialize() should return KeyResultOrdinalDto for ordinal json")
+    @Test
+    void deserializeShouldReturnKeyResultOrdinalDtoForOrdinalJson() throws Exception {
+        // arrange
+        String jsonMetric = """
+                {
+                  "id": 43,
+                  "version": 0,
+                  "keyResultType": "ordinal",
+                  "title": "TITLE_ORDINAL",
+                  "description": "BESCHREIBUNG",
+                  "commitZone": "1",
+                  "targetZone": "3",
+                  "stretchZone": "5",
+                  "owner": {
+                    "id": 1000,
+                    "firstname": "Jaya",
+                    "lastname": "Norris"
+                  },
+                  "objective": {
+                    "id": 1000,
+                    "state": "ongoing-icon.svg",
+                    "keyResultQuarterDto": null
+                  },
+                  "lastCheckIn": null,
+                  "createdOn": null,
+                  "modifiedOn": null,
+                  "writeable": false,
+                  "actionList": []
+                }
+
+                """;
+
+        JsonParser jsonParser = objectMapper.getFactory().createParser(jsonMetric);
+        DeserializationContext ctxt = mock(DeserializationContext.class);
+
+        // act
+        KeyResultDto keyResultDto = keyResultDeserializer.deserialize(jsonParser, ctxt);
+
+        // assert
+        assertNotNull(keyResultDto);
+        assertInstanceOf(KeyResultOrdinalDto.class, keyResultDto);
+
+        KeyResultOrdinalDto keyResultOrdinalDto = (KeyResultOrdinalDto) keyResultDto;
+        assertKeyResultOrdinalDto(keyResultOrdinalDto);
+    }
+
+    private void assertKeyResultOrdinalDto(KeyResultOrdinalDto keyResultOrdinalDto) {
+        assertEquals(43L, keyResultOrdinalDto.id());
+        assertEquals("ordinal", keyResultOrdinalDto.keyResultType());
+        assertEquals("TITLE_ORDINAL", keyResultOrdinalDto.title());
+        assertEquals("BESCHREIBUNG", keyResultOrdinalDto.description());
+        assertEquals("1", keyResultOrdinalDto.commitZone());
+        assertEquals("3", keyResultOrdinalDto.targetZone());
+        assertEquals("5", keyResultOrdinalDto.stretchZone());
+
+        KeyResultUserDto owner = keyResultOrdinalDto.owner();
+        assertOwner(owner);
+
+        KeyResultObjectiveDto objective = keyResultOrdinalDto.objective();
+        assertObjective(objective);
+    }
+
+    @DisplayName("deserialize() should throw ResponseStatusException if KeyResult is of unsupported type")
+    @Test
+    void deserializeShouldThrowResponseStatusExceptionIfKeyResultIsUnsupportedType() throws Exception {
+        // arrange
+        String jsonMetric = """
+                {
+                  "id": 44,
+                  "version": 0,
+                  "keyResultType": "unsupported",
+                  "title": "TITLE_UNSUPPORTED",
+                  "description": "BESCHREIBUNG"
+                }
+                """;
+
+        JsonParser jsonParser = objectMapper.getFactory().createParser(jsonMetric);
+        DeserializationContext ctxt = mock(DeserializationContext.class);
+
+        // act + assert
+        ResponseStatusException exception = assertThrows(ResponseStatusException.class, () -> {
+            keyResultDeserializer.deserialize(jsonParser, ctxt);
+        });
+
+        assertBadRequest(exception);
+    }
+
+    @DisplayName("deserialize() should throw ResponseStatusException if json has no KeyResult Type")
+    @Test
+    void deserializeShouldThrowResponseStatusExceptionIfJsonHasNoKeyResultType() throws Exception {
+        // arrange
+        String jsonMetric = """
+                {
+                  "id": 45,
+                  "version": 0,
+                  "title": "NO_KEY_RESULT_TYPE",
+                  "description": "BESCHREIBUNG"
+                }
+                """;
+
+        JsonParser jsonParser = objectMapper.getFactory().createParser(jsonMetric);
+        DeserializationContext ctxt = mock(DeserializationContext.class);
+
+        // act + assert
+        ResponseStatusException exception = assertThrows(ResponseStatusException.class, () -> {
+            keyResultDeserializer.deserialize(jsonParser, ctxt);
+        });
+
+        assertBadRequest(exception);
+    }
+
+    private void assertBadRequest(ResponseStatusException exception) {
+        assertEquals(HttpStatus.BAD_REQUEST, exception.getStatusCode());
+        assertEquals("unsupported keyResult DTO to deserialize", exception.getReason());
+    }
+
+}
diff --git a/backend/src/test/java/ch/puzzle/okr/mapper/ActionMapperTest.java b/backend/src/test/java/ch/puzzle/okr/mapper/ActionMapperTest.java
new file mode 100644
index 0000000000..9dc733ff5e
--- /dev/null
+++ b/backend/src/test/java/ch/puzzle/okr/mapper/ActionMapperTest.java
@@ -0,0 +1,159 @@
+package ch.puzzle.okr.mapper;
+
+import ch.puzzle.okr.dto.ActionDto;
+import ch.puzzle.okr.models.Action;
+import ch.puzzle.okr.models.keyresult.KeyResult;
+import ch.puzzle.okr.models.keyresult.KeyResultMetric;
+import ch.puzzle.okr.service.business.KeyResultBusinessService;
+import ch.puzzle.okr.service.persistence.KeyResultPersistenceService;
+import ch.puzzle.okr.service.validation.KeyResultValidationService;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.DisplayName;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.mockito.Mock;
+import org.mockito.junit.jupiter.MockitoExtension;
+
+import java.util.List;
+
+import static org.junit.jupiter.api.Assertions.*;
+import static org.mockito.Mockito.when;
+
+@ExtendWith(MockitoExtension.class)
+public class ActionMapperTest {
+
+    private static final long ID = 0L;
+    private static final int VERSION = 1;
+    private static final String ACTION = "action";
+    private static final int PRIORITY = 42;
+    private static final boolean IS_CHECKED = true;
+    private static final boolean IS_WRITEABLE = true;
+    public static final long KEY_RESULT_ID = 10L;
+    private final KeyResult keyResult = KeyResultMetric.Builder.builder().withId(KEY_RESULT_ID).build();
+
+    private ActionMapper actionMapper;
+    @Mock
+    private KeyResultBusinessService keyResultBusinessService;
+    @Mock
+    private KeyResultValidationService validator;
+    @Mock
+    private KeyResultPersistenceService keyResultPersistenceService;
+
+    @BeforeEach
+    void setup() {
+        actionMapper = new ActionMapper(keyResultBusinessService);
+    }
+
+    @DisplayName("toDto() should map Action to Dto")
+    @Test
+    void toDtoShouldMapActionToDto() {
+        // arrange
+        Action action = Action.Builder.builder() //
+                .withId(ID) //
+                .withVersion(VERSION) //
+                .withAction(ACTION) //
+                .withPriority(PRIORITY) //
+                .withIsChecked(IS_CHECKED) //
+                .withKeyResult(keyResult) //
+                .build();
+        action.setWriteable(IS_WRITEABLE);
+
+        // act
+        ActionDto actionDto = actionMapper.toDto(action);
+
+        // assert
+        assertNotNull(actionDto);
+        assertActionDto(action, actionDto);
+    }
+
+    private void assertActionDto(Action expected, ActionDto actual) {
+        assertEquals(expected.getId(), actual.id());
+        assertEquals(expected.getVersion(), actual.version());
+        assertEquals(expected.getAction(), actual.action());
+        assertEquals(expected.getPriority(), actual.priority());
+        assertEquals(expected.isChecked(), actual.isChecked());
+        assertEquals(expected.getKeyResult().getId(), actual.keyResultId());
+        assertEquals(expected.isWriteable(), actual.writeable());
+    }
+
+    @DisplayName("toActions() should map List of Dtos with KeyResultId to list of Actions.")
+    @Test
+    void toActionsShouldMapListOfDtosWithKeyResltIdToListOfActions() {
+        // arrange
+        when(keyResultBusinessService.getEntityById(keyResult.getId())).thenReturn(keyResult);
+
+        ActionDto actionDto = new ActionDto( //
+                ID, //
+                VERSION, //
+                ACTION, //
+                PRIORITY, //
+                IS_CHECKED, //
+                keyResult.getId(), //
+                IS_WRITEABLE //
+        );
+
+        // act
+        List<ActionDto> actionDtoList = List.of(actionDto);
+        List<Action> actionList = actionMapper.toActions(actionDtoList);
+
+        // assert
+        assertNotNull(actionList);
+        assertListOfActionsWithKeyResultId(actionDtoList, actionList);
+    }
+
+    @DisplayName("toActions() with KeyResult Parameter should map List of Dtos (without a KeyResultId) to list of Actions")
+    @Test
+    void toActionsWithKeyResultParameterShouldMapListOfDtosToListOfActions() {
+        // arrange
+        KeyResult keyResultParameter = KeyResultMetric.Builder.builder().withId(20L).build();
+        ActionDto actionDtoWithKeyResultIdIsNull = new ActionDto(ID, //
+                VERSION, //
+                ACTION, //
+                PRIORITY, //
+                IS_CHECKED, //
+                null, // keyResultId
+                IS_WRITEABLE //
+        );
+
+        // act
+        List<ActionDto> actionDtoList = List.of(actionDtoWithKeyResultIdIsNull);
+        List<Action> actionList = actionMapper.toActions(actionDtoList, keyResultParameter);
+
+        // assert
+        assertNotNull(actionList);
+
+        // the value of the KeyResultId in the ActionDto is null
+        // the value of the KeyResultId in Action is the value of keyResultParameter ( == 20)
+        assertListOfActionsAndKeyResultParameter(actionDtoList, actionList, keyResultParameter.getId());
+    }
+
+    private void assertListOfActionsWithKeyResultId(List<ActionDto> expectedDtoList, List<Action> actualList) {
+        assertListsAndFirstAction(expectedDtoList, actualList);
+        assertEquals(expectedDtoList.get(0).keyResultId(), actualList.get(0).getKeyResult().getId());
+    }
+
+    private void assertListOfActionsAndKeyResultParameter(List<ActionDto> expectedDtoList, List<Action> actualList,
+            Long keyResultId) {
+        assertListsAndFirstAction(expectedDtoList, actualList);
+        assertEquals(keyResultId, actualList.get(0).getKeyResult().getId());
+    }
+
+    private void assertListsAndFirstAction(List<ActionDto> expectedDtoList, List<Action> actualList) {
+        assertEquals(expectedDtoList.size(), actualList.size());
+        assertEquals(1, actualList.size());
+
+        ActionDto expectedActionDto = expectedDtoList.get(0);
+        Action actualAction = actualList.get(0);
+        assertNotNull(actualAction);
+        assertAction(expectedActionDto, actualAction);
+    }
+
+    private void assertAction(ActionDto expected, Action actual) {
+        assertEquals(expected.id(), actual.getId());
+        assertEquals(expected.version(), actual.getVersion());
+        assertEquals(expected.action(), actual.getAction());
+        assertEquals(expected.priority(), actual.getPriority());
+        assertEquals(expected.isChecked(), actual.isChecked());
+        assertFalse(actual.isWriteable());
+    }
+}
diff --git a/backend/src/test/java/ch/puzzle/okr/mapper/AlignmentSelectionMapperTest.java b/backend/src/test/java/ch/puzzle/okr/mapper/AlignmentSelectionMapperTest.java
index 26b799ff15..84c1db2ff8 100644
--- a/backend/src/test/java/ch/puzzle/okr/mapper/AlignmentSelectionMapperTest.java
+++ b/backend/src/test/java/ch/puzzle/okr/mapper/AlignmentSelectionMapperTest.java
@@ -7,6 +7,7 @@
 
 import java.util.List;
 
+import static ch.puzzle.okr.test.TestConstants.TEAM_PUZZLE;
 import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.assertTrue;
 
@@ -25,7 +26,7 @@ void toDtoShouldReturnEmptyListWhenNoObjectiveFound() {
     void toDtoShouldReturnOneElementWhenObjectiveFound() {
         List<AlignmentSelection> alignmentSelections = List.of(AlignmentSelection.Builder.builder()
                 .withAlignmentSelectionId(AlignmentSelectionId.Builder.builder().withObjectiveId(1L).build())
-                .withTeamId(2L).withTeamName("Puzzle ITC").withObjectiveTitle("Objective 1").build());
+                .withTeamId(2L).withTeamName(TEAM_PUZZLE).withObjectiveTitle("Objective 1").build());
         List<AlignmentObjectiveDto> alignmentObjectiveDtos = alignmentSelectionMapper.toDto(alignmentSelections);
 
         assertEquals(1, alignmentObjectiveDtos.size());
@@ -37,7 +38,7 @@ void toDtoShouldReturnOneElementWhenObjectiveWithKeyResultFound() {
         List<AlignmentSelection> alignmentSelections = List.of(AlignmentSelection.Builder.builder()
                 .withAlignmentSelectionId(
                         AlignmentSelectionId.Builder.builder().withObjectiveId(1L).withKeyResultId(3L).build())
-                .withTeamId(2L).withTeamName("Puzzle ITC").withObjectiveTitle("Objective 1")
+                .withTeamId(2L).withTeamName(TEAM_PUZZLE).withObjectiveTitle("Objective 1")
                 .withKeyResultTitle("Key Result 3").build());
         List<AlignmentObjectiveDto> alignmentObjectiveDtos = alignmentSelectionMapper.toDto(alignmentSelections);
 
@@ -51,12 +52,12 @@ void toDtoShouldReturnOneElementWhenObjectiveWithTwoKeyResultsFound() {
                 AlignmentSelection.Builder.builder()
                         .withAlignmentSelectionId(
                                 AlignmentSelectionId.Builder.builder().withObjectiveId(1L).withKeyResultId(3L).build())
-                        .withTeamId(2L).withTeamName("Puzzle ITC").withObjectiveTitle("Objective 1")
+                        .withTeamId(2L).withTeamName(TEAM_PUZZLE).withObjectiveTitle("Objective 1")
                         .withKeyResultTitle("Key Result 3").build(),
                 AlignmentSelection.Builder.builder()
                         .withAlignmentSelectionId(
                                 AlignmentSelectionId.Builder.builder().withObjectiveId(1L).withKeyResultId(5L).build())
-                        .withTeamId(2L).withTeamName("Puzzle ITC").withObjectiveTitle("Objective 1")
+                        .withTeamId(2L).withTeamName(TEAM_PUZZLE).withObjectiveTitle("Objective 1")
                         .withKeyResultTitle("Key Result 5").build());
         List<AlignmentObjectiveDto> alignmentObjectiveDtos = alignmentSelectionMapper.toDto(alignmentSelections);
 
@@ -70,17 +71,17 @@ void toDtoShouldReturnOneElementWhenTwoObjectivesWithKeyResultsFound() {
                 AlignmentSelection.Builder.builder()
                         .withAlignmentSelectionId(
                                 AlignmentSelectionId.Builder.builder().withObjectiveId(1L).withKeyResultId(3L).build())
-                        .withTeamId(2L).withTeamName("Puzzle ITC").withObjectiveTitle("Objective 1")
+                        .withTeamId(2L).withTeamName(TEAM_PUZZLE).withObjectiveTitle("Objective 1")
                         .withKeyResultTitle("Key Result 3").build(),
                 AlignmentSelection.Builder.builder()
                         .withAlignmentSelectionId(
                                 AlignmentSelectionId.Builder.builder().withObjectiveId(5L).withKeyResultId(6L).build())
-                        .withTeamId(2L).withTeamName("Puzzle ITC").withObjectiveTitle("Objective 5")
+                        .withTeamId(2L).withTeamName(TEAM_PUZZLE).withObjectiveTitle("Objective 5")
                         .withKeyResultTitle("Key Result 6").build(),
                 AlignmentSelection.Builder.builder()
                         .withAlignmentSelectionId(
                                 AlignmentSelectionId.Builder.builder().withObjectiveId(1L).withKeyResultId(9L).build())
-                        .withTeamId(2L).withTeamName("Puzzle ITC").withObjectiveTitle("Objective 1")
+                        .withTeamId(2L).withTeamName(TEAM_PUZZLE).withObjectiveTitle("Objective 1")
                         .withKeyResultTitle("Key Result 9").build());
         List<AlignmentObjectiveDto> alignmentObjectiveDtos = alignmentSelectionMapper.toDto(alignmentSelections);
 
diff --git a/backend/src/test/java/ch/puzzle/okr/mapper/CnAttributesMapperTest.java b/backend/src/test/java/ch/puzzle/okr/mapper/CnAttributesMapperTest.java
new file mode 100644
index 0000000000..20be29cc7c
--- /dev/null
+++ b/backend/src/test/java/ch/puzzle/okr/mapper/CnAttributesMapperTest.java
@@ -0,0 +1,32 @@
+package ch.puzzle.okr.mapper;
+
+import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.DisplayName;
+import org.junit.jupiter.api.Test;
+
+import javax.naming.NamingException;
+import javax.naming.directory.Attributes;
+import javax.naming.directory.BasicAttributes;
+
+public class CnAttributesMapperTest {
+
+    private final CnAttributesMapper cnAttributesMapper = new CnAttributesMapper();
+
+    @DisplayName("for Cn AttributeId should return AttributeValue")
+    @Test
+    void forCnAttributeIdShouldReturnAttributeValue() throws NamingException {
+        Attributes attributes = new BasicAttributes();
+        attributes.put("cn", "Mango");
+
+        Assertions.assertEquals("Mango", cnAttributesMapper.mapFromAttributes(attributes));
+    }
+
+    @DisplayName("for non Cn AttributeId should return null")
+    @Test
+    void forNonCnAttributeIdShouldReturnNull() throws NamingException {
+        Attributes attributes = new BasicAttributes();
+        attributes.put("ou", "Juicy, Fruit");
+
+        Assertions.assertNull(cnAttributesMapper.mapFromAttributes(attributes));
+    }
+}
diff --git a/backend/src/test/java/ch/puzzle/okr/mapper/CompletedMapperTest.java b/backend/src/test/java/ch/puzzle/okr/mapper/CompletedMapperTest.java
new file mode 100644
index 0000000000..141bb9f789
--- /dev/null
+++ b/backend/src/test/java/ch/puzzle/okr/mapper/CompletedMapperTest.java
@@ -0,0 +1,71 @@
+package ch.puzzle.okr.mapper;
+
+import ch.puzzle.okr.dto.CompletedDto;
+import ch.puzzle.okr.models.Completed;
+import ch.puzzle.okr.models.Objective;
+import org.junit.jupiter.api.DisplayName;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.mockito.InjectMocks;
+import org.mockito.junit.jupiter.MockitoExtension;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+
+@ExtendWith(MockitoExtension.class)
+public class CompletedMapperTest {
+
+    private static final long ID = 0L;
+    private static final String COMMENT = "some comment";
+
+    @InjectMocks
+    private CompletedMapper completedMapper;
+
+    @DisplayName("toDo() should map Completed to Dto")
+    @Test
+    void toDtoShouldMapCompletedToDto() {
+        // arrange
+        Objective objective = Objective.Builder.builder().withId(23L).build();
+
+        Completed completed = Completed.Builder.builder() //
+                .withId(ID) //
+                .withComment(COMMENT) //
+                .withObjective(objective) //
+                .build();
+
+        // act
+        CompletedDto completedDto = completedMapper.toDto(completed);
+
+        // assert
+        assertNotNull(completedDto);
+        assertCompletedDto(completed, completedDto);
+    }
+
+    private void assertCompletedDto(Completed expected, CompletedDto actual) {
+        assertEquals(expected.getId(), actual.id());
+        assertEquals(expected.getComment(), actual.comment());
+        assertEquals(expected.getObjective().getId(), actual.objective().getId());
+    }
+
+    @DisplayName("toCompleted() should map Dto to Completed")
+    @Test
+    void toCompletedShouldMapDtoToCompleted() {
+        // arrange
+        Objective objective = Objective.Builder.builder().withId(23L).build();
+        CompletedDto completedDto = new CompletedDto(ID, objective, COMMENT);
+
+        // act
+        Completed completed = completedMapper.toCompleted(completedDto);
+
+        // assert
+        assertNotNull(completed);
+        assertCompleted(completedDto, completed);
+    }
+
+    private void assertCompleted(CompletedDto expected, Completed actual) {
+        assertEquals(expected.id(), actual.getId());
+        assertEquals(expected.comment(), actual.getComment());
+        assertEquals(expected.objective().getId(), actual.getObjective().getId());
+    }
+
+}
diff --git a/backend/src/test/java/ch/puzzle/okr/mapper/ObjectiveMapperTest.java b/backend/src/test/java/ch/puzzle/okr/mapper/ObjectiveMapperTest.java
new file mode 100644
index 0000000000..35ce1d1cc7
--- /dev/null
+++ b/backend/src/test/java/ch/puzzle/okr/mapper/ObjectiveMapperTest.java
@@ -0,0 +1,145 @@
+package ch.puzzle.okr.mapper;
+
+import ch.puzzle.okr.dto.ObjectiveDto;
+import ch.puzzle.okr.models.Objective;
+import ch.puzzle.okr.models.Quarter;
+import ch.puzzle.okr.models.State;
+import ch.puzzle.okr.models.Team;
+import ch.puzzle.okr.service.business.QuarterBusinessService;
+import ch.puzzle.okr.service.business.TeamBusinessService;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.DisplayName;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.mockito.Mock;
+import org.mockito.MockedStatic;
+import org.mockito.Mockito;
+import org.mockito.junit.jupiter.MockitoExtension;
+
+import java.time.LocalDateTime;
+import java.time.Month;
+
+import static org.junit.jupiter.api.Assertions.*;
+import static org.mockito.Mockito.when;
+
+@ExtendWith(MockitoExtension.class)
+public class ObjectiveMapperTest {
+
+    private static final long TEAM_ID = 23L;
+    private static final long QUARTER_ID = 10L;
+    private static final String QUARTER_LABEL = "GJ 2024 Q1";
+    private static final long ID = 0L;
+    private static final int VERSION = 1;
+    private static final String TITLE = "objective title";
+    private static final String DESCRIPTION = "objective description";
+    private static final State STATE = State.DRAFT;
+    private static final boolean IS_WRITEABLE = true;
+
+    private static final LocalDateTime CREATE_DATE_TIME = LocalDateTime.of(2024, Month.MAY, 20, 12, 35, 0);
+    private static final LocalDateTime MODIFIED_DATE_TIME = LocalDateTime.of(2024, Month.MAY, 21, 8, 0, 0);
+
+    private final Team team = Team.Builder.builder().withId(TEAM_ID).build();
+    private final Quarter quarter = Quarter.Builder.builder() //
+            .withId(QUARTER_ID) //
+            .withLabel(QUARTER_LABEL) //
+            .build();
+
+    private ObjectiveMapper objectiveMapper;
+
+    @Mock
+    private TeamBusinessService teamBusinessService;
+
+    @Mock
+    private QuarterBusinessService quarterBusinessService;
+
+    @BeforeEach
+    void setup() {
+        objectiveMapper = new ObjectiveMapper(teamBusinessService, quarterBusinessService);
+    }
+
+    @DisplayName("toDto() should map Objective to Dto")
+    @Test
+    void toDtoShouldMapObjectiveToDto() {
+        // arrange
+        Objective objective = Objective.Builder.builder() //
+                .withId(ID) //
+                .withVersion(VERSION) //
+                .withTitle(TITLE) //
+                .withTeam(team) //
+                .withQuarter(quarter) //
+                .withDescription(DESCRIPTION) //
+                .withState(STATE) //
+                .withCreatedOn(CREATE_DATE_TIME) //
+                .withModifiedOn(MODIFIED_DATE_TIME) //
+                .build();
+        objective.setWriteable(IS_WRITEABLE);
+
+        // act
+        ObjectiveDto objectiveDto = objectiveMapper.toDto(objective);
+
+        // assert
+        assertNotNull(objectiveDto);
+        assertObjectiveDto(objective, objectiveDto);
+    }
+
+    private void assertObjectiveDto(Objective expected, ObjectiveDto actual) {
+        assertEquals(expected.getId(), actual.id());
+        assertEquals(expected.getVersion(), actual.version());
+        assertEquals(expected.getTitle(), actual.title());
+        assertEquals(expected.getTeam().getId(), actual.teamId());
+        assertEquals(expected.getQuarter().getId(), actual.quarterId());
+        assertEquals(expected.getQuarter().getLabel(), actual.quarterLabel());
+        assertEquals(expected.getDescription(), actual.description());
+        assertEquals(expected.getState(), actual.state());
+        assertEquals(expected.getCreatedOn(), actual.createdOn());
+        assertEquals(expected.getModifiedOn(), actual.modifiedOn());
+    }
+
+    @DisplayName("toObjective() should map Dto to Objective")
+    @Test
+    void toObjectiveShouldMapDtoToObjective() {
+        // arrange
+        when(teamBusinessService.getTeamById(TEAM_ID)).thenReturn(team);
+        when(quarterBusinessService.getQuarterById(QUARTER_ID)).thenReturn(quarter);
+
+        ObjectiveDto objectiveDto = new ObjectiveDto( //
+                ID, //
+                VERSION, //
+                TITLE, //
+                TEAM_ID, //
+                QUARTER_ID, //
+                QUARTER_LABEL, //
+                DESCRIPTION, //
+                STATE, //
+                CREATE_DATE_TIME, //
+                MODIFIED_DATE_TIME, //
+                IS_WRITEABLE //
+        );
+
+        // mock (LocalDateTime.now()) + act + assert
+        try (MockedStatic<LocalDateTime> mockedStatic = Mockito.mockStatic(LocalDateTime.class)) {
+            mockedStatic.when(LocalDateTime::now).thenReturn(MODIFIED_DATE_TIME);
+
+            // act
+            Objective objective = objectiveMapper.toObjective(objectiveDto);
+
+            // assert
+            assertNotNull(objectiveDto);
+            assertObjective(objectiveDto, objective);
+        }
+    }
+
+    private void assertObjective(ObjectiveDto expected, Objective actual) {
+        assertEquals(expected.id(), actual.getId());
+        assertEquals(expected.version(), actual.getVersion());
+        assertEquals(expected.title(), actual.getTitle());
+        assertEquals(expected.teamId(), actual.getTeam().getId());
+        assertEquals(expected.quarterId(), actual.getQuarter().getId());
+        assertEquals(expected.quarterLabel(), actual.getQuarter().getLabel());
+        assertEquals(expected.description(), actual.getDescription());
+        assertEquals(expected.state(), actual.getState());
+        assertEquals(expected.createdOn(), actual.getCreatedOn());
+        assertEquals(expected.modifiedOn(), actual.getModifiedOn());
+        assertFalse(actual.isWriteable());
+    }
+}
diff --git a/backend/src/test/java/ch/puzzle/okr/mapper/OverviewMapperTest.java b/backend/src/test/java/ch/puzzle/okr/mapper/OverviewMapperTest.java
index a169cb25cb..374057e987 100644
--- a/backend/src/test/java/ch/puzzle/okr/mapper/OverviewMapperTest.java
+++ b/backend/src/test/java/ch/puzzle/okr/mapper/OverviewMapperTest.java
@@ -1,6 +1,5 @@
 package ch.puzzle.okr.mapper;
 
-import ch.puzzle.okr.test.TestHelper;
 import ch.puzzle.okr.dto.ErrorDto;
 import ch.puzzle.okr.dto.overview.OverviewDto;
 import ch.puzzle.okr.dto.overview.OverviewKeyResultDto;
@@ -9,25 +8,23 @@
 import ch.puzzle.okr.exception.OkrResponseStatusException;
 import ch.puzzle.okr.models.overview.Overview;
 import ch.puzzle.okr.models.overview.OverviewId;
-import ch.puzzle.okr.service.business.OrganisationBusinessService;
+import ch.puzzle.okr.test.TestHelper;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.extension.ExtendWith;
 import org.mockito.InjectMocks;
-import org.mockito.Mock;
 import org.mockito.junit.jupiter.MockitoExtension;
 
 import java.util.List;
 
 import static ch.puzzle.okr.Constants.KEY_RESULT_TYPE_METRIC;
 import static ch.puzzle.okr.Constants.KEY_RESULT_TYPE_ORDINAL;
+import static ch.puzzle.okr.test.TestConstants.TEAM_PUZZLE;
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.junit.jupiter.api.Assertions.*;
 import static org.springframework.http.HttpStatus.BAD_REQUEST;
 
 @ExtendWith(MockitoExtension.class)
 class OverviewMapperTest {
-    @Mock
-    private OrganisationBusinessService organisationBusinessService;
 
     @InjectMocks
     private OverviewMapper overviewMapper;
@@ -42,9 +39,8 @@ void toDtoShouldReturnEmptyListWhenNoTeamFound() {
 
     @Test
     void toDtoShouldReturnEmptyListWhenTeamFound() {
-        List<Overview> overviews = List
-                .of(Overview.Builder.builder().withOverviewId(OverviewId.Builder.builder().withTeamId(2L).build())
-                        .withTeamName("Puzzle ITC").build());
+        List<Overview> overviews = List.of(Overview.Builder.builder()
+                .withOverviewId(OverviewId.Builder.builder().withTeamId(2L).build()).withTeamName(TEAM_PUZZLE).build());
         List<OverviewDto> overviewDtos = overviewMapper.toDto(overviews);
 
         assertEquals(1, overviewDtos.size());
@@ -55,7 +51,7 @@ void toDtoShouldReturnEmptyListWhenTeamFound() {
     void toDtoShouldReturnOneElementWhenObjectiveFound() {
         List<Overview> overviews = List.of(Overview.Builder.builder()
                 .withOverviewId(OverviewId.Builder.builder().withObjectiveId(1L).withTeamId(2L).build())
-                .withTeamName("Puzzle ITC").withObjectiveTitle("Objective 1").build());
+                .withTeamName(TEAM_PUZZLE).withObjectiveTitle("Objective 1").build());
         List<OverviewDto> overviewDtos = overviewMapper.toDto(overviews);
 
         assertEquals(1, overviewDtos.size());
@@ -68,7 +64,7 @@ void toDtoShouldReturnOneElementWhenObjectiveWithKeyResultFound() {
         List<Overview> overviews = List.of(Overview.Builder.builder()
                 .withOverviewId(
                         OverviewId.Builder.builder().withObjectiveId(1L).withTeamId(2L).withKeyResultId(3L).build())
-                .withTeamName("Puzzle ITC").withObjectiveTitle("Objective 1").withKeyResultTitle("Key Result 1")
+                .withTeamName(TEAM_PUZZLE).withObjectiveTitle("Objective 1").withKeyResultTitle("Key Result 1")
                 .withKeyResultType(KEY_RESULT_TYPE_METRIC).build());
         List<OverviewDto> overviewDtos = overviewMapper.toDto(overviews);
 
@@ -82,7 +78,7 @@ void toDtoShouldReturnOneElementWhenObjectiveWithKeyResultAndCheckInsFound() {
         List<Overview> overviews = List.of(Overview.Builder.builder()
                 .withOverviewId(OverviewId.Builder.builder().withObjectiveId(1L).withTeamId(2L).withKeyResultId(3L)
                         .withCheckInId(4L).build())
-                .withTeamName("Puzzle ITC").withObjectiveTitle("Objective 1").withKeyResultTitle("Key Result 1")
+                .withTeamName(TEAM_PUZZLE).withObjectiveTitle("Objective 1").withKeyResultTitle("Key Result 1")
                 .withKeyResultType(KEY_RESULT_TYPE_METRIC).withCheckInValue(27.5).withConfidence(5).build());
         List<OverviewDto> overviewDtos = overviewMapper.toDto(overviews);
 
@@ -97,12 +93,12 @@ void toDtoShouldReturnOneElementWhenObjectiveWithTwoKeyResultAndCheckInFound() {
                 Overview.Builder.builder()
                         .withOverviewId(OverviewId.Builder.builder().withObjectiveId(1L).withTeamId(2L)
                                 .withKeyResultId(3L).withCheckInId(4L).build())
-                        .withTeamName("Puzzle ITC").withObjectiveTitle("Objective 1").withKeyResultTitle("Key Result 1")
+                        .withTeamName(TEAM_PUZZLE).withObjectiveTitle("Objective 1").withKeyResultTitle("Key Result 1")
                         .withKeyResultType(KEY_RESULT_TYPE_ORDINAL).withCheckInZone("COMMIT").build(),
                 Overview.Builder.builder()
                         .withOverviewId(OverviewId.Builder.builder().withObjectiveId(1L).withTeamId(2L)
                                 .withKeyResultId(5L).build())
-                        .withTeamName("Puzzle ITC").withObjectiveTitle("Objective 1").withKeyResultTitle("Key Result 5")
+                        .withTeamName(TEAM_PUZZLE).withObjectiveTitle("Objective 1").withKeyResultTitle("Key Result 5")
                         .withKeyResultType(KEY_RESULT_TYPE_METRIC).build());
         List<OverviewDto> overviewDtos = overviewMapper.toDto(overviews);
 
@@ -117,13 +113,13 @@ void toDtoShouldReturnOneElementWhenTwoObjectivesWithKeyResultAndCheckInFound()
                 Overview.Builder.builder()
                         .withOverviewId(OverviewId.Builder.builder().withObjectiveId(1L).withTeamId(2L)
                                 .withKeyResultId(3L).withCheckInId(4L).build())
-                        .withTeamName("Puzzle ITC").withObjectiveTitle("Objective 1").withKeyResultTitle("Key Result 1")
+                        .withTeamName(TEAM_PUZZLE).withObjectiveTitle("Objective 1").withKeyResultTitle("Key Result 1")
                         .withKeyResultType(KEY_RESULT_TYPE_METRIC).withBaseline(20.0).withStretchGoal(37.0)
                         .withUnit("TCHF").withCheckInValue(27.5).build(),
                 Overview.Builder.builder()
                         .withOverviewId(OverviewId.Builder.builder().withObjectiveId(5L).withTeamId(2L)
                                 .withKeyResultId(6L).withCheckInId(7L).build())
-                        .withTeamName("Puzzle ITC").withObjectiveTitle("Objective 5").withKeyResultTitle("Key Result 6")
+                        .withTeamName(TEAM_PUZZLE).withObjectiveTitle("Objective 5").withKeyResultTitle("Key Result 6")
                         .withKeyResultType(KEY_RESULT_TYPE_ORDINAL).withCommitZone("commit").withTargetZone("target")
                         .withStretchZone("stretch").withCheckInZone("checkIn").build());
         List<OverviewDto> overviewDtos = overviewMapper.toDto(overviews);
@@ -155,7 +151,7 @@ void toDtoShouldReturnOneElementWhenTwoTeamsWithObjectivesAndKeyResultsFound() {
                 Overview.Builder.builder()
                         .withOverviewId(OverviewId.Builder.builder().withObjectiveId(1L).withTeamId(2L)
                                 .withKeyResultId(3L).withCheckInId(4L).build())
-                        .withTeamName("Puzzle ITC").withObjectiveTitle("Objective 1").withKeyResultTitle("Key Result 1")
+                        .withTeamName(TEAM_PUZZLE).withObjectiveTitle("Objective 1").withKeyResultTitle("Key Result 1")
                         .withKeyResultType(KEY_RESULT_TYPE_ORDINAL).withCheckInZone("TARGET").build(),
                 Overview.Builder.builder()
                         .withOverviewId(OverviewId.Builder.builder().withObjectiveId(5L).withTeamId(4L)
@@ -181,7 +177,7 @@ void toDtoShouldThrowExceptionWhenKeyResultTypeNotSupported() {
         List<Overview> overviews = List.of(Overview.Builder.builder()
                 .withOverviewId(OverviewId.Builder.builder().withObjectiveId(1L).withTeamId(2L).withKeyResultId(3L)
                         .withCheckInId(4L).build())
-                .withTeamName("Puzzle ITC").withObjectiveTitle("Objective 1").withKeyResultTitle("Key Result 1")
+                .withTeamName(TEAM_PUZZLE).withObjectiveTitle("Objective 1").withKeyResultTitle("Key Result 1")
                 .withKeyResultType("unknown").withCheckInZone("TARGET").build());
 
         OkrResponseStatusException exception = assertThrows(OkrResponseStatusException.class,
diff --git a/backend/src/test/java/ch/puzzle/okr/mapper/TeamMapperTest.java b/backend/src/test/java/ch/puzzle/okr/mapper/TeamMapperTest.java
new file mode 100644
index 0000000000..a885626375
--- /dev/null
+++ b/backend/src/test/java/ch/puzzle/okr/mapper/TeamMapperTest.java
@@ -0,0 +1,71 @@
+package ch.puzzle.okr.mapper;
+
+import ch.puzzle.okr.dto.TeamDto;
+import ch.puzzle.okr.models.Team;
+import org.junit.jupiter.api.DisplayName;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.mockito.InjectMocks;
+import org.mockito.junit.jupiter.MockitoExtension;
+
+import static org.junit.jupiter.api.Assertions.*;
+
+@ExtendWith(MockitoExtension.class)
+public class TeamMapperTest {
+
+    private static final long ID = 0L;
+    private static final int VERSION = 1;
+    private static final String NAME = "my team name";
+    public static final boolean IS_WRITEABLE = true;
+
+    @InjectMocks
+    private TeamMapper teamMapper;
+
+    @DisplayName("toDto() should map Team to Dto")
+    @Test
+    void toDtoShouldMapTeamToDto() {
+        // arrange
+        Team team = Team.Builder.builder() //
+                .withId(ID) //
+                .withVersion(VERSION) //
+                .withName(NAME) //
+                .build();
+        team.setWriteable(IS_WRITEABLE);
+
+        // act
+        TeamDto teamDto = teamMapper.toDto(team);
+
+        // assert
+        assertNotNull(teamDto);
+        assertTeamDto(team, teamDto);
+    }
+
+    private static void assertTeamDto(Team expected, TeamDto actual) {
+        assertEquals(expected.getId(), actual.id());
+        assertEquals(expected.getVersion(), actual.version());
+        assertEquals(expected.getName(), actual.name());
+        assertEquals(expected.isWriteable(), actual.writeable());
+    }
+
+    @DisplayName("toTeam() should map Dto to Team")
+    @Test
+    void toTeamShouldMapDtoToTeam() {
+        // arrange
+        TeamDto teamDto = new TeamDto(ID, VERSION, NAME, IS_WRITEABLE);
+
+        // act
+        Team team = teamMapper.toTeam(teamDto);
+
+        // assert
+        assertNotNull(team);
+        assertTeam(teamDto, team);
+    }
+
+    private static void assertTeam(TeamDto expected, Team actual) {
+        assertEquals(expected.id(), actual.getId());
+        assertEquals(expected.version(), actual.getVersion());
+        assertEquals(expected.name(), actual.getName());
+        assertFalse(actual.isWriteable());
+    }
+
+}
diff --git a/backend/src/test/java/ch/puzzle/okr/mapper/UserMapperTest.java b/backend/src/test/java/ch/puzzle/okr/mapper/UserMapperTest.java
new file mode 100644
index 0000000000..3677e06a18
--- /dev/null
+++ b/backend/src/test/java/ch/puzzle/okr/mapper/UserMapperTest.java
@@ -0,0 +1,133 @@
+package ch.puzzle.okr.mapper;
+
+import ch.puzzle.okr.dto.NewUserDto;
+import ch.puzzle.okr.dto.UserDto;
+import ch.puzzle.okr.models.Team;
+import ch.puzzle.okr.models.User;
+import ch.puzzle.okr.models.UserTeam;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.DisplayName;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.mockito.InjectMocks;
+import org.mockito.junit.jupiter.MockitoExtension;
+
+import java.util.List;
+
+import static org.junit.jupiter.api.Assertions.*;
+
+@ExtendWith(MockitoExtension.class)
+public class UserMapperTest {
+
+    private static final long USER_TEAM_ID = 100L;
+    private static final long ID = 0L;
+    private static final int VERSION = 1;
+    private static final String FIRSTNAME = "firstname";
+    private static final String LASTNAME = "lastname";
+    private static final String EMAIL = "a@b.ch";
+    private static final boolean IS_OKR_CHAMPION = true;
+
+    private UserMapper userMapper;
+
+    @InjectMocks
+    private TeamMapper teamMapper;
+
+    private final User user = User.Builder.builder() //
+            .withId(ID) //
+            .withVersion(VERSION) //
+            .withFirstname(FIRSTNAME) //
+            .withLastname(LASTNAME) //
+            .withEmail(EMAIL) //
+            .withUserTeamList(List.of(UserTeam.Builder.builder() //
+                    .withId(USER_TEAM_ID) //
+                    .withTeam(Team.Builder.builder().build()) //
+                    .build())) //
+            .withOkrChampion(IS_OKR_CHAMPION) //
+            .build();
+
+    private final NewUserDto userDto = new NewUserDto(FIRSTNAME, LASTNAME, EMAIL);
+
+    @BeforeEach
+    void setup() {
+        userMapper = new UserMapper(teamMapper);
+    }
+
+    @DisplayName("toDto() without TeamList throws NullPointerException")
+    @Test
+    void toDtoWithoutTeamListThrowsException() {
+        // arrange
+        User user = User.Builder.builder() //
+                .withId(ID) //
+                .withVersion(VERSION) //
+                .withFirstname(FIRSTNAME) //
+                .withLastname(LASTNAME) //
+                .withEmail(EMAIL) //
+                .withOkrChampion(IS_OKR_CHAMPION) //
+                .build();
+
+        // act + assert
+        assertThrows(NullPointerException.class, () -> userMapper.toDto(user));
+    }
+
+    @DisplayName("toDto() should map User to Dto")
+    @Test
+    void toDtoShouldMapUserToDto() {
+        // act
+        UserDto userDto = userMapper.toDto(user);
+
+        // assert
+        assertNotNull(userDto);
+        assertUserDto(user, userDto);
+    }
+
+    @DisplayName("toDtos() should map list of Users to Dtos")
+    @Test
+    void toDtosShouldMapListOfUsersToDtos() {
+        // act
+        List<UserDto> userDtos = userMapper.toDtos(List.of(user));
+
+        // assert
+        assertEquals(1, userDtos.size());
+        assertUserDto(user, userDtos.get(0));
+    }
+
+    private void assertUserDto(User expected, UserDto actual) {
+        assertEquals(expected.getId(), actual.id());
+        assertEquals(expected.getVersion(), actual.version());
+        assertEquals(expected.getFirstname(), actual.firstname());
+        assertEquals(expected.isOkrChampion(), actual.isOkrChampion());
+        assertEquals(expected.getEmail(), actual.email());
+
+        assertEquals(1, actual.userTeamList().size());
+        assertEquals(expected.getUserTeamList().get(0).getId(), actual.userTeamList().get(0).id());
+    }
+
+    @DisplayName("toUser() should map UserDto to User")
+    @Test
+    void toUserShouldMapUserDtoToUser() {
+        // act
+        User user = userMapper.toUser(userDto);
+
+        // assert
+        assertNotNull(user);
+        assertUser(userDto, user);
+    }
+
+    @DisplayName("toUserList() should map List of UserDtos to List of Users")
+    @Test
+    void toUserListShouldMapUserDtoListToUserList() {
+        // act
+        List<User> users = userMapper.toUserList(List.of(userDto));
+
+        // assert
+        assertEquals(1, users.size());
+        assertUser(userDto, users.get(0));
+    }
+
+    private void assertUser(NewUserDto expected, User actual) {
+        assertEquals(expected.firstname(), actual.getFirstname());
+        assertEquals(expected.lastname(), actual.getLastname());
+        assertEquals(expected.email(), actual.getEmail());
+    }
+
+}
diff --git a/backend/src/test/java/ch/puzzle/okr/mapper/checkin/CheckInMapperTest.java b/backend/src/test/java/ch/puzzle/okr/mapper/checkin/CheckInMapperTest.java
new file mode 100644
index 0000000000..514d838491
--- /dev/null
+++ b/backend/src/test/java/ch/puzzle/okr/mapper/checkin/CheckInMapperTest.java
@@ -0,0 +1,131 @@
+package ch.puzzle.okr.mapper.checkin;
+
+import ch.puzzle.okr.dto.checkin.CheckInDto;
+import ch.puzzle.okr.dto.checkin.CheckInMetricDto;
+import ch.puzzle.okr.dto.checkin.CheckInOrdinalDto;
+import ch.puzzle.okr.mapper.checkin.helper.TestDataDtoHelper;
+import ch.puzzle.okr.mapper.checkin.helper.TestDataHelper;
+import ch.puzzle.okr.models.checkin.CheckIn;
+import ch.puzzle.okr.models.checkin.CheckInMetric;
+import ch.puzzle.okr.models.checkin.CheckInOrdinal;
+import ch.puzzle.okr.models.keyresult.KeyResult;
+import ch.puzzle.okr.service.business.KeyResultBusinessService;
+import ch.puzzle.okr.service.persistence.KeyResultPersistenceService;
+import ch.puzzle.okr.service.validation.KeyResultValidationService;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.DisplayName;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.mockito.Mock;
+import org.mockito.junit.jupiter.MockitoExtension;
+import org.springframework.http.HttpStatus;
+import org.springframework.web.server.ResponseStatusException;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.mockito.Mockito.when;
+
+@ExtendWith(MockitoExtension.class)
+public class CheckInMapperTest {
+
+    private CheckInMapper checkInMapper;
+    @Mock
+    private KeyResultBusinessService keyResultBusinessService;
+    @Mock
+    private KeyResultValidationService validator;
+    @Mock
+    private KeyResultPersistenceService keyResultPersistenceService;
+
+    @BeforeEach
+    void setup() {
+        CheckInMetricMapper checkInMetricMapper = new CheckInMetricMapper(keyResultBusinessService);
+        CheckInOrdinalMapper checkInOrdinalMapper = new CheckInOrdinalMapper(keyResultBusinessService);
+        checkInMapper = new CheckInMapper(checkInMetricMapper, checkInOrdinalMapper);
+    }
+
+    @DisplayName("toDto() should map CheckInMetric to CheckInMetricDto")
+    @Test
+    void toDtoShouldMapCheckInMetricToCheckInMetricDto() {
+        // arrange
+        CheckInMetric checkInMetric = TestDataHelper.checkInMetric();
+
+        // act
+        CheckInDto checkInDto = checkInMapper.toDto(checkInMetric);
+
+        // assert
+        assertEquals(CheckInMetricDto.class, checkInDto.getClass());
+    }
+
+    @DisplayName("toDto() should map CheckInOrdinal to a CheckInOrdinalDto")
+    @Test
+    void toDtoShouldMapCheckInOrdinalToCheckInOrdinalDto() {
+        // arrange
+        CheckInOrdinal checkInOrdinal = TestDataHelper.checkInOrdinal();
+
+        // act
+        CheckInDto checkInDto = checkInMapper.toDto(checkInOrdinal);
+
+        // assert
+        assertEquals(CheckInOrdinalDto.class, checkInDto.getClass());
+    }
+
+    @DisplayName("toCheckIn() should map Dto to CheckInMetric")
+    @Test
+    void toCheckInShouldMapDtoToCheckInMetric() {
+        // arrange
+        KeyResult keyResult = TestDataHelper.keyResult();
+        when(keyResultBusinessService.getEntityById(keyResult.getId())).thenReturn(keyResult);
+
+        CheckInMetricDto checkInMetricDto = TestDataDtoHelper.checkInMetricDto();
+
+        // act
+        CheckIn check = checkInMapper.toCheckIn(checkInMetricDto);
+
+        // assert
+        assertEquals(CheckInMetric.class, check.getClass());
+    }
+
+    @DisplayName("toCheckIn() should map Dto to CheckInOrdinal")
+    @Test
+    void toCheckInShouldMapDtoToCheckInOrdinal() {
+        // arrange
+        KeyResult keyResult = TestDataHelper.keyResult();
+        when(keyResultBusinessService.getEntityById(keyResult.getId())).thenReturn(keyResult);
+
+        CheckInOrdinalDto checkInOrdinalDto = TestDataDtoHelper.checkInOrdinalDto();
+
+        // act
+        CheckIn check = checkInMapper.toCheckIn(checkInOrdinalDto);
+
+        // assert
+        assertEquals(CheckInOrdinal.class, check.getClass());
+    }
+
+    @DisplayName("toDto() should throw Exception if CheckIn is not Metric or Ordinal")
+    @Test
+    void toDtoShouldThrowExceptionIfCheckInIsNotMetricOrOrdinal() {
+        // arrange
+        CheckIn checkIn = new CheckIn() {
+        };
+
+        // act + assert
+        ResponseStatusException responseStatusException = assertThrows( //
+                ResponseStatusException.class, //
+                () -> checkInMapper.toDto(checkIn));
+        assertEquals(HttpStatus.BAD_REQUEST, responseStatusException.getStatusCode());
+    }
+
+    @DisplayName("toCheckIn() should throw Exception if CheckIn is not MetricDto or OrdinalDto")
+    @Test
+    void toCheckInShouldThrowExceptionIfCheckInIsNotMetricOrOrdinal() {
+        // arrange
+        CheckInDto checkInDto = new CheckInDto() {
+        };
+
+        // act + assert
+        ResponseStatusException responseStatusException = assertThrows( //
+                ResponseStatusException.class, //
+                () -> checkInMapper.toCheckIn(checkInDto));
+        assertEquals(HttpStatus.BAD_REQUEST, responseStatusException.getStatusCode());
+    }
+}
diff --git a/backend/src/test/java/ch/puzzle/okr/mapper/checkin/CheckInMetricMapperTest.java b/backend/src/test/java/ch/puzzle/okr/mapper/checkin/CheckInMetricMapperTest.java
new file mode 100644
index 0000000000..138391aa35
--- /dev/null
+++ b/backend/src/test/java/ch/puzzle/okr/mapper/checkin/CheckInMetricMapperTest.java
@@ -0,0 +1,72 @@
+package ch.puzzle.okr.mapper.checkin;
+
+import ch.puzzle.okr.dto.checkin.CheckInMetricDto;
+import ch.puzzle.okr.mapper.checkin.helper.TestDataHelper;
+import ch.puzzle.okr.models.checkin.CheckIn;
+import ch.puzzle.okr.models.checkin.CheckInMetric;
+import ch.puzzle.okr.models.keyresult.KeyResult;
+import ch.puzzle.okr.service.business.KeyResultBusinessService;
+import ch.puzzle.okr.service.persistence.KeyResultPersistenceService;
+import ch.puzzle.okr.service.validation.KeyResultValidationService;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.DisplayName;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.mockito.Mock;
+import org.mockito.junit.jupiter.MockitoExtension;
+
+import static ch.puzzle.okr.mapper.checkin.helper.AssertHelper.assertCheckInMetric;
+import static ch.puzzle.okr.mapper.checkin.helper.AssertHelper.assertCheckInMetricDto;
+import static ch.puzzle.okr.mapper.checkin.helper.TestDataDtoHelper.checkInMetricDto;
+import static ch.puzzle.okr.mapper.checkin.helper.TestDataHelper.checkInMetric;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.mockito.Mockito.when;
+
+@ExtendWith(MockitoExtension.class)
+public class CheckInMetricMapperTest {
+
+    private CheckInMetricMapper checkInMetricMapper;
+    @Mock
+    private KeyResultBusinessService keyResultBusinessService;
+    @Mock
+    private KeyResultValidationService validator;
+    @Mock
+    private KeyResultPersistenceService keyResultPersistenceService;
+
+    @BeforeEach
+    void setup() {
+        checkInMetricMapper = new CheckInMetricMapper(keyResultBusinessService);
+    }
+
+    @DisplayName("toDto() should map CheckInMetric to Dto")
+    @Test
+    void toDtoShouldMapCheckInMetricToDto() {
+        // arrange
+        CheckInMetric checkInMetric = checkInMetric();
+
+        // act
+        CheckInMetricDto checkInMetricDto = checkInMetricMapper.toDto(checkInMetric);
+
+        // assert
+        assertNotNull(checkInMetricDto);
+        assertCheckInMetricDto(checkInMetric, checkInMetricDto);
+    }
+
+    @DisplayName("toCheckInMetric() should map Dto to checkInMetric")
+    @Test
+    void toCheckInMetricShouldMapDtoToCheckInMetric() {
+        // arrange
+        KeyResult keyResult = TestDataHelper.keyResult();
+        when(keyResultBusinessService.getEntityById(keyResult.getId())).thenReturn(keyResult);
+
+        CheckInMetricDto checkInMetricDto = checkInMetricDto();
+
+        // act
+        CheckIn checkIn = checkInMetricMapper.toCheckInMetric(checkInMetricDto);
+        CheckInMetric checkInMetric = (CheckInMetric) checkIn;
+
+        // assert
+        assertNotNull(checkInMetricDto);
+        assertCheckInMetric(checkInMetricDto, checkInMetric);
+    }
+}
diff --git a/backend/src/test/java/ch/puzzle/okr/mapper/checkin/CheckInOrdinalMapperTest.java b/backend/src/test/java/ch/puzzle/okr/mapper/checkin/CheckInOrdinalMapperTest.java
new file mode 100644
index 0000000000..76a7900bcf
--- /dev/null
+++ b/backend/src/test/java/ch/puzzle/okr/mapper/checkin/CheckInOrdinalMapperTest.java
@@ -0,0 +1,73 @@
+package ch.puzzle.okr.mapper.checkin;
+
+import ch.puzzle.okr.dto.checkin.CheckInOrdinalDto;
+import ch.puzzle.okr.mapper.checkin.helper.TestDataHelper;
+import ch.puzzle.okr.models.checkin.CheckIn;
+import ch.puzzle.okr.models.checkin.CheckInOrdinal;
+import ch.puzzle.okr.models.keyresult.KeyResult;
+import ch.puzzle.okr.service.business.KeyResultBusinessService;
+import ch.puzzle.okr.service.persistence.KeyResultPersistenceService;
+import ch.puzzle.okr.service.validation.KeyResultValidationService;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.DisplayName;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.mockito.Mock;
+import org.mockito.junit.jupiter.MockitoExtension;
+
+import static ch.puzzle.okr.mapper.checkin.helper.AssertHelper.assertCheckInOrdinal;
+import static ch.puzzle.okr.mapper.checkin.helper.AssertHelper.assertCheckInOrdinalDto;
+import static ch.puzzle.okr.mapper.checkin.helper.TestDataDtoHelper.checkInOrdinalDto;
+import static ch.puzzle.okr.mapper.checkin.helper.TestDataHelper.checkInOrdinal;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.mockito.Mockito.when;
+
+@ExtendWith(MockitoExtension.class)
+public class CheckInOrdinalMapperTest {
+
+    private CheckInOrdinalMapper checkInOrdinalMapper;
+    @Mock
+    private KeyResultBusinessService keyResultBusinessService;
+    @Mock
+    private KeyResultValidationService validator;
+    @Mock
+    private KeyResultPersistenceService keyResultPersistenceService;
+
+    @BeforeEach
+    void setup() {
+        checkInOrdinalMapper = new CheckInOrdinalMapper(keyResultBusinessService);
+    }
+
+    @DisplayName("toDto() should map CheckInOrdinal to Dto")
+    @Test
+    void toDtoShouldMapCheckInOrdinalToDto() {
+        // arrange
+        CheckInOrdinal checkInOrdinal = checkInOrdinal();
+
+        // act
+        CheckInOrdinalDto checkInOrdinalDto = checkInOrdinalMapper.toDto(checkInOrdinal);
+
+        // assert
+        assertNotNull(checkInOrdinalDto);
+        assertCheckInOrdinalDto(checkInOrdinal, checkInOrdinalDto);
+    }
+
+    @DisplayName("toCheckInOrdinal() should map Dto to checkInOrdinal")
+    @Test
+    void toCheckInOrdinalShouldMapDtoToCheckInOrdinal() {
+        // arrange
+        KeyResult keyResult = TestDataHelper.keyResult();
+        when(keyResultBusinessService.getEntityById(keyResult.getId())).thenReturn(keyResult);
+
+        CheckInOrdinalDto checkInOrdinalDto = checkInOrdinalDto();
+
+        // act
+        CheckIn checkIn = checkInOrdinalMapper.toCheckInOrdinal(checkInOrdinalDto);
+        CheckInOrdinal checkInOrdinal = (CheckInOrdinal) checkIn;
+
+        // assert
+        assertNotNull(checkInOrdinal);
+        assertCheckInOrdinal(checkInOrdinalDto, checkInOrdinal);
+    }
+
+}
diff --git a/backend/src/test/java/ch/puzzle/okr/mapper/checkin/helper/AssertHelper.java b/backend/src/test/java/ch/puzzle/okr/mapper/checkin/helper/AssertHelper.java
new file mode 100644
index 0000000000..f05c16717b
--- /dev/null
+++ b/backend/src/test/java/ch/puzzle/okr/mapper/checkin/helper/AssertHelper.java
@@ -0,0 +1,64 @@
+package ch.puzzle.okr.mapper.checkin.helper;
+
+import ch.puzzle.okr.dto.checkin.CheckInMetricDto;
+import ch.puzzle.okr.dto.checkin.CheckInOrdinalDto;
+import ch.puzzle.okr.models.checkin.CheckInMetric;
+import ch.puzzle.okr.models.checkin.CheckInOrdinal;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+
+public class AssertHelper {
+
+    public static void assertCheckInMetricDto(CheckInMetric expected, CheckInMetricDto actual) {
+        assertEquals(expected.getId(), actual.id());
+        assertEquals(expected.getVersion(), actual.version());
+        assertEquals(expected.getChangeInfo(), actual.changeInfo());
+        assertEquals(expected.getInitiatives(), actual.initiatives());
+        assertEquals(expected.getConfidence(), actual.confidence());
+        assertEquals(expected.getKeyResult().getId(), actual.keyResultId());
+        assertEquals(expected.getCreatedOn(), actual.createdOn());
+        assertEquals(expected.getModifiedOn(), actual.modifiedOn());
+        assertEquals(expected.getValue(), actual.value());
+        assertEquals(expected.isWriteable(), actual.writeable());
+    }
+
+    public static void assertCheckInMetric(CheckInMetricDto expected, CheckInMetric actual) {
+        assertEquals(expected.id(), actual.getId());
+        assertEquals(expected.version(), actual.getVersion());
+        assertEquals(expected.changeInfo(), actual.getChangeInfo());
+        assertEquals(expected.initiatives(), actual.getInitiatives());
+        assertEquals(expected.confidence(), actual.getConfidence());
+        assertEquals(expected.keyResultId(), actual.getKeyResult().getId());
+        assertEquals(expected.createdOn(), actual.getCreatedOn());
+        assertEquals(expected.modifiedOn(), actual.getModifiedOn());
+        assertEquals(expected.value(), actual.getValue());
+        assertFalse(actual.isWriteable());
+    }
+
+    public static void assertCheckInOrdinalDto(CheckInOrdinal expected, CheckInOrdinalDto actual) {
+        assertEquals(expected.getId(), actual.id());
+        assertEquals(expected.getVersion(), actual.version());
+        assertEquals(expected.getChangeInfo(), actual.changeInfo());
+        assertEquals(expected.getInitiatives(), actual.initiatives());
+        assertEquals(expected.getConfidence(), actual.confidence());
+        assertEquals(expected.getKeyResult().getId(), actual.keyResultId());
+        assertEquals(expected.getCreatedOn(), actual.createdOn());
+        assertEquals(expected.getModifiedOn(), actual.modifiedOn());
+        assertEquals(expected.getZone(), actual.value());
+        assertEquals(expected.isWriteable(), actual.writeable());
+    }
+
+    public static void assertCheckInOrdinal(CheckInOrdinalDto checkInOrdinalDto, CheckInOrdinal checkInOrdinal) {
+        assertEquals(checkInOrdinalDto.id(), checkInOrdinal.getId());
+        assertEquals(checkInOrdinalDto.version(), checkInOrdinal.getVersion());
+        assertEquals(checkInOrdinalDto.changeInfo(), checkInOrdinal.getChangeInfo());
+        assertEquals(checkInOrdinalDto.initiatives(), checkInOrdinal.getInitiatives());
+        assertEquals(checkInOrdinalDto.confidence(), checkInOrdinal.getConfidence());
+        assertEquals(checkInOrdinalDto.keyResultId(), checkInOrdinal.getKeyResult().getId());
+        assertEquals(checkInOrdinalDto.createdOn(), checkInOrdinal.getCreatedOn());
+        assertEquals(checkInOrdinalDto.modifiedOn(), checkInOrdinal.getModifiedOn());
+        assertEquals(checkInOrdinalDto.value(), checkInOrdinal.getZone());
+        assertFalse(checkInOrdinal.isWriteable());
+    }
+}
diff --git a/backend/src/test/java/ch/puzzle/okr/mapper/checkin/helper/TestDataConstants.java b/backend/src/test/java/ch/puzzle/okr/mapper/checkin/helper/TestDataConstants.java
new file mode 100644
index 0000000000..a060a43c11
--- /dev/null
+++ b/backend/src/test/java/ch/puzzle/okr/mapper/checkin/helper/TestDataConstants.java
@@ -0,0 +1,20 @@
+package ch.puzzle.okr.mapper.checkin.helper;
+
+import ch.puzzle.okr.models.checkin.Zone;
+
+import java.time.LocalDateTime;
+import java.time.Month;
+
+public class TestDataConstants {
+    public static final boolean CHECK_IN_IS_WRITEABLE = true;
+    public static final long CHECK_IN_ID = 0L;
+    public static final int CHECK_IN_VERSION = 1;
+    public static final String CHECK_IN_CHANGE_INFO = "change info";
+    public static final String CHECK_IN_INITIATIVES = "initiatives";
+    public static final int CHECK_IN_CONFIDENCE = 30;
+    public static final double CHECK_IN_METRIC_VALUE = 23;
+    public static final Zone CHECK_IN_ORDINAL_ZONE = Zone.STRETCH;
+    public static final LocalDateTime CHECK_IN_CREATE_DATE_TIME = LocalDateTime.of(2024, Month.MAY, 20, 12, 35, 0);
+    public static final LocalDateTime CHECK_IN_MODIFIED_DATE_TIME = LocalDateTime.of(2024, Month.MAY, 21, 8, 0, 0);
+    public static final long KEY_RESULT_ID = 20L;
+}
diff --git a/backend/src/test/java/ch/puzzle/okr/mapper/checkin/helper/TestDataDtoHelper.java b/backend/src/test/java/ch/puzzle/okr/mapper/checkin/helper/TestDataDtoHelper.java
new file mode 100644
index 0000000000..f7c7f2ff14
--- /dev/null
+++ b/backend/src/test/java/ch/puzzle/okr/mapper/checkin/helper/TestDataDtoHelper.java
@@ -0,0 +1,41 @@
+package ch.puzzle.okr.mapper.checkin.helper;
+
+import ch.puzzle.okr.dto.checkin.CheckInMetricDto;
+import ch.puzzle.okr.dto.checkin.CheckInOrdinalDto;
+
+import static ch.puzzle.okr.mapper.checkin.helper.TestDataConstants.*;
+
+public class TestDataDtoHelper {
+
+    public static CheckInMetricDto checkInMetricDto() {
+        return checkInMetricDto;
+    }
+
+    public static CheckInOrdinalDto checkInOrdinalDto() {
+        return checkInOrdinalDto;
+    }
+
+    private static final CheckInMetricDto checkInMetricDto = new CheckInMetricDto(CHECK_IN_ID, //
+            CHECK_IN_VERSION, //
+            CHECK_IN_CHANGE_INFO, //
+            CHECK_IN_INITIATIVES, //
+            CHECK_IN_CONFIDENCE, //
+            KEY_RESULT_ID, //
+            CHECK_IN_CREATE_DATE_TIME, //
+            CHECK_IN_MODIFIED_DATE_TIME, //
+            CHECK_IN_METRIC_VALUE, //
+            CHECK_IN_IS_WRITEABLE //
+    );
+
+    private static final CheckInOrdinalDto checkInOrdinalDto = new CheckInOrdinalDto(CHECK_IN_ID, //
+            CHECK_IN_VERSION, //
+            CHECK_IN_CHANGE_INFO, //
+            CHECK_IN_INITIATIVES, //
+            CHECK_IN_CONFIDENCE, //
+            KEY_RESULT_ID, //
+            CHECK_IN_CREATE_DATE_TIME, //
+            CHECK_IN_MODIFIED_DATE_TIME, //
+            CHECK_IN_ORDINAL_ZONE, //
+            CHECK_IN_IS_WRITEABLE //
+    );
+}
diff --git a/backend/src/test/java/ch/puzzle/okr/mapper/checkin/helper/TestDataHelper.java b/backend/src/test/java/ch/puzzle/okr/mapper/checkin/helper/TestDataHelper.java
new file mode 100644
index 0000000000..dc2d43b9c8
--- /dev/null
+++ b/backend/src/test/java/ch/puzzle/okr/mapper/checkin/helper/TestDataHelper.java
@@ -0,0 +1,53 @@
+package ch.puzzle.okr.mapper.checkin.helper;
+
+import ch.puzzle.okr.models.checkin.CheckIn;
+import ch.puzzle.okr.models.checkin.CheckInMetric;
+import ch.puzzle.okr.models.checkin.CheckInOrdinal;
+import ch.puzzle.okr.models.keyresult.KeyResult;
+import ch.puzzle.okr.models.keyresult.KeyResultMetric;
+
+import static ch.puzzle.okr.mapper.checkin.helper.TestDataConstants.*;
+
+public class TestDataHelper {
+
+    public static KeyResult keyResult() {
+        return keyResult;
+    }
+
+    public static CheckInMetric checkInMetric() {
+        checkInMetric.setWriteable(CHECK_IN_IS_WRITEABLE);
+        return (CheckInMetric) checkInMetric;
+    }
+
+    public static CheckInOrdinal checkInOrdinal() {
+        checkInOrdinal.setWriteable(CHECK_IN_IS_WRITEABLE);
+        return (CheckInOrdinal) TestDataHelper.checkInOrdinal;
+    }
+
+    private static final KeyResult keyResult = KeyResultMetric.Builder.builder() //
+            .withId(KEY_RESULT_ID) //
+            .build();
+
+    private static final CheckIn checkInMetric = CheckInMetric.Builder.builder() //
+            .withId(CHECK_IN_ID) //
+            .withVersion(CHECK_IN_VERSION) //
+            .withChangeInfo(CHECK_IN_CHANGE_INFO) //
+            .withInitiatives(CHECK_IN_INITIATIVES) //
+            .withConfidence(CHECK_IN_CONFIDENCE) //
+            .withKeyResult(keyResult) //
+            .withCreatedOn(CHECK_IN_CREATE_DATE_TIME) //
+            .withModifiedOn(CHECK_IN_MODIFIED_DATE_TIME) //
+            .withValue(CHECK_IN_METRIC_VALUE) //
+            .build();
+
+    private static final CheckIn checkInOrdinal = CheckInOrdinal.Builder.builder() //
+            .withId(CHECK_IN_ID) //
+            .withVersion(CHECK_IN_VERSION) //
+            .withChangeInfo(CHECK_IN_CHANGE_INFO) //
+            .withInitiatives(CHECK_IN_INITIATIVES) //
+            .withConfidence(CHECK_IN_CONFIDENCE) //
+            .withKeyResult(keyResult) //
+            .withCreatedOn(CHECK_IN_CREATE_DATE_TIME) //
+            .withModifiedOn(CHECK_IN_MODIFIED_DATE_TIME) //
+            .withZone(CHECK_IN_ORDINAL_ZONE).build();
+}
diff --git a/backend/src/test/java/ch/puzzle/okr/mapper/keyresult/KeyResultMapperTest.java b/backend/src/test/java/ch/puzzle/okr/mapper/keyresult/KeyResultMapperTest.java
new file mode 100644
index 0000000000..8ba2235adc
--- /dev/null
+++ b/backend/src/test/java/ch/puzzle/okr/mapper/keyresult/KeyResultMapperTest.java
@@ -0,0 +1,144 @@
+package ch.puzzle.okr.mapper.keyresult;
+
+import ch.puzzle.okr.dto.keyresult.KeyResultDto;
+import ch.puzzle.okr.dto.keyresult.KeyResultMetricDto;
+import ch.puzzle.okr.dto.keyresult.KeyResultOrdinalDto;
+import ch.puzzle.okr.mapper.ActionMapper;
+import ch.puzzle.okr.models.Action;
+import ch.puzzle.okr.models.keyresult.KeyResult;
+import ch.puzzle.okr.models.keyresult.KeyResultMetric;
+import ch.puzzle.okr.models.keyresult.KeyResultOrdinal;
+import ch.puzzle.okr.service.business.CheckInBusinessService;
+import ch.puzzle.okr.service.business.ObjectiveBusinessService;
+import ch.puzzle.okr.service.business.UserBusinessService;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.DisplayName;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.mockito.InjectMocks;
+import org.mockito.Mock;
+import org.mockito.junit.jupiter.MockitoExtension;
+import org.springframework.http.HttpStatus;
+import org.springframework.web.server.ResponseStatusException;
+
+import java.util.List;
+
+import static ch.puzzle.okr.mapper.keyresult.helper.TestDataDtoHelper.keyResultMetricDto;
+import static ch.puzzle.okr.mapper.keyresult.helper.TestDataDtoHelper.keyResultOrdinalDto;
+import static ch.puzzle.okr.mapper.keyresult.helper.TestDataHelper.keyResultMetric;
+import static ch.puzzle.okr.mapper.keyresult.helper.TestDataHelper.keyResultOrdinal;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+
+@ExtendWith(MockitoExtension.class)
+public class KeyResultMapperTest {
+
+    private KeyResultMapper keyResultMapper;
+    @Mock
+    UserBusinessService userBusinessService;
+    @Mock
+    private ObjectiveBusinessService objectiveBusinessService;
+    @Mock
+    private CheckInBusinessService checkInBusinessService;
+    @InjectMocks
+    private ActionMapper actionMapper;
+
+    @BeforeEach
+    void setup() {
+        KeyResultMetricMapper keyResultMetricMapper = new KeyResultMetricMapper( //
+                userBusinessService, //
+                objectiveBusinessService, //
+                checkInBusinessService, //
+                actionMapper);
+
+        KeyResultOrdinalMapper keyResultOrdinalMapper = new KeyResultOrdinalMapper( //
+                userBusinessService, //
+                objectiveBusinessService, //
+                checkInBusinessService, //
+                actionMapper);
+
+        keyResultMapper = new KeyResultMapper(keyResultOrdinalMapper, keyResultMetricMapper);
+    }
+
+    @DisplayName("toDto() should map KeyResultMetric to KeyResultMetricDto")
+    @Test
+    void toDtoShouldMapKeyResultMetricToKeyResultMetricDto() {
+        // arrange
+        KeyResultMetric keyResultMetric = keyResultMetric();
+        List<Action> actions = List.of();
+
+        // act
+        KeyResultDto keyResultDto = keyResultMapper.toDto(keyResultMetric, actions);
+
+        // assert
+        assertEquals(KeyResultMetricDto.class, keyResultDto.getClass());
+    }
+
+    @DisplayName("toDto() should map KeyResultOrdinal to KeyResultOrdinalDto")
+    @Test
+    void toDtoShouldMapKeyResultOrdinalToKeyResultOrdinalDto() {
+        // arrange
+        KeyResultOrdinal keyResultOrdinal = keyResultOrdinal();
+        List<Action> actions = List.of();
+
+        // act
+        KeyResultDto keyResultDto = keyResultMapper.toDto(keyResultOrdinal, actions);
+
+        // assert
+        assertEquals(KeyResultOrdinalDto.class, keyResultDto.getClass());
+    }
+
+    @DisplayName("toKeyResult() should map KeyResultMetricDto to KeyResultMetric")
+    @Test
+    void toKeyResultShouldMapKeyResultMetricDtoToKeyResultMetric() {
+        // arrange
+        KeyResultMetricDto keyResultMetricDto = keyResultMetricDto();
+
+        // act
+        KeyResult keyResult = keyResultMapper.toKeyResult(keyResultMetricDto);
+
+        // assert
+        assertEquals(KeyResultMetric.class, keyResult.getClass());
+    }
+
+    @DisplayName("toKeyResult() should map KeyResultOrdinalDto to KeyResultOrdinal")
+    @Test
+    void toKeyResultShouldMapKeyResultOrdinalDtoToKeyResultOrdinal() {
+        // arrange
+        KeyResultOrdinalDto keyResultOrdinalDto = keyResultOrdinalDto();
+
+        // act
+        KeyResult keyResult = keyResultMapper.toKeyResult(keyResultOrdinalDto);
+
+        // assert
+        assertEquals(KeyResultOrdinal.class, keyResult.getClass());
+    }
+
+    @DisplayName("toDto() should throw Exception if KeyResult is not Metric or Ordinal")
+    @Test
+    void toDtoShouldThrowExceptionIfKeyResultIsNotMetricOrOrdinal() {
+        // arrange
+        KeyResult keyResult = new KeyResult() {
+        };
+        List<Action> actions = List.of();
+
+        // act + assert
+        ResponseStatusException responseStatusException = assertThrows( //
+                ResponseStatusException.class, //
+                () -> keyResultMapper.toDto(keyResult, actions));
+        assertEquals(HttpStatus.BAD_REQUEST, responseStatusException.getStatusCode());
+    }
+
+    @DisplayName("toKeyResult() should throw Exception if KeyResultDto is not MetricDto or OrdinalDto")
+    @Test
+    void toKeyResultShouldThrowExceptionIfKeyResultDtoIsNotMetricOrOrdinal() {
+        // arrange
+        KeyResultDto keyResultDto = List::of;
+
+        // act + assert
+        ResponseStatusException responseStatusException = assertThrows( //
+                ResponseStatusException.class, //
+                () -> keyResultMapper.toKeyResult(keyResultDto));
+        assertEquals(HttpStatus.BAD_REQUEST, responseStatusException.getStatusCode());
+    }
+}
diff --git a/backend/src/test/java/ch/puzzle/okr/mapper/keyresult/KeyResultMetricMapperTest.java b/backend/src/test/java/ch/puzzle/okr/mapper/keyresult/KeyResultMetricMapperTest.java
new file mode 100644
index 0000000000..e6efdb524e
--- /dev/null
+++ b/backend/src/test/java/ch/puzzle/okr/mapper/keyresult/KeyResultMetricMapperTest.java
@@ -0,0 +1,114 @@
+package ch.puzzle.okr.mapper.keyresult;
+
+import ch.puzzle.okr.dto.keyresult.KeyResultDto;
+import ch.puzzle.okr.dto.keyresult.KeyResultMetricDto;
+import ch.puzzle.okr.mapper.ActionMapper;
+import ch.puzzle.okr.mapper.keyresult.helper.TestDataDtoHelper;
+import ch.puzzle.okr.mapper.keyresult.helper.TestDataHelper;
+import ch.puzzle.okr.models.Action;
+import ch.puzzle.okr.models.checkin.CheckIn;
+import ch.puzzle.okr.models.keyresult.KeyResult;
+import ch.puzzle.okr.models.keyresult.KeyResultMetric;
+import ch.puzzle.okr.service.business.CheckInBusinessService;
+import ch.puzzle.okr.service.business.KeyResultBusinessService;
+import ch.puzzle.okr.service.business.ObjectiveBusinessService;
+import ch.puzzle.okr.service.business.UserBusinessService;
+import ch.puzzle.okr.service.persistence.KeyResultPersistenceService;
+import ch.puzzle.okr.service.validation.KeyResultValidationService;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.DisplayName;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.mockito.InjectMocks;
+import org.mockito.Mock;
+import org.mockito.junit.jupiter.MockitoExtension;
+
+import java.util.List;
+
+import static ch.puzzle.okr.mapper.keyresult.helper.AssertHelper.*;
+import static ch.puzzle.okr.mapper.keyresult.helper.TestDataHelper.*;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.mockito.ArgumentMatchers.anyLong;
+import static org.mockito.Mockito.when;
+
+@ExtendWith(MockitoExtension.class)
+public class KeyResultMetricMapperTest {
+
+    private KeyResultMetricMapper keyResultMetricMapper;
+    @Mock
+    UserBusinessService userBusinessService;
+    @Mock
+    private ObjectiveBusinessService objectiveBusinessService;
+    @Mock
+    private CheckInBusinessService checkInBusinessService;
+    @InjectMocks
+    private ActionMapper actionMapper;
+    @Mock
+    private KeyResultBusinessService keyResultBusinessService;
+    @Mock
+    private KeyResultValidationService validator;
+    @Mock
+    private KeyResultPersistenceService keyResultPersistenceService;
+
+    @BeforeEach
+    void setup() {
+        actionMapper = new ActionMapper(keyResultBusinessService);
+        keyResultMetricMapper = new KeyResultMetricMapper( //
+                userBusinessService, //
+                objectiveBusinessService, //
+                checkInBusinessService, //
+                actionMapper);
+    }
+
+    @DisplayName("toDto() should map a KeyResultMetric to a Dto")
+    @Test
+    void toDtoShouldMapKeyResultMetricToDtoWithCheckIn() {
+        // arrange
+        CheckIn checkIn = TestDataHelper.checkInMetric();
+        when(checkInBusinessService.getLastCheckInByKeyResultId(anyLong())).thenReturn(checkIn);
+
+        KeyResultMetric keyResultMetric = keyResultMetric();
+        List<Action> actions = List.of(action(keyResultMetric));
+
+        // act
+        KeyResultDto keyResultDto = keyResultMetricMapper.toDto(keyResultMetric, actions);
+        KeyResultMetricDto keyResultMetricDto = (KeyResultMetricDto) keyResultDto;
+
+        // assert
+        assertNotNull(keyResultMetricDto);
+        assertKeyResultMetricDtoWithCheckIn(keyResultMetric, keyResultMetricDto, actions);
+    }
+
+    @DisplayName("toDto() should map KeyResultMetric to a Dto without CheckIn")
+    @Test
+    void toDtoShouldMapKeyResultMetricToDtoWithoutCheckIn() {
+        // arrange
+        KeyResultMetric keyResultMetric = keyResultMetric();
+        List<Action> actions = List.of(action(keyResultMetric));
+
+        // act
+        KeyResultDto keyResultDto = keyResultMetricMapper.toDto(keyResultMetric, actions);
+        KeyResultMetricDto keyResultMetricDto = (KeyResultMetricDto) keyResultDto;
+
+        // assert
+        assertNotNull(keyResultMetricDto);
+        assertKeyResultMetricDtoWithoutCheckIn(keyResultMetric, keyResultMetricDto, actions);
+    }
+
+    @DisplayName("toKeyResultMetric() should map Dto to KeyResultMetric")
+    @Test
+    void toKeyResultMetricShouldMapDtoToKeyResultMetric() {
+        // arrange
+        when(userBusinessService.getUserById(anyLong())).thenReturn(owner());
+        when(objectiveBusinessService.getEntityById(anyLong())).thenReturn(objective());
+        KeyResultMetricDto keyResultMetricDto = TestDataDtoHelper.keyResultMetricDto();
+
+        // act
+        KeyResult keyResult = keyResultMetricMapper.toKeyResultMetric(keyResultMetricDto);
+        KeyResultMetric keyResultMetric = (KeyResultMetric) keyResult;
+
+        // assert
+        assertNotNull(keyResultMetric);
+        assertKeyResultMetric(keyResultMetricDto, keyResultMetric);
+    }
+}
diff --git a/backend/src/test/java/ch/puzzle/okr/mapper/keyresult/KeyResultOrdinalMapperTest.java b/backend/src/test/java/ch/puzzle/okr/mapper/keyresult/KeyResultOrdinalMapperTest.java
new file mode 100644
index 0000000000..dbc631e1d5
--- /dev/null
+++ b/backend/src/test/java/ch/puzzle/okr/mapper/keyresult/KeyResultOrdinalMapperTest.java
@@ -0,0 +1,116 @@
+package ch.puzzle.okr.mapper.keyresult;
+
+import ch.puzzle.okr.dto.keyresult.KeyResultDto;
+import ch.puzzle.okr.dto.keyresult.KeyResultOrdinalDto;
+import ch.puzzle.okr.mapper.ActionMapper;
+import ch.puzzle.okr.mapper.keyresult.helper.TestDataDtoHelper;
+import ch.puzzle.okr.mapper.keyresult.helper.TestDataHelper;
+import ch.puzzle.okr.models.Action;
+import ch.puzzle.okr.models.checkin.CheckIn;
+import ch.puzzle.okr.models.keyresult.KeyResult;
+import ch.puzzle.okr.models.keyresult.KeyResultOrdinal;
+import ch.puzzle.okr.service.business.CheckInBusinessService;
+import ch.puzzle.okr.service.business.KeyResultBusinessService;
+import ch.puzzle.okr.service.business.ObjectiveBusinessService;
+import ch.puzzle.okr.service.business.UserBusinessService;
+import ch.puzzle.okr.service.persistence.KeyResultPersistenceService;
+import ch.puzzle.okr.service.validation.KeyResultValidationService;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.DisplayName;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.mockito.InjectMocks;
+import org.mockito.Mock;
+import org.mockito.junit.jupiter.MockitoExtension;
+
+import java.util.List;
+
+import static ch.puzzle.okr.mapper.keyresult.helper.AssertHelper.*;
+import static ch.puzzle.okr.mapper.keyresult.helper.TestDataHelper.*;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.mockito.ArgumentMatchers.anyLong;
+import static org.mockito.Mockito.when;
+
+@ExtendWith(MockitoExtension.class)
+public class KeyResultOrdinalMapperTest {
+
+    private KeyResultOrdinalMapper keyResultOrdinalMapper;
+
+    @Mock
+    UserBusinessService userBusinessService;
+    @Mock
+    private ObjectiveBusinessService objectiveBusinessService;
+    @Mock
+    private CheckInBusinessService checkInBusinessService;
+    @InjectMocks
+    private ActionMapper actionMapper;
+    @Mock
+    private KeyResultBusinessService keyResultBusinessService;
+    @Mock
+    private KeyResultValidationService validator;
+    @Mock
+    private KeyResultPersistenceService keyResultPersistenceService;
+
+    @BeforeEach
+    void setup() {
+        actionMapper = new ActionMapper(keyResultBusinessService);
+        keyResultOrdinalMapper = new KeyResultOrdinalMapper( //
+                userBusinessService, //
+                objectiveBusinessService, //
+                checkInBusinessService, //
+                actionMapper);
+    }
+
+    @DisplayName("toDto() should map a KeyResultOrdinal with CheckIn to a Dto")
+    @Test
+    void toDtoShouldMapKeyResultWithCheckInOrdinalToDto() {
+        // arrange
+        CheckIn checkIn = TestDataHelper.checkInOrdinal();
+        when(checkInBusinessService.getLastCheckInByKeyResultId(anyLong())).thenReturn(checkIn);
+
+        KeyResultOrdinal keyResultOrdinal = keyResultOrdinal();
+        List<Action> actions = List.of(action(keyResultOrdinal));
+
+        // act
+        KeyResultDto keyResultDto = keyResultOrdinalMapper.toDto(keyResultOrdinal, actions);
+        KeyResultOrdinalDto keyResultOrdinalDto = (KeyResultOrdinalDto) keyResultDto;
+
+        // assert
+        assertNotNull(keyResultOrdinalDto);
+        assertKeyResultOrdinalDtoWithCheckIn(keyResultOrdinal, keyResultOrdinalDto, actions);
+    }
+
+    @DisplayName("toDto() should map a KeyResultOrdinal without CheckIn to a Dto")
+    @Test
+    void toDtoShouldMapKeyResultWithoutCheckInOrdinalToDto() {
+        // arrange
+        KeyResultOrdinal keyResultOrdinal = keyResultOrdinal();
+        List<Action> actions = List.of(action(keyResultOrdinal));
+
+        // act
+        KeyResultDto keyResultDto = keyResultOrdinalMapper.toDto(keyResultOrdinal, actions);
+        KeyResultOrdinalDto keyResultOrdinalDto = (KeyResultOrdinalDto) keyResultDto;
+
+        // assert
+        assertNotNull(keyResultOrdinalDto);
+        assertKeyResultOrdinalDtoWithoutCheckIn(keyResultOrdinal, keyResultOrdinalDto, actions);
+    }
+
+    @DisplayName("toKeyResultMetric() should map Dto to KeyResultMetric")
+    @Test
+    void toKeyResultMetricShouldMapDtoToKeyResultMetric() {
+        // arrange
+        when(userBusinessService.getUserById(anyLong())).thenReturn(owner());
+        when(objectiveBusinessService.getEntityById(anyLong())).thenReturn(objective());
+        KeyResultOrdinalDto keyResultOrdinalDto = TestDataDtoHelper.keyResultOrdinalDto();
+
+        // act
+        KeyResult keyResult = keyResultOrdinalMapper.toKeyResultOrdinal(keyResultOrdinalDto);
+        KeyResultOrdinal keyResultOrdinal = (KeyResultOrdinal) keyResult;
+
+        // assert
+        assertNotNull(keyResultOrdinal);
+        assertKeyResultOrdinal(keyResultOrdinalDto, keyResultOrdinal);
+    }
+
+}
diff --git a/backend/src/test/java/ch/puzzle/okr/mapper/keyresult/helper/AssertHelper.java b/backend/src/test/java/ch/puzzle/okr/mapper/keyresult/helper/AssertHelper.java
new file mode 100644
index 0000000000..fe66213e59
--- /dev/null
+++ b/backend/src/test/java/ch/puzzle/okr/mapper/keyresult/helper/AssertHelper.java
@@ -0,0 +1,194 @@
+package ch.puzzle.okr.mapper.keyresult.helper;
+
+import ch.puzzle.okr.dto.ActionDto;
+import ch.puzzle.okr.dto.keyresult.*;
+import ch.puzzle.okr.models.Action;
+import ch.puzzle.okr.models.Objective;
+import ch.puzzle.okr.models.Quarter;
+import ch.puzzle.okr.models.User;
+import ch.puzzle.okr.models.keyresult.KeyResultMetric;
+import ch.puzzle.okr.models.keyresult.KeyResultOrdinal;
+
+import java.util.List;
+
+import static ch.puzzle.okr.Constants.KEY_RESULT_TYPE_METRIC;
+import static ch.puzzle.okr.Constants.KEY_RESULT_TYPE_ORDINAL;
+import static ch.puzzle.okr.mapper.keyresult.helper.TestDataDtoHelper.lastCheckInMetricDto;
+import static org.junit.jupiter.api.Assertions.*;
+
+public class AssertHelper {
+
+    public static void assertKeyResultMetricDtoWithCheckIn(KeyResultMetric expected, KeyResultMetricDto actual,
+            List<Action> actions) {
+        assertKeyResultMetricDto(expected, actual, actions);
+        // checkIn is only available on KeyResultMetricDto (and not on KeyResultMetric).
+        // So check actual against the checkInMetricDto from TestDataDtoHelper
+        assertNotNull(actual.lastCheckIn());
+        assertCheckInMetricDto(lastCheckInMetricDto(), actual.lastCheckIn());
+    }
+
+    public static void assertKeyResultMetricDtoWithoutCheckIn(KeyResultMetric expected, KeyResultMetricDto actual,
+            List<Action> actions) {
+        assertKeyResultMetricDto(expected, actual, actions);
+        assertNull(actual.lastCheckIn());
+    }
+
+    private static void assertKeyResultMetricDto(KeyResultMetric expected, KeyResultMetricDto actual,
+            List<Action> actions) {
+        assertEquals(KEY_RESULT_TYPE_METRIC, actual.keyResultType());
+        assertEquals(expected.getKeyResultType(), actual.keyResultType());
+
+        assertEquals(expected.getId(), actual.id());
+        assertEquals(expected.getVersion(), actual.version());
+        assertEquals(expected.getTitle(), actual.title());
+        assertEquals(expected.getDescription(), actual.description());
+        assertEquals(expected.getBaseline(), actual.baseline());
+        assertEquals(expected.getStretchGoal(), actual.stretchGoal());
+        assertEquals(expected.getUnit(), actual.unit());
+        assertOwnerDto(expected.getOwner(), actual.owner());
+        assertObjectiveDto(expected.getObjective(), actual.objective());
+        assertEquals(expected.getCreatedOn(), actual.createdOn());
+        assertEquals(expected.getModifiedOn(), actual.modifiedOn());
+
+        assertEquals(1, actual.getActionList().size());
+        assertActionDto(actions.get(0), actual.getActionList().get(0));
+    }
+
+    public static void assertKeyResultMetric(KeyResultMetricDto expected, KeyResultMetric actual) {
+        assertEquals(KEY_RESULT_TYPE_METRIC, actual.getKeyResultType());
+        assertEquals(expected.keyResultType(), actual.getKeyResultType());
+        assertEquals(expected.id(), actual.getId());
+        assertEquals(expected.version(), actual.getVersion());
+        assertEquals(expected.title(), actual.getTitle());
+        assertEquals(expected.description(), actual.getDescription());
+        assertEquals(expected.baseline(), actual.getBaseline());
+        assertEquals(expected.stretchGoal(), actual.getStretchGoal());
+        assertEquals(expected.unit(), actual.getUnit());
+        assertOwner(expected.owner(), actual.getOwner());
+        assertObjective(expected.objective(), actual.getObjective());
+        assertEquals(expected.createdOn(), actual.getCreatedOn());
+        assertEquals(expected.modifiedOn(), actual.getModifiedOn());
+    }
+
+    public static void assertKeyResultOrdinalDtoWithCheckIn(KeyResultOrdinal expected, KeyResultOrdinalDto actual,
+            List<Action> actions) {
+        assertKeyResultOrdinalDto(expected, actual, actions);
+        assertNotNull(actual.lastCheckIn());
+        assertCheckInOrdinalDto(TestDataDtoHelper.lastCheckInOrdinalDto(), actual.lastCheckIn());
+    }
+
+    public static void assertKeyResultOrdinalDtoWithoutCheckIn(KeyResultOrdinal expected, KeyResultOrdinalDto actual,
+            List<Action> actions) {
+        assertKeyResultOrdinalDto(expected, actual, actions);
+        // checkIn is only available on KeyResultOrdinalDto (and not on KeyResultOrdinal).
+        // So check actual against the KeyResultOrdinalDto from TestDataDtoHelper
+        assertNull(actual.lastCheckIn());
+    }
+
+    private static void assertKeyResultOrdinalDto(KeyResultOrdinal expected, KeyResultOrdinalDto actual,
+            List<Action> actions) {
+        assertEquals(KEY_RESULT_TYPE_ORDINAL, actual.keyResultType());
+        assertEquals(expected.getKeyResultType(), actual.keyResultType());
+
+        assertEquals(expected.getId(), actual.id());
+        assertEquals(expected.getVersion(), actual.version());
+        assertEquals(expected.getTitle(), actual.title());
+        assertEquals(expected.getDescription(), actual.description());
+        assertEquals(expected.getCommitZone(), actual.commitZone());
+        assertEquals(expected.getTargetZone(), actual.targetZone());
+        assertEquals(expected.getStretchZone(), actual.stretchZone());
+        assertOwnerDto(expected.getOwner(), actual.owner());
+        assertObjectiveDto(expected.getObjective(), actual.objective());
+        assertEquals(expected.getCreatedOn(), actual.createdOn());
+        assertEquals(expected.getModifiedOn(), actual.modifiedOn());
+
+        assertEquals(1, actual.getActionList().size());
+        assertActionDto(actions.get(0), actual.getActionList().get(0));
+    }
+
+    public static void assertKeyResultOrdinal(KeyResultOrdinalDto expected, KeyResultOrdinal actual) {
+        assertEquals(KEY_RESULT_TYPE_ORDINAL, actual.getKeyResultType());
+        assertEquals(expected.keyResultType(), actual.getKeyResultType());
+        assertEquals(expected.id(), actual.getId());
+        assertEquals(expected.version(), actual.getVersion());
+        assertEquals(expected.title(), actual.getTitle());
+        assertEquals(expected.description(), actual.getDescription());
+        assertEquals(expected.commitZone(), actual.getCommitZone());
+        assertEquals(expected.targetZone(), actual.getTargetZone());
+        assertEquals(expected.stretchZone(), actual.getStretchZone());
+        assertOwner(expected.owner(), actual.getOwner());
+        assertObjective(expected.objective(), actual.getObjective());
+        assertEquals(expected.createdOn(), actual.getCreatedOn());
+        assertEquals(expected.modifiedOn(), actual.getModifiedOn());
+    }
+
+    private static void assertActionDto(Action expected, ActionDto actual) {
+        assertEquals(expected.getId(), actual.id());
+        assertEquals(expected.getVersion(), actual.version());
+        assertEquals(expected.getAction(), actual.action());
+        assertEquals(expected.getPriority(), actual.priority());
+        assertEquals(expected.isChecked(), actual.isChecked());
+        assertEquals(expected.getKeyResult().getId(), actual.keyResultId());
+    }
+
+    private static void assertObjectiveDto(Objective expected, KeyResultObjectiveDto actual) {
+        assertEquals(expected.getId(), actual.id());
+        assertEquals(expected.getState().name(), actual.state());
+        assertQuarterDto(expected.getQuarter(), actual.keyResultQuarterDto());
+    }
+
+    private static void assertQuarterDto(Quarter expected, KeyResultQuarterDto actual) {
+        assertEquals(expected.getId(), actual.id());
+        assertEquals(expected.getLabel(), actual.label());
+        assertEquals(expected.getStartDate(), actual.startDate());
+        assertEquals(expected.getEndDate(), actual.endDate());
+    }
+
+    private static void assertObjective(KeyResultObjectiveDto expected, Objective actual) {
+        assertEquals(expected.id(), actual.getId());
+        assertEquals(expected.state(), actual.getState().name());
+        assertQuarter(expected.keyResultQuarterDto(), actual.getQuarter());
+    }
+
+    private static void assertQuarter(KeyResultQuarterDto expected, Quarter actual) {
+        assertEquals(expected.id(), actual.getId());
+        assertEquals(expected.label(), actual.getLabel());
+        assertEquals(expected.startDate(), actual.getStartDate());
+        assertEquals(expected.endDate(), actual.getEndDate());
+    }
+
+    private static void assertOwnerDto(User expected, KeyResultUserDto actual) {
+        assertEquals(expected.getId(), actual.id());
+        assertEquals(expected.getFirstname(), actual.firstname());
+        assertEquals(expected.getLastname(), actual.lastname());
+    }
+
+    private static void assertOwner(KeyResultUserDto expected, User actual) {
+        assertEquals(expected.id(), actual.getId());
+        assertEquals(expected.firstname(), actual.getFirstname());
+        assertEquals(expected.lastname(), actual.getLastname());
+    }
+
+    private static void assertCheckInMetricDto(KeyResultLastCheckInMetricDto expected,
+            KeyResultLastCheckInMetricDto actual) {
+        assertEquals(expected.id(), actual.id());
+        assertEquals(expected.version(), actual.version());
+        assertEquals(expected.value(), actual.value());
+        assertEquals(expected.confidence(), actual.confidence());
+        assertEquals(expected.createdOn(), actual.createdOn());
+        assertEquals(expected.changeInfo(), actual.changeInfo());
+        assertEquals(expected.initiatives(), actual.initiatives());
+    }
+
+    private static void assertCheckInOrdinalDto(KeyResultLastCheckInOrdinalDto expected,
+            KeyResultLastCheckInOrdinalDto actual) {
+        assertEquals(expected.id(), actual.id());
+        assertEquals(expected.version(), actual.version());
+        assertEquals(expected.value(), actual.value());
+        assertEquals(expected.confidence(), actual.confidence());
+        assertEquals(expected.createdOn(), actual.createdOn());
+        assertEquals(expected.changeInfo(), actual.changeInfo());
+        assertEquals(expected.initiatives(), actual.initiatives());
+    }
+
+}
diff --git a/backend/src/test/java/ch/puzzle/okr/mapper/keyresult/helper/TestDataConstants.java b/backend/src/test/java/ch/puzzle/okr/mapper/keyresult/helper/TestDataConstants.java
new file mode 100644
index 0000000000..eff5381a5a
--- /dev/null
+++ b/backend/src/test/java/ch/puzzle/okr/mapper/keyresult/helper/TestDataConstants.java
@@ -0,0 +1,56 @@
+package ch.puzzle.okr.mapper.keyresult.helper;
+
+import ch.puzzle.okr.models.State;
+import ch.puzzle.okr.models.Unit;
+import ch.puzzle.okr.models.checkin.Zone;
+
+import java.time.LocalDate;
+import java.time.LocalDateTime;
+import java.time.Month;
+
+public class TestDataConstants {
+
+    public static final long CHECK_IN_ID = 100L;
+    public static final int CHECK_IN_VERSION = 1;
+    public static final double CHECK_IN_METRIC_VALUE = 23;
+    public static final Zone CHECK_IN_ORDINAL_ZONE = Zone.STRETCH;
+    public static final int CHECK_IN_CONFIDENCE = 5;
+    public static final String CHECK_IN_CHANGE_INFO = "checkin changeinfo";
+    public static final String CHECK_IN_INITIATIVES = "checkin initiaitves";
+    public static final LocalDateTime CHECK_IN_CREATED_ON = LocalDateTime.of(2024, Month.MAY, 20, 0, 0, 0);
+    public static final LocalDateTime CHECK_IN_MODIFIED_ON = LocalDateTime.of(2024, Month.MAY, 20, 12, 0, 0);
+    public static final boolean CHECK_IN_IS_WRITABLE = true;
+
+    public static final long USER_ID = 101L;
+    public static final String USER_FIRSTNAME = "owner firstname";
+    public static final String USER_LASTNAME = "owner lastname";
+
+    public static final long QUARTER_ID = 102L;
+    public static final String QUARTER_LABEL = "GJ 2024 Q1";
+    public static final LocalDate QUARTER_START_DATE = LocalDate.of(2024, Month.MAY, 20);
+    public static final LocalDate QUARTER_END_DATE = LocalDate.of(2024, Month.MAY, 21);
+
+    public static final long OBJECTIVE_ID = 103L;
+    public static final State OBJECTIVE_STATE = State.ONGOING;
+
+    public static final long KEY_RESULT_ID = 23L;
+    public static final int KEY_RESULT_VERSION = 1;
+    public static final String KEY_RESULT_TITLE = "keyresult title";
+    public static final String KEY_RESULT_DESCRIPTION = "keyresult description";
+    public static final double KEY_RESULT_BASELINE = 55D;
+    public static final double KEY_RESULT_STRETCH_GOAL = 80D;
+    public static final Unit KEY_RESULT_UNIT = Unit.NUMBER;
+
+    public static final String KEY_RESULT_COMMIT_ZONE = "commit zone";
+    public static final String KEY_RESULT_TARGET_ZONE = "target zone";
+    public static final String KEY_RESULT_STRETCH_ZONE = "stretch zone";
+
+    public static final boolean KEY_RESULT_IS_WRITABLE = true;
+
+    public static final long ACTION_ID = 104L;
+    public static final int ACTION_VERSION = 1;
+    public static final String ACTION_ACTION = "action";
+    public static final int ACTION_PRIORITY = 2;
+    public static final boolean ACTION_IS_CHECKED = true;
+
+}
diff --git a/backend/src/test/java/ch/puzzle/okr/mapper/keyresult/helper/TestDataDtoHelper.java b/backend/src/test/java/ch/puzzle/okr/mapper/keyresult/helper/TestDataDtoHelper.java
new file mode 100644
index 0000000000..ed836d442b
--- /dev/null
+++ b/backend/src/test/java/ch/puzzle/okr/mapper/keyresult/helper/TestDataDtoHelper.java
@@ -0,0 +1,101 @@
+package ch.puzzle.okr.mapper.keyresult.helper;
+
+import ch.puzzle.okr.dto.keyresult.*;
+
+import static ch.puzzle.okr.Constants.KEY_RESULT_TYPE_METRIC;
+import static ch.puzzle.okr.Constants.KEY_RESULT_TYPE_ORDINAL;
+import static ch.puzzle.okr.mapper.keyresult.helper.TestDataConstants.*;
+
+public class TestDataDtoHelper {
+    public static KeyResultMetricDto keyResultMetricDto() {
+        return keyResultMetricDto;
+    }
+
+    public static KeyResultOrdinalDto keyResultOrdinalDto() {
+        return keyResultOrdinalDto;
+    }
+
+    public static KeyResultLastCheckInMetricDto lastCheckInMetricDto() {
+        return lastCheckInMetricDto;
+    }
+
+    public static KeyResultLastCheckInOrdinalDto lastCheckInOrdinalDto() {
+        return lastCheckInOrdinalDto;
+    }
+
+    private static final KeyResultUserDto ownerDto = new KeyResultUserDto( //
+            USER_ID, //
+            USER_FIRSTNAME, //
+            USER_LASTNAME //
+    );
+
+    private static final KeyResultQuarterDto quarterDto = new KeyResultQuarterDto( //
+            QUARTER_ID, //
+            QUARTER_LABEL, //
+            QUARTER_START_DATE, //
+            QUARTER_END_DATE //
+    );
+
+    private static final KeyResultObjectiveDto objectiveDto = new KeyResultObjectiveDto( //
+            OBJECTIVE_ID, //
+            OBJECTIVE_STATE.name(), //
+            quarterDto //
+    );
+
+    private static final KeyResultLastCheckInMetricDto lastCheckInMetricDto = new KeyResultLastCheckInMetricDto( //
+            CHECK_IN_ID, //
+            CHECK_IN_VERSION, //
+            CHECK_IN_METRIC_VALUE, //
+            CHECK_IN_CONFIDENCE, //
+            CHECK_IN_CREATED_ON, //
+            CHECK_IN_CHANGE_INFO, //
+            CHECK_IN_INITIATIVES //
+    );
+
+    private static final KeyResultLastCheckInOrdinalDto lastCheckInOrdinalDto = new KeyResultLastCheckInOrdinalDto( //
+            CHECK_IN_ID, //
+            CHECK_IN_VERSION, //
+            CHECK_IN_ORDINAL_ZONE, //
+            CHECK_IN_CONFIDENCE, //
+            CHECK_IN_CREATED_ON, //
+            CHECK_IN_CHANGE_INFO, //
+            CHECK_IN_INITIATIVES //
+    );
+
+    private static final KeyResultMetricDto keyResultMetricDto = new KeyResultMetricDto( //
+            KEY_RESULT_ID, //
+            KEY_RESULT_VERSION, //
+            KEY_RESULT_TYPE_METRIC, //
+            KEY_RESULT_TITLE, //
+            KEY_RESULT_DESCRIPTION, //
+            KEY_RESULT_BASELINE, //
+            KEY_RESULT_STRETCH_GOAL, //
+            KEY_RESULT_UNIT, //
+            ownerDto, //
+            objectiveDto, //
+            lastCheckInMetricDto, //
+            CHECK_IN_CREATED_ON, //
+            CHECK_IN_MODIFIED_ON, //
+            CHECK_IN_IS_WRITABLE, //
+            null // actionList; ony used for keyResultMetric + action -> dto BUT NOT FOR dto -> keyResultMetric
+    );
+
+    private static final KeyResultOrdinalDto keyResultOrdinalDto = new KeyResultOrdinalDto( //
+            KEY_RESULT_ID, //
+            KEY_RESULT_VERSION, //
+            KEY_RESULT_TYPE_ORDINAL, //
+            KEY_RESULT_TITLE, //
+            KEY_RESULT_DESCRIPTION, //
+            KEY_RESULT_COMMIT_ZONE, //
+            KEY_RESULT_TARGET_ZONE, //
+            KEY_RESULT_STRETCH_ZONE, //
+            ownerDto, //
+            objectiveDto, //
+            lastCheckInOrdinalDto, //
+            CHECK_IN_CREATED_ON, //
+            CHECK_IN_MODIFIED_ON, //
+            CHECK_IN_IS_WRITABLE, //
+            null // actionList; ony used for keyResultOrdinal + action -> dto BUT NOT FOR dto -> keyResultOrdinal
+    );
+
+}
diff --git a/backend/src/test/java/ch/puzzle/okr/mapper/keyresult/helper/TestDataHelper.java b/backend/src/test/java/ch/puzzle/okr/mapper/keyresult/helper/TestDataHelper.java
new file mode 100644
index 0000000000..365999229f
--- /dev/null
+++ b/backend/src/test/java/ch/puzzle/okr/mapper/keyresult/helper/TestDataHelper.java
@@ -0,0 +1,137 @@
+package ch.puzzle.okr.mapper.keyresult.helper;
+
+import ch.puzzle.okr.models.Action;
+import ch.puzzle.okr.models.Objective;
+import ch.puzzle.okr.models.Quarter;
+import ch.puzzle.okr.models.User;
+import ch.puzzle.okr.models.checkin.CheckIn;
+import ch.puzzle.okr.models.checkin.CheckInMetric;
+import ch.puzzle.okr.models.checkin.CheckInOrdinal;
+import ch.puzzle.okr.models.keyresult.KeyResult;
+import ch.puzzle.okr.models.keyresult.KeyResultMetric;
+import ch.puzzle.okr.models.keyresult.KeyResultOrdinal;
+
+import static ch.puzzle.okr.mapper.keyresult.helper.TestDataConstants.*;
+
+public class TestDataHelper {
+
+    public static KeyResultMetric keyResultMetric() {
+        KeyResult keyResult = TestDataHelper.keyResultMetric;
+        keyResult.setWriteable(KEY_RESULT_IS_WRITABLE);
+        return (KeyResultMetric) keyResult;
+    }
+
+    public static KeyResultOrdinal keyResultOrdinal() {
+        KeyResult keyResult = TestDataHelper.keyResultOrdinal;
+        keyResult.setWriteable(KEY_RESULT_IS_WRITABLE);
+        return (KeyResultOrdinal) keyResult;
+    }
+
+    public static CheckInMetric checkInMetric() {
+        return (CheckInMetric) checkInMetric;
+    }
+
+    public static CheckInOrdinal checkInOrdinal() {
+        return (CheckInOrdinal) checkInOrdinal;
+    }
+
+    public static Action action(KeyResult keyResult) {
+        if (keyResult instanceof KeyResultMetric)
+            return actionForKeyResultMetric;
+        if (keyResult instanceof KeyResultOrdinal)
+            return actionForKeyResultOrdinal;
+        return null;
+    }
+
+    public static User owner() {
+        return owner;
+    }
+
+    public static Objective objective() {
+        return objective;
+    }
+
+    private static final CheckIn checkInMetric = CheckInMetric.Builder.builder() //
+            .withId(CHECK_IN_ID) //
+            .withVersion(CHECK_IN_VERSION) //
+            .withValue(CHECK_IN_METRIC_VALUE) //
+            .withConfidence(CHECK_IN_CONFIDENCE) //
+            .withCreatedOn(CHECK_IN_CREATED_ON) //
+            .withChangeInfo(CHECK_IN_CHANGE_INFO) //
+            .withInitiatives(CHECK_IN_INITIATIVES) //
+            .build();
+
+    private static final CheckIn checkInOrdinal = CheckInOrdinal.Builder.builder() //
+            .withId(CHECK_IN_ID) //
+            .withVersion(CHECK_IN_VERSION) //
+            .withZone(CHECK_IN_ORDINAL_ZONE) //
+            .withConfidence(CHECK_IN_CONFIDENCE) //
+            .withCreatedOn(CHECK_IN_CREATED_ON) //
+            .withChangeInfo(CHECK_IN_CHANGE_INFO) //
+            .withInitiatives(CHECK_IN_INITIATIVES) //
+            .build();
+
+    private static final User owner = User.Builder.builder() //
+            .withId(USER_ID) //
+            .withFirstname(USER_FIRSTNAME) //
+            .withLastname(USER_LASTNAME) //
+            .build();
+
+    private static final Quarter quarter = Quarter.Builder.builder() //
+            .withId(QUARTER_ID) //
+            .withLabel(QUARTER_LABEL) //
+            .withStartDate(QUARTER_START_DATE) //
+            .withEndDate(QUARTER_END_DATE) //
+            .build();
+
+    private static final Objective objective = Objective.Builder.builder() //
+            .withId(OBJECTIVE_ID) //
+            .withQuarter(quarter) //
+            .withState(OBJECTIVE_STATE) //
+            .build();
+
+    private static final KeyResult keyResultMetric = KeyResultMetric.Builder.builder() //
+            .withId(KEY_RESULT_ID) //
+            .withVersion(KEY_RESULT_VERSION) //
+            .withTitle(KEY_RESULT_TITLE) //
+            .withDescription(KEY_RESULT_DESCRIPTION) //
+            .withBaseline(KEY_RESULT_BASELINE) //
+            .withStretchGoal(KEY_RESULT_STRETCH_GOAL) //
+            .withUnit(KEY_RESULT_UNIT) //
+            .withOwner(owner) //
+            .withObjective(objective) //
+            .withCreatedOn(CHECK_IN_CREATED_ON) //
+            .withModifiedOn(CHECK_IN_MODIFIED_ON) //
+            .build();
+
+    private static final KeyResult keyResultOrdinal = KeyResultOrdinal.Builder.builder() //
+            .withId(KEY_RESULT_ID) //
+            .withVersion(KEY_RESULT_VERSION) //
+            .withTitle(KEY_RESULT_TITLE) //
+            .withDescription(KEY_RESULT_DESCRIPTION) //
+            .withCommitZone(KEY_RESULT_COMMIT_ZONE).withTargetZone(KEY_RESULT_TARGET_ZONE)
+            .withStretchZone(KEY_RESULT_STRETCH_ZONE).withOwner(owner) //
+            .withObjective(objective) //
+            .withCreatedOn(CHECK_IN_CREATED_ON) //
+            .withModifiedOn(CHECK_IN_MODIFIED_ON) //
+            .build();
+
+    private static final Action actionForKeyResultMetric = Action.Builder.builder() //
+            .withId(ACTION_ID) //
+            .withVersion(ACTION_VERSION) //
+            .withAction(ACTION_ACTION) //
+            .withPriority(ACTION_PRIORITY) //
+            .withIsChecked(ACTION_IS_CHECKED) //
+            .withKeyResult(keyResultMetric) //
+            .build();
+
+    private static final Action actionForKeyResultOrdinal = Action.Builder.builder() //
+            .withId(ACTION_ID) //
+            .withVersion(ACTION_VERSION) //
+            .withAction(ACTION_ACTION) //
+            .withPriority(ACTION_PRIORITY) //
+            .withIsChecked(ACTION_IS_CHECKED) //
+            .withKeyResult(keyResultOrdinal) //
+            .build();
+
+}
diff --git a/backend/src/test/java/ch/puzzle/okr/mapper/role/RoleMapperFactoryIT.java b/backend/src/test/java/ch/puzzle/okr/mapper/role/RoleMapperFactoryIT.java
deleted file mode 100644
index d5848d8fad..0000000000
--- a/backend/src/test/java/ch/puzzle/okr/mapper/role/RoleMapperFactoryIT.java
+++ /dev/null
@@ -1,22 +0,0 @@
-package ch.puzzle.okr.mapper.role;
-
-import ch.puzzle.okr.test.SpringIntegrationTest;
-import org.junit.jupiter.api.Test;
-import org.springframework.beans.factory.annotation.Autowired;
-
-import static org.junit.jupiter.api.Assertions.assertNotNull;
-import static org.junit.jupiter.api.Assertions.assertSame;
-
-@SpringIntegrationTest
-public class RoleMapperFactoryIT {
-
-    @Autowired
-    private RoleMapperFactory roleMapperFactory;
-
-    @Test
-    void getRoleMapper() {
-        RoleMapper mapper = roleMapperFactory.getRoleMapper();
-        assertNotNull(mapper);
-        assertSame(mapper, roleMapperFactory.getRoleMapper());
-    }
-}
diff --git a/backend/src/test/java/ch/puzzle/okr/models/authorization/AuthorizationUserTest.java b/backend/src/test/java/ch/puzzle/okr/models/authorization/AuthorizationUserTest.java
new file mode 100644
index 0000000000..2b74f3dc69
--- /dev/null
+++ b/backend/src/test/java/ch/puzzle/okr/models/authorization/AuthorizationUserTest.java
@@ -0,0 +1,48 @@
+package ch.puzzle.okr.models.authorization;
+
+import ch.puzzle.okr.test.TestHelper;
+import ch.puzzle.okr.models.User;
+import ch.puzzle.okr.models.UserTeam;
+import org.junit.jupiter.api.Test;
+
+import java.util.List;
+
+import static org.junit.jupiter.api.Assertions.*;
+
+class AuthorizationUserTest {
+
+    private final List<UserTeam> userTeamList = List.of(
+            UserTeam.Builder.builder().withTeam(TestHelper.defaultTeam(1L)).withTeamAdmin(true).build(),
+            UserTeam.Builder.builder().withTeam(TestHelper.defaultTeam(2L)).withTeamAdmin(false).build(),
+            UserTeam.Builder.builder().withTeam(TestHelper.defaultTeam(3L)).withTeamAdmin(true).build(),
+            UserTeam.Builder.builder().withTeam(TestHelper.defaultTeam(4L)).withTeamAdmin(false).build(),
+            UserTeam.Builder.builder().withTeam(TestHelper.defaultTeam(5L)).withTeamAdmin(false).build());
+    private final User user = User.Builder.builder().withUserTeamList(userTeamList).build();
+    private final AuthorizationUser authorizationUser = new AuthorizationUser(user);
+
+    @Test
+    public void extractTeamIds_shouldReturnAllIds() {
+        assertEquals(List.of(1L, 2L, 3L, 4L, 5L), authorizationUser.extractTeamIds());
+    }
+
+    @Test
+    public void isUserMemberInTeam_shouldContainAllUsers() {
+        assertTrue(authorizationUser.isUserMemberInTeam(1L));
+        assertTrue(authorizationUser.isUserMemberInTeam(2L));
+        assertTrue(authorizationUser.isUserMemberInTeam(3L));
+        assertTrue(authorizationUser.isUserMemberInTeam(4L));
+        assertTrue(authorizationUser.isUserMemberInTeam(5L));
+        assertFalse(authorizationUser.isUserMemberInTeam(6L));
+    }
+
+    @Test
+    public void isUserAdminInTeam_shouldContainAllAdminUsers() {
+        assertTrue(authorizationUser.isUserAdminInTeam(1L));
+        assertTrue(authorizationUser.isUserAdminInTeam(3L));
+        assertFalse(authorizationUser.isUserAdminInTeam(2L));
+        assertFalse(authorizationUser.isUserAdminInTeam(4L));
+        assertFalse(authorizationUser.isUserAdminInTeam(5L));
+        assertFalse(authorizationUser.isUserAdminInTeam(6L));
+    }
+
+}
\ No newline at end of file
diff --git a/backend/src/test/java/ch/puzzle/okr/multitenancy/CurrentTenantIdentifierResolverImplTest.java b/backend/src/test/java/ch/puzzle/okr/multitenancy/CurrentTenantIdentifierResolverImplTest.java
new file mode 100644
index 0000000000..87d82c4c21
--- /dev/null
+++ b/backend/src/test/java/ch/puzzle/okr/multitenancy/CurrentTenantIdentifierResolverImplTest.java
@@ -0,0 +1,25 @@
+package ch.puzzle.okr.multitenancy;
+
+import org.junit.jupiter.api.DisplayName;
+import org.junit.jupiter.api.Test;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+public class CurrentTenantIdentifierResolverImplTest {
+
+    @DisplayName("current TenantId is TenantId from TenantContext")
+    @Test
+    void currentTenantIdIsTenantIdFromTenantContext() {
+        CurrentTenantIdentifierResolverImpl resolver = new CurrentTenantIdentifierResolverImpl();
+        String tenantIdentifier = resolver.resolveCurrentTenantIdentifier();
+        assertEquals(TenantContext.getCurrentTenant(), tenantIdentifier);
+    }
+
+    @DisplayName("validateExistingCurrentSessions is true")
+    @Test
+    void validateExistingCurrentSessionsIsTrue() {
+        CurrentTenantIdentifierResolverImpl resolver = new CurrentTenantIdentifierResolverImpl();
+        assertTrue(resolver.validateExistingCurrentSessions());
+    }
+}
diff --git a/backend/src/test/java/ch/puzzle/okr/multitenancy/FlywayMultitenantMigrationInitializerTest.java b/backend/src/test/java/ch/puzzle/okr/multitenancy/FlywayMultitenantMigrationInitializerTest.java
new file mode 100644
index 0000000000..3ab1cb4eb4
--- /dev/null
+++ b/backend/src/test/java/ch/puzzle/okr/multitenancy/FlywayMultitenantMigrationInitializerTest.java
@@ -0,0 +1,114 @@
+package ch.puzzle.okr.multitenancy;
+
+import org.flywaydb.core.Flyway;
+import org.flywaydb.core.api.configuration.FluentConfiguration;
+import org.junit.jupiter.api.DisplayName;
+import org.junit.jupiter.api.Test;
+import org.mockito.MockedStatic;
+import org.mockito.Mockito;
+
+import java.util.List;
+import java.util.Optional;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.mockito.Mockito.mock;
+
+/**
+ * Test for FlywayMultitenantMigrationInitializer.migrateFlyway(). The FlywayMultitenantMigrationInitializer constructor
+ * gets a mock implementation of a TenantConfigProviderInterface, which provides some test data. Inside migrateFlyway(),
+ * there are two calls to Flyway: Flyway.configure() (a static method) and flyway.migrate() (an instance method).
+ * Flyway.configure() returns a FluentConfiguration. Then several method calls are made on the FluentConfiguration,
+ * which also return a FluentConfiguration. The last calls is load(), which returns a Flyway Object. We can mock that
+ * with a manual Spy FluentConfigurationSpy, which records the methods calls and load() returns a Mockito Mock, which
+ * does nothing. And later, flyway.migrate() is called on the Mockito Mock, which does nothing.
+ */
+public class FlywayMultitenantMigrationInitializerTest {
+
+    private static final String NOT_USED = "not_used";
+    private static final String URL = "url";
+    private static final String NAME = "name";
+    private static final String PASSWORD = "password";
+    private static final String SCHEMA = "schema";
+    private static final String SCRIPT_LOCATION = "script_location";
+
+    private static class FluentConfigurationSpy extends FluentConfiguration {
+        private String log = "";
+
+        public FluentConfiguration dataSource(String url, String user, String password) {
+            log += "dataSource(" + url + "," + user + "," + password + ")";
+            return this;
+        }
+
+        public FluentConfiguration locations(String... locations) {
+            log += " locations(" + String.join("", locations) + ")";
+            return this;
+        }
+
+        public FluentConfiguration baselineOnMigrate(boolean baselineOnMigrate) {
+            log += " baselineOnMigrate(" + baselineOnMigrate + ")";
+            return this;
+        }
+
+        public FluentConfiguration schemas(String... schemas) {
+            log += " schemas(" + String.join("", schemas) + ")";
+            return this;
+        }
+
+        // the result of load() is used by flyway.migrate(), which we don't test. So load() returns a mock which does
+        // nothing.
+        @Override
+        public Flyway load() {
+            return mock(Flyway.class);
+        }
+
+        public String getLog() {
+            return log;
+        }
+    }
+
+    private final TenantConfigProviderInterface providerInterfaceMock = new TenantConfigProviderInterface() {
+
+        private final TenantConfigProvider.DataSourceConfig dataSourceConfig = new TenantConfigProvider.DataSourceConfig(
+                NOT_USED, URL, NAME, PASSWORD, SCHEMA);
+
+        private final TenantConfigProvider.TenantConfig tenantConfig = new TenantConfigProvider.TenantConfig(NOT_USED,
+                new String[] { NOT_USED }, NOT_USED, NOT_USED, NOT_USED, dataSourceConfig);
+
+        @Override
+        public List<TenantConfigProvider.TenantConfig> getTenantConfigs() {
+            return List.of(tenantConfig);
+        }
+
+        @Override
+        public Optional<TenantConfigProvider.TenantConfig> getTenantConfigById(String tenantId) {
+            return Optional.of(tenantConfig);
+        }
+
+        @Override
+        public Optional<String> getJwkSetUri(String tenantId) {
+            return Optional.empty();
+        }
+    };
+
+    @DisplayName("Flyway.configure() should return FluentConfiguration which we can assert")
+    @Test
+    void flywayConfigureShouldReturnFluentConfigurationWhichWeCanAssert() {
+        try (MockedStatic<Flyway> mockedStatic = Mockito.mockStatic(Flyway.class)) {
+            // arrange
+            FluentConfigurationSpy fluentConfiguration = new FluentConfigurationSpy();
+            mockedStatic.when(Flyway::configure).thenReturn(fluentConfiguration);
+
+            FlywayMultitenantMigrationInitializer migrationInitializer = new FlywayMultitenantMigrationInitializer(
+                    providerInterfaceMock, new String[] { SCRIPT_LOCATION });
+
+            // act
+            migrationInitializer.migrateFlyway();
+
+            // assert
+            String expected = "dataSource(url,name,password) locations(script_location) baselineOnMigrate(true) schemas(schema)";
+            String actual = fluentConfiguration.getLog();
+            assertEquals(expected, actual);
+        }
+    }
+
+}
\ No newline at end of file
diff --git a/backend/src/test/java/ch/puzzle/okr/multitenancy/HibernateContextTest.java b/backend/src/test/java/ch/puzzle/okr/multitenancy/HibernateContextTest.java
new file mode 100644
index 0000000000..7dbc3a5b16
--- /dev/null
+++ b/backend/src/test/java/ch/puzzle/okr/multitenancy/HibernateContextTest.java
@@ -0,0 +1,122 @@
+package ch.puzzle.okr.multitenancy;
+
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.DisplayName;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.Arguments;
+import org.junit.jupiter.params.provider.MethodSource;
+import org.springframework.core.env.ConfigurableEnvironment;
+
+import java.util.Properties;
+import java.util.stream.Stream;
+
+import static ch.puzzle.okr.multitenancy.HibernateContext.*;
+import static org.junit.jupiter.api.Assertions.*;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.when;
+
+public class HibernateContextTest {
+
+    @BeforeEach
+    void setUp() {
+        resetHibernateConfig();
+    }
+
+    @DisplayName("setHibernateConfig() should throw exception if db config is null")
+    @Test
+    void setHibernateConfigShouldThrowExceptionIfDbConfigIsNull() {
+        // arrange
+        DbConfig dbConfig = null;
+
+        // act + assert
+        RuntimeException exception = assertThrows(RuntimeException.class, () -> setHibernateConfig(dbConfig));
+        assertEquals("Invalid hibernate configuration null", exception.getMessage());
+    }
+
+    @DisplayName("setHibernateConfig() should throw exception if db config has null or empty values")
+    @ParameterizedTest
+    @MethodSource("invalidDbConfig")
+    void setHibernateConfigShouldThrowExceptionIfDbConfigHasNullOrEmptyValues(String url, String username,
+            String password, String tenant) {
+
+        // arrange
+        DbConfig dbConfig = new DbConfig(url, username, password, tenant);
+
+        // act + assert
+        RuntimeException exception = assertThrows(RuntimeException.class, () -> setHibernateConfig(dbConfig));
+        assertTrue(exception.getMessage().startsWith("Invalid hibernate configuration"));
+    }
+
+    private static Stream<Arguments> invalidDbConfig() {
+        return Stream.of( //
+                Arguments.of(null, "username", "password", "multiTenancy"), //
+                Arguments.of("", "username", "password", "multiTenancy"), //
+                Arguments.of("url", null, "password", "multiTenancy"), //
+                Arguments.of("url", "", "password", "multiTenancy"), //
+                Arguments.of("url", "username", null, "multiTenancy"), //
+                Arguments.of("url", "username", "", "multiTenancy"), //
+                Arguments.of("url", "username", "password", null), //
+                Arguments.of("url", "username", "password", ""));
+    }
+
+    @DisplayName("extractAndSetHibernateConfig() should extract hibernate properties from environment and set it")
+    @Test
+    void extractAndSetHibernateConfigShouldExtractHibernatePropertiesFromEnvironmentAndSetIt() {
+        // arrange
+        String url = "url", username = "username", password = "password", multiTenancy = "multiTenancy";
+
+        ConfigurableEnvironment environment = mock(ConfigurableEnvironment.class);
+        when(environment.getProperty(HIBERNATE_CONNECTION_URL)).thenReturn(url);
+        when(environment.getProperty(HIBERNATE_CONNECTION_USERNAME)).thenReturn(username);
+        when(environment.getProperty(HIBERNATE_CONNECTION_PASSWORD)).thenReturn(password);
+        when(environment.getProperty(HIBERNATE_MULTITENANCY)).thenReturn(multiTenancy);
+
+        // act
+        extractAndSetHibernateConfig(environment);
+        Properties hibernateProperties = getHibernateConfig();
+
+        // assert
+        assertNotNull(hibernateProperties);
+        assertProperties(url, username, password, multiTenancy, hibernateProperties);
+    }
+
+    @DisplayName("getHibernateConfig() should throw exception if setHibernateConfig() is not called before with valid configuration")
+    @Test
+    void getHibernateConfigShouldThrowExceptionIfSetHibernateConfigIsNotCalledBeforeWithValidConfiguration() {
+        // arrange
+
+        // act + assert
+        RuntimeException exception = assertThrows(RuntimeException.class, HibernateContext::getHibernateConfig);
+        assertEquals("No cached hibernate configuration found", exception.getMessage());
+    }
+
+    @DisplayName("getHibernateConfig() should return hibernate config as properties if db config is valid")
+    @Test
+    void getHibernateConfigShouldReturnHibernateConfigAsPropertiesIfDbConfigIsValid() {
+        // arrange
+        String url = "url", username = "username", password = "password", multiTenancy = "multiTenancy";
+        DbConfig dbConfig = new DbConfig(url, username, password, multiTenancy);
+        setHibernateConfig(dbConfig);
+
+        // act
+        Properties hibernateProperties = getHibernateConfig();
+
+        // assert
+        assertNotNull(hibernateProperties);
+        assertProperties(url, username, password, multiTenancy, hibernateProperties);
+    }
+
+    private void assertProperties(String url, String username, String password, String multiTenancy,
+            Properties properties) {
+
+        assertEquals(url, properties.get(HIBERNATE_CONNECTION_URL));
+        assertEquals(username, properties.get(HIBERNATE_CONNECTION_USERNAME));
+        assertEquals(password, properties.get(HIBERNATE_CONNECTION_PASSWORD));
+        assertEquals(multiTenancy, properties.get(HIBERNATE_MULTITENANCY));
+        assertEquals(url, properties.get(SPRING_DATASOURCE_URL));
+        assertEquals(username, properties.get(SPRING_DATASOURCE_USERNAME));
+        assertEquals(password, properties.get(SPRING_DATASOURCE_PASSWORD));
+    }
+
+}
diff --git a/backend/src/test/java/ch/puzzle/okr/multitenancy/SchemaMultiTenantConnectionProviderInternalsTest.java b/backend/src/test/java/ch/puzzle/okr/multitenancy/SchemaMultiTenantConnectionProviderInternalsTest.java
new file mode 100644
index 0000000000..e8bc0dc7b0
--- /dev/null
+++ b/backend/src/test/java/ch/puzzle/okr/multitenancy/SchemaMultiTenantConnectionProviderInternalsTest.java
@@ -0,0 +1,88 @@
+package ch.puzzle.okr.multitenancy;
+
+import ch.puzzle.okr.exception.ConnectionProviderException;
+import org.hibernate.engine.jdbc.connections.spi.ConnectionProvider;
+import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.DisplayName;
+import org.junit.jupiter.api.Test;
+
+import java.util.Properties;
+
+import static org.mockito.Mockito.mock;
+
+public class SchemaMultiTenantConnectionProviderInternalsTest {
+
+    private static final String TENANT_ID = "pitc";
+
+    private static class ConfigurableConnectionProviderMock extends SchemaMultiTenantConnectionProvider {
+
+        @Override
+        protected Properties getHibernateProperties() {
+            return new Properties();
+        }
+
+        public void registerProvider(String tenantIdentifier, ConnectionProvider connectionProvider) {
+            connectionProviderMap.put(tenantIdentifier, connectionProvider);
+        }
+    }
+
+    @DisplayName("getConnectionProvider() return ConnectionProvider if TenantId is registered")
+    @Test
+    void getConnectionProviderReturnConnectionProviderIfTenantIdIsRegistered() {
+        // arrange
+        ConfigurableConnectionProviderMock mockProvider = new ConfigurableConnectionProviderMock();
+        mockProvider.registerProvider(TENANT_ID, mock(ConnectionProvider.class));
+
+        // act
+        ConnectionProvider foundConnectionProvider = mockProvider.getConnectionProvider(TENANT_ID);
+
+        // assert
+        Assertions.assertNotNull(foundConnectionProvider);
+    }
+
+    @DisplayName("getConnectionProvider() throws Exception when lookup TenantId is null")
+    @Test
+    void getConnectionProviderThrowsExceptionWhenLookupTenantIdIsNull() {
+        // arrange
+        ConfigurableConnectionProviderMock mockProvider = new ConfigurableConnectionProviderMock();
+
+        // act + assert
+        Assertions.assertThrows(ConnectionProviderException.class, () -> mockProvider.getConnectionProvider(null));
+    }
+
+    @DisplayName("selectConnectionProvider() return ConnectionProvider if TenantId is registered")
+    @Test
+    void selectConnectionProviderReturnConnectionProviderIfTenantIdIsRegistered() {
+        // arrange
+        ConfigurableConnectionProviderMock mockProvider = new ConfigurableConnectionProviderMock();
+        mockProvider.registerProvider(TENANT_ID, mock(ConnectionProvider.class));
+
+        // act
+        ConnectionProvider foundConnectionProvider = mockProvider.selectConnectionProvider(TENANT_ID);
+
+        // assert
+        Assertions.assertNotNull(foundConnectionProvider);
+    }
+
+    @DisplayName("getAnyConnectionProvider() return ConnectionProvider for TenantId public")
+    @Test
+    void getAnyConnectionProviderReturnConnectionProviderForTenantIdPublic() {
+        // arrange
+        ConfigurableConnectionProviderMock mockProvider = new ConfigurableConnectionProviderMock();
+        mockProvider.registerProvider("public", mock(ConnectionProvider.class));
+
+        // act
+        ConnectionProvider foundConnectionProvider = mockProvider.getAnyConnectionProvider();
+
+        // assert
+        Assertions.assertNotNull(foundConnectionProvider);
+    }
+
+    @DisplayName("getConnectionProviderShouldThrowRuntimeExceptionWhenNoPropertiesAreFound")
+    @Test
+    void getConnectionProviderShouldThrowRuntimeExceptionWhenNoPropertiesAreFound() {
+        ConfigurableConnectionProviderMock mockProvider = new ConfigurableConnectionProviderMock();
+
+        Assertions.assertThrows(RuntimeException.class, () -> mockProvider.getConnectionProvider(TENANT_ID));
+    }
+}
diff --git a/backend/src/test/java/ch/puzzle/okr/multitenancy/SchemaMultiTenantConnectionProviderTest.java b/backend/src/test/java/ch/puzzle/okr/multitenancy/SchemaMultiTenantConnectionProviderTest.java
new file mode 100644
index 0000000000..e9a97a6d14
--- /dev/null
+++ b/backend/src/test/java/ch/puzzle/okr/multitenancy/SchemaMultiTenantConnectionProviderTest.java
@@ -0,0 +1,52 @@
+package ch.puzzle.okr.multitenancy;
+
+import ch.puzzle.okr.test.SpringIntegrationTest;
+import org.junit.jupiter.api.DisplayName;
+import org.junit.jupiter.api.Test;
+import org.mockito.Mock;
+
+import java.sql.Connection;
+import java.sql.SQLException;
+import java.sql.Statement;
+
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+@SpringIntegrationTest
+public class SchemaMultiTenantConnectionProviderTest {
+    @Mock
+    Connection connection;
+    @Mock
+    Statement statement;
+
+    private static final String TENANT_ID = "pitc";
+
+    @DisplayName("getConnection() should set schema with okr prefix")
+    @Test
+    void getConnectionShouldSetSchemaWithOkrPrefix() throws SQLException {
+        // arrange
+        when(connection.createStatement()).thenReturn(statement);
+        SchemaMultiTenantConnectionProvider provider = new SchemaMultiTenantConnectionProvider();
+
+        // act
+        provider.getConnection(TENANT_ID, connection);
+
+        // assert
+        verify(statement).execute("SET SCHEMA 'okr_" + TENANT_ID + "';");
+    }
+
+    @DisplayName("getConnection() should set schema without okr prefix if tenant id is DEFAULT_TENANT_ID")
+    @Test
+    void getConnectionShouldSetSchemaWithoutOkrPrefixIfTenantIdIsDefaultTenantId() throws SQLException {
+        // arrange
+        when(connection.createStatement()).thenReturn(statement);
+        SchemaMultiTenantConnectionProvider provider = new SchemaMultiTenantConnectionProvider();
+
+        // act
+        provider.getConnection(TenantContext.DEFAULT_TENANT_ID, connection);
+
+        // assert
+        verify(statement).execute("SET SCHEMA '" + TenantContext.DEFAULT_TENANT_ID + "';");
+    }
+
+}
diff --git a/backend/src/test/java/ch/puzzle/okr/multitenancy/TenantConfigProviderTestIT.java b/backend/src/test/java/ch/puzzle/okr/multitenancy/TenantConfigProviderTestIT.java
new file mode 100644
index 0000000000..940473d020
--- /dev/null
+++ b/backend/src/test/java/ch/puzzle/okr/multitenancy/TenantConfigProviderTestIT.java
@@ -0,0 +1,146 @@
+package ch.puzzle.okr.multitenancy;
+
+import ch.puzzle.okr.test.SpringIntegrationTest;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.DisplayName;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.CsvSource;
+import org.mockito.Mock;
+import org.springframework.boot.SpringBootConfiguration;
+import org.springframework.core.env.Environment;
+
+import java.text.MessageFormat;
+import java.util.List;
+import java.util.Optional;
+
+import static org.junit.jupiter.api.Assertions.*;
+import static org.mockito.Mockito.when;
+
+@SpringIntegrationTest
+@SpringBootConfiguration
+public class TenantConfigProviderTestIT {
+    private static final String JWK_SET_URI = "jwkSetUri";
+    private static final String FRONTEND_CLIENT_ISSUER_URL = "frontendClientIssuerUrl";
+    private static final String FRONTEND_CLIENT_ID = "frontendClientId";
+    private static final String DATASOURCE_URL = "datasourceUrl";
+    private static final String DATASOURCE_NAME = "datasourceName";
+    private static final String DATASOURCE_PASSWORD = "datasourcePassword";
+    private static final String DATASOURCE_SCHEMA = "datasourceSchema";
+    private static final String DRIVER_CLASS_NAME = "driverClassName";
+    private static final String CHAMPION_EMAILS_1 = "a@pitc.ch";
+    private static final String CHAMPION_EMAILS_2 = "b@pitc.ch";
+    private static final String CHAMPION_EMAILS = CHAMPION_EMAILS_1 + "," + CHAMPION_EMAILS_2;
+
+    private final String[] tenantIds = { "pitc", "acme" };
+
+    @Mock
+    private Environment env;
+
+    @BeforeEach
+    void setUp() {
+        for (String tenantId : tenantIds) {
+            setupPropertiesForTenantWithId(tenantId);
+        }
+    }
+
+    private void setupPropertiesForTenantWithId(String id) {
+        mockProperty("okr.tenants.{0}.security.oauth2.resourceserver.jwt.jwk-set-uri", JWK_SET_URI, id);
+        mockProperty("okr.tenants.{0}.security.oauth2.frontend.issuer-url", FRONTEND_CLIENT_ISSUER_URL, id);
+        mockProperty("okr.tenants.{0}.security.oauth2.frontend.client-id", FRONTEND_CLIENT_ID, id);
+        mockProperty("okr.tenants.{0}.datasource.url", DATASOURCE_URL, id);
+        mockProperty("okr.tenants.{0}.datasource.username", DATASOURCE_NAME, id);
+        mockProperty("okr.tenants.{0}.datasource.password", DATASOURCE_PASSWORD, id);
+        mockProperty("okr.tenants.{0}.datasource.schema", DATASOURCE_SCHEMA, id);
+
+        mockProperty("okr.datasource.driver-class-name", DRIVER_CLASS_NAME);
+        mockPropertyWithDefaultValue("okr.tenants.{0}.user.champion.emails", CHAMPION_EMAILS, id);
+    }
+
+    private void mockProperty(String propertyName, String propertyValue, String tenantId) {
+        when(env.getProperty(MessageFormat.format(propertyName, tenantId))) //
+                .thenReturn(prefix(tenantId) + propertyValue);
+    }
+
+    private void mockProperty(String propertyName, String propertyValue) {
+        when(env.getProperty(propertyName)).thenReturn(propertyValue);
+    }
+
+    private void mockPropertyWithDefaultValue(String propertyName, String propertyValue, String id) {
+        when(env.getProperty(MessageFormat.format(propertyName, id), "")) //
+                .thenReturn(propertyValue);
+    }
+
+    private String prefix(String tenantId) {
+        return tenantId + "_";
+    }
+
+    @DisplayName("getTenantConfigs returns all TenantConfigs as List")
+    @Test
+    public void testGetTenantConfigs() {
+        TenantConfigProvider configProvider = new TenantConfigProvider(tenantIds, env);
+        List<TenantConfigProvider.TenantConfig> tenantConfigs = configProvider.getTenantConfigs();
+        for (TenantConfigProvider.TenantConfig config : tenantConfigs) {
+            assertTenantConfigProvider(config);
+        }
+    }
+
+    @DisplayName("getTenantConfigById returns for an existing TenantId the TenantConfig as Optional")
+    @ParameterizedTest
+    @CsvSource({ "pitc, acme" })
+    void testGetTenantConfigByIdForExistingTenantId(String tenantId) {
+        TenantConfigProvider configProvider = new TenantConfigProvider(tenantIds, env);
+        Optional<TenantConfigProvider.TenantConfig> config = configProvider.getTenantConfigById(tenantId);
+        assertTrue(config.isPresent());
+        assertTenantConfigProvider(config.get());
+    }
+
+    @DisplayName("getTenantConfigById returns for a non existing TenantId an empty Optional")
+    @ParameterizedTest
+    @CsvSource({ "PITC-London" })
+    void testGetTenantConfigByIdForNonExistingTenantId(String nonExistingTenantId) {
+        TenantConfigProvider configProvider = new TenantConfigProvider(tenantIds, env);
+        Optional<TenantConfigProvider.TenantConfig> config = configProvider.getTenantConfigById(nonExistingTenantId);
+        assertTrue(config.isEmpty());
+    }
+
+    @DisplayName("getJwkSetUri returns for an existing TenantId the JwkSetUri as Optional")
+    @ParameterizedTest
+    @CsvSource({ "pitc", "acme" })
+    void testGetJwkSetUriForExistingTenantId(String tenantId) {
+        // arrange
+        TenantConfigProvider configProvider = new TenantConfigProvider(tenantIds, env);
+
+        // act
+        Optional<String> jwkSetUri = configProvider.getJwkSetUri(tenantId);
+
+        // assert
+        assertTrue(jwkSetUri.isPresent());
+        assertEquals(prefix(tenantId) + JWK_SET_URI, jwkSetUri.get());
+    }
+
+    @DisplayName("getJwkSetUri returns for a non existing TenantId an empty Optional")
+    @ParameterizedTest
+    @CsvSource({ "PITC-London" })
+    void testGetJwkSetUriForNonExistingTenantId(String nonExistingTenantId) {
+        TenantConfigProvider configProvider = new TenantConfigProvider(tenantIds, env);
+        Optional<String> jwkSetUri = configProvider.getJwkSetUri(nonExistingTenantId);
+        assertTrue(jwkSetUri.isEmpty());
+    }
+
+    private void assertTenantConfigProvider(TenantConfigProvider.TenantConfig tenantConfig) {
+        String tenantId = tenantConfig.tenantId();
+        assertEquals(tenantId, tenantConfig.tenantId());
+        assertEquals(prefix(tenantId) + JWK_SET_URI, tenantConfig.jwkSetUri());
+        assertEquals(prefix(tenantId) + FRONTEND_CLIENT_ISSUER_URL, tenantConfig.issuerUrl());
+        assertEquals(prefix(tenantId) + FRONTEND_CLIENT_ID, tenantConfig.clientId());
+        assertEquals(prefix(tenantId) + DATASOURCE_URL, tenantConfig.dataSourceConfig().url());
+        assertEquals(prefix(tenantId) + DATASOURCE_NAME, tenantConfig.dataSourceConfig().name());
+        assertEquals(prefix(tenantId) + DATASOURCE_PASSWORD, tenantConfig.dataSourceConfig().password());
+        assertEquals(prefix(tenantId) + DATASOURCE_SCHEMA, tenantConfig.dataSourceConfig().schema());
+
+        assertArrayEquals(new String[] { CHAMPION_EMAILS_1, CHAMPION_EMAILS_2 }, tenantConfig.okrChampionEmails());
+        assertEquals(DRIVER_CLASS_NAME, tenantConfig.dataSourceConfig().driverClassName());
+    }
+
+}
diff --git a/backend/src/test/java/ch/puzzle/okr/multitenancy/TenantContextTest.java b/backend/src/test/java/ch/puzzle/okr/multitenancy/TenantContextTest.java
new file mode 100644
index 0000000000..cbca37d8c5
--- /dev/null
+++ b/backend/src/test/java/ch/puzzle/okr/multitenancy/TenantContextTest.java
@@ -0,0 +1,25 @@
+package ch.puzzle.okr.multitenancy;
+
+import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+
+public class TenantContextTest {
+
+    @BeforeEach
+    void setUp() {
+        TenantContext.setCurrentTenant(null);
+    }
+
+    @Test
+    void defaultTenantIsPublic() {
+        Assertions.assertEquals("public", TenantContext.getCurrentTenant());
+    }
+
+    @Test
+    void whenTenantIsSetThenReturnIt() {
+        String tenant = "okr_acme";
+        TenantContext.setCurrentTenant(tenant);
+        Assertions.assertEquals(tenant, TenantContext.getCurrentTenant());
+    }
+}
diff --git a/backend/src/test/java/ch/puzzle/okr/multitenancy/customization/TenantClientCustomizationProviderTest.java b/backend/src/test/java/ch/puzzle/okr/multitenancy/customization/TenantClientCustomizationProviderTest.java
new file mode 100644
index 0000000000..9d5a393af0
--- /dev/null
+++ b/backend/src/test/java/ch/puzzle/okr/multitenancy/customization/TenantClientCustomizationProviderTest.java
@@ -0,0 +1,40 @@
+package ch.puzzle.okr.multitenancy.customization;
+
+import org.junit.jupiter.api.DisplayName;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.CsvSource;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+
+public class TenantClientCustomizationProviderTest {
+
+    @DisplayName("extractCssNameFromPropertyName() should return css name for valid property name")
+    @ParameterizedTest
+    @CsvSource({ "pitc", "acme" })
+    void extractCssNameFromPropertyNameShouldReturnCssNameForValidPropertyName(String tenantId) {
+        // arrange
+        String propertyNameWithTenant = "okr.tenants." + tenantId
+                + ".clientcustomization.customstyles.my-css-property-name";
+        TenantClientCustomizationProvider provider = new TenantClientCustomizationProvider(new String[] {}, null);
+
+        // act
+        String cssName = provider.extractCssNameFromPropertyName(propertyNameWithTenant, tenantId);
+
+        // assert
+        assertEquals("my-css-property-name", cssName);
+    }
+
+    @DisplayName("extractCssNameFromPropertyName() should throw IllegalArgumentException for invalid property name")
+    @Test
+    void extractCssNameFromPropertyNameShouldThrowIllegalArgumentExceptionForInvalidPropertyName() {
+        // arrange
+        String propertyNameWithoutTenant = "okr.tenants.clientcustomization.customstyles.my-css-property-name";
+        TenantClientCustomizationProvider provider = new TenantClientCustomizationProvider(new String[] {}, null);
+
+        // act + assert
+        assertThrows(IllegalArgumentException.class,
+                () -> provider.extractCssNameFromPropertyName(propertyNameWithoutTenant, "pitc"));
+    }
+}
diff --git a/backend/src/test/java/ch/puzzle/okr/multitenancy/customization/TenantClientCustomizationProviderTestIT.java b/backend/src/test/java/ch/puzzle/okr/multitenancy/customization/TenantClientCustomizationProviderTestIT.java
new file mode 100644
index 0000000000..fe41e7e636
--- /dev/null
+++ b/backend/src/test/java/ch/puzzle/okr/multitenancy/customization/TenantClientCustomizationProviderTestIT.java
@@ -0,0 +1,90 @@
+package ch.puzzle.okr.multitenancy.customization;
+
+import ch.puzzle.okr.test.SpringIntegrationTest;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.DisplayName;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.CsvSource;
+import org.mockito.Mock;
+import org.springframework.core.env.Environment;
+
+import java.text.MessageFormat;
+import java.util.Optional;
+
+import static org.junit.jupiter.api.Assertions.*;
+import static org.mockito.Mockito.when;
+
+@SpringIntegrationTest
+public class TenantClientCustomizationProviderTestIT {
+    private static final String LOGO = "logo";
+    private static final String TRIANGLES = "triangles";
+    private static final String BACKGROUND_LOGO = "background-logo";
+    private static final String FAVICON = "favicon";
+    private static final String TITLE = "title";
+
+    private static final String CUSTOM_STYLE_NAME = "okr-topbar-background-color";
+    private static final String CUSTOM_STYLE_VALUE = "css-custom-value";
+
+    private final String[] tenantIds = { "pitc", "acme" };
+
+    @Mock
+    private Environment env;
+
+    @BeforeEach
+    void setUp() {
+        for (String tenantId : tenantIds) {
+            setupPropertiesForTenantWithId(tenantId);
+        }
+    }
+
+    private void setupPropertiesForTenantWithId(String id) {
+        mockProperty("okr.tenants.{0}.clientcustomization.logo", LOGO, id);
+        mockProperty("okr.tenants.{0}.clientcustomization.triangles", TRIANGLES, id);
+        mockProperty("okr.tenants.{0}.clientcustomization.background-logo", BACKGROUND_LOGO, id);
+        mockProperty("okr.tenants.{0}.clientcustomization.favicon", FAVICON, id);
+        mockProperty("okr.tenants.{0}.clientcustomization.title", TITLE, id);
+        mockProperty("okr.tenants.{0}.clientcustomization.customstyles.okr-topbar-background-color", CUSTOM_STYLE_VALUE,
+                id);
+    }
+
+    private void mockProperty(String propertyName, String propertyValue, String tenantId) {
+        when(env.getProperty(MessageFormat.format(propertyName, tenantId))) //
+                .thenReturn(prefix(tenantId) + propertyValue);
+    }
+
+    private String prefix(String tenantId) {
+        return tenantId + "_";
+    }
+
+    @DisplayName("getTenantClientCustomizationsById() should return TenantClientCustomization")
+    @ParameterizedTest
+    @CsvSource({ "pitc", "acme" })
+    void getTenantClientCustomizationsByIdShouldReturnTenantClientCustomization(String tenantId) {
+        // arrange
+        TenantClientCustomizationProvider provider = new TenantClientCustomizationProvider(tenantIds, env);
+
+        // act
+        Optional<TenantClientCustomization> customization = provider.getTenantClientCustomizationsById(tenantId);
+
+        // assert
+        assertTrue(customization.isPresent());
+        assertTenantClientCustomization(customization.get(), tenantId);
+    }
+
+    private void assertTenantClientCustomization(TenantClientCustomization customization, String tenantId) {
+        assertEquals(prefix(tenantId) + FAVICON, customization.favicon());
+        assertEquals(prefix(tenantId) + LOGO, customization.logo());
+        assertEquals(prefix(tenantId) + TRIANGLES, customization.triangles());
+        assertEquals(prefix(tenantId) + BACKGROUND_LOGO, customization.backgroundLogo());
+        assertEquals(prefix(tenantId) + TITLE, customization.title());
+        assertCustomStyles(customization, tenantId);
+    }
+
+    private void assertCustomStyles(TenantClientCustomization customization, String tenantId) {
+        assertNotNull(customization.customStyles());
+        assertFalse(customization.customStyles().isEmpty());
+
+        String customStyleValue = customization.customStyles().get(CUSTOM_STYLE_NAME);
+        assertEquals(prefix(tenantId) + CUSTOM_STYLE_VALUE, customStyleValue);
+    }
+}
diff --git a/backend/src/test/java/ch/puzzle/okr/security/AuthenticationEventsTest.java b/backend/src/test/java/ch/puzzle/okr/security/AuthenticationEventsTest.java
new file mode 100644
index 0000000000..f73c3ecf83
--- /dev/null
+++ b/backend/src/test/java/ch/puzzle/okr/security/AuthenticationEventsTest.java
@@ -0,0 +1,61 @@
+package ch.puzzle.okr.security;
+
+import ch.puzzle.okr.multitenancy.TenantContext;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.DisplayName;
+import org.junit.jupiter.api.Test;
+import org.springframework.security.authentication.event.AuthenticationSuccessEvent;
+import org.springframework.security.core.Authentication;
+import org.springframework.security.oauth2.jwt.Jwt;
+
+import static ch.puzzle.okr.multitenancy.TenantContext.DEFAULT_TENANT_ID;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.mockito.Mockito.*;
+
+public class AuthenticationEventsTest {
+
+    public static final String TENANT_FROM_TOKEN = "pitc";
+
+    @BeforeEach
+    void prepareTests() {
+        TenantContext.setCurrentTenant(DEFAULT_TENANT_ID);
+    }
+
+    @DisplayName("onSuccess() puts Token from AuthenticationSuccessEvent in TenantContext")
+    @Test
+    void onSuccessPutsTokenFromAuthenticationSuccessEventInTenantContext() {
+        // arrange
+        Jwt tokenMock = mock(Jwt.class);
+
+        AuthenticationSuccessEvent successEvent = new AuthenticationSuccessEvent(mock(Authentication.class));
+        when(successEvent.getAuthentication().getPrincipal()).thenReturn(tokenMock);
+
+        JwtHelper jwtHelperMock = mock(JwtHelper.class);
+        when(jwtHelperMock.getTenantFromToken(tokenMock)).thenReturn(TENANT_FROM_TOKEN);
+
+        // pre-assert
+        assertDefaultTenantIsInTenantContext();
+
+        // act
+        AuthenticationEvents authenticationEvents = new AuthenticationEvents(jwtHelperMock);
+        authenticationEvents.onSuccess(successEvent);
+
+        // assert
+        assertTenantFromTokenIsInTenantContext();
+        verifyGetTenantFromTokenIsCalledWithTokenFromAuthenticationSuccessEvent(jwtHelperMock, tokenMock);
+    }
+
+    private void assertDefaultTenantIsInTenantContext() {
+        assertEquals(DEFAULT_TENANT_ID, TenantContext.getCurrentTenant());
+    }
+
+    private void assertTenantFromTokenIsInTenantContext() {
+        assertEquals(TENANT_FROM_TOKEN, TenantContext.getCurrentTenant());
+    }
+
+    private void verifyGetTenantFromTokenIsCalledWithTokenFromAuthenticationSuccessEvent(JwtHelper jwtHelper,
+            Jwt token) {
+        verify(jwtHelper).getTenantFromToken(token);
+    }
+
+}
diff --git a/backend/src/test/java/ch/puzzle/okr/security/JwtHelperTest.java b/backend/src/test/java/ch/puzzle/okr/security/JwtHelperTest.java
new file mode 100644
index 0000000000..35f0367478
--- /dev/null
+++ b/backend/src/test/java/ch/puzzle/okr/security/JwtHelperTest.java
@@ -0,0 +1,149 @@
+package ch.puzzle.okr.security;
+
+import ch.puzzle.okr.exception.OkrResponseStatusException;
+import ch.puzzle.okr.models.User;
+import ch.puzzle.okr.multitenancy.TenantConfigProvider;
+import com.nimbusds.jwt.JWTClaimsSet;
+import jakarta.persistence.EntityNotFoundException;
+import org.junit.jupiter.api.DisplayName;
+import org.junit.jupiter.api.Test;
+import org.springframework.security.oauth2.jwt.Jwt;
+
+import java.text.ParseException;
+import java.util.Map;
+import java.util.Optional;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.when;
+import static org.springframework.http.HttpStatus.BAD_REQUEST;
+
+public class JwtHelperTest {
+
+    private static final String TOKEN_CLAIMS_KEY_FIRSTNAME = "given_name";
+    private static final String TOKEN_CLAIMS_KEY_LASTNAME = "family_name";
+    private static final String TOKEN_CLAIMS_KEY_EMAIL = "email";
+    private static final String HANS = "Hans";
+    private static final String MUSTER = "Muster";
+    private static final String EMAIL = "a@b.ch";
+
+    private static final String TOKEN_CLAIMS_KEY_TENANT = "tenant";
+    private static final String PITC = "pitc";
+
+    // ok
+    @DisplayName("getUserFromJwt() extracts User data from Token")
+    @Test
+    void getUserFromJwtExtractsUserDataFromToken() {
+        // arrange
+        Jwt tokenWithUserDataMock = mock(Jwt.class);
+        when(tokenWithUserDataMock.getClaims()).thenReturn(Map.of( //
+                TOKEN_CLAIMS_KEY_FIRSTNAME, HANS, //
+                TOKEN_CLAIMS_KEY_LASTNAME, MUSTER, //
+                TOKEN_CLAIMS_KEY_EMAIL, EMAIL //
+        ));
+
+        JwtHelper jwtHelper = new JwtHelper(null, //
+                TOKEN_CLAIMS_KEY_FIRSTNAME, TOKEN_CLAIMS_KEY_LASTNAME, TOKEN_CLAIMS_KEY_EMAIL);
+
+        // act
+        User userFromToken = jwtHelper.getUserFromJwt(tokenWithUserDataMock);
+
+        // assert
+        assertEquals(HANS, userFromToken.getFirstname());
+        assertEquals(MUSTER, userFromToken.getLastname());
+        assertEquals(EMAIL, userFromToken.getEmail());
+    }
+
+    // ok
+    @DisplayName("getUserFromJwt() throws Exception if Token not contains User data")
+    @Test
+    void getUserFromJwtThrowsExceptionIfTokenNotContainsUserData() {
+        // arrange
+        Jwt tokenWithNoUserDataMock = mock(Jwt.class);
+
+        JwtHelper jwtHelper = new JwtHelper(null, //
+                TOKEN_CLAIMS_KEY_FIRSTNAME, TOKEN_CLAIMS_KEY_LASTNAME, TOKEN_CLAIMS_KEY_EMAIL);
+
+        // act + assert
+        OkrResponseStatusException okrResponseStatusException = //
+                assertThrows(OkrResponseStatusException.class, () -> jwtHelper.getUserFromJwt(tokenWithNoUserDataMock));
+
+        // assert
+        assertEquals(BAD_REQUEST, okrResponseStatusException.getStatusCode());
+    }
+
+    @DisplayName("getTenantFromToken() returns Tenant if Tenant found in TenantConfigProvider")
+    @Test
+    void getTenantFromTokenReturnsTenantIfTenantFoundInTenantConfigProvider() {
+        // arrange
+        Jwt tokenMock = mock(Jwt.class);
+        when(tokenMock.getClaimAsString(TOKEN_CLAIMS_KEY_TENANT)).thenReturn(PITC);
+
+        TenantConfigProvider tenantConfigProviderMock = mock(TenantConfigProvider.class);
+        when(tenantConfigProviderMock.getTenantConfigById(PITC)).thenReturn(Optional.of( //
+                new TenantConfigProvider.TenantConfig(PITC, //
+                        new String[] {}, "jwkSetUri", "issuerUrl", //
+                        "clientId", null) //
+        ));
+
+        JwtHelper jwtHelper = new JwtHelper(tenantConfigProviderMock, null, null, null);
+
+        // act
+        String tenantFromToken = jwtHelper.getTenantFromToken(tokenMock);
+
+        // assert
+        assertEquals(PITC, tenantFromToken);
+    }
+
+    @DisplayName("getTenantFromToken() throws Exception if Tenant not found in TenantConfigProvider")
+    @Test
+    void getTenantFromTokenThrowsExceptionIfTenantNotFoundInTenantConfigProvider() {
+        // arrange
+        Jwt tokenMock = mock(Jwt.class);
+        when(tokenMock.getClaimAsString(TOKEN_CLAIMS_KEY_TENANT)).thenReturn(PITC);
+
+        TenantConfigProvider emptyTenantConfigProviderMock = mock(TenantConfigProvider.class);
+
+        JwtHelper jwtHelper = new JwtHelper(emptyTenantConfigProviderMock, null, null, null);
+
+        // act + assert
+        assertThrows(EntityNotFoundException.class, () -> jwtHelper.getTenantFromToken(tokenMock));
+    }
+
+    @DisplayName("getTenantFromJWTClaimsSet() returns Tenant if Tenant found in TenantConfigProvider")
+    @Test
+    void getTenantFromJWTClaimsSetReturnsTenantIfTenantFoundInTenantConfigProvider() throws ParseException {
+        // arrange
+        JWTClaimsSet claimsSetMock = mock(JWTClaimsSet.class);
+        when(claimsSetMock.getStringClaim(TOKEN_CLAIMS_KEY_TENANT)).thenReturn(PITC);
+
+        TenantConfigProvider tenantConfigProviderWithDataMock = mock(TenantConfigProvider.class);
+        when(tenantConfigProviderWithDataMock.getTenantConfigById(PITC)).thenReturn(Optional.of( //
+                new TenantConfigProvider.TenantConfig(PITC, //
+                        new String[] {}, "jwkSetUri", "issuerUrl", //
+                        "clientId", null) //
+        ));
+
+        JwtHelper jwtHelper = new JwtHelper(tenantConfigProviderWithDataMock, null, null, null);
+
+        // act
+        String tenantFromToken = jwtHelper.getTenantFromJWTClaimsSet(claimsSetMock);
+
+        // assert
+        assertEquals(PITC, tenantFromToken);
+    }
+
+    @DisplayName("getTenantFromJWTClaimsSet() throws Exception if ClaimSet can not be parsed")
+    @Test
+    void getTenantFromJWTClaimsSetThrowsExceptionIfClaimSetCanNotBeParsed() throws ParseException {
+        // arrange
+        JWTClaimsSet claimsSetMock = mock(JWTClaimsSet.class);
+        when(claimsSetMock.getStringClaim(TOKEN_CLAIMS_KEY_TENANT)).thenThrow(new ParseException("", 0));
+
+        JwtHelper jwtHelper = new JwtHelper(null, null, null, null);
+
+        // act + assert
+        assertThrows(RuntimeException.class, () -> jwtHelper.getTenantFromJWTClaimsSet(claimsSetMock));
+    }
+}
diff --git a/backend/src/test/java/ch/puzzle/okr/security/TenantJWSKeySelectorTest.java b/backend/src/test/java/ch/puzzle/okr/security/TenantJWSKeySelectorTest.java
new file mode 100644
index 0000000000..f02c34d5c1
--- /dev/null
+++ b/backend/src/test/java/ch/puzzle/okr/security/TenantJWSKeySelectorTest.java
@@ -0,0 +1,99 @@
+package ch.puzzle.okr.security;
+
+import ch.puzzle.okr.multitenancy.TenantConfigProvider;
+import com.nimbusds.jose.JWSHeader;
+import com.nimbusds.jose.KeySourceException;
+import com.nimbusds.jose.proc.JWSKeySelector;
+import com.nimbusds.jose.proc.SecurityContext;
+import com.nimbusds.jwt.JWTClaimsSet;
+import org.junit.jupiter.api.DisplayName;
+import org.junit.jupiter.api.Test;
+
+import java.security.Key;
+import java.util.List;
+import java.util.Optional;
+
+import static org.junit.jupiter.api.Assertions.*;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.when;
+
+public class TenantJWSKeySelectorTest {
+    private static final String PITC = "pitc";
+    private static final String JWK_SET_URI = "jwkSetUri";
+    private static final String MOCK_ALGORITHM = "mock_algorithm";
+    private static final String UNKNOWN_TENANT = "unknown tenant";
+
+    @DisplayName("selectKeys() throws Exception if JwkSetUri not found in TenantConfigProvider")
+    @Test
+    void selectKeysThrowsExceptionIfTenantConfigIsNotFound() {
+        // arrange
+        JWTClaimsSet jwtClaimsSetMock = mock(JWTClaimsSet.class);
+        JWSHeader jwsHeaderMock = mock(JWSHeader.class);
+        SecurityContext securityContext = new SecurityContext() {
+        };
+
+        JwtHelper jwtHelperMock = mock(JwtHelper.class);
+        when(jwtHelperMock.getTenantFromJWTClaimsSet(jwtClaimsSetMock)).thenReturn(PITC);
+
+        TenantConfigProvider emptyTenantConfigProviderMock = mock(TenantConfigProvider.class);
+
+        // act + assert
+        TenantJWSKeySelector selector = new TenantJWSKeySelector(emptyTenantConfigProviderMock, jwtHelperMock);
+        IllegalArgumentException illegalArgumentException = assertThrows(IllegalArgumentException.class, //
+                () -> selector.selectKeys(jwsHeaderMock, jwtClaimsSetMock, securityContext));
+
+        assertEquals(UNKNOWN_TENANT, illegalArgumentException.getLocalizedMessage());
+    }
+
+    @DisplayName("selectKeys() return Key with Mock Algorithm if JwkSetUri is found in TenantConfigProvider")
+    @Test
+    void selectKeysReturnKeyWithMockAlgorithmIfJwkSetUriIsFound() throws KeySourceException {
+        // arrange
+        JWTClaimsSet jwtClaimsSetMock = mock(JWTClaimsSet.class);
+        JWSHeader jwsHeaderMock = mock(JWSHeader.class);
+        SecurityContext securityContext = new SecurityContext() {
+        };
+
+        JwtHelper jwtHelperMock = mock(JwtHelper.class);
+        when(jwtHelperMock.getTenantFromJWTClaimsSet(jwtClaimsSetMock)).thenReturn(PITC);
+
+        TenantConfigProvider tenantConfigProviderWithDataMock = mock(TenantConfigProvider.class);
+        when(tenantConfigProviderWithDataMock.getJwkSetUri(PITC)).thenReturn(Optional.of(JWK_SET_URI));
+
+        TenantJWSKeySelector selector = new TenantJWSKeySelector(tenantConfigProviderWithDataMock, jwtHelperMock) {
+
+            @Override
+            JWSKeySelector<SecurityContext> fromUri(String uri) {
+                return (jwsHeader, securityContext) -> List.of(new Key() {
+                    @Override
+                    public String getAlgorithm() {
+                        return MOCK_ALGORITHM;
+                    }
+
+                    @Override
+                    public String getFormat() {
+                        return null;
+                    }
+
+                    @Override
+                    public byte[] getEncoded() {
+                        return new byte[0];
+                    }
+                });
+            }
+        };
+
+        // act + assert
+        List<? extends Key> keys = selector.selectKeys(jwsHeaderMock, jwtClaimsSetMock, securityContext);
+
+        // assert
+        assertListContainsSingleKeyWithMockAlgorithm(keys);
+    }
+
+    void assertListContainsSingleKeyWithMockAlgorithm(List<? extends Key> keys) {
+        assertNotNull(keys);
+        assertEquals(1, keys.size());
+        Key key = keys.get(0);
+        assertEquals(MOCK_ALGORITHM, key.getAlgorithm());
+    }
+}
diff --git a/backend/src/test/java/ch/puzzle/okr/security/TenantJwtIssuerValidatorTest.java b/backend/src/test/java/ch/puzzle/okr/security/TenantJwtIssuerValidatorTest.java
new file mode 100644
index 0000000000..7c675c4204
--- /dev/null
+++ b/backend/src/test/java/ch/puzzle/okr/security/TenantJwtIssuerValidatorTest.java
@@ -0,0 +1,78 @@
+package ch.puzzle.okr.security;
+
+import ch.puzzle.okr.multitenancy.TenantConfigProvider;
+import org.junit.jupiter.api.DisplayName;
+import org.junit.jupiter.api.Test;
+import org.springframework.security.oauth2.core.OAuth2TokenValidatorResult;
+import org.springframework.security.oauth2.jwt.Jwt;
+import org.springframework.security.oauth2.jwt.JwtIssuerValidator;
+
+import java.util.Optional;
+
+import static org.junit.jupiter.api.Assertions.*;
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.when;
+
+public class TenantJwtIssuerValidatorTest {
+
+    private static final String PITC = "pitc";
+    private static final String ISSUER_URL = "issuerUrl";
+
+    @DisplayName("validate() throws exception if TenantConfig is not found for Tenant PITC")
+    @Test
+    void validateThrowsExceptionIfTenantConfigNotFound() {
+        // arrange
+        Jwt token = mock(Jwt.class);
+
+        JwtHelper jwtHelper = mock(JwtHelper.class);
+        when(jwtHelper.getTenantFromToken(token)).thenReturn(PITC);
+
+        TenantConfigProvider emptyTenantConfigProvider = mock(TenantConfigProvider.class);
+
+        // act + assert
+        TenantJwtIssuerValidator validator = new TenantJwtIssuerValidator(emptyTenantConfigProvider, jwtHelper);
+        IllegalArgumentException illegalArgumentException = //
+                assertThrows(IllegalArgumentException.class, () -> validator.validate(token));
+
+        assertEquals("unknown tenant", illegalArgumentException.getLocalizedMessage());
+    }
+
+    @DisplayName("validate() return OAuth2TokenValidatorResult if TenantConfig with IssuerUrl is found for Tenant PITC")
+    @Test
+    void validateReturnOAuth2TokenValidatorResultIfTenantConfigWithIssuerUrlIsFound() {
+        // arrange
+        Jwt token = mock(Jwt.class);
+
+        JwtHelper jwtHelper = mock(JwtHelper.class);
+        when(jwtHelper.getTenantFromToken(token)).thenReturn(PITC);
+
+        TenantConfigProvider tenantConfigProviderWithPitcConfig = mock(TenantConfigProvider.class);
+        when(tenantConfigProviderWithPitcConfig.getTenantConfigById(PITC)).thenReturn(Optional.of( //
+                new TenantConfigProvider.TenantConfig( //
+                        PITC, new String[] {}, "jwkSetUri", //
+                        ISSUER_URL, "clientId", null)));
+
+        TenantJwtIssuerValidator tenantJwtIssuerValidator = new TenantJwtIssuerValidator(
+                tenantConfigProviderWithPitcConfig, jwtHelper) {
+
+            @Override
+            JwtIssuerValidator createValidator(String issuer) {
+                OAuth2TokenValidatorResult validatorResultWithNoErrors = mock(OAuth2TokenValidatorResult.class);
+                when(validatorResultWithNoErrors.hasErrors()).thenReturn(false);
+
+                JwtIssuerValidator jwtIssuerValidator = mock(JwtIssuerValidator.class);
+                when(jwtIssuerValidator.validate(any())).thenReturn(validatorResultWithNoErrors);
+                return jwtIssuerValidator;
+            }
+        };
+
+        // act
+        OAuth2TokenValidatorResult validateResult = tenantJwtIssuerValidator.validate(token);
+
+        // assert
+        assertNotNull(validateResult);
+        assertFalse(validateResult.hasErrors());
+    }
+
+}
diff --git a/backend/src/test/java/ch/puzzle/okr/security/helper/ClaimHelperTest.java b/backend/src/test/java/ch/puzzle/okr/security/helper/ClaimHelperTest.java
new file mode 100644
index 0000000000..0a3850bf1f
--- /dev/null
+++ b/backend/src/test/java/ch/puzzle/okr/security/helper/ClaimHelperTest.java
@@ -0,0 +1,143 @@
+package ch.puzzle.okr.security.helper;
+
+import com.nimbusds.jwt.JWTClaimsSet;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.DisplayName;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.ValueSource;
+
+import java.text.ParseException;
+import java.util.Optional;
+
+import static ch.puzzle.okr.security.JwtHelper.CLAIM_ISS;
+import static ch.puzzle.okr.security.JwtHelper.CLAIM_TENANT;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.when;
+
+public class ClaimHelperTest {
+
+    private static final String PITC = "pitc";
+    private ClaimHelper helper;
+
+    @BeforeEach
+    void setup() {
+        helper = new ClaimHelper();
+    }
+
+    @DisplayName("getTenantFromClaimsSetUsingClaimTenant() return tenant if claim tenant is found")
+    @Test
+    void getTenantFromClaimsSetUsingClaimTenantReturnTenantIfClaimTenantFound() throws ParseException {
+        // arrange
+        JWTClaimsSet claimsSetMock = mock(JWTClaimsSet.class);
+        when(claimsSetMock.getStringClaim(CLAIM_TENANT)).thenReturn(PITC);
+
+        // act
+        Optional<String> tenant = helper.getTenantFromClaimsSetUsingClaimTenant(claimsSetMock);
+
+        // assert
+        assertTrue(tenant.isPresent());
+        assertEquals(PITC, tenant.get());
+    }
+
+    @DisplayName("getTenantFromClaimsSetUsingClaimTenant() return empty if claim tenant is not found")
+    @Test
+    void getTenantFromClaimsSetUsingClaimTenantReturnEmptyIfClaimTenantNotFound() {
+        // arrange
+        JWTClaimsSet claimsSetMock = mock(JWTClaimsSet.class);
+
+        // act
+        Optional<String> tenant = helper.getTenantFromClaimsSetUsingClaimTenant(claimsSetMock);
+
+        // assert
+        assertTrue(tenant.isEmpty());
+    }
+
+    @DisplayName("getTenantFromClaimsSetUsingClaimTenant() return empty if claim tenant is found but value is null")
+    @Test
+    void getTenantFromClaimsSetUsingClaimTenantReturnEmptyIfClaimTenantFoundButValueIsNull() throws ParseException {
+        // arrange
+        JWTClaimsSet claimsSetMock = mock(JWTClaimsSet.class);
+        when(claimsSetMock.getStringClaim(CLAIM_TENANT)).thenReturn(null);
+
+        // act
+        Optional<String> tenant = helper.getTenantFromClaimsSetUsingClaimTenant(claimsSetMock);
+
+        // assert
+        assertTrue(tenant.isEmpty());
+    }
+
+    @DisplayName("getTenantFromClaimsSetUsingClaimTenant() return empty if claim tenant is found but parsing of claim failed")
+    @Test
+    void getTenantFromClaimsSetUsingClaimTenantReturnEmptyIfParsingOfClaimFailed() throws ParseException {
+        // arrange
+        JWTClaimsSet claimsSetMock = mock(JWTClaimsSet.class);
+        when(claimsSetMock.getStringClaim(CLAIM_TENANT)).thenThrow(new ParseException("", 0));
+
+        // act
+        Optional<String> tenant = helper.getTenantFromClaimsSetUsingClaimTenant(claimsSetMock);
+
+        // assert
+        assertTrue(tenant.isEmpty());
+    }
+
+    @DisplayName("getTenantFromClaimsSetUsingClaimIss() return tenant if claim iss is found")
+    @ParameterizedTest
+    @ValueSource(strings = { "https://sso.puzzle.ch/auth/realms/pitc", "http://localhost:8544/realms/pitc" })
+    void getTenantFromClaimsSetUsingClaimIssReturnTenantIfClaimIssFound(String issUrl) throws ParseException {
+        // arrange
+        JWTClaimsSet claimsSetMock = mock(JWTClaimsSet.class);
+        when(claimsSetMock.getStringClaim(CLAIM_ISS)).thenReturn(issUrl);
+
+        // act
+        Optional<String> tenant = helper.getTenantFromClaimsSetUsingClaimIss(claimsSetMock);
+
+        // assert
+        assertTrue(tenant.isPresent());
+        assertEquals(PITC, tenant.get());
+    }
+
+    @DisplayName("getTenantFromClaimsSetUsingClaimIss() return empty if claim iss is not found")
+    @Test
+    void getTenantFromClaimsSetUsingClaimIssReturnEmptyIfClaimIssNotFound() {
+        // arrange
+        JWTClaimsSet claimsSetMock = mock(JWTClaimsSet.class);
+
+        // act
+        Optional<String> tenant = helper.getTenantFromClaimsSetUsingClaimIss(claimsSetMock);
+
+        // assert
+        assertTrue(tenant.isEmpty());
+    }
+
+    @DisplayName("getTenantFromClaimsSetUsingClaimIss() return empty if claim iss is found but value is null")
+    @Test
+    void getTenantFromClaimsSetUsingClaimIssReturnEmptyIfClaimIssFoundButValueIsNull() throws ParseException {
+        // arrange
+        JWTClaimsSet claimsSetMock = mock(JWTClaimsSet.class);
+        when(claimsSetMock.getStringClaim(CLAIM_ISS)).thenReturn(null);
+
+        // act
+        Optional<String> tenant = helper.getTenantFromClaimsSetUsingClaimIss(claimsSetMock);
+
+        // assert
+        assertTrue(tenant.isEmpty());
+    }
+
+    @DisplayName("getTenantFromClaimsSetUsingClaimIss() return empty if parsing of claim failed")
+    @Test
+    void getTenantFromClaimsSetUsingClaimIssReturnEmptyIfParsingOfClaimFailed() throws ParseException {
+        // arrange
+        JWTClaimsSet claimsSetMock = mock(JWTClaimsSet.class);
+        when(claimsSetMock.getStringClaim(CLAIM_ISS)).thenThrow(new ParseException("", 0));
+
+        // act
+        Optional<String> tenant = helper.getTenantFromClaimsSetUsingClaimIss(claimsSetMock);
+
+        // assert
+        assertTrue(tenant.isEmpty());
+    }
+
+}
diff --git a/backend/src/test/java/ch/puzzle/okr/security/helper/TokenHelperTest.java b/backend/src/test/java/ch/puzzle/okr/security/helper/TokenHelperTest.java
new file mode 100644
index 0000000000..0b9c2215ce
--- /dev/null
+++ b/backend/src/test/java/ch/puzzle/okr/security/helper/TokenHelperTest.java
@@ -0,0 +1,114 @@
+package ch.puzzle.okr.security.helper;
+
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.DisplayName;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.ValueSource;
+import org.springframework.security.oauth2.jwt.Jwt;
+
+import java.util.Optional;
+
+import static ch.puzzle.okr.security.JwtHelper.CLAIM_ISS;
+import static ch.puzzle.okr.security.JwtHelper.CLAIM_TENANT;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.when;
+
+public class TokenHelperTest {
+
+    private static final String PITC = "pitc";
+    private TokenHelper helper;
+
+    @BeforeEach
+    void setUp() {
+        helper = new TokenHelper();
+    }
+
+    @DisplayName("getTenantFromTokenUsingClaimTenant() return tenant if claim tenant is found")
+    @Test
+    void getTenantFromTokenUsingClaimTenantReturnTenantIfClaimTenantFound() {
+        // arrange
+        Jwt tokenMock = mock(Jwt.class);
+        when(tokenMock.getClaimAsString(CLAIM_TENANT)).thenReturn(PITC);
+
+        // act
+        Optional<String> tenant = helper.getTenantFromTokenUsingClaimTenant(tokenMock);
+
+        // assert
+        assertTrue(tenant.isPresent());
+        assertEquals(PITC, tenant.get());
+    }
+
+    @DisplayName("getTenantFromTokenUsingClaimTenant() return empty if claim tenant not found")
+    @Test
+    void getTenantFromTokenUsingClaimTenantReturnEmptyIfClaimTenantNotFound() {
+        // arrange
+        Jwt tokenMock = mock(Jwt.class);
+
+        // act
+        Optional<String> tenant = helper.getTenantFromTokenUsingClaimTenant(tokenMock);
+
+        // assert
+        assertTrue(tenant.isEmpty());
+    }
+
+    @DisplayName("getTenantFromTokenUsingClaimTenant() return empty if claim tenant is found but value is null")
+    @Test
+    void getTenantFromTokenUsingClaimTenantReturnEmptyIfClaimTenantFoundButValueIsNull() {
+        // arrange
+        Jwt tokenMock = mock(Jwt.class);
+        when(tokenMock.getClaimAsString(CLAIM_TENANT)).thenReturn(null);
+
+        // act
+        Optional<String> tenant = helper.getTenantFromTokenUsingClaimTenant(tokenMock);
+
+        // assert
+        assertTrue(tenant.isEmpty());
+    }
+
+    @DisplayName("getTenantFromTokenUsingClaimIss() return tenant if claim iss is found")
+    @ParameterizedTest
+    @ValueSource(strings = { "https://sso.puzzle.ch/auth/realms/pitc", "http://localhost:8544/realms/pitc" })
+    void getTenantFromTokenUsingClaimIssReturnTenantIfClaimIssFound(String issUrl) {
+        // arrange
+        Jwt tokenMock = mock(Jwt.class);
+        when(tokenMock.getClaimAsString(CLAIM_ISS)).thenReturn(issUrl);
+
+        // act
+        Optional<String> tenant = helper.getTenantFromTokenUsingClaimIss(tokenMock);
+
+        // assert
+        assertTrue(tenant.isPresent());
+        assertEquals(PITC, tenant.get());
+    }
+
+    @DisplayName("getTenantFromTokenUsingClaimIss() return empty if claim iss is not found")
+    @Test
+    void getTenantFromTokenUsingClaimIssReturnEmptyIfClaimIssNotFound() {
+        // arrange
+        Jwt tokenMock = mock(Jwt.class);
+
+        // act
+        Optional<String> tenant = helper.getTenantFromTokenUsingClaimIss(tokenMock);
+
+        // assert
+        assertTrue(tenant.isEmpty());
+    }
+
+    @DisplayName("getTenantFromTokenUsingClaimIss() return empty if claim iss is found but value is null")
+    @Test
+    void getTenantFromTokenUsingClaimIssReturnEmptyIfClaimIssFoundButValueIsNull() {
+        // arrange
+        Jwt tokenMock = mock(Jwt.class);
+        when(tokenMock.getClaimAsString(CLAIM_ISS)).thenReturn(null);
+
+        // act
+        Optional<String> tenant = helper.getTenantFromTokenUsingClaimIss(tokenMock);
+
+        // assert
+        assertTrue(tenant.isEmpty());
+    }
+
+}
diff --git a/backend/src/test/java/ch/puzzle/okr/security/helper/UrlHelperTest.java b/backend/src/test/java/ch/puzzle/okr/security/helper/UrlHelperTest.java
new file mode 100644
index 0000000000..76f71a918e
--- /dev/null
+++ b/backend/src/test/java/ch/puzzle/okr/security/helper/UrlHelperTest.java
@@ -0,0 +1,56 @@
+package ch.puzzle.okr.security.helper;
+
+import org.junit.jupiter.api.DisplayName;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.ValueSource;
+
+import java.util.Optional;
+
+import static org.junit.jupiter.api.Assertions.*;
+
+public class UrlHelperTest {
+
+    private static final String PITC = "pitc";
+
+    @DisplayName("extractTenantFromIssUrl() return tenant if Url contains slash")
+    @ParameterizedTest
+    @ValueSource(strings = { "https://sso.puzzle.ch/auth/realms/pitc", "http://localhost:8544/realms/pitc" })
+    void extractTenantFromIssUrlReturnTenantIfUrlContainSlash(String issUrl) {
+        // arrange
+
+        // act
+        Optional<String> tenantFromIssUrl = UrlHelper.extractTenantFromIssUrl(issUrl);
+
+        // assert
+        assertTrue(tenantFromIssUrl.isPresent());
+        assertEquals(PITC, tenantFromIssUrl.get());
+    }
+
+    @DisplayName("extractTenantFromIssUrl() return input url if url not contains slash")
+    @Test
+    void extractTenantFromIssUrlReturnInputIfUrlNotContainSlash() {
+        // arrange
+        String issUrl = "this_is_not_a_valid_url";
+
+        // act
+        Optional<String> tenantFromIssUrl = UrlHelper.extractTenantFromIssUrl(issUrl);
+
+        // assert
+        assertTrue(tenantFromIssUrl.isPresent());
+        assertEquals(issUrl, tenantFromIssUrl.get());
+    }
+
+    @DisplayName("extractTenantFromIssUrl() return empty if url is null")
+    @Test
+    void extractTenantFromIssUrlReturnEmptyIfUrlIsNull() {
+        // arrange
+        String issUrl = null;
+
+        // act
+        Optional<String> tenantFromIssUrl = UrlHelper.extractTenantFromIssUrl(issUrl);
+
+        // assert
+        assertTrue(tenantFromIssUrl.isEmpty());
+    }
+}
diff --git a/backend/src/test/java/ch/puzzle/okr/service/CacheServiceIT.java b/backend/src/test/java/ch/puzzle/okr/service/CacheServiceIT.java
deleted file mode 100644
index bbb8aea8fa..0000000000
--- a/backend/src/test/java/ch/puzzle/okr/service/CacheServiceIT.java
+++ /dev/null
@@ -1,74 +0,0 @@
-package ch.puzzle.okr.service;
-
-import ch.puzzle.okr.models.User;
-import ch.puzzle.okr.service.persistence.UserPersistenceService;
-import ch.puzzle.okr.test.SpringIntegrationTest;
-import org.junit.jupiter.api.AfterEach;
-import org.junit.jupiter.api.BeforeEach;
-import org.junit.jupiter.api.Test;
-import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.cache.Cache;
-import org.springframework.cache.CacheManager;
-
-import static ch.puzzle.okr.SpringCachingConfig.USER_CACHE;
-import static org.junit.jupiter.api.Assertions.assertNotNull;
-import static org.junit.jupiter.api.Assertions.assertNull;
-
-@SpringIntegrationTest
-class CacheServiceIT {
-
-    @Autowired
-    private CacheService cacheService;
-    @Autowired
-    private CacheManager cacheManager;
-    @Autowired
-    private UserPersistenceService userPersistenceService;
-
-    private User createdUser;
-    private Cache cache;
-
-    private static final String USERNAME = "username";
-
-    @BeforeEach
-    void beforeEach() {
-        cache = cacheManager.getCache(USER_CACHE);
-    }
-
-    @AfterEach
-    void tearDown() {
-        if (createdUser != null) {
-            userPersistenceService.deleteById(createdUser.getId());
-            createdUser = null;
-        }
-        cache.clear();
-    }
-
-    private static User createUser() {
-        return User.Builder.builder().withUsername(USERNAME).withFirstname("firstname").withLastname("lastname")
-                .withEmail("username@puzzle.ch").build();
-    }
-
-    @Test
-    void emptyUsersCacheShouldClearUserCache() {
-        createdUser = userPersistenceService.getOrCreateUser(createUser());
-        User userBeforeClearCache = cache.get(USERNAME, User.class);
-
-        cacheService.emptyUsersCache();
-
-        User userAfterClearCache = cache.get(USERNAME, User.class);
-        assertNotNull(userBeforeClearCache);
-        assertNull(userAfterClearCache);
-    }
-
-    @Test
-    void emptyAllCachesShouldClearAllCaches() {
-        createdUser = userPersistenceService.getOrCreateUser(createUser());
-        User userBeforeClearCache = cache.get(USERNAME, User.class);
-
-        cacheService.emptyAllCaches();
-
-        User userAfterClearCache = cache.get(USERNAME, User.class);
-        assertNotNull(userBeforeClearCache);
-        assertNull(userAfterClearCache);
-    }
-}
diff --git a/backend/src/test/java/ch/puzzle/okr/service/ClientConfigServiceIT.java b/backend/src/test/java/ch/puzzle/okr/service/ClientConfigServiceIT.java
deleted file mode 100644
index 0f2dfa35ed..0000000000
--- a/backend/src/test/java/ch/puzzle/okr/service/ClientConfigServiceIT.java
+++ /dev/null
@@ -1,32 +0,0 @@
-package ch.puzzle.okr.service;
-
-import ch.puzzle.okr.dto.ClientConfigDto;
-import ch.puzzle.okr.service.clientconfig.ClientConfigService;
-import ch.puzzle.okr.test.SpringIntegrationTest;
-import org.junit.jupiter.api.Test;
-import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.boot.test.context.SpringBootTest;
-
-import static org.junit.jupiter.api.Assertions.assertEquals;
-
-@SpringIntegrationTest
-@SpringBootTest(properties = { "okr.clientcustomization.customstyles.okr-topbar-background-color=#affe00",
-        "okr.clientcustomization.customstyles.okr-other-css-style=rgba(50,60,70,0.5)", })
-class ClientConfigServiceIT {
-
-    @Autowired
-    private ClientConfigService clientConfigService;
-
-    @Test
-    void saveKeyResultShouldSaveNewKeyResult() {
-        ClientConfigDto clientConfig = clientConfigService.getConfigBasedOnActiveEnv();
-
-        assertEquals("prod", clientConfig.activeProfile());
-        assertEquals("http://localhost:8544/realms/pitc", clientConfig.issuer());
-        assertEquals("assets/favicon.png", clientConfig.favicon());
-        assertEquals("assets/images/okr-logo.svg", clientConfig.logo());
-        assertEquals("#affe00", clientConfig.customStyles().get("okr-topbar-background-color"));
-        assertEquals("rgba(50,60,70,0.5)", clientConfig.customStyles().get("okr-other-css-style"));
-    }
-
-}
diff --git a/backend/src/test/java/ch/puzzle/okr/service/authorization/ActionAuthorizationServiceTest.java b/backend/src/test/java/ch/puzzle/okr/service/authorization/ActionAuthorizationServiceTest.java
index 6fcc06296a..7e113dea5d 100644
--- a/backend/src/test/java/ch/puzzle/okr/service/authorization/ActionAuthorizationServiceTest.java
+++ b/backend/src/test/java/ch/puzzle/okr/service/authorization/ActionAuthorizationServiceTest.java
@@ -55,7 +55,7 @@ void getActionsByKeyResultShouldReturnListOfActions(boolean isWriteable) {
 
     @Test
     void createEntityShouldReturnCreatedActionWhenAuthorized() {
-        when(authorizationService.getAuthorizationUser()).thenReturn(authorizationUser);
+        when(authorizationService.updateOrAddAuthorizationUser()).thenReturn(authorizationUser);
 
         action1.setWriteable(false);
         action2.setWriteable(false);
@@ -70,7 +70,7 @@ void createEntityShouldReturnCreatedActionWhenAuthorized() {
     @Test
     void createEntityShouldThrowExceptionWhenNotAuthorized() {
         String reason = "junit test reason";
-        when(authorizationService.getAuthorizationUser()).thenReturn(authorizationUser);
+        when(authorizationService.updateOrAddAuthorizationUser()).thenReturn(authorizationUser);
         doThrow(new ResponseStatusException(HttpStatus.UNAUTHORIZED, reason)).when(authorizationService)
                 .hasRoleCreateOrUpdate(actionList.get(0).getKeyResult(), authorizationUser);
 
@@ -82,7 +82,7 @@ void createEntityShouldThrowExceptionWhenNotAuthorized() {
 
     @Test
     void updateEntitiesShouldUpdateActionWhenAuthorized() {
-        when(authorizationService.getAuthorizationUser()).thenReturn(authorizationUser);
+        when(authorizationService.updateOrAddAuthorizationUser()).thenReturn(authorizationUser);
 
         actionAuthorizationService.updateEntities(actionList);
 
@@ -92,7 +92,7 @@ void updateEntitiesShouldUpdateActionWhenAuthorized() {
     @Test
     void updateEntitiesShouldThrowExceptionWhenNotAuthorized() {
         String reason = "junit test reason";
-        when(authorizationService.getAuthorizationUser()).thenReturn(authorizationUser);
+        when(authorizationService.updateOrAddAuthorizationUser()).thenReturn(authorizationUser);
         doThrow(new ResponseStatusException(HttpStatus.UNAUTHORIZED, reason)).when(authorizationService)
                 .hasRoleCreateOrUpdate(actionList.get(0).getKeyResult(), authorizationUser);
 
@@ -105,7 +105,7 @@ void updateEntitiesShouldThrowExceptionWhenNotAuthorized() {
     @Test
     void deleteEntityByIdShouldPassThroughWhenAuthorized() {
         Long id = 5L;
-        when(authorizationService.getAuthorizationUser()).thenReturn(authorizationUser);
+        when(authorizationService.updateOrAddAuthorizationUser()).thenReturn(authorizationUser);
 
         actionAuthorizationService.deleteActionByActionId(id);
 
@@ -116,7 +116,7 @@ void deleteEntityByIdShouldPassThroughWhenAuthorized() {
     void deleteEntityByIdShouldThrowExceptionWhenNotAuthorized() {
         Long id = 8L;
         String reason = "junit test reason";
-        when(authorizationService.getAuthorizationUser()).thenReturn(authorizationUser);
+        when(authorizationService.updateOrAddAuthorizationUser()).thenReturn(authorizationUser);
         doThrow(new ResponseStatusException(HttpStatus.UNAUTHORIZED, reason)).when(authorizationService)
                 .hasRoleDeleteByActionId(id, authorizationUser);
 
diff --git a/backend/src/test/java/ch/puzzle/okr/service/authorization/AuthorizationRegistrationServiceIT.java b/backend/src/test/java/ch/puzzle/okr/service/authorization/AuthorizationRegistrationServiceIT.java
index 827b604674..8ebcaa9351 100644
--- a/backend/src/test/java/ch/puzzle/okr/service/authorization/AuthorizationRegistrationServiceIT.java
+++ b/backend/src/test/java/ch/puzzle/okr/service/authorization/AuthorizationRegistrationServiceIT.java
@@ -1,27 +1,24 @@
 package ch.puzzle.okr.service.authorization;
 
+import ch.puzzle.okr.test.TestHelper;
 import ch.puzzle.okr.models.User;
-import ch.puzzle.okr.models.authorization.AuthorizationRole;
 import ch.puzzle.okr.models.authorization.AuthorizationUser;
+import ch.puzzle.okr.multitenancy.TenantContext;
 import ch.puzzle.okr.service.persistence.UserPersistenceService;
 import ch.puzzle.okr.test.SpringIntegrationTest;
 import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.DisplayName;
 import org.junit.jupiter.api.Test;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.cache.Cache;
 import org.springframework.cache.CacheManager;
-import org.springframework.security.oauth2.jwt.Jwt;
 
-import java.util.List;
+import java.util.Optional;
 
 import static ch.puzzle.okr.SpringCachingConfig.AUTHORIZATION_USER_CACHE;
-import static ch.puzzle.okr.SpringCachingConfig.USER_CACHE;
-import static ch.puzzle.okr.test.TestConstants.*;
 import static ch.puzzle.okr.test.TestHelper.defaultUser;
-import static ch.puzzle.okr.test.TestHelper.mockJwtToken;
-import static ch.puzzle.okr.models.authorization.AuthorizationRole.*;
-import static org.assertj.core.api.Assertions.assertThat;
-import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.*;
 
 @SpringIntegrationTest
 class AuthorizationRegistrationServiceIT {
@@ -34,73 +31,117 @@ class AuthorizationRegistrationServiceIT {
 
     private final User user = defaultUser(null);
 
-    @AfterEach
-    void tearDown() {
-        Cache cache = cacheManager.getCache(USER_CACHE);
-        assertNotNull(cache);
+    private final String tenant = TestHelper.SCHEMA_PITC;
+    private final String key = tenant + "_" + user.getEmail();
 
-        User cachedUser = cache.get(user.getUsername(), User.class);
-        if (cachedUser != null) {
-            userPersistenceService.deleteById(cachedUser.getId());
-        }
-
-        cache.clear();
+    @BeforeEach
+    void setUp() {
+        TenantContext.setCurrentTenant(tenant);
+    }
 
-        cache = cacheManager.getCache(AUTHORIZATION_USER_CACHE);
+    @AfterEach
+    void tearDown() {
+        Cache cache = cacheManager.getCache(AUTHORIZATION_USER_CACHE);
         assertNotNull(cache);
         cache.clear();
+        TenantContext.setCurrentTenant(null);
     }
 
     @Test
     void registerAuthorizationUserShouldAddAuthorizationUserToCache() {
-        Jwt token = mockJwtToken(user, List.of(ORGANISATION_FIRST_LEVEL));
-        authorizationRegistrationService.registerAuthorizationUser(user, token);
-
+        // arrange
         Cache cache = cacheManager.getCache(AUTHORIZATION_USER_CACHE);
-        assertNotNull(cache);
-        assertNotNull(cache.get(user.getUsername(), AuthorizationUser.class));
 
-        cache = cacheManager.getCache(USER_CACHE);
-        assertNotNull(cache);
-        assertNotNull(cache.get(user.getUsername(), User.class));
-    }
+        // act
+        authorizationRegistrationService.updateOrAddAuthorizationUser(user);
 
-    @Test
-    void registerAuthorizationUserShouldSetFirstLeveOrganisations() {
-        Jwt token = mockJwtToken(user, List.of(ORGANISATION_FIRST_LEVEL, ORGANISATION_SECOND_LEVEL));
-        AuthorizationUser authorizationUser = authorizationRegistrationService.registerAuthorizationUser(user, token);
+        // assert
+        assertNotNull(cache);
+        assertNotNull(cache.get(key, AuthorizationUser.class));
 
-        assertRoles(List.of(READ_ALL_DRAFT, READ_ALL_PUBLISHED, WRITE_ALL), authorizationUser);
+        // cleanup
+        userPersistenceService.deleteById(user.getId());
     }
 
+    @DisplayName("registerAuthorizationUser for a user with an email not defined in the application-integration-test.properties should set OkrChampions to false")
     @Test
-    void registerAuthorizationUserShouldSetSecondLevelOrganisations() {
-        Jwt token = mockJwtToken(user, List.of(ORGANISATION_SECOND_LEVEL, ORGANISATION_TEAM));
-        AuthorizationUser authorizationUser = authorizationRegistrationService.registerAuthorizationUser(user, token);
-
-        assertRoles(List.of(READ_TEAMS_DRAFT, READ_ALL_PUBLISHED, WRITE_ALL_TEAMS), authorizationUser);
+    void registerAuthorizationUser_shouldSetOkrChampionsToFalse() {
+        // arrange
+        User user = User.Builder.builder() //
+                .withFirstname("Richard") //
+                .withLastname("Eberhard") //
+                .withEmail("richard.eberhard@puzzle.ch") // email not found in application-integration-test.properties
+                .build();
+
+        userPersistenceService.getOrCreateUser(user); // updates input user with id from DB !!!
+
+        // act
+        AuthorizationUser processedUser = authorizationRegistrationService.updateOrAddAuthorizationUser(user);
+
+        // assert
+        assertFalse(processedUser.user().isOkrChampion());
+        Optional<User> userFromDB = userPersistenceService.findByEmail(user.getEmail());
+        assertFalse(userFromDB.get().isOkrChampion());
+
+        // cleanup
+        userPersistenceService.deleteById(userFromDB.get().getId());
     }
 
+    /*
+     * Special test setup. <pre> - the user wunderland@puzzle.ch is an existing user in the H2 db (created via
+     * X_TestData.sql) - the user wunderland@puzzle.ch is also defined in application-integration-test.properties as
+     * user champion - with this combination we can test, that the user in the db (which has initial isOkrChampion ==
+     * false) is after calling updateOrAddAuthorizationUser() a user champion. - because the user wunderland@puzzle.ch
+     * exists before the test, we make no clean in db (we don't remove it) </pre>
+     */
     @Test
-    void registerAuthorizationUserShouldSetTeamOrganisations() {
-        Jwt token = mockJwtToken(user, List.of(ORGANISATION_TEAM));
-        AuthorizationUser authorizationUser = authorizationRegistrationService.registerAuthorizationUser(user, token);
-
-        assertRoles(List.of(READ_TEAM_DRAFT, READ_ALL_PUBLISHED, WRITE_TEAM), authorizationUser);
+    @DisplayName("registerAuthorizationUser for a user with an email defined in the application-integration-test.properties should set OkrChampions to true")
+    void registerAuthorizationUserShouldSetOkrChampionsToTrue() {
+        // arrange
+        User user = User.Builder.builder() //
+                .withFirstname("Alice") //
+                .withLastname("Wunderland") //
+                .withEmail("wunderland@puzzle.ch") // user.champion.emails from application-integration-test.properties
+                .build();
+
+        userPersistenceService.getOrCreateUser(user); // updates input user with id from DB !!!
+
+        // act
+        AuthorizationUser processedUser = authorizationRegistrationService.updateOrAddAuthorizationUser(user);
+
+        // assert
+        assertTrue(processedUser.user().isOkrChampion());
+        Optional<User> userFromDB = userPersistenceService.findByEmail(user.getEmail());
+        assertTrue(userFromDB.get().isOkrChampion());
     }
 
     @Test
-    void registerAuthorizationUserShouldSetChampions() {
-        User testUser = User.Builder.builder().withFirstname("firstname").withLastname("lastname")
-                .withUsername("peggimann").withEmail("mail@puzzle.ch").build();
-        Jwt token = mockJwtToken(testUser, List.of(ORGANISATION_FIRST_LEVEL, ORGANISATION_SECOND_LEVEL));
-        AuthorizationUser authorizationUser = authorizationRegistrationService.registerAuthorizationUser(testUser,
-                token);
-
-        assertRoles(List.of(READ_ALL_DRAFT, READ_ALL_PUBLISHED, WRITE_ALL), authorizationUser);
-    }
-
-    private static void assertRoles(List<AuthorizationRole> roles, AuthorizationUser authorizationUser) {
-        assertThat(roles).hasSameElementsAs(authorizationUser.roles());
+    void registerAuthorizationUser_shouldSetFirstnameAndLastnameFromToken() {
+        // arrange
+        User user = User.Builder.builder() //
+                .withFirstname("Richard") //
+                .withLastname("Eberhard") //
+                .withEmail("richard.eberhard@puzzle.ch") //
+                .build();
+        userPersistenceService.save(user);
+
+        String firstNameFromToken = "Richu";
+        String lastNameFromToken = "von Gunten";
+        User userFromToken = User.Builder.builder() //
+                .withFirstname(firstNameFromToken) //
+                .withLastname(lastNameFromToken) //
+                .withEmail("richard.eberhard@puzzle.ch") //
+                .build();
+
+        // act
+        authorizationRegistrationService.updateOrAddAuthorizationUser(userFromToken);
+
+        // assert
+        Optional<User> userFromDB = userPersistenceService.findByEmail(user.getEmail());
+        assertEquals(userFromDB.get().getFirstname(), firstNameFromToken);
+        assertEquals(userFromDB.get().getLastname(), lastNameFromToken);
+
+        // cleanup
+        userPersistenceService.deleteById(userFromDB.get().getId());
     }
 }
diff --git a/backend/src/test/java/ch/puzzle/okr/service/authorization/AuthorizationServiceTest.java b/backend/src/test/java/ch/puzzle/okr/service/authorization/AuthorizationServiceTest.java
index 6a8a41d2b2..eb4e88823f 100644
--- a/backend/src/test/java/ch/puzzle/okr/service/authorization/AuthorizationServiceTest.java
+++ b/backend/src/test/java/ch/puzzle/okr/service/authorization/AuthorizationServiceTest.java
@@ -1,11 +1,8 @@
 package ch.puzzle.okr.service.authorization;
 
 import ch.puzzle.okr.test.TestHelper;
-import ch.puzzle.okr.converter.JwtConverterFactory;
-import ch.puzzle.okr.converter.JwtUserConverter;
 import ch.puzzle.okr.dto.ErrorDto;
 import ch.puzzle.okr.exception.OkrResponseStatusException;
-import ch.puzzle.okr.models.Action;
 import ch.puzzle.okr.models.Objective;
 import ch.puzzle.okr.models.Team;
 import ch.puzzle.okr.models.User;
@@ -14,10 +11,8 @@
 import ch.puzzle.okr.models.checkin.CheckInMetric;
 import ch.puzzle.okr.models.keyresult.KeyResult;
 import ch.puzzle.okr.models.keyresult.KeyResultMetric;
-import ch.puzzle.okr.models.keyresult.KeyResultOrdinal;
-import ch.puzzle.okr.service.persistence.ActionPersistenceService;
+import ch.puzzle.okr.security.JwtHelper;
 import ch.puzzle.okr.service.persistence.ObjectivePersistenceService;
-import org.junit.jupiter.api.DisplayName;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.extension.ExtendWith;
 import org.mockito.InjectMocks;
@@ -33,10 +28,9 @@
 import java.util.List;
 
 import static ch.puzzle.okr.ErrorKey.*;
-import static ch.puzzle.okr.test.TestConstants.ORGANISATION_FIRST_LEVEL;
 import static ch.puzzle.okr.test.TestHelper.*;
-import static ch.puzzle.okr.models.authorization.AuthorizationRole.*;
-import static ch.puzzle.okr.service.authorization.AuthorizationService.*;
+import static ch.puzzle.okr.service.authorization.AuthorizationService.hasRoleWriteAndReadAll;
+import static ch.puzzle.okr.service.authorization.AuthorizationService.hasRoleWriteForTeam;
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.junit.jupiter.api.Assertions.*;
 import static org.mockito.ArgumentMatchers.any;
@@ -53,116 +47,65 @@ class AuthorizationServiceTest {
     @Mock
     ObjectivePersistenceService objectivePersistenceService;
     @Mock
-    ActionPersistenceService actionPersistenceService;
-    @Mock
-    JwtConverterFactory jwtConverterFactory;
-    @Mock
-    JwtUserConverter jwtUserConverter;
-
-    private final User user = defaultUser(null);
-
-    @Test
-    void hasRoleReadTeamsDraftShouldReturnTrueWhenContainsRole() {
-        AuthorizationUser authorizationUser = mockAuthorizationUser(user, List.of(1L), 5L, List.of(READ_TEAMS_DRAFT));
-        assertTrue(hasRoleReadTeamsDraft(authorizationUser));
-    }
-
-    @Test
-    void hasRoleReadTeamsDraftShouldReturnFalseWhenDoesNotContainsRole() {
-        AuthorizationUser authorizationUser = mockAuthorizationUser(user, List.of(1L), 5L, List.of(READ_TEAM_DRAFT));
-        assertFalse(hasRoleReadTeamsDraft(authorizationUser));
-    }
-
-    @Test
-    void hasRoleReadTeamDraftShouldReturnTrueWhenContainsRole() {
-        AuthorizationUser authorizationUser = mockAuthorizationUser(user, List.of(1L), 5L, List.of(READ_TEAM_DRAFT));
-        assertTrue(hasRoleReadTeamDraft(authorizationUser));
-    }
-
-    @Test
-    void hasRoleReadTeamDraftShouldReturnFalseWhenDoesNotContainsRole() {
-        AuthorizationUser authorizationUser = mockAuthorizationUser(user, List.of(1L), 5L, List.of(READ_ALL_PUBLISHED));
-        assertFalse(hasRoleReadTeamDraft(authorizationUser));
-    }
-
-    @Test
-    void hasRoleReadAllPublishedShouldReturnTrueWhenContainsRole() {
-        AuthorizationUser authorizationUser = mockAuthorizationUser(user, List.of(1L), 5L, List.of(READ_ALL_PUBLISHED));
-        assertTrue(hasRoleReadAllPublished(authorizationUser));
-    }
-
-    @Test
-    void hasRoleReadAllPublishedShouldReturnFalseWhenDoesNotContainsRole() {
-        AuthorizationUser authorizationUser = mockAuthorizationUser(user, List.of(1L), 5L, List.of());
-        assertFalse(hasRoleReadAllPublished(authorizationUser));
-    }
+    JwtHelper jwtHelper;
 
-    @Test
-    void hasRoleReadAllDraftShouldReturnTrueWhenContainsRole() {
-        AuthorizationUser authorizationUser = mockAuthorizationUser(user, List.of(1L), 5L, List.of(READ_ALL_DRAFT));
-        assertTrue(hasRoleReadAllDraft(authorizationUser));
-    }
+    private final List<Team> adminTeams = List.of(Team.Builder.builder().withName("Team 1").withId(1L).build(),
+            Team.Builder.builder().withName("Team 2").withId(2L).build());
+    private final List<Team> memberTeams = List.of(Team.Builder.builder().withName("Team 3").withId(3L).build(),
+            Team.Builder.builder().withName("Team 4").withId(4L).build());
+    private final List<Team> otherTeams = List.of(Team.Builder.builder().withName("Team 5").withId(5L).build(),
+            Team.Builder.builder().withName("Team 6").withId(6L).build());
 
-    @Test
-    void hasRoleReadAllDraftShouldReturnFalseWhenDoesNotContainsRole() {
-        AuthorizationUser authorizationUser = mockAuthorizationUser(user, List.of(1L), 5L, List.of());
-        assertFalse(hasRoleReadAllDraft(authorizationUser));
-    }
+    private final User user = defaultUserWithTeams(1L, adminTeams, memberTeams);
+    private final User okrUser = defaultOkrChampion(1L);
 
     @Test
     void hasRoleWriteAllShouldReturnTrueWhenContainsRole() {
-        AuthorizationUser authorizationUser = mockAuthorizationUser(user, List.of(1L), 5L, List.of(WRITE_ALL));
-        assertTrue(hasRoleWriteAll(authorizationUser));
+        AuthorizationUser authorizationUser = new AuthorizationUser(okrUser);
+        assertTrue(hasRoleWriteAndReadAll(authorizationUser));
     }
 
     @Test
     void hasRoleWriteAllShouldReturnFalseWhenDoesNotContainsRole() {
-        AuthorizationUser authorizationUser = mockAuthorizationUser(user, List.of(1L), 5L, List.of(WRITE_ALL_TEAMS));
-        assertFalse(hasRoleWriteAll(authorizationUser));
+        AuthorizationUser authorizationUser = new AuthorizationUser(user);
+        assertFalse(hasRoleWriteAndReadAll(authorizationUser));
     }
 
     @Test
-    void hasRoleWriteAllTeamsShouldReturnTrueWhenContainsRole() {
-        AuthorizationUser authorizationUser = mockAuthorizationUser(user, List.of(1L), 5L, List.of(WRITE_ALL_TEAMS));
-        assertTrue(hasRoleWriteAllTeams(authorizationUser));
+    void hasRoleWriteForTeam_shouldReturnTrueWhenOkrChampion() {
+        AuthorizationUser authorizationUser = new AuthorizationUser(okrUser);
+        assertTrue(hasRoleWriteForTeam(authorizationUser, 3L));
     }
 
     @Test
-    void hasRoleWriteAllTeamsShouldReturnFalseWhenDoesNotContainsRole() {
-        AuthorizationUser authorizationUser = mockAuthorizationUser(user, List.of(1L), 5L, List.of(WRITE_TEAM));
-        assertFalse(hasRoleWriteAllTeams(authorizationUser));
+    void hasRoleWriteForTeam_shouldReturnTrueWhenUserIsAdmin() {
+        AuthorizationUser authorizationUser = new AuthorizationUser(user);
+        assertTrue(hasRoleWriteForTeam(authorizationUser, 1L));
     }
 
     @Test
-    void hasRoleWriteTeamShouldReturnTrueWhenContainsRole() {
-        AuthorizationUser authorizationUser = mockAuthorizationUser(user, List.of(1L), 5L, List.of(WRITE_TEAM));
-        assertTrue(hasRoleWriteTeam(authorizationUser));
-    }
-
-    @Test
-    void hasRoleWriteTeamShouldReturnFalseWhenDoesNotContainsRole() {
-        AuthorizationUser authorizationUser = mockAuthorizationUser(user, List.of(1L), 5L, List.of());
-        assertFalse(hasRoleWriteTeam(authorizationUser));
+    void hasRoleWriteForTeam_shouldReturnFalseWhenUserIsNotAdmin() {
+        AuthorizationUser authorizationUser = new AuthorizationUser(user);
+        assertFalse(hasRoleWriteForTeam(authorizationUser, 3L));
     }
 
     @Test
     void getAuthorizationUserShouldReturnAuthorizationUser() {
         User user = defaultUser(null);
-        Jwt token = mockJwtToken(user, List.of(ORGANISATION_FIRST_LEVEL));
+        Jwt token = mockJwtToken(user);
         AuthorizationUser authorizationUser = defaultAuthorizationUser();
         setSecurityContext(token);
 
-        when(jwtConverterFactory.getJwtUserConverter()).thenReturn(jwtUserConverter);
-        when(jwtUserConverter.convert(token)).thenReturn(user);
-        when(authorizationRegistrationService.registerAuthorizationUser(user, token)).thenReturn(authorizationUser);
+        when(jwtHelper.getUserFromJwt(any(Jwt.class))).thenReturn(user);
+        when(authorizationRegistrationService.updateOrAddAuthorizationUser(user)).thenReturn(authorizationUser);
 
-        assertNotNull(authorizationService.getAuthorizationUser());
+        assertNotNull(authorizationService.updateOrAddAuthorizationUser());
     }
 
     @Test
     void hasRoleReadByObjectiveIdShouldPassThroughWhenPermitted() {
         Long id = 13L;
-        AuthorizationUser authorizationUser = defaultAuthorizationUser();
+        AuthorizationUser authorizationUser = new AuthorizationUser(user);
         when(objectivePersistenceService.findObjectiveById(eq(id), eq(authorizationUser), any()))
                 .thenReturn(new Objective());
 
@@ -172,7 +115,7 @@ void hasRoleReadByObjectiveIdShouldPassThroughWhenPermitted() {
     @Test
     void hasRoleReadByKeyResultIdShouldThrowExceptionWhenObjectiveNotFound() {
         Long id = 13L;
-        AuthorizationUser authorizationUser = defaultAuthorizationUser();
+        AuthorizationUser authorizationUser = new AuthorizationUser(user);
         OkrResponseStatusException expectedException = OkrResponseStatusException.of(NOT_AUTHORIZED_TO_READ,
                 "KeyResult");
 
@@ -192,7 +135,7 @@ void hasRoleReadByKeyResultIdShouldThrowExceptionWhenObjectiveNotFound() {
     @Test
     void hasRoleReadByKeyResultIdShouldPassThroughWhenPermitted() {
         Long id = 13L;
-        AuthorizationUser authorizationUser = defaultAuthorizationUser();
+        AuthorizationUser authorizationUser = new AuthorizationUser(user);
         OkrResponseStatusException expectedException = OkrResponseStatusException.of(NOT_AUTHORIZED_TO_READ,
                 "KeyResult");
         when(objectivePersistenceService.findObjectiveByKeyResultId(eq(id), eq(authorizationUser), any()))
@@ -204,7 +147,7 @@ void hasRoleReadByKeyResultIdShouldPassThroughWhenPermitted() {
     @Test
     void hasRoleReadByCheckInIdShouldThrowExceptionWhenObjectiveNotFound() {
         Long id = 13L;
-        AuthorizationUser authorizationUser = defaultAuthorizationUser();
+        AuthorizationUser authorizationUser = new AuthorizationUser(user);
 
         OkrResponseStatusException expectedException = OkrResponseStatusException.of(NOT_AUTHORIZED_TO_READ,
                 "Check-in");
@@ -224,7 +167,7 @@ void hasRoleReadByCheckInIdShouldThrowExceptionWhenObjectiveNotFound() {
     @Test
     void hasRoleReadByCheckInIdShouldPassThroughWhenPermitted() {
         Long id = 13L;
-        AuthorizationUser authorizationUser = defaultAuthorizationUser();
+        AuthorizationUser authorizationUser = new AuthorizationUser(user);
         OkrResponseStatusException expectedException = OkrResponseStatusException.of(NOT_AUTHORIZED_TO_READ,
                 "Check-in");
 
@@ -237,17 +180,32 @@ void hasRoleReadByCheckInIdShouldPassThroughWhenPermitted() {
     @Test
     void hasRoleCreateOrUpdateShouldPassThroughWhenAuthorizedForAllObjectives() {
         Objective objective = Objective.Builder.builder().withTeam(Team.Builder.builder().withId(5L).build()).build();
-        AuthorizationUser authorizationUser = defaultAuthorizationUser();
+        AuthorizationUser authorizationUser = new AuthorizationUser(okrUser);
 
         authorizationService.hasRoleCreateOrUpdate(objective, authorizationUser);
     }
 
     @Test
-    void hasRoleCreateOrUpdateShouldPassThroughWhenAuthorizedForAllTeamsKeyResults() {
+    void hasRoleCreateOrUpdateShouldThrowExceptionWhenMember() {
+        var id = memberTeams.get(0).getId();
+        Objective objective = Objective.Builder.builder().withTeam(Team.Builder.builder().withId(id).build()).build();
+        AuthorizationUser authorizationUser = new AuthorizationUser(user);
+
+        OkrResponseStatusException exception = assertThrows(OkrResponseStatusException.class,
+                () -> authorizationService.hasRoleCreateOrUpdate(objective, authorizationUser));
+
+        List<ErrorDto> expectedErrors = List.of(ErrorDto.of(NOT_AUTHORIZED_TO_WRITE, "Objective"));
+
+        assertEquals(UNAUTHORIZED, exception.getStatusCode());
+        assertThat(expectedErrors).hasSameElementsAs(exception.getErrors());
+        assertTrue(TestHelper.getAllErrorKeys(expectedErrors).contains(exception.getReason()));
+    }
+
+    @Test
+    void hasRoleCreateOrUpdateShouldPassThroughWhenAuthorizedForKeyResults() {
         Objective objective = Objective.Builder.builder().withTeam(Team.Builder.builder().withId(1L).build()).build();
         KeyResult keyResult = KeyResultMetric.Builder.builder().withObjective(objective).build();
-        AuthorizationUser authorizationUser = mockAuthorizationUser(defaultUser(null), List.of(1L), 5L,
-                List.of(WRITE_ALL_TEAMS));
+        AuthorizationUser authorizationUser = new AuthorizationUser(okrUser);
 
         when(objectivePersistenceService.findObjectiveById(eq(keyResult.getObjective().getId()), eq(authorizationUser),
                 any())).thenReturn(objective);
@@ -256,29 +214,32 @@ void hasRoleCreateOrUpdateShouldPassThroughWhenAuthorizedForAllTeamsKeyResults()
     }
 
     @Test
-    void hasRoleCreateOrUpdateShouldPassThroughWhenAuthorizedForTeamCheckIns() {
-        Objective objective = Objective.Builder.builder().withTeam(Team.Builder.builder().withId(1L).build()).build();
+    void hasRoleCreateOrUpdateShouldPassThroughWhenAuthorizedAsAdminForKeyResults() {
+        var id = adminTeams.get(0).getId();
+        Objective objective = Objective.Builder.builder().withTeam(Team.Builder.builder().withId(id).build()).build();
         KeyResult keyResult = KeyResultMetric.Builder.builder().withObjective(objective).build();
-        CheckIn checkIn = CheckInMetric.Builder.builder().withKeyResult(keyResult).build();
-        AuthorizationUser authorizationUser = mockAuthorizationUser(defaultUser(null), List.of(1L), 5L,
-                List.of(WRITE_TEAM));
+        AuthorizationUser authorizationUser = new AuthorizationUser(user);
 
-        when(objectivePersistenceService.findObjectiveByKeyResultId(eq(checkIn.getKeyResult().getObjective().getId()),
-                eq(authorizationUser), any())).thenReturn(objective);
+        when(objectivePersistenceService.findObjectiveById(eq(keyResult.getObjective().getId()), eq(authorizationUser),
+                any())).thenReturn(objective);
 
-        authorizationService.hasRoleCreateOrUpdate(checkIn, authorizationUser);
+        authorizationService.hasRoleCreateOrUpdate(keyResult, authorizationUser);
     }
 
     @Test
-    void hasRoleCreateOrUpdateShouldThrowExceptionWhenNotAuthorizedForFirstLevelObjectives() {
-        Objective objective = Objective.Builder.builder().withTeam(Team.Builder.builder().withId(5L).build()).build();
-        AuthorizationUser authorizationUser = mockAuthorizationUser(defaultUser(null), List.of(1L), 5L,
-                List.of(WRITE_ALL_TEAMS));
+    void hasRoleCreateOrUpdateShouldThorwExceptionWhenNotAuthorizedForKeyResults() {
+        var id = otherTeams.get(0).getId();
+        Objective objective = Objective.Builder.builder().withTeam(Team.Builder.builder().withId(id).build()).build();
+        KeyResult keyResult = KeyResultMetric.Builder.builder().withObjective(objective).build();
+        AuthorizationUser authorizationUser = new AuthorizationUser(user);
+
+        when(objectivePersistenceService.findObjectiveById(eq(keyResult.getObjective().getId()), eq(authorizationUser),
+                any())).thenReturn(objective);
 
         OkrResponseStatusException exception = assertThrows(OkrResponseStatusException.class,
-                () -> authorizationService.hasRoleCreateOrUpdate(objective, authorizationUser));
+                () -> authorizationService.hasRoleCreateOrUpdate(keyResult, authorizationUser));
 
-        List<ErrorDto> expectedErrors = List.of(ErrorDto.of(NOT_AUTHORIZED_TO_WRITE, "Objective"));
+        List<ErrorDto> expectedErrors = List.of(ErrorDto.of(NOT_AUTHORIZED_TO_WRITE, "KeyResult"));
 
         assertEquals(UNAUTHORIZED, exception.getStatusCode());
         assertThat(expectedErrors).hasSameElementsAs(exception.getErrors());
@@ -286,15 +247,34 @@ void hasRoleCreateOrUpdateShouldThrowExceptionWhenNotAuthorizedForFirstLevelObje
     }
 
     @Test
-    void hasRoleCreateOrUpdateShouldThrowExceptionWhenNotAuthorizedForOtherTeamObjectives() {
-        Objective objective = Objective.Builder.builder().withTeam(Team.Builder.builder().withId(5L).build()).build();
-        AuthorizationUser authorizationUser = mockAuthorizationUser(defaultUser(null), List.of(1L), 5L,
-                List.of(WRITE_TEAM));
+    void hasRoleCreateOrUpdateShouldPassThroughWhenAuthorizedAsAdminForTeamCheckIns() {
+        var id = adminTeams.get(0).getId();
+        Objective objective = Objective.Builder.builder().withTeam(Team.Builder.builder().withId(id).build()).build();
+        KeyResult keyResult = KeyResultMetric.Builder.builder().withObjective(objective).build();
+        CheckIn checkIn = CheckInMetric.Builder.builder().withKeyResult(keyResult).build();
+        AuthorizationUser authorizationUser = new AuthorizationUser(user);
+
+        when(objectivePersistenceService.findObjectiveByKeyResultId(eq(checkIn.getKeyResult().getObjective().getId()),
+                eq(authorizationUser), any())).thenReturn(objective);
+
+        authorizationService.hasRoleCreateOrUpdate(checkIn, authorizationUser);
+    }
+
+    @Test
+    void hasRoleCreateOrUpdateShouldThrowExceptionWhenMemberForTeamCheckIns() {
+        var id = memberTeams.get(0).getId();
+        Objective objective = Objective.Builder.builder().withTeam(Team.Builder.builder().withId(id).build()).build();
+        KeyResult keyResult = KeyResultMetric.Builder.builder().withObjective(objective).build();
+        CheckIn checkIn = CheckInMetric.Builder.builder().withKeyResult(keyResult).build();
+        AuthorizationUser authorizationUser = new AuthorizationUser(user);
+
+        when(objectivePersistenceService.findObjectiveByKeyResultId(eq(checkIn.getKeyResult().getObjective().getId()),
+                eq(authorizationUser), any())).thenReturn(objective);
 
         OkrResponseStatusException exception = assertThrows(OkrResponseStatusException.class,
-                () -> authorizationService.hasRoleCreateOrUpdate(objective, authorizationUser));
+                () -> authorizationService.hasRoleCreateOrUpdate(checkIn, authorizationUser));
 
-        List<ErrorDto> expectedErrors = List.of(ErrorDto.of(NOT_AUTHORIZED_TO_WRITE, "Objective"));
+        List<ErrorDto> expectedErrors = List.of(ErrorDto.of(NOT_AUTHORIZED_TO_WRITE, "Check-in"));
 
         assertEquals(UNAUTHORIZED, exception.getStatusCode());
         assertThat(expectedErrors).hasSameElementsAs(exception.getErrors());
@@ -305,7 +285,7 @@ void hasRoleCreateOrUpdateShouldThrowExceptionWhenNotAuthorizedForOtherTeamObjec
     void hasRoleCreateOrUpdateByObjectiveIdShouldPassThroughWhenAuthorizedForAllObjectives() {
         Long id = 13L;
         Objective objective = Objective.Builder.builder().withTeam(Team.Builder.builder().withId(5L).build()).build();
-        AuthorizationUser authorizationUser = defaultAuthorizationUser();
+        AuthorizationUser authorizationUser = new AuthorizationUser(okrUser);
 
         when(objectivePersistenceService.findObjectiveById(eq(id), eq(authorizationUser), any())).thenReturn(objective);
 
@@ -313,76 +293,143 @@ void hasRoleCreateOrUpdateByObjectiveIdShouldPassThroughWhenAuthorizedForAllObje
     }
 
     @Test
-    void isWriteableShouldReturnTrueWhenAuthorizedToWriteAllObjectives() {
-        Objective objective = Objective.Builder.builder().withTeam(Team.Builder.builder().withId(5L).build()).build();
-        AuthorizationUser authorizationUser = defaultAuthorizationUser();
+    void hasRoleCreateOrUpdateByObjectiveIdShouldPassThroughWhenAuthorizedAsAdmin() {
+        var id = adminTeams.get(0).getId();
+        Objective objective = Objective.Builder.builder().withTeam(Team.Builder.builder().withId(id).build()).build();
+        AuthorizationUser authorizationUser = new AuthorizationUser(user);
+
+        when(objectivePersistenceService.findObjectiveById(eq(id), eq(authorizationUser), any())).thenReturn(objective);
+
+        authorizationService.hasRoleCreateOrUpdateByObjectiveId(id, authorizationUser);
+    }
+
+    @Test
+    void hasRoleCreateOrUpdateByObjectiveIdShouldThrowExceptionWhenAuthorizedAsMember() {
+        var id = memberTeams.get(0).getId();
+        Objective objective = Objective.Builder.builder().withTeam(Team.Builder.builder().withId(id).build()).build();
+        AuthorizationUser authorizationUser = new AuthorizationUser(user);
+
+        when(objectivePersistenceService.findObjectiveById(eq(id), eq(authorizationUser), any())).thenReturn(objective);
+
+        OkrResponseStatusException exception = assertThrows(OkrResponseStatusException.class,
+                () -> authorizationService.hasRoleCreateOrUpdateByObjectiveId(id, authorizationUser));
+
+        List<ErrorDto> expectedErrors = List.of(ErrorDto.of(NOT_AUTHORIZED_TO_WRITE, "Objective"));
+
+        assertEquals(UNAUTHORIZED, exception.getStatusCode());
+        assertThat(expectedErrors).hasSameElementsAs(exception.getErrors());
+        assertTrue(TestHelper.getAllErrorKeys(expectedErrors).contains(exception.getReason()));
 
-        assertTrue(authorizationService.isWriteable(objective, authorizationUser));
     }
 
     @Test
-    void isWriteableShouldReturnFalseWhenNotAuthorizedToWriteObjectives() {
+    void hasRoleWriteForTeamShouldReturnTrueWhenAuthorizedToWriteAllObjectives() {
         Objective objective = Objective.Builder.builder().withTeam(Team.Builder.builder().withId(5L).build()).build();
-        AuthorizationUser authorizationUser = mockAuthorizationUser(user, List.of(4L), 13L, List.of(WRITE_TEAM));
+        AuthorizationUser authorizationUser = new AuthorizationUser(okrUser);
+
+        assertTrue(authorizationService.hasRoleWriteForTeam(objective, authorizationUser));
+    }
+
+    @Test
+    void hasRoleWriteForTeamShouldReturnTrueWhenAuthorizedAsAdmin() {
+        var id = adminTeams.get(0).getId();
+        Objective objective = Objective.Builder.builder().withTeam(Team.Builder.builder().withId(id).build()).build();
+        AuthorizationUser authorizationUser = new AuthorizationUser(user);
 
-        assertFalse(authorizationService.isWriteable(objective, authorizationUser));
+        assertTrue(authorizationService.hasRoleWriteForTeam(objective, authorizationUser));
     }
 
     @Test
-    void isWriteableShouldReturnTrueWhenAuthorizedToWriteAllKeyResults() {
+    void hasRoleWriteForTeamShouldReturnFalseWhenAuthorizedAsMember() {
+        var id = memberTeams.get(0).getId();
+        Objective objective = Objective.Builder.builder().withTeam(Team.Builder.builder().withId(id).build()).build();
+        AuthorizationUser authorizationUser = new AuthorizationUser(user);
+
+        assertFalse(authorizationService.hasRoleWriteForTeam(objective, authorizationUser));
+    }
+
+    @Test
+    void hasRoleWriteForTeamShouldReturnTrueWhenAuthorizedToWriteAllKeyResults() {
         Objective objective = Objective.Builder.builder().withTeam(Team.Builder.builder().withId(4L).build()).build();
         KeyResult keyResult = KeyResultMetric.Builder.builder().withObjective(objective).build();
-        AuthorizationUser authorizationUser = defaultAuthorizationUser();
+        AuthorizationUser authorizationUser = new AuthorizationUser(okrUser);
 
         when(objectivePersistenceService.findObjectiveById(eq(keyResult.getObjective().getId()), eq(authorizationUser),
                 any())).thenReturn(objective);
 
-        assertTrue(authorizationService.isWriteable(keyResult, authorizationUser));
+        assertTrue(authorizationService.hasRoleWriteForTeam(keyResult, authorizationUser));
     }
 
     @Test
-    void isWriteableShouldReturnFalseWhenNotAuthorizedToWriteKeyResults() {
+    void hasRoleWriteForTeamShouldReturnTrueWhenAuthorizedAsAdminForKeyResults() {
+        var id = adminTeams.get(0).getId();
+        Objective objective = Objective.Builder.builder().withTeam(Team.Builder.builder().withId(id).build()).build();
+        KeyResult keyResult = KeyResultMetric.Builder.builder().withObjective(objective).build();
+        AuthorizationUser authorizationUser = new AuthorizationUser(user);
+
+        when(objectivePersistenceService.findObjectiveById(eq(keyResult.getObjective().getId()), eq(authorizationUser),
+                any())).thenReturn(objective);
+
+        assertTrue(authorizationService.hasRoleWriteForTeam(keyResult, authorizationUser));
+    }
+
+    @Test
+    void hasRoleWriteForTeamShouldReturnFalseWhenNotAuthorizedToWriteKeyResults() {
         Objective objective = Objective.Builder.builder().withTeam(Team.Builder.builder().withId(5L).build()).build();
         KeyResult keyResult = KeyResultMetric.Builder.builder().withObjective(objective).build();
-        AuthorizationUser authorizationUser = mockAuthorizationUser(user, List.of(4L), 13L, List.of(WRITE_TEAM));
+        AuthorizationUser authorizationUser = mockAuthorizationUser(user);
 
         when(objectivePersistenceService.findObjectiveById(eq(keyResult.getObjective().getId()), eq(authorizationUser),
                 any())).thenReturn(objective);
 
-        assertFalse(authorizationService.isWriteable(keyResult, authorizationUser));
+        assertFalse(authorizationService.hasRoleWriteForTeam(keyResult, authorizationUser));
     }
 
     @Test
-    void isWriteableShouldReturnTrueWhenAuthorizedToWriteAllCheckIns() {
+    void hasRoleWriteForTeamShouldReturnTrueWhenAuthorizedToWriteAllCheckIns() {
         Objective objective = Objective.Builder.builder().withTeam(Team.Builder.builder().withId(5L).build()).build();
         KeyResult keyResult = KeyResultMetric.Builder.builder().withObjective(objective).build();
         CheckIn checkIn = CheckInMetric.Builder.builder().withKeyResult(keyResult).build();
-        AuthorizationUser authorizationUser = defaultAuthorizationUser();
+        AuthorizationUser authorizationUser = new AuthorizationUser(okrUser);
 
         when(objectivePersistenceService.findObjectiveByKeyResultId(eq(checkIn.getKeyResult().getId()),
                 eq(authorizationUser), any())).thenReturn(objective);
 
-        assertTrue(authorizationService.isWriteable(checkIn, authorizationUser));
+        assertTrue(authorizationService.hasRoleWriteForTeam(checkIn, authorizationUser));
     }
 
     @Test
-    void isWriteableShouldReturnFalseWhenNotAuthorizedToWriteCheckIns() {
+    void hasRoleWriteForTeamShouldReturnTrueWhenAuthorizedAsAdminForCheckIns() {
+        var id = adminTeams.get(0).getId();
+        Objective objective = Objective.Builder.builder().withTeam(Team.Builder.builder().withId(id).build()).build();
+        KeyResult keyResult = KeyResultMetric.Builder.builder().withObjective(objective).build();
+        CheckIn checkIn = CheckInMetric.Builder.builder().withKeyResult(keyResult).build();
+        AuthorizationUser authorizationUser = new AuthorizationUser(user);
+
+        when(objectivePersistenceService.findObjectiveByKeyResultId(eq(checkIn.getKeyResult().getId()),
+                eq(authorizationUser), any())).thenReturn(objective);
+
+        assertTrue(authorizationService.hasRoleWriteForTeam(checkIn, authorizationUser));
+    }
+
+    @Test
+    void hasRoleWriteForTeamShouldReturnFalseWhenNotAuthorizedToWriteCheckIns() {
         Objective objective = Objective.Builder.builder().withTeam(Team.Builder.builder().withId(5L).build()).build();
         KeyResult keyResult = KeyResultMetric.Builder.builder().withObjective(objective).build();
         CheckIn checkIn = CheckInMetric.Builder.builder().withKeyResult(keyResult).build();
-        AuthorizationUser authorizationUser = mockAuthorizationUser(user, List.of(4L), 13L, List.of(WRITE_TEAM));
+        AuthorizationUser authorizationUser = mockAuthorizationUser(user);
 
         when(objectivePersistenceService.findObjectiveByKeyResultId(eq(checkIn.getKeyResult().getId()),
                 eq(authorizationUser), any())).thenReturn(objective);
 
-        assertFalse(authorizationService.isWriteable(checkIn, authorizationUser));
+        assertFalse(authorizationService.hasRoleWriteForTeam(checkIn, authorizationUser));
     }
 
     @Test
     void hasRoleDeleteByObjectiveIdShouldPassThroughWhenAuthorizedForAllObjectives() {
         Long id = 13L;
         Objective objective = Objective.Builder.builder().withTeam(Team.Builder.builder().withId(5L).build()).build();
-        AuthorizationUser authorizationUser = defaultAuthorizationUser();
+        AuthorizationUser authorizationUser = new AuthorizationUser(okrUser);
 
         when(objectivePersistenceService.findObjectiveById(eq(id), eq(authorizationUser), any())).thenReturn(objective);
 
@@ -393,8 +440,7 @@ void hasRoleDeleteByObjectiveIdShouldPassThroughWhenAuthorizedForAllObjectives()
     void hasRoleDeleteByKeyResultIdShouldPassThroughWhenAuthorizedForAllTeamsKeyResults() {
         Long id = 13L;
         Objective objective = Objective.Builder.builder().withTeam(Team.Builder.builder().withId(1L).build()).build();
-        AuthorizationUser authorizationUser = mockAuthorizationUser(defaultUser(null), List.of(1L), 5L,
-                List.of(WRITE_ALL_TEAMS));
+        AuthorizationUser authorizationUser = new AuthorizationUser(okrUser);
 
         when(objectivePersistenceService.findObjectiveByKeyResultId(eq(id), eq(authorizationUser), any()))
                 .thenReturn(objective);
@@ -402,30 +448,23 @@ void hasRoleDeleteByKeyResultIdShouldPassThroughWhenAuthorizedForAllTeamsKeyResu
         authorizationService.hasRoleDeleteByKeyResultId(id, authorizationUser);
     }
 
-    @DisplayName("hasRoleDeleteByActionId() should pass through when authorized for team CheckIns")
     @Test
-    void hasRoleDeleteByActionIdShouldPassThroughWhenAuthorizedForTeamCheckIns() {
-        // arrange
-        Long id = 13L;
+    void hasRoleDeleteByCheckInIdShouldPassThroughWhenAuthorizedAsAdminForTeamCheckIns() {
+        var id = adminTeams.get(0).getId();
         Objective objective = Objective.Builder.builder().withTeam(Team.Builder.builder().withId(1L).build()).build();
-        KeyResult keyResult = KeyResultOrdinal.Builder.builder().withObjective(objective).build();
-        Action action = Action.Builder.builder().withId(id).withKeyResult(keyResult).build();
-
-        AuthorizationUser authorizationUser = mockAuthorizationUser(defaultUser(null), List.of(1L), 5L,
-                List.of(WRITE_TEAM));
+        AuthorizationUser authorizationUser = new AuthorizationUser(user);
 
-        when(actionPersistenceService.findById(eq(id))).thenReturn(action);
+        when(objectivePersistenceService.findObjectiveByCheckInId(eq(id), eq(authorizationUser), any()))
+                .thenReturn(objective);
 
-        // act + (implicit) assert (because no exception is thrown)
-        authorizationService.hasRoleDeleteByActionId(id, authorizationUser);
+        authorizationService.hasRoleDeleteByCheckInId(id, authorizationUser);
     }
 
     @Test
-    void hasRoleDeleteByCheckInIdShouldPassThroughWhenAuthorizedForTeamCheckIns() {
-        Long id = 13L;
+    void hasRoleDeleteByCheckInIdShouldPassThroughWhenAuthorizedAsMemberForTeamCheckIns() {
+        var id = memberTeams.get(0).getId();
         Objective objective = Objective.Builder.builder().withTeam(Team.Builder.builder().withId(1L).build()).build();
-        AuthorizationUser authorizationUser = mockAuthorizationUser(defaultUser(null), List.of(1L), 5L,
-                List.of(WRITE_TEAM));
+        AuthorizationUser authorizationUser = new AuthorizationUser(user);
 
         when(objectivePersistenceService.findObjectiveByCheckInId(eq(id), eq(authorizationUser), any()))
                 .thenReturn(objective);
@@ -434,16 +473,17 @@ void hasRoleDeleteByCheckInIdShouldPassThroughWhenAuthorizedForTeamCheckIns() {
     }
 
     @Test
-    void hasRoleDeleteByKeyResultIdShouldThrowExceptionWhenNotAuthorizedForFirstLevelObjectives() {
-        Long id = 13L;
-        Objective objective = Objective.Builder.builder().withTeam(Team.Builder.builder().withId(5L).build()).build();
-        AuthorizationUser authorizationUser = mockAuthorizationUser(defaultUser(null), List.of(1L), 5L,
-                List.of(WRITE_ALL_TEAMS));
-        when(objectivePersistenceService.findObjectiveByKeyResultId(eq(id), eq(authorizationUser), any()))
+    void hasRoleDeleteByKeyResultIdShouldThrowExceptionWhenNotAuthorized() {
+        var memeberId = memberTeams.get(0).getId();
+        var otherId = otherTeams.get(0).getId();
+        Objective objective = Objective.Builder.builder().withTeam(Team.Builder.builder().withId(memeberId).build())
+                .build();
+        AuthorizationUser authorizationUser = new AuthorizationUser(user);
+        when(objectivePersistenceService.findObjectiveByKeyResultId(eq(otherId), eq(authorizationUser), any()))
                 .thenReturn(objective);
 
         OkrResponseStatusException exception = assertThrows(OkrResponseStatusException.class,
-                () -> authorizationService.hasRoleDeleteByKeyResultId(id, authorizationUser));
+                () -> authorizationService.hasRoleDeleteByKeyResultId(otherId, authorizationUser));
 
         List<ErrorDto> expectedErrors = List.of(ErrorDto.of(NOT_AUTHORIZED_TO_DELETE, "KeyResult"));
 
@@ -452,26 +492,6 @@ void hasRoleDeleteByKeyResultIdShouldThrowExceptionWhenNotAuthorizedForFirstLeve
         assertTrue(TestHelper.getAllErrorKeys(expectedErrors).contains(exception.getReason()));
     }
 
-    @Test
-    void hasRoleDeleteByCheckInIdShouldThrowExceptionWhenNotAuthorizedForOtherTeamObjectives() {
-        Long id = 13L;
-        Objective objective = Objective.Builder.builder().withTeam(Team.Builder.builder().withId(5L).build()).build();
-        AuthorizationUser authorizationUser = mockAuthorizationUser(defaultUser(null), List.of(1L), 5L,
-                List.of(WRITE_TEAM));
-
-        when(objectivePersistenceService.findObjectiveByCheckInId(eq(id), eq(authorizationUser), any()))
-                .thenReturn(objective);
-
-        OkrResponseStatusException exception = assertThrows(OkrResponseStatusException.class,
-                () -> authorizationService.hasRoleDeleteByCheckInId(id, authorizationUser));
-
-        List<ErrorDto> expectedErrors = List.of(ErrorDto.of(NOT_AUTHORIZED_TO_DELETE, "Check-in"));
-
-        assertEquals(UNAUTHORIZED, exception.getStatusCode());
-        assertThat(expectedErrors).hasSameElementsAs(exception.getErrors());
-        assertTrue(TestHelper.getAllErrorKeys(expectedErrors).contains(exception.getReason()));
-    }
-
     private void setSecurityContext(Jwt token) {
         SecurityContextHolder.setContext(new SecurityContextImpl(new Authentication() {
             @Override
diff --git a/backend/src/test/java/ch/puzzle/okr/service/authorization/CheckInAuthorizationServiceTest.java b/backend/src/test/java/ch/puzzle/okr/service/authorization/CheckInAuthorizationServiceTest.java
index 9ee5660311..c2cf02731e 100644
--- a/backend/src/test/java/ch/puzzle/okr/service/authorization/CheckInAuthorizationServiceTest.java
+++ b/backend/src/test/java/ch/puzzle/okr/service/authorization/CheckInAuthorizationServiceTest.java
@@ -32,7 +32,7 @@ class CheckInAuthorizationServiceTest {
     @Test
     void getEntityByIdShouldReturnCheckInWhenAuthorized() {
         Long id = 13L;
-        when(authorizationService.getAuthorizationUser()).thenReturn(authorizationUser);
+        when(authorizationService.updateOrAddAuthorizationUser()).thenReturn(authorizationUser);
         when(checkInBusinessService.getEntityById(id)).thenReturn(checkInMetric);
 
         CheckIn checkIn = checkInAuthorizationService.getEntityById(id);
@@ -42,8 +42,8 @@ void getEntityByIdShouldReturnCheckInWhenAuthorized() {
     @Test
     void getEntityByIdShouldReturnCheckInWritableWhenAuthorized() {
         Long id = 13L;
-        when(authorizationService.getAuthorizationUser()).thenReturn(authorizationUser);
-        when(authorizationService.isWriteable(checkInMetric, authorizationUser)).thenReturn(true);
+        when(authorizationService.updateOrAddAuthorizationUser()).thenReturn(authorizationUser);
+        when(authorizationService.hasRoleWriteForTeam(checkInMetric, authorizationUser)).thenReturn(true);
         when(checkInBusinessService.getEntityById(id)).thenReturn(checkInMetric);
 
         CheckIn checkIn = checkInAuthorizationService.getEntityById(id);
@@ -54,7 +54,7 @@ void getEntityByIdShouldReturnCheckInWritableWhenAuthorized() {
     void getEntityByIdShouldThrowExceptionWhenNotAuthorized() {
         Long id = 13L;
         String reason = "junit test reason";
-        when(authorizationService.getAuthorizationUser()).thenReturn(authorizationUser);
+        when(authorizationService.updateOrAddAuthorizationUser()).thenReturn(authorizationUser);
         doThrow(new ResponseStatusException(HttpStatus.UNAUTHORIZED, reason)).when(authorizationService)
                 .hasRoleReadByCheckInId(id, authorizationUser);
 
@@ -66,7 +66,7 @@ void getEntityByIdShouldThrowExceptionWhenNotAuthorized() {
 
     @Test
     void createEntityShouldReturnCreatedCheckInWhenAuthorized() {
-        when(authorizationService.getAuthorizationUser()).thenReturn(authorizationUser);
+        when(authorizationService.updateOrAddAuthorizationUser()).thenReturn(authorizationUser);
         when(checkInBusinessService.createEntity(checkInMetric, authorizationUser)).thenReturn(checkInMetric);
 
         CheckIn checkIn = checkInAuthorizationService.createEntity(checkInMetric);
@@ -76,7 +76,7 @@ void createEntityShouldReturnCreatedCheckInWhenAuthorized() {
     @Test
     void createEntityShouldThrowExceptionWhenNotAuthorized() {
         String reason = "junit test reason";
-        when(authorizationService.getAuthorizationUser()).thenReturn(authorizationUser);
+        when(authorizationService.updateOrAddAuthorizationUser()).thenReturn(authorizationUser);
         doThrow(new ResponseStatusException(HttpStatus.UNAUTHORIZED, reason)).when(authorizationService)
                 .hasRoleCreateOrUpdate(checkInMetric, authorizationUser);
 
@@ -89,7 +89,7 @@ void createEntityShouldThrowExceptionWhenNotAuthorized() {
     @Test
     void updateEntityShouldReturnUpdatedCheckInWhenAuthorized() {
         Long id = 13L;
-        when(authorizationService.getAuthorizationUser()).thenReturn(authorizationUser);
+        when(authorizationService.updateOrAddAuthorizationUser()).thenReturn(authorizationUser);
         when(checkInBusinessService.updateEntity(id, checkInMetric, authorizationUser)).thenReturn(checkInMetric);
 
         CheckIn checkIn = checkInAuthorizationService.updateEntity(id, checkInMetric);
@@ -100,7 +100,7 @@ void updateEntityShouldReturnUpdatedCheckInWhenAuthorized() {
     void updateEntityShouldThrowExceptionWhenNotAuthorized() {
         Long id = 13L;
         String reason = "junit test reason";
-        when(authorizationService.getAuthorizationUser()).thenReturn(authorizationUser);
+        when(authorizationService.updateOrAddAuthorizationUser()).thenReturn(authorizationUser);
         doThrow(new ResponseStatusException(HttpStatus.UNAUTHORIZED, reason)).when(authorizationService)
                 .hasRoleCreateOrUpdate(checkInMetric, authorizationUser);
 
@@ -113,7 +113,7 @@ void updateEntityShouldThrowExceptionWhenNotAuthorized() {
     @Test
     void deleteEntityByIdShouldPassThroughWhenAuthorized() {
         Long id = 13L;
-        when(authorizationService.getAuthorizationUser()).thenReturn(authorizationUser);
+        when(authorizationService.updateOrAddAuthorizationUser()).thenReturn(authorizationUser);
 
         checkInAuthorizationService.deleteEntityById(id);
     }
@@ -122,7 +122,7 @@ void deleteEntityByIdShouldPassThroughWhenAuthorized() {
     void deleteEntityByIdShouldThrowExceptionWhenNotAuthorized() {
         Long id = 13L;
         String reason = "junit test reason";
-        when(authorizationService.getAuthorizationUser()).thenReturn(authorizationUser);
+        when(authorizationService.updateOrAddAuthorizationUser()).thenReturn(authorizationUser);
         doThrow(new ResponseStatusException(HttpStatus.UNAUTHORIZED, reason)).when(authorizationService)
                 .hasRoleDeleteByCheckInId(id, authorizationUser);
 
diff --git a/backend/src/test/java/ch/puzzle/okr/service/authorization/CompletedAuthorizationServiceTest.java b/backend/src/test/java/ch/puzzle/okr/service/authorization/CompletedAuthorizationServiceTest.java
index 887d12c968..2358188144 100644
--- a/backend/src/test/java/ch/puzzle/okr/service/authorization/CompletedAuthorizationServiceTest.java
+++ b/backend/src/test/java/ch/puzzle/okr/service/authorization/CompletedAuthorizationServiceTest.java
@@ -35,7 +35,7 @@ class CompletedAuthorizationServiceTest {
 
     @Test
     void createCompletedShouldReturnObjectiveWhenAuthorized() {
-        when(authorizationService.getAuthorizationUser()).thenReturn(authorizationUser);
+        when(authorizationService.updateOrAddAuthorizationUser()).thenReturn(authorizationUser);
         when(completedBusinessService.createCompleted(newCompleted)).thenReturn(newCompleted);
 
         Completed completed = completedAuthorizationService.createCompleted(newCompleted);
@@ -45,7 +45,7 @@ void createCompletedShouldReturnObjectiveWhenAuthorized() {
     @Test
     void createCompletedShouldThrowExceptionWhenNotAuthorized() {
         String reason = "junit test reason";
-        when(authorizationService.getAuthorizationUser()).thenReturn(authorizationUser);
+        when(authorizationService.updateOrAddAuthorizationUser()).thenReturn(authorizationUser);
         doThrow(new ResponseStatusException(HttpStatus.UNAUTHORIZED, reason)).when(authorizationService)
                 .hasRoleCreateOrUpdateByObjectiveId(objectiveId, authorizationUser);
 
@@ -57,7 +57,7 @@ void createCompletedShouldThrowExceptionWhenNotAuthorized() {
 
     @Test
     void deleteCompletedByObjectiveIdShouldPassThroughWhenAuthorized() {
-        when(authorizationService.getAuthorizationUser()).thenReturn(authorizationUser);
+        when(authorizationService.updateOrAddAuthorizationUser()).thenReturn(authorizationUser);
 
         completedAuthorizationService.deleteCompletedByObjectiveId(13L);
     }
@@ -65,7 +65,7 @@ void deleteCompletedByObjectiveIdShouldPassThroughWhenAuthorized() {
     @Test
     void deleteCompletedByObjectiveIdShouldThrowExceptionWhenNotAuthorized() {
         String reason = "junit test reason";
-        when(authorizationService.getAuthorizationUser()).thenReturn(authorizationUser);
+        when(authorizationService.updateOrAddAuthorizationUser()).thenReturn(authorizationUser);
         doThrow(new ResponseStatusException(HttpStatus.UNAUTHORIZED, reason)).when(authorizationService)
                 .hasRoleDeleteByObjectiveId(objectiveId, authorizationUser);
 
diff --git a/backend/src/test/java/ch/puzzle/okr/service/authorization/KeyResultAuthorizationServiceTest.java b/backend/src/test/java/ch/puzzle/okr/service/authorization/KeyResultAuthorizationServiceTest.java
index ae3d976991..2888e08a8a 100644
--- a/backend/src/test/java/ch/puzzle/okr/service/authorization/KeyResultAuthorizationServiceTest.java
+++ b/backend/src/test/java/ch/puzzle/okr/service/authorization/KeyResultAuthorizationServiceTest.java
@@ -38,7 +38,7 @@ class KeyResultAuthorizationServiceTest {
 
     @Test
     void createEntityShouldReturnKeyResultWhenAuthorized() {
-        when(authorizationService.getAuthorizationUser()).thenReturn(authorizationUser);
+        when(authorizationService.updateOrAddAuthorizationUser()).thenReturn(authorizationUser);
         when(keyResultBusinessService.createEntity(metricKeyResult, authorizationUser)).thenReturn(metricKeyResult);
 
         KeyResult keyResult = keyResultAuthorizationService.createEntity(metricKeyResult);
@@ -48,7 +48,7 @@ void createEntityShouldReturnKeyResultWhenAuthorized() {
     @Test
     void createEntityShouldThrowExceptionWhenNotAuthorized() {
         String reason = "junit test reason";
-        when(authorizationService.getAuthorizationUser()).thenReturn(authorizationUser);
+        when(authorizationService.updateOrAddAuthorizationUser()).thenReturn(authorizationUser);
         doThrow(new ResponseStatusException(HttpStatus.UNAUTHORIZED, reason)).when(authorizationService)
                 .hasRoleCreateOrUpdate(metricKeyResult, authorizationUser);
 
@@ -61,7 +61,7 @@ void createEntityShouldThrowExceptionWhenNotAuthorized() {
     @Test
     void getEntityByIdShouldReturnKeyResultWhenAuthorized() {
         Long id = 13L;
-        when(authorizationService.getAuthorizationUser()).thenReturn(authorizationUser);
+        when(authorizationService.updateOrAddAuthorizationUser()).thenReturn(authorizationUser);
         when(keyResultBusinessService.getEntityById(id)).thenReturn(metricKeyResult);
 
         KeyResult keyResult = keyResultAuthorizationService.getEntityById(id);
@@ -71,8 +71,8 @@ void getEntityByIdShouldReturnKeyResultWhenAuthorized() {
     @Test
     void getEntityByIdShouldReturnKeyResultWritableWhenAuthorized() {
         Long id = 13L;
-        when(authorizationService.getAuthorizationUser()).thenReturn(authorizationUser);
-        when(authorizationService.isWriteable(metricKeyResult, authorizationUser)).thenReturn(true);
+        when(authorizationService.updateOrAddAuthorizationUser()).thenReturn(authorizationUser);
+        when(authorizationService.hasRoleWriteForTeam(metricKeyResult, authorizationUser)).thenReturn(true);
         when(keyResultBusinessService.getEntityById(id)).thenReturn(metricKeyResult);
 
         KeyResult keyResult = keyResultAuthorizationService.getEntityById(id);
@@ -83,7 +83,7 @@ void getEntityByIdShouldReturnKeyResultWritableWhenAuthorized() {
     void getEntityByIdShouldThrowExceptionWhenNotAuthorized() {
         Long id = 13L;
         String reason = "junit test reason";
-        when(authorizationService.getAuthorizationUser()).thenReturn(authorizationUser);
+        when(authorizationService.updateOrAddAuthorizationUser()).thenReturn(authorizationUser);
         doThrow(new ResponseStatusException(HttpStatus.UNAUTHORIZED, reason)).when(authorizationService)
                 .hasRoleReadByKeyResultId(id, authorizationUser);
 
@@ -96,7 +96,7 @@ void getEntityByIdShouldThrowExceptionWhenNotAuthorized() {
     @Test
     void updateEntitiesShouldReturnUpdatedKeyResultWhenAuthorized() {
         Long id = 13L;
-        when(authorizationService.getAuthorizationUser()).thenReturn(authorizationUser);
+        when(authorizationService.updateOrAddAuthorizationUser()).thenReturn(authorizationUser);
         when(keyResultBusinessService.updateEntities(id, metricKeyResult, List.of()))
                 .thenReturn(new KeyResultWithActionList(metricKeyResult, List.of()));
 
@@ -109,7 +109,7 @@ void updateEntitiesShouldReturnUpdatedKeyResultWhenAuthorized() {
     void updateEntitiesShouldThrowExceptionWhenNotAuthorized() {
         Long id = 13L;
         String reason = "junit test reason";
-        when(authorizationService.getAuthorizationUser()).thenReturn(authorizationUser);
+        when(authorizationService.updateOrAddAuthorizationUser()).thenReturn(authorizationUser);
         doThrow(new ResponseStatusException(HttpStatus.UNAUTHORIZED, reason)).when(authorizationService)
                 .hasRoleCreateOrUpdate(metricKeyResult, authorizationUser);
 
@@ -131,7 +131,7 @@ void updateEntityShouldThrowException() {
     @Test
     void deleteEntityByIdShouldPassThroughWhenAuthorized() {
         Long id = 13L;
-        when(authorizationService.getAuthorizationUser()).thenReturn(authorizationUser);
+        when(authorizationService.updateOrAddAuthorizationUser()).thenReturn(authorizationUser);
 
         keyResultAuthorizationService.deleteEntityById(id);
     }
@@ -140,7 +140,7 @@ void deleteEntityByIdShouldPassThroughWhenAuthorized() {
     void deleteEntityByIdShouldThrowExceptionWhenNotAuthorized() {
         Long id = 13L;
         String reason = "junit test reason";
-        when(authorizationService.getAuthorizationUser()).thenReturn(authorizationUser);
+        when(authorizationService.updateOrAddAuthorizationUser()).thenReturn(authorizationUser);
         doThrow(new ResponseStatusException(HttpStatus.UNAUTHORIZED, reason)).when(authorizationService)
                 .hasRoleDeleteByKeyResultId(id, authorizationUser);
 
@@ -153,7 +153,7 @@ void deleteEntityByIdShouldThrowExceptionWhenNotAuthorized() {
     @Test
     void getAllCheckInsByKeyResultShouldReturnListOfCheckInsWhenAuthorized() {
         long id = 13L;
-        when(authorizationService.getAuthorizationUser()).thenReturn(authorizationUser);
+        when(authorizationService.updateOrAddAuthorizationUser()).thenReturn(authorizationUser);
         when(keyResultBusinessService.getAllCheckInsByKeyResult(id)).thenReturn(List.of(checkIn1, checkIn1));
 
         List<CheckIn> checkIns = keyResultAuthorizationService.getAllCheckInsByKeyResult(id);
@@ -164,7 +164,7 @@ void getAllCheckInsByKeyResultShouldReturnListOfCheckInsWhenAuthorized() {
     @Test
     void getAllCheckInsByKeyResultShouldReturnEmptyListIfNoCheckinsAreFound() {
         long id = 13L;
-        when(authorizationService.getAuthorizationUser()).thenReturn(authorizationUser);
+        when(authorizationService.updateOrAddAuthorizationUser()).thenReturn(authorizationUser);
         when(keyResultBusinessService.getAllCheckInsByKeyResult(id)).thenReturn(List.of());
 
         List<CheckIn> checkIns = keyResultAuthorizationService.getAllCheckInsByKeyResult(id);
diff --git a/backend/src/test/java/ch/puzzle/okr/service/authorization/ObjectiveAuthorizationServiceTest.java b/backend/src/test/java/ch/puzzle/okr/service/authorization/ObjectiveAuthorizationServiceTest.java
index 7ce9ba8939..04b72412f9 100644
--- a/backend/src/test/java/ch/puzzle/okr/service/authorization/ObjectiveAuthorizationServiceTest.java
+++ b/backend/src/test/java/ch/puzzle/okr/service/authorization/ObjectiveAuthorizationServiceTest.java
@@ -32,7 +32,7 @@ class ObjectiveAuthorizationServiceTest {
 
     @Test
     void createEntityShouldReturnObjectiveWhenAuthorized() {
-        when(authorizationService.getAuthorizationUser()).thenReturn(authorizationUser);
+        when(authorizationService.updateOrAddAuthorizationUser()).thenReturn(authorizationUser);
         when(objectiveBusinessService.createEntity(newObjective, authorizationUser)).thenReturn(newObjective);
 
         Objective objective = objectiveAuthorizationService.createEntity(newObjective);
@@ -42,7 +42,7 @@ void createEntityShouldReturnObjectiveWhenAuthorized() {
     @Test
     void createEntityShouldThrowExceptionWhenNotAuthorized() {
         String reason = "junit test reason";
-        when(authorizationService.getAuthorizationUser()).thenReturn(authorizationUser);
+        when(authorizationService.updateOrAddAuthorizationUser()).thenReturn(authorizationUser);
         doThrow(new ResponseStatusException(HttpStatus.UNAUTHORIZED, reason)).when(authorizationService)
                 .hasRoleCreateOrUpdate(newObjective, authorizationUser);
 
@@ -55,7 +55,7 @@ void createEntityShouldThrowExceptionWhenNotAuthorized() {
     @Test
     void getEntityByIdShouldReturnObjectiveWhenAuthorized() {
         Long id = 13L;
-        when(authorizationService.getAuthorizationUser()).thenReturn(authorizationUser);
+        when(authorizationService.updateOrAddAuthorizationUser()).thenReturn(authorizationUser);
         when(objectiveBusinessService.getEntityById(id)).thenReturn(newObjective);
 
         Objective objective = objectiveAuthorizationService.getEntityById(id);
@@ -65,8 +65,8 @@ void getEntityByIdShouldReturnObjectiveWhenAuthorized() {
     @Test
     void getEntityByIdShouldReturnObjectiveWritableWhenAuthorized() {
         Long id = 13L;
-        when(authorizationService.getAuthorizationUser()).thenReturn(authorizationUser);
-        when(authorizationService.isWriteable(newObjective, authorizationUser)).thenReturn(true);
+        when(authorizationService.updateOrAddAuthorizationUser()).thenReturn(authorizationUser);
+        when(authorizationService.hasRoleWriteForTeam(newObjective, authorizationUser)).thenReturn(true);
         when(objectiveBusinessService.getEntityById(id)).thenReturn(newObjective);
 
         Objective objective = objectiveAuthorizationService.getEntityById(id);
@@ -77,7 +77,7 @@ void getEntityByIdShouldReturnObjectiveWritableWhenAuthorized() {
     void getEntityByIdShouldThrowExceptionWhenNotAuthorized() {
         Long id = 13L;
         String reason = "junit test reason";
-        when(authorizationService.getAuthorizationUser()).thenReturn(authorizationUser);
+        when(authorizationService.updateOrAddAuthorizationUser()).thenReturn(authorizationUser);
         doThrow(new ResponseStatusException(HttpStatus.UNAUTHORIZED, reason)).when(authorizationService)
                 .hasRoleReadByObjectiveId(id, authorizationUser);
 
@@ -90,7 +90,7 @@ void getEntityByIdShouldThrowExceptionWhenNotAuthorized() {
     @Test
     void updateEntityShouldReturnUpdatedObjectiveWhenAuthorized() {
         Long id = 13L;
-        when(authorizationService.getAuthorizationUser()).thenReturn(authorizationUser);
+        when(authorizationService.updateOrAddAuthorizationUser()).thenReturn(authorizationUser);
         when(objectiveBusinessService.updateEntity(id, newObjective, authorizationUser)).thenReturn(newObjective);
 
         Objective Objective = objectiveAuthorizationService.updateEntity(id, newObjective);
@@ -101,7 +101,7 @@ void updateEntityShouldReturnUpdatedObjectiveWhenAuthorized() {
     void updateEntityShouldThrowExceptionWhenNotAuthorized() {
         Long id = 13L;
         String reason = "junit test reason";
-        when(authorizationService.getAuthorizationUser()).thenReturn(authorizationUser);
+        when(authorizationService.updateOrAddAuthorizationUser()).thenReturn(authorizationUser);
         doThrow(new ResponseStatusException(HttpStatus.UNAUTHORIZED, reason)).when(authorizationService)
                 .hasRoleCreateOrUpdate(newObjective, authorizationUser);
 
@@ -121,7 +121,7 @@ void isImUsedShouldReturnTrueWhenQuarterChanged() {
     @Test
     void deleteEntityByIdShouldPassThroughWhenAuthorized() {
         Long id = 13L;
-        when(authorizationService.getAuthorizationUser()).thenReturn(authorizationUser);
+        when(authorizationService.updateOrAddAuthorizationUser()).thenReturn(authorizationUser);
 
         objectiveAuthorizationService.deleteEntityById(id);
     }
@@ -130,7 +130,7 @@ void deleteEntityByIdShouldPassThroughWhenAuthorized() {
     void deleteEntityByIdShouldThrowExceptionWhenNotAuthorized() {
         Long id = 13L;
         String reason = "junit test reason";
-        when(authorizationService.getAuthorizationUser()).thenReturn(authorizationUser);
+        when(authorizationService.updateOrAddAuthorizationUser()).thenReturn(authorizationUser);
         doThrow(new ResponseStatusException(HttpStatus.UNAUTHORIZED, reason)).when(authorizationService)
                 .hasRoleDeleteByObjectiveId(id, authorizationUser);
 
@@ -148,7 +148,7 @@ void duplicateEntityShouldThrowExceptionWhenNotAuthorized() {
         String reason = "junit test reason";
         Objective objective = Objective.Builder.builder().build();
 
-        when(authorizationService.getAuthorizationUser()).thenReturn(authorizationUser);
+        when(authorizationService.updateOrAddAuthorizationUser()).thenReturn(authorizationUser);
         doThrow(new ResponseStatusException(HttpStatus.UNAUTHORIZED, reason)).when(authorizationService)
                 .hasRoleCreateOrUpdate(objective, authorizationUser);
 
@@ -173,7 +173,7 @@ void duplicateEntityShouldReturnDuplicatedObjectiveWhenAuthorized() {
         Objective newObjectiveWithKeyResults = Objective.Builder.builder() //
                 .withId(42L).withTitle("Objective with Id and KeyResults").build();
 
-        when(authorizationService.getAuthorizationUser()).thenReturn(authorizationUser);
+        when(authorizationService.updateOrAddAuthorizationUser()).thenReturn(authorizationUser);
         when(objectiveBusinessService.duplicateObjective(idExistingObjective, newObjectiveWithoutKeyResults,
                 authorizationUser)).thenReturn(newObjectiveWithKeyResults);
 
diff --git a/backend/src/test/java/ch/puzzle/okr/service/authorization/OrganisationAuthorizationServiceTest.java b/backend/src/test/java/ch/puzzle/okr/service/authorization/OrganisationAuthorizationServiceTest.java
deleted file mode 100644
index 9b65813091..0000000000
--- a/backend/src/test/java/ch/puzzle/okr/service/authorization/OrganisationAuthorizationServiceTest.java
+++ /dev/null
@@ -1,84 +0,0 @@
-package ch.puzzle.okr.service.authorization;
-
-import ch.puzzle.okr.models.Organisation;
-import ch.puzzle.okr.models.authorization.AuthorizationUser;
-import ch.puzzle.okr.service.business.OrganisationBusinessService;
-import org.junit.jupiter.api.DisplayName;
-import org.junit.jupiter.api.Test;
-import org.junit.jupiter.api.extension.ExtendWith;
-import org.mockito.InjectMocks;
-import org.mockito.Mock;
-import org.mockito.junit.jupiter.MockitoExtension;
-import org.springframework.web.server.ResponseStatusException;
-
-import java.util.List;
-
-import static ch.puzzle.okr.test.TestHelper.defaultAuthorizationUser;
-import static ch.puzzle.okr.test.TestHelper.userWithoutWriteAllRole;
-import static org.junit.jupiter.api.Assertions.*;
-import static org.mockito.Mockito.*;
-import static org.springframework.http.HttpStatus.UNAUTHORIZED;
-
-@ExtendWith(MockitoExtension.class)
-class OrganisationAuthorizationServiceTest {
-
-    private final AuthorizationUser authorizationUser = defaultAuthorizationUser();
-    @Mock
-    AuthorizationService authorizationService;
-    @InjectMocks
-    private OrganisationAuthorizationService organizationAuthorizationService;
-    @Mock
-    private OrganisationBusinessService organisationBusinessService;
-
-    @Test
-    void getEntityIfAuthorized() {
-        when(authorizationService.getAuthorizationUser()).thenReturn(authorizationUser);
-
-        organizationAuthorizationService.getEntities();
-        verify(organisationBusinessService, times(1)).getActiveOrganisations();
-    }
-
-    @Test
-    void getErrorIfNotAuthorized() {
-        when(authorizationService.getAuthorizationUser()).thenReturn(userWithoutWriteAllRole());
-
-        ResponseStatusException exception = assertThrows(ResponseStatusException.class,
-                () -> organizationAuthorizationService.getEntities());
-
-        assertEquals(UNAUTHORIZED, exception.getStatusCode());
-        assertEquals("NOT_AUTHORIZED_TO_READ", exception.getReason());
-        verify(organisationBusinessService, never()).getActiveOrganisations();
-    }
-
-    @DisplayName("getEntitiesByTeam() should return entities if authorized")
-    @Test
-    void getEntitiesByTeamShouldReturnEntitiesIfAuthorized() {
-        // arrange
-        long teamId = 5L;
-        Organisation organisation = Organisation.Builder.builder().withId(23L).build();
-
-        when(authorizationService.getAuthorizationUser()).thenReturn(authorizationUser);
-        when(organisationBusinessService.getOrganisationsByTeam(anyLong())).thenReturn(List.of(organisation));
-
-        // act
-        List<Organisation> organisations = organizationAuthorizationService.getEntitiesByTeam(teamId);
-
-        // assert
-        verify(organisationBusinessService, times(1)).getOrganisationsByTeam(teamId);
-        assertEquals(1, organisations.size());
-        assertEquals(organisation, organisations.get(0));
-    }
-
-    @DisplayName("getEntitiesByTeam() throws exception if not authorized")
-    @Test
-    void getEntitiesByTeamThrowsExceptionIfNotAuthorized() {
-        when(authorizationService.getAuthorizationUser()).thenReturn(userWithoutWriteAllRole());
-
-        ResponseStatusException exception = assertThrows(ResponseStatusException.class,
-                () -> organizationAuthorizationService.getEntitiesByTeam(23L));
-
-        assertEquals(UNAUTHORIZED, exception.getStatusCode());
-        assertEquals("NOT_AUTHORIZED_TO_READ", exception.getReason());
-        verify(organisationBusinessService, never()).getOrganisationsByTeam(anyLong());
-    }
-}
diff --git a/backend/src/test/java/ch/puzzle/okr/service/authorization/OverviewAuthorizationServiceTest.java b/backend/src/test/java/ch/puzzle/okr/service/authorization/OverviewAuthorizationServiceTest.java
index e4b34eb114..5a3e6c732c 100644
--- a/backend/src/test/java/ch/puzzle/okr/service/authorization/OverviewAuthorizationServiceTest.java
+++ b/backend/src/test/java/ch/puzzle/okr/service/authorization/OverviewAuthorizationServiceTest.java
@@ -16,9 +16,9 @@
 import java.util.List;
 
 import static ch.puzzle.okr.test.TestHelper.*;
-import static ch.puzzle.okr.models.authorization.AuthorizationRole.READ_ALL_PUBLISHED;
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import static org.mockito.ArgumentMatchers.any;
 import static org.mockito.ArgumentMatchers.eq;
 import static org.mockito.Mockito.*;
@@ -31,9 +31,15 @@ class OverviewAuthorizationServiceTest {
     AuthorizationService authorizationService;
     @InjectMocks
     private OverviewAuthorizationService overviewAuthorizationService;
-    private final AuthorizationUser authorizationUser = defaultAuthorizationUser();
+
+    private final long adminTeamId = 5L;
+    private final long memberTeamId = 6L;
+
+    private final AuthorizationUser authorizationUser = new AuthorizationUser(
+            defaultUserWithTeams(1L, List.of(defaultTeam(adminTeamId)), List.of(defaultTeam(memberTeamId))));
+    private final AuthorizationUser okrChampionUser = new AuthorizationUser(defaultOkrChampion(2L));
     private final Overview overview = Overview.Builder.builder()
-            .withOverviewId(OverviewId.Builder.builder().withObjectiveId(1L).withTeamId(5L).build())
+            .withOverviewId(OverviewId.Builder.builder().withObjectiveId(1L).withTeamId(adminTeamId).build())
             .withObjectiveTitle("Objective 1").build();
 
     @DisplayName("getFilteredOverview() should do nothing when OverviewId is null")
@@ -43,7 +49,7 @@ void getFilteredOverviewShouldDoNothingWhenOverviewIdIsNull() {
         Overview overviewWithoutOverviewId = mock(Overview.class);
         when(overviewWithoutOverviewId.getOverviewId()).thenReturn(null);
 
-        when(authorizationService.getAuthorizationUser()).thenReturn(authorizationUser);
+        when(authorizationService.updateOrAddAuthorizationUser()).thenReturn(authorizationUser);
         when(overviewBusinessService.getFilteredOverview(any(), any(), any(), eq(authorizationUser)))
                 .thenReturn(List.of(overviewWithoutOverviewId));
 
@@ -63,7 +69,7 @@ void getFilteredOverviewShouldDoNothingWhenTeamIdIsNull() {
         Overview overviewWithoutTeamId = mock(Overview.class);
         when(overviewWithoutTeamId.getOverviewId()).thenReturn(overviewId);
 
-        when(authorizationService.getAuthorizationUser()).thenReturn(authorizationUser);
+        when(authorizationService.updateOrAddAuthorizationUser()).thenReturn(authorizationUser);
         when(overviewBusinessService.getFilteredOverview(any(), any(), any(), eq(authorizationUser)))
                 .thenReturn(List.of(overviewWithoutTeamId));
 
@@ -83,7 +89,7 @@ void getFilteredOverviewShouldDoNothingWhenObjectiveIdIsNull() {
         Overview overviewWithoutObjectiveId = mock(Overview.class);
         when(overviewWithoutObjectiveId.getOverviewId()).thenReturn(overviewId);
 
-        when(authorizationService.getAuthorizationUser()).thenReturn(authorizationUser);
+        when(authorizationService.updateOrAddAuthorizationUser()).thenReturn(authorizationUser);
         when(overviewBusinessService.getFilteredOverview(any(), any(), any(), eq(authorizationUser)))
                 .thenReturn(List.of(overviewWithoutObjectiveId));
 
@@ -96,34 +102,43 @@ void getFilteredOverviewShouldDoNothingWhenObjectiveIdIsNull() {
 
     @Test
     void getFilteredOverviewShouldReturnOverviewsWhenAuthorized() {
-        when(authorizationService.getAuthorizationUser()).thenReturn(authorizationUser);
+        when(authorizationService.updateOrAddAuthorizationUser()).thenReturn(authorizationUser);
         when(overviewBusinessService.getFilteredOverview(any(), any(), any(), eq(authorizationUser)))
                 .thenReturn(List.of(overview));
 
-        List<Overview> overviews = overviewAuthorizationService.getFilteredOverview(1L, List.of(5L), "");
+        List<Overview> overviews = overviewAuthorizationService.getFilteredOverview(1L, List.of(adminTeamId), "");
 
         assertThat(List.of(overview)).hasSameElementsAs(overviews);
     }
 
-    @ParameterizedTest
-    @ValueSource(booleans = { true, false })
-    void getFilteredOverviewShouldSetWritableProperly(boolean isWritable) {
-        when(authorizationService.getAuthorizationUser()).thenReturn(authorizationUser);
-        when(authorizationService.isWriteable(authorizationUser, 5L)).thenReturn(isWritable);
+    @Test
+    void getFilteredOverviewShouldSetWritableProperlyToTrue() {
+        when(authorizationService.updateOrAddAuthorizationUser()).thenReturn(authorizationUser);
+        when(overviewBusinessService.getFilteredOverview(any(), any(), any(), eq(authorizationUser)))
+                .thenReturn(List.of(overview));
+
+        List<Overview> overviews = overviewAuthorizationService.getFilteredOverview(1L, List.of(adminTeamId), "");
+
+        assertTrue(overviews.get(0).isWriteable());
+    }
+
+    @Test
+    void getFilteredOverviewShouldSetWritableProperlyToFalse() {
+        when(authorizationService.updateOrAddAuthorizationUser()).thenReturn(authorizationUser);
         when(overviewBusinessService.getFilteredOverview(any(), any(), any(), eq(authorizationUser)))
                 .thenReturn(List.of(overview));
 
-        List<Overview> overviews = overviewAuthorizationService.getFilteredOverview(1L, List.of(5L), "");
+        List<Overview> overviews = overviewAuthorizationService.getFilteredOverview(1L, List.of(memberTeamId), "");
 
-        assertEquals(isWritable, overviews.get(0).isWriteable());
+        assertTrue(overviews.get(0).isWriteable());
     }
 
     @Test
     void getFilteredOverviewShouldReturnEmptyListWhenNotAuthorized() {
-        when(authorizationService.getAuthorizationUser()).thenReturn(authorizationUser);
-        when(overviewBusinessService.getFilteredOverview(1L, List.of(5L), "", authorizationUser)).thenReturn(List.of());
+        when(authorizationService.updateOrAddAuthorizationUser()).thenReturn(authorizationUser);
+        when(overviewBusinessService.getFilteredOverview(1L, List.of(adminTeamId), "", authorizationUser)).thenReturn(List.of());
 
-        List<Overview> overviews = overviewAuthorizationService.getFilteredOverview(1L, List.of(5L), "");
+        List<Overview> overviews = overviewAuthorizationService.getFilteredOverview(1L, List.of(adminTeamId), "");
         assertThat(List.of()).hasSameElementsAs(overviews);
     }
 
@@ -131,10 +146,10 @@ void getFilteredOverviewShouldReturnEmptyListWhenNotAuthorized() {
     @ValueSource(booleans = { true, false })
     void hasWriteAllAccessShouldReturnHasRoleWriteAll(boolean hasRoleWriteAll) {
         if (hasRoleWriteAll) {
-            when(authorizationService.getAuthorizationUser()).thenReturn(authorizationUser);
+            when(authorizationService.updateOrAddAuthorizationUser()).thenReturn(okrChampionUser);
         } else {
-            when(authorizationService.getAuthorizationUser())
-                    .thenReturn(mockAuthorizationUser(defaultUser(5L), List.of(), 7L, List.of(READ_ALL_PUBLISHED)));
+            when(authorizationService.updateOrAddAuthorizationUser())
+                    .thenReturn(mockAuthorizationUser(defaultUser(adminTeamId)));
         }
 
         assertEquals(hasRoleWriteAll, overviewAuthorizationService.hasWriteAllAccess());
diff --git a/backend/src/test/java/ch/puzzle/okr/service/authorization/TeamAuthorizationServiceTest.java b/backend/src/test/java/ch/puzzle/okr/service/authorization/TeamAuthorizationServiceTest.java
index 518c018c30..16b7a8d1a1 100644
--- a/backend/src/test/java/ch/puzzle/okr/service/authorization/TeamAuthorizationServiceTest.java
+++ b/backend/src/test/java/ch/puzzle/okr/service/authorization/TeamAuthorizationServiceTest.java
@@ -1,29 +1,25 @@
 package ch.puzzle.okr.service.authorization;
 
+import ch.puzzle.okr.exception.OkrResponseStatusException;
 import ch.puzzle.okr.models.Team;
 import ch.puzzle.okr.models.authorization.AuthorizationUser;
 import ch.puzzle.okr.service.business.TeamBusinessService;
-import org.junit.jupiter.api.DisplayName;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.extension.ExtendWith;
 import org.junit.jupiter.params.ParameterizedTest;
-import org.junit.jupiter.params.provider.Arguments;
-import org.junit.jupiter.params.provider.MethodSource;
 import org.junit.jupiter.params.provider.ValueSource;
 import org.mockito.InjectMocks;
 import org.mockito.Mock;
 import org.mockito.junit.jupiter.MockitoExtension;
 import org.springframework.web.server.ResponseStatusException;
 
-import java.util.ArrayList;
 import java.util.List;
-import java.util.stream.Stream;
 
 import static ch.puzzle.okr.test.TestHelper.*;
 import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.assertThrows;
 import static org.mockito.ArgumentMatchers.any;
-import static org.mockito.Mockito.when;
+import static org.mockito.Mockito.*;
 import static org.springframework.http.HttpStatus.UNAUTHORIZED;
 
 @ExtendWith(MockitoExtension.class)
@@ -36,59 +32,89 @@ class TeamAuthorizationServiceTest {
     @InjectMocks
     private TeamAuthorizationService teamAuthorizationService;
 
-    private final AuthorizationUser authorizationUser = defaultAuthorizationUser();
-    private final Team newTeam = Team.Builder.builder().withId(5L).withName("Team")
-            .withAuthorizationOrganisation(new ArrayList<>()).build();
+    private final AuthorizationUser okrChampionUser = new AuthorizationUser(defaultOkrChampion(1L));
+    private final Team teamUnderTest = Team.Builder.builder().withId(5L).withName("Team").build();
+    private final AuthorizationUser adminUser = new AuthorizationUser(
+            defaultUserWithTeams(1L, List.of(teamUnderTest), List.of()));
+    private final AuthorizationUser memberUser = new AuthorizationUser(
+            defaultUserWithTeams(1L, List.of(), List.of(teamUnderTest)));
+    private final AuthorizationUser userWithNoTeams = new AuthorizationUser(
+            defaultUserWithTeams(1L, List.of(), List.of()));
 
     @Test
-    void createEntityShouldReturnTeamWhenAuthorized() {
-        when(authorizationService.getAuthorizationUser()).thenReturn(authorizationUser);
-        when(teamBusinessService.createTeam(newTeam)).thenReturn(newTeam);
+    void createEntityShouldReturnTeam() {
+        when(teamBusinessService.createTeam(teamUnderTest, authorizationService.updateOrAddAuthorizationUser())).thenReturn(teamUnderTest);
 
-        Team team = teamAuthorizationService.createEntity(newTeam);
-        assertEquals(newTeam, team);
+        Team team = teamAuthorizationService.createEntity(teamUnderTest);
+        assertEquals(teamUnderTest, team);
     }
 
     @Test
-    void createEntityShouldThrowExceptionWhenNotAuthorized() {
-        when(authorizationService.getAuthorizationUser()).thenReturn(userWithoutWriteAllRole());
-        ResponseStatusException exception = assertThrows(ResponseStatusException.class,
-                () -> teamAuthorizationService.createEntity(newTeam));
-        assertEquals(UNAUTHORIZED, exception.getStatusCode());
-        assertEquals("NOT_AUTHORIZED_TO_WRITE", exception.getReason());
+    void updateEntityShouldReturnUpdatedTeamWhenAuthorizedAsOkrChampion() {
+        Long id = 13L;
+        when(authorizationService.updateOrAddAuthorizationUser()).thenReturn(okrChampionUser);
+        when(teamBusinessService.updateTeam(teamUnderTest, id)).thenReturn(teamUnderTest);
+
+        Team team = teamAuthorizationService.updateEntity(teamUnderTest, id);
+        assertEquals(teamUnderTest, team);
     }
 
     @Test
-    void updateEntityShouldReturnUpdatedTeamWhenAuthorized() {
+    void updateEntityShouldReturnUpdatedTeamWhenAuthorizedAsAdminUser() {
         Long id = 13L;
-        when(authorizationService.getAuthorizationUser()).thenReturn(authorizationUser);
-        when(teamBusinessService.updateTeam(newTeam, id)).thenReturn(newTeam);
+        when(authorizationService.updateOrAddAuthorizationUser()).thenReturn(adminUser);
+        when(teamBusinessService.updateTeam(teamUnderTest, id)).thenReturn(teamUnderTest);
 
-        Team team = teamAuthorizationService.updateEntity(newTeam, id);
-        assertEquals(newTeam, team);
+        Team team = teamAuthorizationService.updateEntity(teamUnderTest, id);
+        assertEquals(teamUnderTest, team);
     }
 
     @Test
-    void updateEntityShouldThrowExceptionWhenNotAuthorized() {
+    void updateEntityShouldThrowExceptionWhenAuthorizedAsMemberUser() {
         Long id = 13L;
-        when(authorizationService.getAuthorizationUser()).thenReturn(userWithoutWriteAllRole());
+        when(authorizationService.updateOrAddAuthorizationUser()).thenReturn(memberUser);
         ResponseStatusException exception = assertThrows(ResponseStatusException.class,
-                () -> teamAuthorizationService.updateEntity(newTeam, id));
+                () -> teamAuthorizationService.updateEntity(teamUnderTest, id));
         assertEquals(UNAUTHORIZED, exception.getStatusCode());
         assertEquals("NOT_AUTHORIZED_TO_WRITE", exception.getReason());
     }
 
     @Test
-    void deleteEntityByIdShouldPassThroughWhenAuthorized() {
+    void updateEntityShouldThrowExceptionWhenAuthorizedAsUserWithNoTeams() {
         Long id = 13L;
-        when(authorizationService.getAuthorizationUser()).thenReturn(authorizationUser);
-        teamAuthorizationService.deleteEntity(id);
+        when(authorizationService.updateOrAddAuthorizationUser()).thenReturn(userWithNoTeams);
+        ResponseStatusException exception = assertThrows(ResponseStatusException.class,
+                () -> teamAuthorizationService.updateEntity(teamUnderTest, id));
+        assertEquals(UNAUTHORIZED, exception.getStatusCode());
+        assertEquals("NOT_AUTHORIZED_TO_WRITE", exception.getReason());
+    }
+
+    @Test
+    void deleteEntityByIdShouldPassThroughWhenAuthorizedAsOkrChampion() {
+        when(authorizationService.updateOrAddAuthorizationUser()).thenReturn(okrChampionUser);
+        teamAuthorizationService.deleteEntity(teamUnderTest.getId());
+    }
+
+    @Test
+    void deleteEntityByIdShouldPassThroughWhenAuthorizedAsTeamAdmin() {
+        when(authorizationService.updateOrAddAuthorizationUser()).thenReturn(adminUser);
+        teamAuthorizationService.deleteEntity(teamUnderTest.getId());
     }
 
     @Test
-    void deleteEntityByIdShouldThrowExceptionWhenNotAuthorized() {
+    void deleteEntityByIdShouldThrowExceptionWhenAuthorizedAsMemberUser() {
+        when(authorizationService.updateOrAddAuthorizationUser()).thenReturn(memberUser);
+
+        ResponseStatusException exception = assertThrows(ResponseStatusException.class,
+                () -> teamAuthorizationService.deleteEntity(teamUnderTest.getId()));
+        assertEquals(UNAUTHORIZED, exception.getStatusCode());
+        assertEquals("NOT_AUTHORIZED_TO_DELETE", exception.getReason());
+    }
+
+    @Test
+    void deleteEntityByIdShouldThrowExceptionWhenAuthorizedAsUserWithNoTeams() {
         Long id = 13L;
-        when(authorizationService.getAuthorizationUser()).thenReturn(userWithoutWriteAllRole());
+        when(authorizationService.updateOrAddAuthorizationUser()).thenReturn(userWithNoTeams);
 
         ResponseStatusException exception = assertThrows(ResponseStatusException.class,
                 () -> teamAuthorizationService.deleteEntity(id));
@@ -99,11 +125,11 @@ void deleteEntityByIdShouldThrowExceptionWhenNotAuthorized() {
     @ParameterizedTest
     @ValueSource(booleans = { true, false })
     void getAllTeamsShouldReturnAllTeams(boolean isWriteable) {
-        List<Team> teamList = List.of(newTeam, newTeam);
+        List<Team> teamList = List.of(teamUnderTest, teamUnderTest);
         if (isWriteable) {
-            when(authorizationService.getAuthorizationUser()).thenReturn(authorizationUser);
+            when(authorizationService.updateOrAddAuthorizationUser()).thenReturn(okrChampionUser);
         } else {
-            when(authorizationService.getAuthorizationUser()).thenReturn(userWithoutWriteAllRole());
+            when(authorizationService.updateOrAddAuthorizationUser()).thenReturn(userWithoutWriteAllRole());
         }
         when(teamBusinessService.getAllTeams(any())).thenReturn(teamList);
 
@@ -112,20 +138,23 @@ void getAllTeamsShouldReturnAllTeams(boolean isWriteable) {
         teams.forEach(team -> assertEquals(isWriteable, team.isWriteable()));
     }
 
-    @DisplayName("getUserTeamIds() should return team Ids independent of the roles of the AuthorizedUser")
-    @ParameterizedTest
-    @MethodSource("generator")
-    void getUserTeamIdsShouldReturnTeamIdsIndependentOfRolesOfAuthorizedUser(AuthorizationUser user) {
-        Long teamIdAuthorizedUser = 5L;
-        when(authorizationService.getAuthorizationUser()).thenReturn(user);
-
-        List<Long> userTeamIds = teamAuthorizationService.getUserTeamIds();
-        assertEquals(1, userTeamIds.size());
-        assertEquals(teamIdAuthorizedUser, userTeamIds.get(0));
+    @Test
+    void addUsersToTeam_shouldThrowExceptionIfUserNotAuthorized() {
+        when(authorizationService.updateOrAddAuthorizationUser()).thenReturn(
+                new AuthorizationUser(defaultUserWithTeams(1L, List.of(), List.of()))
+        );
+        assertThrows(OkrResponseStatusException.class, () -> teamAuthorizationService.addUsersToTeam(1L, List.of()));
     }
 
-    private static Stream<Arguments> generator() {
-        return Stream.of(Arguments.of(userWithoutAnyRole()), Arguments.of(defaultAuthorizationUser()));
-    }
+    @Test
+    void addUsersToTeam_shouldCallTeamBusinessService() {
+        var adminTeamId = 1L;
+        var adminTeam = defaultTeam(adminTeamId);
+        var usersList = List.of(1L, 2L);
+        when(authorizationService.updateOrAddAuthorizationUser())
+                .thenReturn(new AuthorizationUser(defaultUserWithTeams(1L, List.of(adminTeam), List.of())));
+        teamAuthorizationService.addUsersToTeam(adminTeamId, usersList);
+        verify(teamBusinessService, times(1)).addUsersToTeam(adminTeamId, usersList);
 
+    }
 }
diff --git a/backend/src/test/java/ch/puzzle/okr/service/authorization/UserAuthorizationServiceTest.java b/backend/src/test/java/ch/puzzle/okr/service/authorization/UserAuthorizationServiceTest.java
index ddce3980c5..8575cdd561 100644
--- a/backend/src/test/java/ch/puzzle/okr/service/authorization/UserAuthorizationServiceTest.java
+++ b/backend/src/test/java/ch/puzzle/okr/service/authorization/UserAuthorizationServiceTest.java
@@ -1,21 +1,20 @@
 package ch.puzzle.okr.service.authorization;
 
+import ch.puzzle.okr.exception.OkrResponseStatusException;
 import ch.puzzle.okr.models.User;
 import ch.puzzle.okr.models.authorization.AuthorizationUser;
 import ch.puzzle.okr.service.business.UserBusinessService;
+import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.extension.ExtendWith;
-import org.junit.jupiter.params.ParameterizedTest;
-import org.junit.jupiter.params.provider.ValueSource;
 import org.mockito.InjectMocks;
 import org.mockito.Mock;
 import org.mockito.junit.jupiter.MockitoExtension;
 
 import java.util.List;
 
-import static ch.puzzle.okr.test.TestHelper.defaultAuthorizationUser;
-import static ch.puzzle.okr.test.TestHelper.userWithoutWriteAllRole;
-import static org.junit.jupiter.api.Assertions.assertEquals;
-import static org.mockito.Mockito.when;
+import static ch.puzzle.okr.test.TestHelper.*;
+import static org.junit.jupiter.api.Assertions.*;
+import static org.mockito.Mockito.*;
 
 @ExtendWith(MockitoExtension.class)
 public class UserAuthorizationServiceTest {
@@ -23,26 +22,88 @@ public class UserAuthorizationServiceTest {
     UserBusinessService userBusinessService;
     @Mock
     AuthorizationService authorizationService;
+    @Mock
+    TeamAuthorizationService teamAuthorizationService;
     @InjectMocks
     private UserAuthorizationService userAuthorizationService;
 
-    private final AuthorizationUser authorizationUser = defaultAuthorizationUser();
-    User user = User.Builder.builder().withId(5L).withFirstname("firstname").withLastname("lastname")
-            .withUsername("username").withEmail("lastname@puzzle.ch").build();
-
-    @ParameterizedTest
-    @ValueSource(booleans = { true, false })
-    void getAllUsersShouldReturnAllUsers(boolean isWriteable) {
-        List<User> userList = List.of(user, user);
-        if (isWriteable) {
-            when(authorizationService.getAuthorizationUser()).thenReturn(authorizationUser);
-        } else {
-            when(authorizationService.getAuthorizationUser()).thenReturn(userWithoutWriteAllRole());
-        }
+    private final long adminTeamId = 5L;
+    private final long memberTeamId = 6L;
+    User user = defaultUserWithTeams(1L, List.of(defaultTeam(adminTeamId), defaultTeam(memberTeamId)), List.of());
+    User user2 = defaultUserWithTeams(2L, List.of(), List.of(defaultTeam(adminTeamId), defaultTeam(memberTeamId)));
+
+    @Test
+    void getAllUsersShouldReturnAllUsers() {
+        List<User> userList = List.of(user, user2);
         when(userBusinessService.getAllUsers()).thenReturn(userList);
+        when(teamAuthorizationService.isUserWriteAllowed(adminTeamId)).thenReturn(true);
+        when(teamAuthorizationService.isUserWriteAllowed(memberTeamId)).thenReturn(false);
 
         List<User> users = userAuthorizationService.getAllUsers();
         assertEquals(userList, users);
-        users.forEach(user -> assertEquals(isWriteable, user.isWriteable()));
+    }
+
+    @Test
+    void getAllUsers_shouldSetTeamWritableCorrectly() {
+        List<User> userList = List.of(user, user2);
+        when(userBusinessService.getAllUsers()).thenReturn(userList);
+        when(teamAuthorizationService.isUserWriteAllowed(adminTeamId)).thenReturn(true);
+        when(teamAuthorizationService.isUserWriteAllowed(memberTeamId)).thenReturn(false);
+
+        List<User> users = userAuthorizationService.getAllUsers();
+        assertTrue(users.get(0).getUserTeamList().get(0).getTeam().isWriteable());
+        assertFalse(users.get(0).getUserTeamList().get(1).getTeam().isWriteable());
+        assertTrue(users.get(1).getUserTeamList().get(0).getTeam().isWriteable());
+        assertFalse(users.get(1).getUserTeamList().get(1).getTeam().isWriteable());
+    }
+
+    @Test
+    void setOkrChampion_shouldCallBusinessService() {
+        var loggedInUser = defaultUser(1L);
+        loggedInUser.setOkrChampion(true);
+
+        when(userBusinessService.getUserById(user.getId())).thenReturn(user);
+        when(authorizationService.updateOrAddAuthorizationUser()).thenReturn(new AuthorizationUser(loggedInUser));
+
+        userAuthorizationService.setIsOkrChampion(user.getId(), true);
+
+        verify(userBusinessService, times(1)).setIsOkrChampion(user, true);
+    }
+
+    @Test
+    void setOkrChampion_shouldThrowErrorIfLoggedInUserIsNotOkrChampion() {
+        var loggedInUser = defaultUser(1L);
+        loggedInUser.setOkrChampion(false);
+
+        when(userBusinessService.getUserById(user.getId())).thenReturn(user);
+        when(authorizationService.updateOrAddAuthorizationUser()).thenReturn(new AuthorizationUser(loggedInUser));
+
+        assertThrows(OkrResponseStatusException.class,
+                () -> userAuthorizationService.setIsOkrChampion(user.getId(), true));
+    }
+
+    @Test
+    void createUsers_shouldCallBusinessService() {
+        var loggedInUser = defaultUser(1L);
+        loggedInUser.setOkrChampion(true);
+
+        List<User> users = List.of(user, user2);
+        when(userBusinessService.createUsers(users)).thenReturn(users);
+        when(authorizationService.updateOrAddAuthorizationUser()).thenReturn(new AuthorizationUser(loggedInUser));
+
+        userAuthorizationService.createUsers(users);
+
+        verify(userBusinessService, times(1)).createUsers(users);
+    }
+
+    @Test
+    void createUsers_shouldThrowErrorIfLoggedInUserIsNotOkrChampion() {
+        var loggedInUser = defaultUser(1L);
+        loggedInUser.setOkrChampion(false);
+
+        when(authorizationService.updateOrAddAuthorizationUser()).thenReturn(new AuthorizationUser(loggedInUser));
+
+        assertThrows(OkrResponseStatusException.class,
+                () -> userAuthorizationService.createUsers(List.of(user, user2)));
     }
 }
diff --git a/backend/src/test/java/ch/puzzle/okr/service/authorization/UserUpdateHelperTest.java b/backend/src/test/java/ch/puzzle/okr/service/authorization/UserUpdateHelperTest.java
new file mode 100644
index 0000000000..958eaac311
--- /dev/null
+++ b/backend/src/test/java/ch/puzzle/okr/service/authorization/UserUpdateHelperTest.java
@@ -0,0 +1,72 @@
+package ch.puzzle.okr.service.authorization;
+
+import ch.puzzle.okr.models.User;
+import ch.puzzle.okr.multitenancy.TenantConfigProvider;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.DisplayName;
+import org.junit.jupiter.api.Test;
+
+import static org.junit.jupiter.api.Assertions.*;
+
+public class UserUpdateHelperTest {
+    private AuthorizationRegistrationService.UserUpdateHelper helper;
+
+    @BeforeEach
+    void setup() {
+        helper = new AuthorizationRegistrationService.UserUpdateHelper();
+    }
+
+    @DisplayName("update userFromDB with Firstname and Lastname from token")
+    @Test
+    void updateUserFromWithTokenData() {
+        // arrange
+        User userFromDB = User.Builder.builder() //
+                .withId(23L) //
+                .withFirstname("firstname_from_db") //
+                .withLastname("lastname_from_db") //
+                .withEmail("a@b.ch") //
+                .build();
+
+        User userFromToken = User.Builder.builder() //
+                .withFirstname("firstname_from_token") //
+                .withLastname("lastname_from_token") //
+                .build();
+
+        // act
+        User updatedUser = helper.setFirstLastNameFromToken(userFromDB, userFromToken);
+
+        // assert
+        assertEquals(23L, updatedUser.getId());
+        assertEquals("a@b.ch", updatedUser.getEmail());
+        assertEquals("firstname_from_token", updatedUser.getFirstname());
+        assertEquals("lastname_from_token", updatedUser.getLastname());
+    }
+
+    @Test
+    void updateUserAsNoChampion() {
+        // arrange
+        User noChampionUser = User.Builder.builder().withEmail("no@champions.ch").build();
+        TenantConfigProvider.TenantConfig tenantConfig = new TenantConfigProvider.TenantConfig(null, //
+                new String[] { "yes@champions.ch" }, null, null, null, null);
+
+        // act
+        User updatedUser = helper.setOkrChampionFromProperties(noChampionUser, tenantConfig);
+
+        // assert
+        assertFalse(updatedUser.isOkrChampion());
+    }
+
+    @Test
+    void updateUserAsChampion() {
+        // arrange
+        User championUser = User.Builder.builder().withEmail("yes@champions.ch").build();
+        TenantConfigProvider.TenantConfig tenantConfig = new TenantConfigProvider.TenantConfig(null, //
+                new String[] { "yes@champions.ch" }, null, null, null, null);
+
+        // act
+        User updatedUser = helper.setOkrChampionFromProperties(championUser, tenantConfig);
+
+        // assert
+        assertTrue(updatedUser.isOkrChampion());
+    }
+}
diff --git a/backend/src/test/java/ch/puzzle/okr/service/business/AlignmentSelectionBusinessServiceTest.java b/backend/src/test/java/ch/puzzle/okr/service/business/AlignmentSelectionBusinessServiceTest.java
index 961b1e12cb..91257a4974 100644
--- a/backend/src/test/java/ch/puzzle/okr/service/business/AlignmentSelectionBusinessServiceTest.java
+++ b/backend/src/test/java/ch/puzzle/okr/service/business/AlignmentSelectionBusinessServiceTest.java
@@ -11,6 +11,7 @@
 
 import java.util.List;
 
+import static ch.puzzle.okr.test.TestConstants.TEAM_PUZZLE;
 import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.mockito.Mockito.*;
 
@@ -24,17 +25,19 @@ class AlignmentSelectionBusinessServiceTest {
 
     private static AlignmentSelection createAlignmentSelection() {
         return AlignmentSelection.Builder.builder().withAlignmentSelectionId(AlignmentSelectionId.of(9L, 15L))
-                .withTeamId(5L).withTeamName("Puzzle ITC").withObjectiveTitle("Objective 9").withQuarterId(2L)
+                .withTeamId(5L).withTeamName(TEAM_PUZZLE).withObjectiveTitle("Objective 9").withQuarterId(2L)
                 .withQuarterLabel("GJ 23/24-Q1").withKeyResultTitle("Key Result 15").build();
     }
 
     @Test
     void getAlignmentSelectionByQuarterIdAndTeamIdNotShouldReturnListOfAlignmentSelections() {
-        when(alignmentSelectionPersistenceService.getAlignmentSelectionByQuarterIdAndTeamIdNot(2L, 4L))
-                .thenReturn(List.of(createAlignmentSelection()));
+        when(alignmentSelectionPersistenceService.getAlignmentSelectionByQuarterIdAndTeamIdNot(2L,
+                                                                                               4L)).thenReturn(List.of(
+                createAlignmentSelection()));
 
-        List<AlignmentSelection> alignmentSelections = alignmentSelectionBusinessService
-                .getAlignmentSelectionByQuarterIdAndTeamIdNot(2L, 4L);
+        List<AlignmentSelection> alignmentSelections = alignmentSelectionBusinessService.getAlignmentSelectionByQuarterIdAndTeamIdNot(
+                2L,
+                4L);
 
         assertEquals(1, alignmentSelections.size());
         verify(alignmentSelectionPersistenceService, times(1)).getAlignmentSelectionByQuarterIdAndTeamIdNot(2L, 4L);
diff --git a/backend/src/test/java/ch/puzzle/okr/service/business/KeyResultBusinessServiceIT.java b/backend/src/test/java/ch/puzzle/okr/service/business/KeyResultBusinessServiceIT.java
index 0f326bfa5b..13e46094a9 100644
--- a/backend/src/test/java/ch/puzzle/okr/service/business/KeyResultBusinessServiceIT.java
+++ b/backend/src/test/java/ch/puzzle/okr/service/business/KeyResultBusinessServiceIT.java
@@ -1,5 +1,6 @@
 package ch.puzzle.okr.service.business;
 
+import ch.puzzle.okr.test.TestHelper;
 import ch.puzzle.okr.models.Action;
 import ch.puzzle.okr.models.Objective;
 import ch.puzzle.okr.models.Unit;
@@ -13,6 +14,7 @@
 import ch.puzzle.okr.models.keyresult.KeyResultMetric;
 import ch.puzzle.okr.models.keyresult.KeyResultOrdinal;
 import ch.puzzle.okr.models.keyresult.KeyResultWithActionList;
+import ch.puzzle.okr.multitenancy.TenantContext;
 import ch.puzzle.okr.service.authorization.AuthorizationService;
 import ch.puzzle.okr.test.SpringIntegrationTest;
 import org.junit.jupiter.api.AfterEach;
@@ -91,7 +93,8 @@ private static Action createAction2(KeyResult keyResult) {
 
     @BeforeEach
     void setUp() {
-        when(authorizationService.getAuthorizationUser()).thenReturn(authorizationUser);
+        TenantContext.setCurrentTenant(TestHelper.SCHEMA_PITC);
+        when(authorizationService.updateOrAddAuthorizationUser()).thenReturn(authorizationUser);
     }
 
     @AfterEach
diff --git a/backend/src/test/java/ch/puzzle/okr/service/business/ObjectiveBusinessServiceTest.java b/backend/src/test/java/ch/puzzle/okr/service/business/ObjectiveBusinessServiceTest.java
index ce4bab78ae..ce4db63f9c 100644
--- a/backend/src/test/java/ch/puzzle/okr/service/business/ObjectiveBusinessServiceTest.java
+++ b/backend/src/test/java/ch/puzzle/okr/service/business/ObjectiveBusinessServiceTest.java
@@ -7,7 +7,6 @@
 import ch.puzzle.okr.models.keyresult.KeyResultOrdinal;
 import ch.puzzle.okr.service.persistence.ObjectivePersistenceService;
 import ch.puzzle.okr.service.validation.ObjectiveValidationService;
-import org.junit.jupiter.api.DisplayName;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.extension.ExtendWith;
 import org.junit.jupiter.params.ParameterizedTest;
@@ -23,6 +22,7 @@
 import java.util.List;
 
 import static ch.puzzle.okr.test.TestHelper.defaultAuthorizationUser;
+import static ch.puzzle.okr.models.State.DRAFT;
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.junit.jupiter.api.Assertions.*;
 import static org.mockito.ArgumentMatchers.any;
@@ -32,7 +32,6 @@
 @ExtendWith(MockitoExtension.class)
 class ObjectiveBusinessServiceTest {
     private static final AuthorizationUser authorizationUser = defaultAuthorizationUser();
-
     @InjectMocks
     @Spy
     ObjectiveBusinessService objectiveBusinessService;
@@ -45,36 +44,20 @@ class ObjectiveBusinessServiceTest {
     @Mock
     ObjectiveValidationService validator = Mockito.mock(ObjectiveValidationService.class);
 
-    private final Team team1 = Team.Builder.builder() //
-            .withId(1L) //
-            .withName("Team1").build();
-
-    private final Quarter quarter = Quarter.Builder.builder() //
-            .withId(1L) //
-            .withLabel("GJ 22/23-Q2").build();
-
-    private final User user = User.Builder.builder() //
-            .withId(1L) //
-            .withFirstname("Bob") //
-            .withLastname("Kaufmann") //
-            .withUsername("bkaufmann") //
+    private final Team team1 = Team.Builder.builder().withId(1L).withName("Team1").build();
+    private final Quarter quarter = Quarter.Builder.builder().withId(1L).withLabel("GJ 22/23-Q2").build();
+    private final User user = User.Builder.builder().withId(1L).withFirstname("Bob").withLastname("Kaufmann")
             .withEmail("kaufmann@puzzle.ch").build();
-
-    private final Objective objective = Objective.Builder.builder() //
-            .withId(5L) //
-            .withTitle("Objective 1").build();
-
-    private final KeyResult ordinalKeyResult = KeyResultOrdinal.Builder.builder() //
-            .withCommitZone("Baum") //
-            .withStretchZone("Wald") //
-            .withId(5L).withTitle("Keyresult Ordinal") //
-            .withObjective(objective).build();
-
+    private final Objective objective = Objective.Builder.builder().withId(5L).withTitle("Objective 1").build();
+    private final Objective fullObjective = Objective.Builder.builder().withTitle("FullObjective1").withCreatedBy(user)
+            .withTeam(team1).withQuarter(quarter).withDescription("This is our description")
+            .withModifiedOn(LocalDateTime.MAX).build();
+    private final KeyResult ordinalKeyResult = KeyResultOrdinal.Builder.builder().withCommitZone("Baum")
+            .withStretchZone("Wald").withId(5L).withTitle("Keyresult Ordinal").withObjective(objective).build();
     private final List<KeyResult> keyResultList = List.of(ordinalKeyResult, ordinalKeyResult, ordinalKeyResult);
 
-    @DisplayName("getEntityById() should return one Objective")
     @Test
-    void getEntityByIdShouldReturnOneObjective() {
+    void getOneObjective() {
         when(objectivePersistenceService.findById(5L)).thenReturn(objective);
 
         Objective realObjective = objectiveBusinessService.getEntityById(5L);
@@ -82,137 +65,88 @@ void getEntityByIdShouldReturnOneObjective() {
         assertEquals("Objective 1", realObjective.getTitle());
     }
 
-    @DisplayName("getEntityById() should throw exception when Objective is not found")
     @Test
-    void getEntityByIdShouldThrowExceptionWhenObjectiveNotFound() {
+    void getEntitiesByTeamId() {
+        when(objectivePersistenceService.findObjectiveByTeamId(anyLong())).thenReturn(List.of(objective));
+
+        List<Objective> entities = objectiveBusinessService.getEntitiesByTeamId(5L);
+
+        assertThat(entities).hasSameElementsAs(List.of(objective));
+    }
+
+    @Test
+    void shouldNotFindTheObjective() {
         when(objectivePersistenceService.findById(6L))
                 .thenThrow(new ResponseStatusException(NOT_FOUND, "Objective with id 6 not found"));
 
         ResponseStatusException exception = assertThrows(ResponseStatusException.class,
                 () -> objectiveBusinessService.getEntityById(6L));
-
         assertEquals(NOT_FOUND, exception.getStatusCode());
         assertEquals("Objective with id 6 not found", exception.getReason());
     }
 
-    @DisplayName("getEntitiesByTeamId() should return list of Objectives")
     @Test
-    void getEntitiesByTeamIdShouldReturnListOfObjectives() {
-        when(objectivePersistenceService.findObjectiveByTeamId(anyLong())).thenReturn(List.of(objective));
+    void shouldSaveANewObjective() {
+        Objective objective = spy(Objective.Builder.builder().withTitle("Received Objective").withTeam(team1)
+                .withQuarter(quarter).withDescription("The description").withModifiedOn(null).withModifiedBy(null)
+                .withState(DRAFT).build());
 
-        List<Objective> entities = objectiveBusinessService.getEntitiesByTeamId(5L);
+        doNothing().when(objective).setCreatedOn(any());
 
-        assertThat(entities).hasSameElementsAs(List.of(objective));
-    }
+        objectiveBusinessService.createEntity(objective, authorizationUser);
 
-    @DisplayName("createEntity() should save new Objective")
-    @Test
-    void createEntityShouldSaveNewObjective() {
-        // arrange
-        Objective objective = Objective.Builder.builder() //
-                .withId(1L) //
-                .withTitle("Title") //
-                .withDescription("Description") //
-                .withModifiedOn(null) //
-                .withModifiedBy(null) //
-                .build();
-
-        // return input Objective enriched with modified data
-        when(objectivePersistenceService.save(objective)).thenReturn(objective);
-
-        // act
-        Objective savedObjective = objectiveBusinessService.createEntity(objective, authorizationUser);
-
-        // assert
         verify(objectivePersistenceService, times(1)).save(objective);
+        assertEquals(DRAFT, objective.getState());
+        assertEquals(user, objective.getCreatedBy());
+        assertNull(objective.getCreatedOn());
+    }
 
-        // verify enriched with modifiedOn and modifiedBy data
-        assertNotNull(savedObjective.getCreatedOn());
-        assertEquals(authorizationUser.user(), savedObjective.getCreatedBy());
+    @Test
+    void shouldNotThrowResponseStatusExceptionWhenPuttingNullId() {
+        Objective objective1 = Objective.Builder.builder().withId(null).withTitle("Title")
+                .withDescription("Description").withModifiedOn(LocalDateTime.now()).build();
+        when(objectiveBusinessService.createEntity(objective1, authorizationUser)).thenReturn(fullObjective);
+
+        Objective savedObjective = objectiveBusinessService.createEntity(objective1, authorizationUser);
+        assertNull(savedObjective.getId());
+        assertEquals("FullObjective1", savedObjective.getTitle());
+        assertEquals("Bob", savedObjective.getCreatedBy().getFirstname());
     }
 
-    @DisplayName("updateEntity() should handle Quarter correctly")
     @ParameterizedTest
     @ValueSource(booleans = { false, true })
     void updateEntityShouldHandleQuarterCorrectly(boolean hasKeyResultAnyCheckIns) {
-        // arrange
         Long id = 27L;
-        String changedObjectiveTitle = "Changed Objective Title";
-        String savedObjectiveTitle = "Saved Objective Title";
-        String changedObjectiveDescription = "Changed Description";
-        String saveObjectiveDescription = "Saved Description";
-
-        LocalDateTime savedObjectiveCreatedOn = LocalDateTime.of(2024, 1, 1, 11, 11);
-
-        Quarter changedQuarter = Quarter.Builder.builder() //
-                .withId(2L) //
-                .withLabel("another quarter").build();
-
-        Objective changedObjective = Objective.Builder.builder() //
-                .withId(id) //
-                .withTitle(changedObjectiveTitle) // "Changed Objective Title"
-                .withTeam(team1) //
-                .withQuarter(changedQuarter) // quarter with id 2
-                .withDescription(changedObjectiveDescription) // "Changed Description"
+        String title = "Received Objective";
+        String description = "The description";
+        Quarter changedQuarter = Quarter.Builder.builder().withId(2L).withLabel("another quarter").build();
+        Objective savedObjective = Objective.Builder.builder().withId(id).withTitle(title).withTeam(team1)
+                .withQuarter(quarter).withDescription(null).withModifiedOn(null).withModifiedBy(null).build();
+        Objective changedObjective = Objective.Builder.builder().withId(id).withTitle(title).withTeam(team1)
+                .withQuarter(changedQuarter).withDescription(description).withModifiedOn(null).withModifiedBy(null)
                 .build();
+        Objective updatedObjective = Objective.Builder.builder().withId(id).withTitle(title).withTeam(team1)
+                .withQuarter(hasKeyResultAnyCheckIns ? quarter : changedQuarter).withDescription(description)
+                .withModifiedOn(null).withModifiedBy(null).build();
 
-        Objective savedObjectiveInDb = Objective.Builder.builder() //
-                .withId(id) //
-                .withTitle(savedObjectiveTitle) // "Saved Objective Title";
-                .withTeam(team1) //
-                .withQuarter(quarter) // quarter with id 1
-                .withDescription(saveObjectiveDescription) // "Saved Description"
-                .withCreatedOn(savedObjectiveCreatedOn) //
-                .withCreatedBy(user) //
-                .build();
-
-        when(objectivePersistenceService.findById(any())).thenReturn(savedObjectiveInDb);
-        when(keyResultBusinessService.getAllKeyResultsByObjective(savedObjectiveInDb.getId()))
-                .thenReturn(keyResultList);
+        when(objectivePersistenceService.findById(any())).thenReturn(savedObjective);
+        when(keyResultBusinessService.getAllKeyResultsByObjective(savedObjective.getId())).thenReturn(keyResultList);
         when(keyResultBusinessService.hasKeyResultAnyCheckIns(any())).thenReturn(hasKeyResultAnyCheckIns);
+        when(objectivePersistenceService.save(changedObjective)).thenReturn(updatedObjective);
 
-        // return input Objective enriched with data from savedObjectiveInDb
-        when(objectivePersistenceService.save(changedObjective)).thenReturn(changedObjective);
-
-        // act
         boolean isImUsed = objectiveBusinessService.isImUsed(changedObjective);
         Objective updatedEntity = objectiveBusinessService.updateEntity(changedObjective.getId(), changedObjective,
                 authorizationUser);
 
-        // assert
-        assertImUsed(hasKeyResultAnyCheckIns, isImUsed);
-        assertUnchangedData(changedObjectiveDescription, changedObjectiveTitle, updatedEntity);
-        assertChangedData(updatedEntity, savedObjectiveCreatedOn);
-        assertKeyResultDependentData(hasKeyResultAnyCheckIns, savedObjectiveInDb, changedObjective, updatedEntity);
-    }
-
-    private static void assertImUsed(boolean hasKeyResultAnyCheckIns, boolean isImUsed) {
         assertEquals(hasKeyResultAnyCheckIns, isImUsed);
+        assertEquals(hasKeyResultAnyCheckIns ? savedObjective.getQuarter() : changedObjective.getQuarter(),
+                updatedEntity.getQuarter());
+        assertEquals(changedObjective.getDescription(), updatedEntity.getDescription());
+        assertEquals(changedObjective.getTitle(), updatedEntity.getTitle());
     }
 
-    private void assertUnchangedData(String changedObjectiveDescription, String changedObjectiveTitle,
-            Objective updatedEntity) {
-        assertEquals(changedObjectiveDescription, updatedEntity.getDescription());
-        assertEquals(changedObjectiveTitle, updatedEntity.getTitle());
-    }
-
-    private void assertChangedData(Objective updatedEntity, LocalDateTime savedObjectiveCreatedOn) {
-        assertNotNull(updatedEntity.getModifiedOn());
-        assertEquals(authorizationUser.user(), updatedEntity.getModifiedBy());
-        assertEquals(savedObjectiveCreatedOn, updatedEntity.getCreatedOn());
-        assertEquals(user, updatedEntity.getCreatedBy());
-    }
-
-    private void assertKeyResultDependentData(boolean hasKeyResultAnyCheckIns, Objective savedObjectiveInDb,
-            Objective changedObjective, Objective updatedEntity) {
-        Quarter expectedQuarter = hasKeyResultAnyCheckIns ? savedObjectiveInDb.getQuarter()
-                : changedObjective.getQuarter();
-        assertEquals(expectedQuarter, updatedEntity.getQuarter());
-    }
-
-    @DisplayName("deleteEntityById() should delete Objective and associated KeyResults")
     @Test
-    void deleteEntityByIdShouldDeleteObjectiveAndAssociatedKeyResults() {
+    void shouldDeleteObjectiveAndAssociatedKeyResults() {
         when(keyResultBusinessService.getAllKeyResultsByObjective(1L)).thenReturn(keyResultList);
 
         objectiveBusinessService.deleteEntityById(1L);
@@ -221,20 +155,17 @@ void deleteEntityByIdShouldDeleteObjectiveAndAssociatedKeyResults() {
         verify(objectiveBusinessService, times(1)).deleteEntityById(1L);
     }
 
-    @DisplayName("duplicateObjective() should duplicate Objective")
     @Test
-    void duplicateObjectiveShouldDuplicateObjective() {
+    void shouldDuplicateObjective() {
         // arrange
         Objective sourceObjective = Objective.Builder.builder() //
                 .withId(23L) //
                 .withTitle("Objective 1") //
                 .build();
-
         KeyResult keyResultOrdinal = KeyResultOrdinal.Builder.builder() //
                 .withTitle("Ordinal 1") //
                 .withObjective(sourceObjective) //
                 .build();
-
         KeyResult keyResultMetric = KeyResultMetric.Builder.builder() //
                 .withTitle("Metric 1") //
                 .withObjective(sourceObjective) //
@@ -260,68 +191,9 @@ void duplicateObjectiveShouldDuplicateObjective() {
         assertEquals(newObjective.getId(), duplicatedObjective.getId());
         assertEquals(newObjective.getTitle(), duplicatedObjective.getTitle());
 
-        // called when creating the new Objective
+        // called for creating the new Objective
         verify(objectiveBusinessService, times(1)).createEntity(any(), any());
-        // called when creating the new KeyResults
+        // called for creating the new KeyResults
         verify(keyResultBusinessService, times(2)).createEntity(any(), any());
     }
-
-    @DisplayName("isImUsed() should return false when Quarter has not changed")
-    @Test
-    void isImUsedShouldReturnFalseWhenQuarterHasNotChanged() {
-        // arrange
-        Objective objective = Objective.Builder.builder() //
-                .withId(23L) //
-                .withTitle("Objective") //
-                .withQuarter(Quarter.Builder.builder().withLabel("Quarter Label").build()).build();
-
-        when(objectivePersistenceService.findById(anyLong())).thenReturn(objective);
-
-        // act + assert
-        assertFalse(objectiveBusinessService.isImUsed(objective));
-    }
-
-    @DisplayName("isImUsed() should return false when Quarter has changed but no CheckIns are found")
-    @Test
-    void isImUsedShouldReturnFalseWhenQuarterHasChangedButNoCheckinsAreFound() {
-        // arrange
-        Objective sourceObjective = Objective.Builder.builder() //
-                .withId(23L) //
-                .withTitle("Objective") //
-                .withQuarter(Quarter.Builder.builder().withLabel("Source Label").build()).build();
-
-        Objective savedObjectiveWithChangedQuarter = Objective.Builder.builder() //
-                .withId(23L) //
-                .withTitle("Objective") //
-                .withQuarter(Quarter.Builder.builder().withLabel("Saved Label").build()).build();
-
-        when(objectivePersistenceService.findById(anyLong())).thenReturn(savedObjectiveWithChangedQuarter);
-
-        // act + assert
-        assertFalse(objectiveBusinessService.isImUsed(sourceObjective));
-    }
-
-    @DisplayName("isImUsed() should return true when Quarter has changed and CheckIns are found")
-    @Test
-    void isImUsedShouldReturnTrueWhenQuarterHasChangedAndCheckinsAreFound() {
-        // arrange
-        Objective sourceObjective = Objective.Builder.builder() //
-                .withId(23L) //
-                .withTitle("Objective") //
-                .withQuarter(Quarter.Builder.builder().withLabel("Source Label").build()).build();
-
-        Objective savedObjectiveWithChangedQuarter = Objective.Builder.builder() //
-                .withId(23L) //
-                .withTitle("Objective") //
-                .withQuarter(Quarter.Builder.builder().withLabel("Saved Label").build()).build();
-
-        when(objectivePersistenceService.findById(anyLong())).thenReturn(savedObjectiveWithChangedQuarter);
-        when(keyResultBusinessService.getAllKeyResultsByObjective(savedObjectiveWithChangedQuarter.getId()))
-                .thenReturn(keyResultList);
-        when(keyResultBusinessService.hasKeyResultAnyCheckIns(any())).thenReturn(true);
-
-        // act + assert
-        assertTrue(objectiveBusinessService.isImUsed(sourceObjective));
-    }
-
 }
diff --git a/backend/src/test/java/ch/puzzle/okr/service/business/OrganisationBusinessServiceTest.java b/backend/src/test/java/ch/puzzle/okr/service/business/OrganisationBusinessServiceTest.java
deleted file mode 100644
index 6ef6969e60..0000000000
--- a/backend/src/test/java/ch/puzzle/okr/service/business/OrganisationBusinessServiceTest.java
+++ /dev/null
@@ -1,100 +0,0 @@
-package ch.puzzle.okr.service.business;
-
-import ch.puzzle.okr.mapper.CnAttributesMapper;
-import ch.puzzle.okr.models.Organisation;
-import ch.puzzle.okr.models.OrganisationState;
-import ch.puzzle.okr.service.persistence.OrganisationPersistenceService;
-import org.junit.jupiter.api.BeforeEach;
-import org.junit.jupiter.api.Test;
-import org.junit.jupiter.api.extension.ExtendWith;
-import org.mockito.InjectMocks;
-import org.mockito.Mock;
-import org.mockito.Spy;
-import org.mockito.junit.jupiter.MockitoExtension;
-import org.springframework.ldap.core.LdapTemplate;
-import org.springframework.ldap.query.LdapQuery;
-
-import java.util.ArrayList;
-import java.util.List;
-
-import static org.junit.jupiter.api.Assertions.assertFalse;
-import static org.junit.jupiter.api.Assertions.assertTrue;
-import static org.mockito.ArgumentMatchers.any;
-import static org.mockito.Mockito.*;
-
-@ExtendWith(MockitoExtension.class)
-class OrganisationBusinessServiceTest {
-
-    private static final List<String> listOfOrgNames = new ArrayList<>();
-
-    private static final List<Organisation> organisationDbMock = new ArrayList<>();
-
-    private static final Organisation organisationOne = Organisation.Builder.builder().withId(1L).withOrgName("org_one")
-            .withState(OrganisationState.ACTIVE).build();
-    private static final Organisation organisationTwo = Organisation.Builder.builder().withId(2L).withOrgName("org_two")
-            .withState(OrganisationState.ACTIVE).build();
-    private static final Organisation organisationThree = Organisation.Builder.builder().withId(2L)
-            .withOrgName("org_three").withState(OrganisationState.ACTIVE).build();
-
-    private static final Organisation organisationInActive = Organisation.Builder.builder().withId(2L)
-            .withOrgName("org_in_active").withState(OrganisationState.INACTIVE).build();
-
-    @Mock
-    LdapTemplate ldapTemplate;
-
-    @Mock
-    CnAttributesMapper cnAttributesMapper;
-
-    @Mock
-    OrganisationPersistenceService organisationPersistenceService;
-
-    @InjectMocks
-    @Spy
-    OrganisationBusinessService organisationBusinessService;
-
-    @BeforeEach
-    void prepareLists() {
-        listOfOrgNames.addAll(List.of("org_one", "org_two"));
-        organisationDbMock.addAll(List.of(organisationOne, organisationTwo, organisationThree));
-    }
-
-    @Test
-    void shouldRemoveEmptyEntriesOfList() {
-        when(ldapTemplate.search(any(LdapQuery.class), any(CnAttributesMapper.class))).thenReturn(listOfOrgNames);
-        when(organisationPersistenceService.findAll()).thenReturn(organisationDbMock);
-        organisationBusinessService.importOrgFromLDAP();
-        verify(organisationPersistenceService, atLeast(1)).saveIfNotExists(
-                Organisation.Builder.builder().withOrgName("org_one").withState(OrganisationState.ACTIVE).build());
-        verify(organisationPersistenceService, atLeast(1)).saveIfNotExists(
-                Organisation.Builder.builder().withOrgName("org_two").withState(OrganisationState.ACTIVE).build());
-        verify(organisationPersistenceService, atLeast(2)).saveIfNotExists(any());
-        verify(organisationPersistenceService, atLeast(1)).updateOrganisationStateToInactive("org_three");
-        verify(organisationPersistenceService, atLeast(1)).updateOrganisationStateToInactive(anyString());
-    }
-
-    @Test
-    void getAllOrganisations() {
-        organisationBusinessService.getActiveOrganisations();
-        verify(organisationPersistenceService, times(1)).getActiveOrganisations();
-    }
-
-    @Test
-    void getOrganisationsByTeamId() {
-        organisationBusinessService.getOrganisationsByTeam(1L);
-        verify(organisationPersistenceService, times(1)).getOrganisationsByTeamId(1L);
-    }
-
-    @Test
-    void teamHasInActiveOrganisations() {
-        when(organisationPersistenceService.getOrganisationsByTeamId(anyLong()))
-                .thenReturn(List.of(organisationInActive, organisationOne, organisationTwo));
-        assertTrue(organisationBusinessService.teamHasInActiveOrganisations(1L));
-    }
-
-    @Test
-    void teamHasNoInActiveOrganisations() {
-        when(organisationPersistenceService.getOrganisationsByTeamId(anyLong()))
-                .thenReturn(List.of(organisationOne, organisationTwo, organisationThree));
-        assertFalse(organisationBusinessService.teamHasInActiveOrganisations(1L));
-    }
-}
diff --git a/backend/src/test/java/ch/puzzle/okr/service/business/OverviewBusinessServiceTest.java b/backend/src/test/java/ch/puzzle/okr/service/business/OverviewBusinessServiceTest.java
index 48515d6192..546a65df47 100644
--- a/backend/src/test/java/ch/puzzle/okr/service/business/OverviewBusinessServiceTest.java
+++ b/backend/src/test/java/ch/puzzle/okr/service/business/OverviewBusinessServiceTest.java
@@ -6,12 +6,8 @@
 import ch.puzzle.okr.models.overview.OverviewId;
 import ch.puzzle.okr.service.persistence.OverviewPersistenceService;
 import ch.puzzle.okr.service.validation.OverviewValidationService;
-import org.junit.jupiter.api.DisplayName;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.extension.ExtendWith;
-import org.junit.jupiter.params.ParameterizedTest;
-import org.junit.jupiter.params.provider.Arguments;
-import org.junit.jupiter.params.provider.MethodSource;
 import org.mockito.InjectMocks;
 import org.mockito.Mock;
 import org.mockito.junit.jupiter.MockitoExtension;
@@ -21,7 +17,6 @@
 import java.time.LocalDateTime;
 import java.util.ArrayList;
 import java.util.List;
-import java.util.stream.Stream;
 
 import static ch.puzzle.okr.test.OverviewTestHelper.QUARTER_ID;
 import static ch.puzzle.okr.test.OverviewTestHelper.teamIds;
@@ -48,62 +43,40 @@ class OverviewBusinessServiceTest {
     @Mock
     OverviewValidationService overviewValidationService;
 
-    private static final LocalDateTime jan = LocalDateTime.of(2024, 1, 1, 0, 0);
-    private static final LocalDateTime july = LocalDateTime.of(2024, 7, 7, 0, 0);
-
     private static List<Overview> createOverviews() {
         return createOverviews(authorizationUser);
     }
 
-    private static List<Overview> createOverviews(AuthorizationUser user) {
+    private static List<Overview> createOverviews(AuthorizationUser authorizationUser) {
         long index = 1L;
-        List<Overview> overviews = new ArrayList<>();
-        for (Long teamId : user.firstLevelTeamIds()) {
-            overviews.addAll((List.of( //
-                    Overview.Builder.builder() //
-                            .withOverviewId(OverviewId.Builder.builder() //
-                                    .withObjectiveId(index++) //
-                                    .withTeamId(teamId).build()) //
-                            .withObjectiveTitle("ZZZ Objective") //
-                            .withTeamName("firstLevelTeam-" + teamId) //
-                            .withObjectiveCreatedOn(LocalDateTime.of(2023, 12, 10, 18, 33)) //
-                            .build(),
-                    Overview.Builder.builder() //
-                            .withOverviewId(OverviewId.Builder.builder() //
-                                    .withObjectiveId(index++) //
-                                    .withTeamId(teamId) //
-                                    .build()) //
-                            .withObjectiveTitle("AAA Objective") //
-                            .withTeamName("firstLevelTeam-" + teamId) //
-                            .withObjectiveCreatedOn(LocalDateTime.of(2023, 9, 10, 18, 33)) //
-                            .build(),
-                    Overview.Builder.builder() //
-                            .withOverviewId(OverviewId.Builder.builder() //
-                                    .withObjectiveId(index++) //
-                                    .withTeamId(teamId).build()) //
-                            .withObjectiveTitle("AAA Objective") //
-                            .withTeamName("firstLevelTeam-" + teamId) //
-                            .withObjectiveCreatedOn(LocalDateTime.of(2023, 9, 10, 18, 33)) //
-                            .build())));
-        }
-        for (Long teamId : user.userTeamIds()) {
-            overviews.addAll(List.of( //
-                    Overview.Builder.builder() //
-                            .withOverviewId(OverviewId.Builder.builder() //
-                                    .withObjectiveId(index++) //
-                                    .withTeamId(teamId).build()) //
-                            .withObjectiveTitle("CCC Objective") //
-                            .withTeamName("team-" + teamId) //
-                            .withObjectiveCreatedOn(LocalDateTime.of(2023, 10, 21, 18, 33)) //
-                            .build(),
-                    Overview.Builder.builder() //
-                            .withOverviewId(OverviewId.Builder.builder() //
-                                    .withObjectiveId(index++) //
-                                    .withTeamId(teamId).build()) //
-                            .withObjectiveTitle("BBB Objective") //
-                            .withTeamName("team-" + teamId) //
-                            .withObjectiveCreatedOn(LocalDateTime.of(2023, 10, 1, 8, 53)) //
-                            .build()));
+        List<Overview> overviews = new ArrayList<>(List.of(
+                Overview.Builder.builder()
+                        .withOverviewId(OverviewId.Builder.builder().withObjectiveId(index++).withTeamId(111L).build())
+                        .withObjectiveTitle("Another Team Objective A").withTeamName("team-111")
+                        .withObjectiveCreatedOn(LocalDateTime.of(2023, 10, 21, 18, 33)).build(),
+                Overview.Builder.builder()
+                        .withOverviewId(OverviewId.Builder.builder().withObjectiveId(index++).withTeamId(222L).build())
+                        .withObjectiveTitle("Another Team Objective B").withTeamName("team-222")
+                        .withObjectiveCreatedOn(LocalDateTime.of(2023, 10, 1, 8, 53)).build()));
+
+        for (Long teamId : authorizationUser.extractTeamIds()) {
+            overviews
+                    .addAll((List.of(
+                            Overview.Builder.builder()
+                                    .withOverviewId(OverviewId.Builder.builder().withObjectiveId(index++)
+                                            .withTeamId(teamId).build())
+                                    .withObjectiveTitle("ZZZ Objective").withTeamName("firstLevelTeam-" + teamId)
+                                    .withObjectiveCreatedOn(LocalDateTime.of(2023, 12, 10, 18, 33)).build(),
+                            Overview.Builder.builder()
+                                    .withOverviewId(OverviewId.Builder.builder().withObjectiveId(index++)
+                                            .withTeamId(teamId).build())
+                                    .withObjectiveTitle("AAA Objective").withTeamName("firstLevelTeam-" + teamId)
+                                    .withObjectiveCreatedOn(LocalDateTime.of(2023, 9, 10, 18, 33)).build(),
+                            Overview.Builder.builder()
+                                    .withOverviewId(OverviewId.Builder.builder().withObjectiveId(index++)
+                                            .withTeamId(teamId).build())
+                                    .withObjectiveTitle("AAA Objective").withTeamName("firstLevelTeam-" + teamId)
+                                    .withObjectiveCreatedOn(LocalDateTime.of(2023, 9, 10, 18, 33)).build())));
         }
         return overviews;
     }
@@ -169,70 +142,48 @@ void getFilteredOverviewShouldReturnExceptionWhenQuarterIdIsNonExistent() {
     }
 
     @Test
-    void getFilteredOverviewShouldReturnSortedListFirstLevelTeamFirst() {
-        Long firstLevelTeamId = 9L;
-        AuthorizationUser user = mockAuthorizationUser(defaultUser(13L), List.of(firstLevelTeamId, 2L),
-                firstLevelTeamId, List.of());
-        when(overviewPersistenceService.getFilteredOverview(QUARTER_ID, teamIds, null, user))
-                .thenReturn(createOverviews(user));
+    void getFilteredOverviewShouldReturnExceptionWhenTeamIdIsNonExistent() {
+        doThrow(new ResponseStatusException(HttpStatus.NOT_FOUND)).when(overviewValidationService)
+                .validateOnGet(QUARTER_ID, teamIds);
 
-        List<Overview> overviews = overviewBusinessService.getFilteredOverview(QUARTER_ID, teamIds, null, user);
+        assertThrows(ResponseStatusException.class,
+                () -> overviewBusinessService.getFilteredOverview(QUARTER_ID, teamIds, "", authorizationUser));
 
-        assertThat(List.of(OverviewId.of(firstLevelTeamId, 2L, null, null),
-                OverviewId.of(firstLevelTeamId, 3L, null, null), OverviewId.of(firstLevelTeamId, 1L, null, null),
-                OverviewId.of(firstLevelTeamId, 5L, null, null), OverviewId.of(firstLevelTeamId, 4L, null, null),
-                OverviewId.of(2L, 7L, null, null), OverviewId.of(2L, 6L, null, null)))
-                        .hasSameElementsAs(getOverviewIds(overviews));
+        verify(quarterBusinessService, never()).getCurrentQuarter();
+        verify(overviewValidationService, never()).validateQuarter(QUARTER_ID);
+        verify(overviewValidationService, times(1)).validateOnGet(QUARTER_ID, teamIds);
+        verify(overviewPersistenceService, never()).getFilteredOverview(anyLong(), anyList(), any(),
+                eq(authorizationUser));
     }
 
-    private List<OverviewId> getOverviewIds(List<Overview> overviews) {
-        return overviews.stream().map(Overview::getOverviewId).toList();
-    }
+    @Test
+    void getFilteredOverviewShouldThrowExceptionWhenTeamIdIsNonExistent() {
+        doThrow(new ResponseStatusException(HttpStatus.NOT_FOUND)).when(overviewValidationService)
+                .validateOnGet(QUARTER_ID, teamIds);
+        assertThrows(ResponseStatusException.class,
+                () -> overviewBusinessService.getFilteredOverview(QUARTER_ID, teamIds, "", authorizationUser));
 
-    private static Stream<Arguments> generateTestOverviews() {
-        return Stream.of(
-                // matching userTeams and firstLevelTeams
-                Arguments.of(of("team 1", jan), of("team 1", jan), false, false, true, true, 0),
-                Arguments.of(of("team 1", jan), of("team 1", july), false, false, true, true, -6),
-                Arguments.of(of("team 1", jan), of("team 2", july), false, false, true, true, -1),
+        verify(quarterBusinessService, never()).getCurrentQuarter();
+        verify(overviewValidationService, times(1)).validateOnGet(QUARTER_ID, teamIds);
+        verify(overviewPersistenceService, never()).getFilteredOverview(anyLong(), anyList(), anyString(),
+                eq(authorizationUser));
+    }
 
-                // matching userTeams but non-matching firstLevelTeams
-                Arguments.of(of("team 1", jan), of("team 2", july), false, false, true, false, -1),
-                Arguments.of(of("team 1", jan), of("team 2", july), false, false, false, true, 1),
+    @Test
+    void getFilteredOverviewShouldReturnSortedListUserTeamsFirst() {
+        Long firstLevelTeamId = 5L;
+        AuthorizationUser user = mockAuthorizationUser(defaultUser(13L));
+        when(overviewPersistenceService.getFilteredOverview(QUARTER_ID, teamIds, null, user))
+                .thenReturn(createOverviews(user));
 
-                // non-matching userTeams
-                Arguments.of(of("team 1", jan), of("team 2", july), true, false, false, false, -1),
-                Arguments.of(of("team 1", jan), of("team 2", july), false, true, true, true, 1));
-    }
+        List<Overview> overviews = overviewBusinessService.getFilteredOverview(QUARTER_ID, teamIds, null, user);
 
-    private static Overview of(String teamName, LocalDateTime createdOn) {
-        return Overview.Builder.builder() //
-                .withOverviewId(OverviewId.Builder.builder() //
-                        .withTeamId((long) 1) //
-                        .withObjectiveId((long) 1) //
-                        .withKeyResultId((long) 1) //
-                        .withCheckInId((long) 1).build())
-                .withTeamName(teamName) //
-                .withObjectiveCreatedOn(createdOn).build();
+        assertThat(List.of(OverviewId.of(1L, 4L, null, null), OverviewId.of(1L, 5L, null, null),
+                OverviewId.of(1L, 3L, null, null), OverviewId.of(111L, 1L, null, null),
+                OverviewId.of(222L, 2L, null, null))).hasSameElementsAs(getOverviewIds(overviews));
     }
 
-    @DisplayName("compare() should sort Overviews")
-    @ParameterizedTest
-    @MethodSource("generateTestOverviews")
-    void compareShouldSortOverviews(Overview o1, Overview o2, //
-            boolean containsUserTeam1, boolean containsUserTeam2, boolean containsFirstLevelTeam1,
-            boolean containsFirstLevelTeam2, //
-            int expectedResult) {
-        // arrange
-        OverviewBusinessService.OverviewComparator overviewComparator = new OverviewBusinessService.OverviewComparator(
-                null);
-
-        // act
-        int compareResult = overviewComparator.compare(o1, o2, containsUserTeam1, containsUserTeam2,
-                containsFirstLevelTeam1, containsFirstLevelTeam2);
-
-        // assert
-        assertEquals(expectedResult, compareResult);
+    private List<OverviewId> getOverviewIds(List<Overview> overviews) {
+        return overviews.stream().map(Overview::getOverviewId).toList();
     }
-
 }
diff --git a/backend/src/test/java/ch/puzzle/okr/service/business/QuarterBusinessServiceTest.java b/backend/src/test/java/ch/puzzle/okr/service/business/QuarterBusinessServiceTest.java
index c931679c21..479620ad3d 100644
--- a/backend/src/test/java/ch/puzzle/okr/service/business/QuarterBusinessServiceTest.java
+++ b/backend/src/test/java/ch/puzzle/okr/service/business/QuarterBusinessServiceTest.java
@@ -9,16 +9,25 @@
 import org.junit.jupiter.params.provider.Arguments;
 import org.junit.jupiter.params.provider.MethodSource;
 import org.junit.jupiter.params.provider.ValueSource;
-import org.mockito.*;
+import org.mockito.InjectMocks;
+import org.mockito.Mock;
+import org.mockito.Mockito;
+import org.mockito.Spy;
 import org.mockito.junit.jupiter.MockitoExtension;
 import org.springframework.test.util.ReflectionTestUtils;
 
 import java.time.LocalDate;
 import java.time.YearMonth;
-import java.util.*;
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.List;
+import java.util.Map;
 import java.util.stream.Stream;
 
-import static org.junit.jupiter.api.Assertions.*;
+import static ch.puzzle.okr.Constants.BACK_LOG_QUARTER_LABEL;
+import static ch.puzzle.okr.test.TestConstants.BACK_LOG_QUARTER_ID;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNull;
 import static org.mockito.Mockito.*;
 
 @ExtendWith(MockitoExtension.class)
@@ -71,13 +80,14 @@ void shouldGetBacklogQuarter() {
                 .withStartDate(LocalDate.of(2022, 8, 1)).withEndDate(LocalDate.of(2022, 11, 30)).build();
         List<Quarter> quarterList = new ArrayList<>(Arrays.asList(realQuarter1, realQuarter2));
 
-        Quarter backlogQuarter = Quarter.Builder.builder().withId(199L).withLabel("Backlog").build();
+        Quarter backlogQuarter = Quarter.Builder.builder().withId(BACK_LOG_QUARTER_ID).withLabel(BACK_LOG_QUARTER_LABEL)
+                .build();
         when(quarterPersistenceService.getMostCurrentQuarters()).thenReturn(quarterList);
-        when(quarterPersistenceService.findByLabel("Backlog")).thenReturn(backlogQuarter);
+        when(quarterPersistenceService.findByLabel(BACK_LOG_QUARTER_LABEL)).thenReturn(backlogQuarter);
 
         quarterList = quarterBusinessService.getQuarters();
         assertEquals(3, quarterList.size());
-        assertEquals("Backlog", quarterList.get(0).getLabel());
+        assertEquals(BACK_LOG_QUARTER_LABEL, quarterList.get(0).getLabel());
         assertNull(quarterList.get(0).getStartDate());
         assertNull(quarterList.get(0).getEndDate());
     }
diff --git a/backend/src/test/java/ch/puzzle/okr/service/business/TeamBusinessServiceTest.java b/backend/src/test/java/ch/puzzle/okr/service/business/TeamBusinessServiceTest.java
index 68ddbba036..e5586543ec 100644
--- a/backend/src/test/java/ch/puzzle/okr/service/business/TeamBusinessServiceTest.java
+++ b/backend/src/test/java/ch/puzzle/okr/service/business/TeamBusinessServiceTest.java
@@ -1,11 +1,16 @@
 package ch.puzzle.okr.service.business;
 
+import ch.puzzle.okr.ErrorKey;
+import ch.puzzle.okr.exception.OkrResponseStatusException;
 import ch.puzzle.okr.models.Objective;
 import ch.puzzle.okr.models.Team;
 import ch.puzzle.okr.models.User;
+import ch.puzzle.okr.models.UserTeam;
 import ch.puzzle.okr.models.authorization.AuthorizationUser;
 import ch.puzzle.okr.service.CacheService;
 import ch.puzzle.okr.service.persistence.TeamPersistenceService;
+import ch.puzzle.okr.service.persistence.UserPersistenceService;
+import ch.puzzle.okr.service.persistence.UserTeamPersistenceService;
 import ch.puzzle.okr.service.validation.TeamValidationService;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
@@ -19,14 +24,11 @@
 import java.util.ArrayList;
 import java.util.List;
 
-import static ch.puzzle.okr.test.TestHelper.defaultAuthorizationUser;
-import static ch.puzzle.okr.test.TestHelper.defaultUser;
+import static ch.puzzle.okr.test.TestHelper.*;
 import static ch.puzzle.okr.models.State.DRAFT;
 import static ch.puzzle.okr.models.State.SUCCESSFUL;
-import static ch.puzzle.okr.models.authorization.AuthorizationRole.*;
 import static org.assertj.core.api.Assertions.assertThat;
-import static org.junit.jupiter.api.Assertions.assertEquals;
-import static org.mockito.ArgumentMatchers.any;
+import static org.junit.jupiter.api.Assertions.*;
 import static org.mockito.Mockito.*;
 
 @ExtendWith(MockitoExtension.class)
@@ -35,6 +37,7 @@ class TeamBusinessServiceTest {
     TeamPersistenceService teamPersistenceService = Mockito.mock(TeamPersistenceService.class);
     Team team1;
     Team team2;
+    Team team3;
     Team teamWithIdNull;
 
     Objective objective;
@@ -47,6 +50,13 @@ class TeamBusinessServiceTest {
 
     @Mock
     ObjectiveBusinessService objectiveBusinessService;
+
+    @Mock
+    UserPersistenceService userPersistenceService;
+
+    @Mock
+    UserTeamPersistenceService userTeamPersistenceService;
+
     @InjectMocks
     private TeamValidationService validator = Mockito.mock(TeamValidationService.class);
     @InjectMocks
@@ -55,13 +65,20 @@ class TeamBusinessServiceTest {
     @BeforeEach
     void setUp() {
         this.team1 = Team.Builder.builder().withId(1L).withName("Team 1").build();
+        this.team1.setUserTeamList(List.of(
+                UserTeam.Builder.builder().withTeam(team1).withUser(defaultUser(2L)).withTeamAdmin(true).build(),
+                UserTeam.Builder.builder().withTeam(team1).withUser(defaultUser(3L)).withTeamAdmin(false).build()));
         this.team2 = Team.Builder.builder().withId(2L).withName("Team 2").build();
+        this.team2.setUserTeamList(List.of(
+                UserTeam.Builder.builder().withTeam(team2).withUser(defaultUser(4L)).withTeamAdmin(true).build(),
+                UserTeam.Builder.builder().withTeam(team2).withUser(defaultUser(5L)).withTeamAdmin(true).build()));
+        this.team3 = Team.Builder.builder().withId(3L).withName("Team 3").build();
+        this.team3.setUserTeamList(List.of());
         this.teamWithIdNull = Team.Builder.builder().withName("Team with id null").build();
         this.objective = Objective.Builder.builder().withId(5L).withTitle("Objective 1").withState(DRAFT).build();
         this.objectiveCompleted = Objective.Builder.builder().withId(6L).withTitle("Objective 1").withState(SUCCESSFUL)
                 .build();
         this.objectiveList = List.of(objective, objective, objective, objectiveCompleted);
-
     }
 
     @Test
@@ -84,39 +101,43 @@ void getAllTeamsShouldBeSuccessful() {
     }
 
     @Test
-    void getAllTeamsSortedShouldReturnSortedListFirstLevelTeamsFirst() {
-        Team firstLevelTeam1 = Team.Builder.builder().withId(9L).withName("GLTEAM1").withVersion(1).build();
-        Team firstLevelTeam2 = Team.Builder.builder().withId(5L).withName("GLTEAM2").withVersion(1).build();
+    void getAllTeamsSortedShouldReturnSortedListUserTeamsFirst() {
         Team userTeam = Team.Builder.builder().withId(1L).withName("UserTeam").withVersion(1).build();
         Team notUserTeam = Team.Builder.builder().withId(2L).withName("NOTUserTeam").withVersion(1).build();
-        List<Team> teams = List.of(firstLevelTeam1, firstLevelTeam2, userTeam, notUserTeam);
-        List<Long> userTeamIds = List.of(1L);
-        List<Long> firstLevelTeamIds = List.of(9L, 5L);
+        Team notUserTeam2 = Team.Builder.builder().withId(3L).withName("NOTUserTeam2").withVersion(1).build();
+        List<Team> teams = List.of(notUserTeam, userTeam, notUserTeam2);
         User user = defaultUser(13L);
-        AuthorizationUser authUser = new AuthorizationUser(
-                User.Builder.builder().withId(user.getId()).withUsername(user.getUsername())
-                        .withFirstname(user.getFirstname()).withLastname(user.getLastname()).withEmail(user.getEmail())
-                        .build(),
-                userTeamIds, firstLevelTeamIds, List.of(READ_ALL_PUBLISHED, READ_ALL_DRAFT, WRITE_ALL));
+        List<UserTeam> userTeamList = List
+                .of(UserTeam.Builder.builder().withUser(user).withTeam(userTeam).withId(1L).build());
+        AuthorizationUser authUser = new AuthorizationUser(User.Builder.builder().withId(user.getId())
+                .withFirstname(user.getFirstname()).withLastname(user.getLastname()).withEmail(user.getEmail())
+                .withUserTeamList(userTeamList).build());
         when(teamPersistenceService.findAll()).thenReturn(teams);
 
         List<Team> sortedList = teamBusinessService.getAllTeams(authUser);
-        assertEquals(List.of(userTeam, firstLevelTeam1, firstLevelTeam2, notUserTeam), sortedList);
+        assertEquals(List.of(userTeam, notUserTeam, notUserTeam2), sortedList);
     }
 
     @Test
-    void shouldSaveANewTeam() {
-        Team team = Team.Builder.builder().withName("OKR-TEAM").withAuthorizationOrganisation(new ArrayList<>())
-                .build();
-        teamBusinessService.createTeam(team);
+    void shouldSaveANewTeam_shouldSetCurrentUserAsAdmin() {
+        Team team = Team.Builder.builder().withName("OKR-TEAM").withId(2L).build();
+        var user = defaultUserWithTeams(1L, List.of(), List.of());
+
+        when(teamPersistenceService.save(team)).thenReturn(team);
+        when(teamPersistenceService.findById(team.getId())).thenReturn(team);
+
+        teamBusinessService.createTeam(team, new AuthorizationUser(user));
+
         verify(teamPersistenceService, times(1)).save(team);
         verify(cacheService, times(1)).emptyAuthorizationUsersCache();
+        assertEquals(user.getUserTeamList().size(), 1);
+        assertEquals(user.getUserTeamList().get(0).getTeam().getId(), team.getId());
+        assertTrue(user.getUserTeamList().get(0).isTeamAdmin());
     }
 
     @Test
     void shouldUpdateTeam() {
-        Team team = Team.Builder.builder().withId(1L).withName("OKR-TEAM")
-                .withAuthorizationOrganisation(new ArrayList<>()).build();
+        Team team = Team.Builder.builder().withId(1L).withName("OKR-TEAM").build();
         teamBusinessService.updateTeam(team, team.getId());
         verify(teamPersistenceService, times(1)).save(team);
         verify(cacheService, times(1)).emptyAuthorizationUsersCache();
@@ -124,11 +145,119 @@ void shouldUpdateTeam() {
 
     @Test
     void shouldDeleteTeamAndItsObjectives() {
-        when(objectiveBusinessService.getEntitiesByTeamId(1L)).thenReturn(objectiveList);
-        teamBusinessService.deleteTeam(1L);
+        var team = defaultTeam(1L);
+        team.setUserTeamList(
+                List.of(UserTeam.Builder.builder().withTeam(team).withUser(new User()).withId(1L).build()));
+        when(objectiveBusinessService.getEntitiesByTeamId(team.getId())).thenReturn(objectiveList);
+        when(teamPersistenceService.findById(team.getId())).thenReturn(team);
 
-        verify(teamPersistenceService, times(1)).deleteById(1L);
+        teamBusinessService.deleteTeam(team.getId());
+
+        verify(teamPersistenceService, times(1)).deleteById(team.getId());
         verify(objectiveBusinessService, times(objectiveList.size())).deleteEntityById(anyLong());
+        verify(cacheService, times(2)).emptyAuthorizationUsersCache();
+    }
+
+    @Test
+    void addUsersToTeam_shouldAddUsersCorrectly() {
+        var teamId = 1L;
+        var userIds = List.of(1L, 2L);
+
+        var user1 = defaultUserWithTeams(1L, new ArrayList<>(), new ArrayList<>());
+        var user2 = defaultUserWithTeams(2L, new ArrayList<>(), new ArrayList<>());
+
+        when(teamPersistenceService.findById(teamId)).thenReturn(defaultTeam(teamId));
+        when(userPersistenceService.findById(userIds.get(0))).thenReturn(user1);
+        when(userPersistenceService.findById(userIds.get(1))).thenReturn(user2);
+
+        teamBusinessService.addUsersToTeam(teamId, userIds);
+
+        var user1Teamids = user1.getUserTeamList().stream().map(ut -> ut.getTeam().getId()).toList();
+        assertTrue(user1Teamids.contains(teamId));
+
+        var user2Teamids = user2.getUserTeamList().stream().map(ut -> ut.getTeam().getId()).toList();
+        assertTrue(user2Teamids.contains(teamId));
+
+        assertFalse(user1Teamids.contains(3L));
+        assertFalse(user2Teamids.contains(3L));
+    }
+
+    @Test
+    void removeUserFromTeam_shouldRemoveUser() {
+        var user = defaultUserWithTeams(1L, List.of(team1), List.of(team2, team3));
+        when(userPersistenceService.findById(user.getId())).thenReturn(user);
+        when(teamPersistenceService.findById(team2.getId())).thenReturn(team2);
+        team2.setUserTeamList(new ArrayList<>(team2.getUserTeamList()));
+
+        teamBusinessService.removeUserFromTeam(team2.getId(), user.getId());
+        assertEquals(2, user.getUserTeamList().size());
+        assertEquals(user.getUserTeamList().stream().map(ut -> ut.getTeam().getId()).toList(),
+                List.of(team1.getId(), team3.getId()));
         verify(cacheService, times(1)).emptyAuthorizationUsersCache();
     }
+
+    @Test
+    void removeUserFromTeam_shouldThrowExceptionWhenNoTeamFound() {
+        var user = defaultUserWithTeams(1L, List.of(team1), List.of(team3));
+        when(userPersistenceService.findById(user.getId())).thenReturn(user);
+        when(teamPersistenceService.findById(team1.getId())).thenReturn(team1);
+
+        assertThrows(RuntimeException.class, () -> teamBusinessService.removeUserFromTeam(team2.getId(), user.getId()));
+    }
+
+    @Test
+    void removeUserFromTeam_shouldThrowExceptionWhenLastAdminShouldBeRemoved() {
+        var user = defaultUserWithTeams(2L, List.of(team1), List.of(team3));
+        when(userPersistenceService.findById(user.getId())).thenReturn(user);
+        when(teamPersistenceService.findById(team1.getId())).thenReturn(team1);
+
+        assertThrows(OkrResponseStatusException.class,
+                () -> teamBusinessService.removeUserFromTeam(team1.getId(), user.getId()),
+                ErrorKey.TRIED_TO_DELETE_LAST_ADMIN.toString());
+    }
+
+    @Test
+    void updateOrAddTeamMembership_shouldUpdateIfTeamFound() {
+        var user = defaultUserWithTeams(1L, List.of(team1), List.of(team2, team3));
+        when(userPersistenceService.findById(user.getId())).thenReturn(user);
+        teamBusinessService.updateOrAddTeamMembership(team2.getId(), user.getId(), true);
+        assertTrue(user.getUserTeamList().get(0).isTeamAdmin());
+        assertTrue(user.getUserTeamList().get(1).isTeamAdmin());
+        assertFalse(user.getUserTeamList().get(2).isTeamAdmin());
+        verify(cacheService, times(1)).emptyAuthorizationUsersCache();
+    }
+
+    @Test
+    void updateOrAddTeamMembership_shouldThrowExceptionIfLastAdminShouldBeRemoved() {
+        var user = defaultUserWithTeams(1L, List.of(team1), List.of());
+        team1.setUserTeamList(new ArrayList<>(user.getUserTeamList()));
+
+        when(userPersistenceService.findById(user.getId())).thenReturn(user);
+
+        assertThrows(OkrResponseStatusException.class,
+                () -> teamBusinessService.updateOrAddTeamMembership(team1.getId(), user.getId(), false));
+    }
+
+    @Test
+    void updateOrAddTeamMembership_shouldAddTeamIfNoTeamFound() {
+        var user = defaultUserWithTeams(1L, List.of(), List.of(team2));
+        when(userPersistenceService.findById(user.getId())).thenReturn(user);
+        when(teamPersistenceService.findById(team1.getId())).thenReturn(team1);
+        when(teamPersistenceService.findById(team3.getId())).thenReturn(team3);
+
+        teamBusinessService.updateOrAddTeamMembership(team1.getId(), user.getId(), true);
+        teamBusinessService.updateOrAddTeamMembership(team3.getId(), user.getId(), false);
+
+        assertFalse(user.getUserTeamList().get(0).isTeamAdmin());
+        assertEquals(user.getUserTeamList().get(0).getTeam().getId(), team2.getId());
+
+        assertTrue(user.getUserTeamList().get(1).isTeamAdmin());
+        assertEquals(user.getUserTeamList().get(1).getTeam().getId(), team1.getId());
+
+        assertFalse(user.getUserTeamList().get(2).isTeamAdmin());
+        assertEquals(user.getUserTeamList().get(2).getTeam().getId(), team3.getId());
+
+        assertEquals(user.getUserTeamList().size(), 3);
+        verify(cacheService, times(2)).emptyAuthorizationUsersCache();
+    }
 }
diff --git a/backend/src/test/java/ch/puzzle/okr/service/business/UserBusinessServiceTest.java b/backend/src/test/java/ch/puzzle/okr/service/business/UserBusinessServiceTest.java
index 53feb7098e..29eb1f74af 100644
--- a/backend/src/test/java/ch/puzzle/okr/service/business/UserBusinessServiceTest.java
+++ b/backend/src/test/java/ch/puzzle/okr/service/business/UserBusinessServiceTest.java
@@ -1,6 +1,9 @@
 package ch.puzzle.okr.service.business;
 
+import ch.puzzle.okr.test.TestHelper;
+import ch.puzzle.okr.exception.OkrResponseStatusException;
 import ch.puzzle.okr.models.User;
+import ch.puzzle.okr.service.CacheService;
 import ch.puzzle.okr.service.persistence.UserPersistenceService;
 import ch.puzzle.okr.service.validation.UserValidationService;
 import org.assertj.core.api.Assertions;
@@ -17,9 +20,9 @@
 import java.util.Arrays;
 import java.util.List;
 
-import static org.junit.jupiter.api.Assertions.assertEquals;
-import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.junit.jupiter.api.Assertions.*;
 import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.Mockito.*;
 
 @ExtendWith(MockitoExtension.class)
 class UserBusinessServiceTest {
@@ -27,17 +30,19 @@ class UserBusinessServiceTest {
     UserPersistenceService userPersistenceService;
     @Mock
     UserValidationService validationService;
+    @Mock
+    CacheService cacheService;
     List<User> userList;
     @InjectMocks
     private UserBusinessService userBusinessService;
 
     @BeforeEach
     void setUp() {
-        User userAlice = User.Builder.builder().withId(2L).withUsername("awunderland").withFirstname("Alice")
-                .withLastname("Wunderland").withEmail("wunderland@puzzle.ch").build();
+        User userAlice = User.Builder.builder().withId(2L).withFirstname("Alice").withLastname("Wunderland")
+                .withEmail("wunderland@puzzle.ch").build();
 
-        User userBob = User.Builder.builder().withId(9L).withUsername("bbaumeister").withFirstname("Bob")
-                .withLastname("Baumeister").withEmail("baumeister@puzzle.ch").build();
+        User userBob = User.Builder.builder().withId(9L).withFirstname("Bob").withLastname("Baumeister")
+                .withEmail("baumeister@puzzle.ch").build();
 
         userList = Arrays.asList(userAlice, userBob);
     }
@@ -69,22 +74,21 @@ void shouldReturnEmptyUsers() throws ResponseStatusException {
     @Test
     void shouldReturnSingleUserWhenFindingOwnerByValidId() {
         User owner = User.Builder.builder().withId(1L).withFirstname("Bob").withLastname("Kaufmann")
-                .withUsername("bkaufmann").withEmail("kaufmann@puzzle.ch").build();
+                .withEmail("kaufmann@puzzle.ch").build();
         Mockito.when(userPersistenceService.findById(any())).thenReturn(owner);
 
-        User returnedUser = userBusinessService.getOwnerById(1L);
+        User returnedUser = userBusinessService.getUserById(1L);
 
         assertEquals(1L, returnedUser.getId());
         assertEquals("Bob", returnedUser.getFirstname());
         assertEquals("Kaufmann", returnedUser.getLastname());
-        assertEquals("bkaufmann", returnedUser.getUsername());
         assertEquals("kaufmann@puzzle.ch", returnedUser.getEmail());
     }
 
     @Test
     void getOrCreateUserShouldReturnSingleUserWhenUserFound() {
         User newUser = User.Builder.builder().withId(1L).withFirstname("Bob").withLastname("Kaufmann")
-                .withUsername("bkaufmann").withEmail("kaufmann@puzzle.ch").build();
+                .withEmail("kaufmann@puzzle.ch").build();
         Mockito.when(userPersistenceService.getOrCreateUser(any())).thenReturn(newUser);
 
         User returnedUser = userBusinessService.getOrCreateUser(newUser);
@@ -92,14 +96,13 @@ void getOrCreateUserShouldReturnSingleUserWhenUserFound() {
         assertEquals(1L, returnedUser.getId());
         assertEquals("Bob", returnedUser.getFirstname());
         assertEquals("Kaufmann", returnedUser.getLastname());
-        assertEquals("bkaufmann", returnedUser.getUsername());
         assertEquals("kaufmann@puzzle.ch", returnedUser.getEmail());
     }
 
     @Test
     void getOrCreateUserShouldReturnSavedUserWhenUserNotFound() {
         User newUser = User.Builder.builder().withId(1L).withFirstname("Bob").withLastname("Kaufmann")
-                .withUsername("bkaufmann").withEmail("kaufmann@puzzle.ch").build();
+                .withEmail("kaufmann@puzzle.ch").build();
         Mockito.when(userPersistenceService.getOrCreateUser(newUser)).thenReturn(newUser);
 
         User returnedUser = userBusinessService.getOrCreateUser(newUser);
@@ -107,14 +110,13 @@ void getOrCreateUserShouldReturnSavedUserWhenUserNotFound() {
         assertEquals(1L, returnedUser.getId());
         assertEquals("Bob", returnedUser.getFirstname());
         assertEquals("Kaufmann", returnedUser.getLastname());
-        assertEquals("bkaufmann", returnedUser.getUsername());
         assertEquals("kaufmann@puzzle.ch", returnedUser.getEmail());
     }
 
     @Test
     void getOrCreateUserShouldThrowResponseStatusExceptionWhenInvalidUser() {
         User newUser = User.Builder.builder().withId(1L).withFirstname("Bob").withLastname("Kaufmann")
-                .withUsername("bkaufmann").withEmail("kaufmann@puzzle.ch").build();
+                .withEmail("kaufmann@puzzle.ch").build();
         Mockito.doThrow(new ResponseStatusException(HttpStatus.BAD_REQUEST, "Not allowed to give an id"))
                 .when(validationService).validateOnGetOrCreate(newUser);
 
@@ -125,4 +127,39 @@ void getOrCreateUserShouldThrowResponseStatusExceptionWhenInvalidUser() {
         assertEquals(HttpStatus.BAD_REQUEST, exception.getStatusCode());
         assertEquals("Not allowed to give an id", exception.getReason());
     }
+
+    @Test
+    void setOkrChampion_shouldSetOkrChampionCorrectly() {
+        var user = TestHelper.defaultUser(1L);
+        user.setOkrChampion(false);
+
+        userBusinessService.setIsOkrChampion(user, true);
+
+        verify(userPersistenceService, times(1)).save(user);
+        assertTrue(user.isOkrChampion());
+    }
+
+    @Test
+    void setOkrChampion_shouldThrowExceptionIfLastOkrChampIsRemoved() {
+        var user = TestHelper.defaultUser(1L);
+        var user2 = TestHelper.defaultUser(2L);
+        user.setOkrChampion(true);
+        when(userPersistenceService.findAllOkrChampions()).thenReturn(List.of(user, user2));
+
+        assertThrows(OkrResponseStatusException.class, () -> userBusinessService.setIsOkrChampion(user, false));
+    }
+
+    @Test
+    void setOkrChampion_shouldNotThrowExceptionIfSecondLastOkrChampIsRemoved() {
+        var user = TestHelper.defaultUser(1L);
+        var user2 = TestHelper.defaultUser(2L);
+        user.setOkrChampion(true);
+        user2.setOkrChampion(true);
+        when(userPersistenceService.findAllOkrChampions()).thenReturn(List.of(user, user2));
+
+        userBusinessService.setIsOkrChampion(user, false);
+
+        verify(userPersistenceService, times(1)).save(user);
+        assertFalse(user.isOkrChampion());
+    }
 }
diff --git a/backend/src/test/java/ch/puzzle/okr/service/clientconfig/ClientConfigServiceIT.java b/backend/src/test/java/ch/puzzle/okr/service/clientconfig/ClientConfigServiceIT.java
new file mode 100644
index 0000000000..e0ba905289
--- /dev/null
+++ b/backend/src/test/java/ch/puzzle/okr/service/clientconfig/ClientConfigServiceIT.java
@@ -0,0 +1,67 @@
+package ch.puzzle.okr.service.clientconfig;
+
+import ch.puzzle.okr.dto.ClientConfigDto;
+import ch.puzzle.okr.test.SpringIntegrationTest;
+import jakarta.persistence.EntityNotFoundException;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.Arguments;
+import org.junit.jupiter.params.provider.MethodSource;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.boot.test.context.SpringBootTest;
+
+import java.util.stream.Stream;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertThrowsExactly;
+
+@SpringIntegrationTest
+@SpringBootTest()
+class ClientConfigServiceIT {
+
+    @Autowired
+    private ClientConfigService clientConfigService;
+
+    @ParameterizedTest
+    @MethodSource("tenantConfigs")
+    void getConfigBasedOnActiveEnv_validSubdomain_returnsCorrectTenantConfig(String hostname, String activeProfile,
+            String issuer, String clientId) {
+
+        // arrange + act
+        ClientConfigDto clientConfig = clientConfigService.getConfigBasedOnActiveEnv(hostname);
+
+        // assert
+        assertEquals(activeProfile, clientConfig.activeProfile());
+        assertEquals(issuer, clientConfig.issuer());
+        assertEquals(clientId, clientConfig.clientId());
+    }
+
+    private static Stream<Arguments> tenantConfigs() {
+        return Stream.of(
+                Arguments.of("pitc.okr.puzzle.ch", "prod", "http://localhost:8544/realms/pitc", "pitc_okr_staging"),
+                Arguments.of("acme.okr.puzzle.ch", "prod", "http://localhost:8544/realms/pitc", "acme_okr_staging"));
+    }
+
+    @Test
+    void getConfigBasedOnActiveEnv_invalidSubdomain_throwsException() {
+        assertThrowsExactly(EntityNotFoundException.class,
+                () -> clientConfigService.getConfigBasedOnActiveEnv("foobar.okr.puzzle.ch"));
+    }
+
+    @Test
+    void getClientConfig_withOtherValues_returnsRightValues() {
+        // arrange + act
+        ClientConfigDto clientConfig = clientConfigService.getConfigBasedOnActiveEnv("pitc.okr.puzzle.ch");
+
+        // assert
+        assertEquals("prod", clientConfig.activeProfile());
+        assertEquals("http://localhost:8544/realms/pitc", clientConfig.issuer());
+        assertEquals("assets/favicon.png", clientConfig.favicon());
+        assertEquals("assets/images/okr-logo.svg", clientConfig.logo());
+        assertEquals("assets/images/triangles-okr-header.svg", clientConfig.triangles());
+        assertEquals("assets/images/puzzle-p.svg", clientConfig.backgroundLogo());
+        assertEquals("Puzzle OKR", clientConfig.title());
+        assertEquals("#1e5a96", clientConfig.customStyles().get("okr-topbar-background-color"));
+    }
+
+}
diff --git a/backend/src/test/java/ch/puzzle/okr/service/clientconfig/ClientConfigServiceTest.java b/backend/src/test/java/ch/puzzle/okr/service/clientconfig/ClientConfigServiceTest.java
new file mode 100644
index 0000000000..aced05adae
--- /dev/null
+++ b/backend/src/test/java/ch/puzzle/okr/service/clientconfig/ClientConfigServiceTest.java
@@ -0,0 +1,132 @@
+package ch.puzzle.okr.service.clientconfig;
+
+import ch.puzzle.okr.dto.ClientConfigDto;
+import ch.puzzle.okr.multitenancy.TenantConfigProvider;
+import ch.puzzle.okr.multitenancy.customization.TenantClientCustomization;
+import ch.puzzle.okr.multitenancy.customization.TenantClientCustomizationProvider;
+import jakarta.persistence.EntityNotFoundException;
+import org.junit.jupiter.api.DisplayName;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.CsvSource;
+
+import java.util.HashMap;
+import java.util.Optional;
+
+import static org.junit.jupiter.api.Assertions.*;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.when;
+
+public class ClientConfigServiceTest {
+
+    @DisplayName("getConfigBasedOnActiveEnv() should be successful when tenant is configured properly")
+    @ParameterizedTest
+    @CsvSource({ "pitc,pitc.ork.ch", "acme,acme-ork.ch" })
+    void getConfigBasedOnActiveEnvShouldBeSuccessfulWhenTenantIsConfiguredProperly(String tenant, String hostname) {
+        // arrange
+        TenantConfigProvider.TenantConfig tenantConfig = getTenantConfig(tenant);
+        TenantClientCustomization tenantCustomization = getTenantClientCustomization(tenant);
+        ClientConfigService service = getClientConfig(tenantConfig, tenantCustomization, tenant);
+
+        // act
+        ClientConfigDto configBasedOnActiveEnv = service.getConfigBasedOnActiveEnv(hostname);
+
+        // assert
+        assertClientConfigDto(configBasedOnActiveEnv, tenant);
+    }
+
+    @DisplayName("getConfigBasedOnActiveEnv() should throw exception if client customization is not found")
+    @ParameterizedTest
+    @CsvSource({ "pitc,pitc.okr.ch,pitc", "acme,acme-okr.ch,acme-okr" })
+    void getConfigBasedOnActiveEnvShouldThrowExceptionIfClientCustomizationIsNotFound(String tenant, String hostname,
+            String subdomain) {
+        // arrange
+        TenantConfigProvider.TenantConfig tenantConfig = getTenantConfig(tenant);
+        ClientConfigService service = getClientConfig(tenantConfig, tenant);
+
+        // act + assert
+        EntityNotFoundException entityNotFoundException = //
+                assertThrows(EntityNotFoundException.class, () -> service.getConfigBasedOnActiveEnv(hostname));
+
+        String expectedErrorMessage = "Could not find tenant client customization for subdomain:" + subdomain;
+        assertEquals(expectedErrorMessage, entityNotFoundException.getMessage());
+    }
+
+    @DisplayName("getConfigBasedOnActiveEnv() should throw exception if client config is not found")
+    @ParameterizedTest
+    @CsvSource({ "pitc,pitc.okr.ch,pitc", "acme,acme-okr.ch,acme-okr" })
+    void getConfigBasedOnActiveEnvShouldThrowExceptionIfClientConfigIsNotFound(String tenant, String hostname,
+            String subdomain) {
+        // arrange
+        TenantClientCustomization tenantCustomization = getTenantClientCustomization(tenant);
+        ClientConfigService service = getClientConfig(tenantCustomization, tenant);
+
+        // act + assert
+        EntityNotFoundException entityNotFoundException = //
+                assertThrows(EntityNotFoundException.class, () -> service.getConfigBasedOnActiveEnv(hostname));
+
+        String expectedErrorMessage = "Could not find tenant config for subdomain:" + subdomain;
+        assertEquals(expectedErrorMessage, entityNotFoundException.getMessage());
+    }
+
+    private ClientConfigService getClientConfig(TenantConfigProvider.TenantConfig tenantConfig,
+            TenantClientCustomization tenantClientCustomization, String tenantId) {
+        return mockClientConfigService(tenantConfig, tenantClientCustomization, tenantId);
+    }
+
+    private ClientConfigService getClientConfig(TenantClientCustomization tenantClientCustomization, String tenantId) {
+        return mockClientConfigService(null, tenantClientCustomization, tenantId);
+    }
+
+    private ClientConfigService getClientConfig(TenantConfigProvider.TenantConfig tenantConfig, String tenantId) {
+        return mockClientConfigService(tenantConfig, null, tenantId);
+    }
+
+    private ClientConfigService mockClientConfigService(TenantConfigProvider.TenantConfig tenantConfig,
+            TenantClientCustomization tenantCustomization, String tenantId) {
+
+        TenantClientCustomizationProvider tenantCustomizationProvider = mock(TenantClientCustomizationProvider.class);
+        when(tenantCustomizationProvider.getTenantClientCustomizationsById(tenantId)) //
+                .thenReturn(Optional.ofNullable(tenantCustomization));
+
+        TenantConfigProvider tenantConfigProvider = mock(TenantConfigProvider.class);
+        when(tenantConfigProvider.getTenantConfigById(tenantId)) //
+                .thenReturn(Optional.ofNullable(tenantConfig));
+
+        return new ClientConfigService(tenantCustomizationProvider, tenantConfigProvider);
+    }
+
+    private TenantConfigProvider.TenantConfig getTenantConfig(String tenantId) {
+        return new TenantConfigProvider.TenantConfig( //
+                prefix(tenantId) + "tenantId", //
+                new String[] {}, //
+                prefix(tenantId) + "jwkSetUri", //
+                prefix(tenantId) + "issuerUrl", //
+                prefix(tenantId) + "clientId", //
+                null);
+    }
+
+    private TenantClientCustomization getTenantClientCustomization(String tenantId) {
+        return new TenantClientCustomization( //
+                prefix(tenantId) + "favicon", //
+                prefix(tenantId) + "logo", //
+                prefix(tenantId) + "triangles", //
+                prefix(tenantId) + "backgroundLogo", //
+                prefix(tenantId) + "title", //
+                new HashMap<>());
+    }
+
+    private void assertClientConfigDto(ClientConfigDto clientConfigDto, String tenant) {
+        assertNotNull(clientConfigDto);
+        assertEquals(prefix(tenant) + "issuerUrl", clientConfigDto.issuer());
+        assertEquals(prefix(tenant) + "clientId", clientConfigDto.clientId());
+        assertEquals(prefix(tenant) + "favicon", clientConfigDto.favicon());
+        assertEquals(prefix(tenant) + "logo", clientConfigDto.logo());
+        assertEquals(prefix(tenant) + "triangles", clientConfigDto.triangles());
+        assertEquals(prefix(tenant) + "backgroundLogo", clientConfigDto.backgroundLogo());
+        assertEquals(prefix(tenant) + "title", clientConfigDto.title());
+    }
+
+    private String prefix(String tenantId) {
+        return tenantId + "_";
+    }
+}
diff --git a/backend/src/test/java/ch/puzzle/okr/service/persistence/ActionPersistenceServiceIT.java b/backend/src/test/java/ch/puzzle/okr/service/persistence/ActionPersistenceServiceIT.java
index 19be0ac163..b8e62b6a63 100644
--- a/backend/src/test/java/ch/puzzle/okr/service/persistence/ActionPersistenceServiceIT.java
+++ b/backend/src/test/java/ch/puzzle/okr/service/persistence/ActionPersistenceServiceIT.java
@@ -6,8 +6,10 @@
 import ch.puzzle.okr.models.Action;
 import ch.puzzle.okr.models.Objective;
 import ch.puzzle.okr.models.keyresult.KeyResultMetric;
+import ch.puzzle.okr.multitenancy.TenantContext;
 import ch.puzzle.okr.test.SpringIntegrationTest;
 import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.web.server.ResponseStatusException;
@@ -38,6 +40,11 @@ private static Action createAction(Long id, int version) {
 
     private static final String UPDATED_ACTION = "Updated Action";
 
+    @BeforeEach
+    void setUp() {
+        TenantContext.setCurrentTenant(TestHelper.SCHEMA_PITC);
+    }
+
     @AfterEach
     void tearDown() {
         try {
@@ -50,6 +57,7 @@ void tearDown() {
         } finally {
             createdAction = null;
         }
+        TenantContext.setCurrentTenant(null);
     }
 
     @Test
@@ -118,7 +126,7 @@ void getActionByIdShouldReturnActionProperly() {
         assertEquals(1L, action.getId());
         assertEquals("Neues Haus", action.getAction());
         assertEquals(1, action.getPriority());
-        assertEquals(true, action.isChecked());
+        assertTrue(action.isChecked());
         assertEquals(8L, action.getKeyResult().getId());
     }
 
diff --git a/backend/src/test/java/ch/puzzle/okr/service/persistence/AlignmentPersistenceServiceIT.java b/backend/src/test/java/ch/puzzle/okr/service/persistence/AlignmentPersistenceServiceIT.java
index f3d9be646a..de38eed3a5 100644
--- a/backend/src/test/java/ch/puzzle/okr/service/persistence/AlignmentPersistenceServiceIT.java
+++ b/backend/src/test/java/ch/puzzle/okr/service/persistence/AlignmentPersistenceServiceIT.java
@@ -8,8 +8,10 @@
 import ch.puzzle.okr.models.alignment.KeyResultAlignment;
 import ch.puzzle.okr.models.alignment.ObjectiveAlignment;
 import ch.puzzle.okr.models.keyresult.KeyResultMetric;
+import ch.puzzle.okr.multitenancy.TenantContext;
 import ch.puzzle.okr.test.SpringIntegrationTest;
 import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.web.server.ResponseStatusException;
@@ -42,6 +44,11 @@ private static KeyResultAlignment createKeyResultAlignment(Long id, int version)
                 .withTargetKeyResult(KeyResultMetric.Builder.builder().withId(8L).build()).build();
     }
 
+    @BeforeEach
+    void setUp() {
+        TenantContext.setCurrentTenant(TestHelper.SCHEMA_PITC);
+    }
+
     @AfterEach
     void tearDown() {
         try {
@@ -54,6 +61,7 @@ void tearDown() {
         } finally {
             createdAlignment = null;
         }
+        TenantContext.setCurrentTenant(null);
     }
 
     @Test
diff --git a/backend/src/test/java/ch/puzzle/okr/service/persistence/AlignmentSelectionPersistenceServiceIT.java b/backend/src/test/java/ch/puzzle/okr/service/persistence/AlignmentSelectionPersistenceServiceIT.java
index d01a662f88..60ab85c7d9 100644
--- a/backend/src/test/java/ch/puzzle/okr/service/persistence/AlignmentSelectionPersistenceServiceIT.java
+++ b/backend/src/test/java/ch/puzzle/okr/service/persistence/AlignmentSelectionPersistenceServiceIT.java
@@ -1,8 +1,12 @@
 package ch.puzzle.okr.service.persistence;
 
+import ch.puzzle.okr.test.TestHelper;
 import ch.puzzle.okr.models.alignment.AlignmentSelection;
 import ch.puzzle.okr.models.alignment.AlignmentSelectionId;
+import ch.puzzle.okr.multitenancy.TenantContext;
 import ch.puzzle.okr.test.SpringIntegrationTest;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
 import org.springframework.beans.factory.annotation.Autowired;
 
@@ -17,6 +21,16 @@ class AlignmentSelectionPersistenceServiceIT {
     @Autowired
     private AlignmentSelectionPersistenceService alignmentSelectionPersistenceService;
 
+    @BeforeEach
+    void setUp() {
+        TenantContext.setCurrentTenant(TestHelper.SCHEMA_PITC);
+    }
+
+    @AfterEach
+    void tearDown() {
+        TenantContext.setCurrentTenant(null);
+    }
+
     @Test
     void getAlignmentSelectionByQuarterIdAndTeamIdNotShouldReturnAlignmentSelections() {
         List<AlignmentSelection> alignmentSelections = alignmentSelectionPersistenceService
diff --git a/backend/src/test/java/ch/puzzle/okr/service/persistence/AuthorizationCriteriaIT.java b/backend/src/test/java/ch/puzzle/okr/service/persistence/AuthorizationCriteriaIT.java
index e2d18dd07e..7d1e4450ce 100644
--- a/backend/src/test/java/ch/puzzle/okr/service/persistence/AuthorizationCriteriaIT.java
+++ b/backend/src/test/java/ch/puzzle/okr/service/persistence/AuthorizationCriteriaIT.java
@@ -1,16 +1,19 @@
 package ch.puzzle.okr.service.persistence;
 
+import ch.puzzle.okr.test.TestHelper;
 import ch.puzzle.okr.models.Objective;
 import ch.puzzle.okr.models.authorization.AuthorizationUser;
 import ch.puzzle.okr.models.overview.Overview;
+import ch.puzzle.okr.multitenancy.TenantContext;
 import ch.puzzle.okr.test.SpringIntegrationTest;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
 import org.springframework.beans.factory.annotation.Autowired;
 
 import java.util.List;
 
 import static ch.puzzle.okr.test.TestHelper.*;
-import static ch.puzzle.okr.models.authorization.AuthorizationRole.*;
 import static org.junit.jupiter.api.Assertions.assertEquals;
 
 @SpringIntegrationTest
@@ -21,6 +24,16 @@ class AuthorizationCriteriaIT {
     @Autowired
     OverviewPersistenceService overviewPersistenceService;
 
+    @BeforeEach
+    void setUp() {
+        TenantContext.setCurrentTenant(TestHelper.SCHEMA_PITC);
+    }
+
+    @AfterEach
+    void tearDown() {
+        TenantContext.setCurrentTenant(null);
+    }
+
     @Test
     void appendObjectiveShouldReturnObjectiveWhenFirstLevelRole() {
         Long objectiveId = 5L;
@@ -33,8 +46,7 @@ void appendObjectiveShouldReturnObjectiveWhenFirstLevelRole() {
     @Test
     void appendObjectiveShouldReturnObjectiveWhenSecondLevelRole() {
         Long objectiveId = 6L;
-        AuthorizationUser authorizationUser = mockAuthorizationUser(defaultUser(null), List.of(), 5L,
-                List.of(READ_ALL_PUBLISHED, READ_TEAMS_DRAFT));
+        AuthorizationUser authorizationUser = mockAuthorizationUser(defaultUser(null));
         Objective objective = objectivePersistenceService.findObjectiveById(objectiveId, authorizationUser, null);
 
         assertEquals(objectiveId, objective.getId());
@@ -43,8 +55,7 @@ void appendObjectiveShouldReturnObjectiveWhenSecondLevelRole() {
     @Test
     void appendObjectiveShouldReturnObjectiveWhenMemberRole() {
         Long objectiveId = 6L;
-        AuthorizationUser authorizationUser = mockAuthorizationUser(defaultUser(null), List.of(), 5L,
-                List.of(READ_ALL_PUBLISHED, READ_TEAM_DRAFT));
+        AuthorizationUser authorizationUser = mockAuthorizationUser(defaultUser(null));
         Objective objective = objectivePersistenceService.findObjectiveById(objectiveId, authorizationUser, null);
 
         assertEquals(objectiveId, objective.getId());
@@ -63,8 +74,7 @@ void appendOverviewShouldReturnObjectiveWhenFirstLevelRoleAndTeamIdsEmpty() {
     @Test
     void appendOverviewShouldReturnObjectiveWhenSecondLevelRole() {
         Long quarterId = 2L;
-        AuthorizationUser authorizationUser = mockAuthorizationUser(defaultUser(null), List.of(), 5L,
-                List.of(READ_ALL_PUBLISHED, READ_TEAMS_DRAFT));
+        AuthorizationUser authorizationUser = mockAuthorizationUser(defaultUser(null));
         List<Overview> overviews = overviewPersistenceService.getFilteredOverview(quarterId, List.of(5L), "",
                 authorizationUser);
 
@@ -74,8 +84,7 @@ void appendOverviewShouldReturnObjectiveWhenSecondLevelRole() {
     @Test
     void appendOverviewShouldReturnObjectiveWhenMemberRole() {
         Long quarterId = 2L;
-        AuthorizationUser authorizationUser = mockAuthorizationUser(defaultUser(null), List.of(), 5L,
-                List.of(READ_ALL_PUBLISHED, READ_TEAM_DRAFT));
+        AuthorizationUser authorizationUser = mockAuthorizationUser(defaultUser(null));
         List<Overview> overviews = overviewPersistenceService.getFilteredOverview(quarterId, List.of(5L), "",
                 authorizationUser);
 
diff --git a/backend/src/test/java/ch/puzzle/okr/service/persistence/CheckInPersistenceServiceIT.java b/backend/src/test/java/ch/puzzle/okr/service/persistence/CheckInPersistenceServiceIT.java
index 55fdba8fd6..419971e392 100644
--- a/backend/src/test/java/ch/puzzle/okr/service/persistence/CheckInPersistenceServiceIT.java
+++ b/backend/src/test/java/ch/puzzle/okr/service/persistence/CheckInPersistenceServiceIT.java
@@ -8,8 +8,10 @@
 import ch.puzzle.okr.models.checkin.CheckIn;
 import ch.puzzle.okr.models.checkin.CheckInMetric;
 import ch.puzzle.okr.models.keyresult.KeyResultMetric;
+import ch.puzzle.okr.multitenancy.TenantContext;
 import ch.puzzle.okr.test.SpringIntegrationTest;
 import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.web.server.ResponseStatusException;
@@ -45,6 +47,11 @@ private static CheckIn createCheckIn(Long id, int version) {
                 .withConfidence(5).build();
     }
 
+    @BeforeEach
+    void setUp() {
+        TenantContext.setCurrentTenant(TestHelper.SCHEMA_PITC);
+    }
+
     @AfterEach
     void tearDown() {
         try {
@@ -57,6 +64,7 @@ void tearDown() {
         } finally {
             createdCheckIn = null;
         }
+        TenantContext.setCurrentTenant(null);
     }
 
     @Test
@@ -118,7 +126,8 @@ void getCheckInByIdShouldReturnCheckInProperly() {
         assertEquals(20L, checkIn.getId());
         assertEquals(0.5, ((CheckInMetric) checkIn).getValue(), 0.01);
         assertEquals(
-                "Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua. At vero eos et accusam et justo duo dolores ",
+                "Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore "
+                        + "magna aliquyam erat, sed diam voluptua. At vero eos et accusam et justo duo dolores ",
                 checkIn.getChangeInfo());
     }
 
diff --git a/backend/src/test/java/ch/puzzle/okr/service/persistence/CompletedPersistenceServiceIT.java b/backend/src/test/java/ch/puzzle/okr/service/persistence/CompletedPersistenceServiceIT.java
index 3ca5b28fac..651cfa0b88 100644
--- a/backend/src/test/java/ch/puzzle/okr/service/persistence/CompletedPersistenceServiceIT.java
+++ b/backend/src/test/java/ch/puzzle/okr/service/persistence/CompletedPersistenceServiceIT.java
@@ -5,8 +5,10 @@
 import ch.puzzle.okr.exception.OkrResponseStatusException;
 import ch.puzzle.okr.models.Completed;
 import ch.puzzle.okr.models.Objective;
+import ch.puzzle.okr.multitenancy.TenantContext;
 import ch.puzzle.okr.test.SpringIntegrationTest;
 import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.web.server.ResponseStatusException;
@@ -23,6 +25,9 @@ class CompletedPersistenceServiceIT {
     @Autowired
     private CompletedPersistenceService completedPersistenceService;
     private Completed createdCompleted;
+    private static final String WIR_HABEN_ES_GUT_GESCHAFFT = "Wir haben es gut geschafft";
+    public static final String GUTE_LERNENDE = "Gute Lernende";
+    public static final long OBJECTIVE_ID = 3L;
 
     private static Completed createCompleted(Long id) {
         return createCompleted(id, 1);
@@ -30,12 +35,17 @@ private static Completed createCompleted(Long id) {
 
     private static Completed createCompleted(Long id, int version) {
         return Completed.Builder.builder().withId(id).withVersion(version)
-                .withObjective(Objective.Builder.builder().withId(3L).withTitle("Gute Lernende").build())
-                .withComment("Wir haben es gut geschafft").build();
+                .withObjective(Objective.Builder.builder().withId(OBJECTIVE_ID).withTitle(GUTE_LERNENDE).build())
+                .withComment(WIR_HABEN_ES_GUT_GESCHAFFT).build();
     }
 
     private static final String COMPLETED = "Completed";
 
+    @BeforeEach
+    void setUp() {
+        TenantContext.setCurrentTenant(TestHelper.SCHEMA_PITC);
+    }
+
     @AfterEach
     void tearDown() {
         try {
@@ -48,6 +58,7 @@ void tearDown() {
         } finally {
             createdCompleted = null;
         }
+        TenantContext.setCurrentTenant(null);
     }
 
     @Test
@@ -55,8 +66,9 @@ void saveCompletedShouldSaveCompleted() {
         createdCompleted = completedPersistenceService.save(createCompleted(null));
 
         assertNotNull(createdCompleted.getId());
-        assertEquals(createdCompleted.getComment(), createdCompleted.getComment());
-        assertEquals(createdCompleted.getObjective(), createdCompleted.getObjective());
+        assertEquals(WIR_HABEN_ES_GUT_GESCHAFFT, createdCompleted.getComment());
+        assertEquals(OBJECTIVE_ID, createdCompleted.getObjective().getId());
+        assertEquals(GUTE_LERNENDE, createdCompleted.getObjective().getTitle());
     }
 
     @Test
diff --git a/backend/src/test/java/ch/puzzle/okr/service/persistence/KeyResultPersistenceServiceIT.java b/backend/src/test/java/ch/puzzle/okr/service/persistence/KeyResultPersistenceServiceIT.java
index e26a315130..75e33aea68 100644
--- a/backend/src/test/java/ch/puzzle/okr/service/persistence/KeyResultPersistenceServiceIT.java
+++ b/backend/src/test/java/ch/puzzle/okr/service/persistence/KeyResultPersistenceServiceIT.java
@@ -9,8 +9,10 @@
 import ch.puzzle.okr.models.keyresult.KeyResult;
 import ch.puzzle.okr.models.keyresult.KeyResultMetric;
 import ch.puzzle.okr.models.keyresult.KeyResultOrdinal;
+import ch.puzzle.okr.multitenancy.TenantContext;
 import ch.puzzle.okr.test.SpringIntegrationTest;
 import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
 import org.springframework.beans.factory.annotation.Autowired;
 
@@ -53,6 +55,11 @@ private static KeyResult createKeyResultOrdinal(Long id, int version) {
     private static final String MODEL_NOT_FOUND = "MODEL_WITH_ID_NOT_FOUND";
     private static final String KEYRESULT = "KeyResult";
 
+    @BeforeEach
+    void setUp() {
+        TenantContext.setCurrentTenant(TestHelper.SCHEMA_PITC);
+    }
+
     @AfterEach
     void tearDown() {
         try {
@@ -65,6 +72,7 @@ void tearDown() {
         } finally {
             createdKeyResult = null;
         }
+        TenantContext.setCurrentTenant(null);
     }
 
     @Test
diff --git a/backend/src/test/java/ch/puzzle/okr/service/persistence/ObjectivePersistenceServiceIT.java b/backend/src/test/java/ch/puzzle/okr/service/persistence/ObjectivePersistenceServiceIT.java
index 9fb535ad22..ccc6c3a8a0 100644
--- a/backend/src/test/java/ch/puzzle/okr/service/persistence/ObjectivePersistenceServiceIT.java
+++ b/backend/src/test/java/ch/puzzle/okr/service/persistence/ObjectivePersistenceServiceIT.java
@@ -1,13 +1,14 @@
 package ch.puzzle.okr.service.persistence;
 
-import ch.puzzle.okr.test.TestHelper;
 import ch.puzzle.okr.dto.ErrorDto;
 import ch.puzzle.okr.exception.OkrResponseStatusException;
 import ch.puzzle.okr.models.*;
 import ch.puzzle.okr.models.authorization.AuthorizationUser;
+import ch.puzzle.okr.multitenancy.TenantContext;
 import ch.puzzle.okr.test.SpringIntegrationTest;
+import ch.puzzle.okr.test.TestHelper;
 import org.junit.jupiter.api.AfterEach;
-import org.junit.jupiter.api.DisplayName;
+import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.web.server.ResponseStatusException;
@@ -15,6 +16,7 @@
 import java.time.LocalDateTime;
 import java.util.List;
 
+import static ch.puzzle.okr.test.TestConstants.GJ_FOR_TESTS_QUARTER_ID;
 import static ch.puzzle.okr.test.TestHelper.defaultAuthorizationUser;
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.junit.jupiter.api.Assertions.*;
@@ -28,7 +30,6 @@ class ObjectivePersistenceServiceIT {
     private static final String MODEL_WITH_ID_NOT_FOUND = "MODEL_WITH_ID_NOT_FOUND";
     private static final String OBJECTIVE = "Objective";
     private static final String ATTRIBUTE_NULL = "ATTRIBUTE_NULL";
-    private static final long GJ_FOR_TESTS_QUARTER_ID = 99L;
     private final AuthorizationUser authorizationUser = defaultAuthorizationUser();
     private Objective createdObjective;
 
@@ -52,6 +53,11 @@ private static Objective createObjective(Long id, int version) {
                 .withModifiedOn(LocalDateTime.MAX).withModifiedBy(User.Builder.builder().withId(1L).build()).build();
     }
 
+    @BeforeEach
+    void setUp() {
+        TenantContext.setCurrentTenant(TestHelper.SCHEMA_PITC);
+    }
+
     @AfterEach
     void tearDown() {
         try {
@@ -64,6 +70,7 @@ void tearDown() {
         } finally {
             createdObjective = null;
         }
+        TenantContext.setCurrentTenant(null);
     }
 
     @Test
@@ -255,24 +262,4 @@ void countByTeamAndQuarterShouldReturnCountValue() {
 
         assertEquals(2, count);
     }
-
-    @DisplayName("findObjectiveByTeamIdId() should return list of Objectives")
-    @Test
-    void findObjectiveByTeamIdIdShouldReturnListOfObjectives() {
-        long teamId = 5L;
-        List<Objective> objectives = objectivePersistenceService.findObjectiveByTeamId(teamId);
-
-        assertEquals(2, objectives.size());
-        assertEquals(3, objectives.get(0).getId());
-        assertEquals(4, objectives.get(1).getId());
-    }
-
-    @DisplayName("findObjectiveByTeamIdId() should return empty list when Team does not exist")
-    @Test
-    void findObjectiveByTeamIdIdShouldReturnEmptyListWhenTeamDoesNotExist() {
-        long notExistingTeamId = 1234567890L;
-        List<Objective> objectives = objectivePersistenceService.findObjectiveByTeamId(notExistingTeamId);
-
-        assertTrue(objectives.isEmpty());
-    }
 }
diff --git a/backend/src/test/java/ch/puzzle/okr/service/persistence/OrganisationPersistenceIT.java b/backend/src/test/java/ch/puzzle/okr/service/persistence/OrganisationPersistenceIT.java
deleted file mode 100644
index 8b8290b16d..0000000000
--- a/backend/src/test/java/ch/puzzle/okr/service/persistence/OrganisationPersistenceIT.java
+++ /dev/null
@@ -1,146 +0,0 @@
-package ch.puzzle.okr.service.persistence;
-
-import ch.puzzle.okr.test.TestHelper;
-import ch.puzzle.okr.dto.ErrorDto;
-import ch.puzzle.okr.exception.OkrResponseStatusException;
-import ch.puzzle.okr.models.Organisation;
-import ch.puzzle.okr.models.OrganisationState;
-import ch.puzzle.okr.repository.OrganisationRepository;
-import ch.puzzle.okr.test.SpringIntegrationTest;
-import org.junit.jupiter.api.AfterEach;
-import org.junit.jupiter.api.Test;
-import org.mockito.Spy;
-import org.springframework.beans.factory.annotation.Autowired;
-
-import java.util.List;
-
-import static org.assertj.core.api.Assertions.assertThat;
-import static org.junit.jupiter.api.Assertions.*;
-import static org.mockito.Mockito.times;
-import static org.mockito.Mockito.verify;
-import static org.springframework.http.HttpStatus.BAD_REQUEST;
-import static org.springframework.http.HttpStatus.NOT_FOUND;
-
-@SpringIntegrationTest
-class OrganisationPersistenceIT {
-
-    @Autowired
-    private OrganisationPersistenceService organisationPersistenceService;
-
-    @Spy
-    OrganisationRepository repository;
-
-    private Organisation createdOrganisation;
-
-    private Organisation createOrganisation(Long id) {
-        return createOrganisation(id, 0);
-    }
-
-    private Organisation createOrganisation(Long id, int version) {
-        return Organisation.Builder.builder().withId(id).withVersion(version).withOrgName("org_test")
-                .withState(OrganisationState.ACTIVE).build();
-    }
-
-    @AfterEach
-    void tearDown() {
-        try {
-            if (createdOrganisation != null) {
-                organisationPersistenceService.findById(createdOrganisation.getId());
-                organisationPersistenceService.deleteById(createdOrganisation.getId());
-            }
-        } catch (OkrResponseStatusException ex) {
-            // created alignment already deleted
-        } finally {
-            createdOrganisation = null;
-        }
-    }
-
-    @Test
-    void shouldReturnSingleOrganisationWhenFindingByValidId() {
-        Organisation returnedOrganisation = organisationPersistenceService.findById(1L);
-        assertEquals(1L, returnedOrganisation.getId());
-        assertEquals("org_gl", returnedOrganisation.getOrgName());
-    }
-
-    @Test
-    void shouldThrowExceptionWhenFindingOrganisationNotFound() {
-        OkrResponseStatusException exception = assertThrows(OkrResponseStatusException.class,
-                () -> organisationPersistenceService.findById(321L));
-
-        List<ErrorDto> expectedErrors = List
-                .of(new ErrorDto("MODEL_WITH_ID_NOT_FOUND", List.of("Organisation", "321")));
-
-        assertEquals(NOT_FOUND, exception.getStatusCode());
-        assertThat(expectedErrors).hasSameElementsAs(exception.getErrors());
-        assertTrue(TestHelper.getAllErrorKeys(expectedErrors).contains(exception.getReason()));
-    }
-
-    @Test
-    void shouldThrowExceptionWhenFindingOrganisationWithIdNull() {
-        OkrResponseStatusException exception = assertThrows(OkrResponseStatusException.class,
-                () -> organisationPersistenceService.findById(null));
-
-        List<ErrorDto> expectedErrors = List.of(new ErrorDto("ATTRIBUTE_NULL", List.of("ID", "Organisation")));
-
-        assertEquals(BAD_REQUEST, exception.getStatusCode());
-        assertThat(expectedErrors).hasSameElementsAs(exception.getErrors());
-        assertTrue(TestHelper.getAllErrorKeys(expectedErrors).contains(exception.getReason()));
-    }
-
-    @Test
-    void shouldReturnTrueIfOrgWithNameAlreadyExists() {
-        Organisation org = createOrganisation(null);
-        createdOrganisation = organisationPersistenceService.saveIfNotExists(org);
-        assertTrue(organisationPersistenceService.findAll().contains(org));
-    }
-
-    @Test
-    void updateOrganisationShouldSaveOrganisation() {
-        createdOrganisation = organisationPersistenceService.saveIfNotExists(createOrganisation(null));
-        Organisation updateOrganisation = createOrganisation(createdOrganisation.getId());
-        updateOrganisation.setOrgName("Updated organisation");
-
-        Organisation updatedOrganisation = organisationPersistenceService.save(updateOrganisation);
-
-        assertEquals(createdOrganisation.getId(), updatedOrganisation.getId());
-        assertEquals(createdOrganisation.getVersion() + 1, updatedOrganisation.getVersion());
-        assertEquals(updateOrganisation.getOrgName(), updatedOrganisation.getOrgName());
-    }
-
-    @Test
-    void shouldNotSaveOrganisationIfAlreadyExists() {
-        Organisation existingOrganisation = organisationPersistenceService.findById(1L);
-        organisationPersistenceService.saveIfNotExists(existingOrganisation);
-        assertTrue(organisationPersistenceService.getRepository()
-                .existsOrganisationByOrgName(existingOrganisation.getOrgName()));
-        verify(repository, times(0)).save(existingOrganisation);
-    }
-
-    @Test
-    void shouldSetOrgInactive() {
-        Organisation organisation = organisationPersistenceService.findById(5L);
-        organisation.setState(OrganisationState.ACTIVE);
-        assertEquals(OrganisationState.ACTIVE, organisation.getState());
-        organisationPersistenceService
-                .updateOrganisationStateToInactive(organisationPersistenceService.findById(5L).getOrgName());
-        assertEquals(OrganisationState.INACTIVE, organisationPersistenceService.findById(5L).getState());
-    }
-
-    @Test
-    void getOrganisationByTeamId() {
-        assertEquals(List.of(1L),
-                organisationPersistenceService.getOrganisationsByTeamId(5L).stream().map(Organisation::getId).toList());
-    }
-
-    @Test
-    void getEmptyListIfNoTeamWithIdFound() {
-        assertEquals(List.of(), organisationPersistenceService.getOrganisationsByTeamId(90L).stream()
-                .map(Organisation::getId).toList());
-    }
-
-    @Test
-    void getActiveOrganisations() {
-        List<Organisation> organisations = organisationPersistenceService.getActiveOrganisations();
-        organisations.forEach(organisation -> assertNotSame(OrganisationState.INACTIVE, organisation.getState()));
-    }
-}
diff --git a/backend/src/test/java/ch/puzzle/okr/service/persistence/OverviewPersistenceServiceIT.java b/backend/src/test/java/ch/puzzle/okr/service/persistence/OverviewPersistenceServiceIT.java
index c8523247be..fb74abd66e 100644
--- a/backend/src/test/java/ch/puzzle/okr/service/persistence/OverviewPersistenceServiceIT.java
+++ b/backend/src/test/java/ch/puzzle/okr/service/persistence/OverviewPersistenceServiceIT.java
@@ -1,9 +1,13 @@
 package ch.puzzle.okr.service.persistence;
 
+import ch.puzzle.okr.test.TestHelper;
 import ch.puzzle.okr.models.authorization.AuthorizationUser;
 import ch.puzzle.okr.models.overview.Overview;
 import ch.puzzle.okr.models.overview.OverviewId;
+import ch.puzzle.okr.multitenancy.TenantContext;
 import ch.puzzle.okr.test.SpringIntegrationTest;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
 import org.springframework.beans.factory.annotation.Autowired;
 
@@ -42,6 +46,16 @@ class OverviewPersistenceServiceIT {
     @Autowired
     private OverviewPersistenceService overviewPersistenceService;
 
+    @BeforeEach
+    void setUp() {
+        TenantContext.setCurrentTenant(TestHelper.SCHEMA_PITC);
+    }
+
+    @AfterEach
+    void tearDown() {
+        TenantContext.setCurrentTenant(null);
+    }
+
     @Test
     void getFilteredOverviewShouldReturnOverviewsWhenTeamIdsSet() {
         List<Overview> overviews = overviewPersistenceService.getFilteredOverview(2L, List.of(5L, 6L, 8L), "",
diff --git a/backend/src/test/java/ch/puzzle/okr/service/persistence/QuarterPersistenceServiceIT.java b/backend/src/test/java/ch/puzzle/okr/service/persistence/QuarterPersistenceServiceIT.java
index 07a520acd2..23a1ce5faf 100644
--- a/backend/src/test/java/ch/puzzle/okr/service/persistence/QuarterPersistenceServiceIT.java
+++ b/backend/src/test/java/ch/puzzle/okr/service/persistence/QuarterPersistenceServiceIT.java
@@ -3,9 +3,12 @@
 import ch.puzzle.okr.dto.ErrorDto;
 import ch.puzzle.okr.exception.OkrResponseStatusException;
 import ch.puzzle.okr.models.Quarter;
+import ch.puzzle.okr.multitenancy.TenantContext;
 import ch.puzzle.okr.test.SpringIntegrationTest;
 import ch.puzzle.okr.test.TestHelper;
 import ch.puzzle.okr.util.quarter.check.QuarterRangeChecker;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.DisplayName;
 import org.junit.jupiter.api.Test;
 import org.springframework.beans.factory.annotation.Autowired;
@@ -13,6 +16,8 @@
 import java.time.LocalDate;
 import java.util.List;
 
+import static ch.puzzle.okr.test.TestConstants.GJ_FOR_TESTS_QUARTER_ID;
+import static ch.puzzle.okr.test.TestConstants.GJ_FOR_TEST_QUARTER_LABEL;
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.junit.jupiter.api.Assertions.*;
 import static org.springframework.http.HttpStatus.BAD_REQUEST;
@@ -24,12 +29,22 @@ class QuarterPersistenceServiceIT {
     @Autowired
     private QuarterPersistenceService quarterPersistenceService;
 
+    @BeforeEach
+    void setUp() {
+        TenantContext.setCurrentTenant(TestHelper.SCHEMA_PITC);
+    }
+
+    @AfterEach
+    void tearDown() {
+        TenantContext.setCurrentTenant(null);
+    }
+
     @Test
     void shouldReturnSingleQuarterWhenFindingByValidId() {
-        Quarter returnedQuarter = quarterPersistenceService.findById(99L);
+        Quarter returnedQuarter = quarterPersistenceService.findById(GJ_FOR_TESTS_QUARTER_ID);
 
-        assertEquals(99L, returnedQuarter.getId());
-        assertEquals("GJ ForTests", returnedQuarter.getLabel());
+        assertEquals(GJ_FOR_TESTS_QUARTER_ID, returnedQuarter.getId());
+        assertEquals(GJ_FOR_TEST_QUARTER_LABEL, returnedQuarter.getLabel());
         assertEquals(LocalDate.of(2000, 7, 1), returnedQuarter.getStartDate());
         assertEquals(LocalDate.of(2000, 9, 30), returnedQuarter.getEndDate());
     }
@@ -70,7 +85,7 @@ void getMostCurrentQuartersShouldReturnCurrentQuarterAndFutureQuarterAndGJForTes
 
     private void assertGJForTestsQuarterIsFoundOnce(List<Quarter> quarters) {
         long foundGJForTestsQuartersCount = quarters.stream()
-                .filter(quarter -> quarter.getLabel().equals("GJ ForTests")).count();
+                .filter(quarter -> quarter.getLabel().equals(GJ_FOR_TEST_QUARTER_LABEL)).count();
         assertEquals(1, foundGJForTestsQuartersCount);
     }
 
@@ -84,7 +99,12 @@ private void assertCurrentQuarterIsFoundOnce(List<Quarter> quarters) {
     void shouldReturnCurrentQuarter() {
         Quarter quarter = quarterPersistenceService.getCurrentQuarter();
 
-        assertTrue(QuarterRangeChecker.nowIsInQuarter(LocalDate.now(), quarter));
+        assertTrue(LocalDate.now().isEqual(quarter.getStartDate()) || //
+                LocalDate.now().isAfter(quarter.getStartDate()));
+
+        assertTrue(LocalDate.now().isEqual(quarter.getEndDate()) || //
+                LocalDate.now().isBefore(quarter.getEndDate()));
+
         assertNotNull(quarter.getId());
         assertNotNull(quarter.getLabel());
     }
@@ -93,11 +113,11 @@ void shouldReturnCurrentQuarter() {
     @Test
     void findByLabelShouldReturnSingleQuarterWhenLabelIsValid() {
         // arrange + act
-        Quarter returnedQuarter = quarterPersistenceService.findByLabel("GJ ForTests");
+        Quarter returnedQuarter = quarterPersistenceService.findByLabel(GJ_FOR_TEST_QUARTER_LABEL);
 
         // assert
-        assertEquals(99L, returnedQuarter.getId());
-        assertEquals("GJ ForTests", returnedQuarter.getLabel());
+        assertEquals(GJ_FOR_TESTS_QUARTER_ID, returnedQuarter.getId());
+        assertEquals(GJ_FOR_TEST_QUARTER_LABEL, returnedQuarter.getLabel());
         assertEquals(LocalDate.of(2000, 7, 1), returnedQuarter.getStartDate());
         assertEquals(LocalDate.of(2000, 9, 30), returnedQuarter.getEndDate());
     }
diff --git a/backend/src/test/java/ch/puzzle/okr/service/persistence/TeamPersistenceServiceIT.java b/backend/src/test/java/ch/puzzle/okr/service/persistence/TeamPersistenceServiceIT.java
index 01d9767a74..f71c9daa79 100644
--- a/backend/src/test/java/ch/puzzle/okr/service/persistence/TeamPersistenceServiceIT.java
+++ b/backend/src/test/java/ch/puzzle/okr/service/persistence/TeamPersistenceServiceIT.java
@@ -4,35 +4,34 @@
 import ch.puzzle.okr.dto.ErrorDto;
 import ch.puzzle.okr.exception.OkrResponseStatusException;
 import ch.puzzle.okr.models.Team;
+import ch.puzzle.okr.multitenancy.TenantContext;
 import ch.puzzle.okr.test.SpringIntegrationTest;
 import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
-import org.junit.jupiter.params.ParameterizedTest;
-import org.junit.jupiter.params.provider.Arguments;
-import org.junit.jupiter.params.provider.MethodSource;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.web.server.ResponseStatusException;
 
 import java.util.List;
-import java.util.stream.Stream;
 
 import static ch.puzzle.okr.test.TestConstants.TEAM_PUZZLE;
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.junit.jupiter.api.Assertions.*;
-import static org.junit.jupiter.params.provider.Arguments.arguments;
 import static org.springframework.http.HttpStatus.*;
 
 @SpringIntegrationTest
 class TeamPersistenceServiceIT {
 
-    private static final Logger logger = LoggerFactory.getLogger(TeamPersistenceServiceIT.class);
     private static final String NEW_TEAM = "New Team";
     private Team createdTeam;
     @Autowired
     private TeamPersistenceService teamPersistenceService;
 
+    @BeforeEach
+    void setUp() {
+        TenantContext.setCurrentTenant(TestHelper.SCHEMA_PITC);
+    }
+
     @AfterEach
     void tearDown() {
         try {
@@ -45,6 +44,7 @@ void tearDown() {
         } finally {
             createdTeam = null;
         }
+        TenantContext.setCurrentTenant(null);
     }
 
     @Test
@@ -133,16 +133,6 @@ void shouldDeleteTeam() {
         assertTrue(TestHelper.getAllErrorKeys(expectedErrors).contains(exception.getReason()));
     }
 
-    @ParameterizedTest
-    @MethodSource("findTeamIdsByOrganisationNamesArguments")
-    void findTeamIdsByOrganisationNamesShouldReturnFirstLevelTeams(List<String> organisationNames,
-            List<Long> expectedIds, String useCase) {
-        logger.info(useCase);
-        List<Long> teamIds = teamPersistenceService.findTeamIdsByOrganisationNames(organisationNames);
-
-        assertThat(expectedIds).hasSameElementsAs(teamIds);
-    }
-
     @Test
     void shouldFindTeamsByName() {
         Team team = Team.Builder.builder().withName(NEW_TEAM).build();
@@ -150,14 +140,4 @@ void shouldFindTeamsByName() {
         List<Team> teams = teamPersistenceService.findTeamsByName(NEW_TEAM);
         assertThat(teams).contains(createdTeam);
     }
-
-    private static Stream<Arguments> findTeamIdsByOrganisationNamesArguments() {
-        return Stream.of(arguments(List.of("org_gl"), List.of(5L), "get 1st level team"), //
-                arguments(List.of("org_bl"), List.of(6L, 8L), "get 2nd level teams"), //
-                arguments(List.of("org_mobility"), List.of(6L), "get teams belong to organisation mobility"), //
-                arguments(List.of("org_inactive"), List.of(4L, 8L), "get teams belong to inactive organisation name"), //
-                arguments(List.of("org_azubi"), List.of(), "get empty team list for organisation azubi"), //
-                arguments(List.of("org_unknown"), List.of(), "get teams belong to unknown organisation name") //
-        );
-    }
 }
\ No newline at end of file
diff --git a/backend/src/test/java/ch/puzzle/okr/service/persistence/UserPersistenceServiceIT.java b/backend/src/test/java/ch/puzzle/okr/service/persistence/UserPersistenceServiceIT.java
index e7c00837bb..ca1dc10624 100644
--- a/backend/src/test/java/ch/puzzle/okr/service/persistence/UserPersistenceServiceIT.java
+++ b/backend/src/test/java/ch/puzzle/okr/service/persistence/UserPersistenceServiceIT.java
@@ -1,40 +1,33 @@
 package ch.puzzle.okr.service.persistence;
 
 import ch.puzzle.okr.models.User;
+import ch.puzzle.okr.multitenancy.TenantContext;
 import ch.puzzle.okr.test.SpringIntegrationTest;
 import org.assertj.core.api.Assertions;
 import org.junit.jupiter.api.AfterEach;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
 import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.cache.Cache;
-import org.springframework.cache.CacheManager;
 import org.springframework.http.HttpStatus;
 import org.springframework.web.server.ResponseStatusException;
 
 import java.util.List;
 
-import static ch.puzzle.okr.SpringCachingConfig.USER_CACHE;
 import static org.junit.jupiter.api.Assertions.*;
 
 @SpringIntegrationTest
 class UserPersistenceServiceIT {
 
-    private static final String USERNAME_ALICE = "alice";
+    private static final String EMAIL_ALICE = "wunderland@puzzle.ch";
 
     User createdUser;
 
     @Autowired
     private UserPersistenceService userPersistenceService;
 
-    @Autowired
-    private CacheManager cacheManager;
-
-    private Cache cache;
-
     @BeforeEach
-    void beforeEach() {
-        cache = cacheManager.getCache(USER_CACHE);
+    void setUp() {
+        TenantContext.setCurrentTenant("pitc");
     }
 
     @AfterEach
@@ -43,14 +36,14 @@ void tearDown() {
             userPersistenceService.deleteById(createdUser.getId());
             createdUser = null;
         }
-        cache.clear();
+        TenantContext.setCurrentTenant(null);
     }
 
     @Test
     void shouldReturnAllUsersCorrect() throws ResponseStatusException {
         List<User> userList = userPersistenceService.findAll();
 
-        Assertions.assertThat(userList).hasSize(6);
+        Assertions.assertThat(userList.size()).isGreaterThanOrEqualTo(7);
     }
 
     @Test
@@ -60,7 +53,6 @@ void shouldReturnSingleUserWhenFindingOwnerByValidId() {
         assertEquals(1L, returnedUser.getId());
         assertEquals("Paco", returnedUser.getFirstname());
         assertEquals("Eggimann", returnedUser.getLastname());
-        assertEquals("peggimann", returnedUser.getUsername());
         assertEquals("peggimann@puzzle.ch", returnedUser.getEmail());
     }
 
@@ -84,37 +76,26 @@ void shouldThrowExceptionWhenFindingOwnerWithNullId() {
 
     @Test
     void getOrCreateUserShouldReturnSingleUserWhenUserFound() {
-        User existingUser = User.Builder.builder().withUsername(USERNAME_ALICE).build();
+        User existingUser = User.Builder.builder().withEmail(EMAIL_ALICE).build();
 
         User returnedUser = userPersistenceService.getOrCreateUser(existingUser);
 
         assertEquals(11L, returnedUser.getId());
         assertEquals("Alice", returnedUser.getFirstname());
         assertEquals("Wunderland", returnedUser.getLastname());
-        assertEquals(USERNAME_ALICE, returnedUser.getUsername());
         assertEquals("wunderland@puzzle.ch", returnedUser.getEmail());
     }
 
     @Test
     void getOrCreateUserShouldReturnSavedUserWhenUserNotFound() {
         User newUser = User.Builder.builder().withId(null).withFirstname("firstname").withLastname("lastname")
-                .withUsername("username").withEmail("lastname@puzzle.ch").build();
+                .withEmail("lastname@puzzle.ch").build();
 
         createdUser = userPersistenceService.getOrCreateUser(newUser);
 
         assertNotNull(createdUser.getId());
         assertEquals("firstname", createdUser.getFirstname());
         assertEquals("lastname", createdUser.getLastname());
-        assertEquals("username", createdUser.getUsername());
         assertEquals("lastname@puzzle.ch", createdUser.getEmail());
     }
-
-    @Test
-    void getOrCreateUserShouldAddUserToCache() {
-        User existingUser = User.Builder.builder().withUsername(USERNAME_ALICE).build();
-        userPersistenceService.getOrCreateUser(existingUser);
-
-        User cachedUser = cacheManager.getCache(USER_CACHE).get(USERNAME_ALICE, User.class);
-        assertNotNull(cachedUser);
-    }
 }
\ No newline at end of file
diff --git a/backend/src/test/java/ch/puzzle/okr/service/validation/CheckInValidationServiceTest.java b/backend/src/test/java/ch/puzzle/okr/service/validation/CheckInValidationServiceTest.java
index 7e6b8bcc93..b4a1801da5 100644
--- a/backend/src/test/java/ch/puzzle/okr/service/validation/CheckInValidationServiceTest.java
+++ b/backend/src/test/java/ch/puzzle/okr/service/validation/CheckInValidationServiceTest.java
@@ -38,7 +38,7 @@ class CheckInValidationServiceTest {
     CheckInPersistenceService checkInPersistenceService = Mockito.mock(CheckInPersistenceService.class);
 
     private final User user = User.Builder.builder().withId(1L).withFirstname("Ruedi").withLastname("Grochde")
-            .withUsername("rgrochde").withEmail("grochde@puzzle.ch").build();
+            .withEmail("grochde@puzzle.ch").build();
     private final Team team = Team.Builder.builder().withId(1L).withName("Team4").build();
     private final Quarter quarter = Quarter.Builder.builder().withId(1L).withLabel("GJ 22/23-Q2").build();
     private final Objective objective = Objective.Builder.builder().withId(1L).withTitle("Objective 1")
diff --git a/backend/src/test/java/ch/puzzle/okr/service/validation/CompletedValidationServiceTest.java b/backend/src/test/java/ch/puzzle/okr/service/validation/CompletedValidationServiceTest.java
index 933146be12..3fbe650e14 100644
--- a/backend/src/test/java/ch/puzzle/okr/service/validation/CompletedValidationServiceTest.java
+++ b/backend/src/test/java/ch/puzzle/okr/service/validation/CompletedValidationServiceTest.java
@@ -44,7 +44,7 @@ class CompletedValidationServiceTest {
     @BeforeEach
     void setUp() {
         this.user = User.Builder.builder().withId(1L).withFirstname("Bob").withLastname("Kaufmann")
-                .withUsername("bkaufmann").withEmail("kaufmann@puzzle.ch").build();
+                .withEmail("kaufmann@puzzle.ch").build();
         this.team = Team.Builder.builder().withId(1L).withName("Team1").build();
         this.quarter = Quarter.Builder.builder().withId(1L).withLabel("GJ 22/23-Q2").build();
 
diff --git a/backend/src/test/java/ch/puzzle/okr/service/validation/KeyResultValidationServiceTest.java b/backend/src/test/java/ch/puzzle/okr/service/validation/KeyResultValidationServiceTest.java
index 1f78e39124..c4382a5ab6 100644
--- a/backend/src/test/java/ch/puzzle/okr/service/validation/KeyResultValidationServiceTest.java
+++ b/backend/src/test/java/ch/puzzle/okr/service/validation/KeyResultValidationServiceTest.java
@@ -40,7 +40,7 @@ class KeyResultValidationServiceTest {
     KeyResultPersistenceService keyResultPersistenceService = Mockito.mock(KeyResultPersistenceService.class);
 
     private final User user = User.Builder.builder().withId(1L).withFirstname("Bob").withLastname("Kaufmann")
-            .withUsername("bkaufmann").withEmail("kaufmann@puzzle.ch").build();
+            .withEmail("kaufmann@puzzle.ch").build();
     private final Quarter quarter = Quarter.Builder.builder().withId(1L).withLabel("GJ 22/23-Q2").build();
     private final Team team = Team.Builder.builder().withId(1L).withName("Team1").build();
     private final Objective objective = Objective.Builder.builder().withId(1L).withTitle("Objective 1")
diff --git a/backend/src/test/java/ch/puzzle/okr/service/validation/ObjectiveValidationServiceTest.java b/backend/src/test/java/ch/puzzle/okr/service/validation/ObjectiveValidationServiceTest.java
index b0ecbbe841..cc52bad997 100644
--- a/backend/src/test/java/ch/puzzle/okr/service/validation/ObjectiveValidationServiceTest.java
+++ b/backend/src/test/java/ch/puzzle/okr/service/validation/ObjectiveValidationServiceTest.java
@@ -1,31 +1,37 @@
 package ch.puzzle.okr.service.validation;
 
-import ch.puzzle.okr.test.AssertionHelper;
 import ch.puzzle.okr.dto.ErrorDto;
 import ch.puzzle.okr.exception.OkrResponseStatusException;
 import ch.puzzle.okr.models.*;
 import ch.puzzle.okr.service.persistence.ObjectivePersistenceService;
-import org.junit.jupiter.api.DisplayName;
+import ch.puzzle.okr.test.TestHelper;
+import org.apache.commons.lang3.StringUtils;
+import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.extension.ExtendWith;
 import org.junit.jupiter.params.ParameterizedTest;
 import org.junit.jupiter.params.provider.Arguments;
+import org.junit.jupiter.params.provider.EnumSource;
 import org.junit.jupiter.params.provider.MethodSource;
 import org.mockito.InjectMocks;
 import org.mockito.Mockito;
 import org.mockito.Spy;
 import org.mockito.junit.jupiter.MockitoExtension;
 import org.springframework.boot.test.mock.mockito.MockBean;
+import org.springframework.http.HttpStatus;
 
 import java.time.LocalDate;
 import java.time.LocalDateTime;
 import java.util.List;
 import java.util.stream.Stream;
 
-import static ch.puzzle.okr.test.AssertionHelper.assertOkrResponseStatusException;
-import static org.junit.jupiter.api.Assertions.assertDoesNotThrow;
-import static org.junit.jupiter.api.Assertions.assertThrows;
+import static ch.puzzle.okr.Constants.BACK_LOG_QUARTER_LABEL;
+import static ch.puzzle.okr.test.TestConstants.BACK_LOG_QUARTER_ID;
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.junit.jupiter.api.Assertions.*;
+import static org.junit.jupiter.params.provider.Arguments.arguments;
 import static org.mockito.Mockito.*;
+import static org.springframework.http.HttpStatus.BAD_REQUEST;
 import static org.springframework.http.HttpStatus.INTERNAL_SERVER_ERROR;
 
 @ExtendWith(MockitoExtension.class)
@@ -33,214 +39,418 @@ class ObjectiveValidationServiceTest {
     @MockBean
     ObjectivePersistenceService objectivePersistenceService = Mockito.mock(ObjectivePersistenceService.class);
 
+    Objective objective1;
+    Objective objectiveMinimal;
+    User user;
+    Quarter quarter;
+    Team team;
     @Spy
     @InjectMocks
     private ObjectiveValidationService validator;
 
-    private static final State STATE_NOT_DRAFT = State.SUCCESSFUL;
-
-    private static final User user = User.Builder.builder() //
-            .withId(1L) //
-            .withFirstname("Bob") //
-            .withLastname("Kaufmann") //
-            .withUsername("bkaufmann") //
-            .withEmail("kaufmann@puzzle.ch").build();
-
-    private static final Quarter quarter = Quarter.Builder.builder() //
-            .withId(1L) //
-            .withLabel("GJ 22/23-Q2") //
-            .withStartDate(LocalDate.of(2022, 1, 1)) //
-            .withEndDate(LocalDate.of(2022, 3, 31)).build();
-
-    private static final Team team = Team.Builder.builder() //
-            .withId(1L) //
-            .withName("Team1").build();
-
-    private static Stream<Arguments> validBacklogObjectives() {
-        return Stream.of( //
-                Arguments.of(customizedObjective("Backlog", State.DRAFT, null, null)), //
-                Arguments.of(customizedObjective("Backlog", STATE_NOT_DRAFT, LocalDate.now(), null)), //
-                Arguments.of(customizedObjective("Backlog", STATE_NOT_DRAFT, null, LocalDate.now())) //
-        );
-    }
-
-    private static Stream<Arguments> invalidBacklogObjectives() {
-        return Stream.of(//
-                Arguments.of(customizedObjective("Backlog", STATE_NOT_DRAFT, null, null)) //
-        );
-    }
-
-    private static Objective customizedObjective(String label, State state, LocalDate startDate, LocalDate endDate) {
-        return Objective.Builder.builder() //
-                .withId(1L) //
-                .withTitle("Objective with label and state") //
-                .withCreatedBy(user) //
-                .withCreatedOn(LocalDateTime.MAX) //
-                .withState(state) //
-                .withTeam(team) //
-                .withQuarter(Quarter.Builder.builder() //
-                        .withId(199L) //
-                        .withLabel(label) //
-                        .withStartDate(startDate) //
-                        .withEndDate(endDate) //
-                        .build()) //
-                .withModifiedBy(user) //
-                .build();
+    private static Stream<Arguments> nameValidationArguments() {
+        return Stream.of(
+                arguments(StringUtils.repeat('1', 251),
+                        List.of(new ErrorDto("ATTRIBUTE_SIZE_BETWEEN", List.of("title", "Objective", "2", "250")))),
+                arguments(StringUtils.repeat('1', 1),
+                        List.of(new ErrorDto("ATTRIBUTE_SIZE_BETWEEN", List.of("title", "Objective", "2", "250")))),
+
+                arguments("",
+                        List.of(new ErrorDto("ATTRIBUTE_SIZE_BETWEEN", List.of("title", "Objective", "2", "250")),
+                                new ErrorDto("ATTRIBUTE_NOT_BLANK", List.of("title", "Objective")))),
+
+                arguments(" ",
+                        List.of(new ErrorDto("ATTRIBUTE_SIZE_BETWEEN", List.of("title", "Objective", "2", "250")),
+                                new ErrorDto("ATTRIBUTE_NOT_BLANK", List.of("title", "Objective")))),
+
+                arguments("         ", List.of(new ErrorDto("ATTRIBUTE_NOT_BLANK", List.of("title", "Objective")))),
+                arguments(null, List.of(new ErrorDto("ATTRIBUTE_NOT_BLANK", List.of("title", "Objective")),
+                        new ErrorDto("ATTRIBUTE_NOT_NULL", List.of("title", "Objective")))));
+    }
+
+    @BeforeEach
+    void setUp() {
+        this.user = User.Builder.builder().withId(1L).withFirstname("Bob").withLastname("Kaufmann")
+                .withEmail("kaufmann@puzzle.ch").build();
+        this.team = Team.Builder.builder().withId(1L).withName("Team1").build();
+        this.quarter = Quarter.Builder.builder().withId(1L).withLabel("GJ 22/23-Q2")
+                .withStartDate(LocalDate.of(2022, 1, 1)).withEndDate(LocalDate.of(2022, 3, 31)).build();
+
+        this.objective1 = Objective.Builder.builder().withId(1L).withTitle("Objective 1").withCreatedBy(user)
+                .withTeam(team).withQuarter(quarter).withDescription("This is our description")
+                .withModifiedOn(LocalDateTime.MAX).withState(State.DRAFT).withModifiedBy(user)
+                .withCreatedOn(LocalDateTime.MAX).build();
+
+        this.objectiveMinimal = Objective.Builder.builder().withId(null).withTitle("Objective 2").withCreatedBy(user)
+                .withTeam(team).withQuarter(quarter).withState(State.DRAFT).withCreatedOn(LocalDateTime.MAX).build();
+
+        when(objectivePersistenceService.findById(1L)).thenReturn(objective1);
+        when(objectivePersistenceService.getModelName()).thenReturn("Objective");
+        doThrow(new OkrResponseStatusException(HttpStatus.NOT_FOUND,
+                String.format("%s with id %s not found", objectivePersistenceService.getModelName(), 2L)))
+                        .when(objectivePersistenceService).findById(2L);
     }
 
-    @DisplayName("validateOnCreate() should be successful when team is valid")
     @Test
-    void validateOnCreateShouldBeSuccessfulWhenTeamIsValid() {
-        // arrange
-        Objective objectiveMinimal = Objective.Builder.builder() //
-                .withId(null) //
-                .withTitle("Objective") //
-                .withCreatedBy(user) //
-                .withTeam(team) //
-                .withQuarter(quarter) //
-                .withState(State.DRAFT) //
-                .withCreatedOn(LocalDateTime.MAX) //
-                .build();
+    void validateOnGetShouldBeSuccessfulWhenValidObjectiveId() {
+        validator.validateOnGet(1L);
+
+        verify(validator, times(1)).validateOnGet(1L);
+        verify(validator, times(1)).throwExceptionWhenIdIsNull(1L);
+    }
+
+    @Test
+    void validateOnGetShouldThrowExceptionIfObjectiveIdIsNull() {
+        OkrResponseStatusException exception = assertThrows(OkrResponseStatusException.class,
+                () -> validator.validateOnGet(null));
+
+        verify(validator, times(1)).throwExceptionWhenIdIsNull(null);
+        List<ErrorDto> expectedErrors = List.of(new ErrorDto("ATTRIBUTE_NULL", List.of("ID", "Objective")));
+
+        assertEquals(BAD_REQUEST, exception.getStatusCode());
+        assertThat(expectedErrors).hasSameElementsAs(exception.getErrors());
+        assertTrue(TestHelper.getAllErrorKeys(expectedErrors).contains(exception.getReason()));
+    }
 
-        // act
+    @Test
+    void validateOnCreateShouldBeSuccessfulWhenTeamIsValid() {
         validator.validateOnCreate(objectiveMinimal);
 
-        // assert
         verify(validator, times(1)).throwExceptionWhenModelIsNull(objectiveMinimal);
         verify(validator, times(1)).validate(objectiveMinimal);
     }
 
-    @DisplayName("validateOnUpdate() should be successful when ModifiedBy is not null")
-    @Test
-    void validateOnUpdateShouldBeSuccessfulWhenModifiedByIsNotNull() {
-        // arrange
-        User modifiedBy = user;
-        Objective objectiveValid = Objective.Builder.builder() //
-                .withId(1L) //
-                .withTitle("ModifiedBy is not null on create") //
-                .withCreatedBy(user) //
-                .withCreatedOn(LocalDateTime.MAX) //
-                .withState(State.DRAFT) //
-                .withTeam(team) //
-                .withQuarter(quarter) //
-                .withModifiedBy(modifiedBy) //
-                .build();
+    @Test
+    void validateOnCreateShouldThrowExceptionWhenModelIsNull() {
+        OkrResponseStatusException exception = assertThrows(OkrResponseStatusException.class,
+                () -> validator.validateOnCreate(null));
 
-        when(objectivePersistenceService.findById(1L)).thenReturn(objectiveValid);
+        List<ErrorDto> expectedErrors = List.of(new ErrorDto("MODEL_NULL", List.of("Objective")));
 
-        // act + assert
-        assertDoesNotThrow(() -> validator.validateOnUpdate(1L, objectiveValid));
+        assertEquals(BAD_REQUEST, exception.getStatusCode());
+        assertThat(expectedErrors).hasSameElementsAs(exception.getErrors());
+        assertTrue(TestHelper.getAllErrorKeys(expectedErrors).contains(exception.getReason()));
     }
 
-    @DisplayName("validateOnCreate() should throw exception when ModifiedBy is set")
     @Test
-    void validateOnCreateShouldThrowExceptionWhenModifiedByIsSet() {
-        // arrange
-        User modifiedBy = user;
-        Objective objectiveInvalid = Objective.Builder.builder() //
-                .withId(null) //
-                .withTitle("ModifiedBy is not null on create") //
-                .withCreatedBy(user) //
-                .withCreatedOn(LocalDateTime.MAX) //
-                .withState(State.DRAFT) //
-                .withTeam(team) //
-                .withQuarter(quarter) //
-                .withModifiedBy(modifiedBy) //
-                .build();
+    void validateOnCreateShouldThrowExceptionWhenIdIsNotNull() {
+        OkrResponseStatusException exception = assertThrows(OkrResponseStatusException.class,
+                () -> validator.validateOnCreate(objective1));
+
+        List<ErrorDto> expectedErrors = List.of(new ErrorDto("ATTRIBUTE_NOT_NULL", List.of("ID", "Objective")));
+
+        assertEquals(BAD_REQUEST, exception.getStatusCode());
+        assertThat(expectedErrors).hasSameElementsAs(exception.getErrors());
+        assertTrue(TestHelper.getAllErrorKeys(expectedErrors).contains(exception.getReason()));
+    }
+
+    @ParameterizedTest
+    @MethodSource("nameValidationArguments")
+    void validateOnCreateShouldThrowExceptionWhenTitleIsInvalid(String title, List<ErrorDto> expectedErrors) {
+        Objective objective = Objective.Builder.builder().withId(null).withTitle(title).withCreatedBy(this.user)
+                .withTeam(this.team).withQuarter(this.quarter).withDescription("This is our description 2")
+                .withModifiedOn(LocalDateTime.MAX).withState(State.DRAFT).withCreatedOn(LocalDateTime.MAX).build();
+
+        OkrResponseStatusException exception = assertThrows(OkrResponseStatusException.class,
+                () -> validator.validateOnCreate(objective));
+
+        assertEquals(BAD_REQUEST, exception.getStatusCode());
+        assertThat(expectedErrors).hasSameElementsAs(exception.getErrors());
+        assertTrue(TestHelper.getAllErrorKeys(expectedErrors).contains(exception.getReason()));
+    }
 
-        // act + assert
+    @Test
+    void validateOnCreateShouldThrowExceptionWhenAttrsAreMissing() {
+        Objective objectiveInvalid = Objective.Builder.builder().withId(null).withTitle("Title").withQuarter(quarter)
+                .build();
         OkrResponseStatusException exception = assertThrows(OkrResponseStatusException.class,
                 () -> validator.validateOnCreate(objectiveInvalid));
 
+        List<ErrorDto> expectedErrors = List.of(new ErrorDto("ATTRIBUTE_NOT_NULL", List.of("team", "Objective")),
+                new ErrorDto("ATTRIBUTE_NOT_NULL", List.of("createdBy", "Objective")),
+                new ErrorDto("ATTRIBUTE_NOT_NULL", List.of("createdOn", "Objective")),
+                new ErrorDto("ATTRIBUTE_NOT_NULL", List.of("state", "Objective")));
+
+        assertEquals(BAD_REQUEST, exception.getStatusCode());
+        assertThat(expectedErrors).hasSameElementsAs(exception.getErrors());
+        assertTrue(TestHelper.getAllErrorKeys(expectedErrors).contains(exception.getReason()));
+    }
+
+    @Test
+    void validateOnCreateShouldThrowExceptionWhenAttrModifiedByIsSet() {
+        Objective objectiveInvalid = Objective.Builder.builder().withId(null)
+                .withTitle("ModifiedBy is not null on create").withCreatedBy(user).withCreatedOn(LocalDateTime.MAX)
+                .withState(State.DRAFT).withTeam(team).withQuarter(quarter).withModifiedBy(user).build();
+
+        OkrResponseStatusException exception = assertThrows(OkrResponseStatusException.class,
+                () -> validator.validateOnCreate(objectiveInvalid));
         List<ErrorDto> expectedErrors = List.of(new ErrorDto("ATTRIBUTE_SET_FORBIDDEN", List.of("ModifiedBy",
-                "User{id=1, version=0, username='bkaufmann', firstname='Bob', lastname='Kaufmann', email='kaufmann@puzzle.ch', writeable=false}")));
+                "User{id=1, version=0, firstname='Bob', lastname='Kaufmann', email='kaufmann@puzzle.ch', isOkrChampion='false'}")));
 
-        assertOkrResponseStatusException(exception, expectedErrors);
+        assertEquals(BAD_REQUEST, exception.getStatusCode());
+        assertThat(expectedErrors).hasSameElementsAs(exception.getErrors());
+        assertTrue(TestHelper.getAllErrorKeys(expectedErrors).contains(exception.getReason()));
     }
 
-    @DisplayName("validateOnUpdate() should throw exception when ModifiedBy is null")
     @Test
-    void validateOnUpdateShouldThrowExceptionWhenModifiedByIsNull() {
-        // arrange
-        User modifiedBy = null;
-        Objective objectiveInvalid = Objective.Builder.builder() //
-                .withId(1L) //
-                .withTitle("ModifiedBy is not null on create") //
-                .withCreatedBy(user) //
-                .withCreatedOn(LocalDateTime.MAX) //
-                .withState(State.DRAFT) //
-                .withTeam(team) //
-                .withQuarter(quarter) //
-                .withModifiedBy(modifiedBy) //
-                .build();
+    void validateOnCreateShouldThrowExceptionWhenStartDateIsNull() {
+        Quarter invalidQuarter = Quarter.Builder.builder().withId(1L).withLabel("GJ-22/23-Q3")
+                .withEndDate(LocalDate.of(2022, 7, 31)).build();
+        Objective objectiveInvalid = Objective.Builder.builder().withId(null).withTitle("Start date is missing")
+                .withCreatedBy(user).withCreatedOn(LocalDateTime.MAX).withState(State.DRAFT).withTeam(team)
+                .withQuarter(invalidQuarter).build();
+
+        OkrResponseStatusException exception = assertThrows(OkrResponseStatusException.class,
+                () -> validator.validateOnCreate(objectiveInvalid));
+        List<ErrorDto> expectedErrors = List.of(new ErrorDto("ATTRIBUTE_NULL", List.of("StartDate", "GJ-22/23-Q3")));
+
+        assertEquals(BAD_REQUEST, exception.getStatusCode());
+        assertThat(expectedErrors).hasSameElementsAs(exception.getErrors());
+        assertTrue(TestHelper.getAllErrorKeys(expectedErrors).contains(exception.getReason()));
+    }
+
+    @Test
+    void validateOnCreateShouldThrowExceptionWhenEndDateIsNull() {
+        Quarter invalidQuarter = Quarter.Builder.builder().withId(1L).withLabel("GJ-22/23-Q3")
+                .withStartDate(LocalDate.of(2022, 4, 1)).build();
+        Objective objectiveInvalid = Objective.Builder.builder().withId(null).withTitle("End date is missing")
+                .withCreatedBy(user).withCreatedOn(LocalDateTime.MAX).withState(State.DRAFT).withTeam(team)
+                .withQuarter(invalidQuarter).build();
+
+        OkrResponseStatusException exception = assertThrows(OkrResponseStatusException.class,
+                () -> validator.validateOnCreate(objectiveInvalid));
+        List<ErrorDto> expectedErrors = List.of(new ErrorDto("ATTRIBUTE_NULL", List.of("EndDate", "GJ-22/23-Q3")));
+
+        assertEquals(BAD_REQUEST, exception.getStatusCode());
+        assertThat(expectedErrors).hasSameElementsAs(exception.getErrors());
+        assertTrue(TestHelper.getAllErrorKeys(expectedErrors).contains(exception.getReason()));
+    }
+
+    @Test
+    void validateOnUpdateShouldBeSuccessfulWhenObjectiveIsValid() {
+        validator.validateOnUpdate(objective1.getId(), objective1);
+
+        verify(validator, times(1)).throwExceptionWhenModelIsNull(objective1);
+        verify(validator, times(1)).throwExceptionWhenIdIsNull(objective1.getId());
+        verify(validator, times(1)).throwExceptionWhenIdHasChanged(objective1.getId(), objective1.getId());
+        verify(validator, times(1)).validate(objective1);
+    }
+
+    @Test
+    void validateOnUpdateShouldThrowExceptionWhenModelIsNull() {
+        OkrResponseStatusException exception = assertThrows(OkrResponseStatusException.class,
+                () -> validator.validateOnUpdate(1L, null));
+
+        List<ErrorDto> expectedErrors = List.of(new ErrorDto("MODEL_NULL", List.of("Objective")));
+
+        assertEquals(BAD_REQUEST, exception.getStatusCode());
+        assertThat(expectedErrors).hasSameElementsAs(exception.getErrors());
+        assertTrue(TestHelper.getAllErrorKeys(expectedErrors).contains(exception.getReason()));
+    }
+
+    @Test
+    void validateOnUpdateShouldThrowExceptionWhenIdIsNull() {
+        OkrResponseStatusException exception = assertThrows(OkrResponseStatusException.class,
+                () -> validator.validateOnUpdate(null, objectiveMinimal));
+
+        verify(validator, times(1)).throwExceptionWhenModelIsNull(objectiveMinimal);
+        verify(validator, times(1)).throwExceptionWhenIdIsNull(null);
+        List<ErrorDto> expectedErrors = List.of(new ErrorDto("ATTRIBUTE_NULL", List.of("ID", "Objective")));
+
+        assertEquals(BAD_REQUEST, exception.getStatusCode());
+        assertThat(expectedErrors).hasSameElementsAs(exception.getErrors());
+        assertTrue(TestHelper.getAllErrorKeys(expectedErrors).contains(exception.getReason()));
+    }
+
+    @Test
+    void validateOnUpdateShouldThrowExceptionWhenIdHasChanged() {
+        OkrResponseStatusException exception = assertThrows(OkrResponseStatusException.class,
+                () -> validator.validateOnUpdate(7L, objective1));
+
+        verify(validator, times(1)).throwExceptionWhenModelIsNull(objective1);
+        verify(validator, times(1)).throwExceptionWhenIdIsNull(objective1.getId());
+        verify(validator, times(1)).throwExceptionWhenIdHasChanged(7L, objective1.getId());
+        List<ErrorDto> expectedErrors = List.of(new ErrorDto("ATTRIBUTE_CHANGED", List.of("ID", "7", "1")));
+
+        assertEquals(BAD_REQUEST, exception.getStatusCode());
+        assertThat(expectedErrors).hasSameElementsAs(exception.getErrors());
+        assertTrue(TestHelper.getAllErrorKeys(expectedErrors).contains(exception.getReason()));
+    }
+
+    @ParameterizedTest
+    @MethodSource("nameValidationArguments")
+    void validateOnUpdateShouldThrowExceptionWhenTitleIsInvalid(String title, List<ErrorDto> expectedErrors) {
+        Objective objective = Objective.Builder.builder().withId(3L).withTitle(title).withCreatedBy(this.user)
+                .withTeam(this.team).withQuarter(this.quarter).withDescription("This is our description 2")
+                .withModifiedOn(LocalDateTime.MAX).withState(State.DRAFT).withModifiedBy(this.user)
+                .withCreatedOn(LocalDateTime.MAX).build();
+        when(objectivePersistenceService.findById(objective.getId())).thenReturn(objective);
+
+        OkrResponseStatusException exception = assertThrows(OkrResponseStatusException.class,
+                () -> validator.validateOnUpdate(3L, objective));
+
+        assertEquals(BAD_REQUEST, exception.getStatusCode());
+        assertThat(expectedErrors).hasSameElementsAs(exception.getErrors());
+        assertTrue(TestHelper.getAllErrorKeys(expectedErrors).contains(exception.getReason()));
+    }
+
+    @Test
+    void validateOnUpdateShouldThrowExceptionWhenAttrsAreMissing() {
+        Objective objective = Objective.Builder.builder().withId(5L).withTitle("Title").withQuarter(quarter)
+                .withModifiedBy(user).build();
+        when(objectivePersistenceService.findById(objective.getId())).thenReturn(objective);
+
+        OkrResponseStatusException exception = assertThrows(OkrResponseStatusException.class,
+                () -> validator.validateOnUpdate(5L, objective));
+        List<ErrorDto> expectedErrors = List.of(new ErrorDto("ATTRIBUTE_NOT_NULL", List.of("team", "Objective")),
+                new ErrorDto("ATTRIBUTE_NOT_NULL", List.of("createdBy", "Objective")),
+                new ErrorDto("ATTRIBUTE_NOT_NULL", List.of("createdOn", "Objective")),
+                new ErrorDto("ATTRIBUTE_NOT_NULL", List.of("state", "Objective")));
+
+        assertEquals(BAD_REQUEST, exception.getStatusCode());
+        assertThat(expectedErrors).hasSameElementsAs(exception.getErrors());
+        assertTrue(TestHelper.getAllErrorKeys(expectedErrors).contains(exception.getReason()));
+    }
+
+    @Test
+    void validateOnUpdateShouldThrowExceptionWhenAttrModifiedByIsNotSet() {
+        Objective objectiveInvalid = Objective.Builder.builder().withId(1L)
+                .withTitle("ModifiedBy is not null on create").withCreatedBy(user).withCreatedOn(LocalDateTime.MAX)
+                .withState(State.DRAFT).withTeam(team).withQuarter(quarter).withModifiedBy(null).build();
 
-        // act + assert
         OkrResponseStatusException exception = assertThrows(OkrResponseStatusException.class,
                 () -> validator.validateOnUpdate(1L, objectiveInvalid));
 
         List<ErrorDto> expectedErrors = List.of(new ErrorDto("ATTRIBUTE_NOT_SET", List.of("modifiedBy")));
-        AssertionHelper.assertOkrResponseStatusException(INTERNAL_SERVER_ERROR, exception, expectedErrors);
-    }
-
-    @DisplayName("validateOnUpdate() should throw exception when team has changed")
-    @Test
-    void validateOnUpdateShouldThrowExceptionWhenTeamHasChanged() {
-        // arrange
-        Objective savedObjectiveWithoutTeam = Objective.Builder.builder() //
-                .withId(1L) //
-                .withTitle("Team has changed") //
-                .withCreatedBy(user) //
-                .withCreatedOn(LocalDateTime.MAX) //
-                .withState(State.DRAFT).withTeam(team) //
-                .withTeam(null) //
-                .withQuarter(quarter) //
-                .withModifiedBy(null) //
-                .build();
 
-        Objective updatedObjectiveWithTeam = Objective.Builder.builder() //
-                .withId(1L) //
-                .withTitle("Team has changed") //
-                .withCreatedBy(user) //
-                .withCreatedOn(LocalDateTime.MAX) //
-                .withState(State.DRAFT) //
-                .withTeam(team) //
-                .withQuarter(quarter) //
-                .withModifiedBy(user) //
-                .build();
+        assertEquals(INTERNAL_SERVER_ERROR, exception.getStatusCode());
+        assertThat(expectedErrors).hasSameElementsAs(exception.getErrors());
+        assertTrue(TestHelper.getAllErrorKeys(expectedErrors).contains(exception.getReason()));
+    }
 
-        when(objectivePersistenceService.findById(savedObjectiveWithoutTeam.getId()))
-                .thenReturn(savedObjectiveWithoutTeam);
+    @Test
+    void validateOnUpdateShouldThrowExceptionWhenStartDateIsNull() {
+        Quarter invalidQuarter = Quarter.Builder.builder().withId(1L).withLabel("GJ-22/23-Q3")
+                .withEndDate(LocalDate.of(2022, 7, 31)).build();
+        Objective objectiveInvalid = Objective.Builder.builder().withId(1L).withTitle("Start date is missing")
+                .withCreatedBy(user).withCreatedOn(LocalDateTime.MAX).withState(State.DRAFT).withTeam(team)
+                .withQuarter(invalidQuarter).withModifiedBy(user).build();
 
-        // act + assert
         OkrResponseStatusException exception = assertThrows(OkrResponseStatusException.class,
-                () -> validator.validateOnUpdate(1L, updatedObjectiveWithTeam));
+                () -> validator.validateOnUpdate(1L, objectiveInvalid));
+        List<ErrorDto> expectedErrors = List.of(new ErrorDto("ATTRIBUTE_NULL", List.of("StartDate", "GJ-22/23-Q3")));
 
+        assertEquals(BAD_REQUEST, exception.getStatusCode());
+        assertThat(expectedErrors).hasSameElementsAs(exception.getErrors());
+        assertTrue(TestHelper.getAllErrorKeys(expectedErrors).contains(exception.getReason()));
+    }
+
+    @Test
+    void validateOnUpdateShouldThrowExceptionWhenEndDateIsNull() {
+        Quarter invalidQuarter = Quarter.Builder.builder().withId(1L).withLabel("GJ-22/23-Q3")
+                .withStartDate(LocalDate.of(2022, 4, 1)).build();
+        Objective objectiveInvalid = Objective.Builder.builder().withId(1L).withTitle("End date is missing")
+                .withCreatedBy(user).withCreatedOn(LocalDateTime.MAX).withState(State.DRAFT).withTeam(team)
+                .withQuarter(invalidQuarter).withModifiedBy(user).build();
+
+        OkrResponseStatusException exception = assertThrows(OkrResponseStatusException.class,
+                () -> validator.validateOnUpdate(1L, objectiveInvalid));
+        List<ErrorDto> expectedErrors = List.of(new ErrorDto("ATTRIBUTE_NULL", List.of("EndDate", "GJ-22/23-Q3")));
+
+        assertEquals(BAD_REQUEST, exception.getStatusCode());
+        assertThat(expectedErrors).hasSameElementsAs(exception.getErrors());
+        assertTrue(TestHelper.getAllErrorKeys(expectedErrors).contains(exception.getReason()));
+    }
+
+    @Test
+    void validateOnUpdateShouldThrowExceptionWheTeamHasChanged() {
+        Objective savedObjective = Objective.Builder.builder().withId(1L).withTitle("Team has changed")
+                .withCreatedBy(user).withCreatedOn(LocalDateTime.MAX).withState(State.DRAFT).withTeam(team)
+                .withQuarter(quarter).withModifiedBy(null).build();
+        Objective updatedObjective = Objective.Builder.builder().withId(1L).withTitle("Team has changed")
+                .withCreatedBy(user).withCreatedOn(LocalDateTime.MAX).withState(State.DRAFT)
+                .withTeam(Team.Builder.builder().withId(2L).withName("other team").build()).withQuarter(quarter)
+                .withModifiedBy(user).build();
+        when(objectivePersistenceService.findById(savedObjective.getId())).thenReturn(savedObjective);
+
+        OkrResponseStatusException exception = assertThrows(OkrResponseStatusException.class,
+                () -> validator.validateOnUpdate(1L, updatedObjective));
         List<ErrorDto> expectedErrors = List.of(new ErrorDto("ATTRIBUTE_CANNOT_CHANGE", List.of("Team", "Objective")));
-        assertOkrResponseStatusException(exception, expectedErrors);
+
+        assertEquals(BAD_REQUEST, exception.getStatusCode());
+        assertThat(expectedErrors).hasSameElementsAs(exception.getErrors());
+        assertTrue(TestHelper.getAllErrorKeys(expectedErrors).contains(exception.getReason()));
     }
 
-    @DisplayName("validateOnUpdate() should be successful when Objective is valid Backlog Objective")
     @ParameterizedTest
-    @MethodSource("validBacklogObjectives")
-    void validateOnUpdateShouldBeSuccessfulWhenObjectiveIsValidBacklogObjective(Objective validBacklogObjective) {
-        // arrange
-        when(objectivePersistenceService.findById(1L)).thenReturn(validBacklogObjective);
+    @EnumSource(value = State.class, names = { "DRAFT" }, mode = EnumSource.Mode.EXCLUDE)
+    void validateOnCreateShouldThrowExceptionWhenQuarterIsBacklogAndStateIsNotDraft(State state) {
+        Quarter backlogQuarter = Quarter.Builder.builder().withId(BACK_LOG_QUARTER_ID).withLabel(BACK_LOG_QUARTER_LABEL)
+                .withStartDate(null).withEndDate(null).build();
 
-        // act + assert
-        assertDoesNotThrow(() -> validator.validateOnUpdate(1L, validBacklogObjective));
+        Objective invalidObjective = Objective.Builder.builder().withTitle("Invalid Objective").withCreatedBy(user)
+                .withCreatedOn(LocalDateTime.MAX).withState(state).withTeam(team).withQuarter(backlogQuarter).build();
+
+        OkrResponseStatusException exception = assertThrows(OkrResponseStatusException.class,
+                () -> validator.validateOnCreate(invalidObjective));
+        List<ErrorDto> expectedErrors = List
+                .of(new ErrorDto("ATTRIBUTE_MUST_BE_DRAFT", List.of("Objective", "Draft", state.toString())));
+
+        assertEquals(BAD_REQUEST, exception.getStatusCode());
+        assertThat(expectedErrors).hasSameElementsAs(exception.getErrors());
+        assertTrue(TestHelper.getAllErrorKeys(expectedErrors).contains(exception.getReason()));
     }
 
-    @DisplayName("validateOnUpdate() should throw exception when Objective is invalid Backlog Objective")
     @ParameterizedTest
-    @MethodSource("invalidBacklogObjectives")
-    void validateOnUpdateShouldThrowExceptionWhenObjectiveIsInvalidBacklogObjective(Objective invalidBacklogObjective) {
-        // act + assert
+    @EnumSource(value = State.class, names = { "DRAFT" }, mode = EnumSource.Mode.EXCLUDE)
+    void validateOnUpdateShouldThrowExceptionWhenQuarterIsBacklogAndStateIsNotDraft(State state) {
+        Quarter backlogQuarter = Quarter.Builder.builder().withId(BACK_LOG_QUARTER_ID).withLabel(BACK_LOG_QUARTER_LABEL)
+                .withStartDate(null).withEndDate(null).build();
+
+        Objective invalidObjective = Objective.Builder.builder().withId(1L).withTitle("Invalid Objective")
+                .withCreatedBy(user).withCreatedOn(LocalDateTime.MAX).withState(state).withTeam(team)
+                .withQuarter(backlogQuarter).withModifiedBy(user).build();
+
         OkrResponseStatusException exception = assertThrows(OkrResponseStatusException.class,
-                () -> validator.validateOnUpdate(1L, invalidBacklogObjective));
+                () -> validator.validateOnUpdate(1L, invalidObjective));
+        List<ErrorDto> expectedErrors = List
+                .of(new ErrorDto("ATTRIBUTE_MUST_BE_DRAFT", List.of("Objective", "Draft", state.toString())));
+
+        assertEquals(BAD_REQUEST, exception.getStatusCode());
+        assertThat(expectedErrors).hasSameElementsAs(exception.getErrors());
+        assertTrue(TestHelper.getAllErrorKeys(expectedErrors).contains(exception.getReason()));
+    }
+
+    @Test
+    void validateOnUpdateShouldPassWhenQuarterIsBacklogAndStateIsDraft() {
+        Quarter backlogQuarter = Quarter.Builder.builder().withId(BACK_LOG_QUARTER_ID).withLabel(BACK_LOG_QUARTER_LABEL)
+                .withStartDate(null).withEndDate(null).build();
+
+        Objective validObjective = Objective.Builder.builder().withId(1L).withTitle("Invalid Objective")
+                .withCreatedBy(user).withCreatedOn(LocalDateTime.MAX).withState(State.DRAFT).withTeam(team)
+                .withQuarter(backlogQuarter).withModifiedBy(user).build();
 
-        List<ErrorDto> expectedErrors = List.of(new ErrorDto("ATTRIBUTE_MUST_BE_DRAFT",
-                List.of("Objective", "Draft", invalidBacklogObjective.getState().toString())));
-        assertOkrResponseStatusException(exception, expectedErrors);
+        assertDoesNotThrow(() -> validator.validateOnUpdate(1L, validObjective));
     }
 
+    @Test
+    void validateOnDeleteShouldBeSuccessfulWhenValidObjectiveId() {
+        validator.validateOnGet(1L);
+
+        verify(validator, times(1)).validateOnGet(1L);
+        verify(validator, times(1)).throwExceptionWhenIdIsNull(1L);
+    }
+
+    @Test
+    void validateOnDeleteShouldThrowExceptionIfObjectiveIdIsNull() {
+        OkrResponseStatusException exception = assertThrows(OkrResponseStatusException.class,
+                () -> validator.validateOnGet(null));
+
+        verify(validator, times(1)).throwExceptionWhenIdIsNull(null);
+        List<ErrorDto> expectedErrors = List.of(new ErrorDto("ATTRIBUTE_NULL", List.of("ID", "Objective")));
+
+        assertEquals(BAD_REQUEST, exception.getStatusCode());
+        assertThat(expectedErrors).hasSameElementsAs(exception.getErrors());
+        assertTrue(TestHelper.getAllErrorKeys(expectedErrors).contains(exception.getReason()));
+    }
 }
diff --git a/backend/src/test/java/ch/puzzle/okr/service/validation/QuarterValidationServiceTest.java b/backend/src/test/java/ch/puzzle/okr/service/validation/QuarterValidationServiceTest.java
index cefe3e4567..d47a98e53c 100644
--- a/backend/src/test/java/ch/puzzle/okr/service/validation/QuarterValidationServiceTest.java
+++ b/backend/src/test/java/ch/puzzle/okr/service/validation/QuarterValidationServiceTest.java
@@ -1,10 +1,10 @@
 package ch.puzzle.okr.service.validation;
 
-import ch.puzzle.okr.test.TestHelper;
 import ch.puzzle.okr.dto.ErrorDto;
 import ch.puzzle.okr.exception.OkrResponseStatusException;
 import ch.puzzle.okr.models.Quarter;
 import ch.puzzle.okr.service.persistence.QuarterPersistenceService;
+import ch.puzzle.okr.test.TestHelper;
 import org.junit.jupiter.api.DisplayName;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.extension.ExtendWith;
@@ -17,6 +17,7 @@
 import java.time.LocalDate;
 import java.util.List;
 
+import static ch.puzzle.okr.Constants.BACK_LOG_QUARTER_LABEL;
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.junit.jupiter.api.Assertions.*;
 import static org.mockito.Mockito.*;
@@ -36,7 +37,7 @@ class QuarterValidationServiceTest {
     void throwExceptionWhenStartEndDateQuarterIsNullShouldDoNothingWhenQuarterLabelIsBacklog() {
         // arrange
         Quarter quarter = mock(Quarter.class);
-        when(quarter.getLabel()).thenReturn("Backlog");
+        when(quarter.getLabel()).thenReturn(BACK_LOG_QUARTER_LABEL);
 
         // act
         QuarterValidationService.throwExceptionWhenStartEndDateQuarterIsNull(quarter);
diff --git a/backend/src/test/java/ch/puzzle/okr/service/validation/UserValidationServiceTest.java b/backend/src/test/java/ch/puzzle/okr/service/validation/UserValidationServiceTest.java
index 34bf72177d..fbf55cb798 100644
--- a/backend/src/test/java/ch/puzzle/okr/service/validation/UserValidationServiceTest.java
+++ b/backend/src/test/java/ch/puzzle/okr/service/validation/UserValidationServiceTest.java
@@ -39,15 +39,15 @@ class UserValidationServiceTest {
     User userMinimal;
     User user;
 
-    Jwt mockJwt = TestHelper.mockJwtToken("username", "firstname", "lastname", "email@email.com");
+    Jwt mockJwt = TestHelper.mockJwtToken("firstname", "lastname", "email@email.com");
 
     @BeforeEach
     void setUp() {
-        user = User.Builder.builder().withId(1L).withFirstname("Bob").withLastname("Kaufmann").withUsername("bkaufmann")
+        user = User.Builder.builder().withId(1L).withFirstname("Bob").withLastname("Kaufmann")
                 .withEmail("kaufmann@puzzle.ch").build();
 
         userMinimal = User.Builder.builder().withFirstname("Max").withLastname("Mustermann")
-                .withEmail("max@mustermann.com").withUsername("mustermann").build();
+                .withEmail("max@mustermann.com").build();
 
         when(userPersistenceService.findById(1L)).thenReturn(user);
         when(userPersistenceService.getModelName()).thenReturn("User");
@@ -60,23 +60,6 @@ void setUp() {
     @InjectMocks
     private UserValidationService validator;
 
-    private static Stream<Arguments> userNameValidationArguments() {
-        return Stream.of(
-                arguments(StringUtils.repeat('1', 21),
-                        List.of(new ErrorDto("ATTRIBUTE_SIZE_BETWEEN", List.of("username", "User", "2", "20")))),
-                arguments(StringUtils.repeat('1', 1),
-                        List.of(new ErrorDto("ATTRIBUTE_SIZE_BETWEEN", List.of("username", "User", "2", "20")))),
-                arguments("",
-                        List.of(new ErrorDto("ATTRIBUTE_NOT_BLANK", List.of("username", "User")),
-                                new ErrorDto("ATTRIBUTE_SIZE_BETWEEN", List.of("username", "User", "2", "20")))),
-                arguments(" ",
-                        List.of(new ErrorDto("ATTRIBUTE_NOT_BLANK", List.of("username", "User")),
-                                new ErrorDto("ATTRIBUTE_SIZE_BETWEEN", List.of("username", "User", "2", "20")))),
-                arguments("         ", List.of(new ErrorDto("ATTRIBUTE_NOT_BLANK", List.of("username", "User")))),
-                arguments(null, List.of(new ErrorDto("ATTRIBUTE_NOT_BLANK", List.of("username", "User")),
-                        new ErrorDto("ATTRIBUTE_NOT_NULL", List.of("username", "User")))));
-    }
-
     private static Stream<Arguments> firstNameValidationArguments() {
         return Stream.of(
                 arguments(StringUtils.repeat('1', 51),
@@ -206,25 +189,11 @@ void validateOnCreateShouldThrowExceptionWhenIdIsNotNull() {
         assertTrue(TestHelper.getAllErrorKeys(expectedErrors).contains(exception.getReason()));
     }
 
-    @ParameterizedTest
-    @MethodSource("userNameValidationArguments")
-    void validateOnCreateShouldThrowExceptionWhenUsernameIsInvalid(String name, List<ErrorDto> errors) {
-        User user2 = User.Builder.builder().withEmail("max@mail.com").withFirstname("firstname")
-                .withLastname("lastname").withUsername(name).build();
-
-        OkrResponseStatusException exception = assertThrows(OkrResponseStatusException.class,
-                () -> validator.validateOnCreate(user2));
-
-        assertEquals(BAD_REQUEST, exception.getStatusCode());
-        assertThat(errors).hasSameElementsAs(exception.getErrors());
-        assertTrue(TestHelper.getAllErrorKeys(errors).contains(exception.getReason()));
-    }
-
     @ParameterizedTest
     @MethodSource("firstNameValidationArguments")
     void validateOnCreateShouldThrowExceptionWhenFirstnameIsInvalid(String name, List<ErrorDto> errors) {
         User user2 = User.Builder.builder().withEmail("max@mail.com").withFirstname(name).withLastname("lastname")
-                .withUsername("username").build();
+                .build();
 
         OkrResponseStatusException exception = assertThrows(OkrResponseStatusException.class,
                 () -> validator.validateOnCreate(user2));
@@ -238,7 +207,7 @@ void validateOnCreateShouldThrowExceptionWhenFirstnameIsInvalid(String name, Lis
     @MethodSource("lastNameValidationArguments")
     void validateOnCreateShouldThrowExceptionWhenLastnameIsInvalid(String name, List<ErrorDto> errors) {
         User user2 = User.Builder.builder().withEmail("max@mail.com").withFirstname("firstname").withLastname(name)
-                .withUsername("username").build();
+                .build();
 
         OkrResponseStatusException exception = assertThrows(OkrResponseStatusException.class,
                 () -> validator.validateOnCreate(user2));
@@ -252,7 +221,7 @@ void validateOnCreateShouldThrowExceptionWhenLastnameIsInvalid(String name, List
     @MethodSource("emailValidationArguments")
     void validateOnCreateShouldThrowExceptionWhenEmailIsInvalid(String email, List<ErrorDto> errors) {
         User user2 = User.Builder.builder().withEmail(email).withFirstname("firstname").withLastname("lastname")
-                .withUsername("username").build();
+                .build();
 
         OkrResponseStatusException exception = assertThrows(OkrResponseStatusException.class,
                 () -> validator.validateOnCreate(user2));
@@ -264,8 +233,8 @@ void validateOnCreateShouldThrowExceptionWhenEmailIsInvalid(String email, List<E
 
     @Test
     void validateOnCreateShouldThrowExceptionWhenAttrsAreMissing() {
-        User userInvalid = User.Builder.builder().withId(null).withUsername("Username").withLastname("Lastname")
-                .withFirstname("firstname").withEmail("falseemail").build();
+        User userInvalid = User.Builder.builder().withId(null).withLastname("Lastname").withFirstname("firstname")
+                .withEmail("falseemail").build();
         OkrResponseStatusException exception = assertThrows(OkrResponseStatusException.class,
                 () -> validator.validateOnCreate(userInvalid));
 
@@ -329,25 +298,11 @@ void validateOnUpdateShouldThrowExceptionWhenIdHasChanged() {
         assertTrue(TestHelper.getAllErrorKeys(expectedErrors).contains(exception.getReason()));
     }
 
-    @ParameterizedTest
-    @MethodSource("userNameValidationArguments")
-    void validateOnUpdateShouldThrowExceptionWhenUsernameIsInvalid(String name, List<ErrorDto> errors) {
-        User user2 = User.Builder.builder().withId(3L).withEmail("max@mail.com").withFirstname("firstname")
-                .withLastname("lastname").withUsername(name).build();
-
-        OkrResponseStatusException exception = assertThrows(OkrResponseStatusException.class,
-                () -> validator.validateOnUpdate(3L, user2));
-
-        assertEquals(BAD_REQUEST, exception.getStatusCode());
-        assertThat(errors).hasSameElementsAs(exception.getErrors());
-        assertTrue(TestHelper.getAllErrorKeys(errors).contains(exception.getReason()));
-    }
-
     @ParameterizedTest
     @MethodSource("firstNameValidationArguments")
     void validateOnUpdateShouldThrowExceptionWhenFirstnameIsInvalid(String name, List<ErrorDto> errors) {
         User user2 = User.Builder.builder().withId(3L).withEmail("max@mail.com").withFirstname(name)
-                .withLastname("lastname").withUsername("username").build();
+                .withLastname("lastname").build();
 
         OkrResponseStatusException exception = assertThrows(OkrResponseStatusException.class,
                 () -> validator.validateOnUpdate(3L, user2));
@@ -361,7 +316,7 @@ void validateOnUpdateShouldThrowExceptionWhenFirstnameIsInvalid(String name, Lis
     @MethodSource("lastNameValidationArguments")
     void validateOnUpdateShouldThrowExceptionWhenLastnameIsInvalid(String name, List<ErrorDto> errors) {
         User user2 = User.Builder.builder().withId(3L).withEmail("max@mail.com").withFirstname("firstname")
-                .withLastname(name).withUsername("username").build();
+                .withLastname(name).build();
 
         OkrResponseStatusException exception = assertThrows(OkrResponseStatusException.class,
                 () -> validator.validateOnUpdate(3L, user2));
@@ -375,7 +330,7 @@ void validateOnUpdateShouldThrowExceptionWhenLastnameIsInvalid(String name, List
     @MethodSource("emailValidationArguments")
     void validateOnUpdateShouldThrowExceptionWhenEmailIsInvalid(String email, List<ErrorDto> errors) {
         User user2 = User.Builder.builder().withId(3L).withEmail(email).withFirstname("firstname")
-                .withLastname("lastname").withUsername("username").build();
+                .withLastname("lastname").build();
 
         OkrResponseStatusException exception = assertThrows(OkrResponseStatusException.class,
                 () -> validator.validateOnUpdate(3L, user2));
@@ -387,8 +342,8 @@ void validateOnUpdateShouldThrowExceptionWhenEmailIsInvalid(String email, List<E
 
     @Test
     void validateOnUpdateShouldThrowExceptionWhenAttrsAreMissing() {
-        User userInvalid = User.Builder.builder().withId(3L).withUsername("Username").withLastname("Lastname")
-                .withFirstname("firstname").withEmail("falseemail").build();
+        User userInvalid = User.Builder.builder().withId(3L).withLastname("Lastname").withFirstname("firstname")
+                .withEmail("falseemail").build();
         OkrResponseStatusException exception = assertThrows(OkrResponseStatusException.class,
                 () -> validator.validateOnUpdate(3L, userInvalid));
 
diff --git a/backend/src/test/java/ch/puzzle/okr/test/CheckInTestHelpers.java b/backend/src/test/java/ch/puzzle/okr/test/CheckInTestHelpers.java
index 3d7bd61a18..78c98b659e 100644
--- a/backend/src/test/java/ch/puzzle/okr/test/CheckInTestHelpers.java
+++ b/backend/src/test/java/ch/puzzle/okr/test/CheckInTestHelpers.java
@@ -42,6 +42,7 @@ public class CheckInTestHelpers {
     public static final String JSON_PATH_CREATED_ON = "$.createdOn";
 
     public static final String JSON_PATH_VALUE = "$.value";
+    public static final String JSON_PATH_ZONE = "$.value";
 
     /* Test entities */
     static final Objective objective = Objective.Builder.builder().withId(1L).build();
diff --git a/backend/src/test/java/ch/puzzle/okr/test/KeyResultTestHelpers.java b/backend/src/test/java/ch/puzzle/okr/test/KeyResultTestHelpers.java
index 650a52bead..27f175ccb1 100644
--- a/backend/src/test/java/ch/puzzle/okr/test/KeyResultTestHelpers.java
+++ b/backend/src/test/java/ch/puzzle/okr/test/KeyResultTestHelpers.java
@@ -78,8 +78,8 @@ public class KeyResultTestHelpers {
     static final String INITIATIVES_2 = "Initiatives2";
     static final String CHANGE_INFO_1 = "Changeinfo1";
     static final String CHANGE_INFO_2 = "Changeinfo2";
-    static final User user = User.Builder.builder().withId(1L).withFirstname("Bob").withLastname("Kaufmann")
-            .withUsername("bkaufmann").withEmail("kaufmann@puzzle.ch").build();
+    public static final User user = User.Builder.builder().withId(1L).withFirstname("Bob").withLastname("Kaufmann")
+            .withEmail("kaufmann@puzzle.ch").build();
     public static final KeyResult metricKeyResult = KeyResultMetric.Builder.builder().withId(5L).withTitle(TITLE)
             .build();
     public static final CheckIn checkIn1 = CheckInMetric.Builder.builder().withValue(23D).withId(1L)
diff --git a/backend/src/test/java/ch/puzzle/okr/test/SpringIntegrationTest.java b/backend/src/test/java/ch/puzzle/okr/test/SpringIntegrationTest.java
index c2d40543d7..2fe500d842 100644
--- a/backend/src/test/java/ch/puzzle/okr/test/SpringIntegrationTest.java
+++ b/backend/src/test/java/ch/puzzle/okr/test/SpringIntegrationTest.java
@@ -2,6 +2,7 @@
 
 import org.springframework.boot.test.context.SpringBootTest;
 import org.springframework.test.context.ActiveProfiles;
+import org.springframework.test.context.ContextConfiguration;
 
 import java.lang.annotation.*;
 
@@ -10,6 +11,7 @@
 @Documented
 @Inherited
 @SpringBootTest
+@ContextConfiguration(initializers = TestContextInitializer.class)
 @ActiveProfiles(value = "integration-test")
 public @interface SpringIntegrationTest {
 }
diff --git a/backend/src/test/java/ch/puzzle/okr/test/TestConstants.java b/backend/src/test/java/ch/puzzle/okr/test/TestConstants.java
index b7453ac0b5..cbf9ca82ba 100644
--- a/backend/src/test/java/ch/puzzle/okr/test/TestConstants.java
+++ b/backend/src/test/java/ch/puzzle/okr/test/TestConstants.java
@@ -4,9 +4,9 @@ public class TestConstants {
     private TestConstants() {
     }
 
-    public static final String ORGANISATION_FIRST_LEVEL = "org_gl";
-    public static final String ORGANISATION_SECOND_LEVEL = "org_bl";
-    public static final String ORGANISATION_TEAM = "org_mobility";
-
     public static final String TEAM_PUZZLE = "Puzzle ITC";
+    public static final String GJ_FOR_TEST_QUARTER_LABEL = "GJ ForTests";
+
+    public static final long GJ_FOR_TESTS_QUARTER_ID = 998L;
+    public static final long BACK_LOG_QUARTER_ID = 999L;
 }
diff --git a/backend/src/test/java/ch/puzzle/okr/test/TestContextInitializer.java b/backend/src/test/java/ch/puzzle/okr/test/TestContextInitializer.java
new file mode 100644
index 0000000000..80829562cd
--- /dev/null
+++ b/backend/src/test/java/ch/puzzle/okr/test/TestContextInitializer.java
@@ -0,0 +1,18 @@
+package ch.puzzle.okr.test;
+
+import ch.puzzle.okr.multitenancy.HibernateContext;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.context.ApplicationContextInitializer;
+import org.springframework.context.ConfigurableApplicationContext;
+
+public class TestContextInitializer implements ApplicationContextInitializer<ConfigurableApplicationContext> {
+
+    private static final Logger logger = LoggerFactory.getLogger(TestContextInitializer.class);
+
+    @Override
+    public void initialize(ConfigurableApplicationContext applicationContext) {
+        logger.info("Loading hibernate configuration from application properties");
+        HibernateContext.extractAndSetHibernateConfig(applicationContext.getEnvironment());
+    }
+}
diff --git a/backend/src/test/java/ch/puzzle/okr/test/TestHelper.java b/backend/src/test/java/ch/puzzle/okr/test/TestHelper.java
index bb5bae79a3..75d53c1db4 100644
--- a/backend/src/test/java/ch/puzzle/okr/test/TestHelper.java
+++ b/backend/src/test/java/ch/puzzle/okr/test/TestHelper.java
@@ -1,71 +1,88 @@
 package ch.puzzle.okr.test;
 
 import ch.puzzle.okr.dto.ErrorDto;
+import ch.puzzle.okr.models.Team;
 import ch.puzzle.okr.models.User;
-import ch.puzzle.okr.models.authorization.AuthorizationRole;
+import ch.puzzle.okr.models.UserTeam;
 import ch.puzzle.okr.models.authorization.AuthorizationUser;
 import org.springframework.security.oauth2.jwt.Jwt;
-import org.springframework.util.CollectionUtils;
 
 import java.time.Instant;
-import java.util.*;
-
-import static ch.puzzle.okr.models.authorization.AuthorizationRole.*;
+import java.util.ArrayList;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.stream.Collectors;
+import java.util.stream.Stream;
 
 public class TestHelper {
     private TestHelper() {
     }
 
+    public static final String SCHEMA_PITC = "pitc";
+
     private static final String FIRSTNAME = "Bob";
     private static final String LASTNAME = "Kaufmann";
-    private static final String USERNAME = "bkaufmann";
     private static final String EMAIL = "kaufmann@puzzle.ch";
 
     public static User defaultUser(Long id) {
-        return User.Builder.builder().withId(id).withFirstname(FIRSTNAME).withLastname(LASTNAME).withUsername(USERNAME)
-                .withEmail(EMAIL).build();
+        return User.Builder.builder().withId(id).withFirstname(FIRSTNAME).withLastname(LASTNAME).withEmail(EMAIL)
+                .build();
     }
 
-    public static AuthorizationUser defaultAuthorizationUser() {
-        return mockAuthorizationUser(1L, USERNAME, FIRSTNAME, LASTNAME, EMAIL, List.of(5L), 5L,
-                List.of(READ_ALL_PUBLISHED, READ_ALL_DRAFT, WRITE_ALL));
+    public static User defaultOkrChampion(Long id) {
+        var user = defaultUser(id);
+        user.setOkrChampion(true);
+        return user;
     }
 
-    public static AuthorizationUser userWithoutWriteAllRole() {
-        return mockAuthorizationUser(1L, USERNAME, FIRSTNAME, LASTNAME, EMAIL, List.of(5L), 5L,
-                List.of(READ_ALL_PUBLISHED, READ_ALL_DRAFT));
+    public static User defaultUserWithTeams(Long userId, List<Team> adminTeams, List<Team> memberTeams) {
+        var user = defaultUser(userId);
+        var adminUserTeams = adminTeams.stream()
+                .map(t -> UserTeam.Builder.builder().withTeamAdmin(true).withTeam(t).withUser(user).build());
+        var memberUserTeams = memberTeams.stream()
+                .map(t -> UserTeam.Builder.builder().withTeam(t).withUser(user).build());
+        user.setUserTeamList(
+                Stream.concat(adminUserTeams, memberUserTeams).collect(Collectors.toCollection(ArrayList::new)));
+        return user;
     }
 
-    public static AuthorizationUser userWithoutAnyRole() {
-        return mockAuthorizationUser(1L, USERNAME, FIRSTNAME, LASTNAME, EMAIL, List.of(5L), 5L, List.of());
+    public static Team defaultTeam(Long id) {
+        return Team.Builder.builder().withId(id).withName("Test Team").build();
     }
 
-    public static AuthorizationUser mockAuthorizationUser(User user, List<Long> teamIds, Long firstLevelTeamId,
-            List<AuthorizationRole> roles) {
-        return mockAuthorizationUser(user.getId(), user.getUsername(), user.getFirstname(), user.getLastname(),
-                user.getEmail(), teamIds, firstLevelTeamId, roles);
+    public static UserTeam defaultUserTeam(Long id, User user) {
+        return UserTeam.Builder.builder().withId(id).withTeam(defaultTeam(1L)).withUser(user).build();
     }
 
-    public static AuthorizationUser mockAuthorizationUser(Long id, String username, String firstname, String lastname,
-            String email, List<Long> teamIds, Long firstLevelTeamId, List<AuthorizationRole> roles) {
-        return new AuthorizationUser(User.Builder.builder().withId(id).withUsername(username).withFirstname(firstname)
-                .withLastname(lastname).withEmail(email).build(), teamIds, List.of(firstLevelTeamId), roles);
+    public static AuthorizationUser defaultAuthorizationUser() {
+        return mockAuthorizationUser(1L, FIRSTNAME, LASTNAME, EMAIL);
     }
 
-    public static Jwt defaultJwtToken() {
-        return mockJwtToken(USERNAME, FIRSTNAME, LASTNAME, EMAIL, List.of("org_gl"));
+    public static AuthorizationUser userWithoutWriteAllRole() {
+        return mockAuthorizationUser(1L, FIRSTNAME, LASTNAME, EMAIL);
+    }
+
+    public static AuthorizationUser mockAuthorizationUser(User user) {
+        return mockAuthorizationUser(user.getId(), user.getFirstname(), user.getLastname(), user.getEmail());
     }
 
-    public static Jwt mockJwtToken(String username, String firstname, String lastname, String email) {
-        return mockJwtToken(username, firstname, lastname, email, List.of());
+    public static AuthorizationUser mockAuthorizationUser(Long id, String firstname, String lastname, String email) {
+        User user = User.Builder.builder().withId(id).withFirstname(firstname).withLastname(lastname).withEmail(email)
+                .build();
+        user.setUserTeamList(List.of(defaultUserTeam(1L, user)));
+        return new AuthorizationUser(user);
+    }
+
+    public static Jwt defaultJwtToken() {
+        return mockJwtToken(FIRSTNAME, LASTNAME, EMAIL);
     }
 
-    public static Jwt mockJwtToken(User user, List<String> roles) {
-        return mockJwtToken(user.getUsername(), user.getFirstname(), user.getLastname(), user.getEmail(), roles);
+    public static Jwt mockJwtToken(User user) {
+        return mockJwtToken(user.getFirstname(), user.getLastname(), user.getEmail());
     }
 
-    public static Jwt mockJwtToken(String username, String firstname, String lastname, String email,
-            List<String> roles) {
+    public static Jwt mockJwtToken(String firstname, String lastname, String email) {
         String exampleToken = "MockToken";
 
         Map<String, Object> headers = new HashMap<>();
@@ -73,16 +90,10 @@ public static Jwt mockJwtToken(String username, String firstname, String lastnam
         headers.put("typ", "JWT");
 
         Map<String, Object> claims = new HashMap<>();
-        claims.put("preferred_username", username);
         claims.put("given_name", firstname);
         claims.put("family_name", lastname);
         claims.put("email", email);
         claims.put("exp", Instant.now().plusSeconds(3600).getEpochSecond()); // Expires in 1 hour
-        if (!CollectionUtils.isEmpty(roles)) {
-            Map<String, Collection<String>> realmAccess = new HashMap<>();
-            realmAccess.put("roles", new ArrayList<>(roles));
-            claims.put("pitc", realmAccess);
-        }
 
         return new Jwt(exampleToken, Instant.now(), Instant.now().plusSeconds(3600), headers, claims);
     }
diff --git a/backend/src/test/java/ch/puzzle/okr/util/quarter/generate/h2/QuarterFunctionTest.java b/backend/src/test/java/ch/puzzle/okr/util/quarter/generate/h2/QuarterFunctionTest.java
index 14eea20689..232c7c1337 100644
--- a/backend/src/test/java/ch/puzzle/okr/util/quarter/generate/h2/QuarterFunctionTest.java
+++ b/backend/src/test/java/ch/puzzle/okr/util/quarter/generate/h2/QuarterFunctionTest.java
@@ -21,7 +21,7 @@ void quarterFunctionShouldReturnCorrectCurrentQuarterData() {
                 + currentQuarterEndDate() + ")";
 
         // assert
-        String expectedCurrent = "(2, GJ 24/25-Q1, 2024-07-01, 2024-09-30)";
+        String expectedCurrent = "(2, GJ 24/25-Q2, 2024-10-01, 2024-12-31)";
         assertEquals(expectedCurrent, currentQuarter);
     }
 
@@ -38,7 +38,7 @@ void quarterFunctionShouldReturnCorrectNextQuarterData() {
                 + nextQuarterEndDate() + ")";
 
         // assert
-        String expectedNext = "(3, GJ 24/25-Q2, 2024-10-01, 2024-12-31)";
+        String expectedNext = "(3, GJ 24/25-Q3, 2025-01-01, 2025-03-31)";
         assertEquals(expectedNext, nextQuarter);
     }
 }
diff --git a/backend/src/test/resources/repositoriesAndPersistenceServices.csv b/backend/src/test/resources/repositoriesAndPersistenceServices.csv
index 36f53411b3..642a999219 100644
--- a/backend/src/test/resources/repositoriesAndPersistenceServices.csv
+++ b/backend/src/test/resources/repositoriesAndPersistenceServices.csv
@@ -6,7 +6,6 @@ CheckInRepository,CheckInPersistenceService,CheckInValidationService
 CompletedRepository,CompletedPersistenceService,CompletedValidationService
 KeyResultRepository,KeyResultPersistenceService,KeyResultValidationService
 ObjectiveRepository,ObjectivePersistenceService,ObjectiveValidationService
-OrganisationRepository,OrganisationPersistenceService,""
 QuarterRepository,QuarterPersistenceService,QuarterValidationService
 TeamRepository,TeamPersistenceService,TeamValidationService
 UserRepository,UserPersistenceService,UserValidationService
diff --git a/docker/config/realm-export-acme.json b/docker/config/realm-export-acme.json
new file mode 100644
index 0000000000..a1cf8db000
--- /dev/null
+++ b/docker/config/realm-export-acme.json
@@ -0,0 +1,3921 @@
+[ {
+  "id" : "12d967eb-9298-40d6-839a-46d675c7b1e1",
+  "realm" : "acme",
+  "notBefore" : 0,
+  "defaultSignatureAlgorithm" : "RS256",
+  "revokeRefreshToken" : false,
+  "refreshTokenMaxReuse" : 0,
+  "accessTokenLifespan" : 300,
+  "accessTokenLifespanForImplicitFlow" : 900,
+  "ssoSessionIdleTimeout" : 1800,
+  "ssoSessionMaxLifespan" : 36000,
+  "ssoSessionIdleTimeoutRememberMe" : 0,
+  "ssoSessionMaxLifespanRememberMe" : 0,
+  "offlineSessionIdleTimeout" : 2592000,
+  "offlineSessionMaxLifespanEnabled" : false,
+  "offlineSessionMaxLifespan" : 5184000,
+  "clientSessionIdleTimeout" : 0,
+  "clientSessionMaxLifespan" : 0,
+  "clientOfflineSessionIdleTimeout" : 0,
+  "clientOfflineSessionMaxLifespan" : 0,
+  "accessCodeLifespan" : 60,
+  "accessCodeLifespanUserAction" : 300,
+  "accessCodeLifespanLogin" : 1800,
+  "actionTokenGeneratedByAdminLifespan" : 43200,
+  "actionTokenGeneratedByUserLifespan" : 300,
+  "oauth2DeviceCodeLifespan" : 600,
+  "oauth2DevicePollingInterval" : 5,
+  "enabled" : true,
+  "sslRequired" : "external",
+  "registrationAllowed" : false,
+  "registrationEmailAsUsername" : false,
+  "rememberMe" : false,
+  "verifyEmail" : false,
+  "loginWithEmailAllowed" : true,
+  "duplicateEmailsAllowed" : false,
+  "resetPasswordAllowed" : false,
+  "editUsernameAllowed" : false,
+  "bruteForceProtected" : false,
+  "permanentLockout" : false,
+  "maxTemporaryLockouts" : 0,
+  "maxFailureWaitSeconds" : 900,
+  "minimumQuickLoginWaitSeconds" : 60,
+  "waitIncrementSeconds" : 60,
+  "quickLoginCheckMilliSeconds" : 1000,
+  "maxDeltaTimeSeconds" : 43200,
+  "failureFactor" : 30,
+  "roles" : {
+    "realm" : [ {
+      "id" : "d70ff425-0d37-42c7-9548-a2c02f4a9768",
+      "name" : "offline_access",
+      "description" : "${role_offline-access}",
+      "composite" : false,
+      "clientRole" : false,
+      "containerId" : "12d967eb-9298-40d6-839a-46d675c7b1e1",
+      "attributes" : { }
+    }, {
+      "id" : "d5a0b5b2-6601-4b31-bf78-43c15b32ec0c",
+      "name" : "default-roles-acme",
+      "description" : "${role_default-roles}",
+      "composite" : true,
+      "composites" : {
+        "realm" : [ "offline_access", "uma_authorization" ],
+        "client" : {
+          "account" : [ "manage-account", "view-profile" ]
+        }
+      },
+      "clientRole" : false,
+      "containerId" : "12d967eb-9298-40d6-839a-46d675c7b1e1",
+      "attributes" : { }
+    }, {
+      "id" : "948bdf9f-ad41-4626-a18b-4d0102a5a859",
+      "name" : "uma_authorization",
+      "description" : "${role_uma_authorization}",
+      "composite" : false,
+      "clientRole" : false,
+      "containerId" : "12d967eb-9298-40d6-839a-46d675c7b1e1",
+      "attributes" : { }
+    } ],
+    "client" : {
+      "realm-management" : [ {
+        "id" : "7be386b9-8909-4337-ab51-6a20c254c591",
+        "name" : "query-clients",
+        "description" : "${role_query-clients}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "bc63be65-f6c4-4433-b0c8-7a2ecaf39d88",
+        "attributes" : { }
+      }, {
+        "id" : "26ee6dbc-988c-42c7-b95b-5bc6dd732c5e",
+        "name" : "impersonation",
+        "description" : "${role_impersonation}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "bc63be65-f6c4-4433-b0c8-7a2ecaf39d88",
+        "attributes" : { }
+      }, {
+        "id" : "afdf4558-4272-4478-857f-4822a51d29a7",
+        "name" : "manage-clients",
+        "description" : "${role_manage-clients}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "bc63be65-f6c4-4433-b0c8-7a2ecaf39d88",
+        "attributes" : { }
+      }, {
+        "id" : "b8a5f7f8-1158-417a-a9fe-f54ec2590b65",
+        "name" : "manage-events",
+        "description" : "${role_manage-events}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "bc63be65-f6c4-4433-b0c8-7a2ecaf39d88",
+        "attributes" : { }
+      }, {
+        "id" : "19df6b88-9f40-4f7c-a25f-3ed068e21bcf",
+        "name" : "create-client",
+        "description" : "${role_create-client}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "bc63be65-f6c4-4433-b0c8-7a2ecaf39d88",
+        "attributes" : { }
+      }, {
+        "id" : "ae06c03a-1638-4d2d-95f9-480d93ac7120",
+        "name" : "query-users",
+        "description" : "${role_query-users}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "bc63be65-f6c4-4433-b0c8-7a2ecaf39d88",
+        "attributes" : { }
+      }, {
+        "id" : "d12f6918-5c35-4f82-b46f-f7e4181b1ddd",
+        "name" : "view-identity-providers",
+        "description" : "${role_view-identity-providers}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "bc63be65-f6c4-4433-b0c8-7a2ecaf39d88",
+        "attributes" : { }
+      }, {
+        "id" : "a9b5a8db-4ef8-4211-bf29-6e0ec3724985",
+        "name" : "view-clients",
+        "description" : "${role_view-clients}",
+        "composite" : true,
+        "composites" : {
+          "client" : {
+            "realm-management" : [ "query-clients" ]
+          }
+        },
+        "clientRole" : true,
+        "containerId" : "bc63be65-f6c4-4433-b0c8-7a2ecaf39d88",
+        "attributes" : { }
+      }, {
+        "id" : "9053f3dd-eba4-4f3e-89b6-ba9af9a73dd3",
+        "name" : "view-realm",
+        "description" : "${role_view-realm}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "bc63be65-f6c4-4433-b0c8-7a2ecaf39d88",
+        "attributes" : { }
+      }, {
+        "id" : "3736dc83-3079-497c-a432-8380f58d4fd0",
+        "name" : "view-users",
+        "description" : "${role_view-users}",
+        "composite" : true,
+        "composites" : {
+          "client" : {
+            "realm-management" : [ "query-groups", "query-users" ]
+          }
+        },
+        "clientRole" : true,
+        "containerId" : "bc63be65-f6c4-4433-b0c8-7a2ecaf39d88",
+        "attributes" : { }
+      }, {
+        "id" : "b02862fc-1474-430a-afb0-0d1b5aa4eb70",
+        "name" : "query-groups",
+        "description" : "${role_query-groups}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "bc63be65-f6c4-4433-b0c8-7a2ecaf39d88",
+        "attributes" : { }
+      }, {
+        "id" : "98bcced6-53b7-42ad-a567-b1727be111e4",
+        "name" : "view-events",
+        "description" : "${role_view-events}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "bc63be65-f6c4-4433-b0c8-7a2ecaf39d88",
+        "attributes" : { }
+      }, {
+        "id" : "cb427df3-70de-4a6b-8a67-c13e6865e4e0",
+        "name" : "manage-realm",
+        "description" : "${role_manage-realm}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "bc63be65-f6c4-4433-b0c8-7a2ecaf39d88",
+        "attributes" : { }
+      }, {
+        "id" : "0b0e392a-3e69-4c3e-b130-82e5a18d43db",
+        "name" : "query-realms",
+        "description" : "${role_query-realms}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "bc63be65-f6c4-4433-b0c8-7a2ecaf39d88",
+        "attributes" : { }
+      }, {
+        "id" : "540de599-7db8-4803-aef8-02cf24d8b7db",
+        "name" : "manage-users",
+        "description" : "${role_manage-users}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "bc63be65-f6c4-4433-b0c8-7a2ecaf39d88",
+        "attributes" : { }
+      }, {
+        "id" : "3e1761db-0347-4091-bda8-04f748e8fe78",
+        "name" : "realm-admin",
+        "description" : "${role_realm-admin}",
+        "composite" : true,
+        "composites" : {
+          "client" : {
+            "realm-management" : [ "query-clients", "impersonation", "manage-clients", "manage-events", "create-client", "query-users", "view-identity-providers", "view-clients", "view-realm", "view-users", "view-events", "query-groups", "query-realms", "manage-realm", "manage-users", "manage-authorization", "manage-identity-providers", "view-authorization" ]
+          }
+        },
+        "clientRole" : true,
+        "containerId" : "bc63be65-f6c4-4433-b0c8-7a2ecaf39d88",
+        "attributes" : { }
+      }, {
+        "id" : "54241a65-0900-4064-bc90-fd935990e5e3",
+        "name" : "manage-authorization",
+        "description" : "${role_manage-authorization}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "bc63be65-f6c4-4433-b0c8-7a2ecaf39d88",
+        "attributes" : { }
+      }, {
+        "id" : "b818da70-eb64-4aee-8f70-49fdb1af1238",
+        "name" : "manage-identity-providers",
+        "description" : "${role_manage-identity-providers}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "bc63be65-f6c4-4433-b0c8-7a2ecaf39d88",
+        "attributes" : { }
+      }, {
+        "id" : "2c1c7b9a-3eb2-4c15-a932-82e851847bd3",
+        "name" : "view-authorization",
+        "description" : "${role_view-authorization}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "bc63be65-f6c4-4433-b0c8-7a2ecaf39d88",
+        "attributes" : { }
+      } ],
+      "security-admin-console" : [ ],
+      "admin-cli" : [ ],
+      "account-console" : [ ],
+      "acme_okr_staging" : [ ],
+      "broker" : [ {
+        "id" : "e046efce-8985-44bd-8a97-115a22213957",
+        "name" : "read-token",
+        "description" : "${role_read-token}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "0933a63a-9f58-428b-a42c-31d0c94554bd",
+        "attributes" : { }
+      } ],
+      "account" : [ {
+        "id" : "67d350ae-35ed-44df-91df-f50aea014386",
+        "name" : "manage-account",
+        "description" : "${role_manage-account}",
+        "composite" : true,
+        "composites" : {
+          "client" : {
+            "account" : [ "manage-account-links" ]
+          }
+        },
+        "clientRole" : true,
+        "containerId" : "b561fe69-922b-4fe1-9d2b-eabf8989b2f3",
+        "attributes" : { }
+      }, {
+        "id" : "5e29052d-cc8d-40a3-acc0-1c58341a6ad4",
+        "name" : "view-consent",
+        "description" : "${role_view-consent}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "b561fe69-922b-4fe1-9d2b-eabf8989b2f3",
+        "attributes" : { }
+      }, {
+        "id" : "9041412b-de8a-4aba-b4ce-6aeaf957d121",
+        "name" : "view-applications",
+        "description" : "${role_view-applications}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "b561fe69-922b-4fe1-9d2b-eabf8989b2f3",
+        "attributes" : { }
+      }, {
+        "id" : "1382a51d-1f5c-498d-8e84-271ea3578b23",
+        "name" : "view-profile",
+        "description" : "${role_view-profile}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "b561fe69-922b-4fe1-9d2b-eabf8989b2f3",
+        "attributes" : { }
+      }, {
+        "id" : "2c3c2293-0cfd-4bac-914d-786ffefe3713",
+        "name" : "manage-consent",
+        "description" : "${role_manage-consent}",
+        "composite" : true,
+        "composites" : {
+          "client" : {
+            "account" : [ "view-consent" ]
+          }
+        },
+        "clientRole" : true,
+        "containerId" : "b561fe69-922b-4fe1-9d2b-eabf8989b2f3",
+        "attributes" : { }
+      }, {
+        "id" : "bb480e81-3bc7-440c-b96e-6e078a840def",
+        "name" : "view-groups",
+        "description" : "${role_view-groups}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "b561fe69-922b-4fe1-9d2b-eabf8989b2f3",
+        "attributes" : { }
+      }, {
+        "id" : "4993162a-936d-48b1-91f2-6123c8b305c8",
+        "name" : "delete-account",
+        "description" : "${role_delete-account}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "b561fe69-922b-4fe1-9d2b-eabf8989b2f3",
+        "attributes" : { }
+      }, {
+        "id" : "3f0d1f34-a193-4cf1-8ae1-a371ee3a730e",
+        "name" : "manage-account-links",
+        "description" : "${role_manage-account-links}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "b561fe69-922b-4fe1-9d2b-eabf8989b2f3",
+        "attributes" : { }
+      } ]
+    }
+  },
+  "groups" : [ ],
+  "defaultRole" : {
+    "id" : "d5a0b5b2-6601-4b31-bf78-43c15b32ec0c",
+    "name" : "default-roles-acme",
+    "description" : "${role_default-roles}",
+    "composite" : true,
+    "clientRole" : false,
+    "containerId" : "12d967eb-9298-40d6-839a-46d675c7b1e1"
+  },
+  "requiredCredentials" : [ "password" ],
+  "otpPolicyType" : "totp",
+  "otpPolicyAlgorithm" : "HmacSHA1",
+  "otpPolicyInitialCounter" : 0,
+  "otpPolicyDigits" : 6,
+  "otpPolicyLookAheadWindow" : 1,
+  "otpPolicyPeriod" : 30,
+  "otpPolicyCodeReusable" : false,
+  "otpSupportedApplications" : [ "totpAppFreeOTPName", "totpAppGoogleName", "totpAppMicrosoftAuthenticatorName" ],
+  "localizationTexts" : { },
+  "webAuthnPolicyRpEntityName" : "keycloak",
+  "webAuthnPolicySignatureAlgorithms" : [ "ES256" ],
+  "webAuthnPolicyRpId" : "",
+  "webAuthnPolicyAttestationConveyancePreference" : "not specified",
+  "webAuthnPolicyAuthenticatorAttachment" : "not specified",
+  "webAuthnPolicyRequireResidentKey" : "not specified",
+  "webAuthnPolicyUserVerificationRequirement" : "not specified",
+  "webAuthnPolicyCreateTimeout" : 0,
+  "webAuthnPolicyAvoidSameAuthenticatorRegister" : false,
+  "webAuthnPolicyAcceptableAaguids" : [ ],
+  "webAuthnPolicyExtraOrigins" : [ ],
+  "webAuthnPolicyPasswordlessRpEntityName" : "keycloak",
+  "webAuthnPolicyPasswordlessSignatureAlgorithms" : [ "ES256" ],
+  "webAuthnPolicyPasswordlessRpId" : "",
+  "webAuthnPolicyPasswordlessAttestationConveyancePreference" : "not specified",
+  "webAuthnPolicyPasswordlessAuthenticatorAttachment" : "not specified",
+  "webAuthnPolicyPasswordlessRequireResidentKey" : "not specified",
+  "webAuthnPolicyPasswordlessUserVerificationRequirement" : "not specified",
+  "webAuthnPolicyPasswordlessCreateTimeout" : 0,
+  "webAuthnPolicyPasswordlessAvoidSameAuthenticatorRegister" : false,
+  "webAuthnPolicyPasswordlessAcceptableAaguids" : [ ],
+  "webAuthnPolicyPasswordlessExtraOrigins" : [ ],
+  "users" : [ {
+    "id" : "a5e1d334-1435-4f14-b7eb-d91d6cea3832",
+    "username" : "bl-acme",
+    "firstName" : "Esha",
+    "lastName" : "Harris",
+    "email" : "bl@acme.com",
+    "emailVerified" : true,
+    "createdTimestamp" : 1700823629490,
+    "enabled" : true,
+    "totp" : false,
+    "credentials" : [ {
+      "id" : "fc766dfb-7f34-4b35-bdab-af20bb1baebe",
+      "type" : "password",
+      "createdDate" : 1716980845552,
+      "secretData" : "{\"value\":\"luaLwKQV/VReGcdeP6SSzAt0V2llsIkD0C/dIeExGBcY2xZhLYgEUClwZekB9M2SnmP4PiknMMuAxGwR1yzT4w==\",\"salt\":\"H6o81H4q6atlv88tUyHb0w==\",\"additionalParameters\":{}}",
+      "credentialData" : "{\"hashIterations\":210000,\"algorithm\":\"pbkdf2-sha512\",\"additionalParameters\":{}}"
+    } ],
+    "disableableCredentialTypes" : [ ],
+    "requiredActions" : [ ],
+    "notBefore" : 0,
+    "groups" : [ ]
+  }, {
+    "id" : "ce1808d8-2182-4b67-aabe-0534bf38f556",
+    "username" : "gl-acme",
+    "firstName" : "Jaya",
+    "lastName" : "Norris",
+    "email" : "gl@acme.com",
+    "emailVerified" : true,
+    "createdTimestamp" : 1700823629490,
+    "enabled" : true,
+    "totp" : false,
+    "credentials" : [ {
+      "id" : "4e609407-131a-4e35-9d32-6e995de83c85",
+      "type" : "password",
+      "createdDate" : 1716980845360,
+      "secretData" : "{\"value\":\"Eg0AVUS0CF0LH4kjxLo8d2FtdWmvH2oh6J01gAYNj1ByXEmTNXgfj2b4SsF3jTi/lpEm7Za8gU0CSPpySimeog==\",\"salt\":\"cwMTmkwigB2AilrUKh8P4w==\",\"additionalParameters\":{}}",
+      "credentialData" : "{\"hashIterations\":210000,\"algorithm\":\"pbkdf2-sha512\",\"additionalParameters\":{}}"
+    } ],
+    "disableableCredentialTypes" : [ ],
+    "requiredActions" : [ ],
+    "notBefore" : 0,
+    "groups" : [ ]
+  }, {
+    "id" : "20bba530-45ba-402c-bd07-039182f64ffc",
+    "username" : "member-acme",
+    "firstName" : "Abraham",
+    "lastName" : " Woodard",
+    "email" : "member@acme.com",
+    "emailVerified" : true,
+    "createdTimestamp" : 1700823629490,
+    "enabled" : true,
+    "totp" : false,
+    "credentials" : [ {
+      "id" : "7d407b91-b8d9-4d1f-bd1e-33c7091b0bf5",
+      "type" : "password",
+      "createdDate" : 1716980845742,
+      "secretData" : "{\"value\":\"oBlSlYT6pCVSmQaGoYiBOGnv65XjslTtjUShRdmJ5qJWt2lwLBkSgMu9ucjfp489q2SguARwirfMRpPEEjAckA==\",\"salt\":\"1V28zRFw3j5l68JCxY64tA==\",\"additionalParameters\":{}}",
+      "credentialData" : "{\"hashIterations\":210000,\"algorithm\":\"pbkdf2-sha512\",\"additionalParameters\":{}}"
+    } ],
+    "disableableCredentialTypes" : [ ],
+    "requiredActions" : [ ],
+    "notBefore" : 0,
+    "groups" : [ ]
+  } ],
+  "scopeMappings" : [ {
+    "clientScope" : "offline_access",
+    "roles" : [ "offline_access" ]
+  } ],
+  "clientScopeMappings" : {
+    "account" : [ {
+      "client" : "account-console",
+      "roles" : [ "manage-account", "view-groups" ]
+    } ]
+  },
+  "clients" : [ {
+    "id" : "b561fe69-922b-4fe1-9d2b-eabf8989b2f3",
+    "clientId" : "account",
+    "name" : "${client_account}",
+    "rootUrl" : "${authBaseUrl}",
+    "baseUrl" : "/realms/acme/account/",
+    "surrogateAuthRequired" : false,
+    "enabled" : true,
+    "alwaysDisplayInConsole" : false,
+    "clientAuthenticatorType" : "client-secret",
+    "redirectUris" : [ "/realms/acme/account/*" ],
+    "webOrigins" : [ ],
+    "notBefore" : 0,
+    "bearerOnly" : false,
+    "consentRequired" : false,
+    "standardFlowEnabled" : true,
+    "implicitFlowEnabled" : false,
+    "directAccessGrantsEnabled" : false,
+    "serviceAccountsEnabled" : false,
+    "publicClient" : true,
+    "frontchannelLogout" : false,
+    "protocol" : "openid-connect",
+    "attributes" : {
+      "post.logout.redirect.uris" : "+"
+    },
+    "authenticationFlowBindingOverrides" : { },
+    "fullScopeAllowed" : false,
+    "nodeReRegistrationTimeout" : 0,
+    "defaultClientScopes" : [ "web-origins", "acr", "profile", "roles", "email" ],
+    "optionalClientScopes" : [ "address", "phone", "offline_access", "microprofile-jwt" ]
+  }, {
+    "id" : "5e85f446-1ab4-4726-99e8-117f409b3924",
+    "clientId" : "account-console",
+    "name" : "${client_account-console}",
+    "rootUrl" : "${authBaseUrl}",
+    "baseUrl" : "/realms/acme/account/",
+    "surrogateAuthRequired" : false,
+    "enabled" : true,
+    "alwaysDisplayInConsole" : false,
+    "clientAuthenticatorType" : "client-secret",
+    "redirectUris" : [ "/realms/acme/account/*" ],
+    "webOrigins" : [ ],
+    "notBefore" : 0,
+    "bearerOnly" : false,
+    "consentRequired" : false,
+    "standardFlowEnabled" : true,
+    "implicitFlowEnabled" : false,
+    "directAccessGrantsEnabled" : false,
+    "serviceAccountsEnabled" : false,
+    "publicClient" : true,
+    "frontchannelLogout" : false,
+    "protocol" : "openid-connect",
+    "attributes" : {
+      "post.logout.redirect.uris" : "+",
+      "pkce.code.challenge.method" : "S256"
+    },
+    "authenticationFlowBindingOverrides" : { },
+    "fullScopeAllowed" : false,
+    "nodeReRegistrationTimeout" : 0,
+    "protocolMappers" : [ {
+      "id" : "4bc57bf0-ba62-4bb2-9651-aa097be6a5dc",
+      "name" : "audience resolve",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-audience-resolve-mapper",
+      "consentRequired" : false,
+      "config" : { }
+    } ],
+    "defaultClientScopes" : [ "web-origins", "acr", "profile", "roles", "email" ],
+    "optionalClientScopes" : [ "address", "phone", "offline_access", "microprofile-jwt" ]
+  }, {
+    "id" : "5698dd87-f594-4ad8-823f-ee5fbfb9674b",
+    "clientId" : "acme_okr_staging",
+    "name" : "OKR-Tool-Staging-ACME",
+    "description" : "",
+    "rootUrl" : "",
+    "adminUrl" : "",
+    "baseUrl" : "",
+    "surrogateAuthRequired" : false,
+    "enabled" : true,
+    "alwaysDisplayInConsole" : false,
+    "clientAuthenticatorType" : "client-secret",
+    "redirectUris" : [ "http://acme.okr.localhost:4200/*", "http://acme.okr.localhost:8080:/*", "http://acme-okr.localhost:8080:/*", "http://acme-okr.localhost:8080/*", "http://acme-okr.localhost:4200/*", "http://acme.okr.localhost:8080/*" ],
+    "webOrigins" : [ "+" ],
+    "notBefore" : 0,
+    "bearerOnly" : false,
+    "consentRequired" : false,
+    "standardFlowEnabled" : true,
+    "implicitFlowEnabled" : false,
+    "directAccessGrantsEnabled" : false,
+    "serviceAccountsEnabled" : false,
+    "publicClient" : true,
+    "frontchannelLogout" : false,
+    "protocol" : "openid-connect",
+    "attributes" : {
+      "oidc.ciba.grant.enabled" : "false",
+      "backchannel.logout.session.required" : "false",
+      "post.logout.redirect.uris" : "http://acme.okr.localhost:4200/*##http://acme.okr.localhost:8080/*##http://acme.okr.localhost:8080:/*##http://acme-okr.localhost:4200/*##http://acme-okr.localhost:8080/*##http://acme-okr.localhost:8080:/*",
+      "oauth2.device.authorization.grant.enabled" : "false",
+      "display.on.consent.screen" : "false",
+      "backchannel.logout.revoke.offline.tokens" : "false"
+    },
+    "authenticationFlowBindingOverrides" : { },
+    "fullScopeAllowed" : true,
+    "nodeReRegistrationTimeout" : -1,
+    "defaultClientScopes" : [ "web-origins", "acr", "client_acme", "profile", "roles", "email" ],
+    "optionalClientScopes" : [ "address", "phone", "offline_access", "microprofile-jwt" ]
+  }, {
+    "id" : "4a8d1b27-1c75-432e-ac7c-97f57c1b6be6",
+    "clientId" : "admin-cli",
+    "name" : "${client_admin-cli}",
+    "surrogateAuthRequired" : false,
+    "enabled" : true,
+    "alwaysDisplayInConsole" : false,
+    "clientAuthenticatorType" : "client-secret",
+    "redirectUris" : [ ],
+    "webOrigins" : [ ],
+    "notBefore" : 0,
+    "bearerOnly" : false,
+    "consentRequired" : false,
+    "standardFlowEnabled" : false,
+    "implicitFlowEnabled" : false,
+    "directAccessGrantsEnabled" : true,
+    "serviceAccountsEnabled" : false,
+    "publicClient" : true,
+    "frontchannelLogout" : false,
+    "protocol" : "openid-connect",
+    "attributes" : {
+      "post.logout.redirect.uris" : "+"
+    },
+    "authenticationFlowBindingOverrides" : { },
+    "fullScopeAllowed" : false,
+    "nodeReRegistrationTimeout" : 0,
+    "defaultClientScopes" : [ "web-origins", "acr", "profile", "roles", "email" ],
+    "optionalClientScopes" : [ "address", "phone", "offline_access", "microprofile-jwt" ]
+  }, {
+    "id" : "0933a63a-9f58-428b-a42c-31d0c94554bd",
+    "clientId" : "broker",
+    "name" : "${client_broker}",
+    "surrogateAuthRequired" : false,
+    "enabled" : true,
+    "alwaysDisplayInConsole" : false,
+    "clientAuthenticatorType" : "client-secret",
+    "redirectUris" : [ ],
+    "webOrigins" : [ ],
+    "notBefore" : 0,
+    "bearerOnly" : true,
+    "consentRequired" : false,
+    "standardFlowEnabled" : true,
+    "implicitFlowEnabled" : false,
+    "directAccessGrantsEnabled" : false,
+    "serviceAccountsEnabled" : false,
+    "publicClient" : false,
+    "frontchannelLogout" : false,
+    "protocol" : "openid-connect",
+    "attributes" : {
+      "post.logout.redirect.uris" : "+"
+    },
+    "authenticationFlowBindingOverrides" : { },
+    "fullScopeAllowed" : false,
+    "nodeReRegistrationTimeout" : 0,
+    "defaultClientScopes" : [ "web-origins", "acr", "profile", "roles", "email" ],
+    "optionalClientScopes" : [ "address", "phone", "offline_access", "microprofile-jwt" ]
+  }, {
+    "id" : "bc63be65-f6c4-4433-b0c8-7a2ecaf39d88",
+    "clientId" : "realm-management",
+    "name" : "${client_realm-management}",
+    "surrogateAuthRequired" : false,
+    "enabled" : true,
+    "alwaysDisplayInConsole" : false,
+    "clientAuthenticatorType" : "client-secret",
+    "redirectUris" : [ ],
+    "webOrigins" : [ ],
+    "notBefore" : 0,
+    "bearerOnly" : true,
+    "consentRequired" : false,
+    "standardFlowEnabled" : true,
+    "implicitFlowEnabled" : false,
+    "directAccessGrantsEnabled" : false,
+    "serviceAccountsEnabled" : false,
+    "publicClient" : false,
+    "frontchannelLogout" : false,
+    "protocol" : "openid-connect",
+    "attributes" : {
+      "post.logout.redirect.uris" : "+"
+    },
+    "authenticationFlowBindingOverrides" : { },
+    "fullScopeAllowed" : false,
+    "nodeReRegistrationTimeout" : 0,
+    "defaultClientScopes" : [ "web-origins", "acr", "profile", "roles", "email" ],
+    "optionalClientScopes" : [ "address", "phone", "offline_access", "microprofile-jwt" ]
+  }, {
+    "id" : "d33fd946-2b75-4891-86ab-3ca815c8d926",
+    "clientId" : "security-admin-console",
+    "name" : "${client_security-admin-console}",
+    "rootUrl" : "${authAdminUrl}",
+    "baseUrl" : "/admin/acme/console/",
+    "surrogateAuthRequired" : false,
+    "enabled" : true,
+    "alwaysDisplayInConsole" : false,
+    "clientAuthenticatorType" : "client-secret",
+    "redirectUris" : [ "/admin/acme/console/*" ],
+    "webOrigins" : [ "+" ],
+    "notBefore" : 0,
+    "bearerOnly" : false,
+    "consentRequired" : false,
+    "standardFlowEnabled" : true,
+    "implicitFlowEnabled" : false,
+    "directAccessGrantsEnabled" : false,
+    "serviceAccountsEnabled" : false,
+    "publicClient" : true,
+    "frontchannelLogout" : false,
+    "protocol" : "openid-connect",
+    "attributes" : {
+      "post.logout.redirect.uris" : "+",
+      "pkce.code.challenge.method" : "S256"
+    },
+    "authenticationFlowBindingOverrides" : { },
+    "fullScopeAllowed" : false,
+    "nodeReRegistrationTimeout" : 0,
+    "protocolMappers" : [ {
+      "id" : "fc648986-d53b-4e59-abc2-e884c242269b",
+      "name" : "locale",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usermodel-attribute-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "introspection.token.claim" : "true",
+        "userinfo.token.claim" : "true",
+        "user.attribute" : "locale",
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "locale",
+        "jsonType.label" : "String"
+      }
+    } ],
+    "defaultClientScopes" : [ "web-origins", "acr", "profile", "roles", "email" ],
+    "optionalClientScopes" : [ "address", "phone", "offline_access", "microprofile-jwt" ]
+  } ],
+  "clientScopes" : [ {
+    "id" : "b53fb7c7-1f91-4551-8363-0f4299cf5beb",
+    "name" : "client_acme",
+    "description" : "Maps claim tenant to acme",
+    "protocol" : "openid-connect",
+    "attributes" : {
+      "include.in.token.scope" : "false",
+      "display.on.consent.screen" : "false",
+      "gui.order" : "",
+      "consent.screen.text" : ""
+    },
+    "protocolMappers" : [ {
+      "id" : "336bd6db-640d-41eb-bfae-5dcdae28a9a5",
+      "name" : "Tenant ACME claim mapper",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-hardcoded-claim-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "introspection.token.claim" : "true",
+        "claim.value" : "acme",
+        "userinfo.token.claim" : "true",
+        "id.token.claim" : "true",
+        "lightweight.claim" : "false",
+        "access.token.claim" : "true",
+        "claim.name" : "tenant",
+        "jsonType.label" : "String",
+        "access.tokenResponse.claim" : "false"
+      }
+    } ]
+  }, {
+    "id" : "0116437a-27d9-43c7-871d-38d403db68b1",
+    "name" : "offline_access",
+    "description" : "OpenID Connect built-in scope: offline_access",
+    "protocol" : "openid-connect",
+    "attributes" : {
+      "consent.screen.text" : "${offlineAccessScopeConsentText}",
+      "display.on.consent.screen" : "true"
+    }
+  }, {
+    "id" : "88d9be1e-d598-4617-9995-f07ab11d312f",
+    "name" : "profile",
+    "description" : "OpenID Connect built-in scope: profile",
+    "protocol" : "openid-connect",
+    "attributes" : {
+      "include.in.token.scope" : "true",
+      "display.on.consent.screen" : "true",
+      "consent.screen.text" : "${profileScopeConsentText}"
+    },
+    "protocolMappers" : [ {
+      "id" : "c4220bd6-5c6b-474d-875c-0c977a28dbc2",
+      "name" : "username",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usermodel-attribute-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "introspection.token.claim" : "true",
+        "userinfo.token.claim" : "true",
+        "user.attribute" : "username",
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "preferred_username",
+        "jsonType.label" : "String"
+      }
+    }, {
+      "id" : "2be15e24-d49b-439f-9151-bc3004c76ff2",
+      "name" : "gender",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usermodel-attribute-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "introspection.token.claim" : "true",
+        "userinfo.token.claim" : "true",
+        "user.attribute" : "gender",
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "gender",
+        "jsonType.label" : "String"
+      }
+    }, {
+      "id" : "c68654a1-42b3-47c7-a7a5-eace0bda89a5",
+      "name" : "profile",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usermodel-attribute-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "introspection.token.claim" : "true",
+        "userinfo.token.claim" : "true",
+        "user.attribute" : "profile",
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "profile",
+        "jsonType.label" : "String"
+      }
+    }, {
+      "id" : "514cd63d-7062-478c-9444-a12ec6ca8ddf",
+      "name" : "locale",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usermodel-attribute-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "introspection.token.claim" : "true",
+        "userinfo.token.claim" : "true",
+        "user.attribute" : "locale",
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "locale",
+        "jsonType.label" : "String"
+      }
+    }, {
+      "id" : "e6188e18-6ca7-49e8-9db8-d3d857adc758",
+      "name" : "given name",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usermodel-attribute-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "introspection.token.claim" : "true",
+        "userinfo.token.claim" : "true",
+        "user.attribute" : "firstName",
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "given_name",
+        "jsonType.label" : "String"
+      }
+    }, {
+      "id" : "08513499-5efc-4410-b984-ed39b8ba475a",
+      "name" : "picture",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usermodel-attribute-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "introspection.token.claim" : "true",
+        "userinfo.token.claim" : "true",
+        "user.attribute" : "picture",
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "picture",
+        "jsonType.label" : "String"
+      }
+    }, {
+      "id" : "a2f408e0-1969-4799-b863-4b5d040d1ae7",
+      "name" : "full name",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-full-name-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "id.token.claim" : "true",
+        "introspection.token.claim" : "true",
+        "access.token.claim" : "true",
+        "userinfo.token.claim" : "true"
+      }
+    }, {
+      "id" : "9d192e44-a924-4caf-88d2-bfa3116f111c",
+      "name" : "updated at",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usermodel-attribute-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "introspection.token.claim" : "true",
+        "userinfo.token.claim" : "true",
+        "user.attribute" : "updatedAt",
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "updated_at",
+        "jsonType.label" : "long"
+      }
+    }, {
+      "id" : "7176f199-f0de-432d-817e-ae4a84e0455c",
+      "name" : "website",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usermodel-attribute-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "introspection.token.claim" : "true",
+        "userinfo.token.claim" : "true",
+        "user.attribute" : "website",
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "website",
+        "jsonType.label" : "String"
+      }
+    }, {
+      "id" : "a8e59df5-7b54-46a3-8111-37cd405c5541",
+      "name" : "nickname",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usermodel-attribute-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "introspection.token.claim" : "true",
+        "userinfo.token.claim" : "true",
+        "user.attribute" : "nickname",
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "nickname",
+        "jsonType.label" : "String"
+      }
+    }, {
+      "id" : "a0a7cb1e-24b1-43bc-9b13-f9268b1135d0",
+      "name" : "family name",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usermodel-attribute-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "introspection.token.claim" : "true",
+        "userinfo.token.claim" : "true",
+        "user.attribute" : "lastName",
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "family_name",
+        "jsonType.label" : "String"
+      }
+    }, {
+      "id" : "5f70382c-f7cd-4ff7-8ab2-62a2ae01b892",
+      "name" : "birthdate",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usermodel-attribute-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "introspection.token.claim" : "true",
+        "userinfo.token.claim" : "true",
+        "user.attribute" : "birthdate",
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "birthdate",
+        "jsonType.label" : "String"
+      }
+    }, {
+      "id" : "28f81c25-5d0f-421a-88cc-03ae0131f9d2",
+      "name" : "zoneinfo",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usermodel-attribute-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "introspection.token.claim" : "true",
+        "userinfo.token.claim" : "true",
+        "user.attribute" : "zoneinfo",
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "zoneinfo",
+        "jsonType.label" : "String"
+      }
+    }, {
+      "id" : "8fdb8995-e426-4439-acdf-f9cb568ca93b",
+      "name" : "middle name",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usermodel-attribute-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "introspection.token.claim" : "true",
+        "userinfo.token.claim" : "true",
+        "user.attribute" : "middleName",
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "middle_name",
+        "jsonType.label" : "String"
+      }
+    } ]
+  }, {
+    "id" : "f724d87a-c456-4f34-8857-bfbd6fea5a98",
+    "name" : "web-origins",
+    "description" : "OpenID Connect scope for add allowed web origins to the access token",
+    "protocol" : "openid-connect",
+    "attributes" : {
+      "include.in.token.scope" : "false",
+      "display.on.consent.screen" : "false",
+      "consent.screen.text" : ""
+    },
+    "protocolMappers" : [ {
+      "id" : "d0656ad2-0ba5-41c1-a6b7-04d5533a3673",
+      "name" : "allowed web origins",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-allowed-origins-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "introspection.token.claim" : "true",
+        "access.token.claim" : "true"
+      }
+    } ]
+  }, {
+    "id" : "8376e34e-b072-4aac-8c44-e626b1a7a7d5",
+    "name" : "microprofile-jwt",
+    "description" : "Microprofile - JWT built-in scope",
+    "protocol" : "openid-connect",
+    "attributes" : {
+      "include.in.token.scope" : "true",
+      "display.on.consent.screen" : "false"
+    },
+    "protocolMappers" : [ {
+      "id" : "f71d3b8d-7496-422d-b8a4-cfd0f720acad",
+      "name" : "groups",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usermodel-realm-role-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "introspection.token.claim" : "true",
+        "multivalued" : "true",
+        "userinfo.token.claim" : "true",
+        "user.attribute" : "foo",
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "groups",
+        "jsonType.label" : "String"
+      }
+    }, {
+      "id" : "94901787-28d2-4f30-ad6e-39e06d36bcb9",
+      "name" : "upn",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usermodel-attribute-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "introspection.token.claim" : "true",
+        "userinfo.token.claim" : "true",
+        "user.attribute" : "username",
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "upn",
+        "jsonType.label" : "String"
+      }
+    } ]
+  }, {
+    "id" : "5f6e0ab5-6da4-4184-8bdc-ff6f967be5e2",
+    "name" : "roles",
+    "description" : "OpenID Connect scope for add user roles to the access token",
+    "protocol" : "openid-connect",
+    "attributes" : {
+      "include.in.token.scope" : "false",
+      "display.on.consent.screen" : "true",
+      "consent.screen.text" : "${rolesScopeConsentText}"
+    },
+    "protocolMappers" : [ {
+      "id" : "15d1c6fc-b9e2-43b4-ad0f-93c6fe8af0f6",
+      "name" : "audience resolve",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-audience-resolve-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "introspection.token.claim" : "true",
+        "access.token.claim" : "true"
+      }
+    }, {
+      "id" : "29759bdb-72b6-4793-ad68-a821a783d4ff",
+      "name" : "realm roles",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usermodel-realm-role-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "introspection.token.claim" : "true",
+        "multivalued" : "true",
+        "user.attribute" : "foo",
+        "access.token.claim" : "true",
+        "claim.name" : "realm_access.roles",
+        "jsonType.label" : "String"
+      }
+    }, {
+      "id" : "ec6069cd-8e76-4e01-88aa-c055ecb8d3f0",
+      "name" : "client roles",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usermodel-client-role-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "introspection.token.claim" : "true",
+        "multivalued" : "true",
+        "user.attribute" : "foo",
+        "access.token.claim" : "true",
+        "claim.name" : "resource_access.${client_id}.roles",
+        "jsonType.label" : "String"
+      }
+    } ]
+  }, {
+    "id" : "b9587741-3977-4505-8c62-38faf4bc750d",
+    "name" : "acr",
+    "description" : "OpenID Connect scope for add acr (authentication context class reference) to the token",
+    "protocol" : "openid-connect",
+    "attributes" : {
+      "include.in.token.scope" : "false",
+      "display.on.consent.screen" : "false"
+    },
+    "protocolMappers" : [ {
+      "id" : "5f1ac20e-35c7-486e-9b5a-78bbf84517e1",
+      "name" : "acr loa level",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-acr-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "id.token.claim" : "true",
+        "introspection.token.claim" : "true",
+        "access.token.claim" : "true",
+        "userinfo.token.claim" : "true"
+      }
+    } ]
+  }, {
+    "id" : "868f413a-13c7-4681-add1-cd7a6636ef4f",
+    "name" : "email",
+    "description" : "OpenID Connect built-in scope: email",
+    "protocol" : "openid-connect",
+    "attributes" : {
+      "include.in.token.scope" : "true",
+      "display.on.consent.screen" : "true",
+      "consent.screen.text" : "${emailScopeConsentText}"
+    },
+    "protocolMappers" : [ {
+      "id" : "261a16ca-df19-464b-9c94-21a0d278b7ae",
+      "name" : "email",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usermodel-attribute-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "introspection.token.claim" : "true",
+        "userinfo.token.claim" : "true",
+        "user.attribute" : "email",
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "email",
+        "jsonType.label" : "String"
+      }
+    }, {
+      "id" : "60d2c414-35d2-4666-90ce-9c104f6d3c0a",
+      "name" : "email verified",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usermodel-property-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "introspection.token.claim" : "true",
+        "userinfo.token.claim" : "true",
+        "user.attribute" : "emailVerified",
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "email_verified",
+        "jsonType.label" : "boolean"
+      }
+    } ]
+  }, {
+    "id" : "fc2ff10f-c4b3-41bd-bd6f-7c46a56710af",
+    "name" : "address",
+    "description" : "OpenID Connect built-in scope: address",
+    "protocol" : "openid-connect",
+    "attributes" : {
+      "include.in.token.scope" : "true",
+      "display.on.consent.screen" : "true",
+      "consent.screen.text" : "${addressScopeConsentText}"
+    },
+    "protocolMappers" : [ {
+      "id" : "46467d2a-eb52-4b16-9dcd-aafe272a1926",
+      "name" : "address",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-address-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "user.attribute.formatted" : "formatted",
+        "user.attribute.country" : "country",
+        "introspection.token.claim" : "true",
+        "user.attribute.postal_code" : "postal_code",
+        "userinfo.token.claim" : "true",
+        "user.attribute.street" : "street",
+        "id.token.claim" : "true",
+        "user.attribute.region" : "region",
+        "access.token.claim" : "true",
+        "user.attribute.locality" : "locality"
+      }
+    } ]
+  }, {
+    "id" : "23b6c7f7-7b43-485a-9111-444a05653ea5",
+    "name" : "phone",
+    "description" : "OpenID Connect built-in scope: phone",
+    "protocol" : "openid-connect",
+    "attributes" : {
+      "include.in.token.scope" : "true",
+      "display.on.consent.screen" : "true",
+      "consent.screen.text" : "${phoneScopeConsentText}"
+    },
+    "protocolMappers" : [ {
+      "id" : "dcb6d621-67ba-4dca-b7b1-1998f2e3edc2",
+      "name" : "phone number",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usermodel-attribute-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "introspection.token.claim" : "true",
+        "userinfo.token.claim" : "true",
+        "user.attribute" : "phoneNumber",
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "phone_number",
+        "jsonType.label" : "String"
+      }
+    }, {
+      "id" : "eca13ae5-a77f-4c9b-b0ea-c57b104dc412",
+      "name" : "phone number verified",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usermodel-attribute-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "introspection.token.claim" : "true",
+        "userinfo.token.claim" : "true",
+        "user.attribute" : "phoneNumberVerified",
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "phone_number_verified",
+        "jsonType.label" : "boolean"
+      }
+    } ]
+  }, {
+    "id" : "fe1fb00a-2f89-4f7f-9a49-af534038c759",
+    "name" : "role_list",
+    "description" : "SAML role list",
+    "protocol" : "saml",
+    "attributes" : {
+      "consent.screen.text" : "${samlRoleListScopeConsentText}",
+      "display.on.consent.screen" : "true"
+    },
+    "protocolMappers" : [ {
+      "id" : "5538cbf7-1c91-485a-8fee-ce4d35773e59",
+      "name" : "role list",
+      "protocol" : "saml",
+      "protocolMapper" : "saml-role-list-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "single" : "false",
+        "attribute.nameformat" : "Basic",
+        "attribute.name" : "Role"
+      }
+    } ]
+  } ],
+  "defaultDefaultClientScopes" : [ "role_list", "profile", "email", "roles", "web-origins", "acr", "client_acme" ],
+  "defaultOptionalClientScopes" : [ "offline_access", "address", "phone", "microprofile-jwt" ],
+  "browserSecurityHeaders" : {
+    "contentSecurityPolicyReportOnly" : "",
+    "xContentTypeOptions" : "nosniff",
+    "referrerPolicy" : "no-referrer",
+    "xRobotsTag" : "none",
+    "xFrameOptions" : "SAMEORIGIN",
+    "contentSecurityPolicy" : "frame-src 'self'; frame-ancestors 'self'; object-src 'none';",
+    "xXSSProtection" : "1; mode=block",
+    "strictTransportSecurity" : "max-age=31536000; includeSubDomains"
+  },
+  "smtpServer" : { },
+  "eventsEnabled" : false,
+  "eventsListeners" : [ "jboss-logging" ],
+  "enabledEventTypes" : [ ],
+  "adminEventsEnabled" : false,
+  "adminEventsDetailsEnabled" : false,
+  "identityProviders" : [ ],
+  "identityProviderMappers" : [ ],
+  "components" : {
+    "org.keycloak.services.clientregistration.policy.ClientRegistrationPolicy" : [ {
+      "id" : "a7788c7c-7685-4947-a7f5-75af0009d849",
+      "name" : "Allowed Client Scopes",
+      "providerId" : "allowed-client-templates",
+      "subType" : "authenticated",
+      "subComponents" : { },
+      "config" : {
+        "allow-default-scopes" : [ "true" ]
+      }
+    }, {
+      "id" : "dc1ab6ac-31a7-421d-84b9-028b9b9189db",
+      "name" : "Max Clients Limit",
+      "providerId" : "max-clients",
+      "subType" : "anonymous",
+      "subComponents" : { },
+      "config" : {
+        "max-clients" : [ "200" ]
+      }
+    }, {
+      "id" : "7cfc5641-c607-4a97-9687-dc980a355d89",
+      "name" : "Trusted Hosts",
+      "providerId" : "trusted-hosts",
+      "subType" : "anonymous",
+      "subComponents" : { },
+      "config" : {
+        "host-sending-registration-request-must-match" : [ "true" ],
+        "client-uris-must-match" : [ "true" ]
+      }
+    }, {
+      "id" : "89e1d565-ac60-4e60-b8e7-c8a492b19f1f",
+      "name" : "Allowed Client Scopes",
+      "providerId" : "allowed-client-templates",
+      "subType" : "anonymous",
+      "subComponents" : { },
+      "config" : {
+        "allow-default-scopes" : [ "true" ]
+      }
+    }, {
+      "id" : "00687d65-03a5-4cdc-904a-74079ee1c999",
+      "name" : "Consent Required",
+      "providerId" : "consent-required",
+      "subType" : "anonymous",
+      "subComponents" : { },
+      "config" : { }
+    }, {
+      "id" : "7d6cca87-c2d2-442c-99a0-ba64f015d4c4",
+      "name" : "Allowed Protocol Mapper Types",
+      "providerId" : "allowed-protocol-mappers",
+      "subType" : "authenticated",
+      "subComponents" : { },
+      "config" : {
+        "allowed-protocol-mapper-types" : [ "saml-role-list-mapper", "oidc-address-mapper", "oidc-sha256-pairwise-sub-mapper", "oidc-full-name-mapper", "oidc-usermodel-attribute-mapper", "saml-user-attribute-mapper", "saml-user-property-mapper", "oidc-usermodel-property-mapper" ]
+      }
+    }, {
+      "id" : "0d52557d-1ce6-4472-81bc-eaad521281bb",
+      "name" : "Allowed Protocol Mapper Types",
+      "providerId" : "allowed-protocol-mappers",
+      "subType" : "anonymous",
+      "subComponents" : { },
+      "config" : {
+        "allowed-protocol-mapper-types" : [ "oidc-full-name-mapper", "oidc-usermodel-property-mapper", "oidc-address-mapper", "saml-user-property-mapper", "saml-user-attribute-mapper", "saml-role-list-mapper", "oidc-sha256-pairwise-sub-mapper", "oidc-usermodel-attribute-mapper" ]
+      }
+    }, {
+      "id" : "6b48dbba-2496-4269-b917-e8af2961153a",
+      "name" : "Full Scope Disabled",
+      "providerId" : "scope",
+      "subType" : "anonymous",
+      "subComponents" : { },
+      "config" : { }
+    } ],
+    "org.keycloak.keys.KeyProvider" : [ {
+      "id" : "07ff166e-3168-409f-baa1-c2f74b1a636f",
+      "name" : "rsa-generated",
+      "providerId" : "rsa-generated",
+      "subComponents" : { },
+      "config" : {
+        "privateKey" : [ "MIIEogIBAAKCAQEAvWDGG1YOdQMQWXHGS0kHyD/k+w4b9xbo30Wwb9SvEPwTNtx2bgmcqF381b1PmSuWlDnbfGT2LZWnNqBmEBErpehZzfkg3JAG06eHVlL8es2ioL8cPgvdMzyaI94Tg60r+ifjxLFQhnCuQNun87sWpGuQgxsSXgo2Tt0bt7eq03fqvIAm4/n0+aVu4vipkQhfTgOLpPf9okKjKLy7wXnAAWtp7xeJioA+YuHy04vwO/hW+b8PeQNzMR2rkhY+vI8FB1PdQiYDALseDKOiCRUsUuX2Hg3tEQSAeB8LcWSPmNNfbQF0+6Ah/pBy7dFZ0sJRpW4ea8WEWpXdzoNIVBFQzwIDAQABAoIBAA3vLnR5dwkwvLBleOU2OO6I6692AM8ZWPDWFF7jeS7YlWNZLRT4pmsUYKkAy81l5yeolYKdfShVKsoQBaJ+A5uqsTJAzU8IAUXr6D83o6CM5pVJqpQoKaeo+GCA6SesWMrdyi/BVOmnezLbgWFOLU1+JVJ4Q02Ma9A5YF46ve+JnUrggudy94j0y+H0wSjVpd8W0eYtxmJgaTdf0iE+XKdEb80IOSs91ZY6HYje1SIZwyOOQFnADCN3hMaNmg8pWFXbuCpejaha2YOix827MOZBCCa9tMsiqiN01GxTOmhrhUHBgwC3wA+59oWbMg+ZFr8p94K+XG1OKE7xJqZOMcECgYEA7ZFI3GnXSqJd3MQ1qV9g9cjJ1CQ1FkRVJ3c7Jxk5VGeHoX+TuW+SE4tGUKkzqQ/kdO+qDbEVzmeXb486lf8XMKIYtMI2ptV/pDenW6h8Lht1C/qSXpHCdtwofKtq8NPDD8inhy2v4HXz8m1vuwn/aGIcJ+8w9rTKXh4r3jCgjo8CgYEAzBJRtsLoj61TpeZZJ43aDmQNigq4KvLuNCshEzUIdkYaXyVOIU4v0eqRP+rrnXz9VZYrfGWYwvnVyHO9JSowWv+gU0Z223hniYUyK+UCNzfubczrzQaStUo6CgbpXONqj3mFe54H20c5HdehCLcFn+0KYcH/99m8ubM4H4Q4OcECgYBurEc4P6qHX3rAtTuWixN9jSvRQ4jjtbPB7f7FqS+XDaAW8XsdYUe5CSIZw6mIchnpDBm5xSy2enYHB7+wTyU7h9hgpTWWpVGQbEjwH16ykCIIEZSMr/TbMJc/9Q+d39k4ii7Zf8Q2mlyqLKdniDHPLB2X0QuLcw/vprijCx5RKwKBgE3GOZBOzjVb2IJkvNu/Sziq1yIiHbh4p2IIge2BC72P0CMs44777muxWzQiAzQdW6uPtPkO+15ruxdPTOnqH02/GMpEE65nQAaAVfO2rtZ+oYcFT2TvOWCQbng91BiLr6QIq1/GhbYDefguovfgUOt3erpxJm2+dRfM/vm7+XXBAoGAOqQcJRsSR0RYnMpj+VA65409YD7vM8CwRrHlBDN+xqbuDoszXg4KwtiQKTaEFSYeZJolRm/2bMkoV4+Uyk68Fk9ullHYpbyeekJ1wGCoh1vhI4NgR0PcBF0XUYvlVjfhgpFGyVHp28WbUJ+cTjoSl+NX6KcNUVqMS04B3SqBTg4=" ],
+        "certificate" : [ "MIIClzCCAX8CBgGPxAiJ6jANBgkqhkiG9w0BAQsFADAPMQ0wCwYDVQQDDARhY21lMB4XDTI0MDUyOTExMDU0NVoXDTM0MDUyOTExMDcyNVowDzENMAsGA1UEAwwEYWNtZTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAL1gxhtWDnUDEFlxxktJB8g/5PsOG/cW6N9FsG/UrxD8Ezbcdm4JnKhd/NW9T5krlpQ523xk9i2VpzagZhARK6XoWc35INyQBtOnh1ZS/HrNoqC/HD4L3TM8miPeE4OtK/on48SxUIZwrkDbp/O7FqRrkIMbEl4KNk7dG7e3qtN36ryAJuP59PmlbuL4qZEIX04Di6T3/aJCoyi8u8F5wAFrae8XiYqAPmLh8tOL8Dv4Vvm/D3kDczEdq5IWPryPBQdT3UImAwC7HgyjogkVLFLl9h4N7REEgHgfC3Fkj5jTX20BdPugIf6Qcu3RWdLCUaVuHmvFhFqV3c6DSFQRUM8CAwEAATANBgkqhkiG9w0BAQsFAAOCAQEAPgafD3mq15sslm4dd4rD3gSJQ19vMOw4+vhyC4bGf1PnpaARb8yRIYQFXyTKffxzqNxkQd74gyFOzX3vqDWo3NKQ6f7LNbH9Nmt/6n/dEH15TH/5Av8TDnAwnxPyz0Nt86INAi62VnY5MxKbe4djbfO8eXU1De8tKeKHpAcX8OWdD4jFh5Jpc5/xLCLXjmS6gDIEcJRxMe/Gq/nhBBs5Oh8Ryz3nG5KNqKlE5409aEz0RvXtIRyiyvO20OGajod/ZRri6785elaNYdn2hIZcvp77y6GtV5iaDvE5hTIm/83xgAFQsP593+rm0f3eet/3hxofS9D2DTdnLurKjcuY6w==" ],
+        "priority" : [ "100" ]
+      }
+    }, {
+      "id" : "b956e133-9b04-49ec-8cfa-492395aab481",
+      "name" : "aes-generated",
+      "providerId" : "aes-generated",
+      "subComponents" : { },
+      "config" : {
+        "kid" : [ "5229874f-3c0f-4589-a408-65898e2e5379" ],
+        "secret" : [ "TV7BMbFkaxZmBhP0eplJwA" ],
+        "priority" : [ "100" ]
+      }
+    }, {
+      "id" : "81776424-d94c-4ef0-bf61-f803fc036820",
+      "name" : "rsa-enc-generated",
+      "providerId" : "rsa-enc-generated",
+      "subComponents" : { },
+      "config" : {
+        "privateKey" : [ "MIIEowIBAAKCAQEAnT5BOB6hTznBkibZ4gqe0+FAPCif5Lc8+r7RznVVAAInCnUM4I6/VcpBy3C6pn5SaKzgGEHPG2zIpJqWaeYYlluwZomfQQnPLZAQWMdSEXS1BOJMTJz8ov8rzUw2xDBkxtPTS4H9HIYuaZvsqyULCox2jp16qlkqgvHppUoPNTFdFS7KQUfnD72LA0f7YaEjWXYEek2LicplKBpgrvthOVt6jmNxS+5faQAFzcV0PM1pJC1vgixeLH1vSAzuKx3V7chxG2FnOKD2ZAEr02BcHBLgD3zfEcx3z1YSYF5VcGZ2a1AO4PSiL5AuMF3DRb4GjmOgHAT2DLBxAxu/Isub7QIDAQABAoIBAAXiiFTWGqHpLrQuVY226YpS/hEyUQehjvvwa9A/BmsdaYIj7tMxrHoEu5EmWynzhNiLjciCoAJuABVe/r2gYa+w50lzIZ1wxUr2fxIfhZQHKuYvpPziDDd6dtR0Y4FUsVTapSgIiaVJZU/JCOK/3Gms55v/S1G4TBXCAYVQ4ABU1Va3PSW9AzF9mQ2pLBeE877L5KHXdwfVYwZMR/ntgdXXoswMzesTnR8SZiAUn9DQSDt1KT12EcxfR4ZSxXPBgH/c5eHnGQGwOjUPHj43DMpMqa5myP4N5b9XV99jUJKES/Z9i5eYMPvS5cNSNrHAOq6/OR9qUet6nt3DHoLaDJkCgYEA0oWXjIewDXaMBD52ARebTFqOZood5SmHwCb4jN2RvVT8cD/AFTmWjJDHdl2cD0c3itp0A+I836js+9yHBy+fs66j0sZtNGAgQn6Sipv7zQ1XxdU28sA44YS/0OBz8zSJNBju2r4u/g2o3EIE+v4NOwjYBSmwByn2scrKZ3avAkUCgYEAvzY2r0I58qXEHPx6v3s0LgQ9ScoUeWLnhBTnqclF+DBOK2Zl/enyj71ec/2CJeYMvnSUlRLyrTNfMp62iYo6ImrVbR1nVMNXxgBGLg7/APGdpTFuWj1kU7PqYkz8/gcQvjVPomQUaIILDwFfBFmmkswwebcvPuiDl/z1Exo+oYkCgYAmWEDnTtupSBtutnXF8yfNO31Off+9+teID1EcT0s5Yh5sz5/L/eZHCiPakmhXfBBI0UtqXa3ayykHIv7RN0JudvPN82h2rr+RfP5yEsFFcxW2qgRNKOfzY7uQbyGPfdUz0QrIevWSPqiwHbJMiTOduhmmrxYp5+HQNnCxcbOkxQKBgHvJIg/FpPQUImjNfr2Vigs8TV0GyMhoog6c5fjBx11MEF8CVIbTvGcXph0bAfV8/8UQfdwgPyCngDqqCuvxo38CgJa6EVoLeDhDlytcI/O9d1wpKxKaaefSMqtewe3GLy2kH6C2f4vEnFojfhq32yFvtPYnBBwKtJ5hcVrjg6ZZAoGBAMKxzhDwzBiJdTpbIHD5wHUXijG9xN4re8Uu0qJSb5sJjRZX2NsXC8n4QgWpeiiz1IanFgFDDajeJslb5tv+nUPlM/PKHkRm9wpRdz8yjn7BEmZX/ALqr39zx5UQPlE7GsMNMbKOQ/2WRSsnu2iv+U+48s72cgRlVZnqU4Xq1Yj6" ],
+        "certificate" : [ "MIIClzCCAX8CBgGPxAiKRjANBgkqhkiG9w0BAQsFADAPMQ0wCwYDVQQDDARhY21lMB4XDTI0MDUyOTExMDU0NVoXDTM0MDUyOTExMDcyNVowDzENMAsGA1UEAwwEYWNtZTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJ0+QTgeoU85wZIm2eIKntPhQDwon+S3PPq+0c51VQACJwp1DOCOv1XKQctwuqZ+Umis4BhBzxtsyKSalmnmGJZbsGaJn0EJzy2QEFjHUhF0tQTiTEyc/KL/K81MNsQwZMbT00uB/RyGLmmb7KslCwqMdo6deqpZKoLx6aVKDzUxXRUuykFH5w+9iwNH+2GhI1l2BHpNi4nKZSgaYK77YTlbeo5jcUvuX2kABc3FdDzNaSQtb4IsXix9b0gM7isd1e3IcRthZzig9mQBK9NgXBwS4A983xHMd89WEmBeVXBmdmtQDuD0oi+QLjBdw0W+Bo5joBwE9gywcQMbvyLLm+0CAwEAATANBgkqhkiG9w0BAQsFAAOCAQEAjIaBc2GDjEpk8Lh3p8OiIhIFFoeCUlOWPnbjafMZ4d4EpHn5jNk4jrspJnHmAO0PHXe00fbaTZ3JmJKYaHLr59y+7fR5aAMZvyMtfp8B9YcANlLgsNMxJn9SBdGolv8GaSthGXMhIN8cOwxJpaOsRvN9mj5W7H2pXdpKf9ufaUpUyeyrOI8UeWw5CttXxNrjUnfQLBCnrZ21ysh6Q3sOE7JAKezc6pmlr/byShALriLFMrRzZmsT2PM2CQR7m3xvcOPbmhRa+ca6U/W+3LblksEnb/MyYbrGD8ZsXO0Q7olHUph+wvtj7WiGapda23k4TxeQncMasBHcqpJE0t0j/Q==" ],
+        "priority" : [ "100" ],
+        "algorithm" : [ "RSA-OAEP" ]
+      }
+    }, {
+      "id" : "e04164eb-fdd3-4e1f-87a7-e1b18dac356e",
+      "name" : "hmac-generated-hs512",
+      "providerId" : "hmac-generated",
+      "subComponents" : { },
+      "config" : {
+        "kid" : [ "23eb56f8-cf1c-404f-88fe-64a2f11bc6b2" ],
+        "secret" : [ "VFeN0PvliTLociyn4Rcygzd24_a3PqNvDP0LqjGmN7y_CCll9l19-anOpHWSM8LsnQaPy_l7iEasZ3AGOMHn2SBLVgNOqhAOds9wDJE8cFVE-gV25hWf1lKu8uzJ5xOMVZQFDoo6w4vb0kk4myn72-R8DsDDOhrZKHpWwtCZEkE" ],
+        "priority" : [ "100" ],
+        "algorithm" : [ "HS512" ]
+      }
+    } ]
+  },
+  "internationalizationEnabled" : false,
+  "supportedLocales" : [ ],
+  "authenticationFlows" : [ {
+    "id" : "a615c3d9-0fb4-4050-a19f-8c7962f439ea",
+    "alias" : "Account verification options",
+    "description" : "Method with which to verity the existing account",
+    "providerId" : "basic-flow",
+    "topLevel" : false,
+    "builtIn" : true,
+    "authenticationExecutions" : [ {
+      "authenticator" : "idp-email-verification",
+      "authenticatorFlow" : false,
+      "requirement" : "ALTERNATIVE",
+      "priority" : 10,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticatorFlow" : true,
+      "requirement" : "ALTERNATIVE",
+      "priority" : 20,
+      "autheticatorFlow" : true,
+      "flowAlias" : "Verify Existing Account by Re-authentication",
+      "userSetupAllowed" : false
+    } ]
+  }, {
+    "id" : "d3dd4e02-58d2-4450-a92c-e2ceb4796caa",
+    "alias" : "Browser - Conditional OTP",
+    "description" : "Flow to determine if the OTP is required for the authentication",
+    "providerId" : "basic-flow",
+    "topLevel" : false,
+    "builtIn" : true,
+    "authenticationExecutions" : [ {
+      "authenticator" : "conditional-user-configured",
+      "authenticatorFlow" : false,
+      "requirement" : "REQUIRED",
+      "priority" : 10,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticator" : "auth-otp-form",
+      "authenticatorFlow" : false,
+      "requirement" : "REQUIRED",
+      "priority" : 20,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    } ]
+  }, {
+    "id" : "39aa32a4-ff08-451b-92aa-c73955050f62",
+    "alias" : "Direct Grant - Conditional OTP",
+    "description" : "Flow to determine if the OTP is required for the authentication",
+    "providerId" : "basic-flow",
+    "topLevel" : false,
+    "builtIn" : true,
+    "authenticationExecutions" : [ {
+      "authenticator" : "conditional-user-configured",
+      "authenticatorFlow" : false,
+      "requirement" : "REQUIRED",
+      "priority" : 10,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticator" : "direct-grant-validate-otp",
+      "authenticatorFlow" : false,
+      "requirement" : "REQUIRED",
+      "priority" : 20,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    } ]
+  }, {
+    "id" : "e13d2afc-ab65-492a-a8d9-df831a0cad81",
+    "alias" : "First broker login - Conditional OTP",
+    "description" : "Flow to determine if the OTP is required for the authentication",
+    "providerId" : "basic-flow",
+    "topLevel" : false,
+    "builtIn" : true,
+    "authenticationExecutions" : [ {
+      "authenticator" : "conditional-user-configured",
+      "authenticatorFlow" : false,
+      "requirement" : "REQUIRED",
+      "priority" : 10,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticator" : "auth-otp-form",
+      "authenticatorFlow" : false,
+      "requirement" : "REQUIRED",
+      "priority" : 20,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    } ]
+  }, {
+    "id" : "0c828fa7-025e-4e76-8aa9-0d4a1747c516",
+    "alias" : "Handle Existing Account",
+    "description" : "Handle what to do if there is existing account with same email/username like authenticated identity provider",
+    "providerId" : "basic-flow",
+    "topLevel" : false,
+    "builtIn" : true,
+    "authenticationExecutions" : [ {
+      "authenticator" : "idp-confirm-link",
+      "authenticatorFlow" : false,
+      "requirement" : "REQUIRED",
+      "priority" : 10,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticatorFlow" : true,
+      "requirement" : "REQUIRED",
+      "priority" : 20,
+      "autheticatorFlow" : true,
+      "flowAlias" : "Account verification options",
+      "userSetupAllowed" : false
+    } ]
+  }, {
+    "id" : "2c0456b5-ef9c-46ea-85dc-7d403abd63dd",
+    "alias" : "Reset - Conditional OTP",
+    "description" : "Flow to determine if the OTP should be reset or not. Set to REQUIRED to force.",
+    "providerId" : "basic-flow",
+    "topLevel" : false,
+    "builtIn" : true,
+    "authenticationExecutions" : [ {
+      "authenticator" : "conditional-user-configured",
+      "authenticatorFlow" : false,
+      "requirement" : "REQUIRED",
+      "priority" : 10,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticator" : "reset-otp",
+      "authenticatorFlow" : false,
+      "requirement" : "REQUIRED",
+      "priority" : 20,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    } ]
+  }, {
+    "id" : "ff382d18-89fa-4a97-8f91-7b8691445786",
+    "alias" : "User creation or linking",
+    "description" : "Flow for the existing/non-existing user alternatives",
+    "providerId" : "basic-flow",
+    "topLevel" : false,
+    "builtIn" : true,
+    "authenticationExecutions" : [ {
+      "authenticatorConfig" : "create unique user config",
+      "authenticator" : "idp-create-user-if-unique",
+      "authenticatorFlow" : false,
+      "requirement" : "ALTERNATIVE",
+      "priority" : 10,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticatorFlow" : true,
+      "requirement" : "ALTERNATIVE",
+      "priority" : 20,
+      "autheticatorFlow" : true,
+      "flowAlias" : "Handle Existing Account",
+      "userSetupAllowed" : false
+    } ]
+  }, {
+    "id" : "0806c38a-20ef-4967-acc6-2fb3cecdfd04",
+    "alias" : "Verify Existing Account by Re-authentication",
+    "description" : "Reauthentication of existing account",
+    "providerId" : "basic-flow",
+    "topLevel" : false,
+    "builtIn" : true,
+    "authenticationExecutions" : [ {
+      "authenticator" : "idp-username-password-form",
+      "authenticatorFlow" : false,
+      "requirement" : "REQUIRED",
+      "priority" : 10,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticatorFlow" : true,
+      "requirement" : "CONDITIONAL",
+      "priority" : 20,
+      "autheticatorFlow" : true,
+      "flowAlias" : "First broker login - Conditional OTP",
+      "userSetupAllowed" : false
+    } ]
+  }, {
+    "id" : "815de921-fba7-47d3-a77b-b4d929d051d3",
+    "alias" : "browser",
+    "description" : "browser based authentication",
+    "providerId" : "basic-flow",
+    "topLevel" : true,
+    "builtIn" : true,
+    "authenticationExecutions" : [ {
+      "authenticator" : "auth-cookie",
+      "authenticatorFlow" : false,
+      "requirement" : "ALTERNATIVE",
+      "priority" : 10,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticator" : "auth-spnego",
+      "authenticatorFlow" : false,
+      "requirement" : "DISABLED",
+      "priority" : 20,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticator" : "identity-provider-redirector",
+      "authenticatorFlow" : false,
+      "requirement" : "ALTERNATIVE",
+      "priority" : 25,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticatorFlow" : true,
+      "requirement" : "ALTERNATIVE",
+      "priority" : 30,
+      "autheticatorFlow" : true,
+      "flowAlias" : "forms",
+      "userSetupAllowed" : false
+    } ]
+  }, {
+    "id" : "16cf55b2-6770-45c4-82de-56db751b23a3",
+    "alias" : "clients",
+    "description" : "Base authentication for clients",
+    "providerId" : "client-flow",
+    "topLevel" : true,
+    "builtIn" : true,
+    "authenticationExecutions" : [ {
+      "authenticator" : "client-secret",
+      "authenticatorFlow" : false,
+      "requirement" : "ALTERNATIVE",
+      "priority" : 10,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticator" : "client-jwt",
+      "authenticatorFlow" : false,
+      "requirement" : "ALTERNATIVE",
+      "priority" : 20,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticator" : "client-secret-jwt",
+      "authenticatorFlow" : false,
+      "requirement" : "ALTERNATIVE",
+      "priority" : 30,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticator" : "client-x509",
+      "authenticatorFlow" : false,
+      "requirement" : "ALTERNATIVE",
+      "priority" : 40,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    } ]
+  }, {
+    "id" : "99e8a9ba-9bb6-440b-a9bb-e6c979af7580",
+    "alias" : "direct grant",
+    "description" : "OpenID Connect Resource Owner Grant",
+    "providerId" : "basic-flow",
+    "topLevel" : true,
+    "builtIn" : true,
+    "authenticationExecutions" : [ {
+      "authenticator" : "direct-grant-validate-username",
+      "authenticatorFlow" : false,
+      "requirement" : "REQUIRED",
+      "priority" : 10,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticator" : "direct-grant-validate-password",
+      "authenticatorFlow" : false,
+      "requirement" : "REQUIRED",
+      "priority" : 20,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticatorFlow" : true,
+      "requirement" : "CONDITIONAL",
+      "priority" : 30,
+      "autheticatorFlow" : true,
+      "flowAlias" : "Direct Grant - Conditional OTP",
+      "userSetupAllowed" : false
+    } ]
+  }, {
+    "id" : "fb4d9fd1-ccd0-42dd-973d-02e908a266e9",
+    "alias" : "docker auth",
+    "description" : "Used by Docker clients to authenticate against the IDP",
+    "providerId" : "basic-flow",
+    "topLevel" : true,
+    "builtIn" : true,
+    "authenticationExecutions" : [ {
+      "authenticator" : "docker-http-basic-authenticator",
+      "authenticatorFlow" : false,
+      "requirement" : "REQUIRED",
+      "priority" : 10,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    } ]
+  }, {
+    "id" : "ec3e8d47-a952-41f7-9313-ffbe22b9f633",
+    "alias" : "first broker login",
+    "description" : "Actions taken after first broker login with identity provider account, which is not yet linked to any Keycloak account",
+    "providerId" : "basic-flow",
+    "topLevel" : true,
+    "builtIn" : true,
+    "authenticationExecutions" : [ {
+      "authenticatorConfig" : "review profile config",
+      "authenticator" : "idp-review-profile",
+      "authenticatorFlow" : false,
+      "requirement" : "REQUIRED",
+      "priority" : 10,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticatorFlow" : true,
+      "requirement" : "REQUIRED",
+      "priority" : 20,
+      "autheticatorFlow" : true,
+      "flowAlias" : "User creation or linking",
+      "userSetupAllowed" : false
+    } ]
+  }, {
+    "id" : "604db1ec-cdce-42d1-84eb-ce923618234a",
+    "alias" : "forms",
+    "description" : "Username, password, otp and other auth forms.",
+    "providerId" : "basic-flow",
+    "topLevel" : false,
+    "builtIn" : true,
+    "authenticationExecutions" : [ {
+      "authenticator" : "auth-username-password-form",
+      "authenticatorFlow" : false,
+      "requirement" : "REQUIRED",
+      "priority" : 10,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticatorFlow" : true,
+      "requirement" : "CONDITIONAL",
+      "priority" : 20,
+      "autheticatorFlow" : true,
+      "flowAlias" : "Browser - Conditional OTP",
+      "userSetupAllowed" : false
+    } ]
+  }, {
+    "id" : "74dbe172-245d-4044-90dd-5ab0738c85e3",
+    "alias" : "registration",
+    "description" : "registration flow",
+    "providerId" : "basic-flow",
+    "topLevel" : true,
+    "builtIn" : true,
+    "authenticationExecutions" : [ {
+      "authenticator" : "registration-page-form",
+      "authenticatorFlow" : true,
+      "requirement" : "REQUIRED",
+      "priority" : 10,
+      "autheticatorFlow" : true,
+      "flowAlias" : "registration form",
+      "userSetupAllowed" : false
+    } ]
+  }, {
+    "id" : "31a0ef14-0da3-44bc-8cd8-1ae8611b65bd",
+    "alias" : "registration form",
+    "description" : "registration form",
+    "providerId" : "form-flow",
+    "topLevel" : false,
+    "builtIn" : true,
+    "authenticationExecutions" : [ {
+      "authenticator" : "registration-user-creation",
+      "authenticatorFlow" : false,
+      "requirement" : "REQUIRED",
+      "priority" : 20,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticator" : "registration-password-action",
+      "authenticatorFlow" : false,
+      "requirement" : "REQUIRED",
+      "priority" : 50,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticator" : "registration-recaptcha-action",
+      "authenticatorFlow" : false,
+      "requirement" : "DISABLED",
+      "priority" : 60,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticator" : "registration-terms-and-conditions",
+      "authenticatorFlow" : false,
+      "requirement" : "DISABLED",
+      "priority" : 70,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    } ]
+  }, {
+    "id" : "9c69d958-9750-49c4-800d-76c5f35e6bef",
+    "alias" : "reset credentials",
+    "description" : "Reset credentials for a user if they forgot their password or something",
+    "providerId" : "basic-flow",
+    "topLevel" : true,
+    "builtIn" : true,
+    "authenticationExecutions" : [ {
+      "authenticator" : "reset-credentials-choose-user",
+      "authenticatorFlow" : false,
+      "requirement" : "REQUIRED",
+      "priority" : 10,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticator" : "reset-credential-email",
+      "authenticatorFlow" : false,
+      "requirement" : "REQUIRED",
+      "priority" : 20,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticator" : "reset-password",
+      "authenticatorFlow" : false,
+      "requirement" : "REQUIRED",
+      "priority" : 30,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticatorFlow" : true,
+      "requirement" : "CONDITIONAL",
+      "priority" : 40,
+      "autheticatorFlow" : true,
+      "flowAlias" : "Reset - Conditional OTP",
+      "userSetupAllowed" : false
+    } ]
+  }, {
+    "id" : "1134ad29-7c5d-46fc-848f-2f545fab40c1",
+    "alias" : "saml ecp",
+    "description" : "SAML ECP Profile Authentication Flow",
+    "providerId" : "basic-flow",
+    "topLevel" : true,
+    "builtIn" : true,
+    "authenticationExecutions" : [ {
+      "authenticator" : "http-basic-authenticator",
+      "authenticatorFlow" : false,
+      "requirement" : "REQUIRED",
+      "priority" : 10,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    } ]
+  } ],
+  "authenticatorConfig" : [ {
+    "id" : "1df938ef-67a9-4b2f-b3a0-f2e78d03b014",
+    "alias" : "create unique user config",
+    "config" : {
+      "require.password.update.after.registration" : "false"
+    }
+  }, {
+    "id" : "74875b58-d27d-4413-85fe-3cb3f93089e1",
+    "alias" : "review profile config",
+    "config" : {
+      "update.profile.on.first.login" : "missing"
+    }
+  } ],
+  "requiredActions" : [ {
+    "alias" : "CONFIGURE_TOTP",
+    "name" : "Configure OTP",
+    "providerId" : "CONFIGURE_TOTP",
+    "enabled" : true,
+    "defaultAction" : false,
+    "priority" : 10,
+    "config" : { }
+  }, {
+    "alias" : "TERMS_AND_CONDITIONS",
+    "name" : "Terms and Conditions",
+    "providerId" : "TERMS_AND_CONDITIONS",
+    "enabled" : false,
+    "defaultAction" : false,
+    "priority" : 20,
+    "config" : { }
+  }, {
+    "alias" : "UPDATE_PASSWORD",
+    "name" : "Update Password",
+    "providerId" : "UPDATE_PASSWORD",
+    "enabled" : true,
+    "defaultAction" : false,
+    "priority" : 30,
+    "config" : { }
+  }, {
+    "alias" : "UPDATE_PROFILE",
+    "name" : "Update Profile",
+    "providerId" : "UPDATE_PROFILE",
+    "enabled" : true,
+    "defaultAction" : false,
+    "priority" : 40,
+    "config" : { }
+  }, {
+    "alias" : "VERIFY_EMAIL",
+    "name" : "Verify Email",
+    "providerId" : "VERIFY_EMAIL",
+    "enabled" : true,
+    "defaultAction" : false,
+    "priority" : 50,
+    "config" : { }
+  }, {
+    "alias" : "delete_account",
+    "name" : "Delete Account",
+    "providerId" : "delete_account",
+    "enabled" : false,
+    "defaultAction" : false,
+    "priority" : 60,
+    "config" : { }
+  }, {
+    "alias" : "webauthn-register",
+    "name" : "Webauthn Register",
+    "providerId" : "webauthn-register",
+    "enabled" : true,
+    "defaultAction" : false,
+    "priority" : 70,
+    "config" : { }
+  }, {
+    "alias" : "webauthn-register-passwordless",
+    "name" : "Webauthn Register Passwordless",
+    "providerId" : "webauthn-register-passwordless",
+    "enabled" : true,
+    "defaultAction" : false,
+    "priority" : 80,
+    "config" : { }
+  }, {
+    "alias" : "VERIFY_PROFILE",
+    "name" : "Verify Profile",
+    "providerId" : "VERIFY_PROFILE",
+    "enabled" : true,
+    "defaultAction" : false,
+    "priority" : 90,
+    "config" : { }
+  }, {
+    "alias" : "delete_credential",
+    "name" : "Delete Credential",
+    "providerId" : "delete_credential",
+    "enabled" : true,
+    "defaultAction" : false,
+    "priority" : 100,
+    "config" : { }
+  }, {
+    "alias" : "update_user_locale",
+    "name" : "Update User Locale",
+    "providerId" : "update_user_locale",
+    "enabled" : true,
+    "defaultAction" : false,
+    "priority" : 1000,
+    "config" : { }
+  } ],
+  "browserFlow" : "browser",
+  "registrationFlow" : "registration",
+  "directGrantFlow" : "direct grant",
+  "resetCredentialsFlow" : "reset credentials",
+  "clientAuthenticationFlow" : "clients",
+  "dockerAuthenticationFlow" : "docker auth",
+  "firstBrokerLoginFlow" : "first broker login",
+  "attributes" : {
+    "cibaBackchannelTokenDeliveryMode" : "poll",
+    "cibaExpiresIn" : "120",
+    "cibaAuthRequestedUserHint" : "login_hint",
+    "oauth2DeviceCodeLifespan" : "600",
+    "clientOfflineSessionMaxLifespan" : "0",
+    "oauth2DevicePollingInterval" : "5",
+    "clientSessionIdleTimeout" : "0",
+    "parRequestUriLifespan" : "60",
+    "clientSessionMaxLifespan" : "0",
+    "clientOfflineSessionIdleTimeout" : "0",
+    "cibaInterval" : "5",
+    "realmReusableOtpCode" : "false"
+  },
+  "keycloakVersion" : "24.0.3",
+  "userManagedAccessAllowed" : false,
+  "clientProfiles" : {
+    "profiles" : [ ]
+  },
+  "clientPolicies" : {
+    "policies" : [ ]
+  }
+}, {
+  "id" : "191ac492-ee46-4b98-86bd-555f0e9c6dd4",
+  "realm" : "master",
+  "displayName" : "Keycloak",
+  "displayNameHtml" : "<div class=\"kc-logo-text\"><span>Keycloak</span></div>",
+  "notBefore" : 0,
+  "defaultSignatureAlgorithm" : "RS256",
+  "revokeRefreshToken" : false,
+  "refreshTokenMaxReuse" : 0,
+  "accessTokenLifespan" : 60,
+  "accessTokenLifespanForImplicitFlow" : 900,
+  "ssoSessionIdleTimeout" : 1800,
+  "ssoSessionMaxLifespan" : 36000,
+  "ssoSessionIdleTimeoutRememberMe" : 0,
+  "ssoSessionMaxLifespanRememberMe" : 0,
+  "offlineSessionIdleTimeout" : 2592000,
+  "offlineSessionMaxLifespanEnabled" : false,
+  "offlineSessionMaxLifespan" : 5184000,
+  "clientSessionIdleTimeout" : 0,
+  "clientSessionMaxLifespan" : 0,
+  "clientOfflineSessionIdleTimeout" : 0,
+  "clientOfflineSessionMaxLifespan" : 0,
+  "accessCodeLifespan" : 60,
+  "accessCodeLifespanUserAction" : 300,
+  "accessCodeLifespanLogin" : 1800,
+  "actionTokenGeneratedByAdminLifespan" : 43200,
+  "actionTokenGeneratedByUserLifespan" : 300,
+  "oauth2DeviceCodeLifespan" : 600,
+  "oauth2DevicePollingInterval" : 5,
+  "enabled" : true,
+  "sslRequired" : "external",
+  "registrationAllowed" : false,
+  "registrationEmailAsUsername" : false,
+  "rememberMe" : false,
+  "verifyEmail" : false,
+  "loginWithEmailAllowed" : true,
+  "duplicateEmailsAllowed" : false,
+  "resetPasswordAllowed" : false,
+  "editUsernameAllowed" : false,
+  "bruteForceProtected" : false,
+  "permanentLockout" : false,
+  "maxTemporaryLockouts" : 0,
+  "maxFailureWaitSeconds" : 900,
+  "minimumQuickLoginWaitSeconds" : 60,
+  "waitIncrementSeconds" : 60,
+  "quickLoginCheckMilliSeconds" : 1000,
+  "maxDeltaTimeSeconds" : 43200,
+  "failureFactor" : 30,
+  "roles" : {
+    "realm" : [ {
+      "id" : "8ddcc219-9713-4a90-8025-09d78b2215af",
+      "name" : "default-roles-master",
+      "description" : "${role_default-roles}",
+      "composite" : true,
+      "composites" : {
+        "realm" : [ "offline_access", "uma_authorization" ],
+        "client" : {
+          "account" : [ "view-profile", "manage-account" ]
+        }
+      },
+      "clientRole" : false,
+      "containerId" : "191ac492-ee46-4b98-86bd-555f0e9c6dd4",
+      "attributes" : { }
+    }, {
+      "id" : "6ec36f3c-a8a7-425a-945e-f960e1e13ed4",
+      "name" : "uma_authorization",
+      "description" : "${role_uma_authorization}",
+      "composite" : false,
+      "clientRole" : false,
+      "containerId" : "191ac492-ee46-4b98-86bd-555f0e9c6dd4",
+      "attributes" : { }
+    }, {
+      "id" : "197fabfc-b61a-4b30-8bf3-c9c8397ce43f",
+      "name" : "create-realm",
+      "description" : "${role_create-realm}",
+      "composite" : false,
+      "clientRole" : false,
+      "containerId" : "191ac492-ee46-4b98-86bd-555f0e9c6dd4",
+      "attributes" : { }
+    }, {
+      "id" : "d1d8b853-cb11-4039-a376-9b15771d3c45",
+      "name" : "offline_access",
+      "description" : "${role_offline-access}",
+      "composite" : false,
+      "clientRole" : false,
+      "containerId" : "191ac492-ee46-4b98-86bd-555f0e9c6dd4",
+      "attributes" : { }
+    }, {
+      "id" : "09f2d0fc-2ac5-4ca6-9277-b80523fef80e",
+      "name" : "admin",
+      "description" : "${role_admin}",
+      "composite" : true,
+      "composites" : {
+        "realm" : [ "create-realm" ],
+        "client" : {
+          "master-realm" : [ "view-realm", "manage-users", "query-users", "view-events", "view-users", "query-groups", "manage-clients", "query-realms", "manage-authorization", "manage-events", "create-client", "query-clients", "view-authorization", "manage-identity-providers", "view-identity-providers", "manage-realm", "impersonation", "view-clients" ],
+          "acme-realm" : [ "manage-clients", "view-authorization", "impersonation", "view-realm", "manage-realm", "query-users", "query-groups", "query-realms", "manage-identity-providers", "view-identity-providers", "manage-authorization", "query-clients", "view-clients", "manage-events", "manage-users", "create-client", "view-events", "view-users" ]
+        }
+      },
+      "clientRole" : false,
+      "containerId" : "191ac492-ee46-4b98-86bd-555f0e9c6dd4",
+      "attributes" : { }
+    } ],
+    "client" : {
+      "security-admin-console" : [ ],
+      "admin-cli" : [ ],
+      "account-console" : [ ],
+      "acme-realm" : [ {
+        "id" : "44cbd04b-3969-4b80-bed8-65fe25299202",
+        "name" : "query-clients",
+        "description" : "${role_query-clients}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "cadb41af-e4bc-4589-8bb9-4a6815a3c103",
+        "attributes" : { }
+      }, {
+        "id" : "eea80d24-cb46-43ca-9565-23fb26434359",
+        "name" : "manage-clients",
+        "description" : "${role_manage-clients}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "cadb41af-e4bc-4589-8bb9-4a6815a3c103",
+        "attributes" : { }
+      }, {
+        "id" : "54c1b2fb-8cec-412f-870e-abd3b9b27934",
+        "name" : "manage-events",
+        "description" : "${role_manage-events}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "cadb41af-e4bc-4589-8bb9-4a6815a3c103",
+        "attributes" : { }
+      }, {
+        "id" : "adecc1c6-23a2-438d-b933-d0c6c96883cc",
+        "name" : "view-authorization",
+        "description" : "${role_view-authorization}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "cadb41af-e4bc-4589-8bb9-4a6815a3c103",
+        "attributes" : { }
+      }, {
+        "id" : "0279621d-ddb8-464a-889b-f75e81ec9d23",
+        "name" : "view-clients",
+        "description" : "${role_view-clients}",
+        "composite" : true,
+        "composites" : {
+          "client" : {
+            "acme-realm" : [ "query-clients" ]
+          }
+        },
+        "clientRole" : true,
+        "containerId" : "cadb41af-e4bc-4589-8bb9-4a6815a3c103",
+        "attributes" : { }
+      }, {
+        "id" : "a0eefd2b-c739-4ad0-900a-1d259a3bfa93",
+        "name" : "impersonation",
+        "description" : "${role_impersonation}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "cadb41af-e4bc-4589-8bb9-4a6815a3c103",
+        "attributes" : { }
+      }, {
+        "id" : "ccf93e04-c296-4d0c-8db3-deb0109d57eb",
+        "name" : "view-realm",
+        "description" : "${role_view-realm}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "cadb41af-e4bc-4589-8bb9-4a6815a3c103",
+        "attributes" : { }
+      }, {
+        "id" : "ff402b20-339b-4f71-abc4-a83c16c87c2d",
+        "name" : "manage-realm",
+        "description" : "${role_manage-realm}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "cadb41af-e4bc-4589-8bb9-4a6815a3c103",
+        "attributes" : { }
+      }, {
+        "id" : "5a2818eb-f8d7-4b66-a527-ef50998f6c13",
+        "name" : "query-users",
+        "description" : "${role_query-users}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "cadb41af-e4bc-4589-8bb9-4a6815a3c103",
+        "attributes" : { }
+      }, {
+        "id" : "58860a27-1f34-48ae-8501-85629be822a2",
+        "name" : "manage-users",
+        "description" : "${role_manage-users}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "cadb41af-e4bc-4589-8bb9-4a6815a3c103",
+        "attributes" : { }
+      }, {
+        "id" : "f90bada8-1d39-4d59-9fd0-e2a6b63c4022",
+        "name" : "create-client",
+        "description" : "${role_create-client}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "cadb41af-e4bc-4589-8bb9-4a6815a3c103",
+        "attributes" : { }
+      }, {
+        "id" : "571f22a4-2915-403e-902e-859daf55de00",
+        "name" : "query-groups",
+        "description" : "${role_query-groups}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "cadb41af-e4bc-4589-8bb9-4a6815a3c103",
+        "attributes" : { }
+      }, {
+        "id" : "391e3dd5-6023-4d70-8f1d-7223cc3a461e",
+        "name" : "view-events",
+        "description" : "${role_view-events}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "cadb41af-e4bc-4589-8bb9-4a6815a3c103",
+        "attributes" : { }
+      }, {
+        "id" : "67decaa2-0d39-4fdb-aa94-22798c04cc4d",
+        "name" : "manage-identity-providers",
+        "description" : "${role_manage-identity-providers}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "cadb41af-e4bc-4589-8bb9-4a6815a3c103",
+        "attributes" : { }
+      }, {
+        "id" : "4145d686-cc87-4834-8b62-ecdb24aaaefd",
+        "name" : "query-realms",
+        "description" : "${role_query-realms}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "cadb41af-e4bc-4589-8bb9-4a6815a3c103",
+        "attributes" : { }
+      }, {
+        "id" : "a432fa76-2380-45c9-b359-63122e40f69f",
+        "name" : "view-identity-providers",
+        "description" : "${role_view-identity-providers}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "cadb41af-e4bc-4589-8bb9-4a6815a3c103",
+        "attributes" : { }
+      }, {
+        "id" : "3e3bb0ff-b71e-479e-a97d-14ac4be85275",
+        "name" : "view-users",
+        "description" : "${role_view-users}",
+        "composite" : true,
+        "composites" : {
+          "client" : {
+            "acme-realm" : [ "query-groups", "query-users" ]
+          }
+        },
+        "clientRole" : true,
+        "containerId" : "cadb41af-e4bc-4589-8bb9-4a6815a3c103",
+        "attributes" : { }
+      }, {
+        "id" : "34250e33-3057-4ebb-8412-6362b38d18dd",
+        "name" : "manage-authorization",
+        "description" : "${role_manage-authorization}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "cadb41af-e4bc-4589-8bb9-4a6815a3c103",
+        "attributes" : { }
+      } ],
+      "broker" : [ {
+        "id" : "100e1811-c4c4-4ec3-b958-6b242d0bdbe7",
+        "name" : "read-token",
+        "description" : "${role_read-token}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "2ef8b468-85f5-4f42-96de-bbd281e481a5",
+        "attributes" : { }
+      } ],
+      "master-realm" : [ {
+        "id" : "6aae7cfc-8752-4651-b7c1-89e0554bb8d0",
+        "name" : "create-client",
+        "description" : "${role_create-client}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "4e41f3cd-5d3c-44a8-a2eb-1229556c722b",
+        "attributes" : { }
+      }, {
+        "id" : "ab63cb90-bc4a-4fe8-9a04-30c2c8cb57f9",
+        "name" : "manage-users",
+        "description" : "${role_manage-users}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "4e41f3cd-5d3c-44a8-a2eb-1229556c722b",
+        "attributes" : { }
+      }, {
+        "id" : "d5cd06fc-480c-4def-813d-31c42c2a9d40",
+        "name" : "query-users",
+        "description" : "${role_query-users}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "4e41f3cd-5d3c-44a8-a2eb-1229556c722b",
+        "attributes" : { }
+      }, {
+        "id" : "18779a8e-bed6-4c8d-bc9a-0ae7eb42f238",
+        "name" : "view-realm",
+        "description" : "${role_view-realm}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "4e41f3cd-5d3c-44a8-a2eb-1229556c722b",
+        "attributes" : { }
+      }, {
+        "id" : "cacc4662-4f5f-4ed8-b3d4-a328b7616ca7",
+        "name" : "query-clients",
+        "description" : "${role_query-clients}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "4e41f3cd-5d3c-44a8-a2eb-1229556c722b",
+        "attributes" : { }
+      }, {
+        "id" : "0dee4cf8-a32e-4d30-9379-8e5d619ca159",
+        "name" : "view-events",
+        "description" : "${role_view-events}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "4e41f3cd-5d3c-44a8-a2eb-1229556c722b",
+        "attributes" : { }
+      }, {
+        "id" : "594e3f21-0e31-4702-8ea7-d273cbdd27b8",
+        "name" : "view-users",
+        "description" : "${role_view-users}",
+        "composite" : true,
+        "composites" : {
+          "client" : {
+            "master-realm" : [ "query-users", "query-groups" ]
+          }
+        },
+        "clientRole" : true,
+        "containerId" : "4e41f3cd-5d3c-44a8-a2eb-1229556c722b",
+        "attributes" : { }
+      }, {
+        "id" : "17e95675-034e-48e2-a579-750be13c61b0",
+        "name" : "query-groups",
+        "description" : "${role_query-groups}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "4e41f3cd-5d3c-44a8-a2eb-1229556c722b",
+        "attributes" : { }
+      }, {
+        "id" : "3967c19d-7b0d-4f36-9dc3-6ad2ae73f9b1",
+        "name" : "view-authorization",
+        "description" : "${role_view-authorization}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "4e41f3cd-5d3c-44a8-a2eb-1229556c722b",
+        "attributes" : { }
+      }, {
+        "id" : "2027775d-a372-4461-a1c9-03482a8d82fb",
+        "name" : "manage-identity-providers",
+        "description" : "${role_manage-identity-providers}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "4e41f3cd-5d3c-44a8-a2eb-1229556c722b",
+        "attributes" : { }
+      }, {
+        "id" : "67cf5cbd-0dea-41be-8a7f-6befdc8e9b17",
+        "name" : "manage-clients",
+        "description" : "${role_manage-clients}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "4e41f3cd-5d3c-44a8-a2eb-1229556c722b",
+        "attributes" : { }
+      }, {
+        "id" : "150d0944-647e-43ee-8547-ab82e9190c7d",
+        "name" : "view-identity-providers",
+        "description" : "${role_view-identity-providers}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "4e41f3cd-5d3c-44a8-a2eb-1229556c722b",
+        "attributes" : { }
+      }, {
+        "id" : "51e7a804-90c7-40d8-b0a2-a944ca25cf8e",
+        "name" : "query-realms",
+        "description" : "${role_query-realms}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "4e41f3cd-5d3c-44a8-a2eb-1229556c722b",
+        "attributes" : { }
+      }, {
+        "id" : "5d1b8836-0fb7-4d48-afe6-a91efb4b3c98",
+        "name" : "impersonation",
+        "description" : "${role_impersonation}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "4e41f3cd-5d3c-44a8-a2eb-1229556c722b",
+        "attributes" : { }
+      }, {
+        "id" : "3f393673-d0e5-482c-940d-93c37e2e31e4",
+        "name" : "manage-realm",
+        "description" : "${role_manage-realm}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "4e41f3cd-5d3c-44a8-a2eb-1229556c722b",
+        "attributes" : { }
+      }, {
+        "id" : "388d0826-189b-4a71-b1f9-2ca8c0727821",
+        "name" : "manage-authorization",
+        "description" : "${role_manage-authorization}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "4e41f3cd-5d3c-44a8-a2eb-1229556c722b",
+        "attributes" : { }
+      }, {
+        "id" : "68b4508e-5140-4366-a893-25eb6382cbd3",
+        "name" : "view-clients",
+        "description" : "${role_view-clients}",
+        "composite" : true,
+        "composites" : {
+          "client" : {
+            "master-realm" : [ "query-clients" ]
+          }
+        },
+        "clientRole" : true,
+        "containerId" : "4e41f3cd-5d3c-44a8-a2eb-1229556c722b",
+        "attributes" : { }
+      }, {
+        "id" : "d0e91562-4e62-46fb-b5ca-0ad203f5e18c",
+        "name" : "manage-events",
+        "description" : "${role_manage-events}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "4e41f3cd-5d3c-44a8-a2eb-1229556c722b",
+        "attributes" : { }
+      } ],
+      "account" : [ {
+        "id" : "9a255e35-d231-4f43-9b72-f1e02393839c",
+        "name" : "view-applications",
+        "description" : "${role_view-applications}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "3659320b-cfa0-458f-92f6-e9338e778981",
+        "attributes" : { }
+      }, {
+        "id" : "be77643b-f978-4905-950f-0623bf0dd180",
+        "name" : "view-profile",
+        "description" : "${role_view-profile}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "3659320b-cfa0-458f-92f6-e9338e778981",
+        "attributes" : { }
+      }, {
+        "id" : "da3b5b21-72e8-4090-9b69-dbff311ae01a",
+        "name" : "manage-account",
+        "description" : "${role_manage-account}",
+        "composite" : true,
+        "composites" : {
+          "client" : {
+            "account" : [ "manage-account-links" ]
+          }
+        },
+        "clientRole" : true,
+        "containerId" : "3659320b-cfa0-458f-92f6-e9338e778981",
+        "attributes" : { }
+      }, {
+        "id" : "27b19ecd-7059-438e-ba98-64bff523d9d5",
+        "name" : "manage-consent",
+        "description" : "${role_manage-consent}",
+        "composite" : true,
+        "composites" : {
+          "client" : {
+            "account" : [ "view-consent" ]
+          }
+        },
+        "clientRole" : true,
+        "containerId" : "3659320b-cfa0-458f-92f6-e9338e778981",
+        "attributes" : { }
+      }, {
+        "id" : "7d441d29-273e-463f-bc18-f1f8e155fcd3",
+        "name" : "manage-account-links",
+        "description" : "${role_manage-account-links}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "3659320b-cfa0-458f-92f6-e9338e778981",
+        "attributes" : { }
+      }, {
+        "id" : "3f6af371-820c-4e97-82ee-e834d3467371",
+        "name" : "view-consent",
+        "description" : "${role_view-consent}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "3659320b-cfa0-458f-92f6-e9338e778981",
+        "attributes" : { }
+      }, {
+        "id" : "fc66a147-7abd-4ee8-83d7-418340e332ff",
+        "name" : "view-groups",
+        "description" : "${role_view-groups}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "3659320b-cfa0-458f-92f6-e9338e778981",
+        "attributes" : { }
+      }, {
+        "id" : "dba9ba90-c946-4a51-8681-69bd0b81fa62",
+        "name" : "delete-account",
+        "description" : "${role_delete-account}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "3659320b-cfa0-458f-92f6-e9338e778981",
+        "attributes" : { }
+      } ]
+    }
+  },
+  "groups" : [ ],
+  "defaultRole" : {
+    "id" : "8ddcc219-9713-4a90-8025-09d78b2215af",
+    "name" : "default-roles-master",
+    "description" : "${role_default-roles}",
+    "composite" : true,
+    "clientRole" : false,
+    "containerId" : "191ac492-ee46-4b98-86bd-555f0e9c6dd4"
+  },
+  "requiredCredentials" : [ "password" ],
+  "otpPolicyType" : "totp",
+  "otpPolicyAlgorithm" : "HmacSHA1",
+  "otpPolicyInitialCounter" : 0,
+  "otpPolicyDigits" : 6,
+  "otpPolicyLookAheadWindow" : 1,
+  "otpPolicyPeriod" : 30,
+  "otpPolicyCodeReusable" : false,
+  "otpSupportedApplications" : [ "totpAppFreeOTPName", "totpAppGoogleName", "totpAppMicrosoftAuthenticatorName" ],
+  "localizationTexts" : { },
+  "webAuthnPolicyRpEntityName" : "keycloak",
+  "webAuthnPolicySignatureAlgorithms" : [ "ES256" ],
+  "webAuthnPolicyRpId" : "",
+  "webAuthnPolicyAttestationConveyancePreference" : "not specified",
+  "webAuthnPolicyAuthenticatorAttachment" : "not specified",
+  "webAuthnPolicyRequireResidentKey" : "not specified",
+  "webAuthnPolicyUserVerificationRequirement" : "not specified",
+  "webAuthnPolicyCreateTimeout" : 0,
+  "webAuthnPolicyAvoidSameAuthenticatorRegister" : false,
+  "webAuthnPolicyAcceptableAaguids" : [ ],
+  "webAuthnPolicyExtraOrigins" : [ ],
+  "webAuthnPolicyPasswordlessRpEntityName" : "keycloak",
+  "webAuthnPolicyPasswordlessSignatureAlgorithms" : [ "ES256" ],
+  "webAuthnPolicyPasswordlessRpId" : "",
+  "webAuthnPolicyPasswordlessAttestationConveyancePreference" : "not specified",
+  "webAuthnPolicyPasswordlessAuthenticatorAttachment" : "not specified",
+  "webAuthnPolicyPasswordlessRequireResidentKey" : "not specified",
+  "webAuthnPolicyPasswordlessUserVerificationRequirement" : "not specified",
+  "webAuthnPolicyPasswordlessCreateTimeout" : 0,
+  "webAuthnPolicyPasswordlessAvoidSameAuthenticatorRegister" : false,
+  "webAuthnPolicyPasswordlessAcceptableAaguids" : [ ],
+  "webAuthnPolicyPasswordlessExtraOrigins" : [ ],
+  "users" : [ {
+    "id" : "00137895-5233-404f-a55b-f5b988fd75ad",
+    "username" : "admin",
+    "emailVerified" : false,
+    "createdTimestamp" : 1720153344706,
+    "enabled" : true,
+    "totp" : false,
+    "credentials" : [ {
+      "id" : "73115e07-7aeb-477c-abbb-83da133e90ca",
+      "type" : "password",
+      "createdDate" : 1720153344957,
+      "secretData" : "{\"value\":\"afg78aZjUo7hVoki9JI799YrP1pHIjhrybQgnlZLHq70jb4JiX5uRaNy/F8IdlFyZ6p42qoO5fRsKWpVZ8AkIA==\",\"salt\":\"L0kNLhCTFGEi3mSzwHaPRg==\",\"additionalParameters\":{}}",
+      "credentialData" : "{\"hashIterations\":210000,\"algorithm\":\"pbkdf2-sha512\",\"additionalParameters\":{}}"
+    } ],
+    "disableableCredentialTypes" : [ ],
+    "requiredActions" : [ ],
+    "realmRoles" : [ "default-roles-master", "admin" ],
+    "notBefore" : 0,
+    "groups" : [ ]
+  } ],
+  "scopeMappings" : [ {
+    "clientScope" : "offline_access",
+    "roles" : [ "offline_access" ]
+  } ],
+  "clientScopeMappings" : {
+    "account" : [ {
+      "client" : "account-console",
+      "roles" : [ "manage-account", "view-groups" ]
+    } ]
+  },
+  "clients" : [ {
+    "id" : "3659320b-cfa0-458f-92f6-e9338e778981",
+    "clientId" : "account",
+    "name" : "${client_account}",
+    "rootUrl" : "${authBaseUrl}",
+    "baseUrl" : "/realms/master/account/",
+    "surrogateAuthRequired" : false,
+    "enabled" : true,
+    "alwaysDisplayInConsole" : false,
+    "clientAuthenticatorType" : "client-secret",
+    "redirectUris" : [ "/realms/master/account/*" ],
+    "webOrigins" : [ ],
+    "notBefore" : 0,
+    "bearerOnly" : false,
+    "consentRequired" : false,
+    "standardFlowEnabled" : true,
+    "implicitFlowEnabled" : false,
+    "directAccessGrantsEnabled" : false,
+    "serviceAccountsEnabled" : false,
+    "publicClient" : true,
+    "frontchannelLogout" : false,
+    "protocol" : "openid-connect",
+    "attributes" : {
+      "post.logout.redirect.uris" : "+"
+    },
+    "authenticationFlowBindingOverrides" : { },
+    "fullScopeAllowed" : false,
+    "nodeReRegistrationTimeout" : 0,
+    "defaultClientScopes" : [ "web-origins", "acr", "roles", "profile", "email" ],
+    "optionalClientScopes" : [ "address", "phone", "offline_access", "microprofile-jwt" ]
+  }, {
+    "id" : "346a90c1-2851-4eb3-a1be-278760e96e73",
+    "clientId" : "account-console",
+    "name" : "${client_account-console}",
+    "rootUrl" : "${authBaseUrl}",
+    "baseUrl" : "/realms/master/account/",
+    "surrogateAuthRequired" : false,
+    "enabled" : true,
+    "alwaysDisplayInConsole" : false,
+    "clientAuthenticatorType" : "client-secret",
+    "redirectUris" : [ "/realms/master/account/*" ],
+    "webOrigins" : [ ],
+    "notBefore" : 0,
+    "bearerOnly" : false,
+    "consentRequired" : false,
+    "standardFlowEnabled" : true,
+    "implicitFlowEnabled" : false,
+    "directAccessGrantsEnabled" : false,
+    "serviceAccountsEnabled" : false,
+    "publicClient" : true,
+    "frontchannelLogout" : false,
+    "protocol" : "openid-connect",
+    "attributes" : {
+      "post.logout.redirect.uris" : "+",
+      "pkce.code.challenge.method" : "S256"
+    },
+    "authenticationFlowBindingOverrides" : { },
+    "fullScopeAllowed" : false,
+    "nodeReRegistrationTimeout" : 0,
+    "protocolMappers" : [ {
+      "id" : "74b70319-4576-4403-a8e2-50bc5128d3a6",
+      "name" : "audience resolve",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-audience-resolve-mapper",
+      "consentRequired" : false,
+      "config" : { }
+    } ],
+    "defaultClientScopes" : [ "web-origins", "acr", "roles", "profile", "email" ],
+    "optionalClientScopes" : [ "address", "phone", "offline_access", "microprofile-jwt" ]
+  }, {
+    "id" : "cadb41af-e4bc-4589-8bb9-4a6815a3c103",
+    "clientId" : "acme-realm",
+    "name" : "acme Realm",
+    "surrogateAuthRequired" : false,
+    "enabled" : true,
+    "alwaysDisplayInConsole" : false,
+    "clientAuthenticatorType" : "client-secret",
+    "redirectUris" : [ ],
+    "webOrigins" : [ ],
+    "notBefore" : 0,
+    "bearerOnly" : true,
+    "consentRequired" : false,
+    "standardFlowEnabled" : true,
+    "implicitFlowEnabled" : false,
+    "directAccessGrantsEnabled" : false,
+    "serviceAccountsEnabled" : false,
+    "publicClient" : false,
+    "frontchannelLogout" : false,
+    "attributes" : { },
+    "authenticationFlowBindingOverrides" : { },
+    "fullScopeAllowed" : false,
+    "nodeReRegistrationTimeout" : 0,
+    "defaultClientScopes" : [ ],
+    "optionalClientScopes" : [ ]
+  }, {
+    "id" : "dfe2b831-bba5-49c9-a39c-c540e0478ff6",
+    "clientId" : "admin-cli",
+    "name" : "${client_admin-cli}",
+    "surrogateAuthRequired" : false,
+    "enabled" : true,
+    "alwaysDisplayInConsole" : false,
+    "clientAuthenticatorType" : "client-secret",
+    "redirectUris" : [ ],
+    "webOrigins" : [ ],
+    "notBefore" : 0,
+    "bearerOnly" : false,
+    "consentRequired" : false,
+    "standardFlowEnabled" : false,
+    "implicitFlowEnabled" : false,
+    "directAccessGrantsEnabled" : true,
+    "serviceAccountsEnabled" : false,
+    "publicClient" : true,
+    "frontchannelLogout" : false,
+    "protocol" : "openid-connect",
+    "attributes" : { },
+    "authenticationFlowBindingOverrides" : { },
+    "fullScopeAllowed" : false,
+    "nodeReRegistrationTimeout" : 0,
+    "defaultClientScopes" : [ "web-origins", "acr", "roles", "profile", "email" ],
+    "optionalClientScopes" : [ "address", "phone", "offline_access", "microprofile-jwt" ]
+  }, {
+    "id" : "2ef8b468-85f5-4f42-96de-bbd281e481a5",
+    "clientId" : "broker",
+    "name" : "${client_broker}",
+    "surrogateAuthRequired" : false,
+    "enabled" : true,
+    "alwaysDisplayInConsole" : false,
+    "clientAuthenticatorType" : "client-secret",
+    "redirectUris" : [ ],
+    "webOrigins" : [ ],
+    "notBefore" : 0,
+    "bearerOnly" : true,
+    "consentRequired" : false,
+    "standardFlowEnabled" : true,
+    "implicitFlowEnabled" : false,
+    "directAccessGrantsEnabled" : false,
+    "serviceAccountsEnabled" : false,
+    "publicClient" : false,
+    "frontchannelLogout" : false,
+    "protocol" : "openid-connect",
+    "attributes" : { },
+    "authenticationFlowBindingOverrides" : { },
+    "fullScopeAllowed" : false,
+    "nodeReRegistrationTimeout" : 0,
+    "defaultClientScopes" : [ "web-origins", "acr", "roles", "profile", "email" ],
+    "optionalClientScopes" : [ "address", "phone", "offline_access", "microprofile-jwt" ]
+  }, {
+    "id" : "4e41f3cd-5d3c-44a8-a2eb-1229556c722b",
+    "clientId" : "master-realm",
+    "name" : "master Realm",
+    "surrogateAuthRequired" : false,
+    "enabled" : true,
+    "alwaysDisplayInConsole" : false,
+    "clientAuthenticatorType" : "client-secret",
+    "redirectUris" : [ ],
+    "webOrigins" : [ ],
+    "notBefore" : 0,
+    "bearerOnly" : true,
+    "consentRequired" : false,
+    "standardFlowEnabled" : true,
+    "implicitFlowEnabled" : false,
+    "directAccessGrantsEnabled" : false,
+    "serviceAccountsEnabled" : false,
+    "publicClient" : false,
+    "frontchannelLogout" : false,
+    "attributes" : { },
+    "authenticationFlowBindingOverrides" : { },
+    "fullScopeAllowed" : false,
+    "nodeReRegistrationTimeout" : 0,
+    "defaultClientScopes" : [ "web-origins", "acr", "roles", "profile", "email" ],
+    "optionalClientScopes" : [ "address", "phone", "offline_access", "microprofile-jwt" ]
+  }, {
+    "id" : "741d8f5b-1cc1-402c-838c-e3fad9f694e0",
+    "clientId" : "security-admin-console",
+    "name" : "${client_security-admin-console}",
+    "rootUrl" : "${authAdminUrl}",
+    "baseUrl" : "/admin/master/console/",
+    "surrogateAuthRequired" : false,
+    "enabled" : true,
+    "alwaysDisplayInConsole" : false,
+    "clientAuthenticatorType" : "client-secret",
+    "redirectUris" : [ "/admin/master/console/*" ],
+    "webOrigins" : [ "+" ],
+    "notBefore" : 0,
+    "bearerOnly" : false,
+    "consentRequired" : false,
+    "standardFlowEnabled" : true,
+    "implicitFlowEnabled" : false,
+    "directAccessGrantsEnabled" : false,
+    "serviceAccountsEnabled" : false,
+    "publicClient" : true,
+    "frontchannelLogout" : false,
+    "protocol" : "openid-connect",
+    "attributes" : {
+      "post.logout.redirect.uris" : "+",
+      "pkce.code.challenge.method" : "S256"
+    },
+    "authenticationFlowBindingOverrides" : { },
+    "fullScopeAllowed" : false,
+    "nodeReRegistrationTimeout" : 0,
+    "protocolMappers" : [ {
+      "id" : "f9307e43-06ca-4bf4-bfde-9a0d4cdaabe9",
+      "name" : "locale",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usermodel-attribute-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "introspection.token.claim" : "true",
+        "userinfo.token.claim" : "true",
+        "user.attribute" : "locale",
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "locale",
+        "jsonType.label" : "String"
+      }
+    } ],
+    "defaultClientScopes" : [ "web-origins", "acr", "roles", "profile", "email" ],
+    "optionalClientScopes" : [ "address", "phone", "offline_access", "microprofile-jwt" ]
+  } ],
+  "clientScopes" : [ {
+    "id" : "d739dc54-debb-4ed5-b75b-dd4985fe1578",
+    "name" : "web-origins",
+    "description" : "OpenID Connect scope for add allowed web origins to the access token",
+    "protocol" : "openid-connect",
+    "attributes" : {
+      "include.in.token.scope" : "false",
+      "display.on.consent.screen" : "false",
+      "consent.screen.text" : ""
+    },
+    "protocolMappers" : [ {
+      "id" : "3d216846-4588-439b-b176-794ee56a6453",
+      "name" : "allowed web origins",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-allowed-origins-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "introspection.token.claim" : "true",
+        "access.token.claim" : "true"
+      }
+    } ]
+  }, {
+    "id" : "f3c067ad-756f-4077-8353-b0973a77c631",
+    "name" : "microprofile-jwt",
+    "description" : "Microprofile - JWT built-in scope",
+    "protocol" : "openid-connect",
+    "attributes" : {
+      "include.in.token.scope" : "true",
+      "display.on.consent.screen" : "false"
+    },
+    "protocolMappers" : [ {
+      "id" : "ba56c9fd-329a-4005-ac5d-be37e2433e6b",
+      "name" : "groups",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usermodel-realm-role-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "introspection.token.claim" : "true",
+        "multivalued" : "true",
+        "user.attribute" : "foo",
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "groups",
+        "jsonType.label" : "String"
+      }
+    }, {
+      "id" : "bc7abe87-92bc-42f5-8f05-300c188743fe",
+      "name" : "upn",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usermodel-attribute-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "introspection.token.claim" : "true",
+        "userinfo.token.claim" : "true",
+        "user.attribute" : "username",
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "upn",
+        "jsonType.label" : "String"
+      }
+    } ]
+  }, {
+    "id" : "c061b893-bbac-43f6-8dfd-4e9b1770143d",
+    "name" : "acr",
+    "description" : "OpenID Connect scope for add acr (authentication context class reference) to the token",
+    "protocol" : "openid-connect",
+    "attributes" : {
+      "include.in.token.scope" : "false",
+      "display.on.consent.screen" : "false"
+    },
+    "protocolMappers" : [ {
+      "id" : "50b9028d-8bf8-4df4-b576-f07c54945d0f",
+      "name" : "acr loa level",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-acr-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "id.token.claim" : "true",
+        "introspection.token.claim" : "true",
+        "access.token.claim" : "true"
+      }
+    } ]
+  }, {
+    "id" : "6b6444e5-83df-4288-aea8-9c4144a97726",
+    "name" : "roles",
+    "description" : "OpenID Connect scope for add user roles to the access token",
+    "protocol" : "openid-connect",
+    "attributes" : {
+      "include.in.token.scope" : "false",
+      "display.on.consent.screen" : "true",
+      "consent.screen.text" : "${rolesScopeConsentText}"
+    },
+    "protocolMappers" : [ {
+      "id" : "f6f54a66-b397-4450-b561-c0f12fe0220f",
+      "name" : "client roles",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usermodel-client-role-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "introspection.token.claim" : "true",
+        "multivalued" : "true",
+        "user.attribute" : "foo",
+        "access.token.claim" : "true",
+        "claim.name" : "resource_access.${client_id}.roles",
+        "jsonType.label" : "String"
+      }
+    }, {
+      "id" : "6dfe7750-b712-40b2-9ebf-fbda52924c7d",
+      "name" : "realm roles",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usermodel-realm-role-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "introspection.token.claim" : "true",
+        "multivalued" : "true",
+        "user.attribute" : "foo",
+        "access.token.claim" : "true",
+        "claim.name" : "realm_access.roles",
+        "jsonType.label" : "String"
+      }
+    }, {
+      "id" : "ac7c16cb-e777-422c-9a8d-5ad09bce3839",
+      "name" : "audience resolve",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-audience-resolve-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "introspection.token.claim" : "true",
+        "access.token.claim" : "true"
+      }
+    } ]
+  }, {
+    "id" : "3538983c-6c33-495c-af1b-a7bbdbd6fb13",
+    "name" : "offline_access",
+    "description" : "OpenID Connect built-in scope: offline_access",
+    "protocol" : "openid-connect",
+    "attributes" : {
+      "consent.screen.text" : "${offlineAccessScopeConsentText}",
+      "display.on.consent.screen" : "true"
+    }
+  }, {
+    "id" : "46d5f9fe-a86a-4235-bfee-b44564ebd539",
+    "name" : "role_list",
+    "description" : "SAML role list",
+    "protocol" : "saml",
+    "attributes" : {
+      "consent.screen.text" : "${samlRoleListScopeConsentText}",
+      "display.on.consent.screen" : "true"
+    },
+    "protocolMappers" : [ {
+      "id" : "fa808dce-2eb1-4dc1-99c1-393f678d0a0a",
+      "name" : "role list",
+      "protocol" : "saml",
+      "protocolMapper" : "saml-role-list-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "single" : "false",
+        "attribute.nameformat" : "Basic",
+        "attribute.name" : "Role"
+      }
+    } ]
+  }, {
+    "id" : "57169b71-cb55-4570-8599-c1b77f4d96d7",
+    "name" : "phone",
+    "description" : "OpenID Connect built-in scope: phone",
+    "protocol" : "openid-connect",
+    "attributes" : {
+      "include.in.token.scope" : "true",
+      "display.on.consent.screen" : "true",
+      "consent.screen.text" : "${phoneScopeConsentText}"
+    },
+    "protocolMappers" : [ {
+      "id" : "5d917c08-a8f0-42db-b9a9-61cfa81b2407",
+      "name" : "phone number verified",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usermodel-attribute-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "introspection.token.claim" : "true",
+        "userinfo.token.claim" : "true",
+        "user.attribute" : "phoneNumberVerified",
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "phone_number_verified",
+        "jsonType.label" : "boolean"
+      }
+    }, {
+      "id" : "a0d8d739-b485-4ecf-8fcd-4ec25f07199b",
+      "name" : "phone number",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usermodel-attribute-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "introspection.token.claim" : "true",
+        "userinfo.token.claim" : "true",
+        "user.attribute" : "phoneNumber",
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "phone_number",
+        "jsonType.label" : "String"
+      }
+    } ]
+  }, {
+    "id" : "0f320973-cb28-4e48-b388-d76c34261c71",
+    "name" : "profile",
+    "description" : "OpenID Connect built-in scope: profile",
+    "protocol" : "openid-connect",
+    "attributes" : {
+      "include.in.token.scope" : "true",
+      "display.on.consent.screen" : "true",
+      "consent.screen.text" : "${profileScopeConsentText}"
+    },
+    "protocolMappers" : [ {
+      "id" : "b28ea0fe-43c8-4775-8a9b-1d040819b03b",
+      "name" : "updated at",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usermodel-attribute-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "introspection.token.claim" : "true",
+        "userinfo.token.claim" : "true",
+        "user.attribute" : "updatedAt",
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "updated_at",
+        "jsonType.label" : "long"
+      }
+    }, {
+      "id" : "2a06cc4b-98d8-474c-bb13-127186a32968",
+      "name" : "zoneinfo",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usermodel-attribute-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "introspection.token.claim" : "true",
+        "userinfo.token.claim" : "true",
+        "user.attribute" : "zoneinfo",
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "zoneinfo",
+        "jsonType.label" : "String"
+      }
+    }, {
+      "id" : "be73715a-058f-404c-9b51-7e41b1825537",
+      "name" : "website",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usermodel-attribute-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "introspection.token.claim" : "true",
+        "userinfo.token.claim" : "true",
+        "user.attribute" : "website",
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "website",
+        "jsonType.label" : "String"
+      }
+    }, {
+      "id" : "dec647c6-d573-455d-939a-39a802741e95",
+      "name" : "locale",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usermodel-attribute-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "introspection.token.claim" : "true",
+        "userinfo.token.claim" : "true",
+        "user.attribute" : "locale",
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "locale",
+        "jsonType.label" : "String"
+      }
+    }, {
+      "id" : "f1328e07-2ab5-426b-9e1d-77cc7621bc61",
+      "name" : "nickname",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usermodel-attribute-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "introspection.token.claim" : "true",
+        "userinfo.token.claim" : "true",
+        "user.attribute" : "nickname",
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "nickname",
+        "jsonType.label" : "String"
+      }
+    }, {
+      "id" : "f311dbaa-f9a0-4dac-a8ae-8768947e2705",
+      "name" : "username",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usermodel-attribute-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "introspection.token.claim" : "true",
+        "userinfo.token.claim" : "true",
+        "user.attribute" : "username",
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "preferred_username",
+        "jsonType.label" : "String"
+      }
+    }, {
+      "id" : "7eb108c3-a2b8-4e50-bcf8-e80468b0cd53",
+      "name" : "profile",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usermodel-attribute-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "introspection.token.claim" : "true",
+        "userinfo.token.claim" : "true",
+        "user.attribute" : "profile",
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "profile",
+        "jsonType.label" : "String"
+      }
+    }, {
+      "id" : "ad098d23-ec9f-42e8-9a8d-c60f17811fa6",
+      "name" : "given name",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usermodel-attribute-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "introspection.token.claim" : "true",
+        "userinfo.token.claim" : "true",
+        "user.attribute" : "firstName",
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "given_name",
+        "jsonType.label" : "String"
+      }
+    }, {
+      "id" : "69e9863b-ccf1-4156-9228-3ce37afbcaa7",
+      "name" : "picture",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usermodel-attribute-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "introspection.token.claim" : "true",
+        "userinfo.token.claim" : "true",
+        "user.attribute" : "picture",
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "picture",
+        "jsonType.label" : "String"
+      }
+    }, {
+      "id" : "aa9fad06-40d3-4921-9da0-75afcc9b03d7",
+      "name" : "family name",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usermodel-attribute-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "introspection.token.claim" : "true",
+        "userinfo.token.claim" : "true",
+        "user.attribute" : "lastName",
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "family_name",
+        "jsonType.label" : "String"
+      }
+    }, {
+      "id" : "26dcb81b-92e5-4401-ae60-0f17f2900f00",
+      "name" : "full name",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-full-name-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "id.token.claim" : "true",
+        "introspection.token.claim" : "true",
+        "access.token.claim" : "true",
+        "userinfo.token.claim" : "true"
+      }
+    }, {
+      "id" : "631c4bcb-a389-44ba-a90a-67daf1d32797",
+      "name" : "birthdate",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usermodel-attribute-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "introspection.token.claim" : "true",
+        "userinfo.token.claim" : "true",
+        "user.attribute" : "birthdate",
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "birthdate",
+        "jsonType.label" : "String"
+      }
+    }, {
+      "id" : "67ba213a-6383-41b1-8709-06cb73cd9492",
+      "name" : "gender",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usermodel-attribute-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "introspection.token.claim" : "true",
+        "userinfo.token.claim" : "true",
+        "user.attribute" : "gender",
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "gender",
+        "jsonType.label" : "String"
+      }
+    }, {
+      "id" : "a41653aa-0998-4c00-abd2-3d0c543ab346",
+      "name" : "middle name",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usermodel-attribute-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "introspection.token.claim" : "true",
+        "userinfo.token.claim" : "true",
+        "user.attribute" : "middleName",
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "middle_name",
+        "jsonType.label" : "String"
+      }
+    } ]
+  }, {
+    "id" : "78025c65-e548-4a75-a3d7-afb55df66d5e",
+    "name" : "email",
+    "description" : "OpenID Connect built-in scope: email",
+    "protocol" : "openid-connect",
+    "attributes" : {
+      "include.in.token.scope" : "true",
+      "display.on.consent.screen" : "true",
+      "consent.screen.text" : "${emailScopeConsentText}"
+    },
+    "protocolMappers" : [ {
+      "id" : "ddcc3e73-f745-48d7-ac6e-a3b401586db6",
+      "name" : "email",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usermodel-attribute-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "introspection.token.claim" : "true",
+        "userinfo.token.claim" : "true",
+        "user.attribute" : "email",
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "email",
+        "jsonType.label" : "String"
+      }
+    }, {
+      "id" : "7854b2a9-e438-47bd-862a-8ef857adb5e9",
+      "name" : "email verified",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usermodel-property-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "introspection.token.claim" : "true",
+        "userinfo.token.claim" : "true",
+        "user.attribute" : "emailVerified",
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "email_verified",
+        "jsonType.label" : "boolean"
+      }
+    } ]
+  }, {
+    "id" : "3b942313-73f9-4f69-ba6e-c0d636262413",
+    "name" : "address",
+    "description" : "OpenID Connect built-in scope: address",
+    "protocol" : "openid-connect",
+    "attributes" : {
+      "include.in.token.scope" : "true",
+      "display.on.consent.screen" : "true",
+      "consent.screen.text" : "${addressScopeConsentText}"
+    },
+    "protocolMappers" : [ {
+      "id" : "5681e189-ba40-491d-b75c-d1ef3c518c85",
+      "name" : "address",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-address-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "user.attribute.formatted" : "formatted",
+        "user.attribute.country" : "country",
+        "introspection.token.claim" : "true",
+        "user.attribute.postal_code" : "postal_code",
+        "userinfo.token.claim" : "true",
+        "user.attribute.street" : "street",
+        "id.token.claim" : "true",
+        "user.attribute.region" : "region",
+        "access.token.claim" : "true",
+        "user.attribute.locality" : "locality"
+      }
+    } ]
+  } ],
+  "defaultDefaultClientScopes" : [ "role_list", "profile", "email", "roles", "web-origins", "acr" ],
+  "defaultOptionalClientScopes" : [ "offline_access", "address", "phone", "microprofile-jwt" ],
+  "browserSecurityHeaders" : {
+    "contentSecurityPolicyReportOnly" : "",
+    "xContentTypeOptions" : "nosniff",
+    "referrerPolicy" : "no-referrer",
+    "xRobotsTag" : "none",
+    "xFrameOptions" : "SAMEORIGIN",
+    "xXSSProtection" : "1; mode=block",
+    "contentSecurityPolicy" : "frame-src 'self'; frame-ancestors 'self'; object-src 'none';",
+    "strictTransportSecurity" : "max-age=31536000; includeSubDomains"
+  },
+  "smtpServer" : { },
+  "eventsEnabled" : false,
+  "eventsListeners" : [ "jboss-logging" ],
+  "enabledEventTypes" : [ ],
+  "adminEventsEnabled" : false,
+  "adminEventsDetailsEnabled" : false,
+  "identityProviders" : [ ],
+  "identityProviderMappers" : [ ],
+  "components" : {
+    "org.keycloak.services.clientregistration.policy.ClientRegistrationPolicy" : [ {
+      "id" : "13415890-1b69-4dde-89fa-5fea55adefe9",
+      "name" : "Consent Required",
+      "providerId" : "consent-required",
+      "subType" : "anonymous",
+      "subComponents" : { },
+      "config" : { }
+    }, {
+      "id" : "f15d8420-8d85-4bcd-aa59-b555407fe616",
+      "name" : "Allowed Client Scopes",
+      "providerId" : "allowed-client-templates",
+      "subType" : "authenticated",
+      "subComponents" : { },
+      "config" : {
+        "allow-default-scopes" : [ "true" ]
+      }
+    }, {
+      "id" : "40f79657-1647-423f-a9fc-8c232f478f9f",
+      "name" : "Trusted Hosts",
+      "providerId" : "trusted-hosts",
+      "subType" : "anonymous",
+      "subComponents" : { },
+      "config" : {
+        "host-sending-registration-request-must-match" : [ "true" ],
+        "client-uris-must-match" : [ "true" ]
+      }
+    }, {
+      "id" : "4775b4e1-4db9-4e12-9508-50966c151918",
+      "name" : "Allowed Client Scopes",
+      "providerId" : "allowed-client-templates",
+      "subType" : "anonymous",
+      "subComponents" : { },
+      "config" : {
+        "allow-default-scopes" : [ "true" ]
+      }
+    }, {
+      "id" : "730c6fec-35c7-4497-a672-9b9b06ee2b63",
+      "name" : "Full Scope Disabled",
+      "providerId" : "scope",
+      "subType" : "anonymous",
+      "subComponents" : { },
+      "config" : { }
+    }, {
+      "id" : "82b5342d-ed6a-4968-9f6a-1400ad329633",
+      "name" : "Max Clients Limit",
+      "providerId" : "max-clients",
+      "subType" : "anonymous",
+      "subComponents" : { },
+      "config" : {
+        "max-clients" : [ "200" ]
+      }
+    }, {
+      "id" : "e22244ea-2743-442b-af47-6e40c36c516f",
+      "name" : "Allowed Protocol Mapper Types",
+      "providerId" : "allowed-protocol-mappers",
+      "subType" : "anonymous",
+      "subComponents" : { },
+      "config" : {
+        "allowed-protocol-mapper-types" : [ "oidc-address-mapper", "oidc-sha256-pairwise-sub-mapper", "oidc-usermodel-attribute-mapper", "oidc-usermodel-property-mapper", "oidc-full-name-mapper", "saml-role-list-mapper", "saml-user-attribute-mapper", "saml-user-property-mapper" ]
+      }
+    }, {
+      "id" : "9221208f-41b7-4f62-825c-368191583daf",
+      "name" : "Allowed Protocol Mapper Types",
+      "providerId" : "allowed-protocol-mappers",
+      "subType" : "authenticated",
+      "subComponents" : { },
+      "config" : {
+        "allowed-protocol-mapper-types" : [ "saml-role-list-mapper", "saml-user-property-mapper", "oidc-sha256-pairwise-sub-mapper", "oidc-address-mapper", "saml-user-attribute-mapper", "oidc-usermodel-property-mapper", "oidc-full-name-mapper", "oidc-usermodel-attribute-mapper" ]
+      }
+    } ],
+    "org.keycloak.userprofile.UserProfileProvider" : [ {
+      "id" : "c8e87adb-6952-4398-8192-dc16f1d412dc",
+      "providerId" : "declarative-user-profile",
+      "subComponents" : { },
+      "config" : {
+        "kc.user.profile.config" : [ "{\"attributes\":[{\"name\":\"username\",\"displayName\":\"${username}\",\"validations\":{\"length\":{\"min\":3,\"max\":255},\"username-prohibited-characters\":{},\"up-username-not-idn-homograph\":{}},\"permissions\":{\"view\":[\"admin\",\"user\"],\"edit\":[\"admin\",\"user\"]},\"multivalued\":false},{\"name\":\"email\",\"displayName\":\"${email}\",\"validations\":{\"email\":{},\"length\":{\"max\":255}},\"permissions\":{\"view\":[\"admin\",\"user\"],\"edit\":[\"admin\",\"user\"]},\"multivalued\":false},{\"name\":\"firstName\",\"displayName\":\"${firstName}\",\"validations\":{\"length\":{\"max\":255},\"person-name-prohibited-characters\":{}},\"permissions\":{\"view\":[\"admin\",\"user\"],\"edit\":[\"admin\",\"user\"]},\"multivalued\":false},{\"name\":\"lastName\",\"displayName\":\"${lastName}\",\"validations\":{\"length\":{\"max\":255},\"person-name-prohibited-characters\":{}},\"permissions\":{\"view\":[\"admin\",\"user\"],\"edit\":[\"admin\",\"user\"]},\"multivalued\":false}],\"groups\":[{\"name\":\"user-metadata\",\"displayHeader\":\"User metadata\",\"displayDescription\":\"Attributes, which refer to user metadata\"}]}" ]
+      }
+    } ],
+    "org.keycloak.keys.KeyProvider" : [ {
+      "id" : "2a4b5ee7-ea09-4c7c-889a-fb9283cab95f",
+      "name" : "rsa-generated",
+      "providerId" : "rsa-generated",
+      "subComponents" : { },
+      "config" : {
+        "privateKey" : [ "MIIEogIBAAKCAQEAlpHbfoZdFVM2vSG+rC8wyVdenx1oNxpPpjP22Rpv0rWbhxEUyyBfKXo0f++5o65aDMVXVv3Y99eSz4CTg7SSF5DxFXF6a42rkkSxoNcszE9/hlp73lZZX6azpwmYf0aloAdrF2h9SoA7DfuIbNO2juG7YefkpWBJ7jk3FQZ5J6v72YMi3msypZSGhKXvnVW7rMt2QLgU43qjTbv7/p0sBtiROa1cIU1B8xcksxUDbRxLM9nBhZrhQZx0UOrmJALVSwrre/OgEWPNAMt5pcEM7cfEvcIkkbLPye8GKYAAovWat0JiQeaRHShfjNqOmlqlboe3Mo7YQAjPNK7tkydcjQIDAQABAoIBAB4qnF2B2YHlgWTMrzkrnjxkkQxTdbb+gkE0DYuLMKa4ZG/f4/jbZD144q5ULu8Ehj2jRv+ijbcAHYWNxuA/C/sFOsv3R5XnVR3Rvf3RxoOrlMrr83/E8JSJn1pCwacUVigU/Gd884c64DoJsFhPZXbEcoinz2czvrQoCelgOeNQ0p/THP7mhsEQnrA7eLLn3HJhkLO3KDp2F9OqQxG9qwvS1L805+QFjHJpdhFWQ8fPV1VYqfIVGpqQAo/M6QuyYyufBxISaEX3pmw4QgcCKtxooqvIy1nfqrHjUpA/zbwGcYzdkP0Kn6DK3Wjm4LscOsFQpWTnRzsid0j+rnvkl9ECgYEA0qL+9KkKysHHXj8mFJdJiEi9zUabr32+9wniLmOPe4CZt6MuIZiBNOoTiSaUWtCcdX3ZlqUhevXkFaw8uXjcDtdW3gL7j7S3q4PDSx/lJQQWSDG9aifSND3dyj2HnTCEex5OgT+1lBilv4KpibLiLchZozdIpXOz+aBSRe9OCjECgYEAtv8y5XNQKW321j2rFOhaRPtsND+CG6NY09MAKen7eAq3E5wv50JmTABdNg+zbmqTM8Z3RMxSuUbHxlYyJcY4LIh0OIAZtrylzmKYbhjn+2EMhWotYu6rvEHRUu/AGd5sHvjwVVXIS802TiM6zxVCjRhNcdCIk/4Cu/EZkjJhRR0CgYACEd/3f4G/pE/VOUGiiioK0MwsrDjzbITn4Iz8b7YFPKpGB7B4XAtI/dPbUSm8Cri+3tG4jT7a+neXTu351Jo0+yC7ZcQbEWeMo+rTXijeSD//zZ1S4blLEiCP0DL49HUY0J9s3bdnESbvztTjqYJXeNSIqg5osc5e8ZhdX5CgwQKBgD8YzS7KTNiMHvEOAGBMIVvpqQx23WC0ONuIxGSvVdK1Nxze3LGLdoQ8F+edEExBGRJgGx2wqdFSc22SqOXXa+UHA7O7j6Ivd6gq3M4RbmOBufSCgLW8/6AAvbEwE3eX9oXTZeK2mkJwtonIoe1nMjQ+Le3RblZA3iZ5YkzDbECNAoGAd+gtaUS1Gz3EkfP59mFrbc8rrG9Azzt+VNQAcm2xY+LWt7eOKm1nFJIluKNRQJa9YuSZh8rZE3sSLdCroThigaSDZlJfUWPhnuyDtBGCSJ5M0lKeVzUYNKrqzMm3aQOztMGgSz0M8Z4XzqUkp/APZnR+ycLT8SI0UtYcdCt0RyY=" ],
+        "keyUse" : [ "SIG" ],
+        "certificate" : [ "MIICmzCCAYMCBgGQgSEGfjANBgkqhkiG9w0BAQsFADARMQ8wDQYDVQQDDAZtYXN0ZXIwHhcNMjQwNzA1MDQyMDQzWhcNMzQwNzA1MDQyMjIzWjARMQ8wDQYDVQQDDAZtYXN0ZXIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCWkdt+hl0VUza9Ib6sLzDJV16fHWg3Gk+mM/bZGm/StZuHERTLIF8pejR/77mjrloMxVdW/dj315LPgJODtJIXkPEVcXprjauSRLGg1yzMT3+GWnveVllfprOnCZh/RqWgB2sXaH1KgDsN+4hs07aO4bth5+SlYEnuOTcVBnknq/vZgyLeazKllIaEpe+dVbusy3ZAuBTjeqNNu/v+nSwG2JE5rVwhTUHzFySzFQNtHEsz2cGFmuFBnHRQ6uYkAtVLCut786ARY80Ay3mlwQztx8S9wiSRss/J7wYpgACi9Zq3QmJB5pEdKF+M2o6aWqVuh7cyjthACM80ru2TJ1yNAgMBAAEwDQYJKoZIhvcNAQELBQADggEBABMvnj7/QEkBlITuGQHUpQL/EwcAjMw7hdx7r8ALQ27IV5uC0EPwyCjz5Ut43PjYp/K+Z1NISeh+bYCSXgTx6ZuVUXSTF8TY/41JfYo1qlCMhS0nmHXuvs/hwoVhkLwsDDoNLyEdCNzTGWZb48HWbUFqSXuqt6UgaJrxQqnFqcKgP9lgSkThHR7IWFcDQ2lmcZWZQ4kMG0x0+FP3wS/O7g4GDKc79R9DZm23BLLsn9Y+UqEttJ2YoDSivr18V2sowxPD63hGlgzZXT/qdQC9Y5PlJ7CtUqluGwIzFq4foNGvHqHTSYggD1TKmSxfpS4XGmzSv/ZYI4IsYjsHTFS5KEM=" ],
+        "priority" : [ "100" ]
+      }
+    }, {
+      "id" : "e3faf596-c05f-4485-b823-018b25e3e4c8",
+      "name" : "rsa-enc-generated",
+      "providerId" : "rsa-enc-generated",
+      "subComponents" : { },
+      "config" : {
+        "privateKey" : [ "MIIEowIBAAKCAQEA1e0zOnS6dHPgog9xOWJNYSzhdZOxyeMwOODyDRE0o6g5Y7mPu5Sazx0eulobiOAlDJGPVXXT2NBwajV4I4N24kFy1B3h+c8itsQsvd1aaVXvHn2XDf1jLdHTmYDI17Q0+gZNeJprXN2hqFxzi9VBrt2lA8MPG699ohIQ1EAuI4cAksyZ/xZVboxifKkmvyhef0R/7g7JcCyTGefYp0lCm7vyrD+9mMyaSOenMLteKMyhJe4jIiY2YI5aMLplCS4xobor1QU4jgXCmcihIv4JXufMvNjZ96xaSAiaKcdrI5LGAvCfVaBVIWTrvrpD5WgUiOTFMKP6MKjpJOb9VgapZQIDAQABAoIBADrPRRyGV3XJH1Fd/mngmNYkkOySSDdwgeK5EEHAX6C4D+LW8ekG7tIONtLTD6u+tuCwKV+8jxsVHjpMbbURoH6NsIQYnPVgWLI21vfxILhBfAV9UCfz5y6C9vFForEN5NxxHB4SEX7LnPPcSpV/8FkirIkOuBoL0fVakw7OgACazUPz5iT3y35BX8hFvf/QrIDKiTSkfOaDGz6g5W+1UA+KR2WvIAELuVkOH3VFEiFH2kpOPbLtbe7+Dleco9K19KTWOzkZE77kO8GRAchi3SVZZBYq9BnrtgbULh4TICYmLwksqudw6IUg26AHdgMT+9Cd5o95Lm2ON5OIJ4qpgtcCgYEA7I+QyM4LAJB67c1OIDqgKvjmtfpskwrkE9DwLCN4tnsRDyOf3YT6nHBU/bwhzZTQVXyZeKZzLdA3bzV/XMYZRhtPP5+3Ifi3f+65ZLKaRfbakY2FcU1q4NP4gDr6MgLzBVnVuGkx3JuywR6dtnLrHVBYQzpNgOw7a5nxn7f3r1MCgYEA54F8tYyqgOTZDUaFDzv2lLWMJXwcOBnKJTd5VPakiaShcMmwKAfGVZ6M0I24p+lj4Szr8bCw0239KvhYrG/t2MdrXpLId5cBBjQsrgAdF+mhxmmwhJSwWXtrmij8H+GCWBGVGZsxb4xycujDDikiG0SovSNkR4KrRSZrAntzhWcCgYAsp3EKJrK2+Y7q4q1Tsh1X30IVqd7i5tRk1TTw8AUyVQrEU9Iyi46PBzlT6DZtSyEEcg+6UZk+VaaRLIUNKyvMKw2LkgeMtxlUYejHFFvAxzc88Hz3BUkehYTMF9XwqNPc97c7J0hNP2q/v5q/vPOaxfbTQectZepVhmqw3pY3lwKBgFYRaPjiJB2pdxydZCimxWTCHilte9xLkkDF4AD7dW6K205gXXJ0eYMpX/bFSap7dZuopMuFQihI0v+ftu/c6RNYCI3vikITzNiumxHRjv9t56wpbOvNj8akwPteU2XS5C+z0bfkX7u1/nLEIIhqOHjkzMsMlmKTrPMXdl9E4EzvAoGBAKcX7Zm40yjrqXs51FcleAbqHsKNawvPjMRz5sMJixVcvBQcJISgi50UsAxNEnHA6lYr6hgew63TotMgyN9b+WVZffvOuKKC2vPN/nk6SLYMAsHmXuBEnKzcOMqfQK2dStSC65nO2AiU6qsetpbuwUUqz3/lDNCLQ49NfhuCzwdg" ],
+        "keyUse" : [ "ENC" ],
+        "certificate" : [ "MIICmzCCAYMCBgGQgSEG9jANBgkqhkiG9w0BAQsFADARMQ8wDQYDVQQDDAZtYXN0ZXIwHhcNMjQwNzA1MDQyMDQzWhcNMzQwNzA1MDQyMjIzWjARMQ8wDQYDVQQDDAZtYXN0ZXIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDV7TM6dLp0c+CiD3E5Yk1hLOF1k7HJ4zA44PINETSjqDljuY+7lJrPHR66WhuI4CUMkY9VddPY0HBqNXgjg3biQXLUHeH5zyK2xCy93VppVe8efZcN/WMt0dOZgMjXtDT6Bk14mmtc3aGoXHOL1UGu3aUDww8br32iEhDUQC4jhwCSzJn/FlVujGJ8qSa/KF5/RH/uDslwLJMZ59inSUKbu/KsP72YzJpI56cwu14ozKEl7iMiJjZgjlowumUJLjGhuivVBTiOBcKZyKEi/gle58y82Nn3rFpICJopx2sjksYC8J9VoFUhZOu+ukPlaBSI5MUwo/owqOkk5v1WBqllAgMBAAEwDQYJKoZIhvcNAQELBQADggEBALZ2BA3toF/o0AxdB9xLpUs67z2apiV8M+8Sw5HqcC5nHe24BVE7PGOWKxEOKfBn3wz1fXwih6O3PUWyJHWYQM5KpZdKzTWcT1RZYLczd70JRuUFcdfCSB1onFwdPikSJ0ZjUX16706pWiSQ0zp9XT44Y+fcO75KWxdb1C6SnFj9C4mJGjOB4Teli6jnAFzXjcyBRTLlWdYFgLCqVHUodVWEjkISv5Cc7IrW/VmB3zhF9KOLPTTOcCBxuk8uPe7tWkEVhQw+YkACWC/+S7sanEtZf5pxn2GM51u5F4+Ymq7JhQBpHWyDMm0BOfSqdZxesWoqX26A2BKJXSlLlmE2kRk=" ],
+        "priority" : [ "100" ],
+        "algorithm" : [ "RSA-OAEP" ]
+      }
+    }, {
+      "id" : "e5828056-d919-4c2e-be45-48c7597ac363",
+      "name" : "hmac-generated-hs512",
+      "providerId" : "hmac-generated",
+      "subComponents" : { },
+      "config" : {
+        "kid" : [ "cbc2c745-4a3b-48a3-9fe8-4c82d8f9b287" ],
+        "secret" : [ "2oHJvguIgxCb3tr7IKDprsX7glPQhkV9U8ZV0ArAcDGZy-0TvgRNaWyJtN9S-gTyBbz2iLidJN3coUHdFLw9WHQtIWeJjeyj1A-Qj9ujoSDRGzvruHjW63o0Le7sea-4iaQiSDjWhhFZj23ifTd1JKK2UR0j-VoAIcjGMXLTEek" ],
+        "priority" : [ "100" ],
+        "algorithm" : [ "HS512" ]
+      }
+    }, {
+      "id" : "64d8f2ba-5e77-4197-8991-534051700b28",
+      "name" : "aes-generated",
+      "providerId" : "aes-generated",
+      "subComponents" : { },
+      "config" : {
+        "kid" : [ "c4ee3d84-44ce-4d72-b28b-360946db5aa5" ],
+        "secret" : [ "Ki0YG6uouEUz31Wnz_-JxQ" ],
+        "priority" : [ "100" ]
+      }
+    } ]
+  },
+  "internationalizationEnabled" : false,
+  "supportedLocales" : [ ],
+  "authenticationFlows" : [ {
+    "id" : "17f38d86-2dbb-49eb-8a55-b4b88ca15260",
+    "alias" : "Account verification options",
+    "description" : "Method with which to verity the existing account",
+    "providerId" : "basic-flow",
+    "topLevel" : false,
+    "builtIn" : true,
+    "authenticationExecutions" : [ {
+      "authenticator" : "idp-email-verification",
+      "authenticatorFlow" : false,
+      "requirement" : "ALTERNATIVE",
+      "priority" : 10,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticatorFlow" : true,
+      "requirement" : "ALTERNATIVE",
+      "priority" : 20,
+      "autheticatorFlow" : true,
+      "flowAlias" : "Verify Existing Account by Re-authentication",
+      "userSetupAllowed" : false
+    } ]
+  }, {
+    "id" : "e510418e-ed31-4838-828a-5538583cb5c5",
+    "alias" : "Browser - Conditional OTP",
+    "description" : "Flow to determine if the OTP is required for the authentication",
+    "providerId" : "basic-flow",
+    "topLevel" : false,
+    "builtIn" : true,
+    "authenticationExecutions" : [ {
+      "authenticator" : "conditional-user-configured",
+      "authenticatorFlow" : false,
+      "requirement" : "REQUIRED",
+      "priority" : 10,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticator" : "auth-otp-form",
+      "authenticatorFlow" : false,
+      "requirement" : "REQUIRED",
+      "priority" : 20,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    } ]
+  }, {
+    "id" : "1aeebed0-6b38-47f9-acb1-995a8885f0ff",
+    "alias" : "Direct Grant - Conditional OTP",
+    "description" : "Flow to determine if the OTP is required for the authentication",
+    "providerId" : "basic-flow",
+    "topLevel" : false,
+    "builtIn" : true,
+    "authenticationExecutions" : [ {
+      "authenticator" : "conditional-user-configured",
+      "authenticatorFlow" : false,
+      "requirement" : "REQUIRED",
+      "priority" : 10,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticator" : "direct-grant-validate-otp",
+      "authenticatorFlow" : false,
+      "requirement" : "REQUIRED",
+      "priority" : 20,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    } ]
+  }, {
+    "id" : "911e013b-95b7-4c0d-bb96-13908a034b5f",
+    "alias" : "First broker login - Conditional OTP",
+    "description" : "Flow to determine if the OTP is required for the authentication",
+    "providerId" : "basic-flow",
+    "topLevel" : false,
+    "builtIn" : true,
+    "authenticationExecutions" : [ {
+      "authenticator" : "conditional-user-configured",
+      "authenticatorFlow" : false,
+      "requirement" : "REQUIRED",
+      "priority" : 10,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticator" : "auth-otp-form",
+      "authenticatorFlow" : false,
+      "requirement" : "REQUIRED",
+      "priority" : 20,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    } ]
+  }, {
+    "id" : "56776910-0b46-4503-8eb8-388c9e300c3d",
+    "alias" : "Handle Existing Account",
+    "description" : "Handle what to do if there is existing account with same email/username like authenticated identity provider",
+    "providerId" : "basic-flow",
+    "topLevel" : false,
+    "builtIn" : true,
+    "authenticationExecutions" : [ {
+      "authenticator" : "idp-confirm-link",
+      "authenticatorFlow" : false,
+      "requirement" : "REQUIRED",
+      "priority" : 10,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticatorFlow" : true,
+      "requirement" : "REQUIRED",
+      "priority" : 20,
+      "autheticatorFlow" : true,
+      "flowAlias" : "Account verification options",
+      "userSetupAllowed" : false
+    } ]
+  }, {
+    "id" : "5764649a-0ec1-483c-8fe0-fe85fa9d2650",
+    "alias" : "Reset - Conditional OTP",
+    "description" : "Flow to determine if the OTP should be reset or not. Set to REQUIRED to force.",
+    "providerId" : "basic-flow",
+    "topLevel" : false,
+    "builtIn" : true,
+    "authenticationExecutions" : [ {
+      "authenticator" : "conditional-user-configured",
+      "authenticatorFlow" : false,
+      "requirement" : "REQUIRED",
+      "priority" : 10,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticator" : "reset-otp",
+      "authenticatorFlow" : false,
+      "requirement" : "REQUIRED",
+      "priority" : 20,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    } ]
+  }, {
+    "id" : "b4353d0f-73e6-4f9a-a3d6-529845bbe182",
+    "alias" : "User creation or linking",
+    "description" : "Flow for the existing/non-existing user alternatives",
+    "providerId" : "basic-flow",
+    "topLevel" : false,
+    "builtIn" : true,
+    "authenticationExecutions" : [ {
+      "authenticatorConfig" : "create unique user config",
+      "authenticator" : "idp-create-user-if-unique",
+      "authenticatorFlow" : false,
+      "requirement" : "ALTERNATIVE",
+      "priority" : 10,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticatorFlow" : true,
+      "requirement" : "ALTERNATIVE",
+      "priority" : 20,
+      "autheticatorFlow" : true,
+      "flowAlias" : "Handle Existing Account",
+      "userSetupAllowed" : false
+    } ]
+  }, {
+    "id" : "f7f7290c-a5c7-4554-b5eb-020182a9a4f6",
+    "alias" : "Verify Existing Account by Re-authentication",
+    "description" : "Reauthentication of existing account",
+    "providerId" : "basic-flow",
+    "topLevel" : false,
+    "builtIn" : true,
+    "authenticationExecutions" : [ {
+      "authenticator" : "idp-username-password-form",
+      "authenticatorFlow" : false,
+      "requirement" : "REQUIRED",
+      "priority" : 10,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticatorFlow" : true,
+      "requirement" : "CONDITIONAL",
+      "priority" : 20,
+      "autheticatorFlow" : true,
+      "flowAlias" : "First broker login - Conditional OTP",
+      "userSetupAllowed" : false
+    } ]
+  }, {
+    "id" : "4e810336-f746-4651-a0f7-a13fd4a2822e",
+    "alias" : "browser",
+    "description" : "browser based authentication",
+    "providerId" : "basic-flow",
+    "topLevel" : true,
+    "builtIn" : true,
+    "authenticationExecutions" : [ {
+      "authenticator" : "auth-cookie",
+      "authenticatorFlow" : false,
+      "requirement" : "ALTERNATIVE",
+      "priority" : 10,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticator" : "auth-spnego",
+      "authenticatorFlow" : false,
+      "requirement" : "DISABLED",
+      "priority" : 20,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticator" : "identity-provider-redirector",
+      "authenticatorFlow" : false,
+      "requirement" : "ALTERNATIVE",
+      "priority" : 25,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticatorFlow" : true,
+      "requirement" : "ALTERNATIVE",
+      "priority" : 30,
+      "autheticatorFlow" : true,
+      "flowAlias" : "forms",
+      "userSetupAllowed" : false
+    } ]
+  }, {
+    "id" : "7470a006-baf2-4b93-a78d-3fb8b9f2a779",
+    "alias" : "clients",
+    "description" : "Base authentication for clients",
+    "providerId" : "client-flow",
+    "topLevel" : true,
+    "builtIn" : true,
+    "authenticationExecutions" : [ {
+      "authenticator" : "client-secret",
+      "authenticatorFlow" : false,
+      "requirement" : "ALTERNATIVE",
+      "priority" : 10,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticator" : "client-jwt",
+      "authenticatorFlow" : false,
+      "requirement" : "ALTERNATIVE",
+      "priority" : 20,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticator" : "client-secret-jwt",
+      "authenticatorFlow" : false,
+      "requirement" : "ALTERNATIVE",
+      "priority" : 30,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticator" : "client-x509",
+      "authenticatorFlow" : false,
+      "requirement" : "ALTERNATIVE",
+      "priority" : 40,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    } ]
+  }, {
+    "id" : "7218baf3-65f0-469a-80ee-8a136e848842",
+    "alias" : "direct grant",
+    "description" : "OpenID Connect Resource Owner Grant",
+    "providerId" : "basic-flow",
+    "topLevel" : true,
+    "builtIn" : true,
+    "authenticationExecutions" : [ {
+      "authenticator" : "direct-grant-validate-username",
+      "authenticatorFlow" : false,
+      "requirement" : "REQUIRED",
+      "priority" : 10,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticator" : "direct-grant-validate-password",
+      "authenticatorFlow" : false,
+      "requirement" : "REQUIRED",
+      "priority" : 20,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticatorFlow" : true,
+      "requirement" : "CONDITIONAL",
+      "priority" : 30,
+      "autheticatorFlow" : true,
+      "flowAlias" : "Direct Grant - Conditional OTP",
+      "userSetupAllowed" : false
+    } ]
+  }, {
+    "id" : "1b397913-0652-422a-a3c0-744b63819769",
+    "alias" : "docker auth",
+    "description" : "Used by Docker clients to authenticate against the IDP",
+    "providerId" : "basic-flow",
+    "topLevel" : true,
+    "builtIn" : true,
+    "authenticationExecutions" : [ {
+      "authenticator" : "docker-http-basic-authenticator",
+      "authenticatorFlow" : false,
+      "requirement" : "REQUIRED",
+      "priority" : 10,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    } ]
+  }, {
+    "id" : "6628afd8-61a7-4aae-a7cb-750394236d01",
+    "alias" : "first broker login",
+    "description" : "Actions taken after first broker login with identity provider account, which is not yet linked to any Keycloak account",
+    "providerId" : "basic-flow",
+    "topLevel" : true,
+    "builtIn" : true,
+    "authenticationExecutions" : [ {
+      "authenticatorConfig" : "review profile config",
+      "authenticator" : "idp-review-profile",
+      "authenticatorFlow" : false,
+      "requirement" : "REQUIRED",
+      "priority" : 10,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticatorFlow" : true,
+      "requirement" : "REQUIRED",
+      "priority" : 20,
+      "autheticatorFlow" : true,
+      "flowAlias" : "User creation or linking",
+      "userSetupAllowed" : false
+    } ]
+  }, {
+    "id" : "f6cc90e9-ed55-4fc4-bdf6-79d82c79721b",
+    "alias" : "forms",
+    "description" : "Username, password, otp and other auth forms.",
+    "providerId" : "basic-flow",
+    "topLevel" : false,
+    "builtIn" : true,
+    "authenticationExecutions" : [ {
+      "authenticator" : "auth-username-password-form",
+      "authenticatorFlow" : false,
+      "requirement" : "REQUIRED",
+      "priority" : 10,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticatorFlow" : true,
+      "requirement" : "CONDITIONAL",
+      "priority" : 20,
+      "autheticatorFlow" : true,
+      "flowAlias" : "Browser - Conditional OTP",
+      "userSetupAllowed" : false
+    } ]
+  }, {
+    "id" : "1b0d5812-94b8-4965-a6ea-37399494c385",
+    "alias" : "registration",
+    "description" : "registration flow",
+    "providerId" : "basic-flow",
+    "topLevel" : true,
+    "builtIn" : true,
+    "authenticationExecutions" : [ {
+      "authenticator" : "registration-page-form",
+      "authenticatorFlow" : true,
+      "requirement" : "REQUIRED",
+      "priority" : 10,
+      "autheticatorFlow" : true,
+      "flowAlias" : "registration form",
+      "userSetupAllowed" : false
+    } ]
+  }, {
+    "id" : "eac58525-7d5d-437b-bd92-d2bf0fd7dfd7",
+    "alias" : "registration form",
+    "description" : "registration form",
+    "providerId" : "form-flow",
+    "topLevel" : false,
+    "builtIn" : true,
+    "authenticationExecutions" : [ {
+      "authenticator" : "registration-user-creation",
+      "authenticatorFlow" : false,
+      "requirement" : "REQUIRED",
+      "priority" : 20,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticator" : "registration-password-action",
+      "authenticatorFlow" : false,
+      "requirement" : "REQUIRED",
+      "priority" : 50,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticator" : "registration-recaptcha-action",
+      "authenticatorFlow" : false,
+      "requirement" : "DISABLED",
+      "priority" : 60,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticator" : "registration-terms-and-conditions",
+      "authenticatorFlow" : false,
+      "requirement" : "DISABLED",
+      "priority" : 70,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    } ]
+  }, {
+    "id" : "96f8470d-fc7e-4418-a2c1-cd8580779307",
+    "alias" : "reset credentials",
+    "description" : "Reset credentials for a user if they forgot their password or something",
+    "providerId" : "basic-flow",
+    "topLevel" : true,
+    "builtIn" : true,
+    "authenticationExecutions" : [ {
+      "authenticator" : "reset-credentials-choose-user",
+      "authenticatorFlow" : false,
+      "requirement" : "REQUIRED",
+      "priority" : 10,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticator" : "reset-credential-email",
+      "authenticatorFlow" : false,
+      "requirement" : "REQUIRED",
+      "priority" : 20,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticator" : "reset-password",
+      "authenticatorFlow" : false,
+      "requirement" : "REQUIRED",
+      "priority" : 30,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticatorFlow" : true,
+      "requirement" : "CONDITIONAL",
+      "priority" : 40,
+      "autheticatorFlow" : true,
+      "flowAlias" : "Reset - Conditional OTP",
+      "userSetupAllowed" : false
+    } ]
+  }, {
+    "id" : "3166215e-d1e2-4e41-8e62-8f0054b5eabb",
+    "alias" : "saml ecp",
+    "description" : "SAML ECP Profile Authentication Flow",
+    "providerId" : "basic-flow",
+    "topLevel" : true,
+    "builtIn" : true,
+    "authenticationExecutions" : [ {
+      "authenticator" : "http-basic-authenticator",
+      "authenticatorFlow" : false,
+      "requirement" : "REQUIRED",
+      "priority" : 10,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    } ]
+  } ],
+  "authenticatorConfig" : [ {
+    "id" : "b91d0414-5e77-481f-8600-a1da261f5bef",
+    "alias" : "create unique user config",
+    "config" : {
+      "require.password.update.after.registration" : "false"
+    }
+  }, {
+    "id" : "0200f9d4-1093-4f67-bef5-1f503f09c3cd",
+    "alias" : "review profile config",
+    "config" : {
+      "update.profile.on.first.login" : "missing"
+    }
+  } ],
+  "requiredActions" : [ {
+    "alias" : "CONFIGURE_TOTP",
+    "name" : "Configure OTP",
+    "providerId" : "CONFIGURE_TOTP",
+    "enabled" : true,
+    "defaultAction" : false,
+    "priority" : 10,
+    "config" : { }
+  }, {
+    "alias" : "TERMS_AND_CONDITIONS",
+    "name" : "Terms and Conditions",
+    "providerId" : "TERMS_AND_CONDITIONS",
+    "enabled" : false,
+    "defaultAction" : false,
+    "priority" : 20,
+    "config" : { }
+  }, {
+    "alias" : "UPDATE_PASSWORD",
+    "name" : "Update Password",
+    "providerId" : "UPDATE_PASSWORD",
+    "enabled" : true,
+    "defaultAction" : false,
+    "priority" : 30,
+    "config" : { }
+  }, {
+    "alias" : "UPDATE_PROFILE",
+    "name" : "Update Profile",
+    "providerId" : "UPDATE_PROFILE",
+    "enabled" : true,
+    "defaultAction" : false,
+    "priority" : 40,
+    "config" : { }
+  }, {
+    "alias" : "VERIFY_EMAIL",
+    "name" : "Verify Email",
+    "providerId" : "VERIFY_EMAIL",
+    "enabled" : true,
+    "defaultAction" : false,
+    "priority" : 50,
+    "config" : { }
+  }, {
+    "alias" : "delete_account",
+    "name" : "Delete Account",
+    "providerId" : "delete_account",
+    "enabled" : false,
+    "defaultAction" : false,
+    "priority" : 60,
+    "config" : { }
+  }, {
+    "alias" : "webauthn-register",
+    "name" : "Webauthn Register",
+    "providerId" : "webauthn-register",
+    "enabled" : true,
+    "defaultAction" : false,
+    "priority" : 70,
+    "config" : { }
+  }, {
+    "alias" : "webauthn-register-passwordless",
+    "name" : "Webauthn Register Passwordless",
+    "providerId" : "webauthn-register-passwordless",
+    "enabled" : true,
+    "defaultAction" : false,
+    "priority" : 80,
+    "config" : { }
+  }, {
+    "alias" : "VERIFY_PROFILE",
+    "name" : "Verify Profile",
+    "providerId" : "VERIFY_PROFILE",
+    "enabled" : true,
+    "defaultAction" : false,
+    "priority" : 90,
+    "config" : { }
+  }, {
+    "alias" : "delete_credential",
+    "name" : "Delete Credential",
+    "providerId" : "delete_credential",
+    "enabled" : true,
+    "defaultAction" : false,
+    "priority" : 100,
+    "config" : { }
+  }, {
+    "alias" : "update_user_locale",
+    "name" : "Update User Locale",
+    "providerId" : "update_user_locale",
+    "enabled" : true,
+    "defaultAction" : false,
+    "priority" : 1000,
+    "config" : { }
+  } ],
+  "browserFlow" : "browser",
+  "registrationFlow" : "registration",
+  "directGrantFlow" : "direct grant",
+  "resetCredentialsFlow" : "reset credentials",
+  "clientAuthenticationFlow" : "clients",
+  "dockerAuthenticationFlow" : "docker auth",
+  "firstBrokerLoginFlow" : "first broker login",
+  "attributes" : {
+    "cibaBackchannelTokenDeliveryMode" : "poll",
+    "cibaExpiresIn" : "120",
+    "cibaAuthRequestedUserHint" : "login_hint",
+    "parRequestUriLifespan" : "60",
+    "cibaInterval" : "5",
+    "realmReusableOtpCode" : "false"
+  },
+  "keycloakVersion" : "24.0.3",
+  "userManagedAccessAllowed" : false,
+  "clientProfiles" : {
+    "profiles" : [ ]
+  },
+  "clientPolicies" : {
+    "policies" : [ ]
+  }
+} ]
\ No newline at end of file
diff --git a/docker/config/realm-export-pitc.json b/docker/config/realm-export-pitc.json
new file mode 100644
index 0000000000..7d7fe7dae2
--- /dev/null
+++ b/docker/config/realm-export-pitc.json
@@ -0,0 +1,4131 @@
+[ {
+  "id" : "43b9ddfb-26f5-49a8-852b-0e4f447f4a0b",
+  "realm" : "pitc",
+  "displayName" : "",
+  "displayNameHtml" : "",
+  "notBefore" : 0,
+  "defaultSignatureAlgorithm" : "RS256",
+  "revokeRefreshToken" : false,
+  "refreshTokenMaxReuse" : 0,
+  "accessTokenLifespan" : 300,
+  "accessTokenLifespanForImplicitFlow" : 900,
+  "ssoSessionIdleTimeout" : 1800,
+  "ssoSessionMaxLifespan" : 36000,
+  "ssoSessionIdleTimeoutRememberMe" : 0,
+  "ssoSessionMaxLifespanRememberMe" : 0,
+  "offlineSessionIdleTimeout" : 2592000,
+  "offlineSessionMaxLifespanEnabled" : false,
+  "offlineSessionMaxLifespan" : 5184000,
+  "clientSessionIdleTimeout" : 0,
+  "clientSessionMaxLifespan" : 0,
+  "clientOfflineSessionIdleTimeout" : 0,
+  "clientOfflineSessionMaxLifespan" : 0,
+  "accessCodeLifespan" : 60,
+  "accessCodeLifespanUserAction" : 300,
+  "accessCodeLifespanLogin" : 1800,
+  "actionTokenGeneratedByAdminLifespan" : 43200,
+  "actionTokenGeneratedByUserLifespan" : 300,
+  "oauth2DeviceCodeLifespan" : 600,
+  "oauth2DevicePollingInterval" : 5,
+  "enabled" : true,
+  "sslRequired" : "external",
+  "registrationAllowed" : false,
+  "registrationEmailAsUsername" : false,
+  "rememberMe" : false,
+  "verifyEmail" : false,
+  "loginWithEmailAllowed" : true,
+  "duplicateEmailsAllowed" : false,
+  "resetPasswordAllowed" : false,
+  "editUsernameAllowed" : false,
+  "bruteForceProtected" : false,
+  "permanentLockout" : false,
+  "maxTemporaryLockouts" : 0,
+  "maxFailureWaitSeconds" : 900,
+  "minimumQuickLoginWaitSeconds" : 60,
+  "waitIncrementSeconds" : 60,
+  "quickLoginCheckMilliSeconds" : 1000,
+  "maxDeltaTimeSeconds" : 43200,
+  "failureFactor" : 30,
+  "roles" : {
+    "realm" : [ {
+      "id" : "758171cd-58e2-43b6-bd0e-9afb7c2ca2f9",
+      "name" : "org_pl",
+      "description" : "",
+      "composite" : false,
+      "clientRole" : false,
+      "containerId" : "43b9ddfb-26f5-49a8-852b-0e4f447f4a0b",
+      "attributes" : { }
+    }, {
+      "id" : "2717bcd3-3627-460b-b861-571ad8eee0e5",
+      "name" : "offline_access",
+      "description" : "${role_offline-access}",
+      "composite" : false,
+      "clientRole" : false,
+      "containerId" : "43b9ddfb-26f5-49a8-852b-0e4f447f4a0b",
+      "attributes" : { }
+    }, {
+      "id" : "2b173cac-d60e-49e5-be20-454e79199c57",
+      "name" : "org_midcicd",
+      "description" : "",
+      "composite" : false,
+      "clientRole" : false,
+      "containerId" : "43b9ddfb-26f5-49a8-852b-0e4f447f4a0b",
+      "attributes" : { }
+    }, {
+      "id" : "d03eeb03-ad4d-4ce2-acd2-113f169669b7",
+      "name" : "org_personal",
+      "description" : "",
+      "composite" : false,
+      "clientRole" : false,
+      "containerId" : "43b9ddfb-26f5-49a8-852b-0e4f447f4a0b",
+      "attributes" : { }
+    }, {
+      "id" : "f57969cb-5493-4a32-84d4-2d80e708f4fc",
+      "name" : "org_gl",
+      "description" : "",
+      "composite" : false,
+      "clientRole" : false,
+      "containerId" : "43b9ddfb-26f5-49a8-852b-0e4f447f4a0b",
+      "attributes" : { }
+    }, {
+      "id" : "3901aadc-7c91-4568-9e2a-b32934893505",
+      "name" : "org_mobility",
+      "description" : "",
+      "composite" : false,
+      "clientRole" : false,
+      "containerId" : "43b9ddfb-26f5-49a8-852b-0e4f447f4a0b",
+      "attributes" : { }
+    }, {
+      "id" : "e48beabd-4526-4d3d-8958-b45ab2437b9f",
+      "name" : "org_de",
+      "description" : "",
+      "composite" : false,
+      "clientRole" : false,
+      "containerId" : "43b9ddfb-26f5-49a8-852b-0e4f447f4a0b",
+      "attributes" : { }
+    }, {
+      "id" : "db421806-c825-4810-93ac-79b63865c7f2",
+      "name" : "org_devruby",
+      "description" : "",
+      "composite" : false,
+      "clientRole" : false,
+      "containerId" : "43b9ddfb-26f5-49a8-852b-0e4f447f4a0b",
+      "attributes" : { }
+    }, {
+      "id" : "fd4def8e-01d9-488a-bcb8-209914b4601f",
+      "name" : "org_racoon",
+      "description" : "",
+      "composite" : false,
+      "clientRole" : false,
+      "containerId" : "43b9ddfb-26f5-49a8-852b-0e4f447f4a0b",
+      "attributes" : { }
+    }, {
+      "id" : "d6210295-f6f2-4692-b17b-783079135546",
+      "name" : "org_sys",
+      "description" : "",
+      "composite" : false,
+      "clientRole" : false,
+      "containerId" : "43b9ddfb-26f5-49a8-852b-0e4f447f4a0b",
+      "attributes" : { }
+    }, {
+      "id" : "9ceb6dbb-475f-467a-a126-ad70171f861a",
+      "name" : "org_midcontainer",
+      "description" : "",
+      "composite" : false,
+      "clientRole" : false,
+      "containerId" : "43b9ddfb-26f5-49a8-852b-0e4f447f4a0b",
+      "attributes" : { }
+    }, {
+      "id" : "9c802ad9-a0dd-42fd-873d-56335bbe941e",
+      "name" : "org_bl",
+      "description" : "",
+      "composite" : false,
+      "clientRole" : false,
+      "containerId" : "43b9ddfb-26f5-49a8-852b-0e4f447f4a0b",
+      "attributes" : { }
+    }, {
+      "id" : "9f248491-cbde-4bb0-9c8a-9568a5dbefef",
+      "name" : "default-roles-pitc_okr_staging",
+      "description" : "${role_default-roles}",
+      "composite" : true,
+      "composites" : {
+        "realm" : [ "offline_access", "uma_authorization" ],
+        "client" : {
+          "account" : [ "view-profile", "manage-account" ]
+        }
+      },
+      "clientRole" : false,
+      "containerId" : "43b9ddfb-26f5-49a8-852b-0e4f447f4a0b",
+      "attributes" : { }
+    }, {
+      "id" : "4f6337f3-71af-41f1-9917-dfa355bd71c4",
+      "name" : "org_security",
+      "description" : "",
+      "composite" : false,
+      "clientRole" : false,
+      "containerId" : "43b9ddfb-26f5-49a8-852b-0e4f447f4a0b",
+      "attributes" : { }
+    }, {
+      "id" : "0add4da2-883a-412a-8b79-bdd6eef545a6",
+      "name" : "org_devtre",
+      "description" : "",
+      "composite" : false,
+      "clientRole" : false,
+      "containerId" : "43b9ddfb-26f5-49a8-852b-0e4f447f4a0b",
+      "attributes" : { }
+    }, {
+      "id" : "a78755f9-37b1-4cb8-8155-31d0572c1c42",
+      "name" : "org_zh",
+      "description" : "",
+      "composite" : false,
+      "clientRole" : false,
+      "containerId" : "43b9ddfb-26f5-49a8-852b-0e4f447f4a0b",
+      "attributes" : { }
+    }, {
+      "id" : "f65332f6-e9bb-4e0f-a09f-8270b0c0be56",
+      "name" : "org_azubi",
+      "description" : "",
+      "composite" : false,
+      "clientRole" : false,
+      "containerId" : "43b9ddfb-26f5-49a8-852b-0e4f447f4a0b",
+      "attributes" : { }
+    }, {
+      "id" : "5a108868-05e6-4630-b742-492115fc75a4",
+      "name" : "org_ux",
+      "description" : "",
+      "composite" : false,
+      "clientRole" : false,
+      "containerId" : "43b9ddfb-26f5-49a8-852b-0e4f447f4a0b",
+      "attributes" : { }
+    }, {
+      "id" : "15857402-0e96-462e-adf6-1d9c70b258b1",
+      "name" : "uma_authorization",
+      "description" : "${role_uma_authorization}",
+      "composite" : false,
+      "clientRole" : false,
+      "containerId" : "43b9ddfb-26f5-49a8-852b-0e4f447f4a0b",
+      "attributes" : { }
+    } ],
+    "client" : {
+      "realm-management" : [ {
+        "id" : "75eecef4-3714-4de8-acfa-aa76525b95d3",
+        "name" : "view-authorization",
+        "description" : "${role_view-authorization}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "f5757601-9812-4aec-8585-f91b79eb3c6e",
+        "attributes" : { }
+      }, {
+        "id" : "fe725fba-bbbf-476a-a3f3-7a59452212a2",
+        "name" : "manage-realm",
+        "description" : "${role_manage-realm}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "f5757601-9812-4aec-8585-f91b79eb3c6e",
+        "attributes" : { }
+      }, {
+        "id" : "18ecca0b-05b4-45ca-9e1b-ea1bba244f39",
+        "name" : "view-clients",
+        "description" : "${role_view-clients}",
+        "composite" : true,
+        "composites" : {
+          "client" : {
+            "realm-management" : [ "query-clients" ]
+          }
+        },
+        "clientRole" : true,
+        "containerId" : "f5757601-9812-4aec-8585-f91b79eb3c6e",
+        "attributes" : { }
+      }, {
+        "id" : "90cae136-5144-47c0-a540-17eec780e795",
+        "name" : "manage-users",
+        "description" : "${role_manage-users}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "f5757601-9812-4aec-8585-f91b79eb3c6e",
+        "attributes" : { }
+      }, {
+        "id" : "df140639-114b-4f92-b1cb-aeefea5b078b",
+        "name" : "create-client",
+        "description" : "${role_create-client}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "f5757601-9812-4aec-8585-f91b79eb3c6e",
+        "attributes" : { }
+      }, {
+        "id" : "cddeda6b-e03a-413b-b78b-6379c21b1d7f",
+        "name" : "query-clients",
+        "description" : "${role_query-clients}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "f5757601-9812-4aec-8585-f91b79eb3c6e",
+        "attributes" : { }
+      }, {
+        "id" : "7a056ff2-3b4b-4386-9333-8ad7c52e36b5",
+        "name" : "query-groups",
+        "description" : "${role_query-groups}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "f5757601-9812-4aec-8585-f91b79eb3c6e",
+        "attributes" : { }
+      }, {
+        "id" : "01f03112-3ee3-4fd6-b8d1-458ea59ef39a",
+        "name" : "realm-admin",
+        "description" : "${role_realm-admin}",
+        "composite" : true,
+        "composites" : {
+          "client" : {
+            "realm-management" : [ "view-authorization", "view-clients", "manage-realm", "manage-users", "query-groups", "query-clients", "create-client", "manage-clients", "query-realms", "manage-authorization", "view-identity-providers", "view-users", "manage-identity-providers", "manage-events", "impersonation", "view-events", "view-realm", "query-users" ]
+          }
+        },
+        "clientRole" : true,
+        "containerId" : "f5757601-9812-4aec-8585-f91b79eb3c6e",
+        "attributes" : { }
+      }, {
+        "id" : "c74331e3-3834-4700-be56-c8eedcf2df98",
+        "name" : "manage-clients",
+        "description" : "${role_manage-clients}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "f5757601-9812-4aec-8585-f91b79eb3c6e",
+        "attributes" : { }
+      }, {
+        "id" : "84a5f824-160d-4d33-bf11-a855e6cde237",
+        "name" : "query-realms",
+        "description" : "${role_query-realms}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "f5757601-9812-4aec-8585-f91b79eb3c6e",
+        "attributes" : { }
+      }, {
+        "id" : "732214ee-0d66-4f35-8bff-3585aeb0de35",
+        "name" : "manage-authorization",
+        "description" : "${role_manage-authorization}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "f5757601-9812-4aec-8585-f91b79eb3c6e",
+        "attributes" : { }
+      }, {
+        "id" : "191d604c-926d-456c-be2a-59d0fca2ad6a",
+        "name" : "view-identity-providers",
+        "description" : "${role_view-identity-providers}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "f5757601-9812-4aec-8585-f91b79eb3c6e",
+        "attributes" : { }
+      }, {
+        "id" : "ca0a5e14-4ade-4e3f-9208-da612db93ac7",
+        "name" : "view-users",
+        "description" : "${role_view-users}",
+        "composite" : true,
+        "composites" : {
+          "client" : {
+            "realm-management" : [ "query-groups", "query-users" ]
+          }
+        },
+        "clientRole" : true,
+        "containerId" : "f5757601-9812-4aec-8585-f91b79eb3c6e",
+        "attributes" : { }
+      }, {
+        "id" : "ae8096f8-3ffb-49dd-80c6-029421271e83",
+        "name" : "manage-identity-providers",
+        "description" : "${role_manage-identity-providers}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "f5757601-9812-4aec-8585-f91b79eb3c6e",
+        "attributes" : { }
+      }, {
+        "id" : "d54c9636-6847-4d05-a60e-0481ce199d9c",
+        "name" : "manage-events",
+        "description" : "${role_manage-events}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "f5757601-9812-4aec-8585-f91b79eb3c6e",
+        "attributes" : { }
+      }, {
+        "id" : "e0bc7c6c-dacd-4133-abdb-df60c0c3e51b",
+        "name" : "impersonation",
+        "description" : "${role_impersonation}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "f5757601-9812-4aec-8585-f91b79eb3c6e",
+        "attributes" : { }
+      }, {
+        "id" : "9f41add7-9ebd-49d2-aa63-a5d5755c3bc3",
+        "name" : "view-events",
+        "description" : "${role_view-events}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "f5757601-9812-4aec-8585-f91b79eb3c6e",
+        "attributes" : { }
+      }, {
+        "id" : "51efcc02-7301-4652-8df4-6d6c67b1157a",
+        "name" : "view-realm",
+        "description" : "${role_view-realm}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "f5757601-9812-4aec-8585-f91b79eb3c6e",
+        "attributes" : { }
+      }, {
+        "id" : "45c050fe-1214-4dc0-b805-33946ab7e0b4",
+        "name" : "query-users",
+        "description" : "${role_query-users}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "f5757601-9812-4aec-8585-f91b79eb3c6e",
+        "attributes" : { }
+      } ],
+      "security-admin-console" : [ ],
+      "admin-cli" : [ ],
+      "pitc_okr_staging" : [ ],
+      "account-console" : [ ],
+      "broker" : [ {
+        "id" : "ede9fd28-4126-4111-bf9b-acce73510196",
+        "name" : "read-token",
+        "description" : "${role_read-token}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "25604a69-806e-4351-84ce-cc288e714d9c",
+        "attributes" : { }
+      } ],
+      "account" : [ {
+        "id" : "8f26d992-4082-4cd5-962f-a2e5c43f76a1",
+        "name" : "delete-account",
+        "description" : "${role_delete-account}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "d21323ce-46e9-4a10-ba1a-c58c8f1e088c",
+        "attributes" : { }
+      }, {
+        "id" : "7240905a-8cb9-4774-8718-30685e753c4e",
+        "name" : "view-profile",
+        "description" : "${role_view-profile}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "d21323ce-46e9-4a10-ba1a-c58c8f1e088c",
+        "attributes" : { }
+      }, {
+        "id" : "c73ec80b-a72a-4174-a5b6-e14cefd9245d",
+        "name" : "manage-account-links",
+        "description" : "${role_manage-account-links}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "d21323ce-46e9-4a10-ba1a-c58c8f1e088c",
+        "attributes" : { }
+      }, {
+        "id" : "d281db86-b681-4013-8f64-ce1291194f8d",
+        "name" : "view-consent",
+        "description" : "${role_view-consent}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "d21323ce-46e9-4a10-ba1a-c58c8f1e088c",
+        "attributes" : { }
+      }, {
+        "id" : "f1096785-b647-4954-9bb9-b9a9d743084a",
+        "name" : "view-groups",
+        "description" : "${role_view-groups}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "d21323ce-46e9-4a10-ba1a-c58c8f1e088c",
+        "attributes" : { }
+      }, {
+        "id" : "f91e2006-e8fa-408e-9c05-07d44d9259ce",
+        "name" : "view-applications",
+        "description" : "${role_view-applications}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "d21323ce-46e9-4a10-ba1a-c58c8f1e088c",
+        "attributes" : { }
+      }, {
+        "id" : "d65ebb97-5679-4595-a8e6-ca959035fa04",
+        "name" : "manage-account",
+        "description" : "${role_manage-account}",
+        "composite" : true,
+        "composites" : {
+          "client" : {
+            "account" : [ "manage-account-links" ]
+          }
+        },
+        "clientRole" : true,
+        "containerId" : "d21323ce-46e9-4a10-ba1a-c58c8f1e088c",
+        "attributes" : { }
+      }, {
+        "id" : "a4ef81f0-2907-4c09-9bff-df774b0cda1f",
+        "name" : "manage-consent",
+        "description" : "${role_manage-consent}",
+        "composite" : true,
+        "composites" : {
+          "client" : {
+            "account" : [ "view-consent" ]
+          }
+        },
+        "clientRole" : true,
+        "containerId" : "d21323ce-46e9-4a10-ba1a-c58c8f1e088c",
+        "attributes" : { }
+      } ]
+    }
+  },
+  "groups" : [ ],
+  "defaultRole" : {
+    "id" : "9f248491-cbde-4bb0-9c8a-9568a5dbefef",
+    "name" : "default-roles-pitc_okr_staging",
+    "description" : "${role_default-roles}",
+    "composite" : true,
+    "clientRole" : false,
+    "containerId" : "43b9ddfb-26f5-49a8-852b-0e4f447f4a0b"
+  },
+  "requiredCredentials" : [ "password" ],
+  "otpPolicyType" : "totp",
+  "otpPolicyAlgorithm" : "HmacSHA1",
+  "otpPolicyInitialCounter" : 0,
+  "otpPolicyDigits" : 6,
+  "otpPolicyLookAheadWindow" : 1,
+  "otpPolicyPeriod" : 30,
+  "otpPolicyCodeReusable" : false,
+  "otpSupportedApplications" : [ "totpAppFreeOTPName", "totpAppGoogleName", "totpAppMicrosoftAuthenticatorName" ],
+  "localizationTexts" : { },
+  "webAuthnPolicyRpEntityName" : "keycloak",
+  "webAuthnPolicySignatureAlgorithms" : [ "ES256" ],
+  "webAuthnPolicyRpId" : "",
+  "webAuthnPolicyAttestationConveyancePreference" : "not specified",
+  "webAuthnPolicyAuthenticatorAttachment" : "not specified",
+  "webAuthnPolicyRequireResidentKey" : "not specified",
+  "webAuthnPolicyUserVerificationRequirement" : "not specified",
+  "webAuthnPolicyCreateTimeout" : 0,
+  "webAuthnPolicyAvoidSameAuthenticatorRegister" : false,
+  "webAuthnPolicyAcceptableAaguids" : [ ],
+  "webAuthnPolicyExtraOrigins" : [ ],
+  "webAuthnPolicyPasswordlessRpEntityName" : "keycloak",
+  "webAuthnPolicyPasswordlessSignatureAlgorithms" : [ "ES256" ],
+  "webAuthnPolicyPasswordlessRpId" : "",
+  "webAuthnPolicyPasswordlessAttestationConveyancePreference" : "not specified",
+  "webAuthnPolicyPasswordlessAuthenticatorAttachment" : "not specified",
+  "webAuthnPolicyPasswordlessRequireResidentKey" : "not specified",
+  "webAuthnPolicyPasswordlessUserVerificationRequirement" : "not specified",
+  "webAuthnPolicyPasswordlessCreateTimeout" : 0,
+  "webAuthnPolicyPasswordlessAvoidSameAuthenticatorRegister" : false,
+  "webAuthnPolicyPasswordlessAcceptableAaguids" : [ ],
+  "webAuthnPolicyPasswordlessExtraOrigins" : [ ],
+  "users" : [ {
+    "id" : "439b3e29-e444-4e56-ac98-91f7bfd5d7e8",
+    "username" : "bbt",
+    "firstName" : "Ashleigh",
+    "lastName" : "Russell",
+    "email" : "bbt@bbt.com",
+    "emailVerified" : true,
+    "createdTimestamp" : 1700823629490,
+    "enabled" : true,
+    "totp" : false,
+    "credentials" : [ {
+      "id" : "af8a2a40-436e-4e03-b885-b744c27bb359",
+      "type" : "password",
+      "createdDate" : 1717041628849,
+      "secretData" : "{\"value\":\"FyvoLufKNTd8d1NETbXaqp/B7EMpQgn/h8ehYGaTWaG2gZMGYkm4ul6jvsYClE+SsS9ybSovlU7QJsn02C9VJQ==\",\"salt\":\"MTWbSZxQ2B09CSeh0QOiAw==\",\"additionalParameters\":{}}",
+      "credentialData" : "{\"hashIterations\":210000,\"algorithm\":\"pbkdf2-sha512\",\"additionalParameters\":{}}"
+    } ],
+    "disableableCredentialTypes" : [ ],
+    "requiredActions" : [ ],
+    "realmRoles" : [ "default-roles-pitc_okr_staging", "org_azubi" ],
+    "notBefore" : 0,
+    "groups" : [ ]
+  }, {
+    "id" : "3c827efc-c9a3-443d-b06a-b1e099321c35",
+    "username" : "bl",
+    "firstName" : "Esha",
+    "lastName" : "Harris",
+    "email" : "bl@bl.com",
+    "emailVerified" : true,
+    "createdTimestamp" : 1700823629490,
+    "enabled" : true,
+    "totp" : false,
+    "credentials" : [ {
+      "id" : "4876577b-8231-4bde-a60e-b4c3837299ff",
+      "type" : "password",
+      "createdDate" : 1717041629242,
+      "secretData" : "{\"value\":\"zS3WnIUTmIwjoEER4DCjNS1sOBhqjbvzPU6z39DpLA7SW0BOU1vG/1zS/EbDpSpedyLfYfB7RkkLBgV5ZPjI9w==\",\"salt\":\"SnDBz5aQ5Pd8BKq24Gj6Xg==\",\"additionalParameters\":{}}",
+      "credentialData" : "{\"hashIterations\":210000,\"algorithm\":\"pbkdf2-sha512\",\"additionalParameters\":{}}"
+    } ],
+    "disableableCredentialTypes" : [ ],
+    "requiredActions" : [ ],
+    "realmRoles" : [ "org_bl", "default-roles-pitc_okr_staging", "org_mobility" ],
+    "notBefore" : 0,
+    "groups" : [ ]
+  }, {
+    "id" : "ab20a831-8bd7-4d2d-93bd-9423dcf7cfdc",
+    "username" : "bl-mid",
+    "firstName" : "BL",
+    "lastName" : "Mid",
+    "email" : "bl@mid.com",
+    "emailVerified" : true,
+    "createdTimestamp" : 1700823629490,
+    "enabled" : true,
+    "totp" : false,
+    "credentials" : [ {
+      "id" : "8135d6d6-a338-4f62-8445-6fa46da2592a",
+      "type" : "password",
+      "createdDate" : 1717041629809,
+      "secretData" : "{\"value\":\"lOTJFduMaDsc41WeL6bLe7PBNvkbGyLgiabt+de2Sp5Mb9uPPVMxJMkgity8m+mx7hEx3ncz8RhOjux5vug/Cg==\",\"salt\":\"WJiRFn3jGZFxUfkzA+pZqg==\",\"additionalParameters\":{}}",
+      "credentialData" : "{\"hashIterations\":210000,\"algorithm\":\"pbkdf2-sha512\",\"additionalParameters\":{}}"
+    } ],
+    "disableableCredentialTypes" : [ ],
+    "requiredActions" : [ ],
+    "realmRoles" : [ "org_midcontainer", "org_bl", "default-roles-pitc_okr_staging", "org_midcicd" ],
+    "notBefore" : 0,
+    "groups" : [ ]
+  }, {
+    "id" : "1e40714b-0202-4657-aaf1-0a39cf03344a",
+    "username" : "bl-mob",
+    "firstName" : "BL",
+    "lastName" : "Mobility",
+    "email" : "bl@mob.com",
+    "emailVerified" : true,
+    "createdTimestamp" : 1700823629490,
+    "enabled" : true,
+    "totp" : false,
+    "credentials" : [ {
+      "id" : "577874c0-796b-4430-ab63-80935b1f2dc4",
+      "type" : "password",
+      "createdDate" : 1717041629623,
+      "secretData" : "{\"value\":\"Eub+cCeK1xjMyvRzVrSr2DCWkOjvnAFHL25Rlu3xlPE4w27jP+pxxBCZsn5ZoxZDM1SVGemSOI9CJV998qgG6A==\",\"salt\":\"/JxAXWHbjpbzbB7tzCUJZg==\",\"additionalParameters\":{}}",
+      "credentialData" : "{\"hashIterations\":210000,\"algorithm\":\"pbkdf2-sha512\",\"additionalParameters\":{}}"
+    } ],
+    "disableableCredentialTypes" : [ ],
+    "requiredActions" : [ ],
+    "realmRoles" : [ "org_bl", "default-roles-pitc_okr_staging", "org_mobility" ],
+    "notBefore" : 0,
+    "groups" : [ ]
+  }, {
+    "id" : "210b3848-4f6e-4606-af10-7bdeca948d24",
+    "username" : "bl-ruby",
+    "firstName" : "BL",
+    "lastName" : "Ruby",
+    "email" : "bl@ruby.com",
+    "emailVerified" : true,
+    "createdTimestamp" : 1700823629490,
+    "enabled" : true,
+    "totp" : false,
+    "credentials" : [ {
+      "id" : "9db224e9-e2c8-4c4e-a9fb-9985e57aa208",
+      "type" : "password",
+      "createdDate" : 1717041629996,
+      "secretData" : "{\"value\":\"XyYn99uz2eQfK3MCD1OOoDphroP0l0o5BUnOiax2/yB8dpkde6Yp3hxY9k4MloabO2W99N9mh5iRfV2mg1xOeA==\",\"salt\":\"EpaxgpHIL3laQDFEz7g62Q==\",\"additionalParameters\":{}}",
+      "credentialData" : "{\"hashIterations\":210000,\"algorithm\":\"pbkdf2-sha512\",\"additionalParameters\":{}}"
+    } ],
+    "disableableCredentialTypes" : [ ],
+    "requiredActions" : [ ],
+    "realmRoles" : [ "org_bl", "default-roles-pitc_okr_staging", "org_devruby" ],
+    "notBefore" : 0,
+    "groups" : [ ]
+  }, {
+    "id" : "ebc8d2ba-84d4-47c5-b56f-1f3d18eeba07",
+    "username" : "bl-sys",
+    "firstName" : "BL",
+    "lastName" : "Sys",
+    "email" : "bl@sys.com",
+    "emailVerified" : true,
+    "createdTimestamp" : 1700823629490,
+    "enabled" : true,
+    "totp" : false,
+    "credentials" : [ {
+      "id" : "5c7e8dc2-1908-46fa-9076-1728d5167fc0",
+      "type" : "password",
+      "createdDate" : 1717041630181,
+      "secretData" : "{\"value\":\"Uk0YZiRWBL6atJv7cf4Oq+XOFt/0au5OC4v+dptWnJxgEyAUq/4BqOrXwZ4o64SYUqnfP3TkmIcXwkMxfy6Thw==\",\"salt\":\"gxywFSuwab9qQdzE3n3ryA==\",\"additionalParameters\":{}}",
+      "credentialData" : "{\"hashIterations\":210000,\"algorithm\":\"pbkdf2-sha512\",\"additionalParameters\":{}}"
+    } ],
+    "disableableCredentialTypes" : [ ],
+    "requiredActions" : [ ],
+    "realmRoles" : [ "org_sys", "org_bl", "default-roles-pitc_okr_staging" ],
+    "notBefore" : 0,
+    "groups" : [ ]
+  }, {
+    "id" : "539bcbce-5766-4f39-9753-63e5b27da86f",
+    "username" : "gl",
+    "firstName" : "Jaya",
+    "lastName" : "Norris",
+    "email" : "gl@gl.com",
+    "emailVerified" : true,
+    "createdTimestamp" : 1700823629490,
+    "enabled" : true,
+    "totp" : false,
+    "credentials" : [ {
+      "id" : "3a44711b-0414-4a3e-bb39-bf94f0843d21",
+      "type" : "password",
+      "createdDate" : 1717041629051,
+      "secretData" : "{\"value\":\"hHOeh0xJMdjgh2vnm0ZvkXCyABwueh+e7kTA3ylnGEwJi2TZ90vB04miFATUpV7lJrDS52KQJYIwKsMpDPO0rA==\",\"salt\":\"8XUPiUGKuARiBGncujGKvQ==\",\"additionalParameters\":{}}",
+      "credentialData" : "{\"hashIterations\":210000,\"algorithm\":\"pbkdf2-sha512\",\"additionalParameters\":{}}"
+    } ],
+    "disableableCredentialTypes" : [ ],
+    "requiredActions" : [ ],
+    "realmRoles" : [ "default-roles-pitc_okr_staging", "org_gl" ],
+    "notBefore" : 0,
+    "groups" : [ ]
+  }, {
+    "id" : "7858352a-601c-4462-b922-6b400c88d9d6",
+    "username" : "member",
+    "firstName" : "Abraham",
+    "lastName" : " Woodard",
+    "email" : "member@member.com",
+    "emailVerified" : true,
+    "createdTimestamp" : 1700823629490,
+    "enabled" : true,
+    "totp" : false,
+    "credentials" : [ {
+      "id" : "1d5d0ae5-1a05-4c7c-a41d-7c1f13499c07",
+      "type" : "password",
+      "createdDate" : 1717041629436,
+      "secretData" : "{\"value\":\"FbuaEj/W61VYZTbuWGvMHK8rKvJfHWDBNdtzgC6qwpmdeSCAAutPWWVM2eHYnA1gchExjtma9FaeG3GkDSHWzA==\",\"salt\":\"58BxTvqn7SaJFG18jvLo8g==\",\"additionalParameters\":{}}",
+      "credentialData" : "{\"hashIterations\":210000,\"algorithm\":\"pbkdf2-sha512\",\"additionalParameters\":{}}"
+    } ],
+    "disableableCredentialTypes" : [ ],
+    "requiredActions" : [ ],
+    "realmRoles" : [ "default-roles-pitc_okr_staging", "org_mobility" ],
+    "notBefore" : 0,
+    "groups" : [ ]
+  } ],
+  "scopeMappings" : [ {
+    "clientScope" : "pitc",
+    "roles" : [ "org_gl", "org_bl", "offline_access", "org_azubi", "default-roles-pitc_okr_staging", "uma_authorization", "org_mobility" ]
+  }, {
+    "clientScope" : "offline_access",
+    "roles" : [ "offline_access" ]
+  } ],
+  "clientScopeMappings" : {
+    "account" : [ {
+      "client" : "account-console",
+      "roles" : [ "manage-account", "view-groups" ]
+    } ]
+  },
+  "clients" : [ {
+    "id" : "d21323ce-46e9-4a10-ba1a-c58c8f1e088c",
+    "clientId" : "account",
+    "name" : "${client_account}",
+    "rootUrl" : "${authBaseUrl}",
+    "baseUrl" : "/realms/pitc/account/",
+    "surrogateAuthRequired" : false,
+    "enabled" : true,
+    "alwaysDisplayInConsole" : false,
+    "clientAuthenticatorType" : "client-secret",
+    "redirectUris" : [ "/realms/pitc/account/*" ],
+    "webOrigins" : [ ],
+    "notBefore" : 0,
+    "bearerOnly" : false,
+    "consentRequired" : false,
+    "standardFlowEnabled" : true,
+    "implicitFlowEnabled" : false,
+    "directAccessGrantsEnabled" : false,
+    "serviceAccountsEnabled" : false,
+    "publicClient" : true,
+    "frontchannelLogout" : false,
+    "protocol" : "openid-connect",
+    "attributes" : {
+      "post.logout.redirect.uris" : "+"
+    },
+    "authenticationFlowBindingOverrides" : { },
+    "fullScopeAllowed" : false,
+    "nodeReRegistrationTimeout" : 0,
+    "defaultClientScopes" : [ "web-origins", "acr", "profile", "email" ],
+    "optionalClientScopes" : [ "address", "phone", "offline_access", "microprofile-jwt" ]
+  }, {
+    "id" : "577ef857-c6d4-4561-94f2-dd8dd1e7b86d",
+    "clientId" : "account-console",
+    "name" : "${client_account-console}",
+    "rootUrl" : "${authBaseUrl}",
+    "baseUrl" : "/realms/pitc_okr_staging/account/",
+    "surrogateAuthRequired" : false,
+    "enabled" : true,
+    "alwaysDisplayInConsole" : false,
+    "clientAuthenticatorType" : "client-secret",
+    "redirectUris" : [ "/realms/pitc_okr_staging/account/*" ],
+    "webOrigins" : [ ],
+    "notBefore" : 0,
+    "bearerOnly" : false,
+    "consentRequired" : false,
+    "standardFlowEnabled" : true,
+    "implicitFlowEnabled" : false,
+    "directAccessGrantsEnabled" : false,
+    "serviceAccountsEnabled" : false,
+    "publicClient" : true,
+    "frontchannelLogout" : false,
+    "protocol" : "openid-connect",
+    "attributes" : {
+      "post.logout.redirect.uris" : "+",
+      "pkce.code.challenge.method" : "S256"
+    },
+    "authenticationFlowBindingOverrides" : { },
+    "fullScopeAllowed" : false,
+    "nodeReRegistrationTimeout" : 0,
+    "protocolMappers" : [ {
+      "id" : "d3070834-c98d-4c56-9f29-273a9f7dc7a4",
+      "name" : "audience resolve",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-audience-resolve-mapper",
+      "consentRequired" : false,
+      "config" : { }
+    } ],
+    "defaultClientScopes" : [ "web-origins", "acr", "profile", "email" ],
+    "optionalClientScopes" : [ "address", "phone", "offline_access", "microprofile-jwt" ]
+  }, {
+    "id" : "acf762e9-719e-466d-9ef5-956eed3cfa5a",
+    "clientId" : "admin-cli",
+    "name" : "${client_admin-cli}",
+    "surrogateAuthRequired" : false,
+    "enabled" : true,
+    "alwaysDisplayInConsole" : false,
+    "clientAuthenticatorType" : "client-secret",
+    "redirectUris" : [ ],
+    "webOrigins" : [ ],
+    "notBefore" : 0,
+    "bearerOnly" : false,
+    "consentRequired" : false,
+    "standardFlowEnabled" : false,
+    "implicitFlowEnabled" : false,
+    "directAccessGrantsEnabled" : true,
+    "serviceAccountsEnabled" : false,
+    "publicClient" : true,
+    "frontchannelLogout" : false,
+    "protocol" : "openid-connect",
+    "attributes" : {
+      "post.logout.redirect.uris" : "+"
+    },
+    "authenticationFlowBindingOverrides" : { },
+    "fullScopeAllowed" : false,
+    "nodeReRegistrationTimeout" : 0,
+    "defaultClientScopes" : [ "web-origins", "acr", "profile", "email" ],
+    "optionalClientScopes" : [ "address", "phone", "offline_access", "microprofile-jwt" ]
+  }, {
+    "id" : "25604a69-806e-4351-84ce-cc288e714d9c",
+    "clientId" : "broker",
+    "name" : "${client_broker}",
+    "surrogateAuthRequired" : false,
+    "enabled" : true,
+    "alwaysDisplayInConsole" : false,
+    "clientAuthenticatorType" : "client-secret",
+    "redirectUris" : [ ],
+    "webOrigins" : [ ],
+    "notBefore" : 0,
+    "bearerOnly" : true,
+    "consentRequired" : false,
+    "standardFlowEnabled" : true,
+    "implicitFlowEnabled" : false,
+    "directAccessGrantsEnabled" : false,
+    "serviceAccountsEnabled" : false,
+    "publicClient" : false,
+    "frontchannelLogout" : false,
+    "protocol" : "openid-connect",
+    "attributes" : {
+      "post.logout.redirect.uris" : "+"
+    },
+    "authenticationFlowBindingOverrides" : { },
+    "fullScopeAllowed" : false,
+    "nodeReRegistrationTimeout" : 0,
+    "defaultClientScopes" : [ "web-origins", "acr", "profile", "email" ],
+    "optionalClientScopes" : [ "address", "phone", "offline_access", "microprofile-jwt" ]
+  }, {
+    "id" : "6b3dc034-2a41-4230-a27d-493833919a5a",
+    "clientId" : "pitc_okr_staging",
+    "name" : "OKR-Tool-Staging - PITC",
+    "description" : "",
+    "rootUrl" : "",
+    "adminUrl" : "",
+    "baseUrl" : "",
+    "surrogateAuthRequired" : false,
+    "enabled" : true,
+    "alwaysDisplayInConsole" : false,
+    "clientAuthenticatorType" : "client-secret",
+    "redirectUris" : [ "https://okr-stag.ocp.cloudscale.puzzle.ch/auth/keycloakopenid/callback*", "http://pitc-okr.localhost:4200/*", "http://pitc.okr.localhost:4200/*", "https://okr-stag.ocp.cloudscale.puzzle.ch:*", "http://pitc-okr.localhost:8080:/*", "http://pitc-okr.localhost:8080/*", "http://pitc.okr.localhost:8080/*", "https://pitc.okr-stag.ocp.cloudscale.puzzle.ch:*", "https://pitc.okr-stag.ocp.cloudscale.puzzle.ch/auth/keycloakopenid/callback*", "http://pitc.okr.localhost:8080:/*" ],
+    "webOrigins" : [ "+" ],
+    "notBefore" : 0,
+    "bearerOnly" : false,
+    "consentRequired" : false,
+    "standardFlowEnabled" : true,
+    "implicitFlowEnabled" : false,
+    "directAccessGrantsEnabled" : false,
+    "serviceAccountsEnabled" : false,
+    "publicClient" : true,
+    "frontchannelLogout" : false,
+    "protocol" : "openid-connect",
+    "attributes" : {
+      "frontchannel.logout.url" : "https://okr.ocp-internal.cloudscale.puzzle.ch",
+      "post.logout.redirect.uris" : "http://pitc.okr.localhost:4200/*##https://okr-stag.ocp.cloudscale.puzzle.ch:*##http://pitc.okr.localhost:8080/*##http://pitc.okr.localhost:8080:/*##http://pitc-okr.localhost:4200/*##http://pitc-okr.localhost:8080/*##http://pitc-okr.localhost:8080:/*",
+      "oauth2.device.authorization.grant.enabled" : "false",
+      "backchannel.logout.revoke.offline.tokens" : "false",
+      "use.refresh.tokens" : "true",
+      "oidc.ciba.grant.enabled" : "false",
+      "backchannel.logout.session.required" : "false",
+      "client_credentials.use_refresh_token" : "false",
+      "tls.client.certificate.bound.access.tokens" : "false",
+      "require.pushed.authorization.requests" : "false",
+      "acr.loa.map" : "{}",
+      "display.on.consent.screen" : "false",
+      "token.response.type.bearer.lower-case" : "false"
+    },
+    "authenticationFlowBindingOverrides" : { },
+    "fullScopeAllowed" : true,
+    "nodeReRegistrationTimeout" : -1,
+    "defaultClientScopes" : [ "web-origins", "acr", "profile", "pitc", "email", "client_pitc" ],
+    "optionalClientScopes" : [ "address", "phone", "offline_access", "microprofile-jwt" ]
+  }, {
+    "id" : "f5757601-9812-4aec-8585-f91b79eb3c6e",
+    "clientId" : "realm-management",
+    "name" : "${client_realm-management}",
+    "surrogateAuthRequired" : false,
+    "enabled" : true,
+    "alwaysDisplayInConsole" : false,
+    "clientAuthenticatorType" : "client-secret",
+    "redirectUris" : [ ],
+    "webOrigins" : [ ],
+    "notBefore" : 0,
+    "bearerOnly" : true,
+    "consentRequired" : false,
+    "standardFlowEnabled" : true,
+    "implicitFlowEnabled" : false,
+    "directAccessGrantsEnabled" : false,
+    "serviceAccountsEnabled" : false,
+    "publicClient" : false,
+    "frontchannelLogout" : false,
+    "protocol" : "openid-connect",
+    "attributes" : {
+      "post.logout.redirect.uris" : "+"
+    },
+    "authenticationFlowBindingOverrides" : { },
+    "fullScopeAllowed" : false,
+    "nodeReRegistrationTimeout" : 0,
+    "defaultClientScopes" : [ "web-origins", "acr", "profile", "email" ],
+    "optionalClientScopes" : [ "address", "phone", "offline_access", "microprofile-jwt" ]
+  }, {
+    "id" : "5ca5c001-3711-4811-b98a-7deb75497f5d",
+    "clientId" : "security-admin-console",
+    "name" : "${client_security-admin-console}",
+    "rootUrl" : "${authAdminUrl}",
+    "baseUrl" : "/admin/pitc/console/",
+    "surrogateAuthRequired" : false,
+    "enabled" : true,
+    "alwaysDisplayInConsole" : false,
+    "clientAuthenticatorType" : "client-secret",
+    "redirectUris" : [ "/admin/pitc/console/*" ],
+    "webOrigins" : [ "+" ],
+    "notBefore" : 0,
+    "bearerOnly" : false,
+    "consentRequired" : false,
+    "standardFlowEnabled" : true,
+    "implicitFlowEnabled" : false,
+    "directAccessGrantsEnabled" : false,
+    "serviceAccountsEnabled" : false,
+    "publicClient" : true,
+    "frontchannelLogout" : false,
+    "protocol" : "openid-connect",
+    "attributes" : {
+      "post.logout.redirect.uris" : "+",
+      "pkce.code.challenge.method" : "S256"
+    },
+    "authenticationFlowBindingOverrides" : { },
+    "fullScopeAllowed" : false,
+    "nodeReRegistrationTimeout" : 0,
+    "protocolMappers" : [ {
+      "id" : "89fe5321-673c-4b04-9983-781432d79a30",
+      "name" : "locale",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usermodel-attribute-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "userinfo.token.claim" : "true",
+        "user.attribute" : "locale",
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "locale",
+        "jsonType.label" : "String"
+      }
+    } ],
+    "defaultClientScopes" : [ "web-origins", "acr", "profile", "email" ],
+    "optionalClientScopes" : [ "address", "phone", "offline_access", "microprofile-jwt" ]
+  } ],
+  "clientScopes" : [ {
+    "id" : "705ad3ff-5d11-4b80-ae54-1e58f40be825",
+    "name" : "email",
+    "description" : "OpenID Connect built-in scope: email",
+    "protocol" : "openid-connect",
+    "attributes" : {
+      "include.in.token.scope" : "true",
+      "display.on.consent.screen" : "true",
+      "consent.screen.text" : "${emailScopeConsentText}"
+    },
+    "protocolMappers" : [ {
+      "id" : "40d11fc9-9e90-436a-a737-0ef68ecb09ca",
+      "name" : "email verified",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usermodel-property-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "userinfo.token.claim" : "true",
+        "user.attribute" : "emailVerified",
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "email_verified",
+        "jsonType.label" : "boolean"
+      }
+    }, {
+      "id" : "180565c2-6598-46ba-ae99-b3bfb40c7f0e",
+      "name" : "email",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usermodel-property-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "userinfo.token.claim" : "true",
+        "user.attribute" : "email",
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "email",
+        "jsonType.label" : "String"
+      }
+    } ]
+  }, {
+    "id" : "25d825b0-9567-4942-8e9b-4d061bc50825",
+    "name" : "pitc",
+    "description" : "",
+    "protocol" : "openid-connect",
+    "attributes" : {
+      "include.in.token.scope" : "true",
+      "display.on.consent.screen" : "true",
+      "gui.order" : "",
+      "consent.screen.text" : ""
+    },
+    "protocolMappers" : [ {
+      "id" : "76b7042a-f8ed-47e6-a282-6451e953187d",
+      "name" : "realm roles",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usermodel-realm-role-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "multivalued" : "true",
+        "userinfo.token.claim" : "false",
+        "user.attribute" : "foo",
+        "id.token.claim" : "false",
+        "access.token.claim" : "true",
+        "claim.name" : "pitc.roles",
+        "jsonType.label" : "String"
+      }
+    } ]
+  }, {
+    "id" : "c851f7fc-e969-482a-8225-c285a448012c",
+    "name" : "phone",
+    "description" : "OpenID Connect built-in scope: phone",
+    "protocol" : "openid-connect",
+    "attributes" : {
+      "include.in.token.scope" : "true",
+      "display.on.consent.screen" : "true",
+      "consent.screen.text" : "${phoneScopeConsentText}"
+    },
+    "protocolMappers" : [ {
+      "id" : "9ba260e1-f22e-4451-9c16-6e5cda491023",
+      "name" : "phone number",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usermodel-attribute-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "userinfo.token.claim" : "true",
+        "user.attribute" : "phoneNumber",
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "phone_number",
+        "jsonType.label" : "String"
+      }
+    }, {
+      "id" : "b6890e43-9679-4036-8187-372459fc274e",
+      "name" : "phone number verified",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usermodel-attribute-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "userinfo.token.claim" : "true",
+        "user.attribute" : "phoneNumberVerified",
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "phone_number_verified",
+        "jsonType.label" : "boolean"
+      }
+    } ]
+  }, {
+    "id" : "9dcb6931-c86a-45c1-94d1-62110e58a64d",
+    "name" : "role_list",
+    "description" : "SAML role list",
+    "protocol" : "saml",
+    "attributes" : {
+      "consent.screen.text" : "${samlRoleListScopeConsentText}",
+      "display.on.consent.screen" : "true"
+    },
+    "protocolMappers" : [ {
+      "id" : "bfaecd30-a8c8-4b13-b940-4b60a9048f71",
+      "name" : "role list",
+      "protocol" : "saml",
+      "protocolMapper" : "saml-role-list-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "single" : "false",
+        "attribute.nameformat" : "Basic",
+        "attribute.name" : "Role"
+      }
+    } ]
+  }, {
+    "id" : "e3015444-a867-4daf-a02e-384bf12e1a46",
+    "name" : "web-origins",
+    "description" : "OpenID Connect scope for add allowed web origins to the access token",
+    "protocol" : "openid-connect",
+    "attributes" : {
+      "include.in.token.scope" : "false",
+      "display.on.consent.screen" : "false",
+      "consent.screen.text" : ""
+    },
+    "protocolMappers" : [ {
+      "id" : "1e71985c-dd3f-41e2-9b38-b5e1d2185c0f",
+      "name" : "allowed web origins",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-allowed-origins-mapper",
+      "consentRequired" : false,
+      "config" : { }
+    } ]
+  }, {
+    "id" : "cb4d4396-070d-4512-93f6-0dd999644bc1",
+    "name" : "profile",
+    "description" : "OpenID Connect built-in scope: profile",
+    "protocol" : "openid-connect",
+    "attributes" : {
+      "include.in.token.scope" : "true",
+      "display.on.consent.screen" : "true",
+      "consent.screen.text" : "${profileScopeConsentText}"
+    },
+    "protocolMappers" : [ {
+      "id" : "58c5a94e-3f63-49d4-b57a-3ed45087c03b",
+      "name" : "birthdate",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usermodel-attribute-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "userinfo.token.claim" : "true",
+        "user.attribute" : "birthdate",
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "birthdate",
+        "jsonType.label" : "String"
+      }
+    }, {
+      "id" : "a940ae28-1090-4660-84e2-a4396485aba2",
+      "name" : "picture",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usermodel-attribute-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "userinfo.token.claim" : "true",
+        "user.attribute" : "picture",
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "picture",
+        "jsonType.label" : "String"
+      }
+    }, {
+      "id" : "c5c938a2-7ddd-4b96-8806-db7aaaf1883e",
+      "name" : "username",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usermodel-property-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "userinfo.token.claim" : "true",
+        "user.attribute" : "username",
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "preferred_username",
+        "jsonType.label" : "String"
+      }
+    }, {
+      "id" : "801d2478-da8e-4b8e-8125-de57e8952d21",
+      "name" : "website",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usermodel-attribute-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "userinfo.token.claim" : "true",
+        "user.attribute" : "website",
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "website",
+        "jsonType.label" : "String"
+      }
+    }, {
+      "id" : "26df33bb-d365-49eb-ae05-5c26d2da824c",
+      "name" : "gender",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usermodel-attribute-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "userinfo.token.claim" : "true",
+        "user.attribute" : "gender",
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "gender",
+        "jsonType.label" : "String"
+      }
+    }, {
+      "id" : "077f8ae6-5c99-4888-b8cc-bd529795dd9a",
+      "name" : "locale",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usermodel-attribute-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "userinfo.token.claim" : "true",
+        "user.attribute" : "locale",
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "locale",
+        "jsonType.label" : "String"
+      }
+    }, {
+      "id" : "645b1072-ec42-4d71-90ca-a2ba00f057ca",
+      "name" : "zoneinfo",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usermodel-attribute-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "userinfo.token.claim" : "true",
+        "user.attribute" : "zoneinfo",
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "zoneinfo",
+        "jsonType.label" : "String"
+      }
+    }, {
+      "id" : "ae5aab45-5e3a-4856-b301-8c2a16a35368",
+      "name" : "nickname",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usermodel-attribute-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "userinfo.token.claim" : "true",
+        "user.attribute" : "nickname",
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "nickname",
+        "jsonType.label" : "String"
+      }
+    }, {
+      "id" : "70dcf380-a212-45e6-8bfa-a89590e8b824",
+      "name" : "full name",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-full-name-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "userinfo.token.claim" : "true"
+      }
+    }, {
+      "id" : "84cf501f-192b-4c34-baa2-a01e38d0d102",
+      "name" : "middle name",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usermodel-attribute-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "userinfo.token.claim" : "true",
+        "user.attribute" : "middleName",
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "middle_name",
+        "jsonType.label" : "String"
+      }
+    }, {
+      "id" : "fe02f8c6-5957-49d1-846c-17ae34f686ab",
+      "name" : "profile",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usermodel-attribute-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "userinfo.token.claim" : "true",
+        "user.attribute" : "profile",
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "profile",
+        "jsonType.label" : "String"
+      }
+    }, {
+      "id" : "1f58896d-5cad-4226-8a96-cb9b772be039",
+      "name" : "family name",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usermodel-property-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "userinfo.token.claim" : "true",
+        "user.attribute" : "lastName",
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "family_name",
+        "jsonType.label" : "String"
+      }
+    }, {
+      "id" : "697388d3-7e68-428e-af22-ec749d6dbeb1",
+      "name" : "updated at",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usermodel-attribute-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "userinfo.token.claim" : "true",
+        "user.attribute" : "updatedAt",
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "updated_at",
+        "jsonType.label" : "long"
+      }
+    }, {
+      "id" : "f5159dc2-4d3a-4daf-bc5e-1c8c4d349ddf",
+      "name" : "given name",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usermodel-property-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "userinfo.token.claim" : "true",
+        "user.attribute" : "firstName",
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "given_name",
+        "jsonType.label" : "String"
+      }
+    } ]
+  }, {
+    "id" : "95edb5a7-a039-4fa8-9bd8-6cf1c0004ff1",
+    "name" : "microprofile-jwt",
+    "description" : "Microprofile - JWT built-in scope",
+    "protocol" : "openid-connect",
+    "attributes" : {
+      "include.in.token.scope" : "true",
+      "display.on.consent.screen" : "false"
+    },
+    "protocolMappers" : [ {
+      "id" : "462051d5-029e-4fd2-9369-8f543415efe3",
+      "name" : "groups",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usermodel-realm-role-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "multivalued" : "true",
+        "userinfo.token.claim" : "true",
+        "user.attribute" : "foo",
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "groups",
+        "jsonType.label" : "String"
+      }
+    }, {
+      "id" : "edecee36-099c-4cb5-9f28-5c81c4213919",
+      "name" : "upn",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usermodel-property-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "userinfo.token.claim" : "true",
+        "user.attribute" : "username",
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "upn",
+        "jsonType.label" : "String"
+      }
+    } ]
+  }, {
+    "id" : "515536ae-261d-4a86-9021-7ad57ee9d1c7",
+    "name" : "address",
+    "description" : "OpenID Connect built-in scope: address",
+    "protocol" : "openid-connect",
+    "attributes" : {
+      "include.in.token.scope" : "true",
+      "display.on.consent.screen" : "true",
+      "consent.screen.text" : "${addressScopeConsentText}"
+    },
+    "protocolMappers" : [ {
+      "id" : "e4306684-bbdc-491d-85ac-a27a76c575a4",
+      "name" : "address",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-address-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "user.attribute.formatted" : "formatted",
+        "user.attribute.country" : "country",
+        "user.attribute.postal_code" : "postal_code",
+        "userinfo.token.claim" : "true",
+        "user.attribute.street" : "street",
+        "id.token.claim" : "true",
+        "user.attribute.region" : "region",
+        "access.token.claim" : "true",
+        "user.attribute.locality" : "locality"
+      }
+    } ]
+  }, {
+    "id" : "044ae227-c291-48a6-9511-c865657d8d29",
+    "name" : "offline_access",
+    "description" : "OpenID Connect built-in scope: offline_access",
+    "protocol" : "openid-connect",
+    "attributes" : {
+      "consent.screen.text" : "${offlineAccessScopeConsentText}",
+      "display.on.consent.screen" : "true"
+    }
+  }, {
+    "id" : "0e0a238c-0cea-4f62-a278-b4af1aedeb0f",
+    "name" : "acr",
+    "description" : "OpenID Connect scope for add acr (authentication context class reference) to the token",
+    "protocol" : "openid-connect",
+    "attributes" : {
+      "include.in.token.scope" : "false",
+      "display.on.consent.screen" : "false"
+    },
+    "protocolMappers" : [ {
+      "id" : "70411dc1-c84c-4daa-b0f7-58e66a0a644a",
+      "name" : "acr loa level",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-acr-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "userinfo.token.claim" : "true"
+      }
+    } ]
+  }, {
+    "id" : "9726b8d8-283c-4a07-b74e-420aa8b02eb2",
+    "name" : "client_pitc",
+    "description" : "Maps claim tenant to pitc ",
+    "protocol" : "openid-connect",
+    "attributes" : {
+      "include.in.token.scope" : "false",
+      "display.on.consent.screen" : "false",
+      "gui.order" : "",
+      "consent.screen.text" : ""
+    },
+    "protocolMappers" : [ {
+      "id" : "dbdd0068-62d3-42c2-88cb-87011ca7049e",
+      "name" : "Tenant PITC claim mapper",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-hardcoded-claim-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "introspection.token.claim" : "true",
+        "claim.value" : "pitc",
+        "userinfo.token.claim" : "true",
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "tenant",
+        "jsonType.label" : "String",
+        "access.tokenResponse.claim" : "false"
+      }
+    } ]
+  } ],
+  "defaultDefaultClientScopes" : [ "profile", "email", "web-origins", "acr", "pitc" ],
+  "defaultOptionalClientScopes" : [ "offline_access", "address", "phone", "microprofile-jwt", "client_pitc" ],
+  "browserSecurityHeaders" : {
+    "contentSecurityPolicyReportOnly" : "",
+    "xContentTypeOptions" : "nosniff",
+    "referrerPolicy" : "no-referrer",
+    "xRobotsTag" : "none",
+    "xFrameOptions" : "SAMEORIGIN",
+    "contentSecurityPolicy" : "frame-src 'self'; frame-ancestors 'self'; object-src 'none';",
+    "xXSSProtection" : "1; mode=block",
+    "strictTransportSecurity" : "max-age=31536000; includeSubDomains"
+  },
+  "smtpServer" : { },
+  "eventsEnabled" : false,
+  "eventsListeners" : [ "jboss-logging" ],
+  "enabledEventTypes" : [ ],
+  "adminEventsEnabled" : false,
+  "adminEventsDetailsEnabled" : false,
+  "identityProviders" : [ ],
+  "identityProviderMappers" : [ ],
+  "components" : {
+    "org.keycloak.services.clientregistration.policy.ClientRegistrationPolicy" : [ {
+      "id" : "e17e98d3-eb1f-4ce4-9c3c-009b29e3ac06",
+      "name" : "Max Clients Limit",
+      "providerId" : "max-clients",
+      "subType" : "anonymous",
+      "subComponents" : { },
+      "config" : {
+        "max-clients" : [ "200" ]
+      }
+    }, {
+      "id" : "825d03dd-56f9-4516-bdf4-0d429f410c96",
+      "name" : "Allowed Protocol Mapper Types",
+      "providerId" : "allowed-protocol-mappers",
+      "subType" : "anonymous",
+      "subComponents" : { },
+      "config" : {
+        "allowed-protocol-mapper-types" : [ "oidc-usermodel-property-mapper", "saml-user-property-mapper", "saml-user-attribute-mapper", "oidc-sha256-pairwise-sub-mapper", "oidc-usermodel-attribute-mapper", "oidc-full-name-mapper", "saml-role-list-mapper", "oidc-address-mapper" ]
+      }
+    }, {
+      "id" : "ca3537dd-70b8-4077-9718-60844c658ce3",
+      "name" : "Allowed Client Scopes",
+      "providerId" : "allowed-client-templates",
+      "subType" : "authenticated",
+      "subComponents" : { },
+      "config" : {
+        "allow-default-scopes" : [ "true" ]
+      }
+    }, {
+      "id" : "27924afa-35e7-4701-9f02-fc97aa85a357",
+      "name" : "Consent Required",
+      "providerId" : "consent-required",
+      "subType" : "anonymous",
+      "subComponents" : { },
+      "config" : { }
+    }, {
+      "id" : "aed582be-e3d4-4eeb-a108-951ad8807971",
+      "name" : "Allowed Protocol Mapper Types",
+      "providerId" : "allowed-protocol-mappers",
+      "subType" : "authenticated",
+      "subComponents" : { },
+      "config" : {
+        "allowed-protocol-mapper-types" : [ "oidc-address-mapper", "saml-user-property-mapper", "oidc-usermodel-property-mapper", "saml-role-list-mapper", "oidc-full-name-mapper", "oidc-usermodel-attribute-mapper", "saml-user-attribute-mapper", "oidc-sha256-pairwise-sub-mapper" ]
+      }
+    }, {
+      "id" : "4a22bcac-2e91-4e73-a063-9d888cc46cdb",
+      "name" : "Trusted Hosts",
+      "providerId" : "trusted-hosts",
+      "subType" : "anonymous",
+      "subComponents" : { },
+      "config" : {
+        "host-sending-registration-request-must-match" : [ "true" ],
+        "client-uris-must-match" : [ "true" ]
+      }
+    }, {
+      "id" : "e49dea0a-880b-4cfd-a266-b7fe6dc2acf0",
+      "name" : "Full Scope Disabled",
+      "providerId" : "scope",
+      "subType" : "anonymous",
+      "subComponents" : { },
+      "config" : { }
+    }, {
+      "id" : "e00bdb9f-8495-4d78-98e7-57ead89f9bb2",
+      "name" : "Allowed Client Scopes",
+      "providerId" : "allowed-client-templates",
+      "subType" : "anonymous",
+      "subComponents" : { },
+      "config" : {
+        "allow-default-scopes" : [ "true" ]
+      }
+    } ],
+    "org.keycloak.userprofile.UserProfileProvider" : [ {
+      "id" : "9fe82fb7-4892-48d5-8906-3d58a9a05d1e",
+      "providerId" : "declarative-user-profile",
+      "subComponents" : { },
+      "config" : {
+        "kc.user.profile.config" : [ "{\"attributes\":[{\"name\":\"username\",\"displayName\":\"${username}\",\"validations\":{\"length\":{\"min\":3,\"max\":255},\"username-prohibited-characters\":{},\"up-username-not-idn-homograph\":{}},\"permissions\":{\"view\":[\"admin\",\"user\"],\"edit\":[\"admin\",\"user\"]},\"multivalued\":false},{\"name\":\"email\",\"displayName\":\"${email}\",\"validations\":{\"email\":{},\"length\":{\"max\":255}},\"required\":{\"roles\":[\"user\"]},\"permissions\":{\"view\":[\"admin\",\"user\"],\"edit\":[\"admin\",\"user\"]},\"multivalued\":false},{\"name\":\"firstName\",\"displayName\":\"${firstName}\",\"validations\":{\"length\":{\"max\":255},\"person-name-prohibited-characters\":{}},\"required\":{\"roles\":[\"user\"]},\"permissions\":{\"view\":[\"admin\",\"user\"],\"edit\":[\"admin\",\"user\"]},\"multivalued\":false},{\"name\":\"lastName\",\"displayName\":\"${lastName}\",\"validations\":{\"length\":{\"max\":255},\"person-name-prohibited-characters\":{}},\"required\":{\"roles\":[\"user\"]},\"permissions\":{\"view\":[\"admin\",\"user\"],\"edit\":[\"admin\",\"user\"]},\"multivalued\":false}],\"groups\":[{\"name\":\"user-metadata\",\"displayHeader\":\"User metadata\",\"displayDescription\":\"Attributes, which refer to user metadata\"}],\"unmanagedAttributePolicy\":\"ENABLED\"}" ]
+      }
+    } ],
+    "org.keycloak.keys.KeyProvider" : [ {
+      "id" : "4b17c76a-249a-4397-b0b9-eff96aedb59d",
+      "name" : "rsa-enc-generated",
+      "providerId" : "rsa-enc-generated",
+      "subComponents" : { },
+      "config" : {
+        "privateKey" : [ "MIIEowIBAAKCAQEA0X5jmOXcuUERZpFjX2n5eGkY2ogCc3PA6ea0RwoEjnDru+inaMaS2Ot/ArXynaMvg9IBOrx259m+OOCHtqx8D8MXwtswzijfhcI9wT1EMDRydYqrBwx/zXhq81b2VsO3KmP/CgVCWiSj+UJlYUY74Yc2O6AFNXd1f6IBBqvijtL/NJZ4t0B8JZf3PqUkN1W4p6+SVcFLnHPm9RsWahyVeszZT9PK7ra2PVumDBmky3Vnl/7/m7mg4Fob6MbxpgCRRH2mS+o8yAE/QhxcwLihqkGpT0qfiDk9rJezmxdOzGtYgHkVZ0UT/1EoPEoB3yDdlJiyqj7xw6njq+6F58gOhQIDAQABAoIBADHAXk7VaBHmzgcZyAvE0yYxb2GWo15fwxTJYU7tph9d2d4KZpePcRhq9QLjyvZ85q/bk8crMuHk6DQBvrk3RU9I+b+g5npPYqYVdy0JK8R28CfSAsPtx/w3+M5JfL8mQ72hedQbY6KcyQRNLF5pm5b30X1fh10nPZROGQhIkclxDFdHX6m/r6eqUI/puUF8ssjPuP68m9wkGu5ZbOvoxDC1A+tV6vOU1tBLuMC3Dsty6VD72B8AAZqZ+qpH80bb6m5lj00t56kzgu/+cPsh498a5uWoHwXhjrF5Zcb6qM0Ei/MzR4B2XwMKSsSdieL7yC6DVa6TB0e0ACoKAlL68wECgYEA9PUB2TNXax57PPkqJTGsmgdm7e8bhKHPUIfoedDxDAN7bJEwePTfKx3W0aLk42twUZcURu6TIyPCot2okSKRJ/9WhcHMxLAp7qWIjI1GpPqu/DM/BSnh+kiApqf2qLobc5hiuJYzIMOP5hcmRm39oSQcU2O2d6Q4WFXdyiznmPUCgYEA2vAbhA+qRuw8gHf4xdxxMPUdhKX6zgGu7q4hH3A4Gg32wH5DKMPUWJNWoDrkGfTyY2CxM0R4ycAV5+Zt1EM8ElHZ272tR0oe1FZJtukeLu9phdJwc8ftybCr4ubiBH1Vu9sjiuA8yjikJfAbAaJjmGFLrqf17QScpApvAi2IZVECgYBro1XCmZrqSSSiMGLioSdVL7d9CjqvV2L/4hi3nqatPsJ3fH0uSXvfOGdzCv9FJ6rdT2Prn14sbMRUSM6Pp/7c8oiUkgpmy3pBkZ+lE1ddm4JU9DfXDwZrsnxFvzzV+6Ggc++9aNLirMyIsNdyz1ZJ/tIrmn9Np23S8zhYZM8IGQKBgFO3pI3m/5GHG8t0FKh0FsRFtjfW0ASeGCokY34GBy3PUR9iKIQZ/cSw8lrqqfZS96yQeLHF6PocfUPjlPOpkfrfWZLxAKVV7lv7csyCb4w69/q38VAUjxSkfdWRu7NDydi/fuPHwvcAmaP4IBuL4NGPwsTSbPNo5AzGAJSwnItBAoGBAMTx9oDYsFE6XyDm8ibmGP+m9X6589MFldk1stKtEXF3tGAUzTKd1ptZPcyizIiTSHTl4MOB8/7EP3fJ+oDCPItB/OuU/m86+Y5bcjUG4DJaSiZ/KOoRqH/DXcUDRcY6hg3kzOrq00sPDW04wxauPpu27wvQONSgUdJSqi1QIN4R" ],
+        "certificate" : [ "MIIClzCCAX8CBgGPx6gFfDANBgkqhkiG9w0BAQsFADAPMQ0wCwYDVQQDDARwaXRjMB4XDTI0MDUzMDAzNTg0OFoXDTM0MDUzMDA0MDAyOFowDzENMAsGA1UEAwwEcGl0YzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANF+Y5jl3LlBEWaRY19p+XhpGNqIAnNzwOnmtEcKBI5w67vop2jGktjrfwK18p2jL4PSATq8dufZvjjgh7asfA/DF8LbMM4o34XCPcE9RDA0cnWKqwcMf814avNW9lbDtypj/woFQloko/lCZWFGO+GHNjugBTV3dX+iAQar4o7S/zSWeLdAfCWX9z6lJDdVuKevklXBS5xz5vUbFmoclXrM2U/Tyu62tj1bpgwZpMt1Z5f+/5u5oOBaG+jG8aYAkUR9pkvqPMgBP0IcXMC4oapBqU9Kn4g5PayXs5sXTsxrWIB5FWdFE/9RKDxKAd8g3ZSYsqo+8cOp46vuhefIDoUCAwEAATANBgkqhkiG9w0BAQsFAAOCAQEALSPkEADO/9Telcz+kMO235JND1YFs9YOQxSn1Udv6kQHpzguMHrgmlG3pAFg/KXmTXimxqt9rqh8T+EiGtmWJJe4TX5k9S0iSFYJ5fIPsEZ3t5Y9qxTiURrIZdHrtawkYhiBNE0dscZ8P2R+mlX2dIxHEy/3lVHvXJzs8VKvo89sFkjWMPn+7cdey2wkp0KcW0BNh/Ai6NoTOjuv4NGMe4zd4CKgtgbyXR1H4PflmplQ6EhbL9NVyFkkZLISX9WuXPPVUjhdMOyEwDxIKW+idkqaHtWbq+gnKgWsgHyrga1LA6SRJ+CtqpBocfUlCNFBvtWF+nMEUaEq7wrG7mTv5A==" ],
+        "priority" : [ "100" ],
+        "algorithm" : [ "RSA-OAEP" ]
+      }
+    }, {
+      "id" : "1c92da1a-c6d9-4444-8cbe-7f088b3d5212",
+      "name" : "hmac-generated",
+      "providerId" : "hmac-generated",
+      "subComponents" : { },
+      "config" : {
+        "kid" : [ "68533eaa-aec5-4e0c-a121-bd030ee4bb9f" ],
+        "secret" : [ "bBvQt_0ssWLKIQ-NvZ9jEymS29TmCS8n8hItjK3hOKBxYF8lqUJCtz3SOkyscBa3SSAUuvqzX4ElE3Z-iZYQPgmDy05lTz1ZWl4JlvXnt0quwS3AKt3k1zxC-3DmdBkyZSpjwW6rDCxNPLTZTUSmYt7D8pZGz73F81KEDEUC8LQ" ],
+        "priority" : [ "100" ],
+        "algorithm" : [ "HS256" ]
+      }
+    }, {
+      "id" : "17716743-363d-4d31-a09f-cad32b6a6f33",
+      "name" : "hmac-generated-hs512",
+      "providerId" : "hmac-generated",
+      "subComponents" : { },
+      "config" : {
+        "kid" : [ "6854fdc3-55c2-4985-9f95-a44787cf5dbd" ],
+        "secret" : [ "emcF-xT8FLplh_wm_25tvw7_QNK_V1OuQ89tSBd-k25UVnz8AXfjKAHa4JZAEZDLSsJz2XTzSuGJdbvwHAWRBXDabafJINwViFV0ZxzUKtP6CiQRhOSc6e73vv-KDiNSlpiv_tHSPWdgY7Daa9l3a3fv8b0-dPlkYONfjJKYKkY" ],
+        "priority" : [ "100" ],
+        "algorithm" : [ "HS512" ]
+      }
+    }, {
+      "id" : "c622e2d0-6459-4454-baee-c6277ba285ce",
+      "name" : "rsa-generated",
+      "providerId" : "rsa-generated",
+      "subComponents" : { },
+      "config" : {
+        "privateKey" : [ "MIIEpAIBAAKCAQEAm+SLm7qoALIVtKolHv3sTpKw/08wfl+kHqpySLSxcdBs0Ab79ExaMn/8hLrFHi/gBswKeO2vatutJgdpGLQ0leEN7ShKGuxujp8/F7eEjO4XTpe88lBQ9rksf986HWXR8kyAnIgavZH4C8l+c+LVoChphhjQn87zLezE8kmNZA+A4O+YZtN488OKyJbSis0Oj04SucO8tnICHRucldquqO9XNRB2+N7v0gPQ0l3eIVk5A4ZtNvBKRfym4XB/l8z9bQPEVEqdpvyflMiAUxM8CIZ73rJwpFAVPvg9oqtTA9w0C9f+odBbANPov2Q43NwZgrpkP7yezY3AaJp4DJlbrQIDAQABAoIBABVTXDLLQ8DGm9gJX4cgEuPDxvFCHr7m6/9i7zvZdh289qm1juGCUWNvpTZuC1mgEHw1jOgykajjUMovQNYHjtsC/MH43TxWJCCgEcQ3j2stBeSzNr6KNK0vszHx8lQDsgb8pqpjJw9QSNep8oG9Yd5lMNxOiDmYWKVrapy/aZdqndXFjXoiOM9NBQFrytBu5rhxm/EjRSqIwRgHLrIKqO3Uxjh2vmCY3n2wOPAjxw5Cz1jOoTSvs5gusOaSvtrXd2R48UH1SDe0IBApIaAi6q1aBo+WPCaqpbFkdXzZ/qYTtVrU80cVMbeMfhU2y9vKpjm0rQT44areAdx9LbzRbhkCgYEAznR6cRnl50KCL0llhGd7gk2+nbkXtPJVGQoIg5FtFLziC+N1eW9g8DUzZeTRl0IzKp6MiLDn3A8YleCz4qXd+/CJMajgMe30Ojpp1sRKDpxZpur/5wME9E2y9UsF7BnsJEjs/guhXzxMvdaIJ9Pkk3hXw77xPi7j0l/jIDsprJkCgYEAwU3JNE1FqXaqetvWQk2AgG6GTSeWA1wlxeTqSWPDGhyL2N8zuhLyjJI4rKaGuXmP4Hmi2ba21ag5NP7kDJWUHAlmpG722tuqwBPQDVAmYM5j7j21upx+sgGe+e/DvcoYoB5XZmIZvpbmFGU9fjuZ7Y40JdPxAFrTvdzE9QiBoDUCgYAmCeoBar8kU+m+oqxUr+hewspLLy5CBaBOQ73719CcUIzpmdgsLqxStcqpjHZdgzIAOUQ1bzrZHeLuwn8CVINJBzGP98iPCoPEMr0LeBEZDg+qpIPP4YuJI8PEVDVcIg6TROh9ilEKRgbxt1RQ2ka0MSkihMzYIzWQrmAfsSbliQKBgQCRFndcoFsXFRBkYrjwzwcSXuLC6mF4aCOZ43XOW+jGooJ85xsGIM6Yn++V9u/MKufIzsNisfeNalR16JL2txaR7KRz6y2xm4sP3E8ejvgfVQpAeWT7iha2OO1AH6xFuXi+RcfH+v3jxZMv38VGCCpC2adedTPA1mtzaE8Us6vHuQKBgQC86aesvhLtrmL0C3XsvXOnsaAz/M9onnACvHtylCj8TM/+CO8NUFbA+WPBJQJJTjG8eM6c4XLSEFl597TFojKFI6XQohd8XE/Fh4w/yq+1giAmHhXyEMgbbUhFaXvYHY7LiYrOUd5bT1PmcPvb5ILwmHa3Bok5Sm6O6s1zM43QAQ==" ],
+        "certificate" : [ "MIIClzCCAX8CBgGPx6gFxDANBgkqhkiG9w0BAQsFADAPMQ0wCwYDVQQDDARwaXRjMB4XDTI0MDUzMDAzNTg0OFoXDTM0MDUzMDA0MDAyOFowDzENMAsGA1UEAwwEcGl0YzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJvki5u6qACyFbSqJR797E6SsP9PMH5fpB6qcki0sXHQbNAG+/RMWjJ//IS6xR4v4AbMCnjtr2rbrSYHaRi0NJXhDe0oShrsbo6fPxe3hIzuF06XvPJQUPa5LH/fOh1l0fJMgJyIGr2R+AvJfnPi1aAoaYYY0J/O8y3sxPJJjWQPgODvmGbTePPDisiW0orNDo9OErnDvLZyAh0bnJXarqjvVzUQdvje79ID0NJd3iFZOQOGbTbwSkX8puFwf5fM/W0DxFRKnab8n5TIgFMTPAiGe96ycKRQFT74PaKrUwPcNAvX/qHQWwDT6L9kONzcGYK6ZD+8ns2NwGiaeAyZW60CAwEAATANBgkqhkiG9w0BAQsFAAOCAQEAbM04uAxb8Y5tfIymR5N80UshWkbm64r7+Xe++AH1ab1PT/cDE397AUeSGC30dpfxjd1gYcjBRSgT52eHcIhfc9veZbwNvuGKE6quRsgkqsYL62+MHGo47QqqCC6nYr82UwsCssDwhiBJBUdLPZNCoKjTJ68vBbFHOt/hwKjtGmqezB8NNY9dupoY7jQ2zLhLd5E5+kvgAVPkapfVGPPyO0QiwpCzRP/qwqtiJ/9UCUFHoZXXD0MC3KYtbBNJ/vrDvEh4iM3Vqr2GzBTiMOTDfnOwoEV/t1rXbaSzP0x+uA8M8xlVYLR15LhndPNRTlNQOBvt1UyNw4nbGIqWN/yAqw==" ],
+        "priority" : [ "100" ]
+      }
+    }, {
+      "id" : "966cbb2f-8ebb-423f-8311-77f75704abea",
+      "name" : "aes-generated",
+      "providerId" : "aes-generated",
+      "subComponents" : { },
+      "config" : {
+        "kid" : [ "450f5556-1574-4377-a10d-adb5e56150a2" ],
+        "secret" : [ "GGvsTld627qjT7WjMD2xFQ" ],
+        "priority" : [ "100" ]
+      }
+    } ]
+  },
+  "internationalizationEnabled" : false,
+  "supportedLocales" : [ ],
+  "authenticationFlows" : [ {
+    "id" : "76ccd78f-6481-4cef-9d09-efcbb1bf8d5e",
+    "alias" : "Account verification options",
+    "description" : "Method with which to verity the existing account",
+    "providerId" : "basic-flow",
+    "topLevel" : false,
+    "builtIn" : true,
+    "authenticationExecutions" : [ {
+      "authenticator" : "idp-email-verification",
+      "authenticatorFlow" : false,
+      "requirement" : "ALTERNATIVE",
+      "priority" : 10,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticatorFlow" : true,
+      "requirement" : "ALTERNATIVE",
+      "priority" : 20,
+      "autheticatorFlow" : true,
+      "flowAlias" : "Verify Existing Account by Re-authentication",
+      "userSetupAllowed" : false
+    } ]
+  }, {
+    "id" : "f4eff540-099a-40f7-bdc8-4137f7099796",
+    "alias" : "Browser - Conditional OTP",
+    "description" : "Flow to determine if the OTP is required for the authentication",
+    "providerId" : "basic-flow",
+    "topLevel" : false,
+    "builtIn" : true,
+    "authenticationExecutions" : [ {
+      "authenticator" : "conditional-user-configured",
+      "authenticatorFlow" : false,
+      "requirement" : "REQUIRED",
+      "priority" : 10,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticator" : "auth-otp-form",
+      "authenticatorFlow" : false,
+      "requirement" : "REQUIRED",
+      "priority" : 20,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    } ]
+  }, {
+    "id" : "f44d4ab5-8ab8-4e00-8d13-b7f32a96951b",
+    "alias" : "Direct Grant - Conditional OTP",
+    "description" : "Flow to determine if the OTP is required for the authentication",
+    "providerId" : "basic-flow",
+    "topLevel" : false,
+    "builtIn" : true,
+    "authenticationExecutions" : [ {
+      "authenticator" : "conditional-user-configured",
+      "authenticatorFlow" : false,
+      "requirement" : "REQUIRED",
+      "priority" : 10,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticator" : "direct-grant-validate-otp",
+      "authenticatorFlow" : false,
+      "requirement" : "REQUIRED",
+      "priority" : 20,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    } ]
+  }, {
+    "id" : "41e00a6d-5768-445d-9705-18219ea77266",
+    "alias" : "First broker login - Conditional OTP",
+    "description" : "Flow to determine if the OTP is required for the authentication",
+    "providerId" : "basic-flow",
+    "topLevel" : false,
+    "builtIn" : true,
+    "authenticationExecutions" : [ {
+      "authenticator" : "conditional-user-configured",
+      "authenticatorFlow" : false,
+      "requirement" : "REQUIRED",
+      "priority" : 10,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticator" : "auth-otp-form",
+      "authenticatorFlow" : false,
+      "requirement" : "REQUIRED",
+      "priority" : 20,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    } ]
+  }, {
+    "id" : "05fe1a21-fa8c-4485-a429-7108a96fa4b1",
+    "alias" : "Handle Existing Account",
+    "description" : "Handle what to do if there is existing account with same email/username like authenticated identity provider",
+    "providerId" : "basic-flow",
+    "topLevel" : false,
+    "builtIn" : true,
+    "authenticationExecutions" : [ {
+      "authenticator" : "idp-confirm-link",
+      "authenticatorFlow" : false,
+      "requirement" : "REQUIRED",
+      "priority" : 10,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticatorFlow" : true,
+      "requirement" : "REQUIRED",
+      "priority" : 20,
+      "autheticatorFlow" : true,
+      "flowAlias" : "Account verification options",
+      "userSetupAllowed" : false
+    } ]
+  }, {
+    "id" : "93a29c80-fd7d-43e4-b29a-a067bd36ac09",
+    "alias" : "Reset - Conditional OTP",
+    "description" : "Flow to determine if the OTP should be reset or not. Set to REQUIRED to force.",
+    "providerId" : "basic-flow",
+    "topLevel" : false,
+    "builtIn" : true,
+    "authenticationExecutions" : [ {
+      "authenticator" : "conditional-user-configured",
+      "authenticatorFlow" : false,
+      "requirement" : "REQUIRED",
+      "priority" : 10,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticator" : "reset-otp",
+      "authenticatorFlow" : false,
+      "requirement" : "REQUIRED",
+      "priority" : 20,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    } ]
+  }, {
+    "id" : "e37ecd7c-7cab-4b17-8436-d43e40136e42",
+    "alias" : "User creation or linking",
+    "description" : "Flow for the existing/non-existing user alternatives",
+    "providerId" : "basic-flow",
+    "topLevel" : false,
+    "builtIn" : true,
+    "authenticationExecutions" : [ {
+      "authenticatorConfig" : "create unique user config",
+      "authenticator" : "idp-create-user-if-unique",
+      "authenticatorFlow" : false,
+      "requirement" : "ALTERNATIVE",
+      "priority" : 10,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticatorFlow" : true,
+      "requirement" : "ALTERNATIVE",
+      "priority" : 20,
+      "autheticatorFlow" : true,
+      "flowAlias" : "Handle Existing Account",
+      "userSetupAllowed" : false
+    } ]
+  }, {
+    "id" : "8be1fe46-6069-45d3-8806-255b408214f9",
+    "alias" : "Verify Existing Account by Re-authentication",
+    "description" : "Reauthentication of existing account",
+    "providerId" : "basic-flow",
+    "topLevel" : false,
+    "builtIn" : true,
+    "authenticationExecutions" : [ {
+      "authenticator" : "idp-username-password-form",
+      "authenticatorFlow" : false,
+      "requirement" : "REQUIRED",
+      "priority" : 10,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticatorFlow" : true,
+      "requirement" : "CONDITIONAL",
+      "priority" : 20,
+      "autheticatorFlow" : true,
+      "flowAlias" : "First broker login - Conditional OTP",
+      "userSetupAllowed" : false
+    } ]
+  }, {
+    "id" : "465bc00b-c86e-42aa-9cbd-8d136389a800",
+    "alias" : "browser",
+    "description" : "browser based authentication",
+    "providerId" : "basic-flow",
+    "topLevel" : true,
+    "builtIn" : true,
+    "authenticationExecutions" : [ {
+      "authenticator" : "auth-cookie",
+      "authenticatorFlow" : false,
+      "requirement" : "ALTERNATIVE",
+      "priority" : 10,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticator" : "auth-spnego",
+      "authenticatorFlow" : false,
+      "requirement" : "DISABLED",
+      "priority" : 20,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticator" : "identity-provider-redirector",
+      "authenticatorFlow" : false,
+      "requirement" : "ALTERNATIVE",
+      "priority" : 25,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticatorFlow" : true,
+      "requirement" : "ALTERNATIVE",
+      "priority" : 30,
+      "autheticatorFlow" : true,
+      "flowAlias" : "forms",
+      "userSetupAllowed" : false
+    } ]
+  }, {
+    "id" : "da1677a9-9fe5-4d48-bc7d-87e8a14317b2",
+    "alias" : "clients",
+    "description" : "Base authentication for clients",
+    "providerId" : "client-flow",
+    "topLevel" : true,
+    "builtIn" : true,
+    "authenticationExecutions" : [ {
+      "authenticator" : "client-secret",
+      "authenticatorFlow" : false,
+      "requirement" : "ALTERNATIVE",
+      "priority" : 10,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticator" : "client-jwt",
+      "authenticatorFlow" : false,
+      "requirement" : "ALTERNATIVE",
+      "priority" : 20,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticator" : "client-secret-jwt",
+      "authenticatorFlow" : false,
+      "requirement" : "ALTERNATIVE",
+      "priority" : 30,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticator" : "client-x509",
+      "authenticatorFlow" : false,
+      "requirement" : "ALTERNATIVE",
+      "priority" : 40,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    } ]
+  }, {
+    "id" : "eb28b4a6-d3e2-4c7d-aba5-603618a2080c",
+    "alias" : "direct grant",
+    "description" : "OpenID Connect Resource Owner Grant",
+    "providerId" : "basic-flow",
+    "topLevel" : true,
+    "builtIn" : true,
+    "authenticationExecutions" : [ {
+      "authenticator" : "direct-grant-validate-username",
+      "authenticatorFlow" : false,
+      "requirement" : "REQUIRED",
+      "priority" : 10,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticator" : "direct-grant-validate-password",
+      "authenticatorFlow" : false,
+      "requirement" : "REQUIRED",
+      "priority" : 20,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticatorFlow" : true,
+      "requirement" : "CONDITIONAL",
+      "priority" : 30,
+      "autheticatorFlow" : true,
+      "flowAlias" : "Direct Grant - Conditional OTP",
+      "userSetupAllowed" : false
+    } ]
+  }, {
+    "id" : "184ee903-a00f-462f-9f23-24b6905e50c2",
+    "alias" : "docker auth",
+    "description" : "Used by Docker clients to authenticate against the IDP",
+    "providerId" : "basic-flow",
+    "topLevel" : true,
+    "builtIn" : true,
+    "authenticationExecutions" : [ {
+      "authenticator" : "docker-http-basic-authenticator",
+      "authenticatorFlow" : false,
+      "requirement" : "REQUIRED",
+      "priority" : 10,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    } ]
+  }, {
+    "id" : "06264f3c-9a18-4395-863c-32d7cf75178a",
+    "alias" : "first broker login",
+    "description" : "Actions taken after first broker login with identity provider account, which is not yet linked to any Keycloak account",
+    "providerId" : "basic-flow",
+    "topLevel" : true,
+    "builtIn" : true,
+    "authenticationExecutions" : [ {
+      "authenticatorConfig" : "review profile config",
+      "authenticator" : "idp-review-profile",
+      "authenticatorFlow" : false,
+      "requirement" : "REQUIRED",
+      "priority" : 10,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticatorFlow" : true,
+      "requirement" : "REQUIRED",
+      "priority" : 20,
+      "autheticatorFlow" : true,
+      "flowAlias" : "User creation or linking",
+      "userSetupAllowed" : false
+    } ]
+  }, {
+    "id" : "8a302a30-c1ce-4628-a953-05eae840e919",
+    "alias" : "forms",
+    "description" : "Username, password, otp and other auth forms.",
+    "providerId" : "basic-flow",
+    "topLevel" : false,
+    "builtIn" : true,
+    "authenticationExecutions" : [ {
+      "authenticator" : "auth-username-password-form",
+      "authenticatorFlow" : false,
+      "requirement" : "REQUIRED",
+      "priority" : 10,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticatorFlow" : true,
+      "requirement" : "CONDITIONAL",
+      "priority" : 20,
+      "autheticatorFlow" : true,
+      "flowAlias" : "Browser - Conditional OTP",
+      "userSetupAllowed" : false
+    } ]
+  }, {
+    "id" : "89dc879d-926a-4118-a55d-069178987489",
+    "alias" : "registration",
+    "description" : "registration flow",
+    "providerId" : "basic-flow",
+    "topLevel" : true,
+    "builtIn" : true,
+    "authenticationExecutions" : [ {
+      "authenticator" : "registration-page-form",
+      "authenticatorFlow" : true,
+      "requirement" : "REQUIRED",
+      "priority" : 10,
+      "autheticatorFlow" : true,
+      "flowAlias" : "registration form",
+      "userSetupAllowed" : false
+    } ]
+  }, {
+    "id" : "94dcf858-7176-4c9b-af69-fb046ebac202",
+    "alias" : "registration form",
+    "description" : "registration form",
+    "providerId" : "form-flow",
+    "topLevel" : false,
+    "builtIn" : true,
+    "authenticationExecutions" : [ {
+      "authenticator" : "registration-user-creation",
+      "authenticatorFlow" : false,
+      "requirement" : "REQUIRED",
+      "priority" : 20,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticator" : "registration-password-action",
+      "authenticatorFlow" : false,
+      "requirement" : "REQUIRED",
+      "priority" : 50,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticator" : "registration-recaptcha-action",
+      "authenticatorFlow" : false,
+      "requirement" : "DISABLED",
+      "priority" : 60,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    } ]
+  }, {
+    "id" : "0626b26e-3282-4670-b97b-25664490ce52",
+    "alias" : "reset credentials",
+    "description" : "Reset credentials for a user if they forgot their password or something",
+    "providerId" : "basic-flow",
+    "topLevel" : true,
+    "builtIn" : true,
+    "authenticationExecutions" : [ {
+      "authenticator" : "reset-credentials-choose-user",
+      "authenticatorFlow" : false,
+      "requirement" : "REQUIRED",
+      "priority" : 10,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticator" : "reset-credential-email",
+      "authenticatorFlow" : false,
+      "requirement" : "REQUIRED",
+      "priority" : 20,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticator" : "reset-password",
+      "authenticatorFlow" : false,
+      "requirement" : "REQUIRED",
+      "priority" : 30,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticatorFlow" : true,
+      "requirement" : "CONDITIONAL",
+      "priority" : 40,
+      "autheticatorFlow" : true,
+      "flowAlias" : "Reset - Conditional OTP",
+      "userSetupAllowed" : false
+    } ]
+  }, {
+    "id" : "acb17cf5-08ce-4025-b240-4607989b07c2",
+    "alias" : "saml ecp",
+    "description" : "SAML ECP Profile Authentication Flow",
+    "providerId" : "basic-flow",
+    "topLevel" : true,
+    "builtIn" : true,
+    "authenticationExecutions" : [ {
+      "authenticator" : "http-basic-authenticator",
+      "authenticatorFlow" : false,
+      "requirement" : "REQUIRED",
+      "priority" : 10,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    } ]
+  } ],
+  "authenticatorConfig" : [ {
+    "id" : "47bdcb07-ee72-4f0b-896c-f99fcd4ab91b",
+    "alias" : "create unique user config",
+    "config" : {
+      "require.password.update.after.registration" : "false"
+    }
+  }, {
+    "id" : "06ce8406-cd9e-49cf-9d1f-8c2d9462ba02",
+    "alias" : "review profile config",
+    "config" : {
+      "update.profile.on.first.login" : "missing"
+    }
+  } ],
+  "requiredActions" : [ {
+    "alias" : "CONFIGURE_TOTP",
+    "name" : "Configure OTP",
+    "providerId" : "CONFIGURE_TOTP",
+    "enabled" : true,
+    "defaultAction" : false,
+    "priority" : 10,
+    "config" : { }
+  }, {
+    "alias" : "TERMS_AND_CONDITIONS",
+    "name" : "Terms and Conditions",
+    "providerId" : "TERMS_AND_CONDITIONS",
+    "enabled" : false,
+    "defaultAction" : false,
+    "priority" : 20,
+    "config" : { }
+  }, {
+    "alias" : "UPDATE_PASSWORD",
+    "name" : "Update Password",
+    "providerId" : "UPDATE_PASSWORD",
+    "enabled" : true,
+    "defaultAction" : false,
+    "priority" : 30,
+    "config" : { }
+  }, {
+    "alias" : "UPDATE_PROFILE",
+    "name" : "Update Profile",
+    "providerId" : "UPDATE_PROFILE",
+    "enabled" : true,
+    "defaultAction" : false,
+    "priority" : 40,
+    "config" : { }
+  }, {
+    "alias" : "VERIFY_EMAIL",
+    "name" : "Verify Email",
+    "providerId" : "VERIFY_EMAIL",
+    "enabled" : true,
+    "defaultAction" : false,
+    "priority" : 50,
+    "config" : { }
+  }, {
+    "alias" : "delete_account",
+    "name" : "Delete Account",
+    "providerId" : "delete_account",
+    "enabled" : false,
+    "defaultAction" : false,
+    "priority" : 60,
+    "config" : { }
+  }, {
+    "alias" : "webauthn-register",
+    "name" : "Webauthn Register",
+    "providerId" : "webauthn-register",
+    "enabled" : true,
+    "defaultAction" : false,
+    "priority" : 70,
+    "config" : { }
+  }, {
+    "alias" : "webauthn-register-passwordless",
+    "name" : "Webauthn Register Passwordless",
+    "providerId" : "webauthn-register-passwordless",
+    "enabled" : true,
+    "defaultAction" : false,
+    "priority" : 80,
+    "config" : { }
+  }, {
+    "alias" : "delete_credential",
+    "name" : "Delete Credential",
+    "providerId" : "delete_credential",
+    "enabled" : true,
+    "defaultAction" : false,
+    "priority" : 100,
+    "config" : { }
+  }, {
+    "alias" : "update_user_locale",
+    "name" : "Update User Locale",
+    "providerId" : "update_user_locale",
+    "enabled" : true,
+    "defaultAction" : false,
+    "priority" : 1000,
+    "config" : { }
+  } ],
+  "browserFlow" : "browser",
+  "registrationFlow" : "registration",
+  "directGrantFlow" : "direct grant",
+  "resetCredentialsFlow" : "reset credentials",
+  "clientAuthenticationFlow" : "clients",
+  "dockerAuthenticationFlow" : "docker auth",
+  "firstBrokerLoginFlow" : "first broker login",
+  "attributes" : {
+    "cibaBackchannelTokenDeliveryMode" : "poll",
+    "cibaAuthRequestedUserHint" : "login_hint",
+    "clientOfflineSessionMaxLifespan" : "0",
+    "oauth2DevicePollingInterval" : "5",
+    "clientSessionIdleTimeout" : "0",
+    "clientOfflineSessionIdleTimeout" : "0",
+    "cibaInterval" : "5",
+    "realmReusableOtpCode" : "false",
+    "cibaExpiresIn" : "120",
+    "oauth2DeviceCodeLifespan" : "600",
+    "parRequestUriLifespan" : "60",
+    "clientSessionMaxLifespan" : "0",
+    "frontendUrl" : "",
+    "acr.loa.map" : "{}"
+  },
+  "keycloakVersion" : "24.0.3",
+  "userManagedAccessAllowed" : false,
+  "clientProfiles" : {
+    "profiles" : [ ]
+  },
+  "clientPolicies" : {
+    "policies" : [ ]
+  }
+}, {
+  "id" : "f49966bf-a797-49f7-8e35-b38df21e0b0d",
+  "realm" : "master",
+  "displayName" : "Keycloak",
+  "displayNameHtml" : "<div class=\"kc-logo-text\"><span>Keycloak</span></div>",
+  "notBefore" : 0,
+  "defaultSignatureAlgorithm" : "RS256",
+  "revokeRefreshToken" : false,
+  "refreshTokenMaxReuse" : 0,
+  "accessTokenLifespan" : 60,
+  "accessTokenLifespanForImplicitFlow" : 900,
+  "ssoSessionIdleTimeout" : 1800,
+  "ssoSessionMaxLifespan" : 36000,
+  "ssoSessionIdleTimeoutRememberMe" : 0,
+  "ssoSessionMaxLifespanRememberMe" : 0,
+  "offlineSessionIdleTimeout" : 2592000,
+  "offlineSessionMaxLifespanEnabled" : false,
+  "offlineSessionMaxLifespan" : 5184000,
+  "clientSessionIdleTimeout" : 0,
+  "clientSessionMaxLifespan" : 0,
+  "clientOfflineSessionIdleTimeout" : 0,
+  "clientOfflineSessionMaxLifespan" : 0,
+  "accessCodeLifespan" : 60,
+  "accessCodeLifespanUserAction" : 300,
+  "accessCodeLifespanLogin" : 1800,
+  "actionTokenGeneratedByAdminLifespan" : 43200,
+  "actionTokenGeneratedByUserLifespan" : 300,
+  "oauth2DeviceCodeLifespan" : 600,
+  "oauth2DevicePollingInterval" : 5,
+  "enabled" : true,
+  "sslRequired" : "external",
+  "registrationAllowed" : false,
+  "registrationEmailAsUsername" : false,
+  "rememberMe" : false,
+  "verifyEmail" : false,
+  "loginWithEmailAllowed" : true,
+  "duplicateEmailsAllowed" : false,
+  "resetPasswordAllowed" : false,
+  "editUsernameAllowed" : false,
+  "bruteForceProtected" : false,
+  "permanentLockout" : false,
+  "maxTemporaryLockouts" : 0,
+  "maxFailureWaitSeconds" : 900,
+  "minimumQuickLoginWaitSeconds" : 60,
+  "waitIncrementSeconds" : 60,
+  "quickLoginCheckMilliSeconds" : 1000,
+  "maxDeltaTimeSeconds" : 43200,
+  "failureFactor" : 30,
+  "roles" : {
+    "realm" : [ {
+      "id" : "743c330e-c87b-45f2-a47c-ef859c61b796",
+      "name" : "create-realm",
+      "description" : "${role_create-realm}",
+      "composite" : false,
+      "clientRole" : false,
+      "containerId" : "f49966bf-a797-49f7-8e35-b38df21e0b0d",
+      "attributes" : { }
+    }, {
+      "id" : "4967211d-8d50-45a2-9d81-cca3204428d5",
+      "name" : "admin",
+      "description" : "${role_admin}",
+      "composite" : true,
+      "composites" : {
+        "realm" : [ "create-realm" ],
+        "client" : {
+          "master-realm" : [ "query-realms", "query-users", "view-realm", "manage-users", "view-events", "view-authorization", "manage-authorization", "query-groups", "impersonation", "manage-identity-providers", "view-users", "view-clients", "view-identity-providers", "create-client", "manage-realm", "manage-events", "query-clients", "manage-clients" ],
+          "pitc-realm" : [ "query-groups", "manage-users", "manage-clients", "create-client", "manage-events", "view-users", "manage-authorization", "view-events", "view-realm", "manage-identity-providers", "query-realms", "view-authorization", "manage-realm", "view-clients", "impersonation", "view-identity-providers", "query-users", "query-clients" ]
+        }
+      },
+      "clientRole" : false,
+      "containerId" : "f49966bf-a797-49f7-8e35-b38df21e0b0d",
+      "attributes" : { }
+    }, {
+      "id" : "babeca86-f07b-4c4e-9241-112dd62b7fbb",
+      "name" : "uma_authorization",
+      "description" : "${role_uma_authorization}",
+      "composite" : false,
+      "clientRole" : false,
+      "containerId" : "f49966bf-a797-49f7-8e35-b38df21e0b0d",
+      "attributes" : { }
+    }, {
+      "id" : "1055a998-e36d-4784-92eb-fc381f0b58ef",
+      "name" : "default-roles-master",
+      "description" : "${role_default-roles}",
+      "composite" : true,
+      "composites" : {
+        "realm" : [ "offline_access", "uma_authorization" ],
+        "client" : {
+          "account" : [ "view-profile", "manage-account" ]
+        }
+      },
+      "clientRole" : false,
+      "containerId" : "f49966bf-a797-49f7-8e35-b38df21e0b0d",
+      "attributes" : { }
+    }, {
+      "id" : "759c3431-3fbe-43b7-b866-cceb64d72178",
+      "name" : "offline_access",
+      "description" : "${role_offline-access}",
+      "composite" : false,
+      "clientRole" : false,
+      "containerId" : "f49966bf-a797-49f7-8e35-b38df21e0b0d",
+      "attributes" : { }
+    } ],
+    "client" : {
+      "security-admin-console" : [ ],
+      "admin-cli" : [ ],
+      "account-console" : [ ],
+      "broker" : [ {
+        "id" : "35f0445f-36f9-426b-a9be-9789a5c4bdb7",
+        "name" : "read-token",
+        "description" : "${role_read-token}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "a08b7887-c106-4c2e-ae24-6bbd59ea28ce",
+        "attributes" : { }
+      } ],
+      "master-realm" : [ {
+        "id" : "9841ec0f-ce03-420e-9812-8695e4e2fcd5",
+        "name" : "manage-identity-providers",
+        "description" : "${role_manage-identity-providers}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "37063f77-0a28-48a8-8000-9f9e2916b4ea",
+        "attributes" : { }
+      }, {
+        "id" : "a2ae78d9-0c56-4e30-bc7a-3641e21ffa36",
+        "name" : "query-realms",
+        "description" : "${role_query-realms}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "37063f77-0a28-48a8-8000-9f9e2916b4ea",
+        "attributes" : { }
+      }, {
+        "id" : "10876b06-53a4-4b8a-be1a-82936d9d71f9",
+        "name" : "query-users",
+        "description" : "${role_query-users}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "37063f77-0a28-48a8-8000-9f9e2916b4ea",
+        "attributes" : { }
+      }, {
+        "id" : "99f2ab42-59c6-4dee-91f7-6551c847bcce",
+        "name" : "view-realm",
+        "description" : "${role_view-realm}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "37063f77-0a28-48a8-8000-9f9e2916b4ea",
+        "attributes" : { }
+      }, {
+        "id" : "30bcf316-0090-496e-92db-7787b8dafa15",
+        "name" : "view-users",
+        "description" : "${role_view-users}",
+        "composite" : true,
+        "composites" : {
+          "client" : {
+            "master-realm" : [ "query-users", "query-groups" ]
+          }
+        },
+        "clientRole" : true,
+        "containerId" : "37063f77-0a28-48a8-8000-9f9e2916b4ea",
+        "attributes" : { }
+      }, {
+        "id" : "59816579-7abf-4ea2-b6ff-3a1f3d38bf09",
+        "name" : "view-clients",
+        "description" : "${role_view-clients}",
+        "composite" : true,
+        "composites" : {
+          "client" : {
+            "master-realm" : [ "query-clients" ]
+          }
+        },
+        "clientRole" : true,
+        "containerId" : "37063f77-0a28-48a8-8000-9f9e2916b4ea",
+        "attributes" : { }
+      }, {
+        "id" : "3abe8ba2-8536-4da6-877d-f720e91d4dd3",
+        "name" : "view-identity-providers",
+        "description" : "${role_view-identity-providers}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "37063f77-0a28-48a8-8000-9f9e2916b4ea",
+        "attributes" : { }
+      }, {
+        "id" : "ffd8efda-e4f6-451a-9f09-a07d806c6165",
+        "name" : "manage-users",
+        "description" : "${role_manage-users}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "37063f77-0a28-48a8-8000-9f9e2916b4ea",
+        "attributes" : { }
+      }, {
+        "id" : "18d53d90-0546-466f-bd9f-87b6cdf76554",
+        "name" : "create-client",
+        "description" : "${role_create-client}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "37063f77-0a28-48a8-8000-9f9e2916b4ea",
+        "attributes" : { }
+      }, {
+        "id" : "aac173bb-fb84-45d4-88bf-6107a9e523bc",
+        "name" : "manage-events",
+        "description" : "${role_manage-events}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "37063f77-0a28-48a8-8000-9f9e2916b4ea",
+        "attributes" : { }
+      }, {
+        "id" : "940e9452-7934-4b69-bd2d-757cf7e71bc5",
+        "name" : "manage-realm",
+        "description" : "${role_manage-realm}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "37063f77-0a28-48a8-8000-9f9e2916b4ea",
+        "attributes" : { }
+      }, {
+        "id" : "ede7bc39-de83-47dd-98af-f47f7766758b",
+        "name" : "query-clients",
+        "description" : "${role_query-clients}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "37063f77-0a28-48a8-8000-9f9e2916b4ea",
+        "attributes" : { }
+      }, {
+        "id" : "09ac1431-a393-463b-9e3b-c62890978e42",
+        "name" : "view-events",
+        "description" : "${role_view-events}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "37063f77-0a28-48a8-8000-9f9e2916b4ea",
+        "attributes" : { }
+      }, {
+        "id" : "46c021dd-f2c0-4b3d-af21-6588c9540feb",
+        "name" : "manage-clients",
+        "description" : "${role_manage-clients}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "37063f77-0a28-48a8-8000-9f9e2916b4ea",
+        "attributes" : { }
+      }, {
+        "id" : "73f7eccd-f844-4d45-aa7f-ab8b0c1f22fa",
+        "name" : "view-authorization",
+        "description" : "${role_view-authorization}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "37063f77-0a28-48a8-8000-9f9e2916b4ea",
+        "attributes" : { }
+      }, {
+        "id" : "251f5eaa-0268-4d3f-9cfc-39ce6c1d88e9",
+        "name" : "manage-authorization",
+        "description" : "${role_manage-authorization}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "37063f77-0a28-48a8-8000-9f9e2916b4ea",
+        "attributes" : { }
+      }, {
+        "id" : "bac5f62e-0bed-44ad-87c0-17caf073ceb1",
+        "name" : "query-groups",
+        "description" : "${role_query-groups}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "37063f77-0a28-48a8-8000-9f9e2916b4ea",
+        "attributes" : { }
+      }, {
+        "id" : "2aec8e42-c5a9-49f4-aa63-dab9b30f1691",
+        "name" : "impersonation",
+        "description" : "${role_impersonation}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "37063f77-0a28-48a8-8000-9f9e2916b4ea",
+        "attributes" : { }
+      } ],
+      "account" : [ {
+        "id" : "f85ef894-a286-44e9-a9b4-f26e7297422f",
+        "name" : "manage-account-links",
+        "description" : "${role_manage-account-links}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "ac226190-252e-4cd8-a09c-5d91acd5c9e4",
+        "attributes" : { }
+      }, {
+        "id" : "15bc8f02-f6e7-4159-845a-c4b7ba9031d9",
+        "name" : "view-profile",
+        "description" : "${role_view-profile}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "ac226190-252e-4cd8-a09c-5d91acd5c9e4",
+        "attributes" : { }
+      }, {
+        "id" : "331fd37f-56b4-42bd-a0d7-a772fd89cc69",
+        "name" : "view-consent",
+        "description" : "${role_view-consent}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "ac226190-252e-4cd8-a09c-5d91acd5c9e4",
+        "attributes" : { }
+      }, {
+        "id" : "5a289ae7-6df5-40da-ae78-1ab64ae33938",
+        "name" : "view-groups",
+        "description" : "${role_view-groups}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "ac226190-252e-4cd8-a09c-5d91acd5c9e4",
+        "attributes" : { }
+      }, {
+        "id" : "59f43f2f-fd00-4278-8f48-438e2c70fee4",
+        "name" : "manage-account",
+        "description" : "${role_manage-account}",
+        "composite" : true,
+        "composites" : {
+          "client" : {
+            "account" : [ "manage-account-links" ]
+          }
+        },
+        "clientRole" : true,
+        "containerId" : "ac226190-252e-4cd8-a09c-5d91acd5c9e4",
+        "attributes" : { }
+      }, {
+        "id" : "bb8f018d-805c-4257-bcba-4dc7cb8ae098",
+        "name" : "manage-consent",
+        "description" : "${role_manage-consent}",
+        "composite" : true,
+        "composites" : {
+          "client" : {
+            "account" : [ "view-consent" ]
+          }
+        },
+        "clientRole" : true,
+        "containerId" : "ac226190-252e-4cd8-a09c-5d91acd5c9e4",
+        "attributes" : { }
+      }, {
+        "id" : "e0b8bfed-0bba-4993-806f-f5630b63301c",
+        "name" : "view-applications",
+        "description" : "${role_view-applications}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "ac226190-252e-4cd8-a09c-5d91acd5c9e4",
+        "attributes" : { }
+      }, {
+        "id" : "dbe3bfdd-5694-4489-abe9-546ea477ba79",
+        "name" : "delete-account",
+        "description" : "${role_delete-account}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "ac226190-252e-4cd8-a09c-5d91acd5c9e4",
+        "attributes" : { }
+      } ],
+      "pitc-realm" : [ {
+        "id" : "d0f2ca36-6ca6-4e45-9dbd-8aed3e96109e",
+        "name" : "query-realms",
+        "description" : "${role_query-realms}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "7c57a7d5-f160-4812-a44b-50a5d3b9ae18",
+        "attributes" : { }
+      }, {
+        "id" : "cc553fa4-3649-479b-a3c8-da0cd67f99a4",
+        "name" : "query-groups",
+        "description" : "${role_query-groups}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "7c57a7d5-f160-4812-a44b-50a5d3b9ae18",
+        "attributes" : { }
+      }, {
+        "id" : "bcbabc7d-1931-4c05-b6f7-72a3d8978e43",
+        "name" : "view-authorization",
+        "description" : "${role_view-authorization}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "7c57a7d5-f160-4812-a44b-50a5d3b9ae18",
+        "attributes" : { }
+      }, {
+        "id" : "2a87fe2b-384f-449f-81ac-955f94bc3bb1",
+        "name" : "manage-users",
+        "description" : "${role_manage-users}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "7c57a7d5-f160-4812-a44b-50a5d3b9ae18",
+        "attributes" : { }
+      }, {
+        "id" : "3df8311a-4267-4264-9fdd-f607e46c9fcf",
+        "name" : "manage-realm",
+        "description" : "${role_manage-realm}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "7c57a7d5-f160-4812-a44b-50a5d3b9ae18",
+        "attributes" : { }
+      }, {
+        "id" : "6b48340a-f2ba-4d9d-9e27-00cc8d5dcedd",
+        "name" : "view-clients",
+        "description" : "${role_view-clients}",
+        "composite" : true,
+        "composites" : {
+          "client" : {
+            "pitc-realm" : [ "query-clients" ]
+          }
+        },
+        "clientRole" : true,
+        "containerId" : "7c57a7d5-f160-4812-a44b-50a5d3b9ae18",
+        "attributes" : { }
+      }, {
+        "id" : "fa2a633b-23b7-4b7c-b768-9e87d86e4aa4",
+        "name" : "manage-clients",
+        "description" : "${role_manage-clients}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "7c57a7d5-f160-4812-a44b-50a5d3b9ae18",
+        "attributes" : { }
+      }, {
+        "id" : "31e25c28-94e1-44ef-abe0-1d66d1a4f073",
+        "name" : "create-client",
+        "description" : "${role_create-client}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "7c57a7d5-f160-4812-a44b-50a5d3b9ae18",
+        "attributes" : { }
+      }, {
+        "id" : "02a928b6-bfcc-4824-91a5-7e125858040c",
+        "name" : "impersonation",
+        "description" : "${role_impersonation}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "7c57a7d5-f160-4812-a44b-50a5d3b9ae18",
+        "attributes" : { }
+      }, {
+        "id" : "c8209347-5dca-4de5-a818-22ab9bf63242",
+        "name" : "manage-events",
+        "description" : "${role_manage-events}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "7c57a7d5-f160-4812-a44b-50a5d3b9ae18",
+        "attributes" : { }
+      }, {
+        "id" : "ea98ee72-a4bb-42df-9f88-2ee1e3339e62",
+        "name" : "view-users",
+        "description" : "${role_view-users}",
+        "composite" : true,
+        "composites" : {
+          "client" : {
+            "pitc-realm" : [ "query-groups", "query-users" ]
+          }
+        },
+        "clientRole" : true,
+        "containerId" : "7c57a7d5-f160-4812-a44b-50a5d3b9ae18",
+        "attributes" : { }
+      }, {
+        "id" : "ff6d92df-0cec-4faa-bb11-d23222ce6aec",
+        "name" : "manage-authorization",
+        "description" : "${role_manage-authorization}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "7c57a7d5-f160-4812-a44b-50a5d3b9ae18",
+        "attributes" : { }
+      }, {
+        "id" : "830eddbc-2c12-429e-b695-59444406fc17",
+        "name" : "view-events",
+        "description" : "${role_view-events}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "7c57a7d5-f160-4812-a44b-50a5d3b9ae18",
+        "attributes" : { }
+      }, {
+        "id" : "24589120-4d88-45a9-8890-ff16d977afcb",
+        "name" : "view-identity-providers",
+        "description" : "${role_view-identity-providers}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "7c57a7d5-f160-4812-a44b-50a5d3b9ae18",
+        "attributes" : { }
+      }, {
+        "id" : "9af02ea3-19c5-466b-8fe3-5bec62899c9e",
+        "name" : "query-users",
+        "description" : "${role_query-users}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "7c57a7d5-f160-4812-a44b-50a5d3b9ae18",
+        "attributes" : { }
+      }, {
+        "id" : "ab6a896a-58eb-4a08-a73f-6dc59a00af87",
+        "name" : "manage-identity-providers",
+        "description" : "${role_manage-identity-providers}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "7c57a7d5-f160-4812-a44b-50a5d3b9ae18",
+        "attributes" : { }
+      }, {
+        "id" : "6a691419-c4a2-4f21-9cdf-d53cbbd01261",
+        "name" : "query-clients",
+        "description" : "${role_query-clients}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "7c57a7d5-f160-4812-a44b-50a5d3b9ae18",
+        "attributes" : { }
+      }, {
+        "id" : "97bfcc3a-99bd-4ecb-a477-9f11e3c0244f",
+        "name" : "view-realm",
+        "description" : "${role_view-realm}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "7c57a7d5-f160-4812-a44b-50a5d3b9ae18",
+        "attributes" : { }
+      } ]
+    }
+  },
+  "groups" : [ ],
+  "defaultRole" : {
+    "id" : "1055a998-e36d-4784-92eb-fc381f0b58ef",
+    "name" : "default-roles-master",
+    "description" : "${role_default-roles}",
+    "composite" : true,
+    "clientRole" : false,
+    "containerId" : "f49966bf-a797-49f7-8e35-b38df21e0b0d"
+  },
+  "requiredCredentials" : [ "password" ],
+  "otpPolicyType" : "totp",
+  "otpPolicyAlgorithm" : "HmacSHA1",
+  "otpPolicyInitialCounter" : 0,
+  "otpPolicyDigits" : 6,
+  "otpPolicyLookAheadWindow" : 1,
+  "otpPolicyPeriod" : 30,
+  "otpPolicyCodeReusable" : false,
+  "otpSupportedApplications" : [ "totpAppFreeOTPName", "totpAppGoogleName", "totpAppMicrosoftAuthenticatorName" ],
+  "localizationTexts" : { },
+  "webAuthnPolicyRpEntityName" : "keycloak",
+  "webAuthnPolicySignatureAlgorithms" : [ "ES256" ],
+  "webAuthnPolicyRpId" : "",
+  "webAuthnPolicyAttestationConveyancePreference" : "not specified",
+  "webAuthnPolicyAuthenticatorAttachment" : "not specified",
+  "webAuthnPolicyRequireResidentKey" : "not specified",
+  "webAuthnPolicyUserVerificationRequirement" : "not specified",
+  "webAuthnPolicyCreateTimeout" : 0,
+  "webAuthnPolicyAvoidSameAuthenticatorRegister" : false,
+  "webAuthnPolicyAcceptableAaguids" : [ ],
+  "webAuthnPolicyExtraOrigins" : [ ],
+  "webAuthnPolicyPasswordlessRpEntityName" : "keycloak",
+  "webAuthnPolicyPasswordlessSignatureAlgorithms" : [ "ES256" ],
+  "webAuthnPolicyPasswordlessRpId" : "",
+  "webAuthnPolicyPasswordlessAttestationConveyancePreference" : "not specified",
+  "webAuthnPolicyPasswordlessAuthenticatorAttachment" : "not specified",
+  "webAuthnPolicyPasswordlessRequireResidentKey" : "not specified",
+  "webAuthnPolicyPasswordlessUserVerificationRequirement" : "not specified",
+  "webAuthnPolicyPasswordlessCreateTimeout" : 0,
+  "webAuthnPolicyPasswordlessAvoidSameAuthenticatorRegister" : false,
+  "webAuthnPolicyPasswordlessAcceptableAaguids" : [ ],
+  "webAuthnPolicyPasswordlessExtraOrigins" : [ ],
+  "users" : [ {
+    "id" : "60a728f0-e898-47dc-b7f9-5c9ad417bb02",
+    "username" : "admin",
+    "emailVerified" : false,
+    "createdTimestamp" : 1720153345160,
+    "enabled" : true,
+    "totp" : false,
+    "credentials" : [ {
+      "id" : "1b0cfa0e-7ba0-4bfc-83c5-3962c341a788",
+      "type" : "password",
+      "createdDate" : 1720153345384,
+      "secretData" : "{\"value\":\"xVGRgL/Na26gKjB33kctEnl9bbPz50nYexVTJxjL3lEbdJMGRrEuC87IkpHLaO2x6YpNvWH0Jl7ZY3+mAc/IEg==\",\"salt\":\"AEJDuv30d8jwFmywb1kg5A==\",\"additionalParameters\":{}}",
+      "credentialData" : "{\"hashIterations\":210000,\"algorithm\":\"pbkdf2-sha512\",\"additionalParameters\":{}}"
+    } ],
+    "disableableCredentialTypes" : [ ],
+    "requiredActions" : [ ],
+    "realmRoles" : [ "admin", "default-roles-master" ],
+    "notBefore" : 0,
+    "groups" : [ ]
+  } ],
+  "scopeMappings" : [ {
+    "clientScope" : "offline_access",
+    "roles" : [ "offline_access" ]
+  } ],
+  "clientScopeMappings" : {
+    "account" : [ {
+      "client" : "account-console",
+      "roles" : [ "manage-account", "view-groups" ]
+    } ]
+  },
+  "clients" : [ {
+    "id" : "ac226190-252e-4cd8-a09c-5d91acd5c9e4",
+    "clientId" : "account",
+    "name" : "${client_account}",
+    "rootUrl" : "${authBaseUrl}",
+    "baseUrl" : "/realms/master/account/",
+    "surrogateAuthRequired" : false,
+    "enabled" : true,
+    "alwaysDisplayInConsole" : false,
+    "clientAuthenticatorType" : "client-secret",
+    "redirectUris" : [ "/realms/master/account/*" ],
+    "webOrigins" : [ ],
+    "notBefore" : 0,
+    "bearerOnly" : false,
+    "consentRequired" : false,
+    "standardFlowEnabled" : true,
+    "implicitFlowEnabled" : false,
+    "directAccessGrantsEnabled" : false,
+    "serviceAccountsEnabled" : false,
+    "publicClient" : true,
+    "frontchannelLogout" : false,
+    "protocol" : "openid-connect",
+    "attributes" : {
+      "post.logout.redirect.uris" : "+"
+    },
+    "authenticationFlowBindingOverrides" : { },
+    "fullScopeAllowed" : false,
+    "nodeReRegistrationTimeout" : 0,
+    "defaultClientScopes" : [ "web-origins", "acr", "profile", "roles", "email" ],
+    "optionalClientScopes" : [ "address", "phone", "offline_access", "microprofile-jwt" ]
+  }, {
+    "id" : "849ad51b-a7c5-496b-84cf-4fc285f9b6fb",
+    "clientId" : "account-console",
+    "name" : "${client_account-console}",
+    "rootUrl" : "${authBaseUrl}",
+    "baseUrl" : "/realms/master/account/",
+    "surrogateAuthRequired" : false,
+    "enabled" : true,
+    "alwaysDisplayInConsole" : false,
+    "clientAuthenticatorType" : "client-secret",
+    "redirectUris" : [ "/realms/master/account/*" ],
+    "webOrigins" : [ ],
+    "notBefore" : 0,
+    "bearerOnly" : false,
+    "consentRequired" : false,
+    "standardFlowEnabled" : true,
+    "implicitFlowEnabled" : false,
+    "directAccessGrantsEnabled" : false,
+    "serviceAccountsEnabled" : false,
+    "publicClient" : true,
+    "frontchannelLogout" : false,
+    "protocol" : "openid-connect",
+    "attributes" : {
+      "post.logout.redirect.uris" : "+",
+      "pkce.code.challenge.method" : "S256"
+    },
+    "authenticationFlowBindingOverrides" : { },
+    "fullScopeAllowed" : false,
+    "nodeReRegistrationTimeout" : 0,
+    "protocolMappers" : [ {
+      "id" : "fb1cfc7e-f89e-4f83-8867-15f11caa9e43",
+      "name" : "audience resolve",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-audience-resolve-mapper",
+      "consentRequired" : false,
+      "config" : { }
+    } ],
+    "defaultClientScopes" : [ "web-origins", "acr", "profile", "roles", "email" ],
+    "optionalClientScopes" : [ "address", "phone", "offline_access", "microprofile-jwt" ]
+  }, {
+    "id" : "4f27b95d-178c-4d58-9781-af263ce0e103",
+    "clientId" : "admin-cli",
+    "name" : "${client_admin-cli}",
+    "surrogateAuthRequired" : false,
+    "enabled" : true,
+    "alwaysDisplayInConsole" : false,
+    "clientAuthenticatorType" : "client-secret",
+    "redirectUris" : [ ],
+    "webOrigins" : [ ],
+    "notBefore" : 0,
+    "bearerOnly" : false,
+    "consentRequired" : false,
+    "standardFlowEnabled" : false,
+    "implicitFlowEnabled" : false,
+    "directAccessGrantsEnabled" : true,
+    "serviceAccountsEnabled" : false,
+    "publicClient" : true,
+    "frontchannelLogout" : false,
+    "protocol" : "openid-connect",
+    "attributes" : { },
+    "authenticationFlowBindingOverrides" : { },
+    "fullScopeAllowed" : false,
+    "nodeReRegistrationTimeout" : 0,
+    "defaultClientScopes" : [ "web-origins", "acr", "profile", "roles", "email" ],
+    "optionalClientScopes" : [ "address", "phone", "offline_access", "microprofile-jwt" ]
+  }, {
+    "id" : "a08b7887-c106-4c2e-ae24-6bbd59ea28ce",
+    "clientId" : "broker",
+    "name" : "${client_broker}",
+    "surrogateAuthRequired" : false,
+    "enabled" : true,
+    "alwaysDisplayInConsole" : false,
+    "clientAuthenticatorType" : "client-secret",
+    "redirectUris" : [ ],
+    "webOrigins" : [ ],
+    "notBefore" : 0,
+    "bearerOnly" : true,
+    "consentRequired" : false,
+    "standardFlowEnabled" : true,
+    "implicitFlowEnabled" : false,
+    "directAccessGrantsEnabled" : false,
+    "serviceAccountsEnabled" : false,
+    "publicClient" : false,
+    "frontchannelLogout" : false,
+    "protocol" : "openid-connect",
+    "attributes" : { },
+    "authenticationFlowBindingOverrides" : { },
+    "fullScopeAllowed" : false,
+    "nodeReRegistrationTimeout" : 0,
+    "defaultClientScopes" : [ "web-origins", "acr", "profile", "roles", "email" ],
+    "optionalClientScopes" : [ "address", "phone", "offline_access", "microprofile-jwt" ]
+  }, {
+    "id" : "37063f77-0a28-48a8-8000-9f9e2916b4ea",
+    "clientId" : "master-realm",
+    "name" : "master Realm",
+    "surrogateAuthRequired" : false,
+    "enabled" : true,
+    "alwaysDisplayInConsole" : false,
+    "clientAuthenticatorType" : "client-secret",
+    "redirectUris" : [ ],
+    "webOrigins" : [ ],
+    "notBefore" : 0,
+    "bearerOnly" : true,
+    "consentRequired" : false,
+    "standardFlowEnabled" : true,
+    "implicitFlowEnabled" : false,
+    "directAccessGrantsEnabled" : false,
+    "serviceAccountsEnabled" : false,
+    "publicClient" : false,
+    "frontchannelLogout" : false,
+    "attributes" : { },
+    "authenticationFlowBindingOverrides" : { },
+    "fullScopeAllowed" : false,
+    "nodeReRegistrationTimeout" : 0,
+    "defaultClientScopes" : [ "web-origins", "acr", "profile", "roles", "email" ],
+    "optionalClientScopes" : [ "address", "phone", "offline_access", "microprofile-jwt" ]
+  }, {
+    "id" : "7c57a7d5-f160-4812-a44b-50a5d3b9ae18",
+    "clientId" : "pitc-realm",
+    "name" : "pitc Realm",
+    "surrogateAuthRequired" : false,
+    "enabled" : true,
+    "alwaysDisplayInConsole" : false,
+    "clientAuthenticatorType" : "client-secret",
+    "redirectUris" : [ ],
+    "webOrigins" : [ ],
+    "notBefore" : 0,
+    "bearerOnly" : true,
+    "consentRequired" : false,
+    "standardFlowEnabled" : true,
+    "implicitFlowEnabled" : false,
+    "directAccessGrantsEnabled" : false,
+    "serviceAccountsEnabled" : false,
+    "publicClient" : false,
+    "frontchannelLogout" : false,
+    "attributes" : { },
+    "authenticationFlowBindingOverrides" : { },
+    "fullScopeAllowed" : false,
+    "nodeReRegistrationTimeout" : 0,
+    "defaultClientScopes" : [ ],
+    "optionalClientScopes" : [ ]
+  }, {
+    "id" : "0786024c-dc96-4819-bd24-40b5856e0af5",
+    "clientId" : "security-admin-console",
+    "name" : "${client_security-admin-console}",
+    "rootUrl" : "${authAdminUrl}",
+    "baseUrl" : "/admin/master/console/",
+    "surrogateAuthRequired" : false,
+    "enabled" : true,
+    "alwaysDisplayInConsole" : false,
+    "clientAuthenticatorType" : "client-secret",
+    "redirectUris" : [ "/admin/master/console/*" ],
+    "webOrigins" : [ "+" ],
+    "notBefore" : 0,
+    "bearerOnly" : false,
+    "consentRequired" : false,
+    "standardFlowEnabled" : true,
+    "implicitFlowEnabled" : false,
+    "directAccessGrantsEnabled" : false,
+    "serviceAccountsEnabled" : false,
+    "publicClient" : true,
+    "frontchannelLogout" : false,
+    "protocol" : "openid-connect",
+    "attributes" : {
+      "post.logout.redirect.uris" : "+",
+      "pkce.code.challenge.method" : "S256"
+    },
+    "authenticationFlowBindingOverrides" : { },
+    "fullScopeAllowed" : false,
+    "nodeReRegistrationTimeout" : 0,
+    "protocolMappers" : [ {
+      "id" : "0d77f835-e55c-41bf-943b-f5027a1e5e38",
+      "name" : "locale",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usermodel-attribute-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "introspection.token.claim" : "true",
+        "userinfo.token.claim" : "true",
+        "user.attribute" : "locale",
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "locale",
+        "jsonType.label" : "String"
+      }
+    } ],
+    "defaultClientScopes" : [ "web-origins", "acr", "profile", "roles", "email" ],
+    "optionalClientScopes" : [ "address", "phone", "offline_access", "microprofile-jwt" ]
+  } ],
+  "clientScopes" : [ {
+    "id" : "43fbe103-2bb1-4443-a26a-85e9c1938b68",
+    "name" : "address",
+    "description" : "OpenID Connect built-in scope: address",
+    "protocol" : "openid-connect",
+    "attributes" : {
+      "include.in.token.scope" : "true",
+      "display.on.consent.screen" : "true",
+      "consent.screen.text" : "${addressScopeConsentText}"
+    },
+    "protocolMappers" : [ {
+      "id" : "2244a163-3775-4f68-a182-3fefec239b55",
+      "name" : "address",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-address-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "user.attribute.formatted" : "formatted",
+        "user.attribute.country" : "country",
+        "introspection.token.claim" : "true",
+        "user.attribute.postal_code" : "postal_code",
+        "userinfo.token.claim" : "true",
+        "user.attribute.street" : "street",
+        "id.token.claim" : "true",
+        "user.attribute.region" : "region",
+        "access.token.claim" : "true",
+        "user.attribute.locality" : "locality"
+      }
+    } ]
+  }, {
+    "id" : "d87ab334-7df0-4c72-963c-2cca7a89785e",
+    "name" : "web-origins",
+    "description" : "OpenID Connect scope for add allowed web origins to the access token",
+    "protocol" : "openid-connect",
+    "attributes" : {
+      "include.in.token.scope" : "false",
+      "display.on.consent.screen" : "false",
+      "consent.screen.text" : ""
+    },
+    "protocolMappers" : [ {
+      "id" : "071e16db-7442-408e-a436-14c58670ddde",
+      "name" : "allowed web origins",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-allowed-origins-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "introspection.token.claim" : "true",
+        "access.token.claim" : "true"
+      }
+    } ]
+  }, {
+    "id" : "50a61fad-a9b3-4fc7-b474-a4e1f14fb087",
+    "name" : "profile",
+    "description" : "OpenID Connect built-in scope: profile",
+    "protocol" : "openid-connect",
+    "attributes" : {
+      "include.in.token.scope" : "true",
+      "display.on.consent.screen" : "true",
+      "consent.screen.text" : "${profileScopeConsentText}"
+    },
+    "protocolMappers" : [ {
+      "id" : "0b4c38ff-0084-4378-98a2-b279785d77a3",
+      "name" : "locale",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usermodel-attribute-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "introspection.token.claim" : "true",
+        "userinfo.token.claim" : "true",
+        "user.attribute" : "locale",
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "locale",
+        "jsonType.label" : "String"
+      }
+    }, {
+      "id" : "e255eb2a-9930-4264-afcb-faf70b998177",
+      "name" : "middle name",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usermodel-attribute-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "introspection.token.claim" : "true",
+        "userinfo.token.claim" : "true",
+        "user.attribute" : "middleName",
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "middle_name",
+        "jsonType.label" : "String"
+      }
+    }, {
+      "id" : "19311a7d-9e05-4568-a81f-259827e9b12f",
+      "name" : "website",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usermodel-attribute-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "introspection.token.claim" : "true",
+        "userinfo.token.claim" : "true",
+        "user.attribute" : "website",
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "website",
+        "jsonType.label" : "String"
+      }
+    }, {
+      "id" : "8fd8ce65-9c03-42fb-8e5f-f8a5340dcbf5",
+      "name" : "updated at",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usermodel-attribute-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "introspection.token.claim" : "true",
+        "userinfo.token.claim" : "true",
+        "user.attribute" : "updatedAt",
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "updated_at",
+        "jsonType.label" : "long"
+      }
+    }, {
+      "id" : "a971119e-06e9-4337-a41b-146c27abddc3",
+      "name" : "gender",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usermodel-attribute-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "introspection.token.claim" : "true",
+        "userinfo.token.claim" : "true",
+        "user.attribute" : "gender",
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "gender",
+        "jsonType.label" : "String"
+      }
+    }, {
+      "id" : "d5d30a4d-90c4-4dcb-84d1-89c2a4e0dabf",
+      "name" : "zoneinfo",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usermodel-attribute-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "introspection.token.claim" : "true",
+        "userinfo.token.claim" : "true",
+        "user.attribute" : "zoneinfo",
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "zoneinfo",
+        "jsonType.label" : "String"
+      }
+    }, {
+      "id" : "3e8b7456-4c9c-4851-bad5-99b3d4087036",
+      "name" : "username",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usermodel-attribute-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "introspection.token.claim" : "true",
+        "userinfo.token.claim" : "true",
+        "user.attribute" : "username",
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "preferred_username",
+        "jsonType.label" : "String"
+      }
+    }, {
+      "id" : "5242feba-1554-4a98-97b1-090477479126",
+      "name" : "nickname",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usermodel-attribute-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "introspection.token.claim" : "true",
+        "userinfo.token.claim" : "true",
+        "user.attribute" : "nickname",
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "nickname",
+        "jsonType.label" : "String"
+      }
+    }, {
+      "id" : "5483dfaa-e131-4ace-89e3-b27b4725066d",
+      "name" : "full name",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-full-name-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "id.token.claim" : "true",
+        "introspection.token.claim" : "true",
+        "access.token.claim" : "true",
+        "userinfo.token.claim" : "true"
+      }
+    }, {
+      "id" : "96b45389-149f-4a29-b773-572593edf082",
+      "name" : "given name",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usermodel-attribute-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "introspection.token.claim" : "true",
+        "userinfo.token.claim" : "true",
+        "user.attribute" : "firstName",
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "given_name",
+        "jsonType.label" : "String"
+      }
+    }, {
+      "id" : "5353d4d3-40be-4ede-9c22-7079f32a2765",
+      "name" : "birthdate",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usermodel-attribute-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "introspection.token.claim" : "true",
+        "userinfo.token.claim" : "true",
+        "user.attribute" : "birthdate",
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "birthdate",
+        "jsonType.label" : "String"
+      }
+    }, {
+      "id" : "945e82ce-5262-48fc-9c83-4dca53f8b2ca",
+      "name" : "profile",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usermodel-attribute-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "introspection.token.claim" : "true",
+        "userinfo.token.claim" : "true",
+        "user.attribute" : "profile",
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "profile",
+        "jsonType.label" : "String"
+      }
+    }, {
+      "id" : "fe482d5f-2951-4ffb-8f2c-61ba6b02360a",
+      "name" : "picture",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usermodel-attribute-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "introspection.token.claim" : "true",
+        "userinfo.token.claim" : "true",
+        "user.attribute" : "picture",
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "picture",
+        "jsonType.label" : "String"
+      }
+    }, {
+      "id" : "363079de-18ab-4a85-a372-0fe880d23879",
+      "name" : "family name",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usermodel-attribute-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "introspection.token.claim" : "true",
+        "userinfo.token.claim" : "true",
+        "user.attribute" : "lastName",
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "family_name",
+        "jsonType.label" : "String"
+      }
+    } ]
+  }, {
+    "id" : "2d7831d3-53be-4f59-967d-b69c01412b74",
+    "name" : "acr",
+    "description" : "OpenID Connect scope for add acr (authentication context class reference) to the token",
+    "protocol" : "openid-connect",
+    "attributes" : {
+      "include.in.token.scope" : "false",
+      "display.on.consent.screen" : "false"
+    },
+    "protocolMappers" : [ {
+      "id" : "3fad6bf9-8e32-486b-8288-faa9548fa0bd",
+      "name" : "acr loa level",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-acr-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "id.token.claim" : "true",
+        "introspection.token.claim" : "true",
+        "access.token.claim" : "true"
+      }
+    } ]
+  }, {
+    "id" : "7635a565-9daf-4710-91b5-716148ad4709",
+    "name" : "email",
+    "description" : "OpenID Connect built-in scope: email",
+    "protocol" : "openid-connect",
+    "attributes" : {
+      "include.in.token.scope" : "true",
+      "display.on.consent.screen" : "true",
+      "consent.screen.text" : "${emailScopeConsentText}"
+    },
+    "protocolMappers" : [ {
+      "id" : "991b87e9-fb7c-4fcf-984e-5246747fb91f",
+      "name" : "email verified",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usermodel-property-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "introspection.token.claim" : "true",
+        "userinfo.token.claim" : "true",
+        "user.attribute" : "emailVerified",
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "email_verified",
+        "jsonType.label" : "boolean"
+      }
+    }, {
+      "id" : "84ed06d7-6ef9-4809-8eb9-45c4a7c23235",
+      "name" : "email",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usermodel-attribute-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "introspection.token.claim" : "true",
+        "userinfo.token.claim" : "true",
+        "user.attribute" : "email",
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "email",
+        "jsonType.label" : "String"
+      }
+    } ]
+  }, {
+    "id" : "81d2acab-bc05-4c45-a022-1b82dd590ce3",
+    "name" : "offline_access",
+    "description" : "OpenID Connect built-in scope: offline_access",
+    "protocol" : "openid-connect",
+    "attributes" : {
+      "consent.screen.text" : "${offlineAccessScopeConsentText}",
+      "display.on.consent.screen" : "true"
+    }
+  }, {
+    "id" : "c1ed03bb-634e-4f82-acb2-49c481419489",
+    "name" : "role_list",
+    "description" : "SAML role list",
+    "protocol" : "saml",
+    "attributes" : {
+      "consent.screen.text" : "${samlRoleListScopeConsentText}",
+      "display.on.consent.screen" : "true"
+    },
+    "protocolMappers" : [ {
+      "id" : "de05380a-bbc4-4c53-a433-f1e1d3653a62",
+      "name" : "role list",
+      "protocol" : "saml",
+      "protocolMapper" : "saml-role-list-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "single" : "false",
+        "attribute.nameformat" : "Basic",
+        "attribute.name" : "Role"
+      }
+    } ]
+  }, {
+    "id" : "40d811dc-f916-49c3-9d44-d7620ac94f08",
+    "name" : "phone",
+    "description" : "OpenID Connect built-in scope: phone",
+    "protocol" : "openid-connect",
+    "attributes" : {
+      "include.in.token.scope" : "true",
+      "display.on.consent.screen" : "true",
+      "consent.screen.text" : "${phoneScopeConsentText}"
+    },
+    "protocolMappers" : [ {
+      "id" : "c414a7d7-d49b-4e54-a893-2322474e6e30",
+      "name" : "phone number verified",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usermodel-attribute-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "introspection.token.claim" : "true",
+        "userinfo.token.claim" : "true",
+        "user.attribute" : "phoneNumberVerified",
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "phone_number_verified",
+        "jsonType.label" : "boolean"
+      }
+    }, {
+      "id" : "83cfae63-edbc-473d-bcce-cb0a2be5c4bf",
+      "name" : "phone number",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usermodel-attribute-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "introspection.token.claim" : "true",
+        "userinfo.token.claim" : "true",
+        "user.attribute" : "phoneNumber",
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "phone_number",
+        "jsonType.label" : "String"
+      }
+    } ]
+  }, {
+    "id" : "0ee6bfad-6be9-47fb-88b9-5d37223ca324",
+    "name" : "microprofile-jwt",
+    "description" : "Microprofile - JWT built-in scope",
+    "protocol" : "openid-connect",
+    "attributes" : {
+      "include.in.token.scope" : "true",
+      "display.on.consent.screen" : "false"
+    },
+    "protocolMappers" : [ {
+      "id" : "ca214b43-bfb5-43a7-9ce0-17c77cfabe0a",
+      "name" : "upn",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usermodel-attribute-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "introspection.token.claim" : "true",
+        "userinfo.token.claim" : "true",
+        "user.attribute" : "username",
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "upn",
+        "jsonType.label" : "String"
+      }
+    }, {
+      "id" : "d9bc5495-623c-4651-b920-60e14d72e25d",
+      "name" : "groups",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usermodel-realm-role-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "introspection.token.claim" : "true",
+        "multivalued" : "true",
+        "user.attribute" : "foo",
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "groups",
+        "jsonType.label" : "String"
+      }
+    } ]
+  }, {
+    "id" : "511bb644-94ee-49af-aebe-c22740196d88",
+    "name" : "roles",
+    "description" : "OpenID Connect scope for add user roles to the access token",
+    "protocol" : "openid-connect",
+    "attributes" : {
+      "include.in.token.scope" : "false",
+      "display.on.consent.screen" : "true",
+      "consent.screen.text" : "${rolesScopeConsentText}"
+    },
+    "protocolMappers" : [ {
+      "id" : "e551482e-23c7-4c09-8405-d93ba32fb734",
+      "name" : "audience resolve",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-audience-resolve-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "introspection.token.claim" : "true",
+        "access.token.claim" : "true"
+      }
+    }, {
+      "id" : "c97eec07-a071-46ca-aba7-4e6b3b2a3e71",
+      "name" : "realm roles",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usermodel-realm-role-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "introspection.token.claim" : "true",
+        "multivalued" : "true",
+        "user.attribute" : "foo",
+        "access.token.claim" : "true",
+        "claim.name" : "realm_access.roles",
+        "jsonType.label" : "String"
+      }
+    }, {
+      "id" : "6b593ce0-c52a-432c-bf71-47cdd32a9990",
+      "name" : "client roles",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usermodel-client-role-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "introspection.token.claim" : "true",
+        "multivalued" : "true",
+        "user.attribute" : "foo",
+        "access.token.claim" : "true",
+        "claim.name" : "resource_access.${client_id}.roles",
+        "jsonType.label" : "String"
+      }
+    } ]
+  } ],
+  "defaultDefaultClientScopes" : [ "role_list", "profile", "email", "roles", "web-origins", "acr" ],
+  "defaultOptionalClientScopes" : [ "offline_access", "address", "phone", "microprofile-jwt" ],
+  "browserSecurityHeaders" : {
+    "contentSecurityPolicyReportOnly" : "",
+    "xContentTypeOptions" : "nosniff",
+    "referrerPolicy" : "no-referrer",
+    "xRobotsTag" : "none",
+    "xFrameOptions" : "SAMEORIGIN",
+    "xXSSProtection" : "1; mode=block",
+    "contentSecurityPolicy" : "frame-src 'self'; frame-ancestors 'self'; object-src 'none';",
+    "strictTransportSecurity" : "max-age=31536000; includeSubDomains"
+  },
+  "smtpServer" : { },
+  "eventsEnabled" : false,
+  "eventsListeners" : [ "jboss-logging" ],
+  "enabledEventTypes" : [ ],
+  "adminEventsEnabled" : false,
+  "adminEventsDetailsEnabled" : false,
+  "identityProviders" : [ ],
+  "identityProviderMappers" : [ ],
+  "components" : {
+    "org.keycloak.services.clientregistration.policy.ClientRegistrationPolicy" : [ {
+      "id" : "e77ae79f-719a-49fa-90ff-d9ee3172c940",
+      "name" : "Trusted Hosts",
+      "providerId" : "trusted-hosts",
+      "subType" : "anonymous",
+      "subComponents" : { },
+      "config" : {
+        "host-sending-registration-request-must-match" : [ "true" ],
+        "client-uris-must-match" : [ "true" ]
+      }
+    }, {
+      "id" : "5cca4abd-a4c2-433e-94cb-d52413f85987",
+      "name" : "Allowed Client Scopes",
+      "providerId" : "allowed-client-templates",
+      "subType" : "authenticated",
+      "subComponents" : { },
+      "config" : {
+        "allow-default-scopes" : [ "true" ]
+      }
+    }, {
+      "id" : "1e16ed7a-233a-47ef-9b7b-847dddd376d1",
+      "name" : "Consent Required",
+      "providerId" : "consent-required",
+      "subType" : "anonymous",
+      "subComponents" : { },
+      "config" : { }
+    }, {
+      "id" : "9f5be23a-6788-45fb-a6f1-9cc030a9a527",
+      "name" : "Allowed Client Scopes",
+      "providerId" : "allowed-client-templates",
+      "subType" : "anonymous",
+      "subComponents" : { },
+      "config" : {
+        "allow-default-scopes" : [ "true" ]
+      }
+    }, {
+      "id" : "fb681d2f-cd42-4067-8f7b-cb2fb18faf26",
+      "name" : "Allowed Protocol Mapper Types",
+      "providerId" : "allowed-protocol-mappers",
+      "subType" : "authenticated",
+      "subComponents" : { },
+      "config" : {
+        "allowed-protocol-mapper-types" : [ "oidc-sha256-pairwise-sub-mapper", "oidc-usermodel-attribute-mapper", "saml-user-property-mapper", "oidc-usermodel-property-mapper", "oidc-full-name-mapper", "saml-role-list-mapper", "oidc-address-mapper", "saml-user-attribute-mapper" ]
+      }
+    }, {
+      "id" : "ed35a502-cd3a-41f0-9b2a-9f80089d288e",
+      "name" : "Full Scope Disabled",
+      "providerId" : "scope",
+      "subType" : "anonymous",
+      "subComponents" : { },
+      "config" : { }
+    }, {
+      "id" : "c4638b5e-21ae-4ca6-b5ef-a860f8b8aa49",
+      "name" : "Allowed Protocol Mapper Types",
+      "providerId" : "allowed-protocol-mappers",
+      "subType" : "anonymous",
+      "subComponents" : { },
+      "config" : {
+        "allowed-protocol-mapper-types" : [ "oidc-usermodel-attribute-mapper", "oidc-usermodel-property-mapper", "oidc-address-mapper", "oidc-full-name-mapper", "saml-user-property-mapper", "saml-role-list-mapper", "oidc-sha256-pairwise-sub-mapper", "saml-user-attribute-mapper" ]
+      }
+    }, {
+      "id" : "0c8fd7a4-49a9-4f60-9ba1-d43e3b26d038",
+      "name" : "Max Clients Limit",
+      "providerId" : "max-clients",
+      "subType" : "anonymous",
+      "subComponents" : { },
+      "config" : {
+        "max-clients" : [ "200" ]
+      }
+    } ],
+    "org.keycloak.userprofile.UserProfileProvider" : [ {
+      "id" : "23dfc9d9-166a-4430-9cab-878a99964f5e",
+      "providerId" : "declarative-user-profile",
+      "subComponents" : { },
+      "config" : {
+        "kc.user.profile.config" : [ "{\"attributes\":[{\"name\":\"username\",\"displayName\":\"${username}\",\"validations\":{\"length\":{\"min\":3,\"max\":255},\"username-prohibited-characters\":{},\"up-username-not-idn-homograph\":{}},\"permissions\":{\"view\":[\"admin\",\"user\"],\"edit\":[\"admin\",\"user\"]},\"multivalued\":false},{\"name\":\"email\",\"displayName\":\"${email}\",\"validations\":{\"email\":{},\"length\":{\"max\":255}},\"permissions\":{\"view\":[\"admin\",\"user\"],\"edit\":[\"admin\",\"user\"]},\"multivalued\":false},{\"name\":\"firstName\",\"displayName\":\"${firstName}\",\"validations\":{\"length\":{\"max\":255},\"person-name-prohibited-characters\":{}},\"permissions\":{\"view\":[\"admin\",\"user\"],\"edit\":[\"admin\",\"user\"]},\"multivalued\":false},{\"name\":\"lastName\",\"displayName\":\"${lastName}\",\"validations\":{\"length\":{\"max\":255},\"person-name-prohibited-characters\":{}},\"permissions\":{\"view\":[\"admin\",\"user\"],\"edit\":[\"admin\",\"user\"]},\"multivalued\":false}],\"groups\":[{\"name\":\"user-metadata\",\"displayHeader\":\"User metadata\",\"displayDescription\":\"Attributes, which refer to user metadata\"}]}" ]
+      }
+    } ],
+    "org.keycloak.keys.KeyProvider" : [ {
+      "id" : "7f5fc741-fae2-4325-b5ea-665d2091cf61",
+      "name" : "rsa-enc-generated",
+      "providerId" : "rsa-enc-generated",
+      "subComponents" : { },
+      "config" : {
+        "privateKey" : [ "MIIEpAIBAAKCAQEAomS49I5oi8y/a4Et40GoLKUUFgApFAAAZ6XmZaa3hac2kxzaYfUrdGRVOO/FeUKUsO8qPUNfd3HYkuSLaGcsabpo3nNeEJNAI6SKK2tYktHEyWe3Xyoi7SSytZdxQmtA3WIFyRI/xiTGyCOEI3pQz22/Y/PIkIRNxlcBj4N6SULhY8zovCliZWg6iWyzmy+2of3378NInJOKfhFkt6LZaHteuaMvu9aqbe1ZqxNvVyakBYN/xwU8UQ1UPx3PHLzY8ljbEywWo5TK6Z13yQaswYJH9WByhdmLkOr0BU4u39v3tR1iNe0RkEXNP7KfNDLMG5DaMCSF0cdyodY9IDL6qwIDAQABAoIBAEVXXOKQLHQFaXcuIbn4PydRFdKPHvs7RPD9FfQxzAt16wfGOjm5xmRcs0csmtW8aGFkvlSKgCkwo5mVnTFnXL+IqV7TREcvmSOfDqCbpaaLi8u0TciE5YT9NpHzqJkD0x60zGOfNzwUWAz9nV7Iy9jGtAKqBeovlEYswK3XJlBBX0BkcnBLf1KEy8YHT7hgdUjqrYsllmxeqbGNz+wh6jeLopHFkC8y8HAuBIqq0FvMsLTxDF3A70a4fAxg53iN8zAx0R3xCZB2dvLSEI8jyTHgq7RVY+dOmcFKAssWeAUzf2+2YvFSgGaxcXMIQzleOZbanjY4nuH/qC7p3qsIUwECgYEA5adxwq43DGcfV+Umt+qIQIwSkMU8jS/xnvwR6X6ibH/PVJEtJgv/OXbQdzM5stAKsgqqltqLcEHyCgtB7S7OwWQycq0uhkonFskmYUqO8KPBQVzc8Up/Dw+wrJ6lV7FHDzejtGk9RY5ayPAhY+uy+x2gGot89h4qeenxqrdDLgMCgYEAtQXyLQltlRi9aTPVX17VAOeFUw9rWMDlDErk+ZhFdCQLYUWDod4Q0kW6MEHYnGmRzfVE6yFW/QXQeEOx1t18sdh1ul4RG9Nam5kjL/OGALYuPUrIE6Gkih4/XU9NVM51P/1ZTpbF4gZwSOrGvtq1gcJ52bByrODayur0/MaMlDkCgYABukG70i2t1TTCJ4IkDgqaWbNmDWXINh0eMg08cWxtXoTDwRfS2nJAD2nAC82aT8BU2Imx+tDjtktI0g7b5uc9QzCx9iWMcxBaNocoYjQzEThJ8pXi5smP5nFQyxy5TScYsTV1DPmeBVUff9bwdnxxMSbcLEJzY4S0SBM+UoSZ2wKBgQCDS9LBU6tFjvIi0dObHr9DrqkG+5ISh6YZ6mB1oDoP6OzQGolE6DovKR/ITJn9qJx2U8Uu/bmIP6Va9U6R14fPvn51NDEYi42WedYJu4mgDoMvNYQ0qPMcsp+m4BPoxO5KAUm7NKRGMgFTAeYxG5S2jwWuHMqwFU7cCtqyVJg2EQKBgQDStwd+4SdnW1DfmXu2razhzYdyFFTg/Ot8WF50PX0t6e0/xRCqm49m8wrBAEsbERqcCGAcNdfeZ3e+0rRfrRZ11y7G7nRaVSR05Gu8xuTPRMWiqTCMdH1faBOlM3+b2QEmtUdhQWSSta9cdhnTIVMDc7OQebnQgvg6Lp8w3ardRw==" ],
+        "keyUse" : [ "ENC" ],
+        "certificate" : [ "MIICmzCCAYMCBgGQgSEIeTANBgkqhkiG9w0BAQsFADARMQ8wDQYDVQQDDAZtYXN0ZXIwHhcNMjQwNzA1MDQyMDQ0WhcNMzQwNzA1MDQyMjI0WjARMQ8wDQYDVQQDDAZtYXN0ZXIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCiZLj0jmiLzL9rgS3jQagspRQWACkUAABnpeZlpreFpzaTHNph9St0ZFU478V5QpSw7yo9Q193cdiS5ItoZyxpumjec14Qk0AjpIora1iS0cTJZ7dfKiLtJLK1l3FCa0DdYgXJEj/GJMbII4QjelDPbb9j88iQhE3GVwGPg3pJQuFjzOi8KWJlaDqJbLObL7ah/ffvw0ick4p+EWS3otloe165oy+71qpt7VmrE29XJqQFg3/HBTxRDVQ/Hc8cvNjyWNsTLBajlMrpnXfJBqzBgkf1YHKF2YuQ6vQFTi7f2/e1HWI17RGQRc0/sp80MswbkNowJIXRx3Kh1j0gMvqrAgMBAAEwDQYJKoZIhvcNAQELBQADggEBAAGRhVWM6JEOmkU/cdbRmIbW51qryeQCidXO7tfwZIEu2sr5zJoqXzPGKPTpr+st5K1h37ButvD1N+vgIN6JDuQ2s+p53yFN+YlowScIJ0Qdh8FVBvAn34UOz7R5Qrsegq/uAIhE5LTZ5ekBGZ3pszGc0R/BsnOY8OAMHfzNERu2v9STG58ioWqRhpVtWRqw8Kggt7bCAI9DMPy1Q94TDkNVV+b6TUT9t0pYvqyyKXcmEtbjPgE5BfrDlIAUatyg2f0j1dn4Qi8MgD+WJeFCAXzLD+e1i4Iqcr9Ms6BwRw5rvy1Z0umTLSEJwq7tcSqsh0vpbkV5ck4xVijNQWi8c9g=" ],
+        "priority" : [ "100" ],
+        "algorithm" : [ "RSA-OAEP" ]
+      }
+    }, {
+      "id" : "8a94a00e-74f4-4940-b526-57bd74aebeab",
+      "name" : "aes-generated",
+      "providerId" : "aes-generated",
+      "subComponents" : { },
+      "config" : {
+        "kid" : [ "79982853-4fcb-4f52-8981-556070d82d8a" ],
+        "secret" : [ "YyqvUDAD-pNdiHCaLeDE7Q" ],
+        "priority" : [ "100" ]
+      }
+    }, {
+      "id" : "0b135d72-18dc-4aed-a806-f911a657c055",
+      "name" : "rsa-generated",
+      "providerId" : "rsa-generated",
+      "subComponents" : { },
+      "config" : {
+        "privateKey" : [ "MIIEpQIBAAKCAQEA0rmn/MLyIZinO4kSVcR68ay8XVFR8rF1+M0iDjoZDYy3pYceBJVAyy2Xx3aSQOwJPZfdgH3K8PdKrkKtEx6idGkfidudzVXzxNo4DefTkCWgnEfnA9JvU/xghia3bseZAgZZmwuZOAdSerAHHNIHcrfY8gQiWGLkNLvdC/dggECPYT9O+Ye4Fkvvw2xTkmTGtvJC0e/v/Pk5Yk7bYcvhs9P4y0jVF2BnZA3MQmbQ1C2cxJUIrlalvr4/PiZqqE+Uz7gnmwSROOzqeusCwGTdqHzZga6mqYvVuloLfLJlysPtUVddS2tUVxnXMOyrc/YJSL35NPBZImpJD6IRwhzCDQIDAQABAoIBACT86JMx5s1l3ajSGRFL8Sadotygawl2A9adryYfJYme0xdvfaHhTuO7B4K/+dECfWa90uf8bJRaW9X1pyqNfIeBckNA9NR3i1fY0/EA6b5KFISKDG87z0XHLWwuvJDp4R4dXjocUZMnmd8mKcFxzlPhGGf2uM6Z4SOufBDfJaWtHbM1rluMNQCtDDQhi5bOYdF6++zCiKzrA2MS2Kli812tPLii+36/11FJsdXmoNpKvSrNE52xS/KkoJ16KTBkDpSBFrjOgrzsUTxvSS7Oz+Rtvpx54ax2onxhcx+I6cbcSP2mEsvwqftxyWfkwQvKJ9w3MwY+xu8Tj0JXMTqwYFMCgYEA9auUnUvw40o2a+O2ieWOSwWwQI3LfuUZEn6lwhVvS+MyxPLPsqiBVvvj77BPNhKwq3Q14E/n5iBXxSB6ux+G5IuIiKW9u4hlyBGhUeaSNA/EQIrJy4704h7Ph7dxqs8c6w3Hwfr+oQLACvOp3cZ9oNB6d3GXnuKhD7EWFOLDYqMCgYEA25XsiANpIZ72dlQJsSSwGmw9vPj9vks2KxfocJtn3MfK4v/QW0PQNT7knYAcmExrGIN+vPQX5hYXoABM23Z2nbdY4ti4MjOJWFxYu2LXa5/q0CCe3QhEhgcvgar4TwLcf/e3stvTPOyVxqNtCwUiyDiMhGmcgnBsKT+ahKW4Q48CgYEA1NkE2Mer/HEW96ECTTVLdGqIS1XO4rGBaIm7+YzysbA2E3dARk1CSmfRE6EQ8At/b/0ulJsGk1agVNWQIEHvcGIIOERJP4qsjIvh1gDL2Tlz0mus7KV+O89wBOkGHXR2XJzC3qklJcEpPBPir5hCzirygDw1nl5CJ0NJm2zg1bsCgYEAsMTScvP78Brd4YfpfXdBZSP512TCMCyv4KUQc4ZHaE5WH8M74hyHQjXtKHV3j4sFM+i3YDlH++uQ/TcAqDOHbZOptIQuVAt053L/42nAbV2BVCbOfLUpJJQoRER0PHbbNxEeCpg4RvVV5WCuaY6q32/WfsneOotyJwqSw3H9EjUCgYEAvpaUkpo5w54bs+IprgzEF5uWfMzJJgfNJqXC989H94L7eYHIAfRajqaIWcDGruB5O+UxS5w1rF2gu30W3DzWpErmkeftmBOO+vwxgWSSmaSLSLEeEh6EbT2iQs6wlZNnZudzTBZ+jR7TWogSPJC1lPBZLKJC3sD4oXFEXpFBkm8=" ],
+        "keyUse" : [ "SIG" ],
+        "certificate" : [ "MIICmzCCAYMCBgGQgSEHJTANBgkqhkiG9w0BAQsFADARMQ8wDQYDVQQDDAZtYXN0ZXIwHhcNMjQwNzA1MDQyMDQzWhcNMzQwNzA1MDQyMjIzWjARMQ8wDQYDVQQDDAZtYXN0ZXIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDSuaf8wvIhmKc7iRJVxHrxrLxdUVHysXX4zSIOOhkNjLelhx4ElUDLLZfHdpJA7Ak9l92Afcrw90quQq0THqJ0aR+J253NVfPE2jgN59OQJaCcR+cD0m9T/GCGJrdux5kCBlmbC5k4B1J6sAcc0gdyt9jyBCJYYuQ0u90L92CAQI9hP075h7gWS+/DbFOSZMa28kLR7+/8+TliTtthy+Gz0/jLSNUXYGdkDcxCZtDULZzElQiuVqW+vj8+JmqoT5TPuCebBJE47Op66wLAZN2ofNmBrqapi9W6Wgt8smXKw+1RV11La1RXGdcw7Ktz9glIvfk08FkiakkPohHCHMINAgMBAAEwDQYJKoZIhvcNAQELBQADggEBAI4t7ZCTHVNTAuEhK5AKDvxgMyLU/cU05hrCNAnz/Rs3VUhrqPHb738Wj4CfOvX6qGAkAuXheEP7XYCtwufZOWQh3ifEDFkMv8EpKa7tDF2vDitN3EQUpo7MuBq7l8QweURrcx1HCEcfxlLamlHnR440kUZmYYZiuqBGrX7eZ7ouFxloNyvOVBuKV9O3v4NTe+/CON12o+S0gH0q/ZA1ckOqoAXlI2Dy3A4fxZo8F/oEiKGUu9PQqSS+W9oKkJkwOQglhqfX9vghS2nQQ3TpFrwOOj5Y6VLnnbpgeGUvDRAWBwX+KQYK0Quj8ShG5h9I5RIUqITnNLRcPvC97bvM8aU=" ],
+        "priority" : [ "100" ]
+      }
+    }, {
+      "id" : "753c24ce-15f6-4525-a08d-7574ae5b1832",
+      "name" : "hmac-generated-hs512",
+      "providerId" : "hmac-generated",
+      "subComponents" : { },
+      "config" : {
+        "kid" : [ "5bc87c88-69af-41a0-8fe4-73ba82337276" ],
+        "secret" : [ "lvxM4nt03vaZtl4Yj0X-pYZTJ3bOASu0_VBhvyICIxziGlj7_eUFPgb8U4vD7tSl721Haif9Sc3IW6qunqYTOWEK7UMRL4VenpxQ_XjS0NpW3-rsgomORFiAYhIKv-oF6eJ4rqhzTxks4iZC44sh_ASOdweD-szSrka3NrFC2gs" ],
+        "priority" : [ "100" ],
+        "algorithm" : [ "HS512" ]
+      }
+    } ]
+  },
+  "internationalizationEnabled" : false,
+  "supportedLocales" : [ ],
+  "authenticationFlows" : [ {
+    "id" : "9333ebbd-b69f-434b-a623-2c81c727aa37",
+    "alias" : "Account verification options",
+    "description" : "Method with which to verity the existing account",
+    "providerId" : "basic-flow",
+    "topLevel" : false,
+    "builtIn" : true,
+    "authenticationExecutions" : [ {
+      "authenticator" : "idp-email-verification",
+      "authenticatorFlow" : false,
+      "requirement" : "ALTERNATIVE",
+      "priority" : 10,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticatorFlow" : true,
+      "requirement" : "ALTERNATIVE",
+      "priority" : 20,
+      "autheticatorFlow" : true,
+      "flowAlias" : "Verify Existing Account by Re-authentication",
+      "userSetupAllowed" : false
+    } ]
+  }, {
+    "id" : "f046666f-6256-4de1-9753-3efb4d048fa2",
+    "alias" : "Browser - Conditional OTP",
+    "description" : "Flow to determine if the OTP is required for the authentication",
+    "providerId" : "basic-flow",
+    "topLevel" : false,
+    "builtIn" : true,
+    "authenticationExecutions" : [ {
+      "authenticator" : "conditional-user-configured",
+      "authenticatorFlow" : false,
+      "requirement" : "REQUIRED",
+      "priority" : 10,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticator" : "auth-otp-form",
+      "authenticatorFlow" : false,
+      "requirement" : "REQUIRED",
+      "priority" : 20,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    } ]
+  }, {
+    "id" : "0f9eecf3-6c85-46ef-b0ea-08be60d46add",
+    "alias" : "Direct Grant - Conditional OTP",
+    "description" : "Flow to determine if the OTP is required for the authentication",
+    "providerId" : "basic-flow",
+    "topLevel" : false,
+    "builtIn" : true,
+    "authenticationExecutions" : [ {
+      "authenticator" : "conditional-user-configured",
+      "authenticatorFlow" : false,
+      "requirement" : "REQUIRED",
+      "priority" : 10,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticator" : "direct-grant-validate-otp",
+      "authenticatorFlow" : false,
+      "requirement" : "REQUIRED",
+      "priority" : 20,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    } ]
+  }, {
+    "id" : "e545c9f9-4890-4487-ae1d-8317ac07d27a",
+    "alias" : "First broker login - Conditional OTP",
+    "description" : "Flow to determine if the OTP is required for the authentication",
+    "providerId" : "basic-flow",
+    "topLevel" : false,
+    "builtIn" : true,
+    "authenticationExecutions" : [ {
+      "authenticator" : "conditional-user-configured",
+      "authenticatorFlow" : false,
+      "requirement" : "REQUIRED",
+      "priority" : 10,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticator" : "auth-otp-form",
+      "authenticatorFlow" : false,
+      "requirement" : "REQUIRED",
+      "priority" : 20,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    } ]
+  }, {
+    "id" : "228e5fc9-b224-40ee-b6b4-4e59893a3666",
+    "alias" : "Handle Existing Account",
+    "description" : "Handle what to do if there is existing account with same email/username like authenticated identity provider",
+    "providerId" : "basic-flow",
+    "topLevel" : false,
+    "builtIn" : true,
+    "authenticationExecutions" : [ {
+      "authenticator" : "idp-confirm-link",
+      "authenticatorFlow" : false,
+      "requirement" : "REQUIRED",
+      "priority" : 10,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticatorFlow" : true,
+      "requirement" : "REQUIRED",
+      "priority" : 20,
+      "autheticatorFlow" : true,
+      "flowAlias" : "Account verification options",
+      "userSetupAllowed" : false
+    } ]
+  }, {
+    "id" : "382a5aa2-0fbd-4380-977c-1ae8a49c7195",
+    "alias" : "Reset - Conditional OTP",
+    "description" : "Flow to determine if the OTP should be reset or not. Set to REQUIRED to force.",
+    "providerId" : "basic-flow",
+    "topLevel" : false,
+    "builtIn" : true,
+    "authenticationExecutions" : [ {
+      "authenticator" : "conditional-user-configured",
+      "authenticatorFlow" : false,
+      "requirement" : "REQUIRED",
+      "priority" : 10,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticator" : "reset-otp",
+      "authenticatorFlow" : false,
+      "requirement" : "REQUIRED",
+      "priority" : 20,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    } ]
+  }, {
+    "id" : "bf613920-43e9-4cf3-9a3f-b48c50626650",
+    "alias" : "User creation or linking",
+    "description" : "Flow for the existing/non-existing user alternatives",
+    "providerId" : "basic-flow",
+    "topLevel" : false,
+    "builtIn" : true,
+    "authenticationExecutions" : [ {
+      "authenticatorConfig" : "create unique user config",
+      "authenticator" : "idp-create-user-if-unique",
+      "authenticatorFlow" : false,
+      "requirement" : "ALTERNATIVE",
+      "priority" : 10,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticatorFlow" : true,
+      "requirement" : "ALTERNATIVE",
+      "priority" : 20,
+      "autheticatorFlow" : true,
+      "flowAlias" : "Handle Existing Account",
+      "userSetupAllowed" : false
+    } ]
+  }, {
+    "id" : "6586444b-5992-4ffb-8ae9-c87addf35389",
+    "alias" : "Verify Existing Account by Re-authentication",
+    "description" : "Reauthentication of existing account",
+    "providerId" : "basic-flow",
+    "topLevel" : false,
+    "builtIn" : true,
+    "authenticationExecutions" : [ {
+      "authenticator" : "idp-username-password-form",
+      "authenticatorFlow" : false,
+      "requirement" : "REQUIRED",
+      "priority" : 10,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticatorFlow" : true,
+      "requirement" : "CONDITIONAL",
+      "priority" : 20,
+      "autheticatorFlow" : true,
+      "flowAlias" : "First broker login - Conditional OTP",
+      "userSetupAllowed" : false
+    } ]
+  }, {
+    "id" : "8d7329ff-18f6-4d0c-8875-f1d4b5c6895d",
+    "alias" : "browser",
+    "description" : "browser based authentication",
+    "providerId" : "basic-flow",
+    "topLevel" : true,
+    "builtIn" : true,
+    "authenticationExecutions" : [ {
+      "authenticator" : "auth-cookie",
+      "authenticatorFlow" : false,
+      "requirement" : "ALTERNATIVE",
+      "priority" : 10,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticator" : "auth-spnego",
+      "authenticatorFlow" : false,
+      "requirement" : "DISABLED",
+      "priority" : 20,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticator" : "identity-provider-redirector",
+      "authenticatorFlow" : false,
+      "requirement" : "ALTERNATIVE",
+      "priority" : 25,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticatorFlow" : true,
+      "requirement" : "ALTERNATIVE",
+      "priority" : 30,
+      "autheticatorFlow" : true,
+      "flowAlias" : "forms",
+      "userSetupAllowed" : false
+    } ]
+  }, {
+    "id" : "7b944c8d-c237-40ae-b2ac-723e99a7fc10",
+    "alias" : "clients",
+    "description" : "Base authentication for clients",
+    "providerId" : "client-flow",
+    "topLevel" : true,
+    "builtIn" : true,
+    "authenticationExecutions" : [ {
+      "authenticator" : "client-secret",
+      "authenticatorFlow" : false,
+      "requirement" : "ALTERNATIVE",
+      "priority" : 10,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticator" : "client-jwt",
+      "authenticatorFlow" : false,
+      "requirement" : "ALTERNATIVE",
+      "priority" : 20,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticator" : "client-secret-jwt",
+      "authenticatorFlow" : false,
+      "requirement" : "ALTERNATIVE",
+      "priority" : 30,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticator" : "client-x509",
+      "authenticatorFlow" : false,
+      "requirement" : "ALTERNATIVE",
+      "priority" : 40,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    } ]
+  }, {
+    "id" : "42162df8-6de8-4abb-bdb6-88fdbde313f1",
+    "alias" : "direct grant",
+    "description" : "OpenID Connect Resource Owner Grant",
+    "providerId" : "basic-flow",
+    "topLevel" : true,
+    "builtIn" : true,
+    "authenticationExecutions" : [ {
+      "authenticator" : "direct-grant-validate-username",
+      "authenticatorFlow" : false,
+      "requirement" : "REQUIRED",
+      "priority" : 10,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticator" : "direct-grant-validate-password",
+      "authenticatorFlow" : false,
+      "requirement" : "REQUIRED",
+      "priority" : 20,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticatorFlow" : true,
+      "requirement" : "CONDITIONAL",
+      "priority" : 30,
+      "autheticatorFlow" : true,
+      "flowAlias" : "Direct Grant - Conditional OTP",
+      "userSetupAllowed" : false
+    } ]
+  }, {
+    "id" : "c0de33d2-6283-427c-bfcb-3d0ce2fa14eb",
+    "alias" : "docker auth",
+    "description" : "Used by Docker clients to authenticate against the IDP",
+    "providerId" : "basic-flow",
+    "topLevel" : true,
+    "builtIn" : true,
+    "authenticationExecutions" : [ {
+      "authenticator" : "docker-http-basic-authenticator",
+      "authenticatorFlow" : false,
+      "requirement" : "REQUIRED",
+      "priority" : 10,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    } ]
+  }, {
+    "id" : "7d552548-5c11-48e2-b4b9-b6b145afe1ac",
+    "alias" : "first broker login",
+    "description" : "Actions taken after first broker login with identity provider account, which is not yet linked to any Keycloak account",
+    "providerId" : "basic-flow",
+    "topLevel" : true,
+    "builtIn" : true,
+    "authenticationExecutions" : [ {
+      "authenticatorConfig" : "review profile config",
+      "authenticator" : "idp-review-profile",
+      "authenticatorFlow" : false,
+      "requirement" : "REQUIRED",
+      "priority" : 10,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticatorFlow" : true,
+      "requirement" : "REQUIRED",
+      "priority" : 20,
+      "autheticatorFlow" : true,
+      "flowAlias" : "User creation or linking",
+      "userSetupAllowed" : false
+    } ]
+  }, {
+    "id" : "12900d0f-ecda-40e6-b827-b97cafa716bd",
+    "alias" : "forms",
+    "description" : "Username, password, otp and other auth forms.",
+    "providerId" : "basic-flow",
+    "topLevel" : false,
+    "builtIn" : true,
+    "authenticationExecutions" : [ {
+      "authenticator" : "auth-username-password-form",
+      "authenticatorFlow" : false,
+      "requirement" : "REQUIRED",
+      "priority" : 10,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticatorFlow" : true,
+      "requirement" : "CONDITIONAL",
+      "priority" : 20,
+      "autheticatorFlow" : true,
+      "flowAlias" : "Browser - Conditional OTP",
+      "userSetupAllowed" : false
+    } ]
+  }, {
+    "id" : "2b2bb526-c19f-4fa5-9147-181688209ffe",
+    "alias" : "registration",
+    "description" : "registration flow",
+    "providerId" : "basic-flow",
+    "topLevel" : true,
+    "builtIn" : true,
+    "authenticationExecutions" : [ {
+      "authenticator" : "registration-page-form",
+      "authenticatorFlow" : true,
+      "requirement" : "REQUIRED",
+      "priority" : 10,
+      "autheticatorFlow" : true,
+      "flowAlias" : "registration form",
+      "userSetupAllowed" : false
+    } ]
+  }, {
+    "id" : "07ee3d61-e425-4387-bd4a-40b5aa502ae6",
+    "alias" : "registration form",
+    "description" : "registration form",
+    "providerId" : "form-flow",
+    "topLevel" : false,
+    "builtIn" : true,
+    "authenticationExecutions" : [ {
+      "authenticator" : "registration-user-creation",
+      "authenticatorFlow" : false,
+      "requirement" : "REQUIRED",
+      "priority" : 20,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticator" : "registration-password-action",
+      "authenticatorFlow" : false,
+      "requirement" : "REQUIRED",
+      "priority" : 50,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticator" : "registration-recaptcha-action",
+      "authenticatorFlow" : false,
+      "requirement" : "DISABLED",
+      "priority" : 60,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticator" : "registration-terms-and-conditions",
+      "authenticatorFlow" : false,
+      "requirement" : "DISABLED",
+      "priority" : 70,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    } ]
+  }, {
+    "id" : "52114e72-13ec-46d1-a23a-a1cd080e8e36",
+    "alias" : "reset credentials",
+    "description" : "Reset credentials for a user if they forgot their password or something",
+    "providerId" : "basic-flow",
+    "topLevel" : true,
+    "builtIn" : true,
+    "authenticationExecutions" : [ {
+      "authenticator" : "reset-credentials-choose-user",
+      "authenticatorFlow" : false,
+      "requirement" : "REQUIRED",
+      "priority" : 10,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticator" : "reset-credential-email",
+      "authenticatorFlow" : false,
+      "requirement" : "REQUIRED",
+      "priority" : 20,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticator" : "reset-password",
+      "authenticatorFlow" : false,
+      "requirement" : "REQUIRED",
+      "priority" : 30,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticatorFlow" : true,
+      "requirement" : "CONDITIONAL",
+      "priority" : 40,
+      "autheticatorFlow" : true,
+      "flowAlias" : "Reset - Conditional OTP",
+      "userSetupAllowed" : false
+    } ]
+  }, {
+    "id" : "3005d06b-6083-4559-9b07-5f16f2633a40",
+    "alias" : "saml ecp",
+    "description" : "SAML ECP Profile Authentication Flow",
+    "providerId" : "basic-flow",
+    "topLevel" : true,
+    "builtIn" : true,
+    "authenticationExecutions" : [ {
+      "authenticator" : "http-basic-authenticator",
+      "authenticatorFlow" : false,
+      "requirement" : "REQUIRED",
+      "priority" : 10,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    } ]
+  } ],
+  "authenticatorConfig" : [ {
+    "id" : "16d34322-a09a-4f80-83db-cc9a8732304d",
+    "alias" : "create unique user config",
+    "config" : {
+      "require.password.update.after.registration" : "false"
+    }
+  }, {
+    "id" : "9fa91c0f-46eb-47da-a3d0-81154417daa9",
+    "alias" : "review profile config",
+    "config" : {
+      "update.profile.on.first.login" : "missing"
+    }
+  } ],
+  "requiredActions" : [ {
+    "alias" : "CONFIGURE_TOTP",
+    "name" : "Configure OTP",
+    "providerId" : "CONFIGURE_TOTP",
+    "enabled" : true,
+    "defaultAction" : false,
+    "priority" : 10,
+    "config" : { }
+  }, {
+    "alias" : "TERMS_AND_CONDITIONS",
+    "name" : "Terms and Conditions",
+    "providerId" : "TERMS_AND_CONDITIONS",
+    "enabled" : false,
+    "defaultAction" : false,
+    "priority" : 20,
+    "config" : { }
+  }, {
+    "alias" : "UPDATE_PASSWORD",
+    "name" : "Update Password",
+    "providerId" : "UPDATE_PASSWORD",
+    "enabled" : true,
+    "defaultAction" : false,
+    "priority" : 30,
+    "config" : { }
+  }, {
+    "alias" : "UPDATE_PROFILE",
+    "name" : "Update Profile",
+    "providerId" : "UPDATE_PROFILE",
+    "enabled" : true,
+    "defaultAction" : false,
+    "priority" : 40,
+    "config" : { }
+  }, {
+    "alias" : "VERIFY_EMAIL",
+    "name" : "Verify Email",
+    "providerId" : "VERIFY_EMAIL",
+    "enabled" : true,
+    "defaultAction" : false,
+    "priority" : 50,
+    "config" : { }
+  }, {
+    "alias" : "delete_account",
+    "name" : "Delete Account",
+    "providerId" : "delete_account",
+    "enabled" : false,
+    "defaultAction" : false,
+    "priority" : 60,
+    "config" : { }
+  }, {
+    "alias" : "webauthn-register",
+    "name" : "Webauthn Register",
+    "providerId" : "webauthn-register",
+    "enabled" : true,
+    "defaultAction" : false,
+    "priority" : 70,
+    "config" : { }
+  }, {
+    "alias" : "webauthn-register-passwordless",
+    "name" : "Webauthn Register Passwordless",
+    "providerId" : "webauthn-register-passwordless",
+    "enabled" : true,
+    "defaultAction" : false,
+    "priority" : 80,
+    "config" : { }
+  }, {
+    "alias" : "VERIFY_PROFILE",
+    "name" : "Verify Profile",
+    "providerId" : "VERIFY_PROFILE",
+    "enabled" : true,
+    "defaultAction" : false,
+    "priority" : 90,
+    "config" : { }
+  }, {
+    "alias" : "delete_credential",
+    "name" : "Delete Credential",
+    "providerId" : "delete_credential",
+    "enabled" : true,
+    "defaultAction" : false,
+    "priority" : 100,
+    "config" : { }
+  }, {
+    "alias" : "update_user_locale",
+    "name" : "Update User Locale",
+    "providerId" : "update_user_locale",
+    "enabled" : true,
+    "defaultAction" : false,
+    "priority" : 1000,
+    "config" : { }
+  } ],
+  "browserFlow" : "browser",
+  "registrationFlow" : "registration",
+  "directGrantFlow" : "direct grant",
+  "resetCredentialsFlow" : "reset credentials",
+  "clientAuthenticationFlow" : "clients",
+  "dockerAuthenticationFlow" : "docker auth",
+  "firstBrokerLoginFlow" : "first broker login",
+  "attributes" : {
+    "cibaBackchannelTokenDeliveryMode" : "poll",
+    "cibaExpiresIn" : "120",
+    "cibaAuthRequestedUserHint" : "login_hint",
+    "parRequestUriLifespan" : "60",
+    "cibaInterval" : "5",
+    "realmReusableOtpCode" : "false"
+  },
+  "keycloakVersion" : "24.0.3",
+  "userManagedAccessAllowed" : false,
+  "clientProfiles" : {
+    "profiles" : [ ]
+  },
+  "clientPolicies" : {
+    "policies" : [ ]
+  }
+} ]
\ No newline at end of file
diff --git a/docker/config/realm-export.json b/docker/config/realm-export.json
deleted file mode 100644
index 5f72ccadab..0000000000
--- a/docker/config/realm-export.json
+++ /dev/null
@@ -1,2578 +0,0 @@
-{
-  "id": "43b9ddfb-26f5-49a8-852b-0e4f447f4a0b",
-  "realm": "pitc",
-  "displayName": "",
-  "displayNameHtml": "",
-  "notBefore": 0,
-  "defaultSignatureAlgorithm": "RS256",
-  "revokeRefreshToken": false,
-  "refreshTokenMaxReuse": 0,
-  "accessTokenLifespan": 300,
-  "accessTokenLifespanForImplicitFlow": 900,
-  "ssoSessionIdleTimeout": 1800,
-  "ssoSessionMaxLifespan": 36000,
-  "ssoSessionIdleTimeoutRememberMe": 0,
-  "ssoSessionMaxLifespanRememberMe": 0,
-  "offlineSessionIdleTimeout": 2592000,
-  "offlineSessionMaxLifespanEnabled": false,
-  "offlineSessionMaxLifespan": 5184000,
-  "clientSessionIdleTimeout": 0,
-  "clientSessionMaxLifespan": 0,
-  "clientOfflineSessionIdleTimeout": 0,
-  "clientOfflineSessionMaxLifespan": 0,
-  "accessCodeLifespan": 60,
-  "accessCodeLifespanUserAction": 300,
-  "accessCodeLifespanLogin": 1800,
-  "actionTokenGeneratedByAdminLifespan": 43200,
-  "actionTokenGeneratedByUserLifespan": 300,
-  "oauth2DeviceCodeLifespan": 600,
-  "oauth2DevicePollingInterval": 5,
-  "enabled": true,
-  "sslRequired": "external",
-  "registrationAllowed": false,
-  "registrationEmailAsUsername": false,
-  "rememberMe": false,
-  "verifyEmail": false,
-  "loginWithEmailAllowed": true,
-  "duplicateEmailsAllowed": false,
-  "resetPasswordAllowed": false,
-  "editUsernameAllowed": false,
-  "bruteForceProtected": false,
-  "permanentLockout": false,
-  "maxFailureWaitSeconds": 900,
-  "minimumQuickLoginWaitSeconds": 60,
-  "waitIncrementSeconds": 60,
-  "quickLoginCheckMilliSeconds": 1000,
-  "maxDeltaTimeSeconds": 43200,
-  "failureFactor": 30,
-  "users": [
-    {
-      "createdTimestamp": 1700823629490,
-      "username": "bbt",
-      "enabled": true,
-      "totp": false,
-      "emailVerified": true,
-      "firstName": "Ashleigh",
-      "lastName": "Russell",
-      "email": "bbt@bbt.com",
-      "credentials": [
-        {
-          "type": "password",
-          "value": "bbt"
-        }
-      ],
-      "disableableCredentialTypes": [],
-      "requiredActions": [],
-      "realmRoles": [
-        "default-roles-pitc_okr_staging",
-        "org_azubi"
-      ],
-      "notBefore": 0,
-      "groups": []
-    },
-    {
-      "createdTimestamp": 1700823629490,
-      "username": "gl",
-      "enabled": true,
-      "totp": false,
-      "emailVerified": true,
-      "firstName": "Jaya",
-      "lastName": "Norris",
-      "email": "gl@gl.com",
-      "credentials": [
-        {
-          "type": "password",
-          "value": "gl"
-        }
-      ],
-      "disableableCredentialTypes": [],
-      "requiredActions": [],
-      "realmRoles": [
-        "default-roles-pitc_okr_staging",
-        "org_gl"
-      ],
-      "notBefore": 0,
-      "groups": []
-    },
-    {
-      "createdTimestamp": 1700823629490,
-      "username": "bl",
-      "enabled": true,
-      "totp": false,
-      "emailVerified": true,
-      "firstName": "Esha",
-      "lastName": "Harris",
-      "email": "bl@bl.com",
-      "credentials": [
-        {
-          "type": "password",
-          "value": "bl"
-        }
-      ],
-      "disableableCredentialTypes": [],
-      "requiredActions": [],
-      "realmRoles": [
-        "default-roles-pitc_okr_staging",
-        "org_bl",
-        "org_mobility"
-      ],
-      "notBefore": 0,
-      "groups": []
-    },
-    {
-      "createdTimestamp": 1700823629490,
-      "username": "member",
-      "enabled": true,
-      "totp": false,
-      "emailVerified": true,
-      "firstName": "Abraham",
-      "lastName": " Woodard",
-      "email": "member@member.com",
-      "credentials": [
-        {
-          "type": "password",
-          "value": "member"
-        }
-      ],
-      "disableableCredentialTypes": [],
-      "requiredActions": [],
-      "realmRoles": [
-        "default-roles-pitc_okr_staging",
-        "org_mobility"
-      ],
-      "notBefore": 0,
-      "groups": []
-    },
-    {
-      "createdTimestamp": 1700823629490,
-      "username": "bl-mob",
-      "enabled": true,
-      "totp": false,
-      "emailVerified": true,
-      "firstName": "BL",
-      "lastName": "Mobility",
-      "email": "bl@mob.com",
-      "credentials": [
-        {
-          "type": "password",
-          "value": "bl"
-        }
-      ],
-      "disableableCredentialTypes": [],
-      "requiredActions": [],
-      "realmRoles": [
-        "default-roles-pitc_okr_staging",
-        "org_bl",
-        "org_mobility"
-      ],
-      "notBefore": 0,
-      "groups": []
-    },
-    {
-      "createdTimestamp": 1700823629490,
-      "username": "bl-mid",
-      "enabled": true,
-      "totp": false,
-      "emailVerified": true,
-      "firstName": "BL",
-      "lastName": "Mid",
-      "email": "bl@mid.com",
-      "credentials": [
-        {
-          "type": "password",
-          "value": "bl"
-        }
-      ],
-      "disableableCredentialTypes": [],
-      "requiredActions": [],
-      "realmRoles": [
-        "default-roles-pitc_okr_staging",
-        "org_bl",
-        "org_midcicd",
-        "org_midcontainer"
-      ],
-      "notBefore": 0,
-      "groups": []
-    },
-    {
-      "createdTimestamp": 1700823629490,
-      "username": "bl-ruby",
-      "enabled": true,
-      "totp": false,
-      "emailVerified": true,
-      "firstName": "BL",
-      "lastName": "Ruby",
-      "email": "bl@ruby.com",
-      "credentials": [
-        {
-          "type": "password",
-          "value": "bl"
-        }
-      ],
-      "disableableCredentialTypes": [],
-      "requiredActions": [],
-      "realmRoles": [
-        "default-roles-pitc_okr_staging",
-        "org_bl",
-        "org_devruby"
-      ],
-      "notBefore": 0,
-      "groups": []
-    },
-    {
-      "createdTimestamp": 1700823629490,
-      "username": "bl-sys",
-      "enabled": true,
-      "totp": false,
-      "emailVerified": true,
-      "firstName": "BL",
-      "lastName": "Sys",
-      "email": "bl@sys.com",
-      "credentials": [
-        {
-          "type": "password",
-          "value": "bl"
-        }
-      ],
-      "disableableCredentialTypes": [],
-      "requiredActions": [],
-      "realmRoles": [
-        "default-roles-pitc_okr_staging",
-        "org_bl",
-        "org_sys"
-      ],
-      "notBefore": 0,
-      "groups": []
-    }
-  ],
-  "roles": {
-    "realm": [
-      {
-        "id": "758171cd-58e2-43b6-bd0e-9afb7c2ca2f9",
-        "name": "org_pl",
-        "description": "",
-        "composite": false,
-        "clientRole": false,
-        "containerId": "43b9ddfb-26f5-49a8-852b-0e4f447f4a0b",
-        "attributes": {}
-      },
-      {
-        "id": "2717bcd3-3627-460b-b861-571ad8eee0e5",
-        "name": "offline_access",
-        "description": "${role_offline-access}",
-        "composite": false,
-        "clientRole": false,
-        "containerId": "43b9ddfb-26f5-49a8-852b-0e4f447f4a0b",
-        "attributes": {}
-      },
-      {
-        "id": "2b173cac-d60e-49e5-be20-454e79199c57",
-        "name": "org_midcicd",
-        "description": "",
-        "composite": false,
-        "clientRole": false,
-        "containerId": "43b9ddfb-26f5-49a8-852b-0e4f447f4a0b",
-        "attributes": {}
-      },
-      {
-        "id": "d03eeb03-ad4d-4ce2-acd2-113f169669b7",
-        "name": "org_personal",
-        "description": "",
-        "composite": false,
-        "clientRole": false,
-        "containerId": "43b9ddfb-26f5-49a8-852b-0e4f447f4a0b",
-        "attributes": {}
-      },
-      {
-        "id": "f57969cb-5493-4a32-84d4-2d80e708f4fc",
-        "name": "org_gl",
-        "description": "",
-        "composite": false,
-        "clientRole": false,
-        "containerId": "43b9ddfb-26f5-49a8-852b-0e4f447f4a0b",
-        "attributes": {}
-      },
-      {
-        "id": "3901aadc-7c91-4568-9e2a-b32934893505",
-        "name": "org_mobility",
-        "description": "",
-        "composite": false,
-        "clientRole": false,
-        "containerId": "43b9ddfb-26f5-49a8-852b-0e4f447f4a0b",
-        "attributes": {}
-      },
-      {
-        "id": "e48beabd-4526-4d3d-8958-b45ab2437b9f",
-        "name": "org_de",
-        "description": "",
-        "composite": false,
-        "clientRole": false,
-        "containerId": "43b9ddfb-26f5-49a8-852b-0e4f447f4a0b",
-        "attributes": {}
-      },
-      {
-        "id": "db421806-c825-4810-93ac-79b63865c7f2",
-        "name": "org_devruby",
-        "description": "",
-        "composite": false,
-        "clientRole": false,
-        "containerId": "43b9ddfb-26f5-49a8-852b-0e4f447f4a0b",
-        "attributes": {}
-      },
-      {
-        "id": "fd4def8e-01d9-488a-bcb8-209914b4601f",
-        "name": "org_racoon",
-        "description": "",
-        "composite": false,
-        "clientRole": false,
-        "containerId": "43b9ddfb-26f5-49a8-852b-0e4f447f4a0b",
-        "attributes": {}
-      },
-      {
-        "id": "d6210295-f6f2-4692-b17b-783079135546",
-        "name": "org_sys",
-        "description": "",
-        "composite": false,
-        "clientRole": false,
-        "containerId": "43b9ddfb-26f5-49a8-852b-0e4f447f4a0b",
-        "attributes": {}
-      },
-      {
-        "id": "9ceb6dbb-475f-467a-a126-ad70171f861a",
-        "name": "org_midcontainer",
-        "description": "",
-        "composite": false,
-        "clientRole": false,
-        "containerId": "43b9ddfb-26f5-49a8-852b-0e4f447f4a0b",
-        "attributes": {}
-      },
-      {
-        "id": "9c802ad9-a0dd-42fd-873d-56335bbe941e",
-        "name": "org_bl",
-        "description": "",
-        "composite": false,
-        "clientRole": false,
-        "containerId": "43b9ddfb-26f5-49a8-852b-0e4f447f4a0b",
-        "attributes": {}
-      },
-      {
-        "id": "9f248491-cbde-4bb0-9c8a-9568a5dbefef",
-        "name": "default-roles-pitc_okr_staging",
-        "description": "${role_default-roles}",
-        "composite": true,
-        "composites": {
-          "realm": [
-            "offline_access",
-            "uma_authorization"
-          ],
-          "client": {
-            "account": [
-              "view-profile",
-              "manage-account"
-            ]
-          }
-        },
-        "clientRole": false,
-        "containerId": "43b9ddfb-26f5-49a8-852b-0e4f447f4a0b",
-        "attributes": {}
-      },
-      {
-        "id": "4f6337f3-71af-41f1-9917-dfa355bd71c4",
-        "name": "org_security",
-        "description": "",
-        "composite": false,
-        "clientRole": false,
-        "containerId": "43b9ddfb-26f5-49a8-852b-0e4f447f4a0b",
-        "attributes": {}
-      },
-      {
-        "id": "0add4da2-883a-412a-8b79-bdd6eef545a6",
-        "name": "org_devtre",
-        "description": "",
-        "composite": false,
-        "clientRole": false,
-        "containerId": "43b9ddfb-26f5-49a8-852b-0e4f447f4a0b",
-        "attributes": {}
-      },
-      {
-        "id": "a78755f9-37b1-4cb8-8155-31d0572c1c42",
-        "name": "org_zh",
-        "description": "",
-        "composite": false,
-        "clientRole": false,
-        "containerId": "43b9ddfb-26f5-49a8-852b-0e4f447f4a0b",
-        "attributes": {}
-      },
-      {
-        "id": "f65332f6-e9bb-4e0f-a09f-8270b0c0be56",
-        "name": "org_azubi",
-        "description": "",
-        "composite": false,
-        "clientRole": false,
-        "containerId": "43b9ddfb-26f5-49a8-852b-0e4f447f4a0b",
-        "attributes": {}
-      },
-      {
-        "id": "5a108868-05e6-4630-b742-492115fc75a4",
-        "name": "org_ux",
-        "description": "",
-        "composite": false,
-        "clientRole": false,
-        "containerId": "43b9ddfb-26f5-49a8-852b-0e4f447f4a0b",
-        "attributes": {}
-      },
-      {
-        "id": "15857402-0e96-462e-adf6-1d9c70b258b1",
-        "name": "uma_authorization",
-        "description": "${role_uma_authorization}",
-        "composite": false,
-        "clientRole": false,
-        "containerId": "43b9ddfb-26f5-49a8-852b-0e4f447f4a0b",
-        "attributes": {}
-      }
-    ],
-    "client": {
-      "realm-management": [
-        {
-          "id": "75eecef4-3714-4de8-acfa-aa76525b95d3",
-          "name": "view-authorization",
-          "description": "${role_view-authorization}",
-          "composite": false,
-          "clientRole": true,
-          "containerId": "f5757601-9812-4aec-8585-f91b79eb3c6e",
-          "attributes": {}
-        },
-        {
-          "id": "fe725fba-bbbf-476a-a3f3-7a59452212a2",
-          "name": "manage-realm",
-          "description": "${role_manage-realm}",
-          "composite": false,
-          "clientRole": true,
-          "containerId": "f5757601-9812-4aec-8585-f91b79eb3c6e",
-          "attributes": {}
-        },
-        {
-          "id": "18ecca0b-05b4-45ca-9e1b-ea1bba244f39",
-          "name": "view-clients",
-          "description": "${role_view-clients}",
-          "composite": true,
-          "composites": {
-            "client": {
-              "realm-management": [
-                "query-clients"
-              ]
-            }
-          },
-          "clientRole": true,
-          "containerId": "f5757601-9812-4aec-8585-f91b79eb3c6e",
-          "attributes": {}
-        },
-        {
-          "id": "90cae136-5144-47c0-a540-17eec780e795",
-          "name": "manage-users",
-          "description": "${role_manage-users}",
-          "composite": false,
-          "clientRole": true,
-          "containerId": "f5757601-9812-4aec-8585-f91b79eb3c6e",
-          "attributes": {}
-        },
-        {
-          "id": "df140639-114b-4f92-b1cb-aeefea5b078b",
-          "name": "create-client",
-          "description": "${role_create-client}",
-          "composite": false,
-          "clientRole": true,
-          "containerId": "f5757601-9812-4aec-8585-f91b79eb3c6e",
-          "attributes": {}
-        },
-        {
-          "id": "cddeda6b-e03a-413b-b78b-6379c21b1d7f",
-          "name": "query-clients",
-          "description": "${role_query-clients}",
-          "composite": false,
-          "clientRole": true,
-          "containerId": "f5757601-9812-4aec-8585-f91b79eb3c6e",
-          "attributes": {}
-        },
-        {
-          "id": "7a056ff2-3b4b-4386-9333-8ad7c52e36b5",
-          "name": "query-groups",
-          "description": "${role_query-groups}",
-          "composite": false,
-          "clientRole": true,
-          "containerId": "f5757601-9812-4aec-8585-f91b79eb3c6e",
-          "attributes": {}
-        },
-        {
-          "id": "01f03112-3ee3-4fd6-b8d1-458ea59ef39a",
-          "name": "realm-admin",
-          "description": "${role_realm-admin}",
-          "composite": true,
-          "composites": {
-            "client": {
-              "realm-management": [
-                "view-authorization",
-                "view-clients",
-                "manage-realm",
-                "manage-users",
-                "query-groups",
-                "query-clients",
-                "create-client",
-                "manage-clients",
-                "query-realms",
-                "manage-authorization",
-                "view-identity-providers",
-                "view-users",
-                "manage-identity-providers",
-                "manage-events",
-                "impersonation",
-                "view-events",
-                "view-realm",
-                "query-users"
-              ]
-            }
-          },
-          "clientRole": true,
-          "containerId": "f5757601-9812-4aec-8585-f91b79eb3c6e",
-          "attributes": {}
-        },
-        {
-          "id": "c74331e3-3834-4700-be56-c8eedcf2df98",
-          "name": "manage-clients",
-          "description": "${role_manage-clients}",
-          "composite": false,
-          "clientRole": true,
-          "containerId": "f5757601-9812-4aec-8585-f91b79eb3c6e",
-          "attributes": {}
-        },
-        {
-          "id": "84a5f824-160d-4d33-bf11-a855e6cde237",
-          "name": "query-realms",
-          "description": "${role_query-realms}",
-          "composite": false,
-          "clientRole": true,
-          "containerId": "f5757601-9812-4aec-8585-f91b79eb3c6e",
-          "attributes": {}
-        },
-        {
-          "id": "732214ee-0d66-4f35-8bff-3585aeb0de35",
-          "name": "manage-authorization",
-          "description": "${role_manage-authorization}",
-          "composite": false,
-          "clientRole": true,
-          "containerId": "f5757601-9812-4aec-8585-f91b79eb3c6e",
-          "attributes": {}
-        },
-        {
-          "id": "191d604c-926d-456c-be2a-59d0fca2ad6a",
-          "name": "view-identity-providers",
-          "description": "${role_view-identity-providers}",
-          "composite": false,
-          "clientRole": true,
-          "containerId": "f5757601-9812-4aec-8585-f91b79eb3c6e",
-          "attributes": {}
-        },
-        {
-          "id": "ca0a5e14-4ade-4e3f-9208-da612db93ac7",
-          "name": "view-users",
-          "description": "${role_view-users}",
-          "composite": true,
-          "composites": {
-            "client": {
-              "realm-management": [
-                "query-groups",
-                "query-users"
-              ]
-            }
-          },
-          "clientRole": true,
-          "containerId": "f5757601-9812-4aec-8585-f91b79eb3c6e",
-          "attributes": {}
-        },
-        {
-          "id": "ae8096f8-3ffb-49dd-80c6-029421271e83",
-          "name": "manage-identity-providers",
-          "description": "${role_manage-identity-providers}",
-          "composite": false,
-          "clientRole": true,
-          "containerId": "f5757601-9812-4aec-8585-f91b79eb3c6e",
-          "attributes": {}
-        },
-        {
-          "id": "d54c9636-6847-4d05-a60e-0481ce199d9c",
-          "name": "manage-events",
-          "description": "${role_manage-events}",
-          "composite": false,
-          "clientRole": true,
-          "containerId": "f5757601-9812-4aec-8585-f91b79eb3c6e",
-          "attributes": {}
-        },
-        {
-          "id": "e0bc7c6c-dacd-4133-abdb-df60c0c3e51b",
-          "name": "impersonation",
-          "description": "${role_impersonation}",
-          "composite": false,
-          "clientRole": true,
-          "containerId": "f5757601-9812-4aec-8585-f91b79eb3c6e",
-          "attributes": {}
-        },
-        {
-          "id": "9f41add7-9ebd-49d2-aa63-a5d5755c3bc3",
-          "name": "view-events",
-          "description": "${role_view-events}",
-          "composite": false,
-          "clientRole": true,
-          "containerId": "f5757601-9812-4aec-8585-f91b79eb3c6e",
-          "attributes": {}
-        },
-        {
-          "id": "51efcc02-7301-4652-8df4-6d6c67b1157a",
-          "name": "view-realm",
-          "description": "${role_view-realm}",
-          "composite": false,
-          "clientRole": true,
-          "containerId": "f5757601-9812-4aec-8585-f91b79eb3c6e",
-          "attributes": {}
-        },
-        {
-          "id": "45c050fe-1214-4dc0-b805-33946ab7e0b4",
-          "name": "query-users",
-          "description": "${role_query-users}",
-          "composite": false,
-          "clientRole": true,
-          "containerId": "f5757601-9812-4aec-8585-f91b79eb3c6e",
-          "attributes": {}
-        }
-      ],
-      "security-admin-console": [],
-      "admin-cli": [],
-      "pitc_okr_staging": [],
-      "account-console": [],
-      "broker": [
-        {
-          "id": "ede9fd28-4126-4111-bf9b-acce73510196",
-          "name": "read-token",
-          "description": "${role_read-token}",
-          "composite": false,
-          "clientRole": true,
-          "containerId": "25604a69-806e-4351-84ce-cc288e714d9c",
-          "attributes": {}
-        }
-      ],
-      "account": [
-        {
-          "id": "8f26d992-4082-4cd5-962f-a2e5c43f76a1",
-          "name": "delete-account",
-          "description": "${role_delete-account}",
-          "composite": false,
-          "clientRole": true,
-          "containerId": "d21323ce-46e9-4a10-ba1a-c58c8f1e088c",
-          "attributes": {}
-        },
-        {
-          "id": "7240905a-8cb9-4774-8718-30685e753c4e",
-          "name": "view-profile",
-          "description": "${role_view-profile}",
-          "composite": false,
-          "clientRole": true,
-          "containerId": "d21323ce-46e9-4a10-ba1a-c58c8f1e088c",
-          "attributes": {}
-        },
-        {
-          "id": "c73ec80b-a72a-4174-a5b6-e14cefd9245d",
-          "name": "manage-account-links",
-          "description": "${role_manage-account-links}",
-          "composite": false,
-          "clientRole": true,
-          "containerId": "d21323ce-46e9-4a10-ba1a-c58c8f1e088c",
-          "attributes": {}
-        },
-        {
-          "id": "d281db86-b681-4013-8f64-ce1291194f8d",
-          "name": "view-consent",
-          "description": "${role_view-consent}",
-          "composite": false,
-          "clientRole": true,
-          "containerId": "d21323ce-46e9-4a10-ba1a-c58c8f1e088c",
-          "attributes": {}
-        },
-        {
-          "id": "f1096785-b647-4954-9bb9-b9a9d743084a",
-          "name": "view-groups",
-          "description": "${role_view-groups}",
-          "composite": false,
-          "clientRole": true,
-          "containerId": "d21323ce-46e9-4a10-ba1a-c58c8f1e088c",
-          "attributes": {}
-        },
-        {
-          "id": "f91e2006-e8fa-408e-9c05-07d44d9259ce",
-          "name": "view-applications",
-          "description": "${role_view-applications}",
-          "composite": false,
-          "clientRole": true,
-          "containerId": "d21323ce-46e9-4a10-ba1a-c58c8f1e088c",
-          "attributes": {}
-        },
-        {
-          "id": "d65ebb97-5679-4595-a8e6-ca959035fa04",
-          "name": "manage-account",
-          "description": "${role_manage-account}",
-          "composite": true,
-          "composites": {
-            "client": {
-              "account": [
-                "manage-account-links"
-              ]
-            }
-          },
-          "clientRole": true,
-          "containerId": "d21323ce-46e9-4a10-ba1a-c58c8f1e088c",
-          "attributes": {}
-        },
-        {
-          "id": "a4ef81f0-2907-4c09-9bff-df774b0cda1f",
-          "name": "manage-consent",
-          "description": "${role_manage-consent}",
-          "composite": true,
-          "composites": {
-            "client": {
-              "account": [
-                "view-consent"
-              ]
-            }
-          },
-          "clientRole": true,
-          "containerId": "d21323ce-46e9-4a10-ba1a-c58c8f1e088c",
-          "attributes": {}
-        }
-      ]
-    }
-  },
-  "groups": [],
-  "defaultRole": {
-    "id": "9f248491-cbde-4bb0-9c8a-9568a5dbefef",
-    "name": "default-roles-pitc_okr_staging",
-    "description": "${role_default-roles}",
-    "composite": true,
-    "clientRole": false,
-    "containerId": "43b9ddfb-26f5-49a8-852b-0e4f447f4a0b"
-  },
-  "requiredCredentials": [
-    "password"
-  ],
-  "otpPolicyType": "totp",
-  "otpPolicyAlgorithm": "HmacSHA1",
-  "otpPolicyInitialCounter": 0,
-  "otpPolicyDigits": 6,
-  "otpPolicyLookAheadWindow": 1,
-  "otpPolicyPeriod": 30,
-  "otpPolicyCodeReusable": false,
-  "otpSupportedApplications": [
-    "totpAppFreeOTPName",
-    "totpAppMicrosoftAuthenticatorName",
-    "totpAppGoogleName"
-  ],
-  "webAuthnPolicyRpEntityName": "keycloak",
-  "webAuthnPolicySignatureAlgorithms": [
-    "ES256"
-  ],
-  "webAuthnPolicyRpId": "",
-  "webAuthnPolicyAttestationConveyancePreference": "not specified",
-  "webAuthnPolicyAuthenticatorAttachment": "not specified",
-  "webAuthnPolicyRequireResidentKey": "not specified",
-  "webAuthnPolicyUserVerificationRequirement": "not specified",
-  "webAuthnPolicyCreateTimeout": 0,
-  "webAuthnPolicyAvoidSameAuthenticatorRegister": false,
-  "webAuthnPolicyAcceptableAaguids": [],
-  "webAuthnPolicyPasswordlessRpEntityName": "keycloak",
-  "webAuthnPolicyPasswordlessSignatureAlgorithms": [
-    "ES256"
-  ],
-  "webAuthnPolicyPasswordlessRpId": "",
-  "webAuthnPolicyPasswordlessAttestationConveyancePreference": "not specified",
-  "webAuthnPolicyPasswordlessAuthenticatorAttachment": "not specified",
-  "webAuthnPolicyPasswordlessRequireResidentKey": "not specified",
-  "webAuthnPolicyPasswordlessUserVerificationRequirement": "not specified",
-  "webAuthnPolicyPasswordlessCreateTimeout": 0,
-  "webAuthnPolicyPasswordlessAvoidSameAuthenticatorRegister": false,
-  "webAuthnPolicyPasswordlessAcceptableAaguids": [],
-  "scopeMappings": [
-    {
-      "clientScope": "pitc",
-      "roles": [
-        "org_gl",
-        "org_bl",
-        "offline_access",
-        "org_azubi",
-        "default-roles-pitc_okr_staging",
-        "uma_authorization",
-        "org_mobility"
-      ]
-    },
-    {
-      "clientScope": "offline_access",
-      "roles": [
-        "offline_access"
-      ]
-    }
-  ],
-  "clientScopeMappings": {
-    "account": [
-      {
-        "client": "account-console",
-        "roles": [
-          "manage-account",
-          "view-groups"
-        ]
-      }
-    ]
-  },
-  "clients": [
-    {
-      "id": "d21323ce-46e9-4a10-ba1a-c58c8f1e088c",
-      "clientId": "account",
-      "name": "${client_account}",
-      "rootUrl": "${authBaseUrl}",
-      "baseUrl": "/realms/pitc/account/",
-      "surrogateAuthRequired": false,
-      "enabled": true,
-      "alwaysDisplayInConsole": false,
-      "clientAuthenticatorType": "client-secret",
-      "redirectUris": [
-        "/realms/pitc/account/*"
-      ],
-      "webOrigins": [],
-      "notBefore": 0,
-      "bearerOnly": false,
-      "consentRequired": false,
-      "standardFlowEnabled": true,
-      "implicitFlowEnabled": false,
-      "directAccessGrantsEnabled": false,
-      "serviceAccountsEnabled": false,
-      "publicClient": true,
-      "frontchannelLogout": false,
-      "protocol": "openid-connect",
-      "attributes": {
-        "post.logout.redirect.uris": "+"
-      },
-      "authenticationFlowBindingOverrides": {},
-      "fullScopeAllowed": false,
-      "nodeReRegistrationTimeout": 0,
-      "defaultClientScopes": [
-        "web-origins",
-        "acr",
-        "profile",
-        "email"
-      ],
-      "optionalClientScopes": [
-        "address",
-        "phone",
-        "offline_access",
-        "microprofile-jwt"
-      ]
-    },
-    {
-      "id": "577ef857-c6d4-4561-94f2-dd8dd1e7b86d",
-      "clientId": "account-console",
-      "name": "${client_account-console}",
-      "rootUrl": "${authBaseUrl}",
-      "baseUrl": "/realms/pitc_okr_staging/account/",
-      "surrogateAuthRequired": false,
-      "enabled": true,
-      "alwaysDisplayInConsole": false,
-      "clientAuthenticatorType": "client-secret",
-      "redirectUris": [
-        "/realms/pitc_okr_staging/account/*"
-      ],
-      "webOrigins": [],
-      "notBefore": 0,
-      "bearerOnly": false,
-      "consentRequired": false,
-      "standardFlowEnabled": true,
-      "implicitFlowEnabled": false,
-      "directAccessGrantsEnabled": false,
-      "serviceAccountsEnabled": false,
-      "publicClient": true,
-      "frontchannelLogout": false,
-      "protocol": "openid-connect",
-      "attributes": {
-        "post.logout.redirect.uris": "+",
-        "pkce.code.challenge.method": "S256"
-      },
-      "authenticationFlowBindingOverrides": {},
-      "fullScopeAllowed": false,
-      "nodeReRegistrationTimeout": 0,
-      "protocolMappers": [
-        {
-          "id": "d3070834-c98d-4c56-9f29-273a9f7dc7a4",
-          "name": "audience resolve",
-          "protocol": "openid-connect",
-          "protocolMapper": "oidc-audience-resolve-mapper",
-          "consentRequired": false,
-          "config": {}
-        }
-      ],
-      "defaultClientScopes": [
-        "web-origins",
-        "acr",
-        "profile",
-        "email"
-      ],
-      "optionalClientScopes": [
-        "address",
-        "phone",
-        "offline_access",
-        "microprofile-jwt"
-      ]
-    },
-    {
-      "id": "acf762e9-719e-466d-9ef5-956eed3cfa5a",
-      "clientId": "admin-cli",
-      "name": "${client_admin-cli}",
-      "surrogateAuthRequired": false,
-      "enabled": true,
-      "alwaysDisplayInConsole": false,
-      "clientAuthenticatorType": "client-secret",
-      "redirectUris": [],
-      "webOrigins": [],
-      "notBefore": 0,
-      "bearerOnly": false,
-      "consentRequired": false,
-      "standardFlowEnabled": false,
-      "implicitFlowEnabled": false,
-      "directAccessGrantsEnabled": true,
-      "serviceAccountsEnabled": false,
-      "publicClient": true,
-      "frontchannelLogout": false,
-      "protocol": "openid-connect",
-      "attributes": {
-        "post.logout.redirect.uris": "+"
-      },
-      "authenticationFlowBindingOverrides": {},
-      "fullScopeAllowed": false,
-      "nodeReRegistrationTimeout": 0,
-      "defaultClientScopes": [
-        "web-origins",
-        "acr",
-        "profile",
-        "email"
-      ],
-      "optionalClientScopes": [
-        "address",
-        "phone",
-        "offline_access",
-        "microprofile-jwt"
-      ]
-    },
-    {
-      "id": "25604a69-806e-4351-84ce-cc288e714d9c",
-      "clientId": "broker",
-      "name": "${client_broker}",
-      "surrogateAuthRequired": false,
-      "enabled": true,
-      "alwaysDisplayInConsole": false,
-      "clientAuthenticatorType": "client-secret",
-      "redirectUris": [],
-      "webOrigins": [],
-      "notBefore": 0,
-      "bearerOnly": true,
-      "consentRequired": false,
-      "standardFlowEnabled": true,
-      "implicitFlowEnabled": false,
-      "directAccessGrantsEnabled": false,
-      "serviceAccountsEnabled": false,
-      "publicClient": false,
-      "frontchannelLogout": false,
-      "protocol": "openid-connect",
-      "attributes": {
-        "post.logout.redirect.uris": "+"
-      },
-      "authenticationFlowBindingOverrides": {},
-      "fullScopeAllowed": false,
-      "nodeReRegistrationTimeout": 0,
-      "defaultClientScopes": [
-        "web-origins",
-        "acr",
-        "profile",
-        "email"
-      ],
-      "optionalClientScopes": [
-        "address",
-        "phone",
-        "offline_access",
-        "microprofile-jwt"
-      ]
-    },
-    {
-      "id": "6b3dc034-2a41-4230-a27d-493833919a5a",
-      "clientId": "pitc_okr_staging",
-      "name": "OKR-Tool-Staging",
-      "description": "",
-      "rootUrl": "",
-      "adminUrl": "",
-      "baseUrl": "",
-      "surrogateAuthRequired": false,
-      "enabled": true,
-      "alwaysDisplayInConsole": false,
-      "clientAuthenticatorType": "client-secret",
-      "redirectUris": [
-        "https://okr-stag.ocp.cloudscale.puzzle.ch/auth/keycloakopenid/callback*",
-        "https://okr-stag.ocp.cloudscale.puzzle.ch:*",
-        "http://localhost:4200/*",
-        "http://localhost:8080/*",
-        "http://localhost:8080:/*"
-      ],
-      "webOrigins": [
-        "+"
-      ],
-      "notBefore": 0,
-      "bearerOnly": false,
-      "consentRequired": false,
-      "standardFlowEnabled": true,
-      "implicitFlowEnabled": false,
-      "directAccessGrantsEnabled": false,
-      "serviceAccountsEnabled": false,
-      "publicClient": true,
-      "frontchannelLogout": false,
-      "protocol": "openid-connect",
-      "attributes": {
-        "frontchannel.logout.url": "https://okr.ocp-internal.cloudscale.puzzle.ch",
-        "post.logout.redirect.uris": "http://localhost:4200/*##https://okr-stag.ocp.cloudscale.puzzle.ch:*##http://localhost:8080/*##http://localhost:8080:/*",
-        "oauth2.device.authorization.grant.enabled": "false",
-        "backchannel.logout.revoke.offline.tokens": "false",
-        "use.refresh.tokens": "true",
-        "oidc.ciba.grant.enabled": "false",
-        "backchannel.logout.session.required": "false",
-        "client_credentials.use_refresh_token": "false",
-        "tls.client.certificate.bound.access.tokens": "false",
-        "require.pushed.authorization.requests": "false",
-        "acr.loa.map": "{}",
-        "display.on.consent.screen": "false",
-        "token.response.type.bearer.lower-case": "false"
-      },
-      "authenticationFlowBindingOverrides": {},
-      "fullScopeAllowed": true,
-      "nodeReRegistrationTimeout": -1,
-      "defaultClientScopes": [
-        "web-origins",
-        "acr",
-        "profile",
-        "pitc",
-        "email"
-      ],
-      "optionalClientScopes": [
-        "address",
-        "phone",
-        "offline_access",
-        "microprofile-jwt"
-      ]
-    },
-    {
-      "id": "f5757601-9812-4aec-8585-f91b79eb3c6e",
-      "clientId": "realm-management",
-      "name": "${client_realm-management}",
-      "surrogateAuthRequired": false,
-      "enabled": true,
-      "alwaysDisplayInConsole": false,
-      "clientAuthenticatorType": "client-secret",
-      "redirectUris": [],
-      "webOrigins": [],
-      "notBefore": 0,
-      "bearerOnly": true,
-      "consentRequired": false,
-      "standardFlowEnabled": true,
-      "implicitFlowEnabled": false,
-      "directAccessGrantsEnabled": false,
-      "serviceAccountsEnabled": false,
-      "publicClient": false,
-      "frontchannelLogout": false,
-      "protocol": "openid-connect",
-      "attributes": {
-        "post.logout.redirect.uris": "+"
-      },
-      "authenticationFlowBindingOverrides": {},
-      "fullScopeAllowed": false,
-      "nodeReRegistrationTimeout": 0,
-      "defaultClientScopes": [
-        "web-origins",
-        "acr",
-        "profile",
-        "email"
-      ],
-      "optionalClientScopes": [
-        "address",
-        "phone",
-        "offline_access",
-        "microprofile-jwt"
-      ]
-    },
-    {
-      "id": "5ca5c001-3711-4811-b98a-7deb75497f5d",
-      "clientId": "security-admin-console",
-      "name": "${client_security-admin-console}",
-      "rootUrl": "${authAdminUrl}",
-      "baseUrl": "/admin/pitc/console/",
-      "surrogateAuthRequired": false,
-      "enabled": true,
-      "alwaysDisplayInConsole": false,
-      "clientAuthenticatorType": "client-secret",
-      "redirectUris": [
-        "/admin/pitc/console/*"
-      ],
-      "webOrigins": [
-        "+"
-      ],
-      "notBefore": 0,
-      "bearerOnly": false,
-      "consentRequired": false,
-      "standardFlowEnabled": true,
-      "implicitFlowEnabled": false,
-      "directAccessGrantsEnabled": false,
-      "serviceAccountsEnabled": false,
-      "publicClient": true,
-      "frontchannelLogout": false,
-      "protocol": "openid-connect",
-      "attributes": {
-        "post.logout.redirect.uris": "+",
-        "pkce.code.challenge.method": "S256"
-      },
-      "authenticationFlowBindingOverrides": {},
-      "fullScopeAllowed": false,
-      "nodeReRegistrationTimeout": 0,
-      "protocolMappers": [
-        {
-          "id": "89fe5321-673c-4b04-9983-781432d79a30",
-          "name": "locale",
-          "protocol": "openid-connect",
-          "protocolMapper": "oidc-usermodel-attribute-mapper",
-          "consentRequired": false,
-          "config": {
-            "userinfo.token.claim": "true",
-            "user.attribute": "locale",
-            "id.token.claim": "true",
-            "access.token.claim": "true",
-            "claim.name": "locale",
-            "jsonType.label": "String"
-          }
-        }
-      ],
-      "defaultClientScopes": [
-        "web-origins",
-        "acr",
-        "profile",
-        "email"
-      ],
-      "optionalClientScopes": [
-        "address",
-        "phone",
-        "offline_access",
-        "microprofile-jwt"
-      ]
-    }
-  ],
-  "clientScopes": [
-    {
-      "id": "705ad3ff-5d11-4b80-ae54-1e58f40be825",
-      "name": "email",
-      "description": "OpenID Connect built-in scope: email",
-      "protocol": "openid-connect",
-      "attributes": {
-        "include.in.token.scope": "true",
-        "display.on.consent.screen": "true",
-        "consent.screen.text": "${emailScopeConsentText}"
-      },
-      "protocolMappers": [
-        {
-          "id": "40d11fc9-9e90-436a-a737-0ef68ecb09ca",
-          "name": "email verified",
-          "protocol": "openid-connect",
-          "protocolMapper": "oidc-usermodel-property-mapper",
-          "consentRequired": false,
-          "config": {
-            "userinfo.token.claim": "true",
-            "user.attribute": "emailVerified",
-            "id.token.claim": "true",
-            "access.token.claim": "true",
-            "claim.name": "email_verified",
-            "jsonType.label": "boolean"
-          }
-        },
-        {
-          "id": "180565c2-6598-46ba-ae99-b3bfb40c7f0e",
-          "name": "email",
-          "protocol": "openid-connect",
-          "protocolMapper": "oidc-usermodel-property-mapper",
-          "consentRequired": false,
-          "config": {
-            "userinfo.token.claim": "true",
-            "user.attribute": "email",
-            "id.token.claim": "true",
-            "access.token.claim": "true",
-            "claim.name": "email",
-            "jsonType.label": "String"
-          }
-        }
-      ]
-    },
-    {
-      "id": "25d825b0-9567-4942-8e9b-4d061bc50825",
-      "name": "pitc",
-      "description": "",
-      "protocol": "openid-connect",
-      "attributes": {
-        "include.in.token.scope": "true",
-        "display.on.consent.screen": "true",
-        "gui.order": "",
-        "consent.screen.text": ""
-      },
-      "protocolMappers": [
-        {
-          "id": "76b7042a-f8ed-47e6-a282-6451e953187d",
-          "name": "realm roles",
-          "protocol": "openid-connect",
-          "protocolMapper": "oidc-usermodel-realm-role-mapper",
-          "consentRequired": false,
-          "config": {
-            "multivalued": "true",
-            "userinfo.token.claim": "false",
-            "user.attribute": "foo",
-            "id.token.claim": "false",
-            "access.token.claim": "true",
-            "claim.name": "pitc.roles",
-            "jsonType.label": "String"
-          }
-        }
-      ]
-    },
-    {
-      "id": "c851f7fc-e969-482a-8225-c285a448012c",
-      "name": "phone",
-      "description": "OpenID Connect built-in scope: phone",
-      "protocol": "openid-connect",
-      "attributes": {
-        "include.in.token.scope": "true",
-        "display.on.consent.screen": "true",
-        "consent.screen.text": "${phoneScopeConsentText}"
-      },
-      "protocolMappers": [
-        {
-          "id": "9ba260e1-f22e-4451-9c16-6e5cda491023",
-          "name": "phone number",
-          "protocol": "openid-connect",
-          "protocolMapper": "oidc-usermodel-attribute-mapper",
-          "consentRequired": false,
-          "config": {
-            "userinfo.token.claim": "true",
-            "user.attribute": "phoneNumber",
-            "id.token.claim": "true",
-            "access.token.claim": "true",
-            "claim.name": "phone_number",
-            "jsonType.label": "String"
-          }
-        },
-        {
-          "id": "b6890e43-9679-4036-8187-372459fc274e",
-          "name": "phone number verified",
-          "protocol": "openid-connect",
-          "protocolMapper": "oidc-usermodel-attribute-mapper",
-          "consentRequired": false,
-          "config": {
-            "userinfo.token.claim": "true",
-            "user.attribute": "phoneNumberVerified",
-            "id.token.claim": "true",
-            "access.token.claim": "true",
-            "claim.name": "phone_number_verified",
-            "jsonType.label": "boolean"
-          }
-        }
-      ]
-    },
-    {
-      "id": "9dcb6931-c86a-45c1-94d1-62110e58a64d",
-      "name": "role_list",
-      "description": "SAML role list",
-      "protocol": "saml",
-      "attributes": {
-        "consent.screen.text": "${samlRoleListScopeConsentText}",
-        "display.on.consent.screen": "true"
-      },
-      "protocolMappers": [
-        {
-          "id": "bfaecd30-a8c8-4b13-b940-4b60a9048f71",
-          "name": "role list",
-          "protocol": "saml",
-          "protocolMapper": "saml-role-list-mapper",
-          "consentRequired": false,
-          "config": {
-            "single": "false",
-            "attribute.nameformat": "Basic",
-            "attribute.name": "Role"
-          }
-        }
-      ]
-    },
-    {
-      "id": "e3015444-a867-4daf-a02e-384bf12e1a46",
-      "name": "web-origins",
-      "description": "OpenID Connect scope for add allowed web origins to the access token",
-      "protocol": "openid-connect",
-      "attributes": {
-        "include.in.token.scope": "false",
-        "display.on.consent.screen": "false",
-        "consent.screen.text": ""
-      },
-      "protocolMappers": [
-        {
-          "id": "1e71985c-dd3f-41e2-9b38-b5e1d2185c0f",
-          "name": "allowed web origins",
-          "protocol": "openid-connect",
-          "protocolMapper": "oidc-allowed-origins-mapper",
-          "consentRequired": false,
-          "config": {}
-        }
-      ]
-    },
-    {
-      "id": "cb4d4396-070d-4512-93f6-0dd999644bc1",
-      "name": "profile",
-      "description": "OpenID Connect built-in scope: profile",
-      "protocol": "openid-connect",
-      "attributes": {
-        "include.in.token.scope": "true",
-        "display.on.consent.screen": "true",
-        "consent.screen.text": "${profileScopeConsentText}"
-      },
-      "protocolMappers": [
-        {
-          "id": "58c5a94e-3f63-49d4-b57a-3ed45087c03b",
-          "name": "birthdate",
-          "protocol": "openid-connect",
-          "protocolMapper": "oidc-usermodel-attribute-mapper",
-          "consentRequired": false,
-          "config": {
-            "userinfo.token.claim": "true",
-            "user.attribute": "birthdate",
-            "id.token.claim": "true",
-            "access.token.claim": "true",
-            "claim.name": "birthdate",
-            "jsonType.label": "String"
-          }
-        },
-        {
-          "id": "a940ae28-1090-4660-84e2-a4396485aba2",
-          "name": "picture",
-          "protocol": "openid-connect",
-          "protocolMapper": "oidc-usermodel-attribute-mapper",
-          "consentRequired": false,
-          "config": {
-            "userinfo.token.claim": "true",
-            "user.attribute": "picture",
-            "id.token.claim": "true",
-            "access.token.claim": "true",
-            "claim.name": "picture",
-            "jsonType.label": "String"
-          }
-        },
-        {
-          "id": "c5c938a2-7ddd-4b96-8806-db7aaaf1883e",
-          "name": "username",
-          "protocol": "openid-connect",
-          "protocolMapper": "oidc-usermodel-property-mapper",
-          "consentRequired": false,
-          "config": {
-            "userinfo.token.claim": "true",
-            "user.attribute": "username",
-            "id.token.claim": "true",
-            "access.token.claim": "true",
-            "claim.name": "preferred_username",
-            "jsonType.label": "String"
-          }
-        },
-        {
-          "id": "801d2478-da8e-4b8e-8125-de57e8952d21",
-          "name": "website",
-          "protocol": "openid-connect",
-          "protocolMapper": "oidc-usermodel-attribute-mapper",
-          "consentRequired": false,
-          "config": {
-            "userinfo.token.claim": "true",
-            "user.attribute": "website",
-            "id.token.claim": "true",
-            "access.token.claim": "true",
-            "claim.name": "website",
-            "jsonType.label": "String"
-          }
-        },
-        {
-          "id": "26df33bb-d365-49eb-ae05-5c26d2da824c",
-          "name": "gender",
-          "protocol": "openid-connect",
-          "protocolMapper": "oidc-usermodel-attribute-mapper",
-          "consentRequired": false,
-          "config": {
-            "userinfo.token.claim": "true",
-            "user.attribute": "gender",
-            "id.token.claim": "true",
-            "access.token.claim": "true",
-            "claim.name": "gender",
-            "jsonType.label": "String"
-          }
-        },
-        {
-          "id": "077f8ae6-5c99-4888-b8cc-bd529795dd9a",
-          "name": "locale",
-          "protocol": "openid-connect",
-          "protocolMapper": "oidc-usermodel-attribute-mapper",
-          "consentRequired": false,
-          "config": {
-            "userinfo.token.claim": "true",
-            "user.attribute": "locale",
-            "id.token.claim": "true",
-            "access.token.claim": "true",
-            "claim.name": "locale",
-            "jsonType.label": "String"
-          }
-        },
-        {
-          "id": "645b1072-ec42-4d71-90ca-a2ba00f057ca",
-          "name": "zoneinfo",
-          "protocol": "openid-connect",
-          "protocolMapper": "oidc-usermodel-attribute-mapper",
-          "consentRequired": false,
-          "config": {
-            "userinfo.token.claim": "true",
-            "user.attribute": "zoneinfo",
-            "id.token.claim": "true",
-            "access.token.claim": "true",
-            "claim.name": "zoneinfo",
-            "jsonType.label": "String"
-          }
-        },
-        {
-          "id": "ae5aab45-5e3a-4856-b301-8c2a16a35368",
-          "name": "nickname",
-          "protocol": "openid-connect",
-          "protocolMapper": "oidc-usermodel-attribute-mapper",
-          "consentRequired": false,
-          "config": {
-            "userinfo.token.claim": "true",
-            "user.attribute": "nickname",
-            "id.token.claim": "true",
-            "access.token.claim": "true",
-            "claim.name": "nickname",
-            "jsonType.label": "String"
-          }
-        },
-        {
-          "id": "70dcf380-a212-45e6-8bfa-a89590e8b824",
-          "name": "full name",
-          "protocol": "openid-connect",
-          "protocolMapper": "oidc-full-name-mapper",
-          "consentRequired": false,
-          "config": {
-            "id.token.claim": "true",
-            "access.token.claim": "true",
-            "userinfo.token.claim": "true"
-          }
-        },
-        {
-          "id": "84cf501f-192b-4c34-baa2-a01e38d0d102",
-          "name": "middle name",
-          "protocol": "openid-connect",
-          "protocolMapper": "oidc-usermodel-attribute-mapper",
-          "consentRequired": false,
-          "config": {
-            "userinfo.token.claim": "true",
-            "user.attribute": "middleName",
-            "id.token.claim": "true",
-            "access.token.claim": "true",
-            "claim.name": "middle_name",
-            "jsonType.label": "String"
-          }
-        },
-        {
-          "id": "fe02f8c6-5957-49d1-846c-17ae34f686ab",
-          "name": "profile",
-          "protocol": "openid-connect",
-          "protocolMapper": "oidc-usermodel-attribute-mapper",
-          "consentRequired": false,
-          "config": {
-            "userinfo.token.claim": "true",
-            "user.attribute": "profile",
-            "id.token.claim": "true",
-            "access.token.claim": "true",
-            "claim.name": "profile",
-            "jsonType.label": "String"
-          }
-        },
-        {
-          "id": "1f58896d-5cad-4226-8a96-cb9b772be039",
-          "name": "family name",
-          "protocol": "openid-connect",
-          "protocolMapper": "oidc-usermodel-property-mapper",
-          "consentRequired": false,
-          "config": {
-            "userinfo.token.claim": "true",
-            "user.attribute": "lastName",
-            "id.token.claim": "true",
-            "access.token.claim": "true",
-            "claim.name": "family_name",
-            "jsonType.label": "String"
-          }
-        },
-        {
-          "id": "697388d3-7e68-428e-af22-ec749d6dbeb1",
-          "name": "updated at",
-          "protocol": "openid-connect",
-          "protocolMapper": "oidc-usermodel-attribute-mapper",
-          "consentRequired": false,
-          "config": {
-            "userinfo.token.claim": "true",
-            "user.attribute": "updatedAt",
-            "id.token.claim": "true",
-            "access.token.claim": "true",
-            "claim.name": "updated_at",
-            "jsonType.label": "long"
-          }
-        },
-        {
-          "id": "f5159dc2-4d3a-4daf-bc5e-1c8c4d349ddf",
-          "name": "given name",
-          "protocol": "openid-connect",
-          "protocolMapper": "oidc-usermodel-property-mapper",
-          "consentRequired": false,
-          "config": {
-            "userinfo.token.claim": "true",
-            "user.attribute": "firstName",
-            "id.token.claim": "true",
-            "access.token.claim": "true",
-            "claim.name": "given_name",
-            "jsonType.label": "String"
-          }
-        }
-      ]
-    },
-    {
-      "id": "95edb5a7-a039-4fa8-9bd8-6cf1c0004ff1",
-      "name": "microprofile-jwt",
-      "description": "Microprofile - JWT built-in scope",
-      "protocol": "openid-connect",
-      "attributes": {
-        "include.in.token.scope": "true",
-        "display.on.consent.screen": "false"
-      },
-      "protocolMappers": [
-        {
-          "id": "462051d5-029e-4fd2-9369-8f543415efe3",
-          "name": "groups",
-          "protocol": "openid-connect",
-          "protocolMapper": "oidc-usermodel-realm-role-mapper",
-          "consentRequired": false,
-          "config": {
-            "multivalued": "true",
-            "userinfo.token.claim": "true",
-            "user.attribute": "foo",
-            "id.token.claim": "true",
-            "access.token.claim": "true",
-            "claim.name": "groups",
-            "jsonType.label": "String"
-          }
-        },
-        {
-          "id": "edecee36-099c-4cb5-9f28-5c81c4213919",
-          "name": "upn",
-          "protocol": "openid-connect",
-          "protocolMapper": "oidc-usermodel-property-mapper",
-          "consentRequired": false,
-          "config": {
-            "userinfo.token.claim": "true",
-            "user.attribute": "username",
-            "id.token.claim": "true",
-            "access.token.claim": "true",
-            "claim.name": "upn",
-            "jsonType.label": "String"
-          }
-        }
-      ]
-    },
-    {
-      "id": "515536ae-261d-4a86-9021-7ad57ee9d1c7",
-      "name": "address",
-      "description": "OpenID Connect built-in scope: address",
-      "protocol": "openid-connect",
-      "attributes": {
-        "include.in.token.scope": "true",
-        "display.on.consent.screen": "true",
-        "consent.screen.text": "${addressScopeConsentText}"
-      },
-      "protocolMappers": [
-        {
-          "id": "e4306684-bbdc-491d-85ac-a27a76c575a4",
-          "name": "address",
-          "protocol": "openid-connect",
-          "protocolMapper": "oidc-address-mapper",
-          "consentRequired": false,
-          "config": {
-            "user.attribute.formatted": "formatted",
-            "user.attribute.country": "country",
-            "user.attribute.postal_code": "postal_code",
-            "userinfo.token.claim": "true",
-            "user.attribute.street": "street",
-            "id.token.claim": "true",
-            "user.attribute.region": "region",
-            "access.token.claim": "true",
-            "user.attribute.locality": "locality"
-          }
-        }
-      ]
-    },
-    {
-      "id": "044ae227-c291-48a6-9511-c865657d8d29",
-      "name": "offline_access",
-      "description": "OpenID Connect built-in scope: offline_access",
-      "protocol": "openid-connect",
-      "attributes": {
-        "consent.screen.text": "${offlineAccessScopeConsentText}",
-        "display.on.consent.screen": "true"
-      }
-    },
-    {
-      "id": "0e0a238c-0cea-4f62-a278-b4af1aedeb0f",
-      "name": "acr",
-      "description": "OpenID Connect scope for add acr (authentication context class reference) to the token",
-      "protocol": "openid-connect",
-      "attributes": {
-        "include.in.token.scope": "false",
-        "display.on.consent.screen": "false"
-      },
-      "protocolMappers": [
-        {
-          "id": "70411dc1-c84c-4daa-b0f7-58e66a0a644a",
-          "name": "acr loa level",
-          "protocol": "openid-connect",
-          "protocolMapper": "oidc-acr-mapper",
-          "consentRequired": false,
-          "config": {
-            "id.token.claim": "true",
-            "access.token.claim": "true",
-            "userinfo.token.claim": "true"
-          }
-        }
-      ]
-    }
-  ],
-  "defaultDefaultClientScopes": [
-    "profile",
-    "email",
-    "web-origins",
-    "acr",
-    "pitc"
-  ],
-  "defaultOptionalClientScopes": [
-    "offline_access",
-    "address",
-    "phone",
-    "microprofile-jwt"
-  ],
-  "browserSecurityHeaders": {
-    "contentSecurityPolicyReportOnly": "",
-    "xContentTypeOptions": "nosniff",
-    "xRobotsTag": "none",
-    "xFrameOptions": "SAMEORIGIN",
-    "contentSecurityPolicy": "frame-src 'self'; frame-ancestors 'self'; object-src 'none';",
-    "xXSSProtection": "1; mode=block",
-    "strictTransportSecurity": "max-age=31536000; includeSubDomains"
-  },
-  "smtpServer": {},
-  "eventsEnabled": false,
-  "eventsListeners": [
-    "jboss-logging"
-  ],
-  "enabledEventTypes": [],
-  "adminEventsEnabled": false,
-  "adminEventsDetailsEnabled": false,
-  "identityProviders": [],
-  "identityProviderMappers": [],
-  "components": {
-    "org.keycloak.services.clientregistration.policy.ClientRegistrationPolicy": [
-      {
-        "id": "e17e98d3-eb1f-4ce4-9c3c-009b29e3ac06",
-        "name": "Max Clients Limit",
-        "providerId": "max-clients",
-        "subType": "anonymous",
-        "subComponents": {},
-        "config": {
-          "max-clients": [
-            "200"
-          ]
-        }
-      },
-      {
-        "id": "825d03dd-56f9-4516-bdf4-0d429f410c96",
-        "name": "Allowed Protocol Mapper Types",
-        "providerId": "allowed-protocol-mappers",
-        "subType": "anonymous",
-        "subComponents": {},
-        "config": {
-          "allowed-protocol-mapper-types": [
-            "oidc-usermodel-property-mapper",
-            "saml-role-list-mapper",
-            "oidc-address-mapper",
-            "saml-user-attribute-mapper",
-            "oidc-full-name-mapper",
-            "oidc-sha256-pairwise-sub-mapper",
-            "saml-user-property-mapper",
-            "oidc-usermodel-attribute-mapper"
-          ]
-        }
-      },
-      {
-        "id": "ca3537dd-70b8-4077-9718-60844c658ce3",
-        "name": "Allowed Client Scopes",
-        "providerId": "allowed-client-templates",
-        "subType": "authenticated",
-        "subComponents": {},
-        "config": {
-          "allow-default-scopes": [
-            "true"
-          ]
-        }
-      },
-      {
-        "id": "27924afa-35e7-4701-9f02-fc97aa85a357",
-        "name": "Consent Required",
-        "providerId": "consent-required",
-        "subType": "anonymous",
-        "subComponents": {},
-        "config": {}
-      },
-      {
-        "id": "aed582be-e3d4-4eeb-a108-951ad8807971",
-        "name": "Allowed Protocol Mapper Types",
-        "providerId": "allowed-protocol-mappers",
-        "subType": "authenticated",
-        "subComponents": {},
-        "config": {
-          "allowed-protocol-mapper-types": [
-            "saml-user-attribute-mapper",
-            "saml-role-list-mapper",
-            "oidc-usermodel-property-mapper",
-            "oidc-full-name-mapper",
-            "oidc-usermodel-attribute-mapper",
-            "oidc-address-mapper",
-            "saml-user-property-mapper",
-            "oidc-sha256-pairwise-sub-mapper"
-          ]
-        }
-      },
-      {
-        "id": "4a22bcac-2e91-4e73-a063-9d888cc46cdb",
-        "name": "Trusted Hosts",
-        "providerId": "trusted-hosts",
-        "subType": "anonymous",
-        "subComponents": {},
-        "config": {
-          "host-sending-registration-request-must-match": [
-            "true"
-          ],
-          "client-uris-must-match": [
-            "true"
-          ]
-        }
-      },
-      {
-        "id": "e49dea0a-880b-4cfd-a266-b7fe6dc2acf0",
-        "name": "Full Scope Disabled",
-        "providerId": "scope",
-        "subType": "anonymous",
-        "subComponents": {},
-        "config": {}
-      },
-      {
-        "id": "e00bdb9f-8495-4d78-98e7-57ead89f9bb2",
-        "name": "Allowed Client Scopes",
-        "providerId": "allowed-client-templates",
-        "subType": "anonymous",
-        "subComponents": {},
-        "config": {
-          "allow-default-scopes": [
-            "true"
-          ]
-        }
-      }
-    ],
-    "org.keycloak.userprofile.UserProfileProvider": [
-      {
-        "id": "9fe82fb7-4892-48d5-8906-3d58a9a05d1e",
-        "providerId": "declarative-user-profile",
-        "subComponents": {},
-        "config": {}
-      }
-    ],
-    "org.keycloak.keys.KeyProvider": [
-      {
-        "id": "4b17c76a-249a-4397-b0b9-eff96aedb59d",
-        "name": "rsa-enc-generated",
-        "providerId": "rsa-enc-generated",
-        "subComponents": {},
-        "config": {
-          "priority": [
-            "100"
-          ],
-          "algorithm": [
-            "RSA-OAEP"
-          ]
-        }
-      },
-      {
-        "id": "1c92da1a-c6d9-4444-8cbe-7f088b3d5212",
-        "name": "hmac-generated",
-        "providerId": "hmac-generated",
-        "subComponents": {},
-        "config": {
-          "priority": [
-            "100"
-          ],
-          "algorithm": [
-            "HS256"
-          ]
-        }
-      },
-      {
-        "id": "c622e2d0-6459-4454-baee-c6277ba285ce",
-        "name": "rsa-generated",
-        "providerId": "rsa-generated",
-        "subComponents": {},
-        "config": {
-          "priority": [
-            "100"
-          ]
-        }
-      },
-      {
-        "id": "966cbb2f-8ebb-423f-8311-77f75704abea",
-        "name": "aes-generated",
-        "providerId": "aes-generated",
-        "subComponents": {},
-        "config": {
-          "priority": [
-            "100"
-          ]
-        }
-      }
-    ]
-  },
-  "internationalizationEnabled": false,
-  "supportedLocales": [],
-  "authenticationFlows": [
-    {
-      "id": "76ccd78f-6481-4cef-9d09-efcbb1bf8d5e",
-      "alias": "Account verification options",
-      "description": "Method with which to verity the existing account",
-      "providerId": "basic-flow",
-      "topLevel": false,
-      "builtIn": true,
-      "authenticationExecutions": [
-        {
-          "authenticator": "idp-email-verification",
-          "authenticatorFlow": false,
-          "requirement": "ALTERNATIVE",
-          "priority": 10,
-          "autheticatorFlow": false,
-          "userSetupAllowed": false
-        },
-        {
-          "authenticatorFlow": true,
-          "requirement": "ALTERNATIVE",
-          "priority": 20,
-          "autheticatorFlow": true,
-          "flowAlias": "Verify Existing Account by Re-authentication",
-          "userSetupAllowed": false
-        }
-      ]
-    },
-    {
-      "id": "84d61c19-dd42-4bb1-aa9d-227c00a72c97",
-      "alias": "Authentication Options",
-      "description": "Authentication options.",
-      "providerId": "basic-flow",
-      "topLevel": false,
-      "builtIn": true,
-      "authenticationExecutions": [
-        {
-          "authenticator": "basic-auth",
-          "authenticatorFlow": false,
-          "requirement": "REQUIRED",
-          "priority": 10,
-          "autheticatorFlow": false,
-          "userSetupAllowed": false
-        },
-        {
-          "authenticator": "basic-auth-otp",
-          "authenticatorFlow": false,
-          "requirement": "DISABLED",
-          "priority": 20,
-          "autheticatorFlow": false,
-          "userSetupAllowed": false
-        },
-        {
-          "authenticator": "auth-spnego",
-          "authenticatorFlow": false,
-          "requirement": "DISABLED",
-          "priority": 30,
-          "autheticatorFlow": false,
-          "userSetupAllowed": false
-        }
-      ]
-    },
-    {
-      "id": "f4eff540-099a-40f7-bdc8-4137f7099796",
-      "alias": "Browser - Conditional OTP",
-      "description": "Flow to determine if the OTP is required for the authentication",
-      "providerId": "basic-flow",
-      "topLevel": false,
-      "builtIn": true,
-      "authenticationExecutions": [
-        {
-          "authenticator": "conditional-user-configured",
-          "authenticatorFlow": false,
-          "requirement": "REQUIRED",
-          "priority": 10,
-          "autheticatorFlow": false,
-          "userSetupAllowed": false
-        },
-        {
-          "authenticator": "auth-otp-form",
-          "authenticatorFlow": false,
-          "requirement": "REQUIRED",
-          "priority": 20,
-          "autheticatorFlow": false,
-          "userSetupAllowed": false
-        }
-      ]
-    },
-    {
-      "id": "f44d4ab5-8ab8-4e00-8d13-b7f32a96951b",
-      "alias": "Direct Grant - Conditional OTP",
-      "description": "Flow to determine if the OTP is required for the authentication",
-      "providerId": "basic-flow",
-      "topLevel": false,
-      "builtIn": true,
-      "authenticationExecutions": [
-        {
-          "authenticator": "conditional-user-configured",
-          "authenticatorFlow": false,
-          "requirement": "REQUIRED",
-          "priority": 10,
-          "autheticatorFlow": false,
-          "userSetupAllowed": false
-        },
-        {
-          "authenticator": "direct-grant-validate-otp",
-          "authenticatorFlow": false,
-          "requirement": "REQUIRED",
-          "priority": 20,
-          "autheticatorFlow": false,
-          "userSetupAllowed": false
-        }
-      ]
-    },
-    {
-      "id": "41e00a6d-5768-445d-9705-18219ea77266",
-      "alias": "First broker login - Conditional OTP",
-      "description": "Flow to determine if the OTP is required for the authentication",
-      "providerId": "basic-flow",
-      "topLevel": false,
-      "builtIn": true,
-      "authenticationExecutions": [
-        {
-          "authenticator": "conditional-user-configured",
-          "authenticatorFlow": false,
-          "requirement": "REQUIRED",
-          "priority": 10,
-          "autheticatorFlow": false,
-          "userSetupAllowed": false
-        },
-        {
-          "authenticator": "auth-otp-form",
-          "authenticatorFlow": false,
-          "requirement": "REQUIRED",
-          "priority": 20,
-          "autheticatorFlow": false,
-          "userSetupAllowed": false
-        }
-      ]
-    },
-    {
-      "id": "05fe1a21-fa8c-4485-a429-7108a96fa4b1",
-      "alias": "Handle Existing Account",
-      "description": "Handle what to do if there is existing account with same email/username like authenticated identity provider",
-      "providerId": "basic-flow",
-      "topLevel": false,
-      "builtIn": true,
-      "authenticationExecutions": [
-        {
-          "authenticator": "idp-confirm-link",
-          "authenticatorFlow": false,
-          "requirement": "REQUIRED",
-          "priority": 10,
-          "autheticatorFlow": false,
-          "userSetupAllowed": false
-        },
-        {
-          "authenticatorFlow": true,
-          "requirement": "REQUIRED",
-          "priority": 20,
-          "autheticatorFlow": true,
-          "flowAlias": "Account verification options",
-          "userSetupAllowed": false
-        }
-      ]
-    },
-    {
-      "id": "93a29c80-fd7d-43e4-b29a-a067bd36ac09",
-      "alias": "Reset - Conditional OTP",
-      "description": "Flow to determine if the OTP should be reset or not. Set to REQUIRED to force.",
-      "providerId": "basic-flow",
-      "topLevel": false,
-      "builtIn": true,
-      "authenticationExecutions": [
-        {
-          "authenticator": "conditional-user-configured",
-          "authenticatorFlow": false,
-          "requirement": "REQUIRED",
-          "priority": 10,
-          "autheticatorFlow": false,
-          "userSetupAllowed": false
-        },
-        {
-          "authenticator": "reset-otp",
-          "authenticatorFlow": false,
-          "requirement": "REQUIRED",
-          "priority": 20,
-          "autheticatorFlow": false,
-          "userSetupAllowed": false
-        }
-      ]
-    },
-    {
-      "id": "e37ecd7c-7cab-4b17-8436-d43e40136e42",
-      "alias": "User creation or linking",
-      "description": "Flow for the existing/non-existing user alternatives",
-      "providerId": "basic-flow",
-      "topLevel": false,
-      "builtIn": true,
-      "authenticationExecutions": [
-        {
-          "authenticatorConfig": "create unique user config",
-          "authenticator": "idp-create-user-if-unique",
-          "authenticatorFlow": false,
-          "requirement": "ALTERNATIVE",
-          "priority": 10,
-          "autheticatorFlow": false,
-          "userSetupAllowed": false
-        },
-        {
-          "authenticatorFlow": true,
-          "requirement": "ALTERNATIVE",
-          "priority": 20,
-          "autheticatorFlow": true,
-          "flowAlias": "Handle Existing Account",
-          "userSetupAllowed": false
-        }
-      ]
-    },
-    {
-      "id": "8be1fe46-6069-45d3-8806-255b408214f9",
-      "alias": "Verify Existing Account by Re-authentication",
-      "description": "Reauthentication of existing account",
-      "providerId": "basic-flow",
-      "topLevel": false,
-      "builtIn": true,
-      "authenticationExecutions": [
-        {
-          "authenticator": "idp-username-password-form",
-          "authenticatorFlow": false,
-          "requirement": "REQUIRED",
-          "priority": 10,
-          "autheticatorFlow": false,
-          "userSetupAllowed": false
-        },
-        {
-          "authenticatorFlow": true,
-          "requirement": "CONDITIONAL",
-          "priority": 20,
-          "autheticatorFlow": true,
-          "flowAlias": "First broker login - Conditional OTP",
-          "userSetupAllowed": false
-        }
-      ]
-    },
-    {
-      "id": "465bc00b-c86e-42aa-9cbd-8d136389a800",
-      "alias": "browser",
-      "description": "browser based authentication",
-      "providerId": "basic-flow",
-      "topLevel": true,
-      "builtIn": true,
-      "authenticationExecutions": [
-        {
-          "authenticator": "auth-cookie",
-          "authenticatorFlow": false,
-          "requirement": "ALTERNATIVE",
-          "priority": 10,
-          "autheticatorFlow": false,
-          "userSetupAllowed": false
-        },
-        {
-          "authenticator": "auth-spnego",
-          "authenticatorFlow": false,
-          "requirement": "DISABLED",
-          "priority": 20,
-          "autheticatorFlow": false,
-          "userSetupAllowed": false
-        },
-        {
-          "authenticator": "identity-provider-redirector",
-          "authenticatorFlow": false,
-          "requirement": "ALTERNATIVE",
-          "priority": 25,
-          "autheticatorFlow": false,
-          "userSetupAllowed": false
-        },
-        {
-          "authenticatorFlow": true,
-          "requirement": "ALTERNATIVE",
-          "priority": 30,
-          "autheticatorFlow": true,
-          "flowAlias": "forms",
-          "userSetupAllowed": false
-        }
-      ]
-    },
-    {
-      "id": "da1677a9-9fe5-4d48-bc7d-87e8a14317b2",
-      "alias": "clients",
-      "description": "Base authentication for clients",
-      "providerId": "client-flow",
-      "topLevel": true,
-      "builtIn": true,
-      "authenticationExecutions": [
-        {
-          "authenticator": "client-secret",
-          "authenticatorFlow": false,
-          "requirement": "ALTERNATIVE",
-          "priority": 10,
-          "autheticatorFlow": false,
-          "userSetupAllowed": false
-        },
-        {
-          "authenticator": "client-jwt",
-          "authenticatorFlow": false,
-          "requirement": "ALTERNATIVE",
-          "priority": 20,
-          "autheticatorFlow": false,
-          "userSetupAllowed": false
-        },
-        {
-          "authenticator": "client-secret-jwt",
-          "authenticatorFlow": false,
-          "requirement": "ALTERNATIVE",
-          "priority": 30,
-          "autheticatorFlow": false,
-          "userSetupAllowed": false
-        },
-        {
-          "authenticator": "client-x509",
-          "authenticatorFlow": false,
-          "requirement": "ALTERNATIVE",
-          "priority": 40,
-          "autheticatorFlow": false,
-          "userSetupAllowed": false
-        }
-      ]
-    },
-    {
-      "id": "eb28b4a6-d3e2-4c7d-aba5-603618a2080c",
-      "alias": "direct grant",
-      "description": "OpenID Connect Resource Owner Grant",
-      "providerId": "basic-flow",
-      "topLevel": true,
-      "builtIn": true,
-      "authenticationExecutions": [
-        {
-          "authenticator": "direct-grant-validate-username",
-          "authenticatorFlow": false,
-          "requirement": "REQUIRED",
-          "priority": 10,
-          "autheticatorFlow": false,
-          "userSetupAllowed": false
-        },
-        {
-          "authenticator": "direct-grant-validate-password",
-          "authenticatorFlow": false,
-          "requirement": "REQUIRED",
-          "priority": 20,
-          "autheticatorFlow": false,
-          "userSetupAllowed": false
-        },
-        {
-          "authenticatorFlow": true,
-          "requirement": "CONDITIONAL",
-          "priority": 30,
-          "autheticatorFlow": true,
-          "flowAlias": "Direct Grant - Conditional OTP",
-          "userSetupAllowed": false
-        }
-      ]
-    },
-    {
-      "id": "184ee903-a00f-462f-9f23-24b6905e50c2",
-      "alias": "docker auth",
-      "description": "Used by Docker clients to authenticate against the IDP",
-      "providerId": "basic-flow",
-      "topLevel": true,
-      "builtIn": true,
-      "authenticationExecutions": [
-        {
-          "authenticator": "docker-http-basic-authenticator",
-          "authenticatorFlow": false,
-          "requirement": "REQUIRED",
-          "priority": 10,
-          "autheticatorFlow": false,
-          "userSetupAllowed": false
-        }
-      ]
-    },
-    {
-      "id": "06264f3c-9a18-4395-863c-32d7cf75178a",
-      "alias": "first broker login",
-      "description": "Actions taken after first broker login with identity provider account, which is not yet linked to any Keycloak account",
-      "providerId": "basic-flow",
-      "topLevel": true,
-      "builtIn": true,
-      "authenticationExecutions": [
-        {
-          "authenticatorConfig": "review profile config",
-          "authenticator": "idp-review-profile",
-          "authenticatorFlow": false,
-          "requirement": "REQUIRED",
-          "priority": 10,
-          "autheticatorFlow": false,
-          "userSetupAllowed": false
-        },
-        {
-          "authenticatorFlow": true,
-          "requirement": "REQUIRED",
-          "priority": 20,
-          "autheticatorFlow": true,
-          "flowAlias": "User creation or linking",
-          "userSetupAllowed": false
-        }
-      ]
-    },
-    {
-      "id": "8a302a30-c1ce-4628-a953-05eae840e919",
-      "alias": "forms",
-      "description": "Username, password, otp and other auth forms.",
-      "providerId": "basic-flow",
-      "topLevel": false,
-      "builtIn": true,
-      "authenticationExecutions": [
-        {
-          "authenticator": "auth-username-password-form",
-          "authenticatorFlow": false,
-          "requirement": "REQUIRED",
-          "priority": 10,
-          "autheticatorFlow": false,
-          "userSetupAllowed": false
-        },
-        {
-          "authenticatorFlow": true,
-          "requirement": "CONDITIONAL",
-          "priority": 20,
-          "autheticatorFlow": true,
-          "flowAlias": "Browser - Conditional OTP",
-          "userSetupAllowed": false
-        }
-      ]
-    },
-    {
-      "id": "fc1076ab-5d5d-49ee-a392-d9abcce32cf0",
-      "alias": "http challenge",
-      "description": "An authentication flow based on challenge-response HTTP Authentication Schemes",
-      "providerId": "basic-flow",
-      "topLevel": true,
-      "builtIn": true,
-      "authenticationExecutions": [
-        {
-          "authenticator": "no-cookie-redirect",
-          "authenticatorFlow": false,
-          "requirement": "REQUIRED",
-          "priority": 10,
-          "autheticatorFlow": false,
-          "userSetupAllowed": false
-        },
-        {
-          "authenticatorFlow": true,
-          "requirement": "REQUIRED",
-          "priority": 20,
-          "autheticatorFlow": true,
-          "flowAlias": "Authentication Options",
-          "userSetupAllowed": false
-        }
-      ]
-    },
-    {
-      "id": "89dc879d-926a-4118-a55d-069178987489",
-      "alias": "registration",
-      "description": "registration flow",
-      "providerId": "basic-flow",
-      "topLevel": true,
-      "builtIn": true,
-      "authenticationExecutions": [
-        {
-          "authenticator": "registration-page-form",
-          "authenticatorFlow": true,
-          "requirement": "REQUIRED",
-          "priority": 10,
-          "autheticatorFlow": true,
-          "flowAlias": "registration form",
-          "userSetupAllowed": false
-        }
-      ]
-    },
-    {
-      "id": "94dcf858-7176-4c9b-af69-fb046ebac202",
-      "alias": "registration form",
-      "description": "registration form",
-      "providerId": "form-flow",
-      "topLevel": false,
-      "builtIn": true,
-      "authenticationExecutions": [
-        {
-          "authenticator": "registration-user-creation",
-          "authenticatorFlow": false,
-          "requirement": "REQUIRED",
-          "priority": 20,
-          "autheticatorFlow": false,
-          "userSetupAllowed": false
-        },
-        {
-          "authenticator": "registration-profile-action",
-          "authenticatorFlow": false,
-          "requirement": "REQUIRED",
-          "priority": 40,
-          "autheticatorFlow": false,
-          "userSetupAllowed": false
-        },
-        {
-          "authenticator": "registration-password-action",
-          "authenticatorFlow": false,
-          "requirement": "REQUIRED",
-          "priority": 50,
-          "autheticatorFlow": false,
-          "userSetupAllowed": false
-        },
-        {
-          "authenticator": "registration-recaptcha-action",
-          "authenticatorFlow": false,
-          "requirement": "DISABLED",
-          "priority": 60,
-          "autheticatorFlow": false,
-          "userSetupAllowed": false
-        }
-      ]
-    },
-    {
-      "id": "0626b26e-3282-4670-b97b-25664490ce52",
-      "alias": "reset credentials",
-      "description": "Reset credentials for a user if they forgot their password or something",
-      "providerId": "basic-flow",
-      "topLevel": true,
-      "builtIn": true,
-      "authenticationExecutions": [
-        {
-          "authenticator": "reset-credentials-choose-user",
-          "authenticatorFlow": false,
-          "requirement": "REQUIRED",
-          "priority": 10,
-          "autheticatorFlow": false,
-          "userSetupAllowed": false
-        },
-        {
-          "authenticator": "reset-credential-email",
-          "authenticatorFlow": false,
-          "requirement": "REQUIRED",
-          "priority": 20,
-          "autheticatorFlow": false,
-          "userSetupAllowed": false
-        },
-        {
-          "authenticator": "reset-password",
-          "authenticatorFlow": false,
-          "requirement": "REQUIRED",
-          "priority": 30,
-          "autheticatorFlow": false,
-          "userSetupAllowed": false
-        },
-        {
-          "authenticatorFlow": true,
-          "requirement": "CONDITIONAL",
-          "priority": 40,
-          "autheticatorFlow": true,
-          "flowAlias": "Reset - Conditional OTP",
-          "userSetupAllowed": false
-        }
-      ]
-    },
-    {
-      "id": "acb17cf5-08ce-4025-b240-4607989b07c2",
-      "alias": "saml ecp",
-      "description": "SAML ECP Profile Authentication Flow",
-      "providerId": "basic-flow",
-      "topLevel": true,
-      "builtIn": true,
-      "authenticationExecutions": [
-        {
-          "authenticator": "http-basic-authenticator",
-          "authenticatorFlow": false,
-          "requirement": "REQUIRED",
-          "priority": 10,
-          "autheticatorFlow": false,
-          "userSetupAllowed": false
-        }
-      ]
-    }
-  ],
-  "authenticatorConfig": [
-    {
-      "id": "47bdcb07-ee72-4f0b-896c-f99fcd4ab91b",
-      "alias": "create unique user config",
-      "config": {
-        "require.password.update.after.registration": "false"
-      }
-    },
-    {
-      "id": "06ce8406-cd9e-49cf-9d1f-8c2d9462ba02",
-      "alias": "review profile config",
-      "config": {
-        "update.profile.on.first.login": "missing"
-      }
-    }
-  ],
-  "requiredActions": [
-    {
-      "alias": "CONFIGURE_TOTP",
-      "name": "Configure OTP",
-      "providerId": "CONFIGURE_TOTP",
-      "enabled": true,
-      "defaultAction": false,
-      "priority": 10,
-      "config": {}
-    },
-    {
-      "alias": "TERMS_AND_CONDITIONS",
-      "name": "Terms and Conditions",
-      "providerId": "TERMS_AND_CONDITIONS",
-      "enabled": false,
-      "defaultAction": false,
-      "priority": 20,
-      "config": {}
-    },
-    {
-      "alias": "UPDATE_PASSWORD",
-      "name": "Update Password",
-      "providerId": "UPDATE_PASSWORD",
-      "enabled": true,
-      "defaultAction": false,
-      "priority": 30,
-      "config": {}
-    },
-    {
-      "alias": "UPDATE_PROFILE",
-      "name": "Update Profile",
-      "providerId": "UPDATE_PROFILE",
-      "enabled": true,
-      "defaultAction": false,
-      "priority": 40,
-      "config": {}
-    },
-    {
-      "alias": "VERIFY_EMAIL",
-      "name": "Verify Email",
-      "providerId": "VERIFY_EMAIL",
-      "enabled": true,
-      "defaultAction": false,
-      "priority": 50,
-      "config": {}
-    },
-    {
-      "alias": "delete_account",
-      "name": "Delete Account",
-      "providerId": "delete_account",
-      "enabled": false,
-      "defaultAction": false,
-      "priority": 60,
-      "config": {}
-    },
-    {
-      "alias": "webauthn-register",
-      "name": "Webauthn Register",
-      "providerId": "webauthn-register",
-      "enabled": true,
-      "defaultAction": false,
-      "priority": 70,
-      "config": {}
-    },
-    {
-      "alias": "webauthn-register-passwordless",
-      "name": "Webauthn Register Passwordless",
-      "providerId": "webauthn-register-passwordless",
-      "enabled": true,
-      "defaultAction": false,
-      "priority": 80,
-      "config": {}
-    },
-    {
-      "alias": "update_user_locale",
-      "name": "Update User Locale",
-      "providerId": "update_user_locale",
-      "enabled": true,
-      "defaultAction": false,
-      "priority": 1000,
-      "config": {}
-    }
-  ],
-  "browserFlow": "browser",
-  "registrationFlow": "registration",
-  "directGrantFlow": "direct grant",
-  "resetCredentialsFlow": "reset credentials",
-  "clientAuthenticationFlow": "clients",
-  "dockerAuthenticationFlow": "docker auth",
-  "attributes": {
-    "cibaBackchannelTokenDeliveryMode": "poll",
-    "cibaAuthRequestedUserHint": "login_hint",
-    "clientOfflineSessionMaxLifespan": "0",
-    "oauth2DevicePollingInterval": "5",
-    "clientSessionIdleTimeout": "0",
-    "clientOfflineSessionIdleTimeout": "0",
-    "cibaInterval": "5",
-    "realmReusableOtpCode": "false",
-    "cibaExpiresIn": "120",
-    "oauth2DeviceCodeLifespan": "600",
-    "parRequestUriLifespan": "60",
-    "clientSessionMaxLifespan": "0",
-    "frontendUrl": "",
-    "acr.loa.map": "{}"
-  },
-  "keycloakVersion": "21.1.1",
-  "userManagedAccessAllowed": false,
-  "clientProfiles": {
-    "profiles": []
-  },
-  "clientPolicies": {
-    "policies": []
-  }
-}
\ No newline at end of file
diff --git a/docker/dataset/init.sql b/docker/dataset/init.sql
new file mode 100644
index 0000000000..9824907b93
--- /dev/null
+++ b/docker/dataset/init.sql
@@ -0,0 +1,15 @@
+-- pitc
+create user pitc with encrypted password 'pwd';
+create schema if not exists okr_pitc;
+grant create on schema okr_pitc to pitc;
+grant all privileges on all tables in schema okr_pitc to pitc;
+grant all privileges on all sequences in schema okr_pitc to pitc;
+grant usage on schema okr_pitc to pitc;
+
+-- acme
+create user acme with encrypted password 'pwd';
+create schema if not exists okr_acme;
+grant create on schema okr_acme to acme;
+grant all privileges on all tables in schema okr_acme to acme;
+grant all privileges on all sequences in schema okr_acme to acme;
+grant usage on schema okr_acme to acme;
\ No newline at end of file
diff --git a/docker/docker-compose.yml b/docker/docker-compose.yml
index b771f743d5..a35a5e6954 100644
--- a/docker/docker-compose.yml
+++ b/docker/docker-compose.yml
@@ -9,16 +9,31 @@ services:
       POSTGRES_DB: okr
     ports:
       - 5432:5432
+    volumes:
+      - ./dataset:/docker-entrypoint-initdb.d
+
+  keycloak-pitc:
+    image: quay.io/keycloak/keycloak:24.0.3
+    environment:
+      - KEYCLOAK_ADMIN=admin
+      - KEYCLOAK_ADMIN_PASSWORD=keycloak
+    volumes:
+       - ./config/realm-export-pitc.json:/opt/keycloak/data/import/realm-pitc.json
+    command:
+      - start-dev
+      - --import-realm
+    ports:
+      - "8544:8080"
 
-  keycloak:
-    image: quay.io/keycloak/keycloak:24.0.5
+  keycloak-acme:
+    image: quay.io/keycloak/keycloak:24.0.3
     environment:
       - KEYCLOAK_ADMIN=admin
       - KEYCLOAK_ADMIN_PASSWORD=keycloak
     volumes:
-       - ./config/realm-export.json:/opt/keycloak/data/import/realm.json
+      - ./config/realm-export-acme.json:/opt/keycloak/data/import/realm-acme.json
     command:
       - start-dev
       - --import-realm
     ports:
-      - "8544:8080"
\ No newline at end of file
+      - "8545:8080"
\ No newline at end of file
diff --git a/docker/local-prod/docker-compose.yml b/docker/local-prod/docker-compose.yml
index d6d39842a4..285cf3ce97 100644
--- a/docker/local-prod/docker-compose.yml
+++ b/docker/local-prod/docker-compose.yml
@@ -12,36 +12,17 @@ services:
     environment:
       SPRING_PROFILES_ACTIVE: staging
       LOGGING_LEVEL_ORG_SPRINGFRAMEWORK: debug
-      SPRING_SECURITY_OAUTH2_RESOURCESERVER_JWT_ISSUER-URI: http://localhost:8544/realms/pitc
-      SPRING_SECURITY_OAUTH2_RESOURCESERVER_JWT_JWK-SET-URI: http://keycloak:8080/realms/pitc/protocol/openid-connect/certs
-#      SPRING_SECURITY_OAUTH2_RESOURCESERVER_JWT_ISSUER-URI: https://sso.puzzle.ch/auth/realms/pitc
-#      SPRING_SECURITY_OAUTH2_RESOURCESERVER_JWT_JWK-SET-URI: https://sso.puzzle.ch/auth/realms/pitc/protocol/openid-connect/certs
-      SPRING_SECURITY_OAUTH2_RESOURCESERVER_OPAQUETOKEN_CLIENT-ID: pitc_okr_staging
-      ## Postgres DB
-      SPRING_DATASOURCE_URL: jdbc:postgresql://okr-dev-db:5432/okr
-      SPRING_DATASOURCE_USERNAME: user
-      SPRING_DATASOURCE_PASSWORD: pwd
-      SPRING_FLYWAY_LOCATIONS: classpath:db/data-migration,classpath:db/migration,classpath:db/callback
-
-      ## In memory DB
-#      SPRING_DATASOURCE_URL: jdbc:h2:mem:db;DB_CLOSE_DELAY=-1
-#      SPRING_DATASOURCE_USERNAME: user
-#      SPRING_DATASOURCE_PASSWORD: sa
-#      SPRING_FLYWAY_LOCATIONS: classpath:db/h2-db/database-h2-schema,classpath:db/h2-db/data-test-h2
     volumes:
         - ../../../okr/backend/target:/app-root/backend
-    depends_on:
-      maven:
-        condition: service_completed_successfully
 
   maven:
     container_name: maven
-    image: maven:3.8.3-openjdk-17
+    image: maven:3.9.9-amazoncorretto-21
+    command: sh -c "mvn fizzed-watcher:run"
+    working_dir: /app-root/
     volumes:
-      - ../../../okr:/opt
-      - /etc/passwd:/etc/passwd:ro
-      - /etc/group:/etc/group:ro
-    command: [ "/bin/bash", "-c", "cd /opt && mvn -B clean package --file pom.xml -P build-for-docker && chown -R 1000:1000 ./backend/target" ]
+      - ../../../okr:/app-root/
+      - ~/.m2/repository:/root/.m2/repository
 
   angular:
     container_name: angular
diff --git a/frontend/cypress.config.ts b/frontend/cypress.config.ts
index 798456f1aa..626c39a492 100644
--- a/frontend/cypress.config.ts
+++ b/frontend/cypress.config.ts
@@ -2,7 +2,7 @@ import { defineConfig } from 'cypress';
 
 export default defineConfig({
   e2e: {
-    baseUrl: 'http://localhost:4200',
+    baseUrl: 'http://pitc.okr.localhost:4200',
     experimentalMemoryManagement: true,
   },
   env: {
diff --git a/frontend/cypress/e2e/checkIn.cy.ts b/frontend/cypress/e2e/checkIn.cy.ts
index 937a6f51ca..45728dedc0 100644
--- a/frontend/cypress/e2e/checkIn.cy.ts
+++ b/frontend/cypress/e2e/checkIn.cy.ts
@@ -1,5 +1,7 @@
 import * as users from '../fixtures/users.json';
 import { onlyOn } from '@cypress/skip-test';
+import { uniqueSuffix } from '../support/utils';
+import Chainable = Cypress.Chainable;
 
 describe('OKR Check-in e2e tests', () => {
   describe('tests via click', () => {
@@ -281,18 +283,19 @@ describe('OKR Check-in e2e tests', () => {
       cy.getByTestId('submit').click();
 
       cy.getByTestId('keyresult').contains('I am a metric keyresult for testing').click();
-      cy.tabForward();
-      cy.tabForward();
+
+      cy.tabForwardUntil('[data-testId="add-check-in"]');
       cy.focused().contains('Check-in erfassen').click();
       cy.contains('Check-in im Draft-Status');
       cy.contains('Dein Objective befindet sich noch im DRAFT Status. Möchtest du das Check-in trotzdem erfassen?');
     });
 
-    it(`Should not display last value div if last checkin is not present`, () => {
+    it(`Should only display last value div if last checkin is present`, () => {
+      const objectiveName = uniqueSuffix('new objective');
       cy.getByTestId('add-objective').first().click();
-      cy.fillOutObjective('new objective', 'safe', '3');
+      cy.fillOutObjective(objectiveName, 'safe', '3');
       cy.visit('/?quarter=3');
-      cy.contains('new objective').first().parentsUntil('#objective-column').last().focus();
+      getObjectiveContainerByName(objectiveName).focus();
 
       cy.tabForwardUntil('[data-testId="add-keyResult"]');
       cy.focused().contains('Key Result hinzufügen');
@@ -300,16 +303,24 @@ describe('OKR Check-in e2e tests', () => {
 
       cy.fillOutKeyResult('I am a keyresult metric', 'PERCENT', '45', '60', null, null, null, null, 'Description');
       cy.getByTestId('submit').click();
-      cy.getByTestId('keyresult').contains('I am a keyresult metric').click();
+      getObjectiveContainerByName(objectiveName).getByTestId('keyresult').contains('I am a keyresult metric').click();
+
+      cy.intercept('**/keyresults/*').as('getKeyResultsAfterSave');
       cy.getByTestId('add-check-in').first().click();
       cy.get('#old-value').should('not.exist');
-      cy.fillOutCheckInMetric(10, false, 'changeinfo', 'initiatives');
+      cy.fillOutCheckInMetric(10, 0, 'changeinfo', 'initiatives');
+      cy.wait('@getKeyResultsAfterSave');
+
       cy.getByTestId('add-check-in').first().click();
-      cy.get('#old-value').should('not.exist');
+      cy.get('#old-value label + div').contains('10 %');
     });
   });
 });
 
+function getObjectiveContainerByName(name: string): Chainable {
+  return cy.contains(name).first().parentsUntil('#objective-column').last();
+}
+
 function checkForDialogTextMetric() {
   cy.contains('Very important keyresult');
   cy.contains('Check-in erfassen');
@@ -341,8 +352,10 @@ function getCurrentDate() {
   let mm = today.getMonth() + 1; // Months start at 0!
   let dd = today.getDate();
 
-  if (dd < 10) dd = '0' + dd;
-  if (mm < 10) mm = '0' + mm;
+  let dd_str = '' + dd;
+  let mm_str = '' + mm;
+  if (dd < 10) dd_str = '0' + dd_str;
+  if (mm < 10) mm_str = '0' + mm_str;
 
-  return dd + '.' + mm + '.' + yyyy;
+  return dd_str + '.' + mm_str + '.' + yyyy;
 }
diff --git a/frontend/cypress/e2e/login.cy.ts b/frontend/cypress/e2e/login.cy.ts
index 0552d9a0d2..d7730d355b 100644
--- a/frontend/cypress/e2e/login.cy.ts
+++ b/frontend/cypress/e2e/login.cy.ts
@@ -19,4 +19,13 @@ describe('OKR Login', () => {
       cy.get('#kc-page-title').contains('Sign in to your account');
     });
   });
+
+  it('Click on the Hilfe button should open a new tab with the correct URL', () => {
+    cy.window().then((win) => {
+      cy.stub(win, 'open').as('openWindow');
+    });
+
+    cy.get('#hilfeButton').click();
+    cy.get('@openWindow').should('be.calledWith', 'https://wiki.puzzle.ch/Puzzle/OKRs');
+  });
 });
diff --git a/frontend/cypress/e2e/objective-backlog.cy.ts b/frontend/cypress/e2e/objective-backlog.cy.ts
index e1e374f780..5706262f4d 100644
--- a/frontend/cypress/e2e/objective-backlog.cy.ts
+++ b/frontend/cypress/e2e/objective-backlog.cy.ts
@@ -97,7 +97,7 @@ describe('OKR Objective Backlog e2e tests', () => {
 
     cy.contains('This is our first released objective').should('not.exist');
 
-    cy.visit('/?quarter=99');
+    cy.visit('/?quarter=998');
 
     cy.contains('This is our first released objective');
   });
@@ -142,12 +142,12 @@ describe('OKR Objective Backlog e2e tests', () => {
     cy.get('select#quarter').select('GJ ForTests');
     cy.getByTestId('safe').first().click();
 
-    cy.visit('/?quarter=99');
+    cy.visit('/?quarter=998');
     cy.contains('This goes to other quarter later');
   });
 
   it(`Can duplicate from backlog`, () => {
-    cy.visit('/?quarter=99');
+    cy.visit('/?quarter=998');
     cy.getByTestId('add-objective').first().click();
     cy.fillOutObjective('Ready for duplicate', 'safe-draft', undefined, '', false);
 
diff --git a/frontend/cypress/e2e/overview.cy.ts b/frontend/cypress/e2e/overview.cy.ts
index 7ee4e991b4..9f472d899b 100644
--- a/frontend/cypress/e2e/overview.cy.ts
+++ b/frontend/cypress/e2e/overview.cy.ts
@@ -6,9 +6,11 @@ describe('OKR Overview', () => {
   });
 
   it('Check order of teams', () => {
+    cy.intercept('GET', '**/overview*').as('overview');
+
     cy.get('mat-chip:visible:contains("Alle")').click();
-    cy.wait(500);
-    const textsExpectedOrder = ['Puzzle ITC', '/BBT', 'LoremIpsum', 'we are cube.³'];
+    cy.wait('@overview');
+    const textsExpectedOrder = ['LoremIpsum', 'Puzzle ITC', '/BBT', 'we are cube.³'];
     cy.get('.team-title').then((elements) => {
       const texts: string[] = elements.map((_, el) => Cypress.$(el).text()).get();
       expect(texts).to.deep.equal(textsExpectedOrder);
diff --git a/frontend/cypress/e2e/tab.cy.ts b/frontend/cypress/e2e/tab.cy.ts
index f20f3f4889..ac3ed8157e 100644
--- a/frontend/cypress/e2e/tab.cy.ts
+++ b/frontend/cypress/e2e/tab.cy.ts
@@ -123,11 +123,11 @@ describe('Tab workflow tests', () => {
     beforeEach(() => {
       cy.loginAsUser(users.gl);
       onlyOn('chrome');
+      cy.tabForward();
     });
 
     // Header from here
     it('Tab to help element and user menu', () => {
-      cy.tabForward();
       cy.focused().contains('Teamverwaltung');
       cy.tabForward();
       cy.focused().contains('Hilfe');
@@ -136,7 +136,6 @@ describe('Tab workflow tests', () => {
     });
 
     it('Tab to user menu and log out', () => {
-      cy.tabForward();
       cy.tabForward();
       cy.tabForward();
       cy.focused().contains('Jaya Norris');
@@ -149,7 +148,6 @@ describe('Tab workflow tests', () => {
       cy.tabForward();
       cy.tabForward();
       cy.tabForward();
-      cy.tabForward();
       cy.focused().contains('GJ');
       cy.tabForward();
       cy.focused().type('Objective').wait(350); // Decided to try writing since this changes the url. Sadly you can't use contains on placeholders otherwise I would have done that
@@ -217,7 +215,7 @@ describe('Tab workflow tests', () => {
       cy.contains('Edited by Cypress');
     });
 
-    it('Duplicate objective with tab', () => {
+    it.skip('Duplicate objective with tab', () => {
       openThreeDotMenu();
       cy.realPress('ArrowDown');
       cy.focused().contains('Objective duplizieren');
@@ -339,7 +337,7 @@ describe('Tab workflow tests', () => {
       cy.contains('This has been edited by Cypress').should('not.exist');
     });
 
-    it('Create new key result metric with checkin and edit checkin with tab', () => {
+    it.skip('Create new key result metric with checkin and edit checkin with tab', () => {
       // Create keyresult
       openCreateKeyResult();
       cy.wait(500);
diff --git a/frontend/cypress/e2e/team.cy.ts b/frontend/cypress/e2e/team.cy.ts
index 87c42457ff..b94536280f 100644
--- a/frontend/cypress/e2e/team.cy.ts
+++ b/frontend/cypress/e2e/team.cy.ts
@@ -73,28 +73,29 @@ describe('OKR team e2e tests', () => {
         .and('eq', 'rgb(30, 90, 150)');
       cy.get('mat-chip:visible:contains("LoremIpsum")')
         .should('have.css', 'background-color')
-        .and('eq', 'rgb(255, 255, 255)');
+        .and('eq', 'rgb(30, 90, 150)');
       cy.get('mat-chip:visible:contains("we are cube")')
         .should('have.css', 'background-color')
         .and('eq', 'rgb(255, 255, 255)');
       cy.get('mat-chip:visible:contains("Puzzle ITC")').click();
+      cy.get('mat-chip:visible:contains("LoremIpsum")').click();
       cy.contains('Kein Team ausgewählt');
     });
 
     it('URL changes to the selected teams', () => {
       cy.url().should('include', 'teams=');
       cy.url().should('include', '5');
-      cy.url().should('not.include', '6');
+      cy.url().should('include', '6');
 
-      cy.get('mat-chip:visible:contains("LoremIpsum")').click();
+      cy.get('mat-chip:visible:contains("/BBT")').click();
       cy.url().should('include', 'teams=');
       cy.url().should('include', '5');
       cy.url().should('include', '6');
+      cy.url().should('include', '4');
       cy.get('mat-chip:visible:contains("Puzzle ITC")').click();
       cy.get('mat-chip:visible:contains("LoremIpsum")').click();
+      cy.get('mat-chip:visible:contains("/BBT")').click();
       cy.url().should('not.include', 'teams=');
-      cy.url().should('not.include', '5');
-      cy.url().should('not.include', '6');
     });
 
     it('Select teams by url', () => {
diff --git a/frontend/cypress/e2e/teammanagement.cy.ts b/frontend/cypress/e2e/teammanagement.cy.ts
index 3538e1f555..627e6c95da 100644
--- a/frontend/cypress/e2e/teammanagement.cy.ts
+++ b/frontend/cypress/e2e/teammanagement.cy.ts
@@ -1,70 +1,416 @@
 import * as users from '../fixtures/users.json';
+import { uniqueSuffix } from '../support/utils';
 
 describe('Team management tests', () => {
+  const teamName = uniqueSuffix('New Team');
+  const nameEsha = users.bl.name;
+
   describe('As GL', () => {
+    before(() => {
+      // login as bl to ensure this user exists in database
+      cy.loginAsUser(users.bl);
+      cy.getByTestId('user-name').click();
+      cy.getByTestId('logout').click();
+    });
+
     beforeEach(() => {
       cy.loginAsUser(users.gl);
+      cy.getByTestId('team-management').click();
     });
 
     it('Opens teammanagement dialog', () => {
-      cy.getByTestId('team-management').click();
-
       //Check if overview contains correct titles of teammanagement
       cy.contains('Teamverwaltung');
-      cy.contains('Teamname');
-      cy.contains('Organisationen');
+      cy.contains('Team erfassen');
+      cy.contains('Alle Teams');
     });
 
     it('Create team', () => {
-      cy.getByTestId('team-management').click();
-      cy.wait(500);
-      cy.getByTestId('name').click().type('New Team');
+      cy.intercept('POST', '**/teams').as('addTeam');
+
+      cy.contains('Teamverwaltung');
+      cy.getByTestId('add-team').click();
+      cy.getByTestId('add-team-name').click().clear().type(teamName, { delay: 1 });
+      cy.getByTestId('add-team-save').click();
+      cy.wait('@addTeam');
+      cy.contains(teamName);
+    });
 
-      //Select gl as organisation
-      cy.getByTestId('organisation-select').click().get('mat-option').contains('org_gl').click();
-      cy.realPress('Escape');
+    it('Try to remove last admin of team should not work', () => {
+      cy.intercept('PUT', '**/removeuser').as('removeUser');
 
-      //Save team and check if team appears now on overview
-      cy.getByTestId('save').click();
-      cy.contains('New Team');
+      cy.get('app-team-list .mat-mdc-list-item').contains(teamName).click();
+      cy.getByTestId('member-list-more').click();
+      cy.getByTestId('remove-from-member-list').click();
+
+      // dialog
+      cy.contains(`Jaya Norris wirklich aus Team ${teamName} entfernen?`);
+      cy.getByTestId('cancelDialog-confirm').click();
+
+      cy.wait('@removeUser');
+
+      cy.contains('Der letzte Administrator eines Teams kann nicht entfernt werden').should('exist');
+    });
+
+    it('clicking cancel in dialog when removing user should not remove user', () => {
+      cy.intercept('PUT', '**/removeuser').as('removeUser');
+
+      cy.get('app-team-list .mat-mdc-list-item').contains(teamName).click();
+      cy.getByTestId('member-list-more').click();
+      cy.getByTestId('remove-from-member-list').click();
+
+      // cancel dialog
+      cy.contains(`Jaya Norris wirklich aus Team ${teamName} entfernen?`);
+      cy.getByTestId('cancelDialog-cancel').click();
+
+      cy.get('@removeUser.all').then((interceptions) => {
+        expect(interceptions).to.have.length(0);
+      });
     });
 
     it('Edit team', () => {
-      cy.get('mat-chip:visible:contains("LoremIpsum")').click();
-      cy.getByTestId('edit-team-LoremIpsum').click();
-      cy.getByTestId('name').click().clear().type('LoremIpsumEdited');
-      cy.getByTestId('organisation-select').click();
+      cy.intercept('GET', '**/users').as('getUsers');
+      cy.intercept('GET', '**/teams').as('getTeams');
 
-      //Remove organisations from team
-      cy.get('mat-option').contains('org_bl').click();
-      cy.get('mat-option').contains('org_mobility').click();
+      cy.get('app-team-list .mat-mdc-list-item').contains('LoremIpsum').click();
+      editTeamNameAndTest('IpsumLorem');
+      cy.visit('team-management');
 
-      //Add organisation to team
-      cy.get('mat-option').contains('org_azubi').click();
-      cy.realPress('Escape');
+      cy.wait(['@getUsers', '@getTeams']);
 
-      //Save Team and check if it was edited correctly
-      cy.getByTestId('save').click();
-      cy.contains('LoremIpsumEdited');
+      cy.contains('LoremIpsum').should('not.exist');
+      cy.contains('IpsumLorem').should('exist');
+      // set old team name again
+      cy.get('app-team-list .mat-mdc-list-item').contains('IpsumLorem').click();
+      editTeamNameAndTest('LoremIpsum');
     });
 
     it('Delete team', () => {
-      cy.get('mat-chip:visible:contains("LoremIpsum")').click();
-      cy.getByTestId('edit-team-LoremIpsumEdited').click();
+      cy.intercept('DELETE', '**/teams/*').as('saveTeam');
+      cy.intercept('GET', '**/users').as('getUsers');
+
+      cy.contains('app-team-list .mat-mdc-list-item', teamName).click();
+
       //Click delete button
-      cy.getByTestId('delete').click();
-      cy.getByTestId('confirmYes').click();
-      cy.contains('LoremIpsum').should('not.exist');
+      cy.getByTestId('teamMoreButton').click();
+      cy.getByTestId('teamDeleteButton').click();
+
+      // cancel dialog => cancel
+      cy.contains(`${teamName} wirklich löschen?`);
+      cy.getByTestId('cancelDialog-cancel').click();
+
+      // try again and confirm dialog
+      cy.getByTestId('teamMoreButton').click();
+      cy.getByTestId('teamDeleteButton').click();
+      cy.contains(`${teamName} wirklich löschen?`);
+      cy.getByTestId('cancelDialog-confirm').click();
+
+      cy.wait(['@saveTeam', '@getUsers']);
+
+      cy.contains(teamName).should('not.exist');
+    });
+
+    describe('Search', () => {
+      it('Search user', () => {
+        cy.get('app-team-management-banner').getByTestId('teamManagementSearch').click().type('pa', { delay: 1 });
+
+        cy.contains('.mat-mdc-autocomplete-panel mat-option', 'Paco Eggimann (peggimann@puzzle.ch)');
+        cy.contains('.mat-mdc-autocomplete-panel mat-option', 'Paco Egiman (egiman@puzzle.ch)');
+        cy.contains('.mat-mdc-autocomplete-panel mat-option', 'Robin Papierer (papierer@puzzle.ch)').click();
+
+        cy.contains('app-member-detail h2', 'Robin Papierer');
+      });
+
+      it('Search team', () => {
+        cy.get('app-team-management-banner').getByTestId('teamManagementSearch').click().type('we are', { delay: 1 });
+
+        cy.contains('.mat-mdc-autocomplete-panel mat-option', 'we are cube.³').click();
+
+        cy.contains('app-member-list h2', 'we are cube.³');
+      });
+
+      it('Search mixed', () => {
+        cy.get('app-team-management-banner').getByTestId('teamManagementSearch').click().type('puz', { delay: 1 });
+
+        cy.contains('.mat-mdc-autocomplete-panel .mat-mdc-optgroup-label', 'Members');
+        cy.contains('.mat-mdc-autocomplete-panel .mat-mdc-optgroup-label', 'Teams');
+        cy.contains('.mat-mdc-autocomplete-panel mat-option', 'Paco Eggimann (peggimann@puzzle.ch)');
+        cy.contains('.mat-mdc-autocomplete-panel mat-option', 'Paco Egiman (egiman@puzzle.ch)');
+        cy.contains('.mat-mdc-autocomplete-panel mat-option', 'Robin Papierer (papierer@puzzle.ch)');
+        cy.contains('.mat-mdc-autocomplete-panel mat-option', 'Puzzle ITC');
+      });
+    });
+
+    describe('invite members', () => {
+      it('invite two members', () => {
+        const mailUserClaudia = uniqueSuffix('claudia.meier@test') + '.ch';
+        const mailUserStefan = uniqueSuffix('stefan.schmidt@test') + '.ch';
+        const firstNameClaudia = uniqueSuffix('Claudia');
+        const firstNameStefan = uniqueSuffix('Stefan');
+
+        cy.getByTestId('invite-member').click();
+        fillOutNewUser(firstNameClaudia, 'Meier', mailUserClaudia);
+        cy.tabForward();
+        cy.tabForward();
+        cy.realPress('Enter');
+        fillOutNewUser(firstNameStefan, 'Schmidt', mailUserStefan);
+        cy.tabForward();
+        cy.tabForward();
+        cy.realPress('Enter');
+
+        // test error messages
+        fillOutNewUser('Robin', '', 'papierer');
+        cy.getByTestId('invite').click();
+        cy.contains('Angabe benötigt');
+        cy.contains('E-Mail ungültig');
+        cy.getByTestId('email-col_2').focus();
+        cy.realType('@puzzle.ch');
+        cy.contains('E-Mail ungültig').should('not.exist');
+        cy.contains('E-Mail existiert bereits');
+        cy.tabBackward();
+        cy.realType('Papirer');
+        cy.contains('Angabe benötigt').should('not.exist');
+
+        // delete last entry
+        cy.tabForward();
+        cy.tabForward();
+        cy.realPress('Enter');
+        cy.contains('papiererr@puzzle.ch').should('not.exist');
+
+        // save
+        cy.getByTestId('invite').click();
+        cy.contains('Die Members wurden erfolgreich registriert');
+        cy.contains(firstNameClaudia);
+        cy.contains(firstNameStefan);
+      });
+    });
+
+    it('Navigate to Bobs profile and add him to BBT and LoremIpsum', () => {
+      cy.intercept('PUT', '**/updateaddteammembership/*').as('updateEsha');
+
+      navigateToUser(nameEsha);
+
+      // add to team bbt as admin
+      cy.get('app-member-detail').getByTestId('add-user').click();
+      cy.get('app-member-detail').getByTestId('select-team-dropdown').click();
+      cy.getByTestId('select-team-dropdown-option').contains('/BBT').click();
+      cy.get('app-member-detail').getByTestId('select-team-role').click();
+      cy.getByTestId('select-team-role-admin').click();
+      cy.get('app-member-detail').getByTestId('add-user-to-team-save').click();
+
+      cy.wait('@updateEsha');
+
+      // add to team loremipsum as member
+      cy.get('app-member-detail').getByTestId('add-user').click();
+      cy.get('app-member-detail').getByTestId('select-team-dropdown').click();
+
+      // team BBT should not be in list anymore
+      cy.getByTestId('select-team-dropdown-option').should('not.contain', '/BBT');
+
+      cy.getByTestId('select-team-dropdown-option').contains('LoremIpsum').click();
+      cy.get('app-member-detail').getByTestId('select-team-role').click();
+      cy.getByTestId('select-team-role-member').click();
+      cy.get('app-member-detail').getByTestId('add-user-to-team-save').click();
+
+      cy.wait('@updateEsha');
+      // check table
+      checkRolesForEsha();
+
+      closeOverlay();
+
+      let foundEsha = false;
+      cy.get('app-member-list tbody tr')
+        .each(($row) => {
+          let usernameCell = $row.find('td:nth-child(2)');
+          if (usernameCell.text().trim() === nameEsha) {
+            foundEsha = true;
+            let roleCell = $row.find('td:nth-child(3)');
+            let teamsCell = $row.find('td:nth-child(4)');
+            expect(roleCell.text().trim()).to.equal('Team-Admin, Team-Member');
+            expect(teamsCell.text().trim()).to.equal('/BBT, LoremIpsum');
+            return false;
+          }
+          return true;
+        })
+        .then(() => {
+          expect(foundEsha).to.be.true;
+        });
+    });
+
+    it('Navigate to user Esha and set as okr champion', () => {
+      navigateToUser(nameEsha);
+      cy.getByTestId('edit-okr-champion-readonly').contains('OKR Champion:');
+      cy.getByTestId('edit-okr-champion-readonly').contains('Nein');
+      cy.getByTestId('edit-okr-champion-edit').click();
+      cy.getByTestId('edit-okr-champion-readonly').should('not.exist');
+      cy.getByTestId('edit-okr-champion-checkbox').click();
+      cy.getByTestId('edit-okr-champion-readonly').contains('OKR Champion:');
+      cy.getByTestId('edit-okr-champion-readonly').contains('Ja');
+      cy.contains('Der Member wurde erfolgreich aktualisiert.');
+
+      // reset okr champion to false
+      cy.getByTestId('edit-okr-champion-edit').click();
+      cy.getByTestId('edit-okr-champion-checkbox').click();
+      cy.getByTestId('edit-okr-champion-readonly').contains('OKR Champion:');
+      cy.getByTestId('edit-okr-champion-readonly').contains('Nein');
+
+      // test click outside of element
+      cy.getByTestId('edit-okr-champion-edit').click();
+      cy.get('app-member-detail').find('h2').click();
+      // checkbox should hide again
+      cy.getByTestId('edit-okr-champion-readonly').contains('OKR Champion:');
+      cy.getByTestId('edit-okr-champion-readonly').contains('Nein');
     });
   });
 
   describe('As BL', () => {
     beforeEach(() => {
       cy.loginAsUser(users.bl);
+      cy.getByTestId('team-management').click();
     });
 
-    it('Can not see teammanagement icons', () => {
-      cy.getByTestId('team-management').should('not.exist');
+    it('should check if correct roles for BL are set', () => {
+      cy.intercept('GET', '**/users/*').as('getEsha');
+
+      cy.get('td').contains(nameEsha).click();
+      cy.wait('@getEsha');
+
+      checkRolesForEsha();
+      closeOverlay();
+    });
+
+    it('should check if team loremIpsum cannot be edited', () => {
+      cy.get('app-team-management').contains('LoremIpsum').click();
+      cy.getByTestId('teamMoreButton').should('not.exist');
+      cy.getByTestId('editTeamButton').should('not.exist');
+      cy.getByTestId('member-list-more').should('not.exist');
+      cy.getByTestId('edit-role').should('not.exist');
+    });
+
+    it('should check if team /BBT can be edited and edit name', () => {
+      cy.get('app-team-management').contains('/BBT').click();
+      cy.getByTestId('teamMoreButton').should('exist');
+      editTeamNameAndTest('/BBT_edit');
+      // restore old name
+      editTeamNameAndTest('/BBT');
+    });
+
+    it('should add members to team /BBT', () => {
+      cy.get('app-team-management').contains('/BBT').click();
+      cy.getByTestId('add-team-member').click();
+      cy.getByTestId('search-member-to-add').click();
+
+      // esha should not exist (is already member of team)
+      const matOption = '.cdk-overlay-container mat-option';
+      cy.get(matOption).contains(nameEsha).should('not.exist');
+
+      // add findus peterson
+      cy.getByTestId('search-member-to-add').click().type('Find', { delay: 1 });
+      cy.get(matOption).contains('Findus Peterson').click();
+
+      // add robin papierer
+      cy.getByTestId('search-member-to-add').click();
+      cy.get(matOption).contains('Findus Peterson').should('not.exist');
+      cy.get(matOption).contains('Robin Papierer').click();
+
+      // check if Findus and Robin exists in table
+      const allMemberTableTr = '#all-member-table tbody tr';
+      cy.get(allMemberTableTr).eq(0).should('contain', 'Findus Peterson');
+      cy.get(allMemberTableTr).eq(1).should('contain', 'Robin Papierer');
+
+      // remove robin papierer from list
+      cy.get(allMemberTableTr + ' button')
+        .eq(1)
+        .click();
+      cy.get(allMemberTableTr).eq(1).should('not.exist');
+
+      cy.getByTestId('save').click();
+    });
+
+    it('should change role of Findus Peterson to Team Admin', () => {
+      cy.get('app-team-management').contains('/BBT').click();
+
+      cy.get('app-member-list tbody tr')
+        .each(($row) => {
+          let usernameCell = $row.find('td:nth-child(2)');
+          if (usernameCell.text().trim() !== 'Findus Peterson') {
+            return;
+          }
+          $row.find(`[data-testId='edit-role']`).click();
+        })
+        .then(() => {
+          cy.getByTestId('select-team-role').click();
+          cy.getByTestId('select-team-role-admin').click();
+          cy.getByTestId('select-team-role').should('not.exist');
+          cy.contains('Das Team wurde erfolgreich aktualisiert.');
+        });
+    });
+
+    it('should test that Findus Peterson cannot be added to further teams', () => {
+      navigateToUser('Findus Peterson');
+
+      // current user BL (Esha Harris) is only admin in /BBT team.
+      // That's why 'add-team-member' should be disabled
+      cy.get('app-member-detail').getByTestId('add-user').should('be.disabled');
+    });
+
+    it('should remove BBT membership of findus', () => {
+      navigateToUser('Findus Peterson');
+      cy.getByTestId('delete-team-member').click();
+      cy.getByTestId('cancelDialog-confirm').click();
+      cy.get('app-member-detail').contains('/BBT').should('not.exist');
+    });
+
+    it('should remove added memberships from esha', () => {
+      cy.intercept('PUT', '**/removeuser').as('removeUser');
+
+      navigateToUser(nameEsha);
+      cy.getByTestId('delete-team-member').eq(0).click();
+      cy.getByTestId('cancelDialog-confirm').click();
+
+      cy.wait('@removeUser');
+
+      cy.getByTestId('delete-team-member').eq(0).click();
+      cy.getByTestId('cancelDialog-confirm').click();
+      cy.get('app-member-detail').should('not.contain', '/BBT').and('not.contain', 'LoremIpsum');
+    });
+
+    it('Navigate to user Esha and check if okr champion is not editable', () => {
+      navigateToUser(nameEsha);
+      cy.getByTestId('edit-okr-champion-readonly').should('exist');
+      cy.getByTestId('edit-okr-champion-edit').should('not.exist');
     });
   });
 });
+
+function closeOverlay() {
+  cy.get('.cdk-overlay-backdrop').click(-50, -50, { force: true });
+}
+
+function checkRolesForEsha() {
+  cy.get('app-member-detail tbody tr').eq(0).should('contain', '/BBT').and('contain', 'Team-Admin');
+  cy.get('app-member-detail tbody tr').eq(1).should('contain', 'LoremIpsum').and('contain', 'Team-Member');
+}
+
+function editTeamNameAndTest(teamName: string) {
+  cy.intercept('PUT', '**/teams/*').as('saveTeam');
+  cy.getByTestId('editTeamButton').click();
+  cy.getByTestId('add-team-name').click().clear().type(teamName, { delay: 1 });
+  cy.getByTestId('add-team-save').click();
+  cy.wait('@saveTeam');
+  cy.contains(teamName);
+}
+
+function navigateToUser(userName: string) {
+  cy.intercept('GET', '**/users/*').as('getUser');
+  cy.get('td').contains(userName).click();
+  cy.wait('@getUser');
+}
+
+function fillOutNewUser(firstname: string, lastname: string, email: string) {
+  cy.realType(firstname, { delay: 1 });
+  cy.tabForward();
+  cy.realType(lastname, { delay: 1 });
+  cy.tabForward();
+  cy.realType(email, { delay: 1 });
+}
diff --git a/frontend/cypress/support/commands.ts b/frontend/cypress/support/commands.ts
index 8b7984c01b..8804dc3dc4 100644
--- a/frontend/cypress/support/commands.ts
+++ b/frontend/cypress/support/commands.ts
@@ -245,15 +245,17 @@ function setConfidence(confidence: number) {
 
 function loginWithCredentials(username: string, password: string) {
   cy.visit('/');
+  cy.intercept('GET', '**/users/current').as('getCurrentUser');
   cy.origin(Cypress.env('login_url'), { args: { username, password } }, ({ username, password }) => {
     cy.get('input[name="username"]').type(username);
     cy.get('input[name="password"]').type(password);
     cy.get('input[type="submit"]').click();
+    cy.wait('@getCurrentUser', { responseTimeout: 10000 });
   });
   cy.url().then((url) => {
     const currentUrl = new URL(url);
     const baseURL = new URL(Cypress.config().baseUrl!);
-    expect(currentUrl.pathname).equal(baseURL.pathname + 'callback');
+    expect(currentUrl.pathname).equal(baseURL.pathname);
   });
 }
 
@@ -267,8 +269,7 @@ function checkForToaster(selector: string, amount: number, messages: string[] =
     .then((e) => messages.forEach((m) => expect(e).contains(m)));
 }
 
-const overviewIsLoaded = () =>
-  cy.get('mat-chip').should('have.length.at.least', 2) && cy.get('.team-title').should('have.length.at.least', 1);
+const overviewIsLoaded = () => cy.get('mat-chip').should('have.length.at.least', 2);
 
 // -- This is a parent command --
 // Cypress.Commands.add("login", (email, password) => { ... })
diff --git a/frontend/cypress/support/utils.ts b/frontend/cypress/support/utils.ts
new file mode 100644
index 0000000000..1fcb16f3c7
--- /dev/null
+++ b/frontend/cypress/support/utils.ts
@@ -0,0 +1,5 @@
+import { v4 as uuidv4 } from 'uuid';
+
+export const uniqueSuffix = (value: string): string => {
+  return `${value}-${uuidv4()}`;
+};
diff --git a/frontend/package-lock.json b/frontend/package-lock.json
index 31cd04ab91..d8bcd12778 100644
--- a/frontend/package-lock.json
+++ b/frontend/package-lock.json
@@ -21,7 +21,7 @@
         "@angular/router": "^17.0.6",
         "@ngx-translate/core": "^15.0.0",
         "@ngx-translate/http-loader": "^8.0.0",
-        "angular-auth-oidc-client": "^18.0.1",
+        "angular-oauth2-oidc": "^17.0.0",
         "bootstrap": "^5.3.2",
         "moment": "^2.30.1",
         "ngx-toastr": "^18.0.0",
@@ -36,13 +36,15 @@
         "@cypress/schematic": "^2.5.1",
         "@cypress/skip-test": "^2.6.1",
         "@types/jest": "^29.5.11",
+        "@types/uuid": "^9.0.7",
         "cypress": "^13.6.3",
         "cypress-real-events": "^1.11.0",
         "jest": "^29.7.0",
         "jest-preset-angular": "^14.0.0",
         "ngx-translate-testing": "^7.0.0",
         "prettier": "^3.2.4",
-        "typescript": "^5.2.2"
+        "typescript": "^5.2.2",
+        "uuid": "^9.0.1"
       }
     },
     "node_modules/@ampproject/remapping": {
@@ -2856,6 +2858,15 @@
         "node": ">= 6"
       }
     },
+    "node_modules/@cypress/request/node_modules/uuid": {
+      "version": "8.3.2",
+      "resolved": "https://registry.npmjs.org/uuid/-/uuid-8.3.2.tgz",
+      "integrity": "sha512-+NYs2QeMWy+GWFOEm9xnn6HCDp0l7QBD7ml8zLUmJ+93Q5NF0NocErnwkTkXVFNiX3/fpC6afS8Dhb/gz7R7eg==",
+      "dev": true,
+      "bin": {
+        "uuid": "dist/bin/uuid"
+      }
+    },
     "node_modules/@cypress/schematic": {
       "version": "2.5.2",
       "resolved": "https://registry.npmjs.org/@cypress/schematic/-/schematic-2.5.2.tgz",
@@ -5956,6 +5967,12 @@
       "integrity": "sha512-/Ad8+nIOV7Rl++6f1BdKxFSMgmoqEoYbHRpPcx3JEfv8VRsQe9Z4mCXeJBzxs7mbHY/XOZZuXlRNfhpVPbs6ZA==",
       "dev": true
     },
+    "node_modules/@types/uuid": {
+      "version": "9.0.7",
+      "resolved": "https://registry.npmjs.org/@types/uuid/-/uuid-9.0.7.tgz",
+      "integrity": "sha512-WUtIVRUZ9i5dYXefDEAI7sh9/O7jGvHg7Df/5O/gtH3Yabe5odI3UWopVR1qbPXQtvOxWu3mM4XxlYeZtMWF4g==",
+      "dev": true
+    },
     "node_modules/@types/ws": {
       "version": "8.5.10",
       "resolved": "https://registry.npmjs.org/@types/ws/-/ws-8.5.10.tgz",
@@ -6332,20 +6349,17 @@
         "ajv": "^8.8.2"
       }
     },
-    "node_modules/angular-auth-oidc-client": {
-      "version": "18.0.1",
-      "resolved": "https://registry.npmjs.org/angular-auth-oidc-client/-/angular-auth-oidc-client-18.0.1.tgz",
-      "integrity": "sha512-r+PWZuni5msVEKFyA8HQ1lTTbSrrrsgFnU3qGK6P3TMl6+G3d2KdsXztBaRCNFU4oZq8mbDnmwShyvvVYSvxig==",
+    "node_modules/angular-oauth2-oidc": {
+      "version": "17.0.2",
+      "resolved": "https://registry.npmjs.org/angular-oauth2-oidc/-/angular-oauth2-oidc-17.0.2.tgz",
+      "integrity": "sha512-zYgeLmAnu1g8XAYZK+csAsCQBDhgp9ffBv/eArEnujGxNPTeK00bREHWObtehflpQdSn+k9rY2D15ChCSydyVw==",
       "license": "MIT",
       "dependencies": {
-        "rfc4648": "^1.5.0",
-        "tslib": "^2.3.0"
+        "tslib": "^2.5.2"
       },
       "peerDependencies": {
-        "@angular/common": ">=15.0.0",
-        "@angular/core": ">=15.0.0",
-        "@angular/router": ">=15.0.0",
-        "rxjs": "^6.5.3 || ^7.4.0"
+        "@angular/common": ">=14.0.0",
+        "@angular/core": ">=14.0.0"
       }
     },
     "node_modules/ansi-colors": {
@@ -15346,12 +15360,6 @@
         "node": ">=0.10.0"
       }
     },
-    "node_modules/rfc4648": {
-      "version": "1.5.3",
-      "resolved": "https://registry.npmjs.org/rfc4648/-/rfc4648-1.5.3.tgz",
-      "integrity": "sha512-MjOWxM065+WswwnmNONOT+bD1nXzY9Km6u3kzvnx8F8/HXGZdz3T6e6vZJ8Q/RIMUSp/nxqjH3GwvJDy8ijeQQ==",
-      "license": "MIT"
-    },
     "node_modules/rfdc": {
       "version": "1.3.1",
       "resolved": "https://registry.npmjs.org/rfdc/-/rfdc-1.3.1.tgz",
@@ -15957,6 +15965,15 @@
         "websocket-driver": "^0.7.4"
       }
     },
+    "node_modules/sockjs/node_modules/uuid": {
+      "version": "8.3.2",
+      "resolved": "https://registry.npmjs.org/uuid/-/uuid-8.3.2.tgz",
+      "integrity": "sha512-+NYs2QeMWy+GWFOEm9xnn6HCDp0l7QBD7ml8zLUmJ+93Q5NF0NocErnwkTkXVFNiX3/fpC6afS8Dhb/gz7R7eg==",
+      "dev": true,
+      "bin": {
+        "uuid": "dist/bin/uuid"
+      }
+    },
     "node_modules/socks": {
       "version": "2.7.3",
       "resolved": "https://registry.npmjs.org/socks/-/socks-2.7.3.tgz",
@@ -16976,10 +16993,14 @@
       }
     },
     "node_modules/uuid": {
-      "version": "8.3.2",
-      "resolved": "https://registry.npmjs.org/uuid/-/uuid-8.3.2.tgz",
-      "integrity": "sha512-+NYs2QeMWy+GWFOEm9xnn6HCDp0l7QBD7ml8zLUmJ+93Q5NF0NocErnwkTkXVFNiX3/fpC6afS8Dhb/gz7R7eg==",
+      "version": "9.0.1",
+      "resolved": "https://registry.npmjs.org/uuid/-/uuid-9.0.1.tgz",
+      "integrity": "sha512-b+1eJOlsR9K8HJpow9Ok3fiWOWSIcIzXodvv0rQjVoOVNpWMpxf1wZNpt4y9h10odCNrqnYp1OBzRktckBe3sA==",
       "dev": true,
+      "funding": [
+        "https://github.com/sponsors/broofa",
+        "https://github.com/sponsors/ctavan"
+      ],
       "bin": {
         "uuid": "dist/bin/uuid"
       }
diff --git a/frontend/package.json b/frontend/package.json
index 0ddec04cb1..023c5f5bad 100644
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -35,7 +35,7 @@
     "@angular/router": "^17.0.6",
     "@ngx-translate/core": "^15.0.0",
     "@ngx-translate/http-loader": "^8.0.0",
-    "angular-auth-oidc-client": "^18.0.1",
+    "angular-oauth2-oidc": "^17.0.0",
     "bootstrap": "^5.3.2",
     "moment": "^2.30.1",
     "ngx-toastr": "^18.0.0",
@@ -50,13 +50,15 @@
     "@cypress/schematic": "^2.5.1",
     "@cypress/skip-test": "^2.6.1",
     "@types/jest": "^29.5.11",
+    "@types/uuid": "^9.0.7",
     "cypress": "^13.6.3",
     "cypress-real-events": "^1.11.0",
     "jest": "^29.7.0",
     "jest-preset-angular": "^14.0.0",
     "ngx-translate-testing": "^7.0.0",
     "prettier": "^3.2.4",
-    "typescript": "^5.2.2"
+    "typescript": "^5.2.2",
+    "uuid": "^9.0.1"
   },
   "jest": {
     "preset": "jest-preset-angular",
diff --git a/frontend/src/app/app-routing.module.ts b/frontend/src/app/app-routing.module.ts
index b62a90a4f7..a45b15ce2b 100644
--- a/frontend/src/app/app-routing.module.ts
+++ b/frontend/src/app/app-routing.module.ts
@@ -1,45 +1,57 @@
-import { NgModule } from '@angular/core';
-import { ActivatedRouteSnapshot, ResolveFn, RouterModule, Routes } from '@angular/router';
-import { OverviewComponent } from './overview/overview.component';
-import { EMPTY, of } from 'rxjs';
-import { SidepanelComponent } from './shared/custom/sidepanel/sidepanel.component';
-import { AutoLoginPartialRoutesGuard } from 'angular-auth-oidc-client';
-import { CallbackComponent } from './callback/callback.component';
+import { inject, NgModule } from '@angular/core';
+import { ResolveFn, RouterModule, Routes } from '@angular/router';
+import { OverviewComponent } from './components/overview/overview.component';
+import { of } from 'rxjs';
+import { SidepanelComponent } from './shared/sidepanel/sidepanel.component';
+import { authGuard } from './guards/auth.guard';
+import { UserService } from './services/user.service';
+import { User } from './shared/types/model/User';
+import { OAuthService } from 'angular-oauth2-oidc';
+import { ObjectiveDetailComponent } from './components/objective-detail/objective-detail.component';
+import { KeyresultDetailComponent } from './components/keyresult-detail/keyresult-detail.component';
 
-/**
- * Resolver for get the id from url like `/objective/42` or `/keyresult/42`.
- */
-export const getIdFromPathResolver: ResolveFn<number> = (route: ActivatedRouteSnapshot) => {
-  try {
-    let id = Number.parseInt(route.url[1].path);
-    return of(id);
-  } catch (error) {
-    console.error('Can not get id from URL:', error);
-    return EMPTY;
+const currentUserResolver: ResolveFn<User | undefined> = () => {
+  const oauthService = inject(OAuthService);
+  const userService = inject(UserService);
+  if (oauthService.hasValidIdToken()) {
+    return userService.getOrInitCurrentUser();
   }
+  return of(undefined);
 };
 
 const routes: Routes = [
   {
     path: '',
     component: OverviewComponent,
+    resolve: {
+      user: currentUserResolver,
+    },
     children: [
       {
-        path: 'objective/:id',
+        path: 'details',
         component: SidepanelComponent,
-        resolve: { id: getIdFromPathResolver },
-        data: { type: 'Objective' },
-      },
-      {
-        path: 'keyresult/:id',
-        component: SidepanelComponent,
-        resolve: { id: getIdFromPathResolver },
-        data: { type: 'KeyResult' },
+        children: [
+          {
+            path: 'objective/:id',
+            component: ObjectiveDetailComponent,
+          },
+          {
+            path: 'keyresult/:id',
+            component: KeyresultDetailComponent,
+          },
+        ],
       },
     ],
-    canActivate: [AutoLoginPartialRoutesGuard],
+    canActivate: [authGuard],
+  },
+  {
+    path: 'team-management',
+    loadChildren: () => import('./team-management/team-management.module').then((m) => m.TeamManagementModule),
+    canActivate: [authGuard],
+    resolve: { user: currentUserResolver },
   },
-  { path: 'callback', component: CallbackComponent },
+  { path: 'objective', redirectTo: 'details/objective' },
+  { path: 'keyresult', redirectTo: 'details/keyresult' },
   { path: '**', redirectTo: '', pathMatch: 'full' },
 ];
 
diff --git a/frontend/src/app/app.component.html b/frontend/src/app/app.component.html
index 0680b43f9c..8b3716657a 100644
--- a/frontend/src/app/app.component.html
+++ b/frontend/src/app/app.component.html
@@ -1 +1,2 @@
+<app-application-top-bar></app-application-top-bar>
 <router-outlet></router-outlet>
diff --git a/frontend/src/app/app.component.spec.ts b/frontend/src/app/app.component.spec.ts
index 0359ed6237..05f5175a80 100644
--- a/frontend/src/app/app.component.spec.ts
+++ b/frontend/src/app/app.component.spec.ts
@@ -1,7 +1,9 @@
 import { ComponentFixture, TestBed } from '@angular/core/testing';
+import { RouterTestingModule } from '@angular/router/testing';
 import { AppComponent } from './app.component';
 import { CUSTOM_ELEMENTS_SCHEMA } from '@angular/core';
 import { TranslateTestingModule } from 'ngx-translate-testing';
+import { AuthConfig, OAuthModule, OAuthService } from 'angular-oauth2-oidc';
 import { HttpClientTestingModule } from '@angular/common/http/testing';
 // @ts-ignore
 import * as de from '../assets/i18n/de.json';
@@ -9,12 +11,30 @@ import { HarnessLoader } from '@angular/cdk/testing';
 import { TestbedHarnessEnvironment } from '@angular/cdk/testing/testbed';
 import { MatSidenavModule } from '@angular/material/sidenav';
 import { NoopAnimationsModule } from '@angular/platform-browser/animations';
-import { RouterModule, Routes } from '@angular/router';
+import { NavigationEnd, Routes } from '@angular/router';
 import { of } from 'rxjs';
-import { OverviewComponent } from './overview/overview.component';
-import { ObjectiveDetailComponent } from './objective-detail/objective-detail.component';
+import { OverviewComponent } from './components/overview/overview.component';
+import { ObjectiveDetailComponent } from './components/objective-detail/objective-detail.component';
 import { CommonModule } from '@angular/common';
-import { StsConfigLoader } from 'angular-auth-oidc-client';
+
+const oauthServiceMock = {
+  configure(environment: AuthConfig): void {},
+  initCodeFlow(): void {},
+  setupAutomaticSilentRefresh(): void {},
+  hasValidAccessToken(): boolean {
+    return true;
+  },
+  loadDiscoveryDocumentAndTryLogin(): Promise<any> {
+    this.initCodeFlow();
+    return Promise.resolve();
+  },
+};
+
+const routerMock = {
+  root: jest.fn(),
+  // Router
+  events: of(new NavigationEnd(0, 'http://localhost:4200/objective/2', 'http://localhost:4200/objective/2')),
+};
 
 const routes: Routes = [
   {
@@ -32,24 +52,17 @@ describe('AppComponent', () => {
   beforeEach(async () => {
     await TestBed.configureTestingModule({
       imports: [
-        RouterModule.forRoot(routes),
+        RouterTestingModule.withRoutes(routes),
         HttpClientTestingModule,
         TranslateTestingModule.withTranslations({
           de: de,
         }),
+        OAuthModule.forRoot(),
         MatSidenavModule,
         NoopAnimationsModule,
         CommonModule,
       ],
-      providers: [
-        {
-          provide: StsConfigLoader,
-          useValue: {
-            loadConfig: () => of({}),
-            loadConfigs: () => of({}),
-          },
-        },
-      ],
+      providers: [{ provide: OAuthService, useValue: oauthServiceMock }],
       declarations: [AppComponent, OverviewComponent],
       schemas: [CUSTOM_ELEMENTS_SCHEMA],
     })
diff --git a/frontend/src/app/app.component.ts b/frontend/src/app/app.component.ts
index 6f601629c9..854233b3af 100644
--- a/frontend/src/app/app.component.ts
+++ b/frontend/src/app/app.component.ts
@@ -1,5 +1,6 @@
-import { ChangeDetectionStrategy, Component, OnInit } from '@angular/core';
-import { OidcSecurityService } from 'angular-auth-oidc-client';
+import { ChangeDetectionStrategy, Component } from '@angular/core';
+import { MatIconRegistry } from '@angular/material/icon';
+import { DomSanitizer } from '@angular/platform-browser';
 
 @Component({
   selector: 'app-root',
@@ -7,9 +8,19 @@ import { OidcSecurityService } from 'angular-auth-oidc-client';
   styleUrls: ['./app.component.scss'],
   changeDetection: ChangeDetectionStrategy.OnPush,
 })
-export class AppComponent implements OnInit {
-  constructor(private oidcSecurityService: OidcSecurityService) {}
-  ngOnInit(): void {
-    this.oidcSecurityService.checkAuth().subscribe();
+export class AppComponent {
+  readonly PATH_PREFIX = '../assets/icons/';
+  constructor(
+    private matIconRegistry: MatIconRegistry,
+    private domSanitizer: DomSanitizer,
+  ) {
+    this.matIconRegistry.addSvgIcon(
+      'pz-search',
+      this.domSanitizer.bypassSecurityTrustResourceUrl(this.PATH_PREFIX + 'search-icon.svg'),
+    );
+    this.matIconRegistry.addSvgIcon(
+      'pz-menu-icon',
+      this.domSanitizer.bypassSecurityTrustResourceUrl(this.PATH_PREFIX + 'three-dot-menu-icon.svg'),
+    );
   }
 }
diff --git a/frontend/src/app/app.module.ts b/frontend/src/app/app.module.ts
index 05ed1b9104..6e1bc6922a 100644
--- a/frontend/src/app/app.module.ts
+++ b/frontend/src/app/app.module.ts
@@ -1,4 +1,4 @@
-import { APP_INITIALIZER, CUSTOM_ELEMENTS_SCHEMA, NgModule } from '@angular/core';
+import { APP_INITIALIZER, CUSTOM_ELEMENTS_SCHEMA, Injector, NgModule } from '@angular/core';
 import { BrowserModule } from '@angular/platform-browser';
 import { AppRoutingModule } from './app-routing.module';
 import { AppComponent } from './app.component';
@@ -20,80 +20,68 @@ import { TranslateLoader, TranslateModule, TranslateService } from '@ngx-transla
 import { TranslateHttpLoader } from '@ngx-translate/http-loader';
 import { DateAdapter, MAT_DATE_FORMATS, MAT_DATE_LOCALE } from '@angular/material/core';
 import { MomentDateAdapter } from '@angular/material-moment-adapter';
+import { OAuthModule, OAuthService, OAuthStorage } from 'angular-oauth2-oidc';
 import { MatTooltipModule } from '@angular/material/tooltip';
 import { MatAutocompleteModule } from '@angular/material/autocomplete';
-import { A11yModule } from '@angular/cdk/a11y';
-import { ExampleDialogComponent } from './shared/dialog/example-dialog/example-dialog.component';
 import { MatRadioModule } from '@angular/material/radio';
-import { ConfigService } from './config.service';
-import { config, firstValueFrom, map } from 'rxjs';
+import { ConfigService } from './services/config.service';
+import { firstValueFrom } from 'rxjs';
 import { environment } from '../environments/environment';
-import { OauthInterceptor } from './shared/interceptors/oauth.interceptor';
-import { ApplicationTopBarComponent } from './application-top-bar/application-top-bar.component';
-import { TeamComponent } from './team/team.component';
-import { OverviewComponent } from './overview/overview.component';
-import { ObjectiveComponent } from './objective/objective.component';
+import { TeamComponent } from './components/team/team.component';
+import { OverviewComponent } from './components/overview/overview.component';
+import { ObjectiveComponent } from './components/objective/objective.component';
 import { CommonModule, NgOptimizedImage } from '@angular/common';
-import { KeyresultComponent } from './keyresult/keyresult.component';
-import { KeyresultDetailComponent } from './keyresult-detail/keyresult-detail.component';
-import { ObjectiveDetailComponent } from './objective-detail/objective-detail.component';
+import { KeyresultComponent } from './components/keyresult/keyresult.component';
+import { KeyresultDetailComponent } from './components/keyresult-detail/keyresult-detail.component';
+import { ObjectiveDetailComponent } from './components/objective-detail/objective-detail.component';
 import { MatSidenavModule } from '@angular/material/sidenav';
-import { ConfidenceComponent } from './confidence/confidence.component';
+import { ConfidenceComponent } from './components/confidence/confidence.component';
 import { MatSliderModule } from '@angular/material/slider';
-import { ErrorInterceptor } from './shared/interceptors/error-interceptor.service';
-import { CheckInHistoryDialogComponent } from './shared/dialog/check-in-history-dialog/check-in-history-dialog.component';
 import { MatDividerModule } from '@angular/material/divider';
-import { ObjectiveFormComponent } from './shared/dialog/objective-dialog/objective-form.component';
-import { ApplicationBannerComponent } from './application-banner/application-banner.component';
+import { ApplicationBannerComponent } from './components/application-banner/application-banner.component';
 import { MatCheckboxModule } from '@angular/material/checkbox';
-import { CheckInFormMetricComponent } from './shared/dialog/checkin/check-in-form-metric/check-in-form-metric.component';
-import { UnitValueTransformationPipe } from './shared/pipes/unit-value-transformation/unit-value-transformation.pipe';
-import { CheckInFormOrdinalComponent } from './shared/dialog/checkin/check-in-form-ordinal/check-in-form-ordinal.component';
-import { ConfirmDialogComponent } from './shared/dialog/confirm-dialog/confirm-dialog.component';
-import { CheckInFormComponent } from './shared/dialog/checkin/check-in-form/check-in-form.component';
-import { UnitLabelTransformationPipe } from './shared/pipes/unit-label-transformation/unit-label-transformation.pipe';
-import { ParseUnitValuePipe } from './shared/pipes/parse-unit-value/parse-unit-value.pipe';
-import { SidepanelComponent } from './shared/custom/sidepanel/sidepanel.component';
-import { CdkConnectedOverlay, CdkOverlayOrigin, OverlayModule } from '@angular/cdk/overlay';
-import { ScoringComponent } from './shared/custom/scoring/scoring.component';
-import { CompleteDialogComponent } from './shared/dialog/complete-dialog/complete-dialog.component';
-import { QuarterFilterComponent } from './quarter-filter/quarter-filter.component';
-import { KeyResultFormComponent } from './shared/dialog/key-result-form/key-result-form.component';
-import { TeamFilterComponent } from './team-filter/team-filter.component';
+import { OverlayModule } from '@angular/cdk/overlay';
+import { QuarterFilterComponent } from './components/quarter-filter/quarter-filter.component';
+import { TeamFilterComponent } from './components/team-filter/team-filter.component';
 import { MatChipsModule } from '@angular/material/chips';
 import { Router } from '@angular/router';
-import { CustomRouter } from './shared/customRouter';
-import { KeyresultTypeComponent } from './keyresult-type/keyresult-type.component';
-import { DialogHeaderComponent } from './shared/custom/dialog-header/dialog-header.component';
-import { ObjectiveFilterComponent } from './objective-filter/objective-filter.component';
-import { ActionPlanComponent } from './action-plan/action-plan.component';
+import { KeyresultTypeComponent } from './components/keyresult-type/keyresult-type.component';
+import { ObjectiveFilterComponent } from './components/objective-filter/objective-filter.component';
+import { ActionPlanComponent } from './components/action-plan/action-plan.component';
 import { CdkDrag, CdkDragHandle, CdkDropList } from '@angular/cdk/drag-drop';
-import { TeamManagementComponent } from './shared/dialog/team-management/team-management.component';
-import { KeyresultDialogComponent } from './shared/dialog/keyresult-dialog/keyresult-dialog.component';
-import { CustomizationService } from './shared/services/customization.service';
-import {
-  AuthModule,
-  DefaultLocalStorageService,
-  AbstractSecurityStorage,
-  StsConfigLoader,
-  StsConfigHttpLoader,
-  AuthInterceptor,
-} from 'angular-auth-oidc-client';
-import { CallbackComponent } from './callback/callback.component';
+import { SharedModule } from './shared/shared.module';
+import { OauthInterceptor } from './interceptors/oauth.interceptor';
+import { ErrorInterceptor } from './interceptors/error-interceptor.service';
+import { CustomRouter } from './shared/customRouter';
+import { KeyResultFormComponent } from './components/key-result-form/key-result-form.component';
+import { KeyresultDialogComponent } from './components/keyresult-dialog/keyresult-dialog.component';
+import { CheckInHistoryDialogComponent } from './components/check-in-history-dialog/check-in-history-dialog.component';
+import { CheckInFormMetricComponent } from './components/checkin/check-in-form-metric/check-in-form-metric.component';
+import { CheckInFormOrdinalComponent } from './components/checkin/check-in-form-ordinal/check-in-form-ordinal.component';
+import { CheckInFormComponent } from './components/checkin/check-in-form/check-in-form.component';
+import { ApplicationTopBarComponent } from './components/application-top-bar/application-top-bar.component';
+import { A11yModule } from '@angular/cdk/a11y';
+import { CustomizationService } from './services/customization.service';
 
-function initOauthFactory(configService: ConfigService) {
-  const config$ = configService.config$.pipe(
-    map((config) => {
-      return { ...environment.oauth, authority: config.issuer, clientId: config.clientId };
-    }),
-  );
-  return new StsConfigHttpLoader(config$);
+function initOauthFactory(configService: ConfigService, oauthService: OAuthService) {
+  return async () => {
+    const config = await firstValueFrom(configService.config$);
+    oauthService.configure({
+      ...environment.oauth,
+      issuer: config.issuer,
+      clientId: config.clientId,
+    });
+  };
 }
 
 export function createTranslateLoader(http: HttpBackend) {
   return new TranslateHttpLoader(new HttpClient(http), './assets/i18n/', '.json');
 }
 
+export function storageFactory(): OAuthStorage {
+  return localStorage;
+}
+
 export const MY_FORMATS = {
   parse: {
     dateInput: 'LL',
@@ -109,51 +97,32 @@ export const MY_FORMATS = {
 @NgModule({
   declarations: [
     AppComponent,
-    ExampleDialogComponent,
     TeamComponent,
     OverviewComponent,
     ObjectiveComponent,
     KeyresultComponent,
     ApplicationTopBarComponent,
     ConfidenceComponent,
-    CheckInHistoryDialogComponent,
-    ScoringComponent,
     KeyresultDetailComponent,
     ObjectiveDetailComponent,
     ApplicationBannerComponent,
-    KeyResultFormComponent,
-    ConfirmDialogComponent,
-    CheckInFormComponent,
-    CheckInFormMetricComponent,
-    UnitValueTransformationPipe,
-    CheckInFormOrdinalComponent,
-    UnitLabelTransformationPipe,
-    ParseUnitValuePipe,
-    ObjectiveFormComponent,
-    CompleteDialogComponent,
     QuarterFilterComponent,
-    SidepanelComponent,
     TeamFilterComponent,
     KeyresultTypeComponent,
-    DialogHeaderComponent,
     ObjectiveFilterComponent,
     ActionPlanComponent,
-    TeamManagementComponent,
+    KeyResultFormComponent,
     KeyresultDialogComponent,
-    CallbackComponent,
+    CheckInHistoryDialogComponent,
+    CheckInFormMetricComponent,
+    CheckInFormOrdinalComponent,
+    CheckInFormComponent,
   ],
   imports: [
     CommonModule,
     BrowserModule,
     AppRoutingModule,
     HttpClientModule,
-    AuthModule.forRoot({
-      loader: {
-        provide: StsConfigLoader,
-        useFactory: initOauthFactory,
-        deps: [ConfigService],
-      },
-    }),
     MatFormFieldModule,
     MatSelectModule,
     MatIconModule,
@@ -178,7 +147,7 @@ export const MY_FORMATS = {
         deps: [HttpBackend],
       },
     }),
-    A11yModule,
+    OAuthModule.forRoot(),
     MatRadioModule,
     NgOptimizedImage,
     MatSidenavModule,
@@ -187,12 +156,11 @@ export const MY_FORMATS = {
     MatDividerModule,
     MatSidenavModule,
     MatCheckboxModule,
-    CdkOverlayOrigin,
-    CdkConnectedOverlay,
-    CdkOverlayOrigin,
     MatChipsModule,
     CdkDropList,
     CdkDrag,
+    SharedModule,
+    A11yModule,
     CdkDragHandle,
   ],
   providers: [
@@ -204,21 +172,22 @@ export const MY_FORMATS = {
     { provide: MAT_DATE_FORMATS, useValue: MY_FORMATS },
     { provide: HTTP_INTERCEPTORS, useClass: OauthInterceptor, multi: true },
     { provide: HTTP_INTERCEPTORS, useClass: ErrorInterceptor, multi: true },
+    { provide: OAuthStorage, useFactory: storageFactory },
     {
-      provide: AbstractSecurityStorage,
-      useClass: DefaultLocalStorageService,
+      provide: APP_INITIALIZER,
+      useFactory: initOauthFactory,
+      deps: [ConfigService, OAuthService, Injector],
+      multi: true,
     },
     {
       provide: Router,
       useClass: CustomRouter,
     },
-    UnitValueTransformationPipe,
-    ParseUnitValuePipe,
     TranslateService,
   ],
   bootstrap: [AppComponent],
   schemas: [CUSTOM_ELEMENTS_SCHEMA],
 })
 export class AppModule {
-  constructor(customizationService: CustomizationService) {}
+  constructor(private readonly customizationService: CustomizationService) {}
 }
diff --git a/frontend/src/app/application-banner/application-banner.component.scss b/frontend/src/app/application-banner/application-banner.component.scss
deleted file mode 100644
index 7b46071a4a..0000000000
--- a/frontend/src/app/application-banner/application-banner.component.scss
+++ /dev/null
@@ -1,18 +0,0 @@
-@import "variables";
-
-#okrBanner {
-  position: fixed;
-  width: 100%;
-  height: min-content;
-  z-index: 100;
-  transition: 0.5s;
-  background-color: #dcedf9;
-}
-
-.header-content {
-  padding-left: 1.5rem;
-}
-
-.filters {
-  flex: 1;
-}
diff --git a/frontend/src/app/application-top-bar/application-top-bar.component.ts b/frontend/src/app/application-top-bar/application-top-bar.component.ts
deleted file mode 100644
index 7f99d2f4ae..0000000000
--- a/frontend/src/app/application-top-bar/application-top-bar.component.ts
+++ /dev/null
@@ -1,79 +0,0 @@
-import { ChangeDetectionStrategy, Component, Input, OnDestroy, OnInit } from '@angular/core';
-import { BehaviorSubject, map, of, ReplaySubject, Subscription, switchMap } from 'rxjs';
-import { ConfigService } from '../config.service';
-import { MatDialog, MatDialogRef } from '@angular/material/dialog';
-import { TeamManagementComponent } from '../shared/dialog/team-management/team-management.component';
-import { RefreshDataService } from '../shared/services/refresh-data.service';
-import { isMobileDevice } from '../shared/common';
-import { OidcSecurityService } from 'angular-auth-oidc-client';
-
-@Component({
-  selector: 'app-application-top-bar',
-  templateUrl: './application-top-bar.component.html',
-  styleUrls: ['./application-top-bar.component.scss'],
-  changeDetection: ChangeDetectionStrategy.OnPush,
-})
-export class ApplicationTopBarComponent implements OnInit, OnDestroy {
-  menuIsOpen = false;
-
-  @Input()
-  hasAdminAccess!: ReplaySubject<boolean>;
-  logoSrc$ = new BehaviorSubject<String>('assets/images/empty.svg');
-  private dialogRef!: MatDialogRef<TeamManagementComponent> | undefined;
-  private subscription?: Subscription;
-
-  constructor(
-    private oauthService: OidcSecurityService,
-    private configService: ConfigService,
-    private dialog: MatDialog,
-    private refreshDataService: RefreshDataService,
-  ) {}
-
-  ngOnInit(): void {
-    this.subscription = this.configService.config$.subscribe({
-      next: (config) => {
-        if (config.logo) {
-          this.logoSrc$.next(config.logo);
-        }
-      },
-    });
-  }
-
-  ngOnDestroy(): void {
-    this.subscription?.unsubscribe();
-  }
-
-  logOut() {
-    this.oauthService.logoff().subscribe();
-  }
-
-  username() {
-    return this.oauthService.getUserData().pipe(map((user) => user?.name || ''));
-  }
-
-  openTeamManagement() {
-    const dialogConfig = isMobileDevice()
-      ? {
-          maxWidth: '100vw',
-          maxHeight: '100vh',
-          height: '100vh',
-          width: '100vw',
-        }
-      : {
-          width: '45em',
-          height: 'auto',
-        };
-    if (!this.dialogRef) {
-      this.dialogRef = this.dialog.open(TeamManagementComponent, {
-        height: dialogConfig.height,
-        width: dialogConfig.width,
-        maxHeight: dialogConfig.maxHeight,
-        maxWidth: dialogConfig.maxWidth,
-      });
-      this.dialogRef.afterClosed().subscribe(() => {
-        this.dialogRef = undefined;
-        this.refreshDataService.markDataRefresh();
-      });
-    }
-  }
-}
diff --git a/frontend/src/app/action-plan/action-plan.component.html b/frontend/src/app/components/action-plan/action-plan.component.html
similarity index 85%
rename from frontend/src/app/action-plan/action-plan.component.html
rename to frontend/src/app/components/action-plan/action-plan.component.html
index d586d1c2f7..b056643283 100644
--- a/frontend/src/app/action-plan/action-plan.component.html
+++ b/frontend/src/app/components/action-plan/action-plan.component.html
@@ -14,7 +14,7 @@
         <img
           cdkDragHandle
           class="icons"
-          src="../assets/icons/drag_indicator.svg"
+          src="../../../assets/icons/drag_indicator.svg"
           alt="Drag indicator"
           [attr.data-testId]="'dragIcon'"
         />
@@ -35,7 +35,7 @@
         (keydown.shift.tab)="decreaseActiveItemWithShiftTab()"
         (keydown.enter)="removeAction(i)"
         class="icons bin-icon cursor-pointer focus-outline"
-        src="../assets/icons/delete-icon.svg"
+        src="../../../assets/icons/delete-icon.svg"
         alt="Delete bin"
         (click)="removeAction(i)"
       />
@@ -51,7 +51,12 @@
       (click)="addNewAction()"
     >
       <span class="d-flex align-items-center add-text">
-        <img src="assets/icons/new-icon.svg" alt="Add action button" class="add-cross-button" id="add-action" />
+        <img
+          src="../../../assets/icons/new-icon.svg"
+          alt="Add action button"
+          class="add-cross-button"
+          id="add-action"
+        />
         Weitere Action hinzufügen
       </span>
     </button>
diff --git a/frontend/src/app/action-plan/action-plan.component.scss b/frontend/src/app/components/action-plan/action-plan.component.scss
similarity index 100%
rename from frontend/src/app/action-plan/action-plan.component.scss
rename to frontend/src/app/components/action-plan/action-plan.component.scss
diff --git a/frontend/src/app/action-plan/action-plan.component.spec.ts b/frontend/src/app/components/action-plan/action-plan.component.spec.ts
similarity index 96%
rename from frontend/src/app/action-plan/action-plan.component.spec.ts
rename to frontend/src/app/components/action-plan/action-plan.component.spec.ts
index ea934b1e7f..83deab4d69 100644
--- a/frontend/src/app/action-plan/action-plan.component.spec.ts
+++ b/frontend/src/app/components/action-plan/action-plan.component.spec.ts
@@ -4,10 +4,10 @@ import { ActionPlanComponent } from './action-plan.component';
 import { HttpClientTestingModule } from '@angular/common/http/testing';
 import { MatDialogModule, MatDialogRef } from '@angular/material/dialog';
 import { CdkDrag, CdkDropList } from '@angular/cdk/drag-drop';
-import { ActionService } from '../shared/services/action.service';
-import { action1, action2, action3, addedAction } from '../shared/testData';
+import { ActionService } from '../../services/action.service';
+import { action1, action2, action3, addedAction } from '../../shared/testData';
 import { BehaviorSubject, of } from 'rxjs';
-import { Action } from '../shared/types/model/Action';
+import { Action } from '../../shared/types/model/Action';
 import { TranslateModule, TranslateService } from '@ngx-translate/core';
 
 const actionServiceMock = {
diff --git a/frontend/src/app/action-plan/action-plan.component.ts b/frontend/src/app/components/action-plan/action-plan.component.ts
similarity index 93%
rename from frontend/src/app/action-plan/action-plan.component.ts
rename to frontend/src/app/components/action-plan/action-plan.component.ts
index b7f588d006..8f0625ceeb 100644
--- a/frontend/src/app/action-plan/action-plan.component.ts
+++ b/frontend/src/app/components/action-plan/action-plan.component.ts
@@ -1,12 +1,12 @@
 import { Component, ElementRef, Input, QueryList, ViewChildren } from '@angular/core';
 import { CdkDragDrop, moveItemInArray, transferArrayItem } from '@angular/cdk/drag-drop';
-import { Action } from '../shared/types/model/Action';
-import { ActionService } from '../shared/services/action.service';
+import { Action } from '../../shared/types/model/Action';
+import { ActionService } from '../../services/action.service';
 import { MatDialog } from '@angular/material/dialog';
-import { ConfirmDialogComponent } from '../shared/dialog/confirm-dialog/confirm-dialog.component';
+import { ConfirmDialogComponent } from '../../shared/dialog/confirm-dialog/confirm-dialog.component';
 import { BehaviorSubject } from 'rxjs';
-import { isMobileDevice, trackByFn } from '../shared/common';
-import { CONFIRM_DIALOG_WIDTH } from '../shared/constantLibary';
+import { isMobileDevice, trackByFn } from '../../shared/common';
+import { CONFIRM_DIALOG_WIDTH } from '../../shared/constantLibary';
 
 @Component({
   selector: 'app-action-plan',
diff --git a/frontend/src/app/application-banner/application-banner.component.html b/frontend/src/app/components/application-banner/application-banner.component.html
similarity index 93%
rename from frontend/src/app/application-banner/application-banner.component.html
rename to frontend/src/app/components/application-banner/application-banner.component.html
index 211fff8a05..fd59295d0d 100644
--- a/frontend/src/app/application-banner/application-banner.component.html
+++ b/frontend/src/app/components/application-banner/application-banner.component.html
@@ -36,7 +36,7 @@
       </section>
     </div>
     <div *ngIf="!isMobileDevice()" class="d-flex justify-content-end">
-      <img alt="okr-tangram" height="140" ngSrc="assets/images/triangles-okr-header.svg" slot="tangram" width="274" />
+      <app-okr-tangram [attr.data-testId]="'okr-logo'"></app-okr-tangram>
     </div>
   </div>
 </div>
diff --git a/frontend/src/app/components/application-banner/application-banner.component.scss b/frontend/src/app/components/application-banner/application-banner.component.scss
new file mode 100644
index 0000000000..0c0c6289e3
--- /dev/null
+++ b/frontend/src/app/components/application-banner/application-banner.component.scss
@@ -0,0 +1,9 @@
+@import "../style/variables";
+
+.header-content {
+  padding-left: 1.5rem;
+}
+
+.filters {
+  flex: 1;
+}
diff --git a/frontend/src/app/application-banner/application-banner.component.spec.ts b/frontend/src/app/components/application-banner/application-banner.component.spec.ts
similarity index 59%
rename from frontend/src/app/application-banner/application-banner.component.spec.ts
rename to frontend/src/app/components/application-banner/application-banner.component.spec.ts
index 435cff7724..86e542750c 100644
--- a/frontend/src/app/application-banner/application-banner.component.spec.ts
+++ b/frontend/src/app/components/application-banner/application-banner.component.spec.ts
@@ -2,8 +2,23 @@ import { ComponentFixture, fakeAsync, TestBed, tick } from '@angular/core/testin
 
 import { ApplicationBannerComponent } from './application-banner.component';
 import { By } from '@angular/platform-browser';
-import { RefreshDataService } from '../shared/services/refresh-data.service';
-import { PUZZLE_TOP_BAR_HEIGHT } from '../shared/constantLibary';
+import { RefreshDataService } from '../../services/refresh-data.service';
+import { PUZZLE_TOP_BAR_HEIGHT } from '../../shared/constantLibary';
+import { TeamFilterComponent } from '../team-filter/team-filter.component';
+import { QuarterFilterComponent } from '../quarter-filter/quarter-filter.component';
+import { HttpClientTestingModule } from '@angular/common/http/testing';
+import { ActivatedRoute } from '@angular/router';
+import { ObjectiveFilterComponent } from '../objective-filter/objective-filter.component';
+import { of } from 'rxjs';
+import { MatExpansionModule } from '@angular/material/expansion';
+import { MatFormFieldModule } from '@angular/material/form-field';
+import { MatChipsModule } from '@angular/material/chips';
+import { MatSelectModule } from '@angular/material/select';
+import { MatIconModule } from '@angular/material/icon';
+import { NoopAnimationsModule } from '@angular/platform-browser/animations';
+import { OkrTangramComponent } from '../../shared/custom/okr-tangram/okr-tangram.component';
+import { FormsModule, ReactiveFormsModule } from '@angular/forms';
+import { MatInputModule } from '@angular/material/input';
 
 class ResizeObserverMock {
   observe() {}
@@ -15,6 +30,11 @@ const refreshDataServiceMock = {
   okrBannerHeightSubject: {
     next: jest.fn(),
   },
+  reloadOverviewSubject: of(null),
+};
+
+const routeMock = {
+  queryParams: of(null),
 };
 
 describe('ApplicationBannerComponent', () => {
@@ -25,8 +45,29 @@ describe('ApplicationBannerComponent', () => {
 
   beforeEach(() => {
     TestBed.configureTestingModule({
-      declarations: [ApplicationBannerComponent],
-      providers: [{ provide: RefreshDataService, useValue: refreshDataServiceMock }],
+      imports: [
+        HttpClientTestingModule,
+        MatExpansionModule,
+        MatFormFieldModule,
+        MatChipsModule,
+        MatSelectModule,
+        MatIconModule,
+        NoopAnimationsModule,
+        FormsModule,
+        ReactiveFormsModule,
+        MatInputModule,
+      ],
+      declarations: [
+        ApplicationBannerComponent,
+        TeamFilterComponent,
+        QuarterFilterComponent,
+        ObjectiveFilterComponent,
+        OkrTangramComponent,
+      ],
+      providers: [
+        { provide: RefreshDataService, useValue: refreshDataServiceMock },
+        { provide: ActivatedRoute, useValue: routeMock },
+      ],
     });
 
     fixture = TestBed.createComponent(ApplicationBannerComponent);
diff --git a/frontend/src/app/application-banner/application-banner.component.ts b/frontend/src/app/components/application-banner/application-banner.component.ts
similarity index 93%
rename from frontend/src/app/application-banner/application-banner.component.ts
rename to frontend/src/app/components/application-banner/application-banner.component.ts
index 87dc984251..cce55ad140 100644
--- a/frontend/src/app/application-banner/application-banner.component.ts
+++ b/frontend/src/app/components/application-banner/application-banner.component.ts
@@ -8,9 +8,9 @@ import {
   ViewChild,
 } from '@angular/core';
 import { BehaviorSubject } from 'rxjs';
-import { RefreshDataService } from '../shared/services/refresh-data.service';
-import { DEFAULT_HEADER_HEIGHT_PX, PUZZLE_TOP_BAR_HEIGHT } from '../shared/constantLibary';
-import { isMobileDevice } from '../shared/common';
+import { RefreshDataService } from '../../services/refresh-data.service';
+import { DEFAULT_HEADER_HEIGHT_PX, PUZZLE_TOP_BAR_HEIGHT } from '../../shared/constantLibary';
+import { isMobileDevice } from '../../shared/common';
 
 @Component({
   selector: 'app-application-banner',
diff --git a/frontend/src/app/application-top-bar/application-top-bar.component.html b/frontend/src/app/components/application-top-bar/application-top-bar.component.html
similarity index 72%
rename from frontend/src/app/application-top-bar/application-top-bar.component.html
rename to frontend/src/app/components/application-top-bar/application-top-bar.component.html
index c6183a9593..0577a3193a 100644
--- a/frontend/src/app/application-top-bar/application-top-bar.component.html
+++ b/frontend/src/app/components/application-top-bar/application-top-bar.component.html
@@ -3,19 +3,27 @@
     <span class="d-flex h-100 align-items-center ps-4">
       <img alt="okr-logo" height="32" ngSrc="{{ this.logoSrc$ | async }}" width="140" />
     </span>
-
     <div class="d-flex align-items-center me-md-5 me-1">
       <button
-        (click)="openTeamManagement()"
-        *ngIf="hasAdminAccess | async"
+        *ngIf="teamManagementVisible$ | async"
+        routerLink="team-management"
         [attr.data-testId]="'team-management'"
-        class="topBarEntry btn"
+        class="topBarEntry btn visible-by-default"
       >
         <mat-icon aria-hidden="false" aria-label="Group icon" fontIcon="group"></mat-icon>
         <span class="d-none d-md-flex">Teamverwaltung </span>
       </button>
 
-      <button class="topBarEntry btn" href="https://wiki.puzzle.ch/Puzzle/OKRs">
+      <button *ngIf="!(teamManagementVisible$ | async)" routerLink="/" class="topBarEntry btn visible-by-default">
+        <mat-icon aria-hidden="false" aria-label="Group icon" fontIcon="group"></mat-icon>
+        <span class="d-none d-md-flex">OKR Übersicht </span>
+      </button>
+
+      <button
+        id="hilfeButton"
+        class="topBarEntry btn"
+        onclick="window.open('https://wiki.puzzle.ch/Puzzle/OKRs', '_blank')"
+      >
         <mat-icon aria-hidden="false" aria-label="Help icon" fontIcon="help_outline"></mat-icon>
         <span class="d-none d-md-flex"> Hilfe </span>
       </button>
@@ -28,7 +36,7 @@
         class="topBarEntry flex-nowrap btn"
       >
         <mat-icon aria-hidden="false" aria-label="person icon" fontIcon="person_outline" id="topbar-user"></mat-icon>
-        <span [attr.data-testId]="'user-name'" class="fw-normal fs-6 d-none d-md-flex">{{ username() | async }}</span>
+        <span [attr.data-testId]="'user-name'" class="fw-normal fs-6 d-none d-md-flex">{{ userFullName }}</span>
         <mat-icon *ngIf="!menuIsOpen">expand_more</mat-icon>
         <mat-icon *ngIf="menuIsOpen">expand_less</mat-icon>
       </button>
diff --git a/frontend/src/app/application-top-bar/application-top-bar.component.scss b/frontend/src/app/components/application-top-bar/application-top-bar.component.scss
similarity index 90%
rename from frontend/src/app/application-top-bar/application-top-bar.component.scss
rename to frontend/src/app/components/application-top-bar/application-top-bar.component.scss
index 63082ca229..6dedd3b171 100644
--- a/frontend/src/app/application-top-bar/application-top-bar.component.scss
+++ b/frontend/src/app/components/application-top-bar/application-top-bar.component.scss
@@ -1,4 +1,4 @@
-@import "_variables";
+@import "../style/variables";
 
 #topBarHeight {
   height: $top-bar-height;
@@ -13,11 +13,6 @@
   height: inherit;
   justify-content: space-between;
   background-color: var(--okr-topbar-background-color);
-
-  img {
-    max-height: calc(100% - 16px);
-    width: auto;
-  }
 }
 
 .topBarEntry {
@@ -29,10 +24,11 @@
   height: 100%;
   gap: 1px;
   font-size: 16px;
+  font-weight: normal;
+
   padding: 10px;
   border-radius: 8px;
   border: 1px solid transparent;
-  font-weight: normal;
 
   mat-icon {
     display: flex;
diff --git a/frontend/src/app/application-top-bar/application-top-bar.component.spec.ts b/frontend/src/app/components/application-top-bar/application-top-bar.component.spec.ts
similarity index 57%
rename from frontend/src/app/application-top-bar/application-top-bar.component.spec.ts
rename to frontend/src/app/components/application-top-bar/application-top-bar.component.spec.ts
index 8dd77c88f6..f22fa27bc9 100644
--- a/frontend/src/app/application-top-bar/application-top-bar.component.spec.ts
+++ b/frontend/src/app/components/application-top-bar/application-top-bar.component.spec.ts
@@ -1,6 +1,8 @@
 import { ComponentFixture, TestBed } from '@angular/core/testing';
+
 import { ApplicationTopBarComponent } from './application-top-bar.component';
 import { CUSTOM_ELEMENTS_SCHEMA } from '@angular/core';
+import { DateTimeProvider, OAuthLogger, OAuthService, UrlHelperService } from 'angular-oauth2-oidc';
 import { HttpClient, HttpHandler } from '@angular/common/http';
 import { MatMenuModule } from '@angular/material/menu';
 import { HarnessLoader } from '@angular/cdk/testing';
@@ -8,37 +10,67 @@ import { TestbedHarnessEnvironment } from '@angular/cdk/testing/testbed';
 import { MatMenuHarness } from '@angular/material/menu/testing';
 import { NoopAnimationsModule } from '@angular/platform-browser/animations';
 import { MatDialog, MatDialogModule } from '@angular/material/dialog';
+import { NavigationEnd, Router } from '@angular/router';
 import { of } from 'rxjs';
-import { team1 } from '../shared/testData';
-import { OidcSecurityService } from 'angular-auth-oidc-client';
-import { NgOptimizedImage } from '@angular/common';
+import { testUser } from '../../shared/testData';
+import { UserService } from '../../services/user.service';
+import { ConfigService } from '../../services/config.service';
 
 const oAuthMock = {
-  getUserData: jest.fn(),
-  logOff: jest.fn(),
+  getIdentityClaims: jest.fn(),
+  logOut: jest.fn(),
+  hasValidIdToken: jest.fn(),
 };
 
 const dialogMock = {
   open: jest.fn(),
 };
 
-describe('ApplicationHeaderComponent', () => {
+const routerMock = {
+  events: of(new NavigationEnd(1, '', '')),
+  navigateByUrl: jest.fn(),
+};
+
+const userServiceMock = {
+  getCurrentUser: () => testUser,
+};
+
+const configServiceMock = {
+  config$: of({}),
+};
+
+describe('ApplicationTopBarComponent', () => {
   let component: ApplicationTopBarComponent;
   let fixture: ComponentFixture<ApplicationTopBarComponent>;
   let loader: HarnessLoader;
 
   beforeEach(() => {
     TestBed.configureTestingModule({
-      imports: [MatMenuModule, NoopAnimationsModule, MatDialogModule, NgOptimizedImage],
+      imports: [MatMenuModule, NoopAnimationsModule, MatDialogModule],
       declarations: [ApplicationTopBarComponent],
       providers: [
-        { provide: OidcSecurityService, useValue: oAuthMock },
+        { provide: OAuthService, useValue: oAuthMock },
         { provide: HttpClient },
         { provide: HttpHandler },
+        { provide: UrlHelperService },
+        { provide: OAuthLogger },
+        { provide: DateTimeProvider },
         {
           provide: MatDialog,
           useValue: dialogMock,
         },
+        {
+          provide: Router,
+          useValue: routerMock,
+        },
+        {
+          provide: UserService,
+          useValue: userServiceMock,
+        },
+        {
+          provide: ConfigService,
+          useValue: configServiceMock,
+        },
       ],
       schemas: [CUSTOM_ELEMENTS_SCHEMA],
     }).compileComponents();
@@ -46,27 +78,25 @@ describe('ApplicationHeaderComponent', () => {
     fixture = TestBed.createComponent(ApplicationTopBarComponent);
     component = fixture.componentInstance;
     loader = TestbedHarnessEnvironment.loader(fixture);
+    component.ngOnInit();
   });
 
   it('should create', () => {
     expect(component).toBeTruthy();
   });
 
-  it('logout function should get called on button click', async () => {
-    oAuthMock.getUserData.mockReturnValue(of({ name: 'Username' }));
+  it('should set full name from user service', () => {
+    expect(component.userFullName).toBe('Bob Baumeister');
+  });
 
+  it('logout function should get called on button click', async () => {
+    routerMock.navigateByUrl.mockReturnValue(of().toPromise());
     const harness = await loader.getHarness(MatMenuHarness);
     await harness.open();
     fixture.detectChanges();
     harness.getItems().then((items) => {
       items[0].click();
-      expect(oAuthMock.logOff).toHaveBeenCalledTimes(1);
+      expect(oAuthMock.logOut).toBeCalledTimes(1);
     });
   });
-
-  it('should make call to dialog object when opening team management dialog', async () => {
-    jest.spyOn(dialogMock, 'open').mockReturnValue({ afterClosed: () => of(team1) });
-    component.openTeamManagement();
-    expect(dialogMock.open).toHaveBeenCalled();
-  });
 });
diff --git a/frontend/src/app/components/application-top-bar/application-top-bar.component.ts b/frontend/src/app/components/application-top-bar/application-top-bar.component.ts
new file mode 100644
index 0000000000..88b4ce6819
--- /dev/null
+++ b/frontend/src/app/components/application-top-bar/application-top-bar.component.ts
@@ -0,0 +1,72 @@
+import { ChangeDetectionStrategy, ChangeDetectorRef, Component, OnDestroy, OnInit } from '@angular/core';
+import { OAuthService } from 'angular-oauth2-oidc';
+import { BehaviorSubject, filter, Observable, of, Subscription, switchMap } from 'rxjs';
+import { ConfigService } from '../../services/config.service';
+import { NavigationEnd, Router } from '@angular/router';
+import { UserService } from '../../services/user.service';
+import { getFullNameFromUser } from '../../shared/types/model/User';
+
+@Component({
+  selector: 'app-application-top-bar',
+  templateUrl: './application-top-bar.component.html',
+  styleUrls: ['./application-top-bar.component.scss'],
+  changeDetection: ChangeDetectionStrategy.OnPush,
+})
+export class ApplicationTopBarComponent implements OnInit, OnDestroy {
+  userFullName: string = '';
+  menuIsOpen = false;
+  teamManagementVisible$: Observable<boolean> | undefined;
+  logoSrc$ = new BehaviorSubject<String>('assets/images/empty.svg');
+  private subscription?: Subscription;
+
+  constructor(
+    private oauthService: OAuthService,
+    private userService: UserService,
+    private configService: ConfigService,
+    private router: Router,
+    private readonly cd: ChangeDetectorRef,
+  ) {}
+
+  ngOnInit(): void {
+    this.subscription = this.configService.config$.subscribe({
+      next: (config) => {
+        if (config.logo) {
+          this.logoSrc$.next(config.logo);
+        }
+      },
+    });
+
+    this.initUserFullName();
+    this.initTeamManagementVisible();
+  }
+
+  ngOnDestroy(): void {
+    this.subscription?.unsubscribe();
+  }
+
+  logOut() {
+    const currentUrlTree = this.router.createUrlTree([], { queryParams: {} });
+    this.router.navigateByUrl(currentUrlTree).then(() => {
+      this.oauthService.logOut();
+    });
+  }
+
+  private initUserFullName() {
+    // user is loaded on base route resolver. We have to wait until routing is done.
+    this.router.events.subscribe((val) => {
+      if (!this.userFullName && val instanceof NavigationEnd) {
+        this.userFullName = getFullNameFromUser(this.userService.getCurrentUser());
+        this.cd.markForCheck();
+      }
+    });
+  }
+
+  private initTeamManagementVisible() {
+    this.teamManagementVisible$ = this.router.events.pipe(
+      filter((e): e is NavigationEnd => e instanceof NavigationEnd),
+      switchMap(() => {
+        return of(this.router.url.split('?')[0] === '/');
+      }),
+    );
+  }
+}
diff --git a/frontend/src/app/shared/dialog/check-in-history-dialog/check-in-history-dialog.component.html b/frontend/src/app/components/check-in-history-dialog/check-in-history-dialog.component.html
similarity index 92%
rename from frontend/src/app/shared/dialog/check-in-history-dialog/check-in-history-dialog.component.html
rename to frontend/src/app/components/check-in-history-dialog/check-in-history-dialog.component.html
index 17336fca6a..45f8a39c78 100644
--- a/frontend/src/app/shared/dialog/check-in-history-dialog/check-in-history-dialog.component.html
+++ b/frontend/src/app/components/check-in-history-dialog/check-in-history-dialog.component.html
@@ -23,7 +23,7 @@
               *ngIf="!isComplete && checkIn.writeable"
               [attr.data-testId]="'edit-check-in'"
             >
-              <img class="edit-check-in cursor-pointer m-1" src="assets/icons/edit.svg" alt="edit check-in" />
+              <img class="edit-check-in cursor-pointer m-1" src="../../assets/icons/edit.svg" alt="edit check-in" />
             </button>
           </div>
         </div>
@@ -52,9 +52,6 @@
   </div>
   <button class="close-button" mat-flat-button color="primary" mat-dialog-close>Schliessen</button>
   <ng-template #spinner>
-    <div class="spinner-container">
-      Check-in history wird geladen...
-      <mat-progress-spinner color="primary" mode="indeterminate"> </mat-progress-spinner>
-    </div>
+    <app-spinner text="Check-in history wird geladen..."></app-spinner>
   </ng-template>
 </div>
diff --git a/frontend/src/app/shared/dialog/check-in-history-dialog/check-in-history-dialog.component.scss b/frontend/src/app/components/check-in-history-dialog/check-in-history-dialog.component.scss
similarity index 97%
rename from frontend/src/app/shared/dialog/check-in-history-dialog/check-in-history-dialog.component.scss
rename to frontend/src/app/components/check-in-history-dialog/check-in-history-dialog.component.scss
index 51a0b66f95..2d5a6334b6 100644
--- a/frontend/src/app/shared/dialog/check-in-history-dialog/check-in-history-dialog.component.scss
+++ b/frontend/src/app/components/check-in-history-dialog/check-in-history-dialog.component.scss
@@ -1,4 +1,4 @@
-@import "_variables";
+@import "../style/variables";
 
 .cancel-button {
   background-color: $pz-dark-blue;
diff --git a/frontend/src/app/shared/dialog/check-in-history-dialog/check-in-history-dialog.component.spec.ts b/frontend/src/app/components/check-in-history-dialog/check-in-history-dialog.component.spec.ts
similarity index 93%
rename from frontend/src/app/shared/dialog/check-in-history-dialog/check-in-history-dialog.component.spec.ts
rename to frontend/src/app/components/check-in-history-dialog/check-in-history-dialog.component.spec.ts
index 21c6b208d4..7fa0c1ee94 100644
--- a/frontend/src/app/shared/dialog/check-in-history-dialog/check-in-history-dialog.component.spec.ts
+++ b/frontend/src/app/components/check-in-history-dialog/check-in-history-dialog.component.spec.ts
@@ -3,7 +3,7 @@ import { ComponentFixture, TestBed } from '@angular/core/testing';
 import { CheckInHistoryDialogComponent } from './check-in-history-dialog.component';
 import { MAT_DIALOG_DATA, MatDialogModule, MatDialogRef } from '@angular/material/dialog';
 import { HttpClientTestingModule } from '@angular/common/http/testing';
-import { checkInMetric, checkInMetricWriteableFalse, checkInOrdinal, keyResult } from '../../testData';
+import { checkInMetric, checkInMetricWriteableFalse, keyResult } from '../../shared/testData';
 import { By } from '@angular/platform-browser';
 
 const checkInService = {
diff --git a/frontend/src/app/shared/dialog/check-in-history-dialog/check-in-history-dialog.component.ts b/frontend/src/app/components/check-in-history-dialog/check-in-history-dialog.component.ts
similarity index 79%
rename from frontend/src/app/shared/dialog/check-in-history-dialog/check-in-history-dialog.component.ts
rename to frontend/src/app/components/check-in-history-dialog/check-in-history-dialog.component.ts
index 8add8dad5d..4241ad6426 100644
--- a/frontend/src/app/shared/dialog/check-in-history-dialog/check-in-history-dialog.component.ts
+++ b/frontend/src/app/components/check-in-history-dialog/check-in-history-dialog.component.ts
@@ -1,14 +1,13 @@
 import { Component, Inject, OnInit } from '@angular/core';
-import { CheckInMin } from '../../types/model/CheckInMin';
+import { CheckInMin } from '../../shared/types/model/CheckInMin';
 import { CheckInService } from '../../services/check-in.service';
 import { MAT_DIALOG_DATA, MatDialog, MatDialogRef } from '@angular/material/dialog';
-import { DATE_FORMAT } from '../../constantLibary';
-import { KeyResult } from '../../types/model/KeyResult';
+import { DATE_FORMAT, OKR_DIALOG_CONFIG } from '../../shared/constantLibary';
+import { KeyResult } from '../../shared/types/model/KeyResult';
 import { CheckInFormComponent } from '../checkin/check-in-form/check-in-form.component';
 import { Observable, of } from 'rxjs';
-import { KeyResultMetric } from '../../types/model/KeyResultMetric';
+import { KeyResultMetric } from '../../shared/types/model/KeyResultMetric';
 import { RefreshDataService } from '../../services/refresh-data.service';
-import { isMobileDevice } from '../../common';
 
 @Component({
   selector: 'app-check-in-history-dialog',
@@ -36,17 +35,7 @@ export class CheckInHistoryDialogComponent implements OnInit {
   }
 
   openCheckInDialogForm(checkIn: CheckInMin) {
-    const dialogConfig = isMobileDevice()
-      ? {
-          maxWidth: '100vw',
-          maxHeight: '100vh',
-          height: '100vh',
-          width: '100vw',
-        }
-      : {
-          width: '45em',
-          height: 'auto',
-        };
+    const dialogConfig = OKR_DIALOG_CONFIG;
     const dialogRef = this.dialog.open(CheckInFormComponent, {
       data: {
         keyResult: this.keyResult,
diff --git a/frontend/src/app/shared/dialog/checkin/check-in-form-metric/check-in-form-metric.component.html b/frontend/src/app/components/checkin/check-in-form-metric/check-in-form-metric.component.html
similarity index 100%
rename from frontend/src/app/shared/dialog/checkin/check-in-form-metric/check-in-form-metric.component.html
rename to frontend/src/app/components/checkin/check-in-form-metric/check-in-form-metric.component.html
diff --git a/frontend/src/app/shared/dialog/checkin/check-in-form-metric/check-in-form-metric.component.scss b/frontend/src/app/components/checkin/check-in-form-metric/check-in-form-metric.component.scss
similarity index 100%
rename from frontend/src/app/shared/dialog/checkin/check-in-form-metric/check-in-form-metric.component.scss
rename to frontend/src/app/components/checkin/check-in-form-metric/check-in-form-metric.component.scss
diff --git a/frontend/src/app/shared/dialog/checkin/check-in-form-metric/check-in-form-metric.component.spec.ts b/frontend/src/app/components/checkin/check-in-form-metric/check-in-form-metric.component.spec.ts
similarity index 87%
rename from frontend/src/app/shared/dialog/checkin/check-in-form-metric/check-in-form-metric.component.spec.ts
rename to frontend/src/app/components/checkin/check-in-form-metric/check-in-form-metric.component.spec.ts
index be27183db7..08d9d248ed 100644
--- a/frontend/src/app/shared/dialog/checkin/check-in-form-metric/check-in-form-metric.component.spec.ts
+++ b/frontend/src/app/components/checkin/check-in-form-metric/check-in-form-metric.component.spec.ts
@@ -1,18 +1,18 @@
 import { ComponentFixture, TestBed, waitForAsync } from '@angular/core/testing';
 
 import { CheckInFormMetricComponent } from './check-in-form-metric.component';
-import { UnitValueTransformationPipe } from '../../../pipes/unit-value-transformation/unit-value-transformation.pipe';
-import { checkInMetric, keyResultMetric } from '../../../testData';
+import { UnitValueTransformationPipe } from '../../../shared/pipes/unit-value-transformation/unit-value-transformation.pipe';
+import { checkInMetric, keyResultMetric } from '../../../shared/testData';
 import { FormControl, FormGroup, ReactiveFormsModule, Validators } from '@angular/forms';
 import { MatDialogModule } from '@angular/material/dialog';
 import { NoopAnimationsModule } from '@angular/platform-browser/animations';
 import { MatSelectModule } from '@angular/material/select';
 import { MatInputModule } from '@angular/material/input';
 import { MatRadioModule } from '@angular/material/radio';
-import { Unit } from '../../../types/enums/Unit';
-import { ParseUnitValuePipe } from '../../../pipes/parse-unit-value/parse-unit-value.pipe';
+import { Unit } from '../../../shared/types/enums/Unit';
+import { ParseUnitValuePipe } from '../../../shared/pipes/parse-unit-value/parse-unit-value.pipe';
 import { TranslateTestingModule } from 'ngx-translate-testing';
-import * as de from '../../../../../assets/i18n/de.json';
+import * as de from '../../../../assets/i18n/de.json';
 
 describe('CheckInFormComponent', () => {
   let component: CheckInFormMetricComponent;
diff --git a/frontend/src/app/shared/dialog/checkin/check-in-form-metric/check-in-form-metric.component.ts b/frontend/src/app/components/checkin/check-in-form-metric/check-in-form-metric.component.ts
similarity index 85%
rename from frontend/src/app/shared/dialog/checkin/check-in-form-metric/check-in-form-metric.component.ts
rename to frontend/src/app/components/checkin/check-in-form-metric/check-in-form-metric.component.ts
index e600cb95f9..032f42373b 100644
--- a/frontend/src/app/shared/dialog/checkin/check-in-form-metric/check-in-form-metric.component.ts
+++ b/frontend/src/app/components/checkin/check-in-form-metric/check-in-form-metric.component.ts
@@ -1,8 +1,8 @@
 import { ChangeDetectionStrategy, Component, Input, OnInit } from '@angular/core';
 import { FormGroup, Validators } from '@angular/forms';
-import { KeyResultMetric } from '../../../types/model/KeyResultMetric';
-import { CheckInMin } from '../../../types/model/CheckInMin';
-import { formInputCheck, hasFormFieldErrors } from '../../../common';
+import { KeyResultMetric } from '../../../shared/types/model/KeyResultMetric';
+import { CheckInMin } from '../../../shared/types/model/CheckInMin';
+import { formInputCheck, hasFormFieldErrors } from '../../../shared/common';
 import { TranslateService } from '@ngx-translate/core';
 
 @Component({
diff --git a/frontend/src/app/shared/dialog/checkin/check-in-form-ordinal/check-in-form-ordinal.component.html b/frontend/src/app/components/checkin/check-in-form-ordinal/check-in-form-ordinal.component.html
similarity index 100%
rename from frontend/src/app/shared/dialog/checkin/check-in-form-ordinal/check-in-form-ordinal.component.html
rename to frontend/src/app/components/checkin/check-in-form-ordinal/check-in-form-ordinal.component.html
diff --git a/frontend/src/app/shared/dialog/checkin/check-in-form-ordinal/check-in-form-ordinal.component.scss b/frontend/src/app/components/checkin/check-in-form-ordinal/check-in-form-ordinal.component.scss
similarity index 89%
rename from frontend/src/app/shared/dialog/checkin/check-in-form-ordinal/check-in-form-ordinal.component.scss
rename to frontend/src/app/components/checkin/check-in-form-ordinal/check-in-form-ordinal.component.scss
index 34a5c85a4d..55e3fe921d 100644
--- a/frontend/src/app/shared/dialog/checkin/check-in-form-ordinal/check-in-form-ordinal.component.scss
+++ b/frontend/src/app/components/checkin/check-in-form-ordinal/check-in-form-ordinal.component.scss
@@ -1,4 +1,4 @@
-@import "variables";
+@import "../style/variables";
 
 .submit {
   background-color: $pz-dark-blue;
diff --git a/frontend/src/app/shared/dialog/checkin/check-in-form-ordinal/check-in-form-ordinal.component.spec.ts b/frontend/src/app/components/checkin/check-in-form-ordinal/check-in-form-ordinal.component.spec.ts
similarity index 94%
rename from frontend/src/app/shared/dialog/checkin/check-in-form-ordinal/check-in-form-ordinal.component.spec.ts
rename to frontend/src/app/components/checkin/check-in-form-ordinal/check-in-form-ordinal.component.spec.ts
index 075022da57..f1b32bf4c0 100644
--- a/frontend/src/app/shared/dialog/checkin/check-in-form-ordinal/check-in-form-ordinal.component.spec.ts
+++ b/frontend/src/app/components/checkin/check-in-form-ordinal/check-in-form-ordinal.component.spec.ts
@@ -2,14 +2,14 @@ import { ComponentFixture, TestBed, waitForAsync } from '@angular/core/testing';
 
 import { CheckInFormOrdinalComponent } from './check-in-form-ordinal.component';
 import { FormControl, FormGroup, ReactiveFormsModule, Validators } from '@angular/forms';
-import { keyResultOrdinalMin } from '../../../testData';
-import { KeyResultOrdinal } from '../../../types/model/KeyResultOrdinal';
+import { keyResultOrdinalMin } from '../../../shared/testData';
+import { KeyResultOrdinal } from '../../../shared/types/model/KeyResultOrdinal';
 import { MatDialogModule } from '@angular/material/dialog';
 import { NoopAnimationsModule } from '@angular/platform-browser/animations';
 import { MatSelectModule } from '@angular/material/select';
 import { MatInputModule } from '@angular/material/input';
 import { MatRadioModule } from '@angular/material/radio';
-import { Zone } from '../../../types/enums/Zone';
+import { Zone } from '../../../shared/types/enums/Zone';
 import { MatRadioButtonHarness } from '@angular/material/radio/testing';
 import { HarnessLoader } from '@angular/cdk/testing';
 import { TestbedHarnessEnvironment } from '@angular/cdk/testing/testbed';
diff --git a/frontend/src/app/shared/dialog/checkin/check-in-form-ordinal/check-in-form-ordinal.component.ts b/frontend/src/app/components/checkin/check-in-form-ordinal/check-in-form-ordinal.component.ts
similarity index 68%
rename from frontend/src/app/shared/dialog/checkin/check-in-form-ordinal/check-in-form-ordinal.component.ts
rename to frontend/src/app/components/checkin/check-in-form-ordinal/check-in-form-ordinal.component.ts
index ce4b89342b..192c5156fb 100644
--- a/frontend/src/app/shared/dialog/checkin/check-in-form-ordinal/check-in-form-ordinal.component.ts
+++ b/frontend/src/app/components/checkin/check-in-form-ordinal/check-in-form-ordinal.component.ts
@@ -1,8 +1,8 @@
 import { Component, Input } from '@angular/core';
 import { FormGroup } from '@angular/forms';
-import { KeyResultOrdinal } from '../../../types/model/KeyResultOrdinal';
-import { Zone } from '../../../types/enums/Zone';
-import { CheckInMin } from '../../../types/model/CheckInMin';
+import { KeyResultOrdinal } from '../../../shared/types/model/KeyResultOrdinal';
+import { Zone } from '../../../shared/types/enums/Zone';
+import { CheckInMin } from '../../../shared/types/model/CheckInMin';
 
 @Component({
   selector: 'app-check-in-form-ordinal',
diff --git a/frontend/src/app/shared/dialog/checkin/check-in-form/check-in-form.component.html b/frontend/src/app/components/checkin/check-in-form/check-in-form.component.html
similarity index 100%
rename from frontend/src/app/shared/dialog/checkin/check-in-form/check-in-form.component.html
rename to frontend/src/app/components/checkin/check-in-form/check-in-form.component.html
diff --git a/frontend/src/app/shared/dialog/checkin/check-in-form/check-in-form.component.scss b/frontend/src/app/components/checkin/check-in-form/check-in-form.component.scss
similarity index 90%
rename from frontend/src/app/shared/dialog/checkin/check-in-form/check-in-form.component.scss
rename to frontend/src/app/components/checkin/check-in-form/check-in-form.component.scss
index a344c9556d..669c394785 100644
--- a/frontend/src/app/shared/dialog/checkin/check-in-form/check-in-form.component.scss
+++ b/frontend/src/app/components/checkin/check-in-form/check-in-form.component.scss
@@ -1,4 +1,4 @@
-@import "variables";
+@import "../style/variables";
 
 .action-list-item {
   background-color: $show-element;
diff --git a/frontend/src/app/shared/dialog/checkin/check-in-form/check-in-form.component.spec.ts b/frontend/src/app/components/checkin/check-in-form/check-in-form.component.spec.ts
similarity index 90%
rename from frontend/src/app/shared/dialog/checkin/check-in-form/check-in-form.component.spec.ts
rename to frontend/src/app/components/checkin/check-in-form/check-in-form.component.spec.ts
index e63bc52673..65f71b851e 100644
--- a/frontend/src/app/shared/dialog/checkin/check-in-form/check-in-form.component.spec.ts
+++ b/frontend/src/app/components/checkin/check-in-form/check-in-form.component.spec.ts
@@ -10,21 +10,24 @@ import {
   keyResultActions,
   keyResultMetric,
   keyResultOrdinal,
-} from '../../../testData';
+} from '../../../shared/testData';
 import { HttpClientTestingModule } from '@angular/common/http/testing';
 import { MatIconModule } from '@angular/material/icon';
 import { MatFormFieldModule } from '@angular/material/form-field';
 import { MatSelectModule } from '@angular/material/select';
-import { ReactiveFormsModule } from '@angular/forms';
+import { FormsModule, ReactiveFormsModule } from '@angular/forms';
 import { MatInputModule } from '@angular/material/input';
 import { NoopAnimationsModule } from '@angular/platform-browser/animations';
 import { MatCheckboxModule } from '@angular/material/checkbox';
-import { ParseUnitValuePipe } from '../../../pipes/parse-unit-value/parse-unit-value.pipe';
+import { ParseUnitValuePipe } from '../../../shared/pipes/parse-unit-value/parse-unit-value.pipe';
 import { CheckInService } from '../../../services/check-in.service';
 import { of } from 'rxjs';
 import { ActionService } from '../../../services/action.service';
-import * as de from '../../../../../assets/i18n/de.json';
+import * as de from '../../../../assets/i18n/de.json';
 import { TranslateTestingModule } from 'ngx-translate-testing';
+import { DialogHeaderComponent } from '../../../shared/custom/dialog-header/dialog-header.component';
+import { ConfidenceComponent } from '../../confidence/confidence.component';
+import { MatSliderModule } from '@angular/material/slider';
 
 const dialogMock = {
   close: jest.fn(),
@@ -54,6 +57,9 @@ describe('CheckInFormComponent', () => {
         MatInputModule,
         NoopAnimationsModule,
         MatCheckboxModule,
+        MatSliderModule,
+        FormsModule,
+        ReactiveFormsModule,
         TranslateTestingModule.withTranslations({
           de: de,
         }),
@@ -65,7 +71,7 @@ describe('CheckInFormComponent', () => {
         { provide: ActionService, useValue: actionServiceMock },
         ParseUnitValuePipe,
       ],
-      declarations: [CheckInFormComponent],
+      declarations: [CheckInFormComponent, DialogHeaderComponent, ConfidenceComponent],
     });
     fixture = TestBed.createComponent(CheckInFormComponent);
     component = fixture.componentInstance;
diff --git a/frontend/src/app/shared/dialog/checkin/check-in-form/check-in-form.component.ts b/frontend/src/app/components/checkin/check-in-form/check-in-form.component.ts
similarity index 89%
rename from frontend/src/app/shared/dialog/checkin/check-in-form/check-in-form.component.ts
rename to frontend/src/app/components/checkin/check-in-form/check-in-form.component.ts
index c6955bd251..baa3b8b1a0 100644
--- a/frontend/src/app/shared/dialog/checkin/check-in-form/check-in-form.component.ts
+++ b/frontend/src/app/components/checkin/check-in-form/check-in-form.component.ts
@@ -1,15 +1,15 @@
 import { ChangeDetectionStrategy, Component, Inject, OnInit } from '@angular/core';
-import { KeyResultMetric } from '../../../types/model/KeyResultMetric';
+import { KeyResultMetric } from '../../../shared/types/model/KeyResultMetric';
 import { FormControl, FormGroup, Validators } from '@angular/forms';
 import { MAT_DIALOG_DATA, MatDialogRef } from '@angular/material/dialog';
-import { KeyResult } from '../../../types/model/KeyResult';
-import { KeyResultOrdinal } from '../../../types/model/KeyResultOrdinal';
-import { CheckInMin } from '../../../types/model/CheckInMin';
-import { ParseUnitValuePipe } from '../../../pipes/parse-unit-value/parse-unit-value.pipe';
+import { KeyResult } from '../../../shared/types/model/KeyResult';
+import { KeyResultOrdinal } from '../../../shared/types/model/KeyResultOrdinal';
+import { CheckInMin } from '../../../shared/types/model/CheckInMin';
+import { ParseUnitValuePipe } from '../../../shared/pipes/parse-unit-value/parse-unit-value.pipe';
 import { CheckInService } from '../../../services/check-in.service';
-import { Action } from '../../../types/model/Action';
+import { Action } from '../../../shared/types/model/Action';
 import { ActionService } from '../../../services/action.service';
-import { formInputCheck, hasFormFieldErrors } from '../../../common';
+import { formInputCheck, hasFormFieldErrors } from '../../../shared/common';
 import { TranslateService } from '@ngx-translate/core';
 
 @Component({
diff --git a/frontend/src/app/confidence/confidence.component.html b/frontend/src/app/components/confidence/confidence.component.html
similarity index 100%
rename from frontend/src/app/confidence/confidence.component.html
rename to frontend/src/app/components/confidence/confidence.component.html
diff --git a/frontend/src/app/confidence/confidence.component.scss b/frontend/src/app/components/confidence/confidence.component.scss
similarity index 100%
rename from frontend/src/app/confidence/confidence.component.scss
rename to frontend/src/app/components/confidence/confidence.component.scss
diff --git a/frontend/src/app/confidence/confidence.component.spec.ts b/frontend/src/app/components/confidence/confidence.component.spec.ts
similarity index 94%
rename from frontend/src/app/confidence/confidence.component.spec.ts
rename to frontend/src/app/components/confidence/confidence.component.spec.ts
index 7b13214ad0..bf658f3bb2 100644
--- a/frontend/src/app/confidence/confidence.component.spec.ts
+++ b/frontend/src/app/components/confidence/confidence.component.spec.ts
@@ -3,9 +3,9 @@ import { ComponentFixture, TestBed } from '@angular/core/testing';
 import { ConfidenceComponent } from './confidence.component';
 import { HarnessLoader } from '@angular/cdk/testing';
 import { TestbedHarnessEnvironment } from '@angular/cdk/testing/testbed';
-import { checkInMetric } from '../shared/testData';
+import { checkInMetric } from '../../shared/testData';
 import { MatSliderModule } from '@angular/material/slider';
-import { CheckInMin } from '../shared/types/model/CheckInMin';
+import { CheckInMin } from '../../shared/types/model/CheckInMin';
 import { FormsModule } from '@angular/forms';
 import { SimpleChange } from '@angular/core';
 import { By } from '@angular/platform-browser';
diff --git a/frontend/src/app/confidence/confidence.component.ts b/frontend/src/app/components/confidence/confidence.component.ts
similarity index 90%
rename from frontend/src/app/confidence/confidence.component.ts
rename to frontend/src/app/components/confidence/confidence.component.ts
index 68fde4255a..cf5405bd29 100644
--- a/frontend/src/app/confidence/confidence.component.ts
+++ b/frontend/src/app/components/confidence/confidence.component.ts
@@ -1,5 +1,5 @@
 import { ChangeDetectionStrategy, Component, Input, OnChanges, SimpleChanges } from '@angular/core';
-import { CheckInMin } from '../shared/types/model/CheckInMin';
+import { CheckInMin } from '../../shared/types/model/CheckInMin';
 
 @Component({
   selector: 'app-confidence',
diff --git a/frontend/src/app/shared/dialog/key-result-form/key-result-form.component.html b/frontend/src/app/components/key-result-form/key-result-form.component.html
similarity index 98%
rename from frontend/src/app/shared/dialog/key-result-form/key-result-form.component.html
rename to frontend/src/app/components/key-result-form/key-result-form.component.html
index ad773dbf32..9816b6710d 100644
--- a/frontend/src/app/shared/dialog/key-result-form/key-result-form.component.html
+++ b/frontend/src/app/components/key-result-form/key-result-form.component.html
@@ -33,7 +33,7 @@
         formControlName="owner"
         id="owner"
       />
-      <mat-autocomplete #auto="matAutocomplete" [displayWith]="getUserNameById.bind(this)">
+      <mat-autocomplete #auto="matAutocomplete" [displayWith]="getUserNameFromUser.bind(this)">
         <mat-option *ngFor="let user of filteredUsers$ | async" [value]="user">
           {{ user.firstname + " " + user.lastname }}
         </mat-option>
diff --git a/frontend/src/app/shared/dialog/key-result-form/key-result-form.component.scss b/frontend/src/app/components/key-result-form/key-result-form.component.scss
similarity index 100%
rename from frontend/src/app/shared/dialog/key-result-form/key-result-form.component.scss
rename to frontend/src/app/components/key-result-form/key-result-form.component.scss
diff --git a/frontend/src/app/shared/dialog/key-result-form/key-result-form.component.spec.ts b/frontend/src/app/components/key-result-form/key-result-form.component.spec.ts
similarity index 83%
rename from frontend/src/app/shared/dialog/key-result-form/key-result-form.component.spec.ts
rename to frontend/src/app/components/key-result-form/key-result-form.component.spec.ts
index 1b4292e762..724f517822 100644
--- a/frontend/src/app/shared/dialog/key-result-form/key-result-form.component.spec.ts
+++ b/frontend/src/app/components/key-result-form/key-result-form.component.spec.ts
@@ -6,36 +6,35 @@ import { MatInputModule } from '@angular/material/input';
 import { FormControl, FormGroup, ReactiveFormsModule, Validators } from '@angular/forms';
 import { HttpClientTestingModule } from '@angular/common/http/testing';
 import { MatIconModule } from '@angular/material/icon';
-import { keyResultOrdinal, testUser, users } from '../../testData';
-import { State } from '../../types/enums/State';
+import { keyResultOrdinal, testUser, users } from '../../shared/testData';
+import { State } from '../../shared/types/enums/State';
 import { Observable, of } from 'rxjs';
 import { MatAutocompleteModule } from '@angular/material/autocomplete';
 import { MatSelectModule } from '@angular/material/select';
 import { MatRadioModule } from '@angular/material/radio';
-import { KeyResultObjective } from '../../types/model/KeyResultObjective';
-import { User } from '../../types/model/User';
-import { DialogHeaderComponent } from '../../custom/dialog-header/dialog-header.component';
-import { KeyresultTypeComponent } from '../../../keyresult-type/keyresult-type.component';
-import { ActionPlanComponent } from '../../../action-plan/action-plan.component';
+import { KeyResultObjective } from '../../shared/types/model/KeyResultObjective';
+import { User } from '../../shared/types/model/User';
+import { DialogHeaderComponent } from '../../shared/custom/dialog-header/dialog-header.component';
+import { OAuthService } from 'angular-oauth2-oidc';
+import { KeyresultTypeComponent } from '../keyresult-type/keyresult-type.component';
+import { ActionPlanComponent } from '../action-plan/action-plan.component';
 import { TranslateModule, TranslateService } from '@ngx-translate/core';
 import { DragDropModule } from '@angular/cdk/drag-drop';
 import { UserService } from '../../services/user.service';
-import { KeyResultFormComponent } from '../key-result-form/key-result-form.component';
-import { Action } from '../../types/model/Action';
-import { KeyResultMetric } from '../../types/model/KeyResultMetric';
-import { KeyResultOrdinal } from '../../types/model/KeyResultOrdinal';
+import { KeyResultFormComponent } from './key-result-form.component';
+import { Action } from '../../shared/types/model/Action';
+import { KeyResultMetric } from '../../shared/types/model/KeyResultMetric';
+import { KeyResultOrdinal } from '../../shared/types/model/KeyResultOrdinal';
 import { TranslateTestingModule } from 'ngx-translate-testing';
-// @ts-ignore
-import * as de from '../../../../assets/i18n/de.json';
-import { OidcSecurityService } from 'angular-auth-oidc-client';
+import * as de from '../../../assets/i18n/de.json';
 
 describe('KeyResultFormComponent', () => {
   let component: KeyResultFormComponent;
   let fixture: ComponentFixture<KeyResultFormComponent>;
 
   const oauthMockService = {
-    getUserData() {
-      return of({ name: users[1].firstname + ' ' + users[1].lastname });
+    getIdentityClaims() {
+      return { name: users[1].firstname + ' ' + users[1].lastname };
     },
   };
 
@@ -43,6 +42,7 @@ describe('KeyResultFormComponent', () => {
     getUsers() {
       return of(users);
     },
+    getCurrentUser: jest.fn(),
   };
 
   const matDialogRefMock = {
@@ -116,7 +116,7 @@ describe('KeyResultFormComponent', () => {
             useValue: matDialogRefMock,
           },
           {
-            provide: OidcSecurityService,
+            provide: OAuthService,
             useValue: oauthMockService,
           },
         ],
@@ -126,6 +126,7 @@ describe('KeyResultFormComponent', () => {
       fixture = TestBed.createComponent(KeyResultFormComponent);
       component = fixture.componentInstance;
       component.keyResultForm = keyResultFormGroup;
+      userService.getCurrentUser.mockReturnValue(testUser);
       fixture.detectChanges();
     });
 
@@ -143,7 +144,7 @@ describe('KeyResultFormComponent', () => {
       expect(formObject.title).toBe('Title');
       expect(formObject.description).toBe(null);
       expect(userServiceSpy).toHaveBeenCalled();
-      expect(component.keyResultForm.controls['owner'].value).toBe(users[1]);
+      expect(component.keyResultForm.controls['owner'].value).toBe(testUser);
       expect(component.keyResultForm.invalid).toBeFalsy();
     }));
 
@@ -161,7 +162,7 @@ describe('KeyResultFormComponent', () => {
     });
 
     it('should return label from user', () => {
-      let userName: string = component.getUserNameById(testUser);
+      let userName: string = component.getUserNameFromUser(testUser);
       expect(userName).toEqual('Bob Baumeister');
     });
 
@@ -223,8 +224,8 @@ describe('KeyResultFormComponent', () => {
 
     it('should get username from user right', () => {
       let user = users[0];
-      expect(component.getUserNameById(user)).toEqual('Bob Baumeister');
-      expect(component.getUserNameById(null!)).toEqual('');
+      expect(component.getUserNameFromUser(user)).toEqual('Bob Baumeister');
+      expect(component.getUserNameFromUser(null!)).toEqual('');
     });
 
     it('should get keyresult id right', () => {
@@ -234,9 +235,7 @@ describe('KeyResultFormComponent', () => {
     });
 
     it('should get username from oauthService  right', () => {
-      component.getUserName().subscribe((userName) => {
-        expect(userName).toEqual('Paco Egiman');
-      });
+      expect(component.getLoggedInUserName()).toEqual(testUser.firstname + ' ' + testUser.lastname);
     });
   });
 });
diff --git a/frontend/src/app/shared/dialog/key-result-form/key-result-form.component.ts b/frontend/src/app/components/key-result-form/key-result-form.component.ts
similarity index 73%
rename from frontend/src/app/shared/dialog/key-result-form/key-result-form.component.ts
rename to frontend/src/app/components/key-result-form/key-result-form.component.ts
index 04dd1535b2..04b455f631 100644
--- a/frontend/src/app/shared/dialog/key-result-form/key-result-form.component.ts
+++ b/frontend/src/app/components/key-result-form/key-result-form.component.ts
@@ -1,15 +1,15 @@
-import { ChangeDetectionStrategy, Component, Input, OnInit } from '@angular/core';
+import { ChangeDetectionStrategy, Component, Input, OnDestroy, OnInit } from '@angular/core';
 import { FormGroup } from '@angular/forms';
-import { User } from '../../types/model/User';
-import { KeyResult } from '../../types/model/KeyResult';
-import { KeyResultMetric } from '../../types/model/KeyResultMetric';
-import { KeyResultOrdinal } from '../../types/model/KeyResultOrdinal';
-import { BehaviorSubject, filter, map, Observable, of, startWith, switchMap, tap } from 'rxjs';
+import { getFullNameFromUser, User } from '../../shared/types/model/User';
+import { KeyResult } from '../../shared/types/model/KeyResult';
+import { KeyResultMetric } from '../../shared/types/model/KeyResultMetric';
+import { KeyResultOrdinal } from '../../shared/types/model/KeyResultOrdinal';
+import { BehaviorSubject, filter, map, Observable, of, startWith, Subject, switchMap, takeUntil } from 'rxjs';
 import { UserService } from '../../services/user.service';
-import { Action } from '../../types/model/Action';
-import { formInputCheck, hasFormFieldErrors } from '../../common';
+import { Action } from '../../shared/types/model/Action';
+import { formInputCheck, hasFormFieldErrors } from '../../shared/common';
+import { OAuthService } from 'angular-oauth2-oidc';
 import { TranslateService } from '@ngx-translate/core';
-import { OidcSecurityService } from 'angular-auth-oidc-client';
 
 @Component({
   selector: 'app-key-result-form',
@@ -17,12 +17,13 @@ import { OidcSecurityService } from 'angular-auth-oidc-client';
   styleUrls: ['./key-result-form.component.scss'],
   changeDetection: ChangeDetectionStrategy.OnPush,
 })
-export class KeyResultFormComponent implements OnInit {
+export class KeyResultFormComponent implements OnInit, OnDestroy {
   users$!: Observable<User[]>;
   filteredUsers$: Observable<User[]> | undefined = of([]);
   actionList$: BehaviorSubject<Action[] | null> = new BehaviorSubject<Action[] | null>([] as Action[]);
   protected readonly formInputCheck = formInputCheck;
   protected readonly hasFormFieldErrors = hasFormFieldErrors;
+  private unsubscribe$ = new Subject<void>();
 
   @Input()
   keyResultForm!: FormGroup;
@@ -31,7 +32,7 @@ export class KeyResultFormComponent implements OnInit {
 
   constructor(
     public userService: UserService,
-    private oauthService: OidcSecurityService,
+    private oauthService: OAuthService,
     private translate: TranslateService,
   ) {}
 
@@ -61,13 +62,12 @@ export class KeyResultFormComponent implements OnInit {
         { id: null, version: 1, action: '', priority: 2, keyResultId: null, isChecked: false },
       ]);
 
-      this.users$.subscribe((users) => {
-        this.getUserName().subscribe((userName) => {
-          users.forEach((user) => {
-            if (user.firstname + ' ' + user.lastname === userName) {
-              this.keyResultForm.controls['owner'].setValue(user);
-            }
-          });
+      this.users$.pipe(takeUntil(this.unsubscribe$)).subscribe((users) => {
+        const loggedInUser = this.getLoggedInUserName();
+        users.forEach((user) => {
+          if (getFullNameFromUser(user) === loggedInUser) {
+            this.keyResultForm.controls['owner'].setValue(user);
+          }
         });
       });
     }
@@ -77,6 +77,11 @@ export class KeyResultFormComponent implements OnInit {
     });
   }
 
+  ngOnDestroy() {
+    this.unsubscribe$.next();
+    this.unsubscribe$.complete();
+  }
+
   isMetricKeyResult() {
     return this.keyResultForm.controls['keyResultType'].value === 'metric';
   }
@@ -104,13 +109,7 @@ export class KeyResultFormComponent implements OnInit {
   filter(value: string): Observable<User[]> {
     const filterValue = value.toLowerCase();
     return this.users$.pipe(
-      map((users) =>
-        users.filter(
-          (user) =>
-            (user.firstname.toLowerCase() + ' ' + user.lastname.toLowerCase()).includes(filterValue) ||
-            user.username.toLowerCase().includes(filterValue),
-        ),
-      ),
+      map((users) => users.filter((user) => getFullNameFromUser(user).toLowerCase().includes(filterValue))),
     );
   }
 
@@ -121,8 +120,8 @@ export class KeyResultFormComponent implements OnInit {
     );
   }
 
-  getUserNameById(user: User): string {
-    return user ? user.firstname + ' ' + user.lastname : '';
+  getUserNameFromUser(user: User): string {
+    return user ? getFullNameFromUser(user) : '';
   }
 
   getKeyResultId(): number | null {
@@ -131,7 +130,7 @@ export class KeyResultFormComponent implements OnInit {
 
   updateFormValidity() {}
 
-  getUserName() {
-    return this.oauthService.getUserData().pipe(map((user) => user?.name || ''));
+  getLoggedInUserName() {
+    return this.getUserNameFromUser(this.userService.getCurrentUser());
   }
 }
diff --git a/frontend/src/app/keyresult-detail/keyresult-detail.component.html b/frontend/src/app/components/keyresult-detail/keyresult-detail.component.html
similarity index 93%
rename from frontend/src/app/keyresult-detail/keyresult-detail.component.html
rename to frontend/src/app/components/keyresult-detail/keyresult-detail.component.html
index b78f78778e..7bbecb71a6 100644
--- a/frontend/src/app/keyresult-detail/keyresult-detail.component.html
+++ b/frontend/src/app/components/keyresult-detail/keyresult-detail.component.html
@@ -13,7 +13,7 @@ <h3 class="title">{{ keyResult.title }}</h3>
             {{ "KEY_RESULT_TYPE." + keyResult.keyResultType | translate }}
           </div>
           <div class="d-flex align-items-center">
-            <img alt="person icon" class="me-1" height="10" src="assets/icons/person-icon.svg" width="10" />
+            <img alt="person icon" class="me-1" height="10" src="../../../assets/icons/person-icon.svg" width="10" />
             <p *ngIf="keyResult.owner as owner">{{ owner.firstname }} {{ owner.lastname }}</p>
           </div>
           <span *ngIf="keyResult?.objective?.quarter as quarter">{{ quarter.label }}</span>
@@ -82,9 +82,9 @@ <h3 class="title">{{ keyResult.title }}</h3>
         </div>
 
         <div *ngIf="keyResult.lastCheckIn as checkIn" class="mt-4">
-          <p class="sub-title-keyresult-detail fw-bold mb-1">
+          <h2 class="sub-title-keyresult-detail fw-bold mb-1">
             Letztes Check-in ({{ checkIn.createdOn | date: DATE_FORMAT }})
-          </p>
+          </h2>
           <p class="linebreak" *ngIf="checkIn.changeInfo">{{ checkIn.changeInfo }}</p>
           <span class="d-flex justify-content-start">
             <button
@@ -101,7 +101,7 @@ <h3 class="title">{{ keyResult.title }}</h3>
         </div>
 
         <div class="mt-3 mb-4">
-          <p class="sub-title-keyresult-detail fw-bold mb-1">Beschrieb</p>
+          <h2 class="sub-title-keyresult-detail fw-bold mb-1">Beschrieb</h2>
           <p class="linebreak" *ngIf="keyResult.description === ''">-</p>
           <p class="linebreak" *ngIf="keyResult.description !== ''">{{ keyResult.description }}</p>
         </div>
@@ -111,7 +111,7 @@ <h2 class="sub-title-keyresult-detail fw-bold">Action Plan</h2>
           <div *ngFor="let action of keyResult.actionList">
             <div *ngIf="action.isChecked">
               <div class="action-list-checked-item break-word ms-4">
-                <img src="../assets/icons/checkmark.svg" alt="checkbox" class="action-checkbox me-1" />
+                <img src="../../../assets/icons/checkmark.svg" alt="checkbox" class="action-checkbox me-1" />
                 <span [ngStyle]="{ 'text-decoration': 'line-through' }"> {{ action.action }}</span>
               </div>
             </div>
@@ -148,9 +148,6 @@ <h2 class="sub-title-keyresult-detail fw-bold">Action Plan</h2>
   </ng-container>
 
   <ng-template #spinner>
-    <div class="spinner-container">
-      Keyresult wird geladen...
-      <mat-progress-spinner color="primary" mode="indeterminate"> </mat-progress-spinner>
-    </div>
+    <app-spinner text="Keyresult wird geladen..."></app-spinner>
   </ng-template>
 </div>
diff --git a/frontend/src/app/keyresult-detail/keyresult-detail.component.scss b/frontend/src/app/components/keyresult-detail/keyresult-detail.component.scss
similarity index 94%
rename from frontend/src/app/keyresult-detail/keyresult-detail.component.scss
rename to frontend/src/app/components/keyresult-detail/keyresult-detail.component.scss
index 5134aa3298..52a762ce8e 100644
--- a/frontend/src/app/keyresult-detail/keyresult-detail.component.scss
+++ b/frontend/src/app/components/keyresult-detail/keyresult-detail.component.scss
@@ -1,4 +1,8 @@
-@import "_variables";
+@import "../style/variables";
+
+:host {
+  flex: 1;
+}
 
 .keyResult-detail-attribute-show {
   background-color: $show-element;
@@ -6,10 +10,6 @@
   font-size: 0.85rem;
 }
 
-.sub-title-keyresult-detail {
-  font-size: 1.1rem;
-}
-
 .ordinal-zone-title {
   font-size: 1.1rem;
 }
diff --git a/frontend/src/app/keyresult-detail/keyresult-detail.component.spec.ts b/frontend/src/app/components/keyresult-detail/keyresult-detail.component.spec.ts
similarity index 72%
rename from frontend/src/app/keyresult-detail/keyresult-detail.component.spec.ts
rename to frontend/src/app/components/keyresult-detail/keyresult-detail.component.spec.ts
index 3bc77f4232..c0e0055357 100644
--- a/frontend/src/app/keyresult-detail/keyresult-detail.component.spec.ts
+++ b/frontend/src/app/components/keyresult-detail/keyresult-detail.component.spec.ts
@@ -5,15 +5,26 @@ import { HttpClientTestingModule } from '@angular/common/http/testing';
 import { MatDialogModule } from '@angular/material/dialog';
 import { TranslateModule } from '@ngx-translate/core';
 import { of } from 'rxjs';
-import { keyResult, keyResultWriteableFalse } from '../shared/testData';
+import { keyResult, keyResultWriteableFalse } from '../../shared/testData';
 import { By } from '@angular/platform-browser';
-import { KeyresultService } from '../shared/services/keyresult.service';
+import { KeyresultService } from '../../services/keyresult.service';
 import { MatIconModule } from '@angular/material/icon';
+import { ActivatedRoute } from '@angular/router';
+import { ScoringComponent } from '../../shared/custom/scoring/scoring.component';
+import { ConfidenceComponent } from '../confidence/confidence.component';
 
 const keyResultServiceMock = {
   getFullKeyResult: jest.fn(),
 };
 
+const activatedRouteMock = {
+  snapshot: {
+    paramMap: {
+      get: jest.fn(),
+    },
+  },
+};
+
 describe('KeyresultDetailComponent', () => {
   let component: KeyresultDetailComponent;
   let fixture: ComponentFixture<KeyresultDetailComponent>;
@@ -21,16 +32,22 @@ describe('KeyresultDetailComponent', () => {
   beforeEach(async () => {
     await TestBed.configureTestingModule({
       imports: [HttpClientTestingModule, MatDialogModule, MatIconModule, TranslateModule.forRoot()],
-      declarations: [KeyresultDetailComponent],
+      declarations: [KeyresultDetailComponent, ScoringComponent, ConfidenceComponent],
       providers: [
         {
           provide: KeyresultService,
           useValue: keyResultServiceMock,
         },
+        {
+          provide: ActivatedRoute,
+          useValue: activatedRouteMock,
+        },
       ],
     }).compileComponents();
 
     jest.spyOn(keyResultServiceMock, 'getFullKeyResult').mockReturnValue(of(keyResult));
+    activatedRouteMock.snapshot.paramMap.get.mockReturnValue(of(1));
+
     fixture = TestBed.createComponent(KeyresultDetailComponent);
     component = fixture.componentInstance;
     fixture.detectChanges();
@@ -40,6 +57,11 @@ describe('KeyresultDetailComponent', () => {
     expect(component).toBeTruthy();
   });
 
+  it('should throw error when id is undefined', () => {
+    activatedRouteMock.snapshot.paramMap.get.mockReturnValue(undefined);
+    expect(() => component.ngOnInit()).toThrowError('keyresult id is undefined');
+  });
+
   it('should display edit keyresult button if writeable is true', async () => {
     const button = fixture.debugElement.query(By.css('[data-testId="edit-keyResult"]'));
     expect(button).toBeTruthy();
diff --git a/frontend/src/app/keyresult-detail/keyresult-detail.component.ts b/frontend/src/app/components/keyresult-detail/keyresult-detail.component.ts
similarity index 77%
rename from frontend/src/app/keyresult-detail/keyresult-detail.component.ts
rename to frontend/src/app/components/keyresult-detail/keyresult-detail.component.ts
index 5326c6d430..d31fae0dfb 100644
--- a/frontend/src/app/keyresult-detail/keyresult-detail.component.ts
+++ b/frontend/src/app/components/keyresult-detail/keyresult-detail.component.ts
@@ -1,20 +1,20 @@
 import { ChangeDetectionStrategy, Component, Input, OnInit } from '@angular/core';
-import { KeyResult } from '../shared/types/model/KeyResult';
-import { KeyresultService } from '../shared/services/keyresult.service';
-import { KeyResultMetric } from '../shared/types/model/KeyResultMetric';
-import { KeyResultOrdinal } from '../shared/types/model/KeyResultOrdinal';
-import { CheckInHistoryDialogComponent } from '../shared/dialog/check-in-history-dialog/check-in-history-dialog.component';
+import { KeyResult } from '../../shared/types/model/KeyResult';
+import { KeyresultService } from '../../services/keyresult.service';
+import { KeyResultMetric } from '../../shared/types/model/KeyResultMetric';
+import { KeyResultOrdinal } from '../../shared/types/model/KeyResultOrdinal';
+import { CheckInHistoryDialogComponent } from '../check-in-history-dialog/check-in-history-dialog.component';
 import { MatDialog } from '@angular/material/dialog';
 import { BehaviorSubject, catchError, EMPTY } from 'rxjs';
-import { Router } from '@angular/router';
-import { RefreshDataService } from '../shared/services/refresh-data.service';
-import { CloseState } from '../shared/types/enums/CloseState';
-import { CheckInFormComponent } from '../shared/dialog/checkin/check-in-form/check-in-form.component';
-import { State } from '../shared/types/enums/State';
-import { CONFIRM_DIALOG_WIDTH, DATE_FORMAT } from '../shared/constantLibary';
-import { calculateCurrentPercentage, isLastCheckInNegative, isMobileDevice } from '../shared/common';
-import { KeyresultDialogComponent } from '../shared/dialog/keyresult-dialog/keyresult-dialog.component';
-import { ConfirmDialogComponent } from '../shared/dialog/confirm-dialog/confirm-dialog.component';
+import { ActivatedRoute, Router } from '@angular/router';
+import { RefreshDataService } from '../../services/refresh-data.service';
+import { CloseState } from '../../shared/types/enums/CloseState';
+import { CheckInFormComponent } from '../checkin/check-in-form/check-in-form.component';
+import { State } from '../../shared/types/enums/State';
+import { CONFIRM_DIALOG_WIDTH, DATE_FORMAT, OKR_DIALOG_CONFIG } from '../../shared/constantLibary';
+import { calculateCurrentPercentage, isLastCheckInNegative, isMobileDevice } from '../../shared/common';
+import { KeyresultDialogComponent } from '../keyresult-dialog/keyresult-dialog.component';
+import { ConfirmDialogComponent } from '../../shared/dialog/confirm-dialog/confirm-dialog.component';
 
 @Component({
   selector: 'app-keyresult-detail',
@@ -35,12 +35,22 @@ export class KeyresultDetailComponent implements OnInit {
     private refreshDataService: RefreshDataService,
     private dialog: MatDialog,
     private router: Router,
+    private route: ActivatedRoute,
   ) {}
 
   ngOnInit(): void {
+    this.keyResultId = this.getIdFromParams();
     this.loadKeyResult(this.keyResultId);
   }
 
+  private getIdFromParams(): number {
+    const id = this.route.snapshot.paramMap.get('id');
+    if (!id) {
+      throw Error('keyresult id is undefined');
+    }
+    return parseInt(id);
+  }
+
   loadKeyResult(id: number): void {
     this.keyResultService
       .getFullKeyResult(id)
@@ -61,17 +71,7 @@ export class KeyresultDetailComponent implements OnInit {
   }
 
   checkInHistory() {
-    const dialogConfig = isMobileDevice()
-      ? {
-          maxWidth: '100vw',
-          maxHeight: '100vh',
-          height: '100vh',
-          width: '100vw',
-        }
-      : {
-          width: '45em',
-          height: 'auto',
-        };
+    const dialogConfig = OKR_DIALOG_CONFIG;
     const dialogRef = this.dialog.open(CheckInHistoryDialogComponent, {
       data: {
         keyResult: this.keyResult$.getValue(),
diff --git a/frontend/src/app/shared/dialog/keyresult-dialog/keyresult-dialog.component.html b/frontend/src/app/components/keyresult-dialog/keyresult-dialog.component.html
similarity index 100%
rename from frontend/src/app/shared/dialog/keyresult-dialog/keyresult-dialog.component.html
rename to frontend/src/app/components/keyresult-dialog/keyresult-dialog.component.html
diff --git a/frontend/src/app/shared/dialog/keyresult-dialog/keyresult-dialog.component.scss b/frontend/src/app/components/keyresult-dialog/keyresult-dialog.component.scss
similarity index 100%
rename from frontend/src/app/shared/dialog/keyresult-dialog/keyresult-dialog.component.scss
rename to frontend/src/app/components/keyresult-dialog/keyresult-dialog.component.scss
diff --git a/frontend/src/app/shared/dialog/keyresult-dialog/keyresult-dialog.component.spec.ts b/frontend/src/app/components/keyresult-dialog/keyresult-dialog.component.spec.ts
similarity index 95%
rename from frontend/src/app/shared/dialog/keyresult-dialog/keyresult-dialog.component.spec.ts
rename to frontend/src/app/components/keyresult-dialog/keyresult-dialog.component.spec.ts
index 4ed5d5d686..17d9f4d017 100644
--- a/frontend/src/app/shared/dialog/keyresult-dialog/keyresult-dialog.component.spec.ts
+++ b/frontend/src/app/components/keyresult-dialog/keyresult-dialog.component.spec.ts
@@ -8,22 +8,22 @@ import { ReactiveFormsModule } from '@angular/forms';
 import { HttpClientTestingModule } from '@angular/common/http/testing';
 import { MatIconModule } from '@angular/material/icon';
 import { By } from '@angular/platform-browser';
-import { testUser, users } from '../../testData';
-import { State } from '../../types/enums/State';
-import { KeyResult } from '../../types/model/KeyResult';
+import { testUser, users } from '../../shared/testData';
+import { State } from '../../shared/types/enums/State';
+import { KeyResult } from '../../shared/types/model/KeyResult';
 import { of } from 'rxjs';
 import { MatAutocompleteModule } from '@angular/material/autocomplete';
 import { MatSelectModule } from '@angular/material/select';
 import { MatRadioModule } from '@angular/material/radio';
-import { KeyResultObjective } from '../../types/model/KeyResultObjective';
-import { DialogHeaderComponent } from '../../custom/dialog-header/dialog-header.component';
-import { KeyresultTypeComponent } from '../../../keyresult-type/keyresult-type.component';
-import { ActionPlanComponent } from '../../../action-plan/action-plan.component';
+import { KeyResultObjective } from '../../shared/types/model/KeyResultObjective';
+import { DialogHeaderComponent } from '../../shared/custom/dialog-header/dialog-header.component';
+import { OAuthService } from 'angular-oauth2-oidc';
+import { KeyresultTypeComponent } from '../keyresult-type/keyresult-type.component';
+import { ActionPlanComponent } from '../action-plan/action-plan.component';
 import { TranslateModule, TranslateService } from '@ngx-translate/core';
 import { DragDropModule } from '@angular/cdk/drag-drop';
 import { UserService } from '../../services/user.service';
 import { KeyResultFormComponent } from '../key-result-form/key-result-form.component';
-import { OidcSecurityService } from 'angular-auth-oidc-client';
 
 describe('KeyresultDialogComponent', () => {
   let component: KeyresultDialogComponent;
@@ -31,8 +31,8 @@ describe('KeyresultDialogComponent', () => {
   let keyResultService: KeyresultService;
 
   const oauthMockService = {
-    getUserData() {
-      return of({ name: users[1].firstname + ' ' + users[1].lastname });
+    getIdentityClaims() {
+      return { name: users[1].firstname + ' ' + users[1].lastname };
     },
   };
 
@@ -40,6 +40,7 @@ describe('KeyresultDialogComponent', () => {
     getUsers() {
       return of(users);
     },
+    getCurrentUser: jest.fn(),
   };
 
   let fullObjective = {
@@ -277,7 +278,7 @@ describe('KeyresultDialogComponent', () => {
             useValue: { objective: fullObjective, keyResult: undefined },
           },
           {
-            provide: OidcSecurityService,
+            provide: OAuthService,
             useValue: oauthMockService,
           },
         ],
@@ -292,6 +293,9 @@ describe('KeyresultDialogComponent', () => {
 
       fixture = TestBed.createComponent(KeyresultDialogComponent);
       component = fixture.componentInstance;
+
+      userService.getCurrentUser.mockReturnValue(testUser);
+
       fixture.detectChanges();
       keyResultService = TestBed.inject(KeyresultService);
     });
@@ -415,11 +419,11 @@ describe('KeyresultDialogComponent', () => {
           {
             provide: MatDialogRef,
             useValue: {
-              close: (dialogResult: any) => {},
+              close: () => {},
             },
           },
           {
-            provide: OidcSecurityService,
+            provide: OAuthService,
             useValue: oauthMockService,
           },
           {
@@ -562,7 +566,7 @@ describe('KeyresultDialogComponent', () => {
             useValue: matDialogRefMock,
           },
           {
-            provide: OidcSecurityService,
+            provide: OAuthService,
             useValue: oauthMockService,
           },
           {
diff --git a/frontend/src/app/shared/dialog/keyresult-dialog/keyresult-dialog.component.ts b/frontend/src/app/components/keyresult-dialog/keyresult-dialog.component.ts
similarity index 83%
rename from frontend/src/app/shared/dialog/keyresult-dialog/keyresult-dialog.component.ts
rename to frontend/src/app/components/keyresult-dialog/keyresult-dialog.component.ts
index 13e3a7bc48..82f99cb1db 100644
--- a/frontend/src/app/shared/dialog/keyresult-dialog/keyresult-dialog.component.ts
+++ b/frontend/src/app/components/keyresult-dialog/keyresult-dialog.component.ts
@@ -1,17 +1,17 @@
 import { Component, Inject } from '@angular/core';
 import { FormControl, FormGroup, Validators } from '@angular/forms';
-import { User } from '../../types/model/User';
-import { Action } from '../../types/model/Action';
+import { User } from '../../shared/types/model/User';
+import { Action } from '../../shared/types/model/Action';
 import { MAT_DIALOG_DATA, MatDialog, MatDialogRef } from '@angular/material/dialog';
-import { Objective } from '../../types/model/Objective';
-import { KeyResult } from '../../types/model/KeyResult';
-import { KeyResultMetricDTO } from '../../types/DTOs/KeyResultMetricDTO';
-import { KeyResultOrdinalDTO } from '../../types/DTOs/KeyResultOrdinalDTO';
-import { CloseState } from '../../types/enums/CloseState';
+import { Objective } from '../../shared/types/model/Objective';
+import { KeyResult } from '../../shared/types/model/KeyResult';
+import { KeyResultMetricDTO } from '../../shared/types/DTOs/KeyResultMetricDTO';
+import { KeyResultOrdinalDTO } from '../../shared/types/DTOs/KeyResultOrdinalDTO';
+import { CloseState } from '../../shared/types/enums/CloseState';
 import { KeyresultService } from '../../services/keyresult.service';
-import { ConfirmDialogComponent } from '../confirm-dialog/confirm-dialog.component';
-import { isMobileDevice } from '../../common';
-import { CONFIRM_DIALOG_WIDTH } from '../../constantLibary';
+import { ConfirmDialogComponent } from '../../shared/dialog/confirm-dialog/confirm-dialog.component';
+import { isMobileDevice } from '../../shared/common';
+import { CONFIRM_DIALOG_WIDTH } from '../../shared/constantLibary';
 
 @Component({
   selector: 'app-keyresult-dialog',
diff --git a/frontend/src/app/keyresult-type/keyresult-type.component.html b/frontend/src/app/components/keyresult-type/keyresult-type.component.html
similarity index 100%
rename from frontend/src/app/keyresult-type/keyresult-type.component.html
rename to frontend/src/app/components/keyresult-type/keyresult-type.component.html
diff --git a/frontend/src/app/keyresult-type/keyresult-type.component.scss b/frontend/src/app/components/keyresult-type/keyresult-type.component.scss
similarity index 100%
rename from frontend/src/app/keyresult-type/keyresult-type.component.scss
rename to frontend/src/app/components/keyresult-type/keyresult-type.component.scss
diff --git a/frontend/src/app/keyresult-type/keyresult-type.component.spec.ts b/frontend/src/app/components/keyresult-type/keyresult-type.component.spec.ts
similarity index 92%
rename from frontend/src/app/keyresult-type/keyresult-type.component.spec.ts
rename to frontend/src/app/components/keyresult-type/keyresult-type.component.spec.ts
index 32cc866557..5e2e5dcfe6 100644
--- a/frontend/src/app/keyresult-type/keyresult-type.component.spec.ts
+++ b/frontend/src/app/components/keyresult-type/keyresult-type.component.spec.ts
@@ -1,13 +1,13 @@
 import { ComponentFixture, TestBed } from '@angular/core/testing';
-import * as de from '../../assets/i18n/de.json';
+import * as de from '../../../assets/i18n/de.json';
 
 import { KeyresultTypeComponent } from './keyresult-type.component';
-import { KeyResult } from '../shared/types/model/KeyResult';
-import { keyResultMetric, keyResultOrdinal } from '../shared/testData';
+import { KeyResult } from '../../shared/types/model/KeyResult';
+import { keyResultMetric, keyResultOrdinal, testUser } from '../../shared/testData';
 import { TranslateTestingModule } from 'ngx-translate-testing';
 import { By } from '@angular/platform-browser';
 import { FormControl, FormGroup, ReactiveFormsModule, Validators } from '@angular/forms';
-import { User } from '../shared/types/model/User';
+import { User } from '../../shared/types/model/User';
 
 describe('KeyresultTypeComponent', () => {
   let component: KeyresultTypeComponent;
@@ -25,10 +25,7 @@ describe('KeyresultTypeComponent', () => {
     description: new FormControl<string>('Puzzle ITC erledigt die IT-Aufträge für 100% aller Unternehmen.', [
       Validators.maxLength(4096),
     ]),
-    owner: new FormControl<User | string | null>(
-      { id: 1, firstname: 'firstname', lastname: 'lastname', username: 'username' },
-      [Validators.required, Validators.nullValidator],
-    ),
+    owner: new FormControl<User | string | null>(testUser, [Validators.required, Validators.nullValidator]),
     unit: new FormControl<string | null>('PERCENT'),
     baseline: new FormControl<number | null>(30),
     stretchGoal: new FormControl<number | null>(100),
@@ -47,10 +44,7 @@ describe('KeyresultTypeComponent', () => {
     description: new FormControl<string>('Puzzle ITC erledigt die IT-Aufträge für 100% aller Unternehmen.', [
       Validators.maxLength(4096),
     ]),
-    owner: new FormControl<User | string | null>(
-      { id: 1, firstname: 'firstname', lastname: 'lastname', username: 'username' },
-      [Validators.required, Validators.nullValidator],
-    ),
+    owner: new FormControl<User | string | null>(testUser, [Validators.required, Validators.nullValidator]),
     unit: new FormControl<string | null>(null),
     baseline: new FormControl<number | null>(null),
     stretchGoal: new FormControl<number | null>(null),
@@ -69,10 +63,7 @@ describe('KeyresultTypeComponent', () => {
     description: new FormControl<string>('Puzzle ITC erledigt die IT-Aufträge für 100% aller Unternehmen.', [
       Validators.maxLength(4096),
     ]),
-    owner: new FormControl<User | string | null>(
-      { id: 1, firstname: 'firstname', lastname: 'lastname', username: 'username' },
-      [Validators.required, Validators.nullValidator],
-    ),
+    owner: new FormControl<User | string | null>(testUser, [Validators.required, Validators.nullValidator]),
     unit: new FormControl<string | null>(null),
     baseline: new FormControl<number | null>(null),
     stretchGoal: new FormControl<number | null>(null),
diff --git a/frontend/src/app/keyresult-type/keyresult-type.component.ts b/frontend/src/app/components/keyresult-type/keyresult-type.component.ts
similarity index 91%
rename from frontend/src/app/keyresult-type/keyresult-type.component.ts
rename to frontend/src/app/components/keyresult-type/keyresult-type.component.ts
index 4e1ad5f846..0be35b7ced 100644
--- a/frontend/src/app/keyresult-type/keyresult-type.component.ts
+++ b/frontend/src/app/components/keyresult-type/keyresult-type.component.ts
@@ -1,10 +1,10 @@
 import { Component, EventEmitter, Input, OnInit, Output } from '@angular/core';
-import { KeyResult } from '../shared/types/model/KeyResult';
+import { KeyResult } from '../../shared/types/model/KeyResult';
 import { FormGroup, Validators } from '@angular/forms';
-import { KeyResultMetric } from '../shared/types/model/KeyResultMetric';
-import { KeyResultOrdinal } from '../shared/types/model/KeyResultOrdinal';
-import { Unit } from '../shared/types/enums/Unit';
-import { formInputCheck, hasFormFieldErrors } from '../shared/common';
+import { KeyResultMetric } from '../../shared/types/model/KeyResultMetric';
+import { KeyResultOrdinal } from '../../shared/types/model/KeyResultOrdinal';
+import { Unit } from '../../shared/types/enums/Unit';
+import { formInputCheck, hasFormFieldErrors } from '../../shared/common';
 import { TranslateService } from '@ngx-translate/core';
 
 @Component({
diff --git a/frontend/src/app/keyresult/keyresult.component.html b/frontend/src/app/components/keyresult/keyresult.component.html
similarity index 100%
rename from frontend/src/app/keyresult/keyresult.component.html
rename to frontend/src/app/components/keyresult/keyresult.component.html
diff --git a/frontend/src/app/keyresult/keyresult.component.scss b/frontend/src/app/components/keyresult/keyresult.component.scss
similarity index 81%
rename from frontend/src/app/keyresult/keyresult.component.scss
rename to frontend/src/app/components/keyresult/keyresult.component.scss
index b8370aa4d4..19f57b5764 100644
--- a/frontend/src/app/keyresult/keyresult.component.scss
+++ b/frontend/src/app/components/keyresult/keyresult.component.scss
@@ -1,7 +1,7 @@
-@import "_variables";
+@import "../style/variables";
 .key-result {
-  background-color: $keyResult-bg;
-  border: 1px solid $keyResult-border;
+  background-color: $dark-grey;
+  border: 1px solid $dark-grey-border;
   word-wrap: break-word;
 
   &:hover {
diff --git a/frontend/src/app/keyresult/keyresult.component.spec.ts b/frontend/src/app/components/keyresult/keyresult.component.spec.ts
similarity index 70%
rename from frontend/src/app/keyresult/keyresult.component.spec.ts
rename to frontend/src/app/components/keyresult/keyresult.component.spec.ts
index cab9119fa4..2eaccdb68c 100644
--- a/frontend/src/app/keyresult/keyresult.component.spec.ts
+++ b/frontend/src/app/components/keyresult/keyresult.component.spec.ts
@@ -1,7 +1,9 @@
 import { ComponentFixture, TestBed } from '@angular/core/testing';
 import { KeyresultComponent } from './keyresult.component';
-import { keyResultMetricMin } from '../shared/testData';
+import { keyResultMetricMin } from '../../shared/testData';
 import { MatDialogModule } from '@angular/material/dialog';
+import { ScoringComponent } from '../../shared/custom/scoring/scoring.component';
+import { ConfidenceComponent } from '../confidence/confidence.component';
 
 describe('KeyresultComponent', () => {
   let component: KeyresultComponent;
@@ -9,7 +11,7 @@ describe('KeyresultComponent', () => {
 
   beforeEach(async () => {
     await TestBed.configureTestingModule({
-      declarations: [KeyresultComponent],
+      declarations: [KeyresultComponent, ScoringComponent, ConfidenceComponent],
       imports: [MatDialogModule],
     }).compileComponents();
 
diff --git a/frontend/src/app/keyresult/keyresult.component.ts b/frontend/src/app/components/keyresult/keyresult.component.ts
similarity index 71%
rename from frontend/src/app/keyresult/keyresult.component.ts
rename to frontend/src/app/components/keyresult/keyresult.component.ts
index c2a9c8ec79..65a915e0df 100644
--- a/frontend/src/app/keyresult/keyresult.component.ts
+++ b/frontend/src/app/components/keyresult/keyresult.component.ts
@@ -1,7 +1,7 @@
 import { ChangeDetectionStrategy, Component, Input } from '@angular/core';
-import { KeyresultMin } from '../shared/types/model/KeyresultMin';
+import { KeyresultMin } from '../../shared/types/model/KeyresultMin';
 import { Router } from '@angular/router';
-import { DATE_FORMAT } from '../shared/constantLibary';
+import { DATE_FORMAT } from '../../shared/constantLibary';
 
 @Component({
   selector: 'app-keyresult',
@@ -16,6 +16,6 @@ export class KeyresultComponent {
   constructor(private router: Router) {}
 
   openDrawer() {
-    this.router.navigate(['keyresult', this.keyResult.id]);
+    this.router.navigate(['details/keyresult', this.keyResult.id]);
   }
 }
diff --git a/frontend/src/app/objective-detail/objective-detail.component.html b/frontend/src/app/components/objective-detail/objective-detail.component.html
similarity index 89%
rename from frontend/src/app/objective-detail/objective-detail.component.html
rename to frontend/src/app/components/objective-detail/objective-detail.component.html
index 56f7754553..4c79701994 100644
--- a/frontend/src/app/objective-detail/objective-detail.component.html
+++ b/frontend/src/app/components/objective-detail/objective-detail.component.html
@@ -1,4 +1,4 @@
-<div class="w-100" cdkTrapFocus cdkTrapFocusAutoCapture="true">
+<div class="w-100" [cdkTrapFocus]="true" [cdkTrapFocusAutoCapture]="true">
   <ng-container *ngIf="(objective$ | async)?.id && (objective$ | async) as objective; else spinner">
     <div *ngIf="objective" class="d-flex flex-column">
       <div class="w-100 d-flex justify-content-between align-items-center mb-3">
@@ -52,9 +52,6 @@ <h2 class="title">{{ objective.title }}</h2>
   </ng-container>
 
   <ng-template #spinner>
-    <div class="spinner-container">
-      Objective wird geladen...
-      <mat-progress-spinner color="primary" mode="indeterminate"> </mat-progress-spinner>
-    </div>
+    <app-spinner text="Objective wird geladen..."></app-spinner>
   </ng-template>
 </div>
diff --git a/frontend/src/app/objective-detail/objective-detail.component.scss b/frontend/src/app/components/objective-detail/objective-detail.component.scss
similarity index 62%
rename from frontend/src/app/objective-detail/objective-detail.component.scss
rename to frontend/src/app/components/objective-detail/objective-detail.component.scss
index 45795da70f..df5ca6aea7 100644
--- a/frontend/src/app/objective-detail/objective-detail.component.scss
+++ b/frontend/src/app/components/objective-detail/objective-detail.component.scss
@@ -1,3 +1,7 @@
+:host {
+  width: 100%;
+}
+
 .sub-title-objective {
   font-size: 1rem;
 }
diff --git a/frontend/src/app/objective-detail/objective-detail.component.spec.ts b/frontend/src/app/components/objective-detail/objective-detail.component.spec.ts
similarity index 67%
rename from frontend/src/app/objective-detail/objective-detail.component.spec.ts
rename to frontend/src/app/components/objective-detail/objective-detail.component.spec.ts
index 00cc3527dc..71e220d089 100644
--- a/frontend/src/app/objective-detail/objective-detail.component.spec.ts
+++ b/frontend/src/app/components/objective-detail/objective-detail.component.spec.ts
@@ -3,35 +3,55 @@ import { ComponentFixture, TestBed } from '@angular/core/testing';
 import { ObjectiveDetailComponent } from './objective-detail.component';
 import { HttpClientTestingModule } from '@angular/common/http/testing';
 import { By } from '@angular/platform-browser';
-import { ObjectiveService } from '../shared/services/objective.service';
-import { objective, objectiveWriteableFalse } from '../shared/testData';
+import { ObjectiveService } from '../../services/objective.service';
+import { objective, objectiveWriteableFalse } from '../../shared/testData';
 import { of } from 'rxjs';
 import { MatDialogModule } from '@angular/material/dialog';
+import { ActivatedRoute } from '@angular/router';
+import { MatIconModule } from '@angular/material/icon';
 
 let objectiveService = {
   getFullObjective: jest.fn(),
 };
 
+const activatedRouteMock = {
+  snapshot: {
+    paramMap: {
+      get: jest.fn() as any,
+    },
+  },
+};
+
 describe('ObjectiveDetailComponent', () => {
   let component: ObjectiveDetailComponent;
   let fixture: ComponentFixture<ObjectiveDetailComponent>;
 
   beforeEach(async () => {
     await TestBed.configureTestingModule({
-      imports: [HttpClientTestingModule, MatDialogModule],
-      providers: [{ provide: ObjectiveService, useValue: objectiveService }],
+      imports: [HttpClientTestingModule, MatDialogModule, MatIconModule],
+      providers: [
+        { provide: ObjectiveService, useValue: objectiveService },
+        { provide: ActivatedRoute, useValue: activatedRouteMock },
+      ],
       declarations: [ObjectiveDetailComponent],
     }).compileComponents();
 
     fixture = TestBed.createComponent(ObjectiveDetailComponent);
     component = fixture.componentInstance;
     objectiveService.getFullObjective.mockReturnValue(of(objective));
+    activatedRouteMock.snapshot.paramMap.get = jest.fn();
+    activatedRouteMock.snapshot.paramMap.get.mockReturnValue(of(1));
   });
 
   it('should create', () => {
     expect(component).toBeTruthy();
   });
 
+  it('should throw an exception, if id is undefined', () => {
+    activatedRouteMock.snapshot.paramMap.get = () => undefined;
+    expect(() => component.ngOnInit()).toThrowError('objective id is undefined');
+  });
+
   it('get data from backend', () => {
     fixture.detectChanges();
     component.objectiveId = 2;
diff --git a/frontend/src/app/objective-detail/objective-detail.component.ts b/frontend/src/app/components/objective-detail/objective-detail.component.ts
similarity index 68%
rename from frontend/src/app/objective-detail/objective-detail.component.ts
rename to frontend/src/app/components/objective-detail/objective-detail.component.ts
index 40253b3588..a16837c818 100644
--- a/frontend/src/app/objective-detail/objective-detail.component.ts
+++ b/frontend/src/app/components/objective-detail/objective-detail.component.ts
@@ -1,21 +1,21 @@
-import { ChangeDetectionStrategy, Component, Input } from '@angular/core';
-import { Objective } from '../shared/types/model/Objective';
-import { ObjectiveService } from '../shared/services/objective.service';
+import { ChangeDetectionStrategy, Component } from '@angular/core';
+import { Objective } from '../../shared/types/model/Objective';
+import { ObjectiveService } from '../../services/objective.service';
 import { BehaviorSubject, catchError, EMPTY } from 'rxjs';
 import { MatDialog } from '@angular/material/dialog';
-import { RefreshDataService } from '../shared/services/refresh-data.service';
-import { KeyresultDialogComponent } from '../shared/dialog/keyresult-dialog/keyresult-dialog.component';
-import { ObjectiveFormComponent } from '../shared/dialog/objective-dialog/objective-form.component';
-import { Router } from '@angular/router';
-import { isMobileDevice } from '../shared/common';
+import { RefreshDataService } from '../../services/refresh-data.service';
+import { KeyresultDialogComponent } from '../keyresult-dialog/keyresult-dialog.component';
+import { ObjectiveFormComponent } from '../../shared/dialog/objective-dialog/objective-form.component';
+import { ActivatedRoute, Router } from '@angular/router';
+import { OKR_DIALOG_CONFIG } from '../../shared/constantLibary';
 
 @Component({
   selector: 'app-objective-detail',
   templateUrl: './objective-detail.component.html',
+  styleUrl: 'objective-detail.component.scss',
   changeDetection: ChangeDetectionStrategy.OnPush,
 })
 export class ObjectiveDetailComponent {
-  @Input()
   objectiveId!: number;
   objective$: BehaviorSubject<Objective> = new BehaviorSubject<Objective>({} as Objective);
 
@@ -24,12 +24,22 @@ export class ObjectiveDetailComponent {
     private dialog: MatDialog,
     private refreshDataService: RefreshDataService,
     private router: Router,
+    private route: ActivatedRoute,
   ) {}
 
   ngOnInit(): void {
+    this.objectiveId = this.getIdFromParams();
     this.loadObjective(this.objectiveId);
   }
 
+  private getIdFromParams(): number {
+    const id = this.route.snapshot.paramMap.get('id');
+    if (!id) {
+      throw Error('objective id is undefined');
+    }
+    return parseInt(id);
+  }
+
   loadObjective(id: number): void {
     this.objectiveService
       .getFullObjective(id)
@@ -38,17 +48,7 @@ export class ObjectiveDetailComponent {
   }
 
   openAddKeyResultDialog() {
-    const dialogConfig = isMobileDevice()
-      ? {
-          maxWidth: '100vw',
-          maxHeight: '100vh',
-          height: '100vh',
-          width: '100vw',
-        }
-      : {
-          width: '45em',
-          height: 'auto',
-        };
+    const dialogConfig = OKR_DIALOG_CONFIG;
 
     this.dialog
       .open(KeyresultDialogComponent, {
diff --git a/frontend/src/app/objective-filter/objective-filter.component.html b/frontend/src/app/components/objective-filter/objective-filter.component.html
similarity index 85%
rename from frontend/src/app/objective-filter/objective-filter.component.html
rename to frontend/src/app/components/objective-filter/objective-filter.component.html
index e367a4a529..8b9f1f6b68 100644
--- a/frontend/src/app/objective-filter/objective-filter.component.html
+++ b/frontend/src/app/components/objective-filter/objective-filter.component.html
@@ -1,4 +1,4 @@
-<form class="d-flex" (ngSubmit)="this.refresh.next()">
+<form class="d-flex search-form" (ngSubmit)="this.refresh.next()">
   <mat-form-field
     id="objective-form-field"
     class="bg-white header-form-field"
@@ -18,7 +18,7 @@
   </mat-form-field>
 
   <button
-    class="bg-pz-dark-blue d-flex justify-content-start align-items-center search-button icon-button pe-3 focus-outline"
+    class="bg-pz-dark-blue d-flex justify-content-start align-items-center icon-button px-3 focus-outline"
     type="submit"
   >
     <img src="../assets/icons/search-icon.svg" alt="search icon" class="text-white search-scale" />
diff --git a/frontend/src/app/components/objective-filter/objective-filter.component.scss b/frontend/src/app/components/objective-filter/objective-filter.component.scss
new file mode 100644
index 0000000000..6575e0f171
--- /dev/null
+++ b/frontend/src/app/components/objective-filter/objective-filter.component.scss
@@ -0,0 +1,3 @@
+#objective-form-field {
+  width: 300px;
+}
diff --git a/frontend/src/app/objective-filter/objective-filter.component.spec.ts b/frontend/src/app/components/objective-filter/objective-filter.component.spec.ts
similarity index 82%
rename from frontend/src/app/objective-filter/objective-filter.component.spec.ts
rename to frontend/src/app/components/objective-filter/objective-filter.component.spec.ts
index 0eab0ac2af..a76d0e4148 100644
--- a/frontend/src/app/objective-filter/objective-filter.component.spec.ts
+++ b/frontend/src/app/components/objective-filter/objective-filter.component.spec.ts
@@ -2,7 +2,7 @@ import { ComponentFixture, fakeAsync, TestBed, tick } from '@angular/core/testin
 
 import { ObjectiveFilterComponent } from './objective-filter.component';
 import { HttpClientTestingModule } from '@angular/common/http/testing';
-import { AppRoutingModule } from '../app-routing.module';
+import { AppRoutingModule } from '../../app-routing.module';
 import { MatFormFieldModule } from '@angular/material/form-field';
 import { MatIconModule } from '@angular/material/icon';
 import { FormsModule } from '@angular/forms';
@@ -13,10 +13,9 @@ import { TestbedHarnessEnvironment } from '@angular/cdk/testing/testbed';
 import { MatInputHarness } from '@angular/material/input/testing';
 import { Router } from '@angular/router';
 import { RouterTestingHarness } from '@angular/router/testing';
-import { authGuard } from '../shared/guards/auth.guard';
+import { authGuard } from '../../guards/auth.guard';
 import { OverviewComponent } from '../overview/overview.component';
-import { AbstractLoggerService, AutoLoginPartialRoutesGuard, StsConfigLoader } from 'angular-auth-oidc-client';
-import { of } from 'rxjs';
+import { OAuthService } from 'angular-oauth2-oidc';
 
 describe('ObjectiveFilterComponent', () => {
   let component: ObjectiveFilterComponent;
@@ -24,26 +23,25 @@ describe('ObjectiveFilterComponent', () => {
   let loader: HarnessLoader;
   let router: Router;
 
+  const authGuardMock = () => {
+    return Promise.resolve(true);
+  };
+
+  const oauthServiceMock = {
+    hasValidIdToken: jest.fn(),
+  };
+
   beforeEach(() => {
     TestBed.configureTestingModule({
       declarations: [ObjectiveFilterComponent, OverviewComponent],
       providers: [
         {
-          provide: StsConfigLoader,
-          useValue: {
-            loadConfig: () => of({}),
-            loadConfigs: () => of([{}]),
-          },
-        },
-        {
-          provide: AbstractLoggerService,
-          useValue: {
-            logError: () => of({}),
-          },
+          provide: authGuard,
+          useValue: authGuardMock,
         },
         {
-          provide: AutoLoginPartialRoutesGuard,
-          useValue: () => Promise.resolve(true),
+          provide: OAuthService,
+          useValue: oauthServiceMock,
         },
       ],
       imports: [
diff --git a/frontend/src/app/objective-filter/objective-filter.component.ts b/frontend/src/app/components/objective-filter/objective-filter.component.ts
similarity index 97%
rename from frontend/src/app/objective-filter/objective-filter.component.ts
rename to frontend/src/app/components/objective-filter/objective-filter.component.ts
index fd99b21aa2..e16e1d8e8d 100644
--- a/frontend/src/app/objective-filter/objective-filter.component.ts
+++ b/frontend/src/app/components/objective-filter/objective-filter.component.ts
@@ -1,6 +1,6 @@
 import { ChangeDetectionStrategy, Component, OnInit } from '@angular/core';
 import { ActivatedRoute, Router } from '@angular/router';
-import { getQueryString, optionalReplaceWithNulls, sanitize } from '../shared/common';
+import { getQueryString, optionalReplaceWithNulls, sanitize } from '../../shared/common';
 import { debounceTime, map, Subject } from 'rxjs';
 
 @Component({
diff --git a/frontend/src/app/objective/objective.component.html b/frontend/src/app/components/objective/objective.component.html
similarity index 98%
rename from frontend/src/app/objective/objective.component.html
rename to frontend/src/app/components/objective/objective.component.html
index ffec9eb2e6..48fd01a194 100644
--- a/frontend/src/app/objective/objective.component.html
+++ b/frontend/src/app/components/objective/objective.component.html
@@ -55,7 +55,7 @@ <h2 class="title fit-content">{{ objective.title }}</h2>
         (keydown.enter)="$event.stopPropagation()"
       >
         <span class="d-flex align-items-center add-text">
-          <img alt="Add key-result button" class="add-cross-button" src="assets/icons/new-icon.svg" />
+          <img alt="Add key-result button" class="add-cross-button" src="../../../assets/icons/new-icon.svg" />
           Key Result hinzufügen
         </span>
       </button>
diff --git a/frontend/src/app/objective/objective.component.scss b/frontend/src/app/components/objective/objective.component.scss
similarity index 96%
rename from frontend/src/app/objective/objective.component.scss
rename to frontend/src/app/components/objective/objective.component.scss
index 61b5584a70..4bf3ed8826 100644
--- a/frontend/src/app/objective/objective.component.scss
+++ b/frontend/src/app/components/objective/objective.component.scss
@@ -1,4 +1,4 @@
-@import "_variables";
+@import "../style/variables";
 
 .objective {
   max-width: 750px;
diff --git a/frontend/src/app/objective/objective.component.spec.ts b/frontend/src/app/components/objective/objective.component.spec.ts
similarity index 91%
rename from frontend/src/app/objective/objective.component.spec.ts
rename to frontend/src/app/components/objective/objective.component.spec.ts
index 8467049416..c429f95f77 100644
--- a/frontend/src/app/objective/objective.component.spec.ts
+++ b/frontend/src/app/components/objective/objective.component.spec.ts
@@ -6,25 +6,25 @@ import { HarnessLoader } from '@angular/cdk/testing';
 import { TestbedHarnessEnvironment } from '@angular/cdk/testing/testbed';
 import { NoopAnimationsModule } from '@angular/platform-browser/animations';
 import { By } from '@angular/platform-browser';
-import { State } from '../shared/types/enums/State';
+import { State } from '../../shared/types/enums/State';
 import { RouterTestingModule } from '@angular/router/testing';
-import { OverviewService } from '../shared/services/overview.service';
-import { objective, objectiveMin } from '../shared/testData';
+import { OverviewService } from '../../services/overview.service';
+import { objective, objectiveMin } from '../../shared/testData';
 import { MatMenuHarness } from '@angular/material/menu/testing';
 import { KeyresultComponent } from '../keyresult/keyresult.component';
 import { MatDialogModule } from '@angular/material/dialog';
 import { HttpClientTestingModule } from '@angular/common/http/testing';
 import { MatIconModule } from '@angular/material/icon';
 import { MatTooltipModule } from '@angular/material/tooltip';
-import { ScoringComponent } from '../shared/custom/scoring/scoring.component';
+import { ScoringComponent } from '../../shared/custom/scoring/scoring.component';
 import { ConfidenceComponent } from '../confidence/confidence.component';
 import { ReactiveFormsModule } from '@angular/forms';
-import * as de from '../../assets/i18n/de.json';
+import * as de from '../../../assets/i18n/de.json';
 import { TranslateTestingModule } from 'ngx-translate-testing';
-import { ObjectiveMin } from '../shared/types/model/ObjectiveMin';
-import { MenuEntry } from '../shared/types/menu-entry';
-import { ObjectiveService } from '../shared/services/objective.service';
+import { ObjectiveMin } from '../../shared/types/model/ObjectiveMin';
+import { MenuEntry } from '../../shared/types/menu-entry';
 import { of } from 'rxjs';
+import { ObjectiveService } from '../../services/objective.service';
 
 const overviewServiceMock = {
   getObjectiveWithKeyresults: jest.fn(),
diff --git a/frontend/src/app/objective/objective.component.ts b/frontend/src/app/components/objective/objective.component.ts
similarity index 83%
rename from frontend/src/app/objective/objective.component.ts
rename to frontend/src/app/components/objective/objective.component.ts
index 349f7808c5..96aa53acf1 100644
--- a/frontend/src/app/objective/objective.component.ts
+++ b/frontend/src/app/components/objective/objective.component.ts
@@ -1,21 +1,21 @@
 import { ChangeDetectionStrategy, Component, ElementRef, Input, OnInit, ViewChild } from '@angular/core';
-import { MenuEntry } from '../shared/types/menu-entry';
-import { ObjectiveMin } from '../shared/types/model/ObjectiveMin';
+import { MenuEntry } from '../../shared/types/menu-entry';
+import { ObjectiveMin } from '../../shared/types/model/ObjectiveMin';
 import { Router } from '@angular/router';
-import { ObjectiveFormComponent } from '../shared/dialog/objective-dialog/objective-form.component';
+import { ObjectiveFormComponent } from '../../shared/dialog/objective-dialog/objective-form.component';
 import { MatDialog } from '@angular/material/dialog';
 import { BehaviorSubject } from 'rxjs';
-import { RefreshDataService } from '../shared/services/refresh-data.service';
-import { State } from '../shared/types/enums/State';
-import { ObjectiveService } from '../shared/services/objective.service';
-import { ConfirmDialogComponent } from '../shared/dialog/confirm-dialog/confirm-dialog.component';
-import { CompleteDialogComponent } from '../shared/dialog/complete-dialog/complete-dialog.component';
-import { Completed } from '../shared/types/model/Completed';
-import { Objective } from '../shared/types/model/Objective';
-import { isMobileDevice, trackByFn } from '../shared/common';
-import { KeyresultDialogComponent } from '../shared/dialog/keyresult-dialog/keyresult-dialog.component';
+import { RefreshDataService } from '../../services/refresh-data.service';
+import { State } from '../../shared/types/enums/State';
+import { ObjectiveService } from '../../services/objective.service';
+import { ConfirmDialogComponent } from '../../shared/dialog/confirm-dialog/confirm-dialog.component';
+import { CompleteDialogComponent } from '../../shared/dialog/complete-dialog/complete-dialog.component';
+import { Completed } from '../../shared/types/model/Completed';
+import { Objective } from '../../shared/types/model/Objective';
+import { trackByFn } from '../../shared/common';
+import { KeyresultDialogComponent } from '../keyresult-dialog/keyresult-dialog.component';
 import { TranslateService } from '@ngx-translate/core';
-import { GJ_REGEX_PATTERN } from '../shared/constantLibary';
+import { GJ_REGEX_PATTERN, OKR_DIALOG_CONFIG } from '../../shared/constantLibary';
 
 @Component({
   selector: 'app-objective-column',
@@ -147,17 +147,7 @@ export class ObjectiveComponent implements OnInit {
 
   redirect(menuEntry: MenuEntry) {
     if (menuEntry.dialog) {
-      const dialogConfig = isMobileDevice()
-        ? {
-            maxWidth: '100vw',
-            maxHeight: '100vh',
-            height: '100vh',
-            width: '100vw',
-          }
-        : {
-            width: '45em',
-            height: 'auto',
-          };
+      const dialogConfig = OKR_DIALOG_CONFIG;
 
       if (menuEntry.action == 'release' || menuEntry.action == 'todraft') {
         dialogConfig.width = 'auto';
@@ -254,21 +244,11 @@ export class ObjectiveComponent implements OnInit {
   }
 
   openObjectiveDetail() {
-    this.router.navigate(['objective', this.objective$.value.id]);
+    this.router.navigate(['details/objective', this.objective$.value.id]);
   }
 
   openAddKeyResultDialog() {
-    const dialogConfig = isMobileDevice()
-      ? {
-          maxWidth: '100vw',
-          maxHeight: '100vh',
-          height: '100vh',
-          width: '100vw',
-        }
-      : {
-          width: '45em',
-          height: 'auto',
-        };
+    const dialogConfig = OKR_DIALOG_CONFIG;
 
     this.matDialog
       .open(KeyresultDialogComponent, {
diff --git a/frontend/src/app/overview/overview.component.html b/frontend/src/app/components/overview/overview.component.html
similarity index 71%
rename from frontend/src/app/overview/overview.component.html
rename to frontend/src/app/components/overview/overview.component.html
index a8e1e40d7f..18289e8543 100644
--- a/frontend/src/app/overview/overview.component.html
+++ b/frontend/src/app/components/overview/overview.component.html
@@ -1,16 +1,13 @@
-<router-outlet></router-outlet>
-
-<app-application-top-bar [hasAdminAccess]="hasAdminAccess"></app-application-top-bar>
 <app-application-banner id="bannerComponent"></app-application-banner>
 <div id="overview" class="overviewContainer px-sm-4" [ngStyle]="{ 'padding-top.px': overviewPadding | async }">
   <app-team
-    [hasAdminAccess]="hasAdminAccess"
     *ngFor="let overviewEntity of overviewEntities$ | async; trackBy: trackByFn"
     [overviewEntity]="overviewEntity"
   >
   </app-team>
   <div *ngIf="(overviewEntities$ | async)?.length == 0" class="d-flex align-items-center flex-column pt-5 gap-5">
     <p>Kein Team ausgewählt</p>
-    <img src="assets/images/puzzle-p.svg" alt="" width="242" class="puzzle-logo" />
+    <img src="{{ this.backgroundLogoSrc$ | async }}" alt="" width="242" class="puzzle-logo" />
   </div>
 </div>
+<router-outlet></router-outlet>
diff --git a/frontend/src/app/overview/overview.component.scss b/frontend/src/app/components/overview/overview.component.scss
similarity index 89%
rename from frontend/src/app/overview/overview.component.scss
rename to frontend/src/app/components/overview/overview.component.scss
index 0f59a39431..e2a4e71850 100644
--- a/frontend/src/app/overview/overview.component.scss
+++ b/frontend/src/app/components/overview/overview.component.scss
@@ -1,4 +1,4 @@
-@import "variables";
+@import "../style/variables";
 
 .overviewContainer {
   overflow-x: hidden;
diff --git a/frontend/src/app/overview/overview.component.spec.ts b/frontend/src/app/components/overview/overview.component.spec.ts
similarity index 78%
rename from frontend/src/app/overview/overview.component.spec.ts
rename to frontend/src/app/components/overview/overview.component.spec.ts
index 661e6838d4..44a584d46a 100644
--- a/frontend/src/app/overview/overview.component.spec.ts
+++ b/frontend/src/app/components/overview/overview.component.spec.ts
@@ -1,21 +1,21 @@
 import { ComponentFixture, TestBed } from '@angular/core/testing';
+
 import { OverviewComponent } from './overview.component';
 import { HttpClientTestingModule } from '@angular/common/http/testing';
-import { overViewEntity1 } from '../shared/testData';
+import { overViewEntity1 } from '../../shared/testData';
 import { BehaviorSubject, of, Subject } from 'rxjs';
-import { OverviewService } from '../shared/services/overview.service';
-import { AppRoutingModule } from '../app-routing.module';
+import { OverviewService } from '../../services/overview.service';
+import { AppRoutingModule } from '../../app-routing.module';
 import { RouterTestingHarness } from '@angular/router/testing';
-import { RefreshDataService } from '../shared/services/refresh-data.service';
-import { authGuard } from '../shared/guards/auth.guard';
+import { RefreshDataService } from '../../services/refresh-data.service';
+import { authGuard } from '../../guards/auth.guard';
 import { ApplicationBannerComponent } from '../application-banner/application-banner.component';
 import { ApplicationTopBarComponent } from '../application-top-bar/application-top-bar.component';
+import { DateTimeProvider, OAuthLogger, OAuthService, UrlHelperService } from 'angular-oauth2-oidc';
 import { MatDialogModule, MatDialogRef } from '@angular/material/dialog';
 import { MatIconModule } from '@angular/material/icon';
 import { MatMenuModule } from '@angular/material/menu';
 import { CUSTOM_ELEMENTS_SCHEMA } from '@angular/core';
-import { AbstractLoggerService, AutoLoginPartialRoutesGuard, StsConfigLoader } from 'angular-auth-oidc-client';
-import { NgOptimizedImage } from '@angular/common';
 
 const overviewService = {
   getOverview: jest.fn(),
@@ -46,14 +46,7 @@ describe('OverviewComponent', () => {
   let fixture: ComponentFixture<OverviewComponent>;
   beforeEach(async () => {
     await TestBed.configureTestingModule({
-      imports: [
-        HttpClientTestingModule,
-        AppRoutingModule,
-        MatDialogModule,
-        MatIconModule,
-        MatMenuModule,
-        NgOptimizedImage,
-      ],
+      imports: [HttpClientTestingModule, AppRoutingModule, MatDialogModule, MatIconModule, MatMenuModule],
       declarations: [OverviewComponent, ApplicationBannerComponent, ApplicationTopBarComponent],
       providers: [
         {
@@ -61,8 +54,8 @@ describe('OverviewComponent', () => {
           useValue: overviewService,
         },
         {
-          provide: AutoLoginPartialRoutesGuard,
-          useValue: () => Promise.resolve(true),
+          provide: authGuard,
+          useValue: authGuardMock,
         },
         {
           provide: RefreshDataService,
@@ -72,26 +65,17 @@ describe('OverviewComponent', () => {
           provide: MatDialogRef,
           useValue: {},
         },
-        {
-          provide: StsConfigLoader,
-          useValue: {
-            loadConfig: () => of({}),
-            loadConfigs: () => of([{}]),
-          },
-        },
-        {
-          provide: AbstractLoggerService,
-          useValue: {
-            logError: () => of({}),
-          },
-        },
+        OAuthService,
+        UrlHelperService,
+        OAuthLogger,
+        DateTimeProvider,
       ],
       schemas: [CUSTOM_ELEMENTS_SCHEMA],
     }).compileComponents();
 
     fixture = TestBed.createComponent(OverviewComponent);
     component = fixture.componentInstance;
-    overviewService.getOverview.mockReturnValue(of({ overviews: [overViewEntity1], adminAccess: true }));
+    overviewService.getOverview.mockReturnValue(of([overViewEntity1]));
     fixture.detectChanges();
   });
 
diff --git a/frontend/src/app/overview/overview.component.ts b/frontend/src/app/components/overview/overview.component.ts
similarity index 75%
rename from frontend/src/app/overview/overview.component.ts
rename to frontend/src/app/components/overview/overview.component.ts
index 674346df80..b5c2b9158d 100644
--- a/frontend/src/app/overview/overview.component.ts
+++ b/frontend/src/app/components/overview/overview.component.ts
@@ -1,10 +1,21 @@
 import { ChangeDetectionStrategy, ChangeDetectorRef, Component, OnDestroy, OnInit } from '@angular/core';
-import { OverviewEntity } from '../shared/types/model/OverviewEntity';
-import { catchError, combineLatest, EMPTY, ReplaySubject, Subject, take, takeUntil } from 'rxjs';
-import { OverviewService } from '../shared/services/overview.service';
+import { OverviewEntity } from '../../shared/types/model/OverviewEntity';
+import {
+  BehaviorSubject,
+  catchError,
+  combineLatest,
+  EMPTY,
+  ReplaySubject,
+  Subject,
+  Subscription,
+  take,
+  takeUntil,
+} from 'rxjs';
+import { OverviewService } from '../../services/overview.service';
 import { ActivatedRoute } from '@angular/router';
-import { RefreshDataService } from '../shared/services/refresh-data.service';
-import { getQueryString, getValueFromQuery, isMobileDevice, trackByFn } from '../shared/common';
+import { RefreshDataService } from '../../services/refresh-data.service';
+import { getQueryString, getValueFromQuery, isMobileDevice, trackByFn } from '../../shared/common';
+import { ConfigService } from '../../services/config.service';
 
 @Component({
   selector: 'app-overview',
@@ -16,14 +27,16 @@ export class OverviewComponent implements OnInit, OnDestroy {
   overviewEntities$: Subject<OverviewEntity[]> = new Subject<OverviewEntity[]>();
   protected readonly trackByFn = trackByFn;
   private destroyed$: ReplaySubject<boolean> = new ReplaySubject(1);
-  hasAdminAccess: ReplaySubject<boolean> = new ReplaySubject<boolean>(1);
   overviewPadding: Subject<number> = new Subject();
 
+  backgroundLogoSrc$ = new BehaviorSubject<String>('assets/images/empty.svg');
+
   constructor(
     private overviewService: OverviewService,
     private refreshDataService: RefreshDataService,
     private activatedRoute: ActivatedRoute,
     private changeDetector: ChangeDetectorRef,
+    private configService: ConfigService,
   ) {
     this.refreshDataService.reloadOverviewSubject
       .pipe(takeUntil(this.destroyed$))
@@ -49,6 +62,13 @@ export class OverviewComponent implements OnInit, OnDestroy {
     if (!isMobileDevice()) {
       document.getElementById('overview')?.classList.add('bottom-shadow-space');
     }
+    this.configService.config$.subscribe({
+      next: (config) => {
+        if (config.triangles) {
+          this.backgroundLogoSrc$.next(config.backgroundLogo);
+        }
+      },
+    });
   }
 
   loadOverviewWithParams() {
@@ -71,9 +91,8 @@ export class OverviewComponent implements OnInit, OnDestroy {
           return EMPTY;
         }),
       )
-      .subscribe((dashboard) => {
-        this.hasAdminAccess.next(dashboard.adminAccess);
-        this.overviewEntities$.next(dashboard.overviews);
+      .subscribe((overviews) => {
+        this.overviewEntities$.next(overviews);
       });
   }
 
diff --git a/frontend/src/app/quarter-filter/quarter-filter.component.html b/frontend/src/app/components/quarter-filter/quarter-filter.component.html
similarity index 100%
rename from frontend/src/app/quarter-filter/quarter-filter.component.html
rename to frontend/src/app/components/quarter-filter/quarter-filter.component.html
diff --git a/frontend/src/app/quarter-filter/quarter-filter.component.spec.ts b/frontend/src/app/components/quarter-filter/quarter-filter.component.spec.ts
similarity index 90%
rename from frontend/src/app/quarter-filter/quarter-filter.component.spec.ts
rename to frontend/src/app/components/quarter-filter/quarter-filter.component.spec.ts
index 9a578a6310..e2507f74ce 100644
--- a/frontend/src/app/quarter-filter/quarter-filter.component.spec.ts
+++ b/frontend/src/app/components/quarter-filter/quarter-filter.component.spec.ts
@@ -1,14 +1,13 @@
-import { ComponentFixture, TestBed, tick } from '@angular/core/testing';
+import { ComponentFixture, TestBed } from '@angular/core/testing';
 import { QuarterFilterComponent } from './quarter-filter.component';
 import { HttpClientTestingModule } from '@angular/common/http/testing';
-import { OverviewService } from '../shared/services/overview.service';
-import { quarter } from '../shared/testData';
+import { OverviewService } from '../../services/overview.service';
+import { quarter } from '../../shared/testData';
 import { Observable, of } from 'rxjs';
-import { Quarter } from '../shared/types/model/Quarter';
-import { QuarterService } from '../shared/services/quarter.service';
+import { Quarter } from '../../shared/types/model/Quarter';
+import { QuarterService } from '../../services/quarter.service';
 import { RouterTestingHarness, RouterTestingModule } from '@angular/router/testing';
 import { FormsModule } from '@angular/forms';
-import { By } from '@angular/platform-browser';
 import { MatFormFieldModule } from '@angular/material/form-field';
 import { MatSelectModule } from '@angular/material/select';
 import { NoopAnimationsModule } from '@angular/platform-browser/animations';
@@ -22,7 +21,7 @@ const overviewService = {
 };
 
 const quarters = [
-  { id: 199, label: 'Backlog', startDate: null, endDate: null },
+  { id: 999, label: 'Backlog', startDate: null, endDate: null },
   { ...quarter, id: 2 },
   { ...quarter, id: 5 },
   { ...quarter, id: 7 },
diff --git a/frontend/src/app/quarter-filter/quarter-filter.component.ts b/frontend/src/app/components/quarter-filter/quarter-filter.component.ts
similarity index 87%
rename from frontend/src/app/quarter-filter/quarter-filter.component.ts
rename to frontend/src/app/components/quarter-filter/quarter-filter.component.ts
index 10168b7bab..1374bbc135 100644
--- a/frontend/src/app/quarter-filter/quarter-filter.component.ts
+++ b/frontend/src/app/components/quarter-filter/quarter-filter.component.ts
@@ -1,10 +1,10 @@
 import { ChangeDetectionStrategy, Component, EventEmitter, OnInit, Output } from '@angular/core';
-import { QuarterService } from '../shared/services/quarter.service';
-import { Quarter } from '../shared/types/model/Quarter';
+import { QuarterService } from '../../services/quarter.service';
+import { Quarter } from '../../shared/types/model/Quarter';
 import { BehaviorSubject } from 'rxjs';
 import { ActivatedRoute, Router } from '@angular/router';
-import { getQuarterLabel, getValueFromQuery } from '../shared/common';
-import { RefreshDataService } from '../shared/services/refresh-data.service';
+import { getQuarterLabel, getValueFromQuery } from '../../shared/common';
+import { RefreshDataService } from '../../services/refresh-data.service';
 
 @Component({
   selector: 'app-quarter-filter',
diff --git a/frontend/src/app/team-filter/team-filter.component.html b/frontend/src/app/components/team-filter/team-filter.component.html
similarity index 100%
rename from frontend/src/app/team-filter/team-filter.component.html
rename to frontend/src/app/components/team-filter/team-filter.component.html
diff --git a/frontend/src/app/team-filter/team-filter.component.scss b/frontend/src/app/components/team-filter/team-filter.component.scss
similarity index 100%
rename from frontend/src/app/team-filter/team-filter.component.scss
rename to frontend/src/app/components/team-filter/team-filter.component.scss
diff --git a/frontend/src/app/team-filter/team-filter.component.spec.ts b/frontend/src/app/components/team-filter/team-filter.component.spec.ts
similarity index 81%
rename from frontend/src/app/team-filter/team-filter.component.spec.ts
rename to frontend/src/app/components/team-filter/team-filter.component.spec.ts
index df3fac1714..0644b7dfe4 100644
--- a/frontend/src/app/team-filter/team-filter.component.spec.ts
+++ b/frontend/src/app/components/team-filter/team-filter.component.spec.ts
@@ -6,11 +6,15 @@ import { RouterTestingHarness, RouterTestingModule } from '@angular/router/testi
 import { MatChipsModule } from '@angular/material/chips';
 import { HarnessLoader } from '@angular/cdk/testing';
 import { TestbedHarnessEnvironment } from '@angular/cdk/testing/testbed';
-import { TeamService } from '../shared/services/team.service';
-import { RefreshDataService } from '../shared/services/refresh-data.service';
+import { TeamService } from '../../services/team.service';
+import { RefreshDataService } from '../../services/refresh-data.service';
 import { of, Subject } from 'rxjs';
-import { team1, team2, team3, teamList } from '../shared/testData';
+import { team1, team2, team3, teamList, testUser } from '../../shared/testData';
 import { Router } from '@angular/router';
+import { MatIconModule } from '@angular/material/icon';
+import { UserService } from '../../services/user.service';
+import { extractTeamsFromUser } from '../../shared/types/model/User';
+import { ApplicationBannerComponent } from '../application-banner/application-banner.component';
 
 const teamServiceMock = {
   getAllTeams: jest.fn(),
@@ -22,6 +26,10 @@ const refreshDataServiceMock = {
   markDataRefresh: jest.fn,
 };
 
+const userServiceMock = {
+  getCurrentUser: jest.fn(),
+};
+
 describe('TeamFilterComponent', () => {
   let component: TeamFilterComponent;
   let fixture: ComponentFixture<TeamFilterComponent>;
@@ -30,11 +38,12 @@ describe('TeamFilterComponent', () => {
 
   beforeEach(() => {
     TestBed.configureTestingModule({
-      declarations: [TeamFilterComponent],
-      imports: [HttpClientTestingModule, RouterTestingModule, MatChipsModule],
+      declarations: [TeamFilterComponent, ApplicationBannerComponent],
+      imports: [HttpClientTestingModule, RouterTestingModule, MatChipsModule, MatIconModule],
       providers: [
         { provide: TeamService, useValue: teamServiceMock },
         { provide: RefreshDataService, useValue: refreshDataServiceMock },
+        { provide: UserService, useValue: userServiceMock },
       ],
     });
     fixture = TestBed.createComponent(TeamFilterComponent);
@@ -45,6 +54,7 @@ describe('TeamFilterComponent', () => {
       .markDataRefresh()
       .mockImplementation(() => refreshDataServiceMock.reloadOverviewSubject.next(null));
     router = TestBed.inject(Router);
+    userServiceMock.getCurrentUser.mockReturnValue(testUser);
     fixture.detectChanges();
   });
 
@@ -167,10 +177,10 @@ describe('TeamFilterComponent', () => {
     refreshDataServiceMock.reloadOverviewSubject.next(null);
     fixture.detectChanges();
     expect(component.teams$.value).toStrictEqual([team2, team1]);
-    expect(component.activeTeams).toStrictEqual([team2.id]);
+    expect(component.activeTeams).toStrictEqual([team1.id]);
   });
 
-  it('should use default values if no known teams are in url', async () => {
+  it('should use teams of user if no known teams are in url', async () => {
     const teamIds = [654, 478];
     jest.spyOn(component.teams$, 'next');
     jest.spyOn(component, 'changeTeamFilterParams');
@@ -182,7 +192,22 @@ describe('TeamFilterComponent', () => {
     fixture.detectChanges();
 
     expect(component.activeTeams.length).toBe(1);
-    expect(component.activeTeams[0]).toBe(1);
+    expect(component.activeTeams).toStrictEqual(extractTeamsFromUser(testUser).map((team) => team.id));
+    expect(component.changeTeamFilterParams).toBeCalledTimes(1);
+  });
+
+  it('should use teams of user if no teams are in url', async () => {
+    jest.spyOn(component.teams$, 'next');
+    jest.spyOn(component, 'changeTeamFilterParams');
+    const routerHarness = await RouterTestingHarness.create();
+
+    await routerHarness.navigateByUrl('');
+
+    component.ngOnInit();
+    fixture.detectChanges();
+
+    expect(component.activeTeams.length).toBe(1);
+    expect(component.activeTeams).toStrictEqual(extractTeamsFromUser(testUser).map((team) => team.id));
     expect(component.changeTeamFilterParams).toBeCalledTimes(1);
   });
 
diff --git a/frontend/src/app/components/team-filter/team-filter.component.ts b/frontend/src/app/components/team-filter/team-filter.component.ts
new file mode 100644
index 0000000000..5568cc9fff
--- /dev/null
+++ b/frontend/src/app/components/team-filter/team-filter.component.ts
@@ -0,0 +1,100 @@
+import { ChangeDetectionStrategy, Component, OnDestroy, OnInit } from '@angular/core';
+import { BehaviorSubject, filter, Subject, Subscription, takeUntil } from 'rxjs';
+import { Team } from '../../shared/types/model/Team';
+import { TeamService } from '../../services/team.service';
+import { ActivatedRoute, Router } from '@angular/router';
+import { areEqual, getValueFromQuery, optionalReplaceWithNulls, trackByFn } from '../../shared/common';
+import { RefreshDataService } from '../../services/refresh-data.service';
+import { UserService } from '../../services/user.service';
+import { extractTeamsFromUser } from '../../shared/types/model/User';
+
+@Component({
+  selector: 'app-team-filter',
+  templateUrl: './team-filter.component.html',
+  changeDetection: ChangeDetectionStrategy.OnPush,
+})
+export class TeamFilterComponent implements OnInit, OnDestroy {
+  teams$: BehaviorSubject<Team[]> = new BehaviorSubject<Team[]>([]);
+  activeTeams: number[] = [];
+  protected readonly trackByFn = trackByFn;
+  private unsubscribe$ = new Subject<void>();
+  private subscription?: Subscription;
+
+  constructor(
+    private teamService: TeamService,
+    private route: ActivatedRoute,
+    private router: Router,
+    private refreshDataService: RefreshDataService,
+    private userService: UserService,
+  ) {
+    this.refreshDataService.reloadOverviewSubject.pipe(takeUntil(this.unsubscribe$)).subscribe(() => {
+      this.refreshTeamData();
+    });
+  }
+
+  ngOnInit(): void {
+    this.refreshTeamData();
+  }
+
+  private refreshTeamData() {
+    if (this.subscription) {
+      this.subscription.unsubscribe();
+    }
+    this.subscription = this.teamService
+      .getAllTeams()
+      .pipe(
+        takeUntil(this.unsubscribe$),
+        filter((teams) => teams.length > 0),
+      )
+      .subscribe((teams: Team[]) => {
+        this.teams$.next(teams);
+        const teamQuery = this.route.snapshot.queryParams['teams'];
+        const teamIds = getValueFromQuery(teamQuery);
+        const knownTeams = this.getAllTeamIds().filter((teamId) => teamIds?.includes(teamId));
+        if (knownTeams.length == 0) {
+          this.activeTeams = extractTeamsFromUser(this.userService.getCurrentUser()).map((team) => team.id);
+        } else {
+          this.activeTeams = knownTeams;
+        }
+        this.changeTeamFilterParams();
+      });
+  }
+
+  ngOnDestroy() {
+    this.unsubscribe$.next();
+    this.unsubscribe$.complete();
+  }
+
+  changeTeamFilterParams() {
+    const params = { teams: this.activeTeams.join(',') };
+    const optionalParams = optionalReplaceWithNulls(params);
+    this.router
+      .navigate([], { queryParams: optionalParams })
+      .then(() => this.refreshDataService.teamFilterReady.next());
+  }
+
+  toggleSelection(id: number) {
+    if (this.areAllTeamsShown()) {
+      this.activeTeams = [id];
+    } else if (this.activeTeams.includes(id)) {
+      this.activeTeams = this.activeTeams.filter((teamId) => teamId !== id);
+    } else {
+      this.activeTeams.push(id);
+    }
+
+    this.changeTeamFilterParams();
+  }
+
+  areAllTeamsShown() {
+    return areEqual(this.activeTeams, this.getAllTeamIds());
+  }
+
+  toggleAll() {
+    this.activeTeams = this.areAllTeamsShown() ? [] : this.getAllTeamIds();
+    this.changeTeamFilterParams();
+  }
+
+  getAllTeamIds() {
+    return this.teams$.getValue().map((team) => team.id);
+  }
+}
diff --git a/frontend/src/app/team/team.component.html b/frontend/src/app/components/team/team.component.html
similarity index 53%
rename from frontend/src/app/team/team.component.html
rename to frontend/src/app/components/team/team.component.html
index 4048e1ad1c..601f32af68 100644
--- a/frontend/src/app/team/team.component.html
+++ b/frontend/src/app/components/team/team.component.html
@@ -1,39 +1,20 @@
-<div *ngIf="overviewEntity | async as OVEntity" class="bg-grey justify-content-between pt-3">
+<div *ngIf="overviewEntity as OVEntity" class="bg-grey justify-content-between pt-3">
   <section class="team-header">
     <span class="d-flex align-items-center gap-2">
       <div class="d-flex align-items-center flex-row">
         <h1 class="team-title">{{ OVEntity.team.name }}</h1>
-        <img
-          (click)="openEditTeamDialog(OVEntity.team)"
-          (keydown.enter)="openEditTeamDialog(OVEntity.team)"
-          *ngIf="hasAdminAccess | async"
-          [attr.data-testId]="'edit-team-' + OVEntity.team.name"
-          alt="edit team"
-          class="team-icons team-actions cursor-pointer ms-2 mb-2 focus-outline"
-          src="assets/icons/edit.svg"
-          tabindex="0"
-        />
-        <div *ngIf="this.hasAdminAccess | async" class="d-flex flex-row align-items-center">
-          <mat-icon
-            id="organisation-warning"
-            *ngIf="OVEntity.team.hasInActiveOrganisations"
-            [matTooltip]="'This team has inactive organisations'"
-            class="team-actions cursor-pointer ms-2 text-danger mb-2"
-            >error_outline
-          </mat-icon>
-        </div>
       </div>
     </span>
     <button
       (click)="createObjective()"
-      *ngIf="OVEntity.team.writable"
+      *ngIf="OVEntity.writeable"
       [attr.data-testId]="'add-objective'"
       class="px-0 mt-1 mb-3 pe-2 h-50 align-new-icon"
       color="primary"
       mat-button
     >
       <span class="d-flex align-items-center fw-bold add-text">
-        <img alt="Add key-result button" class="add-cross-button" src="assets/icons/new-icon.svg" />
+        <img alt="Add key-result button" class="add-cross-button" src="../../../assets/icons/new-icon.svg" />
         Objective hinzufügen
       </span>
     </button>
@@ -46,7 +27,7 @@ <h1 class="team-title">{{ OVEntity.team.name }}</h1>
     <app-objective-column
       *ngFor="let objective of OVEntity.objectives; trackBy: trackByObjectiveId"
       [attr.data-testId]="'objective'"
-      [isWritable]="OVEntity.team.writable"
+      [isWritable]="OVEntity.writeable"
       [objective]="objective"
       class="col-xs-12 col-md-6 col-xl-4 pb-3 column-width"
       id="objective-column"
diff --git a/frontend/src/app/team/team.component.scss b/frontend/src/app/components/team/team.component.scss
similarity index 100%
rename from frontend/src/app/team/team.component.scss
rename to frontend/src/app/components/team/team.component.scss
diff --git a/frontend/src/app/team/team.component.spec.ts b/frontend/src/app/components/team/team.component.spec.ts
similarity index 67%
rename from frontend/src/app/team/team.component.spec.ts
rename to frontend/src/app/components/team/team.component.spec.ts
index 6c3149b6f6..bdb414aac6 100644
--- a/frontend/src/app/team/team.component.spec.ts
+++ b/frontend/src/app/components/team/team.component.spec.ts
@@ -1,7 +1,7 @@
 import { ComponentFixture, TestBed } from '@angular/core/testing';
 import { TeamComponent } from './team.component';
 import { MatIcon } from '@angular/material/icon';
-import { overViewEntity1, overViewEntity2, team1, teamMin1 } from '../shared/testData';
+import { overViewEntity1, overViewEntity2 } from '../../shared/testData';
 import { ObjectiveComponent } from '../objective/objective.component';
 import { RouterTestingModule } from '@angular/router/testing';
 import { MatMenuModule } from '@angular/material/menu';
@@ -9,15 +9,13 @@ import { KeyresultComponent } from '../keyresult/keyresult.component';
 import { MatDialog, MatDialogModule } from '@angular/material/dialog';
 import { HttpClientTestingModule } from '@angular/common/http/testing';
 import { By } from '@angular/platform-browser';
-import { OrganisationService } from '../shared/services/organisation.service';
-import { of, ReplaySubject } from 'rxjs';
-import { RefreshDataService } from '../shared/services/refresh-data.service';
+import { RefreshDataService } from '../../services/refresh-data.service';
 import { TranslateTestingModule } from 'ngx-translate-testing';
-import * as de from '../../assets/i18n/de.json';
-
-const organisationServiceMock = {
-  getOrganisationsByTeamId: jest.fn(),
-};
+import * as de from '../../../assets/i18n/de.json';
+import { MatTooltipModule } from '@angular/material/tooltip';
+import { ConfidenceComponent } from '../confidence/confidence.component';
+import { ScoringComponent } from '../../shared/custom/scoring/scoring.component';
+import { ChangeDetectionStrategy } from '@angular/core';
 
 const dialogMock = {
   open: jest.fn(),
@@ -38,17 +36,14 @@ describe('TeamComponent', () => {
         MatMenuModule,
         MatDialogModule,
         HttpClientTestingModule,
+        MatTooltipModule,
         TranslateTestingModule.withTranslations({
           de: de,
         }),
         MatIcon,
       ],
-      declarations: [TeamComponent, ObjectiveComponent, KeyresultComponent],
+      declarations: [TeamComponent, ObjectiveComponent, KeyresultComponent, ConfidenceComponent, ScoringComponent],
       providers: [
-        {
-          provide: OrganisationService,
-          useValue: organisationServiceMock,
-        },
         {
           provide: MatDialog,
           useValue: dialogMock,
@@ -58,12 +53,14 @@ describe('TeamComponent', () => {
           useValue: refreshDataServiceMock,
         },
       ],
-    }).compileComponents();
+    })
+      .overrideComponent(TeamComponent, {
+        set: { changeDetection: ChangeDetectionStrategy.Default },
+      })
+      .compileComponents();
 
     fixture = TestBed.createComponent(TeamComponent);
     component = fixture.componentInstance;
-    component.hasAdminAccess = new ReplaySubject<boolean>(1);
-    component.hasAdminAccess.next(true);
     component.overviewEntity = overViewEntity1;
     fixture.detectChanges();
   });
@@ -79,17 +76,11 @@ describe('TeamComponent', () => {
     expect(button).toBeTruthy();
   });
 
-  it('should not display add objective button if writeable is false', async () => {
-    component.overviewEntity = overViewEntity2;
+  it('should not display add objective button if writeable is false', () => {
+    component.overviewEntity = { ...overViewEntity2 };
+    component.overviewEntity.writeable = false;
     fixture.detectChanges();
     const button = fixture.debugElement.query(By.css('[data-testId="add-objective"]'));
     expect(button).toBeFalsy();
   });
-
-  it('should open Teamdialog and make call to dialog object', async () => {
-    jest.spyOn(dialogMock, 'open').mockReturnValue({ afterClosed: () => of(team1) });
-    component.openEditTeamDialog(teamMin1);
-    expect(dialogMock.open).toHaveBeenCalled();
-    expect(refreshDataServiceMock.markDataRefresh).toHaveBeenCalled();
-  });
 });
diff --git a/frontend/src/app/components/team/team.component.ts b/frontend/src/app/components/team/team.component.ts
new file mode 100644
index 0000000000..cb08e03ed7
--- /dev/null
+++ b/frontend/src/app/components/team/team.component.ts
@@ -0,0 +1,94 @@
+import { ChangeDetectionStrategy, Component, Input, OnInit, TrackByFunction } from '@angular/core';
+import { OverviewEntity } from '../../shared/types/model/OverviewEntity';
+import { MatDialog } from '@angular/material/dialog';
+import { ObjectiveFormComponent } from '../../shared/dialog/objective-dialog/objective-form.component';
+import { RefreshDataService } from '../../services/refresh-data.service';
+import { Objective } from '../../shared/types/model/Objective';
+import { isMobileDevice } from '../../shared/common';
+import { KeyresultDialogComponent } from '../keyresult-dialog/keyresult-dialog.component';
+import { ObjectiveMin } from '../../shared/types/model/ObjectiveMin';
+
+@Component({
+  selector: 'app-team',
+  templateUrl: './team.component.html',
+  styleUrls: ['./team.component.scss'],
+  changeDetection: ChangeDetectionStrategy.OnPush,
+})
+export class TeamComponent implements OnInit {
+  @Input({ required: true })
+  public overviewEntity!: OverviewEntity;
+
+  constructor(
+    private dialog: MatDialog,
+    private refreshDataService: RefreshDataService,
+  ) {}
+
+  trackByObjectiveId: TrackByFunction<ObjectiveMin> = (index, objective) => objective.id;
+
+  ngOnInit(): void {}
+
+  createObjective() {
+    const dialogConfig = isMobileDevice()
+      ? {
+          maxWidth: '100vw',
+          maxHeight: '100vh',
+          height: '100vh',
+          width: '100vw',
+        }
+      : {
+          width: '45em',
+          height: 'auto',
+        };
+
+    const matDialogRef = this.dialog.open(ObjectiveFormComponent, {
+      data: {
+        objective: {
+          teamId: this.overviewEntity.team.id,
+        },
+      },
+      height: dialogConfig.height,
+      width: dialogConfig.width,
+      maxHeight: dialogConfig.maxHeight,
+      maxWidth: dialogConfig.maxWidth,
+    });
+    matDialogRef.afterClosed().subscribe((result) => {
+      if (result?.addKeyResult) {
+        this.openAddKeyResultDialog(result.objective);
+      }
+      this.refreshDataService.markDataRefresh();
+    });
+  }
+
+  openAddKeyResultDialog(objective: Objective) {
+    const dialogConfig = isMobileDevice()
+      ? {
+          maxWidth: '100vw',
+          maxHeight: '100vh',
+          height: '100vh',
+          width: '100vw',
+        }
+      : {
+          width: '45em',
+          height: 'auto',
+        };
+
+    this.dialog
+      .open(KeyresultDialogComponent, {
+        height: dialogConfig.height,
+        width: dialogConfig.width,
+        maxHeight: dialogConfig.maxHeight,
+        maxWidth: dialogConfig.maxWidth,
+        data: {
+          objective: objective,
+          keyResult: null,
+        },
+      })
+      .afterClosed()
+      .subscribe((result) => {
+        if (result?.openNew) {
+          this.openAddKeyResultDialog(objective);
+        }
+        this.refreshDataService.markDataRefresh();
+      });
+  }
+}
diff --git a/frontend/src/app/guards/auth.guard.spec.ts b/frontend/src/app/guards/auth.guard.spec.ts
new file mode 100644
index 0000000000..ff06d7b5d1
--- /dev/null
+++ b/frontend/src/app/guards/auth.guard.spec.ts
@@ -0,0 +1,88 @@
+import { TestBed } from '@angular/core/testing';
+import { CanActivateFn, Router } from '@angular/router';
+
+import { authGuard } from './auth.guard';
+import { OAuthService } from 'angular-oauth2-oidc';
+import { of } from 'rxjs';
+
+const oAuthMock = {
+  initCodeFlow: jest.fn(),
+  loadDiscoveryDocumentAndTryLogin: jest.fn(),
+  hasValidIdToken: jest.fn(),
+  setupAutomaticSilentRefresh: jest.fn(),
+};
+
+const routerMock = {
+  navigateByUrl: jest.fn(),
+};
+
+const route = { queryParamMap: new Map() };
+
+describe('authGuard', () => {
+  const executeGuard: CanActivateFn = (...guardParameters) =>
+    TestBed.runInInjectionContext(() => authGuard(...guardParameters));
+
+  beforeEach(() => {
+    TestBed.configureTestingModule({
+      providers: [
+        {
+          provide: OAuthService,
+          useValue: oAuthMock,
+        },
+        {
+          provide: Router,
+          useValue: routerMock,
+        },
+      ],
+    });
+    jest.spyOn(oAuthMock, 'initCodeFlow').mockReturnValue(true);
+    jest.spyOn(oAuthMock, 'loadDiscoveryDocumentAndTryLogin').mockReturnValue(Promise.resolve(true));
+    jest.spyOn(oAuthMock, 'setupAutomaticSilentRefresh').mockReturnValue(true);
+    jest.spyOn(routerMock, 'navigateByUrl').mockReturnValue(of().toPromise());
+    oAuthMock.initCodeFlow.mockReset();
+    oAuthMock.setupAutomaticSilentRefresh.mockReset();
+    routerMock.navigateByUrl.mockReset();
+  });
+
+  it('should be created', () => {
+    expect(executeGuard).toBeTruthy();
+  });
+
+  it('should not call initCodeFlow if token is valid and call router if state param exist', async () => {
+    jest.spyOn(oAuthMock, 'hasValidIdToken').mockReturnValue(true);
+    route.queryParamMap.set('state', 1234);
+
+    const result = await runAuthGuardWithContext(authGuard);
+
+    expect(result).toBe(false);
+    expect(oAuthMock.loadDiscoveryDocumentAndTryLogin).toHaveBeenCalled();
+    expect(oAuthMock.initCodeFlow).not.toHaveBeenCalled();
+    expect(oAuthMock.setupAutomaticSilentRefresh).toHaveBeenCalled();
+
+    expect(routerMock.navigateByUrl).toHaveBeenCalled();
+  });
+
+  it('should not call router if state param does not exist', async () => {
+    jest.spyOn(oAuthMock, 'hasValidIdToken').mockReturnValue(true);
+    route.queryParamMap.set('state', null);
+
+    const result = await runAuthGuardWithContext(authGuard);
+
+    expect(result).toBeTruthy();
+    expect(routerMock.navigateByUrl).not.toHaveBeenCalled();
+  });
+
+  it('should call initCodeFlow if token is invalid', async () => {
+    jest.spyOn(oAuthMock, 'hasValidIdToken').mockReturnValue(false);
+    const result = await runAuthGuardWithContext(authGuard);
+
+    expect(result).toBe(false);
+    expect(oAuthMock.loadDiscoveryDocumentAndTryLogin).toHaveBeenCalled();
+    expect(oAuthMock.initCodeFlow).toHaveBeenCalled();
+    expect(oAuthMock.setupAutomaticSilentRefresh).not.toHaveBeenCalled();
+  });
+
+  async function runAuthGuardWithContext(authGuard: any): Promise<boolean> {
+    return await TestBed.runInInjectionContext(() => authGuard(route, null));
+  }
+});
diff --git a/frontend/src/app/guards/auth.guard.ts b/frontend/src/app/guards/auth.guard.ts
new file mode 100644
index 0000000000..21a018e322
--- /dev/null
+++ b/frontend/src/app/guards/auth.guard.ts
@@ -0,0 +1,23 @@
+import { CanActivateFn, Router } from '@angular/router';
+import { inject } from '@angular/core';
+import { OAuthService } from 'angular-oauth2-oidc';
+
+export const authGuard: CanActivateFn = (route, state) => {
+  const oauthService = inject(OAuthService);
+  const router = inject(Router);
+  return oauthService.loadDiscoveryDocumentAndTryLogin().then(async () => {
+    // if the login failed initialize code flow
+    let validToken = oauthService.hasValidIdToken();
+    if (!validToken) {
+      oauthService.initCodeFlow();
+      return false;
+    }
+    oauthService.setupAutomaticSilentRefresh();
+    // redirect route to remove state query param. do it only, if this param exist to avoid infinite loop
+    if (!!route.queryParamMap.get('state')) {
+      await router.navigateByUrl('');
+      return false;
+    }
+    return true;
+  });
+};
diff --git a/frontend/src/app/shared/interceptors/error-interceptor.service.ts b/frontend/src/app/interceptors/error-interceptor.service.ts
similarity index 95%
rename from frontend/src/app/shared/interceptors/error-interceptor.service.ts
rename to frontend/src/app/interceptors/error-interceptor.service.ts
index 39e16a9303..c5841d0990 100644
--- a/frontend/src/app/shared/interceptors/error-interceptor.service.ts
+++ b/frontend/src/app/interceptors/error-interceptor.service.ts
@@ -8,11 +8,11 @@ import {
   GJ_REGEX_PATTERN,
   SUCCESS_MESSAGE_KEY_PREFIX,
   SUCCESS_MESSAGE_MAP,
-} from '../constantLibary';
+} from '../shared/constantLibary';
 import { ToasterService } from '../services/toaster.service';
 import { TranslateService } from '@ngx-translate/core';
-import { HttpType } from '../types/enums/HttpType';
-import { ToasterType } from '../types/enums/ToasterType';
+import { HttpType } from '../shared/types/enums/HttpType';
+import { ToasterType } from '../shared/types/enums/ToasterType';
 
 @Injectable()
 export class ErrorInterceptor implements HttpInterceptor {
diff --git a/frontend/src/app/shared/interceptors/error.interceptor.spec.ts b/frontend/src/app/interceptors/error.interceptor.spec.ts
similarity index 98%
rename from frontend/src/app/shared/interceptors/error.interceptor.spec.ts
rename to frontend/src/app/interceptors/error.interceptor.spec.ts
index abdc7ec278..14477ec29b 100644
--- a/frontend/src/app/shared/interceptors/error.interceptor.spec.ts
+++ b/frontend/src/app/interceptors/error.interceptor.spec.ts
@@ -4,9 +4,9 @@ import { ToasterService } from '../services/toaster.service';
 import { TranslateModule, TranslateService } from '@ngx-translate/core';
 import { Router } from '@angular/router';
 import { ToastrModule } from 'ngx-toastr';
-import './../../../global';
-import { HttpType } from '../types/enums/HttpType';
-import { ToasterType } from '../types/enums/ToasterType';
+import '../../global';
+import { HttpType } from '../shared/types/enums/HttpType';
+import { ToasterType } from '../shared/types/enums/ToasterType';
 
 describe('ErrorInterceptor', () => {
   let interceptor: ErrorInterceptor;
diff --git a/frontend/src/app/shared/interceptors/oauth.interceptor.spec.ts b/frontend/src/app/interceptors/oauth.interceptor.spec.ts
similarity index 59%
rename from frontend/src/app/shared/interceptors/oauth.interceptor.spec.ts
rename to frontend/src/app/interceptors/oauth.interceptor.spec.ts
index 1ee37d9d4d..8650d459c9 100644
--- a/frontend/src/app/shared/interceptors/oauth.interceptor.spec.ts
+++ b/frontend/src/app/interceptors/oauth.interceptor.spec.ts
@@ -2,23 +2,13 @@ import { TestBed } from '@angular/core/testing';
 
 import { OauthInterceptor } from './oauth.interceptor';
 import { HttpClientTestingModule } from '@angular/common/http/testing';
-import { OidcSecurityService, StsConfigLoader } from 'angular-auth-oidc-client';
-import { of } from 'rxjs';
+import { DateTimeProvider, OAuthLogger, OAuthModule, OAuthService, UrlHelperService } from 'angular-oauth2-oidc';
 
 describe('OauthInterceptor', () => {
   beforeEach(() =>
     TestBed.configureTestingModule({
       imports: [HttpClientTestingModule],
-      providers: [
-        OidcSecurityService,
-        {
-          provide: StsConfigLoader,
-          useValue: {
-            loadConfig: () => of({}),
-            loadConfigs: () => of([{}]),
-          },
-        },
-      ],
+      providers: [OAuthService, UrlHelperService, OAuthLogger, DateTimeProvider, OAuthService],
     }),
   );
 
diff --git a/frontend/src/app/shared/interceptors/oauth.interceptor.ts b/frontend/src/app/interceptors/oauth.interceptor.ts
similarity index 62%
rename from frontend/src/app/shared/interceptors/oauth.interceptor.ts
rename to frontend/src/app/interceptors/oauth.interceptor.ts
index a4ec56f49b..0b96fa28b6 100644
--- a/frontend/src/app/shared/interceptors/oauth.interceptor.ts
+++ b/frontend/src/app/interceptors/oauth.interceptor.ts
@@ -1,19 +1,26 @@
 import { Injectable } from '@angular/core';
 import { HttpEvent, HttpHandler, HttpInterceptor, HttpRequest } from '@angular/common/http';
 import { filter, map, merge, mergeMap, Observable, of, take, timeout } from 'rxjs';
-import { OidcSecurityService } from 'angular-auth-oidc-client';
+import { OAuthService } from 'angular-oauth2-oidc';
 
 @Injectable({
   providedIn: 'root',
 })
 export class OauthInterceptor implements HttpInterceptor {
-  constructor(private oauthService: OidcSecurityService) {}
+  constructor(private oauthService: OAuthService) {}
   intercept(req: HttpRequest<unknown>, next: HttpHandler): Observable<HttpEvent<unknown>> {
     if (!req.url.match(/^(\/)?api/)) {
       return next.handle(req);
     }
 
-    return this.oauthService.getAccessToken().pipe(
+    return merge(
+      of(this.oauthService.getAccessToken()).pipe(filter((token) => !!token)),
+      this.oauthService.events.pipe(
+        filter((e) => e.type === 'token_received'),
+        timeout(500),
+        map((_) => this.oauthService.getAccessToken()),
+      ),
+    ).pipe(
       take(1),
       mergeMap((token) => {
         if (token) {
@@ -23,6 +30,7 @@ export class OauthInterceptor implements HttpInterceptor {
         }
 
         return next.handle(req);
+        // .pipe(catchError((err) => this.errorHandler.handleError(err)));
       }),
     );
   }
diff --git a/frontend/src/app/shared/services/action.service.spec.ts b/frontend/src/app/services/action.service.spec.ts
similarity index 100%
rename from frontend/src/app/shared/services/action.service.spec.ts
rename to frontend/src/app/services/action.service.spec.ts
diff --git a/frontend/src/app/shared/services/action.service.ts b/frontend/src/app/services/action.service.ts
similarity index 90%
rename from frontend/src/app/shared/services/action.service.ts
rename to frontend/src/app/services/action.service.ts
index 4282fed0ff..9082b485ec 100644
--- a/frontend/src/app/shared/services/action.service.ts
+++ b/frontend/src/app/services/action.service.ts
@@ -1,7 +1,7 @@
 import { Injectable } from '@angular/core';
 import { HttpClient } from '@angular/common/http';
 import { Observable } from 'rxjs';
-import { Action } from '../types/model/Action';
+import { Action } from '../shared/types/model/Action';
 
 @Injectable({
   providedIn: 'root',
diff --git a/frontend/src/app/shared/services/check-in.service.spec.ts b/frontend/src/app/services/check-in.service.spec.ts
similarity index 97%
rename from frontend/src/app/shared/services/check-in.service.spec.ts
rename to frontend/src/app/services/check-in.service.spec.ts
index 5f1394d158..96ecaa3ba2 100644
--- a/frontend/src/app/shared/services/check-in.service.spec.ts
+++ b/frontend/src/app/services/check-in.service.spec.ts
@@ -2,7 +2,7 @@ import { TestBed } from '@angular/core/testing';
 
 import { CheckInService } from './check-in.service';
 import { HttpClientTestingModule } from '@angular/common/http/testing';
-import { firstCheckIn, keyResultMetricWithIdEight, secondCheckIn } from '../testData';
+import { firstCheckIn, keyResultMetricWithIdEight, secondCheckIn } from '../shared/testData';
 
 describe('CheckInService', () => {
   let service: CheckInService;
diff --git a/frontend/src/app/shared/services/check-in.service.ts b/frontend/src/app/services/check-in.service.ts
similarity index 84%
rename from frontend/src/app/shared/services/check-in.service.ts
rename to frontend/src/app/services/check-in.service.ts
index 4228939a22..a564dc6fc7 100644
--- a/frontend/src/app/shared/services/check-in.service.ts
+++ b/frontend/src/app/services/check-in.service.ts
@@ -1,8 +1,8 @@
 import { Injectable } from '@angular/core';
 import { HttpClient } from '@angular/common/http';
-import { CheckInMin } from '../types/model/CheckInMin';
+import { CheckInMin } from '../shared/types/model/CheckInMin';
 import { Observable } from 'rxjs';
-import { CheckIn } from '../types/model/CheckIn';
+import { CheckIn } from '../shared/types/model/CheckIn';
 
 @Injectable({
   providedIn: 'root',
diff --git a/frontend/src/app/config.service.spec.ts b/frontend/src/app/services/config.service.spec.ts
similarity index 100%
rename from frontend/src/app/config.service.spec.ts
rename to frontend/src/app/services/config.service.spec.ts
diff --git a/frontend/src/app/config.service.ts b/frontend/src/app/services/config.service.ts
similarity index 85%
rename from frontend/src/app/config.service.ts
rename to frontend/src/app/services/config.service.ts
index 27faea76e1..45b4a03347 100644
--- a/frontend/src/app/config.service.ts
+++ b/frontend/src/app/services/config.service.ts
@@ -1,7 +1,7 @@
 import { Injectable } from '@angular/core';
 import { HttpClient } from '@angular/common/http';
 import { Observable, shareReplay } from 'rxjs';
-import { ClientConfig } from './shared/types/model/ClientConfig';
+import { ClientConfig } from '../shared/types/model/ClientConfig';
 
 @Injectable({
   providedIn: 'root',
diff --git a/frontend/src/app/shared/services/customization.service.spec.ts b/frontend/src/app/services/customization.service.spec.ts
similarity index 89%
rename from frontend/src/app/shared/services/customization.service.spec.ts
rename to frontend/src/app/services/customization.service.spec.ts
index 9419bb8de8..9dae942dfa 100644
--- a/frontend/src/app/shared/services/customization.service.spec.ts
+++ b/frontend/src/app/services/customization.service.spec.ts
@@ -1,7 +1,7 @@
 import { CustomizationService } from './customization.service';
-import { ConfigService } from '../../config.service';
 import { BehaviorSubject } from 'rxjs';
-import { ClientConfig } from '../types/model/ClientConfig';
+import { ClientConfig } from '../shared/types/model/ClientConfig';
+import { ConfigService } from './config.service';
 
 class CallRecorder {
   private calls: { [key: string]: any[] } = {};
@@ -34,6 +34,8 @@ describe('CustomizationService', () => {
     title: 'title',
     favicon: 'favicon',
     logo: 'logo',
+    triangles: 'triangles',
+    backgroundLogo: 'backgroundLogo',
     customStyles: { cssVar1: 'foo' },
   };
 
@@ -82,6 +84,8 @@ describe('CustomizationService', () => {
     expect(currentConfig?.title).toBe(body.title);
     expect(currentConfig?.logo).toBe(body.logo);
     expect(currentConfig?.favicon).toBe(body.favicon);
+    expect(currentConfig?.triangles).toBe(body.triangles);
+    expect(currentConfig?.backgroundLogo).toBe(body.backgroundLogo);
     expect(currentConfig?.customStyles['cssVar1']).toBe(body.customStyles['cssVar1']);
 
     expect(callRecorder.getCallCount('title.innerHTML')).toBe(1);
@@ -104,6 +108,8 @@ describe('CustomizationService', () => {
       title: 'title-second',
       favicon: 'favicon-second',
       logo: 'logo-second',
+      triangles: 'triangles-second',
+      backgroundLogo: 'backgroundLogo-second',
       customStyles: { cssVarNew: 'bar' },
     };
     configSubject.next(bodySecond);
@@ -112,6 +118,8 @@ describe('CustomizationService', () => {
     expect(currentConfig?.title).toBe(bodySecond.title);
     expect(currentConfig?.logo).toBe(bodySecond.logo);
     expect(currentConfig?.favicon).toBe(bodySecond.favicon);
+    expect(currentConfig?.triangles).toBe(bodySecond.triangles);
+    expect(currentConfig?.backgroundLogo).toBe(bodySecond.backgroundLogo);
     expect(currentConfig?.customStyles['cssVarNew']).toBe(bodySecond.customStyles['cssVarNew']);
     expect(currentConfig?.customStyles['cssVar1']).toBe(undefined);
 
diff --git a/frontend/src/app/shared/services/customization.service.ts b/frontend/src/app/services/customization.service.ts
similarity index 94%
rename from frontend/src/app/shared/services/customization.service.ts
rename to frontend/src/app/services/customization.service.ts
index e96215cc12..e4cbc50d29 100644
--- a/frontend/src/app/shared/services/customization.service.ts
+++ b/frontend/src/app/services/customization.service.ts
@@ -1,7 +1,7 @@
 import { Inject, Injectable } from '@angular/core';
-import { ConfigService } from '../../config.service';
-import { CustomizationConfig, CustomStyles } from '../types/model/ClientConfig';
 import { DOCUMENT } from '@angular/common';
+import { CustomizationConfig, CustomStyles } from '../shared/types/model/ClientConfig';
+import { ConfigService } from './config.service';
 
 @Injectable({
   providedIn: 'root',
diff --git a/frontend/src/app/shared/services/keyresult.service.spec.ts b/frontend/src/app/services/keyresult.service.spec.ts
similarity index 100%
rename from frontend/src/app/shared/services/keyresult.service.spec.ts
rename to frontend/src/app/services/keyresult.service.spec.ts
diff --git a/frontend/src/app/shared/services/keyresult.service.ts b/frontend/src/app/services/keyresult.service.ts
similarity index 88%
rename from frontend/src/app/shared/services/keyresult.service.ts
rename to frontend/src/app/services/keyresult.service.ts
index d5c3bb99c4..10d7ac3d6e 100644
--- a/frontend/src/app/shared/services/keyresult.service.ts
+++ b/frontend/src/app/services/keyresult.service.ts
@@ -1,8 +1,8 @@
 import { Injectable } from '@angular/core';
 import { HttpClient } from '@angular/common/http';
-import { KeyResult } from '../types/model/KeyResult';
+import { KeyResult } from '../shared/types/model/KeyResult';
 import { map, Observable } from 'rxjs';
-import { KeyResultDTO } from '../types/DTOs/KeyResultDTO';
+import { KeyResultDTO } from '../shared/types/DTOs/KeyResultDTO';
 
 @Injectable({
   providedIn: 'root',
diff --git a/frontend/src/app/shared/services/objective.service.spec.ts b/frontend/src/app/services/objective.service.spec.ts
similarity index 100%
rename from frontend/src/app/shared/services/objective.service.spec.ts
rename to frontend/src/app/services/objective.service.spec.ts
diff --git a/frontend/src/app/shared/services/objective.service.ts b/frontend/src/app/services/objective.service.ts
similarity index 91%
rename from frontend/src/app/shared/services/objective.service.ts
rename to frontend/src/app/services/objective.service.ts
index 04988bf6cd..e0d49f4460 100644
--- a/frontend/src/app/shared/services/objective.service.ts
+++ b/frontend/src/app/services/objective.service.ts
@@ -1,8 +1,8 @@
 import { Injectable } from '@angular/core';
 import { HttpClient } from '@angular/common/http';
-import { Objective } from '../types/model/Objective';
+import { Objective } from '../shared/types/model/Objective';
 import { Observable } from 'rxjs';
-import { Completed } from '../types/model/Completed';
+import { Completed } from '../shared/types/model/Completed';
 
 @Injectable({
   providedIn: 'root',
diff --git a/frontend/src/app/shared/services/overview.service.spec.ts b/frontend/src/app/services/overview.service.spec.ts
similarity index 86%
rename from frontend/src/app/shared/services/overview.service.spec.ts
rename to frontend/src/app/services/overview.service.spec.ts
index 3a8c83b35d..fcf7c55bf0 100644
--- a/frontend/src/app/shared/services/overview.service.spec.ts
+++ b/frontend/src/app/services/overview.service.spec.ts
@@ -4,7 +4,7 @@ import { OverviewService } from './overview.service';
 import { HttpClientTestingModule } from '@angular/common/http/testing';
 import { of } from 'rxjs';
 import { HttpClient } from '@angular/common/http';
-import { dashboard } from '../testData';
+import { overviews } from '../shared/testData';
 
 const httpClient = {
   get: jest.fn(),
@@ -26,9 +26,9 @@ describe('OverviewService', () => {
   });
 
   it('should set state of objectives correctly', (done) => {
-    jest.spyOn(httpClient, 'get').mockReturnValue(of(dashboard));
+    jest.spyOn(httpClient, 'get').mockReturnValue(of(overviews));
     service.getOverview().subscribe((dashboard) => {
-      dashboard.overviews.forEach((overview) =>
+      overviews.forEach((overview) =>
         overview.objectives.forEach((objective) => expect(typeof objective.state).toBe('string')),
       );
       done();
diff --git a/frontend/src/app/shared/services/overview.service.ts b/frontend/src/app/services/overview.service.ts
similarity index 64%
rename from frontend/src/app/shared/services/overview.service.ts
rename to frontend/src/app/services/overview.service.ts
index d46a4b31e9..e5840783f9 100644
--- a/frontend/src/app/shared/services/overview.service.ts
+++ b/frontend/src/app/services/overview.service.ts
@@ -1,9 +1,9 @@
 import { Injectable } from '@angular/core';
 import { HttpClient } from '@angular/common/http';
 import { map, Observable } from 'rxjs';
-import { optionalValue } from '../common';
-import { Dashboard } from '../types/model/Dashboard';
-import { State } from '../types/enums/State';
+import { optionalValue } from '../shared/common';
+import { State } from '../shared/types/enums/State';
+import { OverviewEntity } from '../shared/types/model/OverviewEntity';
 
 @Injectable({
   providedIn: 'root',
@@ -11,23 +11,21 @@ import { State } from '../types/enums/State';
 export class OverviewService {
   constructor(private http: HttpClient) {}
 
-  getOverview(quarterId?: number, teamIds?: number[], objectiveQuery?: string): Observable<Dashboard> {
+  getOverview(quarterId?: number, teamIds?: number[], objectiveQuery?: string): Observable<OverviewEntity[]> {
     const params = optionalValue({
       quarter: quarterId,
       team: teamIds,
       objectiveQuery: objectiveQuery,
     });
-    return this.http.get<Dashboard>('/api/v2/overview', { params: params }).pipe(
-      map((dashboard) => {
-        let overviews = dashboard.overviews;
+    return this.http.get<OverviewEntity[]>('/api/v2/overview', { params: params }).pipe(
+      map((overviews) => {
         overviews.forEach((overview) => {
           overview.objectives.forEach((objective) => {
             objective.state = State[objective.state as string as keyof typeof State];
             return objective;
           });
-          return dashboard;
         });
-        return dashboard;
+        return overviews;
       }),
     );
   }
diff --git a/frontend/src/app/shared/services/quarter.service.spec.ts b/frontend/src/app/services/quarter.service.spec.ts
similarity index 100%
rename from frontend/src/app/shared/services/quarter.service.spec.ts
rename to frontend/src/app/services/quarter.service.spec.ts
diff --git a/frontend/src/app/shared/services/quarter.service.ts b/frontend/src/app/services/quarter.service.ts
similarity index 86%
rename from frontend/src/app/shared/services/quarter.service.ts
rename to frontend/src/app/services/quarter.service.ts
index 181e0d19a2..3991320476 100644
--- a/frontend/src/app/shared/services/quarter.service.ts
+++ b/frontend/src/app/services/quarter.service.ts
@@ -1,6 +1,6 @@
 import { Injectable } from '@angular/core';
 import { HttpClient } from '@angular/common/http';
-import { Quarter } from '../types/model/Quarter';
+import { Quarter } from '../shared/types/model/Quarter';
 import { Observable } from 'rxjs';
 
 @Injectable({
diff --git a/frontend/src/app/shared/services/refresh-data.service.spec.ts b/frontend/src/app/services/refresh-data.service.spec.ts
similarity index 100%
rename from frontend/src/app/shared/services/refresh-data.service.spec.ts
rename to frontend/src/app/services/refresh-data.service.spec.ts
diff --git a/frontend/src/app/shared/services/refresh-data.service.ts b/frontend/src/app/services/refresh-data.service.ts
similarity index 88%
rename from frontend/src/app/shared/services/refresh-data.service.ts
rename to frontend/src/app/services/refresh-data.service.ts
index d9f994e4c9..fe5a7f5f7a 100644
--- a/frontend/src/app/shared/services/refresh-data.service.ts
+++ b/frontend/src/app/services/refresh-data.service.ts
@@ -1,6 +1,6 @@
 import { Injectable } from '@angular/core';
 import { BehaviorSubject, Subject } from 'rxjs';
-import { DEFAULT_HEADER_HEIGHT_PX } from '../constantLibary';
+import { DEFAULT_HEADER_HEIGHT_PX } from '../shared/constantLibary';
 
 @Injectable({
   providedIn: 'root',
diff --git a/frontend/src/app/shared/services/team.service.spec.ts b/frontend/src/app/services/team.service.spec.ts
similarity index 100%
rename from frontend/src/app/shared/services/team.service.spec.ts
rename to frontend/src/app/services/team.service.spec.ts
diff --git a/frontend/src/app/services/team.service.ts b/frontend/src/app/services/team.service.ts
new file mode 100644
index 0000000000..3b1b5986a7
--- /dev/null
+++ b/frontend/src/app/services/team.service.ts
@@ -0,0 +1,66 @@
+import { Injectable } from '@angular/core';
+import { HttpClient } from '@angular/common/http';
+import { Team } from '../shared/types/model/Team';
+import { BehaviorSubject, Observable, tap } from 'rxjs';
+import { User } from '../shared/types/model/User';
+import { UserTeam } from '../shared/types/model/UserTeam';
+
+@Injectable({
+  providedIn: 'root',
+})
+export class TeamService {
+  constructor(private http: HttpClient) {}
+
+  private teams: BehaviorSubject<Team[]> = new BehaviorSubject<Team[]>([]);
+  private teamsLoaded = false;
+  private readonly API_URL = '/api/v2/teams';
+
+  getAllTeams(): Observable<Team[]> {
+    if (!this.teamsLoaded) {
+      this.reloadTeams();
+      this.teamsLoaded = true;
+    }
+    return this.teams.asObservable();
+  }
+
+  reloadTeams(): void {
+    this.http.get<Team[]>(this.API_URL).subscribe((teams) => {
+      if (!this.teams) {
+        this.teams = new BehaviorSubject<Team[]>(teams);
+        return;
+      }
+      this.teams.next(teams);
+    });
+  }
+
+  createTeam(team: Team): Observable<Team> {
+    return this.http.post<Team>(this.API_URL, team).pipe(tap(() => this.reloadTeams()));
+  }
+
+  updateTeam(team: Team): Observable<Team> {
+    return this.http.put<Team>(`${this.API_URL}/${team.id}`, team).pipe(tap(() => this.reloadTeams()));
+  }
+
+  deleteTeam(id: number): Observable<void> {
+    return this.http.delete<void>(`${this.API_URL}/${id}`).pipe(tap(() => this.reloadTeams()));
+  }
+
+  addUsersToTeam(team: Team, selectedUsers: User[]): Observable<void> {
+    return this.http.put<void>(`${this.API_URL}/${team.id}/addusers`, selectedUsers);
+  }
+
+  removeUserFromTeam(userId: number, team: Team): Observable<void> {
+    return this.http
+      .put<void>(`${this.API_URL}/${team.id}/user/${userId}/removeuser`, null)
+      .pipe(tap(() => this.reloadTeams()));
+  }
+
+  updateOrAddTeamMembership(userId: number, userTeam: UserTeam): Observable<void> {
+    return this.http
+      .put<void>(
+        `${this.API_URL}/${userTeam.team.id}/user/${userId}/updateaddteammembership/${userTeam.isTeamAdmin}`,
+        {},
+      )
+      .pipe(tap(() => this.reloadTeams()));
+  }
+}
diff --git a/frontend/src/app/shared/services/toaster.service.spec.ts b/frontend/src/app/services/toaster.service.spec.ts
similarity index 96%
rename from frontend/src/app/shared/services/toaster.service.spec.ts
rename to frontend/src/app/services/toaster.service.spec.ts
index d09e672644..a879a1c33d 100644
--- a/frontend/src/app/shared/services/toaster.service.spec.ts
+++ b/frontend/src/app/services/toaster.service.spec.ts
@@ -2,7 +2,7 @@ import { TestBed } from '@angular/core/testing';
 
 import { ToasterService } from './toaster.service';
 import { ToastrModule, ToastrService } from 'ngx-toastr';
-import { ToasterType } from '../types/enums/ToasterType';
+import { ToasterType } from '../shared/types/enums/ToasterType';
 
 describe('ToasterService', () => {
   let service: ToasterService;
diff --git a/frontend/src/app/shared/services/toaster.service.ts b/frontend/src/app/services/toaster.service.ts
similarity index 92%
rename from frontend/src/app/shared/services/toaster.service.ts
rename to frontend/src/app/services/toaster.service.ts
index 3debb79cee..bcd1fdad32 100644
--- a/frontend/src/app/shared/services/toaster.service.ts
+++ b/frontend/src/app/services/toaster.service.ts
@@ -1,6 +1,6 @@
 import { Injectable } from '@angular/core';
 import { ToastrService } from 'ngx-toastr';
-import { ToasterType } from '../types/enums/ToasterType';
+import { ToasterType } from '../shared/types/enums/ToasterType';
 
 @Injectable({
   providedIn: 'root',
diff --git a/frontend/src/app/services/user.service.spec.ts b/frontend/src/app/services/user.service.spec.ts
new file mode 100644
index 0000000000..852129736f
--- /dev/null
+++ b/frontend/src/app/services/user.service.spec.ts
@@ -0,0 +1,78 @@
+import { fakeAsync, getTestBed, TestBed, tick } from '@angular/core/testing';
+import { HttpClientTestingModule, HttpTestingController } from '@angular/common/http/testing';
+import { UserService } from './user.service';
+import { testUser, users } from '../shared/testData';
+
+describe('UserService', () => {
+  let service: UserService;
+  let httpMock: HttpTestingController;
+  const URL = 'api/v1/users';
+
+  beforeEach(() => {
+    TestBed.configureTestingModule({
+      imports: [HttpClientTestingModule],
+    });
+    service = TestBed.inject(UserService);
+    const injector = getTestBed();
+    httpMock = injector.get(HttpTestingController);
+  });
+
+  afterEach(() => {
+    httpMock.verify();
+  });
+
+  it('should be created', () => {
+    expect(service).toBeTruthy();
+  });
+
+  it('getUsers should only reload users when they are not loaded yet', (done) => {
+    const spy = jest.spyOn(service, 'reloadUsers');
+    service.getUsers().subscribe(() => {
+      expect(spy).toBeCalledTimes(1);
+      httpMock.expectOne(URL);
+      service.getUsers().subscribe((users) => {
+        expect(spy).toBeCalledTimes(1);
+        expect(users).toStrictEqual([]);
+        done();
+      });
+    });
+  });
+
+  it('get current user should throw error, when not loaded', () => {
+    expect(() => service.getCurrentUser()).toThrowError('user should not be undefined here');
+  });
+
+  it('init current user should load user', (done) => {
+    expect(() => service.getCurrentUser()).toThrowError('user should not be undefined here');
+    service.getOrInitCurrentUser().subscribe(() => {
+      expect(service.getCurrentUser()).toBe(users[0]);
+      done();
+    });
+    const req = httpMock.expectOne('api/v1/users/current');
+    req.flush(users[0]);
+  });
+
+  it('setIsOkrChampion should call put operation, reloadUsers and reloadCurrentUser', fakeAsync(() => {
+    service.setIsOkrChampion(testUser, true).subscribe();
+    const req = httpMock.expectOne(`api/v1/users/${testUser.id}/isokrchampion/true`);
+    req.flush(users[0]);
+
+    tick();
+
+    const req2 = httpMock.expectOne(`api/v1/users`);
+    const req3 = httpMock.expectOne(`api/v1/users/current`);
+    req2.flush({});
+    req3.flush({});
+  }));
+
+  it('createUsers should call createAll and reloadUsers', fakeAsync(() => {
+    service.createUsers(users).subscribe();
+    const req = httpMock.expectOne(`api/v1/users/createall`);
+    req.flush(users);
+
+    tick();
+
+    const req2 = httpMock.expectOne(`api/v1/users`);
+    req2.flush({});
+  }));
+});
diff --git a/frontend/src/app/services/user.service.ts b/frontend/src/app/services/user.service.ts
new file mode 100644
index 0000000000..8900999470
--- /dev/null
+++ b/frontend/src/app/services/user.service.ts
@@ -0,0 +1,65 @@
+import { Injectable } from '@angular/core';
+import { BehaviorSubject, Observable, of, tap } from 'rxjs';
+import { HttpClient } from '@angular/common/http';
+import { User } from '../shared/types/model/User';
+import { NewUser } from '../shared/types/model/NewUser';
+
+@Injectable({
+  providedIn: 'root',
+})
+export class UserService {
+  private readonly API_URL = 'api/v1/users';
+
+  private _currentUser: User | undefined;
+  private users: BehaviorSubject<User[]> = new BehaviorSubject<User[]>([]);
+  private usersLoaded = false;
+
+  constructor(private httpClient: HttpClient) {}
+
+  public getOrInitCurrentUser(): Observable<User> {
+    if (this._currentUser) {
+      return of(this._currentUser);
+    }
+    return this.reloadCurrentUser();
+  }
+
+  public reloadCurrentUser(): Observable<User> {
+    return this.httpClient.get<User>(this.API_URL + '/current').pipe(tap((u) => (this._currentUser = u)));
+  }
+
+  public getCurrentUser(): User {
+    if (!this._currentUser) {
+      throw new Error('user should not be undefined here');
+    }
+    return this._currentUser;
+  }
+
+  public getUsers(): Observable<User[]> {
+    if (!this.usersLoaded) {
+      this.usersLoaded = true;
+      this.reloadUsers();
+    }
+    return this.users.asObservable();
+  }
+
+  public reloadUsers(): void {
+    this.httpClient.get<User[]>(this.API_URL).subscribe((users) => this.users.next(users));
+  }
+
+  getUserById(id: number): Observable<User> {
+    return this.httpClient.get<User>(this.API_URL + '/' + id);
+  }
+
+  setIsOkrChampion(user: User, isOkrChampion: boolean) {
+    return this.httpClient.put(`${this.API_URL}/${user.id}/isokrchampion/${isOkrChampion}`, {}).pipe(
+      tap(() => {
+        this.reloadUsers();
+        this.reloadCurrentUser().subscribe();
+      }),
+    );
+  }
+
+  createUsers(userList: NewUser[]) {
+    return this.httpClient.post<User>(`${this.API_URL}/createall`, userList).pipe(tap(() => this.reloadUsers()));
+  }
+}
diff --git a/frontend/src/app/shared/constantLibary.ts b/frontend/src/app/shared/constantLibary.ts
index eb52e397f9..1e7e70c24b 100644
--- a/frontend/src/app/shared/constantLibary.ts
+++ b/frontend/src/app/shared/constantLibary.ts
@@ -1,6 +1,8 @@
 import { HttpType } from './types/enums/HttpType';
 import { ToasterType } from './types/enums/ToasterType';
 import { HttpStatusCode } from '@angular/common/http';
+import { MatDialogConfig } from '@angular/material/dialog';
+import { isMobileDevice } from './common';
 
 interface MessageKeyMap {
   [key: string]: {
@@ -71,4 +73,20 @@ export const SUCCESS_MESSAGE_MAP: MessageKeyMap = {
     KEY: 'CHECK_IN',
     methods: [{ method: HttpType.POST }, { method: HttpType.PUT }],
   },
+  user: {
+    KEY: 'USERS',
+    methods: [{ method: HttpType.PUT }, { method: HttpType.POST }, { method: HttpType.DELETE }],
+  },
 };
+
+export const OKR_DIALOG_CONFIG: MatDialogConfig = isMobileDevice()
+  ? {
+      maxWidth: '100vw',
+      maxHeight: '100vh',
+      height: '100vh',
+      width: '100vw',
+    }
+  : {
+      width: '45em',
+      height: 'auto',
+    };
diff --git a/frontend/src/app/shared/custom/okr-tangram/okr-tangram.component.html b/frontend/src/app/shared/custom/okr-tangram/okr-tangram.component.html
new file mode 100644
index 0000000000..043cd96ff0
--- /dev/null
+++ b/frontend/src/app/shared/custom/okr-tangram/okr-tangram.component.html
@@ -0,0 +1,3 @@
+<div [style.width]="getWidth()">
+  <img alt="okr-logo" src="{{ this.trianglesSrc$ | async }}" />
+</div>
diff --git a/frontend/src/app/shared/custom/okr-tangram/okr-tangram.component.scss b/frontend/src/app/shared/custom/okr-tangram/okr-tangram.component.scss
new file mode 100644
index 0000000000..4a53cd9648
--- /dev/null
+++ b/frontend/src/app/shared/custom/okr-tangram/okr-tangram.component.scss
@@ -0,0 +1,11 @@
+div {
+  display: block;
+  width: 100px;
+
+  @media (min-width: 576px) {
+    width: 180px;
+  }
+  @media (min-width: 992px) {
+    width: 274px;
+  }
+}
diff --git a/frontend/src/app/shared/custom/okr-tangram/okr-tangram.component.ts b/frontend/src/app/shared/custom/okr-tangram/okr-tangram.component.ts
new file mode 100644
index 0000000000..092e4ae4e3
--- /dev/null
+++ b/frontend/src/app/shared/custom/okr-tangram/okr-tangram.component.ts
@@ -0,0 +1,31 @@
+import { Component } from '@angular/core';
+import { isMobileDevice } from '../../common';
+import { ConfigService } from '../../../services/config.service';
+import { BehaviorSubject, Subscription } from 'rxjs';
+
+@Component({
+  selector: 'app-okr-tangram',
+  templateUrl: 'okr-tangram.component.html',
+  styleUrl: 'okr-tangram.component.scss',
+})
+export class OkrTangramComponent {
+  private readonly MOBILE_WIDTH = 100;
+  private readonly DESKTOP_WIDTH = 274;
+
+  getWidth() {
+    return isMobileDevice() ? this.MOBILE_WIDTH : this.DESKTOP_WIDTH;
+  }
+
+  private subscription?: Subscription;
+  trianglesSrc$ = new BehaviorSubject<String>('assets/images/empty.svg');
+
+  constructor(private configService: ConfigService) {}
+
+  ngOnInit(): void {
+    this.subscription = this.configService.config$.subscribe((config) => {
+      if (config.triangles) {
+        this.trianglesSrc$.next(config.triangles);
+      }
+    });
+  }
+}
diff --git a/frontend/src/app/shared/custom/puzzle-icon-button/puzzle-icon-button.component.html b/frontend/src/app/shared/custom/puzzle-icon-button/puzzle-icon-button.component.html
new file mode 100644
index 0000000000..9ddd9b6564
--- /dev/null
+++ b/frontend/src/app/shared/custom/puzzle-icon-button/puzzle-icon-button.component.html
@@ -0,0 +1,3 @@
+<button class="puzzle-icon-button" [ngStyle]="getStyle()" [style.border-radius]="size / 2" [style.padding]="padding">
+  <app-puzzle-icon [icon]="icon" [alt]="alt" [size]="imgSize"></app-puzzle-icon>
+</button>
diff --git a/frontend/src/app/shared/custom/puzzle-icon-button/puzzle-icon-button.component.scss b/frontend/src/app/shared/custom/puzzle-icon-button/puzzle-icon-button.component.scss
new file mode 100644
index 0000000000..c5ad6f6cf2
--- /dev/null
+++ b/frontend/src/app/shared/custom/puzzle-icon-button/puzzle-icon-button.component.scss
@@ -0,0 +1,14 @@
+:host {
+  display: flex;
+  justify-content: center;
+  align-items: center;
+
+  button.puzzle-icon-button {
+    border: none;
+    background: none;
+
+    &:hover {
+      background-color: #dbdee0;
+    }
+  }
+}
diff --git a/frontend/src/app/shared/custom/puzzle-icon-button/puzzle-icon-button.component.ts b/frontend/src/app/shared/custom/puzzle-icon-button/puzzle-icon-button.component.ts
new file mode 100644
index 0000000000..4371625113
--- /dev/null
+++ b/frontend/src/app/shared/custom/puzzle-icon-button/puzzle-icon-button.component.ts
@@ -0,0 +1,27 @@
+import { Component, Input } from '@angular/core';
+
+@Component({
+  selector: 'app-puzzle-icon-button',
+  templateUrl: './puzzle-icon-button.component.html',
+  styleUrl: './puzzle-icon-button.component.scss',
+})
+export class PuzzleIconButtonComponent {
+  @Input({ required: true })
+  icon!: string;
+
+  @Input({ required: true })
+  alt!: string;
+
+  @Input({ required: false })
+  size: number = 24;
+
+  readonly padding = 4;
+  imgSize = this.size - 2 * this.padding;
+
+  getStyle() {
+    return {
+      'border-radius': this.size / 2 + 'px',
+      padding: this.padding + 'px',
+    };
+  }
+}
diff --git a/frontend/src/app/shared/custom/puzzle-icon/puzzle-icon.component.html b/frontend/src/app/shared/custom/puzzle-icon/puzzle-icon.component.html
new file mode 100644
index 0000000000..7183c7a401
--- /dev/null
+++ b/frontend/src/app/shared/custom/puzzle-icon/puzzle-icon.component.html
@@ -0,0 +1,3 @@
+<div class="d-flex justify-content-center align-items-center">
+  <img [alt]="alt" [height]="size" [width]="size" [ngSrc]="'assets/icons/' + icon" />
+</div>
diff --git a/frontend/src/app/shared/custom/puzzle-icon/puzzle-icon.component.ts b/frontend/src/app/shared/custom/puzzle-icon/puzzle-icon.component.ts
new file mode 100644
index 0000000000..81f30e80c5
--- /dev/null
+++ b/frontend/src/app/shared/custom/puzzle-icon/puzzle-icon.component.ts
@@ -0,0 +1,16 @@
+import { Component, Input } from '@angular/core';
+
+@Component({
+  selector: 'app-puzzle-icon',
+  templateUrl: './puzzle-icon.component.html',
+})
+export class PuzzleIconComponent {
+  @Input({ required: true })
+  icon!: string;
+
+  @Input({ required: true })
+  alt!: string;
+
+  @Input({ required: false })
+  size: number = 16;
+}
diff --git a/frontend/src/app/shared/custom/spinner/spinner.component.html b/frontend/src/app/shared/custom/spinner/spinner.component.html
new file mode 100644
index 0000000000..ecbacb3cbd
--- /dev/null
+++ b/frontend/src/app/shared/custom/spinner/spinner.component.html
@@ -0,0 +1,4 @@
+<div class="spinner-container">
+  <p>{{ text }}</p>
+  <mat-progress-spinner [diameter]="40" color="primary" mode="indeterminate"> </mat-progress-spinner>
+</div>
diff --git a/frontend/src/app/shared/custom/spinner/spinner.component.scss b/frontend/src/app/shared/custom/spinner/spinner.component.scss
new file mode 100644
index 0000000000..c05af2d629
--- /dev/null
+++ b/frontend/src/app/shared/custom/spinner/spinner.component.scss
@@ -0,0 +1,6 @@
+.spinner-container {
+  width: 100%;
+  display: flex;
+  align-items: center;
+  flex-direction: column;
+}
diff --git a/frontend/src/app/shared/custom/spinner/spinner.component.ts b/frontend/src/app/shared/custom/spinner/spinner.component.ts
new file mode 100644
index 0000000000..e73b550c6c
--- /dev/null
+++ b/frontend/src/app/shared/custom/spinner/spinner.component.ts
@@ -0,0 +1,11 @@
+import { Component, Input } from '@angular/core';
+
+@Component({
+  selector: 'app-spinner',
+  templateUrl: './spinner.component.html',
+  styleUrl: './spinner.component.scss',
+})
+export class SpinnerComponent {
+  @Input({ required: false })
+  text: string | undefined;
+}
diff --git a/frontend/src/app/shared/dialog/cancel-dialog/cancel-dialog.component.html b/frontend/src/app/shared/dialog/cancel-dialog/cancel-dialog.component.html
new file mode 100644
index 0000000000..b3d5fd8848
--- /dev/null
+++ b/frontend/src/app/shared/dialog/cancel-dialog/cancel-dialog.component.html
@@ -0,0 +1,18 @@
+<section mat-dialog-title>
+  <app-dialog-header [dialogTitle]="this.data.dialogTitle"></app-dialog-header>
+</section>
+
+<mat-dialog-content>
+  @if (data.dialogText) {
+    <div class="mb-3">
+      <span class="dialog-text">{{ this.data.dialogText }}</span>
+    </div>
+  }
+</mat-dialog-content>
+
+<mat-dialog-actions class="m-0">
+  <button color="primary" [attr.data-testId]="'cancelDialog-confirm'" (click)="closeAndConfirm()" mat-flat-button>
+    Ja
+  </button>
+  <button mat-button mat-dialog-close [attr.data-testId]="'cancelDialog-cancel'">Abbrechen</button>
+</mat-dialog-actions>
diff --git a/frontend/src/app/shared/dialog/cancel-dialog/cancel-dialog.component.scss b/frontend/src/app/shared/dialog/cancel-dialog/cancel-dialog.component.scss
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/frontend/src/app/shared/dialog/cancel-dialog/cancel-dialog.component.ts b/frontend/src/app/shared/dialog/cancel-dialog/cancel-dialog.component.ts
new file mode 100644
index 0000000000..c2a33fc611
--- /dev/null
+++ b/frontend/src/app/shared/dialog/cancel-dialog/cancel-dialog.component.ts
@@ -0,0 +1,23 @@
+import { Component, Inject } from '@angular/core';
+import { MAT_DIALOG_DATA, MatDialogRef } from '@angular/material/dialog';
+
+export type CancelDialogData = {
+  dialogTitle: string;
+  dialogText?: string;
+};
+
+@Component({
+  selector: 'app-cancel-dialog',
+  templateUrl: './cancel-dialog.component.html',
+  styleUrl: './cancel-dialog.component.scss',
+})
+export class CancelDialogComponent {
+  constructor(
+    @Inject(MAT_DIALOG_DATA) public data: CancelDialogData,
+    private dialogRef: MatDialogRef<CancelDialogComponent>,
+  ) {}
+
+  closeAndConfirm() {
+    this.dialogRef.close(true);
+  }
+}
diff --git a/frontend/src/app/shared/dialog/complete-dialog/complete-dialog.component.spec.ts b/frontend/src/app/shared/dialog/complete-dialog/complete-dialog.component.spec.ts
index e6cda43dea..e949a38b9a 100644
--- a/frontend/src/app/shared/dialog/complete-dialog/complete-dialog.component.spec.ts
+++ b/frontend/src/app/shared/dialog/complete-dialog/complete-dialog.component.spec.ts
@@ -1,9 +1,11 @@
 import { ComponentFixture, TestBed } from '@angular/core/testing';
 
 import { CompleteDialogComponent } from './complete-dialog.component';
-import { MAT_DIALOG_DATA, MatDialogRef } from '@angular/material/dialog';
+import { MAT_DIALOG_DATA, MatDialogModule, MatDialogRef } from '@angular/material/dialog';
 import { DialogHeaderComponent } from '../../custom/dialog-header/dialog-header.component';
 import { TranslateService } from '@ngx-translate/core';
+import { FormsModule, ReactiveFormsModule } from '@angular/forms';
+import { MatIconModule } from '@angular/material/icon';
 
 const dialogMock = {
   close: jest.fn(),
@@ -22,6 +24,7 @@ describe('CompleteDialogComponent', () => {
 
   beforeEach(() => {
     TestBed.configureTestingModule({
+      imports: [FormsModule, ReactiveFormsModule, MatDialogModule, MatIconModule],
       declarations: [CompleteDialogComponent, DialogHeaderComponent],
       providers: [
         { provide: MatDialogRef, useValue: dialogMock },
diff --git a/frontend/src/app/shared/dialog/example-dialog/example-dialog.component.spec.ts b/frontend/src/app/shared/dialog/example-dialog/example-dialog.component.spec.ts
index f1d0b8daa2..c70ce01531 100644
--- a/frontend/src/app/shared/dialog/example-dialog/example-dialog.component.spec.ts
+++ b/frontend/src/app/shared/dialog/example-dialog/example-dialog.component.spec.ts
@@ -14,7 +14,7 @@ import { MatSelectHarness } from '@angular/material/select/testing';
 import { By } from '@angular/platform-browser';
 // @ts-ignore
 import * as errorData from '../../../../assets/errors/error-messages.json';
-import { ObjectiveComponent } from '../../../objective/objective.component';
+import { ObjectiveComponent } from '../../../components/objective/objective.component';
 import { MatOptionHarness } from '@angular/material/core/testing';
 
 describe('ExampleDialogComponent', () => {
diff --git a/frontend/src/app/shared/dialog/objective-dialog/objective-form.component.spec.ts b/frontend/src/app/shared/dialog/objective-dialog/objective-form.component.spec.ts
index bae1fc2c25..47ca3ba9ff 100644
--- a/frontend/src/app/shared/dialog/objective-dialog/objective-form.component.spec.ts
+++ b/frontend/src/app/shared/dialog/objective-dialog/objective-form.component.spec.ts
@@ -9,16 +9,16 @@ import { MatFormFieldModule } from '@angular/material/form-field';
 import { MatSelectModule } from '@angular/material/select';
 import { ReactiveFormsModule } from '@angular/forms';
 import { NoopAnimationsModule } from '@angular/platform-browser/animations';
-import { ObjectiveService } from '../../services/objective.service';
-import { objective, quarter, quarterList, teamMin1 } from '../../testData';
+import { ObjectiveService } from '../../../services/objective.service';
+import { marketingTeamWriteable, objective, quarter, quarterList } from '../../testData';
 import { Observable, of } from 'rxjs';
 import { TestbedHarnessEnvironment } from '@angular/cdk/testing/testbed';
 import { HarnessLoader } from '@angular/cdk/testing';
 import { MatCheckboxModule } from '@angular/material/checkbox';
 import { Quarter } from '../../types/model/Quarter';
-import { QuarterService } from '../../services/quarter.service';
+import { QuarterService } from '../../../services/quarter.service';
 import { Team } from '../../types/model/Team';
-import { TeamService } from '../../services/team.service';
+import { TeamService } from '../../../services/team.service';
 import { State } from '../../types/enums/State';
 import { By } from '@angular/platform-browser';
 import { MatCheckboxHarness } from '@angular/material/checkbox/testing';
@@ -40,7 +40,7 @@ const quarterService = {
     return of([
       { id: 1, startDate: quarter.startDate, endDate: quarter.endDate, label: quarter.label },
       { id: 2, startDate: quarter.startDate, endDate: quarter.endDate, label: quarter.label },
-      { id: 199, startDate: null, endDate: null, label: 'Backlog' },
+      { id: 999, startDate: null, endDate: null, label: 'Backlog' },
     ]);
   },
 };
@@ -48,8 +48,8 @@ const quarterService = {
 const teamService = {
   getAllTeams(): Observable<Team[]> {
     return of([
-      { id: 1, version: 2, name: teamMin1.name, writeable: true, organisations: [], filterIsActive: true },
-      { id: 4, version: 5, name: 'team2', writeable: true, organisations: [], filterIsActive: true },
+      { id: 1, version: 2, name: marketingTeamWriteable.name, writeable: true, organisations: [] },
+      { id: 4, version: 5, name: 'team2', writeable: true, organisations: [] },
     ]);
   },
 };
@@ -68,7 +68,7 @@ let matDataMock: { objective: { objectiveId: number | undefined; teamId: number
 const mockActivatedRoute = {
   snapshot: {
     queryParams: {
-      quarter: '199',
+      quarter: '999',
     },
   },
 };
@@ -293,8 +293,8 @@ describe('ObjectiveDialogComponent', () => {
 
     it('should return if option is allowed for quarter select', async () => {
       let quarter: Quarter = {
-        id: 199,
-        label: 'GJ 22/23-Q3',
+        id: 999,
+        label: 'Backlog',
         startDate: null,
         endDate: null,
       };
@@ -386,7 +386,7 @@ describe('ObjectiveDialogComponent', () => {
       isBacklogQuarterSpy.mockReturnValue(false);
 
       const routerHarness = await RouterTestingHarness.create();
-      await routerHarness.navigateByUrl('/?quarter=199');
+      await routerHarness.navigateByUrl('/?quarter=999');
       objectiveService.getFullObjective.mockReturnValue(of(objective));
       fixture.detectChanges();
       component.ngOnInit();
@@ -395,7 +395,7 @@ describe('ObjectiveDialogComponent', () => {
       expect(rawFormValue.title).toBe(objective.title);
       expect(rawFormValue.description).toBe(objective.description);
       expect(rawFormValue.team).toBe(objective.teamId);
-      expect(rawFormValue.quarter).not.toBe(199);
+      expect(rawFormValue.quarter).not.toBe(999);
       expect(rawFormValue.quarter).toBe(2);
     });
   });
diff --git a/frontend/src/app/shared/dialog/objective-dialog/objective-form.component.ts b/frontend/src/app/shared/dialog/objective-dialog/objective-form.component.ts
index 2b967cabd8..53825affcb 100644
--- a/frontend/src/app/shared/dialog/objective-dialog/objective-form.component.ts
+++ b/frontend/src/app/shared/dialog/objective-dialog/objective-form.component.ts
@@ -1,11 +1,11 @@
-import { ChangeDetectionStrategy, Component, Inject, OnInit } from '@angular/core';
+import { ChangeDetectionStrategy, Component, Inject, OnDestroy, OnInit } from '@angular/core';
 import { FormControl, FormGroup, Validators } from '@angular/forms';
 import { Quarter } from '../../types/model/Quarter';
-import { TeamService } from '../../services/team.service';
+import { TeamService } from '../../../services/team.service';
 import { Team } from '../../types/model/Team';
-import { QuarterService } from '../../services/quarter.service';
-import { forkJoin, Observable, of, Subject } from 'rxjs';
-import { ObjectiveService } from '../../services/objective.service';
+import { QuarterService } from '../../../services/quarter.service';
+import { forkJoin, Observable, of, Subject, takeUntil } from 'rxjs';
+import { ObjectiveService } from '../../../services/objective.service';
 import { MAT_DIALOG_DATA, MatDialog, MatDialogRef } from '@angular/material/dialog';
 import { State } from '../../types/enums/State';
 import { ObjectiveMin } from '../../types/model/ObjectiveMin';
@@ -22,7 +22,7 @@ import { TranslateService } from '@ngx-translate/core';
   styleUrls: ['./objective-form.component.scss'],
   changeDetection: ChangeDetectionStrategy.OnPush,
 })
-export class ObjectiveFormComponent implements OnInit {
+export class ObjectiveFormComponent implements OnInit, OnDestroy {
   objectiveForm = new FormGroup({
     title: new FormControl<string>('', [Validators.required, Validators.minLength(2), Validators.maxLength(250)]),
     description: new FormControl<string>('', [Validators.maxLength(4096)]),
@@ -39,6 +39,7 @@ export class ObjectiveFormComponent implements OnInit {
   version!: number;
   protected readonly formInputCheck = formInputCheck;
   protected readonly hasFormFieldErrors = hasFormFieldErrors;
+  private unsubscribe$ = new Subject<void>();
 
   constructor(
     private route: ActivatedRoute,
@@ -53,7 +54,6 @@ export class ObjectiveFormComponent implements OnInit {
       objective: {
         objectiveId?: number;
         teamId?: number;
-        teamVersion?: number;
       };
     },
     private translate: TranslateService,
@@ -80,7 +80,7 @@ export class ObjectiveFormComponent implements OnInit {
 
   ngOnInit(): void {
     const isCreating: boolean = !!this.data.objective.objectiveId;
-    this.teams$ = this.teamService.getAllTeams();
+    this.teams$ = this.teamService.getAllTeams().pipe(takeUntil(this.unsubscribe$));
     this.quarters$ = this.quarterService.getAllQuarters();
     const objective$ = isCreating
       ? this.objectiveService.getFullObjective(this.data.objective.objectiveId!)
@@ -111,6 +111,11 @@ export class ObjectiveFormComponent implements OnInit {
     });
   }
 
+  ngOnDestroy() {
+    this.unsubscribe$.next();
+    this.unsubscribe$.complete();
+  }
+
   getSubmitFunction(id: number, objectiveDTO: any): Observable<Objective> {
     if (this.data.action == 'duplicate') {
       objectiveDTO.id = null;
diff --git a/frontend/src/app/shared/dialog/team-management/team-management.component.html b/frontend/src/app/shared/dialog/team-management/team-management.component.html
deleted file mode 100644
index f7df1cd0ff..0000000000
--- a/frontend/src/app/shared/dialog/team-management/team-management.component.html
+++ /dev/null
@@ -1,79 +0,0 @@
-<section mat-dialog-title>
-  <app-dialog-header [dialogTitle]="data ? 'Team bearbeiten' : 'Team erfassen'"></app-dialog-header>
-</section>
-
-<mat-dialog-content>
-  <div class="dialog-content" tabindex="-1">
-    <div class="w-100 d-flex justify-content-between align-items-center">
-      <form [formGroup]="teamForm" class="d-flex flex-column flex-wrap container p-0">
-        <div class="input-style gap-2 col-12">
-          <label class="text-black" for="name">Teamname</label>
-          <textarea
-            [attr.data-testId]="'name'"
-            class="big-dialog-form-field"
-            [ngClass]="formInputCheck(teamForm, 'name')"
-            formControlName="name"
-            id="name"
-          ></textarea>
-          <mat-error *ngIf="hasFormFieldErrors(teamForm, 'name')">
-            <span>{{ getErrorMessage("SIZE_BETWEEN", "Teamname", 2, 250) }}</span>
-          </mat-error>
-        </div>
-        <div class="input-style gap-2 col-12">
-          <div class="d-flex flex-row">
-            <label class="text-black" for="organisations">Organisationen</label>
-            <mat-icon
-              class="ms-2 text-danger"
-              *ngIf="hasInActiveOrganisations"
-              [matTooltip]="'This team has inactive organisations'"
-              >error_outline
-            </mat-icon>
-          </div>
-          <mat-select
-            [attr.data-testId]="'organisation-select'"
-            [formControl]="teamForm.controls.organisations"
-            multiple
-            id="organisations"
-            class="d-flex flex-column input-fields select-style pt-2 pb-2 pe-2 focus-outline"
-            [ngClass]="formInputCheck(teamForm, 'organisations')"
-            [compareWith]="compareWithFunc"
-          >
-            <mat-option
-              (click)="checkIfInActiveAdded()"
-              *ngFor="let organisation of organisations$ | async"
-              [value]="organisation"
-              [ngStyle]="getMatOptionStyle(organisation)"
-            >
-              {{ organisation.orgName }}
-            </mat-option>
-          </mat-select>
-
-          <mat-error *ngIf="hasFormFieldErrors(teamForm, 'organisations')">
-            <span>{{ getErrorMessage("MUST_SELECT", "Organisation", null, null) }}</span>
-          </mat-error>
-        </div>
-      </form>
-    </div>
-  </div>
-</mat-dialog-content>
-
-<mat-dialog-actions>
-  <div class="d-flex justify-content-between p-0 mt-2" mat-dialog-actions>
-    <div class="d-flex p-0">
-      <button
-        [attr.data-testId]="'save'"
-        [disabled]="teamForm.invalid || this.hasInActiveOrganisations"
-        color="primary"
-        mat-flat-button
-        type="submit"
-        (click)="saveTeam()"
-      >
-        Speichern
-      </button>
-      <button color="primary" mat-button mat-dialog-close class="ms-2">Abbrechen</button>
-    </div>
-    <button [attr.data-testId]="'delete'" (click)="deleteTeam()" color="primary" *ngIf="data" type="button" mat-button>
-      Team löschen
-    </button>
-  </div>
-</mat-dialog-actions>
diff --git a/frontend/src/app/shared/dialog/team-management/team-management.component.spec.ts b/frontend/src/app/shared/dialog/team-management/team-management.component.spec.ts
deleted file mode 100644
index feadaf94cb..0000000000
--- a/frontend/src/app/shared/dialog/team-management/team-management.component.spec.ts
+++ /dev/null
@@ -1,178 +0,0 @@
-import { TeamManagementComponent } from './team-management.component';
-import { ComponentFixture, TestBed } from '@angular/core/testing';
-import { HarnessLoader } from '@angular/cdk/testing';
-import { HttpClientTestingModule } from '@angular/common/http/testing';
-import { MAT_DIALOG_DATA, MatDialog, MatDialogModule, MatDialogRef } from '@angular/material/dialog';
-import { MatIconModule } from '@angular/material/icon';
-import { MatFormFieldModule } from '@angular/material/form-field';
-import { MatSelectModule } from '@angular/material/select';
-import { ReactiveFormsModule } from '@angular/forms';
-import { MatInputModule } from '@angular/material/input';
-import { NoopAnimationsModule } from '@angular/platform-browser/animations';
-import { MatCheckboxModule } from '@angular/material/checkbox';
-import { RouterTestingModule } from '@angular/router/testing';
-import { DialogHeaderComponent } from '../../custom/dialog-header/dialog-header.component';
-import { TestbedHarnessEnvironment } from '@angular/cdk/testing/testbed';
-import { TeamService } from '../../services/team.service';
-import { of } from 'rxjs';
-import { organisationActive, organisationInActive, teamFormObject, teamMin1 } from '../../testData';
-import { Team } from '../../types/model/Team';
-import { OrganisationService } from '../../services/organisation.service';
-import { TranslateService } from '@ngx-translate/core';
-
-const dialogRefMock = {
-  close: jest.fn(),
-};
-
-const dialogMock = {
-  open: jest.fn(),
-};
-
-const teamServiceMock = {
-  createTeam: jest.fn(),
-  updateTeam: jest.fn(),
-  deleteTeam: jest.fn(),
-};
-
-const organisationServiceMock = {
-  getOrganisationsByTeamId: jest.fn(),
-  getOrganisations: jest.fn(),
-};
-
-describe('TeamManagementComponent', () => {
-  let component: TeamManagementComponent;
-  let fixture: ComponentFixture<TeamManagementComponent>;
-  let loader: HarnessLoader;
-
-  beforeEach(() => {
-    TestBed.configureTestingModule({
-      imports: [
-        HttpClientTestingModule,
-        MatDialogModule,
-        MatIconModule,
-        MatFormFieldModule,
-        MatSelectModule,
-        ReactiveFormsModule,
-        MatInputModule,
-        NoopAnimationsModule,
-        MatCheckboxModule,
-        RouterTestingModule,
-      ],
-      declarations: [TeamManagementComponent, DialogHeaderComponent],
-      providers: [
-        {
-          provide: MatDialog,
-          useValue: dialogMock,
-        },
-        {
-          provide: MatDialogRef,
-          useValue: dialogRefMock,
-        },
-        {
-          provide: TeamService,
-          useValue: teamServiceMock,
-        },
-        {
-          provide: OrganisationService,
-          useValue: organisationServiceMock,
-        },
-        {
-          provide: MAT_DIALOG_DATA,
-          useValue: null,
-        },
-        { provide: TranslateService, useValue: {} },
-      ],
-    });
-    fixture = TestBed.createComponent(TeamManagementComponent);
-    component = fixture.componentInstance;
-    fixture.detectChanges();
-    loader = TestbedHarnessEnvironment.loader(fixture);
-  });
-
-  it('should create', () => {
-    expect(component).toBeTruthy();
-  });
-
-  it('should style inactive teams with line through decoration', async () => {
-    expect(component.getMatOptionStyle(organisationInActive).toString()).toBe(
-      { 'text-decoration': 'line-through' }.toString(),
-    );
-  });
-
-  it('should style active teams with no text decoration', async () => {
-    expect(component.getMatOptionStyle(organisationActive).toString()).toBe({ 'text-decoration': 'none' }.toString());
-  });
-
-  it('should return true if team has inactive organisations', async () => {
-    component.teamForm.controls.organisations.setValue([organisationActive, organisationInActive]);
-    component.checkIfInActiveAdded();
-    expect(component.hasInActiveOrganisations).toBeTruthy();
-  });
-
-  it('should return false if team does not have inactive organisations', async () => {
-    component.teamForm.controls.organisations.setValue([organisationActive, organisationActive]);
-    component.checkIfInActiveAdded();
-    expect(component.hasInActiveOrganisations).toBeFalsy();
-  });
-
-  it('should return true if org-name is the same', async () => {
-    expect(component.compareWithFunc(organisationActive, organisationActive)).toBeTruthy();
-  });
-
-  it('should return false if org-name is not the same', async () => {
-    expect(component.compareWithFunc(organisationInActive, organisationActive)).toBeFalsy();
-  });
-
-  it('should call service method to save team', async () => {
-    component.teamForm.setValue(teamFormObject);
-    jest.spyOn(teamServiceMock, 'createTeam').mockReturnValue(of(teamFormObject));
-    fixture.detectChanges();
-    component.saveTeam();
-    expect(teamServiceMock.createTeam).toHaveBeenCalled();
-    expect(teamServiceMock.createTeam).toHaveBeenCalledWith(teamFormObject as Team);
-  });
-
-  it('should call service method to update team if data input is not null', async () => {
-    component.data = { team: teamMin1 };
-    component.teamForm.setValue(teamFormObject);
-    jest.spyOn(teamServiceMock, 'updateTeam').mockReturnValue(of(teamFormObject));
-    fixture.detectChanges();
-    component.saveTeam();
-    expect(teamServiceMock.updateTeam).toHaveBeenCalled();
-    expect(teamServiceMock.updateTeam).toHaveBeenCalledWith({
-      ...teamFormObject,
-      id: teamMin1.id,
-      version: teamMin1.version,
-    } as Team);
-  });
-
-  it('should call service method to delete team', async () => {
-    component.data = { team: teamMin1 };
-    jest.spyOn(dialogMock, 'open').mockReturnValue({ afterClosed: () => of(true) });
-    jest.spyOn(teamServiceMock, 'deleteTeam').mockReturnValue(null);
-    component.deleteTeam();
-    expect(teamServiceMock.deleteTeam).toHaveBeenCalledWith(teamMin1.id);
-  });
-
-  it('should set team values in from on init if data is not null', async () => {
-    jest
-      .spyOn(organisationServiceMock, 'getOrganisations')
-      .mockReturnValue(of([organisationActive, organisationInActive]));
-    jest.spyOn(organisationServiceMock, 'getOrganisationsByTeamId').mockReturnValue(of([organisationActive]));
-    component.data = { team: teamMin1 };
-    component.ngOnInit();
-    expect(component.teamForm.controls.name.value).toBe(teamMin1.name);
-    expect(component.teamForm.controls.organisations.value!.toString()).toBe([organisationActive].toString());
-    expect(component.hasInActiveOrganisations).toBeFalsy();
-  });
-
-  it('should merge Organisations together', (done) => {
-    let organisationsArray = [organisationActive, organisationInActive];
-    component.organisations$ = of([organisationActive]);
-    component.mergeOrganisations(organisationsArray);
-    component.organisations$.subscribe((result) => {
-      expect(result).toStrictEqual([organisationActive, organisationInActive]);
-      done();
-    });
-  }, 1500);
-});
diff --git a/frontend/src/app/shared/dialog/team-management/team-management.component.ts b/frontend/src/app/shared/dialog/team-management/team-management.component.ts
deleted file mode 100644
index f948456cf3..0000000000
--- a/frontend/src/app/shared/dialog/team-management/team-management.component.ts
+++ /dev/null
@@ -1,137 +0,0 @@
-import { Component, Inject, OnInit } from '@angular/core';
-import { MAT_DIALOG_DATA, MatDialog, MatDialogRef } from '@angular/material/dialog';
-import { formInputCheck, isMobileDevice, hasFormFieldErrors } from '../../common';
-import { FormControl, FormGroup, Validators } from '@angular/forms';
-import { Organisation } from '../../types/model/Organisation';
-import { OrganisationService } from '../../services/organisation.service';
-import { Observable, of } from 'rxjs';
-import { TeamService } from '../../services/team.service';
-import { Team } from '../../types/model/Team';
-import { TeamMin } from '../../types/model/TeamMin';
-import { ConfirmDialogComponent } from '../confirm-dialog/confirm-dialog.component';
-import { OrganisationState } from '../../types/enums/OrganisationState';
-import { CONFIRM_DIALOG_WIDTH } from '../../constantLibary';
-import { CloseState } from '../../types/enums/CloseState';
-import { TranslateService } from '@ngx-translate/core';
-
-@Component({
-  selector: 'app-team-management',
-  templateUrl: './team-management.component.html',
-  styleUrls: ['./team-management.component.scss'],
-})
-export class TeamManagementComponent implements OnInit {
-  teamForm = new FormGroup({
-    name: new FormControl<string>('', [Validators.required, Validators.minLength(2), Validators.maxLength(250)]),
-    organisations: new FormControl<Organisation[]>([], [Validators.required]),
-  });
-  organisations$: Observable<Organisation[]> = new Observable<Organisation[]>();
-  public hasInActiveOrganisations: boolean = false;
-  protected readonly formInputCheck = formInputCheck;
-  protected readonly hasFormFieldErrors = hasFormFieldErrors;
-
-  constructor(
-    public dialogRef: MatDialogRef<TeamManagementComponent>,
-    private dialog: MatDialog,
-    private organisationService: OrganisationService,
-    private teamService: TeamService,
-    @Inject(MAT_DIALOG_DATA)
-    public data: {
-      team: TeamMin;
-    },
-    private translate: TranslateService,
-  ) {}
-
-  ngOnInit(): void {
-    this.organisations$ = this.organisationService.getOrganisations();
-    if (this.data) {
-      this.organisationService
-        .getOrganisationsByTeamId(this.data.team.id)
-        .subscribe((organisationsOfTeam: Organisation[]) => {
-          this.mergeOrganisations(organisationsOfTeam);
-          this.teamForm.setValue({
-            name: this.data.team.name,
-            organisations: organisationsOfTeam,
-          });
-          this.hasInActiveOrganisations =
-            organisationsOfTeam.filter((organisation) => organisation.state != OrganisationState.ACTIVE).length > 0;
-        });
-    }
-  }
-
-  saveTeam() {
-    if (!this.data) {
-      let newTeam: Team = this.teamForm.value as Team;
-      this.teamService.createTeam(newTeam).subscribe((result) => {
-        this.dialogRef.close(result);
-      });
-    } else {
-      let updatedTeam: Team = {
-        ...this.teamForm.value,
-        id: this.data.team.id,
-        version: this.data.team.version,
-      } as Team;
-      this.teamService.updateTeam(updatedTeam).subscribe((result) => {
-        this.dialogRef.close(result);
-      });
-    }
-  }
-
-  mergeOrganisations(organisationsOfTeam: Organisation[]) {
-    this.organisations$.subscribe((activeOrganisations) => {
-      organisationsOfTeam
-        .filter((organisation) => organisation.state == OrganisationState.INACTIVE)
-        .forEach((organisation) => activeOrganisations.push(organisation));
-      this.organisations$ = of(activeOrganisations);
-    });
-  }
-
-  checkIfInActiveAdded() {
-    this.hasInActiveOrganisations =
-      this.teamForm.controls.organisations.value!.filter(
-        (organisation) => organisation.state != OrganisationState.ACTIVE,
-      ).length > 0;
-  }
-
-  deleteTeam() {
-    const dialogConfig = isMobileDevice()
-      ? {
-          maxWidth: '100vw',
-          maxHeight: '100vh',
-          height: '100vh',
-          width: '100vw',
-        }
-      : {
-          width: CONFIRM_DIALOG_WIDTH,
-          height: 'auto',
-        };
-    const dialog = this.dialog.open(ConfirmDialogComponent, {
-      data: {
-        title: 'Team',
-      },
-      width: dialogConfig.width,
-      height: dialogConfig.height,
-      maxHeight: dialogConfig.maxHeight,
-      maxWidth: dialogConfig.maxWidth,
-    });
-    dialog.afterClosed().subscribe((result) => {
-      if (result) {
-        this.teamService.deleteTeam(this.data.team.id).subscribe(() => {
-          this.dialogRef.close({ state: CloseState.DELETED, id: this.data.team.id });
-        });
-      }
-    });
-  }
-
-  getMatOptionStyle(organisation: Organisation) {
-    let isInActive = organisation.state == OrganisationState.INACTIVE;
-    return { 'text-decoration': isInActive ? 'line-through' : 'none' };
-  }
-
-  getErrorMessage(error: string, field: string, firstNumber: number | null, secondNumber: number | null): string {
-    return field + this.translate.instant('DIALOG_ERRORS.' + error).format(firstNumber, secondNumber);
-  }
-
-  compareWithFunc(a: Organisation, b: Organisation) {
-    return a.orgName === b.orgName;
-  }
-}
diff --git a/frontend/src/app/shared/guards/auth.guard.spec.ts b/frontend/src/app/shared/guards/auth.guard.spec.ts
deleted file mode 100644
index 318fae4558..0000000000
--- a/frontend/src/app/shared/guards/auth.guard.spec.ts
+++ /dev/null
@@ -1,56 +0,0 @@
-import { TestBed } from '@angular/core/testing';
-import { ActivatedRouteSnapshot, CanActivateFn, RouterStateSnapshot } from '@angular/router';
-
-import { authGuard } from './auth.guard';
-import { OidcSecurityService } from 'angular-auth-oidc-client';
-import { of } from 'rxjs';
-
-const oAuthMock = {
-  get isAuthenticated$() {
-    return of({});
-  },
-};
-
-describe('authGuard', () => {
-  const executeGuard: CanActivateFn = (...guardParameters) =>
-    TestBed.runInInjectionContext(() => authGuard(...guardParameters));
-  const route: ActivatedRouteSnapshot = {} as any;
-  const state: RouterStateSnapshot = {} as any;
-
-  beforeEach(() => {
-    TestBed.configureTestingModule({
-      providers: [
-        {
-          provide: OidcSecurityService,
-          useValue: oAuthMock,
-        },
-      ],
-    });
-  });
-
-  it('should be created', () => {
-    expect(executeGuard).toBeTruthy();
-  });
-
-  it('should return true if token valid ', async () => {
-    jest.spyOn(oAuthMock, 'isAuthenticated$', 'get').mockReturnValue(of({ isAuthenticated: true }));
-    const result$ = runAuthGuardWithContext(authGuard, route, state);
-
-    result$.then((result) => {
-      expect(result).toBe(true);
-    });
-  });
-
-  it('should return false if token invalid', async () => {
-    jest.spyOn(oAuthMock, 'isAuthenticated$', 'get').mockReturnValue(of({ isAuthenticated: false }));
-    const result$ = runAuthGuardWithContext(authGuard, route, state);
-
-    result$.then((result) => {
-      expect(result).toBe(false);
-    });
-  });
-
-  async function runAuthGuardWithContext(authGuard: any, route: any, state: any): Promise<boolean> {
-    return await TestBed.runInInjectionContext(() => authGuard(route, state));
-  }
-});
diff --git a/frontend/src/app/shared/guards/auth.guard.ts b/frontend/src/app/shared/guards/auth.guard.ts
deleted file mode 100644
index 6160c00ac4..0000000000
--- a/frontend/src/app/shared/guards/auth.guard.ts
+++ /dev/null
@@ -1,20 +0,0 @@
-import { CanActivateFn, Router } from '@angular/router';
-import { inject } from '@angular/core';
-import { OidcSecurityService } from 'angular-auth-oidc-client';
-import { map, take, tap } from 'rxjs';
-
-//Not used, can be deleted
-export const authGuard: CanActivateFn = (route, state) => {
-  const oidcSecurityService = inject(OidcSecurityService);
-  // console.log(oidcSecurityService.isAuthenticated$.subscribe(console.log));
-
-  return oidcSecurityService.isAuthenticated$.pipe(
-    take(1),
-    map(({ isAuthenticated }) => {
-      // allow navigation if authenticated
-      return isAuthenticated;
-
-      // redirect if not authenticated
-    }),
-  );
-};
diff --git a/frontend/src/app/shared/pipes/parse-unit-value/parse-unit-value.pipe.ts b/frontend/src/app/shared/pipes/parse-unit-value/parse-unit-value.pipe.ts
index 9e8705f9e0..a52bd56b08 100644
--- a/frontend/src/app/shared/pipes/parse-unit-value/parse-unit-value.pipe.ts
+++ b/frontend/src/app/shared/pipes/parse-unit-value/parse-unit-value.pipe.ts
@@ -1,9 +1,12 @@
-import { Pipe, PipeTransform } from '@angular/core';
+import { Injectable, Pipe, PipeTransform } from '@angular/core';
 import { CHAR_REGEX } from '../../regexLibrary';
 
 @Pipe({
   name: 'parseUnitValue',
 })
+@Injectable({
+  providedIn: 'root',
+})
 export class ParseUnitValuePipe implements PipeTransform {
   transform(param: string | null): number {
     const value: string = param || '0';
diff --git a/frontend/src/app/shared/routeUtils.spec.ts b/frontend/src/app/shared/routeUtils.spec.ts
new file mode 100644
index 0000000000..c6b49f0cbb
--- /dev/null
+++ b/frontend/src/app/shared/routeUtils.spec.ts
@@ -0,0 +1,27 @@
+import { getRouteToTeam, getRouteToUserDetails } from './routeUtils';
+
+describe('routeUtils', () => {
+  describe('getRouteToUserDetails', () => {
+    it('should not include team fragment when teamId is missing', () => {
+      expect(getRouteToUserDetails(1)).toBe(`/team-management/details/member/1`);
+    });
+
+    it('should include team fragment when teamId is missing', () => {
+      expect(getRouteToUserDetails(1, 11)).toBe(`/team-management/11/details/member/1`);
+    });
+
+    it('should work with id=0', () => {
+      expect(getRouteToUserDetails(0, 0)).toBe(`/team-management/0/details/member/0`);
+    });
+  });
+
+  describe('getRouteToTeam', () => {
+    it('should work with normal id', () => {
+      expect(getRouteToTeam(1)).toBe(`/team-management/1`);
+    });
+
+    it('should work with id=0', () => {
+      expect(getRouteToTeam(0)).toBe(`/team-management/0`);
+    });
+  });
+});
diff --git a/frontend/src/app/shared/routeUtils.ts b/frontend/src/app/shared/routeUtils.ts
new file mode 100644
index 0000000000..4265526e72
--- /dev/null
+++ b/frontend/src/app/shared/routeUtils.ts
@@ -0,0 +1,6 @@
+export const getRouteToUserDetails = (userId: number, teamId?: number) => {
+  const teamFragment = teamId !== undefined ? `/${teamId}` : '';
+  return `/team-management${teamFragment}/details/member/${userId}`;
+};
+export const getRouteToTeam = (teamId: number) => `${getRouteToAllTeams()}/${teamId}`;
+export const getRouteToAllTeams = () => `/team-management`;
diff --git a/frontend/src/app/shared/services/organisation.service.spec.ts b/frontend/src/app/shared/services/organisation.service.spec.ts
deleted file mode 100644
index ade83dc206..0000000000
--- a/frontend/src/app/shared/services/organisation.service.spec.ts
+++ /dev/null
@@ -1,19 +0,0 @@
-import { TestBed } from '@angular/core/testing';
-
-import { OrganisationService } from './organisation.service';
-import { HttpClientTestingModule } from '@angular/common/http/testing';
-
-describe('OrganisationService', () => {
-  let service: OrganisationService;
-
-  beforeEach(() => {
-    TestBed.configureTestingModule({
-      imports: [HttpClientTestingModule],
-    });
-    service = TestBed.inject(OrganisationService);
-  });
-
-  it('should be created', () => {
-    expect(service).toBeTruthy();
-  });
-});
diff --git a/frontend/src/app/shared/services/organisation.service.ts b/frontend/src/app/shared/services/organisation.service.ts
deleted file mode 100644
index e24093489d..0000000000
--- a/frontend/src/app/shared/services/organisation.service.ts
+++ /dev/null
@@ -1,19 +0,0 @@
-import { Injectable } from '@angular/core';
-import { HttpClient } from '@angular/common/http';
-import { Organisation } from '../types/model/Organisation';
-import { Observable } from 'rxjs';
-
-@Injectable({
-  providedIn: 'root',
-})
-export class OrganisationService {
-  constructor(private http: HttpClient) {}
-
-  getOrganisations(): Observable<Organisation[]> {
-    return this.http.get<Organisation[]>('/api/v1/organisations');
-  }
-
-  getOrganisationsByTeamId(teamId: number): Observable<Organisation[]> {
-    return this.http.get<Organisation[]>('/api/v1/organisations/' + teamId);
-  }
-}
diff --git a/frontend/src/app/shared/services/team.service.ts b/frontend/src/app/shared/services/team.service.ts
deleted file mode 100644
index da00f7815e..0000000000
--- a/frontend/src/app/shared/services/team.service.ts
+++ /dev/null
@@ -1,27 +0,0 @@
-import { Injectable } from '@angular/core';
-import { HttpClient } from '@angular/common/http';
-import { Team } from '../types/model/Team';
-import { Observable } from 'rxjs';
-
-@Injectable({
-  providedIn: 'root',
-})
-export class TeamService {
-  constructor(private http: HttpClient) {}
-
-  getAllTeams(): Observable<Team[]> {
-    return this.http.get<Team[]>('/api/v2/teams');
-  }
-
-  createTeam(team: Team): Observable<Team> {
-    return this.http.post<Team>('/api/v2/teams', team);
-  }
-
-  updateTeam(team: Team): Observable<Team> {
-    return this.http.put<Team>(`/api/v2/teams/${team.id}`, team);
-  }
-
-  deleteTeam(id: number): Observable<any> {
-    return this.http.delete(`/api/v2/teams/${id}`);
-  }
-}
diff --git a/frontend/src/app/shared/services/user.service.spec.ts b/frontend/src/app/shared/services/user.service.spec.ts
deleted file mode 100644
index 15fb276880..0000000000
--- a/frontend/src/app/shared/services/user.service.spec.ts
+++ /dev/null
@@ -1,40 +0,0 @@
-import { TestBed } from '@angular/core/testing';
-import { HttpClientTestingModule, HttpTestingController } from '@angular/common/http/testing';
-import { User, UserService } from './user.service';
-import { users } from '../testData';
-
-const response = users;
-describe('UserService', () => {
-  let service: UserService;
-  let httpTestingController: HttpTestingController;
-  const URL = 'api/v1/users';
-
-  beforeEach(() => {
-    TestBed.configureTestingModule({
-      imports: [HttpClientTestingModule],
-    });
-    service = TestBed.inject(UserService);
-    httpTestingController = TestBed.inject(HttpTestingController);
-  });
-
-  test('should be created', () => {
-    expect(service).toBeTruthy();
-  });
-
-  test('should get Users', (done) => {
-    service.getUsers().subscribe({
-      next(response: User[]) {
-        expect(response.length).toBe(3);
-        done();
-      },
-      error(error) {
-        done(error);
-      },
-    });
-
-    const req = httpTestingController.expectOne(`${URL}`);
-    expect(req.request.method).toEqual('GET');
-    req.flush(response);
-    httpTestingController.verify();
-  });
-});
diff --git a/frontend/src/app/shared/services/user.service.ts b/frontend/src/app/shared/services/user.service.ts
deleted file mode 100644
index 2c096aedfc..0000000000
--- a/frontend/src/app/shared/services/user.service.ts
+++ /dev/null
@@ -1,22 +0,0 @@
-import { Injectable } from '@angular/core';
-import { Observable } from 'rxjs';
-import { HttpClient } from '@angular/common/http';
-
-export interface User {
-  id: number;
-  username: string;
-  firstname: string;
-  lastname: string;
-  email: string;
-}
-
-@Injectable({
-  providedIn: 'root',
-})
-export class UserService {
-  constructor(private httpClient: HttpClient) {}
-
-  public getUsers(): Observable<User[]> {
-    return this.httpClient.get<User[]>('api/v1/users');
-  }
-}
diff --git a/frontend/src/app/shared/shared.module.ts b/frontend/src/app/shared/shared.module.ts
new file mode 100644
index 0000000000..44a1110da3
--- /dev/null
+++ b/frontend/src/app/shared/shared.module.ts
@@ -0,0 +1,81 @@
+import { NgModule } from '@angular/core';
+import { CommonModule, NgOptimizedImage } from '@angular/common';
+import { ExampleDialogComponent } from './dialog/example-dialog/example-dialog.component';
+import { ObjectiveFormComponent } from './dialog/objective-dialog/objective-form.component';
+import { UnitValueTransformationPipe } from './pipes/unit-value-transformation/unit-value-transformation.pipe';
+import { ConfirmDialogComponent } from './dialog/confirm-dialog/confirm-dialog.component';
+import { UnitLabelTransformationPipe } from './pipes/unit-label-transformation/unit-label-transformation.pipe';
+import { ParseUnitValuePipe } from './pipes/parse-unit-value/parse-unit-value.pipe';
+import { ScoringComponent } from './custom/scoring/scoring.component';
+import { CompleteDialogComponent } from './dialog/complete-dialog/complete-dialog.component';
+import { DialogHeaderComponent } from './custom/dialog-header/dialog-header.component';
+import { MatDialogModule } from '@angular/material/dialog';
+import { MatCheckboxModule } from '@angular/material/checkbox';
+import { MatFormFieldModule } from '@angular/material/form-field';
+import { FormsModule, ReactiveFormsModule } from '@angular/forms';
+import { MatSelectModule } from '@angular/material/select';
+import { MatRadioModule } from '@angular/material/radio';
+import { MatIconModule } from '@angular/material/icon';
+import { OkrTangramComponent } from './custom/okr-tangram/okr-tangram.component';
+import { MatButtonModule } from '@angular/material/button';
+import { SidepanelComponent } from './sidepanel/sidepanel.component';
+import { MatSidenavModule } from '@angular/material/sidenav';
+import { CdkConnectedOverlay, CdkOverlayOrigin } from '@angular/cdk/overlay';
+import { A11yModule } from '@angular/cdk/a11y';
+import { RouterOutlet } from '@angular/router';
+import { SpinnerComponent } from './custom/spinner/spinner.component';
+import { MatProgressSpinnerModule } from '@angular/material/progress-spinner';
+import { CancelDialogComponent } from './dialog/cancel-dialog/cancel-dialog.component';
+
+@NgModule({
+  declarations: [
+    ExampleDialogComponent,
+    ObjectiveFormComponent,
+    UnitValueTransformationPipe,
+    ConfirmDialogComponent,
+    UnitLabelTransformationPipe,
+    ParseUnitValuePipe,
+    ScoringComponent,
+    CompleteDialogComponent,
+    DialogHeaderComponent,
+    OkrTangramComponent,
+    SidepanelComponent,
+    SpinnerComponent,
+    CancelDialogComponent,
+  ],
+  imports: [
+    CommonModule,
+    MatDialogModule,
+    MatCheckboxModule,
+    MatFormFieldModule,
+    FormsModule,
+    ReactiveFormsModule,
+    MatSelectModule,
+    MatRadioModule,
+    MatIconModule,
+    NgOptimizedImage,
+    MatButtonModule,
+    MatSidenavModule,
+    CdkOverlayOrigin,
+    CdkConnectedOverlay,
+    CdkOverlayOrigin,
+    A11yModule,
+    RouterOutlet,
+    MatProgressSpinnerModule,
+  ],
+  exports: [
+    ExampleDialogComponent,
+    ObjectiveFormComponent,
+    UnitValueTransformationPipe,
+    ConfirmDialogComponent,
+    UnitLabelTransformationPipe,
+    ParseUnitValuePipe,
+    ScoringComponent,
+    CompleteDialogComponent,
+    DialogHeaderComponent,
+    OkrTangramComponent,
+    SidepanelComponent,
+    SpinnerComponent,
+  ],
+})
+export class SharedModule {}
diff --git a/frontend/src/app/shared/custom/sidepanel/sidepanel.component.html b/frontend/src/app/shared/sidepanel/sidepanel.component.html
similarity index 67%
rename from frontend/src/app/shared/custom/sidepanel/sidepanel.component.html
rename to frontend/src/app/shared/sidepanel/sidepanel.component.html
index 4875b47209..23827ade92 100644
--- a/frontend/src/app/shared/custom/sidepanel/sidepanel.component.html
+++ b/frontend/src/app/shared/sidepanel/sidepanel.component.html
@@ -17,13 +17,12 @@
       cdkScrollable="false"
       cdkTrapFocus
       class="bg-white w-100 sidepanel overflow-y-auto"
+      [ngClass]="{ right: loaded }"
       [style.right]="right"
     >
       <div class="sidebar__content d-flex">
-        <div [ngSwitch]="modelType" class="d-flex flex-row w-100">
-          <div *ngSwitchDefault>Es ist eine Fehler aufgetreten!</div>
-          <app-objective-detail *ngSwitchCase="'Objective'" [objectiveId]="id" class="w-100"></app-objective-detail>
-          <app-keyresult-detail *ngSwitchCase="'KeyResult'" [keyResultId]="id" class="w-100"></app-keyresult-detail>
+        <div class="d-flex flex-row w-100 router-outlet-wrapper">
+          <router-outlet></router-outlet>
         </div>
       </div>
     </div>
diff --git a/frontend/src/app/shared/custom/sidepanel/sidepanel.component.scss b/frontend/src/app/shared/sidepanel/sidepanel.component.scss
similarity index 73%
rename from frontend/src/app/shared/custom/sidepanel/sidepanel.component.scss
rename to frontend/src/app/shared/sidepanel/sidepanel.component.scss
index 49b4e2093d..e2ebee50f6 100644
--- a/frontend/src/app/shared/custom/sidepanel/sidepanel.component.scss
+++ b/frontend/src/app/shared/sidepanel/sidepanel.component.scss
@@ -1,4 +1,4 @@
-@import "variables";
+@import "../style/variables";
 .sidebar__content {
   padding: 18px;
 }
@@ -8,4 +8,5 @@
   position: relative;
   right: -100%;
   padding-bottom: $top-bar-height;
+  width: 100vw !important;
 }
diff --git a/frontend/src/app/shared/custom/sidepanel/sidepanel.component.ts b/frontend/src/app/shared/sidepanel/sidepanel.component.ts
similarity index 72%
rename from frontend/src/app/shared/custom/sidepanel/sidepanel.component.ts
rename to frontend/src/app/shared/sidepanel/sidepanel.component.ts
index ac5541272c..ead6f64f83 100644
--- a/frontend/src/app/shared/custom/sidepanel/sidepanel.component.ts
+++ b/frontend/src/app/shared/sidepanel/sidepanel.component.ts
@@ -1,6 +1,7 @@
 import {
-  AfterViewInit,
+  AfterContentInit,
   ChangeDetectionStrategy,
+  ChangeDetectorRef,
   Component,
   ElementRef,
   OnDestroy,
@@ -16,9 +17,10 @@ import { ConnectedPosition } from '@angular/cdk/overlay'; // ESM
   styleUrls: ['./sidepanel.component.scss'],
   changeDetection: ChangeDetectionStrategy.OnPush,
 })
-export class SidepanelComponent implements OnInit, AfterViewInit, OnDestroy {
+export class SidepanelComponent implements OnInit, AfterContentInit, OnDestroy {
   leaveKeys = ['Escape'];
   right = '-100%';
+  loaded = false;
   @ViewChild('sidebar')
   sidebar!: ElementRef<HTMLDivElement>;
   position: ConnectedPosition[] = [
@@ -29,24 +31,19 @@ export class SidepanelComponent implements OnInit, AfterViewInit, OnDestroy {
       overlayY: 'top',
     },
   ];
-  modelType = '';
-  id: number = 0;
 
   constructor(
-    private activatedRoute: ActivatedRoute,
     private router: Router,
+    private cd: ChangeDetectorRef,
+    private route: ActivatedRoute,
   ) {}
 
-  ngOnInit(): void {
-    this.activatedRoute.data.subscribe((data) => {
-      this.modelType = data['type'];
-      this.id = data['id'];
-    });
-  }
-
-  ngAfterViewInit(): void {
+  ngOnInit(): void {}
+  ngAfterContentInit(): void {
     document.body.classList.add('disable-scrolling');
     this.right = '0';
+    this.loaded = true;
+    this.cd.markForCheck();
   }
 
   ngOnDestroy() {
@@ -54,7 +51,7 @@ export class SidepanelComponent implements OnInit, AfterViewInit, OnDestroy {
   }
 
   close() {
-    this.router.navigate(['']);
+    this.router.navigate(['../'], { relativeTo: this.route });
   }
 
   closeOnKeydown($event: KeyboardEvent) {
diff --git a/frontend/src/app/shared/testData.ts b/frontend/src/app/shared/testData.ts
index 930e424e55..9a4a64044e 100644
--- a/frontend/src/app/shared/testData.ts
+++ b/frontend/src/app/shared/testData.ts
@@ -1,4 +1,3 @@
-import { TeamMin } from './types/model/TeamMin';
 import { State } from './types/enums/State';
 import { CheckInMin } from './types/model/CheckInMin';
 import { KeyResultMetricMin } from './types/model/KeyResultMetricMin';
@@ -16,63 +15,45 @@ import { KeyResultMetric } from './types/model/KeyResultMetric';
 import { Unit } from './types/enums/Unit';
 import { Team } from './types/model/Team';
 import { Action } from './types/model/Action';
-import { OrganisationState } from './types/enums/OrganisationState';
-import { Organisation } from './types/model/Organisation';
-import { Dashboard } from './types/model/Dashboard';
-
-export const organisationActive = {
-  id: 1,
-  version: 1,
-  orgName: 'org_bbt',
-  teams: [],
-  state: OrganisationState.ACTIVE,
-} as Organisation;
-
-export const organisationInActive = {
-  id: 1,
-  version: 1,
-  orgName: 'org_mobility',
-  teams: [],
-  state: OrganisationState.INACTIVE,
-} as Organisation;
 
 export const teamFormObject = {
   name: 'newTeamName',
-  organisations: [organisationActive],
 };
 
-export const teamMin1: TeamMin = {
+export const marketingTeamWriteable: Team = {
   id: 1,
   version: 2,
   name: 'Marketing Team',
-  writable: true,
-} as TeamMin;
+  writeable: true,
+};
 
-export const teamMin2: TeamMin = {
+export const marketingTeamNotWriteable: Team = {
   id: 1,
   version: 3,
   name: 'Marketing Team',
-  writable: false,
-} as TeamMin;
+  writeable: false,
+};
 
 export const team1: Team = {
   id: 1,
   version: 2,
-  name: 'Team2',
-  filterIsActive: true,
-} as Team;
+  name: 'Team1',
+  writeable: false,
+};
 
 export const team2: Team = {
   id: 2,
   version: 3,
   name: 'Team2',
-} as Team;
+  writeable: false,
+};
 
 export const team3: Team = {
   id: 3,
   version: 4,
   name: 'Team3',
-} as Team;
+  writeable: false,
+};
 
 export const teamList = [team1, team2, team3];
 
@@ -302,15 +283,15 @@ export const objectiveResponse4: any = {
 };
 
 export const overViewEntity1: OverviewEntity = {
-  team: teamMin1,
+  team: marketingTeamWriteable,
   objectives: [objectiveMin, objectiveMin, objectiveMin] as ObjectiveMin[],
-  writable: true,
+  writeable: true,
 };
 
 export const overViewEntity2: OverviewEntity = {
-  team: teamMin2,
+  team: marketingTeamNotWriteable,
   objectives: [objectiveMin, objectiveMin, objectiveMin] as ObjectiveMin[],
-  writable: true,
+  writeable: true,
 };
 
 export const overViewEntityResponse1: any = {
@@ -325,10 +306,7 @@ export const overViewEntityResponse2: any = {
   writable: false,
 };
 
-export const dashboard: Dashboard = {
-  overviews: [overViewEntityResponse1, overViewEntityResponse2],
-  adminAccess: true,
-};
+export const overviews: OverviewEntity[] = [overViewEntityResponse1, overViewEntityResponse2];
 
 export const quarter: Quarter = {
   id: 1,
@@ -404,22 +382,42 @@ export const testUser: User = {
   id: 1,
   firstname: 'Bob',
   lastname: 'Baumeister',
-  username: 'username',
+  isOkrChampion: false,
+  userTeamList: [
+    {
+      id: 1,
+      team: team1,
+      isTeamAdmin: false,
+    },
+  ],
+  email: 'bob.baumeister@puzzle.ch',
 };
 
 export const users: User[] = [
   testUser,
   {
     id: 2,
-    username: 'pacoegiman',
     firstname: 'Paco',
     lastname: 'Egiman',
+    isOkrChampion: true,
+    userTeamList: [],
+    email: 'peggimann@puzzle.ch',
   },
   {
     id: 3,
-    username: 'robinpapier',
     firstname: 'Robin',
     lastname: 'Papier',
+    isOkrChampion: false,
+    userTeamList: [],
+    email: 'robin.papier@puzzle.ch',
+  },
+  {
+    id: 4,
+    firstname: 'Key Result',
+    lastname: 'Owner',
+    isOkrChampion: false,
+    userTeamList: [],
+    email: 'keyresult.owner@puzzle.ch',
   },
 ];
 
@@ -431,7 +429,7 @@ export const keyResult: KeyResultOrdinal = {
   commitZone: 'Äpfel',
   targetZone: 'Äpfel und Birnen',
   stretchZone: 'Äpfel, Birnen, Bananen und Erdberen',
-  owner: { id: 1, firstname: 'firstname', lastname: 'lastname', username: 'username' },
+  owner: users[3],
   keyResultType: 'ordinal',
   objective: {
     id: 301,
@@ -470,7 +468,7 @@ export const keyResultOrdinal: KeyResultOrdinal = {
   commitZone: 'Grundriss steht',
   targetZone: 'Gebäude gebaut',
   stretchZone: 'Inneneinrichtung gestaltet',
-  owner: { id: 1, firstname: 'firstname', lastname: 'lastname', username: 'username' },
+  owner: users[3],
   keyResultType: 'ordinal',
   objective: {
     id: 301,
@@ -509,7 +507,7 @@ export const keyResultWriteableFalse: KeyResultOrdinal = {
   commitZone: 'Not writeable',
   targetZone: 'Not writeable',
   stretchZone: 'Not writeable',
-  owner: { id: 1, firstname: 'firstname', lastname: 'lastname', username: 'username' },
+  owner: users[3],
   keyResultType: 'ordinal',
   objective: {
     id: 301,
@@ -548,7 +546,7 @@ export const keyResultMetric: KeyResultMetric = {
   baseline: 30,
   stretchGoal: 100,
   unit: Unit.PERCENT,
-  owner: { id: 1, firstname: 'firstname', lastname: 'lastname', username: 'username' },
+  owner: users[3],
   keyResultType: 'metric',
   objective: {
     id: 302,
@@ -587,7 +585,7 @@ export const keyResultActions: KeyResultMetric = {
   baseline: 10,
   stretchGoal: 30,
   unit: Unit.PERCENT,
-  owner: { id: 1, firstname: 'firstname', lastname: 'lastname', username: 'username' },
+  owner: users[3],
   keyResultType: 'metric',
   objective: {
     id: 302,
diff --git a/frontend/src/app/shared/types/enums/OrganisationState.ts b/frontend/src/app/shared/types/enums/OrganisationState.ts
deleted file mode 100644
index 9c7daa18ee..0000000000
--- a/frontend/src/app/shared/types/enums/OrganisationState.ts
+++ /dev/null
@@ -1,4 +0,0 @@
-export enum OrganisationState {
-  ACTIVE = 'ACTIVE',
-  INACTIVE = 'INACTIVE',
-}
diff --git a/frontend/src/app/shared/types/enums/UserRole.ts b/frontend/src/app/shared/types/enums/UserRole.ts
new file mode 100644
index 0000000000..58eae00cca
--- /dev/null
+++ b/frontend/src/app/shared/types/enums/UserRole.ts
@@ -0,0 +1,5 @@
+export enum UserRole {
+  OKR_CHAMPION = 'OKR_CHAMPION',
+  TEAM_ADMIN = 'TEAM_ADMIN',
+  TEAM_MEMBER = 'TEAM_MEMBER',
+}
diff --git a/frontend/src/app/shared/types/model/ClientConfig.ts b/frontend/src/app/shared/types/model/ClientConfig.ts
index 031e4bb55a..6d0fb4d0e7 100644
--- a/frontend/src/app/shared/types/model/ClientConfig.ts
+++ b/frontend/src/app/shared/types/model/ClientConfig.ts
@@ -12,6 +12,8 @@ export interface CustomizationConfig {
   title: string;
   favicon: string;
   logo: string;
+  triangles: string;
+  backgroundLogo: string;
   customStyles: CustomStyles;
 }
 export interface ClientConfig extends AuthConfig, CustomizationConfig {}
diff --git a/frontend/src/app/shared/types/model/Dashboard.ts b/frontend/src/app/shared/types/model/Dashboard.ts
deleted file mode 100644
index 2260711272..0000000000
--- a/frontend/src/app/shared/types/model/Dashboard.ts
+++ /dev/null
@@ -1,6 +0,0 @@
-import { OverviewEntity } from './OverviewEntity';
-
-export interface Dashboard {
-  adminAccess: boolean;
-  overviews: OverviewEntity[];
-}
diff --git a/frontend/src/app/shared/types/model/NewUser.ts b/frontend/src/app/shared/types/model/NewUser.ts
new file mode 100644
index 0000000000..f793306897
--- /dev/null
+++ b/frontend/src/app/shared/types/model/NewUser.ts
@@ -0,0 +1,5 @@
+export interface NewUser {
+  firstname: string;
+  lastname: string;
+  email: string;
+}
diff --git a/frontend/src/app/shared/types/model/NewUserForm.ts b/frontend/src/app/shared/types/model/NewUserForm.ts
new file mode 100644
index 0000000000..800df9f04a
--- /dev/null
+++ b/frontend/src/app/shared/types/model/NewUserForm.ts
@@ -0,0 +1,5 @@
+export interface NewUserForm<T> {
+  firstname: T;
+  email: T;
+  lastname: T;
+}
diff --git a/frontend/src/app/shared/types/model/Organisation.ts b/frontend/src/app/shared/types/model/Organisation.ts
deleted file mode 100644
index 5e1e3a4737..0000000000
--- a/frontend/src/app/shared/types/model/Organisation.ts
+++ /dev/null
@@ -1,10 +0,0 @@
-import { Team } from './Team';
-import { OrganisationState } from '../enums/OrganisationState';
-
-export interface Organisation {
-  id: number;
-  version: number;
-  orgName: string;
-  teams: Team[];
-  state: OrganisationState;
-}
diff --git a/frontend/src/app/shared/types/model/OverviewEntity.ts b/frontend/src/app/shared/types/model/OverviewEntity.ts
index 88e1050e14..e679a6101f 100644
--- a/frontend/src/app/shared/types/model/OverviewEntity.ts
+++ b/frontend/src/app/shared/types/model/OverviewEntity.ts
@@ -1,8 +1,8 @@
-import { TeamMin } from './TeamMin';
 import { ObjectiveMin } from './ObjectiveMin';
+import { TeamMin } from './TeamMin';
 
 export interface OverviewEntity {
   team: TeamMin;
   objectives: ObjectiveMin[];
-  writable: boolean;
+  writeable: boolean;
 }
diff --git a/frontend/src/app/shared/types/model/Team.ts b/frontend/src/app/shared/types/model/Team.ts
index 4fc0716996..09655edffb 100644
--- a/frontend/src/app/shared/types/model/Team.ts
+++ b/frontend/src/app/shared/types/model/Team.ts
@@ -1,9 +1,6 @@
-import { Organisation } from './Organisation';
-
 export interface Team {
   id: number;
   version: number;
   name: string;
-  organisations: Organisation[];
-  filterIsActive: boolean;
+  writeable: boolean;
 }
diff --git a/frontend/src/app/shared/types/model/TeamMin.ts b/frontend/src/app/shared/types/model/TeamMin.ts
index 6743ff678e..fdbc59a5dd 100644
--- a/frontend/src/app/shared/types/model/TeamMin.ts
+++ b/frontend/src/app/shared/types/model/TeamMin.ts
@@ -1,7 +1,4 @@
 export interface TeamMin {
   id: number;
-  version: number;
   name: string;
-  writable: boolean;
-  hasInActiveOrganisations: boolean;
 }
diff --git a/frontend/src/app/shared/types/model/User.ts b/frontend/src/app/shared/types/model/User.ts
index a40afcadd4..736edc9bb9 100644
--- a/frontend/src/app/shared/types/model/User.ts
+++ b/frontend/src/app/shared/types/model/User.ts
@@ -1,6 +1,19 @@
+import { UserTeam } from './UserTeam';
+import { UserTableEntry } from './UserTableEntry';
+
 export interface User {
   id: number;
   firstname: string;
   lastname: string;
-  username: string;
+  email: string;
+  userTeamList: UserTeam[];
+  isOkrChampion: boolean;
 }
+
+export const extractTeamsFromUser = (user: User) => {
+  return user.userTeamList.map((u) => u.team);
+};
+
+export const getFullNameFromUser = (user: User | UserTableEntry) => {
+  return `${user.firstname} ${user.lastname}`;
+};
diff --git a/frontend/src/app/shared/types/model/UserTableEntry.ts b/frontend/src/app/shared/types/model/UserTableEntry.ts
new file mode 100644
index 0000000000..5c332b5bdf
--- /dev/null
+++ b/frontend/src/app/shared/types/model/UserTableEntry.ts
@@ -0,0 +1,56 @@
+import { User } from './User';
+import { UserRole } from '../enums/UserRole';
+import { UserTeam } from './UserTeam';
+
+export interface UserTableEntry {
+  id: number;
+  firstname: string;
+  lastname: string;
+  email: string;
+  teams: string[];
+  roles: string[];
+  isOkrChampion: boolean;
+  userTeamList: UserTeam[];
+}
+
+export const convertFromUsers = (users: User[], teamId: number | null): UserTableEntry[] => {
+  // make a deep copy to not modify original value
+  const usersCopy = JSON.parse(JSON.stringify(users)) as User[];
+  let userTableEntries;
+  if (!teamId) {
+    userTableEntries = usersCopy.map((u) => convertFromUser(u));
+  } else {
+    userTableEntries = usersCopy
+      // first we filter user teams based on selected team id
+      .map((u) => {
+        u.userTeamList = u.userTeamList.filter((ut) => ut.team.id === teamId);
+        return u;
+      })
+      // we remove users without membership in selected team id
+      .filter((u) => u.userTeamList.length)
+      .map((u) => convertFromUser(u));
+  }
+  return userTableEntries.sort((a, b) => a.firstname.localeCompare(b.firstname));
+};
+
+export const convertFromUser = (user: User): UserTableEntry => {
+  const teams = user.userTeamList.map((ut) => ut.team.name);
+  const roles = [];
+  if (user.userTeamList.filter((ut) => ut.isTeamAdmin).length > 0) {
+    roles.push(UserRole.TEAM_ADMIN);
+  }
+  if (user.userTeamList.filter((ut) => !ut.isTeamAdmin).length > 0) {
+    roles.push(UserRole.TEAM_MEMBER);
+  }
+
+  return {
+    id: user.id,
+    firstname: user.firstname,
+    lastname: user.lastname,
+    email: user.email,
+    teams,
+    roles,
+    isOkrChampion: user.isOkrChampion,
+    userTeamList: user.userTeamList,
+  };
+};
diff --git a/frontend/src/app/shared/types/model/UserTeam.ts b/frontend/src/app/shared/types/model/UserTeam.ts
new file mode 100644
index 0000000000..aaca2eeaaf
--- /dev/null
+++ b/frontend/src/app/shared/types/model/UserTeam.ts
@@ -0,0 +1,7 @@
+import { Team } from './Team';
+
+export interface UserTeam {
+  id?: number;
+  team: Team;
+  isTeamAdmin: boolean;
+}
diff --git a/frontend/src/app/team-filter/team-filter.component.ts b/frontend/src/app/team-filter/team-filter.component.ts
deleted file mode 100644
index f7ecbd3db3..0000000000
--- a/frontend/src/app/team-filter/team-filter.component.ts
+++ /dev/null
@@ -1,80 +0,0 @@
-import { ChangeDetectionStrategy, Component, OnInit } from '@angular/core';
-import { BehaviorSubject } from 'rxjs';
-import { Team } from '../shared/types/model/Team';
-import { TeamService } from '../shared/services/team.service';
-import { ActivatedRoute, Router } from '@angular/router';
-import { areEqual, getValueFromQuery, optionalReplaceWithNulls, trackByFn } from '../shared/common';
-import { RefreshDataService } from '../shared/services/refresh-data.service';
-
-@Component({
-  selector: 'app-team-filter',
-  templateUrl: './team-filter.component.html',
-  changeDetection: ChangeDetectionStrategy.OnPush,
-})
-export class TeamFilterComponent implements OnInit {
-  teams$: BehaviorSubject<Team[]> = new BehaviorSubject<Team[]>([]);
-  activeTeams: number[] = [];
-  protected readonly trackByFn = trackByFn;
-
-  constructor(
-    private teamService: TeamService,
-    private route: ActivatedRoute,
-    private router: Router,
-    private refreshDataService: RefreshDataService,
-  ) {
-    this.refreshDataService.reloadOverviewSubject.subscribe(() => {
-      this.teamService.getAllTeams().subscribe((teams) => {
-        this.teams$.next(teams);
-        this.activeTeams = this.activeTeams.filter((teamId) => this.getAllTeamIds().includes(teamId));
-      });
-    });
-  }
-
-  ngOnInit(): void {
-    this.teamService.getAllTeams().subscribe((teams: Team[]) => {
-      this.teams$.next(teams);
-      const teamQuery = this.route.snapshot.queryParams['teams'];
-      const teamIds = getValueFromQuery(teamQuery);
-      const knownTeams = this.getAllTeamIds().filter((teamId) => teamIds?.includes(teamId));
-      if (knownTeams.length == 0) {
-        this.activeTeams = teams.filter((e) => e.filterIsActive).map((team) => team.id);
-      } else {
-        this.activeTeams = knownTeams;
-      }
-      this.changeTeamFilterParams();
-    });
-  }
-
-  changeTeamFilterParams() {
-    const params = { teams: this.activeTeams.join(',') };
-    const optionalParams = optionalReplaceWithNulls(params);
-    this.router
-      .navigate([], { queryParams: optionalParams })
-      .then(() => this.refreshDataService.teamFilterReady.next());
-  }
-
-  toggleSelection(id: number) {
-    if (this.areAllTeamsShown()) {
-      this.activeTeams = [id];
-    } else if (this.activeTeams.includes(id)) {
-      this.activeTeams = this.activeTeams.filter((teamId) => teamId !== id);
-    } else {
-      this.activeTeams.push(id);
-    }
-
-    this.changeTeamFilterParams();
-  }
-
-  areAllTeamsShown() {
-    return areEqual(this.activeTeams, this.getAllTeamIds());
-  }
-
-  toggleAll() {
-    this.activeTeams = this.areAllTeamsShown() ? [] : this.getAllTeamIds();
-    this.changeTeamFilterParams();
-  }
-
-  getAllTeamIds() {
-    return this.teams$.getValue().map((team) => team.id);
-  }
-}
diff --git a/frontend/src/app/team-management/add-edit-team-dialog/add-edit-team-dialog.component.html b/frontend/src/app/team-management/add-edit-team-dialog/add-edit-team-dialog.component.html
new file mode 100644
index 0000000000..a181fae4cd
--- /dev/null
+++ b/frontend/src/app/team-management/add-edit-team-dialog/add-edit-team-dialog.component.html
@@ -0,0 +1,44 @@
+<section mat-dialog-title>
+  <app-dialog-header [dialogTitle]="data ? 'Team bearbeiten' : 'Team erfassen'"></app-dialog-header>
+</section>
+
+<mat-dialog-content>
+  <div class="dialog-content" tabindex="-1">
+    <div class="w-100 d-flex justify-content-between align-items-center">
+      <form [formGroup]="teamForm" class="d-flex flex-column flex-wrap container p-0">
+        <div class="input-style gap-2 col-12">
+          <label class="text-black" for="name">Teamname</label>
+          <input
+            matInput
+            [attr.data-testId]="'add-team-name'"
+            class="dialog-form-field"
+            [ngClass]="formInputCheck(teamForm, 'name')"
+            formControlName="name"
+            id="name"
+          />
+          <mat-error *ngIf="hasFormFieldErrors(teamForm, 'name')">
+            <span>{{ getErrorMessage("SIZE_BETWEEN", "Teamname", 2, 250) }}</span>
+          </mat-error>
+        </div>
+      </form>
+    </div>
+  </div>
+</mat-dialog-content>
+
+<mat-dialog-actions>
+  <div class="d-flex justify-content-between p-0 mt-2" mat-dialog-actions>
+    <div class="d-flex p-0">
+      <button
+        [attr.data-testId]="'add-team-save'"
+        [disabled]="teamForm.invalid"
+        color="primary"
+        mat-flat-button
+        type="submit"
+        (click)="saveTeam()"
+      >
+        Speichern
+      </button>
+      <button color="primary" mat-button mat-dialog-close class="ms-2">Abbrechen</button>
+    </div>
+  </div>
+</mat-dialog-actions>
diff --git a/frontend/src/app/shared/dialog/team-management/team-management.component.scss b/frontend/src/app/team-management/add-edit-team-dialog/add-edit-team-dialog.component.scss
similarity index 89%
rename from frontend/src/app/shared/dialog/team-management/team-management.component.scss
rename to frontend/src/app/team-management/add-edit-team-dialog/add-edit-team-dialog.component.scss
index 2019e2f57e..229b3c04e6 100644
--- a/frontend/src/app/shared/dialog/team-management/team-management.component.scss
+++ b/frontend/src/app/team-management/add-edit-team-dialog/add-edit-team-dialog.component.scss
@@ -1,4 +1,4 @@
-@import "_variables";
+@import "../style/variables";
 
 .input-fields {
   margin-bottom: 0.5rem;
diff --git a/frontend/src/app/team-management/add-edit-team-dialog/add-edit-team-dialog.component.spec.ts b/frontend/src/app/team-management/add-edit-team-dialog/add-edit-team-dialog.component.spec.ts
new file mode 100644
index 0000000000..22896af107
--- /dev/null
+++ b/frontend/src/app/team-management/add-edit-team-dialog/add-edit-team-dialog.component.spec.ts
@@ -0,0 +1,114 @@
+import { AddEditTeamDialog } from './add-edit-team-dialog.component';
+import { ComponentFixture, TestBed } from '@angular/core/testing';
+import { HarnessLoader } from '@angular/cdk/testing';
+import { HttpClientTestingModule } from '@angular/common/http/testing';
+import { MAT_DIALOG_DATA, MatDialog, MatDialogModule, MatDialogRef } from '@angular/material/dialog';
+import { MatIconModule } from '@angular/material/icon';
+import { MatFormFieldModule } from '@angular/material/form-field';
+import { MatSelectModule } from '@angular/material/select';
+import { ReactiveFormsModule } from '@angular/forms';
+import { MatInputModule } from '@angular/material/input';
+import { NoopAnimationsModule } from '@angular/platform-browser/animations';
+import { MatCheckboxModule } from '@angular/material/checkbox';
+import { RouterTestingModule } from '@angular/router/testing';
+import { DialogHeaderComponent } from '../../shared/custom/dialog-header/dialog-header.component';
+import { TestbedHarnessEnvironment } from '@angular/cdk/testing/testbed';
+import { TeamService } from '../../services/team.service';
+import { of } from 'rxjs';
+import { marketingTeamWriteable, teamFormObject } from '../../shared/testData';
+import { Team } from '../../shared/types/model/Team';
+import { TranslateService } from '@ngx-translate/core';
+
+const dialogRefMock = {
+  close: jest.fn(),
+};
+
+const dialogMock = {
+  open: jest.fn(),
+};
+
+const teamServiceMock = {
+  createTeam: jest.fn(),
+  updateTeam: jest.fn(),
+  deleteTeam: jest.fn(),
+};
+
+describe('TeamManagementComponent', () => {
+  let component: AddEditTeamDialog;
+  let fixture: ComponentFixture<AddEditTeamDialog>;
+  let loader: HarnessLoader;
+
+  beforeEach(() => {
+    TestBed.configureTestingModule({
+      imports: [
+        HttpClientTestingModule,
+        MatDialogModule,
+        MatIconModule,
+        MatFormFieldModule,
+        MatSelectModule,
+        ReactiveFormsModule,
+        MatInputModule,
+        NoopAnimationsModule,
+        MatCheckboxModule,
+        RouterTestingModule,
+      ],
+      declarations: [AddEditTeamDialog, DialogHeaderComponent],
+      providers: [
+        {
+          provide: MatDialog,
+          useValue: dialogMock,
+        },
+        {
+          provide: MatDialogRef,
+          useValue: dialogRefMock,
+        },
+        {
+          provide: TeamService,
+          useValue: teamServiceMock,
+        },
+        {
+          provide: MAT_DIALOG_DATA,
+          useValue: null,
+        },
+        { provide: TranslateService, useValue: {} },
+      ],
+    });
+    fixture = TestBed.createComponent(AddEditTeamDialog);
+    component = fixture.componentInstance;
+    fixture.detectChanges();
+    loader = TestbedHarnessEnvironment.loader(fixture);
+  });
+
+  it('should create', () => {
+    expect(component).toBeTruthy();
+  });
+
+  it('should call service method to save team', async () => {
+    component.teamForm.setValue(teamFormObject);
+    jest.spyOn(teamServiceMock, 'createTeam').mockReturnValue(of(teamFormObject));
+    fixture.detectChanges();
+    component.saveTeam();
+    expect(teamServiceMock.createTeam).toHaveBeenCalled();
+    expect(teamServiceMock.createTeam).toHaveBeenCalledWith(teamFormObject as Team);
+  });
+
+  it('should call service method to update team if data input is not null', async () => {
+    component.data = { team: marketingTeamWriteable };
+    component.teamForm.setValue(teamFormObject);
+    jest.spyOn(teamServiceMock, 'updateTeam').mockReturnValue(of(teamFormObject));
+    fixture.detectChanges();
+    component.saveTeam();
+    expect(teamServiceMock.updateTeam).toHaveBeenCalled();
+    expect(teamServiceMock.updateTeam).toHaveBeenCalledWith({
+      ...teamFormObject,
+      id: marketingTeamWriteable.id,
+      version: marketingTeamWriteable.version,
+    } as Team);
+  });
+
+  it('should set team values in from on init if data is not null', async () => {
+    component.data = { team: marketingTeamWriteable };
+    component.ngOnInit();
+    expect(component.teamForm.controls.name.value).toBe(marketingTeamWriteable.name);
+  });
+});
diff --git a/frontend/src/app/team-management/add-edit-team-dialog/add-edit-team-dialog.component.ts b/frontend/src/app/team-management/add-edit-team-dialog/add-edit-team-dialog.component.ts
new file mode 100644
index 0000000000..35462fa02c
--- /dev/null
+++ b/frontend/src/app/team-management/add-edit-team-dialog/add-edit-team-dialog.component.ts
@@ -0,0 +1,77 @@
+import { Component, Inject, OnInit } from '@angular/core';
+import { MAT_DIALOG_DATA, MatDialogRef } from '@angular/material/dialog';
+import { formInputCheck, hasFormFieldErrors } from '../../shared/common';
+import { FormControl, FormGroup, Validators } from '@angular/forms';
+import { TeamService } from '../../services/team.service';
+import { Team } from '../../shared/types/model/Team';
+import { TranslateService } from '@ngx-translate/core';
+import { UserService } from '../../services/user.service';
+import { Router } from '@angular/router';
+
+@Component({
+  selector: 'app-add-edit-team-dialog',
+  templateUrl: './add-edit-team-dialog.component.html',
+  styleUrls: ['./add-edit-team-dialog.component.scss'],
+})
+export class AddEditTeamDialog implements OnInit {
+  teamForm = new FormGroup({
+    name: new FormControl<string>('', [Validators.required, Validators.minLength(2), Validators.maxLength(250)]),
+  });
+  protected readonly formInputCheck = formInputCheck;
+  protected readonly hasFormFieldErrors = hasFormFieldErrors;
+
+  constructor(
+    public dialogRef: MatDialogRef<AddEditTeamDialog>,
+    private teamService: TeamService,
+    private userService: UserService,
+    private router: Router,
+    @Inject(MAT_DIALOG_DATA)
+    public data:
+      | {
+          team: Team;
+        }
+      | undefined,
+    private translate: TranslateService,
+  ) {}
+
+  ngOnInit(): void {
+    if (this.data) {
+      this.teamForm.setValue({
+        name: this.data.team.name,
+      });
+    }
+  }
+
+  saveTeam() {
+    if (!this.data) {
+      this.createNewTeam();
+    } else {
+      this.updateTeam();
+    }
+  }
+
+  private createNewTeam() {
+    let newTeam: Team = this.teamForm.value as Team;
+    this.teamService.createTeam(newTeam).subscribe((result) => {
+      this.userService.reloadUsers();
+      this.userService.reloadCurrentUser().subscribe();
+      this.dialogRef.close(result);
+      this.router.navigateByUrl('/team-management/' + result.id);
+    });
+  }
+
+  private updateTeam() {
+    let updatedTeam: Team = {
+      ...this.teamForm.value,
+      id: this.data!.team.id,
+      version: this.data!.team.version,
+    } as Team;
+    this.teamService.updateTeam(updatedTeam).subscribe((result) => {
+      this.dialogRef.close(result);
+    });
+  }
+
+  getErrorMessage(error: string, field: string, firstNumber: number | null, secondNumber: number | null): string {
+    return field + this.translate.instant('DIALOG_ERRORS.' + error).format(firstNumber, secondNumber);
+  }
+}
diff --git a/frontend/src/app/team-management/add-member-to-team-dialog/add-member-to-team-dialog.component.html b/frontend/src/app/team-management/add-member-to-team-dialog/add-member-to-team-dialog.component.html
new file mode 100644
index 0000000000..e64903624d
--- /dev/null
+++ b/frontend/src/app/team-management/add-member-to-team-dialog/add-member-to-team-dialog.component.html
@@ -0,0 +1,74 @@
+<section mat-dialog-title>
+  <app-dialog-header [dialogTitle]="getDialogTitle()"></app-dialog-header>
+</section>
+
+<mat-dialog-content>
+  <div class="dialog-content" tabindex="-1">
+    <div class="w-100 d-flex justify-content-between align-items-center">
+      <form class="example-form w-100">
+        <mat-form-field
+          class="w-100 bg-white header-form-field"
+          ngDefaultControl
+          subscriptSizing="dynamic"
+          appearance="outline"
+        >
+          <input
+            type="text"
+            placeholder="Nach Name oder E-Mail suchen"
+            aria-label="Nach Name oder E-Mail suchen"
+            matInput
+            [formControl]="search"
+            [matAutocomplete]="auto"
+            [attr.data-testId]="'search-member-to-add'"
+          />
+          <mat-autocomplete
+            #auto="matAutocomplete"
+            (optionSelected)="selectUser($event.option.value)"
+            [displayWith]="getDisplayValue"
+          >
+            <mat-option *ngFor="let user of usersForSelection$ | async" [value]="user">
+              {{ getDisplayValue(user) }}
+            </mat-option>
+          </mat-autocomplete>
+        </mat-form-field>
+      </form>
+    </div>
+    <div class="w-100" *ngIf="dataSource">
+      <table mat-table [dataSource]="dataSource" class="okr-table" id="all-member-table">
+        <ng-container matColumnDef="name">
+          <td mat-cell *matCellDef="let element">{{ getDisplayValue(element) }}</td>
+        </ng-container>
+        <ng-container matColumnDef="delete">
+          <td mat-cell *matCellDef="let element">
+            <div class="d-flex">
+              <app-puzzle-icon-button
+                (click)="remove(element)"
+                icon="delete-icon.svg"
+                alt="Remove User Icon"
+              ></app-puzzle-icon-button>
+            </div>
+          </td>
+        </ng-container>
+        <tr mat-row *matRowDef="let row; columns: displayedColumns"></tr>
+      </table>
+    </div>
+  </div>
+</mat-dialog-content>
+
+<mat-dialog-actions>
+  <div class="d-flex justify-content-between p-0 mt-2" mat-dialog-actions>
+    <div class="d-flex p-0">
+      <button
+        [attr.data-testId]="'save'"
+        [disabled]="!(selectedUsers$ | async)?.length"
+        color="primary"
+        mat-flat-button
+        type="submit"
+        (click)="addUsersToTeam()"
+      >
+        Hinzufügen
+      </button>
+      <button color="primary" mat-button mat-dialog-close class="ms-2">Abbrechen</button>
+    </div>
+  </div>
+</mat-dialog-actions>
diff --git a/frontend/src/app/team-management/add-member-to-team-dialog/add-member-to-team-dialog.component.scss b/frontend/src/app/team-management/add-member-to-team-dialog/add-member-to-team-dialog.component.scss
new file mode 100644
index 0000000000..e314b60dba
--- /dev/null
+++ b/frontend/src/app/team-management/add-member-to-team-dialog/add-member-to-team-dialog.component.scss
@@ -0,0 +1,10 @@
+#add-member-table {
+  ::ng-deep thead {
+    display: none;
+  }
+}
+
+.mat-column-delete {
+  display: flex;
+  justify-content: flex-end;
+}
diff --git a/frontend/src/app/team-management/add-member-to-team-dialog/add-member-to-team-dialog.component.spec.ts b/frontend/src/app/team-management/add-member-to-team-dialog/add-member-to-team-dialog.component.spec.ts
new file mode 100644
index 0000000000..45b9c9bd51
--- /dev/null
+++ b/frontend/src/app/team-management/add-member-to-team-dialog/add-member-to-team-dialog.component.spec.ts
@@ -0,0 +1,124 @@
+import { ComponentFixture, TestBed } from '@angular/core/testing';
+import { UserService } from '../../services/user.service';
+import { TeamService } from '../../services/team.service';
+import { AddMemberToTeamDialogComponent } from './add-member-to-team-dialog.component';
+import { SharedModule } from '../../shared/shared.module';
+import { MAT_DIALOG_DATA, MatDialogModule, MatDialogRef } from '@angular/material/dialog';
+import { team1, users } from '../../shared/testData';
+import { BehaviorSubject, of, skip } from 'rxjs';
+import { MatFormFieldModule } from '@angular/material/form-field';
+import { MatAutocompleteModule } from '@angular/material/autocomplete';
+import { User } from '../../shared/types/model/User';
+import { MatTable } from '@angular/material/table';
+
+describe('AddMemberToTeamDialogComponent', () => {
+  let component: AddMemberToTeamDialogComponent;
+  let fixture: ComponentFixture<AddMemberToTeamDialogComponent>;
+
+  const userServiceMock = {
+    getUsers: jest.fn(),
+    reloadUsers: jest.fn(),
+  };
+
+  const teamServiceMock = {
+    addUsersToTeam: jest.fn(),
+  };
+
+  const matDialogRefMock = {};
+
+  beforeEach(async () => {
+    await TestBed.configureTestingModule({
+      declarations: [AddMemberToTeamDialogComponent],
+      imports: [SharedModule, MatDialogModule, MatFormFieldModule, MatAutocompleteModule],
+      providers: [
+        { provide: UserService, useValue: userServiceMock },
+        { provide: TeamService, useValue: teamServiceMock },
+        {
+          provide: MatDialogRef,
+          useValue: matDialogRefMock,
+        },
+        {
+          provide: MAT_DIALOG_DATA,
+          useValue: { team: team1, currentUsersOfTeam: [users[0]] },
+        },
+      ],
+    }).compileComponents();
+
+    userServiceMock.getUsers.mockReturnValue(of(users));
+
+    fixture = TestBed.createComponent(AddMemberToTeamDialogComponent);
+    component = fixture.componentInstance;
+
+    component.table = {
+      renderRows: () => undefined,
+    } as MatTable<User[]>;
+
+    component.selectedUsers$ = new BehaviorSubject<User[]>([]);
+  });
+
+  it('should create', () => {
+    expect(component).toBeTruthy();
+  });
+
+  it('should set allPossibleUsers correctly', () => {
+    component.ngOnInit();
+    component.usersForSelection$!.subscribe((filteredUsers) => {
+      expect(filteredUsers.length).toBe(users.length - 1);
+      expect(filteredUsers).not.toContain(users[0]);
+    });
+  });
+
+  it('should set filteredUsers correctly: search by PaCo', (done) => {
+    component.search = {
+      valueChanges: of('PaCo'),
+    } as any;
+
+    component.ngOnInit();
+
+    component.usersForSelection$!.subscribe((filteredUsers) => {
+      expect(filteredUsers.length).toBe(1);
+      expect(filteredUsers[0].email).toBe('peggimann@puzzle.ch');
+      done();
+    });
+  });
+
+  it('should set filteredUsers correctly: dont show already selected users', (done) => {
+    component.search = {
+      valueChanges: of('puzzle.ch'),
+    } as any;
+
+    component.selectedUsers$.next([users[1]]);
+
+    component.ngOnInit();
+
+    component.usersForSelection$!.pipe(skip(1)).subscribe((filteredUsers) => {
+      expect(filteredUsers.length).toBe(users.length - 2);
+      expect(filteredUsers.map((u) => u.id)).not.toContain(users[1].id);
+      done();
+    });
+  });
+
+  it('should set teamname correctly', () => {
+    expect(component.getDialogTitle()).toBe(`Members zu Team ${team1.name} hinzufügen`);
+  });
+
+  it('should return correct display value', () => {
+    expect(component.getDisplayValue(users[0])).toBe(`${users[0].firstname} ${users[0].lastname} (${users[0].email})`);
+  });
+
+  it('should add user to selected users and restore search value', () => {
+    component.search.setValue('test');
+    component.selectedUsers$.next([users[1], users[2]]);
+    component.selectUser(users[3]);
+    expect(component.search.value).toBe('');
+    expect(component.selectedUsers$.getValue().length).toBe(3);
+    expect(component.selectedUsers$.getValue().map((u) => u.id)).toStrictEqual([users[1].id, users[2].id, users[3].id]);
+  });
+
+  it('should remove user from selected users', () => {
+    component.selectedUsers$.next([...users]);
+    component.remove(users[0]);
+    expect(component.selectedUsers$.getValue().length).toBe(users.length - 1);
+    expect(component.selectedUsers$.getValue().map((u) => u.id)).not.toContain(users[0].id);
+  });
+});
diff --git a/frontend/src/app/team-management/add-member-to-team-dialog/add-member-to-team-dialog.component.ts b/frontend/src/app/team-management/add-member-to-team-dialog/add-member-to-team-dialog.component.ts
new file mode 100644
index 0000000000..00fce4104d
--- /dev/null
+++ b/frontend/src/app/team-management/add-member-to-team-dialog/add-member-to-team-dialog.component.ts
@@ -0,0 +1,109 @@
+import { Component, Inject, OnDestroy, OnInit, ViewChild } from '@angular/core';
+import { BehaviorSubject, combineLatest, filter, map, Observable, startWith, Subject, takeUntil } from 'rxjs';
+import { Team } from '../../shared/types/model/Team';
+import { MAT_DIALOG_DATA, MatDialogRef } from '@angular/material/dialog';
+import { User } from '../../shared/types/model/User';
+import { UserService } from '../../services/user.service';
+import { FormControl } from '@angular/forms';
+import { MatTable, MatTableDataSource } from '@angular/material/table';
+import { TeamService } from '../../services/team.service';
+import { UserTableEntry } from '../../shared/types/model/UserTableEntry';
+
+export type AddMemberToTeamDialogComponentData = {
+  team: Team;
+  currentUsersOfTeam: UserTableEntry[];
+};
+
+@Component({
+  selector: 'app-add-member-to-team-dialog',
+  templateUrl: './add-member-to-team-dialog.component.html',
+  styleUrl: './add-member-to-team-dialog.component.scss',
+})
+export class AddMemberToTeamDialogComponent implements OnInit, OnDestroy {
+  @ViewChild(MatTable) table!: MatTable<User[]>;
+
+  selectedUsers$: BehaviorSubject<User[]> = new BehaviorSubject<User[]>([]);
+  search = new FormControl('');
+  usersForSelection$: Observable<User[]> | undefined;
+  displayedColumns = ['name', 'delete'];
+  dataSource: MatTableDataSource<User> | undefined;
+
+  private readonly unsubscribe$ = new Subject<void>();
+
+  public constructor(
+    private readonly userService: UserService,
+    private readonly teamService: TeamService,
+    public dialogRef: MatDialogRef<AddMemberToTeamDialogComponent>,
+    @Inject(MAT_DIALOG_DATA)
+    public data: AddMemberToTeamDialogComponentData,
+  ) {
+    this.selectedUsers$.subscribe((users) => (this.dataSource = new MatTableDataSource<User>(users)));
+  }
+
+  public ngOnInit(): void {
+    this.usersForSelection$ = combineLatest([
+      this.userService.getUsers(),
+      this.selectedUsers$,
+      this.search.valueChanges.pipe(
+        startWith(''),
+        // directly after selecting object, filtervalue is an object.
+        filter((searchValue) => typeof searchValue === 'string'),
+      ),
+    ]).pipe(
+      takeUntil(this.unsubscribe$),
+      map(([allPossibleUsers, selectedUsers, filterValue]) => {
+        return this.filter(allPossibleUsers, filterValue || '', selectedUsers);
+      }),
+    );
+  }
+
+  public ngOnDestroy() {
+    this.unsubscribe$.next();
+    this.unsubscribe$.complete();
+  }
+
+  getDialogTitle(): string {
+    return `Members zu Team ${this.data.team.name} hinzufügen`;
+  }
+
+  addUsersToTeam(): void {
+    this.teamService.addUsersToTeam(this.data.team, this.selectedUsers$.getValue()).subscribe(() => {
+      this.userService.reloadUsers();
+      this.userService.reloadCurrentUser().subscribe();
+      this.dialogRef.close();
+    });
+  }
+
+  private filter(allPossibleUsers: User[], searchValue: string, selectedUsers: User[]) {
+    // filter currently current users of team
+    const currentUserIds = this.data.currentUsersOfTeam.map((u) => u.id);
+    const filteredUsers = allPossibleUsers.filter((u) => !currentUserIds.includes(u.id));
+    const filterLower = searchValue.toLowerCase();
+    return filteredUsers.filter((user) => {
+      // already added users should not be displayed
+      if (selectedUsers.find((u) => u.id === user.id)) {
+        return false;
+      }
+      return this.getDisplayValue(user).toLowerCase().includes(filterLower);
+    });
+  }
+
+  getDisplayValue(user: User | ''): string {
+    if (!user) {
+      return '';
+    }
+    return `${user.firstname} ${user.lastname} (${user.email})`;
+  }
+
+  selectUser(user: User) {
+    const newUsers = this.selectedUsers$.getValue();
+    newUsers.push(user);
+    this.selectedUsers$.next(newUsers);
+    this.search.setValue('');
+  }
+
+  remove(user: User): void {
+    const filteredUsers = this.selectedUsers$.getValue().filter((u) => u !== user);
+    this.selectedUsers$.next(filteredUsers);
+  }
+}
diff --git a/frontend/src/app/team-management/add-user-team/add-user-team.component.html b/frontend/src/app/team-management/add-user-team/add-user-team.component.html
new file mode 100644
index 0000000000..60a2ec8203
--- /dev/null
+++ b/frontend/src/app/team-management/add-user-team/add-user-team.component.html
@@ -0,0 +1,61 @@
+<ng-container *ngIf="selectableAdminTeams$ | async as selectableAdminTeams">
+  <div
+    class="tooltip-wrapper"
+    [matTooltip]="'Der User ist bereits in allen Teams in welchen Sie Admin sind'"
+    [matTooltipDisabled]="!addButtonDisabled(selectableAdminTeams)"
+  >
+    <button
+      *ngIf="showAddButton(allAdminTeams$ | async)"
+      (click)="createUserTeam(selectableAdminTeams[0])"
+      [attr.data-testId]="'add-user'"
+      class="mdc-button px-0 pe-2"
+      [disabled]="addButtonDisabled(selectableAdminTeams)"
+      color="primary"
+      mat-button
+    >
+      <span class="d-flex align-items-center fw-bold add-text">
+        <img
+          *ngIf="!addButtonDisabled(selectableAdminTeams)"
+          alt="Add key-result button"
+          class="add-cross-button"
+          src="/assets/icons/new-icon.svg"
+        />
+        <img
+          *ngIf="addButtonDisabled(selectableAdminTeams)"
+          alt="Add key-result button"
+          class="add-cross-button"
+          src="/assets/icons/new-icon-disabled.svg"
+        />
+        Zu weiterem Team hinzufügen
+      </span>
+    </button>
+  </div>
+  <ng-container *ngIf="userTeam">
+    <p class="mt-4 mb-2">Zu neuem Team hinzufügen</p>
+    <div class="new-team w-100">
+      <mat-form-field
+        class="bg-white header-form-field"
+        ngDefaultControl
+        subscriptSizing="dynamic"
+        appearance="outline"
+      >
+        <mat-select [attr.data-testId]="'select-team-dropdown'" [(ngModel)]="userTeam.team">
+          <mat-option
+            [attr.data-testId]="'select-team-dropdown-option'"
+            *ngFor="let team of selectableAdminTeams"
+            [value]="team"
+            >{{ team.name }}</mat-option
+          >
+        </mat-select>
+      </mat-form-field>
+
+      <app-team-role-dropdown *ngIf="userTeam" [(isAdmin)]="userTeam.isTeamAdmin"></app-team-role-dropdown>
+    </div>
+    <div class="mt-3">
+      <button [attr.data-testId]="'add-user-to-team-save'" (click)="save()" mat-flat-button color="primary">
+        Hinzufügen
+      </button>
+      <button class="ms-2" (click)="userTeam = undefined" mat-button>Abbrechen</button>
+    </div>
+  </ng-container>
+</ng-container>
diff --git a/frontend/src/app/team-management/add-user-team/add-user-team.component.scss b/frontend/src/app/team-management/add-user-team/add-user-team.component.scss
new file mode 100644
index 0000000000..2ff041c4af
--- /dev/null
+++ b/frontend/src/app/team-management/add-user-team/add-user-team.component.scss
@@ -0,0 +1,12 @@
+.new-team {
+  display: flex;
+
+  > mat-form-field {
+    flex: 0 0 calc(35% + 1rem);
+    padding-right: 1rem;
+    box-sizing: border-box;
+  }
+}
+.tooltip-wrapper {
+  width: fit-content;
+}
diff --git a/frontend/src/app/team-management/add-user-team/add-user-team.component.spec.ts b/frontend/src/app/team-management/add-user-team/add-user-team.component.spec.ts
new file mode 100644
index 0000000000..3fd1a309fb
--- /dev/null
+++ b/frontend/src/app/team-management/add-user-team/add-user-team.component.spec.ts
@@ -0,0 +1,103 @@
+import { ComponentFixture, TestBed } from '@angular/core/testing';
+import { AddUserTeamComponent } from './add-user-team.component';
+import { TeamService } from '../../services/team.service';
+import { team1, team2, team3, testUser } from '../../shared/testData';
+import { of } from 'rxjs';
+
+describe('AddUserTeamComponent', () => {
+  let component: AddUserTeamComponent;
+  let fixture: ComponentFixture<AddUserTeamComponent>;
+  let teamService: TeamService;
+
+  const team1Copy = { ...team1 };
+  const team2Copy = { ...team2 };
+  const team3Copy = { ...team3 };
+
+  const teamServiceMock = {
+    getAllTeams: jest.fn(),
+  };
+
+  beforeEach(async () => {
+    await TestBed.configureTestingModule({
+      declarations: [AddUserTeamComponent],
+      providers: [{ provide: TeamService, useValue: teamServiceMock }],
+    }).compileComponents();
+  });
+
+  beforeEach(() => {
+    fixture = TestBed.createComponent(AddUserTeamComponent);
+    component = fixture.componentInstance;
+    teamService = TestBed.inject(TeamService);
+
+    teamServiceMock.getAllTeams.mockReturnValue(of([team1Copy, team2Copy, team3Copy]));
+    component.currentTeams$ = of(testUser.userTeamList);
+
+    fixture.detectChanges();
+  });
+
+  it('should create the component', () => {
+    expect(component).toBeTruthy();
+  });
+
+  it('should filter selectableAdminTeams correctly', (done) => {
+    team1Copy.writeable = true;
+    team2Copy.writeable = true;
+    team3Copy.writeable = false;
+    component.ngOnInit();
+    component.selectableAdminTeams$!.subscribe((teams) => {
+      expect(teams.length).toBe(1);
+      expect(teams[0].id).toBe(team2Copy.id);
+      done();
+    });
+  });
+
+  it('should filter allAdminTeams correctly', (done) => {
+    team1Copy.writeable = true;
+    team2Copy.writeable = true;
+    team3Copy.writeable = false;
+    component.ngOnInit();
+    component.allAdminTeams$!.subscribe((teams) => {
+      expect(teams.length).toBe(2);
+      expect(teams[0].id).toBe(team1Copy.id);
+      expect(teams[1].id).toBe(team2Copy.id);
+      expect(component.showAddButton(teams)).toBeTruthy();
+      done();
+    });
+  });
+
+  it('createUserTeam should create the userTeam', () => {
+    component.createUserTeam(team1Copy);
+    expect(component.userTeam).toStrictEqual({
+      team: team1Copy,
+      isTeamAdmin: false,
+    });
+  });
+
+  it('save should throw exception if userTeam is undefined', () => {
+    expect(() => component.save()).toThrowError('UserTeam should be defined here');
+  });
+
+  it('save should emit addUserTeam event and set userTeam to undefined', (done) => {
+    component.userTeam = testUser.userTeamList[0];
+    component.addUserTeam.subscribe(() => {
+      done();
+    });
+    component.save();
+    expect(component.userTeam).toBe(undefined);
+  });
+
+  it('should test showAddButton', () => {
+    component.userTeam = testUser.userTeamList[0];
+    expect(component.showAddButton(null)).toBeFalsy();
+    expect(component.showAddButton([team1Copy, team2Copy])).toBeFalsy();
+    component.userTeam = undefined;
+    expect(component.showAddButton([])).toBeFalsy();
+    expect(component.showAddButton([team1Copy, team2Copy])).toBeTruthy();
+  });
+
+  it('should test addButtonDisabled', () => {
+    expect(component.addButtonDisabled([team1Copy])).toBeFalsy();
+    expect(component.addButtonDisabled([])).toBeTruthy();
+    expect(component.addButtonDisabled(null)).toBeTruthy();
+  });
+});
diff --git a/frontend/src/app/team-management/add-user-team/add-user-team.component.ts b/frontend/src/app/team-management/add-user-team/add-user-team.component.ts
new file mode 100644
index 0000000000..fd7c2021ef
--- /dev/null
+++ b/frontend/src/app/team-management/add-user-team/add-user-team.component.ts
@@ -0,0 +1,73 @@
+import { Component, EventEmitter, Input, OnDestroy, OnInit, Output } from '@angular/core';
+import { Team } from '../../shared/types/model/Team';
+import { TeamService } from '../../services/team.service';
+import { combineLatest, map, Observable, Subject, takeUntil } from 'rxjs';
+import { UserTeam } from '../../shared/types/model/UserTeam';
+
+@Component({
+  selector: 'app-add-user-team',
+  templateUrl: './add-user-team.component.html',
+  styleUrl: './add-user-team.component.scss',
+})
+export class AddUserTeamComponent implements OnInit, OnDestroy {
+  @Output()
+  addUserTeam = new EventEmitter<UserTeam>();
+
+  @Input({ required: true })
+  currentTeams$!: Observable<UserTeam[]>;
+
+  userTeam: { team: Team; isTeamAdmin: boolean } | undefined;
+  selectableAdminTeams$: Observable<Team[]> | undefined;
+  allAdminTeams$: Observable<Team[]> | undefined;
+
+  private unsubscribe$ = new Subject<void>();
+
+  constructor(private readonly teamService: TeamService) {}
+
+  ngOnInit() {
+    this.allAdminTeams$ = this.teamService.getAllTeams().pipe(
+      takeUntil(this.unsubscribe$),
+      map((teams) => {
+        return teams.filter((t) => t.writeable);
+      }),
+    );
+
+    this.selectableAdminTeams$ = combineLatest([this.allAdminTeams$, this.currentTeams$]).pipe(
+      takeUntil(this.unsubscribe$),
+      map(([allTeams, userTeams]) => {
+        const currentTeamIds = userTeams.map((ut) => ut.team.id);
+        return allTeams.filter((t) => {
+          return !currentTeamIds.includes(t.id);
+        });
+      }),
+    );
+  }
+
+  ngOnDestroy() {
+    this.unsubscribe$.next();
+    this.unsubscribe$.complete();
+  }
+
+  createUserTeam(team: Team) {
+    this.userTeam = {
+      team,
+      isTeamAdmin: false,
+    };
+  }
+
+  save(): void {
+    if (!this.userTeam) {
+      throw new Error('UserTeam should be defined here');
+    }
+    this.addUserTeam.next(this.userTeam);
+    this.userTeam = undefined;
+  }
+
+  showAddButton(adminTeams: Team[] | null) {
+    return !this.userTeam && adminTeams?.length;
+  }
+
+  addButtonDisabled(selectableAdminTeams: Team[] | null) {
+    return !selectableAdminTeams?.length;
+  }
+}
diff --git a/frontend/src/app/team-management/edit-okr-champion/edit-okr-champion.component.html b/frontend/src/app/team-management/edit-okr-champion/edit-okr-champion.component.html
new file mode 100644
index 0000000000..360443b1fe
--- /dev/null
+++ b/frontend/src/app/team-management/edit-okr-champion/edit-okr-champion.component.html
@@ -0,0 +1,28 @@
+<div>
+  @if (edit) {
+    <mat-checkbox
+      [ngModel]="user.isOkrChampion"
+      (ngModelChange)="setOkrChampion($event)"
+      [attr.data-testId]="'edit-okr-champion-checkbox'"
+      >OKR Champion
+    </mat-checkbox>
+  } @else {
+    <div class="d-flex align-items-center px-2" [attr.data-testId]="'edit-okr-champion-readonly'">
+      <span>OKR Champion:&nbsp;</span>
+      @if (user.isOkrChampion) {
+        <span>Ja</span>
+      } @else {
+        <span>Nein</span>
+      }
+      @if (okrChampionEditable()) {
+        <app-puzzle-icon-button
+          class="mx-2"
+          icon="edit.svg"
+          alt="Edit okr champion icon"
+          [attr.data-testId]="'edit-okr-champion-edit'"
+          (click)="setEditAsync(true)"
+        ></app-puzzle-icon-button>
+      }
+    </div>
+  }
+</div>
diff --git a/frontend/src/app/team-management/edit-okr-champion/edit-okr-champion.component.scss b/frontend/src/app/team-management/edit-okr-champion/edit-okr-champion.component.scss
new file mode 100644
index 0000000000..42fd67b801
--- /dev/null
+++ b/frontend/src/app/team-management/edit-okr-champion/edit-okr-champion.component.scss
@@ -0,0 +1,8 @@
+@import "variables";
+
+:host {
+  height: 40px;
+  background-color: $light-grey;
+  display: flex;
+  align-items: center;
+}
diff --git a/frontend/src/app/team-management/edit-okr-champion/edit-okr-champion.component.ts b/frontend/src/app/team-management/edit-okr-champion/edit-okr-champion.component.ts
new file mode 100644
index 0000000000..7e95f242dd
--- /dev/null
+++ b/frontend/src/app/team-management/edit-okr-champion/edit-okr-champion.component.ts
@@ -0,0 +1,50 @@
+import { ChangeDetectorRef, Component, ElementRef, EventEmitter, HostListener, Input, Output } from '@angular/core';
+import { User } from '../../shared/types/model/User';
+import { UserService } from '../../services/user.service';
+import { TeamService } from '../../services/team.service';
+
+@Component({
+  selector: 'app-edit-okr-champion',
+  templateUrl: './edit-okr-champion.component.html',
+  styleUrl: './edit-okr-champion.component.scss',
+})
+export class EditOkrChampionComponent {
+  @Input({ required: true }) user!: User;
+  @Output() public okrChampionChange = new EventEmitter<boolean>();
+
+  edit = false;
+
+  constructor(
+    private readonly userService: UserService,
+    private readonly teamService: TeamService,
+    private readonly cd: ChangeDetectorRef,
+    private elementRef: ElementRef,
+  ) {}
+
+  @HostListener('document:click', ['$event'])
+  clickOutside(event: MouseEvent) {
+    if (this.elementRef.nativeElement.contains(event.target)) {
+      return;
+    }
+    this.edit = false;
+  }
+
+  // we set edit async, to ensure hostListener can detect outside-of-element clicks correctly
+  // otherwise element of event.target is already hidden
+  setEditAsync(edit: boolean) {
+    setTimeout(() => {
+      this.edit = edit;
+      this.cd.markForCheck();
+    }, 0);
+  }
+
+  okrChampionEditable(): boolean {
+    return this.userService.getCurrentUser().isOkrChampion;
+  }
+
+  setOkrChampion(okrChampion: boolean) {
+    this.okrChampionChange.emit(okrChampion);
+    this.setEditAsync(false);
+    this.cd.markForCheck();
+  }
+}
diff --git a/frontend/src/app/team-management/invite-user-dialog/invite-user-dialog.component.html b/frontend/src/app/team-management/invite-user-dialog/invite-user-dialog.component.html
new file mode 100644
index 0000000000..0ebeead56d
--- /dev/null
+++ b/frontend/src/app/team-management/invite-user-dialog/invite-user-dialog.component.html
@@ -0,0 +1,41 @@
+<section mat-dialog-title>
+  <div class="d-flex justify-content-between align-items-center position-relative dialog-header mt-1">
+    <span class="title w-100 mb-2">
+      <span>Members registrieren</span>
+    </span>
+  </div>
+</section>
+<mat-dialog-content>
+  <div class="dialog-content" tabindex="-1">
+    <form>
+      @for (userFormGroup of form.controls; track $index) {
+        <div class="w-100 d-flex justify-content-between align-items-center pe-4">
+          <app-new-user
+            (removeUser)="removeUser($index)"
+            [index]="$index"
+            [userFormGroup]="userFormGroup"
+            [triedToSubmit]="triedToSubmit"
+          ></app-new-user>
+        </div>
+      }
+      <div class="w-100 d-flex justify-content-start">
+        <button (click)="addUser()" class="px-0 mb-3 pe-2 align-new-icon" color="primary" mat-button>
+          <span class="d-flex align-items-center fw-bold add-text">
+            <img alt="Add User button" class="add-cross-button" src="/assets/icons/new-icon.svg" />
+            Weiterer Member hinzufügen
+          </span>
+        </button>
+      </div>
+    </form>
+  </div>
+</mat-dialog-content>
+<mat-dialog-actions>
+  <div class="d-flex justify-content-between p-0 mt-2" mat-dialog-actions>
+    <div class="d-flex p-0">
+      <button color="primary" [attr.data-testId]="'invite'" mat-flat-button type="submit" (click)="registerUsers()">
+        Einladen
+      </button>
+      <button color="primary" mat-button mat-dialog-close class="ms-2">Abbrechen</button>
+    </div>
+  </div>
+</mat-dialog-actions>
diff --git a/frontend/src/app/team-management/invite-user-dialog/invite-user-dialog.component.scss b/frontend/src/app/team-management/invite-user-dialog/invite-user-dialog.component.scss
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/frontend/src/app/team-management/invite-user-dialog/invite-user-dialog.component.spec.ts b/frontend/src/app/team-management/invite-user-dialog/invite-user-dialog.component.spec.ts
new file mode 100644
index 0000000000..52e589add3
--- /dev/null
+++ b/frontend/src/app/team-management/invite-user-dialog/invite-user-dialog.component.spec.ts
@@ -0,0 +1,106 @@
+import { ComponentFixture, fakeAsync, TestBed, tick } from '@angular/core/testing';
+
+import { InviteUserDialogComponent } from './invite-user-dialog.component';
+import { MatDialogModule } from '@angular/material/dialog';
+import { FormsModule, ReactiveFormsModule } from '@angular/forms';
+import { NewUserComponent } from '../new-user/new-user.component';
+import { PuzzleIconComponent } from '../../shared/custom/puzzle-icon/puzzle-icon.component';
+import { PuzzleIconButtonComponent } from '../../shared/custom/puzzle-icon-button/puzzle-icon-button.component';
+import { UserService } from '../../services/user.service';
+import { testUser } from '../../shared/testData';
+import { DialogRef } from '@angular/cdk/dialog';
+import { of } from 'rxjs';
+import { UniqueEmailValidator } from '../new-user/unique-mail.validator';
+import { MatFormFieldModule } from '@angular/material/form-field';
+import { NO_ERRORS_SCHEMA } from '@angular/core';
+
+describe('InviteUserDialogComponent', () => {
+  let component: InviteUserDialogComponent;
+  let fixture: ComponentFixture<InviteUserDialogComponent>;
+
+  const user1 = { firstname: 'user1', lastname: '1user', email: 'user1@user.ch' };
+  const user2 = { firstname: 'user2', lastname: '2user', email: 'user2@user.ch' };
+  const user3 = { firstname: 'user3', lastname: '3user', email: 'user3@user.ch' };
+
+  const userServiceMock = {
+    createUsers: jest.fn(),
+    getUsers: jest.fn(),
+  };
+
+  const dialogRefMock = {
+    close: jest.fn(),
+  };
+
+  const uniqueMailValidatorMock = {
+    setAddedMails: jest.fn(),
+    validate: () => null,
+  };
+
+  beforeEach(async () => {
+    await TestBed.configureTestingModule({
+      declarations: [InviteUserDialogComponent, NewUserComponent, PuzzleIconComponent, PuzzleIconButtonComponent],
+      imports: [MatDialogModule, FormsModule, ReactiveFormsModule, MatFormFieldModule],
+      providers: [
+        { provide: UserService, useValue: userServiceMock },
+        { provide: DialogRef, useValue: dialogRefMock },
+        { provide: UniqueEmailValidator, useValue: uniqueMailValidatorMock },
+      ],
+      schemas: [NO_ERRORS_SCHEMA],
+    }).compileComponents();
+
+    fixture = TestBed.createComponent(InviteUserDialogComponent);
+    component = fixture.componentInstance;
+
+    userServiceMock.createUsers.mockReset();
+    dialogRefMock.close.mockReset();
+
+    userServiceMock.getUsers.mockReturnValue(of([]));
+
+    fixture.detectChanges();
+  });
+
+  it('should create', () => {
+    expect(component).toBeTruthy();
+  });
+
+  it('addUser should add a user to the existing users', () => {
+    component.addUser();
+    expect(component.form.controls.length).toBe(2);
+  });
+
+  it('removeUser should remove given user from users array', () => {
+    component.addUser();
+    component.addUser();
+    component.addUser();
+
+    component.form.controls[0].setValue(user1);
+    component.form.controls[1].setValue(user2);
+    component.form.controls[2].setValue(user3);
+
+    component.removeUser(1);
+
+    expect(component.form.controls[0].value).toStrictEqual(user1);
+    expect(component.form.controls[1].value).toStrictEqual(user3);
+  });
+
+  it('registerUsers should call createUsers and close dialog if form is valid', fakeAsync(() => {
+    userServiceMock.createUsers.mockReturnValue(of([testUser]));
+
+    component.form.controls[0].setValue(user1);
+
+    component.registerUsers();
+    tick();
+
+    expect(userServiceMock.createUsers).toBeCalledTimes(1);
+    expect(userServiceMock.createUsers).toBeCalledWith(component.form.value);
+    expect(dialogRefMock.close).toBeCalledTimes(1);
+  }));
+
+  it('registerUsers should not call createUsers form is not valid', fakeAsync(() => {
+    component.registerUsers();
+    tick();
+
+    expect(userServiceMock.createUsers).toBeCalledTimes(0);
+    expect(dialogRefMock.close).toBeCalledTimes(0);
+  }));
+});
diff --git a/frontend/src/app/team-management/invite-user-dialog/invite-user-dialog.component.ts b/frontend/src/app/team-management/invite-user-dialog/invite-user-dialog.component.ts
new file mode 100644
index 0000000000..36b8d1ac15
--- /dev/null
+++ b/frontend/src/app/team-management/invite-user-dialog/invite-user-dialog.component.ts
@@ -0,0 +1,72 @@
+import { Component } from '@angular/core';
+import { NewUser } from '../../shared/types/model/NewUser';
+import { FormArray, FormControl, FormGroup, NonNullableFormBuilder, Validators } from '@angular/forms';
+import { UserService } from '../../services/user.service';
+import { DialogRef } from '@angular/cdk/dialog';
+import { NewUserForm } from '../../shared/types/model/NewUserForm';
+import { UniqueEmailValidator } from '../new-user/unique-mail.validator';
+import { takeUntilDestroyed } from '@angular/core/rxjs-interop';
+
+@Component({
+  selector: 'app-invite-user-dialog',
+  templateUrl: './invite-user-dialog.component.html',
+  styleUrl: './invite-user-dialog.component.scss',
+})
+export class InviteUserDialogComponent {
+  form: FormArray<FormGroup<NewUserForm<FormControl>>>;
+  triedToSubmit = false;
+
+  constructor(
+    private readonly userService: UserService,
+    private readonly dialogRef: DialogRef,
+    private readonly formBuilder: NonNullableFormBuilder,
+    private readonly uniqueMailValidator: UniqueEmailValidator,
+  ) {
+    this.form = this.formBuilder.array([this.createUserFormGroup()]);
+    this.form.valueChanges
+      .pipe(takeUntilDestroyed())
+      .subscribe(() => this.uniqueMailValidator.setAddedMails(this.extractAddedMails()));
+  }
+
+  registerUsers() {
+    this.triedToSubmit = true;
+    if (!this.form.valid) {
+      return;
+    }
+    this.userService.createUsers(this.extractFormValue()).subscribe(() => this.dialogRef.close());
+  }
+
+  private extractFormValue(): NewUser[] {
+    return this.form.value as NewUser[];
+  }
+
+  addUser() {
+    this.form.push(this.createUserFormGroup());
+  }
+
+  removeUser(index: number) {
+    this.form.removeAt(index);
+  }
+
+  private createUserFormGroup() {
+    return this.formBuilder.group({
+      firstname: this.formBuilder.control('', [Validators.required, Validators.minLength(1)]),
+      lastname: this.formBuilder.control('', [Validators.required, Validators.minLength(1)]),
+      email: this.formBuilder.control('', [
+        Validators.required,
+        Validators.minLength(1),
+        Validators.email,
+        this.uniqueMailValidator.validate.bind(this.uniqueMailValidator),
+      ]),
+    });
+  }
+
+  private extractAddedMails() {
+    if (!this.form) {
+      return [];
+    }
+    return this.extractFormValue()
+      .map((u) => u.email)
+      .filter((mail) => !!mail);
+  }
+}
diff --git a/frontend/src/app/team-management/member-detail/member-detail.component.html b/frontend/src/app/team-management/member-detail/member-detail.component.html
new file mode 100644
index 0000000000..ea3baeeb00
--- /dev/null
+++ b/frontend/src/app/team-management/member-detail/member-detail.component.html
@@ -0,0 +1,61 @@
+<div class="w-100" cdkTrapFocus cdkTrapFocusAutoCapture="true" [attr.data-testId]="'side-panel'">
+  <div *ngIf="user as userRef; else spinner">
+    <div class="w-100 d-flex justify-content-between align-items-center mb-3">
+      <h2>
+        {{ getFullNameFromUser(userRef) }}
+        <span *ngIf="selectedUserIsLoggedInUser">(ich)</span>
+      </h2>
+      <button class="d-flex" mat-icon-button (click)="navigateBack()" [attr.data-testId]="'close-drawer'">
+        <mat-icon class="d-flex justify-content-center align-items-center">close</mat-icon>
+      </button>
+    </div>
+    <div class="w-100">
+      <app-edit-okr-champion
+        [user]="userRef"
+        (okrChampionChange)="isOkrChampionChange($event, userRef)"
+      ></app-edit-okr-champion>
+    </div>
+    <div class="w-100">
+      <table mat-table [dataSource]="userRef.userTeamList" class="okr-table">
+        <ng-container matColumnDef="team">
+          <th mat-header-cell *matHeaderCellDef>Team</th>
+          <td mat-cell *matCellDef="let element">{{ element.team.name }}</td>
+        </ng-container>
+        <ng-container matColumnDef="role">
+          <th mat-header-cell *matHeaderCellDef>Rolle</th>
+          <td mat-cell *matCellDef="let element">
+            <app-show-edit-role
+              [userTeam]="element"
+              (save)="updateTeamMembership($event, element, userRef)"
+            ></app-show-edit-role>
+          </td>
+        </ng-container>
+        <ng-container matColumnDef="delete">
+          <th mat-header-cell *matHeaderCellDef></th>
+          <td mat-cell *matCellDef="let element">
+            <app-puzzle-icon-button
+              *ngIf="isDeletable(element)"
+              (click)="removeUserFromTeam(element, userRef)"
+              [attr.data-testId]="'delete-team-member'"
+              icon="delete-icon.svg"
+              alt="Delete Member Icon"
+            >
+            </app-puzzle-icon-button>
+          </td>
+        </ng-container>
+        <tr mat-row *matHeaderRowDef="displayedColumns"></tr>
+        <tr mat-row *matRowDef="let row; columns: displayedColumns"></tr>
+        <tr class="mat-row" *matNoDataRow>
+          <td class="mat-cell px-3" [attr.colspan]="displayedColumns.length">Keine Teams</td>
+        </tr>
+      </table>
+      <app-add-user-team
+        [currentTeams$]="currentUserTeams$.asObservable()"
+        (addUserTeam)="addTeamMembership($event, userRef)"
+      ></app-add-user-team>
+    </div>
+  </div>
+</div>
+<ng-template #spinner>
+  <app-spinner text="Member wird geladen..."></app-spinner>
+</ng-template>
diff --git a/frontend/src/app/team-management/member-detail/member-detail.component.scss b/frontend/src/app/team-management/member-detail/member-detail.component.scss
new file mode 100644
index 0000000000..dd2a3058f7
--- /dev/null
+++ b/frontend/src/app/team-management/member-detail/member-detail.component.scss
@@ -0,0 +1,11 @@
+:host {
+  width: 100%;
+}
+
+.mat-column-delete {
+  width: 20px;
+}
+
+.mat-column-team {
+  width: 35%;
+}
diff --git a/frontend/src/app/team-management/member-detail/member-detail.component.spec.ts b/frontend/src/app/team-management/member-detail/member-detail.component.spec.ts
new file mode 100644
index 0000000000..2523c0a284
--- /dev/null
+++ b/frontend/src/app/team-management/member-detail/member-detail.component.spec.ts
@@ -0,0 +1,186 @@
+import { ComponentFixture, fakeAsync, TestBed, tick } from '@angular/core/testing';
+import { MemberDetailComponent } from './member-detail.component';
+import { HttpClientTestingModule } from '@angular/common/http/testing';
+import { ActivatedRoute } from '@angular/router';
+import { delay, of } from 'rxjs';
+import { TranslateModule } from '@ngx-translate/core';
+import { BrowserModule } from '@angular/platform-browser';
+import { SharedModule } from '../../shared/shared.module';
+import { UserService } from '../../services/user.service';
+import { testUser } from '../../shared/testData';
+import { AddUserTeamComponent } from '../add-user-team/add-user-team.component';
+import { MatTableModule } from '@angular/material/table';
+import { MatIconModule } from '@angular/material/icon';
+import { TeamService } from '../../services/team.service';
+import { ShowEditRoleComponent } from '../show-edit-role/show-edit-role.component';
+import { PuzzleIconButtonComponent } from '../../shared/custom/puzzle-icon-button/puzzle-icon-button.component';
+import { PuzzleIconComponent } from '../../shared/custom/puzzle-icon/puzzle-icon.component';
+import { CommonModule } from '@angular/common';
+import { NO_ERRORS_SCHEMA } from '@angular/core';
+import { MatDialog } from '@angular/material/dialog';
+
+describe('MemberDetailComponent', () => {
+  let component: MemberDetailComponent;
+  let fixture: ComponentFixture<MemberDetailComponent>;
+
+  const activatedRouteMock = {
+    paramMap: of({
+      get: (): any => 1,
+    }),
+  };
+
+  const userServiceMock = {
+    getUserById: jest.fn(),
+    getCurrentUser: jest.fn(),
+    reloadUsers: jest.fn(),
+    reloadCurrentUser: jest.fn(),
+  };
+
+  const teamServiceMock = {
+    removeUserFromTeam: jest.fn(),
+    updateOrAddTeamMembership: jest.fn(),
+    getAllTeams: () => of([]),
+  };
+
+  const dialogMock = {
+    open: jest.fn(),
+  };
+
+  beforeEach(async () => {
+    await TestBed.configureTestingModule({
+      declarations: [
+        MemberDetailComponent,
+        AddUserTeamComponent,
+        ShowEditRoleComponent,
+        PuzzleIconButtonComponent,
+        PuzzleIconComponent,
+      ],
+      imports: [
+        HttpClientTestingModule,
+        TranslateModule.forRoot(),
+        BrowserModule,
+        SharedModule,
+        MatTableModule,
+        MatIconModule,
+        CommonModule,
+      ],
+      providers: [
+        { provide: ActivatedRoute, useValue: activatedRouteMock },
+        { provide: UserService, useValue: userServiceMock },
+        { provide: TeamService, useValue: teamServiceMock },
+        { provide: MatDialog, useValue: dialogMock },
+      ],
+      schemas: [NO_ERRORS_SCHEMA],
+    }).compileComponents();
+  });
+
+  beforeEach(() => {
+    fixture = TestBed.createComponent(MemberDetailComponent);
+    component = fixture.componentInstance;
+
+    userServiceMock.getUserById.mockReturnValue(of(testUser));
+    userServiceMock.getCurrentUser.mockReturnValue(testUser);
+    userServiceMock.reloadCurrentUser.mockReturnValue(of(testUser));
+
+    fixture.detectChanges();
+  });
+
+  afterEach(() => {
+    userServiceMock.getUserById.mockReset();
+    userServiceMock.reloadUsers.mockReset();
+    teamServiceMock.updateOrAddTeamMembership.mockReset();
+    dialogMock.open.mockReset();
+    teamServiceMock.removeUserFromTeam.mockReset();
+  });
+
+  it('should create the component', () => {
+    expect(component).toBeTruthy();
+  });
+
+  it('should set selectedUserIsLoggedInUser and currentUserTeams correctly', (done) => {
+    component.ngOnInit();
+    component.currentUserTeams$.subscribe((userTeams) => {
+      expect(userTeams).toStrictEqual(testUser.userTeamList);
+      expect(component.user).toStrictEqual(testUser);
+      expect(component.selectedUserIsLoggedInUser).toBeTruthy();
+      done();
+    });
+  });
+
+  it('removeUserFromTeam should call removeUserFromTeam and loadUser', fakeAsync(() => {
+    const user = testUser;
+    const userTeam = testUser.userTeamList[0];
+    teamServiceMock.removeUserFromTeam.mockReturnValue(of());
+    userServiceMock.getUserById.mockReturnValue(of(user));
+    dialogMock.open.mockReturnValue({
+      afterClosed: () => of(true),
+    });
+
+    component.removeUserFromTeam(userTeam, user);
+    tick();
+
+    expect(teamServiceMock.removeUserFromTeam).toHaveBeenCalledTimes(1);
+    expect(teamServiceMock.removeUserFromTeam).toHaveBeenCalledWith(user.id, userTeam.team);
+    expect(userServiceMock.getUserById).toHaveBeenCalledWith(user.id);
+  }));
+
+  it('removeUserFromTeam should not call removeUserFromTeam if dialog canceled', fakeAsync(() => {
+    const user = testUser;
+    const userTeam = testUser.userTeamList[0];
+    teamServiceMock.removeUserFromTeam.mockReturnValue(of());
+    userServiceMock.getUserById.mockReturnValue(of(user));
+    dialogMock.open.mockReturnValue({
+      afterClosed: () => of(false),
+    });
+
+    component.removeUserFromTeam(userTeam, user);
+    tick();
+
+    expect(teamServiceMock.removeUserFromTeam).toHaveBeenCalledTimes(0);
+  }));
+
+  it('addTeamRole should call updateOrAddTeamMembership, loadUser, reloadUsers and set userTeamEditId to null', fakeAsync(() => {
+    const user = testUser;
+    const userTeam = testUser.userTeamList[0];
+
+    teamServiceMock.updateOrAddTeamMembership.mockReturnValue(of(null));
+    userServiceMock.getUserById.mockReturnValue(of(user));
+
+    component.addTeamMembership(userTeam, user);
+    tick();
+
+    expect(teamServiceMock.updateOrAddTeamMembership).toHaveBeenCalledTimes(1);
+    expect(teamServiceMock.updateOrAddTeamMembership).toHaveBeenCalledWith(user.id, userTeam);
+    expect(userServiceMock.getUserById).toHaveBeenCalledWith(user.id);
+  }));
+
+  it('updateTeamRole should call updateOrAddTeamMembership, loadUser, reloadUsers and set userTeamEditId to null', fakeAsync(() => {
+    const user = testUser;
+    const userTeam = testUser.userTeamList[0];
+
+    teamServiceMock.updateOrAddTeamMembership.mockReturnValue(of(null));
+    userServiceMock.getUserById.mockReturnValue(of(user));
+
+    component.updateTeamMembership(false, userTeam, user);
+    tick();
+
+    expect(teamServiceMock.updateOrAddTeamMembership).toHaveBeenCalledTimes(1);
+    expect(teamServiceMock.updateOrAddTeamMembership).toHaveBeenCalledWith(user.id, userTeam);
+    expect(userServiceMock.getUserById).toHaveBeenCalledWith(user.id);
+  }));
+
+  it('updateTeamRole should set isAdmin only after successfull request', fakeAsync(() => {
+    const user = testUser;
+    const userTeam = { ...testUser.userTeamList[0] };
+    userTeam.isTeamAdmin = false;
+
+    teamServiceMock.updateOrAddTeamMembership.mockReturnValue(of(null).pipe(delay(10)));
+    userServiceMock.getUserById.mockReturnValue(of(user));
+
+    component.updateTeamMembership(true, userTeam, user);
+
+    expect(userTeam.isTeamAdmin).toBeFalsy();
+    tick(11);
+    expect(userTeam.isTeamAdmin).toBeTruthy();
+  }));
+});
diff --git a/frontend/src/app/team-management/member-detail/member-detail.component.ts b/frontend/src/app/team-management/member-detail/member-detail.component.ts
new file mode 100644
index 0000000000..b840c238fa
--- /dev/null
+++ b/frontend/src/app/team-management/member-detail/member-detail.component.ts
@@ -0,0 +1,136 @@
+import { ChangeDetectorRef, Component, OnDestroy, OnInit, ViewChild } from '@angular/core';
+import { UserService } from '../../services/user.service';
+import { BehaviorSubject, filter, mergeMap, Subject, takeUntil, tap } from 'rxjs';
+import { getFullNameFromUser, User } from '../../shared/types/model/User';
+import { ActivatedRoute, ParamMap, Router } from '@angular/router';
+import { Team } from '../../shared/types/model/Team';
+import { UserTeam } from '../../shared/types/model/UserTeam';
+import { TranslateService } from '@ngx-translate/core';
+import { MatTable } from '@angular/material/table';
+import { TeamService } from '../../services/team.service';
+import { MatDialog, MatDialogConfig } from '@angular/material/dialog';
+import { CancelDialogComponent, CancelDialogData } from '../../shared/dialog/cancel-dialog/cancel-dialog.component';
+import { OKR_DIALOG_CONFIG } from '../../shared/constantLibary';
+
+@Component({
+  selector: 'app-member-detail',
+  templateUrl: './member-detail.component.html',
+  styleUrl: './member-detail.component.scss',
+})
+export class MemberDetailComponent implements OnInit, OnDestroy {
+  @ViewChild(MatTable) table!: MatTable<User[]>;
+
+  user: User | undefined;
+  teams: Team[] = [];
+  currentUserTeams$ = new BehaviorSubject<UserTeam[]>([]);
+  selectedUserIsLoggedInUser: boolean = false;
+  unsubscribe$ = new Subject<void>();
+  userTeamEditId: number | undefined;
+
+  readonly displayedColumns = ['team', 'role', 'delete'];
+  readonly getFullNameFromUser = getFullNameFromUser;
+
+  constructor(
+    private readonly userService: UserService,
+    private readonly route: ActivatedRoute,
+    private readonly translateService: TranslateService,
+    private readonly teamService: TeamService,
+    private readonly cd: ChangeDetectorRef,
+    private readonly router: Router,
+    private readonly dialog: MatDialog,
+  ) {}
+  ngOnInit(): void {
+    this.route.paramMap
+      .pipe(
+        takeUntil(this.unsubscribe$),
+        tap((params) => {
+          const id = this.getIdFromParams(params);
+          this.loadUser(id);
+        }),
+      )
+      .subscribe();
+  }
+
+  ngOnDestroy(): void {
+    this.unsubscribe$.next();
+    this.unsubscribe$.complete();
+  }
+
+  private loadUser(userId: number) {
+    this.userService
+      .getUserById(userId)
+      .pipe(tap((user) => this.setSelectedUserIsLoggedinUser(user)))
+      .subscribe((user) => {
+        this.user = user;
+        this.currentUserTeams$.next(user.userTeamList);
+        this.cd.markForCheck();
+      });
+  }
+
+  private setSelectedUserIsLoggedinUser(selectedUser: User) {
+    this.selectedUserIsLoggedInUser = selectedUser.id === this.userService.getCurrentUser().id;
+  }
+
+  private getIdFromParams(params: ParamMap): number {
+    const id = params.get('id');
+    if (!id) {
+      throw Error('member id is undefined');
+    }
+    return parseInt(id);
+  }
+
+  removeUserFromTeam(userTeam: UserTeam, user: User) {
+    const dialogConfig: MatDialogConfig<CancelDialogData> = OKR_DIALOG_CONFIG;
+    dialogConfig.data = {
+      dialogTitle: getFullNameFromUser(user) + ` wirklich aus Team ${userTeam.team.name} entfernen?`,
+    };
+    this.dialog
+      .open(CancelDialogComponent, dialogConfig)
+      .afterClosed()
+      .pipe(
+        filter((confirm) => confirm),
+        mergeMap(() => this.teamService.removeUserFromTeam(user.id, userTeam.team)),
+      )
+      .subscribe(() => {
+        this.loadUser(user.id);
+        this.userService.reloadUsers();
+      });
+  }
+
+  updateTeamMembership(isAdmin: boolean, userTeam: UserTeam, user: User) {
+    this.userTeamEditId = undefined;
+    // make a copy and set value of real object after successful request
+    const newUserTeam = { ...userTeam };
+    newUserTeam.isTeamAdmin = isAdmin;
+    this.teamService.updateOrAddTeamMembership(user.id, newUserTeam).subscribe(() => {
+      userTeam.isTeamAdmin = isAdmin;
+      this.loadUser(user.id);
+      this.userService.reloadUsers();
+      this.userService.reloadCurrentUser().subscribe();
+    });
+  }
+
+  addTeamMembership(userTeam: UserTeam, user: User) {
+    this.userTeamEditId = undefined;
+    this.teamService.updateOrAddTeamMembership(user.id, userTeam).subscribe(() => {
+      this.loadUser(user.id);
+      this.userService.reloadUsers();
+      this.userService.reloadCurrentUser().subscribe();
+    });
+  }
+
+  isDeletable(userTeam: UserTeam): boolean {
+    return userTeam.team.writeable || this.selectedUserIsLoggedInUser;
+  }
+
+  navigateBack() {
+    this.router.navigate(['../'], { relativeTo: this.route.parent });
+  }
+
+  isOkrChampionChange(okrChampion: boolean, user: User) {
+    this.userService.setIsOkrChampion(user, okrChampion).subscribe(() => {
+      this.loadUser(user.id);
+      this.teamService.reloadTeams();
+    });
+  }
+}
diff --git a/frontend/src/app/team-management/member-list/member-list-mobile/member-list-mobile.component.html b/frontend/src/app/team-management/member-list/member-list-mobile/member-list-mobile.component.html
new file mode 100644
index 0000000000..195caec149
--- /dev/null
+++ b/frontend/src/app/team-management/member-list/member-list-mobile/member-list-mobile.component.html
@@ -0,0 +1,20 @@
+@for (member of dataSource.data; track member.id) {
+  <div class="member" [routerLink]="getMemberDetailsLink(member)">
+    <div class="member-icon">
+      <mat-icon>person_outline</mat-icon>
+    </div>
+    <div class="member-content">
+      <div [ngClass]="{ 'single-line': !member.teams.length }">
+        <a [routerLink]="getMemberDetailsLink(member)">{{ getFullNameFromUser(member) }}</a>
+      </div>
+      @if (member.teams.length) {
+        <div>{{ member.teams }}</div>
+      }
+    </div>
+    <div class="member-next">
+      <mat-icon>arrow_forward_ios</mat-icon>
+    </div>
+  </div>
+} @empty {
+  <p>Keine Members</p>
+}
diff --git a/frontend/src/app/team-management/member-list/member-list-mobile/member-list-mobile.component.scss b/frontend/src/app/team-management/member-list/member-list-mobile/member-list-mobile.component.scss
new file mode 100644
index 0000000000..d0705913e0
--- /dev/null
+++ b/frontend/src/app/team-management/member-list/member-list-mobile/member-list-mobile.component.scss
@@ -0,0 +1,44 @@
+@import "variables";
+
+:host {
+  padding-top: 2rem;
+  display: block;
+}
+
+.member {
+  display: flex;
+  width: 100%;
+  margin-bottom: 0.5rem;
+  padding: 1rem;
+  background-color: $light-grey;
+
+  .member-icon {
+    width: 40px;
+    display: flex;
+    align-items: center;
+  }
+
+  .member-content {
+    flex: 1 1 auto;
+    display: flex;
+    flex-direction: column;
+
+    div {
+      flex: 1 1 50%;
+
+      &.single-line {
+        line-height: 1.5 !important;
+      }
+    }
+
+    div:nth-child(2) {
+      margin-top: 0.5rem;
+    }
+  }
+
+  .member-next {
+    display: flex;
+    align-items: center;
+    justify-content: center;
+  }
+}
diff --git a/frontend/src/app/team-management/member-list/member-list-mobile/member-list-mobile.component.spec.ts b/frontend/src/app/team-management/member-list/member-list-mobile/member-list-mobile.component.spec.ts
new file mode 100644
index 0000000000..200f261abb
--- /dev/null
+++ b/frontend/src/app/team-management/member-list/member-list-mobile/member-list-mobile.component.spec.ts
@@ -0,0 +1,48 @@
+import { ComponentFixture, TestBed } from '@angular/core/testing';
+
+import { MemberListMobileComponent } from './member-list-mobile.component';
+import { Team } from '../../../shared/types/model/Team';
+import { BehaviorSubject } from 'rxjs';
+import { team1 } from '../../../shared/testData';
+import { UserTableEntry } from '../../../shared/types/model/UserTableEntry';
+import { MatTableDataSource } from '@angular/material/table';
+
+describe('MemberListMobileComponent', () => {
+  let component: MemberListMobileComponent;
+  let fixture: ComponentFixture<MemberListMobileComponent>;
+
+  beforeEach(async () => {
+    await TestBed.configureTestingModule({
+      declarations: [MemberListMobileComponent],
+    }).compileComponents();
+
+    fixture = TestBed.createComponent(MemberListMobileComponent);
+    component = fixture.componentInstance;
+
+    component.dataSource = new MatTableDataSource<UserTableEntry>([]);
+
+    fixture.detectChanges();
+  });
+
+  it('should create', () => {
+    expect(component).toBeTruthy();
+  });
+
+  it('should navigate to correct path if no team is selected', () => {
+    component.selectedTeam$ = new BehaviorSubject<Team | undefined>(undefined);
+    const userTableEntry: any = {
+      id: 1,
+    };
+    expect(component.getMemberDetailsLink(userTableEntry)).toStrictEqual('/team-management/details/member/1');
+  });
+
+  it('should navigate to correct path team is selected', () => {
+    component.selectedTeam$ = new BehaviorSubject<Team | undefined>(team1);
+    const userTableEntry: any = {
+      id: 1,
+    };
+    expect(component.getMemberDetailsLink(userTableEntry)).toStrictEqual(
+      `/team-management/${team1.id}/details/member/1`,
+    );
+  });
+});
diff --git a/frontend/src/app/team-management/member-list/member-list-mobile/member-list-mobile.component.ts b/frontend/src/app/team-management/member-list/member-list-mobile/member-list-mobile.component.ts
new file mode 100644
index 0000000000..9f87b00fd1
--- /dev/null
+++ b/frontend/src/app/team-management/member-list/member-list-mobile/member-list-mobile.component.ts
@@ -0,0 +1,27 @@
+import { Component, Input, OnInit } from '@angular/core';
+import { UserTableEntry } from '../../../shared/types/model/UserTableEntry';
+import { MatTableDataSource } from '@angular/material/table';
+import { BehaviorSubject } from 'rxjs';
+import { Team } from '../../../shared/types/model/Team';
+import { getFullNameFromUser } from '../../../shared/types/model/User';
+import { getRouteToUserDetails } from '../../../shared/routeUtils';
+
+@Component({
+  selector: 'app-member-list-mobile',
+  templateUrl: './member-list-mobile.component.html',
+  styleUrl: './member-list-mobile.component.scss',
+})
+export class MemberListMobileComponent implements OnInit {
+  @Input({ required: true }) dataSource!: MatTableDataSource<UserTableEntry>;
+  @Input() selectedTeam$!: BehaviorSubject<Team | undefined>;
+
+  constructor() {}
+
+  ngOnInit(): void {}
+
+  getMemberDetailsLink(userTableEntry: UserTableEntry) {
+    return getRouteToUserDetails(userTableEntry.id, this.selectedTeam$.value?.id);
+  }
+
+  protected readonly getFullNameFromUser = getFullNameFromUser;
+}
diff --git a/frontend/src/app/team-management/member-list/member-list-table/member-list-table.component.html b/frontend/src/app/team-management/member-list/member-list-table/member-list-table.component.html
new file mode 100644
index 0000000000..f1d49dc54e
--- /dev/null
+++ b/frontend/src/app/team-management/member-list/member-list-table/member-list-table.component.html
@@ -0,0 +1,87 @@
+<table mat-table [dataSource]="dataSource" class="mat-elevation-z8 okr-table">
+  <ng-container matColumnDef="icon">
+    <th mat-header-cell *matHeaderCellDef></th>
+    <td mat-cell *matCellDef="let element">
+      <app-puzzle-icon icon="person-icon.svg" alt="Member Icon"></app-puzzle-icon>
+    </td>
+  </ng-container>
+
+  <ng-container matColumnDef="name">
+    <th mat-header-cell *matHeaderCellDef>Name</th>
+    <td mat-cell *matCellDef="let element">
+      <a [routerLink]="getMemberDetailsLink(element, selectedTeam$.value)">
+        {{ element.firstname }} {{ element.lastname }}
+      </a>
+    </td>
+  </ng-container>
+
+  <!--  all roles for all teams view-->
+  <ng-container matColumnDef="roles">
+    <th mat-header-cell *matHeaderCellDef>Rolle</th>
+    <td mat-cell *matCellDef="let element">{{ element.roles | roles }}</td>
+  </ng-container>
+
+  <!--  single role with edit for team view-->
+  <ng-container matColumnDef="role">
+    <th mat-header-cell *matHeaderCellDef>Rolle</th>
+    <td mat-cell *matCellDef="let element">
+      <app-show-edit-role
+        *ngIf="element.userTeamList.length"
+        [userTeam]="getSingleUserTeam(element)"
+        (save)="saveUserTeamMembership($event, element, getSingleUserTeam(element))"
+      ></app-show-edit-role>
+    </td>
+  </ng-container>
+
+  <ng-container matColumnDef="teams">
+    <th mat-header-cell *matHeaderCellDef>Teams</th>
+    <td mat-cell *matCellDef="let element" [title]="element.teams | teams: undefined">
+      {{ element.teams | teams: 2 }}
+    </td>
+  </ng-container>
+
+  <ng-container matColumnDef="okr_champion">
+    <th mat-header-cell *matHeaderCellDef>OKR Champion</th>
+    <td mat-cell *matCellDef="let element">
+      {{ element.isOkrChampion | okrChampion }}
+    </td>
+  </ng-container>
+
+  <ng-container matColumnDef="menu">
+    <th mat-header-cell *matHeaderCellDef></th>
+    <td mat-cell *matCellDef="let element">
+      <div class="menu" *ngIf="selectedTeam$.value?.writeable">
+        <app-puzzle-icon-button
+          (click)="$event.stopPropagation()"
+          [matMenuTriggerFor]="userMenu"
+          [attr.data-testId]="'member-list-more'"
+          icon="three-dot-menu-icon.svg"
+          alt="More Icon"
+        >
+        </app-puzzle-icon-button>
+        <mat-menu #userMenu="matMenu">
+          <button
+            (click)="removeMemberFromTeam(element, $event)"
+            mat-menu-item
+            [attr.data-testId]="'remove-from-member-list'"
+          >
+            <app-puzzle-icon icon="delete-icon.svg" alt="Remove Icon"></app-puzzle-icon>
+            <span class="font-size-14">Member entfernen</span>
+          </button>
+        </mat-menu>
+      </div>
+    </td>
+  </ng-container>
+
+  <tr mat-header-row *matHeaderRowDef="displayedColumns"></tr>
+  <tr
+    mat-row
+    class="cursor-pointer"
+    [routerLink]="getMemberDetailsLink(row, selectedTeam$.value)"
+    *matRowDef="let row; columns: displayedColumns"
+  ></tr>
+
+  <tr class="mat-row" *matNoDataRow>
+    <td class="mat-cell px-2" [attr.colspan]="displayedColumns.length">Keine Members</td>
+  </tr>
+</table>
diff --git a/frontend/src/app/team-management/member-list/member-list-table/member-list-table.component.scss b/frontend/src/app/team-management/member-list/member-list-table/member-list-table.component.scss
new file mode 100644
index 0000000000..2f0dd5c531
--- /dev/null
+++ b/frontend/src/app/team-management/member-list/member-list-table/member-list-table.component.scss
@@ -0,0 +1,18 @@
+@import "variables";
+
+.mat-column-icon {
+  width: 40px;
+}
+
+.mat-column-name {
+  width: 30%;
+}
+
+.mat-column-menu {
+  width: 40px;
+  padding: 0;
+}
+
+.mat-column-okr_champion {
+  width: 120px;
+}
diff --git a/frontend/src/app/team-management/member-list/member-list-table/member-list-table.component.spec.ts b/frontend/src/app/team-management/member-list/member-list-table/member-list-table.component.spec.ts
new file mode 100644
index 0000000000..35aac07df4
--- /dev/null
+++ b/frontend/src/app/team-management/member-list/member-list-table/member-list-table.component.spec.ts
@@ -0,0 +1,159 @@
+import { ComponentFixture, fakeAsync, TestBed, tick } from '@angular/core/testing';
+
+import { MemberListTableComponent } from './member-list-table.component';
+import { team1, testUser } from '../../../shared/testData';
+import { BehaviorSubject, of } from 'rxjs';
+import { UserTableEntry } from '../../../shared/types/model/UserTableEntry';
+import { UserService } from '../../../services/user.service';
+import { TeamService } from '../../../services/team.service';
+import { Team } from '../../../shared/types/model/Team';
+import { MatTableModule } from '@angular/material/table';
+import { MatDialog } from '@angular/material/dialog';
+
+describe('MemberListTableComponent', () => {
+  let component: MemberListTableComponent;
+  let fixture: ComponentFixture<MemberListTableComponent>;
+
+  const userServiceMock = {
+    getUsers: jest.fn(),
+    reloadUsers: jest.fn(),
+    reloadCurrentUser: jest.fn(),
+  };
+
+  const teamServiceMock = {
+    getAllTeams: jest.fn(),
+    deleteTeam: jest.fn(),
+    removeUserFromTeam: jest.fn(),
+    updateOrAddTeamMembership: jest.fn(),
+  };
+
+  const dialogMock = {
+    open: jest.fn(),
+  };
+
+  beforeEach(async () => {
+    await TestBed.configureTestingModule({
+      imports: [MatTableModule],
+      declarations: [MemberListTableComponent],
+      providers: [
+        { provide: UserService, useValue: userServiceMock },
+        { provide: TeamService, useValue: teamServiceMock },
+        { provide: MatDialog, useValue: dialogMock },
+      ],
+    }).compileComponents();
+
+    fixture = TestBed.createComponent(MemberListTableComponent);
+
+    component = fixture.componentInstance;
+
+    component.selectedTeam$ = new BehaviorSubject<Team | undefined>(undefined);
+    teamServiceMock.removeUserFromTeam.mockReset();
+    userServiceMock.reloadUsers.mockReset();
+    userServiceMock.reloadCurrentUser.mockReset();
+
+    fixture.detectChanges();
+  });
+
+  afterEach(() => {
+    teamServiceMock.removeUserFromTeam.mockReset();
+  });
+
+  it('should create', () => {
+    expect(component).toBeTruthy();
+  });
+
+  it('should set displayedColumns for all teams correctly', fakeAsync(() => {
+    component.selectedTeam$.next(undefined);
+    tick();
+    expect(component.displayedColumns).toStrictEqual(['icon', 'name', 'roles', 'teams', 'okr_champion']);
+  }));
+
+  it('should set displayedColumns for admin team correctly', fakeAsync(() => {
+    component.selectedTeam$.next(team1);
+    tick();
+    expect(component.displayedColumns).toStrictEqual(['icon', 'name', 'role']);
+  }));
+
+  it('should set displayedColumns for admin team correctly', fakeAsync(() => {
+    const team = { ...team1 };
+    team.writeable = true;
+    component.selectedTeam$.next(team);
+    tick();
+    expect(component.displayedColumns).toStrictEqual(['icon', 'name', 'role', 'menu']);
+  }));
+
+  it('should return correct memberDetailsLink', () => {
+    expect(component.getMemberDetailsLink(testUser)).toStrictEqual('/team-management/details/member/' + testUser.id);
+  });
+
+  it('removeMemberFromTeam should call removeUserFromTeam and reloadUsers if confirmed', fakeAsync(() => {
+    const entry = {
+      id: 1,
+    };
+    component.selectedTeam$.next(team1);
+    teamServiceMock.removeUserFromTeam.mockReturnValue(of(null));
+    userServiceMock.reloadUsers.mockReturnValue(of());
+    userServiceMock.reloadCurrentUser.mockReturnValue(of());
+    dialogMock.open.mockReturnValue({
+      afterClosed: () => of(true),
+    });
+
+    component.removeMemberFromTeam(entry as UserTableEntry, new MouseEvent('click'));
+    tick();
+
+    expect(teamServiceMock.removeUserFromTeam).toBeCalledTimes(1);
+    expect(teamServiceMock.removeUserFromTeam).toBeCalledWith(entry.id, component.selectedTeam$.value);
+    expect(userServiceMock.reloadUsers).toBeCalledTimes(1);
+    expect(userServiceMock.reloadCurrentUser).toBeCalledTimes(1);
+  }));
+
+  it('removeMemberFromTeam should not call removeUserFromTeam and reloadUsers if not confirmed', fakeAsync(() => {
+    const entry = {
+      id: 1,
+    };
+    component.selectedTeam$.next(team1);
+    teamServiceMock.removeUserFromTeam.mockReturnValue(of(null));
+    userServiceMock.reloadUsers.mockReturnValue(of());
+    userServiceMock.reloadCurrentUser.mockReturnValue(of());
+    dialogMock.open.mockReturnValue({
+      afterClosed: () => of(false),
+    });
+
+    component.removeMemberFromTeam(entry as UserTableEntry, new MouseEvent('click'));
+    tick();
+
+    expect(teamServiceMock.removeUserFromTeam).toBeCalledTimes(0);
+    expect(userServiceMock.reloadUsers).toBeCalledTimes(0);
+    expect(userServiceMock.reloadCurrentUser).toBeCalledTimes(0);
+  }));
+
+  it('saveUserTeamRole should call updateOrAddTeamMembership and reload users', fakeAsync(() => {
+    teamServiceMock.updateOrAddTeamMembership.mockReturnValue(of(null));
+    userServiceMock.reloadCurrentUser.mockReturnValue(of());
+    const entry = {
+      id: 1,
+    } as any;
+    const ut = testUser.userTeamList[0];
+    component.saveUserTeamMembership(true, entry, ut);
+    tick();
+    expect(teamServiceMock.updateOrAddTeamMembership).toHaveBeenCalledWith(entry.id, ut);
+    expect(userServiceMock.reloadUsers).toHaveBeenCalledTimes(1);
+    expect(userServiceMock.reloadCurrentUser).toHaveBeenCalledTimes(1);
+  }));
+
+  it('getSingleUserTeam should return first userTeam uf userTableEntry', () => {
+    const ut = {
+      userTeamList: [testUser.userTeamList[0]],
+    } as any;
+    expect(component.getSingleUserTeam(ut)).toStrictEqual(testUser.userTeamList[0]);
+  });
+
+  it('getSingleUserTeam should throw error if userTeamList.length is not 1', () => {
+    const ut = {
+      userTeamList: [testUser.userTeamList[0], testUser.userTeamList[0]],
+    } as any;
+    expect(() => component.getSingleUserTeam(ut)).toThrowError('it should have exactly one UserTeam at this point');
+    ut.userTeamList = [];
+    expect(() => component.getSingleUserTeam(ut)).toThrowError('it should have exactly one UserTeam at this point');
+  });
+});
diff --git a/frontend/src/app/team-management/member-list/member-list-table/member-list-table.component.ts b/frontend/src/app/team-management/member-list/member-list-table/member-list-table.component.ts
new file mode 100644
index 0000000000..64f21c9c79
--- /dev/null
+++ b/frontend/src/app/team-management/member-list/member-list-table/member-list-table.component.ts
@@ -0,0 +1,102 @@
+import { Component, Input, OnDestroy, OnInit } from '@angular/core';
+import { MatTableDataSource } from '@angular/material/table';
+import { UserTableEntry } from '../../../shared/types/model/UserTableEntry';
+import { User } from '../../../shared/types/model/User';
+import { Team } from '../../../shared/types/model/Team';
+import { TeamService } from '../../../services/team.service';
+import { UserService } from '../../../services/user.service';
+import { getRouteToUserDetails } from '../../../shared/routeUtils';
+import { BehaviorSubject, filter, mergeMap, Subject, takeUntil } from 'rxjs';
+import { UserTeam } from '../../../shared/types/model/UserTeam';
+import { MatDialog, MatDialogConfig } from '@angular/material/dialog';
+import { CancelDialogComponent, CancelDialogData } from '../../../shared/dialog/cancel-dialog/cancel-dialog.component';
+import { OKR_DIALOG_CONFIG } from '../../../shared/constantLibary';
+
+@Component({
+  selector: 'app-member-list-table',
+  templateUrl: './member-list-table.component.html',
+  styleUrl: './member-list-table.component.scss',
+})
+export class MemberListTableComponent implements OnInit, OnDestroy {
+  @Input({ required: true }) dataSource!: MatTableDataSource<UserTableEntry>;
+  @Input({ required: true }) selectedTeam$!: BehaviorSubject<undefined | Team>;
+
+  private allColumns = ['icon', 'name', 'roles', 'teams', 'okr_champion'];
+  private teamColumns = ['icon', 'name', 'role'];
+  private unsubscribe$ = new Subject<void>();
+
+  displayedColumns: string[] = this.allColumns;
+
+  constructor(
+    private readonly teamService: TeamService,
+    private readonly userService: UserService,
+    private readonly dialog: MatDialog,
+  ) {}
+
+  ngOnInit() {
+    this.selectedTeam$.pipe(takeUntil(this.unsubscribe$)).subscribe((team) => {
+      team ? this.setColumnForTeam(team) : this.setColumnsForAllTeams();
+    });
+  }
+
+  ngOnDestroy() {
+    this.unsubscribe$.next();
+    this.unsubscribe$.complete();
+  }
+
+  private setColumnForTeam(team: Team) {
+    this.displayedColumns = [...this.teamColumns];
+    if (team.writeable) {
+      this.displayedColumns.push('menu');
+    }
+  }
+
+  private setColumnsForAllTeams() {
+    this.displayedColumns = this.allColumns;
+  }
+
+  removeMemberFromTeam(entry: UserTableEntry, event: MouseEvent) {
+    event.stopPropagation();
+    event.preventDefault();
+
+    const dialogConfig: MatDialogConfig<CancelDialogData> = OKR_DIALOG_CONFIG;
+    dialogConfig.data = {
+      dialogTitle: `${entry.firstname} ${entry.lastname} wirklich aus Team ${this.selectedTeam$.value?.name} entfernen?`,
+    };
+    this.dialog
+      .open(CancelDialogComponent, dialogConfig)
+      .afterClosed()
+      .pipe(
+        filter((confirm) => confirm),
+        mergeMap(() => this.teamService.removeUserFromTeam(entry.id, this.selectedTeam$.value!)),
+      )
+      .subscribe(() => {
+        this.userService.reloadUsers();
+        this.userService.reloadCurrentUser().subscribe();
+      });
+  }
+
+  saveUserTeamMembership(isAdmin: boolean, userTableEntry: UserTableEntry, userTeam: UserTeam): void {
+    // make a copy and set value only after successful request
+    const newUserTeam = { ...userTeam };
+    newUserTeam.isTeamAdmin = isAdmin;
+    this.teamService.updateOrAddTeamMembership(userTableEntry.id, newUserTeam).subscribe(() => {
+      userTeam.isTeamAdmin = isAdmin;
+      this.userService.reloadUsers();
+      this.userService.reloadCurrentUser().subscribe();
+    });
+  }
+
+  getMemberDetailsLink(user: User, team?: Team) {
+    return getRouteToUserDetails(user.id, team?.id);
+  }
+
+  // this method is only used in Team context. Therefore, it should only have one userTeam.
+  // otherwise the method will throw an exception
+  getSingleUserTeam(userTableEntry: UserTableEntry): UserTeam {
+    if (userTableEntry.userTeamList.length !== 1) {
+      throw Error('it should have exactly one UserTeam at this point');
+    }
+    return userTableEntry.userTeamList[0];
+  }
+}
diff --git a/frontend/src/app/team-management/member-list/member-list.component.html b/frontend/src/app/team-management/member-list/member-list.component.html
new file mode 100644
index 0000000000..24d6ff39ff
--- /dev/null
+++ b/frontend/src/app/team-management/member-list/member-list.component.html
@@ -0,0 +1,79 @@
+<div>
+  <div id="member-header">
+    <div class="team-title">
+      <div class="d-flex px-3">
+        <h2 *ngIf="selectedTeam$.value">{{ selectedTeam$.value!.name }}</h2>
+        <app-puzzle-icon-button
+          *ngIf="selectedTeam$.value?.writeable"
+          (click)="editTeam()"
+          [attr.data-testId]="'editTeamButton'"
+          icon="edit.svg"
+          alt="Edit Team Icon"
+        >
+        </app-puzzle-icon-button>
+        <h2 *ngIf="!selectedTeam$.value">Alle Teams</h2>
+      </div>
+      <div class="d-none d-md-flex flex-grow-1">
+        <p>Members: {{ dataSource.data.length }}</p>
+      </div>
+    </div>
+    <div class="action-button d-none d-md-flex">
+      <button
+        *ngIf="showAddMemberToTeam()"
+        (click)="addMemberToTeam()"
+        [attr.data-testId]="'add-team-member'"
+        class="align-new-icon mdc-button px-0 pe-2"
+        color="primary"
+        mat-button
+      >
+        <span class="d-flex align-items-center fw-bold add-text">
+          <img alt="Add key-result button" class="add-cross-button" src="/assets/icons/new-icon.svg" />
+          Member hinzufügen
+        </span>
+      </button>
+      <button
+        *ngIf="showInviteMember()"
+        (click)="inviteMember()"
+        [attr.data-testId]="'invite-member'"
+        class="align-new-icon"
+        color="primary"
+        mat-button
+      >
+        <span class="d-flex align-items-center fw-bold add-text">
+          <img alt="Add key-result button" class="add-cross-button" src="/assets/icons/new-icon.svg" />
+          Member registrieren
+        </span>
+      </button>
+    </div>
+    <div class="menu mx-2" *ngIf="selectedTeam$.value?.writeable">
+      <app-puzzle-icon-button
+        icon="three-dot-menu-icon.svg"
+        alt="Menu Icon"
+        [matMenuTriggerFor]="menu"
+        [attr.data-testId]="'teamMoreButton'"
+      ></app-puzzle-icon-button>
+      <mat-menu #menu="matMenu">
+        <button
+          class="d-block d-md-none"
+          (click)="deleteTeam(selectedTeam$.value!)"
+          mat-menu-item
+          [attr.data-testId]="'teamAddMemberButton'"
+        >
+          <span>Member hinzufügen</span>
+        </button>
+        <button (click)="deleteTeam(selectedTeam$.value!)" mat-menu-item [attr.data-testId]="'teamDeleteButton'">
+          <app-puzzle-icon icon="delete-icon.svg" alt="Delete Team"></app-puzzle-icon>
+          <span class="font-size-14">Team löschen</span>
+        </button>
+      </mat-menu>
+    </div>
+  </div>
+  <p class="d-block d-md-none text-small mx-2 mt-2">Members: {{ dataSource.data.length }}</p>
+
+  <div class="d-none d-md-block">
+    <app-member-list-table [dataSource]="dataSource" [selectedTeam$]="selectedTeam$"></app-member-list-table>
+  </div>
+  <div class="d-block d-md-none">
+    <app-member-list-mobile [dataSource]="dataSource" [selectedTeam$]="selectedTeam$"></app-member-list-mobile>
+  </div>
+</div>
diff --git a/frontend/src/app/team-management/member-list/member-list.component.scss b/frontend/src/app/team-management/member-list/member-list.component.scss
new file mode 100644
index 0000000000..be6472086d
--- /dev/null
+++ b/frontend/src/app/team-management/member-list/member-list.component.scss
@@ -0,0 +1,53 @@
+@import "../../../style/_variables.scss";
+
+:host {
+  width: 100%;
+  display: flex;
+  justify-content: flex-start;
+
+  div {
+    max-width: 800px;
+    flex: 1 0 0;
+
+    #member-header {
+      display: flex;
+      align-items: center;
+      background-color: $dark-grey;
+      width: 100%;
+      min-height: 57px;
+      justify-content: space-between;
+
+      div {
+        display: flex;
+        align-items: end;
+
+        &.team-title {
+          align-items: flex-end;
+
+          div {
+            flex: 0 0 auto;
+            align-items: flex-end;
+
+            h2 {
+              margin-bottom: 0;
+              padding-right: 0.2rem;
+            }
+
+            p {
+              font-size: 0.75rem;
+              font-weight: bold;
+              padding-left: 0.5rem;
+            }
+          }
+        }
+        &.menu {
+          flex: 0 0 0;
+        }
+        &.action-button {
+          flex: 0 0 auto;
+          padding-right: 1rem;
+        }
+      }
+    }
+  }
+}
diff --git a/frontend/src/app/team-management/member-list/member-list.component.spec.ts b/frontend/src/app/team-management/member-list/member-list.component.spec.ts
new file mode 100644
index 0000000000..82097ccee8
--- /dev/null
+++ b/frontend/src/app/team-management/member-list/member-list.component.spec.ts
@@ -0,0 +1,256 @@
+import { ComponentFixture, fakeAsync, TestBed, tick } from '@angular/core/testing';
+import { ActivatedRoute, Router } from '@angular/router';
+import { ChangeDetectorRef } from '@angular/core';
+import { of } from 'rxjs';
+import { MemberListComponent } from './member-list.component';
+import { UserService } from '../../services/user.service';
+import { HttpClientTestingModule } from '@angular/common/http/testing';
+import { User } from '../../shared/types/model/User';
+import { team1, team2, team3, testUser, users } from '../../shared/testData';
+import { convertFromUser, convertFromUsers, UserTableEntry } from '../../shared/types/model/UserTableEntry';
+import { UserRole } from '../../shared/types/enums/UserRole';
+import { TeamService } from '../../services/team.service';
+import { MatDialog } from '@angular/material/dialog';
+import { AddMemberToTeamDialogComponent } from '../add-member-to-team-dialog/add-member-to-team-dialog.component';
+import { OKR_DIALOG_CONFIG } from '../../shared/constantLibary';
+import { AddEditTeamDialog } from '../add-edit-team-dialog/add-edit-team-dialog.component';
+import { TranslateTestingModule } from 'ngx-translate-testing';
+import { MatTableDataSource } from '@angular/material/table';
+import { BrowserAnimationsModule } from '@angular/platform-browser/animations';
+import { MemberListTableComponent } from './member-list-table/member-list-table.component';
+import { MemberListMobileComponent } from './member-list-mobile/member-list-mobile.component';
+
+const userServiceMock = {
+  getUsers: jest.fn(),
+  reloadUsers: jest.fn(),
+  reloadCurrentUser: jest.fn(),
+  getCurrentUser: jest.fn(),
+};
+
+const teamServiceMock = {
+  getAllTeams: jest.fn(),
+  deleteTeam: jest.fn(),
+  removeUserFromTeam: jest.fn(),
+};
+
+const activatedRouteMock = {
+  paramMap: {} as any,
+};
+
+const routerMock = {
+  navigateByUrl: jest.fn(),
+};
+
+const dialogMock = {
+  open: jest.fn(),
+};
+
+describe('MemberListComponent', () => {
+  let component: MemberListComponent;
+  let fixture: ComponentFixture<MemberListComponent>;
+
+  beforeEach(() => {
+    TestBed.configureTestingModule({
+      declarations: [MemberListComponent, MemberListTableComponent, MemberListMobileComponent],
+      imports: [HttpClientTestingModule, TranslateTestingModule, BrowserAnimationsModule],
+      providers: [
+        { provide: UserService, useValue: userServiceMock },
+        { provide: ActivatedRoute, useValue: activatedRouteMock },
+        { provide: TeamService, useValue: teamServiceMock },
+        { provide: Router, useValue: routerMock },
+        { provide: MatDialog, useValue: dialogMock },
+        ChangeDetectorRef,
+      ],
+    });
+
+    fixture = TestBed.createComponent(MemberListComponent);
+    component = fixture.componentInstance;
+
+    activatedRouteMock.paramMap = of({
+      get: () => team1.id,
+    });
+
+    userServiceMock.reloadCurrentUser.mockReset();
+    userServiceMock.reloadUsers.mockReset();
+
+    jest.spyOn(userServiceMock, 'getUsers').mockReturnValue(of([]));
+    userServiceMock.reloadCurrentUser.mockReturnValue(of(testUser));
+    userServiceMock.getCurrentUser.mockReturnValue(of(testUser));
+  });
+
+  afterEach(() => {
+    teamServiceMock.deleteTeam.mockReset();
+  });
+
+  it('should create', () => {
+    expect(component).toBeTruthy();
+  });
+
+  it('should test method convertFromUser', () => {
+    const user: User = { ...testUser };
+    let userTableEntry = convertFromUser(user);
+
+    expect(userTableEntry.id).toBe(user.id);
+    expect(userTableEntry.firstname).toBe(user.firstname);
+    expect(userTableEntry.lastname).toBe(user.lastname);
+    expect(userTableEntry.email).toBe(user.email);
+    expect(userTableEntry.roles).toStrictEqual([UserRole.TEAM_MEMBER]);
+    expect(userTableEntry.isOkrChampion).toBeFalsy();
+    expect(userTableEntry.teams).toStrictEqual([team1.name]);
+    expect(userTableEntry.userTeamList).toStrictEqual(user.userTeamList);
+
+    user.userTeamList.push({
+      id: 2,
+      team: team2,
+      isTeamAdmin: true,
+    });
+    user.isOkrChampion = true;
+
+    userTableEntry = convertFromUser(user);
+
+    expect(userTableEntry.roles).toStrictEqual([UserRole.TEAM_ADMIN, UserRole.TEAM_MEMBER]);
+    expect(userTableEntry.isOkrChampion).toBeTruthy();
+    expect(userTableEntry.teams).toStrictEqual([team1.name, team2.name]);
+    expect(userTableEntry.userTeamList).toStrictEqual(user.userTeamList);
+  });
+
+  it('should test method convertFromUsers', () => {
+    const usersCopy: User[] = JSON.parse(JSON.stringify(users));
+    usersCopy[0].userTeamList.push({
+      id: 1,
+      team: team1,
+      isTeamAdmin: true,
+    });
+    usersCopy[0].isOkrChampion = true;
+    usersCopy[1].userTeamList.push({
+      id: 2,
+      team: team1,
+      isTeamAdmin: false,
+    });
+    usersCopy[2].userTeamList.push({
+      id: 3,
+      team: team2,
+      isTeamAdmin: false,
+    });
+    usersCopy[3].userTeamList.push(
+      {
+        id: 4,
+        team: team1,
+        isTeamAdmin: false,
+      },
+      {
+        id: 5,
+        team: team2,
+        isTeamAdmin: true,
+      },
+    );
+
+    let userTableEntries = convertFromUsers(usersCopy, null);
+    expect(userTableEntries.length).toBe(4);
+    // test that it makes a deep copy
+    expect(userTableEntries).not.toBe(usersCopy);
+    // should be sorted
+    expect(userTableEntries.map((ut) => ut.firstname)).toStrictEqual(['Bob', 'Key Result', 'Paco', 'Robin']);
+  });
+
+  it('ngAfterViewInit should load all Users, set teamId, selectedTeam and update data source correctly', fakeAsync(() => {
+    userServiceMock.getUsers.mockReturnValue(of(users));
+    teamServiceMock.getAllTeams.mockReturnValue(of([team1, team2, team3]));
+    component.ngAfterViewInit();
+    tick();
+    expect(teamServiceMock.getAllTeams).toHaveBeenCalledTimes(1);
+    expect(component.selectedTeam$.value).toBe(team1);
+    expect(component.dataSource.data.length).toBe(1);
+    expect(component.dataSource.data[0].teams[0]).toBe(team1.name);
+  }));
+
+  it('ngAfterViewInit should load all Users, set teamId, selectedTeam and update data source correctly if teamIdParam is null', fakeAsync(() => {
+    activatedRouteMock.paramMap = of({
+      get: () => null,
+    });
+    TestBed.runInInjectionContext(() => {
+      userServiceMock.getUsers.mockReturnValue(of(users));
+      teamServiceMock.getAllTeams.mockReturnValue(of([team1, team2, team3]));
+      component.ngAfterViewInit();
+      tick();
+      expect(component.selectedTeam$.value).toBe(undefined);
+      expect(component.dataSource.data.length).toBe(users.length);
+    });
+  }));
+
+  it('deleteTeam should trigger teamService.deleteTeam and navigate', fakeAsync(() => {
+    routerMock.navigateByUrl.mockReturnValue(of(null));
+    teamServiceMock.deleteTeam.mockReturnValue(of(null));
+    dialogMock.open.mockReturnValue({
+      afterClosed: () => of(true),
+    });
+
+    const team = team1;
+
+    component.deleteTeam(team);
+    tick();
+
+    expect(teamServiceMock.deleteTeam).toBeCalledTimes(1);
+    expect(teamServiceMock.deleteTeam).toBeCalledWith(team.id);
+    expect(routerMock.navigateByUrl).toBeCalledWith('team-management');
+    expect(routerMock.navigateByUrl).toBeCalledTimes(1);
+    expect(userServiceMock.reloadUsers).toBeCalledTimes(1);
+    expect(userServiceMock.reloadCurrentUser).toBeCalledTimes(1);
+  }));
+
+  it('deleteTeam should not trigger teamService.deleteTeam if dialog is canceled', fakeAsync(() => {
+    routerMock.navigateByUrl.mockReturnValue(of(null));
+    teamServiceMock.deleteTeam.mockReturnValue(of(null));
+    dialogMock.open.mockReturnValue({
+      afterClosed: () => of(false),
+    });
+
+    component.deleteTeam(team1);
+    tick();
+
+    expect(teamServiceMock.deleteTeam).toBeCalledTimes(0);
+  }));
+
+  it('addMemberToTeam should open dialog', () => {
+    component.selectedTeam$.next(team1);
+    component.dataSource = new MatTableDataSource<UserTableEntry>([]);
+    dialogMock.open.mockReturnValue({
+      afterClosed: () => of(null),
+    });
+    component.addMemberToTeam();
+
+    const expectedDialogConfig = OKR_DIALOG_CONFIG;
+    expectedDialogConfig.data = {
+      team: team1,
+      currentUsersOfTeam: component.dataSource,
+    };
+
+    expect(dialogMock.open).toBeCalledWith(AddMemberToTeamDialogComponent, expectedDialogConfig);
+  });
+
+  it('should showAddMemberToTeam if selectedTeam is set and selectedTeam is writable', () => {
+    component.selectedTeam$.next(undefined);
+    expect(component.showAddMemberToTeam()).toBeFalsy();
+    const teamCopy = { ...team1 };
+    teamCopy.writeable = false;
+    component.selectedTeam$.next(teamCopy);
+    expect(component.showAddMemberToTeam()).toBeFalsy();
+    teamCopy.writeable = true;
+    expect(component.showAddMemberToTeam()).toBeTruthy();
+  });
+
+  it('edit team should open dialog', () => {
+    component.selectedTeam$.next(team1);
+    dialogMock.open.mockReturnValue({
+      afterClosed: () => of(null),
+    });
+    component.editTeam();
+
+    const expectedDialogConfig = OKR_DIALOG_CONFIG;
+    expectedDialogConfig.data = {
+      team: team1,
+    };
+
+    expect(dialogMock.open).toBeCalledWith(AddEditTeamDialog, expectedDialogConfig);
+  });
+});
diff --git a/frontend/src/app/team-management/member-list/member-list.component.ts b/frontend/src/app/team-management/member-list/member-list.component.ts
new file mode 100644
index 0000000000..6091de2642
--- /dev/null
+++ b/frontend/src/app/team-management/member-list/member-list.component.ts
@@ -0,0 +1,141 @@
+import { AfterViewInit, ChangeDetectorRef, Component, OnDestroy, OnInit } from '@angular/core';
+import { UserService } from '../../services/user.service';
+import { ActivatedRoute, Router } from '@angular/router';
+import { BehaviorSubject, combineLatest, filter, map, mergeMap, ReplaySubject, Subject, takeUntil } from 'rxjs';
+import { User } from '../../shared/types/model/User';
+import { convertFromUsers, UserTableEntry } from '../../shared/types/model/UserTableEntry';
+import { TeamService } from '../../services/team.service';
+import { Team } from '../../shared/types/model/Team';
+import { MatDialog, MatDialogConfig } from '@angular/material/dialog';
+import {
+  AddMemberToTeamDialogComponent,
+  AddMemberToTeamDialogComponentData,
+} from '../add-member-to-team-dialog/add-member-to-team-dialog.component';
+import { OKR_DIALOG_CONFIG } from '../../shared/constantLibary';
+import { AddEditTeamDialog } from '../add-edit-team-dialog/add-edit-team-dialog.component';
+import { MatTableDataSource } from '@angular/material/table';
+import { CancelDialogComponent, CancelDialogData } from '../../shared/dialog/cancel-dialog/cancel-dialog.component';
+import { InviteUserDialogComponent } from '../invite-user-dialog/invite-user-dialog.component';
+
+@Component({
+  selector: 'app-member-list',
+  templateUrl: './member-list.component.html',
+  styleUrl: './member-list.component.scss',
+})
+export class MemberListComponent implements OnInit, OnDestroy, AfterViewInit {
+  dataSource: MatTableDataSource<UserTableEntry> = new MatTableDataSource<UserTableEntry>([]);
+  selectedTeam$: BehaviorSubject<Team | undefined> = new BehaviorSubject<Team | undefined>(undefined);
+
+  private allUsersSubj: ReplaySubject<User[]> = new ReplaySubject<User[]>(1);
+  private unsubscribe$ = new Subject<void>();
+
+  public constructor(
+    private readonly userService: UserService,
+    private readonly route: ActivatedRoute,
+    private readonly cd: ChangeDetectorRef,
+    private readonly teamService: TeamService,
+    private readonly router: Router,
+    private readonly dialog: MatDialog,
+  ) {}
+
+  public ngOnInit(): void {}
+
+  public ngAfterViewInit() {
+    this.userService
+      .getUsers()
+      .pipe(takeUntil(this.unsubscribe$))
+      .subscribe((users) => this.allUsersSubj.next(users));
+    const teamId$ = this.route.paramMap.pipe(map((params) => params.get('teamId')));
+    combineLatest([this.allUsersSubj.asObservable(), teamId$, this.teamService.getAllTeams()])
+      .pipe(takeUntil(this.unsubscribe$))
+      .subscribe(([users, teamIdParam, teams]) => {
+        this.setSelectedTeam(teams, teamIdParam);
+        this.setDataSourceForTeamOrAll(users, teamIdParam);
+      });
+  }
+
+  public ngOnDestroy(): void {
+    this.unsubscribe$.next();
+    this.unsubscribe$.complete();
+  }
+
+  private setSelectedTeam(teams: Team[], teamIdParam: string | null) {
+    if (!teamIdParam) {
+      this.selectedTeam$.next(undefined);
+      return;
+    }
+    const team = teams.find((t) => t.id === parseInt(teamIdParam));
+    this.selectedTeam$.next(team);
+    this.cd.markForCheck();
+  }
+
+  private setDataSourceForTeamOrAll(users: User[], teamIdParam: string | null) {
+    if (!teamIdParam) {
+      this.setDataSourceForAllTeams(users);
+      this.cd.markForCheck();
+      return;
+    }
+    this.setDataSourceForTeam(teamIdParam, users);
+    this.cd.markForCheck();
+  }
+
+  private setDataSourceForAllTeams(users: User[]) {
+    this.dataSource.data = convertFromUsers(users, null);
+  }
+
+  private setDataSourceForTeam(teamIdParam: string, users: User[]) {
+    const teamId = parseInt(teamIdParam);
+    this.dataSource.data = convertFromUsers(users, teamId);
+  }
+
+  deleteTeam(selectedTeam: Team) {
+    const dialogConfig: MatDialogConfig<CancelDialogData> = OKR_DIALOG_CONFIG;
+    dialogConfig.data = {
+      dialogTitle: selectedTeam.name + ' wirklich löschen?',
+      dialogText: 'Soll das Team und dessen OKRs wirklich gelöscht werden?',
+    };
+    this.dialog
+      .open(CancelDialogComponent, dialogConfig)
+      .afterClosed()
+      .pipe(
+        filter((confirm) => confirm),
+        mergeMap(() => this.teamService.deleteTeam(selectedTeam.id)),
+      )
+      .subscribe(() => {
+        this.userService.reloadUsers();
+        this.userService.reloadCurrentUser().subscribe();
+        this.router.navigateByUrl('team-management');
+      });
+  }
+
+  addMemberToTeam() {
+    const dialogConfig: MatDialogConfig<AddMemberToTeamDialogComponentData> = OKR_DIALOG_CONFIG;
+    dialogConfig.data = {
+      team: this.selectedTeam$.value!,
+      currentUsersOfTeam: this.dataSource.data,
+    };
+    const dialogRef = this.dialog.open(AddMemberToTeamDialogComponent, dialogConfig);
+    dialogRef.afterClosed().subscribe(() => this.cd.markForCheck());
+  }
+
+  inviteMember() {
+    this.dialog.open(InviteUserDialogComponent, OKR_DIALOG_CONFIG).afterClosed().subscribe();
+  }
+
+  showInviteMember(): boolean {
+    return !this.selectedTeam$.value && this.userService.getCurrentUser().isOkrChampion;
+  }
+
+  showAddMemberToTeam() {
+    return this.selectedTeam$.value?.writeable;
+  }
+
+  editTeam(): void {
+    const dialogConfig = OKR_DIALOG_CONFIG;
+    dialogConfig.data = {
+      team: this.selectedTeam$.value,
+    };
+    const dialogRef = this.dialog.open(AddEditTeamDialog, dialogConfig);
+    dialogRef.afterClosed().subscribe(() => this.cd.markForCheck());
+  }
+}
diff --git a/frontend/src/app/team-management/new-user/new-user.component.html b/frontend/src/app/team-management/new-user/new-user.component.html
new file mode 100644
index 0000000000..c05f8b7764
--- /dev/null
+++ b/frontend/src/app/team-management/new-user/new-user.component.html
@@ -0,0 +1,78 @@
+<div class="d-flex w-100" [formGroup]="userFormGroup">
+  <div class="firstname equal-sized-col">
+    <div class="input-style">
+      @if (index === 0) {
+        <label [for]="'firstName-col_' + index">Vorname&nbsp;*</label>
+      }
+      <input
+        type="text"
+        class="value-field dialog-form-field"
+        formControlName="firstname"
+        #firstInput
+        [id]="'firstName-col_' + index"
+        [name]="'firstName-col_' + index"
+      />
+      <mat-error>
+        @if (firstname.errors?.["required"] && triedToSubmit) {
+          <span>Angabe benötigt</span>
+        }
+      </mat-error>
+    </div>
+  </div>
+  <div class="lastname equal-sized-col">
+    <div class="input-style equal-sized-col">
+      @if (index === 0) {
+        <label [for]="'lastname-col_' + index">Nachname&nbsp;*</label>
+      }
+      <input
+        type="text"
+        [id]="'lastname-col_' + index"
+        [name]="'lastname-col_' + index"
+        class="value-field dialog-form-field"
+        formControlName="lastname"
+      />
+      <mat-error>
+        @if (lastname.errors?.["required"] && triedToSubmit) {
+          <span>Angabe benötigt</span>
+        }
+      </mat-error>
+    </div>
+  </div>
+  <div class="email equal-sized-col">
+    <div class="input-style equal-sized-col">
+      @if (index === 0) {
+        <label [for]="'email-col_' + index">E-Mail&nbsp;*</label>
+      }
+      <input
+        type="email"
+        [id]="'email-col_' + index"
+        [attr.data-testId]="'email-col_' + index"
+        [name]="'email-col_' + index"
+        class="value-field dialog-form-field"
+        formControlName="email"
+      />
+      <mat-error>
+        @if (email.errors?.["required"] && triedToSubmit) {
+          <span>Angabe benötigt</span>
+        } @else if (email.errors?.["notUniqueMail"]) {
+          <span>E-Mail existiert bereits</span>
+        } @else if (email.errors?.["email"] && triedToSubmit) {
+          <span>E-Mail ungültig</span>
+        }
+      </mat-error>
+    </div>
+  </div>
+  <div class="remove">
+    <div class="input-style equal-sized-col dialog-form-field">
+      @if (index === 0) {
+        <label [for]="'delete-col_' + index">&nbsp;</label>
+      }
+      <app-puzzle-icon-button
+        (click)="remove()"
+        [id]="'delete-col_' + index"
+        icon="delete-icon.svg"
+        alt="Remove User Icon"
+      ></app-puzzle-icon-button>
+    </div>
+  </div>
+</div>
diff --git a/frontend/src/app/team-management/new-user/new-user.component.scss b/frontend/src/app/team-management/new-user/new-user.component.scss
new file mode 100644
index 0000000000..bf3f55c9af
--- /dev/null
+++ b/frontend/src/app/team-management/new-user/new-user.component.scss
@@ -0,0 +1,17 @@
+:host {
+  width: 100%;
+  > div {
+    gap: 0.5rem;
+  }
+}
+.equal-sized-col {
+  flex: 1 0 0;
+  min-width: 0;
+
+  label {
+    margin-bottom: 0.75rem;
+  }
+}
+.delete {
+  display: flex;
+}
diff --git a/frontend/src/app/team-management/new-user/new-user.component.spec.ts b/frontend/src/app/team-management/new-user/new-user.component.spec.ts
new file mode 100644
index 0000000000..3934b994ad
--- /dev/null
+++ b/frontend/src/app/team-management/new-user/new-user.component.spec.ts
@@ -0,0 +1,37 @@
+import { ComponentFixture, TestBed } from '@angular/core/testing';
+
+import { NewUserComponent } from './new-user.component';
+import { FormControl, FormGroup, FormsModule, NgForm, ReactiveFormsModule } from '@angular/forms';
+import { SharedModule } from '../../shared/shared.module';
+import { PuzzleIconButtonComponent } from '../../shared/custom/puzzle-icon-button/puzzle-icon-button.component';
+import { PuzzleIconComponent } from '../../shared/custom/puzzle-icon/puzzle-icon.component';
+import { CommonModule } from '@angular/common';
+import { NewUserForm } from '../../shared/types/model/NewUserForm';
+
+describe('NewUserComponent', () => {
+  let component: NewUserComponent;
+  let fixture: ComponentFixture<NewUserComponent>;
+
+  beforeEach(async () => {
+    await TestBed.configureTestingModule({
+      declarations: [NewUserComponent, PuzzleIconButtonComponent, PuzzleIconComponent],
+      imports: [FormsModule, ReactiveFormsModule, SharedModule, CommonModule],
+      providers: [NgForm],
+    }).compileComponents();
+
+    fixture = TestBed.createComponent(NewUserComponent);
+    component = fixture.componentInstance;
+
+    component.userFormGroup = new FormGroup<NewUserForm<FormControl>>({
+      firstname: new FormControl<any>('user1'),
+      lastname: new FormControl<any>('user'),
+      email: new FormControl<any>('test@test.ch'),
+    });
+
+    fixture.detectChanges();
+  });
+
+  it('should create', () => {
+    expect(component).toBeTruthy();
+  });
+});
diff --git a/frontend/src/app/team-management/new-user/new-user.component.ts b/frontend/src/app/team-management/new-user/new-user.component.ts
new file mode 100644
index 0000000000..2ef11f8b3c
--- /dev/null
+++ b/frontend/src/app/team-management/new-user/new-user.component.ts
@@ -0,0 +1,54 @@
+import {
+  AfterViewInit,
+  ChangeDetectionStrategy,
+  Component,
+  EventEmitter,
+  Input,
+  Output,
+  ViewChild,
+} from '@angular/core';
+import { ControlContainer, FormControl, FormGroup, NgForm } from '@angular/forms';
+import { NewUserForm } from '../../shared/types/model/NewUserForm';
+
+@Component({
+  selector: 'app-new-user',
+  templateUrl: './new-user.component.html',
+  styleUrl: './new-user.component.scss',
+  viewProviders: [{ provide: ControlContainer, useExisting: NgForm }],
+  changeDetection: ChangeDetectionStrategy.Default,
+})
+export class NewUserComponent implements AfterViewInit {
+  @Input({ required: true })
+  index!: number;
+
+  @Input({ required: true })
+  userFormGroup!: FormGroup<NewUserForm<FormControl>>;
+
+  @Input({ required: true })
+  triedToSubmit!: boolean;
+
+  @Output()
+  removeUser: EventEmitter<void> = new EventEmitter<void>();
+
+  @ViewChild('firstInput') firstInput: any;
+
+  ngAfterViewInit(): void {
+    this.firstInput.nativeElement.focus();
+  }
+
+  remove() {
+    this.removeUser.emit();
+  }
+
+  get firstname() {
+    return this.userFormGroup.controls.firstname;
+  }
+
+  get lastname() {
+    return this.userFormGroup.controls.lastname;
+  }
+
+  get email() {
+    return this.userFormGroup.controls.email;
+  }
+}
diff --git a/frontend/src/app/team-management/new-user/unique-mail.directive.spec.ts b/frontend/src/app/team-management/new-user/unique-mail.directive.spec.ts
new file mode 100644
index 0000000000..7e8a654721
--- /dev/null
+++ b/frontend/src/app/team-management/new-user/unique-mail.directive.spec.ts
@@ -0,0 +1,40 @@
+import { UniqueEmailValidator } from './unique-mail.validator';
+import { users } from '../../shared/testData';
+import { TestBed } from '@angular/core/testing';
+import { of } from 'rxjs';
+import { AbstractControl } from '@angular/forms';
+
+describe('UniqueMailDirective', () => {
+  const userServiceMock = {
+    getUsers: jest.fn(),
+  } as any;
+
+  beforeEach(() => {
+    userServiceMock.getUsers.mockReturnValue(of(users));
+  });
+
+  it('should create an instance', () => {
+    TestBed.runInInjectionContext(() => {
+      const directive = new UniqueEmailValidator(userServiceMock);
+      expect(directive).toBeTruthy();
+    });
+  });
+
+  it('should return validationError if user exists, otherwise null', () => {
+    TestBed.runInInjectionContext(() => {
+      const directive = new UniqueEmailValidator(userServiceMock);
+
+      let control = { value: users[0].email } as AbstractControl;
+      expect(directive.validate(control)).toStrictEqual({ notUniqueMail: { value: users[0].email } });
+
+      const notExistingMail = 'notexistinguser@test.com';
+      control = { value: notExistingMail } as AbstractControl;
+      expect(directive.validate(control)).toStrictEqual(null);
+
+      directive.setAddedMails([notExistingMail]);
+      expect(directive.validate(control)).toStrictEqual({ notUniqueMail: { value: notExistingMail } });
+
+      expect(directive).toBeTruthy();
+    });
+  });
+});
diff --git a/frontend/src/app/team-management/new-user/unique-mail.validator.ts b/frontend/src/app/team-management/new-user/unique-mail.validator.ts
new file mode 100644
index 0000000000..99d66782d8
--- /dev/null
+++ b/frontend/src/app/team-management/new-user/unique-mail.validator.ts
@@ -0,0 +1,28 @@
+import { Injectable } from '@angular/core';
+import { AbstractControl, ValidationErrors, Validator } from '@angular/forms';
+import { UserService } from '../../services/user.service';
+import { takeUntilDestroyed } from '@angular/core/rxjs-interop';
+
+@Injectable({ providedIn: 'root' })
+export class UniqueEmailValidator implements Validator {
+  private existingUserMails: string[] = []; // mails exsiting already in backend
+  private addedMails: string[] = []; // mails added in form
+
+  constructor(private readonly userService: UserService) {
+    this.userService
+      .getUsers()
+      .pipe(takeUntilDestroyed())
+      .subscribe((users) => {
+        this.existingUserMails = users.map((u) => u.email);
+      });
+  }
+
+  validate(control: AbstractControl): ValidationErrors | null {
+    const existingUser = this.existingUserMails.concat(this.addedMails).includes(control.value);
+    return existingUser ? { notUniqueMail: { value: control.value } } : null;
+  }
+
+  setAddedMails(mails: string[]) {
+    this.addedMails = mails;
+  }
+}
diff --git a/frontend/src/app/team-management/okr-champion.pipe.spec.ts b/frontend/src/app/team-management/okr-champion.pipe.spec.ts
new file mode 100644
index 0000000000..335c9b93f4
--- /dev/null
+++ b/frontend/src/app/team-management/okr-champion.pipe.spec.ts
@@ -0,0 +1,22 @@
+import { OkrChampionPipe } from './okr-champion.pipe';
+
+describe('OkrChampionPipe', () => {
+  const translateMock = {
+    instant: () => 'Ja',
+  } as any;
+
+  it('create an instance', () => {
+    const pipe = new OkrChampionPipe(translateMock);
+    expect(pipe).toBeTruthy();
+  });
+
+  it('should display "Ja" if user is okrChampion', () => {
+    const pipe = new OkrChampionPipe(translateMock);
+    expect(pipe.transform(true)).toBe('Ja');
+  });
+
+  it('should display "-" if user is not okrChampion', () => {
+    const pipe = new OkrChampionPipe(translateMock);
+    expect(pipe.transform(false)).toBe('-');
+  });
+});
diff --git a/frontend/src/app/team-management/okr-champion.pipe.ts b/frontend/src/app/team-management/okr-champion.pipe.ts
new file mode 100644
index 0000000000..f9b893bcb6
--- /dev/null
+++ b/frontend/src/app/team-management/okr-champion.pipe.ts
@@ -0,0 +1,14 @@
+import { Pipe, PipeTransform } from '@angular/core';
+import { TranslateService } from '@ngx-translate/core';
+
+@Pipe({
+  name: 'okrChampion',
+  standalone: true,
+})
+export class OkrChampionPipe implements PipeTransform {
+  constructor(private readonly translate: TranslateService) {}
+
+  transform(isOkrChampion: boolean): string {
+    return isOkrChampion ? this.translate.instant('SHARED.JA') : '-';
+  }
+}
diff --git a/frontend/src/app/team-management/roles.pipe.ts b/frontend/src/app/team-management/roles.pipe.ts
new file mode 100644
index 0000000000..cad972ab85
--- /dev/null
+++ b/frontend/src/app/team-management/roles.pipe.ts
@@ -0,0 +1,17 @@
+import { Pipe, PipeTransform } from '@angular/core';
+import { UserRole } from '../shared/types/enums/UserRole';
+import { TranslateService } from '@ngx-translate/core';
+
+@Pipe({
+  name: 'roles',
+})
+export class RolesPipe implements PipeTransform {
+  constructor(private translate: TranslateService) {}
+
+  transform(roles: UserRole[]): string {
+    if (!roles?.length) {
+      return '';
+    }
+    return roles.map((r) => this.translate.instant('USER_ROLE.' + r)).join(', ');
+  }
+}
diff --git a/frontend/src/app/team-management/search-team-management/search-team-management.component.html b/frontend/src/app/team-management/search-team-management/search-team-management.component.html
new file mode 100644
index 0000000000..ac1698d547
--- /dev/null
+++ b/frontend/src/app/team-management/search-team-management/search-team-management.component.html
@@ -0,0 +1,41 @@
+<form class="d-flex search-form">
+  <mat-form-field
+    id="search-member-form-field"
+    class="bg-white header-form-field"
+    ngDefaultControl
+    subscriptSizing="dynamic"
+    appearance="outline"
+  >
+    <input
+      type="text"
+      [placeholder]="'TEAM_MANAGEMENT.INPUT_PLACEHOLDER' | translate"
+      matInput
+      [formControl]="search"
+      [matAutocomplete]="auto"
+      [attr.data-testId]="'teamManagementSearch'"
+    />
+    <mat-autocomplete
+      #auto="matAutocomplete"
+      class="autocomplete-bigger"
+      [attr.data-testId]="'teamManagementSearchResult'"
+      [autoActiveFirstOption]="true"
+    >
+      <mat-optgroup [label]="'TEAM_MANAGEMENT.USERS' | translate" *ngIf="(filteredUsers$ | async)?.length">
+        <mat-option *ngFor="let user of filteredUsers$ | async" (onSelectionChange)="selectUser(user)">
+          <span [innerHtml]="user.htmlValue"></span>
+        </mat-option>
+      </mat-optgroup>
+      <mat-optgroup [label]="'TEAM_MANAGEMENT.TEAMS' | translate" *ngIf="(filteredTeams$ | async)?.length">
+        <mat-option *ngFor="let team of filteredTeams$ | async" (onSelectionChange)="selectTeam(team)">
+          <span [innerHtml]="team.htmlValue"></span>
+        </mat-option>
+      </mat-optgroup>
+    </mat-autocomplete>
+  </mat-form-field>
+  <button
+    class="bg-pz-dark-blue d-flex justify-content-center align-items-center icon-button px-3 focus-outline"
+    type="submit"
+  >
+    <mat-icon aria-hidden="false" aria-label="Search Icon" fontIcon="search" class="text-white"></mat-icon>
+  </button>
+</form>
diff --git a/frontend/src/app/team-management/search-team-management/search-team-management.component.scss b/frontend/src/app/team-management/search-team-management/search-team-management.component.scss
new file mode 100644
index 0000000000..566d039998
--- /dev/null
+++ b/frontend/src/app/team-management/search-team-management/search-team-management.component.scss
@@ -0,0 +1,9 @@
+#search-member-form-field {
+  width: 100%;
+}
+
+mat-optgroup {
+  & > span {
+    font-size: 0.5rem;
+  }
+}
diff --git a/frontend/src/app/team-management/search-team-management/search-team-management.component.spec.ts b/frontend/src/app/team-management/search-team-management/search-team-management.component.spec.ts
new file mode 100644
index 0000000000..aaa1f893e4
--- /dev/null
+++ b/frontend/src/app/team-management/search-team-management/search-team-management.component.spec.ts
@@ -0,0 +1,216 @@
+import { ComponentFixture, TestBed } from '@angular/core/testing';
+import { HttpClientTestingModule } from '@angular/common/http/testing';
+import { RouterTestingModule } from '@angular/router/testing';
+import { MatAutocompleteModule } from '@angular/material/autocomplete';
+import { SharedModule } from '../../shared/shared.module';
+import { MatInputModule } from '@angular/material/input';
+import { BrowserAnimationsModule } from '@angular/platform-browser/animations';
+import { FilteredTeam, FilteredUser, SearchTeamManagementComponent } from './search-team-management.component';
+import { TranslateTestingModule } from 'ngx-translate-testing';
+import * as de from '../../../assets/i18n/de.json';
+import { MatIconModule } from '@angular/material/icon';
+import { ReactiveFormsModule } from '@angular/forms';
+import { TeamService } from '../../services/team.service';
+import { UserService } from '../../services/user.service';
+import { of } from 'rxjs';
+import { Team } from '../../shared/types/model/Team';
+import { User } from '../../shared/types/model/User';
+import { ActivatedRoute, ActivatedRouteSnapshot, Router } from '@angular/router';
+import Spy = jasmine.Spy;
+
+const teams: Team[] = [
+  {
+    id: 1,
+    version: 1,
+    name: 'ZZ the Puzzle Team - Keyword',
+    writeable: false,
+  },
+  {
+    id: 2,
+    version: 1,
+    name: 'The Puzzle Team - Keyword',
+    writeable: false,
+  },
+  {
+    id: 3,
+    version: 1,
+    name: 'Puzzle Team - No',
+    writeable: false,
+  },
+  {
+    id: 4,
+    version: 1,
+    name: 'Team Ruedi - Noname',
+    writeable: false,
+  },
+];
+
+const users: User[] = [
+  {
+    id: 2,
+    firstname: 'Pete',
+    lastname: 'Parrot',
+    email: 'parrot@puzzle.ch',
+    userTeamList: [],
+    isOkrChampion: false,
+  },
+  {
+    id: 1,
+    firstname: 'Martin',
+    lastname: 'Käser',
+    email: 'kaeser@puzzle.ch',
+    userTeamList: [],
+    isOkrChampion: false,
+  },
+  {
+    id: 3,
+    firstname: 'Ruedi',
+    lastname: 'Peters',
+    email: 'rpeter@gmail.com',
+    userTeamList: [],
+    isOkrChampion: false,
+  },
+];
+
+describe('SearchTeamManagementComponent', () => {
+  let component: SearchTeamManagementComponent;
+  let fixture: ComponentFixture<SearchTeamManagementComponent>;
+
+  let teamServiceMock: Partial<TeamService>;
+  let userServiceMock: Partial<UserService>;
+  let activatedRouteMock: Partial<ActivatedRoute>;
+  let navigateSpy: Spy;
+  beforeEach(async () => {
+    jest.useFakeTimers();
+
+    teamServiceMock = {
+      getAllTeams: () => {
+        return of(teams);
+      },
+    };
+
+    userServiceMock = {
+      getUsers: () => {
+        return of(users);
+      },
+    };
+
+    activatedRouteMock = {
+      snapshot: {
+        params: {},
+      } as unknown as ActivatedRouteSnapshot,
+    };
+
+    await TestBed.configureTestingModule({
+      imports: [
+        HttpClientTestingModule,
+        RouterTestingModule.withRoutes([]),
+        BrowserAnimationsModule,
+        MatAutocompleteModule,
+        ReactiveFormsModule,
+        MatInputModule,
+        MatIconModule,
+        TranslateTestingModule.withTranslations({
+          de: de,
+        }),
+        SharedModule,
+      ],
+      declarations: [SearchTeamManagementComponent],
+      providers: [
+        {
+          provide: TeamService,
+          useValue: teamServiceMock,
+        },
+        {
+          provide: UserService,
+          useValue: userServiceMock,
+        },
+        {
+          provide: ActivatedRoute,
+          useValue: activatedRouteMock,
+        },
+      ],
+    }).compileComponents();
+  });
+  beforeEach(() => {
+    navigateSpy = jest.spyOn(TestBed.inject(Router), 'navigateByUrl') as unknown as Spy;
+    fixture = TestBed.createComponent(SearchTeamManagementComponent);
+    component = fixture.componentInstance;
+
+    fixture.detectChanges();
+  });
+
+  afterEach(() => {
+    jest.clearAllTimers();
+  });
+
+  const getDisplayValues = (value: FilteredUser | FilteredTeam) => value.displayValue;
+  const getHTMLValues = (value: FilteredUser | FilteredTeam) => value.htmlValue;
+
+  it('should filter out entries and order them according to the position in which the search value occurs', () => {
+    component.search.setValue('puz');
+    fixture.detectChanges();
+    jest.advanceTimersByTime(250);
+
+    let filteredUsers = component.filteredUsers$.getValue();
+    let filteredTeams = component.filteredTeams$.getValue();
+    expect(filteredUsers.map(getDisplayValues)).toEqual([
+      'Pete Parrot (parrot@puzzle.ch)',
+      'Martin Käser (kaeser@puzzle.ch)',
+    ]);
+
+    expect(filteredTeams.map(getDisplayValues)).toEqual([
+      'Puzzle Team - No',
+      'The Puzzle Team - Keyword',
+      'ZZ the Puzzle Team - Keyword',
+    ]);
+  });
+
+  it('should generate html values correctly', () => {
+    component.search.setValue('Ruedi');
+    fixture.detectChanges();
+    jest.advanceTimersByTime(250);
+
+    let filteredUsers = component.filteredUsers$.getValue();
+    let filteredTeams = component.filteredTeams$.getValue();
+
+    expect(filteredUsers.map(getHTMLValues)).toEqual(['<strong>Ruedi</strong> Peters (rpeter@gmail.com)']);
+
+    expect(filteredTeams.map(getHTMLValues)).toEqual(['Team <strong>Ruedi</strong> - Noname']);
+  });
+
+  it('should debounce inputs correctly', () => {
+    component.search.setValue('Ruedi');
+    fixture.detectChanges();
+
+    jest.advanceTimersByTime(100); // After 100ms
+    expect(component.filteredUsers$.getValue()).toHaveLength(0);
+    expect(component.filteredTeams$.getValue()).toHaveLength(0);
+
+    jest.advanceTimersByTime(110); // After 210ms
+    expect(component.filteredUsers$.getValue()).not.toHaveLength(0);
+    expect(component.filteredTeams$.getValue()).not.toHaveLength(0);
+  });
+
+  it('should stay on current team page when a user is selected', () => {
+    activatedRouteMock!.snapshot!.params['teamId'] = '42';
+
+    component.selectUser(users[1]);
+
+    expect(navigateSpy).toHaveBeenCalledWith('/team-management/42/details/member/2');
+  });
+
+  it('should stay on current root page when a user is selected', () => {
+    activatedRouteMock!.snapshot!.params = {};
+
+    component.selectUser(users[1]);
+
+    expect(navigateSpy).toHaveBeenCalledWith('/team-management/details/member/2');
+  });
+
+  it('should switch to teams page when selected', () => {
+    component.selectTeam(teams[0]);
+
+    expect(navigateSpy).toHaveBeenCalledWith('/team-management/3');
+  });
+});
diff --git a/frontend/src/app/team-management/search-team-management/search-team-management.component.ts b/frontend/src/app/team-management/search-team-management/search-team-management.component.ts
new file mode 100644
index 0000000000..1d333f412a
--- /dev/null
+++ b/frontend/src/app/team-management/search-team-management/search-team-management.component.ts
@@ -0,0 +1,149 @@
+import { Component } from '@angular/core';
+import { FormControl } from '@angular/forms';
+import { UserService } from '../../services/user.service';
+import { TeamService } from '../../services/team.service';
+import { Team } from '../../shared/types/model/Team';
+import { User } from '../../shared/types/model/User';
+import { BehaviorSubject, combineLatest, debounceTime, distinctUntilChanged, map } from 'rxjs';
+import { takeUntilDestroyed } from '@angular/core/rxjs-interop';
+import { getRouteToTeam, getRouteToUserDetails } from '../../shared/routeUtils';
+import { ActivatedRoute, Router } from '@angular/router';
+
+export interface FilteredUser extends User {
+  displayValue: string;
+  htmlValue: string;
+}
+
+export interface FilteredTeam extends Team {
+  displayValue: string;
+  htmlValue: string;
+}
+
+@Component({
+  selector: 'app-search-team-management',
+  templateUrl: './search-team-management.component.html',
+  styleUrl: './search-team-management.component.scss',
+})
+export class SearchTeamManagementComponent {
+  static MAX_SUGGESTIONS = 3;
+  search = new FormControl('');
+
+  filteredUsers$ = new BehaviorSubject<FilteredUser[]>([]);
+  filteredTeams$ = new BehaviorSubject<FilteredTeam[]>([]);
+  searchValue$ = new BehaviorSubject<string>('');
+
+  private teams: Team[] = [];
+  private users: User[] = [];
+
+  constructor(
+    private readonly userService: UserService,
+    private readonly teamService: TeamService,
+    private readonly router: Router,
+    private readonly activatedRoute: ActivatedRoute,
+  ) {
+    combineLatest([teamService.getAllTeams(), userService.getUsers()])
+      .pipe(takeUntilDestroyed())
+      .subscribe(([teams, users]) => {
+        this.updateTeamsAndUsers(teams, users);
+        this.applyFilter(this.searchValue$.getValue());
+      });
+
+    this.search.valueChanges
+      .pipe(
+        takeUntilDestroyed(),
+        debounceTime(200),
+        map((v) => (v ? v.trim() : '')),
+        distinctUntilChanged(),
+      )
+      .subscribe((searchValue) => {
+        this.searchValue$.next(searchValue);
+      });
+
+    this.searchValue$.pipe(takeUntilDestroyed()).subscribe(() => {
+      this.applyFilter(this.searchValue$.getValue());
+    });
+  }
+
+  selectUser(user: User) {
+    this.search.setValue('');
+    const teamId: number = this.activatedRoute.snapshot.params['teamId'];
+    this.router.navigateByUrl(getRouteToUserDetails(user.id, teamId)).then();
+  }
+
+  selectTeam(team: Team) {
+    this.search.setValue('');
+    this.router.navigateByUrl(getRouteToTeam(team.id)).then();
+  }
+
+  private applyFilter(filterValue: string): void {
+    if (!filterValue.length) {
+      this.filteredUsers$.next([]);
+      this.filteredTeams$.next([]);
+      return;
+    }
+
+    this.filteredTeams$.next(
+      this.filterTeams(this.teams, filterValue)
+        .sort((a, b) => this.sortByStringPosition(a.displayValue, b.displayValue, filterValue))
+        .slice(0, SearchTeamManagementComponent.MAX_SUGGESTIONS),
+    );
+    this.filteredUsers$.next(
+      this.filterUsers(this.users, filterValue)
+        .sort((a, b) => this.sortByStringPosition(a.displayValue, b.displayValue, filterValue))
+        .slice(0, SearchTeamManagementComponent.MAX_SUGGESTIONS),
+    );
+  }
+
+  private sortByStringPosition(a: string, b: string, value: string): number {
+    const indexA = a.toLowerCase().indexOf(value);
+    const indexB = b.toLowerCase().indexOf(value);
+    if (indexA === indexB) {
+      return 0;
+    }
+
+    if (indexB === -1) {
+      return -1;
+    }
+
+    if (indexA === -1) {
+      return 1;
+    }
+
+    return indexA - indexB;
+  }
+
+  private updateTeamsAndUsers(teams: Team[], users: User[]) {
+    this.teams = teams.sort((a, b) => a.name.localeCompare(b.name));
+    this.users = users.sort((a, b) => (a.firstname + a.lastname).localeCompare(b.firstname + b.lastname));
+    this.applyFilter(this.searchValue$.getValue());
+  }
+
+  private filterTeams(teams: Team[], filterValue: string): FilteredTeam[] {
+    return teams
+      .filter((team) => this.containsText(team.name, filterValue))
+      .map((team) => ({
+        ...team,
+        displayValue: team.name,
+        htmlValue: this.formatText(team.name, filterValue),
+      }));
+  }
+
+  private filterUsers(users: User[], filterValue: string): FilteredUser[] {
+    return users
+      .filter((user) => this.containsText(user.firstname + user.lastname + user.email, filterValue))
+
+      .map((user) => ({
+        ...user,
+        displayValue: `${user.firstname} ${user.lastname} (${user.email})`,
+        htmlValue: this.formatText(`${user.firstname} ${user.lastname} (${user.email})`, filterValue),
+      }));
+  }
+
+  private containsText(value: string, text: string): boolean {
+    return value.toLowerCase().indexOf(text.toLowerCase()) >= 0;
+  }
+
+  private formatText(value: string, text: string): string {
+    return value.replaceAll(new RegExp(`(${text})`, 'ig'), `<strong>$1</strong>`);
+  }
+}
diff --git a/frontend/src/app/team-management/show-edit-role/show-edit-role.component.html b/frontend/src/app/team-management/show-edit-role/show-edit-role.component.html
new file mode 100644
index 0000000000..5d97bba7e7
--- /dev/null
+++ b/frontend/src/app/team-management/show-edit-role/show-edit-role.component.html
@@ -0,0 +1,19 @@
+<div class="role">
+  <ng-container *ngIf="!edit">
+    <span>{{ getRole() }}</span>
+    <app-puzzle-icon-button
+      *ngIf="isEditable()"
+      (click)="setEditAsync($event, true)"
+      [attr.data-testId]="'edit-role'"
+      icon="edit.svg"
+      alt="Edit Team Icon"
+    >
+    </app-puzzle-icon-button>
+  </ng-container>
+  <ng-container *ngIf="edit">
+    <app-team-role-dropdown
+      [isAdmin]="userTeam.isTeamAdmin"
+      (isAdminChange)="saveIsAdmin($event)"
+    ></app-team-role-dropdown>
+  </ng-container>
+</div>
diff --git a/frontend/src/app/team-management/show-edit-role/show-edit-role.component.scss b/frontend/src/app/team-management/show-edit-role/show-edit-role.component.scss
new file mode 100644
index 0000000000..c9c4398c0f
--- /dev/null
+++ b/frontend/src/app/team-management/show-edit-role/show-edit-role.component.scss
@@ -0,0 +1,8 @@
+.role {
+  display: flex;
+  flex-direction: row;
+  align-items: center;
+}
+app-puzzle-icon-button {
+  margin-left: 0.5rem;
+}
diff --git a/frontend/src/app/team-management/show-edit-role/show-edit-role.component.spec.ts b/frontend/src/app/team-management/show-edit-role/show-edit-role.component.spec.ts
new file mode 100644
index 0000000000..066a1fa945
--- /dev/null
+++ b/frontend/src/app/team-management/show-edit-role/show-edit-role.component.spec.ts
@@ -0,0 +1,46 @@
+import { ComponentFixture, fakeAsync, TestBed, tick } from '@angular/core/testing';
+
+import { ShowEditRoleComponent } from './show-edit-role.component';
+import { testUser } from '../../shared/testData';
+import { TranslateTestingModule } from 'ngx-translate-testing';
+import * as de from '../../../assets/i18n/de.json';
+
+describe('ShowEditRoleComponent', () => {
+  let component: ShowEditRoleComponent;
+  let fixture: ComponentFixture<ShowEditRoleComponent>;
+  const userTeam = { ...testUser.userTeamList[0] };
+
+  beforeEach(async () => {
+    await TestBed.configureTestingModule({
+      declarations: [ShowEditRoleComponent],
+      imports: [TranslateTestingModule.withTranslations({ de: de })],
+    }).compileComponents();
+
+    fixture = TestBed.createComponent(ShowEditRoleComponent);
+    component = fixture.componentInstance;
+
+    component.userTeam = userTeam;
+
+    fixture.detectChanges();
+  });
+
+  it('should create', () => {
+    expect(component).toBeTruthy();
+  });
+
+  it('saveIsAdmin should set edit to false', () => {
+    component.edit = true;
+    component.saveIsAdmin(true);
+    expect(component.edit).toBeFalsy();
+  });
+
+  it('setEditAsync should set edit to given value', fakeAsync(() => {
+    component.edit = false;
+    const mouseEvent = {
+      stopPropagation: () => undefined,
+    } as any;
+    component.setEditAsync(mouseEvent, true);
+    tick();
+    expect(component.edit).toBeTruthy();
+  }));
+});
diff --git a/frontend/src/app/team-management/show-edit-role/show-edit-role.component.ts b/frontend/src/app/team-management/show-edit-role/show-edit-role.component.ts
new file mode 100644
index 0000000000..cd8e8169ff
--- /dev/null
+++ b/frontend/src/app/team-management/show-edit-role/show-edit-role.component.ts
@@ -0,0 +1,57 @@
+import { ChangeDetectorRef, Component, ElementRef, EventEmitter, HostListener, Input, Output } from '@angular/core';
+import { UserTeam } from '../../shared/types/model/UserTeam';
+import { TranslateService } from '@ngx-translate/core';
+
+@Component({
+  selector: 'app-show-edit-role',
+  templateUrl: './show-edit-role.component.html',
+  styleUrl: './show-edit-role.component.scss',
+})
+export class ShowEditRoleComponent {
+  @Input({ required: true }) userTeam!: UserTeam;
+
+  @Output()
+  private readonly save = new EventEmitter<boolean>();
+
+  edit = false;
+
+  constructor(
+    private readonly translate: TranslateService,
+    private readonly elementRef: ElementRef,
+    private readonly cd: ChangeDetectorRef,
+  ) {}
+
+  @HostListener('document:click', ['$event'])
+  clickOutside(event: MouseEvent) {
+    if (this.elementRef.nativeElement.contains(event.target)) {
+      return;
+    }
+    this.edit = false;
+  }
+
+  // we set edit async, to ensure hostListener can detect outside-of-element clicks correctly
+  // otherwise element of event.target is already hidden
+  setEditAsync($event: MouseEvent, edit: boolean) {
+    $event.stopPropagation();
+    setTimeout(() => {
+      this.edit = edit;
+      this.cd.markForCheck();
+    }, 0);
+  }
+
+  saveIsAdmin(isAdmin: boolean) {
+    this.edit = false;
+    this.save.emit(isAdmin);
+  }
+
+  getRole(): string {
+    if (this.userTeam.isTeamAdmin) {
+      return this.translate.instant('USER_ROLE.TEAM_ADMIN');
+    }
+    return this.translate.instant('USER_ROLE.TEAM_MEMBER');
+  }
+
+  isEditable() {
+    return this.userTeam.team.writeable;
+  }
+}
diff --git a/frontend/src/app/team-management/team-list/team-list.component.html b/frontend/src/app/team-management/team-list/team-list.component.html
new file mode 100644
index 0000000000..556e268ce9
--- /dev/null
+++ b/frontend/src/app/team-management/team-list/team-list.component.html
@@ -0,0 +1,14 @@
+<div>
+  <mat-nav-list *ngIf="teams$ | async as teams">
+    <a mat-list-item routerLink="/team-management" [ngClass]="{ selected: selectedTeamId === undefined }"
+      >Alle Teams ({{ teams.length }})</a
+    >
+    <a
+      mat-list-item
+      *ngFor="let team of teams"
+      [routerLink]="['/team-management', team.id]"
+      [ngClass]="{ selected: selectedTeamId === team.id }"
+      >{{ team.name }}</a
+    >
+  </mat-nav-list>
+</div>
diff --git a/frontend/src/app/team-management/team-list/team-list.component.scss b/frontend/src/app/team-management/team-list/team-list.component.scss
new file mode 100644
index 0000000000..40f9dab8e7
--- /dev/null
+++ b/frontend/src/app/team-management/team-list/team-list.component.scss
@@ -0,0 +1,29 @@
+@import "../../../style/_variables.scss";
+
+:host {
+  width: 100%;
+  display: flex;
+  justify-content: center;
+
+  > div {
+    width: 300px;
+
+    > mat-nav-list {
+      padding: 0;
+
+      background-color: $light-grey;
+
+      .selected {
+        background-color: $pz-dark-blue;
+
+        ::ng-deep .mdc-list-item__primary-text {
+          color: white;
+        }
+      }
+
+      a {
+        cursor: pointer;
+      }
+    }
+  }
+}
diff --git a/frontend/src/app/team-management/team-list/team-list.component.spec.ts b/frontend/src/app/team-management/team-list/team-list.component.spec.ts
new file mode 100644
index 0000000000..b547fe18c8
--- /dev/null
+++ b/frontend/src/app/team-management/team-list/team-list.component.spec.ts
@@ -0,0 +1,58 @@
+import { ComponentFixture, TestBed } from '@angular/core/testing';
+import { of } from 'rxjs';
+import { ActivatedRoute } from '@angular/router';
+import { TeamService } from '../../services/team.service';
+import { TeamListComponent } from './team-list.component';
+
+describe('TeamListComponent', () => {
+  let component: TeamListComponent;
+  let fixture: ComponentFixture<TeamListComponent>;
+  let teamService: TeamService;
+  let route: ActivatedRoute;
+  const paramTeamId = 1;
+
+  const teamServiceMock = {
+    getAllTeams: jest.fn().mockReturnValue(of()),
+  };
+
+  const activatedRouteMock: any = {
+    paramMap: of({
+      get: () => paramTeamId,
+    }),
+  };
+
+  beforeEach(async () => {
+    await TestBed.configureTestingModule({
+      declarations: [TeamListComponent],
+      providers: [
+        { provide: TeamService, useValue: teamServiceMock },
+        { provide: ActivatedRoute, useValue: activatedRouteMock },
+      ],
+    }).compileComponents();
+  });
+
+  beforeEach(() => {
+    fixture = TestBed.createComponent(TeamListComponent);
+    component = fixture.componentInstance;
+    teamService = TestBed.inject(TeamService);
+    route = TestBed.inject(ActivatedRoute);
+    fixture.detectChanges();
+  });
+
+  it('should create', () => {
+    expect(component).toBeTruthy();
+  });
+
+  it('should set selected teamid', () => {
+    component.ngOnInit();
+    expect(component.selectedTeamId).toBe(paramTeamId);
+  });
+
+  it('should set selected teamid', () => {
+    activatedRouteMock.paramMap = of({
+      get: () => undefined,
+    });
+    component.ngOnInit();
+    expect(component.selectedTeamId).toBe(undefined);
+  });
+});
diff --git a/frontend/src/app/team-management/team-list/team-list.component.ts b/frontend/src/app/team-management/team-list/team-list.component.ts
new file mode 100644
index 0000000000..529f1e82b7
--- /dev/null
+++ b/frontend/src/app/team-management/team-list/team-list.component.ts
@@ -0,0 +1,35 @@
+import { Component, OnDestroy, OnInit } from '@angular/core';
+import { TeamService } from '../../services/team.service';
+import { Observable, Subject, takeUntil } from 'rxjs';
+import { Team } from '../../shared/types/model/Team';
+import { ActivatedRoute } from '@angular/router';
+
+@Component({
+  selector: 'app-team-list',
+  templateUrl: './team-list.component.html',
+  styleUrl: './team-list.component.scss',
+})
+export class TeamListComponent implements OnInit, OnDestroy {
+  public teams$: Observable<Team[]>;
+  public selectedTeamId: number | undefined;
+  private unsubscribe$ = new Subject<void>();
+
+  constructor(
+    private readonly teamService: TeamService,
+    private readonly route: ActivatedRoute,
+  ) {
+    this.teams$ = teamService.getAllTeams();
+  }
+
+  public ngOnInit(): void {
+    this.route.paramMap.pipe(takeUntil(this.unsubscribe$)).subscribe((params) => {
+      const teamId = params.get('teamId');
+      this.selectedTeamId = teamId ? parseInt(teamId) : undefined;
+    });
+  }
+
+  public ngOnDestroy(): void {
+    this.unsubscribe$.next();
+    this.unsubscribe$.complete();
+  }
+}
diff --git a/frontend/src/app/team-management/team-management-banner/team-management-banner.component.html b/frontend/src/app/team-management/team-management-banner/team-management-banner.component.html
new file mode 100644
index 0000000000..3c0d25609a
--- /dev/null
+++ b/frontend/src/app/team-management/team-management-banner/team-management-banner.component.html
@@ -0,0 +1,32 @@
+<div id="okrBanner" class="container-fluid">
+  <div class="row first-line">
+    <div class="col-12">
+      <a routerLink="/">Zurück zur OKR Übersicht</a>
+    </div>
+  </div>
+  <div class="row second-line">
+    <div class="col-12 col-sm-4">
+      <h1>Teamverwaltung</h1>
+    </div>
+    <div class="d-none d-md-flex col-sm-8">
+      <app-search-team-management></app-search-team-management>
+      <button
+        (click)="createTeam()"
+        [attr.data-testId]="'add-team'"
+        class="align-new-icon mdc-button px-0 pe-2"
+        color="primary"
+        mat-button
+      >
+        <span class="d-flex align-items-center fw-bold add-text">
+          <img alt="Add key-result button" class="add-cross-button" src="/assets/icons/new-icon.svg" />
+          Team erfassen
+        </span>
+      </button>
+    </div>
+  </div>
+  <div id="okr-tangram">
+    <div>
+      <app-okr-tangram [attr.data-testId]="'okr-logo'"></app-okr-tangram>
+    </div>
+  </div>
+</div>
diff --git a/frontend/src/app/team-management/team-management-banner/team-management-banner.component.scss b/frontend/src/app/team-management/team-management-banner/team-management-banner.component.scss
new file mode 100644
index 0000000000..edb1f2d3e6
--- /dev/null
+++ b/frontend/src/app/team-management/team-management-banner/team-management-banner.component.scss
@@ -0,0 +1,47 @@
+@import "../../../style/_variables.scss";
+
+#okrBanner {
+  position: relative;
+  height: 140px; // height of okr-tangram
+
+  .first-line {
+    padding-top: 2rem;
+
+    > div:first-child {
+      padding-left: 2rem;
+    }
+  }
+
+  .second-line {
+    padding-top: 0.5rem;
+
+    > div {
+      display: flex;
+      align-items: flex-end;
+    }
+
+    div:first-child {
+      padding-left: 2rem;
+    }
+
+    h1 {
+      margin: 0;
+    }
+  }
+
+  #okr-tangram {
+    position: absolute;
+    z-index: -1;
+    top: 0;
+    right: 0;
+  }
+
+  app-search-team-management {
+    width: 100%;
+    max-width: 360px;
+    margin-right: 2rem;
+    mat-form-field {
+      width: 100%;
+    }
+  }
+}
diff --git a/frontend/src/app/team-management/team-management-banner/team-management-banner.component.spec.ts b/frontend/src/app/team-management/team-management-banner/team-management-banner.component.spec.ts
new file mode 100644
index 0000000000..abd285f27d
--- /dev/null
+++ b/frontend/src/app/team-management/team-management-banner/team-management-banner.component.spec.ts
@@ -0,0 +1,59 @@
+import { TeamManagementBannerComponent } from './team-management-banner.component';
+import { ComponentFixture, fakeAsync, TestBed, tick } from '@angular/core/testing';
+import { MatDialog, MatDialogModule } from '@angular/material/dialog';
+import { of } from 'rxjs';
+import { AddEditTeamDialog } from '../add-edit-team-dialog/add-edit-team-dialog.component';
+import { OKR_DIALOG_CONFIG } from '../../shared/constantLibary';
+import { SearchTeamManagementComponent } from '../search-team-management/search-team-management.component';
+import { MatFormFieldModule } from '@angular/material/form-field';
+import { MatIconModule } from '@angular/material/icon';
+import { HttpClientTestingModule } from '@angular/common/http/testing';
+import { TranslateModule } from '@ngx-translate/core';
+import { MatAutocompleteModule } from '@angular/material/autocomplete';
+import { ActivatedRoute } from '@angular/router';
+
+describe('TeamManagementBannerComponent', () => {
+  let component: TeamManagementBannerComponent;
+  let fixture: ComponentFixture<TeamManagementBannerComponent>;
+
+  const matDialogMock = {
+    open: jest.fn(),
+  };
+
+  beforeEach(() => {
+    TestBed.configureTestingModule({
+      imports: [
+        MatDialogModule,
+        MatFormFieldModule,
+        MatIconModule,
+        HttpClientTestingModule,
+        TranslateModule.forRoot(),
+        MatAutocompleteModule,
+      ],
+      declarations: [TeamManagementBannerComponent, SearchTeamManagementComponent],
+      providers: [
+        { provide: MatDialog, useValue: matDialogMock },
+        { provide: ActivatedRoute, useValue: {} },
+      ],
+    }).compileComponents();
+  });
+
+  beforeEach(() => {
+    fixture = TestBed.createComponent(TeamManagementBannerComponent);
+    component = fixture.componentInstance;
+  });
+
+  it('should create', () => {
+    expect(component).toBeTruthy();
+  });
+
+  it('createTeam should open dialog', fakeAsync(() => {
+    matDialogMock.open.mockReturnValue({
+      afterClosed: () => of(),
+    });
+    component.createTeam();
+    tick();
+    expect(matDialogMock.open).toBeCalledTimes(1);
+    expect(matDialogMock.open).toBeCalledWith(AddEditTeamDialog, OKR_DIALOG_CONFIG);
+  }));
+});
diff --git a/frontend/src/app/team-management/team-management-banner/team-management-banner.component.ts b/frontend/src/app/team-management/team-management-banner/team-management-banner.component.ts
new file mode 100644
index 0000000000..76a75755fc
--- /dev/null
+++ b/frontend/src/app/team-management/team-management-banner/team-management-banner.component.ts
@@ -0,0 +1,26 @@
+import { Component } from '@angular/core';
+import { MatDialog, MatDialogRef } from '@angular/material/dialog';
+import { AddEditTeamDialog } from '../add-edit-team-dialog/add-edit-team-dialog.component';
+import { OKR_DIALOG_CONFIG } from '../../shared/constantLibary';
+
+@Component({
+  selector: 'app-team-management-banner',
+  templateUrl: './team-management-banner.component.html',
+  styleUrl: './team-management-banner.component.scss',
+})
+export class TeamManagementBannerComponent {
+  private dialogRef!: MatDialogRef<AddEditTeamDialog> | undefined;
+
+  public constructor(private dialog: MatDialog) {}
+
+  createTeam(): void {
+    if (!this.dialogRef) {
+      const config = OKR_DIALOG_CONFIG;
+      config.data = undefined;
+      this.dialogRef = this.dialog.open(AddEditTeamDialog, config);
+      this.dialogRef.afterClosed().subscribe(() => {
+        this.dialogRef = undefined;
+      });
+    }
+  }
+}
diff --git a/frontend/src/app/team-management/team-management-mobile-filter/team-management-mobile-filter.component.html b/frontend/src/app/team-management/team-management-mobile-filter/team-management-mobile-filter.component.html
new file mode 100644
index 0000000000..4dacf6058c
--- /dev/null
+++ b/frontend/src/app/team-management/team-management-mobile-filter/team-management-mobile-filter.component.html
@@ -0,0 +1,26 @@
+<div class="mt-4">
+  <app-search-team-management></app-search-team-management>
+</div>
+<div class="mt-4">
+  <div class="new-team">
+    <mat-form-field
+      class="bg-white header-form-field w-100"
+      ngDefaultControl
+      subscriptSizing="dynamic"
+      appearance="outline"
+    >
+      <mat-select
+        [attr.data-testId]="'select-team-dropdown'"
+        [(ngModel)]="selectedTeam"
+        (ngModelChange)="navigate($event)"
+      >
+        <mat-option [value]="ALL_TEAMS">Alle Teams ({{ teams.length }})</mat-option>
+        @for (team of teams; track team.id) {
+          <mat-option [attr.data-testId]="'select-team-dropdown-option'" [value]="team">
+            {{ team.name }}
+          </mat-option>
+        }
+      </mat-select>
+    </mat-form-field>
+  </div>
+</div>
diff --git a/frontend/src/app/team-management/team-management-mobile-filter/team-management-mobile-filter.component.spec.ts b/frontend/src/app/team-management/team-management-mobile-filter/team-management-mobile-filter.component.spec.ts
new file mode 100644
index 0000000000..c9a70d11ac
--- /dev/null
+++ b/frontend/src/app/team-management/team-management-mobile-filter/team-management-mobile-filter.component.spec.ts
@@ -0,0 +1,108 @@
+import { ComponentFixture, fakeAsync, TestBed, tick } from '@angular/core/testing';
+
+import { TeamManagementMobileFilterComponent } from './team-management-mobile-filter.component';
+import { TeamService } from '../../services/team.service';
+import { team1, teamList } from '../../shared/testData';
+import { BehaviorSubject, of } from 'rxjs';
+import { ActivatedRoute, Router } from '@angular/router';
+import { SearchTeamManagementComponent } from '../search-team-management/search-team-management.component';
+import { HttpClientModule } from '@angular/common/http';
+import { MatFormFieldModule } from '@angular/material/form-field';
+import { MatSelectModule } from '@angular/material/select';
+import { FormsModule, ReactiveFormsModule } from '@angular/forms';
+import { TranslateTestingModule } from 'ngx-translate-testing';
+import * as de from '../../../assets/i18n/de.json';
+import { MatAutocompleteModule } from '@angular/material/autocomplete';
+import { MatIconModule } from '@angular/material/icon';
+import { BrowserModule } from '@angular/platform-browser';
+import { MatInputModule } from '@angular/material/input';
+import { NoopAnimationsModule } from '@angular/platform-browser/animations';
+import { getRouteToAllTeams, getRouteToTeam } from '../../shared/routeUtils';
+
+describe('TeamManagementMobileFilterComponent', () => {
+  let component: TeamManagementMobileFilterComponent;
+  let fixture: ComponentFixture<TeamManagementMobileFilterComponent>;
+
+  const teamIdSubj = new BehaviorSubject({
+    get: (): string | undefined => '1',
+  });
+
+  const teamServiceMock = {
+    getAllTeams: jest.fn(),
+  };
+
+  const activatedRouteMock = {
+    paramMap: teamIdSubj.asObservable(),
+  };
+
+  const routerMock = {
+    navigateByUrl: jest.fn(),
+  };
+
+  beforeEach(async () => {
+    await TestBed.configureTestingModule({
+      imports: [
+        HttpClientModule,
+        MatFormFieldModule,
+        MatSelectModule,
+        FormsModule,
+        ReactiveFormsModule,
+        TranslateTestingModule.withTranslations({
+          de: de,
+        }),
+        MatAutocompleteModule,
+        MatIconModule,
+        BrowserModule,
+        MatInputModule,
+        NoopAnimationsModule,
+      ],
+      declarations: [TeamManagementMobileFilterComponent, SearchTeamManagementComponent],
+      providers: [
+        { provide: TeamService, useValue: teamServiceMock },
+        { provide: ActivatedRoute, useValue: activatedRouteMock },
+        { provide: Router, useValue: routerMock },
+      ],
+    }).compileComponents();
+
+    teamServiceMock.getAllTeams.mockReturnValue(of(teamList));
+
+    fixture = TestBed.createComponent(TeamManagementMobileFilterComponent);
+    component = fixture.componentInstance;
+    fixture.detectChanges();
+  });
+
+  afterEach(() => {
+    routerMock.navigateByUrl.mockReset();
+  });
+
+  it('should create', () => {
+    expect(component).toBeTruthy();
+  });
+
+  it('should set allTeams and selectedTeam correctly', fakeAsync(() => {
+    tick();
+    expect(component.selectedTeam).toStrictEqual(team1);
+    expect(component.teams).toStrictEqual(teamList);
+  }));
+
+  it('should set allTeams and selectedTeam correctly if no teamId given', fakeAsync(() => {
+    teamIdSubj.next({
+      get: () => undefined,
+    });
+    tick();
+    expect(component.selectedTeam).toBe(component.ALL_TEAMS);
+    expect(component.teams).toStrictEqual(teamList);
+  }));
+
+  it('navigate should navigate to team ', () => {
+    component.navigate(team1);
+    expect(routerMock.navigateByUrl).toBeCalledTimes(1);
+    expect(routerMock.navigateByUrl).toBeCalledWith(getRouteToTeam(team1.id));
+  });
+
+  it('navigate should navigate to all teams ', () => {
+    component.navigate(component.ALL_TEAMS);
+    expect(routerMock.navigateByUrl).toBeCalledTimes(1);
+    expect(routerMock.navigateByUrl).toBeCalledWith(getRouteToAllTeams());
+  });
+});
diff --git a/frontend/src/app/team-management/team-management-mobile-filter/team-management-mobile-filter.component.ts b/frontend/src/app/team-management/team-management-mobile-filter/team-management-mobile-filter.component.ts
new file mode 100644
index 0000000000..18d346bd45
--- /dev/null
+++ b/frontend/src/app/team-management/team-management-mobile-filter/team-management-mobile-filter.component.ts
@@ -0,0 +1,50 @@
+import { Component } from '@angular/core';
+import { TeamService } from '../../services/team.service';
+import { Team } from '../../shared/types/model/Team';
+import { ActivatedRoute, ParamMap, Router } from '@angular/router';
+import { getRouteToAllTeams, getRouteToTeam } from '../../shared/routeUtils';
+import { combineLatest } from 'rxjs';
+import { takeUntilDestroyed } from '@angular/core/rxjs-interop';
+
+@Component({
+  selector: 'app-team-management-mobile-filter',
+  templateUrl: './team-management-mobile-filter.component.html',
+})
+export class TeamManagementMobileFilterComponent {
+  readonly ALL_TEAMS = 'alle';
+
+  teams: Team[] = [];
+  selectedTeam: Team | undefined | 'alle';
+
+  constructor(
+    private readonly teamService: TeamService,
+    private readonly router: Router,
+    private readonly route: ActivatedRoute,
+  ) {
+    combineLatest([teamService.getAllTeams(), this.route.paramMap])
+      .pipe(takeUntilDestroyed())
+      .subscribe(([teams, params]) => this.setTeamsAndSelectedTeam(teams, params));
+  }
+
+  navigate(team: Team | 'alle') {
+    team == this.ALL_TEAMS ? this.navigateToAllTeams() : this.navigateToTeam(team);
+  }
+
+  private navigateToTeam(team: Team) {
+    this.router.navigateByUrl(getRouteToTeam(team.id));
+  }
+
+  private navigateToAllTeams() {
+    this.router.navigateByUrl(getRouteToAllTeams());
+  }
+
+  private setTeamsAndSelectedTeam(teams: Team[], params: ParamMap) {
+    this.teams = teams;
+    const teamId = params.get('teamId');
+    if (teamId) {
+      this.selectedTeam = teams.find((t) => t.id === parseInt(teamId));
+      return;
+    }
+    this.selectedTeam = this.ALL_TEAMS;
+  }
+}
diff --git a/frontend/src/app/team-management/team-management-routing.module.ts b/frontend/src/app/team-management/team-management-routing.module.ts
new file mode 100644
index 0000000000..6882e8bc08
--- /dev/null
+++ b/frontend/src/app/team-management/team-management-routing.module.ts
@@ -0,0 +1,37 @@
+import { NgModule } from '@angular/core';
+import { RouterModule, Routes } from '@angular/router';
+import { TeamManagementComponent } from './team-management.component';
+import { SidepanelComponent } from '../shared/sidepanel/sidepanel.component';
+import { MemberDetailComponent } from './member-detail/member-detail.component';
+
+const children = [
+  {
+    path: 'details',
+    component: SidepanelComponent,
+    children: [
+      {
+        path: 'member/:id',
+        component: MemberDetailComponent,
+      },
+    ],
+  },
+];
+
+const routes: Routes = [
+  {
+    path: '',
+    component: TeamManagementComponent,
+    children,
+  },
+  {
+    path: ':teamId',
+    component: TeamManagementComponent,
+    children,
+  },
+];
+
+@NgModule({
+  imports: [RouterModule.forChild(routes)],
+  exports: [RouterModule],
+})
+export class TeamManagementRoutingModule {}
diff --git a/frontend/src/app/team-management/team-management.component.html b/frontend/src/app/team-management/team-management.component.html
new file mode 100644
index 0000000000..c96339f87c
--- /dev/null
+++ b/frontend/src/app/team-management/team-management.component.html
@@ -0,0 +1,13 @@
+<app-team-management-banner></app-team-management-banner>
+<div id="wrapper" class="container-fluid">
+  <div class="row">
+    <div class="col-12 col-md-4">
+      <app-team-list class="d-none d-md-flex"></app-team-list>
+      <app-team-management-mobile-filter class="d-block d-md-none"></app-team-management-mobile-filter>
+    </div>
+    <div class="col-12 col-md-8">
+      <app-member-list></app-member-list>
+    </div>
+  </div>
+</div>
+<router-outlet></router-outlet>
diff --git a/frontend/src/app/team-management/team-management.component.scss b/frontend/src/app/team-management/team-management.component.scss
new file mode 100644
index 0000000000..17e2132401
--- /dev/null
+++ b/frontend/src/app/team-management/team-management.component.scss
@@ -0,0 +1,11 @@
+#wrapper {
+  $margin-top: 2rem;
+
+  app-team-list {
+    padding-top: $margin-top;
+  }
+
+  app-member-list {
+    padding-top: $margin-top;
+  }
+}
diff --git a/frontend/src/app/team-management/team-management.component.spec.ts b/frontend/src/app/team-management/team-management.component.spec.ts
new file mode 100644
index 0000000000..ffa1631fec
--- /dev/null
+++ b/frontend/src/app/team-management/team-management.component.spec.ts
@@ -0,0 +1,87 @@
+import { ComponentFixture, TestBed } from '@angular/core/testing';
+import { TeamManagementComponent } from './team-management.component';
+import { TeamManagementBannerComponent } from './team-management-banner/team-management-banner.component';
+import { TeamListComponent } from './team-list/team-list.component';
+import { HttpClientTestingModule } from '@angular/common/http/testing';
+import { ActivatedRoute, RouterModule } from '@angular/router';
+import { MemberListComponent } from './member-list/member-list.component';
+import { SearchTeamManagementComponent } from './search-team-management/search-team-management.component';
+import { MatFormFieldModule } from '@angular/material/form-field';
+import { MatIconModule } from '@angular/material/icon';
+import { of } from 'rxjs';
+import { SharedModule } from '../shared/shared.module';
+import { MatInputModule } from '@angular/material/input';
+import { BrowserAnimationsModule } from '@angular/platform-browser/animations';
+import { MatListModule } from '@angular/material/list';
+import { TranslateModule } from '@ngx-translate/core';
+import { MatAutocompleteModule } from '@angular/material/autocomplete';
+import { TeamManagementMobileFilterComponent } from './team-management-mobile-filter/team-management-mobile-filter.component';
+import { MatSelectModule } from '@angular/material/select';
+import { MemberListTableComponent } from './member-list/member-list-table/member-list-table.component';
+import { MemberListMobileComponent } from './member-list/member-list-mobile/member-list-mobile.component';
+import { FormsModule, ReactiveFormsModule } from '@angular/forms';
+import { MatTableModule } from '@angular/material/table';
+import { testUser, users } from '../shared/testData';
+import { UserService } from '../services/user.service';
+
+describe('TeamManagementComponent', () => {
+  let component: TeamManagementComponent;
+  let fixture: ComponentFixture<TeamManagementComponent>;
+
+  const activatedRouteMock = {
+    paramMap: of({}),
+  };
+
+  const userServiceMock = {
+    getCurrentUser: () => of(testUser),
+    getUsers: () => of(users),
+  };
+
+  beforeEach(async () => {
+    await TestBed.configureTestingModule({
+      imports: [
+        HttpClientTestingModule,
+        MatFormFieldModule,
+        MatIconModule,
+        SharedModule,
+        MatInputModule,
+        BrowserAnimationsModule,
+        MatListModule,
+        RouterModule,
+        MatAutocompleteModule,
+        ReactiveFormsModule,
+        TranslateModule.forRoot(),
+        MatSelectModule,
+        FormsModule,
+        ReactiveFormsModule,
+        MatTableModule,
+      ],
+      declarations: [
+        TeamManagementComponent,
+        TeamManagementBannerComponent,
+        TeamListComponent,
+        MemberListComponent,
+        SearchTeamManagementComponent,
+        TeamManagementMobileFilterComponent,
+        MemberListTableComponent,
+        MemberListMobileComponent,
+      ],
+      providers: [
+        { provide: ActivatedRoute, useValue: activatedRouteMock },
+        { provide: UserService, useValue: userServiceMock },
+      ],
+    }).compileComponents();
+  });
+
+  beforeEach(() => {
+    TestBed.runInInjectionContext(() => {
+      fixture = TestBed.createComponent(TeamManagementComponent);
+      component = fixture.componentInstance;
+      fixture.detectChanges();
+    });
+  });
+
+  it('should create', () => {
+    expect(component).toBeTruthy();
+  });
+});
diff --git a/frontend/src/app/team-management/team-management.component.ts b/frontend/src/app/team-management/team-management.component.ts
new file mode 100644
index 0000000000..79fdb4522f
--- /dev/null
+++ b/frontend/src/app/team-management/team-management.component.ts
@@ -0,0 +1,8 @@
+import { Component } from '@angular/core';
+
+@Component({
+  selector: 'app-team-management',
+  templateUrl: './team-management.component.html',
+  styleUrl: './team-management.component.scss',
+})
+export class TeamManagementComponent {}
diff --git a/frontend/src/app/team-management/team-management.module.ts b/frontend/src/app/team-management/team-management.module.ts
new file mode 100644
index 0000000000..03a57af44e
--- /dev/null
+++ b/frontend/src/app/team-management/team-management.module.ts
@@ -0,0 +1,93 @@
+import { NgModule } from '@angular/core';
+import { CommonModule, NgOptimizedImage } from '@angular/common';
+import { TeamManagementComponent } from './team-management.component';
+import { TeamManagementRoutingModule } from './team-management-routing.module';
+import { AddEditTeamDialog } from './add-edit-team-dialog/add-edit-team-dialog.component';
+import { SharedModule } from '../shared/shared.module';
+import { MatDialogModule } from '@angular/material/dialog';
+import { MatFormFieldModule } from '@angular/material/form-field';
+import { FormsModule, ReactiveFormsModule } from '@angular/forms';
+import { TeamManagementBannerComponent } from './team-management-banner/team-management-banner.component';
+import { TeamListComponent } from './team-list/team-list.component';
+import { MemberListComponent } from './member-list/member-list.component';
+import { MatListModule } from '@angular/material/list';
+import { MatTableModule } from '@angular/material/table';
+import { RolesPipe } from './roles.pipe';
+import { TeamsPipe } from './teams.pipe';
+import { MatIconModule } from '@angular/material/icon';
+import { MatInputModule } from '@angular/material/input';
+import { MatButtonModule } from '@angular/material/button';
+import { MatMenuModule } from '@angular/material/menu';
+import { SearchTeamManagementComponent } from './search-team-management/search-team-management.component';
+import { AddMemberToTeamDialogComponent } from './add-member-to-team-dialog/add-member-to-team-dialog.component';
+import { MatAutocompleteModule } from '@angular/material/autocomplete';
+import { MemberDetailComponent } from './member-detail/member-detail.component';
+import { MatProgressSpinnerModule } from '@angular/material/progress-spinner';
+import { TeamRoleDropdownComponent } from './team-role-dropdown/team-role-dropdown.component';
+import { MatSelectModule } from '@angular/material/select';
+import { TranslateModule } from '@ngx-translate/core';
+import { AddUserTeamComponent } from './add-user-team/add-user-team.component';
+import { A11yModule } from '@angular/cdk/a11y';
+import { TeamManagementMobileFilterComponent } from './team-management-mobile-filter/team-management-mobile-filter.component';
+import { MemberListTableComponent } from './member-list/member-list-table/member-list-table.component';
+import { MemberListMobileComponent } from './member-list/member-list-mobile/member-list-mobile.component';
+import { OkrChampionPipe } from './okr-champion.pipe';
+import { PuzzleIconComponent } from '../shared/custom/puzzle-icon/puzzle-icon.component';
+import { PuzzleIconButtonComponent } from '../shared/custom/puzzle-icon-button/puzzle-icon-button.component';
+import { ShowEditRoleComponent } from './show-edit-role/show-edit-role.component';
+import { MatCheckboxModule } from '@angular/material/checkbox';
+import { EditOkrChampionComponent } from './edit-okr-champion/edit-okr-champion.component';
+import { MatTooltipModule } from '@angular/material/tooltip';
+import { NewUserComponent } from './new-user/new-user.component';
+import { InviteUserDialogComponent } from './invite-user-dialog/invite-user-dialog.component';
+
+@NgModule({
+  declarations: [
+    TeamManagementComponent,
+    AddEditTeamDialog,
+    TeamManagementBannerComponent,
+    TeamListComponent,
+    MemberListComponent,
+    RolesPipe,
+    TeamsPipe,
+    SearchTeamManagementComponent,
+    AddMemberToTeamDialogComponent,
+    MemberDetailComponent,
+    TeamRoleDropdownComponent,
+    AddUserTeamComponent,
+    TeamManagementMobileFilterComponent,
+    MemberListTableComponent,
+    MemberListMobileComponent,
+    PuzzleIconComponent,
+    PuzzleIconButtonComponent,
+    ShowEditRoleComponent,
+    EditOkrChampionComponent,
+    NewUserComponent,
+    InviteUserDialogComponent,
+  ],
+  imports: [
+    CommonModule,
+    MatDialogModule,
+    TeamManagementRoutingModule,
+    MatFormFieldModule,
+    SharedModule,
+    FormsModule,
+    ReactiveFormsModule,
+    NgOptimizedImage,
+    MatListModule,
+    MatTableModule,
+    MatIconModule,
+    MatInputModule,
+    MatButtonModule,
+    MatMenuModule,
+    MatAutocompleteModule,
+    MatProgressSpinnerModule,
+    MatSelectModule,
+    TranslateModule,
+    A11yModule,
+    OkrChampionPipe,
+    MatCheckboxModule,
+    MatTooltipModule,
+  ],
+})
+export class TeamManagementModule {}
diff --git a/frontend/src/app/team-management/team-role-dropdown/team-role-dropdown.component.html b/frontend/src/app/team-management/team-role-dropdown/team-role-dropdown.component.html
new file mode 100644
index 0000000000..6f3efd3005
--- /dev/null
+++ b/frontend/src/app/team-management/team-role-dropdown/team-role-dropdown.component.html
@@ -0,0 +1,20 @@
+<mat-form-field
+  class="w-100 bg-white header-form-field"
+  ngDefaultControl
+  subscriptSizing="dynamic"
+  appearance="outline"
+>
+  <mat-select
+    [attr.data-testId]="'select-team-role'"
+    [(ngModel)]="isAdmin"
+    (ngModelChange)="triggerIsAdminChange()"
+    (click)="$event.stopPropagation()"
+  >
+    <mat-option [attr.data-testId]="'select-team-role-member'" [value]="false">{{
+      "USER_ROLE.TEAM_MEMBER" | translate
+    }}</mat-option>
+    <mat-option [attr.data-testId]="'select-team-role-admin'" [value]="true">{{
+      "USER_ROLE.TEAM_ADMIN" | translate
+    }}</mat-option>
+  </mat-select>
+</mat-form-field>
diff --git a/frontend/src/app/team-management/team-role-dropdown/team-role-dropdown.component.scss b/frontend/src/app/team-management/team-role-dropdown/team-role-dropdown.component.scss
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/frontend/src/app/team-management/team-role-dropdown/team-role-dropdown.component.spec.ts b/frontend/src/app/team-management/team-role-dropdown/team-role-dropdown.component.spec.ts
new file mode 100644
index 0000000000..3e3e654e1c
--- /dev/null
+++ b/frontend/src/app/team-management/team-role-dropdown/team-role-dropdown.component.spec.ts
@@ -0,0 +1,46 @@
+import { ComponentFixture, TestBed } from '@angular/core/testing';
+import { TeamRoleDropdownComponent } from './team-role-dropdown.component';
+import { FormControl, FormsModule, ReactiveFormsModule, Validators } from '@angular/forms';
+import { CommonModule } from '@angular/common';
+import { MatOptionModule } from '@angular/material/core';
+import { TranslateModule } from '@ngx-translate/core';
+import { takeLast } from 'rxjs';
+
+describe('TeamRoleDropdownComponent', () => {
+  let component: TeamRoleDropdownComponent;
+  let fixture: ComponentFixture<TeamRoleDropdownComponent>;
+
+  beforeEach(async () => {
+    await TestBed.configureTestingModule({
+      imports: [ReactiveFormsModule, CommonModule, FormsModule, MatOptionModule, TranslateModule.forRoot()],
+      declarations: [TeamRoleDropdownComponent],
+    }).compileComponents();
+  });
+
+  beforeEach(() => {
+    fixture = TestBed.createComponent(TeamRoleDropdownComponent);
+    component = fixture.componentInstance;
+  });
+
+  it('should create', () => {
+    expect(component).toBeTruthy();
+  });
+
+  it('component onInit should create formControl', () => {
+    component.isAdmin = false;
+    component.ngOnInit();
+    expect(JSON.stringify(component.adminControl)).toStrictEqual(
+      JSON.stringify(new FormControl(component.isAdmin, [Validators.required])),
+    );
+  });
+
+  it('triggerIsAdminChange should submit next value', (done) => {
+    component.isAdminChange.pipe(takeLast(1)).subscribe((val) => {
+      expect(val).toBeFalsy();
+      done();
+    });
+    component.isAdminChange.next(false);
+    component.triggerIsAdminChange();
+    component.isAdminChange.complete();
+  });
+});
diff --git a/frontend/src/app/team-management/team-role-dropdown/team-role-dropdown.component.ts b/frontend/src/app/team-management/team-role-dropdown/team-role-dropdown.component.ts
new file mode 100644
index 0000000000..8280ce7fec
--- /dev/null
+++ b/frontend/src/app/team-management/team-role-dropdown/team-role-dropdown.component.ts
@@ -0,0 +1,25 @@
+import { Component, EventEmitter, Input, OnInit, Output } from '@angular/core';
+import { FormControl, Validators } from '@angular/forms';
+
+@Component({
+  selector: 'app-team-role-dropdown',
+  templateUrl: './team-role-dropdown.component.html',
+  styleUrl: './team-role-dropdown.component.scss',
+})
+export class TeamRoleDropdownComponent implements OnInit {
+  @Input({ required: true })
+  isAdmin!: boolean;
+
+  @Output()
+  isAdminChange = new EventEmitter<boolean>();
+
+  adminControl!: FormControl<boolean | null>;
+
+  ngOnInit(): void {
+    this.adminControl = new FormControl(this.isAdmin, [Validators.required]);
+  }
+
+  public triggerIsAdminChange(): void {
+    this.isAdminChange.next(this.isAdmin);
+  }
+}
diff --git a/frontend/src/app/team-management/teams.pipe.spec.ts b/frontend/src/app/team-management/teams.pipe.spec.ts
new file mode 100644
index 0000000000..b67b7986aa
--- /dev/null
+++ b/frontend/src/app/team-management/teams.pipe.spec.ts
@@ -0,0 +1,30 @@
+import { TeamsPipe } from './teams.pipe';
+
+describe('TeamsPipe', () => {
+  let pipe: TeamsPipe;
+  const translateMock: any = {
+    instant: jest.fn(),
+  };
+
+  beforeEach(() => {
+    pipe = new TeamsPipe(translateMock);
+  });
+
+  it('should return an empty string if teams array is empty', () => {
+    expect(pipe.transform([], 2)).toEqual('');
+  });
+
+  it('should join all team names if maxEntries is not defined', () => {
+    expect(pipe.transform(['team1', 'team2', 'team3'], undefined)).toEqual('team1, team2, team3');
+  });
+
+  it('should limit the number of teams if maxEntries is defined', () => {
+    translateMock.instant.mockReturnValue('+ 1 Weitere');
+    expect(pipe.transform(['team1', 'team2', 'team3'], 2)).toEqual('team1, team2, + 1 Weitere');
+    expect(translateMock.instant).toBeCalledWith('TEAM_MANAGEMENT.WEITERE', { overflow: 1 });
+  });
+
+  it('should join all of teams if maxEntries is defined and matched', () => {
+    expect(pipe.transform(['team1', 'team2'], 2)).toEqual('team1, team2');
+  });
+});
diff --git a/frontend/src/app/team-management/teams.pipe.ts b/frontend/src/app/team-management/teams.pipe.ts
new file mode 100644
index 0000000000..879636fd8a
--- /dev/null
+++ b/frontend/src/app/team-management/teams.pipe.ts
@@ -0,0 +1,29 @@
+import { Pipe, PipeTransform } from '@angular/core';
+import { TranslateService } from '@ngx-translate/core';
+
+@Pipe({
+  name: 'teams',
+})
+export class TeamsPipe implements PipeTransform {
+  private readonly SEPARATOR = ', ';
+
+  constructor(private readonly translate: TranslateService) {}
+
+  transform(teams: string[], maxEntries: number | undefined): string {
+    if (!teams?.length) {
+      return '';
+    }
+    if (!maxEntries) {
+      return teams.join(this.SEPARATOR);
+    }
+    const overflow = teams.length - maxEntries;
+    if (overflow > 0) {
+      return (
+        teams.slice(0, maxEntries).join(this.SEPARATOR) +
+        ', ' +
+        this.translate.instant('TEAM_MANAGEMENT.WEITERE', { overflow })
+      );
+    }
+    return teams.join(this.SEPARATOR);
+  }
+}
diff --git a/frontend/src/app/team/team.component.ts b/frontend/src/app/team/team.component.ts
deleted file mode 100644
index 289a6a6013..0000000000
--- a/frontend/src/app/team/team.component.ts
+++ /dev/null
@@ -1,150 +0,0 @@
-import { ChangeDetectionStrategy, Component, Input, TrackByFunction } from '@angular/core';
-import { OverviewEntity } from '../shared/types/model/OverviewEntity';
-import { MatDialog } from '@angular/material/dialog';
-import { ObjectiveFormComponent } from '../shared/dialog/objective-dialog/objective-form.component';
-import { BehaviorSubject, ReplaySubject } from 'rxjs';
-import { RefreshDataService } from '../shared/services/refresh-data.service';
-import { Objective } from '../shared/types/model/Objective';
-import { isMobileDevice, optionalReplaceWithNulls } from '../shared/common';
-import { TeamManagementComponent } from '../shared/dialog/team-management/team-management.component';
-import { TeamMin } from '../shared/types/model/TeamMin';
-import { KeyresultDialogComponent } from '../shared/dialog/keyresult-dialog/keyresult-dialog.component';
-import { ActivatedRoute, Router } from '@angular/router';
-import { CloseState } from '../shared/types/enums/CloseState';
-import { ObjectiveMin } from '../shared/types/model/ObjectiveMin';
-
-@Component({
-  selector: 'app-team',
-  templateUrl: './team.component.html',
-  styleUrls: ['./team.component.scss'],
-  changeDetection: ChangeDetectionStrategy.OnPush,
-})
-export class TeamComponent {
-  private overviewEntity$ = new BehaviorSubject<OverviewEntity>({} as OverviewEntity);
-  trackByObjectiveId: TrackByFunction<ObjectiveMin> = (index, objective) => objective.id;
-
-  @Input()
-  hasAdminAccess!: ReplaySubject<boolean>;
-
-  constructor(
-    private dialog: MatDialog,
-    private refreshDataService: RefreshDataService,
-    private router: Router,
-    private route: ActivatedRoute,
-  ) {}
-
-  @Input()
-  get overviewEntity(): BehaviorSubject<OverviewEntity> {
-    return this.overviewEntity$;
-  }
-
-  set overviewEntity(overviewEntity: OverviewEntity) {
-    this.overviewEntity$.next(overviewEntity);
-  }
-
-  createObjective() {
-    const dialogConfig = isMobileDevice()
-      ? {
-          maxWidth: '100vw',
-          maxHeight: '100vh',
-          height: '100vh',
-          width: '100vw',
-        }
-      : {
-          width: '45em',
-          height: 'auto',
-        };
-
-    const matDialogRef = this.dialog.open(ObjectiveFormComponent, {
-      data: {
-        objective: {
-          teamId: this.overviewEntity.value.team.id,
-          teamVersion: this.overviewEntity.value.team.version,
-        },
-      },
-      height: dialogConfig.height,
-      width: dialogConfig.width,
-      maxHeight: dialogConfig.maxHeight,
-      maxWidth: dialogConfig.maxWidth,
-    });
-    matDialogRef.afterClosed().subscribe((result) => {
-      if (result?.addKeyResult) {
-        this.openAddKeyResultDialog(result.objective);
-      }
-      this.refreshDataService.markDataRefresh();
-    });
-  }
-
-  openAddKeyResultDialog(objective: Objective) {
-    const dialogConfig = isMobileDevice()
-      ? {
-          maxWidth: '100vw',
-          maxHeight: '100vh',
-          height: '100vh',
-          width: '100vw',
-        }
-      : {
-          width: '45em',
-          height: 'auto',
-        };
-
-    this.dialog
-      .open(KeyresultDialogComponent, {
-        height: dialogConfig.height,
-        width: dialogConfig.width,
-        maxHeight: dialogConfig.maxHeight,
-        maxWidth: dialogConfig.maxWidth,
-        data: {
-          objective: objective,
-          keyResult: null,
-        },
-      })
-      .afterClosed()
-      .subscribe((result) => {
-        if (result?.openNew) {
-          this.openAddKeyResultDialog(objective);
-        }
-        this.refreshDataService.markDataRefresh();
-      });
-  }
-
-  openEditTeamDialog(team: TeamMin) {
-    const dialogConfig = isMobileDevice()
-      ? {
-          maxWidth: '100vw',
-          maxHeight: '100vh',
-          height: '100vh',
-          width: '100vw',
-        }
-      : {
-          width: '45em',
-          height: 'auto',
-        };
-    const dialog = this.dialog.open(TeamManagementComponent, {
-      height: dialogConfig.height,
-      width: dialogConfig.width,
-      maxHeight: dialogConfig.maxHeight,
-      maxWidth: dialogConfig.maxWidth,
-      data: {
-        team: team,
-      },
-    });
-    dialog.afterClosed().subscribe((result) => {
-      if (result) {
-        if (result.state == CloseState.DELETED) {
-          this.removeTeam(result.id).then(() => this.refreshDataService.markDataRefresh());
-        } else {
-          this.refreshDataService.markDataRefresh();
-        }
-      }
-    });
-  }
-
-  removeTeam(id: string) {
-    let currentTeams = this.route.snapshot.queryParams['teams'].split(',');
-    currentTeams = currentTeams.filter((cid: any) => cid != id);
-    const params = { teams: currentTeams.join(',') };
-    const optionalParams = optionalReplaceWithNulls(params);
-    return this.router.navigate([], { queryParams: optionalParams });
-  }
-}
diff --git a/frontend/src/assets/favicon-acme.png b/frontend/src/assets/favicon-acme.png
new file mode 100644
index 0000000000..5bc7076c15
Binary files /dev/null and b/frontend/src/assets/favicon-acme.png differ
diff --git a/frontend/src/assets/i18n/de.json b/frontend/src/assets/i18n/de.json
index 669da7212f..19db19f325 100644
--- a/frontend/src/assets/i18n/de.json
+++ b/frontend/src/assets/i18n/de.json
@@ -53,7 +53,9 @@
     "NOT_AUTHORIZED_TO_WRITE": "Du bist nicht autorisiert, um dieses {0} zu bearbeiten.",
     "NOT_AUTHORIZED_TO_DELETE": "Du bist nicht autorisiert, um dieses {0} zu löschen.",
     "TOKEN_NULL": "Das erhaltene Token ist null.",
-    "ILLEGAL_CHANGE_OBJECTIVE_QUARTER": "Element kann nicht in ein anderes Quartal verlegt werden."
+    "ILLEGAL_CHANGE_OBJECTIVE_QUARTER": "Element kann nicht in ein anderes Quartal verlegt werden.",
+    "TRIED_TO_DELETE_LAST_ADMIN": "Der letzte Administrator eines Teams kann nicht entfernt werden",
+    "TRIED_TO_REMOVE_LAST_OKR_CHAMPION": "Der letzte OKR Champion kann nicht entfernt werden"
   },
   "SUCCESS": {
     "TEAM": {
@@ -77,6 +79,10 @@
     "CHECK_IN": {
       "POST": "Das Check-in wurde erfolgreich erstellt.",
       "PUT": "Das Check-in wurde erfolgreich aktualisiert."
+    },
+    "USERS": {
+      "PUT": "Der Member wurde erfolgreich aktualisiert.",
+      "POST": "Die Members wurden erfolgreich registriert"
     }
   },
   "DIALOG_ERRORS": {
@@ -84,5 +90,28 @@
     "MUST_SELECT": " muss ausgewählt sein.",
     "MAX_VALUE": " darf maximal eine Länge von {0} Zeichen haben.",
     "SIZE_BETWEEN": " muss folgende Länge haben: {0}-{1} Zeichen."
+  },
+  "USER_ROLE": {
+    "TEAM_ADMIN": "Team-Admin",
+    "TEAM_MEMBER": "Team-Member",
+    "OKR_CHAMPION": "OKR-Champion"
+  },
+  "TEAM_MANAGEMENT": {
+    "WEITERE": "+ {{overflow}} weitere",
+    "INPUT_PLACEHOLDER": "Nach Team oder Member suchen",
+    "TEAMS": "Teams",
+    "USERS": "Members"
+  },
+  "PAGINATOR": {
+    "MEMBERS_PRO_SEITE":  "Members pro Seite",
+    "NAECHSTE_SEITE": "Nächste Seite",
+    "VORHERIGE_SEITE":  "Vorherige Seite",
+    "ERSTE_SEITE": "Erste Seite",
+    "LETZTE_SEITE":  "Letzte Seite",
+    "VON": "von"
+  },
+  "SHARED": {
+    "JA": "Ja",
+    "NEIN": "Nein"
   }
 }
diff --git a/frontend/src/assets/icons/new-icon-disabled.svg b/frontend/src/assets/icons/new-icon-disabled.svg
new file mode 100644
index 0000000000..904215f2fd
--- /dev/null
+++ b/frontend/src/assets/icons/new-icon-disabled.svg
@@ -0,0 +1,4 @@
+<svg width="16" height="16" viewBox="0 0 16 16" fill="none" xmlns="http://www.w3.org/2000/svg">
+  <path d="M0.800003 8H15.2" stroke="#00000061" stroke-width="2.3" stroke-linecap="round" stroke-linejoin="round"/>
+  <path d="M8 0.800781V15.2008" stroke="#00000061" stroke-width="2.3" stroke-linecap="round" stroke-linejoin="round"/>
+</svg>
diff --git a/frontend/src/assets/images/acme.svg b/frontend/src/assets/images/acme.svg
new file mode 100644
index 0000000000..3f1de1d2af
--- /dev/null
+++ b/frontend/src/assets/images/acme.svg
@@ -0,0 +1 @@
+<svg width="1245" height="865" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" xml:space="preserve" overflow="hidden"><defs><clipPath id="clip0"><rect x="640" y="856" width="1245" height="865"/></clipPath><clipPath id="clip1"><rect x="1697" y="1514" width="189" height="208"/></clipPath><clipPath id="clip2"><rect x="1697" y="1514" width="189" height="208"/></clipPath><clipPath id="clip3"><rect x="1345" y="1514" width="189" height="208"/></clipPath><clipPath id="clip4"><rect x="1345" y="1514" width="189" height="208"/></clipPath><clipPath id="clip5"><rect x="992" y="1514" width="189" height="208"/></clipPath><clipPath id="clip6"><rect x="992" y="1514" width="189" height="208"/></clipPath><clipPath id="clip7"><rect x="640" y="1514" width="189" height="208"/></clipPath><clipPath id="clip8"><rect x="640" y="1514" width="189" height="208"/></clipPath><clipPath id="clip9"><rect x="640" y="855" width="1246" height="569"/></clipPath><clipPath id="clip10"><rect x="640" y="855" width="1246" height="569"/></clipPath></defs><g clip-path="url(#clip0)" transform="translate(-640 -856)"><g clip-path="url(#clip1)"><g clip-path="url(#clip2)"><text fill="#A1B5D8" font-family="Arial,Arial_MSFontService,sans-serif" font-weight="700" font-size="144" transform="matrix(2.29075 0 0 2.29394 764.45 1262)">ACME</text><path d="M680.955 1659.95C685.131 1658.1 695.337 1653.06 700.74 1645.94 707.627 1636.97 707.134 1633.89 707.134 1633.89L683.413 1638.19 677.148 1632.91 678.866 1627.87 701.487 1623.2C701.487 1623.2 692.265 1615.57 681.695 1613.61 671.735 1611.64 658.955 1613.85 654.034 1624.55L654.034 1624.43C654.034 1624.43 651.579 1629.59 651.214 1633.03 650.843 1636.35 649.123 1643.6 645.921 1649.38 643.22 1654.17 640.272 1659.71 632.895 1666.95L630.93 1664.99 630.066 1665.73 604.989 1639.79C598.355 1618.28 630.685 1624.18 644.571 1625.91 610.893 1593.58 574.63 1608.94 556.684 1646.19 552.259 1651.59 542.672 1647.29 537.263 1658.48 540.333 1667.08 553.608 1675.56 561.108 1678.27 570.573 1672.73 568.484 1662.66 570.818 1655.41 577.949 1649.5 583.603 1651.47 590.361 1656.27L617.158 1678.02 616.42 1678.76 617.648 1680.11C597.982 1696.34 561.108 1726.21 556.806 1729.65 551.521 1733.95 542.301 1742.07 552.38 1752.39 562.581 1762.71 572.168 1756.32 575.242 1753.25 577.457 1751.16 611.504 1718.34 633.134 1697.69L688.446 1760.62 708.847 1740.96 649.121 1682.69C649.858 1681.95 650.468 1681.34 650.713 1681.22 653.668 1678.76 658.462 1673.1 670.995 1669.42L684.767 1671.14 685.012 1670.03 680.955 1659.95Z" fill="#656565" transform="matrix(1 0 0 1.00139 68.0623 -70.942)"/><path d="M887.906 1616.3 902.684 1616.3 902.684 1590.31 999.008 1590.31 999.008 1616.3 1013.79 1616.3C1025.95 1616.3 1035.96 1626.19 1035.96 1638.47L1035.96 1677.34C1035.96 1689.49 1025.95 1699.51 1013.79 1699.51L1004.97 1699.51 1004.97 1666.13 896.728 1666.13 896.728 1699.51 887.906 1699.51C875.742 1699.51 865.73 1689.49 865.73 1677.34L865.73 1638.47C865.73 1626.19 875.742 1616.3 887.906 1616.3Z" fill="#656565" transform="matrix(1 0 0 1.00139 68.0623 -70.942)"/><path d="M904.12 1669.85 1001.75 1669.85 1001.75 1757.83 899.949 1757.83 899.949 1669.85 904.12 1669.85ZM993.404 1678.19 908.294 1678.19 908.294 1749.36 993.404 1749.36 993.404 1678.19Z" fill="#656565" transform="matrix(1 0 0 1.00139 68.0623 -70.942)"/><path d="M917.361 1686.51 974.158 1686.51 974.158 1692.48 917.361 1692.48Z" fill="#656565" transform="matrix(1 0 0 1.00139 68.0623 -70.942)"/><path d="M917.356 1698.44 961.013 1698.44 961.013 1704.42 917.356 1704.42Z" fill="#656565" transform="matrix(1 0 0 1.00139 68.0623 -70.942)"/><path d="M917.35 1710.47 976.917 1710.47 976.917 1716.45 917.35 1716.45Z" fill="#656565" transform="matrix(1 0 0 1.00139 68.0623 -70.942)"/><path d="M917.356 1722.4 968.619 1722.4 968.619 1728.38 917.356 1728.38Z" fill="#656565" transform="matrix(1 0 0 1.00139 68.0623 -70.942)"/><path d="M1376.56 1685.75 1360.9 1685.75C1360.68 1693.86 1354.15 1700.5 1345.93 1700.5 1337.82 1700.5 1331.17 1693.86 1331.06 1685.75L1278.36 1685.75C1278.24 1693.86 1271.6 1700.5 1263.37 1700.5 1255.26 1700.5 1248.62 1693.86 1248.51 1685.75L1232.86 1685.75C1225.87 1685.75 1220.13 1691.49 1220.13 1698.47 1220.13 1705.12 1225.42 1710.64 1231.96 1711.09L1248.62 1773.71C1249.41 1776.85 1251.32 1779.67 1254.59 1779.67L1352.46 1779.67C1355.84 1779.67 1357.53 1776.85 1358.54 1773.71L1377.46 1711.09C1383.99 1710.64 1389.17 1705.12 1389.17 1698.47 1389.17 1691.49 1383.54 1685.75 1376.56 1685.75ZM1336.35 1748.37C1338.15 1748.37 1339.62 1749.83 1339.62 1751.63 1339.62 1753.43 1338.15 1754.9 1336.35 1754.9L1273.06 1754.9C1271.26 1754.9 1269.8 1753.43 1269.8 1751.63 1269.8 1749.83 1271.26 1748.37 1273.06 1748.37M1345.59 1740.71 1263.82 1740.71C1262.02 1740.71 1260.56 1739.24 1260.56 1737.44 1260.56 1735.64 1262.02 1734.17 1263.82 1734.17L1345.59 1734.17C1347.39 1734.17 1348.85 1735.64 1348.85 1737.44 1348.85 1739.24 1347.39 1740.71 1345.59 1740.71ZM1354.03 1725.5 1255.38 1725.5C1253.58 1725.5 1252.11 1724.04 1252.11 1722.23 1252.11 1720.43 1253.58 1719.08 1255.38 1719.08L1354.03 1719.08C1355.84 1719.08 1357.3 1720.43 1357.3 1722.23 1357.3 1724.04 1355.84 1725.5 1354.03 1725.5Z" fill="#656565" transform="matrix(1 0 0 1.00139 68.0623 -70.942)"/><path d="M1259.39 1692.86 1259.56 1692.96C1263.36 1695.15 1268.24 1693.85 1270.43 1690.04L1297.63 1642.93C1299.84 1639.12 1298.53 1634.25 1294.72 1632.05L1294.55 1631.96C1290.74 1629.76 1285.87 1631.07 1283.67 1634.88L1256.48 1681.98C1254.28 1685.79 1255.58 1690.66 1259.39 1692.86Z" fill="#656565" transform="matrix(1 0 0 1.00139 68.0623 -70.942)"/><path d="M1338.92 1690.04C1341.12 1693.85 1345.99 1695.15 1349.8 1692.96L1349.96 1692.86C1353.77 1690.66 1355.08 1685.79 1352.88 1681.98L1325.68 1634.87C1323.48 1631.06 1318.62 1629.76 1314.81 1631.96L1314.64 1632.05C1310.83 1634.25 1309.53 1639.12 1311.73 1642.93L1338.92 1690.04Z" fill="#656565" transform="matrix(1 0 0 1.00139 68.0623 -70.942)"/><path d="M1774.77 1613.03 1731.44 1620.23 1638.76 1712.92 1702.53 1776.69 1795.79 1683.42 1803 1641.37 1774.77 1613.03ZM1715.3 1745.21 1670.24 1700.14 1676.28 1694.1 1721.35 1739.17 1715.3 1745.21ZM1727.96 1732.66 1682.78 1687.48 1688.82 1681.56 1733.88 1726.62 1727.96 1732.66ZM1769.89 1657.51 1759.09 1646.71 1769.89 1635.91 1780.82 1646.71 1769.89 1657.51Z" fill="#656565" transform="matrix(1 0 0 1.00139 68.0623 -70.942)"/></g></g><g clip-path="url(#clip3)"><g clip-path="url(#clip4)"><text fill="#A1B5D8" font-family="Arial,Arial_MSFontService,sans-serif" font-weight="700" font-size="144" transform="matrix(2.29075 0 0 2.29394 831.003 1248)">ACME</text><path d="M680.955 1659.95C685.131 1658.1 695.337 1653.06 700.74 1645.94 707.627 1636.97 707.134 1633.89 707.134 1633.89L683.413 1638.19 677.148 1632.91 678.866 1627.87 701.487 1623.2C701.487 1623.2 692.265 1615.57 681.695 1613.61 671.735 1611.64 658.955 1613.85 654.034 1624.55L654.034 1624.43C654.034 1624.43 651.579 1629.59 651.214 1633.03 650.843 1636.35 649.123 1643.6 645.921 1649.38 643.22 1654.17 640.272 1659.71 632.895 1666.95L630.93 1664.99 630.066 1665.73 604.989 1639.79C598.355 1618.28 630.685 1624.18 644.571 1625.91 610.893 1593.58 574.63 1608.94 556.684 1646.19 552.259 1651.59 542.672 1647.29 537.263 1658.48 540.333 1667.08 553.608 1675.56 561.108 1678.27 570.573 1672.73 568.484 1662.66 570.818 1655.41 577.949 1649.5 583.603 1651.47 590.361 1656.27L617.158 1678.02 616.42 1678.76 617.648 1680.11C597.982 1696.34 561.108 1726.21 556.806 1729.65 551.521 1733.95 542.301 1742.07 552.38 1752.39 562.581 1762.71 572.168 1756.32 575.242 1753.25 577.457 1751.16 611.504 1718.34 633.134 1697.69L688.446 1760.62 708.847 1740.96 649.121 1682.69C649.858 1681.95 650.468 1681.34 650.713 1681.22 653.668 1678.76 658.462 1673.1 670.995 1669.42L684.767 1671.14 685.012 1670.03 680.955 1659.95Z" fill="#656565" transform="matrix(1 0 0 1.00139 134.615 -85.1626)"/><path d="M887.906 1616.3 902.684 1616.3 902.684 1590.31 999.008 1590.31 999.008 1616.3 1013.79 1616.3C1025.95 1616.3 1035.96 1626.19 1035.96 1638.47L1035.96 1677.34C1035.96 1689.49 1025.95 1699.51 1013.79 1699.51L1004.97 1699.51 1004.97 1666.13 896.728 1666.13 896.728 1699.51 887.906 1699.51C875.742 1699.51 865.73 1689.49 865.73 1677.34L865.73 1638.47C865.73 1626.19 875.742 1616.3 887.906 1616.3Z" fill="#656565" transform="matrix(1 0 0 1.00139 134.615 -85.1626)"/><path d="M904.12 1669.85 1001.75 1669.85 1001.75 1757.83 899.949 1757.83 899.949 1669.85 904.12 1669.85ZM993.404 1678.19 908.294 1678.19 908.294 1749.36 993.404 1749.36 993.404 1678.19Z" fill="#656565" transform="matrix(1 0 0 1.00139 134.615 -85.1626)"/><path d="M917.361 1686.51 974.158 1686.51 974.158 1692.48 917.361 1692.48Z" fill="#656565" transform="matrix(1 0 0 1.00139 134.615 -85.1626)"/><path d="M917.356 1698.44 961.013 1698.44 961.013 1704.42 917.356 1704.42Z" fill="#656565" transform="matrix(1 0 0 1.00139 134.615 -85.1626)"/><path d="M917.35 1710.47 976.917 1710.47 976.917 1716.45 917.35 1716.45Z" fill="#656565" transform="matrix(1 0 0 1.00139 134.615 -85.1626)"/><path d="M917.356 1722.4 968.619 1722.4 968.619 1728.38 917.356 1728.38Z" fill="#656565" transform="matrix(1 0 0 1.00139 134.615 -85.1626)"/><path d="M1376.56 1685.75 1360.9 1685.75C1360.68 1693.86 1354.15 1700.5 1345.93 1700.5 1337.82 1700.5 1331.17 1693.86 1331.06 1685.75L1278.36 1685.75C1278.24 1693.86 1271.6 1700.5 1263.37 1700.5 1255.26 1700.5 1248.62 1693.86 1248.51 1685.75L1232.86 1685.75C1225.87 1685.75 1220.13 1691.49 1220.13 1698.47 1220.13 1705.12 1225.42 1710.64 1231.96 1711.09L1248.62 1773.71C1249.41 1776.85 1251.32 1779.67 1254.59 1779.67L1352.46 1779.67C1355.84 1779.67 1357.53 1776.85 1358.54 1773.71L1377.46 1711.09C1383.99 1710.64 1389.17 1705.12 1389.17 1698.47 1389.17 1691.49 1383.54 1685.75 1376.56 1685.75ZM1336.35 1748.37C1338.15 1748.37 1339.62 1749.83 1339.62 1751.63 1339.62 1753.43 1338.15 1754.9 1336.35 1754.9L1273.06 1754.9C1271.26 1754.9 1269.8 1753.43 1269.8 1751.63 1269.8 1749.83 1271.26 1748.37 1273.06 1748.37M1345.59 1740.71 1263.82 1740.71C1262.02 1740.71 1260.56 1739.24 1260.56 1737.44 1260.56 1735.64 1262.02 1734.17 1263.82 1734.17L1345.59 1734.17C1347.39 1734.17 1348.85 1735.64 1348.85 1737.44 1348.85 1739.24 1347.39 1740.71 1345.59 1740.71ZM1354.03 1725.5 1255.38 1725.5C1253.58 1725.5 1252.11 1724.04 1252.11 1722.23 1252.11 1720.43 1253.58 1719.08 1255.38 1719.08L1354.03 1719.08C1355.84 1719.08 1357.3 1720.43 1357.3 1722.23 1357.3 1724.04 1355.84 1725.5 1354.03 1725.5Z" fill="#656565" transform="matrix(1 0 0 1.00139 134.615 -85.1626)"/><path d="M1259.39 1692.86 1259.56 1692.96C1263.36 1695.15 1268.24 1693.85 1270.43 1690.04L1297.63 1642.93C1299.84 1639.12 1298.53 1634.25 1294.72 1632.05L1294.55 1631.96C1290.74 1629.76 1285.87 1631.07 1283.67 1634.88L1256.48 1681.98C1254.28 1685.79 1255.58 1690.66 1259.39 1692.86Z" fill="#656565" transform="matrix(1 0 0 1.00139 134.615 -85.1626)"/><path d="M1338.92 1690.04C1341.12 1693.85 1345.99 1695.15 1349.8 1692.96L1349.96 1692.86C1353.77 1690.66 1355.08 1685.79 1352.88 1681.98L1325.68 1634.87C1323.48 1631.06 1318.62 1629.76 1314.81 1631.96L1314.64 1632.05C1310.83 1634.25 1309.53 1639.12 1311.73 1642.93L1338.92 1690.04Z" fill="#656565" transform="matrix(1 0 0 1.00139 134.615 -85.1626)"/><path d="M1774.77 1613.03 1731.44 1620.23 1638.76 1712.92 1702.53 1776.69 1795.79 1683.42 1803 1641.37 1774.77 1613.03ZM1715.3 1745.21 1670.24 1700.14 1676.28 1694.1 1721.35 1739.17 1715.3 1745.21ZM1727.96 1732.66 1682.78 1687.48 1688.82 1681.56 1733.88 1726.62 1727.96 1732.66ZM1769.89 1657.51 1759.09 1646.71 1769.89 1635.91 1780.82 1646.71 1769.89 1657.51Z" fill="#656565" transform="matrix(1 0 0 1.00139 134.615 -85.1626)"/></g></g><g clip-path="url(#clip5)"><g clip-path="url(#clip6)"><text fill="#A1B5D8" font-family="Arial,Arial_MSFontService,sans-serif" font-weight="700" font-size="144" transform="matrix(2.29075 0 0 2.29394 832.727 1283)">ACME</text><path d="M680.955 1659.95C685.131 1658.1 695.337 1653.06 700.74 1645.94 707.627 1636.97 707.134 1633.89 707.134 1633.89L683.413 1638.19 677.148 1632.91 678.866 1627.87 701.487 1623.2C701.487 1623.2 692.265 1615.57 681.695 1613.61 671.735 1611.64 658.955 1613.85 654.034 1624.55L654.034 1624.43C654.034 1624.43 651.579 1629.59 651.214 1633.03 650.843 1636.35 649.123 1643.6 645.921 1649.38 643.22 1654.17 640.272 1659.71 632.895 1666.95L630.93 1664.99 630.066 1665.73 604.989 1639.79C598.355 1618.28 630.685 1624.18 644.571 1625.91 610.893 1593.58 574.63 1608.94 556.684 1646.19 552.259 1651.59 542.672 1647.29 537.263 1658.48 540.333 1667.08 553.608 1675.56 561.108 1678.27 570.573 1672.73 568.484 1662.66 570.818 1655.41 577.949 1649.5 583.603 1651.47 590.361 1656.27L617.158 1678.02 616.42 1678.76 617.648 1680.11C597.982 1696.34 561.108 1726.21 556.806 1729.65 551.521 1733.95 542.301 1742.07 552.38 1752.39 562.581 1762.71 572.168 1756.32 575.242 1753.25 577.457 1751.16 611.504 1718.34 633.134 1697.69L688.446 1760.62 708.847 1740.96 649.121 1682.69C649.858 1681.95 650.468 1681.34 650.713 1681.22 653.668 1678.76 658.462 1673.1 670.995 1669.42L684.767 1671.14 685.012 1670.03 680.955 1659.95Z" fill="#656565" transform="matrix(1 0 0 1.00139 136.339 -49.6359)"/><path d="M887.906 1616.3 902.684 1616.3 902.684 1590.31 999.008 1590.31 999.008 1616.3 1013.79 1616.3C1025.95 1616.3 1035.96 1626.19 1035.96 1638.47L1035.96 1677.34C1035.96 1689.49 1025.95 1699.51 1013.79 1699.51L1004.97 1699.51 1004.97 1666.13 896.728 1666.13 896.728 1699.51 887.906 1699.51C875.742 1699.51 865.73 1689.49 865.73 1677.34L865.73 1638.47C865.73 1626.19 875.742 1616.3 887.906 1616.3Z" fill="#656565" transform="matrix(1 0 0 1.00139 136.339 -49.6359)"/><path d="M904.12 1669.85 1001.75 1669.85 1001.75 1757.83 899.949 1757.83 899.949 1669.85 904.12 1669.85ZM993.404 1678.19 908.294 1678.19 908.294 1749.36 993.404 1749.36 993.404 1678.19Z" fill="#656565" transform="matrix(1 0 0 1.00139 136.339 -49.6359)"/><path d="M917.361 1686.51 974.158 1686.51 974.158 1692.48 917.361 1692.48Z" fill="#656565" transform="matrix(1 0 0 1.00139 136.339 -49.6359)"/><path d="M917.356 1698.44 961.013 1698.44 961.013 1704.42 917.356 1704.42Z" fill="#656565" transform="matrix(1 0 0 1.00139 136.339 -49.6359)"/><path d="M917.35 1710.47 976.917 1710.47 976.917 1716.45 917.35 1716.45Z" fill="#656565" transform="matrix(1 0 0 1.00139 136.339 -49.6359)"/><path d="M917.356 1722.4 968.619 1722.4 968.619 1728.38 917.356 1728.38Z" fill="#656565" transform="matrix(1 0 0 1.00139 136.339 -49.6359)"/><path d="M1376.56 1685.75 1360.9 1685.75C1360.68 1693.86 1354.15 1700.5 1345.93 1700.5 1337.82 1700.5 1331.17 1693.86 1331.06 1685.75L1278.36 1685.75C1278.24 1693.86 1271.6 1700.5 1263.37 1700.5 1255.26 1700.5 1248.62 1693.86 1248.51 1685.75L1232.86 1685.75C1225.87 1685.75 1220.13 1691.49 1220.13 1698.47 1220.13 1705.12 1225.42 1710.64 1231.96 1711.09L1248.62 1773.71C1249.41 1776.85 1251.32 1779.67 1254.59 1779.67L1352.46 1779.67C1355.84 1779.67 1357.53 1776.85 1358.54 1773.71L1377.46 1711.09C1383.99 1710.64 1389.17 1705.12 1389.17 1698.47 1389.17 1691.49 1383.54 1685.75 1376.56 1685.75ZM1336.35 1748.37C1338.15 1748.37 1339.62 1749.83 1339.62 1751.63 1339.62 1753.43 1338.15 1754.9 1336.35 1754.9L1273.06 1754.9C1271.26 1754.9 1269.8 1753.43 1269.8 1751.63 1269.8 1749.83 1271.26 1748.37 1273.06 1748.37M1345.59 1740.71 1263.82 1740.71C1262.02 1740.71 1260.56 1739.24 1260.56 1737.44 1260.56 1735.64 1262.02 1734.17 1263.82 1734.17L1345.59 1734.17C1347.39 1734.17 1348.85 1735.64 1348.85 1737.44 1348.85 1739.24 1347.39 1740.71 1345.59 1740.71ZM1354.03 1725.5 1255.38 1725.5C1253.58 1725.5 1252.11 1724.04 1252.11 1722.23 1252.11 1720.43 1253.58 1719.08 1255.38 1719.08L1354.03 1719.08C1355.84 1719.08 1357.3 1720.43 1357.3 1722.23 1357.3 1724.04 1355.84 1725.5 1354.03 1725.5Z" fill="#656565" transform="matrix(1 0 0 1.00139 136.339 -49.6359)"/><path d="M1259.39 1692.86 1259.56 1692.96C1263.36 1695.15 1268.24 1693.85 1270.43 1690.04L1297.63 1642.93C1299.84 1639.12 1298.53 1634.25 1294.72 1632.05L1294.55 1631.96C1290.74 1629.76 1285.87 1631.07 1283.67 1634.88L1256.48 1681.98C1254.28 1685.79 1255.58 1690.66 1259.39 1692.86Z" fill="#656565" transform="matrix(1 0 0 1.00139 136.339 -49.6359)"/><path d="M1338.92 1690.04C1341.12 1693.85 1345.99 1695.15 1349.8 1692.96L1349.96 1692.86C1353.77 1690.66 1355.08 1685.79 1352.88 1681.98L1325.68 1634.87C1323.48 1631.06 1318.62 1629.76 1314.81 1631.96L1314.64 1632.05C1310.83 1634.25 1309.53 1639.12 1311.73 1642.93L1338.92 1690.04Z" fill="#656565" transform="matrix(1 0 0 1.00139 136.339 -49.6359)"/><path d="M1774.77 1613.03 1731.44 1620.23 1638.76 1712.92 1702.53 1776.69 1795.79 1683.42 1803 1641.37 1774.77 1613.03ZM1715.3 1745.21 1670.24 1700.14 1676.28 1694.1 1721.35 1739.17 1715.3 1745.21ZM1727.96 1732.66 1682.78 1687.48 1688.82 1681.56 1733.88 1726.62 1727.96 1732.66ZM1769.89 1657.51 1759.09 1646.71 1769.89 1635.91 1780.82 1646.71 1769.89 1657.51Z" fill="#656565" transform="matrix(1 0 0 1.00139 136.339 -49.6359)"/></g></g><g clip-path="url(#clip7)"><g clip-path="url(#clip8)"><text fill="#A1B5D8" font-family="Arial,Arial_MSFontService,sans-serif" font-weight="700" font-size="144" transform="matrix(2.29075 0 0 2.29394 809.696 1272)">ACME</text><path d="M680.955 1659.95C685.131 1658.1 695.337 1653.06 700.74 1645.94 707.627 1636.97 707.134 1633.89 707.134 1633.89L683.413 1638.19 677.148 1632.91 678.866 1627.87 701.487 1623.2C701.487 1623.2 692.265 1615.57 681.695 1613.61 671.735 1611.64 658.955 1613.85 654.034 1624.55L654.034 1624.43C654.034 1624.43 651.579 1629.59 651.214 1633.03 650.843 1636.35 649.123 1643.6 645.921 1649.38 643.22 1654.17 640.272 1659.71 632.895 1666.95L630.93 1664.99 630.066 1665.73 604.989 1639.79C598.355 1618.28 630.685 1624.18 644.571 1625.91 610.893 1593.58 574.63 1608.94 556.684 1646.19 552.259 1651.59 542.672 1647.29 537.263 1658.48 540.333 1667.08 553.608 1675.56 561.108 1678.27 570.573 1672.73 568.484 1662.66 570.818 1655.41 577.949 1649.5 583.603 1651.47 590.361 1656.27L617.158 1678.02 616.42 1678.76 617.648 1680.11C597.982 1696.34 561.108 1726.21 556.806 1729.65 551.521 1733.95 542.301 1742.07 552.38 1752.39 562.581 1762.71 572.168 1756.32 575.242 1753.25 577.457 1751.16 611.504 1718.34 633.134 1697.69L688.446 1760.62 708.847 1740.96 649.121 1682.69C649.858 1681.95 650.468 1681.34 650.713 1681.22 653.668 1678.76 658.462 1673.1 670.995 1669.42L684.767 1671.14 685.012 1670.03 680.955 1659.95Z" fill="#656565" transform="matrix(1 0 0 1.00139 113.308 -60.2889)"/><path d="M887.906 1616.3 902.684 1616.3 902.684 1590.31 999.008 1590.31 999.008 1616.3 1013.79 1616.3C1025.95 1616.3 1035.96 1626.19 1035.96 1638.47L1035.96 1677.34C1035.96 1689.49 1025.95 1699.51 1013.79 1699.51L1004.97 1699.51 1004.97 1666.13 896.728 1666.13 896.728 1699.51 887.906 1699.51C875.742 1699.51 865.73 1689.49 865.73 1677.34L865.73 1638.47C865.73 1626.19 875.742 1616.3 887.906 1616.3Z" fill="#656565" transform="matrix(1 0 0 1.00139 113.308 -60.2889)"/><path d="M904.12 1669.85 1001.75 1669.85 1001.75 1757.83 899.949 1757.83 899.949 1669.85 904.12 1669.85ZM993.404 1678.19 908.294 1678.19 908.294 1749.36 993.404 1749.36 993.404 1678.19Z" fill="#656565" transform="matrix(1 0 0 1.00139 113.308 -60.2889)"/><path d="M917.361 1686.51 974.158 1686.51 974.158 1692.48 917.361 1692.48Z" fill="#656565" transform="matrix(1 0 0 1.00139 113.308 -60.2889)"/><path d="M917.356 1698.44 961.013 1698.44 961.013 1704.42 917.356 1704.42Z" fill="#656565" transform="matrix(1 0 0 1.00139 113.308 -60.2889)"/><path d="M917.35 1710.47 976.917 1710.47 976.917 1716.45 917.35 1716.45Z" fill="#656565" transform="matrix(1 0 0 1.00139 113.308 -60.2889)"/><path d="M917.356 1722.4 968.619 1722.4 968.619 1728.38 917.356 1728.38Z" fill="#656565" transform="matrix(1 0 0 1.00139 113.308 -60.2889)"/><path d="M1376.56 1685.75 1360.9 1685.75C1360.68 1693.86 1354.15 1700.5 1345.93 1700.5 1337.82 1700.5 1331.17 1693.86 1331.06 1685.75L1278.36 1685.75C1278.24 1693.86 1271.6 1700.5 1263.37 1700.5 1255.26 1700.5 1248.62 1693.86 1248.51 1685.75L1232.86 1685.75C1225.87 1685.75 1220.13 1691.49 1220.13 1698.47 1220.13 1705.12 1225.42 1710.64 1231.96 1711.09L1248.62 1773.71C1249.41 1776.85 1251.32 1779.67 1254.59 1779.67L1352.46 1779.67C1355.84 1779.67 1357.53 1776.85 1358.54 1773.71L1377.46 1711.09C1383.99 1710.64 1389.17 1705.12 1389.17 1698.47 1389.17 1691.49 1383.54 1685.75 1376.56 1685.75ZM1336.35 1748.37C1338.15 1748.37 1339.62 1749.83 1339.62 1751.63 1339.62 1753.43 1338.15 1754.9 1336.35 1754.9L1273.06 1754.9C1271.26 1754.9 1269.8 1753.43 1269.8 1751.63 1269.8 1749.83 1271.26 1748.37 1273.06 1748.37M1345.59 1740.71 1263.82 1740.71C1262.02 1740.71 1260.56 1739.24 1260.56 1737.44 1260.56 1735.64 1262.02 1734.17 1263.82 1734.17L1345.59 1734.17C1347.39 1734.17 1348.85 1735.64 1348.85 1737.44 1348.85 1739.24 1347.39 1740.71 1345.59 1740.71ZM1354.03 1725.5 1255.38 1725.5C1253.58 1725.5 1252.11 1724.04 1252.11 1722.23 1252.11 1720.43 1253.58 1719.08 1255.38 1719.08L1354.03 1719.08C1355.84 1719.08 1357.3 1720.43 1357.3 1722.23 1357.3 1724.04 1355.84 1725.5 1354.03 1725.5Z" fill="#656565" transform="matrix(1 0 0 1.00139 113.308 -60.2889)"/><path d="M1259.39 1692.86 1259.56 1692.96C1263.36 1695.15 1268.24 1693.85 1270.43 1690.04L1297.63 1642.93C1299.84 1639.12 1298.53 1634.25 1294.72 1632.05L1294.55 1631.96C1290.74 1629.76 1285.87 1631.07 1283.67 1634.88L1256.48 1681.98C1254.28 1685.79 1255.58 1690.66 1259.39 1692.86Z" fill="#656565" transform="matrix(1 0 0 1.00139 113.308 -60.2889)"/><path d="M1338.92 1690.04C1341.12 1693.85 1345.99 1695.15 1349.8 1692.96L1349.96 1692.86C1353.77 1690.66 1355.08 1685.79 1352.88 1681.98L1325.68 1634.87C1323.48 1631.06 1318.62 1629.76 1314.81 1631.96L1314.64 1632.05C1310.83 1634.25 1309.53 1639.12 1311.73 1642.93L1338.92 1690.04Z" fill="#656565" transform="matrix(1 0 0 1.00139 113.308 -60.2889)"/><path d="M1774.77 1613.03 1731.44 1620.23 1638.76 1712.92 1702.53 1776.69 1795.79 1683.42 1803 1641.37 1774.77 1613.03ZM1715.3 1745.21 1670.24 1700.14 1676.28 1694.1 1721.35 1739.17 1715.3 1745.21ZM1727.96 1732.66 1682.78 1687.48 1688.82 1681.56 1733.88 1726.62 1727.96 1732.66ZM1769.89 1657.51 1759.09 1646.71 1769.89 1635.91 1780.82 1646.71 1769.89 1657.51Z" fill="#656565" transform="matrix(1 0 0 1.00139 113.308 -60.2889)"/></g></g><g clip-path="url(#clip9)"><g clip-path="url(#clip10)"><text fill="#A1B5D8" font-family="Arial,Arial_MSFontService,sans-serif" font-weight="700" font-size="144" transform="matrix(2.29076 0 0 2.29288 780.924 1332)">ACME</text><path d="M680.957 1659.96C685.133 1658.11 695.339 1653.07 700.743 1645.94 707.629 1636.97 707.136 1633.9 707.136 1633.9L683.415 1638.2 677.15 1632.91 678.868 1627.87 701.49 1623.2C701.49 1623.2 692.267 1615.58 681.697 1613.61 671.737 1611.65 658.957 1613.86 654.036 1624.55L654.036 1624.43C654.036 1624.43 651.581 1629.59 651.216 1633.04 650.845 1636.36 649.125 1643.61 645.923 1649.39 643.222 1654.18 640.274 1659.71 632.897 1666.96L630.932 1664.99 630.068 1665.73 604.991 1639.8C598.357 1618.29 630.687 1624.19 644.573 1625.91 610.895 1593.58 574.632 1608.95 556.686 1646.19 552.26 1651.6 542.674 1647.3 537.265 1658.49 540.335 1667.09 553.61 1675.57 561.11 1678.27 570.575 1672.74 568.486 1662.66 570.82 1655.41 577.951 1649.51 583.605 1651.48 590.363 1656.27L617.16 1678.03 616.422 1678.77 617.65 1680.12C597.984 1696.34 561.11 1726.21 556.808 1729.65 551.523 1733.96 542.302 1742.07 552.382 1752.39 562.583 1762.72 572.169 1756.33 575.244 1753.25 577.459 1751.17 611.506 1718.35 633.136 1697.69L688.448 1760.63 708.85 1740.96 649.123 1682.7C649.86 1681.96 650.47 1681.34 650.715 1681.22 653.67 1678.76 658.464 1673.11 670.997 1669.42L684.769 1671.14 685.014 1670.04 680.957 1659.96Z" fill="#656565" transform="matrix(1 0 0 1.00093 84.5335 -0.653986)"/><path d="M887.909 1616.31 902.687 1616.31 902.687 1590.31 999.011 1590.31 999.011 1616.3 1013.8 1616.3C1025.95 1616.3 1035.97 1626.2 1035.97 1638.48L1035.97 1677.34C1035.97 1689.5 1025.95 1699.52 1013.8 1699.52L1004.97 1699.52 1004.97 1666.13 896.731 1666.13 896.731 1699.52 887.909 1699.52C875.745 1699.52 865.732 1689.5 865.732 1677.34L865.732 1638.48C865.732 1626.2 875.745 1616.31 887.909 1616.31Z" fill="#656565" transform="matrix(1 0 0 1.00093 84.5335 -0.653986)"/><path d="M904.123 1669.85 1001.75 1669.85 1001.75 1757.83 899.952 1757.83 899.952 1669.85 904.123 1669.85ZM993.408 1678.2 908.297 1678.2 908.297 1749.36 993.408 1749.36 993.408 1678.2Z" fill="#656565" transform="matrix(1 0 0 1.00093 84.5335 -0.653986)"/><path d="M917.364 1686.52 974.161 1686.52 974.161 1692.49 917.364 1692.49Z" fill="#656565" transform="matrix(1 0 0 1.00093 84.5335 -0.653986)"/><path d="M917.359 1698.45 961.016 1698.45 961.016 1704.43 917.359 1704.43Z" fill="#656565" transform="matrix(1 0 0 1.00093 84.5335 -0.653986)"/><path d="M917.353 1710.47 976.92 1710.47 976.92 1716.45 917.353 1716.45Z" fill="#656565" transform="matrix(1 0 0 1.00093 84.5335 -0.653986)"/><path d="M917.359 1722.41 968.622 1722.41 968.622 1728.39 917.359 1728.39Z" fill="#656565" transform="matrix(1 0 0 1.00093 84.5335 -0.653986)"/><path d="M1376.56 1685.75 1360.91 1685.75C1360.68 1693.86 1354.15 1700.5 1345.93 1700.5 1337.82 1700.5 1331.18 1693.86 1331.07 1685.75L1278.36 1685.75C1278.25 1693.86 1271.6 1700.5 1263.38 1700.5 1255.27 1700.5 1248.63 1693.86 1248.52 1685.75L1232.86 1685.75C1225.88 1685.75 1220.14 1691.5 1220.14 1698.48 1220.14 1705.12 1225.43 1710.64 1231.96 1711.09L1248.63 1773.71C1249.42 1776.86 1251.33 1779.68 1254.6 1779.68L1352.46 1779.68C1355.84 1779.68 1357.53 1776.86 1358.54 1773.71L1377.46 1711.09C1384 1710.64 1389.18 1705.12 1389.18 1698.48 1389.17 1691.5 1383.54 1685.75 1376.56 1685.75ZM1336.36 1748.37C1338.16 1748.37 1339.62 1749.84 1339.62 1751.63 1339.62 1753.44 1338.16 1754.9 1336.36 1754.9L1273.07 1754.9C1271.26 1754.9 1269.8 1753.44 1269.8 1751.63 1269.8 1749.84 1271.26 1748.37 1273.07 1748.37M1345.59 1740.71 1263.83 1740.71C1262.03 1740.71 1260.56 1739.25 1260.56 1737.45 1260.56 1735.65 1262.03 1734.18 1263.83 1734.18L1345.59 1734.18C1347.39 1734.18 1348.86 1735.65 1348.86 1737.45 1348.86 1739.25 1347.39 1740.71 1345.59 1740.71ZM1354.04 1725.51 1255.39 1725.51C1253.58 1725.51 1252.12 1724.04 1252.12 1722.24 1252.12 1720.44 1253.58 1719.09 1255.39 1719.09L1354.03 1719.09C1355.84 1719.09 1357.3 1720.44 1357.3 1722.24 1357.3 1724.04 1355.84 1725.51 1354.04 1725.51Z" fill="#656565" transform="matrix(1 0 0 1.00093 84.5335 -0.653986)"/><path d="M1259.4 1692.87 1259.56 1692.96C1263.37 1695.16 1268.24 1693.86 1270.44 1690.05L1297.64 1642.94C1299.84 1639.13 1298.53 1634.26 1294.72 1632.06L1294.56 1631.96C1290.75 1629.76 1285.88 1631.07 1283.68 1634.88L1256.48 1681.99C1254.28 1685.8 1255.59 1690.67 1259.4 1692.87Z" fill="#656565" transform="matrix(1 0 0 1.00093 84.5335 -0.653986)"/><path d="M1338.92 1690.05C1341.12 1693.86 1345.99 1695.16 1349.8 1692.96L1349.97 1692.87C1353.78 1690.67 1355.08 1685.8 1352.88 1681.99L1325.69 1634.88C1323.49 1631.07 1318.62 1629.76 1314.81 1631.96L1314.64 1632.06C1310.83 1634.26 1309.53 1639.13 1311.73 1642.94L1338.92 1690.05Z" fill="#656565" transform="matrix(1 0 0 1.00093 84.5335 -0.653986)"/><path d="M1774.78 1613.04 1731.45 1620.24 1638.77 1712.93 1702.53 1776.69 1795.8 1683.42 1803 1641.38 1774.78 1613.04ZM1715.31 1745.21 1670.24 1700.15 1676.29 1694.11 1721.35 1739.17 1715.31 1745.21ZM1727.97 1732.67 1682.79 1687.49 1688.83 1681.56 1733.89 1726.63 1727.97 1732.67ZM1769.9 1657.52 1759.1 1646.72 1769.9 1635.92 1780.82 1646.72 1769.9 1657.52Z" fill="#656565" transform="matrix(1 0 0 1.00093 84.5335 -0.653986)"/></g></g></g></svg>
\ No newline at end of file
diff --git a/frontend/src/assets/images/okr-logo-acme.svg b/frontend/src/assets/images/okr-logo-acme.svg
new file mode 100644
index 0000000000..a78ea86fb8
--- /dev/null
+++ b/frontend/src/assets/images/okr-logo-acme.svg
@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!-- Generated by Pixelmator Pro 3.6.5 -->
+<svg width="160" height="32" viewBox="0 0 160 32" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
+    <image id="Layer" x="4" y="2" width="29" height="29" xlink:href="data:image/png;base64, iVBORw0KGgoAAAANSUhEUgAAAB0AAAAdCAYAAABWk2cPAAAAAXNSR0IArs4c6QAAAERlWElmTU0AKgAAAAgAAYdpAAQAAAABAAAAGgAAAAAAA6ABAAMAAAABAAEAAKACAAQAAAABAAAAHaADAAQAAAABAAAAHQAAAADeexZRAAACB0lEQVRIDb1XzU7CQBC2RWi8GLxAQmLSF+gBXgESeAJfwZshmuBTaOJr4BsIyslEL2JIIN6bFFoEKiSUSkudrdukC/3ZAmUv092Z+b79nZkyRxFbXbROjp8b93oiVU6Zy4ZZLFUvzhktIgy9udzu1frt7mA+GFrmQreQlD66stzp1ehRKC0ty+JnolQH6dtmYh/peUrIYDMAErThuOXL5lJgOyEYMUQLeHl9PHl14YZ+6uMfZJ8PgfZWg2NBG6tvoSweBtiv4I3sM4oIYcZbETpzwP50xOCU33aFDqEjMU7wVoOxEPUMHQI/ic/Y+3KBE097S/0I/MYxLr9xmmHv0A+QdhzhE6Qo0tA672Ind77syMWiWGpa1jUxi5g6hmHcID422WrepXOZbEw8BOxZLpthX5oP7IJJVrj0KaGMq4N49ARXZpOG3tTVaVw8BC7i4Va/DXYkCFVVkhVCG1NHlRRlVCpe2fDfcKt2uZW0vkqnd0usB+dDWv/IdlNReiQIUQdQDh+RMDHEXjsfRl6Jn0Ng7HWWDs57zDJ2egzOMi7infOpNlHfYQF0+dRNvG1e1f4LgGiELmKokaKdMban21KHaF3CFh22GnQmAMRQ99p1LXx6N/QOQcM7PnuTqJJHFT1R4be7cv9zLdKEMDIh+g21nQ8hPcG/TIVbLZ9QLL3MMfMNw4CBP/cHXy5LP5XdAAAAAElFTkSuQmCC"/>
+    <linearGradient id="linearGradient1" x1="18.5" y1="23" x2="18.5" y2="10" gradientUnits="userSpaceOnUse">
+        <stop offset="1e-05" stop-color="#dc2b20" stop-opacity="1"/>
+        <stop offset="1" stop-color="#dc5262" stop-opacity="1"/>
+    </linearGradient>
+    <path id="Circular-Outline" fill="url(#linearGradient1)" fill-rule="evenodd" stroke="none" d="M 18.5 23 C 14.910154 23 12 20.089848 12 16.5 C 12 12.910152 14.910154 10 18.5 10 C 22.089846 10 25 12.910152 25 16.5 C 25 20.089848 22.089846 23 18.5 23 Z M 18.5 21.992249 C 21.533281 21.992249 23.992249 19.533281 23.992249 16.5 C 23.992249 13.466719 21.533281 11.007751 18.5 11.007751 C 15.466719 11.007751 13.007751 13.466719 13.007751 16.5 C 13.007751 19.533281 15.466719 21.992249 18.5 21.992249 Z"/>
+    <text id="ACME" xml:space="preserve" x="45" y="23" font-family="Helvetica" font-size="18" fill="#ffffff">ACME</text>
+    <text id="OKR" xml:space="preserve" x="102" y="23" font-family="Helvetica" font-size="18" font-weight="700" fill="#c2d8b9">OKR</text>
+</svg>
diff --git a/frontend/src/assets/images/triangles-okr-acme-header.svg b/frontend/src/assets/images/triangles-okr-acme-header.svg
new file mode 100644
index 0000000000..a51045760c
--- /dev/null
+++ b/frontend/src/assets/images/triangles-okr-acme-header.svg
@@ -0,0 +1,5 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!-- Generated by Pixelmator Pro 3.6.5 -->
+<svg width="274" height="140" viewBox="0 0 274 140" xmlns="http://www.w3.org/2000/svg">
+    <path id="Right-Triangle" fill="#e5e8eb" fill-rule="evenodd" stroke="none" d="M 274 -72 L 16 -72 L 274 186 Z"/>
+</svg>
diff --git a/frontend/src/environments/environment.prod.ts b/frontend/src/environments/environment.prod.ts
index 0f14293fee..132519abdb 100644
--- a/frontend/src/environments/environment.prod.ts
+++ b/frontend/src/environments/environment.prod.ts
@@ -1,22 +1,17 @@
-import { OpenIdConfiguration } from 'angular-auth-oidc-client';
+import { AuthConfig } from 'angular-oauth2-oidc';
 
 export const environment = {
   production: true,
   staging: false,
   oauth: {
-    authority: 'https://sso.puzzle.ch/auth/realms/pitc',
-    // redirectUri: `${window.location.protocol}//${window.location.hostname}:${window.location.port}/auth/keycloakopenid/callback${window.location.search}`,
-    redirectUrl: window.location.origin + '/callback',
-    postLogoutRedirectUri: window.location.origin,
-    renewTimeBeforeTokenExpiresInSeconds: 30,
-    scope: 'profile openid offline_access',
+    decreaseExpirationBySec: 30,
+    clearHashAfterLogin: true,
+    issuer: 'https://sso.puzzle.ch/auth/realms/pitc',
+    strictDiscoveryDocumentValidation: false,
+    redirectUri: `${window.location.protocol}//${window.location.hostname}:${window.location.port}`,
+    scope: 'profile openid',
     clientId: 'pitc_okr_prod',
     responseType: 'code',
-    // showDebugInformation: true,
-    customParamsRefreshTokenRequest: {
-      scope: 'openid profile offline_access',
-    },
-    ignoreNonceAfterRefresh: true, // this is required if the id_token is not returned
-    triggerRefreshWhenIdTokenExpired: false,
-  } as OpenIdConfiguration,
+    showDebugInformation: true,
+  } as AuthConfig,
 };
diff --git a/frontend/src/environments/environment.ts b/frontend/src/environments/environment.ts
index 6980970211..360dc3ddc7 100644
--- a/frontend/src/environments/environment.ts
+++ b/frontend/src/environments/environment.ts
@@ -2,28 +2,22 @@
 // `ng build` replaces `environment.ts` with `environment.prod.ts`.
 // The list of file replacements can be found in `angular.json`.
 
-import { LogLevel, OpenIdConfiguration } from 'angular-auth-oidc-client';
+import { AuthConfig } from 'angular-oauth2-oidc';
 
 export const environment = {
   production: false,
   staging: false,
   oauth: {
-    issuer: 'http://localhost:8095/auth/realms/pitc',
-    redirectUrl: 'http://localhost:4200/callback',
-    postLogoutRedirectUri: window.location.origin,
-    renewTimeBeforeTokenExpiresInSeconds: 30,
-    scope: 'openid profile offline_access',
+    decreaseExpirationBySec: 30,
+    clearHashAfterLogin: true,
+    issuer: '',
+    strictDiscoveryDocumentValidation: false,
+    redirectUri: `${window.location.protocol}//${window.location.hostname}:${window.location.port}`,
+    scope: 'openid profile',
     clientId: '',
     responseType: 'code',
-    logLevel: LogLevel.Debug,
-    silentRenew: true,
-    useRefreshToken: true,
-    customParamsRefreshTokenRequest: {
-      scope: 'openid profile offline_access',
-    },
-    ignoreNonceAfterRefresh: true, // this is required if the id_token is not returned
-    triggerRefreshWhenIdTokenExpired: false,
-  } as OpenIdConfiguration,
+    showDebugInformation: true,
+  } as AuthConfig,
 };
 
 /*
diff --git a/frontend/src/index.html b/frontend/src/index.html
index 7d125adb4c..69fb91e0c2 100644
--- a/frontend/src/index.html
+++ b/frontend/src/index.html
@@ -7,7 +7,7 @@
     <meta name="viewport" content="width=device-width, initial-scale=1" />
     <link id="favicon" rel="icon" type="image" href="assets/images/empty.svg" />
   </head>
-  <body>
+  <body class="okr">
     <app-root></app-root>
   </body>
 </html>
diff --git a/frontend/src/style/_variables.scss b/frontend/src/style/_variables.scss
index 8fe6a1340c..ddf5eb6b58 100644
--- a/frontend/src/style/_variables.scss
+++ b/frontend/src/style/_variables.scss
@@ -4,8 +4,9 @@ $pz-dark-blue: #1e5a96;
 $error: #ba3838;
 $eggshell: #f6f7f8;
 
-$keyResult-border: #5d6974;
-$keyResult-bg: #e5e8eb;
+$light-grey: #f8f8f8;
+$dark-grey: #e5e8eb;
+$dark-grey-border: #5d6974;
 
 $top-bar-height: 48px;
 
@@ -49,4 +50,5 @@ $pz-dark-blue-palette: (
   --mdc-outlined-button-label-text-tracking: normal;
 
   --okr-topbar-background-color: #1e5a96;
+  --okr-banner-background-color: #dcedf9;
 }
diff --git a/frontend/src/style/styles.scss b/frontend/src/style/styles.scss
index 2d6e4db109..4724741de6 100644
--- a/frontend/src/style/styles.scss
+++ b/frontend/src/style/styles.scss
@@ -4,18 +4,40 @@
 @import "fonts/Roboto";
 @import "fonts/MaterialIcons";
 
-p {
-  margin: 0;
-  padding: 0;
-}
-
 html,
-body {
+body.okr {
   font-size: 100%;
   margin: 0;
   padding: 0;
   background-color: $overview-bg;
   font-family: Roboto, sans-serif;
+  --bs-body-font-family: Roboto, "Helvetica Neue", sans-serif;
+
+  h1 {
+    font-size: 1.5rem;
+    font-weight: bold;
+  }
+
+  h2 {
+    font-size: 1.25rem;
+    font-weight: bold;
+  }
+
+  p {
+    margin: 0;
+    padding: 0;
+  }
+
+  a {
+    color: $pz-dark-blue;
+    text-decoration: none;
+    font-size: 0.875rem;
+    font-weight: 700;
+  }
+
+  .font-size-14 {
+    font-size: 0.875rem;
+  }
 }
 
 .linebreak {
@@ -99,15 +121,6 @@ input textarea {
   margin-top: $top-bar-height;
 }
 
-.spinner-container {
-  width: 100%;
-  display: flex;
-  align-items: center;
-  flex-direction: column;
-  @extend .mt-5;
-  @extend .display-6;
-}
-
 .cursor-pointer {
   cursor: pointer;
 }
@@ -133,6 +146,10 @@ input[type="text"] {
   padding: 0.437rem 0.625rem 0.375rem 0.625rem !important;
 }
 
+.dialog-form-field {
+  padding: 0.437rem 0.625rem 0.375rem 0.625rem !important;
+}
+
 .mat-mdc-checkbox .mdc-form-field {
   font-size: 1rem !important;
 }
@@ -189,11 +206,6 @@ input {
   }
 }
 
-.team-title {
-  font-size: 1.5rem;
-  font-weight: bold;
-}
-
 .select-style .mat-mdc-select-value-text {
   margin-left: 0.5rem !important;
 }
@@ -202,11 +214,6 @@ input {
   margin-left: -8px;
 }
 
-#objective-form-field .mdc-notched-outline__trailing {
-  border-bottom-right-radius: 0 !important;
-  border-top-right-radius: 0 !important;
-}
-
 mat-form-field.quarter-filter .mat-mdc-text-field-wrapper {
   width: 220px;
 }
@@ -293,3 +300,73 @@ img.add-cross-button {
 .break-word {
   word-break: break-all;
 }
+
+#okrBanner {
+  position: fixed;
+  width: 100%;
+  height: min-content;
+  z-index: 100;
+  transition: 0.5s;
+  background-color: var(--okr-banner-background-color);
+}
+
+app-team-management-banner > #okrBanner {
+  position: relative;
+}
+
+table.okr-table {
+  border-collapse: separate;
+  border-spacing: 0 0.5rem;
+  border: none;
+  box-shadow: none;
+  tr {
+    $table-height: 40px;
+    height: $table-height;
+
+    > td {
+      height: $table-height;
+      border: none;
+      background-color: $light-grey;
+    }
+    > th {
+      vertical-align: bottom;
+      font-size: 0.75rem;
+      font-weight: bold;
+      border: none;
+      background-color: white;
+    }
+  }
+  tbody {
+    tr:hover {
+      box-shadow: 0 0 0 1px $dark-grey;
+    }
+  }
+}
+
+.search-form {
+  button {
+    border-radius: 0 4px 4px 0;
+    mat-icon {
+      display: flex;
+      align-items: center;
+      justify-content: center;
+      transform: scale(1.25);
+    }
+  }
+  .mdc-notched-outline__trailing {
+    border-bottom-right-radius: 0 !important;
+    border-top-right-radius: 0 !important;
+  }
+}
+
+.mat-mdc-autocomplete-panel {
+  &.autocomplete-bigger {
+    max-height: 480px;
+  }
+}
+
+@import "custom_bootstrap";
+
+.spinner-container {
+  @extend .mt-5;
+}
diff --git a/pom.xml b/pom.xml
index 5518bba6fd..d98e3c263e 100644
--- a/pom.xml
+++ b/pom.xml
@@ -8,7 +8,7 @@
 
     <groupId>ch.puzzle.okr</groupId>
     <artifactId>parent</artifactId>
-    <version>2.0.136-SNAPSHOT</version>
+    <version>2.0.160-SNAPSHOT</version>
 
     <parent>
         <groupId>org.springframework.boot</groupId>
@@ -28,11 +28,29 @@
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
         <project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
     </properties>
-
-
     <build>
         <pluginManagement>
             <plugins>
+                <plugin>
+                    <groupId>com.fizzed</groupId>
+                    <artifactId>fizzed-watcher-maven-plugin</artifactId>
+                    <version>1.0.6</version>
+                    <configuration>
+                        <touchFile>backend/target/classes/watcher.txt</touchFile>
+                        <watches>
+                            <watch>
+                                <directory>backend/src/main/java</directory>
+                            </watch>
+                        </watches>
+                        <goals>
+                            <goal>clean</goal>
+                            <goal>package</goal>
+                        </goals>
+                        <profiles>
+                            <profile>build-for-docker</profile>
+                        </profiles>
+                    </configuration>
+                </plugin>
                 <plugin>
                     <groupId>org.apache.maven.plugins</groupId>
                     <artifactId>maven-resources-plugin</artifactId>