diff --git a/.github/ISSUE_TEMPLATE/bug_report.yml b/.github/ISSUE_TEMPLATE/bug_report.yml
index 0b981122b6..53af08c54b 100644
--- a/.github/ISSUE_TEMPLATE/bug_report.yml
+++ b/.github/ISSUE_TEMPLATE/bug_report.yml
@@ -26,7 +26,7 @@ body:
 
         **Troubleshooting**
 
-        Please read our [Troubleshooting wiki page](https://github.com/ubuntu/authd/wiki/06--Troubleshooting)
+        Please read our [Troubleshooting wiki page](https://documentation.ubuntu.com/authd/stable-docs/reference/troubleshooting/#common-issues-and-limitations)
         and see if you can find a solution to your problem there.
   - type: checkboxes
     attributes:
@@ -92,12 +92,17 @@ body:
 
         #### Logs
         \`\`\`
-        $(sudo journalctl -o short-monotonic --lines 500  _SYSTEMD_UNIT=authd.service \+ UNIT=authd.service \+ \
+        $(sudo journalctl -o short-monotonic --lines 500  \
+          _SYSTEMD_UNIT=authd.service \+ UNIT=authd.service \+ \
           _SYSTEMD_UNIT=snap.authd-msentraid.authd-msentraid.service \+ UNIT=snap.authd-msentraid.authd-msentraid.service \+ SYSLOG_IDENTIFIER=authd-msentraid \+ \
           _SYSTEMD_UNIT=snap.authd-google.authd-google.service \+ UNIT=snap.authd-google.authd-google.service \+ SYSLOG_IDENTIFIER=authd-google \+ \
-          '_CMDLINE="gdm-session-worker [pam/gdm-authd]"' | sed -E -e 's/[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}/<UUID redacted>/g' \
+          _SYSTEMD_UNIT=snap.authd-oidc.authd-oidc.service \+ UNIT=snap.authd-oidc.authd-oidc.service \+ SYSLOG_IDENTIFIER=authd-oidc \+ \
+          _COMM=authd-pam \+ \
+          '_CMDLINE="gdm-session-worker [pam/gdm-authd]"' \
+          | sed -E -e 's/[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}/<UUID redacted>/g' \
             -e 's/GOCSPX-[0-9a-zA-Z_-]+/<redacted>/g' \
-            -e 's/[0-9a-zA-Z_-]+\.apps\.googleusercontent\.com/<redacted>/g')
+            -e 's/[0-9a-zA-Z_-]+\.apps\.googleusercontent\.com/<redacted>/g' \
+            -e 's/(client_secret = )\S+.*/\1<redacted>/g')
         \`\`\`
 
         #### authd apt history
@@ -106,7 +111,7 @@ body:
         \`\`\`
 
         #### authd broker configuration
-        $(sudo sh -c 'if ! find /etc/authd/brokers.d -name \*.conf | grep -q .; then echo ":warning: No config files in /etc/authd/brokers.d/"; else for f in /etc/authd/brokers.d/*.conf; do echo "#### $f"; echo "\`\`\`";  cat $f; echo "\`\`\`"; done; fi')
+        $(sudo sh -c 'if ! find /etc/authd/brokers.d -name \*.conf | grep -q .; then echo ":warning: No config files in /etc/authd/brokers.d/"; else for f in /etc/authd/brokers.d/*.conf; do echo "#### $f"; echo "\`\`\`";  cat $f; echo "\`\`\`"; done; fi' | sed -E 's/client_secret = .*/client_secret = <redacted>/g')
 
         #### authd-msentraid configuration
         \`\`\`
diff --git a/.github/actions/e2e-tests/set-up-ssh-keys/action.yml b/.github/actions/e2e-tests/set-up-ssh-keys/action.yml
new file mode 100644
index 0000000000..830a3fce6d
--- /dev/null
+++ b/.github/actions/e2e-tests/set-up-ssh-keys/action.yml
@@ -0,0 +1,42 @@
+name: Set up SSH keys for VM provisioning
+description: "Sets up SSH keys for VM provisioning"
+inputs:
+  E2E_VM_SSH_PRIV_KEY:
+    description: "Private SSH key for VM provisioning"
+    required: true
+  E2E_VM_SSH_PUB_KEY:
+    description: "Public SSH key for VM provisioning"
+    required: true
+outputs:
+  keys-path:
+    description: "Path to the SSH keys"
+    value: "${{ steps.set-ssh-keys.outputs.keys-path }}"
+runs:
+  using: "composite"
+  steps:
+    - name: Set GitHub Path
+      run: echo "$GITHUB_ACTION_PATH" >> $GITHUB_PATH
+      shell: bash
+      env:
+        GITHUB_ACTION_PATH: ${{ github.action_path }}
+
+    - name: Set up SSH keys for the VM provisioning
+      id: set-ssh-keys
+      shell: bash
+      run: |
+        set -eu
+
+        mkdir -p "${HOME}/.ssh"
+        chmod 700 "${HOME}/.ssh"
+
+        echo "${{ inputs.E2E_VM_SSH_PRIV_KEY }}" > "${HOME}/.ssh/id_rsa"
+        chmod 600 "${HOME}/.ssh/id_rsa"
+
+        echo "${{ inputs.E2E_VM_SSH_PUB_KEY }}" > "${HOME}/.ssh/id_rsa.pub"
+        chmod 644 "${HOME}/.ssh/id_rsa.pub"
+
+        eval "$(ssh-agent -s)"
+
+        ssh-add "${HOME}/.ssh/id_rsa"
+
+        echo "keys-path=${HOME}/.ssh" >> "$GITHUB_OUTPUT"
diff --git a/.github/actions/generate-coverage-report/action.yaml b/.github/actions/generate-coverage-report/action.yaml
new file mode 100644
index 0000000000..5536b4caae
--- /dev/null
+++ b/.github/actions/generate-coverage-report/action.yaml
@@ -0,0 +1,49 @@
+name: 'Generate and upload coverage report'
+description: 'Generates and uploads the coverage report for Go tests'
+inputs:
+  codecov-token:
+    description: 'Codecov token for uploading coverage'
+    required: true
+runs:
+  using: 'composite'
+  steps:
+    - name: Generate coverage report
+      shell: bash
+      run: |
+        # Generate coverage report
+        set -eu
+
+        tmp_dir=$(mktemp -d)
+
+        # Convert the raw coverage data into textfmt so we can merge the Rust one into it
+        go tool covdata textfmt -i="${RAW_COVERAGE_DIR}" -o="${tmp_dir}/coverage.out"
+
+        # Append the Rust coverage data to the Go one
+        cat "${RAW_COVERAGE_DIR}/rust-cov/rust2go_coverage" >>"${tmp_dir}/coverage.out"
+
+        # Filter out the testutils package and the pb.go file
+        grep -v -e "testutils" -e "pb.go" -e "testsdetection" "${tmp_dir}/coverage.out" >"${tmp_dir}/coverage.out.filtered"
+
+        # Generate the Cobertura report for Go and Rust
+        gocov convert "${tmp_dir}/coverage.out.filtered" | gocov-xml > "${tmp_dir}/coverage.xml"
+        reportgenerator -reports:"${tmp_dir}/coverage.xml" -targetdir:"${tmp_dir}" -reporttypes:Cobertura
+
+        # Generate the Cobertura report for C
+        gcovr --cobertura "${tmp_dir}/Cobertura_C.xml" "${RAW_COVERAGE_DIR}"
+
+        # Merge Cobertura reports into a single one
+        reportgenerator -reports:"${tmp_dir}/Cobertura.xml;${tmp_dir}/Cobertura_C.xml" \
+          -targetdir:"${COVERAGE_DIR}" -reporttypes:Cobertura
+
+    - name: Upload coverage to Codecov
+      uses: codecov/codecov-action@v5
+      with:
+        directory: ${{ env.COVERAGE_DIR }}
+        files: ${{ env.COVERAGE_DIR }}/Cobertura.xml
+        token: ${{ inputs.codecov-token }}
+
+    - name: Upload coverage artifacts
+      uses: actions/upload-artifact@v5
+      with:
+        name: coverage
+        path: ${{ env.COVERAGE_DIR }}
diff --git a/.github/actions/install-debug-symbols/action.yaml b/.github/actions/install-debug-symbols/action.yaml
new file mode 100644
index 0000000000..e441266304
--- /dev/null
+++ b/.github/actions/install-debug-symbols/action.yaml
@@ -0,0 +1,30 @@
+name: 'Install debug symbols for glibc, PAM and GLib'
+description: 'Installs debug symbols for glibc, PAM and GLib for better stack traces'
+runs:
+  using: 'composite'
+  steps:
+    - uses: canonical/desktop-engineering/gh-actions/common/dpkg-install-speedup@main
+
+    - name: Install glibc, PAM and GLib debug symbols
+      shell: bash
+      run: |
+        # Install glibc, PAM and GLib debug symbols
+        set -eu
+
+        sudo apt-get install -y ubuntu-dbgsym-keyring libc6-dbg
+        echo "deb http://ddebs.ubuntu.com $(lsb_release -cs) main restricted universe multiverse
+        deb http://ddebs.ubuntu.com $(lsb_release -cs)-updates main restricted universe multiverse
+        deb http://ddebs.ubuntu.com $(lsb_release -cs)-proposed main restricted universe multiverse" | \
+        sudo tee -a /etc/apt/sources.list.d/ddebs.list
+        # Sometimes ddebs archive is stuck, so in case of failure we need to go manual
+        sudo apt-get update -y || true
+        if ! sudo apt-get install -y libpam-modules-dbgsym libpam0*-dbgsym libglib2.0-0*-dbgsym; then
+          sudo apt-get install -y ubuntu-dev-tools
+          for pkg in pam glib2.0; do
+            pull-lp-debs "${pkg}" $(lsb_release -cs)
+            pull-lp-ddebs "${pkg}" $(lsb_release -cs)
+          done
+          sudo apt-get install -y ./libpam0*.*deb ./libpam-modules*.*deb ./libglib2.0-0*-dbgsym*.ddeb
+          sudo apt-get remove -y ubuntu-dev-tools
+          sudo apt-get autoremove -y
+        fi
diff --git a/.github/actions/setup-go-coverage-tests/action.yaml b/.github/actions/setup-go-coverage-tests/action.yaml
new file mode 100644
index 0000000000..4f18fc0036
--- /dev/null
+++ b/.github/actions/setup-go-coverage-tests/action.yaml
@@ -0,0 +1,26 @@
+name: 'Setup Go Tests with Coverage Analysis'
+description: 'Additional setup steps for Go tests with coverage analysis'
+runs:
+  using: 'composite'
+  steps:
+    - name: Install grcov
+      uses: baptiste0928/cargo-install@v3
+      with:
+        crate: grcov
+
+    - name: Install coverage collection dependencies
+      shell: bash
+      run: |
+        # Install coverage collection dependencies
+        set -eu
+
+        echo "::group::Install coverage collection dependencies"
+
+        # Dependendencies for C coverage collection
+        sudo apt-get install -y gcovr
+
+        # Dependendencies for Go coverage collection
+        go install github.com/AlekSi/gocov-xml@latest
+        go install github.com/adombeck/gocov/gocov@latest
+        dotnet tool install -g dotnet-reportgenerator-globaltool
+        echo "::endgroup::"
diff --git a/.github/actions/setup-go-tests/action.yaml b/.github/actions/setup-go-tests/action.yaml
new file mode 100644
index 0000000000..30703cf781
--- /dev/null
+++ b/.github/actions/setup-go-tests/action.yaml
@@ -0,0 +1,66 @@
+name: 'Setup Go Tests'
+description: 'Common setup steps for Go tests'
+runs:
+  using: 'composite'
+  steps:
+    - uses: actions/setup-go@v6
+      with:
+        go-version-file: go.mod
+
+    - uses: canonical/desktop-engineering/gh-actions/common/dpkg-install-speedup@main
+
+    - name: Install dependencies
+      shell: bash
+      run: |
+        # Install dependencies
+        set -eu
+        echo "::group::Install dependencies"
+
+        sudo apt-get update
+
+        # Disable the php8.3-fpm.service which is enabled by default on ubuntu-latest-runner
+        # and is restarted when installing the dependencies but times out after 90s.
+        sudo systemctl mask --now php8.3-fpm.service || true
+
+        # The integration tests build the NSS crate, so we need the cargo build dependencies in order to run them.
+        sudo apt-get install -y protobuf-compiler
+
+        sudo apt-get install -y ${{ env.go_build_dependencies }} ${{ env.go_test_dependencies}}
+
+        echo "::endgroup::"
+
+    - name: Install gotestfmt and our wrapper script
+      uses: canonical/desktop-engineering/gh-actions/go/gotestfmt@main
+
+    - name: Install VHS and ttyd for integration tests
+      shell: bash
+      run: |
+        # Install VHS and ttyd for integration tests
+        set -eu
+        echo "::group::Install VHS and ttyd"
+        go install github.com/charmbracelet/vhs@latest
+
+        # VHS requires ttyd >= 1.7.2 to work properly.
+        wget https://github.com/tsl0922/ttyd/releases/download/1.7.7/ttyd.x86_64
+        chmod +x ttyd.x86_64
+        sudo mv ttyd.x86_64 /usr/bin/ttyd
+
+        # VHS doesn't really use ffmpeg anymore now, but it still checks for it.
+        # Drop this when https://github.com/charmbracelet/vhs/pull/591 is released.
+        sudo ln -s /usr/bin/true /usr/local/bin/ffmpeg
+        echo "::endgroup::"
+
+    - name: Install latest Rust version
+      shell: bash
+      run: rustup update stable
+
+    - name: Prepare tests artifacts path
+      shell: bash
+      run: |
+        # Prepare tests artifacts path
+        set -eu
+
+        artifacts_dir=$(mktemp -d --tmpdir authd-test-artifacts-XXXXXX)
+        echo AUTHD_TESTS_ARTIFACTS_PATH="${artifacts_dir}" >> $GITHUB_ENV
+
+        echo ASAN_OPTIONS="log_path=${artifacts_dir}/asan.log:print_stats=true" >> $GITHUB_ENV
diff --git a/.github/actions/setup-oras/action.yaml b/.github/actions/setup-oras/action.yaml
new file mode 100644
index 0000000000..486736486b
--- /dev/null
+++ b/.github/actions/setup-oras/action.yaml
@@ -0,0 +1,26 @@
+name: 'Setup oras'
+description: 'Setup oras CLI tool for pushing and pulling OCI artifacts.'
+inputs:
+  version:
+    description: 'Version of oras to install'
+    required: false
+    default: '1.3.0'
+runs:
+  using: 'composite'
+  steps:
+    - name: Install oras
+      shell: bash
+      run: |
+        # Install oras CLI
+        set -eu
+
+        VERSION="${{ inputs.version }}"
+        FILENAME="oras_${VERSION}_linux_$(dpkg --print-architecture).tar.gz"
+        curl -fsSL \
+          -H "Authorization: Bearer ${{ secrets.GITHUB_TOKEN }}" \
+          -o "${FILENAME}" \
+          "https://github.com/oras-project/oras/releases/download/v${VERSION}/${FILENAME}"
+        mkdir -p oras-install/
+        tar -zxf "${FILENAME}" -C oras-install/
+        sudo mv oras-install/oras /usr/local/bin/
+        rm -rf "${FILENAME}" oras-install/
diff --git a/.github/actions/upload-test-artifacts/action.yaml b/.github/actions/upload-test-artifacts/action.yaml
new file mode 100644
index 0000000000..323da5150e
--- /dev/null
+++ b/.github/actions/upload-test-artifacts/action.yaml
@@ -0,0 +1,10 @@
+name: 'Upload test artifacts'
+description: 'Uploads test artifacts'
+runs:
+  using: 'composite'
+  steps:
+    - name: Upload test artifacts
+      uses: actions/upload-artifact@v5
+      with:
+        name: authd-${{ github.job }}-artifacts-${{ github.run_attempt }}
+        path: ${{ env.AUTHD_TESTS_ARTIFACTS_PATH }}
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index cdee4301af..add6e487b1 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -20,7 +20,7 @@ updates:
     commit-message:
       prefix: "deps(ci)"
 
-  # Codebase
+  # authd codebase
   ## Go dependencies
   - package-ecosystem: "gomod"
     directory: "/" # Location of package manifests
@@ -61,3 +61,40 @@ updates:
         update-types: ["minor", "patch"]
     commit-message:
       prefix: "deps(rust)"
+
+  ## git submodules
+  - package-ecosystem: "gitsubmodule"
+    directory: "/" # Directory containing .gitmodules
+    schedule:
+      interval: "weekly"
+    commit-message:
+      prefix: "deps(submodule)"
+
+  # authd-oidc-brokers codebase
+  ## Go dependencies
+  - package-ecosystem: "gomod"
+    directory: "/authd-oidc-brokers" # Location of package manifests
+    schedule:
+      interval: "weekly"
+    groups:
+      minor-updates:
+        update-types: [ "minor", "patch" ]
+    commit-message:
+      prefix: "deps(brokers/go)"
+
+  - package-ecosystem: "gomod"
+    directory: "/authd-oidc-brokers/tools"
+    schedule:
+      interval: "weekly"
+    groups:
+      minor-updates:
+        update-types: [ "minor", "patch" ]
+    commit-message:
+      prefix: "deps(brokers/go-tools)"
+  ## rust-toolchain.toml
+  - package-ecosystem: "cargo"
+    directory: "/authd-oidc-brokers"
+    schedule:
+      interval: "weekly"
+    commit-message:
+      prefix: "deps(brokers/rust)"
diff --git a/.github/scripts/compute-deb-build-hash.sh b/.github/scripts/compute-deb-build-hash.sh
new file mode 100755
index 0000000000..06bea16e00
--- /dev/null
+++ b/.github/scripts/compute-deb-build-hash.sh
@@ -0,0 +1,41 @@
+#!/bin/bash
+
+set -euo pipefail
+
+# Add all files in the repo, except for those that we know are not relevant for
+# the build of the Debian package.
+relevant_files=$(git ls-files | grep -v \
+    -e '^\.github/' \
+    -e '^\.gitignore$' \
+    -e '^\.gitmodules$' \
+    -e '^\.golangci\.yaml$' \
+    -e '\.md$' \
+    -e '^COPYING' \
+    -e '^authd-oidc-brokers/' \
+    -e '^docs/' \
+    -e '^e2e-tests/' \
+    -e '^examplebroker/' \
+    -e '^gotestcov$' \
+    -e '^snap/' \
+    -e '_test\.go$' \
+    -e '/testdata/' \
+    -e '/testutils/')
+
+# We excluded the .github directory, so we need to add the workflow file back,
+# since it is relevant for the build of the Debian package.
+relevant_files="${relevant_files}"$'\n'".github/workflows/debian-build.yaml"
+
+# Sort the files
+relevant_files=$(echo "${relevant_files}" | sort -u)
+
+# Print the files for debugging purposes.
+echo >&2 "Build-relevant files: ${relevant_files}"
+
+hash=$(echo "${relevant_files}" |
+    grep -e '.' |
+    xargs git hash-object | sha256sum | cut -d' ' -f1)
+
+# Print the hash for debugging purposes.
+echo >&2 "Hash: ${hash}"
+
+echo "${hash}"
diff --git a/.github/workflows/auto-updates.yaml b/.github/workflows/auto-updates.yaml
index f7fd9ff2a7..9884b71e71 100644
--- a/.github/workflows/auto-updates.yaml
+++ b/.github/workflows/auto-updates.yaml
@@ -1,9 +1,10 @@
-name: Update translations and Rust packaging related files in main
+name: Update Rust packaging related files in main
 on:
   push:
     branches:
       - main
-    paths-ignore:
+    paths:
+      - 'Cargo.lock'
       - 'debian/control'
 concurrency: auto-update
 
@@ -40,20 +41,20 @@ jobs:
         run: |
           set -euo pipefail
 
-          apt update -y
-          apt install -y dh-cargo git
+          apt-get update -y
+          apt-get install -y dh-cargo git
 
           if [ "${{ matrix.ubuntu-version }}" = "noble" ]; then
             # Special behavior on noble as dh-cargo is not new enough there
-            apt install -y libssl-dev pkg-config
+            apt-get install -y libssl-dev pkg-config
             cargo install --locked --root=/usr \
               cargo-vendor-filterer@${{ env.CARGO_VENDOR_FILTERER_NOBLE_VERSION }}
           else
-            apt install -y cargo-vendor-filterer
+            apt-get install -y cargo-vendor-filterer
           fi
 
       - name: Checkout the code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           ref: ${{ matrix.branch }}
 
@@ -71,14 +72,16 @@ jobs:
         run: |
           set -euo pipefail
 
+          echo "Running dh-cargo-vendored-sources"
           VENDORED_SOURCES=$(/usr/share/cargo/bin/dh-cargo-vendored-sources 2>&1) \
             || cmd_status=$?
+          echo "${VENDORED_SOURCES}"
+
           OUTPUT=$(echo "$VENDORED_SOURCES" | grep ^XS-Vendored-Sources-Rust: || true)
           if [ -z "${OUTPUT}" ]; then
             if [ "${cmd_status:-0}" -ne 0 ]; then
               # dh-cargo-vendored-sources failed because of other reason, so let's fail with it!
-              echo "dh-cargo-vendored-sources failed:"
-              echo "${VENDORED_SOURCES}"
+              echo "dh-cargo-vendored-sources failed unexpectedly (exit code ${cmd_status})"
               exit "${cmd_status}"
             fi
 
@@ -92,7 +95,7 @@ jobs:
 
       - name: Create Pull Request
         if: ${{ env.modified == 'true' }}
-        uses: peter-evans/create-pull-request@v7
+        uses: peter-evans/create-pull-request@v8
         with:
           commit-message: Auto update packaging related Rust files
           title: |
diff --git a/.github/workflows/automatic-doc-checks.yml b/.github/workflows/automatic-doc-checks.yaml
similarity index 74%
rename from .github/workflows/automatic-doc-checks.yml
rename to .github/workflows/automatic-doc-checks.yaml
index 9f44eead32..766c005cfc 100644
--- a/.github/workflows/automatic-doc-checks.yml
+++ b/.github/workflows/automatic-doc-checks.yaml
@@ -4,13 +4,11 @@ on:
   push:
     branches: [main]
     paths:
-      - '.github/workflows/automatic-doc-checks.yml'
-      - '.readthedocs.yaml'
+      - '.github/workflows/automatic-doc-checks.yaml'
       - 'docs/**'
   pull_request:
     paths:
-      - '.github/workflows/automatic-doc-checks.yml'
-      - '.readthedocs.yaml'
+      - '.github/workflows/automatic-doc-checks.yaml'
       - 'docs/**'
   schedule:
     - cron:  '0 12 * * MON'
diff --git a/.github/workflows/brokers-qa.yaml b/.github/workflows/brokers-qa.yaml
new file mode 100644
index 0000000000..63e49ea5a1
--- /dev/null
+++ b/.github/workflows/brokers-qa.yaml
@@ -0,0 +1,206 @@
+name: Brokers QA & sanity checks
+on:
+  push:
+    branches:
+      - main
+    tags:
+      - "*"
+    paths:
+      - ".github/workflows/brokers-qa.yaml"
+      - "authd-oidc-brokers/**"
+      - "!authd-oidc-brokers/e2e-tests/**"
+      - "!authd-oidc-brokers/po/**"
+      - "!authd-oidc-brokers/.gitignore"
+
+  pull_request:
+    paths:
+      - ".github/workflows/brokers-qa.yaml"
+      - "authd-oidc-brokers/**"
+      - "!authd-oidc-brokers/e2e-tests/**"
+      - "!authd-oidc-brokers/po/**"
+      - "!authd-oidc-brokers/.gitignore"
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+defaults:
+  run:
+    working-directory: ./authd-oidc-brokers
+
+jobs:
+  go-sanity:
+    name: "Go: Code sanity"
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          submodules: recursive
+
+      - name: Build libhimmelblau
+        # The code sanity check fails if himmelblau.h does not exist, so we generate it first.
+        run: go generate --tags withmsentraid ./internal/providers/msentraid/...
+
+      - name: Go code sanity check
+        uses: canonical/desktop-engineering/gh-actions/go/code-sanity@v2
+        with:
+          golangci-lint-configfile: ".golangci.yaml"
+          working-directory: "./authd-oidc-brokers"
+          tools-directory: "./authd-oidc-brokers/tools"
+          go-tags: "withmsentraid"
+
+  shell-sanity:
+    name: "Shell: Code sanity"
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - name: Run ShellCheck
+        uses: ludeeus/action-shellcheck@master
+        with:
+          scandir: "./authd-oidc-brokers"
+
+  go-tests:
+    name: "Go: Tests"
+    runs-on: ubuntu-24.04 # ubuntu-latest-runner
+    strategy:
+      fail-fast: false
+      matrix:
+        test: [ "coverage", "asan" ]
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          submodules: recursive
+      - uses: actions/setup-go@v6
+        with:
+          go-version-file: go.mod
+
+      - uses: canonical/desktop-engineering/gh-actions/common/dpkg-install-speedup@main
+      - name: Install dependencies
+        run: |
+          set -eu
+          sudo apt-get update
+          sudo apt-get install -y git-delta
+
+      - name: Install coverage collection dependencies
+        if: matrix.test == 'coverage'
+        run: |
+          set -eu
+
+          go install github.com/AlekSi/gocov-xml@latest
+          go install github.com/adombeck/gocov/gocov@latest
+          dotnet tool install -g dotnet-reportgenerator-globaltool
+
+      - name: Build libhimmelblau
+        run: go generate --tags withmsentraid ./internal/providers/msentraid/...
+
+      - name: Prepare tests artifacts path
+        run: |
+          set -eu
+
+          artifacts_dir=$(mktemp -d --tmpdir authd-test-artifacts-XXXXXX)
+          echo AUTHD_TEST_ARTIFACTS_DIR="${artifacts_dir}" >> $GITHUB_ENV
+
+      - name: Install gotestfmt and our wrapper script
+        uses: canonical/desktop-engineering/gh-actions/go/gotestfmt@main
+
+      - name: Run tests (with coverage collection)
+        if: matrix.test == 'coverage'
+        run: |
+          set -euo pipefail
+
+          # The coverage is not written if the output directory does not exist, so we need to create it.
+          cov_dir=${PWD}/coverage
+          raw_cov_dir=${cov_dir}/raw_files
+          codecov_dir=${cov_dir}/codecov
+
+          mkdir -p "${raw_cov_dir}" "${codecov_dir}"
+
+          # Print executed commands to ease debugging
+          set -x
+
+          # Overriding the default coverage directory is not an exported flag of go test (yet), so
+          # we need to override it using the test.gocoverdir flag instead.
+          #TODO: Update when https://go-review.googlesource.com/c/go/+/456595 is merged.
+          go test -tags withmsentraid -json -cover -covermode=set ./... -shuffle=on -args -test.gocoverdir="${raw_cov_dir}" 2>&1 | \
+            gotestfmt --logfile "${AUTHD_TEST_ARTIFACTS_DIR}/gotestfmt.cover.log"
+
+          # Convert the raw coverage data into textfmt so we can merge the Rust one into it
+          go tool covdata textfmt -i="${raw_cov_dir}" -o="${cov_dir}/coverage.out"
+
+          # Filter out the testutils package
+          grep -v -e "testutils" "${cov_dir}/coverage.out" >"${cov_dir}/coverage.out.filtered"
+
+          # Generate the Cobertura report for Go
+          gocov convert "${cov_dir}/coverage.out.filtered" | gocov-xml > "${cov_dir}/coverage.xml"
+          reportgenerator -reports:"${cov_dir}/coverage.xml" -targetdir:"${codecov_dir}" -reporttypes:Cobertura
+
+          # Store the coverage directory for the next steps
+          echo COVERAGE_DIR="${codecov_dir}" >> ${GITHUB_ENV}
+
+      - name: Run msentraid tests (with Address Sanitizer)
+        if: matrix.test == 'asan'
+        env:
+          # Do not optimize, keep debug symbols and frame pointer for better
+          # stack trace information in case of ASAN errors.
+          CGO_CFLAGS: "-O0 -g3 -fno-omit-frame-pointer"
+          GO_TESTS_TIMEOUT: 30m
+          # Use these flags to give ASAN a better time to unwind the stack trace
+          GO_GC_FLAGS: -N -l
+        run: |
+          # Print executed commands to ease debugging
+          set -x
+
+          # For llvm-symbolizer
+          sudo apt-get install -y llvm
+
+          # We only run the msentraid tests with ASAN because only these use cgo.
+          pushd ./internal/providers/msentraid
+          go test -asan -gcflags=all="${GO_GC_FLAGS}" -c
+          go tool test2json -p internal/providers/msentraid ./msentraid.test \
+            -test.v=test2json \
+            -test.failfast \
+            -test.timeout ${GO_TESTS_TIMEOUT} | \
+          gotestfmt --logfile "${AUTHD_TEST_ARTIFACTS_DIR}/gotestfmt.asan.log" || \
+          exit_code=$?
+          popd
+
+          # We don't need the xtrace output after this point
+          set +x
+
+          # We're logging to a file, and this is useful for having artifacts, but we still may want to see it in logs:
+          for f in "${AUTHD_TEST_ARTIFACTS_DIR}"/*asan.log*; do
+            if ! [ -e "${f}" ]; then
+              continue
+            fi
+            if [ -s "${f}" ]; then
+              echo "::group::${f} ($(wc -l < "${f}") lines)"
+              cat "${f}"
+              echo "::endgroup::"
+            else
+              echo "${f}: empty"
+            fi
+          done
+
+          exit ${exit_code}
+
+      - name: Upload coverage to Codecov
+        if: matrix.test == 'coverage'
+        uses: codecov/codecov-action@v5
+        with:
+          directory: ${{ env.COVERAGE_DIR }}
+          files: ${{ env.COVERAGE_DIR }}/Cobertura.xml
+          token: ${{ secrets.CODECOV_TOKEN }}
+
+      - name: Upload coverage report as artifact
+        if: matrix.test == 'coverage' && github.ref == 'refs/heads/main'
+        uses: actions/upload-artifact@v7
+        with:
+          name: coverage
+          path: ${{ env.COVERAGE_DIR }}
+
+      - name: Upload test artifacts
+        if: failure()
+        uses: actions/upload-artifact@v7
+        with:
+          name: authd-${{ github.job }}-artifacts-${{ github.run_attempt }}
+          path: ${{ env.AUTHD_TEST_ARTIFACTS_DIR }}
diff --git a/.github/workflows/build-broker-snap.yaml b/.github/workflows/build-broker-snap.yaml
new file mode 100644
index 0000000000..646ed33cf2
--- /dev/null
+++ b/.github/workflows/build-broker-snap.yaml
@@ -0,0 +1,92 @@
+name: build-broker-snap (reusable)
+
+on:
+  workflow_call:
+    inputs:
+      broker:
+        description: 'Name of the broker snap to build'
+        required: true
+        type: string
+
+jobs:
+  build-broker-snap:
+    name: Build broker snap (${{ inputs.broker }})
+    runs-on: ubuntu-latest
+    permissions:
+      # Needed by actions/checkout
+      contents: read
+      # Needed to push/pull OCI artifact to/from ghcr.io
+      packages: write
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          # The authd-msentraid broker requires the libhimmelblau submodule.
+          submodules: recursive
+
+      - name: Compute hash of build-relevant files
+        id: files-hash
+        run: |
+          set -euo pipefail
+
+          hash=${{ hashFiles('authd-oidc-brokers/**', 'snap/**') }}
+
+          # Print the hash for debugging purposes.
+          echo "Hash: ${hash}"
+
+          echo "hash=${hash}" >> "${GITHUB_OUTPUT}"
+
+      - uses: ./.github/actions/setup-oras
+
+      - name: Try to restore broker snap from OCI registry cache
+        id: restore-cache
+        run: |
+          set -euo pipefail
+
+          echo "${{ secrets.GITHUB_TOKEN }}" \
+            | oras login ghcr.io -u "${{ github.actor }}" --password-stdin
+
+          OCI_REPO=ghcr.io/${{ github.repository }}/${{ inputs.broker }}-snap
+          OCI_TAG=${{ steps.files-hash.outputs.hash }}
+          if oras pull "${OCI_REPO}:${OCI_TAG}"; then
+            echo "cache-hit=true" >> "${GITHUB_OUTPUT}"
+          else
+            echo "cache-hit=false" >> "${GITHUB_OUTPUT}"
+          fi
+
+      - name: Prepare build of the broker snap
+        if: steps.restore-cache.outputs.cache-hit != 'true'
+        run: |
+          set -euo pipefail
+          set -x
+
+          # Tags and main branch are needed by the snap/scripts/version script
+          # which is used during the build of the broker snap.
+          git fetch --tags --unshallow
+          git fetch origin main:main
+
+          ./snap/scripts/prepare-variant --broker "${{ inputs.broker }}"
+
+      - name: Build broker snap
+        if: steps.restore-cache.outputs.cache-hit != 'true'
+        id: build-broker-snap
+        uses: snapcore/action-build@v1
+
+      - name: Rename snap to canonical name
+        if: steps.restore-cache.outputs.cache-hit != 'true'
+        run: mv "${{ steps.build-broker-snap.outputs.snap }}" "${{ inputs.broker }}.snap"
+
+      - name: Upload snap as OCI artifact
+        run: |
+          set -euo pipefail
+
+          # Upload the snap to the OCI registry with the following tags:
+          # - The current commit hash. This is used by subsequent workflows to
+          #   download the snap for this run.
+          # - The hash of the files that affect the build. This allows us to
+          #   use it as a cache key, avoiding unnecessary rebuilds.
+          OCI_REPO=ghcr.io/${{ github.repository }}/${{ inputs.broker }}-snap
+          OCI_TAG=${{ steps.files-hash.outputs.hash }}
+          oras push "${OCI_REPO}:${OCI_TAG}" \
+            "${{ inputs.broker }}.snap" \
+            --artifact-type application/vnd.snap
+          oras tag "${OCI_REPO}:${OCI_TAG}" "${{ github.sha }}"
diff --git a/.github/workflows/build-deb.yaml b/.github/workflows/build-deb.yaml
deleted file mode 100644
index 6bc07eb0c2..0000000000
--- a/.github/workflows/build-deb.yaml
+++ /dev/null
@@ -1,269 +0,0 @@
-name: Build debian packages
-
-on:
-  push:
-    branches:
-      - main
-    paths-ignore:
-      - .github/workflows/automatic-doc-checks.yml
-      - .readthedocs.yaml
-      - docs/**
-    tags:
-      - "*"
-  pull_request:
-    paths-ignore:
-      - .github/workflows/automatic-doc-checks.yml
-      - .readthedocs.yaml
-      - docs/**
-
-env:
-  UBUNTU_VERSIONS: |
-    ["noble", "plucky", "devel"]
-  CARGO_VENDOR_FILTERER_VERSION: 0.5.16
-
-jobs:
-  define-versions:
-    name: Define build versions
-    runs-on: ubuntu-latest
-    outputs:
-      ubuntu-versions: ${{ env.UBUNTU_VERSIONS }}
-    steps:
-      - run: 'true'
-
-  build-deb-package:
-    name: Build ubuntu package
-    runs-on: ubuntu-latest
-    needs: define-versions
-    strategy:
-      fail-fast: false
-      matrix:
-        ubuntu-version: ${{ fromJSON(needs.define-versions.outputs.ubuntu-versions) }}
-    outputs:
-      run-id: ${{ github.run_id }}
-      # FIXME: Use dynamic outputs when possible: https://github.com/actions/runner/pull/2477
-      pkg-dsc-devel:  ${{ steps.outputs.outputs.pkg-dsc-devel }}
-      pkg-dsc-plucky:  ${{ steps.outputs.outputs.pkg-dsc-plucky }}
-      pkg-dsc-noble:  ${{ steps.outputs.outputs.pkg-dsc-noble }}
-      pkg-src-changes-devel: ${{ steps.outputs.outputs.pkg-src-changes-devel }}
-      pkg-src-changes-plucky: ${{ steps.outputs.outputs.pkg-src-changes-plucky }}
-      pkg-src-changes-noble: ${{ steps.outputs.outputs.pkg-src-changes-noble }}
-
-    steps:
-      - name: Checkout authd code
-        uses: actions/checkout@v4
-
-      - name: Build debian packages and sources
-        uses: canonical/desktop-engineering/gh-actions/common/build-debian@main
-        with:
-          docker-image: ubuntu:${{ matrix.ubuntu-version }}
-          extra-source-build-deps: |
-            ca-certificates
-            git
-            libssl-dev
-          extra-source-build-script: |
-            if [ "${{ matrix.ubuntu-version }}" == noble ]; then
-              cargo install --locked --root=/usr \
-                cargo-vendor-filterer@${{ env.CARGO_VENDOR_FILTERER_VERSION }}
-              command -v cargo-vendor-filterer
-            fi
-
-        # FIXME: Use dynamic outputs when possible: https://github.com/actions/runner/pull/2477
-      - name: Generate outputs
-        id: outputs
-        run: |
-          (
-            echo "pkg-dsc-${{ matrix.ubuntu-version }}=${{ env.PKG_DSC }}"
-            echo "pkg-src-changes-${{ matrix.ubuntu-version }}=${{ env.PKG_SOURCE_CHANGES }}"
-          ) >> "${GITHUB_OUTPUT}"
-
-  check-modified-files:
-    name: Check modified files
-    runs-on: ubuntu-latest
-    needs:
-      - build-deb-package
-    outputs:
-      list: ${{ fromJSON(steps.git-diff.outputs.modified_files) }}
-
-    steps:
-      - name: Checkout authd code
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 100
-
-      - id: git-diff
-        name: Check modified files
-        run: |
-          set -ue
-
-          base_ref=${{ github.event.pull_request.base.sha }}
-          if [ -z "${base_ref}" ]; then
-            base_ref=${{ github.event.before }}
-          fi
-          if [ -z "${base_ref}" ]; then
-            base_ref=$(git log --root --reverse -n1 --format=%H)
-          fi
-
-          # Build a JSON array of modified paths.
-          modified_files=$(git diff --name-only "${base_ref}" HEAD | \
-            while read line; do
-              jq -n --arg path "$line" '$path'
-            done | jq -n '. |= [inputs]')
-          echo "${modified_files}"
-
-          escaped_json=$(echo "${modified_files}" | jq '.| tostring')
-          echo "modified_files=${escaped_json}" >> "${GITHUB_OUTPUT}"
-
-  synchronize-packaging-branches:
-    name: Update packaging branch
-    runs-on: ubuntu-latest
-    needs:
-      - define-versions
-      - build-deb-package
-    permissions:
-      contents: write
-    strategy:
-      fail-fast: false
-      matrix:
-        ubuntu-version: ${{ fromJSON(needs.define-versions.outputs.ubuntu-versions) }}
-    env:
-        PACKAGING_BRANCH: ubuntu-packaging-${{ matrix.ubuntu-version }}
-
-    # Run only on:
-    #  - Push events to main
-    #  - On github release
-    if: ${{ (github.event_name == 'push' && github.ref == 'refs/heads/main') ||
-       github.event_name == 'release' }}
-
-    steps:
-    # FIXME: Use dynamic outputs when possible: https://github.com/actions/runner/pull/2477
-    - name: Setup job variables
-      run: |
-        set -exuo pipefail
-
-        json_output='${{ toJSON(needs.build-deb-package.outputs) }}'
-        for var in $(echo "${json_output}" | jq -r 'keys | .[]'); do
-          if  [[ "${var}" != *"-${{ matrix.ubuntu-version }}" ]]; then
-            continue;
-          fi
-
-          v=$(echo "${json_output}" | jq -r ".\"${var}\"")
-          var="${var%-${{ matrix.ubuntu-version }}}"
-          echo "${var//-/_}=${v}" >> "${GITHUB_ENV}"
-        done
-
-    - name: Download artifacts
-      uses: actions/download-artifact@v4
-      with:
-        run-id: ${{ needs.build-deb-package.outputs.run-id }}
-        merge-multiple: true
-
-    - name: Install dependencies
-      run: |
-        set -euo pipefail
-
-        sudo apt update -y
-        sudo apt install -y --no-install-suggests --no-install-recommends \
-          dpkg-dev devscripts
-
-    - name: Checkout code
-      uses: actions/checkout@v4
-      with:
-        fetch-depth: 100
-        path: repo
-
-    - name: Extract the debian sources
-      run: |
-        set -euo pipefail
-
-        dpkg-source -x ${{ env.pkg_dsc }} sources
-
-    - name: Commit packaging sources
-      run: |
-        set -exuo pipefail
-
-        # Create or switch to the packaging branch
-        if git -C repo fetch --depth=1 origin "${{ env.PACKAGING_BRANCH }}:${{ env.PACKAGING_BRANCH }}"; then
-          git -C repo checkout "${{ env.PACKAGING_BRANCH }}"
-        else
-          git -C repo checkout -b "${{ env.PACKAGING_BRANCH }}"
-        fi
-
-        # Replace the repository content with the package sources
-        mv repo/.git sources/
-        cd sources
-
-        # Drop the ubuntu version, as the PPA recipe will add it anyways
-        version=$(dpkg-parsechangelog -SVersion)
-        sanitized_version=$(echo "${version}" | sed "s,~[0-9.]\+\$,,")
-        perl -pe "s|\Q${version}\E|${sanitized_version}|" debian/changelog > \
-          debian/changelog.sanitized
-        mv debian/changelog.sanitized debian/changelog
-        dpkg-parsechangelog
-
-        git config --global user.name "Ubuntu Enterprise Desktop"
-        git config --global user.email "ubuntu-devel-discuss@lists.ubuntu.com"
-
-        git add --all
-        git commit \
-          --allow-empty \
-          -m "Update ubuntu ${{ matrix.ubuntu-version }} package sources" \
-          -m "Use upstream commit ${GITHUB_SHA}"
-
-    - name: Push to packaging branch
-      run: |
-        set -exuo pipefail
-
-        git -C sources push origin "${{ env.PACKAGING_BRANCH }}:${{ env.PACKAGING_BRANCH }}"
-
-  run-autopkgtests:
-    name: Run autopkgtests
-    runs-on: ubuntu-latest
-    needs:
-      - define-versions
-      - build-deb-package
-      - check-modified-files
-    strategy:
-      fail-fast: false
-      matrix:
-        ubuntu-version: ${{ fromJSON(needs.define-versions.outputs.ubuntu-versions) }}
-
-    # Run autopkgtests only on:
-    #  - Push events to main
-    #  - When a file in the debian subdir is modified
-    #  - When this file is modified
-    #  - On new tags
-    #  - On github release
-    if: ${{ (github.event_name == 'push' && github.ref == 'refs/heads/main') ||
-       contains(needs.check-modified-files.outputs.list, 'debian/') ||
-       contains(needs.check-modified-files.outputs.list, '.github/workflows/build-deb.yaml') ||
-       startsWith(github.ref, 'refs/tags/') ||
-       github.event_name == 'release' }}
-
-    steps:
-    # FIXME: Use dynamic outputs when possible: https://github.com/actions/runner/pull/2477
-    - name: Setup job variables
-      run: |
-        set -exuo pipefail
-
-        json_output='${{ toJSON(needs.build-deb-package.outputs) }}'
-        for var in $(echo "${json_output}" | jq -r 'keys | .[]'); do
-          if  [[ "${var}" != *"-${{ matrix.ubuntu-version }}" ]]; then
-            continue;
-          fi
-
-          v=$(echo "${json_output}" | jq -r ".\"${var}\"")
-          var="${var%-${{ matrix.ubuntu-version }}}"
-          echo "${var//-/_}=${v}" >> "${GITHUB_ENV}"
-        done
-
-    - name: Download artifacts
-      uses: actions/download-artifact@v4
-      with:
-        run-id: ${{ needs.build-deb-package.outputs.run-id }}
-        merge-multiple: true
-
-    - name: Run autopkgtests
-      uses: canonical/desktop-engineering/gh-actions/common/run-autopkgtest@main
-      with:
-        lxd-image: ubuntu:${{ matrix.ubuntu-version }}
-        source-changes: ${{ env.pkg_src_changes }}
diff --git a/.github/workflows/cla-check.yaml b/.github/workflows/cla-check.yaml
index c9fc001af5..566269953a 100644
--- a/.github/workflows/cla-check.yaml
+++ b/.github/workflows/cla-check.yaml
@@ -10,3 +10,7 @@ jobs:
         uses: canonical/has-signed-canonical-cla@v2
         with:
           accept-existing-contributors: true
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
\ No newline at end of file
diff --git a/.github/workflows/debian-build-test-and-sync.yaml b/.github/workflows/debian-build-test-and-sync.yaml
new file mode 100644
index 0000000000..673f01dbda
--- /dev/null
+++ b/.github/workflows/debian-build-test-and-sync.yaml
@@ -0,0 +1,161 @@
+name: build-deb-and-test (reusable)
+
+on:
+  workflow_call:
+    inputs:
+      files-hash:
+        description: 'Hash of build-relevant files, used as cache key and concurrency group'
+        type: string
+        required: true
+      ubuntu-version:
+        description: 'Ubuntu version to build and test the Debian package for'
+        type: string
+        required: true
+      modified-files:
+        description: 'JSON array of files modified since the last commit, used to decide whether to run autopkgtests'
+        type: string
+        required: true
+
+jobs:
+  build-deb:
+    uses: ./.github/workflows/debian-build.yaml
+    with:
+      files-hash: ${{ inputs.files-hash }}
+      ubuntu-version: ${{ inputs.ubuntu-version }}
+    secrets: inherit
+
+  run-autopkgtests:
+    name: Run autopkgtests
+    runs-on: ubuntu-latest
+    needs: build-deb
+
+    # Run autopkgtests only on:
+    #  - Push events to main
+    #  - When a file in the debian subdir is modified
+    #  - When this file is modified
+    #  - On new tags
+    #  - On github release
+    if: ${{ (github.event_name == 'push' && github.ref == 'refs/heads/main') ||
+      contains(inputs.modified-files, 'debian/') ||
+      contains(inputs.modified-files, '.github/workflows/debian.yaml') ||
+      startsWith(github.ref, 'refs/tags/') ||
+      github.event_name == 'release' }}
+
+    steps:
+      - uses: actions/checkout@v6
+
+      - uses: ./.github/actions/setup-oras
+
+      - name: Download the Debian sources
+        env:
+          OCI_REPO: ghcr.io/${{ github.repository }}/authd-deb-sources-${{ inputs.ubuntu-version }}
+          OCI_TAG: ${{ github.sha }}
+        run: |
+          set -euo pipefail
+
+          echo "${{ secrets.GITHUB_TOKEN }}" \
+          | oras login ghcr.io -u "${{ github.actor }}" --password-stdin
+
+          oras pull "${OCI_REPO}:${OCI_TAG}"
+
+      - name: Run autopkgtests
+        uses: canonical/desktop-engineering/gh-actions/common/run-autopkgtest@main
+        with:
+          lxd-image: ubuntu:${{ inputs.ubuntu-version }}
+          source-changes: ${{ needs.build-deb.outputs.pkg-src-changes }}
+          autopkgtest-args: --add-apt-source=ppa:ubuntu-enterprise-desktop/golang
+
+  synchronize-packaging-branches:
+    name: Update packaging branch
+    runs-on: ubuntu-latest
+    needs: build-deb
+    permissions:
+      contents: write
+    env:
+      PACKAGING_BRANCH: ubuntu-packaging-${{ inputs.ubuntu-version }}
+
+    # Run only on:
+    #  - Push events to main
+    #  - On github release
+    if: ${{ (github.event_name == 'push' && github.ref == 'refs/heads/main') ||
+      github.event_name == 'release' }}
+
+    steps:
+      - uses: actions/checkout@v6
+
+      - uses: ./.github/actions/setup-oras
+
+      - name: Download the Debian sources
+        env:
+          OCI_REPO: ghcr.io/${{ github.repository }}/authd-deb-sources-${{ inputs.ubuntu-version }}
+          OCI_TAG: ${{ github.sha }}
+        run: |
+          set -euo pipefail
+
+          echo "${{ secrets.GITHUB_TOKEN }}" \
+          | oras login ghcr.io -u "${{ github.actor }}" --password-stdin
+
+          oras pull "${OCI_REPO}:${OCI_TAG}"
+
+      - name: Install dependencies
+        run: |
+          set -euo pipefail
+
+          sudo apt-get update -y
+          sudo apt-get install -y --no-install-suggests --no-install-recommends \
+            dpkg-dev devscripts
+
+      - name: Checkout packaging branch
+        uses: actions/checkout@v6
+        with:
+          path: packaging-branch
+
+      - name: Prepare packaging branch
+        run: |
+          set -euo pipefail
+
+          cd packaging-branch
+
+          # Checkout to the packaging branch if it exists, otherwise create a new orphan branch with a clean state to make
+          # sure we don't accidentally include files from the repository that are not part of the package sources.
+          if git ls-remote --exit-code --heads origin "${{ env.PACKAGING_BRANCH }}" >/dev/null 2>&1; then
+            git fetch origin "${{ env.PACKAGING_BRANCH }}"
+            git checkout -B "${{ env.PACKAGING_BRANCH }}" "origin/${{ env.PACKAGING_BRANCH }}"
+          else
+            git checkout --orphan "${{ env.PACKAGING_BRANCH }}"
+            git rm -rf . >/dev/null 2>&1 || true
+            git clean -fdx
+          fi
+
+      - name: Extract the debian sources
+        run: dpkg-source -x ${{ env.pkg_dsc }} sources
+
+      - name: Commit packaging sources
+        run: |
+          set -exuo pipefail
+
+          # Replace the repository content with the package sources
+          find packaging-branch -mindepth 1 -maxdepth 1 ! -name .git -exec rm -rf {} +
+          cp --force --recursive sources/. packaging-branch/
+
+          cd packaging-branch
+
+          # Drop the ubuntu version, as the PPA recipe will add it anyways
+          version=$(dpkg-parsechangelog -SVersion)
+          sanitized_version=$(echo "${version}" | sed "s,~[0-9.]\+\$,,")
+          perl -pe "s|\Q${version}\E|${sanitized_version}|" debian/changelog > \
+            debian/changelog.sanitized
+          mv debian/changelog.sanitized debian/changelog
+          dpkg-parsechangelog
+
+          git config user.name "Ubuntu Enterprise Desktop"
+          git config user.email "ubuntu-devel-discuss@lists.ubuntu.com"
+
+          git add --all
+          git commit \
+            --allow-empty \
+            -m "Update ubuntu ${{ matrix.ubuntu-version }} package sources" \
+            -m "Use upstream commit ${{ github.sha }}"
+
+      - name: Push to packaging branch
+        run: git -C sources push origin "${{ env.PACKAGING_BRANCH }}:${{ env.PACKAGING_BRANCH }}"
diff --git a/.github/workflows/debian-build.yaml b/.github/workflows/debian-build.yaml
new file mode 100644
index 0000000000..aaddbad41b
--- /dev/null
+++ b/.github/workflows/debian-build.yaml
@@ -0,0 +1,256 @@
+name: build-deb (reusable)
+
+on:
+  workflow_call:
+    inputs:
+      files-hash:
+        description: 'Hash of build-relevant files, used as cache key'
+        type: string
+        required: true
+      ubuntu-version:
+        description: 'Ubuntu version to build the Debian package for'
+        type: string
+        required: true
+    outputs:
+      pkg-name:
+        value: ${{ jobs.build-deb.outputs.pkg-name }}
+      pkg-version:
+        value: ${{ jobs.build-deb.outputs.pkg-version }}
+      pkg-dsc:
+        value: ${{ jobs.build-deb.outputs.pkg-dsc }}
+      pkg-src-changes:
+        value: ${{ jobs.build-deb.outputs.pkg-src-changes }}
+
+
+env:
+  CARGO_VENDOR_FILTERER_VERSION: 0.5.16
+
+jobs:
+  build-deb:
+    name: Build Debian package (${{ inputs.files-hash }})
+    runs-on: ubuntu-latest
+    outputs:
+      pkg-name: ${{ steps.outputs.outputs.pkg-name }}
+      pkg-version: ${{ steps.outputs.outputs.pkg-version }}
+      pkg-dsc: ${{ steps.outputs.outputs.pkg-dsc }}
+      pkg-src-changes: ${{ steps.outputs.outputs.pkg-src-changes }}
+
+    steps:
+      - uses: actions/checkout@v6
+
+      - uses: ./.github/actions/setup-oras
+
+      - name: Try to restore deb and sources from OCI registry
+        id: restore-cache
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          set -euo pipefail
+          set -x
+
+          echo "${{ secrets.GITHUB_TOKEN }}" \
+            | oras login ghcr.io -u "${{ github.actor }}" --password-stdin
+
+          OCI_DEB=ghcr.io/${{ github.repository }}/authd-deb-${{ inputs.ubuntu-version }}
+          OCI_SOURCES=ghcr.io/${{ github.repository }}/authd-deb-sources-${{ inputs.ubuntu-version }}
+          OCI_TAG=${{ inputs.files-hash }}
+
+          try_restore() {
+            # Try to restore the deb
+            if ! oras pull "${OCI_DEB}:${OCI_TAG}" 2>/dev/null; then
+              return 1
+            fi
+            PKG_DEB=$(find . -maxdepth 1 -name "authd_*.deb")
+            [ -n "${PKG_DEB}" ] || return 1
+
+            # Try to restore the sources
+            if ! oras pull "${OCI_SOURCES}:${OCI_TAG}" 2>/dev/null; then
+              echo "cache-hit=false" >> "${GITHUB_OUTPUT}"
+              return 0
+            fi
+            PKG_DSC=$(find . -maxdepth 1 -name "authd_*.dsc")
+            PKG_SOURCE_CHANGES=$(find . -maxdepth 1 -name "authd_*.changes")
+            PKG_TARBALL=$(find . -maxdepth 1 -name "authd_*.tar*")
+            [ -n "${PKG_DSC}" ] || return 1
+            [ -n "${PKG_SOURCE_CHANGES}" ] || return 1
+            [ -n "${PKG_TARBALL}" ] || return 1
+
+            echo "PKG_NAME=$(dpkg-parsechangelog --show-field source)" >> "${GITHUB_ENV}"
+            echo "PKG_VERSION=$(dpkg-parsechangelog --show-field version)" >> "${GITHUB_ENV}"
+            echo "PKG_DEB=${PKG_DEB}" >> "${GITHUB_ENV}"
+            echo "PKG_DSC=${PKG_DSC}" >> "${GITHUB_ENV}"
+            echo "PKG_SOURCE_CHANGES=${PKG_SOURCE_CHANGES}" >> "${GITHUB_ENV}"
+            echo "PKG_TARBALL=${PKG_TARBALL}" >> "${GITHUB_ENV}"
+            echo "cache-hit=true" >> "${GITHUB_OUTPUT}"
+            return 0
+          }
+
+          # Fast path: artifact already in OCI registry
+          if try_restore; then
+            exit 0
+          fi
+
+          # Check if another run is already building the same package.
+          # We identify a builder run as any other non-completed workflow run
+          # with a lower run_id that:
+          #   1. references debian-build.yaml (i.e. calls the same reusable workflow), and
+          #   2. has an in-progress or queued job with the same name as ours
+          #      (which encodes ubuntu-version and files-hash).
+          BUILDER_JOB_ID=$(gh api \
+            "/repos/${{ github.repository }}/actions/runs?status=in_progress" \
+            --paginate \
+            --jq '.workflow_runs[]
+               | select(
+                   .id != ${{ github.run_id }}
+                   and .id < ${{ github.run_id }}
+                   and .status != "completed"
+                   and ([.referenced_workflows[]?.path // "" | contains("debian-build.yaml")] | any)
+                 )
+               | .id' \
+            | while read -r other_run_id; do
+                # Confirm this run has a job matching our exact job name
+                # (same files-hash and ubuntu-version), to avoid waiting for
+                # a run that builds a different ubuntu-version or from a
+                # different branch. Also emit the job ID so we can poll it
+                # directly rather than waiting for the entire run to finish.
+                gh api "/repos/${{ github.repository }}/actions/runs/${other_run_id}/jobs" \
+                  --jq '.jobs[] | select(.name | (contains("(${{ inputs.ubuntu-version }})") and contains("(${{ inputs.files-hash }})"))) | .id' \
+                  2>/dev/null || true
+              done | head -1)
+
+          if [ -z "${BUILDER_JOB_ID}" ]; then
+            # No earlier run is building this package: we are the builder.
+            echo "cache-hit=false" >> "${GITHUB_OUTPUT}"
+            exit 0
+          fi
+
+          # Another run (with a lower run_id) is already building this package.
+          # Wait for the specific build job to finish, then restore from OCI.
+          # We poll the job (not the run) so we don't wait for autopkgtests or
+          # other jobs in that run.
+          # TODO: Use GitHub's 'concurrency' keyword instead of busy-waiting
+          # once https://github.com/orgs/community/discussions/12835 is implemented.
+          echo "Job ${BUILDER_JOB_ID} is already building this package, waiting..."
+          DEADLINE=$(( SECONDS + 30 * 60 ))
+          while [ "${SECONDS}" -lt "${DEADLINE}" ]; do
+            sleep 10
+
+            # Check builder job status to detect completion, failure or cancellation.
+            BUILDER_JOB=$(gh api "/repos/${{ github.repository }}/actions/jobs/${BUILDER_JOB_ID}" \
+              --jq '{status: .status, conclusion: .conclusion}')
+            BUILDER_STATUS=$(echo "${BUILDER_JOB}" | jq -r '.status')
+            BUILDER_CONCLUSION=$(echo "${BUILDER_JOB}" | jq -r '.conclusion')
+
+            if [ "${BUILDER_STATUS}" != "completed" ]; then
+              REMAINING=$(( DEADLINE - SECONDS ))
+              echo "Still waiting... (${REMAINING}s remaining)"
+              continue
+            fi
+
+            if [ "${BUILDER_CONCLUSION}" = "success" ]; then
+              if try_restore; then
+                echo "Restored artifact after builder job succeeded."
+                exit 0
+              fi
+              echo "Builder job succeeded but artifact not found. Proceeding to build ourselves."
+            else
+              echo "Builder job finished with conclusion '${BUILDER_CONCLUSION}'. Proceeding to build ourselves."
+            fi
+            echo "cache-hit=false" >> "${GITHUB_OUTPUT}"
+            exit 0
+
+          done
+
+          echo "Timed out waiting for builder job. Proceeding to build ourselves."
+          echo "cache-hit=false" >> "${GITHUB_OUTPUT}"
+
+      - name: Build Debian package and sources
+        if: steps.restore-cache.outputs.cache-hit != 'true'
+        uses: canonical/desktop-engineering/gh-actions/common/build-debian@main
+        with:
+          docker-image: ubuntu:${{ inputs.ubuntu-version }}
+          # Add the Go backports PPA if we're testing a Ubuntu release which
+          # doesn't have the required Go version in main.
+          extra-apt-repositories: ${{ (inputs.ubuntu-version == 'noble' || inputs.ubuntu-version == 'questing') && 'ppa:ubuntu-enterprise-desktop/golang' || '' }}
+          # Extra build dependencies:
+          # - systemd-dev: Required to read compile time variables from systemd via pkg-config.
+          extra-source-build-deps: |
+            ca-certificates
+            git
+            libssl-dev
+            systemd-dev
+          extra-source-build-script: |
+            if [ "${{ inputs.ubuntu-version }}" == noble ]; then
+              cargo install --locked --root=/usr \
+                cargo-vendor-filterer@${{ env.CARGO_VENDOR_FILTERER_VERSION }}
+              command -v cargo-vendor-filterer
+            fi
+          allow-sudo: true
+          lintian: --fail-on error,warning,info --verbose
+          run-lrc: true
+
+      - name: Prepare deb and sources for upload
+        if: steps.restore-cache.outputs.cache-hit != 'true'
+        run: |
+          set -euo pipefail
+          set -x
+
+          # In the next step we upload the deb and sources with 'oras push'.
+          # When using a relative file path with that command, that path is
+          # preserved and the directory structure is recreated when downloading
+          # the file. To avoid that, we copy the files to be uploaded to the
+          # working directory and upload them from there.
+
+          # Copy binary deb to working directory. In contrast to the dsc and
+          # changes files, the path to the binary deb is not set in the
+          # environment by the build-debian action, so we have to find it first.
+          DEB_PATH=$(find "${{ env.BUILD_OUTPUT_DIR }}" -maxdepth 1 -name "authd_*.deb")
+          PKG_DEB=$(basename "${DEB_PATH}")
+          cp "${DEB_PATH}" "${PKG_DEB}"
+          echo "PKG_DEB=${PKG_DEB}" >> ${GITHUB_ENV}
+
+          # Copy sources to working directory
+          TARBALL_PATH=$(find "${{ env.SOURCE_OUTPUT_DIR }}" -maxdepth 1 -name "authd_*.tar*")
+          PKG_TARBALL=$(basename "${TARBALL_PATH}")
+          cp "${TARBALL_PATH}" "${PKG_TARBALL}"
+          cp "${{ env.SOURCE_OUTPUT_DIR }}/${{ env.PKG_DSC }}" .
+          cp "${{ env.SOURCE_OUTPUT_DIR }}/${{ env.PKG_SOURCE_CHANGES }}" .
+          echo "PKG_TARBALL=${PKG_TARBALL}" >> ${GITHUB_ENV}
+
+      - name: Upload deb and sources as OCI artifacts
+        run: |
+          set -euo pipefail
+          set -x
+
+          OCI_REPO=ghcr.io/${{ github.repository }}/authd-deb-${{ inputs.ubuntu-version }}
+          OCI_TAG=${{ inputs.files-hash }}
+          oras push "${OCI_REPO}:${OCI_TAG}" \
+            "${{ env.PKG_DEB }}" \
+            --artifact-type=application/vnd.debian.binary-package \
+            --annotation "org.opencontainers.image.title=authd debian package" \
+            --annotation "org.opencontainers.image.version=${{ env.PKG_VERSION }}"
+          oras tag "${OCI_REPO}:${OCI_TAG}" "${{ github.sha }}"
+          rm "${{ env.PKG_DEB }}"
+
+          OCI_REPO=ghcr.io/${{ github.repository }}/authd-deb-sources-${{ inputs.ubuntu-version }}
+          oras push "${OCI_REPO}:${OCI_TAG}" \
+            "${{ env.PKG_DSC }}" \
+            "${{ env.PKG_SOURCE_CHANGES }}" \
+            "${{ env.PKG_TARBALL }}" \
+            --artifact-type=application/vnd.debian.source-package \
+            --annotation "org.opencontainers.image.title=authd source debian package" \
+            --annotation "org.opencontainers.image.version=${{ env.PKG_VERSION }}"
+          oras tag "${OCI_REPO}:${OCI_TAG}" "${{ github.sha }}"
+          rm "${{ env.PKG_DSC }}" \
+             "${{ env.PKG_SOURCE_CHANGES }}" \
+             "${{ env.PKG_TARBALL }}"
+
+      - name: Generate outputs
+        id: outputs
+        run: |
+          (
+            echo "pkg-name=${{ env.PKG_NAME }}"
+            echo "pkg-version=${{ env.PKG_VERSION }}"
+            echo "pkg-dsc=${{ env.PKG_DSC }}"
+            echo "pkg-src-changes=${{ env.PKG_SOURCE_CHANGES }}"
+          ) >> "${GITHUB_OUTPUT}"
diff --git a/.github/workflows/debian.yaml b/.github/workflows/debian.yaml
new file mode 100644
index 0000000000..f5b7b0c691
--- /dev/null
+++ b/.github/workflows/debian.yaml
@@ -0,0 +1,117 @@
+name: Debian Packaging
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - '**'
+      - '!.github/**'
+      - '.github/workflows/debian.yaml'
+      - '.github/workflows/debian-build.yaml'
+      - '.github/workflows/debian-build-test-and-sync.yaml'
+      - '!.gitignore'
+      - '!.gitmodules'
+      - '!.golangci.yaml'
+      - '!*.md'
+      - '!COPYING*'
+      - '!authd-oidc-brokers/**'
+      - '!docs/**'
+      - '!e2e-tests/**'
+      - '!examplebroker/**'
+      - '!gotestcov'
+      - '!snap/**'
+      - '!**_test.go'
+      - '!**/testdata/**'
+      - '!**/testutils/**'
+
+    tags:
+      - "*"
+  pull_request:
+    paths:
+      - '**'
+      - '!.github/**'
+      - '.github/workflows/debian.yaml'
+      - '.github/workflows/debian-build.yaml'
+      - '.github/workflows/debian-build-test-and-sync.yaml'
+      - '!.gitignore'
+      - '!.gitmodules'
+      - '!.golangci.yaml'
+      - '!*.md'
+      - '!COPYING*'
+      - '!authd-oidc-brokers/**'
+      - '!docs/**'
+      - '!e2e-tests/**'
+      - '!examplebroker/**'
+      - '!gotestcov'
+      - '!snap/**'
+      - '!**_test.go'
+      - '!**/testdata/**'
+      - '!**/testutils/**'
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  compute-hash:
+    name: Compute hash of build-relevant files
+    runs-on: ubuntu-latest
+    outputs:
+      files-hash: ${{ steps.hash.outputs.hash }}
+    steps:
+      - uses: actions/checkout@v6
+      - name: Compute hash of build-relevant files
+        id: hash
+        run: |
+          hash=$(bash .github/scripts/compute-deb-build-hash.sh)
+          echo "hash=${hash}" >> "${GITHUB_OUTPUT}"
+
+  get-modified-files:
+    name: Get modified files
+    runs-on: ubuntu-latest
+    outputs:
+      list: ${{ fromJSON(steps.git-diff.outputs.modified_files) }}
+
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 100
+
+      - id: git-diff
+        name: Get modified files
+        run: |
+          set -ue
+
+          base_ref=${{ github.event.pull_request.base.sha }}
+          if [ -z "${base_ref}" ]; then
+            base_ref=${{ github.event.before }}
+          fi
+          if [ -z "${base_ref}" ]; then
+            base_ref=$(git log --root --reverse -n1 --format=%H)
+          fi
+
+          # Build a JSON array of modified paths.
+          modified_files=$(git diff --name-only "${base_ref}" HEAD | \
+            while read line; do
+              jq -n --arg path "$line" '$path'
+            done | jq -n '. |= [inputs]')
+          echo "${modified_files}"
+
+          escaped_json=$(echo "${modified_files}" | jq '.| tostring')
+          echo "modified_files=${escaped_json}" >> "${GITHUB_OUTPUT}"
+
+  build-deb-and-test:
+    needs:
+      - compute-hash
+      - get-modified-files
+    strategy:
+      matrix:
+        ubuntu-version: [ 'noble', 'questing', 'devel' ]
+      fail-fast: false
+    uses: ./.github/workflows/debian-build-test-and-sync.yaml
+    with:
+      files-hash: ${{ needs.compute-hash.outputs.files-hash }}
+      ubuntu-version: ${{ matrix.ubuntu-version }}
+      modified-files: ${{ needs.get-modified-files.outputs.list }}
+    secrets: inherit
diff --git a/.github/workflows/e2e-tests-provision-and-run.yaml b/.github/workflows/e2e-tests-provision-and-run.yaml
new file mode 100644
index 0000000000..69c0fc6bf0
--- /dev/null
+++ b/.github/workflows/e2e-tests-provision-and-run.yaml
@@ -0,0 +1,141 @@
+name: provision-e2e-test (reusable)
+
+on:
+  workflow_call:
+    inputs:
+      files-hash:
+        description: 'Hash of build-relevant files, used as cache key and concurrency group'
+        type: string
+        required: true
+      ubuntu-version:
+        required: true
+        type: string
+    secrets:
+      E2E_VM_SSH_PRIV_KEY:
+        required: true
+      E2E_VM_SSH_PUB_KEY:
+        required: true
+
+env:
+  DEBIAN_FRONTEND: noninteractive
+  VM_NAME_BASE: e2e-runner
+  ARTIFACTS_DIR: /tmp/e2e-artifacts
+  E2E_TESTS_DIR: e2e-tests
+
+jobs:
+  provision-vm:
+    name: Provision VM
+    runs-on: ubuntu-latest
+    permissions:
+      # Needed by actions/checkout
+      contents: read
+      # Needed to push OCI artifact to ghcr.io
+      packages: write
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Restore cached VM image (if available)
+        id: restore-cache
+        uses: actions/cache/restore@v5
+        with:
+          path: ${{ env.ARTIFACTS_DIR }}/${{ env.VM_NAME_BASE }}-${{ inputs.ubuntu-version }}.qcow2
+          key: >-
+            e2e-runner-vm-${{ inputs.ubuntu-version }}-${{ hashFiles(
+              'e2e-tests/vm/**',
+              '.github/actions/e2e-tests/set-up-ssh-keys/**',
+              '.github/workflows/e2e-tests-provision-and-run.yaml'
+            ) }}
+          fail-on-cache-miss: false
+
+      - uses: canonical/desktop-engineering/gh-actions/common/dpkg-install-speedup@main
+        if: steps.restore-cache.outputs.cache-hit != 'true'
+
+      - name: Install APT dependencies for VM provisioning
+        if: steps.restore-cache.outputs.cache-hit != 'true'
+        run: ./${{ env.E2E_TESTS_DIR }}/vm/install-provision-deps.sh
+
+      - name: Set up SSH keys for the VM provisioning
+        id: set-ssh-keys
+        if: steps.restore-cache.outputs.cache-hit != 'true'
+        uses: ./.github/actions/e2e-tests/set-up-ssh-keys
+        with:
+          E2E_VM_SSH_PRIV_KEY: ${{ secrets.E2E_VM_SSH_PRIV_KEY }}
+          E2E_VM_SSH_PUB_KEY: ${{ secrets.E2E_VM_SSH_PUB_KEY }}
+
+      - name: Provision the VM
+        id: provision-vm
+        if: steps.restore-cache.outputs.cache-hit != 'true'
+        run: |
+          set -eu
+          export PATH="$(realpath "${{ env.E2E_TESTS_DIR }}/vm/helpers"):${PATH}"
+          mkdir -p ${{ env.ARTIFACTS_DIR }}
+          env VM_NAME_BASE="${{ env.VM_NAME_BASE }}" \
+            RELEASE="${{ inputs.ubuntu-version }}" \
+            ARTIFACTS_DIR="${{ env.ARTIFACTS_DIR }}" \
+            SSH_PUBLIC_KEY_FILE="${{ steps.set-ssh-keys.outputs.keys-path }}/id_rsa.pub" \
+            ./${{ env.E2E_TESTS_DIR }}/vm/provision-ubuntu.sh
+
+      - name: Clean previous cache
+        if: always() && steps.provision-vm.outcome == 'success'
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_REPO: ${{ github.repository }}
+        run: |
+          set -eu
+          gh cache delete e2e-runner-${{ inputs.ubuntu-version }} || true
+          echo "Previous cache (if any) deleted"
+
+      - name: Cache the VM image
+        uses: actions/cache/save@v5
+        if: always() && steps.provision-vm.outcome == 'success'
+        with:
+          path: ${{ env.ARTIFACTS_DIR }}/${{ env.VM_NAME_BASE }}-${{ inputs.ubuntu-version }}.qcow2
+          key: >-
+            e2e-runner-vm-${{ inputs.ubuntu-version }}-${{ hashFiles(
+              'e2e-tests/vm/**',
+              '.github/actions/e2e-tests/set-up-ssh-keys/**',
+              '.github/workflows/e2e-tests-provision-and-run.yaml'
+            ) }}
+
+      - uses: ./.github/actions/setup-oras
+
+      - name: Upload VM image as OCI artifact
+        if: steps.provision-vm.outcome == 'success' || steps.restore-cache.outputs.cache-hit == 'true'
+        env:
+          IMAGE_PATH: ${{ env.ARTIFACTS_DIR }}/${{ env.VM_NAME_BASE }}-${{ inputs.ubuntu-version }}.qcow2
+          OCI_REPO: ghcr.io/${{ github.repository }}/e2e-runner
+          OCI_TAG: ${{ inputs.ubuntu-version }}
+        run: |
+          set -euo pipefail
+
+          echo "${{ secrets.GITHUB_TOKEN }}" \
+            | oras login ghcr.io -u "${{ github.actor }}" --password-stdin
+
+          # Chunk qcow2 into stable fixed-size layers (64 MiB)
+          WORKDIR=$(mktemp -d)
+          split -b 64M "$IMAGE_PATH" "$WORKDIR/chunk-"
+
+          # Push as a layered OCI artifact (each chunk becomes a layer)
+          cd "$WORKDIR"
+          oras push "${OCI_REPO}:${OCI_TAG}" chunk-* --artifact-type application/vnd.qemu.qcow2
+
+  build-deb:
+    uses: ./.github/workflows/debian-build.yaml
+    with:
+      files-hash: ${{ inputs.files-hash }}
+      ubuntu-version: ${{ inputs.ubuntu-version }}
+    secrets: inherit
+
+  e2e-test:
+    needs:
+      - provision-vm
+      - build-deb
+    strategy:
+      matrix:
+        broker: [ authd-msentraid, authd-google ]
+      fail-fast: false
+    uses: ./.github/workflows/e2e-tests-run.yaml
+    with:
+      ubuntu-version: ${{ inputs.ubuntu-version }}
+      broker: ${{ matrix.broker }}
+    secrets: inherit
diff --git a/.github/workflows/e2e-tests-run.yaml b/.github/workflows/e2e-tests-run.yaml
new file mode 100644
index 0000000000..e00a4fcc53
--- /dev/null
+++ b/.github/workflows/e2e-tests-run.yaml
@@ -0,0 +1,310 @@
+name: run-e2e-test (reusable)
+
+on:
+  workflow_call:
+    inputs:
+      ubuntu-version:
+        required: true
+        type: string
+      broker:
+        required: true
+        type: string
+    secrets:
+      E2E_VM_SSH_PRIV_KEY:
+        required: true
+      E2E_VM_SSH_PUB_KEY:
+        required: true
+      E2E_MSENTRA_ISSUER_ID:
+        required: false
+      E2E_MSENTRA_CLIENT_ID:
+        required: false
+      E2E_MSENTRA_USERNAME:
+        required: false
+      E2E_MSENTRA_PASSWORD:
+        required: false
+      E2E_MSENTRA_TOTP_SECRET:
+        required: false
+      E2E_GOOGLE_CLIENT_ID:
+        required: false
+      E2E_GOOGLE_CLIENT_SECRET:
+        required: false
+      E2E_GOOGLE_USERNAME:
+        required: false
+      E2E_GOOGLE_PASSWORD:
+        required: false
+      E2E_GOOGLE_TOTP_SECRET:
+        required: false
+      R2_ACCESS_KEY_ID:
+        required: true
+      R2_SECRET_ACCESS_KEY:
+        required: true
+      R2_ACCOUNT_ID:
+        required: true
+
+env:
+  DEBIAN_FRONTEND: noninteractive
+  VM_NAME_BASE: e2e-runner
+  ARTIFACTS_DIR: /tmp/e2e-artifacts
+  E2E_TESTS_DIR: e2e-tests
+  OUTPUT_DIR: /tmp/e2e-${{ inputs.broker }}-${{ inputs.ubuntu-version }}/output
+
+jobs:
+  build-broker-snap:
+    uses: ./.github/workflows/build-broker-snap.yaml
+    with:
+      broker: ${{ inputs.broker }}
+    secrets: inherit
+
+  run-tests:
+    name: Run e2e-tests (${{ inputs.broker }})
+    needs: build-broker-snap
+    runs-on: ubuntu-latest
+    permissions:
+      # Needed by actions/checkout
+      contents: read
+      # Needed to pull OCI artifacts from ghcr.io
+      packages: read
+      # Needed to use the commit statuses API to show a PR check for the e2e-test logs
+      statuses: write
+    steps:
+      - uses: actions/checkout@v6
+
+      - uses: ./.github/actions/setup-oras
+
+      - name: Download the broker snap
+        id: download-broker-snap
+        env:
+          OCI_REPO: ghcr.io/${{ github.repository }}/${{ inputs.broker }}-snap
+          OCI_TAG: ${{ github.sha }}
+        run: |
+          set -euo pipefail
+
+          echo "${{ secrets.GITHUB_TOKEN }}" \
+            | oras login ghcr.io -u "${{ github.actor }}" --password-stdin
+
+          oras pull "${OCI_REPO}:${OCI_TAG}"
+
+          SNAP=$(find . -maxdepth 1 -name '*.snap')
+          if [ -z "$SNAP" ] || [ ! -f "$SNAP" ]; then
+            echo "Error: Snap file not found after pulling from OCI registry"
+            exit 1
+          fi
+
+          mkdir -p "${{ env.ARTIFACTS_DIR }}"
+          mv "$SNAP" "${{ env.ARTIFACTS_DIR }}"
+          SNAP=$(realpath "${{ env.ARTIFACTS_DIR }}/$SNAP")
+          echo "snap=${SNAP}" >> $GITHUB_OUTPUT
+
+      - name: Download the authd deb
+        id: download-authd-deb
+        env:
+          OCI_REPO: ghcr.io/${{ github.repository }}/authd-deb-${{ inputs.ubuntu-version }}
+          OCI_TAG: ${{ github.sha }}
+        run: |
+          set -euo pipefail
+
+          echo "${{ secrets.GITHUB_TOKEN }}" \
+            | oras login ghcr.io -u "${{ github.actor }}" --password-stdin
+
+          oras pull "${OCI_REPO}:${OCI_TAG}"
+
+          DEB=$(find . -maxdepth 1 -name 'authd_*.deb')
+          if [ -z "$DEB" ] || [ ! -f "$DEB" ]; then
+            echo "Error: Deb not found after pulling from OCI registry"
+            exit 1
+          fi
+
+          mkdir -p "${{ env.ARTIFACTS_DIR }}"
+          mv "$DEB" "${{ env.ARTIFACTS_DIR }}"
+          DEB=$(realpath "${{ env.ARTIFACTS_DIR }}/$DEB")
+          echo "deb=${DEB}" >> $GITHUB_OUTPUT
+
+      - name: Download the VM image
+        id: download-vm-image
+        env:
+          OCI_REPO: ghcr.io/${{ github.repository }}/e2e-runner
+          OCI_TAG: ${{ inputs.ubuntu-version }}
+          IMAGE_PATH: ${{ env.ARTIFACTS_DIR }}/${{ env.VM_NAME_BASE }}-${{ inputs.ubuntu-version }}.qcow2
+        run: |
+          set -euo pipefail
+
+          mkdir -p "$(dirname "$IMAGE_PATH")"
+
+          echo "${{ secrets.GITHUB_TOKEN }}" \
+            | oras login ghcr.io -u "${{ github.actor }}" --password-stdin
+
+          oras pull "${OCI_REPO}:${OCI_TAG}"
+          cat chunk-* > "$IMAGE_PATH"
+          rm chunk-*
+          echo "image-path=${IMAGE_PATH}" >> $GITHUB_OUTPUT
+
+      - uses: canonical/desktop-engineering/gh-actions/common/dpkg-install-speedup@main
+
+      - name: Install APT dependencies for provisioning
+        run: ${{ env.E2E_TESTS_DIR }}/vm/install-provision-deps.sh
+
+      - name: Set up SSH keys for the VM provisioning
+        id: set-ssh-keys
+        uses: ./.github/actions/e2e-tests/set-up-ssh-keys
+        with:
+          E2E_VM_SSH_PRIV_KEY: ${{ secrets.E2E_VM_SSH_PRIV_KEY }}
+          E2E_VM_SSH_PUB_KEY: ${{ secrets.E2E_VM_SSH_PUB_KEY }}
+
+      - name: Provision authd and the broker
+        run: |
+          set -eux
+          export PATH="$(realpath "${{ env.E2E_TESTS_DIR }}/vm/helpers"):${PATH}"
+
+          # Generate the libvirt domain XML file
+          template="${{ env.E2E_TESTS_DIR }}/vm/e2e-runner-template.xml"
+          env \
+            IMAGE_FILE=${{ steps.download-vm-image.outputs.image-path }} \
+            VM_NAME=${{ env.VM_NAME_BASE }}-${{ inputs.ubuntu-version }} \
+            envsubst \
+              < "${template}" \
+              > "${{ env.ARTIFACTS_DIR }}/${{ env.VM_NAME_BASE }}.xml"
+
+          # Create the provisioning config file
+          cat > "${{ env.E2E_TESTS_DIR }}/vm/config.sh" <<-EOF
+            export SSH_PUBLIC_KEY_FILE=${{ steps.set-ssh-keys.outputs.keys-path }}/id_rsa.pub
+            export VM_NAME_BASE=${{ env.VM_NAME_BASE }}
+            export RELEASE=${{ inputs.ubuntu-version }}
+            export BROKER=${{ inputs.broker }}
+
+            export AUTHD_MSENTRAID_ISSUER_ID=${{ secrets.E2E_MSENTRA_ISSUER_ID }}
+            export AUTHD_MSENTRAID_CLIENT_ID=${{ secrets.E2E_MSENTRA_CLIENT_ID }}
+            export AUTHD_MSENTRAID_USER=${{ secrets.E2E_MSENTRA_USERNAME }}
+
+            export AUTHD_GOOGLE_CLIENT_ID=${{ secrets.E2E_GOOGLE_CLIENT_ID }}
+            export AUTHD_GOOGLE_CLIENT_SECRET=${{ secrets.E2E_GOOGLE_CLIENT_SECRET }}
+            export AUTHD_GOOGLE_USER=${{ secrets.E2E_GOOGLE_USERNAME }}
+          EOF
+
+          # Provision the VM
+          ${{ env.E2E_TESTS_DIR }}/vm/provision-authd.sh \
+            --authd-deb "${{ steps.download-authd-deb.outputs.deb }}" \
+            --broker-snap "${{ steps.download-broker-snap.outputs.snap }}"
+
+      - name: Checkout YARF repo
+        uses: actions/checkout@v6
+        with:
+          repository: adombeck/yarf
+          path: ${{ env.E2E_TESTS_DIR }}/.yarf
+
+      - name: Install APT dependencies for running the E2E tests
+        run: ${{ env.E2E_TESTS_DIR }}/install-deps.sh
+
+      - name: Configure YARF
+        run: ${{ env.E2E_TESTS_DIR }}/setup-yarf.sh
+
+      - name: Run tests
+        id: run-tests
+        run: |
+          set -eux
+          export PATH="$(realpath "${{ env.E2E_TESTS_DIR }}/vm/helpers"):${PATH}"
+
+          # Set the credentials for the broker
+          if [ "${{ inputs.broker }}" = "authd-msentraid" ]; then
+            E2E_USER=${{ secrets.E2E_MSENTRA_USERNAME }}
+            E2E_PASSWORD=${{ secrets.E2E_MSENTRA_PASSWORD }}
+            TOTP_SECRET=${{ secrets.E2E_MSENTRA_TOTP_SECRET }}
+          elif [ "${{ inputs.broker }}" = "authd-google" ]; then
+            E2E_USER=${{ secrets.E2E_GOOGLE_USERNAME }}
+            E2E_PASSWORD=${{ secrets.E2E_GOOGLE_PASSWORD }}
+            TOTP_SECRET=${{ secrets.E2E_GOOGLE_TOTP_SECRET }}
+          fi
+
+          # Run the tests
+          ${{ env.E2E_TESTS_DIR }}/run-tests.sh \
+            --user "${E2E_USER}" \
+            --password "${E2E_PASSWORD}" \
+            --totp-secret "${TOTP_SECRET}" \
+            --release "${{ inputs.ubuntu-version }}" \
+            --broker "${{ inputs.broker }}" \
+            --output-dir "${{ env.OUTPUT_DIR }}" \
+            || exit_code=$?
+
+          if [ -n "${exit_code:-}" ]; then
+            state="failure"
+          else
+            state="success"
+          fi
+
+          echo "log=${{ env.OUTPUT_DIR }}/log.html" >> "$GITHUB_OUTPUT"
+          echo "report=${{ env.OUTPUT_DIR }}/report.html" >> "$GITHUB_OUTPUT"
+          echo "state=${state}" >> "$GITHUB_OUTPUT"
+          echo "exit-code=${exit_code:-0}" >> "$GITHUB_OUTPUT"
+          echo "Exit code: ${exit_code:-0}"
+
+      - name: Upload test results as artifact
+        if: always()
+        id: upload-results
+        uses: actions/upload-artifact@v7
+        with:
+          name: e2e-tests-${{ inputs.ubuntu-version }}-${{ inputs.broker }}-${{ github.run_id }}-${{ github.run_attempt }}
+          path: ${{ env.OUTPUT_DIR }}
+
+      - name: Prepare upload to Pages
+        id: prepare-pages
+        # Only run if either the log or the report file exists
+        if: always() && (steps.run-tests.outputs.log != '' || steps.run-tests.outputs.report != '')
+        run: |
+          set -euo pipefail
+          TARGET_DIR="pr-${{ github.event.pull_request.number }}/run-${{ github.run_id }}-${{ github.run_attempt }}/${{ inputs.ubuntu-version }}-${{ inputs.broker }}"
+          mkdir -p "pages/${TARGET_DIR}"
+          cp "${{ steps.run-tests.outputs.log }}" "pages/${TARGET_DIR}/log.html"
+          cp "${{ steps.run-tests.outputs.report }}" "pages/${TARGET_DIR}/report.html"
+          echo "target-dir=${TARGET_DIR}" >> "$GITHUB_OUTPUT"
+
+          # Add a link to the parent directory to the log and report pages
+          for page in "pages/${TARGET_DIR}"/*.html; do
+            sed -i 's|<div id="header"></div>|<div style="padding:8px;background:#333;"><a href=".." style="color:#aaa;font-family:sans-serif;font-size:14px;">← Back to parent directory</a></div><div id="header"></div>|' "$page"
+          done
+
+          # We can't pass this as a secret because then it's masked in the logs
+          # and we can't pass it as an Action variable because those are not
+          # available in called reusable workflows.
+          R2_E2E_TEST_DOMAIN="authd-e2e-test-logs.adrian-dombeck.workers.dev"
+          echo "log-url=https://${R2_E2E_TEST_DOMAIN}/${TARGET_DIR}/log.html" >> "$GITHUB_OUTPUT"
+
+      - name: Upload test logs
+        id: upload-pages
+        env:
+          AWS_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
+        run: |
+          aws s3 sync pages/ s3://authd-e2e-test-logs/ \
+            --endpoint-url https://${{ secrets.R2_ACCOUNT_ID }}.r2.cloudflarestorage.com \
+            --region auto
+
+      - name: Create commit status with link to the logs
+        id: create-commit-status
+        uses: actions/github-script@v8
+        if: always() && steps.upload-pages.outcome == 'success'
+        with:
+          retries: 3
+          script: |
+            const response = await github.rest.repos.createCommitStatus({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              sha: context.sha,
+              state: '${{ steps.run-tests.outputs.state }}',
+              target_url: '${{ steps.prepare-pages.outputs.log-url }}',
+              description: 'View logs',
+              context: 'e2e-tests (${{ inputs.ubuntu-version }}) (${{ inputs.broker }})',
+            });
+            console.log(JSON.stringify(response, null, 2));
+
+      - name: Check the test result
+        uses: actions/github-script@v8
+        if: always()
+        with:
+          script: |
+            const state = '${{ steps.run-tests.outputs.state }}';
+            const logUrl = '${{ steps.prepare-pages.outputs.log-url }}';
+
+            if (state === 'failure') {
+              core.setFailed(`e2e-tests failed with exit code ${{ steps.run-tests.outputs.exit-code }}. See the logs at ${logUrl}`);
+            } else {
+              console.log(`::notice::e2e-tests passed, see the logs at ${logUrl}`);
+            }
diff --git a/.github/workflows/e2e-tests.yaml b/.github/workflows/e2e-tests.yaml
new file mode 100644
index 0000000000..352e8b3b5b
--- /dev/null
+++ b/.github/workflows/e2e-tests.yaml
@@ -0,0 +1,81 @@
+name: e2e-tests
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - '**'
+      - '!.github/**'
+      - '.github/workflows/build-broker-snap.yaml'
+      - '.github/workflows/e2e-tests.yaml'
+      - '.github/workflows/e2e-tests-provision-and-run.yaml'
+      - '.github/workflows/e2e-tests-run.yaml'
+      - '.github/workflows/debian-build.yaml'
+      - '!.gitignore'
+      - '!.gitmodules'
+      - '!.golangci.yaml'
+      - '!*.md'
+      - '!COPYING*'
+      - '!docs/**'
+      - '!examplebroker/**'
+      - '!gotestcov'
+      - '!**_test.go'
+      - '!**/testdata/**'
+      - '!**/testutils/**'
+
+    tags:
+      - "*"
+  pull_request:
+    paths:
+      - '**'
+      - '!.github/**'
+      - '.github/workflows/build-broker-snap.yaml'
+      - '.github/workflows/e2e-tests.yaml'
+      - '.github/workflows/e2e-tests-provision-and-run.yaml'
+      - '.github/workflows/e2e-tests-run.yaml'
+      - '.github/workflows/debian-build.yaml'
+      - '!.gitignore'
+      - '!.gitmodules'
+      - '!.golangci.yaml'
+      - '!*.md'
+      - '!COPYING*'
+      - '!docs/**'
+      - '!examplebroker/**'
+      - '!gotestcov'
+      - '!**_test.go'
+      - '!**/testdata/**'
+      - '!**/testutils/**'
+  workflow_dispatch:
+  schedule:
+    - cron: '0 0 * * 1'  # Runs every Monday at midnight
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  compute-hash:
+    name: Compute hash of build-relevant files
+    runs-on: ubuntu-latest
+    outputs:
+      files-hash: ${{ steps.hash.outputs.hash }}
+    steps:
+      - uses: actions/checkout@v6
+      - name: Compute hash of build-relevant files
+        id: hash
+        run: |
+          hash=$(bash .github/scripts/compute-deb-build-hash.sh)
+          echo "hash=${hash}" >> "${GITHUB_OUTPUT}"
+
+  provision-and-run:
+    needs: compute-hash
+    strategy:
+      matrix:
+        ubuntu-version: [ 'noble', 'questing' ]
+      fail-fast: false
+    uses: ./.github/workflows/e2e-tests-provision-and-run.yaml
+    with:
+      ubuntu-version: ${{ matrix.ubuntu-version }}
+      files-hash: ${{ needs.compute-hash.outputs.files-hash }}
+    secrets: inherit
diff --git a/.github/workflows/git.yaml b/.github/workflows/git.yaml
new file mode 100644
index 0000000000..2555375d76
--- /dev/null
+++ b/.github/workflows/git.yaml
@@ -0,0 +1,25 @@
+name: Git Checks
+
+on: [pull_request]
+
+jobs:
+  block-fixup:
+    runs-on: ubuntu-latest
+
+    steps:
+    - uses: actions/checkout@v6
+    - name: Block Fixup Commit Merge
+      run: |
+        PR_REF="${GITHUB_REF%/merge}/head"
+        BASE_REF="${GITHUB_BASE_REF}"
+        git fetch --no-tags --prune --progress --no-recurse-submodules --depth=1 origin "${BASE_REF}:__ci_base"
+        git fetch --no-tags --prune --progress --no-recurse-submodules --shallow-exclude="${BASE_REF}" origin "${PR_REF}:__ci_pr"
+        COMMIT_LIST=$(/usr/bin/git log --pretty=format:%s __ci_base..__ci_pr)
+        echo "Fixup commits:"
+        if echo "${COMMIT_LIST}" | grep -iE '^(fixup|squash|wip)'; then
+          exit 1
+        fi
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
diff --git a/.github/workflows/git.yml b/.github/workflows/git.yml
deleted file mode 100644
index e3f3a5cfc2..0000000000
--- a/.github/workflows/git.yml
+++ /dev/null
@@ -1,12 +0,0 @@
-name: Git Checks
-
-on: [pull_request]
-
-jobs:
-  block-fixup:
-    runs-on: ubuntu-latest
-
-    steps:
-    - uses: actions/checkout@v4
-    - name: Block Fixup Commit Merge
-      uses: 13rac1/block-fixup-merge-action@v2.0.0
diff --git a/.github/workflows/oci-artifacts-cleanup.yaml b/.github/workflows/oci-artifacts-cleanup.yaml
new file mode 100644
index 0000000000..4fccde4e29
--- /dev/null
+++ b/.github/workflows/oci-artifacts-cleanup.yaml
@@ -0,0 +1,56 @@
+name: Clean up OCI artifacts
+on:
+  schedule:
+    # run every day at 5am UTC
+    - cron: '0 5 * * *'
+  workflow_dispatch:
+
+jobs:
+  cleanup-broker-snap:
+    runs-on: ubuntu-latest
+    permissions:
+      packages: write
+    strategy:
+      matrix:
+        broker: [ authd-msentraid, authd-google ]
+    steps:
+      - name: Delete broker snap OCI artifacts
+        uses: actions/delete-package-versions@v5
+        with:
+          package-name: authd/${{ matrix.broker }}-snap
+          package-type: container
+          min-versions-to-keep: 10
+
+  cleanup-deb:
+    runs-on: ubuntu-latest
+    permissions:
+      packages: write
+    strategy:
+      matrix:
+        ubuntu-version: [ 'noble', 'questing', 'devel' ]
+    steps:
+      - name: Delete deb OCI artifacts
+        uses: actions/delete-package-versions@v5
+        with:
+          package-name: authd/authd-deb-${{ matrix.ubuntu-version }}
+          package-type: container
+          min-versions-to-keep: 10
+
+      - name: Delete deb sources OCI artifacts
+        uses: actions/delete-package-versions@v5
+        with:
+          package-name: authd/authd-deb-sources-${{ matrix.ubuntu-version }}
+          package-type: container
+          min-versions-to-keep: 10
+
+  cleanup-e2e-test-vm-image:
+    runs-on: ubuntu-latest
+    permissions:
+      packages: write
+    steps:
+      - name: Delete e2e-test VM image OCI artifacts
+        uses: actions/delete-package-versions@v5
+        with:
+          package-name: authd/e2e-runner
+          package-type: container
+          min-versions-to-keep: 10
diff --git a/.github/workflows/qa.yaml b/.github/workflows/qa.yaml
index 07921a1cb0..315eff5a71 100644
--- a/.github/workflows/qa.yaml
+++ b/.github/workflows/qa.yaml
@@ -1,57 +1,95 @@
-name: QA & sanity checks
+name: authd QA & sanity checks
 on:
   push:
     branches:
       - main
-    paths-ignore:
-      - '.github/workflows/automatic-doc-checks.yml'
-      - '.readthedocs.yaml'
-      - 'docs/**'
+    paths:
+      - '**'
+      - '!.github/**'
+      - '.github/workflows/qa.yaml'
+      - '!.gitignore'
+      - '!.gitmodules'
+      - '!AGENTS.md'
+      - '!CODE_OF_CONDUCT.md'
+      - '!CONTRIBUTING.md'
+      - '!COPYING'
+      - '!COPYING.LESSER'
+      - '!README.md'
+      - '!SECURITY.md'
+      - '!authd-oidc-brokers/**'
+      - '!docs/**'
+      - '!examplebroker/**'
+      - '!gotestcov'
+      - '!snap/**'
     tags:
       - "*"
   pull_request:
-    paths-ignore:
-      - '.github/workflows/automatic-doc-checks.yml'
-      - '.readthedocs.yaml'
-      - 'docs/**'
+    paths:
+      - '**'
+      - '!.github/**'
+      - '.github/workflows/qa.yaml'
+      - '!.gitignore'
+      - '!.gitmodules'
+      - '!AGENTS.md'
+      - '!CODE_OF_CONDUCT.md'
+      - '!CONTRIBUTING.md'
+      - '!COPYING'
+      - '!COPYING.LESSER'
+      - '!README.md'
+      - '!SECURITY.md'
+      - '!authd-oidc-brokers/**'
+      - '!docs/**'
+      - '!examplebroker/**'
+      - '!gotestcov'
+      - '!snap/**'
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
 
 env:
   DEBIAN_FRONTEND: noninteractive
   GO_TESTS_TIMEOUT: 20m
-  apt_deps: >-
+  AUTHD_SSHD_STDERR_LOG_ALL_PAM_MESSAGES: true
+  c_build_dependencies: >-
+    clang-tools
+    clang
+    libglib2.0-dev
     libpam-dev
+
+  go_build_dependencies: >-
     libglib2.0-dev
+    libpam-dev
     libpwquality-dev
 
-  test_apt_deps: >-
-    apparmor-profiles
+  go_test_dependencies: >-
     bubblewrap
     cracklib-runtime
     git-delta
     openssh-client
     openssh-server
 
-  # In Rust the grpc stubs are generated at build time
-  # so we always need to install the protobuf compilers
-  # when building the NSS crate.
-  protobuf_compilers: >-
-    protobuf-compiler
-
 jobs:
   go-sanity:
     name: "Go: Code sanity"
+    permissions: {}
     runs-on: ubuntu-24.04 # ubuntu-latest-runner
     steps:
+      - uses: canonical/desktop-engineering/gh-actions/common/dpkg-install-speedup@main
       - name: Install dependencies
         run: |
-          sudo apt update
-          sudo apt install -y ${{ env.apt_deps }}
-      - uses: actions/checkout@v4
+          # Install dependencies
+          set -eu
+
+          sudo apt-get update
+          sudo apt-get install -y ${{ env.go_build_dependencies }}
+      - uses: actions/checkout@v6
       - name: Go code sanity check
-        uses: canonical/desktop-engineering/gh-actions/go/code-sanity@main
+        uses: canonical/desktop-engineering/gh-actions/go/code-sanity@v2
         with:
           golangci-lint-configfile: ".golangci.yaml"
           tools-directory: "tools"
+          token: ${{ secrets.GITHUB_TOKEN }}
       - name: Build cmd/authd with withexamplebroker tag
         run: |
           set -eu
@@ -75,15 +113,33 @@ jobs:
           test -e pam/pam_authd.so
           test -e pam/go-exec/pam_authd_exec.so
 
+  shell-sanity:
+    name: "Shell: Code sanity"
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - name: Run ShellCheck
+        uses: ludeeus/action-shellcheck@master
+        with:
+          ignore_paths: "./authd-oidc-brokers"
+
   rust-sanity:
     name: "Rust: Code sanity"
+    permissions: {}
     runs-on: ubuntu-24.04 # ubuntu-latest-runner
     steps:
+      - uses: canonical/desktop-engineering/gh-actions/common/dpkg-install-speedup@main
       - name: Install dependencies
         run: |
-          sudo apt update
-          sudo apt install -y ${{ env.apt_deps }} ${{ env.protobuf_compilers}}
-      - uses: actions/checkout@v4
+          # Install dependencies
+          set -eu
+
+          sudo apt-get update
+          # In Rust the grpc stubs are generated at build time
+          # so we always need to install the protobuf compilers
+          # when building the NSS crate.
+          sudo apt-get install -y protobuf-compiler
+      - uses: actions/checkout@v6
       - name: Rust code sanity check
         uses: canonical/desktop-engineering/gh-actions/rust/code-sanity@main
         with:
@@ -95,19 +151,21 @@ jobs:
     env:
       CFLAGS: "-Werror"
     steps:
+      - uses: canonical/desktop-engineering/gh-actions/common/dpkg-install-speedup@main
       - name: Install dependencies
         run: |
+          # Install dependencies
           set -eu
 
-          sudo apt update
-          sudo apt install -y ${{ env.apt_deps }} clang-tools clang
+          sudo apt-get update
+          sudo apt-get install -y ${{ env.c_build_dependencies }}
       - name: Prepare report dir
         run: |
           set -eu
 
           scan_build_dir=$(mktemp -d --tmpdir scan-build-dir-XXXXXX)
           echo SCAN_BUILD_REPORTS_PATH="${scan_build_dir}" >> $GITHUB_ENV
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: Run scan build on GDM extensions
         run: |
           set -eu
@@ -125,179 +183,178 @@ jobs:
             -lpam -shared -fPIC \
             pam/go-exec/module.c
       - name: Upload scan build reports
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: authd-${{ github.job }}-artifacts-${{ github.run_attempt }}
           path: ${{ env.SCAN_BUILD_REPORTS_PATH }}
 
-  go-tests:
-    name: "Go: Tests"
+  go-tests-coverage:
+    name: "Go Tests with Coverage Collection"
     runs-on: ubuntu-24.04 # ubuntu-latest-runner
-    strategy:
-      fail-fast: false
-      matrix:
-        test: ["coverage", "race", "asan"]
+    env:
+      RAW_COVERAGE_DIR: ${{ github.workspace }}/raw-coverage
+      COVERAGE_DIR: ${{ github.workspace }}/coverage
     steps:
-      - name: Install dependencies
-        run: |
-          # Disable installing of locales and manpages
-          cat <<"EOF" | sudo tee /etc/dpkg/dpkg.cfg.d/01_nodoc
-          # Delete locales
-          path-exclude=/usr/share/locale/*
-
-          # Delete man pages
-          path-exclude=/usr/share/man/*
-
-          # Delete docs
-          path-exclude=/usr/share/doc/*
-          path-include=/usr/share/doc/*/copyright
-          EOF
-
-          sudo apt update
-
-          # The integration tests build the NSS crate, so we need the cargo build dependencies in order to run them.
-          sudo apt install -y ${{ env.apt_deps }} ${{ env.protobuf_compilers}} ${{ env.test_apt_deps }}
-
-          # Load the apparmor profile for bubblewrap.
-          sudo ln -s /usr/share/apparmor/extra-profiles/bwrap-userns-restrict /etc/apparmor.d/
-          sudo apparmor_parser /etc/apparmor.d/bwrap-userns-restrict
-
-      - name: Install PAM and GLib debug symbols
-        continue-on-error: true
-        run: |
-          set -eu
-          sudo apt-get install ubuntu-dbgsym-keyring -y
-          echo "deb http://ddebs.ubuntu.com $(lsb_release -cs) main restricted universe multiverse
-          deb http://ddebs.ubuntu.com $(lsb_release -cs)-updates main restricted universe multiverse
-          deb http://ddebs.ubuntu.com $(lsb_release -cs)-proposed main restricted universe multiverse" | \
-          sudo tee -a /etc/apt/sources.list.d/ddebs.list
-          # Sometimes ddebs archive is stuck, so in case of failure we need to go manual
-          sudo apt update -y || true
-          if ! sudo apt install -y libpam-modules-dbgsym libpam0*-dbgsym libglib2.0-0*-dbgsym; then
-            sudo apt install -y ubuntu-dev-tools
-            for pkg in pam glib2.0; do
-              pull-lp-debs "${pkg}" $(lsb_release -cs)
-              pull-lp-ddebs "${pkg}" $(lsb_release -cs)
-            done
-            sudo apt install -y ./libpam0*.*deb ./libpam-modules*.*deb ./libglib2.0-0*-dbgsym*.ddeb
-            sudo apt remove -y ubuntu-dev-tools
-            sudo apt autoremove -y
-          fi
-      - uses: actions/checkout@v4
-      - uses: actions/setup-go@v5
-        with:
-          go-version-file: go.mod
-
-      - name: Install gotestfmt and our wrapper script
-        uses: canonical/desktop-engineering/gh-actions/go/gotestfmt@main
-
-      - name: Install VHS and ttyd for integration tests
-        run: |
-          set -eu
-          go install github.com/charmbracelet/vhs@latest
-
-          # VHS requires ttyd >= 1.7.2 to work properly.
-          wget https://github.com/tsl0922/ttyd/releases/download/1.7.7/ttyd.x86_64
-          chmod +x ttyd.x86_64
-          sudo mv ttyd.x86_64 /usr/bin/ttyd
-
-          # VHS doesn't really use ffmpeg anymore now, but it still checks for it.
-          # Drop this when https://github.com/charmbracelet/vhs/pull/591 is released.
-          sudo ln -s /usr/bin/true /usr/local/bin/ffmpeg
-
-      - name: Install rust
-        if: matrix.test != 'asan'
-        uses: actions-rs/toolchain@v1
-        with:
-          profile: minimal
-          toolchain: nightly # We need nightly to enable instrumentation for coverage.
-          override: true
-          components: llvm-tools-preview
-      - name: Install grcov
-        if: matrix.test == 'coverage'
-        uses: baptiste0928/cargo-install@v3
-        with:
-          crate: grcov
-      - name: Prepare tests artifacts path
-        run: |
-          set -eu
-
-          artifacts_dir=$(mktemp -d --tmpdir authd-test-artifacts-XXXXXX)
-          echo AUTHD_TESTS_ARTIFACTS_PATH="${artifacts_dir}" >> $GITHUB_ENV
-
-          echo ASAN_OPTIONS="log_path=${artifacts_dir}/asan.log:print_stats=true" >> $GITHUB_ENV
-
-      - name: Install coverage collection dependencies
-        if: matrix.test == 'coverage'
-        run: |
-          set -eu
-
-          # Dependendencies for C coverage collection
-          sudo apt install -y gcovr
-
-          # Dependendencies for Go coverage collection
-          go install github.com/AlekSi/gocov-xml@latest
-          go install github.com/axw/gocov/gocov@latest
-          dotnet tool install -g dotnet-reportgenerator-globaltool
-
-      - name: Run tests (with coverage collection)
-        if: matrix.test == 'coverage'
+      - uses: actions/checkout@v6
+      - uses: ./.github/actions/setup-go-tests
+      - uses: ./.github/actions/setup-go-coverage-tests
+      # Installation of debug symbols takes a long time (and fails currently),
+      # so we skip it for now. Enable on demand.
+      # - uses: ./.github/actions/install-debug-symbols
+      #   continue-on-error: true
+
+      - name: Run tests with coverage collection
         env:
           G_DEBUG: "fatal-criticals"
         run: |
           set -euo pipefail
 
           # The coverage is not written if the output directory does not exist, so we need to create it.
-          cov_dir=${PWD}/coverage
-          codecov_dir=${cov_dir}/codecov
-          raw_cov_dir=${cov_dir}/raw
-          mkdir -p "${raw_cov_dir}" "${codecov_dir}"
+          mkdir -p "${RAW_COVERAGE_DIR}"
 
           # Print executed commands to ease debugging
           set -x
 
+          # Work around https://github.com/golang/go/issues/75031
+          go env -w GOTOOLCHAIN="$(go version | awk '{ print $3 }')+auto"
+
           # Overriding the default coverage directory is not an exported flag of go test (yet), so
           # we need to override it using the test.gocoverdir flag instead.
           #TODO: Update when https://go-review.googlesource.com/c/go/+/456595 is merged.
           go test -json -timeout ${GO_TESTS_TIMEOUT} -cover -covermode=set ./... -coverpkg=./... \
-            -shuffle=on -failfast -args -test.gocoverdir="${raw_cov_dir}" | \
+            -shuffle=on -args -test.gocoverdir="${RAW_COVERAGE_DIR}" | \
             gotestfmt --logfile "${AUTHD_TESTS_ARTIFACTS_PATH}/gotestfmt.cover.log"
 
-          # Convert the raw coverage data into textfmt so we can merge the Rust one into it
-          go tool covdata textfmt -i="${raw_cov_dir}" -o="${cov_dir}/coverage.out"
+      # Upload the test output for the go-tests-coverage-retry job which retries
+      # the failed tests.
+      - name: Upload JSON test output on failure
+        if: failure()
+        uses: actions/upload-artifact@v7
+        with:
+          name: coverage-test-output
+          path: ${{ env.AUTHD_TESTS_ARTIFACTS_PATH }}/gotestfmt.cover.stdout
+
+      # Upload the raw coverage data so that the go-tests-coverage-retry job has
+      # all the data to generate the coverage report (if the tests succeed on
+      # retry).
+      - name: Upload raw coverage on failure
+        if: failure()
+        uses: actions/upload-artifact@v7
+        with:
+          name: raw-coverage-data
+          path: ${{ env.RAW_COVERAGE_DIR }}
+
+      - uses: ./.github/actions/generate-coverage-report
+        with:
+          codecov-token: ${{ secrets.CODECOV_TOKEN }}
+
+      - uses: ./.github/actions/upload-test-artifacts
+        if: always()
+
+  go-tests-coverage-retry:
+    name: "Retry Go Tests with Coverage Collection"
+    needs: go-tests-coverage
+    if: always() && needs.go-tests-coverage.result == 'failure'
+    runs-on: ubuntu-24.04
+    env:
+      RAW_COVERAGE_DIR: ${{ github.workspace }}/raw-coverage
+      COVERAGE_DIR: ${{ github.workspace }}/coverage
+    steps:
+      - uses: actions/checkout@v6
+      - uses: ./.github/actions/setup-go-tests
+      - uses: ./.github/actions/setup-go-coverage-tests
+      # Installation of debug symbols takes a long time (and fails currently),
+      # so we skip it for now. Enable on demand.
+      # - uses: ./.github/actions/install-debug-symbols
+      #   continue-on-error: true
+
+      - name: Download JSON output of failed tests
+        uses: actions/download-artifact@v8
+        with:
+          name: coverage-test-output
+          path: /tmp/coverage-test-output
+
+      - name: Download raw coverage data
+        uses: actions/download-artifact@v8
+        with:
+          name: raw-coverage-data
+          path: ${{ env.RAW_COVERAGE_DIR }}
 
-          # Append the Rust coverage data to the Go one
-          cat "${raw_cov_dir}/rust-cov/rust2go_coverage" >>"${cov_dir}/coverage.out"
+      - name: Install gotest-rerun-failed
+        run: go install github.com/adombeck/gotest-rerun-failed@latest
 
-          # Filter out the testutils package and the pb.go file
-          grep -v -e "testutils" -e "pb.go" -e "testsdetection" "${cov_dir}/coverage.out" >"${cov_dir}/coverage.out.filtered"
+      - name: Retry failed tests with coverage collection
+        run: |
+          set -euo pipefail
 
-          # Generate the Cobertura report for Go and Rust
-          gocov convert "${cov_dir}/coverage.out.filtered" | gocov-xml > "${cov_dir}/coverage.xml"
-          reportgenerator -reports:"${cov_dir}/coverage.xml" -targetdir:"${cov_dir}" -reporttypes:Cobertura
+          # Print executed commands to ease debugging
+          set -x
 
-          # Generate the Cobertura report for C
-          gcovr --cobertura "${cov_dir}/Cobertura_C.xml" "${raw_cov_dir}"
+          test_output="/tmp/coverage-test-output/gotestfmt.cover.stdout"
+          for i in $(seq 1 3); do
+            echo "Retrying failed tests (attempt ${i})"
+            gotest-rerun-failed -json -timeout ${GO_TESTS_TIMEOUT} -cover -covermode=set -- -coverpkg=./... \
+              -shuffle=on -args -test.gocoverdir="${RAW_COVERAGE_DIR}" \
+              < "${test_output}" \
+              | gotestfmt --logfile "${AUTHD_TESTS_ARTIFACTS_PATH}/gotestfmt.cover.retry-$i.log" \
+              && exit_code=0 || exit_code=$?
+            if [ "${exit_code}" -eq 0 ]; then
+              break
+            fi
+            if [ "${i}" -eq 3 ]; then
+              echo "Tests failed 3 times, giving up"
+              exit ${exit_code}
+            fi
+            test_output="${AUTHD_TESTS_ARTIFACTS_PATH}/gotestfmt.cover.retry-$i.stdout"
+          done
 
-          # Merge Cobertura reports into a single one
-          reportgenerator -reports:"${cov_dir}/Cobertura.xml;${cov_dir}/Cobertura_C.xml" \
-            -targetdir:"${codecov_dir}" -reporttypes:Cobertura
+      - uses: ./.github/actions/generate-coverage-report
+        with:
+          codecov-token: ${{ secrets.CODECOV_TOKEN }}
 
-          # Store the coverage directory for the next steps
-          echo COVERAGE_DIR="${codecov_dir}" >> ${GITHUB_ENV}
+      - uses: ./.github/actions/upload-test-artifacts
+        if: always()
 
-      - name: Run tests (with race detector)
-        if: matrix.test == 'race'
+  go-tests-race:
+    name: "Go Tests with Race Detector"
+    runs-on: ubuntu-24.04 # ubuntu-latest-runner
+    steps:
+      - uses: actions/checkout@v6
+      - uses: ./.github/actions/setup-go-tests
+      # Installation of debug symbols takes a long time (and fails currently),
+      # so we skip it for now. Enable on demand.
+      # - uses: ./.github/actions/install-debug-symbols
+      #   continue-on-error: true
+
+      - name: Run tests with race detector
         env:
           GO_TESTS_TIMEOUT: 35m
           AUTHD_TESTS_SLEEP_MULTIPLIER: 3
           GORACE: log_path=${{ env.AUTHD_TESTS_ARTIFACTS_PATH }}/gorace.log
         run: |
           go test -json -timeout ${GO_TESTS_TIMEOUT} -race -failfast ./... | \
-            gotestfmt --logfile "${AUTHD_TESTS_ARTIFACTS_PATH}/gotestfmt.race.log"
+            gotestfmt --logfile "${AUTHD_TESTS_ARTIFACTS_PATH}/gotestfmt.race.log" || exit_code=$?
+
+          if [ "${exit_code:-0}" -ne 0 ]; then
+            cat "${AUTHD_TESTS_ARTIFACTS_PATH}"/gorace.log* || true
+            exit ${exit_code}
+          fi
 
-      - name: Run PAM tests (with Address Sanitizer)
-        if: matrix.test == 'asan'
+      - uses: ./.github/actions/upload-test-artifacts
+        if: always()
+
+  go-tests-asan:
+    name: "Go PAM tests with Address Sanitizer"
+    runs-on: ubuntu-24.04 # ubuntu-latest-runner
+    steps:
+      - uses: actions/checkout@v6
+      - uses: ./.github/actions/setup-go-tests
+      # Installation of debug symbols takes a long time (and fails currently),
+      # so we skip it for now. Enable on demand.
+      # - uses: ./.github/actions/install-debug-symbols
+      #   continue-on-error: true
+
+      - name: Run PAM tests with Address Sanitizer
         env:
           # Do not optimize, keep debug symbols and frame pointer for better
           # stack trace information in case of ASAN errors.
@@ -311,6 +368,11 @@ jobs:
           # Print executed commands to ease debugging
           set -x
 
+          echo "::group::Install llvm-symbolizer"
+          # For llvm-symbolizer
+          sudo apt-get install -y llvm
+          echo "::endgroup::"
+
           go test -C ./pam/internal -json -asan -gcflags=all="${GO_GC_FLAGS}" -failfast -timeout ${GO_TESTS_TIMEOUT} ./... | \
             gotestfmt --logfile "${AUTHD_TESTS_ARTIFACTS_PATH}/gotestfmt.pam-internal-asan.log" || exit_code=$?
           if [ -n "${exit_code:-}" ]; then
@@ -348,24 +410,5 @@ jobs:
 
           exit ${exit_code}
 
-      - name: Upload coverage to Codecov
-        if: matrix.test == 'coverage'
-        uses: codecov/codecov-action@v5
-        with:
-          directory: ${{ env.COVERAGE_DIR }}
-          files: ${{ env.COVERAGE_DIR }}/Cobertura.xml
-          token: ${{ secrets.CODECOV_TOKEN }}
-
-      - name: Upload coverage artifacts
-        if: matrix.test == 'coverage' && github.ref == 'refs/heads/main'
-        uses: actions/upload-artifact@v4
-        with:
-          name: coverage.zip
-          path: ${{ env.COVERAGE_DIR }}
-
-      - name: Upload test artifacts
+      - uses: ./.github/actions/upload-test-artifacts
         if: always()
-        uses: actions/upload-artifact@v4
-        with:
-          name: authd-${{ github.job }}-${{ matrix.test }}-artifacts-${{ github.run_attempt }}
-          path: ${{ env.AUTHD_TESTS_ARTIFACTS_PATH }}
diff --git a/.github/workflows/tics-run.yaml b/.github/workflows/tics-run.yaml
new file mode 100644
index 0000000000..1167a9ed8c
--- /dev/null
+++ b/.github/workflows/tics-run.yaml
@@ -0,0 +1,116 @@
+name: TICS QA Analysis
+
+on:
+    schedule:
+        - cron: '0 0 * * 1'  # Runs every Monday at midnight
+    workflow_dispatch:
+
+
+env:
+  DEBIAN_FRONTEND: noninteractive
+  build_dependencies: >-
+    clang-tools
+    clang
+    dotnet8
+    libglib2.0-dev
+    libpam-dev
+    libpwquality-dev
+    rustup
+
+jobs:
+    tics:
+        name: TIOBE TICS Framework
+        runs-on: [self-hosted, amd64, tiobe, noble]
+        steps:
+            - uses: actions/checkout@v6
+            - uses: actions/setup-go@v6
+              with:
+                go-version-file: go.mod
+
+            - uses: canonical/desktop-engineering/gh-actions/common/dpkg-install-speedup@main
+            - name: Install dependencies
+              run: |
+                set -eu
+
+                sudo apt-get update
+                sudo apt-get install -y ${{ env.build_dependencies }}
+
+                go install honnef.co/go/tools/cmd/staticcheck@latest
+
+            - name: Update Rust version
+              run: |
+                rustup update stable
+
+            - uses: canonical/desktop-engineering/gh-actions/go/generate@main
+              with:
+                tools-directory: ./tools
+
+            - name: Fetch last successful QA runs ids
+              env:
+                GITHUB_TOKEN: ${{ github.token }}
+              run: |
+                set -eu
+                echo "LAST_AUTHD_QA_ID=$(gh run list --workflow 'authd QA & sanity checks' --limit 1 --status success --json databaseId -b main | jq '.[].databaseId')" >> $GITHUB_ENV
+                echo "LAST_BROKERS_QA_ID=$(gh run list --workflow 'Brokers QA & sanity checks' --limit 1 --status success --json databaseId -b main | jq '.[].databaseId')" >> $GITHUB_ENV
+
+            - name: Download coverage artifact from authd QA
+              uses: actions/download-artifact@v8
+              with:
+                github-token: ${{ github.token }}
+                path: .artifacts/authd
+                run-id: ${{ env.LAST_AUTHD_QA_ID }}
+
+            - name: Download coverage artifact from brokers QA
+              uses: actions/download-artifact@v8
+              with:
+                github-token: ${{ github.token }}
+                path: .artifacts/brokers
+                run-id: ${{ env.LAST_BROKERS_QA_ID }}
+
+            - name: Merge coverage reports
+              run: |
+                set -eu
+
+                dotnet tool install -g dotnet-reportgenerator-globaltool
+
+                export PATH="$PATH:/home/ubuntu/.dotnet/tools"
+
+                mv .artifacts/authd/coverage/Cobertura.xml .artifacts/authd-coverage.xml
+                mv .artifacts/brokers/Cobertura.xml .artifacts/broker-coverage.xml
+
+                # TICS expects the coverage report to:
+                # - be in a directory named 'coverage' in the current working directory
+                mkdir -p coverage
+
+                # - have a single report named coverage.xml
+                reportgenerator -reports:.artifacts/*.xml -targetdir:coverage -reporttypes:Cobertura
+                mv coverage/Cobertura.xml coverage/coverage.xml
+
+            - name: Build artifacts
+              run: |
+                set -eu
+
+                # TICS needs to build the artifacts in order to run the analysis.
+                # Since it uses the GOTOOLCHAIN=local stanza, it's better if we prebuild it to make sure that the Go
+                # toolchain setup by the action is properly updated to the one we defined in go.mod. Prebuilding also
+                # helps to speed up the TICS analysis, as we would already have the build cache populated.
+                find pam -name '*.so' -print -delete
+                go build ./cmd/authd
+                go -C ./authd-oidc-brokers build -o authd-oidc ./cmd/authd-oidc
+                go -C ./authd-oidc-brokers build -tags=withgoogle -o authd-google ./cmd/authd-oidc
+
+                # We also need to build libhimmelblau when building the msentraid variant
+                git submodule update --init
+                cd ./authd-oidc-brokers
+                go generate --tags=withmsentraid ./internal/providers/msentraid/...
+                go build -tags=withmsentraid -o authd-msentraid ./cmd/authd-oidc
+
+            - name: TICS Analysis
+              uses: tiobe/tics-github-action@v3
+              with:
+                mode: qserver
+                project: authd
+                branchdir: .
+                viewerUrl: https://canonical.tiobe.com/tiobeweb/TICS/api/cfg?name=GoProjects
+                ticsAuthToken: ${{ secrets.TICSAUTHTOKEN }}
+                installTics: true
diff --git a/.github/workflows/update-broker-variant-branches.yaml b/.github/workflows/update-broker-variant-branches.yaml
new file mode 100644
index 0000000000..ce50edee24
--- /dev/null
+++ b/.github/workflows/update-broker-variant-branches.yaml
@@ -0,0 +1,49 @@
+name: Auto update broker variant branches
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - "authd-oidc-brokers/**"
+      - "!authd-oidc-brokers/e2e-tests/**"
+      - "!authd-oidc-brokers/po/**"
+      - "!authd-oidc-brokers/.gitignore"
+      - "snap/**"
+  workflow_dispatch:
+
+concurrency:
+  group: auto-update-broker-variants
+  cancel-in-progress: true
+
+permissions:
+    pull-requests: write
+    contents: write
+
+jobs:
+  update-snap-branches:
+    name: Update snap branches
+    strategy:
+      matrix:
+        branch_name: ["google","msentraid","oidc"]
+    runs-on: ubuntu-latest
+    steps:
+        - uses: actions/checkout@v6
+          with:
+            fetch-depth: 0
+
+        - name: Prepare snapcraft.yaml
+          # We can't symlink the snapcraft.yaml file here because it causes launchpad to fail with:
+          # "The top level of snapcraft.yaml from ~ubuntu-enterprise-desktop/authd/+git/authd:oidc is not a mapping"
+          run: ./snap/scripts/prepare-variant --copy --broker ${{ matrix.branch_name }}
+
+        - name: Commit broker variant files
+          run: |
+            set -eux
+            # We have to use --force because we added the broker variant files to .gitignore
+            git add --force .
+            git config user.name "github-actions[bot]"
+            git config user.email "github-actions[bot]@users.noreply.github.com"
+            git commit -m "Copy ${{ matrix.branch_name }} variant files"
+
+        - name: Push branch
+          run: git push --force origin HEAD:${{ matrix.branch_name }}
diff --git a/.github/workflows/validate-dependabot.yaml b/.github/workflows/validate-dependabot.yaml
index 135dbdb499..d58c0e89e2 100644
--- a/.github/workflows/validate-dependabot.yaml
+++ b/.github/workflows/validate-dependabot.yaml
@@ -3,13 +3,13 @@ name: dependabot validate
 on:
   pull_request:
     paths:
-      - '.github/dependabot.yml'
+      - '.github/dependabot.yaml'
 
 jobs:
   validate:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - uses: marocchino/validate-dependabot@v3
         id: validate
       - uses: marocchino/sticky-pull-request-comment@v2
@@ -17,3 +17,7 @@ jobs:
         with:
           header: validate-dependabot
           message: ${{ steps.validate.outputs.markdown }}
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
\ No newline at end of file
diff --git a/.gitignore b/.gitignore
index 03074c6b0a..63dbb8ad56 100644
--- a/.gitignore
+++ b/.gitignore
@@ -29,3 +29,15 @@ vendor_rust/
 
 # Go workspace file
 go.work
+
+# Symlinks to broker variant files
+snap/icon.svg
+snap/snapcraft.yaml
+authd-oidc-brokers/conf/authd.conf
+authd-oidc-brokers/conf/broker.conf
+
+# Useful for running e2e-tests locally
+e2e-tests/e2e-tests.env
+
+# e2e tests python cache
+__pycache__/
diff --git a/.gitmodules b/.gitmodules
new file mode 100644
index 0000000000..420518c3f1
--- /dev/null
+++ b/.gitmodules
@@ -0,0 +1,3 @@
+[submodule "authd-oidc-brokers/third_party/libhimmelblau"]
+	path = authd-oidc-brokers/third_party/libhimmelblau
+	url = https://gitlab.com/samba-team/libhimmelblau.git
diff --git a/.golangci.yaml b/.golangci.yaml
index 63c379b05d..5bb0c11024 100644
--- a/.golangci.yaml
+++ b/.golangci.yaml
@@ -1,6 +1,7 @@
 # This is for linting. To run it, please use:
 # golangci-lint run ${MODULE}/... [--fix]
 
+version: "2"
 linters:
   # linters to run in addition to default ones
   enable:
@@ -11,9 +12,7 @@ linters:
     - errorlint
     - forbidigo
     - forcetypeassert
-    - gci
     - godot
-    - gofmt
     - gosec
     - misspell
     - nakedret
@@ -24,41 +23,65 @@ linters:
     - unconvert
     - unparam
     - whitespace
-
-run:
-  timeout: 5m
-
-# Get all linter issues, even if duplicated
+  settings:
+    # Forbid the usage of deprecated ioutil and debug prints
+    forbidigo:
+      forbid:
+        - pattern: ioutil\.
+        - pattern: ^print.*$
+    # Never have naked return ever
+    nakedret:
+      max-func-lines: 1
+    nolintlint:
+      # Require an explanation of nonzero length after each nolint directive.
+      require-explanation: true
+      # Require nolint directives to mention the specific linter being suppressed.
+      require-specific: true
+  exclusions:
+    generated: lax
+    rules:
+      # EXC0001 errcheck: most errors are in defer calls, which are safe to ignore and idiomatic Go (would be good to only ignore defer ones though)
+      - path: (.+)\.go$
+        text: Error return value of .((os\.)?std(out|err)\..*|.*Close|.*Flush|os\.Remove(All)?|.*print(f|ln)?|os\.(Un)?Setenv|w\.Stop). is not checked
+      # EXC0008 gosec: duplicated of errcheck
+      - path: (.+)\.go$
+        text: (G104|G307)
+      # EXC0010 gosec: False positive is triggered by 'src, err := ioutil.ReadFile(filename)'
+      - path: (.+)\.go$
+        text: Potential file inclusion via variable
+      # We don't wrap errors on purpose
+      - path: (.+)\.go$
+        text: non-wrapping format verb for fmt.Errorf. Use `%w` to format errors
+      # We want named parameters even if unused, as they help better document the function
+      - path: (.+)\.go$
+        text: unused-parameter
+      # Sometimes it is more readable it do a `if err:=a(); err != nil` tha simpy `return a()`
+      - path: (.+)\.go$
+        text: if-return
+      # gosec G101: hardcoded credentials - false positive for test data (fake passwords, tokens).
+      - path: _test\.go$
+        text: G101
+      # gosec G703: path traversal via taint analysis - false positive in test code where file operation arguments are test-controlled.
+      - path: (_test\.go$|internal/testutils/)
+        text: G703
+      # We don't want to rename this package at this point
+      - path: internal/users/types/(.+)\.go$
+        text: "var-naming: avoid meaningless package names"
+    paths:
+      - third_party$
+      - builtin$
+      - examples$
 issues:
-  exclude-use-default: false
   max-issues-per-linter: 0
   max-same-issues: 0
-  fix: false # we don’t want this in CI
-  exclude:
-    # EXC0001 errcheck: most errors are in defer calls, which are safe to ignore and idiomatic Go (would be good to only ignore defer ones though)
-    - 'Error return value of .((os\.)?std(out|err)\..*|.*Close|.*Flush|os\.Remove(All)?|.*print(f|ln)?|os\.(Un)?Setenv|w\.Stop). is not checked'
-    # EXC0008 gosec: duplicated of errcheck
-    - (G104|G307)
-    # EXC0010 gosec: False positive is triggered by 'src, err := ioutil.ReadFile(filename)'
-    - Potential file inclusion via variable
-    # We don't wrap errors on purpose
-    - non-wrapping format verb for fmt.Errorf. Use `%w` to format errors
-    # We want named parameters even if unused, as they help better document the function
-    - unused-parameter
-    # Sometimes it is more readable it do a `if err:=a(); err != nil` tha simpy `return a()`
-    - if-return
-
-linters-settings:
-  # Forbid the usage of deprecated ioutil and debug prints
-  forbidigo:
-    forbid:
-      - ioutil\.
-      - ^print.*$
-  # Never have naked return ever
-  nakedret:
-    max-func-lines: 1
-  nolintlint:
-    # Require an explanation of nonzero length after each nolint directive.
-    require-explanation: true
-    # Require nolint directives to mention the specific linter being suppressed.
-    require-specific: true
+  fix: false
+formatters:
+  enable:
+    - gci
+    - gofmt
+  exclusions:
+    generated: lax
+    paths:
+      - third_party$
+      - builtin$
+      - examples$
diff --git a/.shellcheckrc b/.shellcheckrc
new file mode 100644
index 0000000000..25c98c8fde
--- /dev/null
+++ b/.shellcheckrc
@@ -0,0 +1,2 @@
+source-path=SCRIPTDIR
+external-sources=true
diff --git a/.wokeignore b/.wokeignore
deleted file mode 120000
index 19f3fe4bda..0000000000
--- a/.wokeignore
+++ /dev/null
@@ -1 +0,0 @@
-docs/.wokeignore
\ No newline at end of file
diff --git a/AGENTS.md b/AGENTS.md
new file mode 100644
index 0000000000..b6501c5d4f
--- /dev/null
+++ b/AGENTS.md
@@ -0,0 +1,112 @@
+# authd AI Coding Instructions
+
+## Project Overview
+
+authd is an authentication daemon for cloud-based identity providers (MS Entra ID, Google IAM). It's a hybrid Go/Rust/C project that provides:
+- **authd daemon** (Go): Main authentication service with gRPC API
+- **PAM modules** (Go): Two implementations - native shared library for GDM, and C-wrapper+executable for other PAM apps
+- **NSS module** (Rust): Name Service Switch integration for user/group lookups
+- **Brokers** (Go): Pluggable D-Bus-based providers that interface with identity providers
+
+## Architecture Fundamentals
+
+### Component Communication
+- **Internal**: gRPC for PAM/NSS ↔ authd (defined in `internal/proto/authd/authd.proto`)
+- **External**: D-Bus for authd ↔ brokers (interface in `examplebroker/com.ubuntu.auth.ExampleBroker.xml`)
+- **Daemon**: Systemd socket activation via `internal/daemon/daemon.go`
+- **Data flow**: PAM/NSS → gRPC → authd → D-Bus → broker → identity provider
+
+### Key Directories
+- `cmd/authd/`, `cmd/authctl/`: Main binaries
+- `internal/brokers/`: Broker manager and D-Bus integration
+- `internal/services/`: gRPC service implementations (PAM, NSS, user management)
+- `internal/users/`: User/group database management (SQLite + BoltDB legacy)
+- `pam/`: PAM module with two build modes (see `pam/Hacking.md`)
+- `nss/`: Rust NSS module using `libnss` crate
+- `examplebroker/`: Reference broker implementation
+
+## Building & Testing
+
+### Build Commands
+```bash
+# Full Debian package (includes all components + tests)
+debuild --prepend-path=${HOME}/.cargo/bin
+
+# Individual components (development)
+go build ./cmd/authd                    # authd daemon only
+go generate ./pam/ && go build -tags pam_binary_exec -o ./pam/authd-pam ./pam  # PAM test client
+cargo build                              # NSS (debug mode)
+```
+
+### Testing Conventions
+- **Run tests**: `go test ./...` (add `-race` for race detection)
+- **Golden files**: Use `internal/testutils/golden` package
+  - Update with `TESTS_UPDATE_GOLDEN=1 go test ./...`
+  - Compare/update: `golden.CheckOrUpdate(t, got)` or `golden.CheckOrUpdateYAML(t, got)`
+- **Test helpers with underscores**: Functions prefixed `Z_ForTests_` are test-only exports (e.g., `Z_ForTests_CreateDBFromYAML`)
+- **Environment variables**:
+  - `AUTHD_SKIP_EXTERNAL_DEPENDENT_TESTS=1`: Skip tests requiring external tools (vhs)
+  - `AUTHD_SKIP_ROOT_TESTS=1`: Skip tests that fail when run as root
+
+### Code Generation
+Critical: Run `go generate` before building PAM or when modifying protobuf files:
+```bash
+go generate ./pam/                      # PAM module (creates .so files)
+go generate ./internal/proto/authd/     # Regenerate protobuf
+go generate ./shell-completion/         # Shell completions
+```
+
+## Project-Specific Patterns
+
+### Broker Integration
+- Brokers are discovered from `/usr/share/authd/brokers/*.conf` (D-Bus service files)
+- First broker is always the local broker (no config file)
+- Manager in `internal/brokers/manager.go` handles session→broker and user→broker mappings
+- Brokers must implement the D-Bus interface defined in `internal/brokers/dbusbroker.go`
+
+### PAM Module Dual Mode
+The PAM module has two implementations (see `pam/Hacking.md`):
+1. **GDM mode** (`pam_authd.so`): Native Go shared library with GDM JSON protocol support
+2. **Generic mode** (`pam_authd_exec.so` + `authd-pam` executable): C wrapper launching Go program via private D-Bus
+   - Required for reliability with non-GDM PAM apps (avoids Go threading issues)
+
+### Database & User Management
+- Migrating from BoltDB to SQLite: `internal/users/db/` handles both
+- User/group data cached locally in `/var/lib/authd/authd.db`
+- ID allocation: `internal/users/idlimitsgenerator/` generates UID/GID ranges
+- Group file updates: `internal/users/localentries/` handles local system files
+
+### Testing Patterns
+- Use `testify/require` for assertions (not `assert`)
+- Golden files in `testdata/golden/` subdirectories matching test structure
+- Test-only exports via `export_test.go` files (no build tag, package-level visibility)
+- PAM integration tests use `vhs` tapes in `pam/integration-tests/testdata/tapes/`
+
+## Common Workflows
+
+### Adding a gRPC Service Method
+1. Update `internal/proto/authd/authd.proto`
+2. Run `go generate ./internal/proto/authd/`
+3. Implement in service (e.g., `internal/services/pam/pam.go`)
+4. Add tests with golden files
+
+### Creating a New Broker
+1. Implement D-Bus interface from `examplebroker/com.ubuntu.auth.ExampleBroker.xml`
+2. Create `.conf` file in `/usr/share/authd/brokers/`
+3. Register D-Bus service with systemd
+
+### Debugging
+- Logs via `github.com/canonical/authd/log` package (supports systemd journal)
+- Enable debug: `authd daemon -vvv` (3 levels of verbosity)
+- Socket path: `/run/authd.sock` (override with `AUTHD_NSS_SOCKET` for NSS tests)
+
+## Dependencies & Tools
+- **Go**: See `go.mod` for version requirements, uses go modules with vendoring
+- **Rust**: Cargo with vendor filtering (see `Cargo.toml` workspace)
+- **Required**: `libpam-dev`, `libglib2.0-dev`, `protoc`, `cargo-vendor-filterer`
+- **Optional**: `vhs` (PAM CLI tests), `delta` (colored diffs in tests)
+
+## Code Style
+- Follow [Effective Go](https://go.dev/doc/effective_go) for Go style conventions
+- Use `go fmt` and `gofmt -s`
+- Rust: Standard cargo fmt conventions
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 65921022ef..b6321bdf95 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -23,9 +23,14 @@ These are mostly guidelines, not rules. Use your best judgment and feel free to
       - [Building authd only](#building-authd-only)
       - [Building the PAM module only](#building-the-pam-module-only)
       - [Building the NSS module only](#building-the-nss-module-only)
+    - [Building the broker](#building-the-broker)
     - [About the test suite](#about-the-testsuite)
       - [Tests with dependencies](#tests-with-dependencies)
     - [Code style](#code-style)
+  - [Contributing to the documentation](#contributing-to-the-documentation)
+    - [Building the documentation](#building-the-documentation)
+    - [Testing the documentation](#testing-the-documentation)
+    - [Open Documentation Academy](#open-documentation-academy)
   - [Contributor License Agreement](#contributor-license-agreement)
   - [Getting help](#getting-help)
 
@@ -39,16 +44,16 @@ We take our community seriously, holding ourselves and other contributors to hig
 Contributions are made to this project via Issues and Pull Requests (PRs). These are some general guidelines that cover both:
 
 * To report security vulnerabilities, use the advisories page of the repository and not a public bug report. Please use [launchpad private bugs](https://bugs.launchpad.net/ubuntu/+source/authd/+filebug), which is monitored by our security team. On an Ubuntu machine, it’s best to use `ubuntu-bug authd` to collect relevant information. <!-- FIXME: snap? -->
-* General issues or feature requests should be reported to the [GitHub Project](https://github.com/ubuntu/authd/issues)
+* General issues or feature requests should be reported to the [GitHub Project](https://github.com/canonical/authd/issues)
 * If you've never contributed before, see [this post on ubuntu.com](https://ubuntu.com/community/contribute) for resources and tips on how to get started.
-* Existing Issues and PRs should be searched for on the [project's repository](https://github.com/ubuntu/authd) before creating your own.
+* Existing Issues and PRs should be searched for on the [project's repository](https://github.com/canonical/authd) before creating your own.
 * While we work hard to ensure that issues are handled in a timely manner, it can take time to investigate the root cause. A friendly ping in the comment thread to the submitter or a contributor can help draw attention if your issue is blocking.
 
 ### Issues
 
-Issues can be used to report problems with the software, request a new feature or discuss potential changes before a PR is created. When you [create a new Issue](https://github.com/ubuntu/authd/issues), a template will be loaded that will guide you through collecting and providing the information that we need to investigate.
+Issues can be used to report problems with the software, request a new feature or discuss potential changes before a PR is created. When you [create a new Issue](https://github.com/canonical/authd/issues), a template will be loaded that will guide you through collecting and providing the information that we need to investigate.
 
-If you find an Issue that addresses the problem you're having, please add your own reproduction information to the existing issue rather than creating a new one. Adding a [reaction](https://github.blog/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) can also help be indicating to our maintainers that a particular problem is affecting more than just the reporter.
+If you find an Issue that addresses the problem you're having, please add your own reproduction information to the existing issue rather than creating a new one. Adding a [reaction](https://github.blog/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) can also help by indicating to our maintainers that a particular problem is affecting more than just the reporter.
 
 ### Pull Requests
 
@@ -57,7 +62,7 @@ PRs to our project are always welcome and can be a quick way to get your fix or
 * Only fix/add the functionality in question **OR** address wide-spread whitespace/style issues, not both.
 * Add unit or integration tests for fixed or changed functionality.
 * Address a single concern in the least possible number of changed lines.
-* Include documentation in the repo or on our [docs site](https://github.com/ubuntu/authd/wiki).
+* Include documentation in the repo or on our [docs site](https://documentation.ubuntu.com/authd/stable/).
 * Be accompanied by a complete Pull Request template (loaded automatically when a PR is created).
 
 For changes that address core functionality or that would require breaking changes (e.g. a major release), it's best to open an Issue to discuss your proposal first. This is not required but can save time when creating and reviewing changes.
@@ -76,6 +81,11 @@ In general, we follow the ["fork-and-pull" Git workflow](https://github.com/susa
 
 Once merged into the main branch, `po` files and any documentation change will be automatically updated. Updates to these files are therefore not necessary in the pull request itself, which helps minimize diff review.
 
+The authd documentation is published in **edge-docs** and **stable-docs** versions. Only the edge version is updated when documentation changes are merged into the main branch.
+If a documentation change should be applied to the stable documentation *before* the next release, create a separate PR
+against the `stable-docs` branch after your main PR has been merged, with the changes to the documentation cherry-picked
+from your main PR.
+
 ## Contributing to the code
 
 ### Required dependencies
@@ -153,7 +163,7 @@ This last command will produce two libraries (`./pam/pam_authd.so` and `./pam/go
 These modules must be copied to `/usr/lib/$(gcc -dumpmachine)/security/` while the executable must be copied to `/usr/libexec/authd-pam`.
 
 For further information about the PAM module architecture and testing see the
-[PAM Hacking](https://github.com/ubuntu/authd/blob/main/pam/Hacking.md) page.
+[PAM Hacking](https://github.com/canonical/authd/blob/main/pam/Hacking.md) page.
 
 #### Building the NSS module only
 
@@ -167,6 +177,41 @@ This will build a debug release of the NSS module.
 
 The library resulting from the build is located in `./target/debug/libnss_authd.so`. This module must be copied to `/usr/lib/$(gcc -dumpmachine)/libnss_authd.so.2`.
 
+### Building the broker
+
+The authd brokers are packaged as separate snaps that are built and released
+independently from authd. The source code for the brokers is located in
+`./authd-oidc-brokers` and the snap packaging files are located in `./snap`.
+
+To build the broker snap for a specific broker variant, follow these steps from the top of the source tree:
+
+1. Ensure that the submodules are checked out:
+
+   ```shell
+   git submodule update --init --recursive
+   ```
+
+2. Prepare the `snapcraft.yaml` for the desired broker variant:
+
+   ```shell
+   ./snap/scripts/prepare-variant --broker <broker>
+   ```
+
+   where `<broker>` is one of `oidc`, `msentraid`, or `google`.
+
+3. Build the broker snap:
+
+   ```shell
+   snapcraft pack
+   ```
+
+When the build succeeds, the resulting `.snap` file is created in the current working directory.
+You can install the locally built broker snap for development with a command such as:
+
+```shell
+snap install --dangerous ./path/to/broker.snap
+```
+
 ### About the test suite
 
 The project includes a comprehensive test suite made of unit and integration tests. All the tests must pass before the review is considered. If you have troubles with the test suite, feel free to mention it in your PR description.
@@ -179,17 +224,98 @@ The test suite must pass before merging the PR to our main branch. Any new featu
 
 #### Tests with dependencies
 
-Some tests, such as the [PAM CLI tests](https://github.com/ubuntu/authd/blob/5ba54c0a573f34e99782fe624b090ab229798fc3/pam/integration-tests/integration_test.go#L21), use external tools such as [vhs](https://github.com/charmbracelet/vhs)
+Some tests, such as the [PAM CLI tests](https://github.com/canonical/authd/blob/5ba54c0a573f34e99782fe624b090ab229798fc3/pam/integration-tests/integration_test.go#L21), use external tools such as [VHS](https://github.com/charmbracelet/vhs)
 to record and run the tape files needed for the tests. Those tools are not included in the project dependencies and must be installed manually.
 
 Information about these tools and their usage will be linked below:
 
-- [vhs](https://github.com/charmbracelet/vhs?tab=readme-ov-file#tutorial): tutorial on using vhs as a CLI-based video recorder
+- [VHS](https://github.com/charmbracelet/vhs?tab=readme-ov-file#tutorial): tutorial on using VHS as a CLI-based video recorder
 
 ### Code style
 
 This project follow the Go code-style. For more detailed information about the code style in use, please check <https://google.github.io/styleguide/go/>.
 
+## Contributing to the documentation
+
+You can contribute to the documentation in various ways.
+
+At the top of each page in the documentation, there is a **Give feedback**
+button. If you find an issue in the documentation, clicking this button will
+open an Issue submission on GitHub for the specific page.
+
+For minor changes, such as fixing a single typo, you can click the **pencil**
+icon at the top right of any page. This will open up the source file in GitHub so
+that you can make edits directly.
+
+For more significant changes to the content or organization of the
+documentation, you should create your own fork and follow the steps
+outlined in the section on [pull requests](#pull-requests).
+
+### Building the documentation
+
+After cloning your fork, change into the `/docs/` directory.
+The documentation is written in markdown files grouped under
+[Diátaxis](https://diataxis.fr/) categories.
+
+A makefile is used to preview and test the documentation locally.
+To view all the possible commands, run `make` without arguments.
+
+The command `make run` will serve the documentation at port `8000` on
+`localhost`. You can then preview the documentation in your browser and the
+preview will automatically update with each change that you make.
+
+To clean the build environment at any point, run `make clean`.
+
+When you submit a PR, there are automated checks for typos and broken links.
+Please run the tests locally before submitting the PR to save yourself and your
+reviewers time.
+
+### Testing the documentation
+
+Automatic checks will be run on any PR relating to documentation to verify
+spelling and the validity of links. Before submitting a PR, you can check for
+any issues locally:
+
+- Check the spelling: `make spelling`
+- Check the validity of links: `make linkcheck`
+
+Doing these checks locally is good practice. You are less likely to run into
+failed CI checks after your PR is submitted and the reviewer of your PR can
+more quickly focus on the substance of your contribution.
+
+If the documentation builds, your PR will generate a preview of the
+documentation on Read the Docs. This preview appears as a check in the CI.
+Click on the check to open the preview and confirm that your changes have been
+applied successfully.
+
+### Open Documentation Academy
+
+authd is a proud member of the [Canonical Open Documentation
+Academy](https://github.com/canonical/open-documentation-academy) (CODA).
+
+CODA is an initiative to encourage open source contributions from the
+community, and to provide help, advice and mentorship to people making their
+first contributions.
+
+A key aim of the initiative is to lower the barrier to successful open-source
+software contributions by making documentation into the gateway, and it’s a
+great way to make your first open source contributions to projects like authd.
+
+The best way to get started is to take a look at our [project-related
+documentation
+tasks](https://github.com/canonical/open-documentation-academy/issues) and read
+our [Getting started
+guide](https://discourse.ubuntu.com/t/getting-started/42769). Tasks typically
+include testing and fixing documentation pages, updating outdated content, and
+restructuring large documents. We'll help you see those tasks through to
+completion.
+
+You can get involved the with the CODA community through:
+
+* The [discussion forum](https://discourse.ubuntu.com/c/community/open-documentation-academy/166) on the Ubuntu Community Hub
+* The [Matrix channel](https://matrix.to/#/#documentation:ubuntu.com) for interactive chat
+* [Fosstodon](https://fosstodon.org/@CanonicalDocumentation) for the latest updates and events
+
 ## Contributor License Agreement
 
 It is a requirement that you sign the [Contributor License Agreement](https://ubuntu.com/legal/contributors) in order to contribute to this project.
diff --git a/Cargo.lock b/Cargo.lock
index 4cdf3abe21..d1c0c85a24 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -13,9 +13,9 @@ dependencies = [
 
 [[package]]
 name = "adler2"
-version = "2.0.0"
+version = "2.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "512761e0bb2578dd7380c6baaa0f4ce03e84f95e960231d1dec8bf4d7d6e2627"
+checksum = "320119579fcad9c21884f5c4861d16174d0e06250625266f50fe6898340abefa"
 
 [[package]]
 name = "aho-corasick"
@@ -43,15 +43,15 @@ dependencies = [
 
 [[package]]
 name = "anyhow"
-version = "1.0.98"
+version = "1.0.99"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e16d2d3311acee920a9eb8d33b8cbc1787ce4a264e85f964c2404b969bdcd487"
+checksum = "b0674a1ddeecb70197781e945de4b3b8ffb61fa939a5597bcf48503737663100"
 
 [[package]]
 name = "async-trait"
-version = "0.1.88"
+version = "0.1.89"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e539d3fca749fcee5236ab05e93a52867dd549cc157c8cb7f99595f3cedffdb5"
+checksum = "9035ad2d096bed7955a320ee7e2230574d28fd3c3a0f186cbea1ff3c7eed5dbb"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -66,9 +66,9 @@ checksum = "1505bd5d3d116872e7271a6d4e16d81d0c8570876c8de68093a09ac269d8aac0"
 
 [[package]]
 name = "autocfg"
-version = "1.4.0"
+version = "1.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ace50bade8e6234aa140d9a2f552bbee1db4d353f69b8217bc503490fc1a9f26"
+checksum = "c08606f8c3cbf4ce6ec8e28fb0014a2c086708fe954eaa885384a6165172e7e8"
 
 [[package]]
 name = "axum"
@@ -138,36 +138,36 @@ checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
 
 [[package]]
 name = "bitflags"
-version = "2.9.0"
+version = "2.9.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5c8214115b7bf84099f1309324e63141d4c5d7cc26862f97a0a857dbefe165bd"
+checksum = "34efbcccd345379ca2868b2b2c9d3782e9cc58ba87bc7d79d5b53d9c9ae6f25d"
 
 [[package]]
 name = "bumpalo"
-version = "3.17.0"
+version = "3.19.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1628fb46dfa0b37568d12e5edd512553eccf6a22a78e8bde00bb4aed84d5bdbf"
+checksum = "46c5e41b57b8bba42a04676d81cb89e9ee8e859a1a66f80a5a72e1cb76b34d43"
 
 [[package]]
 name = "bytes"
-version = "1.10.1"
+version = "1.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d71b6127be86fdcfddb610f7182ac57211d4b18a3e9c82eb2d17662f2227ad6a"
+checksum = "1e748733b7cbc798e1434b6ac524f0c1ff2ab456fe201501e6497c8417a4fc33"
 
 [[package]]
 name = "cc"
-version = "1.2.21"
+version = "1.2.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8691782945451c1c383942c4874dbe63814f61cb57ef773cda2972682b7bb3c0"
+checksum = "42bc4aea80032b7bf409b0bc7ccad88853858911b7713a8062fdc0623867bedc"
 dependencies = [
  "shlex",
 ]
 
 [[package]]
 name = "cfg-if"
-version = "1.0.0"
+version = "1.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
+checksum = "2fd1289c04a9ea8cb22300a459a72a385d7c73d3259e2ed7dcb2af674838cfa9"
 
 [[package]]
 name = "chrono"
@@ -199,18 +199,18 @@ checksum = "773648b94d0e5d620f64f280777445740e61fe701025087ec8b57f45c791888b"
 
 [[package]]
 name = "crc32fast"
-version = "1.4.2"
+version = "1.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a97769d94ddab943e4510d138150169a2758b5ef3eb191a9ee688de3e23ef7b3"
+checksum = "9481c1c90cbf2ac953f07c8d4a58aa3945c425b7185c9154d67a65e4230da511"
 dependencies = [
  "cfg-if",
 ]
 
 [[package]]
 name = "ctor"
-version = "0.4.2"
+version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a4735f265ba6a1188052ca32d461028a7d1125868be18e287e756019da7607b5"
+checksum = "67773048316103656a637612c4a62477603b777d91d9c62ff2290f9cde178fdb"
 dependencies = [
  "ctor-proc-macro",
  "dtor",
@@ -218,9 +218,9 @@ dependencies = [
 
 [[package]]
 name = "ctor-proc-macro"
-version = "0.0.5"
+version = "0.0.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4f211af61d8efdd104f96e57adf5e426ba1bc3ed7a4ead616e15e5881fd79c4d"
+checksum = "e2931af7e13dc045d8e9d26afccc6fa115d64e115c9c84b1166288b46f6782c2"
 
 [[package]]
 name = "deranged"
@@ -233,18 +233,18 @@ dependencies = [
 
 [[package]]
 name = "dtor"
-version = "0.0.6"
+version = "0.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "97cbdf2ad6846025e8e25df05171abfb30e3ababa12ee0a0e44b9bbe570633a8"
+checksum = "e58a0764cddb55ab28955347b45be00ade43d4d6f3ba4bf3dc354e4ec9432934"
 dependencies = [
  "dtor-proc-macro",
 ]
 
 [[package]]
 name = "dtor-proc-macro"
-version = "0.0.5"
+version = "0.0.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7454e41ff9012c00d53cf7f475c5e3afa3b91b7c90568495495e8d9bf47a1055"
+checksum = "f678cf4a922c215c63e0de95eb1ff08a958a81d47e485cf9da1e27bf6305cfa5"
 
 [[package]]
 name = "either"
@@ -260,12 +260,12 @@ checksum = "877a4ace8713b0bcf2a4e7eec82529c029f1d0619886d18145fea96c3ffe5c0f"
 
 [[package]]
 name = "errno"
-version = "0.3.11"
+version = "0.3.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "976dd42dc7e85965fe702eb8164f21f450704bdde31faefd6471dba214cb594e"
+checksum = "778e2ac28f6c47af28e4907f13ffd1e1ddbd400980a9abd7c8df189bf578a5ad"
 dependencies = [
  "libc",
- "windows-sys 0.59.0",
+ "windows-sys 0.60.2",
 ]
 
 [[package]]
@@ -282,9 +282,9 @@ checksum = "1d674e81391d1e1ab681a28d99df07927c6d4aa5b027d7da16ba32d1d21ecd99"
 
 [[package]]
 name = "flate2"
-version = "1.1.1"
+version = "1.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7ced92e76e966ca2fd84c8f7aa01a4aea65b0eb6648d72f7c8f3e2764a67fece"
+checksum = "4a3d7db9596fecd151c5f638c0ee5d5bd487b6e0ea232e5dc96d5250f6f94b1d"
 dependencies = [
  "crc32fast",
  "miniz_oxide",
@@ -337,9 +337,9 @@ dependencies = [
 
 [[package]]
 name = "getrandom"
-version = "0.3.2"
+version = "0.3.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "73fea8450eea4bac3940448fb7ae50d91f034f941199fcd9d909a5a07aa455f0"
+checksum = "26145e563e54f2cadc477553f1ec5ee650b00862f0a58bcd12cbdc5f0ea2d2f4"
 dependencies = [
  "cfg-if",
  "libc",
@@ -355,9 +355,9 @@ checksum = "07e28edb80900c19c28f1072f2e8aeca7fa06b23cd4169cefe1af5aa3260783f"
 
 [[package]]
 name = "h2"
-version = "0.4.10"
+version = "0.4.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a9421a676d1b147b16b82c9225157dc629087ef8ec4d5e2960f9437a90dac0a5"
+checksum = "f3c0b69cfcb4e1b9f1bf2f53f95f766e4661169728ec61cd3fe5a0166f2d1386"
 dependencies = [
  "atomic-waker",
  "bytes",
@@ -374,9 +374,9 @@ dependencies = [
 
 [[package]]
 name = "hashbrown"
-version = "0.15.3"
+version = "0.15.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "84b26c544d002229e640969970a2e74021aadf6e2f96372b9c58eff97de08eb3"
+checksum = "9229cfe53dfd69f0609a49f65461bd93001ea1ef889cd5529dd176593f5338a1"
 
 [[package]]
 name = "heck"
@@ -449,13 +449,14 @@ checksum = "df3b46402a9d5adb4c86a0cf463f42e19994e3ee891101b1841f30a545cb49a9"
 
 [[package]]
 name = "hyper"
-version = "1.6.0"
+version = "1.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cc2b571658e38e0c01b1fdca3bbbe93c00d3d71693ff2770043f8c29bc7d6f80"
+checksum = "eb3aa54a13a0dfe7fbe3a59e0c76093041720fdc77b110cc0fc260fafb4dc51e"
 dependencies = [
+ "atomic-waker",
  "bytes",
  "futures-channel",
- "futures-util",
+ "futures-core",
  "h2",
  "http",
  "http-body",
@@ -463,6 +464,7 @@ dependencies = [
  "httpdate",
  "itoa",
  "pin-project-lite",
+ "pin-utils",
  "smallvec",
  "tokio",
  "want",
@@ -483,12 +485,13 @@ dependencies = [
 
 [[package]]
 name = "hyper-util"
-version = "0.1.11"
+version = "0.1.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "497bbc33a26fdd4af9ed9c70d63f61cf56a938375fbb32df34db9b1cd6d643f2"
+checksum = "8d9b05277c7e8da2c93a568989bb6207bef0112e8d17df7a6eda4a3cf143bc5e"
 dependencies = [
  "bytes",
  "futures-channel",
+ "futures-core",
  "futures-util",
  "http",
  "http-body",
@@ -527,14 +530,25 @@ dependencies = [
 
 [[package]]
 name = "indexmap"
-version = "2.9.0"
+version = "2.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cea70ddb795996207ad57735b50c5982d8844f38ba9ee5f1aedcfb708a2aa11e"
+checksum = "f2481980430f9f78649238835720ddccc57e52df14ffce1c6f37391d61b563e9"
 dependencies = [
  "equivalent",
  "hashbrown",
 ]
 
+[[package]]
+name = "io-uring"
+version = "0.7.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "046fa2d4d00aea763528b4950358d0ead425372445dc8ff86312b3c69ff7727b"
+dependencies = [
+ "bitflags",
+ "cfg-if",
+ "libc",
+]
+
 [[package]]
 name = "itertools"
 version = "0.14.0"
@@ -568,9 +582,9 @@ checksum = "bbd2bcb4c963f2ddae06a2efc7e9f3591312473c50c6685e1f298068316e66fe"
 
 [[package]]
 name = "libc"
-version = "0.2.172"
+version = "0.2.175"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d750af042f7ef4f724306de029d18836c26c1765a54a6a3f094cbd23a7267ffa"
+checksum = "6a82ae493e598baaea5209805c49bbf2ea7de956d50d7da0da1164f9c6d28543"
 
 [[package]]
 name = "libnss"
@@ -609,9 +623,9 @@ checksum = "47e1ffaa40ddd1f3ed91f717a33c8c0ee23fff369e3aa8772b9605cc1d22f4c3"
 
 [[package]]
 name = "memchr"
-version = "2.7.4"
+version = "2.7.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "78ca9ab1a0babb1e7d5695e3530886289c18cf2f87ec19a575a0abdce112e3a3"
+checksum = "32a282da65faaf38286cf3be983213fcf1d2e2a58700e808f83f4ea9a4804bc0"
 
 [[package]]
 name = "mime"
@@ -621,29 +635,29 @@ checksum = "6877bb514081ee2a7ff5ef9de3281f14a4dd4bceac4c09388074a6b5df8a139a"
 
 [[package]]
 name = "miniz_oxide"
-version = "0.8.8"
+version = "0.8.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3be647b768db090acb35d5ec5db2b0e1f1de11133ca123b9eacf5137868f892a"
+checksum = "1fa76a2c86f704bdb222d66965fb3d63269ce38518b83cb0575fca855ebb6316"
 dependencies = [
  "adler2",
 ]
 
 [[package]]
 name = "mio"
-version = "1.0.3"
+version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2886843bf800fba2e3377cff24abf6379b4c4d5c6681eaf9ea5b0d15090450bd"
+checksum = "78bed444cc8a2160f01cbcf811ef18cac863ad68ae8ca62092e8db51d51c761c"
 dependencies = [
  "libc",
- "wasi 0.11.0+wasi-snapshot-preview1",
- "windows-sys 0.52.0",
+ "wasi 0.11.1+wasi-snapshot-preview1",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
 name = "multimap"
-version = "0.10.0"
+version = "0.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "defc4c55412d89136f966bbb339008b474350e5e6e78d2714439c386b3137a03"
+checksum = "1d87ecb2933e8aeadb3e3a02b828fed80a7528047e68b4f424523a0981a3a084"
 
 [[package]]
 name = "nss"
@@ -655,14 +669,17 @@ dependencies = [
  "libc",
  "libnss",
  "log",
+ "once_cell",
  "procfs",
  "prost",
- "rustix 1.0.7",
+ "rustix 1.0.8",
  "simple_logger",
  "syslog",
+ "time",
  "tokio",
  "tonic",
- "tonic-build",
+ "tonic-prost",
+ "tonic-prost-build",
  "tower 0.4.13",
 ]
 
@@ -713,9 +730,9 @@ checksum = "57c0d7b74b563b49d38dae00a0c37d4d6de9b432382b2892f0574ddcae73fd0a"
 
 [[package]]
 name = "percent-encoding"
-version = "2.3.1"
+version = "2.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e3148f5046208a5d56bcfc03053e3ca6334e51da8dfb19b6cdc8b306fae3283e"
+checksum = "9b4f627cb1b25917193a259e49bdad08f671f8d9708acfd5fe0a8c1455d87220"
 
 [[package]]
 name = "petgraph"
@@ -767,9 +784,9 @@ checksum = "439ee305def115ba05938db6eb1644ff94165c5ab5e9420d1c1bcedbba909391"
 
 [[package]]
 name = "prettyplease"
-version = "0.2.32"
+version = "0.2.37"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "664ec5419c51e34154eec046ebcba56312d5a2fc3b09a06da188e1ad21afadf6"
+checksum = "479ca8adacdd7ce8f1fb39ce9ecccbfe93a3f1344b3d0d97f20bc0196208f62b"
 dependencies = [
  "proc-macro2",
  "syn",
@@ -777,9 +794,9 @@ dependencies = [
 
 [[package]]
 name = "proc-macro2"
-version = "1.0.95"
+version = "1.0.101"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "02b3e5e68a3a1a02aad3ec490a98007cbc13c37cbe84a3cd7b8e406d76e7f778"
+checksum = "89ae43fd86e4158d6db51ad8e2b80f313af9cc74f5c0e03ccb87de09998732de"
 dependencies = [
  "unicode-ident",
 ]
@@ -811,9 +828,9 @@ dependencies = [
 
 [[package]]
 name = "prost"
-version = "0.13.5"
+version = "0.14.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2796faa41db3ec313a31f7624d9286acf277b52de526150b7e69f3debf891ee5"
+checksum = "7231bd9b3d3d33c86b58adbac74b5ec0ad9f496b19d22801d773636feaa95f3d"
 dependencies = [
  "bytes",
  "prost-derive",
@@ -821,9 +838,9 @@ dependencies = [
 
 [[package]]
 name = "prost-build"
-version = "0.13.5"
+version = "0.14.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "be769465445e8c1474e9c5dac2018218498557af32d9ed057325ec9a41ae81bf"
+checksum = "ac6c3320f9abac597dcbc668774ef006702672474aad53c6d596b62e487b40b1"
 dependencies = [
  "heck",
  "itertools",
@@ -834,6 +851,8 @@ dependencies = [
  "prettyplease",
  "prost",
  "prost-types",
+ "pulldown-cmark",
+ "pulldown-cmark-to-cmark",
  "regex",
  "syn",
  "tempfile",
@@ -841,9 +860,9 @@ dependencies = [
 
 [[package]]
 name = "prost-derive"
-version = "0.13.5"
+version = "0.14.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8a56d757972c98b346a9b766e3f02746cde6dd1cd1d1d563472929fdd74bec4d"
+checksum = "9120690fafc389a67ba3803df527d0ec9cbbc9cc45e4cc20b332996dfb672425"
 dependencies = [
  "anyhow",
  "itertools",
@@ -854,13 +873,33 @@ dependencies = [
 
 [[package]]
 name = "prost-types"
-version = "0.13.5"
+version = "0.14.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "52c2c1bf36ddb1a1c396b3601a3cec27c2462e45f07c386894ec3ccf5332bd16"
+checksum = "b9b4db3d6da204ed77bb26ba83b6122a73aeb2e87e25fbf7ad2e84c4ccbf8f72"
 dependencies = [
  "prost",
 ]
 
+[[package]]
+name = "pulldown-cmark"
+version = "0.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e8bbe1a966bd2f362681a44f6edce3c2310ac21e4d5067a6e7ec396297a6ea0"
+dependencies = [
+ "bitflags",
+ "memchr",
+ "unicase",
+]
+
+[[package]]
+name = "pulldown-cmark-to-cmark"
+version = "21.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e5b6a0769a491a08b31ea5c62494a8f144ee0987d86d670a8af4df1e1b7cde75"
+dependencies = [
+ "pulldown-cmark",
+]
+
 [[package]]
 name = "quote"
 version = "1.0.40"
@@ -872,15 +911,15 @@ dependencies = [
 
 [[package]]
 name = "r-efi"
-version = "5.2.0"
+version = "5.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "74765f6d916ee2faa39bc8e68e4f3ed8949b48cccdac59983d287a7cb71ce9c5"
+checksum = "69cdb34c158ceb288df11e18b4bd39de994f6657d83847bdffdbd7f346754b0f"
 
 [[package]]
 name = "regex"
-version = "1.11.1"
+version = "1.11.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b544ef1b4eac5dc2db33ea63606ae9ffcfac26c1416a2806ae0bf5f56b201191"
+checksum = "23d7fd106d8c02486a8d64e778353d1cffe08ce79ac2e82f540c86d0facf6912"
 dependencies = [
  "aho-corasick",
  "memchr",
@@ -890,9 +929,9 @@ dependencies = [
 
 [[package]]
 name = "regex-automata"
-version = "0.4.9"
+version = "0.4.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "809e8dc61f6de73b46c85f4c96486310fe304c434cfa43669d7b40f711150908"
+checksum = "6b9458fa0bfeeac22b5ca447c63aaf45f28439a709ccd244698632f9aa6394d6"
 dependencies = [
  "aho-corasick",
  "memchr",
@@ -901,15 +940,15 @@ dependencies = [
 
 [[package]]
 name = "regex-syntax"
-version = "0.8.5"
+version = "0.8.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2b15c43186be67a4fd63bee50d0303afffcef381492ebe2c5d87f324e1b8815c"
+checksum = "caf4aa5b0f434c91fe5c7f1ecb6a5ece2130b02ad2a590589dda5146df959001"
 
 [[package]]
 name = "rustc-demangle"
-version = "0.1.24"
+version = "0.1.26"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "719b953e2095829ee67db738b3bfa9fa368c94900df327b3f07fe6e794d2fe1f"
+checksum = "56f7d92ca342cea22a06f2121d944b4fd82af56988c270852495420f961d4ace"
 
 [[package]]
 name = "rustix"
@@ -926,22 +965,22 @@ dependencies = [
 
 [[package]]
 name = "rustix"
-version = "1.0.7"
+version = "1.0.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c71e83d6afe7ff64890ec6b71d6a69bb8a610ab78ce364b3352876bb4c801266"
+checksum = "11181fbabf243db407ef8df94a6ce0b2f9a733bd8be4ad02b4eda9602296cac8"
 dependencies = [
  "bitflags",
  "errno",
  "libc",
  "linux-raw-sys 0.9.4",
- "windows-sys 0.59.0",
+ "windows-sys 0.60.2",
 ]
 
 [[package]]
 name = "rustversion"
-version = "1.0.20"
+version = "1.0.22"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eded382c5f5f786b989652c49544c4877d9f015cc22e145a5ea8ea66c2921cd2"
+checksum = "b39cdef0fa800fc44525c84ccb54a029961a8215f9619753635a9c0d2538d46d"
 
 [[package]]
 name = "serde"
@@ -983,34 +1022,31 @@ dependencies = [
 
 [[package]]
 name = "slab"
-version = "0.4.9"
+version = "0.4.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8f92a496fb766b417c996b9c5e57daf2f7ad3b0bebe1ccfca4856390e3d3bb67"
-dependencies = [
- "autocfg",
-]
+checksum = "7a2ae44ef20feb57a68b23d846850f861394c2e02dc425a50098ae8c90267589"
 
 [[package]]
 name = "smallvec"
-version = "1.15.0"
+version = "1.15.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8917285742e9f3e1683f0a9c4e6b57960b7314d0b08d30d1ecd426713ee2eee9"
+checksum = "67b1b7a3b5fe4f1376887184045fcf45c69e92af734b7aaddc05fb777b6fbd03"
 
 [[package]]
 name = "socket2"
-version = "0.5.9"
+version = "0.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4f5fd57c80058a56cf5c777ab8a126398ece8e442983605d280a44ce79d0edef"
+checksum = "233504af464074f9d066d7b5416c5f9b894a5862a6506e306f7b816cdd6f1807"
 dependencies = [
  "libc",
- "windows-sys 0.52.0",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
 name = "syn"
-version = "2.0.101"
+version = "2.0.106"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8ce2b7fc941b3a24138a0a7cf8e858bfc6a992e7978a068a5c760deb0ed43caf"
+checksum = "ede7c438028d4436d71104916910f5bb611972c5cfd7f89b8300a8186e6fada6"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -1037,15 +1073,15 @@ dependencies = [
 
 [[package]]
 name = "tempfile"
-version = "3.19.1"
+version = "3.21.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7437ac7763b9b123ccf33c338a5cc1bac6f69b45a136c19bdd8a65e3916435bf"
+checksum = "15b61f8f20e3a6f7e0649d825294eaf317edce30f82cf6026e7e4cb9222a7d1e"
 dependencies = [
  "fastrand",
  "getrandom",
  "once_cell",
- "rustix 1.0.7",
- "windows-sys 0.59.0",
+ "rustix 1.0.8",
+ "windows-sys 0.60.2",
 ]
 
 [[package]]
@@ -1083,18 +1119,20 @@ dependencies = [
 
 [[package]]
 name = "tokio"
-version = "1.45.0"
+version = "1.47.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2513ca694ef9ede0fb23fe71a4ee4107cb102b9dc1930f6d0fd77aae068ae165"
+checksum = "89e49afdadebb872d3145a5638b59eb0691ea23e46ca484037cfab3b76b95038"
 dependencies = [
  "backtrace",
  "bytes",
+ "io-uring",
  "libc",
  "mio",
  "pin-project-lite",
+ "slab",
  "socket2",
  "tokio-macros",
- "windows-sys 0.52.0",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
@@ -1121,9 +1159,9 @@ dependencies = [
 
 [[package]]
 name = "tokio-util"
-version = "0.7.15"
+version = "0.7.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "66a539a9ad6d5d281510d5bd368c973d636c02dbf8a67300bfb6b950696ad7df"
+checksum = "14307c986784f72ef81c89db7d9e28d6ac26d16213b109ea501696195e6e3ce5"
 dependencies = [
  "bytes",
  "futures-core",
@@ -1134,9 +1172,9 @@ dependencies = [
 
 [[package]]
 name = "tonic"
-version = "0.13.1"
+version = "0.14.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7e581ba15a835f4d9ea06c55ab1bd4dce26fc53752c69a04aac00703bfb49ba9"
+checksum = "eb7613188ce9f7df5bfe185db26c5814347d110db17920415cf2fbcad85e7203"
 dependencies = [
  "async-trait",
  "axum",
@@ -1151,8 +1189,8 @@ dependencies = [
  "hyper-util",
  "percent-encoding",
  "pin-project",
- "prost",
  "socket2",
+ "sync_wrapper",
  "tokio",
  "tokio-stream",
  "tower 0.5.2",
@@ -1163,9 +1201,32 @@ dependencies = [
 
 [[package]]
 name = "tonic-build"
-version = "0.13.1"
+version = "0.14.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eac6f67be712d12f0b41328db3137e0d0757645d8904b4cb7d51cd9c2279e847"
+checksum = "4c40aaccc9f9eccf2cd82ebc111adc13030d23e887244bc9cfa5d1d636049de3"
+dependencies = [
+ "prettyplease",
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "tonic-prost"
+version = "0.14.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "66bd50ad6ce1252d87ef024b3d64fe4c3cf54a86fb9ef4c631fdd0ded7aeaa67"
+dependencies = [
+ "bytes",
+ "prost",
+ "tonic",
+]
+
+[[package]]
+name = "tonic-prost-build"
+version = "0.14.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b4a16cba4043dc3ff43fcb3f96b4c5c154c64cbd18ca8dce2ab2c6a451d058a2"
 dependencies = [
  "prettyplease",
  "proc-macro2",
@@ -1173,6 +1234,8 @@ dependencies = [
  "prost-types",
  "quote",
  "syn",
+ "tempfile",
+ "tonic-build",
 ]
 
 [[package]]
@@ -1235,9 +1298,9 @@ dependencies = [
 
 [[package]]
 name = "tracing-attributes"
-version = "0.1.28"
+version = "0.1.30"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "395ae124c09f9e6918a2310af6038fba074bcf474ac352496d5910dd59a2226d"
+checksum = "81383ab64e72a7a8b8e13130c49e3dab29def6d0c7d76a03087b3cf71c5c6903"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -1246,9 +1309,9 @@ dependencies = [
 
 [[package]]
 name = "tracing-core"
-version = "0.1.33"
+version = "0.1.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e672c95779cf947c5311f83787af4fa8fffd12fb27e4993211a84bdfd9610f9c"
+checksum = "b9d12581f227e93f094d3af2ae690a574abb8a2b9b7a96e7cfe9647b2b617678"
 dependencies = [
  "once_cell",
 ]
@@ -1259,6 +1322,12 @@ version = "0.2.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e421abadd41a4225275504ea4d6566923418b7f05506fbc9c0fe86ba7396114b"
 
+[[package]]
+name = "unicase"
+version = "2.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "75b844d17643ee918803943289730bec8aac480150456169e647ed0b576ba539"
+
 [[package]]
 name = "unicode-ident"
 version = "1.0.18"
@@ -1276,9 +1345,9 @@ dependencies = [
 
 [[package]]
 name = "wasi"
-version = "0.11.0+wasi-snapshot-preview1"
+version = "0.11.1+wasi-snapshot-preview1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9c8d87e72b64a3b4db28d11ce29237c246188f4f51057d65a7eab63b7987e423"
+checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b"
 
 [[package]]
 name = "wasi"
@@ -1349,9 +1418,9 @@ dependencies = [
 
 [[package]]
 name = "windows-core"
-version = "0.61.0"
+version = "0.61.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4763c1de310c86d75a878046489e2e5ba02c649d185f21c67d4cf8a56d098980"
+checksum = "c0fdd3ddb90610c7638aa2b3a3ab2904fb9e5cdbecc643ddb3647212781c4ae3"
 dependencies = [
  "windows-implement",
  "windows-interface",
@@ -1384,24 +1453,24 @@ dependencies = [
 
 [[package]]
 name = "windows-link"
-version = "0.1.1"
+version = "0.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "76840935b766e1b0a05c0066835fb9ec80071d4c09a16f6bd5f7e655e3c14c38"
+checksum = "5e6ad25900d524eaabdbbb96d20b4311e1e7ae1699af4fb28c17ae66c80d798a"
 
 [[package]]
 name = "windows-result"
-version = "0.3.2"
+version = "0.3.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c64fd11a4fd95df68efcfee5f44a294fe71b8bc6a91993e2791938abcc712252"
+checksum = "56f42bd332cc6c8eac5af113fc0c1fd6a8fd2aa08a0119358686e5160d0586c6"
 dependencies = [
  "windows-link",
 ]
 
 [[package]]
 name = "windows-strings"
-version = "0.4.0"
+version = "0.4.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7a2ba9642430ee452d5a7aa78d72907ebe8cfda358e8cb7918a2050581322f97"
+checksum = "56e6c93f3a0c3b36176cb1327a4958a0353d5d166c2a35cb268ace15e91d3b57"
 dependencies = [
  "windows-link",
 ]
@@ -1417,20 +1486,20 @@ dependencies = [
 
 [[package]]
 name = "windows-sys"
-version = "0.52.0"
+version = "0.59.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d"
+checksum = "1e38bc4d79ed67fd075bcc251a1c39b32a1776bbe92e5bef1f0bf1f8c531853b"
 dependencies = [
  "windows-targets 0.52.6",
 ]
 
 [[package]]
 name = "windows-sys"
-version = "0.59.0"
+version = "0.60.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e38bc4d79ed67fd075bcc251a1c39b32a1776bbe92e5bef1f0bf1f8c531853b"
+checksum = "f2f500e4d28234f72040990ec9d39e3a6b950f9f22d3dba18416c35882612bcb"
 dependencies = [
- "windows-targets 0.52.6",
+ "windows-targets 0.53.3",
 ]
 
 [[package]]
@@ -1457,13 +1526,30 @@ dependencies = [
  "windows_aarch64_gnullvm 0.52.6",
  "windows_aarch64_msvc 0.52.6",
  "windows_i686_gnu 0.52.6",
- "windows_i686_gnullvm",
+ "windows_i686_gnullvm 0.52.6",
  "windows_i686_msvc 0.52.6",
  "windows_x86_64_gnu 0.52.6",
  "windows_x86_64_gnullvm 0.52.6",
  "windows_x86_64_msvc 0.52.6",
 ]
 
+[[package]]
+name = "windows-targets"
+version = "0.53.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d5fe6031c4041849d7c496a8ded650796e7b6ecc19df1a431c1a363342e5dc91"
+dependencies = [
+ "windows-link",
+ "windows_aarch64_gnullvm 0.53.0",
+ "windows_aarch64_msvc 0.53.0",
+ "windows_i686_gnu 0.53.0",
+ "windows_i686_gnullvm 0.53.0",
+ "windows_i686_msvc 0.53.0",
+ "windows_x86_64_gnu 0.53.0",
+ "windows_x86_64_gnullvm 0.53.0",
+ "windows_x86_64_msvc 0.53.0",
+]
+
 [[package]]
 name = "windows_aarch64_gnullvm"
 version = "0.48.5"
@@ -1476,6 +1562,12 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3"
 
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.53.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "86b8d5f90ddd19cb4a147a5fa63ca848db3df085e25fee3cc10b39b6eebae764"
+
 [[package]]
 name = "windows_aarch64_msvc"
 version = "0.48.5"
@@ -1488,6 +1580,12 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469"
 
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.53.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c7651a1f62a11b8cbd5e0d42526e55f2c99886c77e007179efff86c2b137e66c"
+
 [[package]]
 name = "windows_i686_gnu"
 version = "0.48.5"
@@ -1500,12 +1598,24 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8e9b5ad5ab802e97eb8e295ac6720e509ee4c243f69d781394014ebfe8bbfa0b"
 
+[[package]]
+name = "windows_i686_gnu"
+version = "0.53.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c1dc67659d35f387f5f6c479dc4e28f1d4bb90ddd1a5d3da2e5d97b42d6272c3"
+
 [[package]]
 name = "windows_i686_gnullvm"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66"
 
+[[package]]
+name = "windows_i686_gnullvm"
+version = "0.53.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ce6ccbdedbf6d6354471319e781c0dfef054c81fbc7cf83f338a4296c0cae11"
+
 [[package]]
 name = "windows_i686_msvc"
 version = "0.48.5"
@@ -1518,6 +1628,12 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66"
 
+[[package]]
+name = "windows_i686_msvc"
+version = "0.53.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "581fee95406bb13382d2f65cd4a908ca7b1e4c2f1917f143ba16efe98a589b5d"
+
 [[package]]
 name = "windows_x86_64_gnu"
 version = "0.48.5"
@@ -1530,6 +1646,12 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78"
 
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.53.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2e55b5ac9ea33f2fc1716d1742db15574fd6fc8dadc51caab1c16a3d3b4190ba"
+
 [[package]]
 name = "windows_x86_64_gnullvm"
 version = "0.48.5"
@@ -1542,6 +1664,12 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d"
 
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.53.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0a6e035dd0599267ce1ee132e51c27dd29437f63325753051e71dd9e42406c57"
+
 [[package]]
 name = "windows_x86_64_msvc"
 version = "0.48.5"
@@ -1554,6 +1682,12 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
 
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.53.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "271414315aff87387382ec3d271b52d7ae78726f5d44ac98b4f4030c91880486"
+
 [[package]]
 name = "wit-bindgen-rt"
 version = "0.39.0"
diff --git a/Cargo.toml b/Cargo.toml
index 8b865788a4..dca77e898e 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1,6 +1,6 @@
 [workspace]
 members = ["nss/"]
-exclude = ["vendor_rust/"]
+exclude = ["vendor_rust/", "authd-oidc-brokers/third_party/libhimmelblau/", "parts/libhimmelblau/build"]
 resolver = "2"
 
 [profile.release]
@@ -11,17 +11,12 @@ platforms = ["*-unknown-linux-gnu"]
 tier = "2"
 exclude-crate-paths = [
     { name = "*", exclude = "assets" },
-    { name = "*", exclude = "Cargo.toml.orig" },
     { name = "*", exclude = "docs" },
     { name = "*", exclude = "examples" },
     { name = "*", exclude = "tests" },
-    { name = "*", exclude = ".editorconfig" },
-    { name = "*", exclude = ".git-blame-ignore-revs" },
-    { name = "*", exclude = ".github" },
-    { name = "*", exclude = ".gitignore" },
-    { name = "*", exclude = ".gitlab-ci.yml" },
-    { name = "*", exclude = "*.png" },
-    { name = "*", exclude = "*.svg" },
 
-    { name = "regex", exclude = "record" },
+    # For some reason, this file is excluded from the source tarball. Exclude
+    # it here to exclude it from the checksum calculation to avoid build
+    # failures due to checksum mismatches.
+    { name = "*", exclude = "Cargo.toml.orig" },
 ]
diff --git a/README.md b/README.md
index 2095a29335..8b45ebe440 100644
--- a/README.md
+++ b/README.md
@@ -1,22 +1,22 @@
 # authd: an authentication daemon for cloud identity providers
 
-[actions-image]: https://github.com/ubuntu/authd/actions/workflows/qa.yaml/badge.svg
-[actions-url]: https://github.com/ubuntu/authd/actions?query=workflow%3AQA
+[actions-image]: https://github.com/canonical/authd/actions/workflows/qa.yaml/badge.svg
+[actions-url]: https://github.com/canonical/authd/actions?query=workflow%3AQA
 
 [license-image]: https://img.shields.io/badge/License-GPL3.0-blue.svg
 
 [codecov-image]: https://codecov.io/gh/ubuntu/authd/graph/badge.svg
 [codecov-url]: https://codecov.io/gh/ubuntu/authd
 
-[reference-documentation-image]: https://pkg.go.dev/badge/github.com/ubuntu/authd.svg
-[reference-documentation-url]: https://pkg.go.dev/github.com/ubuntu/authd
+[reference-documentation-image]: https://pkg.go.dev/badge/github.com/canonical/authd.svg
+[reference-documentation-url]: https://pkg.go.dev/github.com/canonical/authd
 
-[goreport-image]: https://goreportcard.com/badge/github.com/ubuntu/authd
-[goreport-url]: https://goreportcard.com/report/github.com/ubuntu/authd
+[goreport-image]: https://goreportcard.com/badge/github.com/canonical/authd
+[goreport-url]: https://goreportcard.com/report/github.com/canonical/authd
 
-[docs-image]: https://readthedocs.com/projects/canonical-authd/badge/?version=latest
-[docs-url-stable]: https://canonical-authd.readthedocs-hosted.com/en/stable/
-[docs-url-latest]: https://canonical-authd.readthedocs-hosted.com/en/latest/
+[docs-image]: https://readthedocs.com/projects/canonical-authd/badge/?version=edge-docs
+[docs-url-stable]: https://documentation.ubuntu.com/authd/stable-docs/
+[docs-url-edge]: https://documentation.ubuntu.com/authd/edge-docs/
 
 [![Code quality][actions-image]][actions-url]
 [![License][license-image]](COPYING)
@@ -38,7 +38,7 @@ supported and several other identity providers are under active development.
 To find out more about using authd, refer to the
 [official authd documentation][docs-url-stable].
 If you are on an edge release then you can also read the
-[latest development version of the documentation][docs-url-latest],
+[edge version of the documentation][docs-url-edge],
 which may include features not yet available in the stable release.
 
 The documentation includes how-to guides on installing and configuring authd,
@@ -47,7 +47,7 @@ in addition to information about authd architecture and troubleshooting.
 ## Brokers
 
 authd uses brokers to interface with cloud identity providers through a
-[DBus API](https://github.com/ubuntu/authd/blob/HEAD/examplebroker/com.ubuntu.auth.ExampleBroker.xml).
+[DBus API](https://github.com/canonical/authd/blob/HEAD/examplebroker/com.ubuntu.auth.ExampleBroker.xml).
 
 Currently [MS Entra ID](https://learn.microsoft.com/en-us/entra/fundamentals/whatis)
 and [Google IAM](https://cloud.google.com/iam/docs/overview)
@@ -55,7 +55,7 @@ are supported as identity providers.
 They allow you to authenticate using MFA and the device authentication flow.
 
 For development purposes, authd also provides an
-[example broker](https://github.com/ubuntu/authd/tree/main/examplebroker)
+[example broker](https://github.com/canonical/authd/tree/main/examplebroker)
 to help you develop your own.
 
 ## Get involved
@@ -66,12 +66,12 @@ contributing, please take a look at our [contribution guidelines](CONTRIBUTING.m
 first.
 
 When reporting an issue you can
-[choose from several templates](https://github.com/ubuntu/authd/issues/new/choose):
+[choose from several templates](https://github.com/canonical/authd/issues/new/choose):
 
 - To report an issue, please file a bug report against our repository, using the
-  [report an issue](https://github.com/ubuntu/authd/issues/new?assignees=&labels=bug&projects=&template=bug_report.yml&title=Issue%3A+) template.
+  [report an issue](https://github.com/canonical/authd/issues/new?assignees=&labels=bug&projects=&template=bug_report.yml&title=Issue%3A+) template.
 - For suggestions and constructive feedback, report a feature request bug report, using the
-  [request a feature](https://github.com/ubuntu/authd/issues/new?assignees=&labels=feature&projects=&template=feature_request.yml&title=Feature%3A+) template.
+  [request a feature](https://github.com/canonical/authd/issues/new?assignees=&labels=feature&projects=&template=feature_request.yml&title=Feature%3A+) template.
 
 ## Get in touch
 
diff --git a/SECURITY.md b/SECURITY.md
index c35f5e0982..a7ddac30b0 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -17,7 +17,7 @@ If you discover a security vulnerability within this repository, we encourage re
 
 ### Private Vulnerability Reporting
 
-The most straightforward way to report a security vulnerability is via [GitHub](https://github.com/ubuntu/authd/security/advisories/new).
+The most straightforward way to report a security vulnerability is via [GitHub](https://github.com/canonical/authd/security/advisories/new).
 For detailed instructions, please review the [Privately reporting a security vulnerability](https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing-information-about-vulnerabilities/privately-reporting-a-security-vulnerability) documentation.
 This method enables you to communicate vulnerabilities directly and confidentially with the `authd` maintainers.
 
@@ -28,7 +28,7 @@ The [Ubuntu Security disclosure and embargo policy](https://ubuntu.com/security/
 
 #### Steps to Report a Vulnerability
 
-1. Go to the [Security Advisories Page](https://github.com/ubuntu/authd/security/advisories) of the `authd` repository.
+1. Go to the [Security Advisories Page](https://github.com/canonical/authd/security/advisories) of the `authd` repository.
 2. Click "Report a Vulnerability."
 3. Provide detailed information about the vulnerability, including steps to reproduce, affected versions, and potential impact.
 
@@ -37,6 +37,6 @@ The [Ubuntu Security disclosure and embargo policy](https://ubuntu.com/security/
 - [Canonical's Security Site](https://ubuntu.com/security)
 - [Ubuntu Security disclosure and embargo policy](https://ubuntu.com/security/disclosure-policy)
 - [Ubuntu Security Notices](https://ubuntu.com/security/notices)
-- [authd Documentation](https://canonical-authd.readthedocs-hosted.com/en/latest/)
+- [authd Documentation](https://documentation.ubuntu.com/authd/stable-docs/)
 
 If you have any questions regarding security vulnerabilities, please reach out to the maintainers via the aforementioned channels.
diff --git a/authd-oidc-brokers/.gitignore b/authd-oidc-brokers/.gitignore
new file mode 100644
index 0000000000..1c02e90520
--- /dev/null
+++ b/authd-oidc-brokers/.gitignore
@@ -0,0 +1,29 @@
+# If you prefer the allow list template instead of the deny list, see community template:
+# https://github.com/github/gitignore/blob/main/community/Golang/Go.AllowList.gitignore
+#
+# Binaries for programs and plugins
+*.snap
+/authd-oidc
+cmd/authd-oidc/authd-oidc
+/authd-msentraid
+cmd/authd-oidc/authd-msentraid
+__pycache__
+
+# Test binary, built with `go test -c`
+*.test
+coverage/
+
+# Output of the go coverage tool, specifically when used with LiteIDE
+*.out
+
+# Dependency directories (remove the comment below to include it)
+vendor/
+
+# Go workspace file
+go.work
+
+# Directories created by `snapcraft --destructive-mode`
+/parts
+/prime
+/stage
+
diff --git a/authd-oidc-brokers/.golangci.yaml b/authd-oidc-brokers/.golangci.yaml
new file mode 100644
index 0000000000..fe8913804c
--- /dev/null
+++ b/authd-oidc-brokers/.golangci.yaml
@@ -0,0 +1,83 @@
+# This is for linting. To run it, please use:
+# golangci-lint run ${MODULE}/... [--fix]
+
+version: "2"
+linters:
+  # linters to run in addition to default ones
+  enable:
+    - copyloopvar
+    - dupl
+    - durationcheck
+    - errname
+    - errorlint
+    - forbidigo
+    - forcetypeassert
+    - godot
+    - gosec
+    - misspell
+    - nakedret
+    - nolintlint
+    - revive
+    - tparallel
+    - unconvert
+    - unparam
+    - whitespace
+  settings:
+    # Forbid the usage of deprecated ioutil and debug prints
+    forbidigo:
+      forbid:
+        - pattern: ioutil\.
+        - pattern: ^print.*$
+    # Never have naked return ever
+    nakedret:
+      max-func-lines: 1
+    nolintlint:
+      # Require an explanation of nonzero length after each nolint directive.
+      require-explanation: true
+      # Require nolint directives to mention the specific linter being suppressed.
+      require-specific: true
+  exclusions:
+    generated: lax
+    rules:
+      # EXC0001 errcheck: most errors are in defer calls, which are safe to ignore and idiomatic Go (would be good to only ignore defer ones though)
+      - path: (.+)\.go$
+        text: Error return value of .((os\.)?std(out|err)\..*|.*Close|.*Flush|os\.Remove(All)?|.*print(f|ln)?|os\.(Un)?Setenv|w\.Stop). is not checked
+      # EXC0008 gosec: duplicated of errcheck
+      - path: (.+)\.go$
+        text: (G104|G307)
+      # EXC0010 gosec: False positive is triggered by 'src, err := ioutil.ReadFile(filename)'
+      - path: (.+)\.go$
+        text: Potential file inclusion via variable
+      # We don't wrap errors on purpose
+      - path: (.+)\.go$
+        text: non-wrapping format verb for fmt.Errorf. Use `%w` to format errors
+      # We want named parameters even if unused, as they help better document the function
+      - path: (.+)\.go$
+        text: unused-parameter
+      # Sometimes it is more readable it do a `if err:=a(); err != nil` tha simpy `return a()`
+      - path: (.+)\.go$
+        text: if-return
+      # gosec G101: hardcoded credentials - false positive for test data (fake passwords, tokens).
+      - path: _test\.go$
+        text: G101
+      # gosec G703: path traversal via taint analysis - false positive in test code where file operation arguments are test-controlled.
+      - path: (_test\.go$|internal/testutils/)
+        text: G703
+    paths:
+      - third_party$
+      - builtin$
+      - examples$
+issues:
+  max-issues-per-linter: 0
+  max-same-issues: 0
+  fix: false
+formatters:
+  enable:
+    - gci
+    - gofmt
+  exclusions:
+    generated: lax
+    paths:
+      - third_party$
+      - builtin$
+      - examples$
diff --git a/authd-oidc-brokers/.shellcheckrc b/authd-oidc-brokers/.shellcheckrc
new file mode 100644
index 0000000000..25c98c8fde
--- /dev/null
+++ b/authd-oidc-brokers/.shellcheckrc
@@ -0,0 +1,2 @@
+source-path=SCRIPTDIR
+external-sources=true
diff --git a/authd-oidc-brokers/cmd/authd-oidc/daemon/config.go b/authd-oidc-brokers/cmd/authd-oidc/daemon/config.go
new file mode 100644
index 0000000000..795df3a4b0
--- /dev/null
+++ b/authd-oidc-brokers/cmd/authd-oidc/daemon/config.go
@@ -0,0 +1,106 @@
+package daemon
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+
+	"github.com/canonical/authd/authd-oidc-brokers/internal/consts"
+	"github.com/spf13/cobra"
+	"github.com/spf13/viper"
+	"github.com/ubuntu/authd/log"
+	"github.com/ubuntu/decorate"
+)
+
+// initViperConfig sets verbosity level and add config env variables and file support based on name prefix.
+func initViperConfig(name string, cmd *cobra.Command, vip *viper.Viper) (err error) {
+	defer decorate.OnError(&err, "can't load configuration")
+
+	// Force a visit of the local flags so persistent flags for all parents are merged.
+	//cmd.LocalFlags() // TODO: still necessary?
+
+	// Get cmdline flag for verbosity to configure logger until we have everything parsed.
+	v, err := cmd.Flags().GetCount("verbosity")
+	if err != nil {
+		return fmt.Errorf("internal error: no persistent verbosity flag installed on cmd: %w", err)
+	}
+	setVerboseMode(v)
+
+	// Handle configuration.
+	if v, err := cmd.Flags().GetString("paths-config"); err == nil && v != "" {
+		vip.SetConfigFile(v)
+	} else {
+		vip.SetConfigName(name)
+		vip.AddConfigPath("./")
+		vip.AddConfigPath("$HOME/")
+		vip.AddConfigPath("$SNAP_DATA/")
+		vip.AddConfigPath(filepath.Join("/etc", name))
+		// Add the executable path to the config search path.
+		if binPath, err := os.Executable(); err != nil {
+			log.Warningf(context.Background(), "Failed to get current executable path, not adding it as a config dir: %v", err)
+		} else {
+			vip.AddConfigPath(filepath.Dir(binPath))
+		}
+	}
+
+	var configNotFoundErr viper.ConfigFileNotFoundError
+	err = vip.ReadInConfig()
+	if err != nil && !errors.As(err, &configNotFoundErr) {
+		return fmt.Errorf("invalid configuration file: %w", err)
+	}
+	if vip.ConfigFileUsed() != "" {
+		log.Infof(context.Background(), "Using configuration file: %v", vip.ConfigFileUsed())
+	}
+
+	// Handle environment.
+	vip.SetEnvPrefix(name)
+	vip.AutomaticEnv()
+
+	// Visit manually env to bind every possibly related environment variable to be able to unmarshall
+	// those into a struct.
+	// More context on https://github.com/spf13/viper/pull/1429.
+	prefix := strings.ToUpper(name) + "_"
+	for _, e := range os.Environ() {
+		if !strings.HasPrefix(e, prefix) {
+			continue
+		}
+
+		s := strings.Split(e, "=")
+		k := strings.ReplaceAll(strings.TrimPrefix(s[0], prefix), "_", ".")
+		if err := vip.BindEnv(k, s[0]); err != nil {
+			return fmt.Errorf("could not bind environment variable: %w", err)
+		}
+	}
+
+	return nil
+}
+
+// installConfigFlag installs a --config option.
+func installConfigFlag(cmd *cobra.Command) *string {
+	flag := cmd.PersistentFlags().StringP("config", "c", "", "use a specific configuration file")
+	if err := cmd.PersistentFlags().MarkHidden("config"); err != nil {
+		log.Warningf(context.Background(), "Failed to hide --config flag: %v", err)
+	}
+	return flag
+}
+
+// SetVerboseMode change ErrorFormat and logs between very, middly and non verbose.
+func setVerboseMode(level int) {
+	//var reportCaller bool
+	switch level {
+	case 0:
+		log.SetLevel(consts.DefaultLevelLog)
+	case 1:
+		log.SetLevel(log.InfoLevel)
+	case 3:
+		//reportCaller = true
+		fallthrough
+	default:
+		log.SetLevel(log.DebugLevel)
+	}
+
+	//slog.SetReportCaller(reportCaller)
+}
diff --git a/authd-oidc-brokers/cmd/authd-oidc/daemon/daemon.go b/authd-oidc-brokers/cmd/authd-oidc/daemon/daemon.go
new file mode 100644
index 0000000000..318352f892
--- /dev/null
+++ b/authd-oidc-brokers/cmd/authd-oidc/daemon/daemon.go
@@ -0,0 +1,216 @@
+// Package daemon represents the oidc broker binary
+package daemon
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"path/filepath"
+	"runtime"
+
+	"github.com/canonical/authd/authd-oidc-brokers/internal/broker"
+	"github.com/canonical/authd/authd-oidc-brokers/internal/consts"
+	"github.com/canonical/authd/authd-oidc-brokers/internal/daemon"
+	"github.com/canonical/authd/authd-oidc-brokers/internal/dbusservice"
+	"github.com/spf13/cobra"
+	"github.com/spf13/viper"
+	log "github.com/ubuntu/authd/log"
+)
+
+// App encapsulate commands and options of the daemon, which can be controlled by env variables and config files.
+type App struct {
+	rootCmd cobra.Command
+	viper   *viper.Viper
+	config  daemonConfig
+
+	daemon *daemon.Daemon
+	name   string
+
+	ready chan struct{}
+}
+
+// only overriable for tests.
+type systemPaths struct {
+	BrokerConf string
+	DataDir    string
+}
+
+// daemonConfig defines configuration parameters of the daemon.
+type daemonConfig struct {
+	Verbosity int
+	Paths     systemPaths
+}
+
+// New registers commands and return a new App.
+func New(name string) *App {
+	a := App{ready: make(chan struct{}), name: name}
+	a.rootCmd = cobra.Command{
+		Use:   fmt.Sprintf("%s COMMAND", name),
+		Short: fmt.Sprintf("%s authentication broker", name),
+		Long:  fmt.Sprintf("Authentication daemon %s to communicate with our authentication daemon.", name),
+		Args:  cobra.NoArgs,
+		PersistentPreRunE: func(cmd *cobra.Command, args []string) error {
+			// First thing, initialize the log handler
+			log.InitJournalHandler(false)
+
+			// Command parsing has been successful, so don't print the usage message on errors anymore.
+			a.rootCmd.SilenceUsage = true
+
+			dataDir := filepath.Join("/var", "lib", name)
+			configDir := "."
+			if snapData := os.Getenv("SNAP_DATA"); snapData != "" {
+				dataDir = snapData
+				configDir = snapData
+			}
+			// Set config defaults
+			a.config = daemonConfig{
+				Paths: systemPaths{
+					BrokerConf: filepath.Join(configDir, "broker.conf"),
+					DataDir:    dataDir,
+				},
+			}
+
+			// Install and unmarshall configuration
+			if err := initViperConfig(name, &a.rootCmd, a.viper); err != nil {
+				return err
+			}
+			if err := a.viper.Unmarshal(&a.config); err != nil {
+				return fmt.Errorf("unable to decode configuration into struct: %w", err)
+			}
+
+			// FIXME: for now, config is only the broker.conf file. It should be merged with the viper configuration.
+			if v, err := cmd.Flags().GetString("config"); err == nil && v != "" {
+				a.config.Paths.BrokerConf = v
+			}
+
+			setVerboseMode(a.config.Verbosity)
+
+			log.Infof(context.Background(), "Version: %s", consts.Version)
+			log.Debug(context.Background(), "Debug mode is enabled")
+
+			return nil
+		},
+		RunE: func(cmd *cobra.Command, args []string) error {
+			return a.serve(a.config)
+		},
+		// We display usage error ourselves
+		SilenceErrors: true,
+	}
+	viper := viper.New()
+
+	a.viper = viper
+
+	installVerbosityFlag(&a.rootCmd, a.viper)
+	installConfigFlag(&a.rootCmd)
+	// FIXME: This option is for the viper path configuration. We should merge --config and this one in the future.
+	a.rootCmd.PersistentFlags().StringP("paths-config", "", "", "use a specific paths configuration file")
+	if err := a.rootCmd.PersistentFlags().MarkHidden("paths-config"); err != nil {
+		log.Warningf(context.Background(), "Failed to hide --paths-config flag: %v", err)
+	}
+
+	// subcommands
+	a.installVersion()
+
+	return &a
+}
+
+// serve creates new dbus service on the system bus. This call is blocking until we quit it.
+func (a *App) serve(config daemonConfig) error {
+	ctx := context.Background()
+	// Ensure that the a.ready channel is closed when the function returns, which is what Quit() waits for before exiting.
+	readyPtr := &a.ready
+	closeFunc := func() {
+		if readyPtr == nil {
+			return
+		}
+		close(*readyPtr)
+		readyPtr = nil
+	}
+	defer closeFunc()
+
+	// When the data directory is SNAP_DATA, it has permission 0755, else we want to create it with 0700.
+	if err := ensureDirWithPerms(config.Paths.DataDir, 0700, os.Geteuid()); err != nil {
+		if err := ensureDirWithPerms(config.Paths.DataDir, 0755, os.Geteuid()); err != nil {
+			return fmt.Errorf("error initializing data directory %q: %v", config.Paths.DataDir, err)
+		}
+	}
+
+	brokerConfigDir := broker.GetDropInDir(config.Paths.BrokerConf)
+	if err := ensureDirWithPerms(brokerConfigDir, 0700, os.Geteuid()); err != nil {
+		return fmt.Errorf("error initializing broker configuration directory %q: %v", brokerConfigDir, err)
+	}
+
+	b, err := broker.New(broker.Config{
+		ConfigFile: config.Paths.BrokerConf,
+		DataDir:    config.Paths.DataDir,
+	})
+	if err != nil {
+		return err
+	}
+
+	s, err := dbusservice.New(ctx, b)
+	if err != nil {
+		return err
+	}
+
+	var daemonopts []daemon.Option
+	daemon, err := daemon.New(ctx, s, daemonopts...)
+	if err != nil {
+		_ = s.Stop()
+		return err
+	}
+
+	a.daemon = daemon
+	closeFunc()
+
+	return daemon.Serve(ctx)
+}
+
+// installVerbosityFlag adds the -v and -vv options and returns the reference to it.
+func installVerbosityFlag(cmd *cobra.Command, viper *viper.Viper) *int {
+	r := cmd.PersistentFlags().CountP("verbosity", "v" /*i18n.G(*/, "issue INFO (-v), DEBUG (-vv) or DEBUG with caller (-vvv) output") //)
+
+	if err := viper.BindPFlag("verbosity", cmd.PersistentFlags().Lookup("verbosity")); err != nil {
+		log.Warning(context.Background(), err.Error())
+	}
+
+	return r
+}
+
+// Run executes the command and associated process. It returns an error on syntax/usage error.
+func (a *App) Run() error {
+	return a.rootCmd.Execute()
+}
+
+// UsageError returns if the error is a command parsing or runtime one.
+func (a App) UsageError() bool {
+	return !a.rootCmd.SilenceUsage
+}
+
+// Hup prints all goroutine stack traces and return false to signal you shouldn't quit.
+func (a App) Hup() (shouldQuit bool) {
+	buf := make([]byte, 1<<16)
+	runtime.Stack(buf, true)
+	fmt.Printf("%s", buf)
+	return false
+}
+
+// Quit gracefully shutdown the service.
+func (a *App) Quit() {
+	a.WaitReady()
+	if a.daemon == nil {
+		return
+	}
+	a.daemon.Quit()
+}
+
+// WaitReady signals when the daemon is ready
+// Note: we need to use a pointer to not copy the App object before the daemon is ready, and thus, creates a data race.
+func (a *App) WaitReady() {
+	<-a.ready
+}
+
+// RootCmd returns a copy of the root command for the app. Shouldn't be in general necessary apart when running generators.
+func (a App) RootCmd() cobra.Command {
+	return a.rootCmd
+}
diff --git a/authd-oidc-brokers/cmd/authd-oidc/daemon/daemon_test.go b/authd-oidc-brokers/cmd/authd-oidc/daemon/daemon_test.go
new file mode 100644
index 0000000000..893ee4daac
--- /dev/null
+++ b/authd-oidc-brokers/cmd/authd-oidc/daemon/daemon_test.go
@@ -0,0 +1,409 @@
+package daemon_test
+
+import (
+	"bytes"
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/canonical/authd/authd-oidc-brokers/cmd/authd-oidc/daemon"
+	"github.com/canonical/authd/authd-oidc-brokers/internal/consts"
+	"github.com/canonical/authd/authd-oidc-brokers/internal/testutils"
+	"github.com/stretchr/testify/require"
+)
+
+var issuerURL string
+
+func TestHelp(t *testing.T) {
+	a := daemon.NewForTests(t, nil, issuerURL, "--help")
+
+	getStdout := captureStdout(t)
+
+	err := a.Run()
+	require.NoErrorf(t, err, "Run should not return an error with argument --help. Stdout: %v", getStdout())
+}
+
+func TestCompletion(t *testing.T) {
+	a := daemon.NewForTests(t, nil, issuerURL, "completion", "bash")
+
+	getStdout := captureStdout(t)
+
+	err := a.Run()
+	require.NoError(t, err, "Completion should not start the daemon. Stdout: %v", getStdout())
+}
+
+func TestVersion(t *testing.T) {
+	a := daemon.NewForTests(t, nil, issuerURL, "version")
+
+	getStdout := captureStdout(t)
+
+	err := a.Run()
+	require.NoError(t, err, "Run should not return an error")
+
+	out := getStdout()
+
+	fields := strings.Fields(out)
+	require.Len(t, fields, 2, "wrong number of fields in version: %s", out)
+
+	require.Equal(t, t.Name(), fields[0], "Wrong executable name")
+	require.Equal(t, consts.Version, fields[1], "Wrong version")
+}
+
+func TestNoUsageError(t *testing.T) {
+	a := daemon.NewForTests(t, nil, issuerURL, "completion", "bash")
+
+	getStdout := captureStdout(t)
+	err := a.Run()
+
+	require.NoError(t, err, "Run should not return an error, stdout: %v", getStdout())
+	isUsageError := a.UsageError()
+	require.False(t, isUsageError, "No usage error is reported as such")
+}
+
+func TestUsageError(t *testing.T) {
+	a := daemon.NewForTests(t, nil, issuerURL, "doesnotexist")
+
+	err := a.Run()
+	require.Error(t, err, "Run should return an error, stdout: %v")
+	isUsageError := a.UsageError()
+	require.True(t, isUsageError, "Usage error is reported as such")
+}
+
+func TestCanQuitWhenExecute(t *testing.T) {
+	a, wait := startDaemon(t, nil)
+	defer wait()
+
+	a.Quit()
+}
+
+func TestCanQuitTwice(t *testing.T) {
+	a, wait := startDaemon(t, nil)
+
+	a.Quit()
+	wait()
+
+	require.NotPanics(t, a.Quit)
+}
+
+func TestAppCanQuitWithoutExecute(t *testing.T) {
+	t.Skipf("This test is skipped because it is flaky. There is no way to guarantee Quit has been called before run.")
+
+	a := daemon.NewForTests(t, nil, issuerURL)
+
+	requireGoroutineStarted(t, a.Quit)
+	err := a.Run()
+	require.Error(t, err, "Should return an error")
+
+	require.Containsf(t, err.Error(), "grpc: the server has been stopped", "Unexpected error message")
+}
+
+func TestAppRunFailsOnComponentsCreationAndQuit(t *testing.T) {
+	const (
+		// DataDir errors
+		dirIsFile = iota
+		wrongPermission
+		noParentDir
+	)
+
+	tests := map[string]struct {
+		dataDirBehavior int
+		configBehavior  int
+	}{
+		"Error_on_existing_data_dir_being_a_file":    {dataDirBehavior: dirIsFile},
+		"Error_on_data_dir_missing_parent_directory": {dataDirBehavior: noParentDir},
+		"Error_on_wrong_permission_on_data_dir":      {dataDirBehavior: wrongPermission},
+	}
+	for name, tc := range tests {
+		t.Run(name, func(t *testing.T) {
+			tmpDir := t.TempDir()
+			dataDir := filepath.Join(tmpDir, "data")
+
+			switch tc.dataDirBehavior {
+			case dirIsFile:
+				err := os.WriteFile(dataDir, []byte("file"), 0600)
+				require.NoError(t, err, "Setup: could not create cache file for tests")
+			case wrongPermission:
+				err := os.Mkdir(dataDir, 0600)
+				require.NoError(t, err, "Setup: could not create cache directory for tests")
+			case noParentDir:
+				dataDir = filepath.Join(dataDir, "doesnotexist", "data")
+			}
+
+			config := daemon.DaemonConfig{
+				Verbosity: 0,
+				Paths: daemon.SystemPaths{
+					DataDir: dataDir,
+				},
+			}
+
+			a := daemon.NewForTests(t, &config, issuerURL)
+			err := a.Run()
+			require.Error(t, err, "Run should return an error")
+		})
+	}
+}
+
+func TestAppCanSigHupWhenExecute(t *testing.T) {
+	r, w, err := os.Pipe()
+	require.NoError(t, err, "Setup: pipe shouldn't fail")
+
+	a, wait := startDaemon(t, nil)
+
+	defer wait()
+	defer a.Quit()
+
+	orig := os.Stdout
+	os.Stdout = w
+
+	a.Hup()
+
+	os.Stdout = orig
+	w.Close()
+
+	var out bytes.Buffer
+	_, err = io.Copy(&out, r)
+	require.NoError(t, err, "Couldn't copy stdout to buffer")
+	require.NotEmpty(t, out.String(), "Stacktrace is printed")
+}
+
+func TestAppCanSigHupAfterExecute(t *testing.T) {
+	r, w, err := os.Pipe()
+	require.NoError(t, err, "Setup: pipe shouldn't fail")
+
+	a, wait := startDaemon(t, nil)
+	a.Quit()
+	wait()
+
+	orig := os.Stdout
+	os.Stdout = w
+
+	a.Hup()
+
+	os.Stdout = orig
+	w.Close()
+
+	var out bytes.Buffer
+	_, err = io.Copy(&out, r)
+	require.NoError(t, err, "Couldn't copy stdout to buffer")
+	require.NotEmpty(t, out.String(), "Stacktrace is printed")
+}
+
+func TestAppCanSigHupWithoutExecute(t *testing.T) {
+	r, w, err := os.Pipe()
+	require.NoError(t, err, "Setup: pipe shouldn't fail")
+
+	a := daemon.NewForTests(t, nil, issuerURL)
+
+	orig := os.Stdout
+	os.Stdout = w
+
+	a.Hup()
+
+	os.Stdout = orig
+	w.Close()
+
+	var out bytes.Buffer
+	_, err = io.Copy(&out, r)
+	require.NoError(t, err, "Couldn't copy stdout to buffer")
+	require.NotEmpty(t, out.String(), "Stacktrace is printed")
+}
+
+func TestAppGetRootCmd(t *testing.T) {
+	a := daemon.NewForTests(t, nil, issuerURL)
+	require.NotNil(t, a.RootCmd(), "Returns root command")
+}
+
+func TestConfigLoad(t *testing.T) {
+	tmpDir := t.TempDir()
+	config := daemon.DaemonConfig{
+		Verbosity: 1,
+		Paths: daemon.SystemPaths{
+			BrokerConf: filepath.Join(tmpDir, "broker.conf"),
+			DataDir:    filepath.Join(tmpDir, "data"),
+		},
+	}
+
+	a, wait := startDaemon(t, &config)
+	defer wait()
+	defer a.Quit()
+
+	require.Equal(t, config, a.Config(), "Config is loaded")
+}
+
+func TestConfigHasPrecedenceOverPathsConfig(t *testing.T) {
+	tmpDir := t.TempDir()
+	config := daemon.DaemonConfig{
+		Verbosity: 1,
+		Paths: daemon.SystemPaths{
+			BrokerConf: filepath.Join(tmpDir, "broker.conf"),
+			DataDir:    filepath.Join(tmpDir, "data"),
+		},
+	}
+
+	overrideBrokerConfPath := filepath.Join(tmpDir, "override", "via", "config", "broker.conf")
+	daemon.GenerateBrokerConfig(t, overrideBrokerConfPath, issuerURL)
+	a := daemon.NewForTests(t, &config, issuerURL, "--config", overrideBrokerConfPath)
+
+	wg := sync.WaitGroup{}
+	wg.Add(1)
+	go func() {
+		defer wg.Done()
+		err := a.Run()
+		require.NoError(t, err, "Run should exits without any error")
+	}()
+	a.WaitReady()
+	time.Sleep(50 * time.Millisecond)
+
+	defer wg.Wait()
+	defer a.Quit()
+
+	want := config
+	want.Paths.BrokerConf = overrideBrokerConfPath
+	require.Equal(t, want, a.Config(), "Config is loaded")
+}
+
+func TestAutoDetectConfig(t *testing.T) {
+	tmpDir := t.TempDir()
+	config := daemon.DaemonConfig{
+		Verbosity: 1,
+		Paths: daemon.SystemPaths{
+			BrokerConf: filepath.Join(tmpDir, "broker.conf"),
+			DataDir:    filepath.Join(tmpDir, "data"),
+		},
+	}
+
+	configPath := daemon.GenerateTestConfig(t, &config, issuerURL)
+	configNextToBinaryPath := filepath.Join(filepath.Dir(os.Args[0]), t.Name()+".yaml")
+	err := os.Rename(configPath, configNextToBinaryPath)
+	require.NoError(t, err, "Could not relocate authd configuration file in the binary directory")
+	// Remove configuration next binary for other tests to not pick it up.
+	defer os.Remove(configNextToBinaryPath)
+
+	a := daemon.New(t.Name())
+	wg := sync.WaitGroup{}
+	wg.Add(1)
+	go func() {
+		defer wg.Done()
+		err := a.Run()
+		require.NoError(t, err, "Run should exits without any error")
+	}()
+	a.WaitReady()
+	time.Sleep(50 * time.Millisecond)
+
+	defer wg.Wait()
+	defer a.Quit()
+
+	require.Equal(t, config, a.Config(), "Did not load configuration next to binary")
+}
+
+func TestNoConfigSetDefaults(t *testing.T) {
+	tmpDir := t.TempDir()
+	t.Setenv("SNAP_DATA", tmpDir)
+
+	a := daemon.New(t.Name()) // Use version to still run preExec to load no config but without running server
+	a.SetArgs("version")
+
+	err := a.Run()
+	require.NoError(t, err, "Run should not return an error")
+
+	require.Equal(t, 0, a.Config().Verbosity, "Default Verbosity")
+	require.Equal(t, filepath.Join(tmpDir, "broker.conf"), a.Config().Paths.BrokerConf, "Default broker configuration path")
+	require.Equal(t, tmpDir, a.Config().Paths.DataDir, "Default data directory")
+}
+
+func TestBadConfigReturnsError(t *testing.T) {
+	a := daemon.New(t.Name()) // Use version to still run preExec to load no config but without running server
+	a.SetArgs("version", "--paths-config", "/does/not/exist.yaml")
+
+	err := a.Run()
+	require.Error(t, err, "Run should return an error on config file")
+}
+
+// requireGoroutineStarted starts a goroutine and blocks until it has been launched.
+func requireGoroutineStarted(t *testing.T, f func()) {
+	t.Helper()
+
+	launched := make(chan struct{})
+
+	go func() {
+		close(launched)
+		f()
+	}()
+
+	<-launched
+}
+
+// startDaemon prepares and starts the daemon in the background. The done function should be called
+// to wait for the daemon to stop.
+func startDaemon(t *testing.T, conf *daemon.DaemonConfig) (app *daemon.App, done func()) {
+	t.Helper()
+
+	a := daemon.NewForTests(t, conf, issuerURL)
+
+	wg := sync.WaitGroup{}
+	wg.Add(1)
+	go func() {
+		defer wg.Done()
+		err := a.Run()
+		require.NoError(t, err, "Run should exits without any error")
+	}()
+	a.WaitReady()
+	time.Sleep(50 * time.Millisecond)
+
+	return a, func() {
+		wg.Wait()
+	}
+}
+
+// captureStdout capture current process stdout and returns a function to get the captured buffer.
+func captureStdout(t *testing.T) func() string {
+	t.Helper()
+
+	r, w, err := os.Pipe()
+	require.NoError(t, err, "Setup: pipe shouldn't fail")
+
+	orig := os.Stdout
+	os.Stdout = w
+
+	t.Cleanup(func() {
+		os.Stdout = orig
+		w.Close()
+	})
+
+	var out bytes.Buffer
+	errch := make(chan error)
+	go func() {
+		_, err = io.Copy(&out, r)
+		errch <- err
+		close(errch)
+	}()
+
+	return func() string {
+		w.Close()
+		w = nil
+		require.NoError(t, <-errch, "Couldn't copy stdout to buffer")
+
+		return out.String()
+	}
+}
+
+func TestMain(m *testing.M) {
+	// Start system bus mock.
+	cleanup, err := testutils.StartSystemBusMock()
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "%v\n", err)
+		os.Exit(1)
+	}
+	defer cleanup()
+
+	// Start provider mock
+	issuerURL, cleanup = testutils.StartMockProviderServer("", nil)
+	defer cleanup()
+
+	m.Run()
+}
diff --git a/authd-oidc-brokers/cmd/authd-oidc/daemon/export_test.go b/authd-oidc-brokers/cmd/authd-oidc/daemon/export_test.go
new file mode 100644
index 0000000000..fda6f80346
--- /dev/null
+++ b/authd-oidc-brokers/cmd/authd-oidc/daemon/export_test.go
@@ -0,0 +1,95 @@
+package daemon
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+	"gopkg.in/yaml.v3"
+)
+
+type (
+	DaemonConfig = daemonConfig
+	SystemPaths  = systemPaths
+)
+
+func NewForTests(t *testing.T, conf *DaemonConfig, providerURL string, args ...string) *App {
+	t.Helper()
+
+	p := GenerateTestConfig(t, conf, providerURL)
+	argsWithConf := []string{"--paths-config", p}
+	argsWithConf = append(argsWithConf, args...)
+
+	a := New(t.Name())
+	a.rootCmd.SetArgs(argsWithConf)
+	return a
+}
+
+func GenerateTestConfig(t *testing.T, origConf *daemonConfig, providerURL string) string {
+	t.Helper()
+
+	var conf daemonConfig
+
+	if origConf != nil {
+		conf = *origConf
+	}
+
+	if conf.Verbosity == 0 {
+		conf.Verbosity = 2
+	}
+	if conf.Paths.DataDir == "" {
+		conf.Paths.DataDir = t.TempDir()
+		//nolint: gosec // This is a directory owned only by the current user for tests.
+		err := os.Chmod(conf.Paths.DataDir, 0700)
+		require.NoError(t, err, "Setup: could not change permission on cache directory for tests")
+	}
+	if conf.Paths.BrokerConf == "" {
+		conf.Paths.BrokerConf = filepath.Join(t.TempDir(), strings.ReplaceAll(t.Name(), "/", "_")+".yaml")
+	}
+
+	GenerateBrokerConfig(t, conf.Paths.BrokerConf, providerURL)
+
+	d, err := yaml.Marshal(conf)
+	require.NoError(t, err, "Setup: could not marshal configuration for tests")
+
+	confPath := filepath.Join(t.TempDir(), "testconfig.yaml")
+	err = os.WriteFile(confPath, d, 0600)
+	require.NoError(t, err, "Setup: could not create configuration for tests")
+
+	return confPath
+}
+
+// GenerateBrokerConfig creates a broker configuration file for tests.
+func GenerateBrokerConfig(t *testing.T, p, providerURL string) {
+	t.Helper()
+
+	err := os.MkdirAll(filepath.Dir(p), 0700)
+	require.NoError(t, err, "Setup: could not create parent broker configuration directory for tests")
+
+	brokerCfg := fmt.Sprintf(`
+	[authd]
+	name = %[1]s
+	brand_icon = broker_icon.png
+	dbus_name = com.ubuntu.authd.%[1]s
+	dbus_object = /com/ubuntu/authd/%[1]s
+
+	[oidc]
+	issuer = %[2]s
+	client_id = client_id
+	`, strings.ReplaceAll(t.Name(), "/", "_"), providerURL)
+	err = os.WriteFile(p, []byte(brokerCfg), 0600)
+	require.NoError(t, err, "Setup: could not create broker configuration for tests")
+}
+
+// Config returns a DaemonConfig for tests.
+func (a App) Config() DaemonConfig {
+	return a.config
+}
+
+// SetArgs set some arguments on root command for tests.
+func (a *App) SetArgs(args ...string) {
+	a.rootCmd.SetArgs(args)
+}
diff --git a/authd-oidc-brokers/cmd/authd-oidc/daemon/fs.go b/authd-oidc-brokers/cmd/authd-oidc/daemon/fs.go
new file mode 100644
index 0000000000..a5ce4e173f
--- /dev/null
+++ b/authd-oidc-brokers/cmd/authd-oidc/daemon/fs.go
@@ -0,0 +1,32 @@
+package daemon
+
+import (
+	"fmt"
+	"io/fs"
+	"os"
+	"syscall"
+)
+
+// ensureDirWithPerms creates a directory at path if it doesn't exist yet with perm as permissions.
+// If the path exists, it will check if it’s a directory with those perms.
+func ensureDirWithPerms(path string, perm os.FileMode, owner int) error {
+	dir, err := os.Stat(path)
+	if err == nil {
+		if !dir.IsDir() {
+			return &os.PathError{Op: "mkdir", Path: path, Err: syscall.ENOTDIR}
+		}
+		if dir.Mode() != (perm | fs.ModeDir) {
+			return fmt.Errorf("permissions should be %v but are %v", perm|fs.ModeDir, dir.Mode())
+		}
+		stat, ok := dir.Sys().(*syscall.Stat_t)
+		if !ok {
+			return fmt.Errorf("failed to get syscall.Stat_t for %s", path)
+		}
+		if int(stat.Uid) != owner {
+			return fmt.Errorf("owner should be %d but is %d", owner, stat.Uid)
+		}
+
+		return nil
+	}
+	return os.Mkdir(path, perm)
+}
diff --git a/authd-oidc-brokers/cmd/authd-oidc/daemon/version.go b/authd-oidc-brokers/cmd/authd-oidc/daemon/version.go
new file mode 100644
index 0000000000..6e1fa8cc13
--- /dev/null
+++ b/authd-oidc-brokers/cmd/authd-oidc/daemon/version.go
@@ -0,0 +1,24 @@
+package daemon
+
+import (
+	"fmt"
+
+	"github.com/canonical/authd/authd-oidc-brokers/internal/consts"
+	"github.com/spf13/cobra"
+)
+
+func (a *App) installVersion() {
+	cmd := &cobra.Command{
+		Use:                                                     "version",
+		Short:/*i18n.G(*/ "Returns version of daemon and exits", /*)*/
+		Args:                                                    cobra.NoArgs,
+		RunE:                                                    func(cmd *cobra.Command, args []string) error { return a.getVersion() },
+	}
+	a.rootCmd.AddCommand(cmd)
+}
+
+// getVersion returns the current service version.
+func (a *App) getVersion() (err error) {
+	fmt.Printf( /*i18n.G(*/ "%s\t%s" /*)*/ +"\n", a.name, consts.Version)
+	return nil
+}
diff --git a/authd-oidc-brokers/cmd/authd-oidc/main.go b/authd-oidc-brokers/cmd/authd-oidc/main.go
new file mode 100644
index 0000000000..14f520e682
--- /dev/null
+++ b/authd-oidc-brokers/cmd/authd-oidc/main.go
@@ -0,0 +1,83 @@
+// Package main is the entry point.
+package main
+
+import (
+	"context"
+	"os"
+	"os/signal"
+	"path/filepath"
+	"sync"
+	"syscall"
+
+	"github.com/canonical/authd/authd-oidc-brokers/cmd/authd-oidc/daemon"
+	"github.com/canonical/authd/authd-oidc-brokers/internal/consts"
+	"github.com/canonical/authd/authd-oidc-brokers/po"
+	"github.com/ubuntu/authd/log"
+	"github.com/ubuntu/go-i18n"
+)
+
+//FIXME go:generate go run ../generate_completion_documentation.go completion ../../generated
+//FIXME go:generate go run ../generate_completion_documentation.go update-readme
+//FIXME go:generate go run ../generate_completion_documentation.go update-doc-cli-ref
+
+func main() {
+	i18n.InitI18nDomain(consts.TEXTDOMAIN, po.Files)
+	a := daemon.New(filepath.Base(os.Args[0]))
+	os.Exit(run(a))
+}
+
+type app interface {
+	Run() error
+	UsageError() bool
+	Hup() bool
+	Quit()
+}
+
+func run(a app) int {
+	defer installSignalHandler(a)()
+
+	if err := a.Run(); err != nil {
+		log.Error(context.Background(), err.Error())
+
+		if a.UsageError() {
+			return 2
+		}
+		return 1
+	}
+
+	return 0
+}
+
+func installSignalHandler(a app) func() {
+	c := make(chan os.Signal, 1)
+	signal.Notify(c, syscall.SIGHUP, syscall.SIGINT, syscall.SIGTERM)
+
+	wg := sync.WaitGroup{}
+	wg.Add(1)
+	go func() {
+		defer wg.Done()
+		for {
+			switch v, ok := <-c; v {
+			case syscall.SIGINT, syscall.SIGTERM:
+				a.Quit()
+				return
+			case syscall.SIGHUP:
+				if a.Hup() {
+					a.Quit()
+					return
+				}
+			default:
+				// channel was closed: we exited
+				if !ok {
+					return
+				}
+			}
+		}
+	}()
+
+	return func() {
+		signal.Stop(c)
+		close(c)
+		wg.Wait()
+	}
+}
diff --git a/authd-oidc-brokers/cmd/authd-oidc/main_test.go b/authd-oidc-brokers/cmd/authd-oidc/main_test.go
new file mode 100644
index 0000000000..5c7ed40bf1
--- /dev/null
+++ b/authd-oidc-brokers/cmd/authd-oidc/main_test.go
@@ -0,0 +1,117 @@
+package main
+
+import (
+	"errors"
+	"syscall"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+)
+
+type myApp struct {
+	done chan struct{}
+
+	runError         bool
+	usageErrorReturn bool
+	hupReturn        bool
+}
+
+func (a *myApp) Run() error {
+	<-a.done
+	if a.runError {
+		return errors.New("Error requested")
+	}
+	return nil
+}
+
+func (a myApp) UsageError() bool {
+	return a.usageErrorReturn
+}
+
+func (a myApp) Hup() bool {
+	return a.hupReturn
+}
+
+func (a *myApp) Quit() {
+	close(a.done)
+}
+
+//nolint:tparallel // Signal handlers tests: subtests can't be parallel
+func TestRun(t *testing.T) {
+	t.Parallel()
+
+	tests := map[string]struct {
+		runError         bool
+		usageErrorReturn bool
+		hupReturn        bool
+		sendSig          syscall.Signal
+
+		wantReturnCode int
+	}{
+		"Run_and_exit_successfully":              {},
+		"Run_and_return_error":                   {runError: true, wantReturnCode: 1},
+		"Run_and_return_usage_error":             {usageErrorReturn: true, runError: true, wantReturnCode: 2},
+		"Run_and_usage_error_only_does_not_fail": {usageErrorReturn: true, runError: false, wantReturnCode: 0},
+
+		// Signals handling
+		"Send_SIGINT_exits":           {sendSig: syscall.SIGINT},
+		"Send_SIGTERM_exits":          {sendSig: syscall.SIGTERM},
+		"Send_SIGHUP_without_exiting": {sendSig: syscall.SIGHUP},
+		"Send_SIGHUP_with_exit":       {sendSig: syscall.SIGHUP, hupReturn: true},
+	}
+	for name, tc := range tests {
+		t.Run(name, func(t *testing.T) {
+			a := myApp{
+				done:             make(chan struct{}),
+				runError:         tc.runError,
+				usageErrorReturn: tc.usageErrorReturn,
+				hupReturn:        tc.hupReturn,
+			}
+
+			var rc int
+			wait := make(chan struct{})
+			go func() {
+				rc = run(&a)
+				close(wait)
+			}()
+
+			time.Sleep(100 * time.Millisecond)
+
+			var exited bool
+			switch tc.sendSig {
+			case syscall.SIGINT:
+				fallthrough
+			case syscall.SIGTERM:
+				err := syscall.Kill(syscall.Getpid(), tc.sendSig)
+				require.NoError(t, err, "Teardown: kill should return no error")
+				select {
+				case <-time.After(50 * time.Millisecond):
+					exited = false
+				case <-wait:
+					exited = true
+				}
+				require.Equal(t, true, exited, "Expect to exit on SIGINT and SIGTERM")
+			case syscall.SIGHUP:
+				err := syscall.Kill(syscall.Getpid(), syscall.SIGHUP)
+				require.NoError(t, err, "Teardown: kill should return no error")
+				select {
+				case <-time.After(50 * time.Millisecond):
+					exited = false
+				case <-wait:
+					exited = true
+				}
+				// if SIGHUP returns false: do nothing and still wait.
+				// Otherwise, it means that we wanted to stop
+				require.Equal(t, tc.hupReturn, exited, "Expect to exit only on SIGHUP returning True")
+			}
+
+			if !exited {
+				a.Quit()
+				<-wait
+			}
+
+			require.Equal(t, tc.wantReturnCode, rc, "Return expected code")
+		})
+	}
+}
diff --git a/authd-oidc-brokers/conf/migrations/pre-0.2.0-pre1/broker.conf.d/00-migration-allowed_users.conf b/authd-oidc-brokers/conf/migrations/pre-0.2.0-pre1/broker.conf.d/00-migration-allowed_users.conf
new file mode 100644
index 0000000000..d1b977fdee
--- /dev/null
+++ b/authd-oidc-brokers/conf/migrations/pre-0.2.0-pre1/broker.conf.d/00-migration-allowed_users.conf
@@ -0,0 +1,11 @@
+## This file was generated during the broker upgrade process. DO NOT EDIT.
+##
+## This file adds the 'allowed_users' option and sets it to 'ALL'
+## to preserve backward compatibility, as the default for this
+## option is 'OWNER'.
+## For more information, refer to 10-allowed_users.conf.
+##
+## If you want to use the new default setting, simply delete this file.
+
+[users]
+allowed_users = ALL
diff --git a/authd-oidc-brokers/conf/migrations/pre-0.2.0-pre1/broker.conf.d/10-allowed_users.conf b/authd-oidc-brokers/conf/migrations/pre-0.2.0-pre1/broker.conf.d/10-allowed_users.conf
new file mode 100644
index 0000000000..33377e5227
--- /dev/null
+++ b/authd-oidc-brokers/conf/migrations/pre-0.2.0-pre1/broker.conf.d/10-allowed_users.conf
@@ -0,0 +1,28 @@
+[users]
+## 'allowed_users' specifies the users who are permitted to log in after
+## successfully authenticating with the Identity Provider.
+## Values are separated by commas. Supported values:
+## - 'OWNER': Grants access to the user specified in the 'owner' option
+##        	(see below). This is the default.
+## - 'ALL': Grants access to all users who successfully authenticate
+##      	with the Identity Provider.
+## - <username>: Grants access to specific additional users
+##           	(e.g. user1@example.com).
+## Example: allowed_users = OWNER,user1@example.com,admin@example.com
+#allowed_users = OWNER
+
+## 'owner' specifies the user assigned the owner role. This user is
+## permitted to log in if 'OWNER' is included in the 'allowed_users'
+## option.
+##
+## If this option is left unset, the first user to successfully log in
+## via this broker will automatically be assigned the owner role. A
+## drop-in configuration file will be created in broker.conf.d/ to set
+## the 'owner' option.
+##
+## To disable automatic assignment, you can either:
+## 1. Explicitly set this option to an empty value (e.g. owner = "")
+## 2. Remove 'OWNER' from the 'allowed_users' option
+##
+## Example: owner = user2@example.com
+#owner =
diff --git a/authd-oidc-brokers/conf/variants/google/authd.conf b/authd-oidc-brokers/conf/variants/google/authd.conf
new file mode 100644
index 0000000000..18da085caf
--- /dev/null
+++ b/authd-oidc-brokers/conf/variants/google/authd.conf
@@ -0,0 +1,7 @@
+# This section is used by authd to identify and communicate with the broker.
+# It should not be edited.
+[authd]
+name = Google
+brand_icon = /snap/authd-google/current/broker_icon.png
+dbus_name = com.ubuntu.authd.Google
+dbus_object = /com/ubuntu/authd/Google
diff --git a/authd-oidc-brokers/conf/variants/google/broker.conf b/authd-oidc-brokers/conf/variants/google/broker.conf
new file mode 100644
index 0000000000..31d80afb07
--- /dev/null
+++ b/authd-oidc-brokers/conf/variants/google/broker.conf
@@ -0,0 +1,82 @@
+[oidc]
+issuer = https://accounts.google.com
+client_id = <CLIENT_ID>
+client_secret = <CLIENT_SECRET>
+
+## Force remote authentication with the identity provider during login,
+## even if a local method (e.g. local password) is used.
+## This works by forcing a token refresh during login, which fails if the
+## user does not have the necessary permissions in the identity provider.
+##
+## If set to false (the default), remote authentication with the identity
+## provider only happens if there is a working internet connection and
+## the provider is reachable during login.
+##
+## Important: Enabling this option prevents authd users from logging in
+## if the identity provider is unreachable (e.g. due to network issues).
+#force_provider_authentication = false
+
+[users]
+## The directory where the home directories of new users are created.
+## Existing users will keep their current home directory.
+## The home directories are created in the format <home_base_dir>/<username>
+#home_base_dir = /home
+
+## By default, SSH only allows logins from users that already exist on the
+## system.
+## New authd users (who have never logged in before) are *not* allowed to log
+## in for the first time via SSH unless this option is configured.
+##
+## If configured, only users with a suffix in this list are allowed to
+## authenticate for the first time directly through SSH.
+## Note that this does not affect users that already authenticated for
+## the first time and already exist on the system.
+##
+## Suffixes must be comma-separated (e.g., '@example.com,@example.org').
+## To allow all suffixes, use a single asterisk ('*').
+##
+## Example:
+##     ssh_allowed_suffixes_first_auth = @example.com,@anotherexample.org
+##
+## Example (allow all):
+##     ssh_allowed_suffixes_first_auth = *
+##
+#ssh_allowed_suffixes_first_auth =
+
+## 'allowed_users' specifies the users who are permitted to log in after
+## successfully authenticating with the identity provider.
+## Values are separated by commas. Supported values:
+## - 'OWNER': Grants access to the user specified in the 'owner' option
+##            (see below). This is the default.
+## - 'ALL': Grants access to all users who successfully authenticate
+##          with the identity provider.
+## - <username>: Grants access to specific additional users
+##               (e.g. user1@example.com).
+## Example: allowed_users = OWNER,user1@example.com,admin@example.com
+#allowed_users = OWNER
+
+## 'owner' specifies the user assigned the owner role. This user is
+## permitted to log in if 'OWNER' is included in the 'allowed_users'
+## option.
+##
+## If this option is left unset, the first user to successfully log in
+## via this broker will automatically be assigned the owner role. A
+## drop-in configuration file will be created in broker.conf.d/ to set
+## the 'owner' option.
+##
+## To disable automatic assignment, you can either:
+## 1. Explicitly set this option to an empty value (e.g. owner = "")
+## 2. Remove 'OWNER' from the 'allowed_users' option
+##
+## Example: owner = user2@example.com
+#owner =
+
+## A comma-separated list of local groups which authd users will be
+## added to upon login.
+## Example: extra_groups = users
+#extra_groups =
+
+## Like 'extra_groups', but only the user assigned the owner role
+## (see 'owner' option) will be added to these groups.
+## Example: owner_extra_groups = sudo,lpadmin
+#owner_extra_groups =
diff --git a/authd-oidc-brokers/conf/variants/msentraid/authd.conf b/authd-oidc-brokers/conf/variants/msentraid/authd.conf
new file mode 100644
index 0000000000..9a620538cb
--- /dev/null
+++ b/authd-oidc-brokers/conf/variants/msentraid/authd.conf
@@ -0,0 +1,7 @@
+# This section is used by authd to identify and communicate with the broker.
+# It should not be edited.
+[authd]
+name = Microsoft Entra ID
+brand_icon = /snap/authd-msentraid/current/broker_icon.png
+dbus_name = com.ubuntu.authd.MSEntraID
+dbus_object = /com/ubuntu/authd/MSEntraID
diff --git a/authd-oidc-brokers/conf/variants/msentraid/broker.conf b/authd-oidc-brokers/conf/variants/msentraid/broker.conf
new file mode 100644
index 0000000000..db63181111
--- /dev/null
+++ b/authd-oidc-brokers/conf/variants/msentraid/broker.conf
@@ -0,0 +1,91 @@
+[oidc]
+issuer = https://login.microsoftonline.com/<ISSUER_ID>/v2.0
+client_id = <CLIENT_ID>
+
+## Force remote authentication with the identity provider during login,
+## even if a local method (e.g. local password) is used.
+## This works by forcing a token refresh during login, which fails if the
+## user does not have the necessary permissions in the identity provider.
+##
+## If set to false (the default), remote authentication with the identity
+## provider only happens if there is a working internet connection and
+## the provider is reachable during login.
+##
+## Important: Enabling this option prevents authd users from logging in
+## if the identity provider is unreachable (e.g. due to network issues).
+#force_provider_authentication = false
+
+[msentraid]
+## Enable automatic device registration with Microsoft Entra ID
+## when a user logs in through this broker.
+##
+## If set to true, authd will attempt to register the local machine
+## as a device in Entra ID upon successful login.
+##
+## If set to false (the default), device registration will be skipped.
+#register_device = false
+
+[users]
+## The directory where the home directories of new users are created.
+## Existing users will keep their current home directory.
+## The home directories are created in the format <home_base_dir>/<username>
+#home_base_dir = /home
+
+## By default, SSH only allows logins from users that already exist on the
+## system.
+## New authd users (who have never logged in before) are *not* allowed to log
+## in for the first time via SSH unless this option is configured.
+##
+## If configured, only users with a suffix in this list are allowed to
+## authenticate for the first time directly through SSH.
+## Note that this does not affect users that already authenticated for
+## the first time and already exist on the system.
+##
+## Suffixes must be comma-separated (e.g., '@example.com,@example.org').
+## To allow all suffixes, use a single asterisk ('*').
+##
+## Example:
+##     ssh_allowed_suffixes_first_auth = @example.com,@anotherexample.org
+##
+## Example (allow all):
+##     ssh_allowed_suffixes_first_auth = *
+##
+#ssh_allowed_suffixes_first_auth =
+
+## 'allowed_users' specifies the users who are permitted to log in after
+## successfully authenticating with the identity provider.
+## Values are separated by commas. Supported values:
+## - 'OWNER': Grants access to the user specified in the 'owner' option
+##            (see below). This is the default.
+## - 'ALL': Grants access to all users who successfully authenticate
+##          with the identity provider.
+## - <username>: Grants access to specific additional users
+##               (e.g. user1@example.com).
+## Example: allowed_users = OWNER,user1@example.com,admin@example.com
+#allowed_users = OWNER
+
+## 'owner' specifies the user assigned the owner role. This user is
+## permitted to log in if 'OWNER' is included in the 'allowed_users'
+## option.
+##
+## If this option is left unset, the first user to successfully log in
+## via this broker will automatically be assigned the owner role. A
+## drop-in configuration file will be created in broker.conf.d/ to set
+## the 'owner' option.
+##
+## To disable automatic assignment, you can either:
+## 1. Explicitly set this option to an empty value (e.g. owner = "")
+## 2. Remove 'OWNER' from the 'allowed_users' option
+##
+## Example: owner = user2@example.com
+#owner =
+
+## A comma-separated list of local groups which authd users will be
+## added to upon login.
+## Example: extra_groups = users
+#extra_groups =
+
+## Like 'extra_groups', but only the user assigned the owner role
+## (see 'owner' option) will be added to these groups.
+## Example: owner_extra_groups = sudo,lpadmin
+#owner_extra_groups =
diff --git a/authd-oidc-brokers/conf/variants/oidc/authd.conf b/authd-oidc-brokers/conf/variants/oidc/authd.conf
new file mode 100644
index 0000000000..4475af5569
--- /dev/null
+++ b/authd-oidc-brokers/conf/variants/oidc/authd.conf
@@ -0,0 +1,7 @@
+# This section is used by authd to identify and communicate with the broker.
+# It should not be edited.
+[authd]
+name = OIDC
+brand_icon = /snap/authd-oidc/current/broker_icon.png
+dbus_name = com.ubuntu.authd.Oidc
+dbus_object = /com/ubuntu/authd/Oidc
diff --git a/authd-oidc-brokers/conf/variants/oidc/broker.conf b/authd-oidc-brokers/conf/variants/oidc/broker.conf
new file mode 100644
index 0000000000..8325587984
--- /dev/null
+++ b/authd-oidc-brokers/conf/variants/oidc/broker.conf
@@ -0,0 +1,90 @@
+[oidc]
+issuer = <ISSUER_URL>
+client_id = <CLIENT_ID>
+
+## Depending on the identity provider, you may need to provide a
+## client secret to authenticate with the provider.
+#client_secret = <CLIENT_SECRET>
+
+## Comma-separated list of extra OIDC scopes to request in addition to
+## the default scopes.
+## Example: extra_scopes = offline_access
+#extra_scopes =
+
+## Force remote authentication with the identity provider during login,
+## even if a local method (e.g. local password) is used.
+## This works by forcing a token refresh during login, which fails if the
+## user does not have the necessary permissions in the identity provider.
+##
+## If set to false (the default), remote authentication with the identity
+## provider only happens if there is a working internet connection and
+## the provider is reachable during login.
+##
+## Important: Enabling this option prevents authd users from logging in
+## if the identity provider is unreachable (e.g. due to network issues).
+#force_provider_authentication = false
+
+[users]
+## The directory where the home directories of new users are created.
+## Existing users will keep their current home directory.
+## The home directories are created in the format <home_base_dir>/<username>
+#home_base_dir = /home
+
+## By default, SSH only allows logins from users that already exist on the
+## system.
+## New authd users (who have never logged in before) are *not* allowed to log
+## in for the first time via SSH unless this option is configured.
+##
+## If configured, only users with a suffix in this list are allowed to
+## authenticate for the first time directly through SSH.
+## Note that this does not affect users that already authenticated for
+## the first time and already exist on the system.
+##
+## Suffixes must be comma-separated (e.g., '@example.com,@example.org').
+## To allow all suffixes, use a single asterisk ('*').
+##
+## Example:
+##     ssh_allowed_suffixes_first_auth = @example.com,@anotherexample.org
+##
+## Example (allow all):
+##     ssh_allowed_suffixes_first_auth = *
+##
+#ssh_allowed_suffixes_first_auth =
+
+## 'allowed_users' specifies the users who are permitted to log in after
+## successfully authenticating with the identity provider.
+## Values are separated by commas. Supported values:
+## - 'OWNER': Grants access to the user specified in the 'owner' option
+##            (see below). This is the default.
+## - 'ALL': Grants access to all users who successfully authenticate
+##          with the identity provider.
+## - <username>: Grants access to specific additional users
+##               (e.g. user1@example.com).
+## Example: allowed_users = OWNER,user1@example.com,admin@example.com
+#allowed_users = OWNER
+
+## 'owner' specifies the user assigned the owner role. This user is
+## permitted to log in if 'OWNER' is included in the 'allowed_users'
+## option.
+##
+## If this option is left unset, the first user to successfully log in
+## via this broker will automatically be assigned the owner role. A
+## drop-in configuration file will be created in broker.conf.d/ to set
+## the 'owner' option.
+##
+## To disable automatic assignment, you can either:
+## 1. Explicitly set this option to an empty value (e.g. owner = "")
+## 2. Remove 'OWNER' from the 'allowed_users' option
+##
+## Example: owner = user2@example.com
+#owner =
+
+## A comma-separated list of local groups which authd users will be
+## added to upon login.
+## Example: extra_groups = users
+#extra_groups =
+
+## Like 'extra_groups', but only the user assigned the owner role
+## (see 'owner' option) will be added to these groups.
+## Example: owner_extra_groups = sudo,lpadmin
+#owner_extra_groups =
diff --git a/authd-oidc-brokers/go.mod b/authd-oidc-brokers/go.mod
new file mode 100644
index 0000000000..b6001e729c
--- /dev/null
+++ b/authd-oidc-brokers/go.mod
@@ -0,0 +1,71 @@
+module github.com/canonical/authd/authd-oidc-brokers
+
+go 1.25.0
+
+toolchain go1.25.8
+
+require (
+	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.21.0
+	github.com/coreos/go-oidc/v3 v3.17.0
+	github.com/coreos/go-systemd v0.0.0-20191104093116-d3cd4ed1dbcf
+	github.com/go-jose/go-jose/v4 v4.1.3
+	github.com/godbus/dbus/v5 v5.2.2
+	github.com/golang-jwt/jwt/v5 v5.3.1
+	github.com/google/uuid v1.6.0
+	github.com/k0kubun/pp v3.0.1+incompatible
+	github.com/microsoftgraph/msgraph-sdk-go v1.96.0
+	github.com/microsoftgraph/msgraph-sdk-go-core v1.4.0
+	github.com/otiai10/copy v1.14.1
+	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2
+	github.com/spf13/cobra v1.10.2
+	github.com/spf13/viper v1.21.0
+	github.com/stretchr/testify v1.11.1
+	github.com/ubuntu/authd v0.5.8
+	github.com/ubuntu/decorate v0.0.0-20240301153420-5015d6dbc8e5
+	github.com/ubuntu/go-i18n v0.0.0-20231113092927-594c1754ca47
+	golang.org/x/crypto v0.48.0
+	golang.org/x/oauth2 v0.35.0
+	gopkg.in/ini.v1 v1.67.1
+	gopkg.in/yaml.v3 v3.0.1
+)
+
+require (
+	github.com/Azure/azure-sdk-for-go/sdk/internal v1.11.2 // indirect
+	github.com/coreos/go-systemd/v22 v22.5.0 // indirect
+	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
+	github.com/fsnotify/fsnotify v1.9.0 // indirect
+	github.com/go-logr/logr v1.4.3 // indirect
+	github.com/go-logr/stdr v1.2.2 // indirect
+	github.com/go-viper/mapstructure/v2 v2.4.0 // indirect
+	github.com/inconshreveable/mousetrap v1.1.0 // indirect
+	github.com/k0kubun/colorstring v0.0.0-20150214042306-9440f1994b88 // indirect
+	github.com/leonelquinteros/gotext v1.5.3-0.20230829162019-37f474cfb069 // indirect
+	github.com/mattn/go-colorable v0.1.14 // indirect
+	github.com/mattn/go-isatty v0.0.20 // indirect
+	github.com/microsoft/kiota-abstractions-go v1.9.3 // indirect
+	github.com/microsoft/kiota-authentication-azure-go v1.3.1 // indirect
+	github.com/microsoft/kiota-http-go v1.5.4 // indirect
+	github.com/microsoft/kiota-serialization-form-go v1.1.2 // indirect
+	github.com/microsoft/kiota-serialization-json-go v1.1.2 // indirect
+	github.com/microsoft/kiota-serialization-multipart-go v1.1.2 // indirect
+	github.com/microsoft/kiota-serialization-text-go v1.1.3 // indirect
+	github.com/otiai10/mint v1.6.3 // indirect
+	github.com/pelletier/go-toml/v2 v2.2.4 // indirect
+	github.com/sagikazarmark/locafero v0.11.0 // indirect
+	github.com/sirupsen/logrus v1.9.3 // indirect
+	github.com/sourcegraph/conc v0.3.1-0.20240121214520-5f936abd7ae8 // indirect
+	github.com/spf13/afero v1.15.0 // indirect
+	github.com/spf13/cast v1.10.0 // indirect
+	github.com/spf13/pflag v1.0.10 // indirect
+	github.com/std-uritemplate/std-uritemplate/go/v2 v2.0.3 // indirect
+	github.com/subosito/gotenv v1.6.0 // indirect
+	go.opentelemetry.io/auto/sdk v1.1.0 // indirect
+	go.opentelemetry.io/otel v1.37.0 // indirect
+	go.opentelemetry.io/otel/metric v1.37.0 // indirect
+	go.opentelemetry.io/otel/trace v1.37.0 // indirect
+	go.yaml.in/yaml/v3 v3.0.4 // indirect
+	golang.org/x/net v0.49.0 // indirect
+	golang.org/x/sync v0.19.0 // indirect
+	golang.org/x/sys v0.41.0 // indirect
+	golang.org/x/text v0.34.0 // indirect
+)
diff --git a/authd-oidc-brokers/go.sum b/authd-oidc-brokers/go.sum
new file mode 100644
index 0000000000..67c880d216
--- /dev/null
+++ b/authd-oidc-brokers/go.sum
@@ -0,0 +1,176 @@
+github.com/Azure/azure-sdk-for-go/sdk/azcore v1.21.0 h1:fou+2+WFTib47nS+nz/ozhEBnvU96bKHy6LjRsY4E28=
+github.com/Azure/azure-sdk-for-go/sdk/azcore v1.21.0/go.mod h1:t76Ruy8AHvUAC8GfMWJMa0ElSbuIcO03NLpynfbgsPA=
+github.com/Azure/azure-sdk-for-go/sdk/internal v1.11.2 h1:9iefClla7iYpfYWdzPCRDozdmndjTm8DXdpCzPajMgA=
+github.com/Azure/azure-sdk-for-go/sdk/internal v1.11.2/go.mod h1:XtLgD3ZD34DAaVIIAyG3objl5DynM3CQ/vMcbBNJZGI=
+github.com/coreos/go-oidc/v3 v3.17.0 h1:hWBGaQfbi0iVviX4ibC7bk8OKT5qNr4klBaCHVNvehc=
+github.com/coreos/go-oidc/v3 v3.17.0/go.mod h1:wqPbKFrVnE90vty060SB40FCJ8fTHTxSwyXJqZH+sI8=
+github.com/coreos/go-systemd v0.0.0-20191104093116-d3cd4ed1dbcf h1:iW4rZ826su+pqaw19uhpSCzhj44qo35pNgKFGqzDKkU=
+github.com/coreos/go-systemd v0.0.0-20191104093116-d3cd4ed1dbcf/go.mod h1:F5haX7vjVVG0kc13fIWeqUViNPyEJxv/OmvnBo0Yme4=
+github.com/coreos/go-systemd/v22 v22.5.0 h1:RrqgGjYQKalulkV8NGVIfkXQf6YYmOyiJKk8iXXhfZs=
+github.com/coreos/go-systemd/v22 v22.5.0/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc=
+github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
+github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
+github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/frankban/quicktest v1.14.6 h1:7Xjx+VpznH+oBnejlPUj8oUpdxnVs4f8XU8WnHkI4W8=
+github.com/frankban/quicktest v1.14.6/go.mod h1:4ptaffx2x8+WTWXmUCuVU6aPUX1/Mz7zb5vbUoiM6w0=
+github.com/fsnotify/fsnotify v1.9.0 h1:2Ml+OJNzbYCTzsxtv8vKSFD9PbJjmhYF14k/jKC7S9k=
+github.com/fsnotify/fsnotify v1.9.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0=
+github.com/go-jose/go-jose/v4 v4.1.3 h1:CVLmWDhDVRa6Mi/IgCgaopNosCaHz7zrMeF9MlZRkrs=
+github.com/go-jose/go-jose/v4 v4.1.3/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
+github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
+github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
+github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
+github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
+github.com/go-viper/mapstructure/v2 v2.4.0 h1:EBsztssimR/CONLSZZ04E8qAkxNYq4Qp9LvH92wZUgs=
+github.com/go-viper/mapstructure/v2 v2.4.0/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM=
+github.com/godbus/dbus/v5 v5.0.4/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
+github.com/godbus/dbus/v5 v5.2.2 h1:TUR3TgtSVDmjiXOgAAyaZbYmIeP3DPkld3jgKGV8mXQ=
+github.com/godbus/dbus/v5 v5.2.2/go.mod h1:3AAv2+hPq5rdnr5txxxRwiGjPXamgoIHgz9FPBfOp3c=
+github.com/golang-jwt/jwt/v5 v5.3.1 h1:kYf81DTWFe7t+1VvL7eS+jKFVWaUnK9cB1qbwn63YCY=
+github.com/golang-jwt/jwt/v5 v5.3.1/go.mod h1:fxCRLWMO43lRc8nhHWY6LGqRcf+1gQWArsqaEUEa5bE=
+github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
+github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
+github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
+github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
+github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
+github.com/k0kubun/colorstring v0.0.0-20150214042306-9440f1994b88 h1:uC1QfSlInpQF+M0ao65imhwqKnz3Q2z/d8PWZRMQvDM=
+github.com/k0kubun/colorstring v0.0.0-20150214042306-9440f1994b88/go.mod h1:3w7q1U84EfirKl04SVQ/s7nPm1ZPhiXd34z40TNz36k=
+github.com/k0kubun/pp v3.0.1+incompatible h1:3tqvf7QgUnZ5tXO6pNAZlrvHgl6DvifjDrd9g2S9Z40=
+github.com/k0kubun/pp v3.0.1+incompatible/go.mod h1:GWse8YhT0p8pT4ir3ZgBbfZild3tgzSScAn6HmfYukg=
+github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
+github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
+github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
+github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
+github.com/leonelquinteros/gotext v1.5.3-0.20230829162019-37f474cfb069 h1:9ZM/t54vDjI3XRw2+HC2DxrH2Giv/jAyv7+Vq2QgXmg=
+github.com/leonelquinteros/gotext v1.5.3-0.20230829162019-37f474cfb069/go.mod h1:AT4NpQrOmyj1L/+hLja6aR0lk81yYYL4ePnj2kp7d6M=
+github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE=
+github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
+github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
+github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
+github.com/microsoft/kiota-abstractions-go v1.9.3 h1:cqhbqro+VynJ7kObmo7850h3WN2SbvoyhypPn8uJ1SE=
+github.com/microsoft/kiota-abstractions-go v1.9.3/go.mod h1:f06pl3qSyvUHEfVNkiRpXPkafx7khZqQEb71hN/pmuU=
+github.com/microsoft/kiota-authentication-azure-go v1.3.1 h1:AGta92S6IL1E6ZMDb8YYB7NVNTIFUakbtLKUdY5RTuw=
+github.com/microsoft/kiota-authentication-azure-go v1.3.1/go.mod h1:26zylt2/KfKwEWZSnwHaMxaArpbyN/CuzkbotdYXF0g=
+github.com/microsoft/kiota-http-go v1.5.4 h1:wSUmL1J+bTQlAWHjbRkSwr+SPAkMVYeYxxB85Zw0KFs=
+github.com/microsoft/kiota-http-go v1.5.4/go.mod h1:L+5Ri+SzwELnUcNA0cpbFKp/pBbvypLh3Cd1PR6sjx0=
+github.com/microsoft/kiota-serialization-form-go v1.1.2 h1:SD6MATqNw+Dc5beILlsb/D87C36HKC/Zw7l+N9+HY2A=
+github.com/microsoft/kiota-serialization-form-go v1.1.2/go.mod h1:m4tY2JT42jAZmgbqFwPy3zGDF+NPJACuyzmjNXeuHio=
+github.com/microsoft/kiota-serialization-json-go v1.1.2 h1:eJrPWeQ665nbjO0gsHWJ0Bw6V/ZHHU1OfFPaYfRG39k=
+github.com/microsoft/kiota-serialization-json-go v1.1.2/go.mod h1:deaGt7fjZarywyp7TOTiRsjfYiyWxwJJPQZytXwYQn8=
+github.com/microsoft/kiota-serialization-multipart-go v1.1.2 h1:1pUyA1QgIeKslQwbk7/ox1TehjlCUUT3r1f8cNlkvn4=
+github.com/microsoft/kiota-serialization-multipart-go v1.1.2/go.mod h1:j2K7ZyYErloDu7Kuuk993DsvfoP7LPWvAo7rfDpdPio=
+github.com/microsoft/kiota-serialization-text-go v1.1.3 h1:8z7Cebn0YAAr++xswVgfdxZjnAZ4GOB9O7XP4+r5r/M=
+github.com/microsoft/kiota-serialization-text-go v1.1.3/go.mod h1:NDSvz4A3QalGMjNboKKQI9wR+8k+ih8UuagNmzIRgTQ=
+github.com/microsoftgraph/msgraph-sdk-go v1.96.0 h1:UnqyTX8Ils9tJ7QLaR2yVF3ctXCvRUp2gl3BThIteJk=
+github.com/microsoftgraph/msgraph-sdk-go v1.96.0/go.mod h1:JBHC+/jxEODRr1TmV5caB84mJF4whlpTLHPveVJ0DFA=
+github.com/microsoftgraph/msgraph-sdk-go-core v1.4.0 h1:0SrIoFl7TQnMRrsi5TFaeNe0q8KO5lRzRp4GSCCL2So=
+github.com/microsoftgraph/msgraph-sdk-go-core v1.4.0/go.mod h1:A1iXs+vjsRjzANxF6UeKv2ACExG7fqTwHHbwh1FL+EE=
+github.com/otiai10/copy v1.14.1 h1:5/7E6qsUMBaH5AnQ0sSLzzTg1oTECmcCmT6lvF45Na8=
+github.com/otiai10/copy v1.14.1/go.mod h1:oQwrEDDOci3IM8dJF0d8+jnbfPDllW6vUjNc3DoZm9I=
+github.com/otiai10/mint v1.6.3 h1:87qsV/aw1F5as1eH1zS/yqHY85ANKVMgkDrf9rcxbQs=
+github.com/otiai10/mint v1.6.3/go.mod h1:MJm72SBthJjz8qhefc4z1PYEieWmy8Bku7CjcAqyUSM=
+github.com/pelletier/go-toml/v2 v2.2.4 h1:mye9XuhQ6gvn5h28+VilKrrPoQVanw5PMw/TB0t5Ec4=
+github.com/pelletier/go-toml/v2 v2.2.4/go.mod h1:2gIqNv+qfxSVS7cM2xJQKtLSTLUE9V8t9Stt+h56mCY=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
+github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
+github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=
+github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
+github.com/sagikazarmark/locafero v0.11.0 h1:1iurJgmM9G3PA/I+wWYIOw/5SyBtxapeHDcg+AAIFXc=
+github.com/sagikazarmark/locafero v0.11.0/go.mod h1:nVIGvgyzw595SUSUE6tvCp3YYTeHs15MvlmU87WwIik=
+github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
+github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
+github.com/sourcegraph/conc v0.3.1-0.20240121214520-5f936abd7ae8 h1:+jumHNA0Wrelhe64i8F6HNlS8pkoyMv5sreGx2Ry5Rw=
+github.com/sourcegraph/conc v0.3.1-0.20240121214520-5f936abd7ae8/go.mod h1:3n1Cwaq1E1/1lhQhtRK2ts/ZwZEhjcQeJQ1RuC6Q/8U=
+github.com/spf13/afero v1.15.0 h1:b/YBCLWAJdFWJTN9cLhiXXcD7mzKn9Dm86dNnfyQw1I=
+github.com/spf13/afero v1.15.0/go.mod h1:NC2ByUVxtQs4b3sIUphxK0NioZnmxgyCrfzeuq8lxMg=
+github.com/spf13/cast v1.10.0 h1:h2x0u2shc1QuLHfxi+cTJvs30+ZAHOGRic8uyGTDWxY=
+github.com/spf13/cast v1.10.0/go.mod h1:jNfB8QC9IA6ZuY2ZjDp0KtFO2LZZlg4S/7bzP6qqeHo=
+github.com/spf13/cobra v1.10.2 h1:DMTTonx5m65Ic0GOoRY2c16WCbHxOOw6xxezuLaBpcU=
+github.com/spf13/cobra v1.10.2/go.mod h1:7C1pvHqHw5A4vrJfjNwvOdzYu0Gml16OCs2GRiTUUS4=
+github.com/spf13/pflag v1.0.9/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
+github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/spf13/viper v1.21.0 h1:x5S+0EU27Lbphp4UKm1C+1oQO+rKx36vfCoaVebLFSU=
+github.com/spf13/viper v1.21.0/go.mod h1:P0lhsswPGWD/1lZJ9ny3fYnVqxiegrlNrEmgLjbTCAY=
+github.com/std-uritemplate/std-uritemplate/go/v2 v2.0.3 h1:7hth9376EoQEd1hH4lAp3vnaLP2UMyxuMMghLKzDHyU=
+github.com/std-uritemplate/std-uritemplate/go/v2 v2.0.3/go.mod h1:Z5KcoM0YLC7INlNhEezeIZ0TZNYf7WSNO0Lvah4DSeQ=
+github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
+github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
+github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
+github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
+github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
+github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
+github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
+github.com/subosito/gotenv v1.6.0 h1:9NlTDc1FTs4qu0DDq7AEtTPNw6SVm7uBMsUCUjABIf8=
+github.com/subosito/gotenv v1.6.0/go.mod h1:Dk4QP5c2W3ibzajGcXpNraDfq2IrhjMIvMSWPKKo0FU=
+github.com/ubuntu/authd v0.5.8 h1:OMHWb4fZ6e9gg0d5Mxbb3fiOSK6XN3+LOOAYZt8mjjo=
+github.com/ubuntu/authd v0.5.8/go.mod h1:fAJiEdBA4iusBgaysolNVkOKVvv0qv45HQHxMfxVcnk=
+github.com/ubuntu/decorate v0.0.0-20240301153420-5015d6dbc8e5 h1:qO8m+4mLbo1HRpD5lfhEfr7R1PuqZvbAmjaRzYEy+tM=
+github.com/ubuntu/decorate v0.0.0-20240301153420-5015d6dbc8e5/go.mod h1:PUpwIgUuCQyuCz/gwiq6WYbo7IvtXXd8JqL01ez+jZE=
+github.com/ubuntu/go-i18n v0.0.0-20231113092927-594c1754ca47 h1:CA2dVorxvzdsGtszqhSjyvkrXxZi4bS52ZKvP0Ko634=
+github.com/ubuntu/go-i18n v0.0.0-20231113092927-594c1754ca47/go.mod h1:ZRhdDyx6YkKz/YiMWi0gS3uMCltgdaKz9IpkiNf/GRg=
+github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
+go.opentelemetry.io/auto/sdk v1.1.0 h1:cH53jehLUN6UFLY71z+NDOiNJqDdPRaXzTel0sJySYA=
+go.opentelemetry.io/auto/sdk v1.1.0/go.mod h1:3wSPjt5PWp2RhlCcmmOial7AvC4DQqZb7a7wCow3W8A=
+go.opentelemetry.io/otel v1.37.0 h1:9zhNfelUvx0KBfu/gb+ZgeAfAgtWrfHJZcAqFC228wQ=
+go.opentelemetry.io/otel v1.37.0/go.mod h1:ehE/umFRLnuLa/vSccNq9oS1ErUlkkK71gMcN34UG8I=
+go.opentelemetry.io/otel/metric v1.37.0 h1:mvwbQS5m0tbmqML4NqK+e3aDiO02vsf/WgbsdpcPoZE=
+go.opentelemetry.io/otel/metric v1.37.0/go.mod h1:04wGrZurHYKOc+RKeye86GwKiTb9FKm1WHtO+4EVr2E=
+go.opentelemetry.io/otel/trace v1.37.0 h1:HLdcFNbRQBE2imdSEgm/kwqmQj1Or1l/7bW6mxVK7z4=
+go.opentelemetry.io/otel/trace v1.37.0/go.mod h1:TlgrlQ+PtQO5XFerSPUYG0JSgGyryXewPGyayAWSBS0=
+go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
+go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
+golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
+golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
+golang.org/x/crypto v0.48.0 h1:/VRzVqiRSggnhY7gNRxPauEQ5Drw9haKdM0jqfcCFts=
+golang.org/x/crypto v0.48.0/go.mod h1:r0kV5h3qnFPlQnBSrULhlsRfryS2pmewsg+XfMgkVos=
+golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
+golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
+golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
+golang.org/x/net v0.49.0 h1:eeHFmOGUTtaaPSGNmjBKpbng9MulQsJURQUAfUwY++o=
+golang.org/x/net v0.49.0/go.mod h1:/ysNB2EvaqvesRkuLAyjI1ycPZlQHM3q01F02UY/MV8=
+golang.org/x/oauth2 v0.35.0 h1:Mv2mzuHuZuY2+bkyWXIHMfhNdJAdwW3FuWeCPYN5GVQ=
+golang.org/x/oauth2 v0.35.0/go.mod h1:lzm5WQJQwKZ3nwavOZ3IS5Aulzxi68dUSgRHujetwEA=
+golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.19.0 h1:vV+1eWNmZ5geRlYjzm2adRgW2/mcpevXNg50YZtPCE4=
+golang.org/x/sync v0.19.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
+golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.41.0 h1:Ivj+2Cp/ylzLiEU89QhWblYnOE9zerudt9Ftecq2C6k=
+golang.org/x/sys v0.41.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
+golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
+golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
+golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
+golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
+golang.org/x/text v0.3.8/go.mod h1:E6s5w1FMmriuDzIBO73fBruAKo1PCIq6d2Q6DHfQ8WQ=
+golang.org/x/text v0.34.0 h1:oL/Qq0Kdaqxa1KbNeMKwQq0reLCCaFtqu2eNuSeNHbk=
+golang.org/x/text v0.34.0/go.mod h1:homfLqTYRFyVYemLBFl5GgL/DWEiH5wcsQ5gSh1yziA=
+golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
+golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
+gopkg.in/ini.v1 v1.67.1 h1:tVBILHy0R6e4wkYOn3XmiITt/hEVH4TFMYvAX2Ytz6k=
+gopkg.in/ini.v1 v1.67.1/go.mod h1:x/cyOwCgZqOkJoDIJ3c1KNHMo10+nLGAhh+kn3Zizss=
+gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
+gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
diff --git a/authd-oidc-brokers/internal/broker/authmodes/consts.go b/authd-oidc-brokers/internal/broker/authmodes/consts.go
new file mode 100644
index 0000000000..366a9d2af5
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/authmodes/consts.go
@@ -0,0 +1,26 @@
+// Package authmodes lists the authentication modes that providers can support.
+package authmodes
+
+const (
+	// Password is the ID of the password authentication method.
+	Password = "password"
+
+	// Device is the ID of the device authentication method.
+	Device = "device_auth"
+
+	// DeviceQr is the ID of the device authentication method when QrCode rendering is enabled.
+	DeviceQr = "device_auth_qr"
+
+	// NewPassword is the ID of the new password configuration method.
+	NewPassword = "newpassword"
+)
+
+var (
+	// Label is a map of auth mode IDs to their display labels.
+	Label = map[string]string{
+		Password:    "Local Password Authentication",
+		Device:      "Device Authentication",
+		DeviceQr:    "Device Authentication",
+		NewPassword: "Define your local password",
+	}
+)
diff --git a/authd-oidc-brokers/internal/broker/authresponses.go b/authd-oidc-brokers/internal/broker/authresponses.go
new file mode 100644
index 0000000000..eae9c4b625
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/authresponses.go
@@ -0,0 +1,21 @@
+package broker
+
+import "github.com/canonical/authd/authd-oidc-brokers/internal/providers/info"
+
+type isAuthenticatedDataResponse interface {
+	isAuthenticatedDataResponse()
+}
+
+// userInfoMessage represents the user information message that is returned to authd.
+type userInfoMessage struct {
+	UserInfo info.User `json:"userinfo"`
+}
+
+func (userInfoMessage) isAuthenticatedDataResponse() {}
+
+// errorMessage represents the error message that is returned to authd.
+type errorMessage struct {
+	Message string `json:"message"`
+}
+
+func (errorMessage) isAuthenticatedDataResponse() {}
diff --git a/authd-oidc-brokers/internal/broker/broker.go b/authd-oidc-brokers/internal/broker/broker.go
new file mode 100644
index 0000000000..2dee4139b5
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/broker.go
@@ -0,0 +1,1140 @@
+// Package broker is the generic oidc business code.
+package broker
+
+import (
+	"context"
+	"crypto/rand"
+	"crypto/rsa"
+	"crypto/x509"
+	"encoding/base64"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"path/filepath"
+	"slices"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/canonical/authd/authd-oidc-brokers/internal/broker/authmodes"
+	"github.com/canonical/authd/authd-oidc-brokers/internal/broker/sessionmode"
+	"github.com/canonical/authd/authd-oidc-brokers/internal/consts"
+	"github.com/canonical/authd/authd-oidc-brokers/internal/fileutils"
+	"github.com/canonical/authd/authd-oidc-brokers/internal/password"
+	"github.com/canonical/authd/authd-oidc-brokers/internal/providers"
+	providerErrors "github.com/canonical/authd/authd-oidc-brokers/internal/providers/errors"
+	"github.com/canonical/authd/authd-oidc-brokers/internal/providers/info"
+	"github.com/canonical/authd/authd-oidc-brokers/internal/providers/msentraid/himmelblau"
+	"github.com/canonical/authd/authd-oidc-brokers/internal/token"
+	"github.com/coreos/go-oidc/v3/oidc"
+	"github.com/google/uuid"
+	"github.com/ubuntu/authd/log"
+	"github.com/ubuntu/decorate"
+	"golang.org/x/oauth2"
+)
+
+const (
+	maxAuthAttempts    = 3
+	maxRequestDuration = 5 * time.Second
+)
+
+// Config is the configuration for the broker.
+type Config struct {
+	ConfigFile string
+	DataDir    string
+
+	userConfig
+}
+
+// Broker is the real implementation of the broker to track sessions and process oidc calls.
+type Broker struct {
+	cfg Config
+
+	provider providers.Provider
+	oidcCfg  oidc.Config
+
+	currentSessions   map[string]session
+	currentSessionsMu sync.RWMutex
+
+	privateKey *rsa.PrivateKey
+}
+
+type session struct {
+	username string
+	lang     string
+	mode     string
+
+	selectedMode    string
+	authModes       []string
+	attemptsPerMode map[string]int
+	nextAuthModes   []string
+
+	oidcServer              *oidc.Provider
+	oauth2Config            oauth2.Config
+	isOffline               bool
+	providerConnectionError error
+	userDataDir             string
+	passwordPath            string
+	tokenPath               string
+
+	// Data to pass from one request to another.
+	deviceAuthResponse *oauth2.DeviceAuthResponse
+	authInfo           *token.AuthCachedInfo
+
+	isAuthenticating *isAuthenticatedCtx
+}
+
+type isAuthenticatedCtx struct {
+	ctx        context.Context
+	cancelFunc context.CancelFunc
+}
+
+type option struct {
+	provider providers.Provider
+}
+
+// Option is a func that allows to override some of the broker default settings.
+type Option func(*option)
+
+// New returns a new oidc Broker with the providers listed in the configuration file.
+func New(cfg Config, args ...Option) (b *Broker, err error) {
+	p := providers.CurrentProvider()
+
+	if cfg.ConfigFile != "" {
+		cfg.userConfig, err = parseConfigFromPath(cfg.ConfigFile, p)
+		if err != nil {
+			return nil, fmt.Errorf("could not parse config file '%s': %v", cfg.ConfigFile, err)
+		}
+	}
+
+	opts := option{
+		provider: p,
+	}
+	for _, arg := range args {
+		arg(&opts)
+	}
+
+	if cfg.DataDir == "" {
+		err = errors.Join(err, errors.New("cache path is required and was not provided"))
+	}
+	if cfg.issuerURL == "" {
+		err = errors.Join(err, errors.New("issuer URL is required and was not provided"))
+	}
+	if cfg.clientID == "" {
+		err = errors.Join(err, errors.New("client ID is required and was not provided"))
+	}
+	if err != nil {
+		return nil, err
+	}
+
+	if cfg.homeBaseDir == "" {
+		cfg.homeBaseDir = "/home"
+	}
+
+	// Generate a new private key for the broker.
+	privateKey, err := rsa.GenerateKey(rand.Reader, 2048)
+	if err != nil {
+		log.Error(context.Background(), err.Error())
+		return nil, errors.New("failed to generate broker private key")
+	}
+
+	clientID := cfg.clientID
+	if opts.provider.SupportsDeviceRegistration() && cfg.registerDevice {
+		clientID = consts.MicrosoftBrokerAppID
+	}
+
+	b = &Broker{
+		cfg:        cfg,
+		provider:   opts.provider,
+		oidcCfg:    oidc.Config{ClientID: clientID},
+		privateKey: privateKey,
+
+		currentSessions:   make(map[string]session),
+		currentSessionsMu: sync.RWMutex{},
+	}
+	return b, nil
+}
+
+// NewSession creates a new session for the user.
+func (b *Broker) NewSession(username, lang, mode string) (sessionID, encryptionKey string, err error) {
+	defer decorate.OnError(&err, "could not create new session for user %q", username)
+
+	sessionID = uuid.New().String()
+	s := session{
+		username: username,
+		lang:     lang,
+		mode:     mode,
+
+		attemptsPerMode: make(map[string]int),
+	}
+
+	pubASN1, err := x509.MarshalPKIXPublicKey(&b.privateKey.PublicKey)
+	if err != nil {
+		return "", "", err
+	}
+
+	_, issuer, _ := strings.Cut(b.cfg.issuerURL, "://")
+	issuer = strings.ReplaceAll(issuer, "/", "_")
+	issuer = strings.ReplaceAll(issuer, ":", "_")
+	s.userDataDir = filepath.Join(b.cfg.DataDir, issuer, username)
+	// The token is stored in $DATA_DIR/$ISSUER/$USERNAME/token.json.
+	s.tokenPath = filepath.Join(s.userDataDir, "token.json")
+	// The password is stored in $DATA_DIR/$ISSUER/$USERNAME/password.
+	s.passwordPath = filepath.Join(s.userDataDir, "password")
+
+	// Construct an OIDC provider via OIDC discovery.
+	s.oidcServer, err = b.connectToOIDCServer(context.Background())
+	if err != nil {
+		log.Noticef(context.Background(), "Could not connect to the provider: %v. Starting session in offline mode.", err)
+		s.isOffline = true
+		s.providerConnectionError = err
+	}
+
+	scopes := append(consts.DefaultScopes, b.provider.AdditionalScopes()...)
+	if b.provider.SupportsDeviceRegistration() && b.cfg.registerDevice {
+		scopes = consts.MicrosoftBrokerAppScopes
+	}
+	// Append extra scopes from config
+	scopes = append(scopes, b.cfg.extraScopes...)
+
+	if s.oidcServer != nil {
+		s.oauth2Config = oauth2.Config{
+			ClientID:     b.oidcCfg.ClientID,
+			ClientSecret: b.cfg.clientSecret,
+			Endpoint:     s.oidcServer.Endpoint(),
+			Scopes:       scopes,
+		}
+	}
+
+	b.currentSessionsMu.Lock()
+	b.currentSessions[sessionID] = s
+	b.currentSessionsMu.Unlock()
+
+	return sessionID, base64.StdEncoding.EncodeToString(pubASN1), nil
+}
+
+func (b *Broker) connectToOIDCServer(ctx context.Context) (*oidc.Provider, error) {
+	ctx, cancel := context.WithTimeout(ctx, maxRequestDuration)
+	defer cancel()
+
+	return oidc.NewProvider(ctx, b.cfg.issuerURL)
+}
+
+// GetAuthenticationModes returns the authentication modes available for the user.
+func (b *Broker) GetAuthenticationModes(sessionID string, supportedUILayouts []map[string]string) (authModesWithLabels []map[string]string, err error) {
+	session, err := b.getSession(sessionID)
+	if err != nil {
+		return nil, err
+	}
+
+	availableModes, err := b.availableAuthModes(session)
+	if err != nil {
+		return nil, err
+	}
+
+	// Store the available auth modes, so that we can check in SelectAuthenticationMode if the selected mode is valid.
+	session.authModes = availableModes
+	if err := b.updateSession(sessionID, session); err != nil {
+		return nil, err
+	}
+
+	modesSupportedByUI := b.authModesSupportedByUI(supportedUILayouts)
+
+	for _, mode := range availableModes {
+		if !slices.Contains(modesSupportedByUI, mode) {
+			continue
+		}
+
+		authModesWithLabels = append(authModesWithLabels, map[string]string{
+			"id":    mode,
+			"label": authmodes.Label[mode],
+		})
+	}
+
+	if len(authModesWithLabels) == 0 {
+		// If we can't use a local authentication mode and we failed to connect to the provider,
+		// report the connection error.
+		if session.providerConnectionError != nil {
+			log.Errorf(context.Background(), "Error connecting to provider: %v", session.providerConnectionError)
+			//nolint:staticcheck,revive // ST1005 This error is displayed as is to the user, so it should be capitalized
+			return nil, errors.New("Error connecting to provider. Check your network connection.")
+		}
+		return nil, fmt.Errorf("no authentication modes available for user %q", session.username)
+	}
+
+	return authModesWithLabels, nil
+}
+
+func (b *Broker) availableAuthModes(session session) (availableModes []string, err error) {
+	if len(session.nextAuthModes) > 0 {
+		for _, mode := range session.nextAuthModes {
+			if !b.authModeIsAvailable(session, mode) {
+				continue
+			}
+			availableModes = append(availableModes, mode)
+		}
+		if availableModes == nil {
+			log.Warningf(context.Background(), "None of the next auth modes are available: %v", session.nextAuthModes)
+		}
+		return availableModes, nil
+	}
+
+	switch session.mode {
+	case sessionmode.ChangePassword, sessionmode.ChangePasswordOld:
+		// Session is for changing the password.
+		if !passwordFileExists(session) {
+			return nil, errors.New("password file does not exist, cannot change password")
+		}
+		return []string{authmodes.Password}, nil
+
+	default:
+		// Session is for login. Check which auth modes are available.
+		// The order of the modes is important, because authd picks the first supported one.
+		// Password authentication should be the first option if available, to avoid performing device authentication
+		// when it's not necessary.
+		modes := append([]string{authmodes.Password}, b.provider.SupportedOIDCAuthModes()...)
+		for _, mode := range modes {
+			if b.authModeIsAvailable(session, mode) {
+				availableModes = append(availableModes, mode)
+			}
+		}
+		return availableModes, nil
+	}
+}
+
+func (b *Broker) authModeIsAvailable(session session, authMode string) bool {
+	switch authMode {
+	case authmodes.Password:
+		if !tokenExists(session) {
+			log.Debugf(context.Background(), "Token does not exist for user %q, so local password authentication is not available", session.username)
+			return false
+		}
+
+		if !passwordFileExists(session) {
+			log.Debugf(context.Background(), "Password file does not exist for user %q, so local password authentication is not available", session.username)
+			return false
+		}
+
+		authInfo, err := token.LoadAuthInfo(session.tokenPath)
+		if err != nil {
+			log.Warningf(context.Background(), "Could not load token, so local password authentication is not available: %v", err)
+			return false
+		}
+
+		if !b.provider.SupportsDeviceRegistration() {
+			// If the provider does not support device registration,
+			// we can always use the token for local password authentication.
+			log.Debugf(context.Background(), "Provider does not support device registration, so local password authentication is available for user %q", session.username)
+			return true
+		}
+
+		if session.isOffline {
+			// If the session is in offline mode, we can't register the device anyway,
+			// so we can allow the user to use local password authentication.
+			log.Debugf(context.Background(), "Session is in offline mode, so local password authentication is available for user %q", session.username)
+			return true
+		}
+
+		isTokenForDeviceRegistration, err := b.provider.IsTokenForDeviceRegistration(authInfo.Token)
+		if err != nil {
+			log.Warningf(context.Background(), "Could not check if token is for device registration, so local password authentication is not available: %v", err)
+			return false
+		}
+
+		if b.cfg.registerDevice && !isTokenForDeviceRegistration {
+			// TODO: We might want to display a message to the user in this case
+			log.Noticef(context.Background(), "Token exists for user %q, but it cannot be used for device registration, so local password authentication is not available", session.username)
+			return false
+		}
+		if !b.cfg.registerDevice && isTokenForDeviceRegistration {
+			// TODO: We might want to display a message to the user in this case
+			log.Noticef(context.Background(), "Token exists for user %q, but it requires device registration, so local password authentication is not available", session.username)
+			return false
+		}
+
+		return true
+	case authmodes.NewPassword:
+		return true
+	case authmodes.Device, authmodes.DeviceQr:
+		if session.oidcServer == nil {
+			log.Debugf(context.Background(), "OIDC server is not initialized, so device authentication is not available")
+			return false
+		}
+		if session.oidcServer.Endpoint().DeviceAuthURL == "" {
+			log.Debugf(context.Background(), "OIDC server does not support device authentication, so device authentication is not available")
+			return false
+		}
+		if session.isOffline {
+			log.Noticef(context.Background(), "Session is in offline mode, so device authentication is not available")
+			return false
+		}
+		return true
+	}
+	return false
+}
+
+func tokenExists(session session) bool {
+	exists, err := fileutils.FileExists(session.tokenPath)
+	if err != nil {
+		log.Warningf(context.Background(), "Could not check if token exists: %v", err)
+	}
+	return exists
+}
+
+func passwordFileExists(session session) bool {
+	exists, err := fileutils.FileExists(session.passwordPath)
+	if err != nil {
+		log.Warningf(context.Background(), "Could not check if local password file exists: %v", err)
+	}
+	return exists
+}
+
+func (b *Broker) authModesSupportedByUI(supportedUILayouts []map[string]string) (supportedModes []string) {
+	for _, layout := range supportedUILayouts {
+		mode := b.supportedAuthModeFromLayout(layout)
+		if mode != "" {
+			supportedModes = append(supportedModes, mode)
+		}
+	}
+	return supportedModes
+}
+
+func (b *Broker) supportedAuthModeFromLayout(layout map[string]string) string {
+	supportedEntries := strings.Split(strings.TrimPrefix(layout["entry"], "optional:"), ",")
+	switch layout["type"] {
+	case "qrcode":
+		if !strings.Contains(layout["wait"], "true") {
+			return ""
+		}
+		if layout["renders_qrcode"] == "false" {
+			return authmodes.Device
+		}
+		return authmodes.DeviceQr
+
+	case "form":
+		if slices.Contains(supportedEntries, "chars_password") {
+			return authmodes.Password
+		}
+
+	case "newpassword":
+		if slices.Contains(supportedEntries, "chars_password") {
+			return authmodes.NewPassword
+		}
+	}
+	return ""
+}
+
+// SelectAuthenticationMode selects the authentication mode for the user.
+func (b *Broker) SelectAuthenticationMode(sessionID, authModeID string) (uiLayoutInfo map[string]string, err error) {
+	session, err := b.getSession(sessionID)
+	if err != nil {
+		return nil, err
+	}
+
+	// populate UI options based on selected authentication mode
+	uiLayoutInfo, err = b.generateUILayout(&session, authModeID)
+	if err != nil {
+		return nil, err
+	}
+
+	// Store selected mode
+	session.selectedMode = authModeID
+
+	if err = b.updateSession(sessionID, session); err != nil {
+		return nil, err
+	}
+
+	return uiLayoutInfo, nil
+}
+
+func (b *Broker) generateUILayout(session *session, authModeID string) (map[string]string, error) {
+	if !slices.Contains(session.authModes, authModeID) {
+		return nil, fmt.Errorf("selected authentication mode %q does not exist", authModeID)
+	}
+
+	var uiLayout map[string]string
+	switch authModeID {
+	case authmodes.Device, authmodes.DeviceQr:
+		ctx, cancel := context.WithTimeout(context.Background(), maxRequestDuration)
+		defer cancel()
+
+		var authOpts []oauth2.AuthCodeOption
+
+		// Workaround to cater for RFC compliant oauth2 server. Public providers do not properly
+		// implement the RFC, (probably) because they assume that device clients are public.
+		// As described in https://datatracker.ietf.org/doc/html/rfc8628#section-3.1
+		// device authentication requests must provide client authentication, similar to that for
+		// the token endpoint.
+		// The golang/oauth2 library does not implement this, see https://github.com/golang/oauth2/issues/685.
+		// We implement a workaround for implementing the client_secret_post client authn method.
+		// Supporting client_secret_basic would require us to patch the http client used by the
+		// oauth2 lib.
+		// Some providers support both of these authentication methods, some implement only one and
+		// some implement neither.
+		// This was tested with the following providers:
+		// - Ory Hydra: supports client_secret_post
+		// TODO @shipperizer: client_authentication methods should be configurable
+		if secret := session.oauth2Config.ClientSecret; secret != "" {
+			authOpts = append(authOpts, oauth2.SetAuthURLParam("client_secret", secret))
+		}
+
+		log.Debug(ctx, "Sending Device Authorization Request to retrieve device code...")
+		response, err := session.oauth2Config.DeviceAuth(ctx, authOpts...)
+		if err != nil {
+			return nil, fmt.Errorf("could not generate Device Authentication code layout: %v", err)
+		}
+		log.Debugf(ctx, "Retrieved device code. Device Authorization Response: %#v", response)
+		session.deviceAuthResponse = response
+
+		label := "Open the URL and enter the code below."
+		if authModeID == authmodes.DeviceQr {
+			label = "Scan the QR code or open the URL and enter the code below."
+		}
+
+		uiLayout = map[string]string{
+			"type":    "qrcode",
+			"label":   label,
+			"wait":    "true",
+			"button":  "Request new code",
+			"content": response.VerificationURI,
+			"code":    response.UserCode,
+		}
+
+	case authmodes.Password:
+		uiLayout = map[string]string{
+			"type":  "form",
+			"label": "Enter your local password",
+			"entry": "chars_password",
+		}
+
+	case authmodes.NewPassword:
+		label := "Create a local password"
+		if session.mode == sessionmode.ChangePassword || session.mode == sessionmode.ChangePasswordOld {
+			label = "Update your local password"
+		}
+
+		uiLayout = map[string]string{
+			"type":  "newpassword",
+			"label": label,
+			"entry": "chars_password",
+		}
+	}
+
+	return uiLayout, nil
+}
+
+// IsAuthenticated evaluates the provided authenticationData and returns the authentication status for the user.
+func (b *Broker) IsAuthenticated(sessionID, authenticationData string) (string, string, error) {
+	session, err := b.getSession(sessionID)
+	if err != nil {
+		return AuthDenied, "{}", err
+	}
+
+	var authData map[string]string
+	if authenticationData != "" {
+		if err := json.Unmarshal([]byte(authenticationData), &authData); err != nil {
+			return AuthDenied, "{}", fmt.Errorf("authentication data is not a valid json value: %v", err)
+		}
+	}
+
+	ctx, err := b.startAuthenticate(sessionID)
+	if err != nil {
+		return AuthDenied, "{}", err
+	}
+
+	// Cleans up the IsAuthenticated context when the call is done.
+	defer b.CancelIsAuthenticated(sessionID)
+
+	authDone := make(chan struct{})
+	var access string
+	var iadResponse isAuthenticatedDataResponse
+	go func() {
+		access, iadResponse = b.handleIsAuthenticated(ctx, &session, authData)
+		close(authDone)
+	}()
+
+	select {
+	case <-authDone:
+	case <-ctx.Done():
+		// We can ignore the error here since the message is constant.
+		msg, _ := json.Marshal(errorMessage{Message: "Authentication request cancelled"})
+		return AuthCancelled, string(msg), ctx.Err()
+	}
+
+	if access == AuthRetry {
+		session.attemptsPerMode[session.selectedMode]++
+		if session.attemptsPerMode[session.selectedMode] == maxAuthAttempts {
+			access = AuthDenied
+			iadResponse = errorMessage{Message: "Maximum number of authentication attempts reached"}
+		}
+	}
+
+	if err = b.updateSession(sessionID, session); err != nil {
+		return AuthDenied, "{}", err
+	}
+
+	encoded, err := json.Marshal(iadResponse)
+	if err != nil {
+		return AuthDenied, "{}", fmt.Errorf("could not parse data to JSON: %v", err)
+	}
+
+	data := string(encoded)
+	if data == "null" {
+		data = "{}"
+	}
+	return access, data, nil
+}
+
+func unexpectedErrMsg(msg string) errorMessage {
+	return errorMessage{Message: fmt.Sprintf("An unexpected error occurred: %s. Please report this error on https://github.com/canonical/authd/issues", msg)}
+}
+
+func (b *Broker) handleIsAuthenticated(ctx context.Context, session *session, authData map[string]string) (access string, data isAuthenticatedDataResponse) {
+	rawSecret, ok := authData[AuthDataSecret]
+	if !ok {
+		rawSecret = authData[AuthDataSecretOld]
+	}
+
+	// Decrypt secret if present.
+	secret, err := decodeRawSecret(b.privateKey, rawSecret)
+	if err != nil {
+		log.Errorf(context.Background(), "could not decode secret: %s", err)
+		return AuthRetry, unexpectedErrMsg("could not decode secret")
+	}
+
+	switch session.selectedMode {
+	case authmodes.Device, authmodes.DeviceQr:
+		return b.deviceAuth(ctx, session)
+	case authmodes.Password:
+		return b.passwordAuth(ctx, session, secret)
+	case authmodes.NewPassword:
+		return b.newPassword(session, secret)
+	default:
+		log.Errorf(context.Background(), "unknown authentication mode %q", session.selectedMode)
+		return AuthDenied, unexpectedErrMsg("unknown authentication mode")
+	}
+}
+
+func (b *Broker) deviceAuth(ctx context.Context, session *session) (string, isAuthenticatedDataResponse) {
+	response := session.deviceAuthResponse
+	if response == nil {
+		log.Error(context.Background(), "device auth response is not set")
+		return AuthDenied, unexpectedErrMsg("device auth response is not set")
+	}
+
+	if response.Expiry.IsZero() {
+		response.Expiry = time.Now().Add(time.Hour)
+		log.Debugf(context.Background(), "Device code does not have an expiry time, using default of %s", response.Expiry)
+	} else {
+		log.Debugf(context.Background(), "Device code expiry time: %s", response.Expiry)
+	}
+	expiryCtx, cancel := context.WithDeadline(ctx, response.Expiry)
+	defer cancel()
+
+	// The default interval is 5 seconds, which means the user has to wait up to 5 seconds after
+	// successful authentication. We're reducing the interval to 1 second to improve UX a bit.
+	response.Interval = 1
+
+	log.Debug(ctx, "Polling to exchange device code for token...")
+	t, err := session.oauth2Config.DeviceAccessToken(expiryCtx, response, b.provider.AuthOptions()...)
+	if err != nil {
+		log.Errorf(context.Background(), "Error retrieving access token: %s", err)
+		return AuthRetry, errorMessage{Message: "Error retrieving access token. Please try again."}
+	}
+	log.Debug(ctx, "Exchanged device code for token.")
+
+	if t.RefreshToken == "" {
+		log.Warningf(context.Background(), "No refresh token returned for user during device authentication. You might have to add the 'offline_access' scope to the 'extra_scopes' setting.")
+	}
+
+	rawIDToken, ok := t.Extra("id_token").(string)
+	if !ok {
+		log.Error(context.Background(), "token response does not contain an ID token")
+		return AuthDenied, unexpectedErrMsg("token response does not contain an ID token")
+	}
+
+	authInfo := token.NewAuthCachedInfo(t, rawIDToken, b.provider)
+
+	authInfo.ProviderMetadata, err = b.provider.GetMetadata(session.oidcServer)
+	if err != nil {
+		log.Errorf(context.Background(), "could not get provider metadata: %s", err)
+		return AuthDenied, unexpectedErrMsg("could not get provider metadata")
+	}
+
+	authInfo.UserInfo, err = b.userInfoFromIDToken(ctx, session, rawIDToken)
+	if err != nil {
+		log.Errorf(context.Background(), "could not get user info: %s", err)
+		return AuthDenied, errorMessageForDisplay(err, "Could not get user info")
+	}
+
+	if !b.userNameIsAllowed(authInfo.UserInfo.Name) {
+		log.Warning(context.Background(), b.userNotAllowedLogMsg(authInfo.UserInfo.Name))
+		return AuthDenied, errorMessage{Message: "Authentication failure: user not allowed in broker configuration"}
+	}
+
+	if b.provider.SupportsDeviceRegistration() && b.cfg.registerDevice {
+		// Load existing device registration data if there is any, to avoid re-registering the device.
+		var deviceRegistrationData []byte
+		oldAuthInfo, err := token.LoadAuthInfo(session.tokenPath)
+		if err == nil {
+			deviceRegistrationData = oldAuthInfo.DeviceRegistrationData
+		}
+
+		var cleanup func()
+		authInfo.DeviceRegistrationData, cleanup, err = b.provider.MaybeRegisterDevice(ctx, t,
+			session.username,
+			b.cfg.issuerURL,
+			deviceRegistrationData,
+		)
+		if err != nil {
+			log.Errorf(context.Background(), "error registering device: %s", err)
+			return AuthDenied, errorMessage{Message: "Error registering device"}
+		}
+		defer cleanup()
+
+		// Store the auth info, so that the device registration data is not lost if the login fails after this point.
+		if err := token.CacheAuthInfo(session.tokenPath, authInfo); err != nil {
+			log.Errorf(context.Background(), "Failed to store token: %s", err)
+			return AuthDenied, unexpectedErrMsg("failed to store token")
+		}
+	}
+
+	// We can only fetch the groups after registering the device, because the token acquired for device registration
+	// cannot be used with the Microsoft Graph API and a new token must be acquired for the Graph API.
+	authInfo.UserInfo.Groups, err = b.getGroups(ctx, session, authInfo)
+	if err != nil {
+		log.Errorf(context.Background(), "failed to get groups: %s", err)
+		return AuthDenied, errorMessageForDisplay(err, "Failed to retrieve groups from Microsoft Graph API")
+	}
+
+	// Store the auth info in the session so that we can use it when handling the
+	// next IsAuthenticated call for the new password mode.
+	session.authInfo = authInfo
+	session.nextAuthModes = []string{authmodes.NewPassword}
+
+	return AuthNext, nil
+}
+
+func (b *Broker) passwordAuth(ctx context.Context, session *session, secret string) (string, isAuthenticatedDataResponse) {
+	ok, err := password.CheckPassword(secret, session.passwordPath)
+	if err != nil {
+		log.Error(context.Background(), err.Error())
+		return AuthDenied, unexpectedErrMsg("could not check password")
+	}
+	if !ok {
+		log.Noticef(context.Background(), "Authentication failure: incorrect local password for user %q", session.username)
+		return AuthRetry, errorMessage{Message: "Incorrect password, please try again."}
+	}
+
+	authInfo, err := token.LoadAuthInfo(session.tokenPath)
+	if err != nil {
+		log.Error(context.Background(), err.Error())
+		return AuthDenied, unexpectedErrMsg("could not load stored token")
+	}
+
+	// If the session is for changing the password, we don't need to refresh the token and user info (and we don't
+	// want the method call to return an error if refreshing the token or user info fails).
+	if session.mode == sessionmode.ChangePassword || session.mode == sessionmode.ChangePasswordOld {
+		// Store the auth info in the session so that we can use it when handling the
+		// next IsAuthenticated call for the new password mode.
+		session.authInfo = authInfo
+		session.nextAuthModes = []string{authmodes.NewPassword}
+		return AuthNext, nil
+	}
+
+	if b.cfg.forceProviderAuthentication && session.isOffline {
+		log.Error(context.Background(), "Remote authentication failed: force_provider_authentication is enabled, but the identity provider is not reachable")
+		return AuthDenied, errorMessage{Message: "Remote authentication failed: identity provider is not reachable"}
+	}
+
+	if authInfo.UserIsDisabled && session.isOffline {
+		log.Errorf(context.Background(), "Login denied: user %q is disabled in Microsoft Entra ID and session is offline", session.username)
+		return AuthDenied, errorMessage{Message: "This user is disabled in Microsoft Entra ID. Please contact your administrator or try again with a working network connection."}
+	}
+
+	if authInfo.DeviceIsDisabled && session.isOffline {
+		log.Errorf(context.Background(), "Login denied: device %q is disabled in Microsoft Entra ID and session is offline", session.username)
+		return AuthDenied, errorMessage{Message: "This device is disabled in Microsoft Entra ID. Please contact your administrator or try again with a working network connection."}
+	}
+
+	// Refresh the token if we're online even if the token has not expired
+	if b.cfg.forceProviderAuthentication || !session.isOffline {
+		// Check if we have a refresh token before attempting to refresh
+		if authInfo.Token.RefreshToken == "" {
+			log.Warningf(context.Background(), "No refresh token available for user %q", session.username)
+			session.nextAuthModes = []string{authmodes.Device, authmodes.DeviceQr}
+			return AuthNext, errorMessage{Message: "Remote authentication failed: No refresh token. Please contact your administrator."}
+		}
+
+		// We have a refresh token, attempt to refresh
+		oldAuthInfo := authInfo
+		authInfo, err = b.refreshToken(ctx, session, authInfo)
+		var retrieveErr *oauth2.RetrieveError
+		if errors.As(err, &retrieveErr) {
+			if b.provider.IsTokenExpiredError(retrieveErr) {
+				log.Noticef(context.Background(), "Refresh token expired for user %q, new device authentication required", session.username)
+				session.nextAuthModes = []string{authmodes.Device, authmodes.DeviceQr}
+				return AuthNext, errorMessage{Message: "Refresh token expired, please authenticate again using device authentication."}
+			}
+			if b.provider.IsUserDisabledError(retrieveErr) {
+				log.Error(context.Background(), retrieveErr.Error())
+				log.Errorf(context.Background(), "Login failed: User %q is disabled in Microsoft Entra ID, please contact your administrator.", session.username)
+
+				// Store the information that the user is disabled, so that we can deny login on subsequent offline attempts.
+				oldAuthInfo.UserIsDisabled = true
+				if err = token.CacheAuthInfo(session.tokenPath, oldAuthInfo); err != nil {
+					log.Errorf(context.Background(), "Failed to store token: %s", err)
+					return AuthDenied, unexpectedErrMsg("failed to store token")
+				}
+
+				return AuthDenied, errorMessage{Message: "This user is disabled in Microsoft Entra ID, please contact your administrator."}
+			}
+		}
+		if err != nil {
+			log.Errorf(context.Background(), "Failed to refresh token: %s", err)
+			return AuthDenied, errorMessage{Message: "Failed to refresh token"}
+		}
+	}
+
+	// If device registration is enabled, ensure that the device is registered.
+	if b.provider.SupportsDeviceRegistration() && !session.isOffline && b.cfg.registerDevice {
+		var cleanup func()
+		authInfo.DeviceRegistrationData, cleanup, err = b.provider.MaybeRegisterDevice(ctx,
+			authInfo.Token,
+			session.username,
+			b.cfg.issuerURL,
+			authInfo.DeviceRegistrationData,
+		)
+		if err != nil {
+			log.Errorf(context.Background(), "error registering device: %s", err)
+			return AuthDenied, errorMessage{Message: "Error registering device"}
+		}
+		defer cleanup()
+
+		// Store the auth info, so that the device registration data is not lost if the login fails after this point.
+		if err := token.CacheAuthInfo(session.tokenPath, authInfo); err != nil {
+			log.Errorf(context.Background(), "Failed to store token: %s", err)
+			return AuthDenied, unexpectedErrMsg("failed to store token")
+		}
+	}
+
+	// Try to refresh the groups
+	groups, err := b.getGroups(ctx, session, authInfo)
+	if errors.Is(err, himmelblau.ErrDeviceDisabled) {
+		// The device is disabled, deny login
+		log.Errorf(context.Background(), "Login failed: %s", err)
+
+		// Store the information that the device is disabled, so that we can deny login on subsequent offline attempts.
+		authInfo.DeviceIsDisabled = true
+		if err = token.CacheAuthInfo(session.tokenPath, authInfo); err != nil {
+			log.Errorf(context.Background(), "Failed to store token: %s", err)
+			return AuthDenied, unexpectedErrMsg("failed to store token")
+		}
+
+		return AuthDenied, errorMessage{Message: "This device is disabled in Microsoft Entra ID, please contact your administrator."}
+	}
+	if errors.Is(err, himmelblau.ErrInvalidRedirectURI) {
+		// Deny login if the redirect URI is invalid, so that users and administrators are aware of the issue.
+		log.Errorf(context.Background(), "Login failed: %s", err)
+		return AuthDenied, errorMessageForDisplay(err, "Invalid redirect URI")
+	}
+	var tokenAcquisitionError himmelblau.TokenAcquisitionError
+	if errors.As(err, &tokenAcquisitionError) {
+		log.Errorf(context.Background(), "Token acquisition failed: %s. Try again using device authentication.", err)
+		// The token acquisition failed unexpectedly.
+		// One possible reason is that the device was deleted by an administrator in Entra ID.
+		// In this case, the user can perform device authentication again to get a new token
+		// and register the device again, allowing the user to log in.
+		// We delete the device registration data to cause device authentication to re-register the device.
+		authInfo.DeviceRegistrationData = nil
+		if err = token.CacheAuthInfo(session.tokenPath, authInfo); err != nil {
+			log.Errorf(context.Background(), "Failed to store token: %s", err)
+			return AuthDenied, unexpectedErrMsg("failed to store token")
+		}
+
+		session.nextAuthModes = []string{authmodes.Device, authmodes.DeviceQr}
+		msg := "Authentication failed due to a token issue. Please try again using device authentication."
+		return AuthNext, errorMessage{Message: msg}
+	}
+	if err != nil {
+		// We couldn't fetch the groups, but we have valid cached ones.
+		log.Warningf(context.Background(), "Could not get groups: %v. Using cached groups.", err)
+	} else {
+		authInfo.UserInfo.Groups = groups
+	}
+
+	return b.finishAuth(session, authInfo)
+}
+
+func (b *Broker) finishAuth(session *session, authInfo *token.AuthCachedInfo) (string, isAuthenticatedDataResponse) {
+	if b.cfg.shouldRegisterOwner() {
+		if err := b.cfg.registerOwner(b.cfg.ConfigFile, authInfo.UserInfo.Name); err != nil {
+			// The user is not allowed if we fail to create the owner-autoregistration file.
+			// Otherwise the owner might change if the broker is restarted.
+			log.Errorf(context.Background(), "Failed to assign the owner role: %v", err)
+			return AuthDenied, unexpectedErrMsg("failed to assign the owner role")
+		}
+	}
+
+	if !b.userNameIsAllowed(authInfo.UserInfo.Name) {
+		log.Warning(context.Background(), b.userNotAllowedLogMsg(authInfo.UserInfo.Name))
+		return AuthDenied, errorMessage{Message: "Authentication failure: user not allowed in broker configuration"}
+	}
+
+	// Add extra groups to the user info.
+	for _, name := range b.cfg.extraGroups {
+		log.Debugf(context.Background(), "Adding extra group %q", name)
+		authInfo.UserInfo.Groups = append(authInfo.UserInfo.Groups, info.Group{Name: name})
+	}
+
+	if b.isOwner(authInfo.UserInfo.Name) {
+		// Add the owner extra groups to the user info.
+		for _, name := range b.cfg.ownerExtraGroups {
+			log.Debugf(context.Background(), "Adding owner extra group %q", name)
+			authInfo.UserInfo.Groups = append(authInfo.UserInfo.Groups, info.Group{Name: name})
+		}
+	}
+
+	if session.isOffline {
+		return AuthGranted, userInfoMessage{UserInfo: authInfo.UserInfo}
+	}
+
+	if err := token.CacheAuthInfo(session.tokenPath, authInfo); err != nil {
+		log.Errorf(context.Background(), "Failed to store token: %s", err)
+		return AuthDenied, unexpectedErrMsg("failed to store token")
+	}
+
+	return AuthGranted, userInfoMessage{UserInfo: authInfo.UserInfo}
+}
+
+func (b *Broker) newPassword(session *session, secret string) (string, isAuthenticatedDataResponse) {
+	if secret == "" {
+		return AuthRetry, unexpectedErrMsg("empty secret")
+	}
+
+	// This mode must always come after an authentication mode, so we should have auth info from the previous mode
+	// stored in the session.
+	authInfo := session.authInfo
+	if authInfo == nil {
+		log.Error(context.Background(), "auth info is not set")
+		return AuthDenied, unexpectedErrMsg("auth info is not set")
+	}
+
+	if err := password.HashAndStorePassword(secret, session.passwordPath); err != nil {
+		log.Errorf(context.Background(), "Failed to store password: %s", err)
+		return AuthDenied, unexpectedErrMsg("failed to store password")
+	}
+
+	return b.finishAuth(session, authInfo)
+}
+
+// userNameIsAllowed checks whether the user's username is allowed to access the machine.
+func (b *Broker) userNameIsAllowed(userName string) bool {
+	return b.cfg.userNameIsAllowed(b.provider.NormalizeUsername(userName))
+}
+
+// isOwner returns true if the user is the owner of the machine.
+func (b *Broker) isOwner(userName string) bool {
+	return b.cfg.owner == b.provider.NormalizeUsername(userName)
+}
+
+func (b *Broker) userNotAllowedLogMsg(userName string) string {
+	logMsg := fmt.Sprintf("User %q is not in the list of allowed users.", userName)
+	logMsg += fmt.Sprintf("\nYou can add the user to allowed_users in %s", b.cfg.ConfigFile)
+	return logMsg
+}
+
+func (b *Broker) startAuthenticate(sessionID string) (context.Context, error) {
+	session, err := b.getSession(sessionID)
+	if err != nil {
+		return nil, err
+	}
+
+	if session.isAuthenticating != nil {
+		log.Errorf(context.Background(), "Authentication already running for session %q", sessionID)
+		return nil, errors.New("authentication already running for this user session")
+	}
+
+	ctx, cancel := context.WithCancel(context.Background())
+	session.isAuthenticating = &isAuthenticatedCtx{ctx: ctx, cancelFunc: cancel}
+
+	if err := b.updateSession(sessionID, session); err != nil {
+		cancel()
+		return nil, err
+	}
+
+	return ctx, nil
+}
+
+// EndSession ends the session for the user.
+func (b *Broker) EndSession(sessionID string) error {
+	session, err := b.getSession(sessionID)
+	if err != nil {
+		return err
+	}
+
+	// Checks if there is a isAuthenticated call running for this session and cancels it before ending the session.
+	if session.isAuthenticating != nil {
+		b.CancelIsAuthenticated(sessionID)
+	}
+
+	b.currentSessionsMu.Lock()
+	defer b.currentSessionsMu.Unlock()
+	delete(b.currentSessions, sessionID)
+	return nil
+}
+
+// CancelIsAuthenticated cancels the IsAuthenticated call for the user.
+func (b *Broker) CancelIsAuthenticated(sessionID string) {
+	session, err := b.getSession(sessionID)
+	if err != nil {
+		return
+	}
+
+	if session.isAuthenticating == nil {
+		return
+	}
+
+	session.isAuthenticating.cancelFunc()
+	session.isAuthenticating = nil
+
+	if err := b.updateSession(sessionID, session); err != nil {
+		log.Errorf(context.Background(), "Error when cancelling IsAuthenticated: %v", err)
+	}
+}
+
+// UserPreCheck checks if the user is valid and can be allowed to authenticate.
+// It returns the user info in JSON format if the user is valid, or an empty string if the user is not allowed.
+func (b *Broker) UserPreCheck(username string) (string, error) {
+	found := false
+	for _, suffix := range b.cfg.allowedSSHSuffixes {
+		if suffix == "" {
+			continue
+		}
+
+		// If suffix is only "*", TrimPrefix will return the empty string and that works for the 'match all' case also.
+		suffix = strings.TrimPrefix(suffix, "*")
+		if strings.HasSuffix(username, suffix) {
+			found = true
+			break
+		}
+	}
+
+	if !found {
+		// The username does not match any of the allowed suffixes.
+		return "", nil
+	}
+
+	u := info.NewUser(username, filepath.Join(b.cfg.homeBaseDir, username), "", "", "", nil)
+	encoded, err := json.Marshal(u)
+	if err != nil {
+		return "", fmt.Errorf("could not marshal user info: %v", err)
+	}
+	return string(encoded), nil
+}
+
+// getSession returns the session information for the specified session ID or an error if the session is not active.
+func (b *Broker) getSession(sessionID string) (session, error) {
+	b.currentSessionsMu.RLock()
+	defer b.currentSessionsMu.RUnlock()
+	s, active := b.currentSessions[sessionID]
+	if !active {
+		return session{}, fmt.Errorf("%s is not a current transaction", sessionID)
+	}
+	return s, nil
+}
+
+// updateSession checks if the session is still active and updates the session info.
+func (b *Broker) updateSession(sessionID string, session session) error {
+	// Checks if the session was ended in the meantime, otherwise we would just accidentally recreate it.
+	if _, err := b.getSession(sessionID); err != nil {
+		return err
+	}
+	b.currentSessionsMu.Lock()
+	defer b.currentSessionsMu.Unlock()
+	b.currentSessions[sessionID] = session
+	return nil
+}
+
+// refreshToken refreshes the OAuth2 token and returns the updated AuthCachedInfo.
+func (b *Broker) refreshToken(ctx context.Context, session *session, oldToken *token.AuthCachedInfo) (*token.AuthCachedInfo, error) {
+	timeoutCtx, cancel := context.WithTimeout(ctx, maxRequestDuration)
+	defer cancel()
+	// set cached token expiry time to one hour in the past
+	// this makes sure the token is refreshed even if it has not 'actually' expired
+	oldToken.Token.Expiry = time.Now().Add(-time.Hour)
+	oauthToken, err := session.oauth2Config.TokenSource(timeoutCtx, oldToken.Token).Token()
+	if err != nil {
+		return nil, err
+	}
+
+	// Update the raw ID token
+	rawIDToken, ok := oauthToken.Extra("id_token").(string)
+	if !ok {
+		log.Debug(context.Background(), "refreshed token does not contain an ID token, keeping the old one")
+		rawIDToken = oldToken.RawIDToken
+	}
+
+	t := token.NewAuthCachedInfo(oauthToken, rawIDToken, b.provider)
+	t.ProviderMetadata = oldToken.ProviderMetadata
+	t.DeviceRegistrationData = oldToken.DeviceRegistrationData
+
+	t.UserInfo, err = b.userInfoFromIDToken(ctx, session, rawIDToken)
+	if err != nil {
+		return nil, err
+	}
+
+	t.UserInfo.Groups = oldToken.UserInfo.Groups
+
+	return t, nil
+}
+
+// userInfoFromIDToken verifies and parses the raw ID token and returns the user info from it.
+// Note that verifying the ID token requires a working network connection to the provider's JWKs endpoint,
+// so make sure to only call this function if the session is online.
+func (b *Broker) userInfoFromIDToken(ctx context.Context, session *session, rawIDToken string) (info.User, error) {
+	idToken, err := session.oidcServer.Verifier(&b.oidcCfg).Verify(ctx, rawIDToken)
+	if err != nil {
+		return info.User{}, fmt.Errorf("could not verify token: %v", err)
+	}
+
+	userInfo, err := b.provider.GetUserInfo(idToken)
+	if err != nil {
+		return info.User{}, err
+	}
+
+	if err = b.provider.VerifyUsername(session.username, userInfo.Name); err != nil {
+		return info.User{}, fmt.Errorf("username verification failed: %w", err)
+	}
+
+	// This means that home was not provided by the claims, so we need to set it to the broker default.
+	if !filepath.IsAbs(userInfo.Home) {
+		userInfo.Home = filepath.Join(b.cfg.homeBaseDir, userInfo.Home)
+	}
+
+	return userInfo, nil
+}
+
+func (b *Broker) getGroups(ctx context.Context, session *session, t *token.AuthCachedInfo) ([]info.Group, error) {
+	if session.isOffline {
+		return nil, errors.New("session is in offline mode")
+	}
+
+	return b.provider.GetGroups(ctx,
+		b.cfg.clientID,
+		b.cfg.issuerURL,
+		t.Token,
+		t.ProviderMetadata,
+		t.DeviceRegistrationData,
+	)
+}
+
+// Checks if the provided error is of type ForDisplayError. If it is, it returns the error message. Else, it returns
+// the provided fallback message.
+func errorMessageForDisplay(err error, fallback string) errorMessage {
+	var forDisplayErr *providerErrors.ForDisplayError
+	if errors.As(err, &forDisplayErr) {
+		return errorMessage{Message: forDisplayErr.Error()}
+	}
+	return errorMessage{Message: fallback}
+}
diff --git a/authd-oidc-brokers/internal/broker/broker_test.go b/authd-oidc-brokers/internal/broker/broker_test.go
new file mode 100644
index 0000000000..3cc46b7cbe
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/broker_test.go
@@ -0,0 +1,1377 @@
+package broker_test
+
+import (
+	"encoding/json"
+	"fmt"
+	"os"
+	"path/filepath"
+	"slices"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/canonical/authd/authd-oidc-brokers/internal/broker"
+	"github.com/canonical/authd/authd-oidc-brokers/internal/broker/authmodes"
+	"github.com/canonical/authd/authd-oidc-brokers/internal/broker/sessionmode"
+	"github.com/canonical/authd/authd-oidc-brokers/internal/consts"
+	"github.com/canonical/authd/authd-oidc-brokers/internal/password"
+	"github.com/canonical/authd/authd-oidc-brokers/internal/providers/info"
+	"github.com/canonical/authd/authd-oidc-brokers/internal/testutils"
+	"github.com/canonical/authd/authd-oidc-brokers/internal/testutils/golden"
+	"github.com/stretchr/testify/require"
+	"github.com/ubuntu/authd/log"
+	"gopkg.in/yaml.v3"
+)
+
+var defaultIssuerURL string
+
+func TestNew(t *testing.T) {
+	t.Parallel()
+
+	tests := map[string]struct {
+		issuer   string
+		clientID string
+		dataDir  string
+
+		wantErr bool
+	}{
+		"Successfully_create_new_broker":                              {},
+		"Successfully_create_new_even_if_can_not_connect_to_provider": {issuer: "https://notavailable"},
+
+		"Error_if_issuer_is_not_provided":   {issuer: "-", wantErr: true},
+		"Error_if_clientID_is_not_provided": {clientID: "-", wantErr: true},
+		"Error_if_dataDir_is_not_provided":  {dataDir: "-", wantErr: true},
+	}
+	for name, tc := range tests {
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			switch tc.issuer {
+			case "":
+				tc.issuer = defaultIssuerURL
+			case "-":
+				tc.issuer = ""
+			}
+
+			if tc.clientID == "-" {
+				tc.clientID = ""
+			} else {
+				tc.clientID = "test-client-id"
+			}
+
+			if tc.dataDir == "-" {
+				tc.dataDir = ""
+			} else {
+				tc.dataDir = t.TempDir()
+			}
+
+			bCfg := &broker.Config{DataDir: tc.dataDir}
+			bCfg.SetIssuerURL(tc.issuer)
+			bCfg.SetClientID(tc.clientID)
+			b, err := broker.New(*bCfg)
+			if tc.wantErr {
+				require.Error(t, err, "New should have returned an error")
+				return
+			}
+			require.NoError(t, err, "New should not have returned an error")
+			require.NotNil(t, b, "New should have returned a non-nil broker")
+		})
+	}
+}
+
+func TestNewSession(t *testing.T) {
+	t.Parallel()
+
+	tests := map[string]struct {
+		customHandlers map[string]testutils.EndpointHandler
+
+		wantOffline bool
+	}{
+		"Successfully_create_new_session": {},
+		"Creates_new_session_in_offline_mode_if_provider_is_not_available": {
+			customHandlers: map[string]testutils.EndpointHandler{
+				"/.well-known/openid-configuration": testutils.UnavailableHandler(),
+			},
+			wantOffline: true,
+		},
+		"Creates_new_session_in_offline_mode_if_provider_connection_times_out": {
+			customHandlers: map[string]testutils.EndpointHandler{
+				"/.well-known/openid-configuration": testutils.HangingHandler(broker.MaxRequestDuration + 1),
+			},
+			wantOffline: true,
+		},
+	}
+	for name, tc := range tests {
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			b := newBrokerForTests(t, &brokerForTestConfig{
+				customHandlers: tc.customHandlers,
+			})
+
+			id, _, err := b.NewSession("test-user", "lang", sessionmode.Login)
+			require.NoError(t, err, "NewSession should not have returned an error")
+
+			gotOffline, err := b.IsOffline(id)
+			require.NoError(t, err, "Session should have been created")
+
+			require.Equal(t, tc.wantOffline, gotOffline, "Session should have been created in the expected mode")
+		})
+	}
+}
+
+var supportedUILayouts = map[string]map[string]string{
+	"form": {
+		"type":  "form",
+		"entry": "chars_password",
+	},
+	"form-without-entry": {
+		"type": "form",
+	},
+
+	"qrcode": {
+		"type": "qrcode",
+		"wait": "true",
+	},
+	"qrcode-without-wait": {
+		"type": "qrcode",
+	},
+	"qrcode-without-qrcode": {
+		"type":           "qrcode",
+		"renders_qrcode": "false",
+		"wait":           "true",
+	},
+	"qrcode-without-wait-and-qrcode": {
+		"type":           "qrcode",
+		"renders_qrcode": "false",
+	},
+
+	"newpassword": {
+		"type":  "newpassword",
+		"entry": "chars_password",
+	},
+	"newpassword-without-entry": {
+		"type": "newpassword",
+	},
+}
+
+func TestGetAuthenticationModes(t *testing.T) {
+	t.Parallel()
+
+	tests := map[string]struct {
+		sessionMode      string
+		sessionID        string
+		supportedLayouts []string
+
+		providerAddress                    string
+		token                              *tokenOptions
+		noPasswordFile                     bool
+		nextAuthMode                       string
+		unavailableProvider                bool
+		deviceAuthUnsupported              bool
+		registerDevice                     bool
+		providerSupportsDeviceRegistration bool
+
+		wantErr   bool
+		wantModes []string
+	}{
+		// === Authentication session ===
+		"Get_only_device_auth_qr_if_there_is_no_token": {
+			token:     nil,
+			wantModes: []string{authmodes.DeviceQr},
+		},
+		"Get_password_and_device_auth_qr_if_token_exists": {
+			token:     &tokenOptions{},
+			wantModes: []string{authmodes.Password, authmodes.DeviceQr},
+		},
+		"Get_only_device_auth_qr_if_token_is_invalid": {
+			token:     &tokenOptions{invalid: true},
+			wantModes: []string{authmodes.DeviceQr},
+		},
+		"Get_only_device_auth_qr_if_there_is_no_password_file": {
+			token:          &tokenOptions{},
+			noPasswordFile: true,
+			wantModes:      []string{authmodes.DeviceQr},
+		},
+
+		// --- Next auth mode ---
+		"Get_only_newpassword_if_next_auth_mode_is_newpassword": {
+			nextAuthMode: authmodes.NewPassword,
+			wantModes:    []string{authmodes.NewPassword},
+		},
+		"Get_only_device_auth_qr_if_next_auth_mode_is_device_qr": {
+			nextAuthMode: authmodes.DeviceQr,
+			wantModes:    []string{authmodes.DeviceQr},
+		},
+
+		// --- Device registration ---
+		"Get_password_and_device_auth_qr_if_device_should_be_registered_and_token_is_for_device_registration": {
+			registerDevice:                     true,
+			providerSupportsDeviceRegistration: true,
+			token:                              &tokenOptions{isForDeviceRegistration: true},
+			wantModes:                          []string{authmodes.Password, authmodes.DeviceQr},
+		},
+		"Get_only_device_auth_qr_if_device_should_be_registered_and_token_is_not_for_device_registration": {
+			registerDevice:                     true,
+			providerSupportsDeviceRegistration: true,
+			token:                              &tokenOptions{isForDeviceRegistration: false},
+			wantModes:                          []string{authmodes.DeviceQr},
+		},
+		"Get_password_and_device_auth_qr_if_device_should_be_registered_and_token_is_not_for_device_registration_and_provider_does_not_support_it": {
+			registerDevice:                     true,
+			providerSupportsDeviceRegistration: false,
+			token:                              &tokenOptions{isForDeviceRegistration: false},
+			wantModes:                          []string{authmodes.Password, authmodes.DeviceQr},
+		},
+		"Get_only_device_auth_qr_if_device_should_not_be_registered_and_token_is_for_device_registration": {
+			registerDevice:                     false,
+			providerSupportsDeviceRegistration: true,
+			token:                              &tokenOptions{isForDeviceRegistration: true},
+			wantModes:                          []string{authmodes.DeviceQr},
+		},
+		"Get_password_and_device_auth_qr_if_device_should_not_be_registered_and_token_is_not_for_device_registration": {
+			registerDevice:                     false,
+			providerSupportsDeviceRegistration: true,
+			token:                              &tokenOptions{isForDeviceRegistration: false},
+			wantModes:                          []string{authmodes.Password, authmodes.DeviceQr},
+		},
+		"Get_password_and_device_auth_qr_if_token_is_not_for_device_registration_but_provider_does_not_support_it": {
+			registerDevice:                     false,
+			providerSupportsDeviceRegistration: false,
+			token:                              &tokenOptions{isForDeviceRegistration: false},
+			wantModes:                          []string{authmodes.Password, authmodes.DeviceQr},
+		},
+		// Note: We don't care about the weird case that the token is for device registration but the provider doesn't
+		//       support it, because that never happens (providers which don't support device registration always return
+		//       false for IsTokenForDeviceRegistration).
+
+		"Get_only_password_if_device_should_be_registered_and_token_is_not_for_device_registration_but_provider_is_not_available": {
+			registerDevice:                     true,
+			providerSupportsDeviceRegistration: true,
+			token:                              &tokenOptions{isForDeviceRegistration: false},
+			unavailableProvider:                true,
+			// TODO: Automatically set providerAddress if unavailableProvider or deviceAuthUnsupported is set
+			providerAddress: "127.0.0.1:31308",
+			wantModes:       []string{authmodes.Password},
+		},
+		"Get_only_password_if_device_should_not_be_registered_and_token_is_for_device_registration_but_provider_is_not_available": {
+			registerDevice:                     true,
+			providerSupportsDeviceRegistration: true,
+			token:                              &tokenOptions{isForDeviceRegistration: true},
+			unavailableProvider:                true,
+			providerAddress:                    "127.0.0.1:31309",
+			wantModes:                          []string{authmodes.Password},
+		},
+
+		"Get_only_password_if_token_exists_and_provider_is_not_available": {
+			token:               &tokenOptions{},
+			providerAddress:     "127.0.0.1:31310",
+			unavailableProvider: true,
+			wantModes:           []string{authmodes.Password},
+		},
+		"Get_only_password_if_token_exists_and_provider_does_not_support_device_auth_qr": {
+			token:                 &tokenOptions{},
+			providerAddress:       "127.0.0.1:31311",
+			deviceAuthUnsupported: true,
+			wantModes:             []string{authmodes.Password},
+		},
+		"Get_only_device_auth_if_token_exists_but_checking_if_it_is_for_device_registration_fails": {
+			token:                              &tokenOptions{noIsForDeviceRegistration: true},
+			providerSupportsDeviceRegistration: true,
+			wantModes:                          []string{authmodes.DeviceQr},
+		},
+
+		// === Change password session ===
+		"Get_only_password_if_token_exists_and_session_is_for_changing_password": {
+			sessionMode: sessionmode.ChangePassword,
+			token:       &tokenOptions{},
+			wantModes:   []string{authmodes.Password},
+		},
+		"Get_only_newpassword_if_session_is_for changing_password_and_next_auth_mode_is_newpassword": {
+			sessionMode:  sessionmode.ChangePassword,
+			token:        &tokenOptions{},
+			nextAuthMode: authmodes.NewPassword,
+			wantModes:    []string{authmodes.NewPassword},
+		},
+		"Get_only_password_if_token_exists_and_session_mode_is_the_old_passwd_value": {
+			sessionMode: sessionmode.ChangePasswordOld,
+			token:       &tokenOptions{},
+			wantModes:   []string{authmodes.Password},
+		},
+
+		// === Errors ===
+		// --- General errors ---
+		"Error_if_there_is_no_session": {
+			sessionID: "-",
+			wantErr:   true,
+		},
+		"Error_if_no_authentication_mode_is_supported": {
+			providerAddress:       "127.0.0.1:31312",
+			deviceAuthUnsupported: true,
+			wantErr:               true,
+		},
+		"Error_if_expecting_device_auth_qr_but_not_supported": {
+			supportedLayouts: []string{"qrcode-without-wait"},
+			wantErr:          true,
+		},
+		"Error_if_expecting_device_auth_but_not_supported": {
+			supportedLayouts: []string{"qrcode-without-wait-and-qrcode"},
+			wantErr:          true,
+		},
+		"Error_if_expecting_newpassword_but_not_supported": {
+			supportedLayouts: []string{"newpassword-without-entry"},
+			wantErr:          true,
+		},
+		"Error_if_expecting_password_but_not_supported": {
+			supportedLayouts: []string{"form-without-entry"},
+			wantErr:          true,
+		},
+		"Error_if_next_auth_mode_is_invalid": {
+			nextAuthMode: "invalid",
+			wantErr:      true,
+		},
+
+		// --- Change password session errors ---
+		"Error_if_session_is_for_changing_password_but_password_file_does_not_exist": {
+			sessionMode:    sessionmode.ChangePassword,
+			noPasswordFile: true,
+			wantErr:        true,
+		},
+	}
+	for name, tc := range tests {
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			if tc.sessionMode == "" {
+				tc.sessionMode = sessionmode.Login
+			}
+
+			cfg := &brokerForTestConfig{
+				registerDevice:             tc.registerDevice,
+				supportsDeviceRegistration: tc.providerSupportsDeviceRegistration,
+			}
+			if tc.providerAddress == "" {
+				// Use the default provider URL if no address is provided.
+				cfg.issuerURL = defaultIssuerURL
+			} else {
+				cfg.listenAddress = tc.providerAddress
+
+				const wellKnown = "/.well-known/openid-configuration"
+				if tc.deviceAuthUnsupported {
+					cfg.customHandlers = map[string]testutils.EndpointHandler{
+						wellKnown: testutils.OpenIDHandlerWithNoDeviceEndpoint("http://" + tc.providerAddress),
+					}
+				}
+				if tc.unavailableProvider {
+					cfg.customHandlers = map[string]testutils.EndpointHandler{
+						wellKnown: testutils.UnavailableHandler(),
+					}
+				}
+			}
+			b := newBrokerForTests(t, cfg)
+
+			sessionID, _ := newSessionForTests(t, b, "", tc.sessionMode)
+			if tc.sessionID == "-" {
+				sessionID = ""
+			}
+			if tc.token != nil {
+				generateAndStoreCachedInfo(t, *tc.token, b.TokenPathForSession(sessionID))
+			}
+			if !tc.noPasswordFile && sessionID != "" {
+				err := password.HashAndStorePassword("password", b.PasswordFilepathForSession(sessionID))
+				require.NoError(t, err, "Setup: HashAndStorePassword should not have returned an error")
+			}
+			if tc.nextAuthMode != "" {
+				b.SetNextAuthModes(sessionID, []string{tc.nextAuthMode})
+			}
+
+			if tc.supportedLayouts == nil {
+				tc.supportedLayouts = []string{"form", "qrcode", "newpassword"}
+			}
+			var layouts []map[string]string
+			for _, layout := range tc.supportedLayouts {
+				layouts = append(layouts, supportedUILayouts[layout])
+			}
+
+			modes, err := b.GetAuthenticationModes(sessionID, layouts)
+			if tc.wantErr {
+				require.Error(t, err, "GetAuthenticationModes should have returned an error")
+				return
+			}
+			require.NoError(t, err, "GetAuthenticationModes should not have returned an error")
+
+			var modeIDs []string
+			for _, mode := range modes {
+				id, exists := mode["id"]
+				require.True(t, exists, "Each mode should have an 'id' field. Mode: %v", mode)
+				modeIDs = append(modeIDs, id)
+			}
+			require.Equal(t, tc.wantModes, modeIDs, "GetAuthenticationModes should have returned the expected modes")
+
+			golden.CheckOrUpdateYAML(t, modes)
+		})
+	}
+}
+
+var supportedLayouts = []map[string]string{
+	supportedUILayouts["form"],
+	supportedUILayouts["qrcode"],
+	supportedUILayouts["newpassword"],
+}
+
+var supportedLayoutsWithoutQrCode = []map[string]string{
+	supportedUILayouts["form"],
+	supportedUILayouts["qrcode-without-qrcode"],
+	supportedUILayouts["newpassword"],
+}
+
+func TestSelectAuthenticationMode(t *testing.T) {
+	t.Parallel()
+
+	tests := map[string]struct {
+		modeName string
+
+		tokenExists      bool
+		nextAuthMode     string
+		passwdSession    bool
+		customHandlers   map[string]testutils.EndpointHandler
+		supportedLayouts []map[string]string
+
+		wantErr bool
+	}{
+		"Successfully_select_password":       {modeName: authmodes.Password, tokenExists: true},
+		"Successfully_select_device_auth_qr": {modeName: authmodes.DeviceQr},
+		"Successfully_select_device_auth":    {supportedLayouts: supportedLayoutsWithoutQrCode, modeName: authmodes.Device},
+		"Successfully_select_newpassword":    {modeName: authmodes.NewPassword, nextAuthMode: authmodes.NewPassword},
+
+		"Selected_newpassword_shows_correct_label_in_passwd_session": {modeName: authmodes.NewPassword, passwdSession: true, tokenExists: true, nextAuthMode: authmodes.NewPassword},
+
+		"Error_when_selecting_invalid_mode": {modeName: "invalid", wantErr: true},
+		"Error_when_selecting_device_auth_qr_but_provider_is_unavailable": {modeName: authmodes.DeviceQr, wantErr: true,
+			customHandlers: map[string]testutils.EndpointHandler{
+				"/device_auth": testutils.UnavailableHandler(),
+			},
+		},
+		"Error_when_selecting_device_auth_but_provider_is_unavailable": {
+			supportedLayouts: supportedLayoutsWithoutQrCode,
+			modeName:         authmodes.Device,
+			customHandlers: map[string]testutils.EndpointHandler{
+				"/device_auth": testutils.UnavailableHandler(),
+			},
+			wantErr: true,
+		},
+		"Error_when_selecting_device_auth_qr_but_request_times_out": {modeName: authmodes.DeviceQr, wantErr: true,
+			customHandlers: map[string]testutils.EndpointHandler{
+				"/device_auth": testutils.HangingHandler(broker.MaxRequestDuration + 1),
+			},
+		},
+		"Error_when_selecting_device_auth_but_request_times_out": {
+			supportedLayouts: supportedLayoutsWithoutQrCode,
+			modeName:         authmodes.Device,
+			customHandlers: map[string]testutils.EndpointHandler{
+				"/device_auth": testutils.HangingHandler(broker.MaxRequestDuration + 1),
+			},
+			wantErr: true,
+		},
+	}
+	for name, tc := range tests {
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			cfg := &brokerForTestConfig{}
+			if tc.customHandlers == nil {
+				// Use the default provider URL if no custom handlers are provided.
+				cfg.issuerURL = defaultIssuerURL
+			} else {
+				cfg.customHandlers = tc.customHandlers
+			}
+			b := newBrokerForTests(t, cfg)
+
+			sessionType := sessionmode.Login
+			if tc.passwdSession {
+				sessionType = sessionmode.ChangePassword
+			}
+			sessionID, _ := newSessionForTests(t, b, "", sessionType)
+
+			if tc.tokenExists {
+				generateAndStoreCachedInfo(t, tokenOptions{}, b.TokenPathForSession(sessionID))
+				err := password.HashAndStorePassword("password", b.PasswordFilepathForSession(sessionID))
+				require.NoError(t, err, "Setup: HashAndStorePassword should not have returned an error")
+			}
+			if tc.nextAuthMode != "" {
+				b.SetNextAuthModes(sessionID, []string{tc.nextAuthMode})
+			}
+			if tc.supportedLayouts == nil {
+				tc.supportedLayouts = supportedLayouts
+			}
+
+			// We need to do a GAM call first to get all the modes.
+			_, err := b.GetAuthenticationModes(sessionID, tc.supportedLayouts)
+			require.NoError(t, err, "Setup: GetAuthenticationModes should not have returned an error")
+
+			got, err := b.SelectAuthenticationMode(sessionID, tc.modeName)
+			if tc.wantErr {
+				require.Error(t, err, "SelectAuthenticationMode should have returned an error")
+				return
+			}
+			require.NoError(t, err, "SelectAuthenticationMode should not have returned an error")
+
+			golden.CheckOrUpdateYAML(t, got)
+		})
+	}
+}
+
+type isAuthenticatedResponse struct {
+	Access string
+	Data   string
+	Err    string
+}
+
+func TestIsAuthenticated(t *testing.T) {
+	t.Parallel()
+
+	correctPassword := "password"
+
+	tests := map[string]struct {
+		sessionMode                        string
+		sessionOffline                     bool
+		username                           string
+		forceProviderAuthentication        bool
+		userDoesNotBecomeOwner             bool
+		allUsersAllowed                    bool
+		extraGroups                        []string
+		ownerExtraGroups                   []string
+		providerSupportsDeviceRegistration bool
+		registerDevice                     bool
+
+		firstMode                string
+		firstSecret              string
+		badFirstKey              bool
+		getGroupsFails           bool
+		useOldNameForSecretField bool
+		groupsReturnedByProvider []info.Group
+
+		customHandlers map[string]testutils.EndpointHandler
+		address        string
+
+		wantSecondCall bool
+		secondMode     string
+		secondSecret   string
+
+		token                *tokenOptions
+		invalidAuthData      bool
+		dontWaitForFirstCall bool
+		readOnlyDataDir      bool
+		wantGroups           []info.Group
+		wantNextAuthModes    []string
+	}{
+		"Successfully_authenticate_user_with_device_auth_and_newpassword": {firstSecret: "-", wantSecondCall: true},
+		"Successfully_authenticate_user_with_password":                    {firstMode: authmodes.Password, token: &tokenOptions{}},
+
+		"Authenticating_with_qrcode_reacquires_token":          {firstSecret: "-", wantSecondCall: true, token: &tokenOptions{}},
+		"Authenticating_with_password_refreshes_expired_token": {firstMode: authmodes.Password, token: &tokenOptions{expired: true}},
+		"Authenticating_with_password_still_allowed_if_server_is_unreachable": {
+			firstMode: authmodes.Password,
+			token:     &tokenOptions{},
+			customHandlers: map[string]testutils.EndpointHandler{
+				"/.well-known/openid-configuration": testutils.UnavailableHandler(),
+			},
+		},
+		"Authenticating_with_password_still_allowed_if_token_is_expired_and_server_is_unreachable": {
+			firstMode: authmodes.Password,
+			token:     &tokenOptions{expired: true},
+			customHandlers: map[string]testutils.EndpointHandler{
+				"/.well-known/openid-configuration": testutils.UnavailableHandler(),
+			},
+		},
+		"Authenticating_still_allowed_if_token_is_missing_scopes": {
+			firstSecret:    "-",
+			wantSecondCall: true,
+			customHandlers: map[string]testutils.EndpointHandler{
+				"/token": testutils.TokenHandler("http://127.0.0.1:31313", nil),
+			},
+			address: "127.0.0.1:31313",
+		},
+		"Authenticating_with_password_refreshes_groups": {
+			firstMode:                authmodes.Password,
+			token:                    &tokenOptions{},
+			groupsReturnedByProvider: []info.Group{{Name: "refreshed-group"}},
+			wantGroups:               []info.Group{{Name: "refreshed-group"}},
+		},
+		"Authenticating_with_password_keeps_old_groups_if_fetching_groups_fails": {
+			firstMode:      authmodes.Password,
+			token:          &tokenOptions{groups: []info.Group{{Name: "old-group"}}},
+			getGroupsFails: true,
+			wantGroups:     []info.Group{{Name: "old-group"}},
+		},
+		"Authenticating_with_password_keeps_old_groups_if_session_is_offline": {
+			firstMode:      authmodes.Password,
+			token:          &tokenOptions{groups: []info.Group{{Name: "old-group"}}},
+			sessionOffline: true,
+			wantGroups:     []info.Group{{Name: "old-group"}},
+		},
+		"Authenticating_when_the_auth_data_secret_field_uses_the_old_name": {
+			firstMode:                authmodes.Password,
+			token:                    &tokenOptions{},
+			useOldNameForSecretField: true,
+		},
+		"Authenticating_to_change_password_still_allowed_if_fetching_groups_fails": {
+			sessionMode:       sessionmode.ChangePassword,
+			firstMode:         authmodes.Password,
+			wantNextAuthModes: []string{authmodes.NewPassword},
+			token:             &tokenOptions{noUserInfo: true},
+			getGroupsFails:    true,
+		},
+		"Authenticating_with_password_when_refresh_token_is_expired_results_in_device_auth_as_next_mode": {
+			firstMode:         authmodes.Password,
+			token:             &tokenOptions{refreshTokenExpired: true},
+			wantNextAuthModes: []string{authmodes.Device, authmodes.DeviceQr},
+			wantSecondCall:    true,
+			secondMode:        authmodes.DeviceQr,
+		},
+		"Authenticating_with_password_when_no_refresh_token_results_in_device_auth_as_next_mode": {
+			firstMode:         authmodes.Password,
+			token:             &tokenOptions{noRefreshToken: true},
+			wantNextAuthModes: []string{authmodes.Device, authmodes.DeviceQr},
+			wantSecondCall:    true,
+			secondMode:        authmodes.DeviceQr,
+		},
+		"Authenticating_with_password_still_allowed_if_no_refresh_token_and_server_is_unreachable": {
+			firstMode: authmodes.Password,
+			token:     &tokenOptions{noRefreshToken: true, groups: []info.Group{{Name: "old-group"}}},
+			customHandlers: map[string]testutils.EndpointHandler{
+				"/.well-known/openid-configuration": testutils.UnavailableHandler(),
+			},
+			wantGroups: []info.Group{{Name: "old-group"}},
+		},
+		"Authenticating_with_password_when_provider_authentication_is_forced": {
+			firstMode:                   authmodes.Password,
+			token:                       &tokenOptions{},
+			forceProviderAuthentication: true,
+		},
+		"Extra_groups_configured": {
+			firstMode:                authmodes.Password,
+			token:                    &tokenOptions{},
+			groupsReturnedByProvider: []info.Group{{Name: "remote-group"}},
+			extraGroups:              []string{"extra-group"},
+			wantGroups:               []info.Group{{Name: "remote-group"}, {Name: "extra-group"}},
+		},
+		"Owner_extra_groups_configured": {
+			firstMode:                authmodes.Password,
+			token:                    &tokenOptions{},
+			groupsReturnedByProvider: []info.Group{{Name: "remote-group"}},
+			ownerExtraGroups:         []string{"owner-group"},
+			wantGroups:               []info.Group{{Name: "remote-group"}, {Name: "owner-group"}},
+		},
+		"Owner_extra_groups_configured_but_user_does_not_become_owner": {
+			firstMode:                authmodes.Password,
+			token:                    &tokenOptions{},
+			groupsReturnedByProvider: []info.Group{{Name: "remote-group"}},
+			userDoesNotBecomeOwner:   true,
+			allUsersAllowed:          true,
+			ownerExtraGroups:         []string{"owner-group"},
+			wantGroups:               []info.Group{{Name: "remote-group"}},
+		},
+		"Authenticating_with_device_auth_when_provider_supports_device_registration": {
+			firstSecret:                        "-",
+			wantSecondCall:                     true,
+			providerSupportsDeviceRegistration: true,
+			registerDevice:                     true,
+			customHandlers: map[string]testutils.EndpointHandler{
+				"/token": testutils.TokenHandler("http://127.0.0.1:31314", &testutils.TokenHandlerOptions{
+					IDTokenClaims: []map[string]interface{}{
+						{"aud": consts.MicrosoftBrokerAppID},
+					},
+				}),
+			},
+			address: "127.0.0.1:31314",
+		},
+		"Authenticating_with_password_when_provider_supports_device_registration": {
+			firstMode:                          authmodes.Password,
+			token:                              &tokenOptions{},
+			providerSupportsDeviceRegistration: true,
+			registerDevice:                     true,
+			customHandlers: map[string]testutils.EndpointHandler{
+				"/token": testutils.TokenHandler("http://127.0.0.1:31315", &testutils.TokenHandlerOptions{
+					IDTokenClaims: []map[string]interface{}{
+						{"aud": consts.MicrosoftBrokerAppID},
+					},
+				}),
+			},
+			address: "127.0.0.1:31315",
+		},
+
+		"Error_when_authentication_data_is_invalid":         {invalidAuthData: true},
+		"Error_when_secret_can_not_be_decrypted":            {firstMode: authmodes.Password, badFirstKey: true},
+		"Error_when_provided_wrong_secret":                  {firstMode: authmodes.Password, token: &tokenOptions{}, firstSecret: "wrongpassword"},
+		"Error_when_can_not_cache_token":                    {firstSecret: "-", wantSecondCall: true, readOnlyDataDir: true},
+		"Error_when_IsAuthenticated_is_ongoing_for_session": {dontWaitForFirstCall: true, wantSecondCall: true},
+
+		"Error_when_mode_is_password_and_token_does_not_exist": {firstMode: authmodes.Password},
+		"Error_when_mode_is_password_but_server_returns_error": {
+			firstMode: authmodes.Password,
+			token:     &tokenOptions{expired: true},
+			customHandlers: map[string]testutils.EndpointHandler{
+				"/token": testutils.BadRequestHandler(),
+			},
+		},
+		"Error_when_mode_is_password_and_token_is_invalid":       {firstMode: authmodes.Password, token: &tokenOptions{invalid: true}},
+		"Error_when_mode_is_password_and_no_refresh_token":       {firstMode: authmodes.Password, token: &tokenOptions{noRefreshToken: true}},
+		"Error_when_token_is_expired_and_refreshing_token_fails": {firstMode: authmodes.Password, token: &tokenOptions{expired: true, noRefreshToken: true}},
+		"Error_when_mode_is_password_and_token_refresh_times_out": {firstMode: authmodes.Password, token: &tokenOptions{expired: true},
+			customHandlers: map[string]testutils.EndpointHandler{
+				"/token": testutils.HangingHandler(broker.MaxRequestDuration + 1),
+			},
+		},
+
+		"Error_when_mode_is_qrcode_and_link_expires": {
+			customHandlers: map[string]testutils.EndpointHandler{
+				"/device_auth": testutils.ExpiryDeviceAuthHandler(),
+			},
+		},
+		"Error_when_mode_is_qrcode_and_can_not_get_token": {
+			customHandlers: map[string]testutils.EndpointHandler{
+				"/token": testutils.UnavailableHandler(),
+			},
+		},
+		"Error_when_mode_is_qrcode_and_can_not_get_token_due_to_timeout": {
+			customHandlers: map[string]testutils.EndpointHandler{
+				"/token": testutils.HangingHandler(broker.MaxRequestDuration + 1),
+			},
+		},
+		"Error_when_mode_is_link_code_and_link_expires": {
+			customHandlers: map[string]testutils.EndpointHandler{
+				"/device_auth": testutils.ExpiryDeviceAuthHandler(),
+			},
+		},
+		"Error_when_mode_is_link_code_and_can_not_get_token": {
+			firstMode: authmodes.Device,
+			customHandlers: map[string]testutils.EndpointHandler{
+				"/token": testutils.UnavailableHandler(),
+			},
+		},
+		"Error_when_mode_is_link_code_and_can_not_get_token_due_to_timeout": {
+			firstMode: authmodes.Device,
+			customHandlers: map[string]testutils.EndpointHandler{
+				"/token": testutils.HangingHandler(broker.MaxRequestDuration + 1),
+			},
+		},
+		"Error_when_empty_secret_is_provided_for_local_password":  {firstSecret: "-", wantSecondCall: true, secondSecret: "-"},
+		"Error_when_mode_is_newpassword_and_session_has_no_token": {firstMode: authmodes.NewPassword},
+		// This test case also tests that errors with double quotes are marshaled to JSON correctly.
+		"Error_when_selected_username_does_not_match_the_provider_one": {username: "not-matching", firstSecret: "-"},
+		"Error_when_provider_authentication_is_forced_and_session_is_offline": {
+			firstMode:                   authmodes.Password,
+			token:                       &tokenOptions{},
+			forceProviderAuthentication: true,
+			sessionOffline:              true,
+		},
+		"Error_when_user_is_disabled_and_session_is_offline": {
+			firstMode:      authmodes.Password,
+			token:          &tokenOptions{userIsDisabled: true},
+			sessionOffline: true,
+		},
+		"Error_when_device_is_disabled_and_session_is_offline": {
+			firstMode:      authmodes.Password,
+			token:          &tokenOptions{deviceIsDisabled: true},
+			sessionOffline: true,
+		},
+		"Error_when_mode_is_invalid": {firstMode: "invalid"},
+	}
+	for name, tc := range tests {
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			if tc.sessionMode == "" {
+				tc.sessionMode = sessionmode.Login
+			}
+
+			if tc.sessionOffline {
+				tc.customHandlers = map[string]testutils.EndpointHandler{
+					"/.well-known/openid-configuration": testutils.UnavailableHandler(),
+				}
+			}
+
+			outDir := t.TempDir()
+			dataDir := filepath.Join(outDir, "data")
+
+			err := os.Mkdir(dataDir, 0700)
+			require.NoError(t, err, "Setup: Mkdir should not have returned an error")
+
+			cfg := &brokerForTestConfig{
+				Config:                      broker.Config{DataDir: dataDir},
+				getGroupsFails:              tc.getGroupsFails,
+				ownerAllowed:                true,
+				firstUserBecomesOwner:       !tc.userDoesNotBecomeOwner,
+				allUsersAllowed:             tc.allUsersAllowed,
+				forceProviderAuthentication: tc.forceProviderAuthentication,
+				extraGroups:                 tc.extraGroups,
+				ownerExtraGroups:            tc.ownerExtraGroups,
+				supportsDeviceRegistration:  tc.providerSupportsDeviceRegistration,
+				registerDevice:              tc.registerDevice,
+			}
+			if tc.customHandlers == nil {
+				// Use the default provider URL if no custom handlers are provided.
+				cfg.issuerURL = defaultIssuerURL
+			} else {
+				cfg.customHandlers = tc.customHandlers
+				cfg.listenAddress = tc.address
+			}
+			if tc.groupsReturnedByProvider != nil {
+				cfg.getGroupsFunc = func() ([]info.Group, error) {
+					return tc.groupsReturnedByProvider, nil
+				}
+			}
+			b := newBrokerForTests(t, cfg)
+
+			sessionID, key := newSessionForTests(t, b, tc.username, tc.sessionMode)
+
+			if tc.token != nil {
+				generateAndStoreCachedInfo(t, *tc.token, b.TokenPathForSession(sessionID))
+				err = password.HashAndStorePassword(correctPassword, b.PasswordFilepathForSession(sessionID))
+				require.NoError(t, err, "Setup: HashAndStorePassword should not have returned an error")
+			}
+
+			var readOnlyDataCleanup, readOnlyTokenCleanup func()
+			if tc.readOnlyDataDir {
+				if tc.token != nil {
+					readOnlyTokenCleanup = testutils.MakeReadOnly(t, b.TokenPathForSession(sessionID))
+					t.Cleanup(readOnlyTokenCleanup)
+				}
+				readOnlyDataCleanup = testutils.MakeReadOnly(t, b.DataDir())
+				t.Cleanup(readOnlyDataCleanup)
+			}
+
+			switch tc.firstSecret {
+			case "":
+				tc.firstSecret = correctPassword
+			case "-":
+				tc.firstSecret = ""
+			}
+
+			authData := "{}"
+			if tc.firstSecret != "" {
+				eKey := key
+				if tc.badFirstKey {
+					eKey = ""
+				}
+				secret := encryptSecret(t, tc.firstSecret, eKey)
+				field := broker.AuthDataSecret
+				if tc.useOldNameForSecretField {
+					field = broker.AuthDataSecretOld
+				}
+				authData = fmt.Sprintf(`{"%s":"%s"}`, field, secret)
+			}
+			if tc.invalidAuthData {
+				authData = "invalid json"
+			}
+
+			firstCallDone := make(chan struct{})
+			go func() {
+				defer close(firstCallDone)
+
+				if tc.firstMode == "" {
+					tc.firstMode = authmodes.DeviceQr
+				}
+				updateAuthModes(t, b, sessionID, tc.firstMode)
+
+				access, data, err := b.IsAuthenticated(sessionID, authData)
+				require.True(t, json.Valid([]byte(data)), "IsAuthenticated returned data must be a valid JSON")
+
+				got := isAuthenticatedResponse{Access: access, Data: data, Err: fmt.Sprint(err)}
+				out, err := yaml.Marshal(got)
+				require.NoError(t, err, "Failed to marshal first response")
+
+				err = os.WriteFile(filepath.Join(outDir, "first_call"), out, 0600)
+				require.NoError(t, err, "Failed to write first response")
+
+				if tc.wantNextAuthModes != nil {
+					nextAuthModes := b.GetNextAuthModes(sessionID)
+					require.ElementsMatch(t, tc.wantNextAuthModes, nextAuthModes, "Next auth modes should match")
+				}
+
+				if tc.wantGroups != nil {
+					type userInfoMsgType struct {
+						UserInfo info.User `json:"userinfo"`
+					}
+					userInfoMsg := userInfoMsgType{}
+					err = json.Unmarshal([]byte(data), &userInfoMsg)
+					require.NoError(t, err, "Failed to unmarshal user info message")
+					userInfo := userInfoMsg.UserInfo
+					require.ElementsMatch(t, tc.wantGroups, userInfo.Groups, "Groups should match")
+				}
+			}()
+
+			if !tc.dontWaitForFirstCall {
+				<-firstCallDone
+			}
+
+			if tc.wantSecondCall {
+				// Give some time for the first call
+				time.Sleep(10 * time.Millisecond)
+
+				secret := "passwordpassword"
+				if tc.secondSecret == "-" {
+					secret = ""
+				}
+
+				secret = encryptSecret(t, secret, key)
+				field := broker.AuthDataSecret
+				if tc.useOldNameForSecretField {
+					field = broker.AuthDataSecretOld
+				}
+				secondAuthData := fmt.Sprintf(`{"%s":"%s"}`, field, secret)
+				if tc.invalidAuthData {
+					secondAuthData = "invalid json"
+				}
+
+				if tc.secondMode == "" {
+					tc.secondMode = authmodes.NewPassword
+				}
+
+				secondCallDone := make(chan struct{})
+				go func() {
+					defer close(secondCallDone)
+
+					updateAuthModes(t, b, sessionID, tc.secondMode)
+
+					access, data, err := b.IsAuthenticated(sessionID, secondAuthData)
+					require.True(t, json.Valid([]byte(data)), "IsAuthenticated returned data must be a valid JSON")
+
+					got := isAuthenticatedResponse{Access: access, Data: data, Err: fmt.Sprint(err)}
+					out, err := yaml.Marshal(got)
+					require.NoError(t, err, "Failed to marshal second response")
+
+					err = os.WriteFile(filepath.Join(outDir, "second_call"), out, 0600)
+					require.NoError(t, err, "Failed to write second response")
+				}()
+				<-secondCallDone
+			}
+			<-firstCallDone
+
+			// We need to restore some permissions in order to save the golden files.
+			if tc.readOnlyDataDir {
+				readOnlyDataCleanup()
+				if tc.token != nil {
+					readOnlyTokenCleanup()
+				}
+			}
+
+			// Ensure that the token content is generic to avoid golden file conflicts
+			if _, err := os.Stat(b.TokenPathForSession(sessionID)); err == nil {
+				err := os.WriteFile(b.TokenPathForSession(sessionID), []byte("Definitely a token"), 0600)
+				require.NoError(t, err, "Teardown: Failed to write generic token file")
+			}
+			passwordPath := b.PasswordFilepathForSession(sessionID)
+			if _, err := os.Stat(passwordPath); err == nil {
+				err := os.WriteFile(passwordPath, []byte("Definitely a hashed password"), 0600)
+				require.NoError(t, err, "Teardown: Failed to write generic password file")
+			}
+
+			// Ensure that the directory structure is generic to avoid golden file conflicts
+			if _, err := os.Stat(filepath.Dir(b.TokenPathForSession(sessionID))); err == nil {
+				issuerDir := filepath.Dir(filepath.Dir(b.TokenPathForSession(sessionID)))
+				newIsserDir := filepath.Join(filepath.Dir(issuerDir), "provider_url")
+				err := os.Rename(issuerDir, newIsserDir)
+				if err != nil {
+					require.ErrorIs(t, err, os.ErrNotExist, "Teardown: Failed to rename token directory")
+					t.Logf("Failed to rename token directory: %v", err)
+				}
+			}
+
+			golden.CheckOrUpdateFileTree(t, outDir)
+		})
+	}
+}
+
+// Due to ordering restrictions, this test can not be run in parallel, otherwise the routines would not be ordered as expected.
+func TestConcurrentIsAuthenticated(t *testing.T) {
+	tests := map[string]struct {
+		firstCallDelay        int
+		secondCallDelay       int
+		ownerAllowed          bool
+		allUsersAllowed       bool
+		firstUserBecomesOwner bool
+
+		timeBetween time.Duration
+	}{
+		"First_auth_starts_and_finishes_before_second": {
+			secondCallDelay: 1,
+			timeBetween:     2 * time.Second,
+			allUsersAllowed: true,
+		},
+		"First_auth_starts_first_but_second_finishes_first": {
+			firstCallDelay:  3,
+			timeBetween:     time.Second,
+			allUsersAllowed: true,
+		},
+		"First_auth_starts_first_then_second_starts_and_first_finishes": {
+			firstCallDelay:  2,
+			secondCallDelay: 3,
+			timeBetween:     time.Second,
+			allUsersAllowed: true,
+		},
+		"First_auth_starts_first_but_second_finishes_first_and_is_registered_as_the_owner": {
+			firstCallDelay:        3,
+			timeBetween:           time.Second,
+			ownerAllowed:          true,
+			firstUserBecomesOwner: true,
+		},
+	}
+
+	for name, tc := range tests {
+		t.Run(name, func(t *testing.T) {
+			outDir := t.TempDir()
+			dataDir := filepath.Join(outDir, "data")
+			err := os.Mkdir(dataDir, 0700)
+			require.NoError(t, err, "Setup: Mkdir should not have returned an error")
+
+			username1 := "user1@example.com"
+			username2 := "user2@example.com"
+
+			b := newBrokerForTests(t, &brokerForTestConfig{
+				Config:                broker.Config{DataDir: dataDir},
+				allUsersAllowed:       tc.allUsersAllowed,
+				ownerAllowed:          tc.ownerAllowed,
+				firstUserBecomesOwner: tc.firstUserBecomesOwner,
+				firstCallDelay:        tc.firstCallDelay,
+				secondCallDelay:       tc.secondCallDelay,
+				tokenHandlerOptions: &testutils.TokenHandlerOptions{
+					IDTokenClaims: []map[string]interface{}{
+						{"sub": "user1", "name": "user1", "email": username1},
+						{"sub": "user2", "name": "user2", "email": username2},
+					},
+				},
+			})
+
+			firstSession, firstKey := newSessionForTests(t, b, username1, "")
+			firstToken := tokenOptions{username: username1}
+			generateAndStoreCachedInfo(t, firstToken, b.TokenPathForSession(firstSession))
+			err = password.HashAndStorePassword("password", b.PasswordFilepathForSession(firstSession))
+			require.NoError(t, err, "Setup: HashAndStorePassword should not have returned an error")
+
+			secondSession, secondKey := newSessionForTests(t, b, username2, "")
+			secondToken := tokenOptions{username: username2}
+			generateAndStoreCachedInfo(t, secondToken, b.TokenPathForSession(secondSession))
+			err = password.HashAndStorePassword("password", b.PasswordFilepathForSession(secondSession))
+			require.NoError(t, err, "Setup: HashAndStorePassword should not have returned an error")
+
+			firstCallDone := make(chan struct{})
+			go func() {
+				t.Logf("%s: First auth starting", t.Name())
+				defer close(firstCallDone)
+
+				updateAuthModes(t, b, firstSession, authmodes.Password)
+
+				secret := encryptSecret(t, "password", firstKey)
+				authData := fmt.Sprintf(`{"%s":"%s"}`, broker.AuthDataSecret, secret)
+
+				access, data, err := b.IsAuthenticated(firstSession, authData)
+				require.True(t, json.Valid([]byte(data)), "IsAuthenticated returned data must be a valid JSON")
+
+				got := isAuthenticatedResponse{Access: access, Data: data, Err: fmt.Sprint(err)}
+				out, err := yaml.Marshal(got)
+				require.NoError(t, err, "Failed to marshal first response")
+
+				err = os.WriteFile(filepath.Join(outDir, "first_auth"), out, 0600)
+				require.NoError(t, err, "Failed to write first response")
+
+				t.Logf("%s: First auth done", t.Name())
+			}()
+
+			time.Sleep(tc.timeBetween)
+
+			secondCallDone := make(chan struct{})
+			go func() {
+				t.Logf("%s: Second auth starting", t.Name())
+				defer close(secondCallDone)
+
+				updateAuthModes(t, b, secondSession, authmodes.Password)
+
+				secret := encryptSecret(t, "password", secondKey)
+				authData := fmt.Sprintf(`{"%s":"%s"}`, broker.AuthDataSecret, secret)
+
+				access, data, err := b.IsAuthenticated(secondSession, authData)
+				require.True(t, json.Valid([]byte(data)), "IsAuthenticated returned data must be a valid JSON")
+
+				got := isAuthenticatedResponse{Access: access, Data: data, Err: fmt.Sprint(err)}
+				out, err := yaml.Marshal(got)
+				require.NoError(t, err, "Failed to marshal second response")
+
+				err = os.WriteFile(filepath.Join(outDir, "second_auth"), out, 0600)
+				require.NoError(t, err, "Failed to write second response")
+
+				t.Logf("%s: Second auth done", t.Name())
+			}()
+
+			<-firstCallDone
+			<-secondCallDone
+
+			for _, sessionID := range []string{firstSession, secondSession} {
+				// Ensure that the token content is generic to avoid golden file conflicts
+				if _, err := os.Stat(b.TokenPathForSession(sessionID)); err == nil {
+					err := os.WriteFile(b.TokenPathForSession(sessionID), []byte("Definitely a token"), 0600)
+					require.NoError(t, err, "Teardown: Failed to write generic token file")
+				}
+				passwordPath := b.PasswordFilepathForSession(sessionID)
+				if _, err := os.Stat(passwordPath); err == nil {
+					err := os.WriteFile(passwordPath, []byte("Definitely a hashed password"), 0600)
+					require.NoError(t, err, "Teardown: Failed to write generic password file")
+				}
+			}
+
+			// Ensure that the directory structure is generic to avoid golden file conflicts
+			issuerDataDir := filepath.Dir(b.UserDataDirForSession(firstSession))
+			if _, err := os.Stat(issuerDataDir); err == nil {
+				err := os.Rename(issuerDataDir, filepath.Join(filepath.Dir(issuerDataDir), "provider_url"))
+				if err != nil {
+					require.ErrorIs(t, err, os.ErrNotExist, "Teardown: Failed to rename issuer data directory")
+					t.Logf("Failed to rename issuer data directory: %v", err)
+				}
+			}
+			golden.CheckOrUpdateFileTree(t, outDir)
+		})
+	}
+}
+
+func TestIsAuthenticatedAllowedUsersConfig(t *testing.T) {
+	t.Parallel()
+
+	u1 := "u1"
+	u2 := "u2"
+	u3 := "U3"
+	allUsers := []string{u1, u2, u3}
+
+	idTokenClaims := []map[string]interface{}{}
+	for _, uname := range allUsers {
+		idTokenClaims = append(idTokenClaims, map[string]interface{}{"sub": "user", "name": "user", "email": uname})
+	}
+
+	tests := map[string]struct {
+		allowedUsers          map[string]struct{}
+		owner                 string
+		ownerAllowed          bool
+		allUsersAllowed       bool
+		firstUserBecomesOwner bool
+
+		wantAllowedUsers   []string
+		wantUnallowedUsers []string
+	}{
+		"No_users_allowed": {
+			wantUnallowedUsers: allUsers,
+		},
+		"No_users_allowed_when_owner_is_allowed_but_not_set": {
+			ownerAllowed:       true,
+			wantUnallowedUsers: allUsers,
+		},
+		"No_users_allowed_when_owner_is_set_but_not_allowed": {
+			owner:              u1,
+			wantUnallowedUsers: allUsers,
+		},
+
+		"All_users_are_allowed": {
+			allUsersAllowed:  true,
+			wantAllowedUsers: allUsers,
+		},
+		"Only_owner_allowed": {
+			ownerAllowed:       true,
+			owner:              u1,
+			wantAllowedUsers:   []string{u1},
+			wantUnallowedUsers: []string{u2, u3},
+		},
+		"Only_first_user_allowed": {
+			ownerAllowed:          true,
+			firstUserBecomesOwner: true,
+			wantAllowedUsers:      []string{u1},
+			wantUnallowedUsers:    []string{u2, u3},
+		},
+		"Specific_users_allowed": {
+			allowedUsers:       map[string]struct{}{u1: {}, u2: {}},
+			wantAllowedUsers:   []string{u1, u2},
+			wantUnallowedUsers: []string{u3},
+		},
+		"Specific_users_and_owner": {
+			ownerAllowed:       true,
+			allowedUsers:       map[string]struct{}{u1: {}},
+			owner:              u2,
+			wantAllowedUsers:   []string{u1, u2},
+			wantUnallowedUsers: []string{u3},
+		},
+		"Usernames_are_normalized": {
+			ownerAllowed:       true,
+			allowedUsers:       map[string]struct{}{u3: {}},
+			owner:              strings.ToLower(u3),
+			wantAllowedUsers:   []string{u3},
+			wantUnallowedUsers: []string{u1, u2},
+		},
+	}
+
+	for name, tc := range tests {
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+			outDir := t.TempDir()
+			dataDir := filepath.Join(outDir, "data")
+			err := os.Mkdir(dataDir, 0700)
+			require.NoError(t, err, "Setup: Mkdir should not have returned an error")
+
+			b := newBrokerForTests(t, &brokerForTestConfig{
+				Config:                broker.Config{DataDir: dataDir},
+				allowedUsers:          tc.allowedUsers,
+				owner:                 tc.owner,
+				ownerAllowed:          tc.ownerAllowed,
+				allUsersAllowed:       tc.allUsersAllowed,
+				firstUserBecomesOwner: tc.firstUserBecomesOwner,
+				tokenHandlerOptions: &testutils.TokenHandlerOptions{
+					IDTokenClaims: idTokenClaims,
+				},
+			})
+
+			for _, u := range allUsers {
+				sessionID, key := newSessionForTests(t, b, u, "")
+				token := tokenOptions{username: u}
+				generateAndStoreCachedInfo(t, token, b.TokenPathForSession(sessionID))
+				err = password.HashAndStorePassword("password", b.PasswordFilepathForSession(sessionID))
+				require.NoError(t, err, "Setup: HashAndStorePassword should not have returned an error")
+
+				updateAuthModes(t, b, sessionID, authmodes.Password)
+
+				secret := encryptSecret(t, "password", key)
+				authData := fmt.Sprintf(`{"%s":"%s"}`, broker.AuthDataSecret, secret)
+
+				access, data, err := b.IsAuthenticated(sessionID, authData)
+				require.True(t, json.Valid([]byte(data)), "IsAuthenticated returned data must be a valid JSON")
+				require.NoError(t, err)
+				if slices.Contains(tc.wantAllowedUsers, u) {
+					require.Equal(t, broker.AuthGranted, access, "authentication failed")
+					continue
+				}
+				if slices.Contains(tc.wantUnallowedUsers, u) {
+					require.Equal(t, broker.AuthDenied, access, "authentication failed")
+					continue
+				}
+				t.Fatalf("user %s is not in the allowed or unallowed users list", u)
+			}
+		})
+	}
+}
+
+func TestCancelIsAuthenticated(t *testing.T) {
+	t.Parallel()
+
+	b := newBrokerForTests(t, &brokerForTestConfig{
+		customHandlers: map[string]testutils.EndpointHandler{
+			"/token": testutils.HangingHandler(3 * time.Second),
+		},
+	})
+	sessionID, _ := newSessionForTests(t, b, "", "")
+
+	updateAuthModes(t, b, sessionID, authmodes.DeviceQr)
+
+	stopped := make(chan struct{})
+	go func() {
+		defer close(stopped)
+		_, _, err := b.IsAuthenticated(sessionID, `{}`)
+		require.Error(t, err, "IsAuthenticated should have returned an error")
+	}()
+
+	// Wait for the call to hang
+	time.Sleep(50 * time.Millisecond)
+
+	b.CancelIsAuthenticated(sessionID)
+	<-stopped
+}
+
+func TestEndSession(t *testing.T) {
+	t.Parallel()
+
+	b := newBrokerForTests(t, &brokerForTestConfig{
+		issuerURL: defaultIssuerURL,
+	})
+
+	sessionID, _ := newSessionForTests(t, b, "", "")
+
+	// Try to end a session that does not exist
+	err := b.EndSession("nonexistent")
+	require.Error(t, err, "EndSession should have returned an error when ending a nonexistent session")
+
+	// End a session that exists
+	err = b.EndSession(sessionID)
+	require.NoError(t, err, "EndSession should not have returned an error when ending an existent session")
+}
+
+func TestUserPreCheck(t *testing.T) {
+	t.Parallel()
+
+	tests := map[string]struct {
+		username        string
+		allowedSuffixes []string
+		homePrefix      string
+	}{
+		"Successfully_allow_username_with_matching_allowed_suffix": {
+			username:        "user@allowed",
+			allowedSuffixes: []string{"@allowed"}},
+		"Successfully_allow_username_that_matches_at_least_one_allowed_suffix": {
+			username:        "user@allowed",
+			allowedSuffixes: []string{"@other", "@something", "@allowed"},
+		},
+		"Successfully_allow_username_if_suffix_is_allow_all": {
+			username:        "user@doesnotmatter",
+			allowedSuffixes: []string{"*"},
+		},
+		"Successfully_allow_username_if_suffix_has_asterisk": {
+			username:        "user@allowed",
+			allowedSuffixes: []string{"*@allowed"},
+		},
+		"Successfully_allow_username_ignoring_empty_string_in_config": {
+			username:        "user@allowed",
+			allowedSuffixes: []string{"@anothersuffix", "", "@allowed"},
+		},
+		"Return_userinfo_with_correct_homedir_after_precheck": {
+			username:        "user@allowed",
+			allowedSuffixes: []string{"@allowed"},
+			homePrefix:      "/home/allowed/",
+		},
+
+		"Empty_userinfo_if_username_does_not_match_allowed_suffix": {
+			username:        "user@notallowed",
+			allowedSuffixes: []string{"@allowed"},
+		},
+		"Empty_userinfo_if_username_does_not_match_any_of_the_allowed_suffixes": {
+			username:        "user@notallowed",
+			allowedSuffixes: []string{"@other", "@something", "@allowed", ""},
+		},
+		"Empty_userinfo_if_no_allowed_suffixes_are_provided": {
+			username: "user@allowed",
+		},
+		"Empty_userinfo_if_allowed_suffixes_has_only_empty_string": {
+			username:        "user@allowed",
+			allowedSuffixes: []string{""},
+		},
+	}
+	for name, tc := range tests {
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			b := newBrokerForTests(t, &brokerForTestConfig{
+				issuerURL:          defaultIssuerURL,
+				homeBaseDir:        tc.homePrefix,
+				allowedSSHSuffixes: tc.allowedSuffixes,
+			})
+
+			got, err := b.UserPreCheck(tc.username)
+			require.NoError(t, err, "UserPreCheck should not have returned an error")
+
+			golden.CheckOrUpdate(t, got)
+		})
+	}
+}
+
+func TestMain(m *testing.M) {
+	log.SetLevel(log.DebugLevel)
+
+	var cleanup func()
+	defaultIssuerURL, cleanup = testutils.StartMockProviderServer("", nil)
+	defer cleanup()
+
+	m.Run()
+}
diff --git a/authd-oidc-brokers/internal/broker/config.go b/authd-oidc-brokers/internal/broker/config.go
new file mode 100644
index 0000000000..68b7753f45
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/config.go
@@ -0,0 +1,316 @@
+package broker
+
+import (
+	"embed"
+	"errors"
+	"fmt"
+	"html/template"
+	"io/fs"
+	"os"
+	"path/filepath"
+	"strings"
+	"sync"
+
+	"gopkg.in/ini.v1"
+)
+
+// Configuration sections and keys.
+const (
+	// forceProviderAuthenticationKey is the key in the config file for the option to force provider authentication during login.
+	forceProviderAuthenticationKey = "force_provider_authentication"
+
+	// oidcSection is the section name in the config file for the OIDC specific configuration.
+	oidcSection = "oidc"
+	// issuerKey is the key in the config file for the issuer.
+	issuerKey = "issuer"
+	// clientIDKey is the key in the config file for the client ID.
+	clientIDKey = "client_id"
+	// clientSecret is the optional client secret for this client.
+	clientSecret = "client_secret"
+	// extraScopesKey is the key in the config file for extra OIDC scopes.
+	extraScopesKey = "extra_scopes"
+
+	// entraIDSection is the section name in the config file for Microsoft Entra ID specific configuration.
+	entraIDSection = "msentraid"
+	// registerDeviceKey is the key in the config file for the setting that enables automatic device registration.
+	registerDeviceKey = "register_device"
+
+	// usersSection is the section name in the config file for the users and broker specific configuration.
+	usersSection = "users"
+	// allowedUsersKey is the key in the config file for the users that are allowed to access the machine.
+	allowedUsersKey = "allowed_users"
+	// ownerKey is the key in the config file for the owner of the machine.
+	ownerKey = "owner"
+	// homeDirKey is the key in the config file for the home directory prefix.
+	homeDirKey = "home_base_dir"
+	// sshSuffixesKey is the key in the config file for the SSH allowed suffixes.
+	sshSuffixesKey = "ssh_allowed_suffixes_first_auth"
+	// sshSuffixesKeyOld is the old key in the config file for the SSH allowed suffixes. It should be removed later.
+	sshSuffixesKeyOld = "ssh_allowed_suffixes"
+	// extraGroupsKey is the key in the config file for the extra groups to add to each authd user.
+	extraGroupsKey = "extra_groups"
+	// ownerExtraGroupsKey is the key in the config file for the extra groups to add to the owner.
+	ownerExtraGroupsKey = "owner_extra_groups"
+	// allUsersKeyword is the keyword for the `allowed_users` key that allows access to all users.
+	allUsersKeyword = "ALL"
+	// ownerUserKeyword is the keyword for the `allowed_users` key that allows access to the owner.
+	ownerUserKeyword = "OWNER"
+
+	// ownerAutoRegistrationConfigPath is the name of the file that will be auto-generated to register the owner.
+	ownerAutoRegistrationConfigPath     = "20-owner-autoregistration.conf"
+	ownerAutoRegistrationConfigTemplate = "templates/20-owner-autoregistration.conf.tmpl"
+)
+
+var (
+	//go:embed templates/20-owner-autoregistration.conf.tmpl
+	ownerAutoRegistrationConfig embed.FS
+)
+
+type provider interface {
+	NormalizeUsername(username string) string
+}
+
+type templateEnv struct {
+	Owner string
+}
+
+type userConfig struct {
+	clientID     string
+	clientSecret string
+	issuerURL    string
+
+	forceProviderAuthentication bool
+	registerDevice              bool
+
+	allowedUsers          map[string]struct{}
+	allUsersAllowed       bool
+	ownerAllowed          bool
+	firstUserBecomesOwner bool
+	owner                 string
+	ownerMutex            *sync.RWMutex
+	homeBaseDir           string
+	allowedSSHSuffixes    []string
+	extraGroups           []string
+	ownerExtraGroups      []string
+	extraScopes           []string
+
+	provider provider
+}
+
+// GetDropInDir takes the broker configuration path and returns the drop in dir path.
+func GetDropInDir(cfgPath string) string {
+	return cfgPath + ".d"
+}
+
+func readDropInFiles(cfgPath string) ([]any, error) {
+	// Check if a .d directory exists and return the paths to the files in it.
+	dropInDir := GetDropInDir(cfgPath)
+	files, err := os.ReadDir(dropInDir)
+	if errors.Is(err, fs.ErrNotExist) {
+		return nil, nil
+	}
+	if err != nil {
+		return nil, err
+	}
+
+	var dropInFiles []any
+	// files is empty if the directory does not exist
+	for _, file := range files {
+		if file.IsDir() {
+			continue
+		}
+
+		dropInFile, err := os.ReadFile(filepath.Join(dropInDir, file.Name()))
+		if err != nil {
+			return nil, fmt.Errorf("could not read drop-in file %q: %v", file.Name(), err)
+		}
+		dropInFiles = append(dropInFiles, dropInFile)
+	}
+
+	return dropInFiles, nil
+}
+
+func (uc *userConfig) populateUsersConfig(users *ini.Section) {
+	uc.ownerMutex.Lock()
+	defer uc.ownerMutex.Unlock()
+
+	if users == nil {
+		// The default behavior is to allow only the owner
+		uc.ownerAllowed = true
+		uc.firstUserBecomesOwner = true
+		return
+	}
+
+	uc.homeBaseDir = users.Key(homeDirKey).String()
+
+	suffixesKey := sshSuffixesKey
+	// If we don't have the new key, we should try reading the old one instead.
+	if !users.HasKey(sshSuffixesKey) {
+		suffixesKey = sshSuffixesKeyOld
+	}
+	uc.allowedSSHSuffixes = strings.Split(users.Key(suffixesKey).String(), ",")
+
+	if uc.allowedUsers == nil {
+		uc.allowedUsers = make(map[string]struct{})
+	}
+
+	allowedUsers := users.Key(allowedUsersKey).Strings(",")
+	if len(allowedUsers) == 0 {
+		allowedUsers = append(allowedUsers, ownerUserKeyword)
+	}
+
+	for _, user := range allowedUsers {
+		if user == allUsersKeyword {
+			uc.allUsersAllowed = true
+			continue
+		}
+		if user == ownerUserKeyword {
+			uc.ownerAllowed = true
+			if !users.HasKey(ownerKey) {
+				// If owner is unset, then the first user becomes owner
+				uc.firstUserBecomesOwner = true
+			}
+			continue
+		}
+
+		uc.allowedUsers[uc.provider.NormalizeUsername(user)] = struct{}{}
+	}
+
+	// We need to read the owner key after we call HasKey, because the key is created
+	// when we call the "Key" function and we can't distinguish between empty and unset.
+	uc.owner = uc.provider.NormalizeUsername(users.Key(ownerKey).String())
+
+	uc.extraGroups = users.Key(extraGroupsKey).Strings(",")
+	uc.ownerExtraGroups = users.Key(ownerExtraGroupsKey).Strings(",")
+}
+
+// parseConfigFromPath parses the config file and returns a map with the configuration keys and values.
+func parseConfigFromPath(cfgPath string, p provider) (userConfig, error) {
+	cfgFile, err := os.ReadFile(cfgPath)
+	if err != nil {
+		return userConfig{}, fmt.Errorf("could not open config file %q: %v", cfgPath, err)
+	}
+
+	dropInFiles, err := readDropInFiles(cfgPath)
+	if err != nil {
+		return userConfig{}, err
+	}
+
+	return parseConfig(cfgFile, dropInFiles, p)
+}
+
+// parseConfig parses the config file and returns a userConfig struct with the configuration keys and values.
+// It also checks if the keys contain any placeholders and returns an error if they do.
+func parseConfig(cfgContent []byte, dropInContent []any, p provider) (userConfig, error) {
+	cfg := userConfig{provider: p, ownerMutex: &sync.RWMutex{}}
+
+	iniCfg, err := ini.Load(cfgContent, dropInContent...)
+	if err != nil {
+		return userConfig{}, err
+	}
+
+	// Check if any of the keys still contain the placeholders.
+	for _, section := range iniCfg.Sections() {
+		for _, key := range section.Keys() {
+			if strings.Contains(key.Value(), "<") && strings.Contains(key.Value(), ">") {
+				err = errors.Join(err, fmt.Errorf("found invalid character in section %q, key %q", section.Name(), key.Name()))
+			}
+		}
+	}
+	if err != nil {
+		return userConfig{}, fmt.Errorf("config file has invalid values, did you edit the config file?\n%w", err)
+	}
+
+	oidc := iniCfg.Section(oidcSection)
+	if oidc != nil {
+		cfg.issuerURL = oidc.Key(issuerKey).String()
+		cfg.clientID = oidc.Key(clientIDKey).String()
+		cfg.clientSecret = oidc.Key(clientSecret).String()
+		cfg.extraScopes = oidc.Key(extraScopesKey).Strings(",")
+
+		if oidc.HasKey(forceProviderAuthenticationKey) {
+			cfg.forceProviderAuthentication, err = oidc.Key(forceProviderAuthenticationKey).Bool()
+			if err != nil {
+				return userConfig{}, fmt.Errorf("error parsing '%s': %w", forceProviderAuthenticationKey, err)
+			}
+		}
+	}
+
+	entraID := iniCfg.Section(entraIDSection)
+	if entraID != nil && entraID.HasKey(registerDeviceKey) {
+		cfg.registerDevice, err = entraID.Key(registerDeviceKey).Bool()
+		if err != nil {
+			return userConfig{}, fmt.Errorf("error parsing '%s': %w", registerDeviceKey, err)
+		}
+	}
+
+	cfg.populateUsersConfig(iniCfg.Section(usersSection))
+
+	return cfg, nil
+}
+
+func (uc *userConfig) userNameIsAllowed(userName string) bool {
+	uc.ownerMutex.RLock()
+	defer uc.ownerMutex.RUnlock()
+
+	// The user is allowed to log in if:
+	// - ALL users are allowed
+	// - the user's name is in the list of allowed_users
+	// - OWNER is in the allowed_users list and the user is the owner of the machine
+	// - The user will be registered as the owner
+	if uc.allUsersAllowed {
+		return true
+	}
+	if _, ok := uc.allowedUsers[userName]; ok {
+		return true
+	}
+	if uc.ownerAllowed && uc.owner == userName {
+		return true
+	}
+
+	return uc.shouldRegisterOwner()
+}
+
+// shouldRegisterOwner returns true if the first user to log in should be registered as the owner.
+// Only call this with the ownerMutex locked.
+func (uc *userConfig) shouldRegisterOwner() bool {
+	return uc.ownerAllowed && uc.firstUserBecomesOwner && uc.owner == ""
+}
+
+func (uc *userConfig) registerOwner(cfgPath, userName string) error {
+	// We need to lock here to avoid a race condition where two users log in at the same time, causing both to be
+	// considered the owner.
+	uc.ownerMutex.Lock()
+	defer uc.ownerMutex.Unlock()
+
+	if cfgPath == "" {
+		uc.owner = uc.provider.NormalizeUsername(userName)
+		uc.firstUserBecomesOwner = false
+		return nil
+	}
+
+	p := filepath.Join(GetDropInDir(cfgPath), ownerAutoRegistrationConfigPath)
+
+	templateName := filepath.Base(ownerAutoRegistrationConfigTemplate)
+	t, err := template.New(templateName).ParseFS(ownerAutoRegistrationConfig, ownerAutoRegistrationConfigTemplate)
+	if err != nil {
+		return fmt.Errorf("failed to open autoregistration template: %v", err)
+	}
+
+	f, err := os.OpenFile(p, os.O_RDWR|os.O_CREATE|os.O_TRUNC, 0600)
+	if err != nil {
+		return fmt.Errorf("failed to create owner registration file: %v", err)
+	}
+	defer f.Close()
+
+	if err := t.Execute(f, templateEnv{Owner: userName}); err != nil {
+		return fmt.Errorf("failed to write owner registration file: %v", err)
+	}
+
+	// We set the owner after we create the autoregistration file, so that in case of an error
+	// the owner is not updated.
+	uc.owner = uc.provider.NormalizeUsername(userName)
+	uc.firstUserBecomesOwner = false
+
+	return nil
+}
diff --git a/authd-oidc-brokers/internal/broker/config_test.go b/authd-oidc-brokers/internal/broker/config_test.go
new file mode 100644
index 0000000000..15d3538d19
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/config_test.go
@@ -0,0 +1,363 @@
+package broker
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+	"reflect"
+	"strings"
+	"sync"
+	"testing"
+	"unsafe"
+
+	"github.com/canonical/authd/authd-oidc-brokers/internal/testutils"
+	"github.com/canonical/authd/authd-oidc-brokers/internal/testutils/golden"
+	"github.com/stretchr/testify/require"
+)
+
+var configTypes = map[string]string{
+	"valid": `
+[oidc]
+issuer = https://issuer.url.com
+client_id = client_id
+`,
+
+	"valid+optional": `
+[oidc]
+issuer = https://issuer.url.com
+client_id = client_id
+force_provider_authentication = true
+extra_scopes = groups,offline_access, some_other_scope
+
+[users]
+home_base_dir = /home
+allowed_ssh_suffixes = @issuer.url.com
+`,
+
+	"invalid_boolean_value": `
+[oidc]
+issuer = https://issuer.url.com
+client_id = client_id
+force_provider_authentication = invalid
+`,
+
+	"singles": `
+[oidc]
+issuer = https://ISSUER_URL>
+client_id = <CLIENT_ID
+`,
+
+	"template": `
+[oidc]
+issuer = https://<ISSUER_URL>
+client_id = <CLIENT_ID>
+`,
+
+	"overwrite_lower_precedence": `
+[oidc]
+issuer = https://lower-precedence-issuer.url.com
+client_id = lower_precedence_client_id
+`,
+
+	"overwrite_higher_precedence": `
+[oidc]
+issuer = https://higher-precedence-issuer.url.com
+`,
+}
+
+func TestParseConfig(t *testing.T) {
+	t.Parallel()
+	p := &testutils.MockProvider{}
+	ignoredFields := map[string]struct{}{"provider": {}, "ownerMutex": {}}
+
+	tests := map[string]struct {
+		configType string
+		dropInType string
+
+		wantErr bool
+	}{
+		"Successfully_parse_config_file":                      {},
+		"Successfully_parse_config_file_with_optional_values": {configType: "valid+optional"},
+		"Successfully_parse_config_with_drop_in_files":        {dropInType: "valid"},
+
+		"Do_not_fail_if_values_contain_a_single_template_delimiter": {configType: "singles"},
+
+		"Error_if_file_does_not_exist":             {configType: "inexistent", wantErr: true},
+		"Error_if_file_is_unreadable":              {configType: "unreadable", wantErr: true},
+		"Error_if_file_is_not_updated":             {configType: "template", wantErr: true},
+		"Error_if_drop_in_directory_is_unreadable": {dropInType: "unreadable-dir", wantErr: true},
+		"Error_if_drop_in_file_is_unreadable":      {dropInType: "unreadable-file", wantErr: true},
+		"Error_if_config_contains_invalid_values":  {configType: "invalid_boolean_value", wantErr: true},
+	}
+	for name, tc := range tests {
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			confPath := filepath.Join(t.TempDir(), "broker.conf")
+
+			if tc.configType == "" {
+				tc.configType = "valid"
+			}
+			err := os.WriteFile(confPath, []byte(configTypes[tc.configType]), 0600)
+			require.NoError(t, err, "Setup: Failed to write config file")
+
+			switch tc.configType {
+			case "inexistent":
+				err = os.Remove(confPath)
+				require.NoError(t, err, "Setup: Failed to remove config file")
+			case "unreadable":
+				err = os.Chmod(confPath, 0000)
+				require.NoError(t, err, "Setup: Failed to make config file unreadable")
+			}
+
+			dropInDir := GetDropInDir(confPath)
+			if tc.dropInType != "" {
+				err = os.Mkdir(dropInDir, 0700)
+				require.NoError(t, err, "Setup: Failed to create drop-in directory")
+			}
+
+			switch tc.dropInType {
+			case "valid":
+				// Create multiple drop-in files to test that they are loaded in the correct order.
+				err = os.WriteFile(filepath.Join(dropInDir, "00-drop-in.conf"), []byte(configTypes["overwrite_lower_precedence"]), 0600)
+				require.NoError(t, err, "Setup: Failed to write drop-in file")
+				err = os.WriteFile(filepath.Join(dropInDir, "01-drop-in.conf"), []byte(configTypes["overwrite_higher_precedence"]), 0600)
+				require.NoError(t, err, "Setup: Failed to write drop-in file")
+				// Create the main config file, to test that the options which are not overwritten by the drop-in files
+				// are still present.
+				err = os.WriteFile(confPath, []byte(configTypes["valid+optional"]), 0600)
+				require.NoError(t, err, "Setup: Failed to write config file")
+			case "unreadable-dir":
+				err = os.Chmod(dropInDir, 0000)
+				require.NoError(t, err, "Setup: Failed to make drop-in directory unreadable")
+			case "unreadable-file":
+				err = os.WriteFile(filepath.Join(dropInDir, "00-drop-in.conf"), []byte(configTypes["valid"]), 0000)
+				require.NoError(t, err, "Setup: Failed to make drop-in file unreadable")
+			}
+
+			cfg, err := parseConfigFromPath(confPath, p)
+			if tc.wantErr {
+				require.Error(t, err)
+				return
+			}
+			require.NoError(t, err)
+			require.Equal(t, cfg.provider, p)
+
+			outDir := t.TempDir()
+			// Write the names and values of all fields in the config to a file. We can't use the json or yaml
+			// packages because they can't access unexported fields.
+			var fields []string
+			val := reflect.ValueOf(&cfg).Elem()
+			typ := reflect.TypeOf(&cfg).Elem()
+			for i := 0; i < typ.NumField(); i++ {
+				field := typ.Field(i)
+				if _, ok := ignoredFields[field.Name]; ok {
+					continue
+				}
+				fieldValue := val.Field(i)
+				if field.PkgPath != "" {
+					//nolint: gosec // We are using unsafe to access unexported fields for testing purposes
+					fieldValue = reflect.NewAt(fieldValue.Type(), unsafe.Pointer(fieldValue.UnsafeAddr())).Elem()
+				}
+				fields = append(fields, fmt.Sprintf("%s=%v", field.Name, fieldValue))
+			}
+			err = os.WriteFile(filepath.Join(outDir, "config.txt"), []byte(strings.Join(fields, "\n")), 0600)
+			require.NoError(t, err)
+
+			golden.CheckOrUpdateFileTree(t, outDir)
+		})
+	}
+}
+
+var testParseUserConfigTypes = map[string]string{
+	"All_are_allowed": `
+[oidc]
+issuer = https://issuer.url.com
+client_id = client_id
+
+[users]
+allowed_users = ALL
+owner = machine_owner
+home_base_dir = /home
+allowed_ssh_suffixes_first_auth = @issuer.url.com
+`,
+	"Only_owner_is_allowed": `
+[oidc]
+issuer = https://issuer.url.com
+client_id = client_id
+
+[users]
+allowed_users = OWNER
+owner = machine_owner
+home_base_dir = /home
+allowed_ssh_suffixes_first_auth = @issuer.url.com
+`,
+	"By_default_only_owner_is_allowed": `
+[oidc]
+issuer = https://issuer.url.com
+client_id = client_id
+
+[users]
+owner = machine_owner
+home_base_dir = /home
+allowed_ssh_suffixes_first_auth = @issuer.url.com
+`,
+	"Only_owner_is_allowed_but_is_unset": `
+[oidc]
+issuer = https://issuer.url.com
+client_id = client_id
+
+[users]
+home_base_dir = /home
+allowed_ssh_suffixes_first_auth = @issuer.url.com
+`,
+	"Only_owner_is_allowed_but_is_empty": `
+[oidc]
+issuer = https://issuer.url.com
+client_id = client_id
+
+[users]
+owner =
+home_base_dir = /home
+allowed_ssh_suffixes_first_auth = @issuer.url.com
+`,
+	"Users_u1_and_u2_are_allowed": `
+[oidc]
+issuer = https://issuer.url.com
+client_id = client_id
+
+[users]
+allowed_users = u1,u2
+home_base_dir = /home
+allowed_ssh_suffixes_first_auth = @issuer.url.com
+`,
+	"Unset_owner_and_u1_is_allowed": `
+[oidc]
+issuer = https://issuer.url.com
+client_id = client_id
+
+[users]
+allowed_users = OWNER,u1
+home_base_dir = /home
+allowed_ssh_suffixes_first_auth = @issuer.url.com
+`,
+	"Set_owner_and_u1_is_allowed": `
+[oidc]
+issuer = https://issuer.url.com
+client_id = client_id
+
+[users]
+allowed_users = OWNER,u1
+owner = machine_owner
+home_base_dir = /home
+allowed_ssh_suffixes_first_auth = @issuer.url.com
+`,
+	"Support_old_suffixes_key": `
+[oidc]
+issuer = https://issuer.url.com
+client_id = client_id
+
+[users]
+allowed_users = ALL
+owner = machine_owner
+home_base_dir = /home
+allowed_ssh_suffixes = @issuer.url.com
+`,
+}
+
+func TestParseUserConfig(t *testing.T) {
+	t.Parallel()
+	p := &testutils.MockProvider{}
+
+	tests := map[string]struct {
+		wantAllUsersAllowed       bool
+		wantOwnerAllowed          bool
+		wantFirstUserBecomesOwner bool
+		wantOwner                 string
+		wantAllowedUsers          []string
+	}{
+		"All_are_allowed":                    {wantAllUsersAllowed: true, wantOwner: "machine_owner"},
+		"Only_owner_is_allowed":              {wantOwnerAllowed: true, wantOwner: "machine_owner"},
+		"By_default_only_owner_is_allowed":   {wantOwnerAllowed: true, wantOwner: "machine_owner"},
+		"Only_owner_is_allowed_but_is_unset": {wantOwnerAllowed: true, wantFirstUserBecomesOwner: true},
+		"Only_owner_is_allowed_but_is_empty": {wantOwnerAllowed: true},
+		"Users_u1_and_u2_are_allowed":        {wantAllowedUsers: []string{"u1", "u2"}},
+		"Unset_owner_and_u1_is_allowed": {
+			wantOwnerAllowed:          true,
+			wantFirstUserBecomesOwner: true,
+			wantAllowedUsers:          []string{"u1"},
+		},
+		"Set_owner_and_u1_is_allowed": {
+			wantOwnerAllowed: true,
+			wantOwner:        "machine_owner",
+			wantAllowedUsers: []string{"u1"},
+		},
+		"Support_old_suffixes_key": {wantAllUsersAllowed: true, wantOwner: "machine_owner"},
+	}
+	for name, tc := range tests {
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			outDir := t.TempDir()
+			confPath := filepath.Join(outDir, "broker.conf")
+
+			err := os.WriteFile(confPath, []byte(testParseUserConfigTypes[name]), 0600)
+			require.NoError(t, err, "Setup: Failed to write config file")
+
+			dropInDir := GetDropInDir(confPath)
+			err = os.Mkdir(dropInDir, 0700)
+			require.NoError(t, err, "Setup: Failed to create drop-in directory")
+
+			cfg, err := parseConfigFromPath(confPath, p)
+
+			// convert the allowed users array to a map
+			allowedUsersMap := map[string]struct{}{}
+			for _, k := range tc.wantAllowedUsers {
+				allowedUsersMap[k] = struct{}{}
+			}
+
+			require.Equal(t, tc.wantAllUsersAllowed, cfg.allUsersAllowed)
+			require.Equal(t, tc.wantOwnerAllowed, cfg.ownerAllowed)
+			require.Equal(t, tc.wantOwner, cfg.owner)
+			require.Equal(t, tc.wantFirstUserBecomesOwner, cfg.firstUserBecomesOwner)
+			require.Equal(t, allowedUsersMap, cfg.allowedUsers)
+
+			require.NoError(t, err)
+			golden.CheckOrUpdateFileTree(t, outDir)
+		})
+	}
+}
+
+func TestRegisterOwner(t *testing.T) {
+	p := &testutils.MockProvider{}
+	outDir := t.TempDir()
+	userName := "owner_name"
+	confPath := filepath.Join(outDir, "broker.conf")
+
+	err := os.WriteFile(confPath, []byte(configTypes["valid"]), 0600)
+	require.NoError(t, err, "Setup: Failed to write config file")
+
+	dropInDir := GetDropInDir(confPath)
+	err = os.Mkdir(dropInDir, 0700)
+	require.NoError(t, err, "Setup: Failed to create drop-in directory")
+
+	cfg := userConfig{firstUserBecomesOwner: true, ownerAllowed: true, provider: p, ownerMutex: &sync.RWMutex{}}
+	err = cfg.registerOwner(confPath, userName)
+	require.NoError(t, err)
+
+	require.Equal(t, cfg.owner, userName)
+	require.Equal(t, cfg.firstUserBecomesOwner, false)
+
+	f, err := os.Open(filepath.Join(dropInDir, "20-owner-autoregistration.conf"))
+	require.NoError(t, err, "failed to open 20-owner-autoregistration.conf")
+	defer f.Close()
+
+	golden.CheckOrUpdateFileTree(t, outDir)
+}
+
+func FuzzParseConfig(f *testing.F) {
+	p := &testutils.MockProvider{}
+	f.Fuzz(func(t *testing.T, a []byte) {
+		_, _ = parseConfig(a, nil, p)
+	})
+}
diff --git a/authd-oidc-brokers/internal/broker/consts.go b/authd-oidc-brokers/internal/broker/consts.go
new file mode 100644
index 0000000000..0365cf2f91
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/consts.go
@@ -0,0 +1,26 @@
+package broker
+
+// Broker responses.
+const (
+	// AuthGranted is the response when the authentication is granted.
+	AuthGranted = "granted"
+	// AuthDenied is the response when the authentication is denied.
+	AuthDenied = "denied"
+	// AuthCancelled is the response when the authentication is cancelled.
+	AuthCancelled = "cancelled"
+	// AuthRetry is the response when the authentication needs to be retried (another chance).
+	AuthRetry = "retry"
+	// AuthNext is the response when another MFA (including changing password) authentication is necessary.
+	AuthNext = "next"
+)
+
+// AuthReplies is the list of all possible authentication replies.
+var AuthReplies = []string{AuthGranted, AuthDenied, AuthCancelled, AuthRetry, AuthNext}
+
+const (
+	// AuthDataSecret is the key for the secret in the authentication data.
+	AuthDataSecret = "secret"
+	// AuthDataSecretOld is the old key for the secret in the authentication data, which is now deprecated
+	// TODO(UDENG-5844): Remove this once all authd installations use "secret" instead of "challenge".
+	AuthDataSecretOld = "challenge"
+)
diff --git a/authd-oidc-brokers/internal/broker/encrypt.go b/authd-oidc-brokers/internal/broker/encrypt.go
new file mode 100644
index 0000000000..5163d1b25e
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/encrypt.go
@@ -0,0 +1,40 @@
+package broker
+
+import (
+	"context"
+	"crypto/rsa"
+	"crypto/sha512"
+	"encoding/base64"
+	"errors"
+	"fmt"
+
+	"github.com/ubuntu/authd/log"
+)
+
+// decodeRawSecret extract the base64 secret and try to decrypt it with the private key.
+func decodeRawSecret(priv *rsa.PrivateKey, rawSecret string) (decoded string, err error) {
+	defer func() {
+		// Override the error so that we don't leak information. Also, abstract it for the user.
+		// We still log as error for the admin to get access.
+		if err != nil {
+			log.Errorf(context.Background(), "Error when decoding secret: %v", err)
+			err = errors.New("could not decode secret")
+		}
+	}()
+
+	if rawSecret == "" {
+		return "", nil
+	}
+
+	ciphertext, err := base64.StdEncoding.DecodeString(rawSecret)
+	if err != nil {
+		return "", err
+	}
+
+	plaintext, err := rsa.DecryptOAEP(sha512.New(), nil, priv, ciphertext, nil)
+	if err != nil {
+		return "", fmt.Errorf("could not decrypt secret: %v", err)
+	}
+
+	return string(plaintext), nil
+}
diff --git a/authd-oidc-brokers/internal/broker/export_test.go b/authd-oidc-brokers/internal/broker/export_test.go
new file mode 100644
index 0000000000..816d8209c3
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/export_test.go
@@ -0,0 +1,174 @@
+package broker
+
+import (
+	"sync"
+)
+
+func (cfg *Config) Init() {
+	cfg.ownerMutex = &sync.RWMutex{}
+}
+
+func (cfg *Config) SetClientID(clientID string) {
+	cfg.clientID = clientID
+}
+
+func (cfg *Config) SetIssuerURL(issuerURL string) {
+	cfg.issuerURL = issuerURL
+}
+
+func (cfg *Config) SetForceProviderAuthentication(value bool) {
+	cfg.forceProviderAuthentication = value
+}
+
+func (cfg *Config) SetRegisterDevice(value bool) {
+	cfg.registerDevice = value
+}
+
+func (cfg *Config) SetHomeBaseDir(homeBaseDir string) {
+	cfg.homeBaseDir = homeBaseDir
+}
+
+func (cfg *Config) SetAllowedUsers(allowedUsers map[string]struct{}) {
+	cfg.allowedUsers = allowedUsers
+}
+
+func (cfg *Config) SetOwner(owner string) {
+	cfg.ownerMutex.Lock()
+	defer cfg.ownerMutex.Unlock()
+
+	cfg.owner = owner
+}
+
+func (cfg *Config) SetFirstUserBecomesOwner(firstUserBecomesOwner bool) {
+	cfg.ownerMutex.Lock()
+	defer cfg.ownerMutex.Unlock()
+
+	cfg.firstUserBecomesOwner = firstUserBecomesOwner
+}
+
+func (cfg *Config) SetAllUsersAllowed(allUsersAllowed bool) {
+	cfg.allUsersAllowed = allUsersAllowed
+}
+
+func (cfg *Config) SetOwnerAllowed(ownerAllowed bool) {
+	cfg.ownerMutex.Lock()
+	defer cfg.ownerMutex.Unlock()
+
+	cfg.ownerAllowed = ownerAllowed
+}
+
+func (cfg *Config) SetExtraGroups(extraGroups []string) {
+	cfg.extraGroups = extraGroups
+}
+
+func (cfg *Config) SetOwnerExtraGroups(ownerExtraGroups []string) {
+	cfg.ownerExtraGroups = ownerExtraGroups
+}
+
+func (cfg *Config) SetAllowedSSHSuffixes(allowedSSHSuffixes []string) {
+	cfg.allowedSSHSuffixes = allowedSSHSuffixes
+}
+
+func (cfg *Config) SetProvider(provider provider) {
+	cfg.provider = provider
+}
+
+func (cfg *Config) ClientID() string {
+	return cfg.clientID
+}
+
+func (cfg *Config) IssuerURL() string {
+	return cfg.issuerURL
+}
+
+// TokenPathForSession returns the path to the token file for the given session.
+func (b *Broker) TokenPathForSession(sessionID string) string {
+	b.currentSessionsMu.Lock()
+	defer b.currentSessionsMu.Unlock()
+
+	session, ok := b.currentSessions[sessionID]
+	if !ok {
+		return ""
+	}
+
+	return session.tokenPath
+}
+
+// PasswordFilepathForSession returns the path to the password file for the given session.
+func (b *Broker) PasswordFilepathForSession(sessionID string) string {
+	b.currentSessionsMu.Lock()
+	defer b.currentSessionsMu.Unlock()
+
+	session, ok := b.currentSessions[sessionID]
+	if !ok {
+		return ""
+	}
+
+	return session.passwordPath
+}
+
+// UserDataDirForSession returns the path to the user data directory for the given session.
+func (b *Broker) UserDataDirForSession(sessionID string) string {
+	b.currentSessionsMu.Lock()
+	defer b.currentSessionsMu.Unlock()
+
+	session, ok := b.currentSessions[sessionID]
+	if !ok {
+		return ""
+	}
+
+	return session.userDataDir
+}
+
+// DataDir returns the path to the data directory for tests.
+func (b *Broker) DataDir() string {
+	return b.cfg.DataDir
+}
+
+// GetNextAuthModes returns the next auth mode of the specified session.
+func (b *Broker) GetNextAuthModes(sessionID string) []string {
+	b.currentSessionsMu.Lock()
+	defer b.currentSessionsMu.Unlock()
+
+	session, ok := b.currentSessions[sessionID]
+	if !ok {
+		return nil
+	}
+	return session.nextAuthModes
+}
+
+// SetNextAuthModes sets the next auth mode of the specified session.
+func (b *Broker) SetNextAuthModes(sessionID string, authModes []string) {
+	b.currentSessionsMu.Lock()
+	defer b.currentSessionsMu.Unlock()
+
+	session, ok := b.currentSessions[sessionID]
+	if !ok {
+		return
+	}
+
+	session.nextAuthModes = authModes
+	b.currentSessions[sessionID] = session
+}
+
+func (b *Broker) SetAvailableMode(sessionID, mode string) error {
+	s, err := b.getSession(sessionID)
+	if err != nil {
+		return err
+	}
+	s.authModes = []string{mode}
+
+	return b.updateSession(sessionID, s)
+}
+
+// IsOffline returns whether the given session is offline or an error if the session does not exist.
+func (b *Broker) IsOffline(sessionID string) (bool, error) {
+	session, err := b.getSession(sessionID)
+	if err != nil {
+		return false, err
+	}
+	return session.isOffline, nil
+}
+
+// MaxRequestDuration exposes the broker's maxRequestDuration for tests.
+const MaxRequestDuration = maxRequestDuration
diff --git a/authd-oidc-brokers/internal/broker/helper_test.go b/authd-oidc-brokers/internal/broker/helper_test.go
new file mode 100644
index 0000000000..eaf23aa0c1
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/helper_test.go
@@ -0,0 +1,302 @@
+package broker_test
+
+import (
+	"crypto/rand"
+	"crypto/rsa"
+	"crypto/sha512"
+	"crypto/x509"
+	"encoding/base64"
+	"os"
+	"path/filepath"
+	"testing"
+	"time"
+
+	"github.com/canonical/authd/authd-oidc-brokers/internal/broker"
+	"github.com/canonical/authd/authd-oidc-brokers/internal/broker/sessionmode"
+	"github.com/canonical/authd/authd-oidc-brokers/internal/providers"
+	"github.com/canonical/authd/authd-oidc-brokers/internal/providers/info"
+	"github.com/canonical/authd/authd-oidc-brokers/internal/testutils"
+	"github.com/canonical/authd/authd-oidc-brokers/internal/token"
+	"github.com/golang-jwt/jwt/v5"
+	"github.com/stretchr/testify/require"
+	"golang.org/x/oauth2"
+)
+
+type brokerForTestConfig struct {
+	broker.Config
+	issuerURL                   string
+	forceProviderAuthentication bool
+	registerDevice              bool
+	allowedUsers                map[string]struct{}
+	allUsersAllowed             bool
+	ownerAllowed                bool
+	firstUserBecomesOwner       bool
+	owner                       string
+	extraGroups                 []string
+	ownerExtraGroups            []string
+	homeBaseDir                 string
+	allowedSSHSuffixes          []string
+	provider                    providers.Provider
+
+	getGroupsFails             bool
+	supportsDeviceRegistration bool
+	firstCallDelay             int
+	secondCallDelay            int
+	getGroupsFunc              func() ([]info.Group, error)
+
+	listenAddress       string
+	tokenHandlerOptions *testutils.TokenHandlerOptions
+	customHandlers      map[string]testutils.EndpointHandler
+}
+
+// newBrokerForTests is a helper function to easily create a new broker for tests.
+func newBrokerForTests(t *testing.T, cfg *brokerForTestConfig) (b *broker.Broker) {
+	t.Helper()
+
+	cfg.Init()
+	if cfg.issuerURL != "" {
+		cfg.SetIssuerURL(cfg.issuerURL)
+	}
+	if cfg.forceProviderAuthentication {
+		cfg.SetForceProviderAuthentication(cfg.forceProviderAuthentication)
+	}
+	if cfg.registerDevice {
+		cfg.SetRegisterDevice(cfg.registerDevice)
+	}
+	if cfg.homeBaseDir != "" {
+		cfg.SetHomeBaseDir(cfg.homeBaseDir)
+	}
+	if cfg.allowedSSHSuffixes != nil {
+		cfg.SetAllowedSSHSuffixes(cfg.allowedSSHSuffixes)
+	}
+	if cfg.allowedUsers != nil {
+		cfg.SetAllowedUsers(cfg.allowedUsers)
+	}
+	if cfg.owner != "" {
+		cfg.SetOwner(cfg.owner)
+	}
+	if cfg.firstUserBecomesOwner != false {
+		cfg.SetFirstUserBecomesOwner(cfg.firstUserBecomesOwner)
+	}
+	if cfg.allUsersAllowed != false {
+		cfg.SetAllUsersAllowed(cfg.allUsersAllowed)
+	}
+	if cfg.ownerAllowed != false {
+		cfg.SetOwnerAllowed(cfg.ownerAllowed)
+	}
+	if cfg.extraGroups != nil {
+		cfg.SetExtraGroups(cfg.extraGroups)
+	}
+	if cfg.ownerExtraGroups != nil {
+		cfg.SetOwnerExtraGroups(cfg.ownerExtraGroups)
+	}
+
+	provider := &testutils.MockProvider{
+		GetGroupsFails:                     cfg.getGroupsFails,
+		ProviderSupportsDeviceRegistration: cfg.supportsDeviceRegistration,
+		FirstCallDelay:                     cfg.firstCallDelay,
+		SecondCallDelay:                    cfg.secondCallDelay,
+		GetGroupsFunc:                      cfg.getGroupsFunc,
+	}
+
+	if cfg.provider == nil {
+		cfg.SetProvider(provider)
+	}
+	if cfg.DataDir == "" {
+		cfg.DataDir = t.TempDir()
+	}
+	if cfg.ClientID() == "" {
+		cfg.SetClientID("test-client-id")
+	}
+
+	if cfg.IssuerURL() == "" {
+		var serverOpts []testutils.ProviderServerOption
+		for endpoint, handler := range cfg.customHandlers {
+			serverOpts = append(serverOpts, testutils.WithHandler(endpoint, handler))
+		}
+		issuerURL, cleanup := testutils.StartMockProviderServer(
+			cfg.listenAddress,
+			cfg.tokenHandlerOptions,
+			serverOpts...,
+		)
+		t.Cleanup(cleanup)
+		cfg.SetIssuerURL(issuerURL)
+	}
+
+	b, err := broker.New(cfg.Config, broker.WithCustomProvider(provider))
+	require.NoError(t, err, "Setup: New should not have returned an error")
+	return b
+}
+
+// newSessionForTests is a helper function to easily create a new session for tests.
+// If kept empty, username and mode will be assigned default values.
+func newSessionForTests(t *testing.T, b *broker.Broker, username, mode string) (id, key string) {
+	t.Helper()
+
+	if username == "" {
+		username = "test-user@email.com"
+	}
+	if mode == "" {
+		mode = sessionmode.Login
+	}
+
+	id, key, err := b.NewSession(username, "some lang", mode)
+	require.NoError(t, err, "Setup: NewSession should not have returned an error")
+
+	return id, key
+}
+
+func encryptSecret(t *testing.T, secret, strKey string) string {
+	t.Helper()
+
+	if strKey == "" {
+		return secret
+	}
+
+	pubASN1, err := base64.StdEncoding.DecodeString(strKey)
+	require.NoError(t, err, "Setup: base64 decoding should not have failed")
+
+	pubKey, err := x509.ParsePKIXPublicKey(pubASN1)
+	require.NoError(t, err, "Setup: parsing public key should not have failed")
+
+	rsaPubKey, ok := pubKey.(*rsa.PublicKey)
+	require.True(t, ok, "Setup: public key should be an RSA key")
+
+	ciphertext, err := rsa.EncryptOAEP(sha512.New(), rand.Reader, rsaPubKey, []byte(secret), nil)
+	require.NoError(t, err, "Setup: encryption should not have failed")
+
+	// encrypt it to base64 and replace the secret with it
+	return base64.StdEncoding.EncodeToString(ciphertext)
+}
+
+func updateAuthModes(t *testing.T, b *broker.Broker, sessionID, selectedMode string) {
+	t.Helper()
+
+	err := b.SetAvailableMode(sessionID, selectedMode)
+	require.NoError(t, err, "Setup: SetAvailableMode should not have returned an error")
+	_, err = b.SelectAuthenticationMode(sessionID, selectedMode)
+	require.NoError(t, err, "Setup: SelectAuthenticationMode should not have returned an error")
+}
+
+func generateAndStoreCachedInfo(t *testing.T, options tokenOptions, path string) {
+	t.Helper()
+
+	tok := generateCachedInfo(t, options)
+	if tok == nil {
+		writeTrashToken(t, path)
+		return
+	}
+	err := token.CacheAuthInfo(path, tok)
+	require.NoError(t, err, "Setup: storing token should not have failed")
+}
+
+type tokenOptions struct {
+	username string
+	issuer   string
+	groups   []info.Group
+
+	expired                   bool
+	noRefreshToken            bool
+	refreshTokenExpired       bool
+	noIDToken                 bool
+	invalid                   bool
+	invalidClaims             bool
+	noUserInfo                bool
+	isForDeviceRegistration   bool
+	noIsForDeviceRegistration bool
+	deviceIsDisabled          bool
+	userIsDisabled            bool
+}
+
+func generateCachedInfo(t *testing.T, options tokenOptions) *token.AuthCachedInfo {
+	t.Helper()
+
+	if options.invalid {
+		return nil
+	}
+
+	if options.username == "" {
+		options.username = "test-user@email.com"
+	}
+	if options.username == "-" {
+		options.username = ""
+	}
+
+	idToken := jwt.NewWithClaims(jwt.SigningMethodRS256, jwt.MapClaims{
+		"iss":                options.issuer,
+		"sub":                "saved-user-id",
+		"aud":                "test-client-id",
+		"exp":                9999999999,
+		"name":               "test-user",
+		"preferred_username": "test-user-preferred-username@email.com",
+		"email":              options.username,
+		"email_verified":     true,
+	})
+	encodedIDToken, err := idToken.SignedString(testutils.MockKey)
+	require.NoError(t, err, "Setup: signing ID token should not have failed")
+
+	tok := token.AuthCachedInfo{
+		Token: &oauth2.Token{
+			AccessToken:  "accesstoken",
+			RefreshToken: "refreshtoken",
+			Expiry:       time.Now().Add(1000 * time.Hour),
+		},
+		DeviceIsDisabled: options.deviceIsDisabled,
+		UserIsDisabled:   options.userIsDisabled,
+	}
+
+	if options.expired {
+		tok.Token.Expiry = time.Now().Add(-1000 * time.Hour)
+	}
+	if options.noRefreshToken {
+		tok.Token.RefreshToken = ""
+	}
+	if options.refreshTokenExpired {
+		tok.Token.RefreshToken = testutils.ExpiredRefreshToken
+	}
+	if !options.noIsForDeviceRegistration {
+		tok.ExtraFields = map[string]any{testutils.IsForDeviceRegistrationClaim: options.isForDeviceRegistration}
+	}
+
+	if !options.noUserInfo {
+		tok.UserInfo = info.User{
+			Name:  options.username,
+			UUID:  "saved-user-id",
+			Home:  "/home/" + options.username,
+			Gecos: options.username,
+			Shell: "/usr/bin/bash",
+			Groups: []info.Group{
+				{Name: "saved-remote-group", UGID: "12345"},
+				{Name: "saved-local-group", UGID: ""},
+			},
+		}
+		if options.groups != nil {
+			tok.UserInfo.Groups = options.groups
+		}
+	}
+
+	if options.invalidClaims {
+		encodedIDToken = ".invalid."
+		tok.UserInfo = info.User{}
+	}
+
+	if !options.noIDToken {
+		tok.Token = tok.Token.WithExtra(map[string]string{"id_token": encodedIDToken})
+		tok.RawIDToken = encodedIDToken
+	}
+
+	return &tok
+}
+
+func writeTrashToken(t *testing.T, path string) {
+	t.Helper()
+
+	content := []byte("This is a trash token that is not valid for authentication")
+
+	// Create issuer specific cache directory if it doesn't exist.
+	err := os.MkdirAll(filepath.Dir(path), 0700)
+	require.NoError(t, err, "Setup: creating token directory should not have failed")
+
+	err = os.WriteFile(path, content, 0600)
+	require.NoError(t, err, "Setup: writing trash token should not have failed")
+}
diff --git a/authd-oidc-brokers/internal/broker/options_test.go b/authd-oidc-brokers/internal/broker/options_test.go
new file mode 100644
index 0000000000..e0cc0e8de2
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/options_test.go
@@ -0,0 +1,10 @@
+package broker
+
+import "github.com/canonical/authd/authd-oidc-brokers/internal/providers"
+
+// WithCustomProvider returns an option that sets a custom provider for the broker.
+func WithCustomProvider(p providers.Provider) Option {
+	return func(o *option) {
+		o.provider = p
+	}
+}
diff --git a/authd-oidc-brokers/internal/broker/sessionmode/consts.go b/authd-oidc-brokers/internal/broker/sessionmode/consts.go
new file mode 100644
index 0000000000..2472e65506
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/sessionmode/consts.go
@@ -0,0 +1,15 @@
+// Package sessionmode defines the session modes supported by the broker.
+package sessionmode
+
+const (
+	// Login is used when the session is for user login.
+	Login = "login"
+	// LoginOld is the old name for the login session, which is now deprecated but still used by authd until all broker
+	// installations are updated.
+	LoginOld = "auth"
+	// ChangePassword is used when the session is for changing the user password.
+	ChangePassword = "change-password"
+	// ChangePasswordOld is the old name for the change-password session, which is now deprecated but still used by authd
+	// until all broker installations are updated.
+	ChangePasswordOld = "passwd"
+)
diff --git a/authd-oidc-brokers/internal/broker/templates/20-owner-autoregistration.conf.tmpl b/authd-oidc-brokers/internal/broker/templates/20-owner-autoregistration.conf.tmpl
new file mode 100644
index 0000000000..4673fe2c2b
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/templates/20-owner-autoregistration.conf.tmpl
@@ -0,0 +1,13 @@
+## This file was generated automatically by the broker. DO NOT EDIT.
+##
+## This file registers the first authenticated user as the owner of
+## this device.
+##
+## The 'owner' option is only considered for authentication if
+## 'allowed_users' contains the 'OWNER' keyword.
+##
+## To register a different owner for the machine on the next
+## successful authentication, delete this file.
+
+[users]
+owner = {{ .Owner }}
diff --git a/authd-oidc-brokers/internal/broker/testdata/TestParseConfig/golden/Successfully_parse_config_with_drop_in_files/config.txt b/authd-oidc-brokers/internal/broker/testdata/TestParseConfig/golden/Successfully_parse_config_with_drop_in_files/config.txt
new file mode 100644
index 0000000000..7761f024d6
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/TestParseConfig/golden/Successfully_parse_config_with_drop_in_files/config.txt
@@ -0,0 +1,5 @@
+clientID=lower_precedence_client_id
+clientSecret=
+issuerURL=https://higher-precedence-issuer.url.com
+homeBaseDir=/home
+allowedSSHSuffixes=[]
\ No newline at end of file
diff --git a/authd-oidc-brokers/internal/broker/testdata/fuzz/FuzzParseConfig/00 b/authd-oidc-brokers/internal/broker/testdata/fuzz/FuzzParseConfig/00
new file mode 100644
index 0000000000..b349e97638
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/fuzz/FuzzParseConfig/00
@@ -0,0 +1,2 @@
+go test fuzz v1
+[]byte("clientID = client_id\nclientSecret = client_secret\nissuerURL = https://issuer.url.com\nhomeBaseDir = /home\nallowedSSHSuffixes = []\n")
diff --git a/authd-oidc-brokers/internal/broker/testdata/fuzz/FuzzParseConfig/01 b/authd-oidc-brokers/internal/broker/testdata/fuzz/FuzzParseConfig/01
new file mode 100644
index 0000000000..ee3e7da3b2
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/fuzz/FuzzParseConfig/01
@@ -0,0 +1,2 @@
+go test fuzz v1
+[]byte("clientID = <CLIENT_ID>\nclientSecret = client_secret\nissuerURL = https://issuer.url.com\nhomeBaseDir = /home\nallowedSSHSuffixes = []\n")
diff --git a/authd-oidc-brokers/internal/broker/testdata/fuzz/FuzzParseConfig/02 b/authd-oidc-brokers/internal/broker/testdata/fuzz/FuzzParseConfig/02
new file mode 100644
index 0000000000..34393fab24
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/fuzz/FuzzParseConfig/02
@@ -0,0 +1,2 @@
+go test fuzz v1
+[]byte("[oidc]\nforce_provider_authentication = nope\n")
diff --git a/authd-oidc-brokers/internal/broker/testdata/fuzz/FuzzParseConfig/93a65ad473ce3e3c893c1c1225351f4a3b9d700b1836c1087afdc595cf44fb54 b/authd-oidc-brokers/internal/broker/testdata/fuzz/FuzzParseConfig/93a65ad473ce3e3c893c1c1225351f4a3b9d700b1836c1087afdc595cf44fb54
new file mode 100644
index 0000000000..c61979ae4c
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/fuzz/FuzzParseConfig/93a65ad473ce3e3c893c1c1225351f4a3b9d700b1836c1087afdc595cf44fb54
@@ -0,0 +1,2 @@
+go test fuzz v1
+[]byte("[oidc]\nissuer = <ISSUER_URL>\nclient_id = <CLIENT_ID>\n\n## Depending on the identity provider, you may need to provide a\n## client secret to authenticate with the provider.\n#client_secret = <CLIENT_SECRET>\n\n## Force remote authentication with the identity provider during login,\n## even if a local method (e.g. local password) is used.\n## This works by forcing a token refresh during login, which fails if the\n## user does not have the necessary permissions in the identity provider.\n##\n## If set to false (the default), remote authentication with the identity\n## provider only happens if there is a working internet connection and\n## the provider is reachable during login.\n##\n## Important: Enabling this option prevents authd users from logging in\n## if the identity provider is unreachable (e.g. due to network issues).\n#force_provider_authentication = false\n\n[users]\n## The directory where the home directories of new users are created.\n## Existing users will keep their current home directory.\n## The home directories are created in the format <home_base_dir>/<username>\n#home_base_dir = /home\n\n## By default, SSH only allows logins from users that already exist on the\n## system.\n## New authd users (who have never logged in before) are *not* allowed to log\n## in for the first time via SSH unless this option is configured.\n##\n## If configured, only users with a suffix in this list are allowed to\n## authenticate for the first time directly through SSH.\n## Note that this does not affect users that already authenticated for\n## the first time and already exist on the system.\n##\n## Suffixes must be comma-separated (e.g., '@example.com,@example.org').\n## To allow all suffixes, use a single asterisk ('*').\n##\n## Example:\n##     ssh_allowed_suffixes_first_auth = @example.com,@anotherexample.org\n##\n## Example (allow all):\n##     ssh_allowed_suffixes_first_auth = *\n##\n#ssh_allowed_suffixes_first_auth =\n\n## 'allowed_users' specifies the users who are permitted to log in after\n## successfully authenticating with the identity provider.\n## Values are separated by commas. Supported values:\n## - 'OWNER': Grants access to the user specified in the 'owner' option\n##            (see below). This is the default.\n## - 'ALL': Grants access to all users who successfully authenticate\n##          with the identity provider.\n## - <username>: Grants access to specific additional users\n##               (e.g. user1@example.com).\n## Example: allowed_users = OWNER,user1@example.com,admin@example.com\n#allowed_users = OWNER\n\n## 'owner' specifies the user assigned the owner role. This user is\n## permitted to log in if 'OWNER' is included in the 'allowed_users'\n## option.\n##\n## If this option is left unset, the first user to successfully log in\n## via this broker will automatically be assigned the owner role. A\n## drop-in configuration file will be created in broker.conf.d/ to set\n## the 'owner' option.\n##\n## To disable automatic assignment, you can either:\n## 1. Explicitly set this option to an empty value (e.g. owner = \"\")\n## 2. Remove 'OWNER' from the 'allowed_users' option\n##\n## Example: owner = user2@example.com\n#owner =\n\n## A comma-separated list of local groups which authd users will be\n## added to upon login.\n## Example: extra_groups = users\n#extra_groups =\n\n## Like 'extra_groups', but only the user assigned the owner role\n## (see 'owner' option) will be added to these groups.\n## Example: owner_extra_groups = sudo,lpadmin\n#owner_extra_groups =\n")
\ No newline at end of file
diff --git a/authd-oidc-brokers/internal/broker/testdata/fuzz/FuzzParseConfig/caf81e9797b19c76 b/authd-oidc-brokers/internal/broker/testdata/fuzz/FuzzParseConfig/caf81e9797b19c76
new file mode 100644
index 0000000000..67322c7048
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/fuzz/FuzzParseConfig/caf81e9797b19c76
@@ -0,0 +1,2 @@
+go test fuzz v1
+[]byte("")
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestConcurrentIsAuthenticated/First_auth_starts_and_finishes_before_second/data/provider_url/user1@example.com/password b/authd-oidc-brokers/internal/broker/testdata/golden/TestConcurrentIsAuthenticated/First_auth_starts_and_finishes_before_second/data/provider_url/user1@example.com/password
new file mode 100644
index 0000000000..119947240f
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestConcurrentIsAuthenticated/First_auth_starts_and_finishes_before_second/data/provider_url/user1@example.com/password
@@ -0,0 +1 @@
+Definitely a hashed password
\ No newline at end of file
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestConcurrentIsAuthenticated/First_auth_starts_and_finishes_before_second/data/provider_url/user1@example.com/token.json b/authd-oidc-brokers/internal/broker/testdata/golden/TestConcurrentIsAuthenticated/First_auth_starts_and_finishes_before_second/data/provider_url/user1@example.com/token.json
new file mode 100644
index 0000000000..ecaed7cd75
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestConcurrentIsAuthenticated/First_auth_starts_and_finishes_before_second/data/provider_url/user1@example.com/token.json
@@ -0,0 +1 @@
+Definitely a token
\ No newline at end of file
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestConcurrentIsAuthenticated/First_auth_starts_and_finishes_before_second/data/provider_url/user2@example.com/password b/authd-oidc-brokers/internal/broker/testdata/golden/TestConcurrentIsAuthenticated/First_auth_starts_and_finishes_before_second/data/provider_url/user2@example.com/password
new file mode 100644
index 0000000000..119947240f
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestConcurrentIsAuthenticated/First_auth_starts_and_finishes_before_second/data/provider_url/user2@example.com/password
@@ -0,0 +1 @@
+Definitely a hashed password
\ No newline at end of file
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestConcurrentIsAuthenticated/First_auth_starts_and_finishes_before_second/data/provider_url/user2@example.com/token.json b/authd-oidc-brokers/internal/broker/testdata/golden/TestConcurrentIsAuthenticated/First_auth_starts_and_finishes_before_second/data/provider_url/user2@example.com/token.json
new file mode 100644
index 0000000000..ecaed7cd75
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestConcurrentIsAuthenticated/First_auth_starts_and_finishes_before_second/data/provider_url/user2@example.com/token.json
@@ -0,0 +1 @@
+Definitely a token
\ No newline at end of file
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestConcurrentIsAuthenticated/First_auth_starts_and_finishes_before_second/first_auth b/authd-oidc-brokers/internal/broker/testdata/golden/TestConcurrentIsAuthenticated/First_auth_starts_and_finishes_before_second/first_auth
new file mode 100644
index 0000000000..89c182d5f3
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestConcurrentIsAuthenticated/First_auth_starts_and_finishes_before_second/first_auth
@@ -0,0 +1,3 @@
+access: granted
+data: '{"userinfo":{"name":"user1@example.com","uuid":"user1","dir":"/home/user1@example.com","shell":"/usr/bin/bash","gecos":"user1@example.com","groups":[{"name":"remote-test-group","ugid":"12345"},{"name":"local-test-group","ugid":""}]}}'
+err: <nil>
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestConcurrentIsAuthenticated/First_auth_starts_and_finishes_before_second/second_auth b/authd-oidc-brokers/internal/broker/testdata/golden/TestConcurrentIsAuthenticated/First_auth_starts_and_finishes_before_second/second_auth
new file mode 100644
index 0000000000..f0643dd9fe
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestConcurrentIsAuthenticated/First_auth_starts_and_finishes_before_second/second_auth
@@ -0,0 +1,3 @@
+access: granted
+data: '{"userinfo":{"name":"user2@example.com","uuid":"user2","dir":"/home/user2@example.com","shell":"/usr/bin/bash","gecos":"user2@example.com","groups":[{"name":"remote-test-group","ugid":"12345"},{"name":"local-test-group","ugid":""}]}}'
+err: <nil>
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestConcurrentIsAuthenticated/First_auth_starts_first_but_second_finishes_first/data/provider_url/user1@example.com/password b/authd-oidc-brokers/internal/broker/testdata/golden/TestConcurrentIsAuthenticated/First_auth_starts_first_but_second_finishes_first/data/provider_url/user1@example.com/password
new file mode 100644
index 0000000000..119947240f
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestConcurrentIsAuthenticated/First_auth_starts_first_but_second_finishes_first/data/provider_url/user1@example.com/password
@@ -0,0 +1 @@
+Definitely a hashed password
\ No newline at end of file
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestConcurrentIsAuthenticated/First_auth_starts_first_but_second_finishes_first/data/provider_url/user1@example.com/token.json b/authd-oidc-brokers/internal/broker/testdata/golden/TestConcurrentIsAuthenticated/First_auth_starts_first_but_second_finishes_first/data/provider_url/user1@example.com/token.json
new file mode 100644
index 0000000000..ecaed7cd75
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestConcurrentIsAuthenticated/First_auth_starts_first_but_second_finishes_first/data/provider_url/user1@example.com/token.json
@@ -0,0 +1 @@
+Definitely a token
\ No newline at end of file
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestConcurrentIsAuthenticated/First_auth_starts_first_but_second_finishes_first/data/provider_url/user2@example.com/password b/authd-oidc-brokers/internal/broker/testdata/golden/TestConcurrentIsAuthenticated/First_auth_starts_first_but_second_finishes_first/data/provider_url/user2@example.com/password
new file mode 100644
index 0000000000..119947240f
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestConcurrentIsAuthenticated/First_auth_starts_first_but_second_finishes_first/data/provider_url/user2@example.com/password
@@ -0,0 +1 @@
+Definitely a hashed password
\ No newline at end of file
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestConcurrentIsAuthenticated/First_auth_starts_first_but_second_finishes_first/data/provider_url/user2@example.com/token.json b/authd-oidc-brokers/internal/broker/testdata/golden/TestConcurrentIsAuthenticated/First_auth_starts_first_but_second_finishes_first/data/provider_url/user2@example.com/token.json
new file mode 100644
index 0000000000..ecaed7cd75
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestConcurrentIsAuthenticated/First_auth_starts_first_but_second_finishes_first/data/provider_url/user2@example.com/token.json
@@ -0,0 +1 @@
+Definitely a token
\ No newline at end of file
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestConcurrentIsAuthenticated/First_auth_starts_first_but_second_finishes_first/first_auth b/authd-oidc-brokers/internal/broker/testdata/golden/TestConcurrentIsAuthenticated/First_auth_starts_first_but_second_finishes_first/first_auth
new file mode 100644
index 0000000000..89c182d5f3
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestConcurrentIsAuthenticated/First_auth_starts_first_but_second_finishes_first/first_auth
@@ -0,0 +1,3 @@
+access: granted
+data: '{"userinfo":{"name":"user1@example.com","uuid":"user1","dir":"/home/user1@example.com","shell":"/usr/bin/bash","gecos":"user1@example.com","groups":[{"name":"remote-test-group","ugid":"12345"},{"name":"local-test-group","ugid":""}]}}'
+err: <nil>
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestConcurrentIsAuthenticated/First_auth_starts_first_but_second_finishes_first/second_auth b/authd-oidc-brokers/internal/broker/testdata/golden/TestConcurrentIsAuthenticated/First_auth_starts_first_but_second_finishes_first/second_auth
new file mode 100644
index 0000000000..f0643dd9fe
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestConcurrentIsAuthenticated/First_auth_starts_first_but_second_finishes_first/second_auth
@@ -0,0 +1,3 @@
+access: granted
+data: '{"userinfo":{"name":"user2@example.com","uuid":"user2","dir":"/home/user2@example.com","shell":"/usr/bin/bash","gecos":"user2@example.com","groups":[{"name":"remote-test-group","ugid":"12345"},{"name":"local-test-group","ugid":""}]}}'
+err: <nil>
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestConcurrentIsAuthenticated/First_auth_starts_first_but_second_finishes_first_and_is_registered_as_the_owner/data/provider_url/user1@example.com/password b/authd-oidc-brokers/internal/broker/testdata/golden/TestConcurrentIsAuthenticated/First_auth_starts_first_but_second_finishes_first_and_is_registered_as_the_owner/data/provider_url/user1@example.com/password
new file mode 100644
index 0000000000..119947240f
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestConcurrentIsAuthenticated/First_auth_starts_first_but_second_finishes_first_and_is_registered_as_the_owner/data/provider_url/user1@example.com/password
@@ -0,0 +1 @@
+Definitely a hashed password
\ No newline at end of file
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestConcurrentIsAuthenticated/First_auth_starts_first_but_second_finishes_first_and_is_registered_as_the_owner/data/provider_url/user1@example.com/token.json b/authd-oidc-brokers/internal/broker/testdata/golden/TestConcurrentIsAuthenticated/First_auth_starts_first_but_second_finishes_first_and_is_registered_as_the_owner/data/provider_url/user1@example.com/token.json
new file mode 100644
index 0000000000..ecaed7cd75
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestConcurrentIsAuthenticated/First_auth_starts_first_but_second_finishes_first_and_is_registered_as_the_owner/data/provider_url/user1@example.com/token.json
@@ -0,0 +1 @@
+Definitely a token
\ No newline at end of file
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestConcurrentIsAuthenticated/First_auth_starts_first_but_second_finishes_first_and_is_registered_as_the_owner/data/provider_url/user2@example.com/password b/authd-oidc-brokers/internal/broker/testdata/golden/TestConcurrentIsAuthenticated/First_auth_starts_first_but_second_finishes_first_and_is_registered_as_the_owner/data/provider_url/user2@example.com/password
new file mode 100644
index 0000000000..119947240f
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestConcurrentIsAuthenticated/First_auth_starts_first_but_second_finishes_first_and_is_registered_as_the_owner/data/provider_url/user2@example.com/password
@@ -0,0 +1 @@
+Definitely a hashed password
\ No newline at end of file
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestConcurrentIsAuthenticated/First_auth_starts_first_but_second_finishes_first_and_is_registered_as_the_owner/data/provider_url/user2@example.com/token.json b/authd-oidc-brokers/internal/broker/testdata/golden/TestConcurrentIsAuthenticated/First_auth_starts_first_but_second_finishes_first_and_is_registered_as_the_owner/data/provider_url/user2@example.com/token.json
new file mode 100644
index 0000000000..ecaed7cd75
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestConcurrentIsAuthenticated/First_auth_starts_first_but_second_finishes_first_and_is_registered_as_the_owner/data/provider_url/user2@example.com/token.json
@@ -0,0 +1 @@
+Definitely a token
\ No newline at end of file
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestConcurrentIsAuthenticated/First_auth_starts_first_but_second_finishes_first_and_is_registered_as_the_owner/first_auth b/authd-oidc-brokers/internal/broker/testdata/golden/TestConcurrentIsAuthenticated/First_auth_starts_first_but_second_finishes_first_and_is_registered_as_the_owner/first_auth
new file mode 100644
index 0000000000..d8fe78633c
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestConcurrentIsAuthenticated/First_auth_starts_first_but_second_finishes_first_and_is_registered_as_the_owner/first_auth
@@ -0,0 +1,3 @@
+access: denied
+data: '{"message":"Authentication failure: user not allowed in broker configuration"}'
+err: <nil>
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestConcurrentIsAuthenticated/First_auth_starts_first_but_second_finishes_first_and_is_registered_as_the_owner/second_auth b/authd-oidc-brokers/internal/broker/testdata/golden/TestConcurrentIsAuthenticated/First_auth_starts_first_but_second_finishes_first_and_is_registered_as_the_owner/second_auth
new file mode 100644
index 0000000000..f0643dd9fe
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestConcurrentIsAuthenticated/First_auth_starts_first_but_second_finishes_first_and_is_registered_as_the_owner/second_auth
@@ -0,0 +1,3 @@
+access: granted
+data: '{"userinfo":{"name":"user2@example.com","uuid":"user2","dir":"/home/user2@example.com","shell":"/usr/bin/bash","gecos":"user2@example.com","groups":[{"name":"remote-test-group","ugid":"12345"},{"name":"local-test-group","ugid":""}]}}'
+err: <nil>
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestConcurrentIsAuthenticated/First_auth_starts_first_then_second_starts_and_first_finishes/data/provider_url/user1@example.com/password b/authd-oidc-brokers/internal/broker/testdata/golden/TestConcurrentIsAuthenticated/First_auth_starts_first_then_second_starts_and_first_finishes/data/provider_url/user1@example.com/password
new file mode 100644
index 0000000000..119947240f
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestConcurrentIsAuthenticated/First_auth_starts_first_then_second_starts_and_first_finishes/data/provider_url/user1@example.com/password
@@ -0,0 +1 @@
+Definitely a hashed password
\ No newline at end of file
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestConcurrentIsAuthenticated/First_auth_starts_first_then_second_starts_and_first_finishes/data/provider_url/user1@example.com/token.json b/authd-oidc-brokers/internal/broker/testdata/golden/TestConcurrentIsAuthenticated/First_auth_starts_first_then_second_starts_and_first_finishes/data/provider_url/user1@example.com/token.json
new file mode 100644
index 0000000000..ecaed7cd75
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestConcurrentIsAuthenticated/First_auth_starts_first_then_second_starts_and_first_finishes/data/provider_url/user1@example.com/token.json
@@ -0,0 +1 @@
+Definitely a token
\ No newline at end of file
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestConcurrentIsAuthenticated/First_auth_starts_first_then_second_starts_and_first_finishes/data/provider_url/user2@example.com/password b/authd-oidc-brokers/internal/broker/testdata/golden/TestConcurrentIsAuthenticated/First_auth_starts_first_then_second_starts_and_first_finishes/data/provider_url/user2@example.com/password
new file mode 100644
index 0000000000..119947240f
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestConcurrentIsAuthenticated/First_auth_starts_first_then_second_starts_and_first_finishes/data/provider_url/user2@example.com/password
@@ -0,0 +1 @@
+Definitely a hashed password
\ No newline at end of file
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestConcurrentIsAuthenticated/First_auth_starts_first_then_second_starts_and_first_finishes/data/provider_url/user2@example.com/token.json b/authd-oidc-brokers/internal/broker/testdata/golden/TestConcurrentIsAuthenticated/First_auth_starts_first_then_second_starts_and_first_finishes/data/provider_url/user2@example.com/token.json
new file mode 100644
index 0000000000..ecaed7cd75
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestConcurrentIsAuthenticated/First_auth_starts_first_then_second_starts_and_first_finishes/data/provider_url/user2@example.com/token.json
@@ -0,0 +1 @@
+Definitely a token
\ No newline at end of file
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestConcurrentIsAuthenticated/First_auth_starts_first_then_second_starts_and_first_finishes/first_auth b/authd-oidc-brokers/internal/broker/testdata/golden/TestConcurrentIsAuthenticated/First_auth_starts_first_then_second_starts_and_first_finishes/first_auth
new file mode 100644
index 0000000000..89c182d5f3
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestConcurrentIsAuthenticated/First_auth_starts_first_then_second_starts_and_first_finishes/first_auth
@@ -0,0 +1,3 @@
+access: granted
+data: '{"userinfo":{"name":"user1@example.com","uuid":"user1","dir":"/home/user1@example.com","shell":"/usr/bin/bash","gecos":"user1@example.com","groups":[{"name":"remote-test-group","ugid":"12345"},{"name":"local-test-group","ugid":""}]}}'
+err: <nil>
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestConcurrentIsAuthenticated/First_auth_starts_first_then_second_starts_and_first_finishes/second_auth b/authd-oidc-brokers/internal/broker/testdata/golden/TestConcurrentIsAuthenticated/First_auth_starts_first_then_second_starts_and_first_finishes/second_auth
new file mode 100644
index 0000000000..f0643dd9fe
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestConcurrentIsAuthenticated/First_auth_starts_first_then_second_starts_and_first_finishes/second_auth
@@ -0,0 +1,3 @@
+access: granted
+data: '{"userinfo":{"name":"user2@example.com","uuid":"user2","dir":"/home/user2@example.com","shell":"/usr/bin/bash","gecos":"user2@example.com","groups":[{"name":"remote-test-group","ugid":"12345"},{"name":"local-test-group","ugid":""}]}}'
+err: <nil>
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestGetAuthenticationModes/Get_only_device_auth_if_token_exists_but_checking_if_it_is_for_device_registration_fails b/authd-oidc-brokers/internal/broker/testdata/golden/TestGetAuthenticationModes/Get_only_device_auth_if_token_exists_but_checking_if_it_is_for_device_registration_fails
new file mode 100644
index 0000000000..0742ddffe6
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestGetAuthenticationModes/Get_only_device_auth_if_token_exists_but_checking_if_it_is_for_device_registration_fails
@@ -0,0 +1,2 @@
+- id: device_auth_qr
+  label: Device Authentication
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestGetAuthenticationModes/Get_only_device_auth_qr_if_device_should_be_registered_and_token_is_not_for_device_registration b/authd-oidc-brokers/internal/broker/testdata/golden/TestGetAuthenticationModes/Get_only_device_auth_qr_if_device_should_be_registered_and_token_is_not_for_device_registration
new file mode 100644
index 0000000000..0742ddffe6
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestGetAuthenticationModes/Get_only_device_auth_qr_if_device_should_be_registered_and_token_is_not_for_device_registration
@@ -0,0 +1,2 @@
+- id: device_auth_qr
+  label: Device Authentication
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestGetAuthenticationModes/Get_only_device_auth_qr_if_device_should_not_be_registered_and_token_is_for_device_registration b/authd-oidc-brokers/internal/broker/testdata/golden/TestGetAuthenticationModes/Get_only_device_auth_qr_if_device_should_not_be_registered_and_token_is_for_device_registration
new file mode 100644
index 0000000000..0742ddffe6
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestGetAuthenticationModes/Get_only_device_auth_qr_if_device_should_not_be_registered_and_token_is_for_device_registration
@@ -0,0 +1,2 @@
+- id: device_auth_qr
+  label: Device Authentication
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestGetAuthenticationModes/Get_only_device_auth_qr_if_next_auth_mode_is_device_qr b/authd-oidc-brokers/internal/broker/testdata/golden/TestGetAuthenticationModes/Get_only_device_auth_qr_if_next_auth_mode_is_device_qr
new file mode 100644
index 0000000000..0742ddffe6
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestGetAuthenticationModes/Get_only_device_auth_qr_if_next_auth_mode_is_device_qr
@@ -0,0 +1,2 @@
+- id: device_auth_qr
+  label: Device Authentication
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestGetAuthenticationModes/Get_only_device_auth_qr_if_there_is_no_password_file b/authd-oidc-brokers/internal/broker/testdata/golden/TestGetAuthenticationModes/Get_only_device_auth_qr_if_there_is_no_password_file
new file mode 100644
index 0000000000..0742ddffe6
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestGetAuthenticationModes/Get_only_device_auth_qr_if_there_is_no_password_file
@@ -0,0 +1,2 @@
+- id: device_auth_qr
+  label: Device Authentication
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestGetAuthenticationModes/Get_only_device_auth_qr_if_there_is_no_token b/authd-oidc-brokers/internal/broker/testdata/golden/TestGetAuthenticationModes/Get_only_device_auth_qr_if_there_is_no_token
new file mode 100644
index 0000000000..0742ddffe6
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestGetAuthenticationModes/Get_only_device_auth_qr_if_there_is_no_token
@@ -0,0 +1,2 @@
+- id: device_auth_qr
+  label: Device Authentication
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestGetAuthenticationModes/Get_only_device_auth_qr_if_token_is_invalid b/authd-oidc-brokers/internal/broker/testdata/golden/TestGetAuthenticationModes/Get_only_device_auth_qr_if_token_is_invalid
new file mode 100644
index 0000000000..0742ddffe6
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestGetAuthenticationModes/Get_only_device_auth_qr_if_token_is_invalid
@@ -0,0 +1,2 @@
+- id: device_auth_qr
+  label: Device Authentication
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestGetAuthenticationModes/Get_only_newpassword_if_next_auth_mode_is_newpassword b/authd-oidc-brokers/internal/broker/testdata/golden/TestGetAuthenticationModes/Get_only_newpassword_if_next_auth_mode_is_newpassword
new file mode 100644
index 0000000000..1bf8f6dae4
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestGetAuthenticationModes/Get_only_newpassword_if_next_auth_mode_is_newpassword
@@ -0,0 +1,2 @@
+- id: newpassword
+  label: Define your local password
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestGetAuthenticationModes/Get_only_newpassword_if_session_is_for_changing_password_and_next_auth_mode_is_newpassword b/authd-oidc-brokers/internal/broker/testdata/golden/TestGetAuthenticationModes/Get_only_newpassword_if_session_is_for_changing_password_and_next_auth_mode_is_newpassword
new file mode 100644
index 0000000000..1bf8f6dae4
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestGetAuthenticationModes/Get_only_newpassword_if_session_is_for_changing_password_and_next_auth_mode_is_newpassword
@@ -0,0 +1,2 @@
+- id: newpassword
+  label: Define your local password
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestGetAuthenticationModes/Get_only_password_if_device_should_be_registered_and_token_is_not_for_device_registration_but_provider_is_not_available b/authd-oidc-brokers/internal/broker/testdata/golden/TestGetAuthenticationModes/Get_only_password_if_device_should_be_registered_and_token_is_not_for_device_registration_but_provider_is_not_available
new file mode 100644
index 0000000000..e4e7cb1d35
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestGetAuthenticationModes/Get_only_password_if_device_should_be_registered_and_token_is_not_for_device_registration_but_provider_is_not_available
@@ -0,0 +1,2 @@
+- id: password
+  label: Local Password Authentication
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestGetAuthenticationModes/Get_only_password_if_device_should_not_be_registered_and_token_is_for_device_registration_but_provider_is_not_available b/authd-oidc-brokers/internal/broker/testdata/golden/TestGetAuthenticationModes/Get_only_password_if_device_should_not_be_registered_and_token_is_for_device_registration_but_provider_is_not_available
new file mode 100644
index 0000000000..e4e7cb1d35
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestGetAuthenticationModes/Get_only_password_if_device_should_not_be_registered_and_token_is_for_device_registration_but_provider_is_not_available
@@ -0,0 +1,2 @@
+- id: password
+  label: Local Password Authentication
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestGetAuthenticationModes/Get_only_password_if_token_exists_and_provider_does_not_support_device_auth_qr b/authd-oidc-brokers/internal/broker/testdata/golden/TestGetAuthenticationModes/Get_only_password_if_token_exists_and_provider_does_not_support_device_auth_qr
new file mode 100644
index 0000000000..e4e7cb1d35
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestGetAuthenticationModes/Get_only_password_if_token_exists_and_provider_does_not_support_device_auth_qr
@@ -0,0 +1,2 @@
+- id: password
+  label: Local Password Authentication
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestGetAuthenticationModes/Get_only_password_if_token_exists_and_provider_is_not_available b/authd-oidc-brokers/internal/broker/testdata/golden/TestGetAuthenticationModes/Get_only_password_if_token_exists_and_provider_is_not_available
new file mode 100644
index 0000000000..e4e7cb1d35
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestGetAuthenticationModes/Get_only_password_if_token_exists_and_provider_is_not_available
@@ -0,0 +1,2 @@
+- id: password
+  label: Local Password Authentication
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestGetAuthenticationModes/Get_only_password_if_token_exists_and_session_is_for_changing_password b/authd-oidc-brokers/internal/broker/testdata/golden/TestGetAuthenticationModes/Get_only_password_if_token_exists_and_session_is_for_changing_password
new file mode 100644
index 0000000000..e4e7cb1d35
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestGetAuthenticationModes/Get_only_password_if_token_exists_and_session_is_for_changing_password
@@ -0,0 +1,2 @@
+- id: password
+  label: Local Password Authentication
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestGetAuthenticationModes/Get_only_password_if_token_exists_and_session_mode_is_the_old_passwd_value b/authd-oidc-brokers/internal/broker/testdata/golden/TestGetAuthenticationModes/Get_only_password_if_token_exists_and_session_mode_is_the_old_passwd_value
new file mode 100644
index 0000000000..e4e7cb1d35
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestGetAuthenticationModes/Get_only_password_if_token_exists_and_session_mode_is_the_old_passwd_value
@@ -0,0 +1,2 @@
+- id: password
+  label: Local Password Authentication
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestGetAuthenticationModes/Get_password_and_device_auth_qr_if_device_should_be_registered_and_token_is_for_device_registration b/authd-oidc-brokers/internal/broker/testdata/golden/TestGetAuthenticationModes/Get_password_and_device_auth_qr_if_device_should_be_registered_and_token_is_for_device_registration
new file mode 100644
index 0000000000..6327db6363
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestGetAuthenticationModes/Get_password_and_device_auth_qr_if_device_should_be_registered_and_token_is_for_device_registration
@@ -0,0 +1,4 @@
+- id: password
+  label: Local Password Authentication
+- id: device_auth_qr
+  label: Device Authentication
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestGetAuthenticationModes/Get_password_and_device_auth_qr_if_device_should_be_registered_and_token_is_not_for_device_registration_and_provider_does_not_support_it b/authd-oidc-brokers/internal/broker/testdata/golden/TestGetAuthenticationModes/Get_password_and_device_auth_qr_if_device_should_be_registered_and_token_is_not_for_device_registration_and_provider_does_not_support_it
new file mode 100644
index 0000000000..6327db6363
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestGetAuthenticationModes/Get_password_and_device_auth_qr_if_device_should_be_registered_and_token_is_not_for_device_registration_and_provider_does_not_support_it
@@ -0,0 +1,4 @@
+- id: password
+  label: Local Password Authentication
+- id: device_auth_qr
+  label: Device Authentication
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestGetAuthenticationModes/Get_password_and_device_auth_qr_if_device_should_not_be_registered_and_token_is_not_for_device_registration b/authd-oidc-brokers/internal/broker/testdata/golden/TestGetAuthenticationModes/Get_password_and_device_auth_qr_if_device_should_not_be_registered_and_token_is_not_for_device_registration
new file mode 100644
index 0000000000..6327db6363
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestGetAuthenticationModes/Get_password_and_device_auth_qr_if_device_should_not_be_registered_and_token_is_not_for_device_registration
@@ -0,0 +1,4 @@
+- id: password
+  label: Local Password Authentication
+- id: device_auth_qr
+  label: Device Authentication
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestGetAuthenticationModes/Get_password_and_device_auth_qr_if_token_exists b/authd-oidc-brokers/internal/broker/testdata/golden/TestGetAuthenticationModes/Get_password_and_device_auth_qr_if_token_exists
new file mode 100644
index 0000000000..6327db6363
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestGetAuthenticationModes/Get_password_and_device_auth_qr_if_token_exists
@@ -0,0 +1,4 @@
+- id: password
+  label: Local Password Authentication
+- id: device_auth_qr
+  label: Device Authentication
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestGetAuthenticationModes/Get_password_and_device_auth_qr_if_token_is_not_for_device_registration_but_provider_does_not_support_it b/authd-oidc-brokers/internal/broker/testdata/golden/TestGetAuthenticationModes/Get_password_and_device_auth_qr_if_token_is_not_for_device_registration_but_provider_does_not_support_it
new file mode 100644
index 0000000000..6327db6363
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestGetAuthenticationModes/Get_password_and_device_auth_qr_if_token_is_not_for_device_registration_but_provider_does_not_support_it
@@ -0,0 +1,4 @@
+- id: password
+  label: Local Password Authentication
+- id: device_auth_qr
+  label: Device Authentication
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_still_allowed_if_token_is_missing_scopes/data/provider_url/test-user@email.com/password b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_still_allowed_if_token_is_missing_scopes/data/provider_url/test-user@email.com/password
new file mode 100644
index 0000000000..119947240f
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_still_allowed_if_token_is_missing_scopes/data/provider_url/test-user@email.com/password
@@ -0,0 +1 @@
+Definitely a hashed password
\ No newline at end of file
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_still_allowed_if_token_is_missing_scopes/data/provider_url/test-user@email.com/token.json b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_still_allowed_if_token_is_missing_scopes/data/provider_url/test-user@email.com/token.json
new file mode 100644
index 0000000000..ecaed7cd75
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_still_allowed_if_token_is_missing_scopes/data/provider_url/test-user@email.com/token.json
@@ -0,0 +1 @@
+Definitely a token
\ No newline at end of file
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_still_allowed_if_token_is_missing_scopes/first_call b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_still_allowed_if_token_is_missing_scopes/first_call
new file mode 100644
index 0000000000..d0887a134f
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_still_allowed_if_token_is_missing_scopes/first_call
@@ -0,0 +1,3 @@
+access: next
+data: '{}'
+err: <nil>
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_still_allowed_if_token_is_missing_scopes/second_call b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_still_allowed_if_token_is_missing_scopes/second_call
new file mode 100644
index 0000000000..f50b5eb551
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_still_allowed_if_token_is_missing_scopes/second_call
@@ -0,0 +1,3 @@
+access: granted
+data: '{"userinfo":{"name":"test-user@email.com","uuid":"test-user-id","dir":"/home/test-user@email.com","shell":"/usr/bin/bash","gecos":"test-user@email.com","groups":[{"name":"remote-test-group","ugid":"12345"},{"name":"local-test-group","ugid":""}]}}'
+err: <nil>
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_to_change_password_still_allowed_if_fetching_groups_fails/data/provider_url/test-user@email.com/password b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_to_change_password_still_allowed_if_fetching_groups_fails/data/provider_url/test-user@email.com/password
new file mode 100644
index 0000000000..119947240f
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_to_change_password_still_allowed_if_fetching_groups_fails/data/provider_url/test-user@email.com/password
@@ -0,0 +1 @@
+Definitely a hashed password
\ No newline at end of file
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_to_change_password_still_allowed_if_fetching_groups_fails/data/provider_url/test-user@email.com/token.json b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_to_change_password_still_allowed_if_fetching_groups_fails/data/provider_url/test-user@email.com/token.json
new file mode 100644
index 0000000000..ecaed7cd75
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_to_change_password_still_allowed_if_fetching_groups_fails/data/provider_url/test-user@email.com/token.json
@@ -0,0 +1 @@
+Definitely a token
\ No newline at end of file
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_to_change_password_still_allowed_if_fetching_groups_fails/first_call b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_to_change_password_still_allowed_if_fetching_groups_fails/first_call
new file mode 100644
index 0000000000..d0887a134f
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_to_change_password_still_allowed_if_fetching_groups_fails/first_call
@@ -0,0 +1,3 @@
+access: next
+data: '{}'
+err: <nil>
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_when_the_auth_data_secret_field_uses_the_old_name/data/provider_url/test-user@email.com/password b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_when_the_auth_data_secret_field_uses_the_old_name/data/provider_url/test-user@email.com/password
new file mode 100644
index 0000000000..119947240f
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_when_the_auth_data_secret_field_uses_the_old_name/data/provider_url/test-user@email.com/password
@@ -0,0 +1 @@
+Definitely a hashed password
\ No newline at end of file
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_when_the_auth_data_secret_field_uses_the_old_name/data/provider_url/test-user@email.com/token.json b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_when_the_auth_data_secret_field_uses_the_old_name/data/provider_url/test-user@email.com/token.json
new file mode 100644
index 0000000000..ecaed7cd75
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_when_the_auth_data_secret_field_uses_the_old_name/data/provider_url/test-user@email.com/token.json
@@ -0,0 +1 @@
+Definitely a token
\ No newline at end of file
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_when_the_auth_data_secret_field_uses_the_old_name/first_call b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_when_the_auth_data_secret_field_uses_the_old_name/first_call
new file mode 100644
index 0000000000..f50b5eb551
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_when_the_auth_data_secret_field_uses_the_old_name/first_call
@@ -0,0 +1,3 @@
+access: granted
+data: '{"userinfo":{"name":"test-user@email.com","uuid":"test-user-id","dir":"/home/test-user@email.com","shell":"/usr/bin/bash","gecos":"test-user@email.com","groups":[{"name":"remote-test-group","ugid":"12345"},{"name":"local-test-group","ugid":""}]}}'
+err: <nil>
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_with_device_auth_when_provider_supports_device_registration/data/provider_url/test-user@email.com/password b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_with_device_auth_when_provider_supports_device_registration/data/provider_url/test-user@email.com/password
new file mode 100644
index 0000000000..119947240f
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_with_device_auth_when_provider_supports_device_registration/data/provider_url/test-user@email.com/password
@@ -0,0 +1 @@
+Definitely a hashed password
\ No newline at end of file
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_with_device_auth_when_provider_supports_device_registration/data/provider_url/test-user@email.com/token.json b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_with_device_auth_when_provider_supports_device_registration/data/provider_url/test-user@email.com/token.json
new file mode 100644
index 0000000000..ecaed7cd75
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_with_device_auth_when_provider_supports_device_registration/data/provider_url/test-user@email.com/token.json
@@ -0,0 +1 @@
+Definitely a token
\ No newline at end of file
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_with_device_auth_when_provider_supports_device_registration/first_call b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_with_device_auth_when_provider_supports_device_registration/first_call
new file mode 100644
index 0000000000..d0887a134f
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_with_device_auth_when_provider_supports_device_registration/first_call
@@ -0,0 +1,3 @@
+access: next
+data: '{}'
+err: <nil>
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_with_device_auth_when_provider_supports_device_registration/second_call b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_with_device_auth_when_provider_supports_device_registration/second_call
new file mode 100644
index 0000000000..f50b5eb551
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_with_device_auth_when_provider_supports_device_registration/second_call
@@ -0,0 +1,3 @@
+access: granted
+data: '{"userinfo":{"name":"test-user@email.com","uuid":"test-user-id","dir":"/home/test-user@email.com","shell":"/usr/bin/bash","gecos":"test-user@email.com","groups":[{"name":"remote-test-group","ugid":"12345"},{"name":"local-test-group","ugid":""}]}}'
+err: <nil>
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_with_password_keeps_old_groups_if_fetching_groups_fails/data/provider_url/test-user@email.com/password b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_with_password_keeps_old_groups_if_fetching_groups_fails/data/provider_url/test-user@email.com/password
new file mode 100644
index 0000000000..119947240f
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_with_password_keeps_old_groups_if_fetching_groups_fails/data/provider_url/test-user@email.com/password
@@ -0,0 +1 @@
+Definitely a hashed password
\ No newline at end of file
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_with_password_keeps_old_groups_if_fetching_groups_fails/data/provider_url/test-user@email.com/token.json b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_with_password_keeps_old_groups_if_fetching_groups_fails/data/provider_url/test-user@email.com/token.json
new file mode 100644
index 0000000000..ecaed7cd75
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_with_password_keeps_old_groups_if_fetching_groups_fails/data/provider_url/test-user@email.com/token.json
@@ -0,0 +1 @@
+Definitely a token
\ No newline at end of file
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_with_password_keeps_old_groups_if_fetching_groups_fails/first_call b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_with_password_keeps_old_groups_if_fetching_groups_fails/first_call
new file mode 100644
index 0000000000..4b9e9db6b0
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_with_password_keeps_old_groups_if_fetching_groups_fails/first_call
@@ -0,0 +1,3 @@
+access: granted
+data: '{"userinfo":{"name":"test-user@email.com","uuid":"test-user-id","dir":"/home/test-user@email.com","shell":"/usr/bin/bash","gecos":"test-user@email.com","groups":[{"name":"old-group","ugid":""}]}}'
+err: <nil>
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_with_password_keeps_old_groups_if_session_is_offline/data/provider_url/test-user@email.com/password b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_with_password_keeps_old_groups_if_session_is_offline/data/provider_url/test-user@email.com/password
new file mode 100644
index 0000000000..119947240f
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_with_password_keeps_old_groups_if_session_is_offline/data/provider_url/test-user@email.com/password
@@ -0,0 +1 @@
+Definitely a hashed password
\ No newline at end of file
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_with_password_keeps_old_groups_if_session_is_offline/data/provider_url/test-user@email.com/token.json b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_with_password_keeps_old_groups_if_session_is_offline/data/provider_url/test-user@email.com/token.json
new file mode 100644
index 0000000000..ecaed7cd75
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_with_password_keeps_old_groups_if_session_is_offline/data/provider_url/test-user@email.com/token.json
@@ -0,0 +1 @@
+Definitely a token
\ No newline at end of file
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_with_password_keeps_old_groups_if_session_is_offline/first_call b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_with_password_keeps_old_groups_if_session_is_offline/first_call
new file mode 100644
index 0000000000..aca00f387f
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_with_password_keeps_old_groups_if_session_is_offline/first_call
@@ -0,0 +1,3 @@
+access: granted
+data: '{"userinfo":{"name":"test-user@email.com","uuid":"saved-user-id","dir":"/home/test-user@email.com","shell":"/usr/bin/bash","gecos":"test-user@email.com","groups":[{"name":"old-group","ugid":""}]}}'
+err: <nil>
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_with_password_refreshes_expired_token/data/provider_url/test-user@email.com/password b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_with_password_refreshes_expired_token/data/provider_url/test-user@email.com/password
new file mode 100644
index 0000000000..119947240f
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_with_password_refreshes_expired_token/data/provider_url/test-user@email.com/password
@@ -0,0 +1 @@
+Definitely a hashed password
\ No newline at end of file
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_with_password_refreshes_expired_token/data/provider_url/test-user@email.com/token.json b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_with_password_refreshes_expired_token/data/provider_url/test-user@email.com/token.json
new file mode 100644
index 0000000000..ecaed7cd75
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_with_password_refreshes_expired_token/data/provider_url/test-user@email.com/token.json
@@ -0,0 +1 @@
+Definitely a token
\ No newline at end of file
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_with_password_refreshes_expired_token/first_call b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_with_password_refreshes_expired_token/first_call
new file mode 100644
index 0000000000..f50b5eb551
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_with_password_refreshes_expired_token/first_call
@@ -0,0 +1,3 @@
+access: granted
+data: '{"userinfo":{"name":"test-user@email.com","uuid":"test-user-id","dir":"/home/test-user@email.com","shell":"/usr/bin/bash","gecos":"test-user@email.com","groups":[{"name":"remote-test-group","ugid":"12345"},{"name":"local-test-group","ugid":""}]}}'
+err: <nil>
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_with_password_refreshes_groups/data/provider_url/test-user@email.com/password b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_with_password_refreshes_groups/data/provider_url/test-user@email.com/password
new file mode 100644
index 0000000000..119947240f
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_with_password_refreshes_groups/data/provider_url/test-user@email.com/password
@@ -0,0 +1 @@
+Definitely a hashed password
\ No newline at end of file
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_with_password_refreshes_groups/data/provider_url/test-user@email.com/token.json b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_with_password_refreshes_groups/data/provider_url/test-user@email.com/token.json
new file mode 100644
index 0000000000..ecaed7cd75
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_with_password_refreshes_groups/data/provider_url/test-user@email.com/token.json
@@ -0,0 +1 @@
+Definitely a token
\ No newline at end of file
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_with_password_refreshes_groups/first_call b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_with_password_refreshes_groups/first_call
new file mode 100644
index 0000000000..0d246a68ad
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_with_password_refreshes_groups/first_call
@@ -0,0 +1,3 @@
+access: granted
+data: '{"userinfo":{"name":"test-user@email.com","uuid":"test-user-id","dir":"/home/test-user@email.com","shell":"/usr/bin/bash","gecos":"test-user@email.com","groups":[{"name":"refreshed-group","ugid":""}]}}'
+err: <nil>
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_with_password_still_allowed_if_no_refresh_token_and_server_is_unreachable/data/provider_url/test-user@email.com/password b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_with_password_still_allowed_if_no_refresh_token_and_server_is_unreachable/data/provider_url/test-user@email.com/password
new file mode 100644
index 0000000000..119947240f
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_with_password_still_allowed_if_no_refresh_token_and_server_is_unreachable/data/provider_url/test-user@email.com/password
@@ -0,0 +1 @@
+Definitely a hashed password
\ No newline at end of file
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_with_password_still_allowed_if_no_refresh_token_and_server_is_unreachable/data/provider_url/test-user@email.com/token.json b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_with_password_still_allowed_if_no_refresh_token_and_server_is_unreachable/data/provider_url/test-user@email.com/token.json
new file mode 100644
index 0000000000..ecaed7cd75
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_with_password_still_allowed_if_no_refresh_token_and_server_is_unreachable/data/provider_url/test-user@email.com/token.json
@@ -0,0 +1 @@
+Definitely a token
\ No newline at end of file
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_with_password_still_allowed_if_no_refresh_token_and_server_is_unreachable/first_call b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_with_password_still_allowed_if_no_refresh_token_and_server_is_unreachable/first_call
new file mode 100644
index 0000000000..aca00f387f
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_with_password_still_allowed_if_no_refresh_token_and_server_is_unreachable/first_call
@@ -0,0 +1,3 @@
+access: granted
+data: '{"userinfo":{"name":"test-user@email.com","uuid":"saved-user-id","dir":"/home/test-user@email.com","shell":"/usr/bin/bash","gecos":"test-user@email.com","groups":[{"name":"old-group","ugid":""}]}}'
+err: <nil>
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_with_password_still_allowed_if_server_is_unreachable/data/provider_url/test-user@email.com/password b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_with_password_still_allowed_if_server_is_unreachable/data/provider_url/test-user@email.com/password
new file mode 100644
index 0000000000..119947240f
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_with_password_still_allowed_if_server_is_unreachable/data/provider_url/test-user@email.com/password
@@ -0,0 +1 @@
+Definitely a hashed password
\ No newline at end of file
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_with_password_still_allowed_if_server_is_unreachable/data/provider_url/test-user@email.com/token.json b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_with_password_still_allowed_if_server_is_unreachable/data/provider_url/test-user@email.com/token.json
new file mode 100644
index 0000000000..ecaed7cd75
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_with_password_still_allowed_if_server_is_unreachable/data/provider_url/test-user@email.com/token.json
@@ -0,0 +1 @@
+Definitely a token
\ No newline at end of file
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_with_password_still_allowed_if_server_is_unreachable/first_call b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_with_password_still_allowed_if_server_is_unreachable/first_call
new file mode 100644
index 0000000000..2928c3a331
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_with_password_still_allowed_if_server_is_unreachable/first_call
@@ -0,0 +1,3 @@
+access: granted
+data: '{"userinfo":{"name":"test-user@email.com","uuid":"saved-user-id","dir":"/home/test-user@email.com","shell":"/usr/bin/bash","gecos":"test-user@email.com","groups":[{"name":"saved-remote-group","ugid":"12345"},{"name":"saved-local-group","ugid":""}]}}'
+err: <nil>
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_with_password_still_allowed_if_token_is_expired_and_server_is_unreachable/data/provider_url/test-user@email.com/password b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_with_password_still_allowed_if_token_is_expired_and_server_is_unreachable/data/provider_url/test-user@email.com/password
new file mode 100644
index 0000000000..119947240f
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_with_password_still_allowed_if_token_is_expired_and_server_is_unreachable/data/provider_url/test-user@email.com/password
@@ -0,0 +1 @@
+Definitely a hashed password
\ No newline at end of file
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_with_password_still_allowed_if_token_is_expired_and_server_is_unreachable/data/provider_url/test-user@email.com/token.json b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_with_password_still_allowed_if_token_is_expired_and_server_is_unreachable/data/provider_url/test-user@email.com/token.json
new file mode 100644
index 0000000000..ecaed7cd75
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_with_password_still_allowed_if_token_is_expired_and_server_is_unreachable/data/provider_url/test-user@email.com/token.json
@@ -0,0 +1 @@
+Definitely a token
\ No newline at end of file
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_with_password_still_allowed_if_token_is_expired_and_server_is_unreachable/first_call b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_with_password_still_allowed_if_token_is_expired_and_server_is_unreachable/first_call
new file mode 100644
index 0000000000..2928c3a331
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_with_password_still_allowed_if_token_is_expired_and_server_is_unreachable/first_call
@@ -0,0 +1,3 @@
+access: granted
+data: '{"userinfo":{"name":"test-user@email.com","uuid":"saved-user-id","dir":"/home/test-user@email.com","shell":"/usr/bin/bash","gecos":"test-user@email.com","groups":[{"name":"saved-remote-group","ugid":"12345"},{"name":"saved-local-group","ugid":""}]}}'
+err: <nil>
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_with_password_when_no_refresh_token_results_in_device_auth_as_next_mode/data/provider_url/test-user@email.com/password b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_with_password_when_no_refresh_token_results_in_device_auth_as_next_mode/data/provider_url/test-user@email.com/password
new file mode 100644
index 0000000000..119947240f
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_with_password_when_no_refresh_token_results_in_device_auth_as_next_mode/data/provider_url/test-user@email.com/password
@@ -0,0 +1 @@
+Definitely a hashed password
\ No newline at end of file
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_with_password_when_no_refresh_token_results_in_device_auth_as_next_mode/data/provider_url/test-user@email.com/token.json b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_with_password_when_no_refresh_token_results_in_device_auth_as_next_mode/data/provider_url/test-user@email.com/token.json
new file mode 100644
index 0000000000..ecaed7cd75
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_with_password_when_no_refresh_token_results_in_device_auth_as_next_mode/data/provider_url/test-user@email.com/token.json
@@ -0,0 +1 @@
+Definitely a token
\ No newline at end of file
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_with_password_when_no_refresh_token_results_in_device_auth_as_next_mode/first_call b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_with_password_when_no_refresh_token_results_in_device_auth_as_next_mode/first_call
new file mode 100644
index 0000000000..7b2d780726
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_with_password_when_no_refresh_token_results_in_device_auth_as_next_mode/first_call
@@ -0,0 +1,3 @@
+access: next
+data: '{"message":"Remote authentication failed: No refresh token. Please contact your administrator."}'
+err: <nil>
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_with_password_when_no_refresh_token_results_in_device_auth_as_next_mode/second_call b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_with_password_when_no_refresh_token_results_in_device_auth_as_next_mode/second_call
new file mode 100644
index 0000000000..d0887a134f
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_with_password_when_no_refresh_token_results_in_device_auth_as_next_mode/second_call
@@ -0,0 +1,3 @@
+access: next
+data: '{}'
+err: <nil>
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_with_password_when_provider_authentication_is_forced/data/provider_url/test-user@email.com/password b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_with_password_when_provider_authentication_is_forced/data/provider_url/test-user@email.com/password
new file mode 100644
index 0000000000..119947240f
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_with_password_when_provider_authentication_is_forced/data/provider_url/test-user@email.com/password
@@ -0,0 +1 @@
+Definitely a hashed password
\ No newline at end of file
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_with_password_when_provider_authentication_is_forced/data/provider_url/test-user@email.com/token.json b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_with_password_when_provider_authentication_is_forced/data/provider_url/test-user@email.com/token.json
new file mode 100644
index 0000000000..ecaed7cd75
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_with_password_when_provider_authentication_is_forced/data/provider_url/test-user@email.com/token.json
@@ -0,0 +1 @@
+Definitely a token
\ No newline at end of file
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_with_password_when_provider_authentication_is_forced/first_call b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_with_password_when_provider_authentication_is_forced/first_call
new file mode 100644
index 0000000000..f50b5eb551
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_with_password_when_provider_authentication_is_forced/first_call
@@ -0,0 +1,3 @@
+access: granted
+data: '{"userinfo":{"name":"test-user@email.com","uuid":"test-user-id","dir":"/home/test-user@email.com","shell":"/usr/bin/bash","gecos":"test-user@email.com","groups":[{"name":"remote-test-group","ugid":"12345"},{"name":"local-test-group","ugid":""}]}}'
+err: <nil>
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_with_password_when_provider_supports_device_registration/data/provider_url/test-user@email.com/password b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_with_password_when_provider_supports_device_registration/data/provider_url/test-user@email.com/password
new file mode 100644
index 0000000000..119947240f
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_with_password_when_provider_supports_device_registration/data/provider_url/test-user@email.com/password
@@ -0,0 +1 @@
+Definitely a hashed password
\ No newline at end of file
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_with_password_when_provider_supports_device_registration/data/provider_url/test-user@email.com/token.json b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_with_password_when_provider_supports_device_registration/data/provider_url/test-user@email.com/token.json
new file mode 100644
index 0000000000..ecaed7cd75
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_with_password_when_provider_supports_device_registration/data/provider_url/test-user@email.com/token.json
@@ -0,0 +1 @@
+Definitely a token
\ No newline at end of file
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_with_password_when_provider_supports_device_registration/first_call b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_with_password_when_provider_supports_device_registration/first_call
new file mode 100644
index 0000000000..f50b5eb551
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_with_password_when_provider_supports_device_registration/first_call
@@ -0,0 +1,3 @@
+access: granted
+data: '{"userinfo":{"name":"test-user@email.com","uuid":"test-user-id","dir":"/home/test-user@email.com","shell":"/usr/bin/bash","gecos":"test-user@email.com","groups":[{"name":"remote-test-group","ugid":"12345"},{"name":"local-test-group","ugid":""}]}}'
+err: <nil>
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_with_password_when_refresh_token_is_expired_results_in_device_auth_as_next_mode/data/provider_url/test-user@email.com/password b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_with_password_when_refresh_token_is_expired_results_in_device_auth_as_next_mode/data/provider_url/test-user@email.com/password
new file mode 100644
index 0000000000..119947240f
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_with_password_when_refresh_token_is_expired_results_in_device_auth_as_next_mode/data/provider_url/test-user@email.com/password
@@ -0,0 +1 @@
+Definitely a hashed password
\ No newline at end of file
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_with_password_when_refresh_token_is_expired_results_in_device_auth_as_next_mode/data/provider_url/test-user@email.com/token.json b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_with_password_when_refresh_token_is_expired_results_in_device_auth_as_next_mode/data/provider_url/test-user@email.com/token.json
new file mode 100644
index 0000000000..ecaed7cd75
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_with_password_when_refresh_token_is_expired_results_in_device_auth_as_next_mode/data/provider_url/test-user@email.com/token.json
@@ -0,0 +1 @@
+Definitely a token
\ No newline at end of file
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_with_password_when_refresh_token_is_expired_results_in_device_auth_as_next_mode/first_call b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_with_password_when_refresh_token_is_expired_results_in_device_auth_as_next_mode/first_call
new file mode 100644
index 0000000000..7cfe409ecb
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_with_password_when_refresh_token_is_expired_results_in_device_auth_as_next_mode/first_call
@@ -0,0 +1,3 @@
+access: next
+data: '{"message":"Refresh token expired, please authenticate again using device authentication."}'
+err: <nil>
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_with_password_when_refresh_token_is_expired_results_in_device_auth_as_next_mode/second_call b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_with_password_when_refresh_token_is_expired_results_in_device_auth_as_next_mode/second_call
new file mode 100644
index 0000000000..d0887a134f
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_with_password_when_refresh_token_is_expired_results_in_device_auth_as_next_mode/second_call
@@ -0,0 +1,3 @@
+access: next
+data: '{}'
+err: <nil>
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_with_qrcode_reacquires_token/data/provider_url/test-user@email.com/password b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_with_qrcode_reacquires_token/data/provider_url/test-user@email.com/password
new file mode 100644
index 0000000000..119947240f
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_with_qrcode_reacquires_token/data/provider_url/test-user@email.com/password
@@ -0,0 +1 @@
+Definitely a hashed password
\ No newline at end of file
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_with_qrcode_reacquires_token/data/provider_url/test-user@email.com/token.json b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_with_qrcode_reacquires_token/data/provider_url/test-user@email.com/token.json
new file mode 100644
index 0000000000..ecaed7cd75
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_with_qrcode_reacquires_token/data/provider_url/test-user@email.com/token.json
@@ -0,0 +1 @@
+Definitely a token
\ No newline at end of file
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_with_qrcode_reacquires_token/first_call b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_with_qrcode_reacquires_token/first_call
new file mode 100644
index 0000000000..d0887a134f
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_with_qrcode_reacquires_token/first_call
@@ -0,0 +1,3 @@
+access: next
+data: '{}'
+err: <nil>
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_with_qrcode_reacquires_token/second_call b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_with_qrcode_reacquires_token/second_call
new file mode 100644
index 0000000000..f50b5eb551
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Authenticating_with_qrcode_reacquires_token/second_call
@@ -0,0 +1,3 @@
+access: granted
+data: '{"userinfo":{"name":"test-user@email.com","uuid":"test-user-id","dir":"/home/test-user@email.com","shell":"/usr/bin/bash","gecos":"test-user@email.com","groups":[{"name":"remote-test-group","ugid":"12345"},{"name":"local-test-group","ugid":""}]}}'
+err: <nil>
diff --git a/internal/users/db/testdata/golden/TestMigrationToLowercaseUserAndGroupNamesEmptyDB/groups b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_IsAuthenticated_is_ongoing_for_session/data/.empty
similarity index 100%
rename from internal/users/db/testdata/golden/TestMigrationToLowercaseUserAndGroupNamesEmptyDB/groups
rename to authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_IsAuthenticated_is_ongoing_for_session/data/.empty
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_IsAuthenticated_is_ongoing_for_session/first_call b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_IsAuthenticated_is_ongoing_for_session/first_call
new file mode 100644
index 0000000000..d0887a134f
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_IsAuthenticated_is_ongoing_for_session/first_call
@@ -0,0 +1,3 @@
+access: next
+data: '{}'
+err: <nil>
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_IsAuthenticated_is_ongoing_for_session/second_call b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_IsAuthenticated_is_ongoing_for_session/second_call
new file mode 100644
index 0000000000..1cd265a88e
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_IsAuthenticated_is_ongoing_for_session/second_call
@@ -0,0 +1,3 @@
+access: denied
+data: '{}'
+err: authentication already running for this user session
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_authentication_data_is_invalid/data/.empty b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_authentication_data_is_invalid/data/.empty
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_authentication_data_is_invalid/first_call b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_authentication_data_is_invalid/first_call
new file mode 100644
index 0000000000..1ed5d6d1d0
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_authentication_data_is_invalid/first_call
@@ -0,0 +1,3 @@
+access: denied
+data: '{}'
+err: 'authentication data is not a valid json value: invalid character ''i'' looking for beginning of value'
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_can_not_cache_token/data/.empty b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_can_not_cache_token/data/.empty
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_can_not_cache_token/first_call b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_can_not_cache_token/first_call
new file mode 100644
index 0000000000..d0887a134f
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_can_not_cache_token/first_call
@@ -0,0 +1,3 @@
+access: next
+data: '{}'
+err: <nil>
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_can_not_cache_token/second_call b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_can_not_cache_token/second_call
new file mode 100644
index 0000000000..a329231079
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_can_not_cache_token/second_call
@@ -0,0 +1,3 @@
+access: denied
+data: '{"message":"An unexpected error occurred: failed to store password. Please report this error on https://github.com/canonical/authd/issues"}'
+err: <nil>
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_device_is_disabled_and_session_is_offline/data/provider_url/test-user@email.com/password b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_device_is_disabled_and_session_is_offline/data/provider_url/test-user@email.com/password
new file mode 100644
index 0000000000..119947240f
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_device_is_disabled_and_session_is_offline/data/provider_url/test-user@email.com/password
@@ -0,0 +1 @@
+Definitely a hashed password
\ No newline at end of file
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_device_is_disabled_and_session_is_offline/data/provider_url/test-user@email.com/token.json b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_device_is_disabled_and_session_is_offline/data/provider_url/test-user@email.com/token.json
new file mode 100644
index 0000000000..ecaed7cd75
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_device_is_disabled_and_session_is_offline/data/provider_url/test-user@email.com/token.json
@@ -0,0 +1 @@
+Definitely a token
\ No newline at end of file
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_device_is_disabled_and_session_is_offline/first_call b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_device_is_disabled_and_session_is_offline/first_call
new file mode 100644
index 0000000000..6d17fa8918
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_device_is_disabled_and_session_is_offline/first_call
@@ -0,0 +1,3 @@
+access: denied
+data: '{"message":"This device is disabled in Microsoft Entra ID. Please contact your administrator or try again with a working network connection."}'
+err: <nil>
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_empty_secret_is_provided_for_local_password/data/.empty b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_empty_secret_is_provided_for_local_password/data/.empty
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_empty_secret_is_provided_for_local_password/first_call b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_empty_secret_is_provided_for_local_password/first_call
new file mode 100644
index 0000000000..d0887a134f
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_empty_secret_is_provided_for_local_password/first_call
@@ -0,0 +1,3 @@
+access: next
+data: '{}'
+err: <nil>
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_empty_secret_is_provided_for_local_password/second_call b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_empty_secret_is_provided_for_local_password/second_call
new file mode 100644
index 0000000000..3629f92c63
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_empty_secret_is_provided_for_local_password/second_call
@@ -0,0 +1,3 @@
+access: retry
+data: '{"message":"An unexpected error occurred: empty secret. Please report this error on https://github.com/canonical/authd/issues"}'
+err: <nil>
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_mode_is_invalid/data/.empty b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_mode_is_invalid/data/.empty
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_mode_is_invalid/first_call b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_mode_is_invalid/first_call
new file mode 100644
index 0000000000..d55df3d2e4
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_mode_is_invalid/first_call
@@ -0,0 +1,3 @@
+access: denied
+data: '{"message":"An unexpected error occurred: unknown authentication mode. Please report this error on https://github.com/canonical/authd/issues"}'
+err: <nil>
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_mode_is_link_code_and_can_not_get_token/data/.empty b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_mode_is_link_code_and_can_not_get_token/data/.empty
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_mode_is_link_code_and_can_not_get_token/first_call b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_mode_is_link_code_and_can_not_get_token/first_call
new file mode 100644
index 0000000000..20ac2d889e
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_mode_is_link_code_and_can_not_get_token/first_call
@@ -0,0 +1,3 @@
+access: retry
+data: '{"message":"Error retrieving access token. Please try again."}'
+err: <nil>
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_mode_is_link_code_and_can_not_get_token_due_to_timeout/data/.empty b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_mode_is_link_code_and_can_not_get_token_due_to_timeout/data/.empty
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_mode_is_link_code_and_can_not_get_token_due_to_timeout/first_call b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_mode_is_link_code_and_can_not_get_token_due_to_timeout/first_call
new file mode 100644
index 0000000000..20ac2d889e
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_mode_is_link_code_and_can_not_get_token_due_to_timeout/first_call
@@ -0,0 +1,3 @@
+access: retry
+data: '{"message":"Error retrieving access token. Please try again."}'
+err: <nil>
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_mode_is_link_code_and_link_expires/data/.empty b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_mode_is_link_code_and_link_expires/data/.empty
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_mode_is_link_code_and_link_expires/first_call b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_mode_is_link_code_and_link_expires/first_call
new file mode 100644
index 0000000000..20ac2d889e
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_mode_is_link_code_and_link_expires/first_call
@@ -0,0 +1,3 @@
+access: retry
+data: '{"message":"Error retrieving access token. Please try again."}'
+err: <nil>
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_mode_is_newpassword_and_session_has_no_token/data/.empty b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_mode_is_newpassword_and_session_has_no_token/data/.empty
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_mode_is_newpassword_and_session_has_no_token/first_call b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_mode_is_newpassword_and_session_has_no_token/first_call
new file mode 100644
index 0000000000..af5a5ed71f
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_mode_is_newpassword_and_session_has_no_token/first_call
@@ -0,0 +1,3 @@
+access: denied
+data: '{"message":"An unexpected error occurred: auth info is not set. Please report this error on https://github.com/canonical/authd/issues"}'
+err: <nil>
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_mode_is_password_and_no_refresh_token/data/provider_url/test-user@email.com/password b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_mode_is_password_and_no_refresh_token/data/provider_url/test-user@email.com/password
new file mode 100644
index 0000000000..119947240f
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_mode_is_password_and_no_refresh_token/data/provider_url/test-user@email.com/password
@@ -0,0 +1 @@
+Definitely a hashed password
\ No newline at end of file
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_mode_is_password_and_no_refresh_token/data/provider_url/test-user@email.com/token.json b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_mode_is_password_and_no_refresh_token/data/provider_url/test-user@email.com/token.json
new file mode 100644
index 0000000000..ecaed7cd75
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_mode_is_password_and_no_refresh_token/data/provider_url/test-user@email.com/token.json
@@ -0,0 +1 @@
+Definitely a token
\ No newline at end of file
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_mode_is_password_and_no_refresh_token/first_call b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_mode_is_password_and_no_refresh_token/first_call
new file mode 100644
index 0000000000..7b2d780726
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_mode_is_password_and_no_refresh_token/first_call
@@ -0,0 +1,3 @@
+access: next
+data: '{"message":"Remote authentication failed: No refresh token. Please contact your administrator."}'
+err: <nil>
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_mode_is_password_and_token_does_not_exist/data/.empty b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_mode_is_password_and_token_does_not_exist/data/.empty
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_mode_is_password_and_token_does_not_exist/first_call b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_mode_is_password_and_token_does_not_exist/first_call
new file mode 100644
index 0000000000..e28fc80a14
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_mode_is_password_and_token_does_not_exist/first_call
@@ -0,0 +1,3 @@
+access: denied
+data: '{"message":"An unexpected error occurred: could not check password. Please report this error on https://github.com/canonical/authd/issues"}'
+err: <nil>
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_mode_is_password_and_token_is_invalid/data/provider_url/test-user@email.com/password b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_mode_is_password_and_token_is_invalid/data/provider_url/test-user@email.com/password
new file mode 100644
index 0000000000..119947240f
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_mode_is_password_and_token_is_invalid/data/provider_url/test-user@email.com/password
@@ -0,0 +1 @@
+Definitely a hashed password
\ No newline at end of file
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_mode_is_password_and_token_is_invalid/data/provider_url/test-user@email.com/token.json b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_mode_is_password_and_token_is_invalid/data/provider_url/test-user@email.com/token.json
new file mode 100644
index 0000000000..ecaed7cd75
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_mode_is_password_and_token_is_invalid/data/provider_url/test-user@email.com/token.json
@@ -0,0 +1 @@
+Definitely a token
\ No newline at end of file
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_mode_is_password_and_token_is_invalid/first_call b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_mode_is_password_and_token_is_invalid/first_call
new file mode 100644
index 0000000000..c57483aac8
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_mode_is_password_and_token_is_invalid/first_call
@@ -0,0 +1,3 @@
+access: denied
+data: '{"message":"An unexpected error occurred: could not load stored token. Please report this error on https://github.com/canonical/authd/issues"}'
+err: <nil>
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_mode_is_password_and_token_refresh_times_out/data/provider_url/test-user@email.com/password b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_mode_is_password_and_token_refresh_times_out/data/provider_url/test-user@email.com/password
new file mode 100644
index 0000000000..119947240f
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_mode_is_password_and_token_refresh_times_out/data/provider_url/test-user@email.com/password
@@ -0,0 +1 @@
+Definitely a hashed password
\ No newline at end of file
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_mode_is_password_and_token_refresh_times_out/data/provider_url/test-user@email.com/token.json b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_mode_is_password_and_token_refresh_times_out/data/provider_url/test-user@email.com/token.json
new file mode 100644
index 0000000000..ecaed7cd75
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_mode_is_password_and_token_refresh_times_out/data/provider_url/test-user@email.com/token.json
@@ -0,0 +1 @@
+Definitely a token
\ No newline at end of file
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_mode_is_password_and_token_refresh_times_out/first_call b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_mode_is_password_and_token_refresh_times_out/first_call
new file mode 100644
index 0000000000..9ddc2b8193
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_mode_is_password_and_token_refresh_times_out/first_call
@@ -0,0 +1,3 @@
+access: denied
+data: '{"message":"Failed to refresh token"}'
+err: <nil>
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_mode_is_password_but_server_returns_error/data/provider_url/test-user@email.com/password b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_mode_is_password_but_server_returns_error/data/provider_url/test-user@email.com/password
new file mode 100644
index 0000000000..119947240f
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_mode_is_password_but_server_returns_error/data/provider_url/test-user@email.com/password
@@ -0,0 +1 @@
+Definitely a hashed password
\ No newline at end of file
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_mode_is_password_but_server_returns_error/data/provider_url/test-user@email.com/token.json b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_mode_is_password_but_server_returns_error/data/provider_url/test-user@email.com/token.json
new file mode 100644
index 0000000000..ecaed7cd75
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_mode_is_password_but_server_returns_error/data/provider_url/test-user@email.com/token.json
@@ -0,0 +1 @@
+Definitely a token
\ No newline at end of file
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_mode_is_password_but_server_returns_error/first_call b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_mode_is_password_but_server_returns_error/first_call
new file mode 100644
index 0000000000..9ddc2b8193
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_mode_is_password_but_server_returns_error/first_call
@@ -0,0 +1,3 @@
+access: denied
+data: '{"message":"Failed to refresh token"}'
+err: <nil>
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_mode_is_qrcode_and_can_not_get_token/data/.empty b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_mode_is_qrcode_and_can_not_get_token/data/.empty
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_mode_is_qrcode_and_can_not_get_token/first_call b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_mode_is_qrcode_and_can_not_get_token/first_call
new file mode 100644
index 0000000000..20ac2d889e
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_mode_is_qrcode_and_can_not_get_token/first_call
@@ -0,0 +1,3 @@
+access: retry
+data: '{"message":"Error retrieving access token. Please try again."}'
+err: <nil>
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_mode_is_qrcode_and_can_not_get_token_due_to_timeout/data/.empty b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_mode_is_qrcode_and_can_not_get_token_due_to_timeout/data/.empty
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_mode_is_qrcode_and_can_not_get_token_due_to_timeout/first_call b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_mode_is_qrcode_and_can_not_get_token_due_to_timeout/first_call
new file mode 100644
index 0000000000..20ac2d889e
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_mode_is_qrcode_and_can_not_get_token_due_to_timeout/first_call
@@ -0,0 +1,3 @@
+access: retry
+data: '{"message":"Error retrieving access token. Please try again."}'
+err: <nil>
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_mode_is_qrcode_and_link_expires/data/.empty b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_mode_is_qrcode_and_link_expires/data/.empty
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_mode_is_qrcode_and_link_expires/first_call b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_mode_is_qrcode_and_link_expires/first_call
new file mode 100644
index 0000000000..20ac2d889e
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_mode_is_qrcode_and_link_expires/first_call
@@ -0,0 +1,3 @@
+access: retry
+data: '{"message":"Error retrieving access token. Please try again."}'
+err: <nil>
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_provided_wrong_secret/data/provider_url/test-user@email.com/password b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_provided_wrong_secret/data/provider_url/test-user@email.com/password
new file mode 100644
index 0000000000..119947240f
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_provided_wrong_secret/data/provider_url/test-user@email.com/password
@@ -0,0 +1 @@
+Definitely a hashed password
\ No newline at end of file
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_provided_wrong_secret/data/provider_url/test-user@email.com/token.json b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_provided_wrong_secret/data/provider_url/test-user@email.com/token.json
new file mode 100644
index 0000000000..ecaed7cd75
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_provided_wrong_secret/data/provider_url/test-user@email.com/token.json
@@ -0,0 +1 @@
+Definitely a token
\ No newline at end of file
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_provided_wrong_secret/first_call b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_provided_wrong_secret/first_call
new file mode 100644
index 0000000000..ba81768a7a
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_provided_wrong_secret/first_call
@@ -0,0 +1,3 @@
+access: retry
+data: '{"message":"Incorrect password, please try again."}'
+err: <nil>
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_provider_authentication_is_forced_and_session_is_offline/data/provider_url/test-user@email.com/password b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_provider_authentication_is_forced_and_session_is_offline/data/provider_url/test-user@email.com/password
new file mode 100644
index 0000000000..119947240f
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_provider_authentication_is_forced_and_session_is_offline/data/provider_url/test-user@email.com/password
@@ -0,0 +1 @@
+Definitely a hashed password
\ No newline at end of file
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_provider_authentication_is_forced_and_session_is_offline/data/provider_url/test-user@email.com/token.json b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_provider_authentication_is_forced_and_session_is_offline/data/provider_url/test-user@email.com/token.json
new file mode 100644
index 0000000000..ecaed7cd75
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_provider_authentication_is_forced_and_session_is_offline/data/provider_url/test-user@email.com/token.json
@@ -0,0 +1 @@
+Definitely a token
\ No newline at end of file
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_provider_authentication_is_forced_and_session_is_offline/first_call b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_provider_authentication_is_forced_and_session_is_offline/first_call
new file mode 100644
index 0000000000..6df9858167
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_provider_authentication_is_forced_and_session_is_offline/first_call
@@ -0,0 +1,3 @@
+access: denied
+data: '{"message":"Remote authentication failed: identity provider is not reachable"}'
+err: <nil>
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_secret_can_not_be_decrypted/data/.empty b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_secret_can_not_be_decrypted/data/.empty
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_secret_can_not_be_decrypted/first_call b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_secret_can_not_be_decrypted/first_call
new file mode 100644
index 0000000000..b5e4d86786
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_secret_can_not_be_decrypted/first_call
@@ -0,0 +1,3 @@
+access: retry
+data: '{"message":"An unexpected error occurred: could not decode secret. Please report this error on https://github.com/canonical/authd/issues"}'
+err: <nil>
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_selected_username_does_not_match_the_provider_one/data/.empty b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_selected_username_does_not_match_the_provider_one/data/.empty
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_selected_username_does_not_match_the_provider_one/first_call b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_selected_username_does_not_match_the_provider_one/first_call
new file mode 100644
index 0000000000..7ade8c427e
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_selected_username_does_not_match_the_provider_one/first_call
@@ -0,0 +1,3 @@
+access: denied
+data: '{"message":"Authentication failure: requested username \"not-matching\" does not match the authenticated user \"test-user@email.com\""}'
+err: <nil>
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_token_is_expired_and_refreshing_token_fails/data/provider_url/test-user@email.com/password b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_token_is_expired_and_refreshing_token_fails/data/provider_url/test-user@email.com/password
new file mode 100644
index 0000000000..119947240f
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_token_is_expired_and_refreshing_token_fails/data/provider_url/test-user@email.com/password
@@ -0,0 +1 @@
+Definitely a hashed password
\ No newline at end of file
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_token_is_expired_and_refreshing_token_fails/data/provider_url/test-user@email.com/token.json b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_token_is_expired_and_refreshing_token_fails/data/provider_url/test-user@email.com/token.json
new file mode 100644
index 0000000000..ecaed7cd75
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_token_is_expired_and_refreshing_token_fails/data/provider_url/test-user@email.com/token.json
@@ -0,0 +1 @@
+Definitely a token
\ No newline at end of file
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_token_is_expired_and_refreshing_token_fails/first_call b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_token_is_expired_and_refreshing_token_fails/first_call
new file mode 100644
index 0000000000..7b2d780726
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_token_is_expired_and_refreshing_token_fails/first_call
@@ -0,0 +1,3 @@
+access: next
+data: '{"message":"Remote authentication failed: No refresh token. Please contact your administrator."}'
+err: <nil>
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_user_is_disabled_and_session_is_offline/data/provider_url/test-user@email.com/password b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_user_is_disabled_and_session_is_offline/data/provider_url/test-user@email.com/password
new file mode 100644
index 0000000000..119947240f
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_user_is_disabled_and_session_is_offline/data/provider_url/test-user@email.com/password
@@ -0,0 +1 @@
+Definitely a hashed password
\ No newline at end of file
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_user_is_disabled_and_session_is_offline/data/provider_url/test-user@email.com/token.json b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_user_is_disabled_and_session_is_offline/data/provider_url/test-user@email.com/token.json
new file mode 100644
index 0000000000..ecaed7cd75
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_user_is_disabled_and_session_is_offline/data/provider_url/test-user@email.com/token.json
@@ -0,0 +1 @@
+Definitely a token
\ No newline at end of file
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_user_is_disabled_and_session_is_offline/first_call b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_user_is_disabled_and_session_is_offline/first_call
new file mode 100644
index 0000000000..a2db4ae326
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Error_when_user_is_disabled_and_session_is_offline/first_call
@@ -0,0 +1,3 @@
+access: denied
+data: '{"message":"This user is disabled in Microsoft Entra ID. Please contact your administrator or try again with a working network connection."}'
+err: <nil>
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Extra_groups_configured/data/provider_url/test-user@email.com/password b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Extra_groups_configured/data/provider_url/test-user@email.com/password
new file mode 100644
index 0000000000..119947240f
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Extra_groups_configured/data/provider_url/test-user@email.com/password
@@ -0,0 +1 @@
+Definitely a hashed password
\ No newline at end of file
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Extra_groups_configured/data/provider_url/test-user@email.com/token.json b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Extra_groups_configured/data/provider_url/test-user@email.com/token.json
new file mode 100644
index 0000000000..ecaed7cd75
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Extra_groups_configured/data/provider_url/test-user@email.com/token.json
@@ -0,0 +1 @@
+Definitely a token
\ No newline at end of file
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Extra_groups_configured/first_call b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Extra_groups_configured/first_call
new file mode 100644
index 0000000000..c767dfccbf
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Extra_groups_configured/first_call
@@ -0,0 +1,3 @@
+access: granted
+data: '{"userinfo":{"name":"test-user@email.com","uuid":"test-user-id","dir":"/home/test-user@email.com","shell":"/usr/bin/bash","gecos":"test-user@email.com","groups":[{"name":"remote-group","ugid":""},{"name":"extra-group","ugid":""}]}}'
+err: <nil>
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Owner_extra_groups_configured/data/provider_url/test-user@email.com/password b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Owner_extra_groups_configured/data/provider_url/test-user@email.com/password
new file mode 100644
index 0000000000..119947240f
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Owner_extra_groups_configured/data/provider_url/test-user@email.com/password
@@ -0,0 +1 @@
+Definitely a hashed password
\ No newline at end of file
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Owner_extra_groups_configured/data/provider_url/test-user@email.com/token.json b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Owner_extra_groups_configured/data/provider_url/test-user@email.com/token.json
new file mode 100644
index 0000000000..ecaed7cd75
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Owner_extra_groups_configured/data/provider_url/test-user@email.com/token.json
@@ -0,0 +1 @@
+Definitely a token
\ No newline at end of file
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Owner_extra_groups_configured/first_call b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Owner_extra_groups_configured/first_call
new file mode 100644
index 0000000000..26add22993
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Owner_extra_groups_configured/first_call
@@ -0,0 +1,3 @@
+access: granted
+data: '{"userinfo":{"name":"test-user@email.com","uuid":"test-user-id","dir":"/home/test-user@email.com","shell":"/usr/bin/bash","gecos":"test-user@email.com","groups":[{"name":"remote-group","ugid":""},{"name":"owner-group","ugid":""}]}}'
+err: <nil>
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Owner_extra_groups_configured_but_user_does_not_become_owner/data/provider_url/test-user@email.com/password b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Owner_extra_groups_configured_but_user_does_not_become_owner/data/provider_url/test-user@email.com/password
new file mode 100644
index 0000000000..119947240f
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Owner_extra_groups_configured_but_user_does_not_become_owner/data/provider_url/test-user@email.com/password
@@ -0,0 +1 @@
+Definitely a hashed password
\ No newline at end of file
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Owner_extra_groups_configured_but_user_does_not_become_owner/data/provider_url/test-user@email.com/token.json b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Owner_extra_groups_configured_but_user_does_not_become_owner/data/provider_url/test-user@email.com/token.json
new file mode 100644
index 0000000000..ecaed7cd75
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Owner_extra_groups_configured_but_user_does_not_become_owner/data/provider_url/test-user@email.com/token.json
@@ -0,0 +1 @@
+Definitely a token
\ No newline at end of file
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Owner_extra_groups_configured_but_user_does_not_become_owner/first_call b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Owner_extra_groups_configured_but_user_does_not_become_owner/first_call
new file mode 100644
index 0000000000..e97c996716
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Owner_extra_groups_configured_but_user_does_not_become_owner/first_call
@@ -0,0 +1,3 @@
+access: granted
+data: '{"userinfo":{"name":"test-user@email.com","uuid":"test-user-id","dir":"/home/test-user@email.com","shell":"/usr/bin/bash","gecos":"test-user@email.com","groups":[{"name":"remote-group","ugid":""}]}}'
+err: <nil>
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Successfully_authenticate_user_with_device_auth_and_newpassword/data/provider_url/test-user@email.com/password b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Successfully_authenticate_user_with_device_auth_and_newpassword/data/provider_url/test-user@email.com/password
new file mode 100644
index 0000000000..119947240f
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Successfully_authenticate_user_with_device_auth_and_newpassword/data/provider_url/test-user@email.com/password
@@ -0,0 +1 @@
+Definitely a hashed password
\ No newline at end of file
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Successfully_authenticate_user_with_device_auth_and_newpassword/data/provider_url/test-user@email.com/token.json b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Successfully_authenticate_user_with_device_auth_and_newpassword/data/provider_url/test-user@email.com/token.json
new file mode 100644
index 0000000000..ecaed7cd75
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Successfully_authenticate_user_with_device_auth_and_newpassword/data/provider_url/test-user@email.com/token.json
@@ -0,0 +1 @@
+Definitely a token
\ No newline at end of file
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Successfully_authenticate_user_with_device_auth_and_newpassword/first_call b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Successfully_authenticate_user_with_device_auth_and_newpassword/first_call
new file mode 100644
index 0000000000..d0887a134f
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Successfully_authenticate_user_with_device_auth_and_newpassword/first_call
@@ -0,0 +1,3 @@
+access: next
+data: '{}'
+err: <nil>
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Successfully_authenticate_user_with_device_auth_and_newpassword/second_call b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Successfully_authenticate_user_with_device_auth_and_newpassword/second_call
new file mode 100644
index 0000000000..f50b5eb551
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Successfully_authenticate_user_with_device_auth_and_newpassword/second_call
@@ -0,0 +1,3 @@
+access: granted
+data: '{"userinfo":{"name":"test-user@email.com","uuid":"test-user-id","dir":"/home/test-user@email.com","shell":"/usr/bin/bash","gecos":"test-user@email.com","groups":[{"name":"remote-test-group","ugid":"12345"},{"name":"local-test-group","ugid":""}]}}'
+err: <nil>
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Successfully_authenticate_user_with_password/data/provider_url/test-user@email.com/password b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Successfully_authenticate_user_with_password/data/provider_url/test-user@email.com/password
new file mode 100644
index 0000000000..119947240f
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Successfully_authenticate_user_with_password/data/provider_url/test-user@email.com/password
@@ -0,0 +1 @@
+Definitely a hashed password
\ No newline at end of file
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Successfully_authenticate_user_with_password/data/provider_url/test-user@email.com/token.json b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Successfully_authenticate_user_with_password/data/provider_url/test-user@email.com/token.json
new file mode 100644
index 0000000000..ecaed7cd75
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Successfully_authenticate_user_with_password/data/provider_url/test-user@email.com/token.json
@@ -0,0 +1 @@
+Definitely a token
\ No newline at end of file
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Successfully_authenticate_user_with_password/first_call b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Successfully_authenticate_user_with_password/first_call
new file mode 100644
index 0000000000..f50b5eb551
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestIsAuthenticated/Successfully_authenticate_user_with_password/first_call
@@ -0,0 +1,3 @@
+access: granted
+data: '{"userinfo":{"name":"test-user@email.com","uuid":"test-user-id","dir":"/home/test-user@email.com","shell":"/usr/bin/bash","gecos":"test-user@email.com","groups":[{"name":"remote-test-group","ugid":"12345"},{"name":"local-test-group","ugid":""}]}}'
+err: <nil>
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestParseConfig/Do_not_fail_if_values_contain_a_single_template_delimiter/config.txt b/authd-oidc-brokers/internal/broker/testdata/golden/TestParseConfig/Do_not_fail_if_values_contain_a_single_template_delimiter/config.txt
new file mode 100644
index 0000000000..c68cb5a100
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestParseConfig/Do_not_fail_if_values_contain_a_single_template_delimiter/config.txt
@@ -0,0 +1,15 @@
+clientID=<CLIENT_ID
+clientSecret=
+issuerURL=https://ISSUER_URL>
+forceProviderAuthentication=false
+registerDevice=false
+allowedUsers=map[]
+allUsersAllowed=false
+ownerAllowed=true
+firstUserBecomesOwner=true
+owner=
+homeBaseDir=
+allowedSSHSuffixes=[]
+extraGroups=[]
+ownerExtraGroups=[]
+extraScopes=[]
\ No newline at end of file
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestParseConfig/Successfully_parse_config_file/config.txt b/authd-oidc-brokers/internal/broker/testdata/golden/TestParseConfig/Successfully_parse_config_file/config.txt
new file mode 100644
index 0000000000..ce860f6ee7
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestParseConfig/Successfully_parse_config_file/config.txt
@@ -0,0 +1,15 @@
+clientID=client_id
+clientSecret=
+issuerURL=https://issuer.url.com
+forceProviderAuthentication=false
+registerDevice=false
+allowedUsers=map[]
+allUsersAllowed=false
+ownerAllowed=true
+firstUserBecomesOwner=true
+owner=
+homeBaseDir=
+allowedSSHSuffixes=[]
+extraGroups=[]
+ownerExtraGroups=[]
+extraScopes=[]
\ No newline at end of file
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestParseConfig/Successfully_parse_config_file_with_optional_values/config.txt b/authd-oidc-brokers/internal/broker/testdata/golden/TestParseConfig/Successfully_parse_config_file_with_optional_values/config.txt
new file mode 100644
index 0000000000..186c12ac12
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestParseConfig/Successfully_parse_config_file_with_optional_values/config.txt
@@ -0,0 +1,15 @@
+clientID=client_id
+clientSecret=
+issuerURL=https://issuer.url.com
+forceProviderAuthentication=true
+registerDevice=false
+allowedUsers=map[]
+allUsersAllowed=false
+ownerAllowed=true
+firstUserBecomesOwner=true
+owner=
+homeBaseDir=/home
+allowedSSHSuffixes=[]
+extraGroups=[]
+ownerExtraGroups=[]
+extraScopes=[groups offline_access some_other_scope]
\ No newline at end of file
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestParseConfig/Successfully_parse_config_with_drop_in_files/config.txt b/authd-oidc-brokers/internal/broker/testdata/golden/TestParseConfig/Successfully_parse_config_with_drop_in_files/config.txt
new file mode 100644
index 0000000000..984aee7a70
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestParseConfig/Successfully_parse_config_with_drop_in_files/config.txt
@@ -0,0 +1,15 @@
+clientID=lower_precedence_client_id
+clientSecret=
+issuerURL=https://higher-precedence-issuer.url.com
+forceProviderAuthentication=true
+registerDevice=false
+allowedUsers=map[]
+allUsersAllowed=false
+ownerAllowed=true
+firstUserBecomesOwner=true
+owner=
+homeBaseDir=/home
+allowedSSHSuffixes=[]
+extraGroups=[]
+ownerExtraGroups=[]
+extraScopes=[groups offline_access some_other_scope]
\ No newline at end of file
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestParseUserConfig/All_are_allowed/broker.conf b/authd-oidc-brokers/internal/broker/testdata/golden/TestParseUserConfig/All_are_allowed/broker.conf
new file mode 100644
index 0000000000..18badfb1e6
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestParseUserConfig/All_are_allowed/broker.conf
@@ -0,0 +1,10 @@
+
+[oidc]
+issuer = https://issuer.url.com
+client_id = client_id
+
+[users]
+allowed_users = ALL
+owner = machine_owner
+home_base_dir = /home
+allowed_ssh_suffixes_first_auth = @issuer.url.com
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestParseUserConfig/All_are_allowed/broker.conf.d/.empty b/authd-oidc-brokers/internal/broker/testdata/golden/TestParseUserConfig/All_are_allowed/broker.conf.d/.empty
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestParseUserConfig/By_default_only_owner_is_allowed/broker.conf b/authd-oidc-brokers/internal/broker/testdata/golden/TestParseUserConfig/By_default_only_owner_is_allowed/broker.conf
new file mode 100644
index 0000000000..1c8f8105bf
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestParseUserConfig/By_default_only_owner_is_allowed/broker.conf
@@ -0,0 +1,9 @@
+
+[oidc]
+issuer = https://issuer.url.com
+client_id = client_id
+
+[users]
+owner = machine_owner
+home_base_dir = /home
+allowed_ssh_suffixes_first_auth = @issuer.url.com
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestParseUserConfig/By_default_only_owner_is_allowed/broker.conf.d/.empty b/authd-oidc-brokers/internal/broker/testdata/golden/TestParseUserConfig/By_default_only_owner_is_allowed/broker.conf.d/.empty
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestParseUserConfig/Only_owner_is_allowed/broker.conf b/authd-oidc-brokers/internal/broker/testdata/golden/TestParseUserConfig/Only_owner_is_allowed/broker.conf
new file mode 100644
index 0000000000..4146b36d1c
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestParseUserConfig/Only_owner_is_allowed/broker.conf
@@ -0,0 +1,10 @@
+
+[oidc]
+issuer = https://issuer.url.com
+client_id = client_id
+
+[users]
+allowed_users = OWNER
+owner = machine_owner
+home_base_dir = /home
+allowed_ssh_suffixes_first_auth = @issuer.url.com
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestParseUserConfig/Only_owner_is_allowed/broker.conf.d/.empty b/authd-oidc-brokers/internal/broker/testdata/golden/TestParseUserConfig/Only_owner_is_allowed/broker.conf.d/.empty
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestParseUserConfig/Only_owner_is_allowed_but_is_empty/broker.conf b/authd-oidc-brokers/internal/broker/testdata/golden/TestParseUserConfig/Only_owner_is_allowed_but_is_empty/broker.conf
new file mode 100644
index 0000000000..6fedf4fead
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestParseUserConfig/Only_owner_is_allowed_but_is_empty/broker.conf
@@ -0,0 +1,9 @@
+
+[oidc]
+issuer = https://issuer.url.com
+client_id = client_id
+
+[users]
+owner =
+home_base_dir = /home
+allowed_ssh_suffixes_first_auth = @issuer.url.com
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestParseUserConfig/Only_owner_is_allowed_but_is_empty/broker.conf.d/.empty b/authd-oidc-brokers/internal/broker/testdata/golden/TestParseUserConfig/Only_owner_is_allowed_but_is_empty/broker.conf.d/.empty
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestParseUserConfig/Only_owner_is_allowed_but_is_unset/broker.conf b/authd-oidc-brokers/internal/broker/testdata/golden/TestParseUserConfig/Only_owner_is_allowed_but_is_unset/broker.conf
new file mode 100644
index 0000000000..7657c12ad9
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestParseUserConfig/Only_owner_is_allowed_but_is_unset/broker.conf
@@ -0,0 +1,8 @@
+
+[oidc]
+issuer = https://issuer.url.com
+client_id = client_id
+
+[users]
+home_base_dir = /home
+allowed_ssh_suffixes_first_auth = @issuer.url.com
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestParseUserConfig/Only_owner_is_allowed_but_is_unset/broker.conf.d/.empty b/authd-oidc-brokers/internal/broker/testdata/golden/TestParseUserConfig/Only_owner_is_allowed_but_is_unset/broker.conf.d/.empty
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestParseUserConfig/Set_owner_and_u1_is_allowed/broker.conf b/authd-oidc-brokers/internal/broker/testdata/golden/TestParseUserConfig/Set_owner_and_u1_is_allowed/broker.conf
new file mode 100644
index 0000000000..4d5ee91a36
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestParseUserConfig/Set_owner_and_u1_is_allowed/broker.conf
@@ -0,0 +1,10 @@
+
+[oidc]
+issuer = https://issuer.url.com
+client_id = client_id
+
+[users]
+allowed_users = OWNER,u1
+owner = machine_owner
+home_base_dir = /home
+allowed_ssh_suffixes_first_auth = @issuer.url.com
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestParseUserConfig/Set_owner_and_u1_is_allowed/broker.conf.d/.empty b/authd-oidc-brokers/internal/broker/testdata/golden/TestParseUserConfig/Set_owner_and_u1_is_allowed/broker.conf.d/.empty
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestParseUserConfig/Support_old_suffixes_key/broker.conf b/authd-oidc-brokers/internal/broker/testdata/golden/TestParseUserConfig/Support_old_suffixes_key/broker.conf
new file mode 100644
index 0000000000..b777f7fc85
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestParseUserConfig/Support_old_suffixes_key/broker.conf
@@ -0,0 +1,10 @@
+
+[oidc]
+issuer = https://issuer.url.com
+client_id = client_id
+
+[users]
+allowed_users = ALL
+owner = machine_owner
+home_base_dir = /home
+allowed_ssh_suffixes = @issuer.url.com
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestParseUserConfig/Support_old_suffixes_key/broker.conf.d/.empty b/authd-oidc-brokers/internal/broker/testdata/golden/TestParseUserConfig/Support_old_suffixes_key/broker.conf.d/.empty
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestParseUserConfig/Unset_owner_and_u1_is_allowed/broker.conf b/authd-oidc-brokers/internal/broker/testdata/golden/TestParseUserConfig/Unset_owner_and_u1_is_allowed/broker.conf
new file mode 100644
index 0000000000..39fc9aa19b
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestParseUserConfig/Unset_owner_and_u1_is_allowed/broker.conf
@@ -0,0 +1,9 @@
+
+[oidc]
+issuer = https://issuer.url.com
+client_id = client_id
+
+[users]
+allowed_users = OWNER,u1
+home_base_dir = /home
+allowed_ssh_suffixes_first_auth = @issuer.url.com
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestParseUserConfig/Unset_owner_and_u1_is_allowed/broker.conf.d/.empty b/authd-oidc-brokers/internal/broker/testdata/golden/TestParseUserConfig/Unset_owner_and_u1_is_allowed/broker.conf.d/.empty
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestParseUserConfig/Users_u1_and_u2_are_allowed/broker.conf b/authd-oidc-brokers/internal/broker/testdata/golden/TestParseUserConfig/Users_u1_and_u2_are_allowed/broker.conf
new file mode 100644
index 0000000000..fd4ce484d7
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestParseUserConfig/Users_u1_and_u2_are_allowed/broker.conf
@@ -0,0 +1,9 @@
+
+[oidc]
+issuer = https://issuer.url.com
+client_id = client_id
+
+[users]
+allowed_users = u1,u2
+home_base_dir = /home
+allowed_ssh_suffixes_first_auth = @issuer.url.com
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestParseUserConfig/Users_u1_and_u2_are_allowed/broker.conf.d/.empty b/authd-oidc-brokers/internal/broker/testdata/golden/TestParseUserConfig/Users_u1_and_u2_are_allowed/broker.conf.d/.empty
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestRegisterOwner/broker.conf b/authd-oidc-brokers/internal/broker/testdata/golden/TestRegisterOwner/broker.conf
new file mode 100644
index 0000000000..aa6cfd3e38
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestRegisterOwner/broker.conf
@@ -0,0 +1,4 @@
+
+[oidc]
+issuer = https://issuer.url.com
+client_id = client_id
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestRegisterOwner/broker.conf.d/20-owner-autoregistration.conf b/authd-oidc-brokers/internal/broker/testdata/golden/TestRegisterOwner/broker.conf.d/20-owner-autoregistration.conf
new file mode 100644
index 0000000000..f6c5a43bef
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestRegisterOwner/broker.conf.d/20-owner-autoregistration.conf
@@ -0,0 +1,13 @@
+## This file was generated automatically by the broker. DO NOT EDIT.
+##
+## This file registers the first authenticated user as the owner of
+## this device.
+##
+## The 'owner' option is only considered for authentication if
+## 'allowed_users' contains the 'OWNER' keyword.
+##
+## To register a different owner for the machine on the next
+## successful authentication, delete this file.
+
+[users]
+owner = owner_name
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestSelectAuthenticationMode/Selected_newpassword_shows_correct_label_in_passwd_session b/authd-oidc-brokers/internal/broker/testdata/golden/TestSelectAuthenticationMode/Selected_newpassword_shows_correct_label_in_passwd_session
new file mode 100644
index 0000000000..31798b45da
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestSelectAuthenticationMode/Selected_newpassword_shows_correct_label_in_passwd_session
@@ -0,0 +1,3 @@
+entry: chars_password
+label: Update your local password
+type: newpassword
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestSelectAuthenticationMode/Successfully_select_device_auth b/authd-oidc-brokers/internal/broker/testdata/golden/TestSelectAuthenticationMode/Successfully_select_device_auth
new file mode 100644
index 0000000000..7eb58122b9
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestSelectAuthenticationMode/Successfully_select_device_auth
@@ -0,0 +1,6 @@
+button: Request new code
+code: user_code
+content: https://verification_uri.com
+label: Open the URL and enter the code below.
+type: qrcode
+wait: "true"
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestSelectAuthenticationMode/Successfully_select_device_auth_qr b/authd-oidc-brokers/internal/broker/testdata/golden/TestSelectAuthenticationMode/Successfully_select_device_auth_qr
new file mode 100644
index 0000000000..848a4175a7
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestSelectAuthenticationMode/Successfully_select_device_auth_qr
@@ -0,0 +1,6 @@
+button: Request new code
+code: user_code
+content: https://verification_uri.com
+label: Scan the QR code or open the URL and enter the code below.
+type: qrcode
+wait: "true"
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestSelectAuthenticationMode/Successfully_select_newpassword b/authd-oidc-brokers/internal/broker/testdata/golden/TestSelectAuthenticationMode/Successfully_select_newpassword
new file mode 100644
index 0000000000..246a5f3b8d
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestSelectAuthenticationMode/Successfully_select_newpassword
@@ -0,0 +1,3 @@
+entry: chars_password
+label: Create a local password
+type: newpassword
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestSelectAuthenticationMode/Successfully_select_password b/authd-oidc-brokers/internal/broker/testdata/golden/TestSelectAuthenticationMode/Successfully_select_password
new file mode 100644
index 0000000000..f5c748db40
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestSelectAuthenticationMode/Successfully_select_password
@@ -0,0 +1,3 @@
+entry: chars_password
+label: Enter your local password
+type: form
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestUserPreCheck/Empty_userinfo_if_allowed_suffixes_has_only_empty_string b/authd-oidc-brokers/internal/broker/testdata/golden/TestUserPreCheck/Empty_userinfo_if_allowed_suffixes_has_only_empty_string
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestUserPreCheck/Empty_userinfo_if_no_allowed_suffixes_are_provided b/authd-oidc-brokers/internal/broker/testdata/golden/TestUserPreCheck/Empty_userinfo_if_no_allowed_suffixes_are_provided
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestUserPreCheck/Empty_userinfo_if_username_does_not_match_allowed_suffix b/authd-oidc-brokers/internal/broker/testdata/golden/TestUserPreCheck/Empty_userinfo_if_username_does_not_match_allowed_suffix
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestUserPreCheck/Empty_userinfo_if_username_does_not_match_any_of_the_allowed_suffixes b/authd-oidc-brokers/internal/broker/testdata/golden/TestUserPreCheck/Empty_userinfo_if_username_does_not_match_any_of_the_allowed_suffixes
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestUserPreCheck/Return_userinfo_with_correct_homedir_after_precheck b/authd-oidc-brokers/internal/broker/testdata/golden/TestUserPreCheck/Return_userinfo_with_correct_homedir_after_precheck
new file mode 100644
index 0000000000..fadbc5c469
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestUserPreCheck/Return_userinfo_with_correct_homedir_after_precheck
@@ -0,0 +1 @@
+{"name":"user@allowed","uuid":"","dir":"/home/allowed/user@allowed","shell":"/usr/bin/bash","gecos":"user@allowed","groups":null}
\ No newline at end of file
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestUserPreCheck/Successfully_allow_username_if_suffix_has_asterisk b/authd-oidc-brokers/internal/broker/testdata/golden/TestUserPreCheck/Successfully_allow_username_if_suffix_has_asterisk
new file mode 100644
index 0000000000..1c1ddfb545
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestUserPreCheck/Successfully_allow_username_if_suffix_has_asterisk
@@ -0,0 +1 @@
+{"name":"user@allowed","uuid":"","dir":"/home/user@allowed","shell":"/usr/bin/bash","gecos":"user@allowed","groups":null}
\ No newline at end of file
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestUserPreCheck/Successfully_allow_username_if_suffix_is_allow_all b/authd-oidc-brokers/internal/broker/testdata/golden/TestUserPreCheck/Successfully_allow_username_if_suffix_is_allow_all
new file mode 100644
index 0000000000..6a420fc5e0
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestUserPreCheck/Successfully_allow_username_if_suffix_is_allow_all
@@ -0,0 +1 @@
+{"name":"user@doesnotmatter","uuid":"","dir":"/home/user@doesnotmatter","shell":"/usr/bin/bash","gecos":"user@doesnotmatter","groups":null}
\ No newline at end of file
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestUserPreCheck/Successfully_allow_username_ignoring_empty_string_in_config b/authd-oidc-brokers/internal/broker/testdata/golden/TestUserPreCheck/Successfully_allow_username_ignoring_empty_string_in_config
new file mode 100644
index 0000000000..1c1ddfb545
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestUserPreCheck/Successfully_allow_username_ignoring_empty_string_in_config
@@ -0,0 +1 @@
+{"name":"user@allowed","uuid":"","dir":"/home/user@allowed","shell":"/usr/bin/bash","gecos":"user@allowed","groups":null}
\ No newline at end of file
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestUserPreCheck/Successfully_allow_username_that_matches_at_least_one_allowed_suffix b/authd-oidc-brokers/internal/broker/testdata/golden/TestUserPreCheck/Successfully_allow_username_that_matches_at_least_one_allowed_suffix
new file mode 100644
index 0000000000..1c1ddfb545
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestUserPreCheck/Successfully_allow_username_that_matches_at_least_one_allowed_suffix
@@ -0,0 +1 @@
+{"name":"user@allowed","uuid":"","dir":"/home/user@allowed","shell":"/usr/bin/bash","gecos":"user@allowed","groups":null}
\ No newline at end of file
diff --git a/authd-oidc-brokers/internal/broker/testdata/golden/TestUserPreCheck/Successfully_allow_username_with_matching_allowed_suffix b/authd-oidc-brokers/internal/broker/testdata/golden/TestUserPreCheck/Successfully_allow_username_with_matching_allowed_suffix
new file mode 100644
index 0000000000..1c1ddfb545
--- /dev/null
+++ b/authd-oidc-brokers/internal/broker/testdata/golden/TestUserPreCheck/Successfully_allow_username_with_matching_allowed_suffix
@@ -0,0 +1 @@
+{"name":"user@allowed","uuid":"","dir":"/home/user@allowed","shell":"/usr/bin/bash","gecos":"user@allowed","groups":null}
\ No newline at end of file
diff --git a/authd-oidc-brokers/internal/consts/consts.go b/authd-oidc-brokers/internal/consts/consts.go
new file mode 100644
index 0000000000..0d04593cf6
--- /dev/null
+++ b/authd-oidc-brokers/internal/consts/consts.go
@@ -0,0 +1,40 @@
+// Package consts defines the constants used by the project.
+package consts
+
+import (
+	"github.com/coreos/go-oidc/v3/oidc"
+	"github.com/ubuntu/authd/log"
+)
+
+var (
+	// Version is the version of the executable.
+	Version = "Dev"
+)
+
+const (
+	// TEXTDOMAIN is the gettext domain for l10n.
+	TEXTDOMAIN = "authd-oidc"
+
+	// DefaultLevelLog is the default logging level selected without any option.
+	DefaultLevelLog = log.WarnLevel
+
+	// The application ID of the Microsoft-owned Azure Portal app.
+	azurePortalAppID = "c44b4083-3bb0-49c1-b47d-974e53cbdf3c"
+	// The ".default" scope for the Azure Portal app.
+	azurePortalScope = azurePortalAppID + "/.default"
+
+	// MicrosoftBrokerAppID is the application ID of the Microsoft-owned Microsoft Authentication Broker app.
+	// This app is used in OAuth 2.0 authentication to acquire a token with the ".default" scope for the Azure Portal app.
+	// That token can then be used to acquire a token for device registration.
+	MicrosoftBrokerAppID = "29d9ed98-a469-4536-ade2-f981bc1d605e"
+)
+
+var (
+	// MicrosoftBrokerAppScopes contains the OIDC scopes that we require for the Microsoft Authentication Broker app.
+	// The ".default" scope for the Azure Portal app is needed to acquire a token for device registration.
+	MicrosoftBrokerAppScopes = []string{oidc.ScopeOpenID, "profile", oidc.ScopeOfflineAccess, azurePortalScope}
+
+	// DefaultScopes contains the OIDC scopes that we require for all providers.
+	// Provider implementations can append additional scopes.
+	DefaultScopes = []string{oidc.ScopeOpenID, "profile", "email"}
+)
diff --git a/authd-oidc-brokers/internal/consts/google.go b/authd-oidc-brokers/internal/consts/google.go
new file mode 100644
index 0000000000..5393e11731
--- /dev/null
+++ b/authd-oidc-brokers/internal/consts/google.go
@@ -0,0 +1,10 @@
+//go:build withgoogle
+
+package consts
+
+const (
+	// DbusName owned by the broker for authd to contact us.
+	DbusName = "com.ubuntu.authd.Google"
+	// DbusObject main object path for authd to contact us.
+	DbusObject = "/com/ubuntu/authd/Google"
+)
diff --git a/authd-oidc-brokers/internal/consts/msentraid.go b/authd-oidc-brokers/internal/consts/msentraid.go
new file mode 100644
index 0000000000..29532acc22
--- /dev/null
+++ b/authd-oidc-brokers/internal/consts/msentraid.go
@@ -0,0 +1,10 @@
+//go:build withmsentraid
+
+package consts
+
+const (
+	// DbusName owned by the broker for authd to contact us.
+	DbusName = "com.ubuntu.authd.MSEntraID"
+	// DbusObject main object path for authd to contact us.
+	DbusObject = "/com/ubuntu/authd/MSEntraID"
+)
diff --git a/authd-oidc-brokers/internal/consts/oidc.go b/authd-oidc-brokers/internal/consts/oidc.go
new file mode 100644
index 0000000000..7bb571c74d
--- /dev/null
+++ b/authd-oidc-brokers/internal/consts/oidc.go
@@ -0,0 +1,10 @@
+//go:build !withgoogle && !withmsentraid
+
+package consts
+
+const (
+	// DbusName owned by the broker for authd to contact us.
+	DbusName = "com.ubuntu.authd.Oidc"
+	// DbusObject main object path for authd to contact us.
+	DbusObject = "/com/ubuntu/authd/Oidc"
+)
diff --git a/authd-oidc-brokers/internal/daemon/daemon.go b/authd-oidc-brokers/internal/daemon/daemon.go
new file mode 100644
index 0000000000..50082d620c
--- /dev/null
+++ b/authd-oidc-brokers/internal/daemon/daemon.go
@@ -0,0 +1,82 @@
+// Package daemon handles the dbus daemon with systemd support.
+package daemon
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/coreos/go-systemd/daemon"
+	"github.com/ubuntu/authd/log"
+	"github.com/ubuntu/decorate"
+)
+
+// Daemon is a grpc daemon with systemd support.
+type Daemon struct {
+	service Service
+
+	systemdSdNotifier systemdSdNotifier
+}
+
+type options struct {
+	// private member that we export for tests.
+	systemdSdNotifier func(unsetEnvironment bool, state string) (bool, error)
+}
+
+type systemdSdNotifier func(unsetEnvironment bool, state string) (bool, error)
+
+// Option is the function signature used to tweak the daemon creation.
+type Option func(*options)
+
+// Service is a server that can Serve and be Stopped by our daemon.
+type Service interface {
+	Addr() string
+	Serve() error
+	Stop() error
+}
+
+// New returns an new, initialized daemon server, which handles systemd activation.
+// If systemd activation is used, it will override any socket passed here.
+func New(ctx context.Context, service Service, args ...Option) (d *Daemon, err error) {
+	defer decorate.OnError(&err, "can't create daemon")
+
+	log.Debug(context.Background(), "Building new daemon")
+
+	// Set default options.
+	opts := options{
+		systemdSdNotifier: daemon.SdNotify,
+	}
+	// Apply given args.
+	for _, f := range args {
+		f(&opts)
+	}
+
+	return &Daemon{
+		service: service,
+
+		systemdSdNotifier: opts.systemdSdNotifier,
+	}, nil
+}
+
+// Serve signals systemd that we are ready to receive from the service.
+func (d *Daemon) Serve(ctx context.Context) (err error) {
+	defer decorate.OnError(&err, "error while serving")
+
+	log.Debug(context.Background(), "Starting to serve requests")
+
+	// Signal to systemd that we are ready.
+	if sent, err := d.systemdSdNotifier(false, "READY=1"); err != nil {
+		return fmt.Errorf("couldn't send ready notification to systemd: %v", err)
+	} else if sent {
+		log.Debug(context.Background(), "Ready state sent to systemd")
+	}
+
+	log.Infof(context.Background(), "Serving requests as %v", d.service.Addr())
+	return d.service.Serve()
+}
+
+// Quit gracefully quits listening loop and stops the grpc server.
+// It can drops any existing connexion is force is true.
+func (d Daemon) Quit() {
+	log.Info(context.Background(), "Stopping daemon requested.")
+	_ = d.service.Stop()
+}
diff --git a/authd-oidc-brokers/internal/dbusservice/dbusservice.go b/authd-oidc-brokers/internal/dbusservice/dbusservice.go
new file mode 100644
index 0000000000..d9b1c52648
--- /dev/null
+++ b/authd-oidc-brokers/internal/dbusservice/dbusservice.go
@@ -0,0 +1,118 @@
+// Package dbusservice is the dbus service implementation delegating its functional call to brokers.
+package dbusservice
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/canonical/authd/authd-oidc-brokers/internal/broker"
+	"github.com/canonical/authd/authd-oidc-brokers/internal/consts"
+	"github.com/godbus/dbus/v5"
+	"github.com/godbus/dbus/v5/introspect"
+)
+
+const intro = `
+<node>
+	<interface name="%s">
+		<method name="NewSession">
+			<arg type="s" direction="in" name="username"/>
+			<arg type="s" direction="in" name="lang"/>
+			<arg type="s" direction="in" name="mode"/>
+			<arg type="s" direction="out" name="sessionID"/>
+			<arg type="s" direction="out" name="encryptionKey"/>
+		</method>
+		<method name="GetAuthenticationModes">
+			<arg type="s" direction="in" name="sessionID"/>
+			<arg type="aa{ss}" direction="in" name="supportedUILayouts"/>
+			<arg type="aa{ss}" direction="out" name="authenticationModes"/>
+		</method>
+		<method name="SelectAuthenticationMode">
+			<arg type="s" direction="in" name="sessionID"/>
+			<arg type="s" direction="in" name="authenticationModeName"/>
+			<arg type="a{ss}" direction="out"  name="uiLayoutInfo"/>
+		</method>
+		<method name="IsAuthenticated">
+			<arg type="s" direction="in" name="sessionID"/>
+			<arg type="s" direction="in" name="authenticationData"/>
+			<arg type="s" direction="out" name="access"/>
+			<arg type="s" direction="out" name="data"/>
+		</method>
+		<method name="EndSession">
+			<arg type="s" direction="in" name="sessionID"/>
+		</method>
+		<method name="CancelIsAuthenticated">
+			<arg type="s" direction="in" name="sessionID"/>
+		</method>
+		<method name="UserPreCheck">
+			<arg type="s" direction="in" name="username"/>
+			<arg type="s" direction="out" name="userInfo"/>
+		</method>
+	</interface>` + introspect.IntrospectDataString + `</node> `
+
+// Service is the handler exposing our broker methods on the system bus.
+type Service struct {
+	name   string
+	broker *broker.Broker
+
+	serve      chan struct{}
+	disconnect func()
+}
+
+// New returns a new dbus service after exporting to the system bus our name.
+func New(_ context.Context, broker *broker.Broker) (s *Service, err error) {
+	name := consts.DbusName
+	object := dbus.ObjectPath(consts.DbusObject)
+	iface := "com.ubuntu.authd.Broker"
+	s = &Service{
+		name:   name,
+		broker: broker,
+		serve:  make(chan struct{}),
+	}
+
+	conn, err := s.getBus()
+	if err != nil {
+		return nil, err
+	}
+
+	if err := conn.Export(s, object, iface); err != nil {
+		return nil, err
+	}
+	if err := conn.Export(introspect.Introspectable(fmt.Sprintf(intro, iface)), object, "org.freedesktop.DBus.Introspectable"); err != nil {
+		return nil, err
+	}
+
+	reply, err := conn.RequestName(consts.DbusName, dbus.NameFlagDoNotQueue)
+	if err != nil {
+		s.disconnect()
+		return nil, err
+	}
+	if reply != dbus.RequestNameReplyPrimaryOwner {
+		s.disconnect()
+		return nil, fmt.Errorf("%q is already taken in the bus", name)
+	}
+
+	return s, nil
+}
+
+// Addr returns the address of the service.
+func (s *Service) Addr() string {
+	return s.name
+}
+
+// Serve wait for the service.
+func (s *Service) Serve() error {
+	<-s.serve
+	return nil
+}
+
+// Stop stop the service and do all the necessary cleanup operation.
+func (s *Service) Stop() error {
+	// Check if already stopped.
+	select {
+	case <-s.serve:
+	default:
+		close(s.serve)
+		s.disconnect()
+	}
+	return nil
+}
diff --git a/authd-oidc-brokers/internal/dbusservice/localbus.go b/authd-oidc-brokers/internal/dbusservice/localbus.go
new file mode 100644
index 0000000000..f496f7ae5a
--- /dev/null
+++ b/authd-oidc-brokers/internal/dbusservice/localbus.go
@@ -0,0 +1,32 @@
+// TiCS: disabled // This is a helper file for tests.
+
+//go:build withlocalbus
+
+package dbusservice
+
+import (
+	"os"
+
+	"github.com/canonical/authd/authd-oidc-brokers/internal/testutils"
+	"github.com/godbus/dbus/v5"
+)
+
+// getBus creates the local bus and returns a connection to the bus.
+// It attaches a disconnect handler to stop the local bus subprocess.
+func (s *Service) getBus() (*dbus.Conn, error) {
+	cleanup, err := testutils.StartSystemBusMock()
+	if err != nil {
+		return nil, err
+	}
+	log.Infof(context.Background(), "Using local bus address: %s", os.Getenv("DBUS_SYSTEM_BUS_ADDRESS"))
+	conn, err := dbus.ConnectSystemBus()
+	if err != nil {
+		return nil, err
+	}
+
+	s.disconnect = func() {
+		conn.Close()
+		cleanup()
+	}
+	return conn, err
+}
diff --git a/authd-oidc-brokers/internal/dbusservice/methods.go b/authd-oidc-brokers/internal/dbusservice/methods.go
new file mode 100644
index 0000000000..3a12774694
--- /dev/null
+++ b/authd-oidc-brokers/internal/dbusservice/methods.go
@@ -0,0 +1,92 @@
+package dbusservice
+
+import (
+	"context"
+	"errors"
+
+	"github.com/canonical/authd/authd-oidc-brokers/internal/broker"
+	"github.com/godbus/dbus/v5"
+	"github.com/ubuntu/authd/log"
+)
+
+// NewSession is the method through which the broker and the daemon will communicate once dbusInterface.NewSession is called.
+func (s *Service) NewSession(username, lang, mode string) (sessionID, encryptionKey string, dbusErr *dbus.Error) {
+	log.Debugf(context.Background(), "Creating new session (username=%s, lang=%s, mode=%s)", username, lang, mode)
+	sessionID, encryptionKey, err := s.broker.NewSession(username, lang, mode)
+	if err != nil {
+		return "", "", dbus.MakeFailedError(err)
+	}
+	log.Debugf(context.Background(), "Created new session %s", sessionID)
+	return sessionID, encryptionKey, nil
+}
+
+// GetAuthenticationModes is the method through which the broker and the daemon will communicate once dbusInterface.GetAuthenticationModes is called.
+func (s *Service) GetAuthenticationModes(sessionID string, supportedUILayouts []map[string]string) (authenticationModes []map[string]string, dbusErr *dbus.Error) {
+	log.Debugf(context.Background(), "Getting authentication modes for session %s", sessionID)
+	authenticationModes, err := s.broker.GetAuthenticationModes(sessionID, supportedUILayouts)
+	if err != nil {
+		return nil, dbus.MakeFailedError(err)
+	}
+	log.Debugf(context.Background(), "Got authentication modes for session %s: %v", sessionID, authenticationModes)
+	return authenticationModes, nil
+}
+
+// SelectAuthenticationMode is the method through which the broker and the daemon will communicate once dbusInterface.SelectAuthenticationMode is called.
+func (s *Service) SelectAuthenticationMode(sessionID, authenticationModeName string) (uiLayoutInfo map[string]string, dbusErr *dbus.Error) {
+	log.Debugf(context.Background(), "Selecting authentication mode %s for session %s", authenticationModeName, sessionID)
+	uiLayoutInfo, err := s.broker.SelectAuthenticationMode(sessionID, authenticationModeName)
+	if err != nil {
+		return nil, dbus.MakeFailedError(err)
+	}
+	log.Debugf(context.Background(), "Selected authentication mode %s for session %s: %v", authenticationModeName, sessionID, uiLayoutInfo)
+	return uiLayoutInfo, nil
+}
+
+// IsAuthenticated is the method through which the broker and the daemon will communicate once dbusInterface.IsAuthenticated is called.
+func (s *Service) IsAuthenticated(sessionID, authenticationData string) (access, data string, dbusErr *dbus.Error) {
+	// Do *not* log authenticationData here, because it may contain the user's password in cleartext.
+	log.Debugf(context.Background(), "Handling IsAuthenticated call for session %s", sessionID)
+	access, data, err := s.broker.IsAuthenticated(sessionID, authenticationData)
+	if errors.Is(err, context.Canceled) {
+		return access, data, makeCanceledError()
+	}
+	if err != nil {
+		log.Warningf(context.Background(), "IsAuthenticated error: %v", err)
+		return broker.AuthDenied, "", dbus.MakeFailedError(err)
+	}
+	log.Debugf(context.Background(), "IsAuthenticated result (session %s): %s, %s", sessionID, access, data)
+	return access, data, nil
+}
+
+// EndSession is the method through which the broker and the daemon will communicate once dbusInterface.EndSession is called.
+func (s *Service) EndSession(sessionID string) (dbusErr *dbus.Error) {
+	log.Debugf(context.Background(), "Ending session %s", sessionID)
+	err := s.broker.EndSession(sessionID)
+	if err != nil {
+		return dbus.MakeFailedError(err)
+	}
+	return nil
+}
+
+// CancelIsAuthenticated is the method through which the broker and the daemon will communicate once dbusInterface.CancelIsAuthenticated is called.
+func (s *Service) CancelIsAuthenticated(sessionID string) (dbusErr *dbus.Error) {
+	log.Debugf(context.Background(), "Cancelling IsAuthenticated call for session %s", sessionID)
+	s.broker.CancelIsAuthenticated(sessionID)
+	return nil
+}
+
+// UserPreCheck is the method through which the broker and the daemon will communicate once dbusInterface.UserPreCheck is called.
+func (s *Service) UserPreCheck(username string) (userinfo string, dbusErr *dbus.Error) {
+	log.Debugf(context.Background(), "UserPreCheck: %s", username)
+	userinfo, err := s.broker.UserPreCheck(username)
+	if err != nil {
+		return "", dbus.MakeFailedError(err)
+	}
+	log.Debugf(context.Background(), "UserPreCheck result: %s", userinfo)
+	return userinfo, nil
+}
+
+// makeCanceledError creates a dbus.Error for a canceled operation.
+func makeCanceledError() *dbus.Error {
+	return &dbus.Error{Name: "com.ubuntu.authd.Canceled"}
+}
diff --git a/authd-oidc-brokers/internal/dbusservice/systembus.go b/authd-oidc-brokers/internal/dbusservice/systembus.go
new file mode 100644
index 0000000000..7ac7a6a0dd
--- /dev/null
+++ b/authd-oidc-brokers/internal/dbusservice/systembus.go
@@ -0,0 +1,18 @@
+//go:build !withlocalbus
+
+package dbusservice
+
+import (
+	"github.com/godbus/dbus/v5"
+)
+
+// getBus returns the system bus and attach a disconnect handler.
+func (s *Service) getBus() (*dbus.Conn, error) {
+	conn, err := dbus.ConnectSystemBus()
+	if err != nil {
+		return nil, err
+	}
+	s.disconnect = func() { _ = conn.Close() }
+
+	return conn, nil
+}
diff --git a/authd-oidc-brokers/internal/fileutils/fileutils.go b/authd-oidc-brokers/internal/fileutils/fileutils.go
new file mode 100644
index 0000000000..584aeef45c
--- /dev/null
+++ b/authd-oidc-brokers/internal/fileutils/fileutils.go
@@ -0,0 +1,45 @@
+// Package fileutils provides utility functions for file operations.
+package fileutils
+
+import (
+	"errors"
+	"io"
+	"os"
+)
+
+// FileExists checks if a file exists at the given path.
+func FileExists(path string) (bool, error) {
+	_, err := os.Stat(path)
+	if err != nil && !errors.Is(err, os.ErrNotExist) {
+		return false, err
+	}
+	return !errors.Is(err, os.ErrNotExist), nil
+}
+
+// IsDirEmpty checks if the specified directory is empty.
+func IsDirEmpty(path string) (bool, error) {
+	f, err := os.Open(path)
+	if err != nil {
+		return false, err
+	}
+	defer f.Close()
+
+	_, err = f.Readdirnames(1)
+	if errors.Is(err, io.EOF) {
+		return true, nil
+	}
+	return false, err
+}
+
+// Touch creates an empty file at the given path, if it doesn't already exist.
+func Touch(path string) error {
+	file, err := os.OpenFile(path, os.O_RDONLY|os.O_CREATE, 0o600)
+	if err != nil && !errors.Is(err, os.ErrExist) {
+		return err
+	}
+	err = file.Close()
+	if err != nil {
+		return err
+	}
+	return nil
+}
diff --git a/authd-oidc-brokers/internal/fileutils/fileutils_test.go b/authd-oidc-brokers/internal/fileutils/fileutils_test.go
new file mode 100644
index 0000000000..069d4a7482
--- /dev/null
+++ b/authd-oidc-brokers/internal/fileutils/fileutils_test.go
@@ -0,0 +1,156 @@
+package fileutils_test
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/canonical/authd/authd-oidc-brokers/internal/fileutils"
+	"github.com/stretchr/testify/require"
+)
+
+func TestFileExists(t *testing.T) {
+	t.Parallel()
+
+	tests := map[string]struct {
+		name            string
+		fileExists      bool
+		parentDirIsFile bool
+
+		wantExists bool
+		wantError  bool
+	}{
+		"Returns_true_when_file_exists":                      {fileExists: true, wantExists: true},
+		"Returns_false_when_file_does_not_exist":             {fileExists: false, wantExists: false},
+		"Returns_false_when_parent_directory_does_not_exist": {fileExists: false, wantExists: false},
+
+		"Error_when_parent_directory_is_a_file": {parentDirIsFile: true, wantError: true},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			tempDir := t.TempDir()
+			path := filepath.Join(tempDir, "file")
+			if tc.fileExists {
+				err := fileutils.Touch(path)
+				require.NoError(t, err, "Touch should not return an error")
+			}
+			if tc.parentDirIsFile {
+				path = filepath.Join(tempDir, "file", "file")
+				err := fileutils.Touch(filepath.Join(tempDir, "file"))
+				require.NoError(t, err, "Touch should not return an error")
+			}
+
+			exists, err := fileutils.FileExists(path)
+			if tc.wantError {
+				require.Error(t, err, "FileExists should return an error")
+			} else {
+				require.NoError(t, err, "FileExists should not return an error")
+			}
+			require.Equal(t, tc.wantExists, exists, "FileExists should return the expected result")
+		})
+	}
+}
+
+func TestIsDirEmpty(t *testing.T) {
+	t.Parallel()
+
+	tests := map[string]struct {
+		isEmpty      bool
+		isFile       bool
+		doesNotExist bool
+
+		wantEmpty bool
+		wantError bool
+	}{
+		"Returns_true_when_directory_is_empty":      {isEmpty: true, wantEmpty: true},
+		"Returns_false_when_directory_is_not_empty": {wantEmpty: false},
+
+		"Error_when_directory_does_not_exist": {doesNotExist: true, wantError: true},
+		"Error_when_directory_is_a_file":      {isFile: true, wantError: true},
+	}
+
+	for name, tc := range tests {
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			tempDir := t.TempDir()
+			path := filepath.Join(tempDir, "dir")
+
+			if !tc.doesNotExist {
+				err := os.Mkdir(path, 0o700)
+				require.NoError(t, err, "Mkdir should not return an error")
+			}
+
+			if !tc.isEmpty && !tc.doesNotExist && !tc.isFile {
+				err := fileutils.Touch(filepath.Join(tempDir, "dir", "file"))
+				require.NoError(t, err, "Touch should not return an error")
+			}
+			if tc.isFile {
+				path = filepath.Join(tempDir, "file")
+				err := fileutils.Touch(path)
+				require.NoError(t, err, "Touch should not return an error")
+			}
+
+			empty, err := fileutils.IsDirEmpty(path)
+			if tc.wantError {
+				require.Error(t, err, "IsDirEmpty should return an error")
+			} else {
+				require.NoError(t, err, "IsDirEmpty should not return an error")
+			}
+			require.Equal(t, tc.wantEmpty, empty, "IsDirEmpty should return the expected result")
+		})
+	}
+}
+
+func TestTouch(t *testing.T) {
+	t.Parallel()
+
+	tests := map[string]struct {
+		name               string
+		fileExists         bool
+		fileIsDir          bool
+		parentDoesNotExist bool
+
+		wantError bool
+	}{
+		"Creates_file_when_it_does_not_exist":            {fileExists: false},
+		"Does_not_return_error_when_file_already_exists": {fileExists: true},
+
+		"Returns_error_when_file_is_a_directory":             {fileIsDir: true, wantError: true},
+		"Returns_error_when_parent_directory_does_not_exist": {parentDoesNotExist: true, wantError: true},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			tempDir := t.TempDir()
+			path := filepath.Join(tempDir, "file")
+
+			if tc.fileExists && !tc.fileIsDir {
+				err := fileutils.Touch(path)
+				require.NoError(t, err, "Touch should not return an error")
+			}
+
+			if tc.fileIsDir {
+				path = filepath.Join(tempDir, "dir")
+				err := os.Mkdir(path, 0o700)
+				require.NoError(t, err, "Mkdir should not return an error")
+			}
+
+			if tc.parentDoesNotExist {
+				path = filepath.Join(tempDir, "dir", "file")
+			}
+
+			err := fileutils.Touch(path)
+			if tc.wantError {
+				require.Error(t, err, "Touch should return an error")
+				return
+			}
+
+			require.NoError(t, err, "Touch should not return an error")
+		})
+	}
+}
diff --git a/authd-oidc-brokers/internal/password/password.go b/authd-oidc-brokers/internal/password/password.go
new file mode 100644
index 0000000000..93477d3efa
--- /dev/null
+++ b/authd-oidc-brokers/internal/password/password.go
@@ -0,0 +1,59 @@
+// Package password provides functions for creating and using the hashed password file.
+package password
+
+import (
+	"crypto/rand"
+	"encoding/base64"
+	"fmt"
+	"os"
+	"path/filepath"
+	"slices"
+
+	"golang.org/x/crypto/argon2"
+)
+
+// HashAndStorePassword hashes the password and stores it in the data directory.
+func HashAndStorePassword(password, path string) error {
+	// Ensure that the password file's parent directory exists.
+	if err := os.MkdirAll(filepath.Dir(path), 0o700); err != nil {
+		return fmt.Errorf("could not create password parent directory: %w", err)
+	}
+
+	salt := make([]byte, 16)
+	if _, err := rand.Read(salt); err != nil {
+		return fmt.Errorf("could not generate salt: %w", err)
+	}
+
+	hash := hashPassword(password, salt)
+	s := base64.StdEncoding.EncodeToString(append(salt, hash...))
+	if err := os.WriteFile(path, []byte(s), 0o600); err != nil {
+		return fmt.Errorf("could not store password: %w", err)
+	}
+
+	return nil
+}
+
+// CheckPassword checks if the provided password matches the hash stored in the password file.
+func CheckPassword(password, path string) (bool, error) {
+	data, err := os.ReadFile(path)
+	if err != nil {
+		return false, fmt.Errorf("could not read password file: %w", err)
+	}
+
+	decoded, err := base64.StdEncoding.DecodeString(string(data))
+	if err != nil {
+		return false, fmt.Errorf("could not decode password: %w", err)
+	}
+
+	salt, hash := decoded[:16], decoded[16:]
+	if !slices.Equal(hash, hashPassword(password, salt)) {
+		return false, nil
+	}
+
+	return true, nil
+}
+
+func hashPassword(password string, salt []byte) []byte {
+	// If you change these parameters, update the section in the security overview doc.
+	return argon2.IDKey([]byte(password), salt, 1, 64*1024, 4, 32)
+}
diff --git a/authd-oidc-brokers/internal/password/password_test.go b/authd-oidc-brokers/internal/password/password_test.go
new file mode 100644
index 0000000000..5da3031314
--- /dev/null
+++ b/authd-oidc-brokers/internal/password/password_test.go
@@ -0,0 +1,106 @@
+package password_test
+
+import (
+	"encoding/base64"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/canonical/authd/authd-oidc-brokers/internal/fileutils"
+	"github.com/canonical/authd/authd-oidc-brokers/internal/password"
+	"github.com/stretchr/testify/require"
+)
+
+func TestHashAndStorePassword(t *testing.T) {
+	t.Parallel()
+
+	tests := map[string]struct {
+		password        string
+		path            string
+		pathExists      bool
+		parentDirExists bool
+
+		wantErr bool
+	}{
+		"Success_when_password_file_and_parent_dir_do_not_exist_yet": {password: "test123"},
+		"Success_when_parent_directory_already_exists":               {password: "test123", parentDirExists: true},
+		"Success_when_password_file_already_exists":                  {password: "test123", pathExists: true},
+	}
+
+	for name, tc := range tests {
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			if tc.pathExists {
+				// The parent directory must also exist for the file to exist.
+				tc.parentDirExists = true
+			}
+
+			parentDir := t.TempDir()
+			if !tc.parentDirExists {
+				err := os.Remove(parentDir)
+				require.NoError(t, err, "Removing parent directory failed")
+			}
+			path := filepath.Join(parentDir, "password")
+
+			if tc.pathExists {
+				err := fileutils.Touch(path)
+				require.NoError(t, err, "Creating empty password file failed")
+			}
+
+			err := password.HashAndStorePassword(tc.password, path)
+			if err != nil {
+				t.Fatalf("HashAndStorePassword() failed: %v", err)
+			}
+		})
+	}
+}
+
+func TestCheckPassword(t *testing.T) {
+	t.Parallel()
+
+	tests := map[string]struct {
+		password     string
+		pathToRead   string
+		writeGarbage bool
+
+		wantMatch     bool
+		expectedError error
+	}{
+		"Success_when_password_matches":         {password: "test123", wantMatch: true},
+		"No_match_when_password_does_not_match": {password: "not-test123", wantMatch: false},
+
+		"Error_when_password_file_does_not_exist":   {password: "test123", pathToRead: "nonexistent", expectedError: os.ErrNotExist},
+		"Error_when_password_file_contains_garbage": {password: "test123", writeGarbage: true, expectedError: base64.CorruptInputError(0)},
+	}
+
+	for name, tc := range tests {
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			parentDir := t.TempDir()
+			path := filepath.Join(parentDir, "password")
+
+			if tc.pathToRead == "" {
+				tc.pathToRead = path
+			}
+
+			err := password.HashAndStorePassword("test123", path)
+			require.NoError(t, err, "HashAndStorePassword() failed")
+
+			if tc.writeGarbage {
+				err := os.WriteFile(path, []byte{0x00}, 0o600)
+				require.NoError(t, err, "Writing garbage to password file failed")
+			}
+
+			match, err := password.CheckPassword(tc.password, tc.pathToRead)
+			if tc.expectedError != nil {
+				require.ErrorIs(t, err, tc.expectedError, "CheckPassword() failed")
+			} else {
+				require.NoError(t, err, "CheckPassword() failed")
+			}
+
+			require.Equal(t, tc.wantMatch, match, "CheckPassword() returned unexpected result")
+		})
+	}
+}
diff --git a/authd-oidc-brokers/internal/providers/default.go b/authd-oidc-brokers/internal/providers/default.go
new file mode 100644
index 0000000000..a8251bad51
--- /dev/null
+++ b/authd-oidc-brokers/internal/providers/default.go
@@ -0,0 +1,12 @@
+//go:build !withgoogle && !withmsentraid
+
+package providers
+
+import (
+	"github.com/canonical/authd/authd-oidc-brokers/internal/providers/genericprovider"
+)
+
+// CurrentProvider returns a generic oidc provider implementation.
+func CurrentProvider() Provider {
+	return genericprovider.New()
+}
diff --git a/authd-oidc-brokers/internal/providers/errors/errors.go b/authd-oidc-brokers/internal/providers/errors/errors.go
new file mode 100644
index 0000000000..2058e2ac1c
--- /dev/null
+++ b/authd-oidc-brokers/internal/providers/errors/errors.go
@@ -0,0 +1,20 @@
+// Package errors provides custom error types which can be returned by the providers
+//
+// The package name conflicts with `errors` from the standard library.
+// That's not ideal, but we're planning a major refactoring of the broker and
+// provider packages in the future, so it's not worth the effort to fix this now.
+package errors
+
+// ForDisplayError is an error type for errors that are meant to be displayed to the user.
+type ForDisplayError struct {
+	Message string
+	Err     error
+}
+
+func (e *ForDisplayError) Error() string {
+	return e.Message
+}
+
+func (e *ForDisplayError) Unwrap() error {
+	return e.Err
+}
diff --git a/authd-oidc-brokers/internal/providers/genericprovider/genericprovider.go b/authd-oidc-brokers/internal/providers/genericprovider/genericprovider.go
new file mode 100644
index 0000000000..4278b5f4ae
--- /dev/null
+++ b/authd-oidc-brokers/internal/providers/genericprovider/genericprovider.go
@@ -0,0 +1,140 @@
+// Package genericprovider is the generic oidc extension.
+package genericprovider
+
+import (
+	"context"
+	"fmt"
+	"strings"
+
+	"github.com/canonical/authd/authd-oidc-brokers/internal/broker/authmodes"
+	providerErrors "github.com/canonical/authd/authd-oidc-brokers/internal/providers/errors"
+	"github.com/canonical/authd/authd-oidc-brokers/internal/providers/info"
+	"github.com/coreos/go-oidc/v3/oidc"
+	"golang.org/x/oauth2"
+)
+
+// GenericProvider is a generic OIDC provider.
+type GenericProvider struct{}
+
+// New returns a new GenericProvider.
+func New() GenericProvider {
+	return GenericProvider{}
+}
+
+// AdditionalScopes returns the generic scopes required by the provider.
+func (p GenericProvider) AdditionalScopes() []string {
+	return []string{}
+}
+
+// AuthOptions is a no-op when no specific provider is in use.
+func (p GenericProvider) AuthOptions() []oauth2.AuthCodeOption {
+	return []oauth2.AuthCodeOption{}
+}
+
+// GetExtraFields returns the extra fields of the token which should be stored persistently.
+func (p GenericProvider) GetExtraFields(token *oauth2.Token) map[string]interface{} {
+	return nil
+}
+
+// GetMetadata is a no-op when no specific provider is in use.
+func (p GenericProvider) GetMetadata(provider *oidc.Provider) (map[string]interface{}, error) {
+	return nil, nil
+}
+
+// GetUserInfo is a no-op when no specific provider is in use.
+func (p GenericProvider) GetUserInfo(idToken info.Claimer) (info.User, error) {
+	userClaims, err := p.userClaims(idToken)
+	if err != nil {
+		return info.User{}, err
+	}
+
+	if userClaims.Sub == "" {
+		return info.User{}, fmt.Errorf("authentication failure: sub claim is missing in the ID token")
+	}
+
+	if userClaims.Email == "" {
+		return info.User{}, fmt.Errorf("authentication failure: email claim is missing in the ID token")
+	}
+
+	if !userClaims.EmailVerified {
+		return info.User{}, &providerErrors.ForDisplayError{Message: "Authentication failure: email not verified"}
+	}
+
+	return info.NewUser(
+		userClaims.Email,
+		userClaims.Home,
+		userClaims.Sub,
+		userClaims.Shell,
+		userClaims.Gecos,
+		nil,
+	), nil
+}
+
+// GetGroups is a no-op when no specific provider is in use.
+func (GenericProvider) GetGroups(ctx context.Context, clientID string, issuerURL string, token *oauth2.Token, providerMetadata map[string]interface{}, deviceRegistrationData []byte) ([]info.Group, error) {
+	return nil, nil
+}
+
+// NormalizeUsername parses a username into a normalized version.
+func (p GenericProvider) NormalizeUsername(username string) string {
+	return username
+}
+
+// VerifyUsername checks if the requested username matches the authenticated user.
+func (p GenericProvider) VerifyUsername(requestedUsername, username string) error {
+	if p.NormalizeUsername(requestedUsername) != p.NormalizeUsername(username) {
+		msg := fmt.Sprintf("Authentication failure: requested username %q does not match the authenticated user %q", requestedUsername, username)
+		return &providerErrors.ForDisplayError{Message: msg}
+	}
+	return nil
+}
+
+// SupportedOIDCAuthModes returns the OIDC authentication modes supported by the provider.
+func (p GenericProvider) SupportedOIDCAuthModes() []string {
+	return []string{authmodes.Device, authmodes.DeviceQr}
+}
+
+type claims struct {
+	Email         string `json:"email"`
+	Sub           string `json:"sub"`
+	Home          string `json:"home"`
+	Shell         string `json:"shell"`
+	Gecos         string `json:"gecos"`
+	EmailVerified bool   `json:"email_verified"`
+}
+
+// userClaims returns the user claims parsed from the ID token.
+func (p GenericProvider) userClaims(idToken info.Claimer) (claims, error) {
+	var userClaims claims
+	if err := idToken.Claims(&userClaims); err != nil {
+		return claims{}, fmt.Errorf("failed to get ID token claims: %v", err)
+	}
+	return userClaims, nil
+}
+
+// IsTokenExpiredError returns true if the reason for the error is that the refresh token is expired.
+func (p GenericProvider) IsTokenExpiredError(err *oauth2.RetrieveError) bool {
+	// TODO: This is an msentraid specific error code and description.
+	//       Change it to the ones from Google once we know them.
+	return err.ErrorCode == "invalid_grant" && strings.HasPrefix(err.ErrorDescription, "AADSTS50173:")
+}
+
+// IsUserDisabledError returns false, as the generic provider does not support disabling users.
+func (p GenericProvider) IsUserDisabledError(_ *oauth2.RetrieveError) bool {
+	return false
+}
+
+// SupportsDeviceRegistration returns false, as the generic provider does not support device registration.
+func (p GenericProvider) SupportsDeviceRegistration() bool {
+	return false
+}
+
+// IsTokenForDeviceRegistration returns false, as the generic provider does not support device registration.
+func (p GenericProvider) IsTokenForDeviceRegistration(_ *oauth2.Token) (bool, error) {
+	return false, nil
+}
+
+// MaybeRegisterDevice is a no-op when no specific provider is in use.
+func (p GenericProvider) MaybeRegisterDevice(_ context.Context, _ *oauth2.Token, _, _ string, _ []byte) ([]byte, func(), error) {
+	return nil, func() {}, nil
+}
diff --git a/authd-oidc-brokers/internal/providers/genericprovider/genericprovider_test.go b/authd-oidc-brokers/internal/providers/genericprovider/genericprovider_test.go
new file mode 100644
index 0000000000..2f7fb7cd32
--- /dev/null
+++ b/authd-oidc-brokers/internal/providers/genericprovider/genericprovider_test.go
@@ -0,0 +1,114 @@
+package genericprovider_test
+
+import (
+	"encoding/json"
+	"fmt"
+	"testing"
+
+	providerErrors "github.com/canonical/authd/authd-oidc-brokers/internal/providers/errors"
+	"github.com/canonical/authd/authd-oidc-brokers/internal/providers/genericprovider"
+	"github.com/canonical/authd/authd-oidc-brokers/internal/providers/info"
+	"github.com/stretchr/testify/require"
+)
+
+func TestGetUserInfo(t *testing.T) {
+	t.Parallel()
+
+	tests := map[string]struct {
+		claims      map[string]interface{}
+		wantUser    info.User
+		wantErr     bool
+		wantErrType error
+	}{
+		"Successfully_get_user_info_with_all_fields": {
+			claims: map[string]interface{}{
+				"sub":            "sub123",
+				"email":          "user@example.com",
+				"email_verified": true,
+				"home":           "/home/user",
+				"shell":          "/bin/bash",
+				"gecos":          "Test User",
+			},
+			wantUser: info.NewUser("user@example.com", "/home/user", "sub123", "/bin/bash", "Test User", nil),
+		},
+		"Successfully_get_user_info_with_minimal_fields": {
+			claims: map[string]interface{}{
+				"sub":            "sub123",
+				"email":          "user@example.com",
+				"email_verified": true,
+			},
+			wantUser: info.NewUser("user@example.com", "", "sub123", "", "", nil),
+		},
+
+		"Error_when_sub_is_missing": {
+			claims: map[string]interface{}{
+				"email":          "user@example.com",
+				"email_verified": false,
+			},
+			wantErr: true,
+		},
+		"Error_when_email_is_missing": {
+			claims: map[string]interface{}{
+				"sub": "sub123",
+			},
+			wantErr: true,
+		},
+		"Error_when_email_verified_is_missing": {
+			claims: map[string]interface{}{
+				"sub":   "sub123",
+				"email": "user@example.com",
+			},
+			wantErr:     true,
+			wantErrType: &providerErrors.ForDisplayError{},
+		},
+		"Error_when_email_is_not_verified": {
+			claims: map[string]interface{}{
+				"email":          "user@example.com",
+				"sub":            "sub123",
+				"email_verified": false,
+			},
+			wantErr:     true,
+			wantErrType: &providerErrors.ForDisplayError{},
+		},
+	}
+
+	for name, tc := range tests {
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			p := genericprovider.New()
+			mockToken := &mockIDToken{claims: tc.claims}
+
+			user, err := p.GetUserInfo(mockToken)
+			t.Logf("GetUserInfo error: %v", err)
+
+			if tc.wantErr {
+				require.Error(t, err)
+				return
+			}
+			if tc.wantErrType != nil {
+				require.ErrorIs(t, err, tc.wantErrType)
+				return
+			}
+			require.NoError(t, err)
+			require.Equal(t, tc.wantUser, user)
+		})
+	}
+}
+
+type mockIDToken struct {
+	claims map[string]interface{}
+}
+
+func (m *mockIDToken) Claims(v interface{}) error {
+	data, err := json.Marshal(m.claims)
+	if err != nil {
+		return fmt.Errorf("failed to marshal claims: %v", err)
+	}
+
+	if err := json.Unmarshal(data, v); err != nil {
+		return fmt.Errorf("failed to unmarshal claims: %v", err)
+	}
+
+	return nil
+}
diff --git a/authd-oidc-brokers/internal/providers/google/google.go b/authd-oidc-brokers/internal/providers/google/google.go
new file mode 100644
index 0000000000..b0235a2526
--- /dev/null
+++ b/authd-oidc-brokers/internal/providers/google/google.go
@@ -0,0 +1,28 @@
+// Package google is the google specific extension.
+package google
+
+import (
+	"github.com/canonical/authd/authd-oidc-brokers/internal/providers/genericprovider"
+)
+
+// Provider is the google provider implementation.
+type Provider struct {
+	genericprovider.GenericProvider
+}
+
+// New returns a new GoogleProvider.
+func New() Provider {
+	return Provider{
+		GenericProvider: genericprovider.New(),
+	}
+}
+
+// AdditionalScopes returns the generic scopes required by the provider.
+// Note that we do not return oidc.ScopeOfflineAccess, as for TV/limited input devices, the API call will fail as not
+// supported by this application type. However, the refresh token will be acquired and is functional to refresh without
+// user interaction.
+// If we start to support other kinds of applications, we should revisit this.
+// More info on https://developers.google.com/identity/protocols/oauth2/limited-input-device#allowedscopes.
+func (Provider) AdditionalScopes() []string {
+	return []string{}
+}
diff --git a/authd-oidc-brokers/internal/providers/google/google_test.go b/authd-oidc-brokers/internal/providers/google/google_test.go
new file mode 100644
index 0000000000..b51c2c2f5a
--- /dev/null
+++ b/authd-oidc-brokers/internal/providers/google/google_test.go
@@ -0,0 +1,24 @@
+package google_test
+
+import (
+	"testing"
+
+	"github.com/canonical/authd/authd-oidc-brokers/internal/providers/google"
+	"github.com/stretchr/testify/require"
+)
+
+func TestNew(t *testing.T) {
+	t.Parallel()
+
+	p := google.New()
+
+	require.Empty(t, p, "New should return the default provider implementation with no parameters")
+}
+
+func TestAdditionalScopes(t *testing.T) {
+	t.Parallel()
+
+	p := google.New()
+
+	require.Empty(t, p.AdditionalScopes(), "Google provider should not require additional scopes")
+}
diff --git a/authd-oidc-brokers/internal/providers/info/info.go b/authd-oidc-brokers/internal/providers/info/info.go
new file mode 100644
index 0000000000..e2eb936a28
--- /dev/null
+++ b/authd-oidc-brokers/internal/providers/info/info.go
@@ -0,0 +1,49 @@
+// Package info defines types used by the broker.
+package info
+
+// Group represents the group information that is fetched by the broker.
+type Group struct {
+	Name string `json:"name"`
+	UGID string `json:"ugid"`
+}
+
+// User represents the user information obtained from the provider.
+type User struct {
+	Name   string  `json:"name"`
+	UUID   string  `json:"uuid"`
+	Home   string  `json:"dir"`
+	Shell  string  `json:"shell"`
+	Gecos  string  `json:"gecos"`
+	Groups []Group `json:"groups"`
+}
+
+// NewUser creates a new user with the specified values.
+//
+// It fills the defaults for Shell and Gecos if they are empty.
+func NewUser(name, home, uuid, shell, gecos string, groups []Group) User {
+	u := User{
+		Name:   name,
+		Home:   home,
+		UUID:   uuid,
+		Shell:  shell,
+		Gecos:  gecos,
+		Groups: groups,
+	}
+
+	if u.Home == "" {
+		u.Home = u.Name
+	}
+	if u.Shell == "" {
+		u.Shell = "/usr/bin/bash"
+	}
+	if u.Gecos == "" {
+		u.Gecos = u.Name
+	}
+
+	return u
+}
+
+// Claimer is an interface that defines a method to extract the claims from the ID token.
+type Claimer interface {
+	Claims(any) error
+}
diff --git a/authd-oidc-brokers/internal/providers/info/info_test.go b/authd-oidc-brokers/internal/providers/info/info_test.go
new file mode 100644
index 0000000000..58902ad5ce
--- /dev/null
+++ b/authd-oidc-brokers/internal/providers/info/info_test.go
@@ -0,0 +1,82 @@
+package info_test
+
+import (
+	"testing"
+
+	"github.com/canonical/authd/authd-oidc-brokers/internal/providers/info"
+	"github.com/stretchr/testify/require"
+)
+
+func TestNewUser(t *testing.T) {
+	t.Parallel()
+
+	tests := map[string]struct {
+		name   string
+		home   string
+		uuid   string
+		shell  string
+		gecos  string
+		groups []info.Group
+	}{
+		"Create_a_new_user": {
+			name:   "test-user",
+			home:   "/home/test-user",
+			uuid:   "some-uuid",
+			shell:  "/usr/bin/zsh",
+			gecos:  "Test User",
+			groups: []info.Group{{Name: "test-group", UGID: "12345"}},
+		},
+
+		// Default values
+		"Create_a_new_user_with_default_home": {
+			name:   "test-user",
+			home:   "",
+			uuid:   "some-uuid",
+			shell:  "/usr/bin/zsh",
+			gecos:  "Test User",
+			groups: []info.Group{{Name: "test-group", UGID: "12345"}},
+		},
+		"Create_a_new_user_with_default_shell": {
+			name:   "test-user",
+			home:   "/home/test-user",
+			uuid:   "some-uuid",
+			shell:  "",
+			gecos:  "Test User",
+			groups: []info.Group{{Name: "test-group", UGID: "12345"}},
+		},
+		"Create_a_new_user_with_default_gecos": {name: "test-user",
+			home:   "/home/test-user",
+			uuid:   "some-uuid",
+			shell:  "/usr/bin/zsh",
+			gecos:  "",
+			groups: []info.Group{{Name: "test-group", UGID: "12345"}}},
+	}
+	for name, tc := range tests {
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			wantHome := tc.home
+			if tc.home == "" {
+				wantHome = tc.name
+			}
+
+			wantShell := tc.shell
+			if tc.shell == "" {
+				wantShell = "/usr/bin/bash"
+			}
+
+			wantGecos := tc.gecos
+			if tc.gecos == "" {
+				wantGecos = tc.name
+			}
+
+			got := info.NewUser(tc.name, tc.home, tc.uuid, tc.shell, tc.gecos, tc.groups)
+			require.Equal(t, tc.name, got.Name, "Name does not match the expected value")
+			require.Equal(t, wantHome, got.Home, "Home does not match the expected value")
+			require.Equal(t, tc.uuid, got.UUID, "UUID does not match the expected value")
+			require.Equal(t, wantShell, got.Shell, "Shell does not match the expected value")
+			require.Equal(t, wantGecos, got.Gecos, "Gecos does not match the expected value")
+			require.Equal(t, tc.groups, got.Groups, "Groups do not match the expected value")
+		})
+	}
+}
diff --git a/authd-oidc-brokers/internal/providers/msentraid/dummy.go b/authd-oidc-brokers/internal/providers/msentraid/dummy.go
new file mode 100644
index 0000000000..ffbb368fb0
--- /dev/null
+++ b/authd-oidc-brokers/internal/providers/msentraid/dummy.go
@@ -0,0 +1,8 @@
+// Package msentraid is the Microsoft Entra ID specific extension.
+package msentraid
+
+// This file is here to make the build pass. It doesn't have any build tags,
+// so it avoids the build failure:
+//
+//    build constraints exclude all Go files in internal/providers/msentraid
+//
diff --git a/authd-oidc-brokers/internal/providers/msentraid/export_test.go b/authd-oidc-brokers/internal/providers/msentraid/export_test.go
new file mode 100644
index 0000000000..1899f9019d
--- /dev/null
+++ b/authd-oidc-brokers/internal/providers/msentraid/export_test.go
@@ -0,0 +1,19 @@
+//go:build withmsentraid
+
+package msentraid
+
+import "strings"
+
+// AllExpectedScopes returns all the default expected scopes for a new provider.
+func AllExpectedScopes() string {
+	return strings.Join(New().expectedScopes, " ")
+}
+
+func (p *Provider) SetNeedsAccessTokenForGraphAPI(value bool) {
+	p.needsAccessTokenForGraphAPI = value
+}
+
+// SetTokenScopesForGraphAPI can be used in tests to set the scopes for the Microsoft Graph API access token.
+func (p *Provider) SetTokenScopesForGraphAPI(scopes []string) {
+	p.tokenScopesForGraphAPI = scopes
+}
diff --git a/authd-oidc-brokers/internal/providers/msentraid/helper_test.go b/authd-oidc-brokers/internal/providers/msentraid/helper_test.go
new file mode 100644
index 0000000000..88fab6fc5e
--- /dev/null
+++ b/authd-oidc-brokers/internal/providers/msentraid/helper_test.go
@@ -0,0 +1,29 @@
+//go:build withmsentraid
+
+package msentraid_test
+
+import (
+	"encoding/json"
+)
+
+var (
+	validIDToken = &testIDToken{
+		claims: `{"preferred_username": "valid-user",
+		"sub": "valid-sub",
+		"home": "/home/valid-user",
+		"shell": "/bin/bash",
+		"name": "Valid User"}`,
+	}
+
+	invalidIDToken = &testIDToken{
+		claims: "invalid claims",
+	}
+)
+
+type testIDToken struct {
+	claims string
+}
+
+func (t *testIDToken) Claims(v interface{}) error {
+	return json.Unmarshal([]byte(t.claims), v)
+}
diff --git a/authd-oidc-brokers/internal/providers/msentraid/himmelblau/.gitignore b/authd-oidc-brokers/internal/providers/msentraid/himmelblau/.gitignore
new file mode 100644
index 0000000000..72914cb857
--- /dev/null
+++ b/authd-oidc-brokers/internal/providers/msentraid/himmelblau/.gitignore
@@ -0,0 +1,3 @@
+himmelblau.h
+libhimmelblau.so
+libhimmelblau.so.*
diff --git a/authd-oidc-brokers/internal/providers/msentraid/himmelblau/errors.go b/authd-oidc-brokers/internal/providers/msentraid/himmelblau/errors.go
new file mode 100644
index 0000000000..fbe7eca709
--- /dev/null
+++ b/authd-oidc-brokers/internal/providers/msentraid/himmelblau/errors.go
@@ -0,0 +1,19 @@
+// Package himmelblau provides functions to use the libhimmelblau library.
+package himmelblau
+
+import "fmt"
+
+// ErrDeviceDisabled is returned when the device is disabled in Microsoft Entra ID.
+var ErrDeviceDisabled = fmt.Errorf("device is disabled in Microsoft Entra ID")
+
+// ErrInvalidRedirectURI is returned when the redirect URI of the client application is missing or invalid.
+var ErrInvalidRedirectURI = fmt.Errorf("invalid redirect URI")
+
+// TokenAcquisitionError is returned when an error occurs while acquiring a token via libhimmelblau.
+type TokenAcquisitionError struct {
+	msg string
+}
+
+func (e TokenAcquisitionError) Error() string {
+	return e.msg
+}
diff --git a/authd-oidc-brokers/internal/providers/msentraid/himmelblau/generate.sh b/authd-oidc-brokers/internal/providers/msentraid/himmelblau/generate.sh
new file mode 100755
index 0000000000..90718e9534
--- /dev/null
+++ b/authd-oidc-brokers/internal/providers/msentraid/himmelblau/generate.sh
@@ -0,0 +1,40 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+SCRIPT_DIR=$(readlink -f "$(dirname "$0")")
+cd "$SCRIPT_DIR"
+
+GIT_DIR=$(git rev-parse --show-toplevel)
+
+# Verify we are in a git repo and get the top-level dir
+if [ -z "${GIT_DIR}" ]; then
+  echo >&2 "Error: Not inside a git repository"
+  exit 1
+fi
+
+cargo install cargo-c cbindgen
+
+cd "${GIT_DIR}/authd-oidc-brokers/third_party/libhimmelblau"
+
+mkdir -p himmelblau
+
+# Print executed commands to ease debugging
+set -x
+
+"${CARGO_HOME:-$HOME/.cargo}"/bin/cbindgen --config ./cbindgen.toml > himmelblau/himmelblau.h
+
+FEATURES="broker,changepassword,on_behalf_of"
+# Enable custom_oidc_discovery_url feature when not building a release,
+# which is the case when building inside snapcraft or when the RELEASE env
+# var is set (the latter can be used during development).
+if [ -z "${SNAPCRAFT_PROJECT_NAME:-}" ] && [ -z "${RELEASE:-}" ]; then
+  FEATURES="${FEATURES},custom_oidc_discovery_url"
+fi
+cargo cbuild --release --lib --features="${FEATURES}"
+
+# Copy header and shared library
+TARGET_TRIPLE=$(rustc -vV | awk '/host:/ {print $2}')
+cp "target/${TARGET_TRIPLE}/release/himmelblau.h" "${SCRIPT_DIR}/"
+cp "target/${TARGET_TRIPLE}/release/libhimmelblau.so" "${SCRIPT_DIR}/libhimmelblau.so.0"
+ln -sf libhimmelblau.so.0 "${SCRIPT_DIR}/libhimmelblau.so"
diff --git a/authd-oidc-brokers/internal/providers/msentraid/himmelblau/himmelblau.go b/authd-oidc-brokers/internal/providers/msentraid/himmelblau/himmelblau.go
new file mode 100644
index 0000000000..722599c9bd
--- /dev/null
+++ b/authd-oidc-brokers/internal/providers/msentraid/himmelblau/himmelblau.go
@@ -0,0 +1,265 @@
+//go:build withmsentraid
+
+// Package himmelblau provides functions to use the libhimmelblau library
+package himmelblau
+
+import (
+	"context"
+	"fmt"
+	"net/url"
+	"os"
+	"strings"
+	"sync"
+
+	"github.com/ubuntu/authd/log"
+	"golang.org/x/oauth2"
+)
+
+var (
+	tpm         *boxedDynTPM
+	tpmInitOnce sync.Once
+	//nolint:errname // This is not a sentinel error.
+	tpmInitErr error
+
+	brokerClientApp         *brokerClientApplication
+	brokerClientAppInitOnce sync.Once
+	//nolint:errname // This is not a sentinel error.
+	brokerClientAppInitErr error
+
+	authorityBaseURL   = "https://login.microsoftonline.com"
+	authorityBaseURLMu sync.RWMutex
+
+	deviceRegistrationMu sync.RWMutex
+)
+
+func ensureTPMInitialized() error {
+	tpmInitOnce.Do(func() {
+		filters := []string{"warn"}
+		logLevel := log.GetLevel()
+		if logLevel <= log.DebugLevel {
+			log.Debug(context.Background(), "Setting libhimmelblau tracing level to DEBUG")
+			filters = append(filters, "himmelblau=debug")
+		} else if logLevel <= log.InfoLevel {
+			filters = append(filters, "himmelblau=info")
+		}
+
+		if tpmInitErr = setTracingFilter(strings.Join(filters, ",")); tpmInitErr != nil {
+			return
+		}
+
+		// An optional TPM Transmission Interface. If this parameter is empty, a soft TPM is initialized.
+		var tctiName string
+		tpm, tpmInitErr = initTPM(tctiName)
+		if tpmInitErr != nil {
+			return
+		}
+	})
+
+	return tpmInitErr
+}
+
+func ensureBrokerClientAppInitialized(tenantID string, data *DeviceRegistrationData) error {
+	if err := ensureTPMInitialized(); err != nil {
+		return err
+	}
+
+	brokerClientAppInitOnce.Do(func() {
+		authorityBaseURLMu.RLock()
+		authority, err := url.JoinPath(authorityBaseURL, tenantID)
+		authorityBaseURLMu.RUnlock()
+		if err != nil {
+			brokerClientAppInitErr = fmt.Errorf("failed to construct authority URL: %v", err)
+			return
+		}
+		var transportKey []byte
+		var certKey []byte
+		if data != nil {
+			transportKey = data.TransportKey
+			certKey = data.CertKey
+		}
+
+		brokerClientApp, brokerClientAppInitErr = initBroker(authority, "", transportKey, certKey)
+		if brokerClientAppInitErr != nil {
+			return
+		}
+	})
+
+	return brokerClientAppInitErr
+}
+
+// DeviceRegistrationData contains the data returned by RegisterDevice
+// which is needed to acquire an access token later.
+type DeviceRegistrationData struct {
+	DeviceID      string `json:"device_id"`
+	CertKey       []byte `json:"cert_key"`
+	TransportKey  []byte `json:"transport_key"`
+	AuthValue     string `json:"auth_value"`
+	TPMMachineKey []byte `json:"tpm_machine_key"`
+}
+
+// IsValid checks whether all fields of the DeviceRegistrationData are set.
+func (d *DeviceRegistrationData) IsValid() bool {
+	return d.DeviceID != "" &&
+		d.CertKey != nil &&
+		d.TransportKey != nil &&
+		d.AuthValue != "" &&
+		d.TPMMachineKey != nil
+}
+
+// RegisterDevice registers the device with Microsoft Entra ID and returns the
+// device registration data required for subsequent access token acquisition via
+// AcquireAccessTokenForGraphAPI.
+//
+// The returned cleanup function must be called after AcquireAccessTokenForGraphAPI
+// or if that function will not be called, to release an internal mutex and allow
+// future device registrations.
+//
+// RegisterDevice is thread-safe due to an internal mutex that serializes access
+// to libhimmelblau, which modifies shared state during registration.
+func RegisterDevice(
+	ctx context.Context,
+	token *oauth2.Token,
+	tenantID string,
+	domain string,
+) (registrationData *DeviceRegistrationData, cleanup func(), err error) {
+	deviceRegistrationMu.Lock()
+	// libhimmelblau modifies BrokerClientApplication.cert_key during registration.
+	// This key is reused in later calls, including acquire_token_by_refresh_token.
+	// If cert_key changes because another device registration was done concurrently,
+	// libhimmelblau returns "TPM error: Failed to load IdentityKey: Aes256GcmDecrypt".
+	// The mutex also prevents concurrent modifications to TPM state.
+	unlock := deviceRegistrationMu.Unlock
+
+	// Ensure that the mutex is unlocked if an error occurs.
+	// We can't rename `unlock` to `cleanup` because `return nil, nil, err` sets
+	// the return value `cleanup` to `nil`, so calling `cleanup()` would panic.
+	defer func() {
+		if err != nil {
+			unlock()
+		}
+	}()
+
+	if err := ensureBrokerClientAppInitialized(tenantID, nil); err != nil {
+		return nil, nil, fmt.Errorf("failed to initialize broker client application: %v", err)
+	}
+
+	authValue, err := generateAuthValue()
+	if err != nil {
+		return nil, nil, err
+	}
+
+	loadableMachineKey, tpmCleanup, err := createTPMMachineKey(tpm, authValue)
+	if err != nil {
+		return nil, nil, err
+	}
+	defer tpmCleanup()
+
+	attrs, err := initEnrollAttrs(domain, hostname(), OSVersion())
+	if err != nil {
+		return nil, nil, err
+	}
+
+	machineKey, tpmCleanup, err := loadTPMMachineKey(tpm, authValue, loadableMachineKey)
+	if err != nil {
+		return nil, nil, err
+	}
+	defer tpmCleanup()
+
+	data, err := enrollDevice(brokerClientApp, token.RefreshToken, attrs, tpm, machineKey)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	log.Infof(ctx, "Enrolled device with ID: %v", data.DeviceID)
+
+	data.TPMMachineKey, err = serializeLoadableMachineKey(loadableMachineKey)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	data.AuthValue = authValue
+
+	return data, unlock, nil
+}
+
+func hostname() string {
+	name, err := os.Hostname()
+	if err != nil {
+		log.Warningf(context.Background(), "Failed to get hostname: %v", err)
+		return "unknown"
+	}
+	return name
+}
+
+// OSVersion gets the pretty name of the OS release from the system.
+// Since we're running in a snap, this returns the version of the core base snap
+// (which is not that helpful when it's shown as the device's OS in Entra, so
+// might want to change this in the future, to somehow get the host's OS version).
+var OSVersion = sync.OnceValue(func() string {
+	data, err := os.ReadFile("/etc/os-release")
+	if err != nil {
+		log.Warningf(context.Background(), "Failed to read /etc/os-release: %v", err)
+		return "unknown"
+	}
+
+	for _, line := range strings.Split(string(data), "\n") {
+		if name, found := strings.CutPrefix(line, "PRETTY_NAME="); found && name != "" {
+			return name
+		}
+	}
+
+	log.Warningf(context.Background(), "PRETTY_NAME not found in /etc/os-release")
+	return "unknown"
+})
+
+// AcquireAccessTokenForGraphAPI uses the refresh token from the provided
+// OAuth 2.0 token with the required scopes to access the Microsoft Graph API.
+func AcquireAccessTokenForGraphAPI(
+	ctx context.Context,
+	clientID string,
+	tenantID string,
+	token *oauth2.Token,
+	data DeviceRegistrationData,
+) (string, error) {
+	if err := ensureBrokerClientAppInitialized(tenantID, &data); err != nil {
+		return "", fmt.Errorf("failed to initialize broker client application: %v", err)
+	}
+
+	loadableMachineKey, cleanup, err := deserializeLoadableMachineKey(data.TPMMachineKey)
+	if err != nil {
+		return "", err
+	}
+	defer cleanup()
+
+	machineKey, cleanup, err := loadTPMMachineKey(tpm, data.AuthValue, loadableMachineKey)
+	if err != nil {
+		return "", err
+	}
+	defer cleanup()
+
+	userToken, cleanup, err := acquireTokenByRefreshToken(
+		brokerClientApp,
+		token.RefreshToken,
+		[]string{"GroupMember.Read.All"},
+		"",
+		// We could use `nil` here instead of the client ID if we also use `nil` as the client ID
+		// in the `broker_init` call, which means that the user doesn't even have to register
+		// an OIDC app in Entra. However, that has the effect that we can't fetch the groups
+		// of the user.
+		clientID,
+		tpm,
+		machineKey,
+	)
+	if err != nil {
+		return "", err
+	}
+	defer cleanup()
+
+	accessToken, err := accessTokenFromUserToken(userToken)
+	if err != nil {
+		return "", err
+	}
+	log.Info(ctx, "Acquired access token")
+
+	return accessToken, nil
+}
diff --git a/authd-oidc-brokers/internal/providers/msentraid/himmelblau/himmelblau_c.go b/authd-oidc-brokers/internal/providers/msentraid/himmelblau/himmelblau_c.go
new file mode 100644
index 0000000000..d45e064470
--- /dev/null
+++ b/authd-oidc-brokers/internal/providers/msentraid/himmelblau/himmelblau_c.go
@@ -0,0 +1,350 @@
+//go:build withmsentraid
+
+package himmelblau
+
+//go:generate ./generate.sh
+
+/*
+#cgo LDFLAGS: -L${SRCDIR} -lhimmelblau
+// Add the current directory to the library search path if we're building for testing,
+// because libhimmelblau is not installed in the standard search directories.
+#cgo !release LDFLAGS: -Wl,-rpath,${SRCDIR}
+#include "himmelblau.h"
+*/
+import "C"
+
+import (
+	"context"
+	"fmt"
+	"strconv"
+	"strings"
+	"unsafe"
+
+	"github.com/ubuntu/authd/log"
+)
+
+// Entra AADSTS error codes as defined in
+// https://learn.microsoft.com/en-us/entra/identity-platform/reference-error-codes
+const (
+	// AADSTS135011 Device used during the authentication is disabled.
+	deviceDisabledErrorCode = 135011
+	// AADSTS50011 InvalidReplyTo - The reply address is missing, misconfigured,
+	// or doesn't match reply addresses configured for the app. As a resolution
+	// ensures to add this missing reply address to the Microsoft Entra
+	// application or have someone with the permissions to manage your
+	// application in Microsoft Entra IF do this for you. To learn more, see the
+	// troubleshooting article for error AADSTS50011.
+	invalidRedirectURIErrorCode = 50011
+)
+
+type boxedDynTPM C.BoxedDynTpm
+type brokerClientApplication C.BrokerClientApplication
+
+func setTracingFilter(filter string) error {
+	if msalErr := C.set_module_tracing_filter(C.CString(filter)); msalErr != nil {
+		return fmt.Errorf("failed to set libhimmelblau tracing filter: %v", C.GoString(msalErr.msg))
+	}
+
+	return nil
+}
+
+func initTPM(tctiName string) (tpm *boxedDynTPM, err error) {
+	var cTctiName *C.char
+	if tctiName != "" {
+		cTctiName = C.CString(tctiName)
+		defer C.free(unsafe.Pointer(cTctiName))
+	}
+
+	if msalErr := C.tpm_init(cTctiName, (**C.BoxedDynTpm)(unsafe.Pointer(&tpm))); msalErr != nil {
+		return nil, fmt.Errorf("failed to initialize TPM: %v", C.GoString(msalErr.msg))
+	}
+
+	return tpm, nil
+}
+
+func initBroker(authority, clientID string, transportKeyBytes, certKeyBytes []byte) (broker *brokerClientApplication, err error) {
+	cAuthority := C.CString(authority)
+	defer C.free(unsafe.Pointer(cAuthority))
+
+	var cClientID *C.char
+	if clientID != "" {
+		cClientID = C.CString(clientID)
+		defer C.free(unsafe.Pointer(cClientID))
+	}
+
+	var cTransportKey *C.LoadableMsOapxbcRsaKey
+	if len(transportKeyBytes) > 0 {
+		msalErr := C.deserialize_loadable_ms_oapxbc_rsa_key(
+			(*C.uint8_t)(unsafe.Pointer(&transportKeyBytes[0])),
+			C.size_t(len(transportKeyBytes)),
+			&cTransportKey,
+		)
+		if msalErr != nil {
+			return nil, fmt.Errorf("failed to deserialize transport key: %v", C.GoString(msalErr.msg))
+		}
+		defer C.loadable_ms_oapxbc_rsa_key_free(cTransportKey)
+	}
+
+	var cCertKey *C.LoadableMsDeviceEnrolmentKey
+	if len(certKeyBytes) > 0 {
+		msalErr := C.deserialize_loadable_ms_device_enrolment_key(
+			(*C.uint8_t)(unsafe.Pointer(&certKeyBytes[0])),
+			C.size_t(len(certKeyBytes)),
+			&cCertKey,
+		)
+		if msalErr != nil {
+			return nil, fmt.Errorf("failed to deserialize cert key: %v", C.GoString(msalErr.msg))
+		}
+		defer C.loadable_ms_device_enrollment_key_free(cCertKey)
+	}
+
+	msalErr := C.broker_init(
+		cAuthority,
+		cClientID,
+		cTransportKey,
+		cCertKey,
+		(**C.BrokerClientApplication)(unsafe.Pointer(&broker)),
+	)
+	if msalErr != nil {
+		return nil, fmt.Errorf("failed to initialize broker client: %v", C.GoString(msalErr.msg))
+	}
+
+	return broker, nil
+}
+
+func initEnrollAttrs(domain, hostname, osVersion string) (attrs *C.EnrollAttrs, err error) {
+	cDomain := C.CString(domain)
+	defer C.free(unsafe.Pointer(cDomain))
+	cHostname := C.CString(hostname)
+	defer C.free(unsafe.Pointer(cHostname))
+	cOSVersion := C.CString(osVersion)
+	defer C.free(unsafe.Pointer(cOSVersion))
+
+	msalErr := C.enroll_attrs_init(
+		cDomain,
+		cHostname,
+		nil, /* device_type - default is "Linux" */
+		0,   /* join_type - 0: Azure AD join */
+		cOSVersion,
+		&attrs,
+	)
+	if msalErr != nil {
+		return nil, fmt.Errorf("failed to initialize enroll attributes: %v", C.GoString(msalErr.msg))
+	}
+
+	// TODO: Do we not have to free the attrs?
+
+	return attrs, nil
+}
+
+func generateAuthValue() (authValue string, err error) {
+	var cAuthValue *C.char
+	if msalErr := C.auth_value_generate(&cAuthValue); msalErr != nil {
+		return "", fmt.Errorf("failed to generate auth value: %v", C.GoString(msalErr.msg))
+	}
+	defer C.free(unsafe.Pointer(cAuthValue))
+
+	return C.GoString(cAuthValue), nil
+}
+
+func createTPMMachineKey(tpm *boxedDynTPM, authValue string) (key *C.LoadableMachineKey, cleanup func(), err error) {
+	cAuthValue := C.CString(authValue)
+	defer C.free(unsafe.Pointer(cAuthValue))
+
+	var loadableMachineKey *C.LoadableMachineKey
+	msalErr := C.tpm_machine_key_create((*C.BoxedDynTpm)(unsafe.Pointer(tpm)), cAuthValue, &loadableMachineKey)
+	if msalErr != nil {
+		return nil, nil, fmt.Errorf("failed to create loadable machine key: %v", C.GoString(msalErr.msg))
+	}
+
+	cleanup = func() { C.loadable_machine_key_free(loadableMachineKey) }
+
+	return loadableMachineKey, cleanup, nil
+}
+
+func loadTPMMachineKey(tpm *boxedDynTPM, authValue string, loadableMachineKey *C.LoadableMachineKey) (key *C.MachineKey, cleanup func(), err error) {
+	cAuthValue := C.CString(authValue)
+	defer C.free(unsafe.Pointer(cAuthValue))
+
+	if msalErr := C.tpm_machine_key_load((*C.BoxedDynTpm)(unsafe.Pointer(tpm)), cAuthValue, loadableMachineKey, &key); msalErr != nil {
+		return nil, nil, fmt.Errorf("failed to load TPM machine key: %v", C.GoString(msalErr.msg))
+	}
+
+	cleanup = func() { C.machine_key_free(key) }
+
+	return key, cleanup, nil
+}
+
+func enrollDevice(broker *brokerClientApplication, refreshToken string, attrs *C.EnrollAttrs, tpm *boxedDynTPM, machineKey *C.MachineKey) (data *DeviceRegistrationData, err error) {
+	cRefreshToken := C.CString(refreshToken)
+	defer C.free(unsafe.Pointer(cRefreshToken))
+
+	var cTransportKey *C.LoadableMsOapxbcRsaKey
+	var cCertKey *C.LoadableMsDeviceEnrolmentKey
+	var cDeviceID *C.char
+
+	msalErr := C.broker_enroll_device(
+		(*C.BrokerClientApplication)(unsafe.Pointer(broker)),
+		cRefreshToken,
+		attrs,
+		(*C.BoxedDynTpm)(unsafe.Pointer(tpm)),
+		machineKey,
+		&cTransportKey,
+		&cCertKey,
+		&cDeviceID,
+	)
+	if msalErr != nil {
+		return nil, fmt.Errorf("failed to enroll device: %v", C.GoString(msalErr.msg))
+	}
+	defer C.loadable_ms_oapxbc_rsa_key_free(cTransportKey)
+	defer C.loadable_ms_device_enrollment_key_free(cCertKey)
+	defer C.free(unsafe.Pointer(cDeviceID))
+
+	deviceID := C.GoString(cDeviceID)
+
+	var certKey []byte
+	var cSerializedCertKey *C.char
+	var cSerializedCertKeyLen C.size_t
+	defer C.free(unsafe.Pointer(cSerializedCertKey))
+	msalErr = C.serialize_loadable_ms_device_enrolment_key(cCertKey, &cSerializedCertKey, &cSerializedCertKeyLen)
+	if msalErr != nil {
+		return nil, fmt.Errorf("failed to serialize device enrollment key: %v", C.GoString(msalErr.msg))
+	}
+	if cSerializedCertKeyLen > 0 {
+		certKey = C.GoBytes(unsafe.Pointer(cSerializedCertKey), C.int(cSerializedCertKeyLen))
+	}
+
+	var transportKey []byte
+	var cSerializedTransportKey *C.char
+	var cSerializedTransportKeyLen C.size_t
+	defer C.free(unsafe.Pointer(cSerializedTransportKey))
+	msalErr = C.serialize_loadable_ms_oapxbc_rsa_key(cTransportKey, &cSerializedTransportKey, &cSerializedTransportKeyLen)
+	if msalErr != nil {
+		return nil, fmt.Errorf("failed to serialize transport key: %v", C.GoString(msalErr.msg))
+	}
+	if cSerializedTransportKeyLen > 0 {
+		transportKey = C.GoBytes(unsafe.Pointer(cSerializedTransportKey), C.int(cSerializedTransportKeyLen))
+	}
+
+	return &DeviceRegistrationData{
+		DeviceID:     deviceID,
+		CertKey:      certKey,
+		TransportKey: transportKey,
+	}, nil
+}
+
+func serializeLoadableMachineKey(loadableMachineKey *C.LoadableMachineKey) (key []byte, err error) {
+	var cSerializedKey *C.char
+	var cSerializedKeyLen C.size_t
+	defer C.free(unsafe.Pointer(cSerializedKey))
+	msalErr := C.serialize_loadable_machine_key(loadableMachineKey, &cSerializedKey, &cSerializedKeyLen)
+	if msalErr != nil {
+		return nil, fmt.Errorf("failed to serialize loadable machine key: %v", C.GoString(msalErr.msg))
+	}
+	if cSerializedKeyLen > 0 {
+		key = C.GoBytes(unsafe.Pointer(cSerializedKey), C.int(cSerializedKeyLen))
+	}
+
+	return key, nil
+}
+
+func deserializeLoadableMachineKey(key []byte) (loadableMachineKey *C.LoadableMachineKey, cleanup func(), err error) {
+	msalErr := C.deserialize_loadable_machine_key(
+		(*C.uint8_t)(unsafe.Pointer(&key[0])),
+		C.size_t(len(key)),
+		&loadableMachineKey,
+	)
+	if msalErr != nil {
+		return nil, nil, fmt.Errorf("failed to deserialize loadable machine key: %v", C.GoString(msalErr.msg))
+	}
+
+	cleanup = func() { C.loadable_machine_key_free(loadableMachineKey) }
+
+	return loadableMachineKey, cleanup, nil
+}
+
+func acquireTokenByRefreshToken(broker *brokerClientApplication, refreshToken string, scopes []string, requestResource string, clientID string, tpm *boxedDynTPM, machineKey *C.MachineKey) (token *C.UserToken, cleanup func(), err error) {
+	cRefreshToken := C.CString(refreshToken)
+	defer C.free(unsafe.Pointer(cRefreshToken))
+
+	var cScopes []*C.char
+	for _, scope := range scopes {
+		cScope := C.CString(scope)
+		cScopes = append(cScopes, cScope)
+		defer C.free(unsafe.Pointer(cScope))
+	}
+
+	var cRequestResource *C.char
+	if requestResource != "" {
+		cRequestResource = C.CString(requestResource)
+		defer C.free(unsafe.Pointer(cRequestResource))
+	}
+
+	var cClientID *C.char
+	if clientID != "" {
+		cClientID = C.CString(clientID)
+		defer C.free(unsafe.Pointer(cClientID))
+	}
+
+	var userToken *C.UserToken
+
+	msalErr := C.broker_acquire_token_by_refresh_token(
+		(*C.BrokerClientApplication)(unsafe.Pointer(broker)),
+		cRefreshToken,
+		&cScopes[0],
+		C.int(len(scopes)),
+		cRequestResource,
+		// We could use `nil` here instead of the client ID if we also use `nil` as the client ID
+		// in the `broker_init` call, which means that the user doesn't even have to register
+		// an OIDC app in Entra. However, that has the effect that we can't fetch the groups
+		// of the user.
+		cClientID,
+		(*C.BoxedDynTpm)(unsafe.Pointer(tpm)),
+		machineKey,
+		&userToken,
+	)
+	if msalErr != nil {
+		// Error codes can be returned by libhimmelblau as a single code in the aadsts_code field or
+		// as a list of error codes in the acquire_token_error_codes field.
+		errorCodes := []C.uint32_t{msalErr.aadsts_code}
+		if msalErr.acquire_token_error_codes != nil && msalErr.acquire_token_error_codes_len > 0 {
+			errorCodes = unsafe.Slice(msalErr.acquire_token_error_codes, msalErr.acquire_token_error_codes_len)
+		}
+
+		for _, errorCode := range errorCodes {
+			errorCodeStr := strconv.Itoa(int(errorCode))
+			switch {
+			// AADSTS error codes can have additional digits or subcodes appended
+			// (e.g. AADSTS500113 as a variation of AADSTS50011).
+			// Checking the prefix ensures we catch all variations of the base error code.
+			case strings.HasPrefix(errorCodeStr, strconv.Itoa(deviceDisabledErrorCode)):
+				log.Error(context.Background(), C.GoString(msalErr.msg))
+				return nil, nil, ErrDeviceDisabled
+			case strings.HasPrefix(errorCodeStr, strconv.Itoa(invalidRedirectURIErrorCode)):
+				log.Errorf(context.Background(), "Token acquisition failed: %v", C.GoString(msalErr.msg))
+				return nil, nil, ErrInvalidRedirectURI
+			}
+		}
+
+		// The token acquisition failed unexpectedly.
+		// One possible reason is that the device was deleted by an administrator in Entra ID.
+		// Unfortunately, Microsoft doesn't return a specific error code for that case,
+		// it returns the generic error "AADSTS50155: Device authentication failed".
+		return nil, nil, TokenAcquisitionError{msg: fmt.Sprintf("error acquiring access token using refresh token: %v", C.GoString(msalErr.msg))}
+	}
+
+	cleanup = func() { C.user_token_free(userToken) }
+
+	return userToken, cleanup, nil
+}
+
+func accessTokenFromUserToken(userToken *C.UserToken) (accessToken string, err error) {
+	var cAccessToken *C.char
+	msalErr := C.user_token_access_token(userToken, &cAccessToken)
+	if msalErr != nil {
+		return "", fmt.Errorf("failed to get access token: %v", C.GoString(msalErr.msg))
+	}
+	defer C.free(unsafe.Pointer(cAccessToken))
+
+	return C.GoString(cAccessToken), nil
+}
diff --git a/authd-oidc-brokers/internal/providers/msentraid/himmelblau/testutils.go b/authd-oidc-brokers/internal/providers/msentraid/himmelblau/testutils.go
new file mode 100644
index 0000000000..538b1cb8c6
--- /dev/null
+++ b/authd-oidc-brokers/internal/providers/msentraid/himmelblau/testutils.go
@@ -0,0 +1,13 @@
+//go:build withmsentraid
+
+package himmelblau
+
+import "testing"
+
+// SetAuthorityBaseURL sets the base URL for the token authority, used in tests to override the default.
+// This is not thread-safe.
+func SetAuthorityBaseURL(_ *testing.T, url string) {
+	authorityBaseURLMu.Lock()
+	authorityBaseURL = url
+	authorityBaseURLMu.Unlock()
+}
diff --git a/authd-oidc-brokers/internal/providers/msentraid/msentraid.go b/authd-oidc-brokers/internal/providers/msentraid/msentraid.go
new file mode 100644
index 0000000000..b03a2fdcb8
--- /dev/null
+++ b/authd-oidc-brokers/internal/providers/msentraid/msentraid.go
@@ -0,0 +1,542 @@
+//go:build withmsentraid
+
+// Package msentraid is the Microsoft Entra ID specific extension.
+package msentraid
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"regexp"
+	"slices"
+	"strings"
+	"time"
+
+	"github.com/Azure/azure-sdk-for-go/sdk/azcore"
+	"github.com/Azure/azure-sdk-for-go/sdk/azcore/policy"
+	"github.com/canonical/authd/authd-oidc-brokers/internal/broker/authmodes"
+	"github.com/canonical/authd/authd-oidc-brokers/internal/consts"
+	providerErrors "github.com/canonical/authd/authd-oidc-brokers/internal/providers/errors"
+	"github.com/canonical/authd/authd-oidc-brokers/internal/providers/info"
+	"github.com/canonical/authd/authd-oidc-brokers/internal/providers/msentraid/himmelblau"
+	"github.com/coreos/go-oidc/v3/oidc"
+	"github.com/golang-jwt/jwt/v5"
+	"github.com/k0kubun/pp"
+	msgraphsdk "github.com/microsoftgraph/msgraph-sdk-go"
+	msgraphauth "github.com/microsoftgraph/msgraph-sdk-go-core/authentication"
+	msgraphmodels "github.com/microsoftgraph/msgraph-sdk-go/models"
+	"github.com/ubuntu/authd/log"
+	"golang.org/x/oauth2"
+)
+
+func init() {
+	pp.ColoringEnabled = false
+}
+
+const (
+	localGroupPrefix   = "linux-"
+	defaultMSGraphHost = "graph.microsoft.com"
+	msgraphAPIVersion  = "v1.0"
+)
+
+// Provider is the Microsoft Entra ID provider implementation.
+type Provider struct {
+	expectedScopes              []string
+	needsAccessTokenForGraphAPI bool
+
+	// Used as the token scopes of the access token for the Microsoft Graph API in tests.
+	tokenScopesForGraphAPI []string
+}
+
+// New returns a new MSEntraID provider.
+func New() *Provider {
+	return &Provider{
+		expectedScopes: append(consts.DefaultScopes, "GroupMember.Read.All", "User.Read"),
+	}
+}
+
+// AdditionalScopes returns the generic scopes required by the EntraID provider.
+func (p *Provider) AdditionalScopes() []string {
+	return []string{oidc.ScopeOfflineAccess, "GroupMember.Read.All", "User.Read"}
+}
+
+// AuthOptions returns the generic auth options required by the EntraID provider.
+func (p *Provider) AuthOptions() []oauth2.AuthCodeOption {
+	return []oauth2.AuthCodeOption{}
+}
+
+func (p *Provider) getTokenScopes(token *jwt.Token) ([]string, error) {
+	claims, ok := token.Claims.(jwt.MapClaims)
+	if !ok {
+		return nil, fmt.Errorf("failed to cast token claims to MapClaims: %v", token.Claims)
+	}
+	scopesStr, ok := claims["scp"].(string)
+	if !ok {
+		return nil, fmt.Errorf("failed to cast scp claim to string: %v", claims["scp"])
+	}
+	return strings.Split(scopesStr, " "), nil
+}
+
+func (p *Provider) getAppID(token *jwt.Token) (string, error) {
+	claims, ok := token.Claims.(jwt.MapClaims)
+	if !ok {
+		return "", fmt.Errorf("failed to cast token claims to MapClaims: %v", token.Claims)
+	}
+	appID, ok := claims["appid"].(string)
+	if !ok {
+		return "", fmt.Errorf("failed to cast appid claim to string: %v", claims["appid"])
+	}
+	return appID, nil
+}
+
+// GetExtraFields returns the extra fields of the token which should be stored persistently.
+func (p *Provider) GetExtraFields(token *oauth2.Token) map[string]interface{} {
+	return map[string]interface{}{
+		"scope": token.Extra("scope"),
+		"scp":   token.Extra("scp"),
+	}
+}
+
+// GetMetadata returns relevant metadata about the provider.
+func (p *Provider) GetMetadata(provider *oidc.Provider) (map[string]interface{}, error) {
+	var claims struct {
+		MSGraphHost string `json:"msgraph_host"`
+	}
+
+	if err := provider.Claims(&claims); err != nil {
+		return nil, fmt.Errorf("failed to get provider claims: %v", err)
+	}
+
+	return map[string]interface{}{
+		"msgraph_host": fmt.Sprintf("https://%s/%s", claims.MSGraphHost, msgraphAPIVersion),
+	}, nil
+}
+
+// GetUserInfo returns the user info from the ID token.
+func (p *Provider) GetUserInfo(idToken info.Claimer) (info.User, error) {
+	var err error
+
+	userClaims, err := p.userClaims(idToken)
+	if err != nil {
+		return info.User{}, err
+	}
+
+	return info.NewUser(
+		userClaims.PreferredUserName,
+		userClaims.Home,
+		userClaims.Sub,
+		userClaims.Shell,
+		userClaims.Gecos,
+		nil,
+	), nil
+}
+
+// GetGroups retrieves the groups the user is a member of via the Microsoft Graph API.
+func (p *Provider) GetGroups(
+	ctx context.Context,
+	clientID string,
+	issuerURL string,
+	token *oauth2.Token,
+	providerMetadata map[string]interface{},
+	deviceRegistrationDataJSON []byte,
+) ([]info.Group, error) {
+	accessTokenStr := token.AccessToken
+	if p.needsAccessTokenForGraphAPI {
+		var data himmelblau.DeviceRegistrationData
+		err := json.Unmarshal(deviceRegistrationDataJSON, &data)
+		if err != nil {
+			log.Noticef(ctx, "Device registration JSON data: %s", deviceRegistrationDataJSON)
+			return nil, fmt.Errorf("failed to unmarshal device registration data: %v", err)
+		}
+
+		tenantID := tenantID(issuerURL)
+		accessTokenStr, err = himmelblau.AcquireAccessTokenForGraphAPI(ctx, clientID, tenantID, token, data)
+		if errors.Is(err, himmelblau.ErrDeviceDisabled) {
+			return nil, err
+		}
+		if errors.Is(err, himmelblau.ErrInvalidRedirectURI) {
+			msg := "Token acquisition failed: The app is misconfigured in Microsoft Entra (the redirect URI is missing or invalid). Please contact your administrator."
+			return nil, &providerErrors.ForDisplayError{Message: msg, Err: err}
+		}
+		if err != nil {
+			return nil, fmt.Errorf("failed to acquire access token for Microsoft Graph API: %w", err)
+		}
+	}
+	// Parse the access token without signature verification, because we're not the audience of the token (that's
+	// the Microsoft Graph API) and we don't use it for authentication, but only to access the Microsoft Graph API.
+	accessToken, _, err := new(jwt.Parser).ParseUnverified(accessTokenStr, jwt.MapClaims{})
+	if err != nil {
+		return nil, fmt.Errorf("failed to parse access token: %w", err)
+	}
+
+	msgraphHost := fmt.Sprintf("https://%s/%s", defaultMSGraphHost, msgraphAPIVersion)
+	if providerMetadata["msgraph_host"] != nil {
+		var ok bool
+		msgraphHost, ok = providerMetadata["msgraph_host"].(string)
+		if !ok {
+			return nil, fmt.Errorf("failed to cast msgraph_host to string: %v", providerMetadata["msgraph_host"])
+		}
+
+		// Handle the case that the provider metadata only contains the host without the protocol and API version,
+		// as was the case before 5fc98520c45294ffb85bb27a81929e2ec1b89fcb. This fixes #858.
+		if !strings.Contains(msgraphHost, "://") {
+			msgraphHost = fmt.Sprintf("https://%s/%s", msgraphHost, msgraphAPIVersion)
+		}
+	}
+
+	return p.fetchUserGroups(accessToken, msgraphHost)
+}
+
+type claims struct {
+	PreferredUserName string `json:"preferred_username"`
+	Sub               string `json:"sub"`
+	Home              string `json:"home"`
+	Shell             string `json:"shell"`
+	Gecos             string `json:"name"`
+}
+
+// userClaims returns the user claims parsed from the ID token.
+func (p *Provider) userClaims(idToken info.Claimer) (claims, error) {
+	var userClaims claims
+	if err := idToken.Claims(&userClaims); err != nil {
+		return claims{}, fmt.Errorf("failed to get ID token claims: %v", err)
+	}
+	return userClaims, nil
+}
+
+// fetchUserGroups access the Microsoft Graph API to get the groups the user is a member of.
+func (p *Provider) fetchUserGroups(token *jwt.Token, msgraphHost string) ([]info.Group, error) {
+	log.Debug(context.Background(), "Getting user groups from Microsoft Graph API")
+
+	var err error
+	scopes := p.tokenScopesForGraphAPI
+
+	if scopes == nil {
+		scopes, err = p.getTokenScopes(token)
+		if err != nil {
+			return nil, err
+		}
+	}
+
+	// Check if the token has the GroupMember.Read.All scope
+	if !slices.Contains(scopes, "GroupMember.Read.All") {
+		msg := "Error: the Microsoft Entra ID app is missing the GroupMember.Read.All permission"
+		return nil, &providerErrors.ForDisplayError{Message: msg}
+	}
+
+	cred := azureTokenCredential{token: token}
+	auth, err := msgraphauth.NewAzureIdentityAuthenticationProvider(cred)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create AzureIdentityAuthenticationProvider: %v", err)
+	}
+
+	adapter, err := msgraphsdk.NewGraphRequestAdapter(auth)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create GraphRequestAdapter: %v", err)
+	}
+	adapter.SetBaseUrl(msgraphHost)
+
+	client := msgraphsdk.NewGraphServiceClient(adapter)
+
+	// Get the groups (only the groups, not directory roles or administrative units, because that would require
+	// additional permissions) which the user is a member of.
+	graphGroups, err := getSecurityGroups(client)
+	if err != nil {
+		return nil, err
+	}
+
+	var groups []info.Group
+	var msGroupNames []string
+	for _, msGroup := range graphGroups {
+		var group info.Group
+
+		idPtr := msGroup.GetId()
+		if idPtr == nil {
+			log.Warning(context.Background(), pp.Sprintf("Could not get ID for group: %v", msGroup))
+			return nil, errors.New("could not get group id")
+		}
+		id := *idPtr
+
+		msGroupNamePtr := msGroup.GetDisplayName()
+		if msGroupNamePtr == nil {
+			log.Warning(context.Background(), pp.Sprintf("Could not get display name for group object (ID: %s): %v", id, msGroup))
+			return nil, errors.New("could not get group name")
+		}
+		msGroupName := *msGroupNamePtr
+
+		// Check if there is a name conflict with another group returned by the Graph API. It's not clear in which case
+		// the Graph API returns multiple groups with the same name (or the same group twice), but we've seen it happen
+		// in https://github.com/canonical/authd/issues/789.
+		if checkGroupIsDuplicate(msGroupName, msGroupNames) {
+			continue
+		}
+
+		// Microsoft groups are case-insensitive, see https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/resource-name-rules
+		group.Name = strings.ToLower(msGroupName)
+
+		isLocalGroup := strings.HasPrefix(group.Name, localGroupPrefix)
+		if isLocalGroup {
+			group.Name = strings.TrimPrefix(group.Name, localGroupPrefix)
+		}
+
+		// Don't set the UGID for local groups, because that's how the user manager differentiates between local and
+		// remote groups.
+		if !isLocalGroup {
+			group.UGID = id
+		}
+
+		groups = append(groups, group)
+		msGroupNames = append(msGroupNames, msGroupName)
+	}
+
+	return groups, nil
+}
+
+func checkGroupIsDuplicate(groupName string, groupNames []string) bool {
+	for _, name := range groupNames {
+		// We don't want to treat local groups without the prefix as duplicates of non-local groups
+		// (e.g. "linux-sudo" and "sudo"), so we compare the names as returned by the Graph API - except that we
+		// ignore the case, because we use the group names in lowercase.
+		if !strings.EqualFold(name, groupName) {
+			// Not a duplicate
+			continue
+		}
+
+		// To make debugging easier, check if the groups differ in case, and mention that in the log message.
+		if name == groupName {
+			log.Warningf(context.Background(), "The Microsoft Graph API returned the group %q multiple times, ignoring the duplicate", name)
+		} else {
+			log.Warningf(context.Background(), "The Microsoft Graph API returned the group %[1]q multiple times, but with different case (%[2]q and %[1]q), ignoring the duplicate", groupName, name)
+		}
+
+		return true
+	}
+
+	return false
+}
+
+func removeNonSecurityGroups(groups []msgraphmodels.Groupable) []msgraphmodels.Groupable {
+	var securityGroups []msgraphmodels.Groupable
+	for _, group := range groups {
+		if !isSecurityGroup(group) {
+			var s string
+			if groupNamePtr := group.GetDisplayName(); groupNamePtr != nil {
+				s = *groupNamePtr
+			} else if description := group.GetDescription(); description != nil {
+				s = *description
+			} else if uniqueName := group.GetUniqueName(); uniqueName != nil {
+				s = *uniqueName
+			}
+			if s == "" {
+				log.Debugf(context.Background(), "Removing unnamed non-security group")
+			} else {
+				log.Debugf(context.Background(), "Removing non-security group %s", s)
+			}
+			continue
+		}
+		securityGroups = append(securityGroups, group)
+	}
+	return securityGroups
+}
+
+func getSecurityGroups(client *msgraphsdk.GraphServiceClient) ([]msgraphmodels.Groupable, error) {
+	// Initial request to get groups
+	requestBuilder := client.Me().TransitiveMemberOf().GraphGroup()
+	result, err := requestBuilder.Get(context.Background(), nil)
+	if err != nil {
+		return nil, fmt.Errorf("failed to get user groups: %v", err)
+	}
+	if result == nil {
+		log.Debug(context.Background(), "Got nil response from Microsoft Graph API for user's groups, assuming that user is not a member of any group.")
+		return []msgraphmodels.Groupable{}, nil
+	}
+
+	groups := result.GetValue()
+
+	// Continue fetching groups using paging if a next link is available
+	for result.GetOdataNextLink() != nil {
+		nextLink := *result.GetOdataNextLink()
+
+		result, err = requestBuilder.WithUrl(nextLink).Get(context.Background(), nil)
+		if err != nil {
+			return nil, fmt.Errorf("failed to get next page of user groups: %v", err)
+		}
+
+		groups = append(groups, result.GetValue()...)
+	}
+
+	// Remove the groups which are not security groups (but for example Microsoft 365 groups, which can be created
+	// by non-admin users).
+	groups = removeNonSecurityGroups(groups)
+
+	var groupNames []string
+	for _, group := range groups {
+		groupNamePtr := group.GetDisplayName()
+		if groupNamePtr != nil {
+			groupNames = append(groupNames, *groupNamePtr)
+		}
+	}
+	log.Debugf(context.Background(), "Got groups: %s", strings.Join(groupNames, ", "))
+
+	return groups, nil
+}
+
+func isSecurityGroup(group msgraphmodels.Groupable) bool {
+	// A group is a security group if the `securityEnabled` property is true and the `groupTypes` property does not
+	// contain "Unified".
+	securityEnabledPtr := group.GetSecurityEnabled()
+	if securityEnabledPtr == nil || !*securityEnabledPtr {
+		return false
+	}
+
+	return !slices.Contains(group.GetGroupTypes(), "Unified")
+}
+
+// NormalizeUsername parses a username into a normalized version.
+func (p *Provider) NormalizeUsername(username string) string {
+	// Microsoft Entra usernames are case-insensitive. We can safely use strings.ToLower here without worrying about
+	// different Unicode characters that fold to the same lowercase letter, because the Microsoft Entra username policy
+	// (which we check in VerifyUsername) ensures that the username only contains ASCII characters.
+	return strings.ToLower(username)
+}
+
+// SupportedOIDCAuthModes returns the OIDC authentication modes supported by the provider.
+func (p *Provider) SupportedOIDCAuthModes() []string {
+	return []string{authmodes.Device, authmodes.DeviceQr}
+}
+
+// VerifyUsername checks if the authenticated username matches the requested username and that both are valid.
+func (p *Provider) VerifyUsername(requestedUsername, authenticatedUsername string) error {
+	if p.NormalizeUsername(requestedUsername) != p.NormalizeUsername(authenticatedUsername) {
+		msg := fmt.Sprintf("Authentication failure: requested username %q does not match the authenticated username %q", requestedUsername, authenticatedUsername)
+		return &providerErrors.ForDisplayError{Message: msg}
+	}
+
+	// Check that the usernames only contain the characters allowed by the Microsoft Entra username policy
+	// https://learn.microsoft.com/en-us/entra/identity/authentication/concept-sspr-policy#username-policies
+	usernameRegexp := regexp.MustCompile(`^[a-zA-Z0-9'.\-_!#^~@]+$`)
+	if !usernameRegexp.MatchString(authenticatedUsername) {
+		// If this error occurs, we should investigate and probably relax the username policy, so we ask the user
+		// explicitly to report this error.
+		msg := fmt.Sprintf("Authentication failure: the authenticated username %q contains invalid characters. Please report this error on https://github.com/canonical/authd/issues", authenticatedUsername)
+		return &providerErrors.ForDisplayError{Message: msg}
+	}
+	if !usernameRegexp.MatchString(requestedUsername) {
+		msg := fmt.Sprintf("Authentication failure: requested username %q contains invalid characters", requestedUsername)
+		return &providerErrors.ForDisplayError{Message: msg}
+	}
+
+	return nil
+}
+
+// SupportsDeviceRegistration checks if the provider supports device registration.
+func (p *Provider) SupportsDeviceRegistration() bool {
+	// The Microsoft Entra ID provider supports device registration.
+	return true
+}
+
+// IsTokenForDeviceRegistration checks if the token is for device registration.
+func (p *Provider) IsTokenForDeviceRegistration(token *oauth2.Token) (bool, error) {
+	accessToken, _, err := new(jwt.Parser).ParseUnverified(token.AccessToken, jwt.MapClaims{})
+	if err != nil {
+		return false, fmt.Errorf("failed to parse access token: %v", err)
+	}
+
+	appID, err := p.getAppID(accessToken)
+	if err != nil {
+		return false, fmt.Errorf("failed to get app ID from access token: %v", err)
+	}
+
+	return appID == consts.MicrosoftBrokerAppID, nil
+}
+
+// MaybeRegisterDevice checks if the device is already registered and registers it if not.
+func (p *Provider) MaybeRegisterDevice(
+	ctx context.Context,
+	token *oauth2.Token,
+	username string,
+	issuerURL string,
+	jsonData []byte,
+) (registrationData []byte, cleanup func(), err error) {
+	// If this function is called, it means that the token that we have is for device registration,
+	// so we can't use it to access the Microsoft Graph API.
+	p.needsAccessTokenForGraphAPI = true
+
+	nop := func() {}
+
+	// Check if the device is already registered
+	if len(jsonData) > 0 {
+		var data himmelblau.DeviceRegistrationData
+		if err := json.Unmarshal(jsonData, &data); err != nil {
+			log.Noticef(ctx, "Device registration JSON data: %s", string(jsonData))
+			return nil, nil, fmt.Errorf("failed to unmarshal device registration data: %v", err)
+		}
+		if data.IsValid() {
+			return jsonData, nop, nil
+		}
+	}
+
+	nameParts := strings.Split(username, "@")
+	if len(nameParts) != 2 {
+		return nil, nop, fmt.Errorf("invalid username format: %s, expected format is 'username@domain'", username)
+	}
+	domain := nameParts[1]
+
+	data, cleanup, err := himmelblau.RegisterDevice(ctx, token, tenantID(issuerURL), domain)
+	if err != nil {
+		return nil, nop, err
+	}
+
+	// Ensure that the cleanup function is called if we return an error.
+	defer func() {
+		if err != nil {
+			cleanup()
+		}
+	}()
+
+	jsonData, err = json.Marshal(data)
+	if err != nil {
+		return nil, nop, fmt.Errorf("failed to marshal device registration data: %v", err)
+	}
+
+	return jsonData, cleanup, nil
+}
+
+// tenantID extracts the tenant ID from a Microsoft Entra ID issuer URL.
+// For example, given: https://login.microsoftonline.com/8de88d99-6d0f-44d7-a8a5-925b012e5940/v2.0
+// it returns: 8de88d99-6d0f-44d7-a8a5-925b012e5940.
+func tenantID(issuerURL string) string {
+	return strings.Split(strings.TrimPrefix(issuerURL, "https://login.microsoftonline.com/"), "/")[0]
+}
+
+type azureTokenCredential struct {
+	token *jwt.Token
+}
+
+// GetToken creates an azcore.AccessToken from an oauth2.Token.
+func (c azureTokenCredential) GetToken(_ context.Context, _ policy.TokenRequestOptions) (azcore.AccessToken, error) {
+	claims, ok := c.token.Claims.(jwt.MapClaims)
+	if !ok {
+		return azcore.AccessToken{}, fmt.Errorf("failed to cast token claims to MapClaims: %v", c.token.Claims)
+	}
+	expiresOn, ok := claims["exp"].(float64)
+	if !ok {
+		return azcore.AccessToken{}, fmt.Errorf("failed to cast token expiration to float64: %v", claims["exp"])
+	}
+
+	return azcore.AccessToken{
+		Token:     c.token.Raw,
+		ExpiresOn: time.Unix(int64(expiresOn), 0),
+	}, nil
+}
+
+// IsTokenExpiredError returns true if the reason for the error is that the refresh token is expired.
+func (p *Provider) IsTokenExpiredError(err *oauth2.RetrieveError) bool {
+	return err.ErrorCode == "invalid_grant" && (strings.HasPrefix(err.ErrorDescription, "AADSTS50173:") || strings.HasPrefix(err.ErrorDescription, "AADSTS70043:"))
+}
+
+// IsUserDisabledError returns true if the reason for the error is that the user is disabled.
+func (p *Provider) IsUserDisabledError(err *oauth2.RetrieveError) bool {
+	return err.ErrorCode == "invalid_grant" && strings.HasPrefix(err.ErrorDescription, "AADSTS50057:")
+}
diff --git a/authd-oidc-brokers/internal/providers/msentraid/msentraid_test.go b/authd-oidc-brokers/internal/providers/msentraid/msentraid_test.go
new file mode 100644
index 0000000000..673c234c01
--- /dev/null
+++ b/authd-oidc-brokers/internal/providers/msentraid/msentraid_test.go
@@ -0,0 +1,391 @@
+//go:build withmsentraid
+
+package msentraid_test
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"os"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/canonical/authd/authd-oidc-brokers/internal/consts"
+	"github.com/canonical/authd/authd-oidc-brokers/internal/providers/msentraid"
+	"github.com/canonical/authd/authd-oidc-brokers/internal/providers/msentraid/himmelblau"
+	"github.com/canonical/authd/authd-oidc-brokers/internal/testutils"
+	"github.com/canonical/authd/authd-oidc-brokers/internal/testutils/golden"
+	"github.com/golang-jwt/jwt/v5"
+	"github.com/stretchr/testify/require"
+	"github.com/ubuntu/authd/log"
+	"golang.org/x/oauth2"
+)
+
+var discoveryURLMu sync.RWMutex
+
+func TestNew(t *testing.T) {
+	p := msentraid.New()
+
+	require.NotEmpty(t, p, "New should return a non-empty provider")
+}
+
+func TestNormalizeUsername(t *testing.T) {
+	t.Parallel()
+	tests := map[string]struct {
+		username string
+
+		wantNormalized string
+	}{
+		"Shouldnt_change_all_lower_case": {
+			username:       "name@email.com",
+			wantNormalized: "name@email.com",
+		},
+		"Should_convert_all_to_lower_case": {
+			username:       "NAME@email.com",
+			wantNormalized: "name@email.com",
+		},
+	}
+	for name, tc := range tests {
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			p := msentraid.New()
+			ret := p.NormalizeUsername(tc.username)
+			require.Equal(t, tc.wantNormalized, ret)
+		})
+	}
+}
+
+func TestVerifyUsername(t *testing.T) {
+	t.Parallel()
+
+	tests := map[string]struct {
+		requestedUsername string
+		authenticatedUser string
+
+		wantErr bool
+	}{
+		"Success_when_usernames_are_the_same":   {requestedUsername: "foo-bar@example", authenticatedUser: "foo-bar@example"},
+		"Success_when_usernames_differ_in_case": {requestedUsername: "foo-bar@example", authenticatedUser: "Foo-Bar@example"},
+
+		"Error_when_usernames_differ": {requestedUsername: "foo@example", authenticatedUser: "bar@foo", wantErr: true},
+		"Error_when_requested_username_contains_invalid_characters": {
+			requestedUsername: "fóó@example", authenticatedUser: "foo@example", wantErr: true,
+		},
+		"Error_when_authenticated_username_contains_invalid_characters": {
+			requestedUsername: "foo@example", authenticatedUser: "fóó@example", wantErr: true,
+		},
+	}
+	for name, tc := range tests {
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			p := msentraid.New()
+
+			err := p.VerifyUsername(tc.requestedUsername, tc.authenticatedUser)
+			if tc.wantErr {
+				require.Error(t, err, "VerifyUsername should return an error")
+				return
+			}
+
+			require.NoError(t, err, "VerifyUsername should not return an error")
+		})
+	}
+}
+
+func TestGetUserInfo(t *testing.T) {
+	t.Parallel()
+
+	tests := map[string]struct {
+		invalidIDToken     bool
+		tokenScopes        []string
+		providerMetadata   map[string]any
+		acquireAccessToken bool
+
+		groupEndpointHandler http.HandlerFunc
+
+		wantErr bool
+	}{
+		"Successfully_get_user_info": {},
+
+		"Error_when_id_token_claims_are_invalid": {invalidIDToken: true, wantErr: true},
+	}
+	for name, tc := range tests {
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			idToken := validIDToken
+			if tc.invalidIDToken {
+				idToken = invalidIDToken
+			}
+
+			p := msentraid.New()
+
+			got, err := p.GetUserInfo(idToken)
+			if tc.wantErr {
+				require.Error(t, err, "GetUserInfo should return an error")
+				return
+			}
+			require.NoError(t, err, "GetUserInfo should not return an error")
+
+			golden.CheckOrUpdateYAML(t, got)
+		})
+	}
+}
+
+func TestGetGroups(t *testing.T) {
+	t.Parallel()
+
+	accessToken := jwt.NewWithClaims(jwt.SigningMethodRS256, jwt.MapClaims{})
+	accessTokenStr, err := accessToken.SignedString(testutils.MockKey)
+	require.NoError(t, err, "Failed to sign access token")
+	token := &oauth2.Token{
+		AccessToken:  accessTokenStr,
+		RefreshToken: "refreshtoken",
+		Expiry:       time.Now().Add(1000 * time.Hour),
+	}
+
+	tests := map[string]struct {
+		tokenScopes        []string
+		providerMetadata   map[string]any
+		acquireAccessToken bool
+
+		groupEndpointHandler http.HandlerFunc
+
+		wantErr bool
+	}{
+		"Successfully_get_groups":                               {},
+		"Successfully_get_groups_with_local_groups":             {groupEndpointHandler: localGroupHandler},
+		"Successfully_get_groups_with_mixed_groups":             {groupEndpointHandler: mixedGroupHandler},
+		"Successfully_get_groups_filtering_non_security_groups": {groupEndpointHandler: nonSecurityGroupHandler},
+		"Successfully_get_groups_with_acquired_access_token":    {acquireAccessToken: true},
+
+		"Error_when_msgraph_host_is_invalid":             {providerMetadata: map[string]any{"msgraph_host": "invalid"}, wantErr: true},
+		"Error_when_token_does_not_have_required_scopes": {tokenScopes: []string{"not the required scopes"}, wantErr: true},
+		"Error_when_getting_user_groups_fails":           {groupEndpointHandler: errorGroupHandler, wantErr: true},
+		"Error_when_group_is_missing_id":                 {groupEndpointHandler: missingIDGroupHandler, wantErr: true},
+		"Error_when_group_is_missing_display_name":       {groupEndpointHandler: missingDisplayNameGroupHandler, wantErr: true},
+	}
+	for name, tc := range tests {
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			if tc.tokenScopes == nil {
+				tc.tokenScopes = strings.Split(msentraid.AllExpectedScopes(), " ")
+			}
+
+			if tc.providerMetadata == nil {
+				mockServer, cleanup := startMockMSServer(t, &mockMSServerConfig{
+					GroupEndpointHandler: tc.groupEndpointHandler,
+				})
+				t.Cleanup(cleanup)
+				tc.providerMetadata = map[string]any{"msgraph_host": mockServer.URL}
+			}
+
+			var deviceRegistrationData []byte
+			if tc.acquireAccessToken {
+				var cleanup func()
+				deviceRegistrationData, cleanup, err = maybeRegisterDevice(t, nil)
+				t.Cleanup(cleanup)
+				require.NoError(t, err, "maybeRegisterDevice should not return an error")
+			}
+
+			p := msentraid.New()
+			p.SetNeedsAccessTokenForGraphAPI(tc.acquireAccessToken)
+			p.SetTokenScopesForGraphAPI(tc.tokenScopes)
+
+			got, err := p.GetGroups(
+				context.Background(),
+				"",
+				"",
+				token,
+				tc.providerMetadata,
+				deviceRegistrationData,
+			)
+			if tc.wantErr {
+				require.Error(t, err, "GetUserInfo should return an error")
+				return
+			}
+			require.NoError(t, err, "GetUserInfo should not return an error")
+
+			golden.CheckOrUpdateYAML(t, got)
+		})
+	}
+}
+
+func TestIsTokenForDeviceRegistration(t *testing.T) {
+	t.Parallel()
+
+	tests := map[string]struct {
+		appID        string
+		invalidToken bool
+
+		want    bool
+		wantErr bool
+	}{
+		"Success_when_token_has_microsoft_broker_app_ID": {appID: consts.MicrosoftBrokerAppID, want: true},
+		"Success_when_token_has_other_app_ID":            {appID: "some-other-app-id", want: false},
+		"Success_when_token_has_empty_app_ID":            {appID: "", want: false},
+
+		"Error_when_token_has_no_app_ID": {appID: "-", wantErr: true},
+		"Error_when_token_is_invalid":    {invalidToken: true, wantErr: true},
+	}
+
+	for name, tc := range tests {
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			claims := jwt.MapClaims{"appid": tc.appID}
+			if tc.appID == "-" {
+				claims = jwt.MapClaims{}
+			}
+
+			accessToken := jwt.NewWithClaims(jwt.SigningMethodRS256, claims)
+			accessTokenString, err := accessToken.SignedString(testutils.MockKey)
+			require.NoError(t, err, "Failed to sign access token")
+
+			if tc.invalidToken {
+				accessTokenString = "invalid-token"
+			}
+
+			token := &oauth2.Token{AccessToken: accessTokenString}
+
+			p := msentraid.New()
+			got, err := p.IsTokenForDeviceRegistration(token)
+
+			if tc.wantErr {
+				require.Error(t, err, "IsTokenForDeviceRegistration should return an error")
+				return
+			}
+			require.NoError(t, err, "IsTokenForDeviceRegistration should not return an error")
+			require.Equal(t, tc.want, got, "IsTokenForDeviceRegistration should return the expected value")
+		})
+	}
+}
+
+func TestMaybeRegisterDevice(t *testing.T) {
+	t.Parallel()
+
+	registrationData, err := json.Marshal(&himmelblau.DeviceRegistrationData{
+		DeviceID:      "test-device-id",
+		CertKey:       []byte("test-cert-key"),
+		TransportKey:  []byte("test-transport-key"),
+		AuthValue:     "test-auth-value",
+		TPMMachineKey: []byte("test-tpm-machine-key"),
+	})
+	require.NoError(t, err, "Failed to marshal device registration data")
+
+	type args = maybeRegisterDeviceArgs
+
+	tests := map[string]struct {
+		args
+
+		wantErr bool
+	}{
+		"Successfully_registers_device":       {},
+		"Reuses_existing_device_registration": {args: args{oldData: registrationData}},
+
+		"Error_when_username_does_not_have_a_domain": {args: args{username: "userwithoutdomain"}, wantErr: true},
+		"Error_when_discover_url_is_invalid_format":  {args: args{discoveryURL: "invalid-url"}, wantErr: true},
+		"Error_when_discover_url_is_unreachable":     {args: args{discoveryURL: "http://invalid-url"}, wantErr: true},
+	}
+
+	for name, tc := range tests {
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			registrationData, cleanup, err := maybeRegisterDevice(t, &tc.args)
+			t.Cleanup(cleanup)
+			if tc.wantErr {
+				require.Error(t, err, "MaybeRegisterDevice should return an error")
+				return
+			}
+			require.NoError(t, err, "MaybeRegisterDevice should not return an error")
+
+			if tc.oldData != nil {
+				require.Equal(t, tc.oldData, registrationData, "MaybeRegisterDevice should return the existing registration data")
+			}
+
+			// We don't compare the registration data with a golden file, because it differs every time due to the
+			// generated keys. Instead, we just check that it's not empty.
+			require.NotEmpty(t, registrationData, "MaybeRegisterDevice should return non-empty registration data")
+		})
+	}
+}
+
+type maybeRegisterDeviceArgs struct {
+	username     string
+	oldData      []byte
+	discoveryURL string
+}
+
+func maybeRegisterDevice(
+	t *testing.T,
+	args *maybeRegisterDeviceArgs,
+) ([]byte, func(), error) {
+	// Start the mock MS server (or reuse the existing one)
+	ensureMockMSServerForDeviceRegistration(t)
+	mockServer := mockMSServerForDeviceRegistration
+
+	if args == nil {
+		args = &maybeRegisterDeviceArgs{}
+	}
+
+	if args.discoveryURL == "" {
+		args.discoveryURL = mockServer.URL
+	}
+
+	if args.username == "" {
+		args.username = "user@example.com"
+	}
+
+	// Make libhimmelblau use the mock MS server. These settings are global,
+	// so test case which need different settings must not run in parallel.
+	if args.discoveryURL == "" {
+		// We don't need to set the environment variable, just ensure no other test is modifying it while we run.
+		discoveryURLMu.RLock()
+		defer discoveryURLMu.RUnlock()
+	} else {
+		// Set the environment variable for the duration of the test.
+		discoveryURLMu.Lock()
+		oldValue := os.Getenv("HIMMELBLAU_DISCOVERY_URL")
+		err := os.Setenv("HIMMELBLAU_DISCOVERY_URL", args.discoveryURL)
+		require.NoError(t, err, "Failed to set HIMMELBLAU_DISCOVERY_URL environment variable")
+		defer func() {
+			err := os.Setenv("HIMMELBLAU_DISCOVERY_URL", oldValue)
+			discoveryURLMu.Unlock()
+			require.NoError(t, err, "Failed to unset HIMMELBLAU_DISCOVERY_URL environment variable")
+		}()
+	}
+
+	accessToken := jwt.NewWithClaims(jwt.SigningMethodRS256, jwt.MapClaims{})
+	accessTokenStr, err := accessToken.SignedString(testutils.MockKey)
+	require.NoError(t, err, "Failed to sign access token")
+	token := &oauth2.Token{
+		AccessToken:  accessTokenStr,
+		RefreshToken: "refreshtoken",
+		Expiry:       time.Now().Add(1000 * time.Hour),
+	}
+
+	tenantID := "8de88d99-6d0f-44d7-a8a5-925b012e5940"
+	issuerURL := fmt.Sprintf("https://login.microsoftonline.com/%s/v2.0", tenantID)
+
+	p := msentraid.New()
+
+	return p.MaybeRegisterDevice(
+		context.Background(),
+		token,
+		args.username,
+		issuerURL,
+		args.oldData,
+	)
+}
+
+func TestMain(m *testing.M) {
+	log.SetLevel(log.DebugLevel)
+
+	m.Run()
+}
diff --git a/authd-oidc-brokers/internal/providers/msentraid/msmock_test.go b/authd-oidc-brokers/internal/providers/msentraid/msmock_test.go
new file mode 100644
index 0000000000..c597db3589
--- /dev/null
+++ b/authd-oidc-brokers/internal/providers/msentraid/msmock_test.go
@@ -0,0 +1,519 @@
+//go:build withmsentraid
+
+package msentraid_test
+
+import (
+	"crypto/rand"
+	"crypto/rsa"
+	"crypto/sha256"
+	"crypto/x509"
+	"encoding/base64"
+	"encoding/binary"
+	"encoding/hex"
+	"encoding/json"
+	"fmt"
+	"html"
+	"io"
+	"math/big"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"os"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/canonical/authd/authd-oidc-brokers/internal/providers/msentraid/himmelblau"
+	"github.com/go-jose/go-jose/v4"
+	"github.com/golang-jwt/jwt/v5"
+	"github.com/stretchr/testify/require"
+)
+
+var mockMSServerForDeviceRegistration *mockMSServer
+var mockMSServerForDeviceRegistrationOnce sync.Once
+
+func ensureMockMSServerForDeviceRegistration(t *testing.T) {
+	mockMSServerForDeviceRegistrationOnce.Do(func() {
+		mockMSServerForDeviceRegistration, _ = startMockMSServer(t, &mockMSServerConfig{
+			GroupEndpointHandler: simpleGroupHandler,
+		})
+
+		himmelblau.SetAuthorityBaseURL(t, mockMSServerForDeviceRegistration.URL)
+		err := os.Setenv("HIMMELBLAU_DISCOVERY_URL", mockMSServerForDeviceRegistration.URL)
+		require.NoError(t, err, "failed to set HIMMELBLAU_DISCOVERY_URL")
+	})
+}
+
+type mockMSServer struct {
+	*httptest.Server
+
+	rsaPrivateKey      *rsa.PrivateKey
+	transportKeyBySPKI map[string]*rsa.PublicKey
+	transportKeyMu     sync.RWMutex
+}
+
+type mockMSServerConfig struct {
+	// TenantID is the tenant ID to use in the token endpoint URL.
+	// If empty, requests to the token endpoint will be accepted for any tenant.
+	TenantID             string
+	GroupEndpointHandler http.HandlerFunc
+}
+
+func startMockMSServer(t *testing.T, config *mockMSServerConfig) (mockServer *mockMSServer, cleanup func()) {
+	if config == nil {
+		config = &mockMSServerConfig{}
+	}
+
+	if config.GroupEndpointHandler == nil {
+		config.GroupEndpointHandler = simpleGroupHandler
+	}
+
+	rsaPrivateKey, err := rsa.GenerateKey(rand.Reader, 2048)
+	require.NoError(t, err, "failed to generate RSA private key")
+
+	m := &mockMSServer{
+		rsaPrivateKey:      rsaPrivateKey,
+		transportKeyBySPKI: make(map[string]*rsa.PublicKey),
+	}
+
+	m.Server = httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		fmt.Fprintf(os.Stderr, "Mock MS server received request: %s %s\n", r.Method, r.URL.Path)
+
+		switch {
+		// ===== login.microsoftonline.com =====
+		case r.Method == http.MethodPost && isTokenEndpoint(r.URL.Path, config.TenantID):
+			m.handleTokenRequest(t, w, r)
+
+		case r.Method == http.MethodGet && isAuthorizeEndpoint(r.URL.Path, config.TenantID):
+			m.handleAuthorizeRequest(t, w, r)
+
+		// ===== enterpriseregistration.windows.net =====
+		case r.Method == http.MethodGet && strings.HasSuffix(r.URL.Path, "/Discover"):
+			m.handleDiscoverRequest(t, w, r)
+
+		case r.Method == http.MethodPost && strings.Contains(r.URL.Path, "/EnrollmentServer/device/"):
+			m.handleDeviceEnrollmentRequest(t, w, r)
+
+		// ===== graph.microsoft.com =====
+		case r.Method == http.MethodGet && strings.HasSuffix(r.URL.Path, "/me/transitiveMemberOf/graph.group"):
+			config.GroupEndpointHandler(w, r)
+
+		default:
+			require.Fail(t, "unexpected request", "path=%s, method=%s", r.URL.Path, r.Method)
+		}
+	}))
+
+	cleanup = func() { m.Close() }
+
+	return m, cleanup
+}
+
+func (m *mockMSServer) Close() {
+	m.Server.Close()
+}
+
+// isTokenEndpoint returns true if the given path is the token endpoint for the given tenant.
+// Both the v2.0 and v1.0 endpoints are supported.
+// If tenantID is empty, requests for any tenant will be accepted.
+func isTokenEndpoint(path, tenantID string) bool {
+	path = strings.ToLower(path)
+
+	if tenantID != "" {
+		return path == "/"+tenantID+"/oauth2/v2.0/token" || path == "/"+tenantID+"/oauth2/token"
+	}
+	return strings.HasSuffix(path, "/oauth2/v2.0/token") || strings.HasSuffix(path, "/oauth2/token")
+}
+
+func isAuthorizeEndpoint(path, tenantID string) bool {
+	path = strings.ToLower(path)
+
+	if tenantID != "" {
+		return path == "/"+tenantID+"/oauth2/v2.0/authorize"
+	}
+	return strings.HasSuffix(path, "/oauth2/v2.0/authorize")
+}
+
+// ----- handlers -----
+
+func (m *mockMSServer) handleTokenRequest(t *testing.T, w http.ResponseWriter, r *http.Request) {
+	//nolint:gosec // G120 - test mock server, no untrusted input.
+	err := r.ParseForm()
+	require.NoError(t, err, "failed to parse form")
+
+	body, err := io.ReadAll(r.Body)
+	require.NoError(t, err, "failed to read request body")
+	fmt.Fprintf(os.Stderr, "Mock MS server received token request - form: %s, body: %s\n", r.Form, string(body))
+
+	// The grant_type can be passed as form data or as the body
+	grantType := r.Form.Get("grant_type")
+	if grantType == "" && strings.HasPrefix(string(body), "grant_type=") {
+		grantType = strings.TrimPrefix(string(body), "grant_type=")
+	}
+
+	switch grantType {
+	case "refresh_token":
+		m.handleRefreshTokenRequest(t, w, r)
+
+	case "srv_challenge":
+		m.handleNonceRequest(t, w, r)
+
+	case "urn:ietf:params:oauth:grant-type:jwt-bearer":
+		m.handlePRTRequest(t, w, r)
+
+	case "authorization_code":
+		m.handleAuthorizationCodeRequest(t, w, r)
+
+	default:
+		t.Fatalf("unexpected grant_type in token request: %s", grantType)
+	}
+}
+
+func (m *mockMSServer) handleAuthorizeRequest(t *testing.T, w http.ResponseWriter, r *http.Request) {
+	// Example path: /<tenant>/oAuth2/v2.0/authorize
+	// Example query: client_id=...&response_type=code&redirect_uri=...&client-request-id=...&scope=...
+
+	q := r.URL.Query()
+	clientID := q.Get("client_id")
+	redirectURI := q.Get("redirect_uri")
+	respType := q.Get("response_type")
+	scope := q.Get("scope")
+	reqID := q.Get("client-request-id")
+
+	fmt.Fprintf(os.Stderr, "Mock MS server authorize request: client_id=%s, response_type=%s, redirect_uri=%s, scope=%s, client-request-id=%s\n",
+		clientID, respType, redirectURI, scope, reqID)
+
+	require.Equal(t, "code", respType, "unexpected response_type")
+	require.NotEmpty(t, redirectURI, "missing redirect_uri")
+
+	// Construct the final redirect URL: {redirect_uri}?code=...
+	redir, err := url.Parse(redirectURI)
+	require.NoError(t, err, "failed to parse redirect_uri")
+	params := redir.Query()
+	params.Set("code", "mock-code")
+	redir.RawQuery = params.Encode()
+	redirectStr := redir.String()
+
+	jsURL, err := json.Marshal(redirectStr)
+	require.NoError(t, err, "failed to encode redirect URI for javascript")
+
+	htmlBody := fmt.Sprintf(`<!doctype html>
+<html>
+  <head><meta charset="utf-8"><title>Working…</title></head>
+  <body>
+    <script>document.location.replace(%s)</script>
+    <noscript><a href="%s">Continue</a></noscript>
+  </body>
+</html>`, jsURL, html.EscapeString(redirectStr))
+
+	w.Header().Set("Content-Type", "text/html; charset=utf-8")
+	w.WriteHeader(http.StatusOK)
+	_, _ = w.Write([]byte(htmlBody))
+}
+
+func (m *mockMSServer) handlePRTRequest(t *testing.T, w http.ResponseWriter, r *http.Request) {
+	fmt.Fprint(os.Stderr, "Mock MS server responding with PRT\n")
+
+	reqJWT := r.Form.Get("request")
+	spki := spkiFromJWTx5c(t, reqJWT)
+	m.transportKeyMu.Lock()
+	transportKey, ok := m.transportKeyBySPKI[spki]
+	m.transportKeyMu.Unlock()
+	require.True(t, ok, "no transport key for SPKI %s, transport key map: %v", spki, m.transportKeyBySPKI)
+
+	resp := map[string]any{
+		"token_type":               "Bearer",
+		"expires_in":               "3600",
+		"ext_expires_in":           "3600",
+		"expires_on":               "9999999999",
+		"refresh_token":            "mock-refresh-token",
+		"refresh_token_expires_in": 7200,
+		"session_key_jwe":          m.generateMockJWE(t, transportKey),
+		"id_token": map[string]string{
+			"name": "Mock User",
+			"oid":  "00000000-0000-0000-0000-000000000000",
+			"tid":  "11111111-1111-1111-1111-111111111111",
+		},
+		"client_info": map[string]string{
+			"uid":  "11111111-1111-1111-1111-111111111111",
+			"utid": "22222222-2222-2222-2222-222222222222",
+		},
+	}
+	fmt.Fprintf(os.Stderr, "Mock MS server responding with PRT: %+v\n", resp)
+
+	w.Header().Set("Content-Type", "application/json")
+	err := json.NewEncoder(w).Encode(resp)
+	require.NoError(t, err, "failed to encode response")
+}
+
+func (m *mockMSServer) handleAuthorizationCodeRequest(t *testing.T, w http.ResponseWriter, _ *http.Request) {
+	fmt.Fprint(os.Stderr, "Mock MS server handling authorization code request\n")
+
+	accessToken := jwt.NewWithClaims(jwt.SigningMethodRS256, jwt.MapClaims{})
+	accessTokenStr, err := accessToken.SignedString(m.rsaPrivateKey)
+	require.NoError(t, err, "failed to sign access token")
+
+	resp := map[string]interface{}{
+		"token_type":     "Bearer",
+		"expires_in":     3600,
+		"ext_expires_in": 3600,
+		"access_token":   accessTokenStr,
+		"refresh_token":  "mock-refresh-token",
+	}
+
+	w.Header().Set("Content-Type", "application/json")
+	w.WriteHeader(http.StatusOK)
+	err = json.NewEncoder(w).Encode(resp)
+	require.NoError(t, err, "failed to encode response")
+}
+
+func (m *mockMSServer) handleNonceRequest(t *testing.T, w http.ResponseWriter, _ *http.Request) {
+	fmt.Fprint(os.Stderr, "Mock MS server responding with nonce\n")
+	resp := map[string]string{
+		"Nonce": "mock-nonce-1234",
+	}
+	w.Header().Set("Content-Type", "application/json")
+	err := json.NewEncoder(w).Encode(resp)
+	require.NoError(t, err, "failed to encode response")
+}
+
+func (m *mockMSServer) handleRefreshTokenRequest(t *testing.T, w http.ResponseWriter, _ *http.Request) {
+	fmt.Fprint(os.Stderr, "Mock MS server responding with access token from refresh\n")
+	resp := map[string]any{
+		"token_type":     "Bearer",
+		"expires_in":     3600,
+		"ext_expires_in": 3600,
+		"access_token":   "mock_access_token",
+		"refresh_token":  "mock_refresh_token",
+		"id_token": map[string]string{
+			"name": "Mock User",
+			"oid":  "00000000-0000-0000-0000-000000000000",
+			"tid":  "11111111-1111-1111-1111-111111111111",
+		},
+		"client_info": map[string]string{
+			"uid":  "11111111-1111-1111-1111-111111111111",
+			"utid": "22222222-2222-2222-2222-222222222222",
+		},
+	}
+	w.Header().Set("Content-Type", "application/json")
+	err := json.NewEncoder(w).Encode(resp)
+	require.NoError(t, err, "failed to encode response")
+}
+
+func (m *mockMSServer) handleDiscoverRequest(t *testing.T, w http.ResponseWriter, _ *http.Request) {
+	fmt.Fprint(os.Stderr, "Mock MS server responding with enrollment discovery\n")
+	resp := map[string]any{
+		"DeviceJoinService": map[string]string{
+			"JoinEndpoint": m.URL + "/EnrollmentServer/device/",
+		},
+	}
+	w.Header().Set("Content-Type", "application/json")
+	err := json.NewEncoder(w).Encode(resp)
+	require.NoError(t, err, "failed to encode response")
+}
+
+func (m *mockMSServer) handleDeviceEnrollmentRequest(t *testing.T, w http.ResponseWriter, r *http.Request) {
+	fmt.Fprint(os.Stderr, "Mock MS server responding with device enrollment\n")
+
+	var req struct {
+		CertificateRequest struct {
+			Data string `json:"Data"`
+			Type string `json:"Type"`
+		} `json:"CertificateRequest"`
+		TransportKey string `json:"TransportKey"`
+	}
+	err := json.NewDecoder(r.Body).Decode(&req)
+	require.NoError(t, err, "failed to parse request")
+
+	csrDER, err := base64.StdEncoding.DecodeString(req.CertificateRequest.Data)
+	require.NoError(t, err, "failed to decode CSR data")
+
+	csr, err := x509.ParseCertificateRequest(csrDER)
+	require.NoError(t, err, "failed to parse CSR")
+
+	m.transportKeyMu.RLock()
+	m.transportKeyBySPKI[spkiFingerprint(csr.RawSubjectPublicKeyInfo)] = parseBcryptRSAPublicBlob(t, req.TransportKey)
+	m.transportKeyMu.RUnlock()
+
+	// Create a self-signed cert using the CSR's public key
+	template := &x509.Certificate{
+		SerialNumber:          big.NewInt(1),
+		Subject:               csr.Subject,
+		NotBefore:             time.Now(),
+		NotAfter:              time.Now().Add(365 * 24 * time.Hour),
+		KeyUsage:              x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature,
+		ExtKeyUsage:           []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth},
+		BasicConstraintsValid: true,
+	}
+
+	certDER, err := x509.CreateCertificate(rand.Reader, template, template, csr.PublicKey, m.rsaPrivateKey)
+	require.NoError(t, err, "failed to create certificate")
+
+	resp := map[string]any{
+		"Certificate": map[string]string{
+			"RawBody": base64.StdEncoding.EncodeToString(certDER),
+		},
+	}
+	w.Header().Set("Content-Type", "application/json")
+	err = json.NewEncoder(w).Encode(resp)
+	require.NoError(t, err, "failed to encode response")
+}
+
+// ----- group endpoint handlers -----
+
+// simpleGroupHandler simulates a successful response with a list of groups.
+func simpleGroupHandler(w http.ResponseWriter, r *http.Request) {
+	response := map[string]any{
+		"value": []map[string]any{
+			{"id": "id1", "displayName": "Group1", "securityEnabled": true},
+			{"id": "id2", "displayName": "Group2", "securityEnabled": true},
+		},
+	}
+	w.Header().Set("Content-Type", "application/json")
+	_ = json.NewEncoder(w).Encode(response)
+}
+
+// localGroupHandler simulates a successful response with a list of local groups.
+func localGroupHandler(w http.ResponseWriter, r *http.Request) {
+	response := map[string]any{
+		"value": []map[string]any{
+			{"id": "local-id1", "displayName": "linux-local1", "securityEnabled": true},
+			{"id": "local-id2", "displayName": "linux-local2", "securityEnabled": true},
+		},
+	}
+	w.Header().Set("Content-Type", "application/json")
+	_ = json.NewEncoder(w).Encode(response)
+}
+
+// mixedGroupHandler simulates a successful response with a list of mixed remote and local groups.
+func mixedGroupHandler(w http.ResponseWriter, r *http.Request) {
+	response := map[string]any{
+		"value": []map[string]any{
+			{"id": "id1", "displayName": "Group1", "securityEnabled": true},
+			{"id": "local-id1", "displayName": "linux-local1", "securityEnabled": true},
+		},
+	}
+	w.Header().Set("Content-Type", "application/json")
+	_ = json.NewEncoder(w).Encode(response)
+}
+
+// nonSecurityGroupHandler simulates a successful response with a list of groups including non-security groups.
+func nonSecurityGroupHandler(w http.ResponseWriter, r *http.Request) {
+	response := map[string]any{
+		"value": []map[string]any{
+			{"id": "id1", "displayName": "Group1", "securityEnabled": true},
+			{"id": "non-security-id", "displayName": "non-security"},
+		},
+	}
+	w.Header().Set("Content-Type", "application/json")
+	_ = json.NewEncoder(w).Encode(response)
+}
+
+// missingIDGroupHandler simulates a successful response with a list of groups missing the ID field.
+func missingIDGroupHandler(w http.ResponseWriter, r *http.Request) {
+	response := map[string]any{
+		"value": []map[string]any{
+			{"displayName": "Group1", "securityEnabled": true},
+			{"id": "id2", "displayName": "Group2", "securityEnabled": true},
+		},
+	}
+	w.Header().Set("Content-Type", "application/json")
+	_ = json.NewEncoder(w).Encode(response)
+}
+
+// missingDisplayNameGroupHandler simulates a successful response with a list of groups missing the displayName field.
+func missingDisplayNameGroupHandler(w http.ResponseWriter, r *http.Request) {
+	response := map[string]any{
+		"value": []map[string]any{
+			{"id": "id1", "securityEnabled": true},
+			{"id": "id2", "displayName": "Group2", "securityEnabled": true},
+		},
+	}
+	w.Header().Set("Content-Type", "application/json")
+	_ = json.NewEncoder(w).Encode(response)
+}
+
+// errorGroupHandler simulates an error response from the server.
+func errorGroupHandler(w http.ResponseWriter, r *http.Request) {
+	w.WriteHeader(http.StatusInternalServerError)
+}
+
+// ----- helpers -----
+
+// parseBcryptRSAPublicBlob decodes a BCRYPT_RSAPUBLIC_BLOB ("RSA1" magic, little-endian header) as used by the Windows CryptoAPI.
+// This format is not supported by the Go standard library.
+func parseBcryptRSAPublicBlob(t *testing.T, b64 string) *rsa.PublicKey {
+	raw, err := base64.StdEncoding.DecodeString(b64)
+	require.NoError(t, err, "failed to base64-decode transport key")
+
+	require.Equal(t, "RSA1", string(raw[:4]), "invalid RSA1 blob")
+
+	cbExp := binary.LittleEndian.Uint32(raw[8:12])
+	cbMod := binary.LittleEndian.Uint32(raw[12:16])
+
+	offset := 24
+	eBytes := raw[offset : offset+int(cbExp)]
+	offset += int(cbExp)
+	mBytes := raw[offset : offset+int(cbMod)]
+
+	// Convert exponent bytes (big-endian) to int
+	e := 0
+	for _, b := range eBytes {
+		e = (e << 8) | int(b)
+	}
+
+	n := new(big.Int).SetBytes(mBytes) // modulus is big-endian in this blob
+
+	return &rsa.PublicKey{N: n, E: e}
+}
+
+func (m *mockMSServer) generateMockJWE(t *testing.T, transportKey *rsa.PublicKey) string {
+	opts := &jose.EncrypterOptions{}
+
+	encrypter, err := jose.NewEncrypter(
+		jose.A256GCM,
+		jose.Recipient{Algorithm: jose.RSA_OAEP, Key: transportKey},
+		opts,
+	)
+	require.NoError(t, err, "failed to create encrypter")
+
+	// Payload is ignored by the client, keep it simple
+	payload := []byte(`{}`)
+
+	obj, err := encrypter.Encrypt(payload)
+	require.NoError(t, err, "failed to encrypt payload")
+
+	jwe, err := obj.CompactSerialize()
+	require.NoError(t, err, "failed to serialize JWE")
+
+	return jwe
+}
+
+// Extract SPKI fingerprint from the request JWT's header x5c.
+func spkiFromJWTx5c(t *testing.T, reqJWT string) string {
+	parts := strings.Split(reqJWT, ".")
+	require.GreaterOrEqual(t, len(parts), 2, "invalid JWT")
+
+	hdrJSON, err := base64.RawURLEncoding.DecodeString(parts[0])
+	require.NoError(t, err, "decode header")
+
+	var hdr struct {
+		X5c []string `json:"x5c"`
+	}
+	err = json.Unmarshal(hdrJSON, &hdr)
+	require.NoError(t, err, "unmarshal header")
+	require.NotEmpty(t, hdr.X5c, "x5c missing")
+
+	der, err := base64.StdEncoding.DecodeString(hdr.X5c[0])
+	require.NoError(t, err, "x5c b64")
+
+	cert, err := x509.ParseCertificate(der)
+	require.NoError(t, err, "x5c parse cert")
+
+	return spkiFingerprint(cert.RawSubjectPublicKeyInfo)
+}
+
+func spkiFingerprint(spkiDER []byte) string {
+	sum := sha256.Sum256(spkiDER)
+	return hex.EncodeToString(sum[:])
+}
diff --git a/authd-oidc-brokers/internal/providers/msentraid/testdata/golden/TestGetGroups/Successfully_get_groups b/authd-oidc-brokers/internal/providers/msentraid/testdata/golden/TestGetGroups/Successfully_get_groups
new file mode 100644
index 0000000000..781c44561e
--- /dev/null
+++ b/authd-oidc-brokers/internal/providers/msentraid/testdata/golden/TestGetGroups/Successfully_get_groups
@@ -0,0 +1,4 @@
+- name: group1
+  ugid: id1
+- name: group2
+  ugid: id2
diff --git a/authd-oidc-brokers/internal/providers/msentraid/testdata/golden/TestGetGroups/Successfully_get_groups_filtering_non_security_groups b/authd-oidc-brokers/internal/providers/msentraid/testdata/golden/TestGetGroups/Successfully_get_groups_filtering_non_security_groups
new file mode 100644
index 0000000000..368fbd4757
--- /dev/null
+++ b/authd-oidc-brokers/internal/providers/msentraid/testdata/golden/TestGetGroups/Successfully_get_groups_filtering_non_security_groups
@@ -0,0 +1,2 @@
+- name: group1
+  ugid: id1
diff --git a/authd-oidc-brokers/internal/providers/msentraid/testdata/golden/TestGetGroups/Successfully_get_groups_with_acquired_access_token b/authd-oidc-brokers/internal/providers/msentraid/testdata/golden/TestGetGroups/Successfully_get_groups_with_acquired_access_token
new file mode 100644
index 0000000000..781c44561e
--- /dev/null
+++ b/authd-oidc-brokers/internal/providers/msentraid/testdata/golden/TestGetGroups/Successfully_get_groups_with_acquired_access_token
@@ -0,0 +1,4 @@
+- name: group1
+  ugid: id1
+- name: group2
+  ugid: id2
diff --git a/authd-oidc-brokers/internal/providers/msentraid/testdata/golden/TestGetGroups/Successfully_get_groups_with_local_groups b/authd-oidc-brokers/internal/providers/msentraid/testdata/golden/TestGetGroups/Successfully_get_groups_with_local_groups
new file mode 100644
index 0000000000..20d38a219a
--- /dev/null
+++ b/authd-oidc-brokers/internal/providers/msentraid/testdata/golden/TestGetGroups/Successfully_get_groups_with_local_groups
@@ -0,0 +1,4 @@
+- name: local1
+  ugid: ""
+- name: local2
+  ugid: ""
diff --git a/authd-oidc-brokers/internal/providers/msentraid/testdata/golden/TestGetGroups/Successfully_get_groups_with_mixed_groups b/authd-oidc-brokers/internal/providers/msentraid/testdata/golden/TestGetGroups/Successfully_get_groups_with_mixed_groups
new file mode 100644
index 0000000000..a6c80f7619
--- /dev/null
+++ b/authd-oidc-brokers/internal/providers/msentraid/testdata/golden/TestGetGroups/Successfully_get_groups_with_mixed_groups
@@ -0,0 +1,4 @@
+- name: group1
+  ugid: id1
+- name: local1
+  ugid: ""
diff --git a/authd-oidc-brokers/internal/providers/msentraid/testdata/golden/TestGetUserInfo/Successfully_get_user_info b/authd-oidc-brokers/internal/providers/msentraid/testdata/golden/TestGetUserInfo/Successfully_get_user_info
new file mode 100644
index 0000000000..b8c7d0c961
--- /dev/null
+++ b/authd-oidc-brokers/internal/providers/msentraid/testdata/golden/TestGetUserInfo/Successfully_get_user_info
@@ -0,0 +1,6 @@
+name: valid-user
+uuid: valid-sub
+home: /home/valid-user
+shell: /bin/bash
+gecos: Valid User
+groups: []
diff --git a/authd-oidc-brokers/internal/providers/providers.go b/authd-oidc-brokers/internal/providers/providers.go
new file mode 100644
index 0000000000..8831acf7c6
--- /dev/null
+++ b/authd-oidc-brokers/internal/providers/providers.go
@@ -0,0 +1,46 @@
+// Package providers define provider-specific configurations and functions to be used by the OIDC broker.
+package providers
+
+import (
+	"context"
+
+	"github.com/canonical/authd/authd-oidc-brokers/internal/providers/info"
+	"github.com/coreos/go-oidc/v3/oidc"
+	"golang.org/x/oauth2"
+)
+
+// Provider defines provider-specific methods to be used by the broker.
+type Provider interface {
+	AdditionalScopes() []string
+	AuthOptions() []oauth2.AuthCodeOption
+	GetExtraFields(token *oauth2.Token) map[string]interface{}
+	GetMetadata(provider *oidc.Provider) (map[string]interface{}, error)
+
+	GetUserInfo(idToken info.Claimer) (info.User, error)
+
+	GetGroups(
+		ctx context.Context,
+		clientID string,
+		issuerURL string,
+		token *oauth2.Token,
+		providerMetadata map[string]interface{},
+		deviceRegistrationData []byte,
+	) ([]info.Group, error)
+
+	IsTokenExpiredError(err *oauth2.RetrieveError) bool
+	IsUserDisabledError(err *oauth2.RetrieveError) bool
+	IsTokenForDeviceRegistration(token *oauth2.Token) (bool, error)
+
+	MaybeRegisterDevice(
+		ctx context.Context,
+		token *oauth2.Token,
+		username string,
+		issuerURL string,
+		deviceRegistrationData []byte,
+	) ([]byte, func(), error)
+
+	NormalizeUsername(username string) string
+	SupportedOIDCAuthModes() []string
+	VerifyUsername(requestedUsername, authenticatedUsername string) error
+	SupportsDeviceRegistration() bool
+}
diff --git a/authd-oidc-brokers/internal/providers/withgoogle.go b/authd-oidc-brokers/internal/providers/withgoogle.go
new file mode 100644
index 0000000000..912decfe6e
--- /dev/null
+++ b/authd-oidc-brokers/internal/providers/withgoogle.go
@@ -0,0 +1,10 @@
+//go:build withgoogle
+
+package providers
+
+import "github.com/canonical/authd/authd-oidc-brokers/internal/providers/google"
+
+// CurrentProvider returns a Google provider implementation.
+func CurrentProvider() Provider {
+	return google.New()
+}
diff --git a/authd-oidc-brokers/internal/providers/withmsentraid.go b/authd-oidc-brokers/internal/providers/withmsentraid.go
new file mode 100644
index 0000000000..b246f00c43
--- /dev/null
+++ b/authd-oidc-brokers/internal/providers/withmsentraid.go
@@ -0,0 +1,12 @@
+//go:build withmsentraid
+
+package providers
+
+import (
+	"github.com/canonical/authd/authd-oidc-brokers/internal/providers/msentraid"
+)
+
+// CurrentProvider returns a Microsoft Entra ID provider implementation.
+func CurrentProvider() Provider {
+	return msentraid.New()
+}
diff --git a/authd-oidc-brokers/internal/testutils/dbus.go b/authd-oidc-brokers/internal/testutils/dbus.go
new file mode 100644
index 0000000000..1537ad0b7a
--- /dev/null
+++ b/authd-oidc-brokers/internal/testutils/dbus.go
@@ -0,0 +1,102 @@
+// Package testutils provides utility functions and behaviors for testing.
+package testutils
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"testing"
+	"time"
+
+	"github.com/godbus/dbus/v5"
+)
+
+const defaultSystemBusAddress = "unix:path=/var/run/dbus/system_bus_socket"
+
+var systemBusMockCfg = `<!DOCTYPE busconfig PUBLIC "-//freedesktop//DTD D-Bus Bus Configuration 1.0//EN"
+ "http://www.freedesktop.org/standards/dbus/1.0/busconfig.dtd">
+<busconfig>
+  <type>system</type>
+  <keep_umask/>
+  <listen>unix:path=%s</listen>
+  <policy context="default">
+    <allow user="*"/>
+    <allow send_destination="*" eavesdrop="true"/>
+    <allow eavesdrop="true"/>
+    <allow own="*"/>
+  </policy>
+</busconfig>
+`
+
+// StartSystemBusMock starts a mock dbus daemon and returns a cancel function to stop it.
+//
+// This function uses os.Setenv to set the DBUS_SYSTEM_BUS_ADDRESS environment, so it shouldn't be used in parallel tests
+// that rely on the mentioned variable.
+func StartSystemBusMock() (func(), error) {
+	if isRunning() {
+		return nil, errors.New("system bus mock is already running")
+	}
+
+	tmp, err := os.MkdirTemp(os.TempDir(), "authd-system-bus-mock")
+	if err != nil {
+		return nil, err
+	}
+
+	cfgPath := filepath.Join(tmp, "bus.conf")
+	listenPath := filepath.Join(tmp, "bus.sock")
+
+	err = os.WriteFile(cfgPath, []byte(fmt.Sprintf(systemBusMockCfg, listenPath)), 0600)
+	if err != nil {
+		err = errors.Join(err, os.RemoveAll(tmp))
+		return nil, err
+	}
+
+	busCtx, busCancel := context.WithCancel(context.Background())
+	//#nosec:G204 // This is a test helper and we are in control of the arguments.
+	cmd := exec.CommandContext(busCtx, "dbus-daemon", "--config-file="+cfgPath)
+	if err := cmd.Start(); err != nil {
+		busCancel()
+		err = errors.Join(err, os.RemoveAll(tmp))
+		return nil, err
+	}
+	// Give some time for the daemon to start.
+	time.Sleep(500 * time.Millisecond)
+
+	prev, set := os.LookupEnv("DBUS_SYSTEM_BUS_ADDRESS")
+	os.Setenv("DBUS_SYSTEM_BUS_ADDRESS", "unix:path="+listenPath)
+
+	return func() {
+		busCancel()
+		_ = cmd.Wait()
+		_ = os.RemoveAll(tmp)
+
+		if !set {
+			_ = os.Unsetenv("DBUS_SYSTEM_BUS_ADDRESS")
+		} else {
+			_ = os.Setenv("DBUS_SYSTEM_BUS_ADDRESS", prev)
+		}
+	}, nil
+}
+
+// GetSystemBusConnection returns a connection to the system bus with a safety check to avoid mistakenly connecting to the
+// actual system bus.
+func GetSystemBusConnection(t *testing.T) (*dbus.Conn, error) {
+	t.Helper()
+	if !isRunning() {
+		return nil, errors.New("system bus mock is not running. If that's intended, manually connect to the system bus instead of using this function")
+	}
+	conn, err := dbus.ConnectSystemBus()
+	if err != nil {
+		return nil, err
+	}
+	return conn, nil
+}
+
+// isRunning checks if the system bus mock is running.
+func isRunning() bool {
+	busAddr := os.Getenv("DBUS_SYSTEM_BUS_ADDRESS")
+	return busAddr != "" && busAddr != defaultSystemBusAddress
+}
diff --git a/authd-oidc-brokers/internal/testutils/golden/golden.go b/authd-oidc-brokers/internal/testutils/golden/golden.go
new file mode 100644
index 0000000000..a9b1706d11
--- /dev/null
+++ b/authd-oidc-brokers/internal/testutils/golden/golden.go
@@ -0,0 +1,381 @@
+// Package golden provides utilities to compare and update golden files in tests.
+package golden
+
+import (
+	"bytes"
+	"errors"
+	"fmt"
+	"io/fs"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strconv"
+	"strings"
+	"testing"
+
+	"github.com/otiai10/copy"
+	"github.com/pmezard/go-difflib/difflib"
+	"github.com/stretchr/testify/require"
+	"gopkg.in/yaml.v3"
+)
+
+var update bool
+
+const (
+	// UpdateGoldenFilesEnv is the environment variable used to indicate go test that
+	// the golden files should be overwritten with the current test results.
+	UpdateGoldenFilesEnv = `TESTS_UPDATE_GOLDEN`
+)
+
+func init() {
+	if os.Getenv(UpdateGoldenFilesEnv) != "" {
+		update = true
+	}
+}
+
+type config struct {
+	path string
+}
+
+// Option is a supported option reference to change the golden files comparison.
+type Option func(*config)
+
+// WithPath overrides the default path for golden files used.
+func WithPath(path string) Option {
+	return func(cfg *config) {
+		if path != "" {
+			cfg.path = path
+		}
+	}
+}
+
+func updateGoldenFile(t *testing.T, path string, data []byte) {
+	t.Helper()
+
+	t.Logf("updating golden file %s", path)
+	err := os.MkdirAll(filepath.Dir(path), 0750)
+	require.NoError(t, err, "Cannot create directory for updating golden files")
+	err = os.WriteFile(path, data, 0600)
+	require.NoError(t, err, "Cannot write golden file")
+}
+
+// CheckOrUpdate compares the provided string with the content of the golden file. If the update environment
+// variable is set, the golden file is updated with the provided string.
+func CheckOrUpdate(t *testing.T, got string, options ...Option) {
+	t.Helper()
+
+	cfg := config{}
+	for _, f := range options {
+		f(&cfg)
+	}
+	if !filepath.IsAbs(cfg.path) {
+		cfg.path = filepath.Join(Path(t), cfg.path)
+	}
+
+	if update {
+		updateGoldenFile(t, cfg.path, []byte(got))
+	}
+
+	checkGoldenFileEqualsString(t, got, cfg.path)
+}
+
+// CheckOrUpdateYAML compares the provided object with the content of the golden file. If the update environment
+// variable is set, the golden file is updated with the provided object serialized as YAML.
+func CheckOrUpdateYAML[E any](t *testing.T, got E, options ...Option) {
+	t.Helper()
+
+	data, err := yaml.Marshal(got)
+	require.NoError(t, err, "Cannot serialize provided object")
+
+	CheckOrUpdate(t, string(data), options...)
+}
+
+// LoadWithUpdate loads the element from a plaintext golden file.
+// It will update the file if the update flag is used prior to loading it.
+func LoadWithUpdate(t *testing.T, data string, options ...Option) string {
+	t.Helper()
+
+	cfg := config{}
+	for _, f := range options {
+		f(&cfg)
+	}
+	if !filepath.IsAbs(cfg.path) {
+		cfg.path = filepath.Join(Path(t), cfg.path)
+	}
+
+	if update {
+		updateGoldenFile(t, cfg.path, []byte(data))
+	}
+
+	want, err := os.ReadFile(cfg.path)
+	require.NoError(t, err, "Cannot load golden file")
+
+	return string(want)
+}
+
+// LoadWithUpdateYAML load the generic element from a YAML serialized golden file.
+// It will update the file if the update flag is used prior to deserializing it.
+func LoadWithUpdateYAML[E any](t *testing.T, got E, options ...Option) E {
+	t.Helper()
+
+	t.Logf("Serializing object for golden file")
+	data, err := yaml.Marshal(got)
+	require.NoError(t, err, "Cannot serialize provided object")
+	want := LoadWithUpdate(t, string(data), options...)
+
+	var wantDeserialized E
+	err = yaml.Unmarshal([]byte(want), &wantDeserialized)
+	require.NoError(t, err, "Cannot create expanded policy objects from golden file")
+
+	return wantDeserialized
+}
+
+// CheckValidGoldenFileName checks if the provided name is a valid golden file name.
+func CheckValidGoldenFileName(t *testing.T, name string) {
+	t.Helper()
+
+	// A valid golden file contains only alphanumeric characters, underscores, dashes, and dots.
+	require.Regexp(t, `^[\w\-.]+$`, name,
+		"Invalid golden file name %q. Only alphanumeric characters, underscores, dashes, and dots are allowed", name)
+}
+
+// Path returns the golden path for the provided test.
+func Path(t *testing.T) string {
+	t.Helper()
+
+	cwd, err := os.Getwd()
+	require.NoError(t, err, "Cannot get current working directory")
+
+	topLevelTest, subtest, subtestFound := strings.Cut(t.Name(), "/")
+	CheckValidGoldenFileName(t, topLevelTest)
+
+	path := filepath.Join(cwd, "testdata", "golden", topLevelTest)
+
+	if !subtestFound {
+		return path
+	}
+
+	CheckValidGoldenFileName(t, subtest)
+	return filepath.Join(path, subtest)
+}
+
+// runDelta pipes the unified diff through the `delta` command for word-level diff and coloring.
+func runDelta(diff string) (string, error) {
+	cmd := exec.Command("delta", "--diff-so-fancy", "--hunk-header-style", "omit")
+	cmd.Stdin = strings.NewReader(diff)
+
+	var out bytes.Buffer
+	cmd.Stdout = &out
+	cmd.Stderr = &out
+
+	err := cmd.Run()
+	if err != nil {
+		return "", fmt.Errorf("failed to run delta: %w", err)
+	}
+	return out.String(), nil
+}
+
+// checkFileContent compares the content of the actual and golden files and reports any differences.
+func checkFileContent(t *testing.T, actual, expected, actualPath, expectedPath string) {
+	t.Helper()
+
+	if actual == expected {
+		return
+	}
+
+	diff := difflib.UnifiedDiff{
+		A:        difflib.SplitLines(expected),
+		B:        difflib.SplitLines(actual),
+		FromFile: "Expected (golden)",
+		ToFile:   "Actual",
+		Context:  3,
+	}
+	diffStr, err := difflib.GetUnifiedDiffString(diff)
+	require.NoError(t, err, "Cannot get unified diff")
+
+	// Check if the `delta` command is available and use it to colorize the diff.
+	_, err = exec.LookPath("delta")
+	if err == nil {
+		diffStr, err = runDelta(diffStr)
+		require.NoError(t, err, "Cannot run delta")
+	} else {
+		diffStr = "\nDiff:\n" + diffStr
+	}
+
+	msg := fmt.Sprintf("Golden file: %s", expectedPath)
+	if actualPath != "Actual" {
+		msg += fmt.Sprintf("\nFile: %s", actualPath)
+	}
+
+	require.Failf(t, strings.Join([]string{
+		"Golden file content mismatch",
+		"\nExpected (golden):",
+		strings.Repeat("-", 50),
+		strings.TrimSuffix(expected, "\n"),
+		strings.Repeat("-", 50),
+		"\nActual: ",
+		strings.Repeat("-", 50),
+		strings.TrimSuffix(actual, "\n"),
+		strings.Repeat("-", 50),
+		diffStr,
+	}, "\n"), msg)
+}
+
+func checkGoldenFileEqualsFile(t *testing.T, path, goldenPath string) {
+	t.Helper()
+
+	fileContent, err := os.ReadFile(path)
+	require.NoError(t, err, "Cannot read file %s", path)
+	goldenContent, err := os.ReadFile(goldenPath)
+	require.NoError(t, err, "Cannot read golden file %s", goldenPath)
+
+	checkFileContent(t, string(fileContent), string(goldenContent), path, goldenPath)
+}
+
+func checkGoldenFileEqualsString(t *testing.T, got, goldenPath string) {
+	t.Helper()
+
+	goldenContent, err := os.ReadFile(goldenPath)
+	require.NoError(t, err, "Cannot read golden file %s", goldenPath)
+
+	checkFileContent(t, got, string(goldenContent), "Actual", goldenPath)
+}
+
+// CheckOrUpdateFileTree allows comparing a goldPath directory to p. Those can be updated via the dedicated flag.
+func CheckOrUpdateFileTree(t *testing.T, path string, options ...Option) {
+	t.Helper()
+
+	cfg := config{}
+	for _, f := range options {
+		f(&cfg)
+	}
+	if !filepath.IsAbs(cfg.path) {
+		cfg.path = filepath.Join(Path(t), cfg.path)
+	}
+
+	if update {
+		t.Logf("updating golden path %s", cfg.path)
+		err := os.RemoveAll(cfg.path)
+		require.NoError(t, err, "Cannot remove golden path %s", cfg.path)
+
+		// check the source directory exists before trying to copy it
+		info, err := os.Stat(path)
+		if errors.Is(err, fs.ErrNotExist) {
+			return
+		}
+		require.NoErrorf(t, err, "Error on checking %q", path)
+
+		if !info.IsDir() {
+			// copy file
+			data, err := os.ReadFile(path)
+			require.NoError(t, err, "Cannot read file %s", path)
+			err = os.WriteFile(cfg.path, data, info.Mode())
+			require.NoError(t, err, "Cannot write golden file")
+		} else {
+			err := addEmptyMarker(path)
+			require.NoError(t, err, "Cannot add empty marker to directory %s", path)
+
+			err = copy.Copy(path, cfg.path)
+			require.NoError(t, err, "Can’t update golden directory")
+		}
+	}
+
+	// Compare the content and attributes of the files in the directories.
+	err := filepath.WalkDir(path, func(p string, de fs.DirEntry, err error) error {
+		if err != nil {
+			return err
+		}
+
+		relPath, err := filepath.Rel(path, p)
+		require.NoError(t, err, "Cannot get relative path for %s", p)
+		goldenFilePath := filepath.Join(cfg.path, relPath)
+
+		if de.IsDir() {
+			return nil
+		}
+
+		goldenFile, err := os.Stat(goldenFilePath)
+		if errors.Is(err, fs.ErrNotExist) {
+			require.Failf(t, fmt.Sprintf("Missing golden file %s", goldenFilePath), "File: %s", p)
+		}
+		require.NoError(t, err, "Cannot get golden file %s", goldenFilePath)
+
+		file, err := os.Stat(p)
+		require.NoError(t, err, "Cannot get file %s", p)
+
+		// Compare executable bit
+		a := strconv.FormatInt(int64(goldenFile.Mode().Perm()&0o111), 8)
+		b := strconv.FormatInt(int64(file.Mode().Perm()&0o111), 8)
+		require.Equal(t, a, b, "Executable bit does not match.\nFile: %s\nGolden file: %s", p, goldenFilePath)
+
+		// Compare content
+		checkGoldenFileEqualsFile(t, p, goldenFilePath)
+
+		return nil
+	})
+	require.NoError(t, err, "Cannot walk through directory %s", path)
+
+	// Check if there are files in the golden directory that are not in the source directory.
+	err = filepath.WalkDir(cfg.path, func(p string, de fs.DirEntry, err error) error {
+		if err != nil {
+			return err
+		}
+
+		// Ignore the ".empty" file
+		if de.Name() == fileForEmptyDir {
+			return nil
+		}
+
+		relPath, err := filepath.Rel(cfg.path, p)
+		require.NoError(t, err, "Cannot get relative path for %s", p)
+		filePath := filepath.Join(path, relPath)
+
+		if de.IsDir() {
+			return nil
+		}
+
+		_, err = os.Stat(filePath)
+		require.NoError(t, err, "Missing expected file %s", filePath)
+
+		return nil
+	})
+	require.NoError(t, err, "Cannot walk through directory %s", cfg.path)
+}
+
+const fileForEmptyDir = ".empty"
+
+// addEmptyMarker adds to any empty directory, fileForEmptyDir to it.
+// That allows git to commit it.
+func addEmptyMarker(p string) error {
+	err := filepath.WalkDir(p, func(path string, de fs.DirEntry, err error) error {
+		if err != nil {
+			return err
+		}
+
+		if !de.IsDir() {
+			return nil
+		}
+
+		entries, err := os.ReadDir(path)
+		if err != nil {
+			return err
+		}
+		if len(entries) == 0 {
+			f, err := os.Create(filepath.Join(path, fileForEmptyDir))
+			if err != nil {
+				return err
+			}
+			if err = f.Close(); err != nil {
+				return err
+			}
+		}
+		return nil
+	})
+
+	return err
+}
+
+// UpdateEnabled returns true if the update flag was set, false otherwise.
+func UpdateEnabled() bool {
+	return update
+}
diff --git a/authd-oidc-brokers/internal/testutils/path.go b/authd-oidc-brokers/internal/testutils/path.go
new file mode 100644
index 0000000000..d6d2cfd09c
--- /dev/null
+++ b/authd-oidc-brokers/internal/testutils/path.go
@@ -0,0 +1,37 @@
+package testutils
+
+import (
+	"errors"
+	"io/fs"
+	"os"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+// MakeReadOnly makes dest read only and restore permission on cleanup.
+func MakeReadOnly(t *testing.T, dest string) func() {
+	t.Helper()
+
+	// Get current dest permissions
+	fi, err := os.Stat(dest)
+	require.NoError(t, err, "Cannot stat %s", dest)
+	mode := fi.Mode()
+
+	var perms fs.FileMode = 0444
+	if fi.IsDir() {
+		perms = 0555
+	}
+	err = os.Chmod(dest, perms)
+	require.NoError(t, err)
+
+	return func() {
+		_, err := os.Stat(dest)
+		if errors.Is(err, os.ErrNotExist) {
+			return
+		}
+
+		err = os.Chmod(dest, mode)
+		require.NoError(t, err)
+	}
+}
diff --git a/authd-oidc-brokers/internal/testutils/provider.go b/authd-oidc-brokers/internal/testutils/provider.go
new file mode 100644
index 0000000000..31c8a5558b
--- /dev/null
+++ b/authd-oidc-brokers/internal/testutils/provider.go
@@ -0,0 +1,477 @@
+package testutils
+
+import (
+	"context"
+	"crypto/rand"
+	"crypto/rsa"
+	"crypto/x509"
+	"crypto/x509/pkix"
+	"errors"
+	"fmt"
+	"math/big"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"net/http/httputil"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/canonical/authd/authd-oidc-brokers/internal/consts"
+	"github.com/canonical/authd/authd-oidc-brokers/internal/providers/genericprovider"
+	"github.com/canonical/authd/authd-oidc-brokers/internal/providers/info"
+	"github.com/coreos/go-oidc/v3/oidc"
+	"github.com/go-jose/go-jose/v4"
+	"github.com/golang-jwt/jwt/v5"
+	"github.com/ubuntu/authd/log"
+	"golang.org/x/oauth2"
+)
+
+const (
+	// ExpiredRefreshToken is used to test the expired refresh token error.
+	ExpiredRefreshToken = "expired-refresh-token"
+	// IsForDeviceRegistrationClaim is the claim used to indicate to the mock provider if the token is for device registration.
+	IsForDeviceRegistrationClaim = "is_for_device_registration"
+)
+
+// MockKey is the RSA key used to sign the JWTs for the mock provider.
+var MockKey *rsa.PrivateKey
+
+var mockCertificate *x509.Certificate
+
+func init() {
+	key, err := rsa.GenerateKey(rand.Reader, 2048)
+	if err != nil {
+		panic(fmt.Sprintf("Setup: Could not generate RSA key for the Mock: %v", err))
+	}
+	MockKey = key
+
+	certTemplate := &x509.Certificate{
+		SerialNumber: big.NewInt(2024),
+		Subject: pkix.Name{
+			Organization: []string{"Mocks ltd."},
+		},
+		NotBefore:             time.Now(),
+		NotAfter:              time.Now().AddDate(0, 0, 1),
+		SubjectKeyId:          []byte{1, 2, 3, 4, 5},
+		ExtKeyUsage:           []x509.ExtKeyUsage{x509.ExtKeyUsageAny},
+		KeyUsage:              x509.KeyUsageDigitalSignature,
+		IsCA:                  true,
+		BasicConstraintsValid: true,
+	}
+
+	c, err := x509.CreateCertificate(rand.Reader, certTemplate, certTemplate, &MockKey.PublicKey, MockKey)
+	if err != nil {
+		panic("Setup: Could not create certificate for the Mock")
+	}
+
+	cert, err := x509.ParseCertificate(c)
+	if err != nil {
+		panic("Setup: Could not parse certificate for the Mock")
+	}
+	mockCertificate = cert
+}
+
+// EndpointHandler is a function that handles a request to an OIDC provider endpoint.
+type EndpointHandler func(http.ResponseWriter, *http.Request)
+
+type providerServerOption struct {
+	handlers map[string]EndpointHandler
+}
+
+// ProviderServerOption is a function that allows to override default options of the mock provider.
+type ProviderServerOption func(*providerServerOption)
+
+// WithHandler returns a ProviderServerOption that adds a handler for a provider endpoint specified by path.
+func WithHandler(path string, handler func(http.ResponseWriter, *http.Request)) ProviderServerOption {
+	return func(o *providerServerOption) {
+		o.handlers[path] = handler
+	}
+}
+
+// StartMockProviderServer starts a new HTTP server to be used as an OIDC provider for tests.
+func StartMockProviderServer(address string, tokenHandlerOpts *TokenHandlerOptions, args ...ProviderServerOption) (string, func()) {
+	servMux := http.NewServeMux()
+	server := httptest.NewUnstartedServer(servMux)
+
+	if address != "" {
+		l, err := net.Listen("tcp", address)
+		if err != nil {
+			panic(fmt.Sprintf("error starting listener: %v", err))
+		}
+		server.Listener = l
+	}
+	server.Start()
+
+	opts := providerServerOption{
+		handlers: map[string]EndpointHandler{
+			"/.well-known/openid-configuration": DefaultOpenIDHandler(server.URL),
+			"/device_auth":                      DefaultDeviceAuthHandler(),
+			"/token":                            TokenHandler(server.URL, tokenHandlerOpts),
+			"/keys":                             DefaultJWKHandler(),
+		},
+	}
+	for _, arg := range args {
+		arg(&opts)
+	}
+
+	for path, handler := range opts.handlers {
+		if handler == nil {
+			continue
+		}
+		servMux.HandleFunc(path, handler)
+	}
+
+	return server.URL, func() {
+		server.Close()
+	}
+}
+
+// DefaultOpenIDHandler returns a handler that returns a default OIDC configuration.
+func DefaultOpenIDHandler(serverURL string) EndpointHandler {
+	return func(w http.ResponseWriter, _ *http.Request) {
+		wellKnown := fmt.Sprintf(`{
+			"issuer": "%[1]s",
+			"authorization_endpoint": "%[1]s/auth",
+			"device_authorization_endpoint": "%[1]s/device_auth",
+			"token_endpoint": "%[1]s/token",
+			"jwks_uri": "%[1]s/keys",
+			"id_token_signing_alg_values_supported": ["RS256"]
+		}`, serverURL)
+
+		w.Header().Add("Content-Type", "application/json")
+		_, err := w.Write([]byte(wellKnown))
+		if err != nil {
+			w.WriteHeader(http.StatusInternalServerError)
+		}
+	}
+}
+
+// OpenIDHandlerWithNoDeviceEndpoint returns a handler that returns an OIDC configuration without device endpoint.
+func OpenIDHandlerWithNoDeviceEndpoint(serverURL string) EndpointHandler {
+	return func(w http.ResponseWriter, _ *http.Request) {
+		wellKnown := fmt.Sprintf(`{
+			"issuer": "%[1]s",
+			"authorization_endpoint": "%[1]s/auth",
+			"token_endpoint": "%[1]s/token",
+			"jwks_uri": "%[1]s/keys",
+			"id_token_signing_alg_values_supported": ["RS256"]
+		}`, serverURL)
+
+		w.Header().Add("Content-Type", "application/json")
+		_, err := w.Write([]byte(wellKnown))
+		if err != nil {
+			w.WriteHeader(http.StatusInternalServerError)
+		}
+	}
+}
+
+// DefaultDeviceAuthHandler returns a handler that returns a default device auth response.
+func DefaultDeviceAuthHandler() EndpointHandler {
+	return func(w http.ResponseWriter, _ *http.Request) {
+		response := `{
+			"device_code": "device_code",
+			"user_code": "user_code",
+			"verification_uri": "https://verification_uri.com"
+		}`
+
+		w.Header().Add("Content-Type", "application/json")
+		_, err := w.Write([]byte(response))
+		if err != nil {
+			w.WriteHeader(http.StatusInternalServerError)
+		}
+	}
+}
+
+// TokenHandlerOptions contains options for the token handler.
+type TokenHandlerOptions struct {
+	Scopes []string
+	// A list of custom claims to be added to the ID token. Each time the
+	// handler returns a token, the claims from the first element of the list
+	// will be added to the token, and then that element will be removed from
+	// the list.
+	IDTokenClaims []map[string]interface{}
+}
+
+var idTokenClaimsMutex sync.Mutex
+
+// TokenHandler returns a handler that returns a default token response.
+func TokenHandler(serverURL string, opts *TokenHandlerOptions) EndpointHandler {
+	if opts == nil {
+		opts = &TokenHandlerOptions{}
+	}
+	if opts.Scopes == nil {
+		opts.Scopes = consts.DefaultScopes
+	}
+
+	return func(w http.ResponseWriter, r *http.Request) {
+		s, err := httputil.DumpRequest(r, true)
+		if err != nil {
+			log.Errorf(context.Background(), "could not dump request: %v", err)
+		}
+		log.Debugf(context.Background(), "/token endpoint request:\n%s", s)
+
+		// Handle expired refresh token
+		//nolint:gosec // G120 - test-only mock handler; request bodies are controlled by tests.
+		refreshToken := r.FormValue("refresh_token")
+		if refreshToken == ExpiredRefreshToken {
+			w.Header().Add("Content-Type", "application/json")
+			w.WriteHeader(http.StatusBadRequest)
+			// This is an msentraid specific error code and description.
+			_, _ = w.Write([]byte(`{"error": "invalid_grant", "error_description": "AADSTS50173: The refresh token has expired."}`))
+			return
+		}
+
+		// Mimics user going through auth process
+		time.Sleep(2 * time.Second)
+
+		claims := jwt.MapClaims{
+			"iss":                serverURL,
+			"sub":                "test-user-id",
+			"aud":                "test-client-id",
+			"exp":                9999999999,
+			"name":               "test-user",
+			"preferred_username": "test-user-preferred-username@email.com",
+			"email":              "test-user@email.com",
+			"email_verified":     true,
+		}
+
+		idTokenClaimsMutex.Lock()
+		// Override the default claims with the custom claims
+		if len(opts.IDTokenClaims) > 0 {
+			for k, v := range opts.IDTokenClaims[0] {
+				claims[k] = v
+			}
+			opts.IDTokenClaims = opts.IDTokenClaims[1:]
+		}
+		idTokenClaimsMutex.Unlock()
+
+		idToken := jwt.NewWithClaims(jwt.SigningMethodRS256, claims)
+
+		rawToken, err := idToken.SignedString(MockKey)
+		if err != nil {
+			w.WriteHeader(http.StatusInternalServerError)
+		}
+
+		response := fmt.Sprintf(`{
+			"access_token": "accesstoken",
+			"refresh_token": "refreshtoken",
+			"token_type": "Bearer",
+			"scope": "%s",
+			"expires_in": 3600,
+			"id_token": "%s"
+		}`, strings.Join(opts.Scopes, " "), rawToken)
+
+		w.Header().Add("Content-Type", "application/json")
+		if _, err := w.Write([]byte(response)); err != nil {
+			w.WriteHeader(http.StatusInternalServerError)
+		}
+	}
+}
+
+// DefaultJWKHandler returns a handler that provides the signing keys from the broker.
+//
+// Meant to be used an the endpoint for /keys.
+func DefaultJWKHandler() EndpointHandler {
+	return func(w http.ResponseWriter, r *http.Request) {
+		jwk := jose.JSONWebKey{
+			Key:          &MockKey.PublicKey,
+			KeyID:        "fa834459-66c6-475a-852f-444262a07c13_sig_rs256",
+			Algorithm:    "RS256",
+			Use:          "sig",
+			Certificates: []*x509.Certificate{mockCertificate},
+		}
+
+		encodedJWK, err := jwk.MarshalJSON()
+		if err != nil {
+			w.WriteHeader(http.StatusInternalServerError)
+		}
+
+		response := fmt.Sprintf(`{"keys": [%s]}`, encodedJWK)
+		w.Header().Add("Content-Type", "application/json")
+		if _, err := w.Write([]byte(response)); err != nil {
+			w.WriteHeader(http.StatusInternalServerError)
+		}
+	}
+}
+
+// UnavailableHandler returns a handler that returns a 503 Service Unavailable response.
+func UnavailableHandler() EndpointHandler {
+	return func(w http.ResponseWriter, _ *http.Request) {
+		w.WriteHeader(http.StatusServiceUnavailable)
+	}
+}
+
+// BadRequestHandler returns a handler that returns a 400 Bad Request response.
+func BadRequestHandler() EndpointHandler {
+	return func(w http.ResponseWriter, _ *http.Request) {
+		w.WriteHeader(http.StatusBadRequest)
+	}
+}
+
+// CustomResponseHandler returns a handler that returns a custom token response.
+func CustomResponseHandler(response string) EndpointHandler {
+	return func(w http.ResponseWriter, _ *http.Request) {
+		w.Header().Add("Content-Type", "application/json")
+		_, err := w.Write([]byte(response))
+		if err != nil {
+			w.WriteHeader(http.StatusInternalServerError)
+		}
+	}
+}
+
+// HangingHandler returns a handler that hangs the request until the duration has elapsed.
+func HangingHandler(d time.Duration) EndpointHandler {
+	return func(w http.ResponseWriter, r *http.Request) {
+		time.Sleep(d)
+
+		w.Header().Add("Content-Type", "application/json")
+		w.WriteHeader(http.StatusRequestTimeout)
+	}
+}
+
+// ExpiryDeviceAuthHandler returns a handler that returns a device auth response with a short expiry time.
+func ExpiryDeviceAuthHandler() EndpointHandler {
+	return func(w http.ResponseWriter, _ *http.Request) {
+		response := `{
+			"device_code": "device_code",
+			"user_code": "user_code",
+			"verification_uri": "https://verification_uri.com",
+			"expires_in": 1
+		}`
+
+		w.Header().Add("Content-Type", "application/json")
+		_, err := w.Write([]byte(response))
+		if err != nil {
+			w.WriteHeader(http.StatusInternalServerError)
+		}
+	}
+}
+
+// MockProvider is a mock that implements the Provider interface.
+type MockProvider struct {
+	genericprovider.GenericProvider
+	Scopes                             []string
+	Options                            []oauth2.AuthCodeOption
+	GetGroupsFunc                      func() ([]info.Group, error)
+	FirstCallDelay                     int
+	SecondCallDelay                    int
+	GetGroupsFails                     bool
+	ProviderSupportsDeviceRegistration bool
+
+	numCalls     int
+	numCallsLock sync.Mutex
+}
+
+// AdditionalScopes returns the additional scopes required by the provider.
+func (p *MockProvider) AdditionalScopes() []string {
+	if p.Scopes != nil {
+		return p.Scopes
+	}
+	return p.GenericProvider.AdditionalScopes()
+}
+
+// AuthOptions returns the additional options required by the provider.
+func (p *MockProvider) AuthOptions() []oauth2.AuthCodeOption {
+	if p.Options != nil {
+		return p.Options
+	}
+	return p.GenericProvider.AuthOptions()
+}
+
+// NormalizeUsername parses a username into a normalized version.
+func (p *MockProvider) NormalizeUsername(username string) string {
+	return strings.ToLower(username)
+}
+
+// GetMetadata is a no-op when no specific provider is in use.
+func (p *MockProvider) GetMetadata(provider *oidc.Provider) (map[string]interface{}, error) {
+	return nil, nil
+}
+
+// GetUserInfo returns the user info parsed from the ID token.
+func (p *MockProvider) GetUserInfo(idToken info.Claimer) (info.User, error) {
+	userClaims, err := p.userClaims(idToken)
+	if err != nil {
+		return info.User{}, err
+	}
+
+	p.numCallsLock.Lock()
+	numCalls := p.numCalls
+	p.numCalls++
+	p.numCallsLock.Unlock()
+
+	if numCalls == 0 && p.FirstCallDelay > 0 {
+		time.Sleep(time.Duration(p.FirstCallDelay) * time.Second)
+	}
+	if numCalls == 1 && p.SecondCallDelay > 0 {
+		time.Sleep(time.Duration(p.SecondCallDelay) * time.Second)
+	}
+
+	return info.NewUser(
+		userClaims.Email,
+		userClaims.Home,
+		userClaims.Sub,
+		userClaims.Shell,
+		userClaims.Gecos,
+		nil,
+	), nil
+}
+
+// GetGroups returns the groups the user is a member of.
+func (p *MockProvider) GetGroups(ctx context.Context, clientID string, issuerURL string, token *oauth2.Token, providerMetadata map[string]interface{}, deviceRegistrationData []byte) ([]info.Group, error) {
+	if p.GetGroupsFails {
+		return nil, errors.New("error requested in the mock")
+	}
+
+	userGroups := []info.Group{
+		{Name: "remote-test-group", UGID: "12345"},
+		{Name: "local-test-group", UGID: ""},
+	}
+
+	var err error
+	if p.GetGroupsFunc != nil {
+		userGroups, err = p.GetGroupsFunc()
+		if err != nil {
+			return nil, err
+		}
+	}
+
+	return userGroups, nil
+}
+
+// IsTokenForDeviceRegistration checks if the token is for device registration.
+func (p *MockProvider) IsTokenForDeviceRegistration(token *oauth2.Token) (bool, error) {
+	if token == nil {
+		return false, errors.New("token is nil")
+	}
+
+	isForDeviceRegistration, ok := token.Extra(IsForDeviceRegistrationClaim).(bool)
+	if !ok {
+		return false, fmt.Errorf("token does not contain %q claim", IsForDeviceRegistrationClaim)
+	}
+
+	return isForDeviceRegistration, nil
+}
+
+// SupportsDeviceRegistration checks if the provider supports device registration.
+func (p *MockProvider) SupportsDeviceRegistration() bool {
+	return p.ProviderSupportsDeviceRegistration
+}
+
+type claims struct {
+	Email string `json:"email"`
+	Sub   string `json:"sub"`
+	Home  string `json:"home"`
+	Shell string `json:"shell"`
+	Gecos string `json:"gecos"`
+}
+
+// userClaims returns the user claims parsed from the ID token.
+func (p *MockProvider) userClaims(idToken info.Claimer) (claims, error) {
+	var userClaims claims
+	if err := idToken.Claims(&userClaims); err != nil {
+		return claims{}, fmt.Errorf("failed to get ID token claims: %v", err)
+	}
+	return userClaims, nil
+}
diff --git a/authd-oidc-brokers/internal/token/token.go b/authd-oidc-brokers/internal/token/token.go
new file mode 100644
index 0000000000..ffb4cf8090
--- /dev/null
+++ b/authd-oidc-brokers/internal/token/token.go
@@ -0,0 +1,73 @@
+// Package token provides functions to save and load tokens from disk.
+package token
+
+import (
+	"encoding/json"
+	"fmt"
+	"os"
+	"path/filepath"
+
+	"github.com/canonical/authd/authd-oidc-brokers/internal/providers"
+	"github.com/canonical/authd/authd-oidc-brokers/internal/providers/info"
+	"golang.org/x/oauth2"
+)
+
+// AuthCachedInfo represents the token that will be saved on disk for offline authentication.
+type AuthCachedInfo struct {
+	Token                  *oauth2.Token
+	ExtraFields            map[string]interface{}
+	RawIDToken             string
+	ProviderMetadata       map[string]interface{}
+	UserInfo               info.User
+	DeviceRegistrationData []byte
+	DeviceIsDisabled       bool
+	UserIsDisabled         bool
+}
+
+// NewAuthCachedInfo creates a new AuthCachedInfo. It sets the provided token and rawIDToken and the provider-specific
+// extra fields which should be stored persistently.
+func NewAuthCachedInfo(token *oauth2.Token, rawIDToken string, provider providers.Provider) *AuthCachedInfo {
+	return &AuthCachedInfo{
+		Token:       token,
+		RawIDToken:  rawIDToken,
+		ExtraFields: provider.GetExtraFields(token),
+	}
+}
+
+// CacheAuthInfo saves the token to the given path.
+func CacheAuthInfo(path string, token *AuthCachedInfo) (err error) {
+	jsonData, err := json.Marshal(token)
+	if err != nil {
+		return fmt.Errorf("could not marshal token: %v", err)
+	}
+
+	// Create issuer specific cache directory if it doesn't exist.
+	if err = os.MkdirAll(filepath.Dir(path), 0700); err != nil {
+		return fmt.Errorf("could not create token directory: %v", err)
+	}
+
+	if err = os.WriteFile(path, jsonData, 0600); err != nil {
+		return fmt.Errorf("could not save token: %v", err)
+	}
+
+	return nil
+}
+
+// LoadAuthInfo reads the token from the given path.
+func LoadAuthInfo(path string) (*AuthCachedInfo, error) {
+	jsonData, err := os.ReadFile(path)
+	if err != nil {
+		return nil, fmt.Errorf("could not read token: %v", err)
+	}
+
+	var cachedInfo AuthCachedInfo
+	if err := json.Unmarshal(jsonData, &cachedInfo); err != nil {
+		return nil, fmt.Errorf("could not unmarshal token: %v", err)
+	}
+	// Set the extra fields of the token.
+	if cachedInfo.ExtraFields != nil {
+		cachedInfo.Token = cachedInfo.Token.WithExtra(cachedInfo.ExtraFields)
+	}
+
+	return &cachedInfo, nil
+}
diff --git a/authd-oidc-brokers/internal/token/token_test.go b/authd-oidc-brokers/internal/token/token_test.go
new file mode 100644
index 0000000000..0a7b8fbb74
--- /dev/null
+++ b/authd-oidc-brokers/internal/token/token_test.go
@@ -0,0 +1,127 @@
+package token_test
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/canonical/authd/authd-oidc-brokers/internal/providers/info"
+	"github.com/canonical/authd/authd-oidc-brokers/internal/token"
+	"github.com/stretchr/testify/require"
+	"golang.org/x/oauth2"
+)
+
+var testToken = &token.AuthCachedInfo{
+	Token: &oauth2.Token{
+		AccessToken:  "accesstoken",
+		RefreshToken: "refreshtoken",
+	},
+	RawIDToken: "rawidtoken",
+	UserInfo: info.User{
+		Name:  "foo",
+		UUID:  "saved-user-id",
+		Home:  "/home/foo",
+		Gecos: "foo",
+		Shell: "/usr/bin/bash",
+		Groups: []info.Group{
+			{Name: "token-test-group", UGID: "12345"},
+		},
+	},
+}
+
+func TestCacheAuthInfo(t *testing.T) {
+	t.Parallel()
+
+	tests := map[string]struct {
+		existingParentDir bool
+		existingFile      bool
+		fileIsDir         bool
+		parentIsFile      bool
+
+		wantError bool
+	}{
+		"Successfully_store_token_with_non_existing_parent_directory": {},
+		"Successfully_store_token_with_existing_parent_directory":     {existingParentDir: true},
+		"Successfully_store_token_with_existing_file":                 {existingParentDir: true, existingFile: true},
+
+		"Error_when_file_exists_and_is_a_directory": {existingParentDir: true, existingFile: true, fileIsDir: true, wantError: true},
+		"Error_when_parent_directory_is_a_file":     {existingParentDir: true, parentIsFile: true, wantError: true},
+	}
+
+	for name, tc := range tests {
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			tokenPath := filepath.Join(t.TempDir(), "parent", "token.json")
+
+			if tc.existingParentDir && !tc.parentIsFile {
+				err := os.MkdirAll(filepath.Dir(tokenPath), 0700)
+				require.NoError(t, err, "MkdirAll should not return an error")
+			}
+			if tc.existingFile && !tc.fileIsDir {
+				err := os.WriteFile(tokenPath, []byte("existing file"), 0600)
+				require.NoError(t, err, "WriteFile should not return an error")
+			}
+			if tc.fileIsDir {
+				err := os.MkdirAll(tokenPath, 0700)
+				require.NoError(t, err, "MkdirAll should not return an error")
+			}
+			if tc.parentIsFile {
+				parentPath := filepath.Dir(tokenPath)
+				err := os.WriteFile(parentPath, []byte("existing file"), 0600)
+				require.NoError(t, err, "WriteFile should not return an error")
+			}
+
+			err := token.CacheAuthInfo(tokenPath, testToken)
+			if tc.wantError {
+				require.Error(t, err, "CacheAuthInfo should return an error")
+				return
+			}
+			require.NoError(t, err, "CacheAuthInfo should not return an error")
+		})
+	}
+}
+
+func TestLoadAuthInfo(t *testing.T) {
+	t.Parallel()
+
+	tests := map[string]struct {
+		expectedRet *token.AuthCachedInfo
+		fileExists  bool
+		invalidJSON bool
+
+		wantError bool
+	}{
+		"Successfully_load_token_from_existing_file": {fileExists: true, expectedRet: testToken},
+		"Error_when_file_does_not_exist":             {wantError: true},
+		"Error_when_file_contains_invalid_JSON":      {fileExists: true, invalidJSON: true, wantError: true},
+	}
+
+	for name, tc := range tests {
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			tokenPath := filepath.Join(t.TempDir(), "parent", "token.json")
+			if tc.fileExists {
+				err := os.MkdirAll(filepath.Dir(tokenPath), 0700)
+				require.NoError(t, err, "MkdirAll should not return an error")
+
+				if tc.invalidJSON {
+					err = os.WriteFile(tokenPath, []byte("invalid json"), 0600)
+					require.NoError(t, err, "WriteFile should not return an error")
+				} else {
+					err = token.CacheAuthInfo(tokenPath, testToken)
+					require.NoError(t, err, "CacheAuthInfo should not return an error")
+				}
+			}
+
+			got, err := token.LoadAuthInfo(tokenPath)
+			if tc.wantError {
+				require.Error(t, err, "LoadAuthInfo should return an error")
+				return
+			}
+			require.NoError(t, err, "LoadAuthInfo should not return an error")
+			require.Equal(t, tc.expectedRet, got, "LoadAuthInfo should return the expected value")
+		})
+	}
+}
diff --git a/authd-oidc-brokers/po/embedder.go b/authd-oidc-brokers/po/embedder.go
new file mode 100644
index 0000000000..734c4dd21c
--- /dev/null
+++ b/authd-oidc-brokers/po/embedder.go
@@ -0,0 +1,11 @@
+//go:build !withmo || windows
+
+// Package po allows embedding po files in project in development mode or windows.
+package po
+
+import "embed"
+
+// Files containing po files
+//
+//go:embed *.po
+var Files embed.FS
diff --git a/authd-oidc-brokers/po/fr.po b/authd-oidc-brokers/po/fr.po
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/authd-oidc-brokers/po/mofiles.go b/authd-oidc-brokers/po/mofiles.go
new file mode 100644
index 0000000000..5609fa7d6b
--- /dev/null
+++ b/authd-oidc-brokers/po/mofiles.go
@@ -0,0 +1,9 @@
+// TiCS: disabled // This is a helper file.
+
+//go:build withmo && !windows
+
+package po
+
+import "embed"
+
+var Files embed.FS
diff --git a/authd-oidc-brokers/rust-toolchain.toml b/authd-oidc-brokers/rust-toolchain.toml
new file mode 100644
index 0000000000..4f0b659d63
--- /dev/null
+++ b/authd-oidc-brokers/rust-toolchain.toml
@@ -0,0 +1,4 @@
+[toolchain]
+channel = "1.94.0"
+profile = "minimal"
+components = ["clippy"]
diff --git a/authd-oidc-brokers/third_party/libhimmelblau b/authd-oidc-brokers/third_party/libhimmelblau
new file mode 160000
index 0000000000..11bd85bd8b
--- /dev/null
+++ b/authd-oidc-brokers/third_party/libhimmelblau
@@ -0,0 +1 @@
+Subproject commit 11bd85bd8bf2de0d645cbeead1292bcbc72b6f66
diff --git a/authd-oidc-brokers/tools/go.mod b/authd-oidc-brokers/tools/go.mod
new file mode 100644
index 0000000000..f4dd562017
--- /dev/null
+++ b/authd-oidc-brokers/tools/go.mod
@@ -0,0 +1,218 @@
+module github.com/canonical/authd/authd-oidc-brokers/tools
+
+go 1.25.0
+
+toolchain go1.25.8
+
+require (
+	github.com/golangci/golangci-lint/v2 v2.11.3
+	golang.org/x/mod v0.33.0
+)
+
+require (
+	4d63.com/gocheckcompilerdirectives v1.3.0 // indirect
+	4d63.com/gochecknoglobals v0.2.2 // indirect
+	codeberg.org/chavacava/garif v0.2.0 // indirect
+	codeberg.org/polyfloyd/go-errorlint v1.9.0 // indirect
+	dev.gaijin.team/go/exhaustruct/v4 v4.0.0 // indirect
+	dev.gaijin.team/go/golib v0.6.0 // indirect
+	github.com/4meepo/tagalign v1.4.3 // indirect
+	github.com/Abirdcfly/dupword v0.1.7 // indirect
+	github.com/AdminBenni/iota-mixing v1.0.0 // indirect
+	github.com/AlwxSin/noinlineerr v1.0.5 // indirect
+	github.com/Antonboom/errname v1.1.1 // indirect
+	github.com/Antonboom/nilnil v1.1.1 // indirect
+	github.com/Antonboom/testifylint v1.6.4 // indirect
+	github.com/BurntSushi/toml v1.6.0 // indirect
+	github.com/Djarvur/go-err113 v0.1.1 // indirect
+	github.com/Masterminds/semver/v3 v3.4.0 // indirect
+	github.com/MirrexOne/unqueryvet v1.5.4 // indirect
+	github.com/OpenPeeDeeP/depguard/v2 v2.2.1 // indirect
+	github.com/alecthomas/chroma/v2 v2.23.1 // indirect
+	github.com/alecthomas/go-check-sumtype v0.3.1 // indirect
+	github.com/alexkohler/nakedret/v2 v2.0.6 // indirect
+	github.com/alexkohler/prealloc v1.1.0 // indirect
+	github.com/alfatraining/structtag v1.0.0 // indirect
+	github.com/alingse/asasalint v0.0.11 // indirect
+	github.com/alingse/nilnesserr v0.2.0 // indirect
+	github.com/ashanbrown/forbidigo/v2 v2.3.0 // indirect
+	github.com/ashanbrown/makezero/v2 v2.1.0 // indirect
+	github.com/aymanbagabas/go-osc52/v2 v2.0.1 // indirect
+	github.com/beorn7/perks v1.0.1 // indirect
+	github.com/bkielbasa/cyclop v1.2.3 // indirect
+	github.com/blizzy78/varnamelen v0.8.0 // indirect
+	github.com/bombsimon/wsl/v4 v4.7.0 // indirect
+	github.com/bombsimon/wsl/v5 v5.6.0 // indirect
+	github.com/breml/bidichk v0.3.3 // indirect
+	github.com/breml/errchkjson v0.4.1 // indirect
+	github.com/butuzov/ireturn v0.4.0 // indirect
+	github.com/butuzov/mirror v1.3.0 // indirect
+	github.com/catenacyber/perfsprint v0.10.1 // indirect
+	github.com/ccojocar/zxcvbn-go v1.0.4 // indirect
+	github.com/cespare/xxhash/v2 v2.3.0 // indirect
+	github.com/charithe/durationcheck v0.0.11 // indirect
+	github.com/charmbracelet/colorprofile v0.2.3-0.20250311203215-f60798e515dc // indirect
+	github.com/charmbracelet/lipgloss v1.1.0 // indirect
+	github.com/charmbracelet/x/ansi v0.10.1 // indirect
+	github.com/charmbracelet/x/cellbuf v0.0.13-0.20250311204145-2c3ea96c31dd // indirect
+	github.com/charmbracelet/x/term v0.2.1 // indirect
+	github.com/ckaznocha/intrange v0.3.1 // indirect
+	github.com/curioswitch/go-reassign v0.3.0 // indirect
+	github.com/daixiang0/gci v0.13.7 // indirect
+	github.com/dave/dst v0.27.3 // indirect
+	github.com/davecgh/go-spew v1.1.1 // indirect
+	github.com/denis-tingaikin/go-header v0.5.0 // indirect
+	github.com/dlclark/regexp2 v1.11.5 // indirect
+	github.com/ettle/strcase v0.2.0 // indirect
+	github.com/fatih/color v1.18.0 // indirect
+	github.com/fatih/structtag v1.2.0 // indirect
+	github.com/firefart/nonamedreturns v1.0.6 // indirect
+	github.com/fsnotify/fsnotify v1.5.4 // indirect
+	github.com/fzipp/gocyclo v0.6.0 // indirect
+	github.com/ghostiam/protogetter v0.3.20 // indirect
+	github.com/go-critic/go-critic v0.14.3 // indirect
+	github.com/go-toolsmith/astcast v1.1.0 // indirect
+	github.com/go-toolsmith/astcopy v1.1.0 // indirect
+	github.com/go-toolsmith/astequal v1.2.0 // indirect
+	github.com/go-toolsmith/astfmt v1.1.0 // indirect
+	github.com/go-toolsmith/astp v1.1.0 // indirect
+	github.com/go-toolsmith/strparse v1.1.0 // indirect
+	github.com/go-toolsmith/typep v1.1.0 // indirect
+	github.com/go-viper/mapstructure/v2 v2.5.0 // indirect
+	github.com/go-xmlfmt/xmlfmt v1.1.3 // indirect
+	github.com/gobwas/glob v0.2.3 // indirect
+	github.com/godoc-lint/godoc-lint v0.11.2 // indirect
+	github.com/gofrs/flock v0.13.0 // indirect
+	github.com/golang/protobuf v1.5.3 // indirect
+	github.com/golangci/asciicheck v0.5.0 // indirect
+	github.com/golangci/dupl v0.0.0-20250308024227-f665c8d69b32 // indirect
+	github.com/golangci/go-printf-func-name v0.1.1 // indirect
+	github.com/golangci/gofmt v0.0.0-20250106114630-d62b90e6713d // indirect
+	github.com/golangci/golines v0.15.0 // indirect
+	github.com/golangci/misspell v0.8.0 // indirect
+	github.com/golangci/plugin-module-register v0.1.2 // indirect
+	github.com/golangci/revgrep v0.8.0 // indirect
+	github.com/golangci/swaggoswag v0.0.0-20250504205917-77f2aca3143e // indirect
+	github.com/golangci/unconvert v0.0.0-20250410112200-a129a6e6413e // indirect
+	github.com/google/go-cmp v0.7.0 // indirect
+	github.com/gordonklaus/ineffassign v0.2.0 // indirect
+	github.com/gostaticanalysis/analysisutil v0.7.1 // indirect
+	github.com/gostaticanalysis/comment v1.5.0 // indirect
+	github.com/gostaticanalysis/forcetypeassert v0.2.0 // indirect
+	github.com/gostaticanalysis/nilerr v0.1.2 // indirect
+	github.com/hashicorp/go-immutable-radix/v2 v2.1.0 // indirect
+	github.com/hashicorp/go-version v1.8.0 // indirect
+	github.com/hashicorp/golang-lru/v2 v2.0.7 // indirect
+	github.com/hashicorp/hcl v1.0.0 // indirect
+	github.com/hexops/gotextdiff v1.0.3 // indirect
+	github.com/inconshreveable/mousetrap v1.1.0 // indirect
+	github.com/jgautheron/goconst v1.8.2 // indirect
+	github.com/jingyugao/rowserrcheck v1.1.1 // indirect
+	github.com/jjti/go-spancheck v0.6.5 // indirect
+	github.com/julz/importas v0.2.0 // indirect
+	github.com/karamaru-alpha/copyloopvar v1.2.2 // indirect
+	github.com/kisielk/errcheck v1.10.0 // indirect
+	github.com/kkHAIKE/contextcheck v1.1.6 // indirect
+	github.com/kulti/thelper v0.7.1 // indirect
+	github.com/kunwardeep/paralleltest v1.0.15 // indirect
+	github.com/lasiar/canonicalheader v1.1.2 // indirect
+	github.com/ldez/exptostd v0.4.5 // indirect
+	github.com/ldez/gomoddirectives v0.8.0 // indirect
+	github.com/ldez/grignotin v0.10.1 // indirect
+	github.com/ldez/structtags v0.6.1 // indirect
+	github.com/ldez/tagliatelle v0.7.2 // indirect
+	github.com/ldez/usetesting v0.5.0 // indirect
+	github.com/leonklingele/grouper v1.1.2 // indirect
+	github.com/lucasb-eyer/go-colorful v1.2.0 // indirect
+	github.com/macabu/inamedparam v0.2.0 // indirect
+	github.com/magiconair/properties v1.8.6 // indirect
+	github.com/manuelarte/embeddedstructfieldcheck v0.4.0 // indirect
+	github.com/manuelarte/funcorder v0.5.0 // indirect
+	github.com/maratori/testableexamples v1.0.1 // indirect
+	github.com/maratori/testpackage v1.1.2 // indirect
+	github.com/matoous/godox v1.1.0 // indirect
+	github.com/mattn/go-colorable v0.1.14 // indirect
+	github.com/mattn/go-isatty v0.0.20 // indirect
+	github.com/mattn/go-runewidth v0.0.16 // indirect
+	github.com/matttproud/golang_protobuf_extensions v1.0.1 // indirect
+	github.com/mgechev/revive v1.15.0 // indirect
+	github.com/mitchellh/go-homedir v1.1.0 // indirect
+	github.com/mitchellh/mapstructure v1.5.0 // indirect
+	github.com/moricho/tparallel v0.3.2 // indirect
+	github.com/muesli/termenv v0.16.0 // indirect
+	github.com/nakabonne/nestif v0.3.1 // indirect
+	github.com/nishanths/exhaustive v0.12.0 // indirect
+	github.com/nishanths/predeclared v0.2.2 // indirect
+	github.com/nunnatsa/ginkgolinter v0.23.0 // indirect
+	github.com/pelletier/go-toml v1.9.5 // indirect
+	github.com/pelletier/go-toml/v2 v2.2.4 // indirect
+	github.com/pmezard/go-difflib v1.0.0 // indirect
+	github.com/prometheus/client_golang v1.12.1 // indirect
+	github.com/prometheus/client_model v0.2.0 // indirect
+	github.com/prometheus/common v0.32.1 // indirect
+	github.com/prometheus/procfs v0.7.3 // indirect
+	github.com/quasilyte/go-ruleguard v0.4.5 // indirect
+	github.com/quasilyte/go-ruleguard/dsl v0.3.23 // indirect
+	github.com/quasilyte/gogrep v0.5.0 // indirect
+	github.com/quasilyte/regex/syntax v0.0.0-20210819130434-b3f0c404a727 // indirect
+	github.com/quasilyte/stdinfo v0.0.0-20220114132959-f7386bf02567 // indirect
+	github.com/raeperd/recvcheck v0.2.0 // indirect
+	github.com/rivo/uniseg v0.4.7 // indirect
+	github.com/rogpeppe/go-internal v1.14.1 // indirect
+	github.com/ryancurrah/gomodguard v1.4.1 // indirect
+	github.com/ryanrolds/sqlclosecheck v0.5.1 // indirect
+	github.com/sanposhiho/wastedassign/v2 v2.1.0 // indirect
+	github.com/santhosh-tekuri/jsonschema/v6 v6.0.2 // indirect
+	github.com/sashamelentyev/interfacebloat v1.1.0 // indirect
+	github.com/sashamelentyev/usestdlibvars v1.29.0 // indirect
+	github.com/securego/gosec/v2 v2.24.8-0.20260309165252-619ce2117e08 // indirect
+	github.com/sirupsen/logrus v1.9.4 // indirect
+	github.com/sivchari/containedctx v1.0.3 // indirect
+	github.com/sonatard/noctx v0.5.0 // indirect
+	github.com/sourcegraph/go-diff v0.7.0 // indirect
+	github.com/spf13/afero v1.15.0 // indirect
+	github.com/spf13/cast v1.5.0 // indirect
+	github.com/spf13/cobra v1.10.2 // indirect
+	github.com/spf13/jwalterweatherman v1.1.0 // indirect
+	github.com/spf13/pflag v1.0.10 // indirect
+	github.com/spf13/viper v1.12.0 // indirect
+	github.com/ssgreg/nlreturn/v2 v2.2.1 // indirect
+	github.com/stbenjam/no-sprintf-host-port v0.3.1 // indirect
+	github.com/stretchr/objx v0.5.2 // indirect
+	github.com/stretchr/testify v1.11.1 // indirect
+	github.com/subosito/gotenv v1.4.1 // indirect
+	github.com/tetafro/godot v1.5.4 // indirect
+	github.com/timakin/bodyclose v0.0.0-20241222091800-1db5c5ca4d67 // indirect
+	github.com/timonwong/loggercheck v0.11.0 // indirect
+	github.com/tomarrell/wrapcheck/v2 v2.12.0 // indirect
+	github.com/tommy-muehle/go-mnd/v2 v2.5.1 // indirect
+	github.com/ultraware/funlen v0.2.0 // indirect
+	github.com/ultraware/whitespace v0.2.0 // indirect
+	github.com/uudashr/gocognit v1.2.1 // indirect
+	github.com/uudashr/iface v1.4.1 // indirect
+	github.com/xen0n/gosmopolitan v1.3.0 // indirect
+	github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect
+	github.com/yagipy/maintidx v1.0.0 // indirect
+	github.com/yeya24/promlinter v0.3.0 // indirect
+	github.com/ykadowak/zerologlint v0.1.5 // indirect
+	gitlab.com/bosi/decorder v0.4.2 // indirect
+	go-simpler.org/musttag v0.14.0 // indirect
+	go-simpler.org/sloglint v0.11.1 // indirect
+	go.augendre.info/arangolint v0.4.0 // indirect
+	go.augendre.info/fatcontext v0.9.0 // indirect
+	go.uber.org/multierr v1.10.0 // indirect
+	go.uber.org/zap v1.27.0 // indirect
+	go.yaml.in/yaml/v3 v3.0.4 // indirect
+	golang.org/x/exp/typeparams v0.0.0-20260209203927-2842357ff358 // indirect
+	golang.org/x/sync v0.20.0 // indirect
+	golang.org/x/sys v0.41.0 // indirect
+	golang.org/x/text v0.34.0 // indirect
+	golang.org/x/tools v0.42.0 // indirect
+	google.golang.org/protobuf v1.36.8 // indirect
+	gopkg.in/ini.v1 v1.67.0 // indirect
+	gopkg.in/yaml.v2 v2.4.0 // indirect
+	gopkg.in/yaml.v3 v3.0.1 // indirect
+	honnef.co/go/tools v0.7.0 // indirect
+	mvdan.cc/gofumpt v0.9.2 // indirect
+	mvdan.cc/unparam v0.0.0-20251027182757-5beb8c8f8f15 // indirect
+)
diff --git a/authd-oidc-brokers/tools/go.sum b/authd-oidc-brokers/tools/go.sum
new file mode 100644
index 0000000000..316eef9859
--- /dev/null
+++ b/authd-oidc-brokers/tools/go.sum
@@ -0,0 +1,994 @@
+4d63.com/gocheckcompilerdirectives v1.3.0 h1:Ew5y5CtcAAQeTVKUVFrE7EwHMrTO6BggtEj8BZSjZ3A=
+4d63.com/gocheckcompilerdirectives v1.3.0/go.mod h1:ofsJ4zx2QAuIP/NO/NAh1ig6R1Fb18/GI7RVMwz7kAY=
+4d63.com/gochecknoglobals v0.2.2 h1:H1vdnwnMaZdQW/N+NrkT1SZMTBmcwHe9Vq8lJcYYTtU=
+4d63.com/gochecknoglobals v0.2.2/go.mod h1:lLxwTQjL5eIesRbvnzIP3jZtG140FnTdz+AlMa+ogt0=
+cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
+cloud.google.com/go v0.34.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
+cloud.google.com/go v0.38.0/go.mod h1:990N+gfupTy94rShfmMCWGDn0LpTmnzTp2qbd1dvSRU=
+cloud.google.com/go v0.44.1/go.mod h1:iSa0KzasP4Uvy3f1mN/7PiObzGgflwredwwASm/v6AU=
+cloud.google.com/go v0.44.2/go.mod h1:60680Gw3Yr4ikxnPRS/oxxkBccT6SA1yMk63TGekxKY=
+cloud.google.com/go v0.45.1/go.mod h1:RpBamKRgapWJb87xiFSdk4g1CME7QZg3uwTez+TSTjc=
+cloud.google.com/go v0.46.3/go.mod h1:a6bKKbmY7er1mI7TEI4lsAkts/mkhTSZK8w33B4RAg0=
+cloud.google.com/go v0.50.0/go.mod h1:r9sluTvynVuxRIOHXQEHMFffphuXHOMZMycpNR5e6To=
+cloud.google.com/go v0.52.0/go.mod h1:pXajvRH/6o3+F9jDHZWQ5PbGhn+o8w9qiu/CffaVdO4=
+cloud.google.com/go v0.53.0/go.mod h1:fp/UouUEsRkN6ryDKNW/Upv/JBKnv6WDthjR6+vze6M=
+cloud.google.com/go v0.54.0/go.mod h1:1rq2OEkV3YMf6n/9ZvGWI3GWw0VoqH/1x2nd8Is/bPc=
+cloud.google.com/go v0.56.0/go.mod h1:jr7tqZxxKOVYizybht9+26Z/gUq7tiRzu+ACVAMbKVk=
+cloud.google.com/go v0.57.0/go.mod h1:oXiQ6Rzq3RAkkY7N6t3TcE6jE+CIBBbA36lwQ1JyzZs=
+cloud.google.com/go v0.62.0/go.mod h1:jmCYTdRCQuc1PHIIJ/maLInMho30T/Y0M4hTdTShOYc=
+cloud.google.com/go v0.65.0/go.mod h1:O5N8zS7uWy9vkA9vayVHs65eM1ubvY4h553ofrNHObY=
+cloud.google.com/go/bigquery v1.0.1/go.mod h1:i/xbL2UlR5RvWAURpBYZTtm/cXjCha9lbfbpx4poX+o=
+cloud.google.com/go/bigquery v1.3.0/go.mod h1:PjpwJnslEMmckchkHFfq+HTD2DmtT67aNFKH1/VBDHE=
+cloud.google.com/go/bigquery v1.4.0/go.mod h1:S8dzgnTigyfTmLBfrtrhyYhwRxG72rYxvftPBK2Dvzc=
+cloud.google.com/go/bigquery v1.5.0/go.mod h1:snEHRnqQbz117VIFhE8bmtwIDY80NLUZUMb4Nv6dBIg=
+cloud.google.com/go/bigquery v1.7.0/go.mod h1://okPTzCYNXSlb24MZs83e2Do+h+VXtc4gLoIoXIAPc=
+cloud.google.com/go/bigquery v1.8.0/go.mod h1:J5hqkt3O0uAFnINi6JXValWIb1v0goeZM77hZzJN/fQ=
+cloud.google.com/go/datastore v1.0.0/go.mod h1:LXYbyblFSglQ5pkeyhO+Qmw7ukd3C+pD7TKLgZqpHYE=
+cloud.google.com/go/datastore v1.1.0/go.mod h1:umbIZjpQpHh4hmRpGhH4tLFup+FVzqBi1b3c64qFpCk=
+cloud.google.com/go/pubsub v1.0.1/go.mod h1:R0Gpsv3s54REJCy4fxDixWD93lHJMoZTyQ2kNxGRt3I=
+cloud.google.com/go/pubsub v1.1.0/go.mod h1:EwwdRX2sKPjnvnqCa270oGRyludottCI76h+R3AArQw=
+cloud.google.com/go/pubsub v1.2.0/go.mod h1:jhfEVHT8odbXTkndysNHCcx0awwzvfOlguIAii9o8iA=
+cloud.google.com/go/pubsub v1.3.1/go.mod h1:i+ucay31+CNRpDW4Lu78I4xXG+O1r/MAHgjpRVR+TSU=
+cloud.google.com/go/storage v1.0.0/go.mod h1:IhtSnM/ZTZV8YYJWCY8RULGVqBDmpoyjwiyrjsg+URw=
+cloud.google.com/go/storage v1.5.0/go.mod h1:tpKbwo567HUNpVclU5sGELwQWBDZ8gh0ZeosJ0Rtdos=
+cloud.google.com/go/storage v1.6.0/go.mod h1:N7U0C8pVQ/+NIKOBQyamJIeKQKkZ+mxpohlUTyfDhBk=
+cloud.google.com/go/storage v1.8.0/go.mod h1:Wv1Oy7z6Yz3DshWRJFhqM/UCfaWIRTdp0RXyy7KQOVs=
+cloud.google.com/go/storage v1.10.0/go.mod h1:FLPqc6j+Ki4BU591ie1oL6qBQGu2Bl/tZ9ullr3+Kg0=
+codeberg.org/chavacava/garif v0.2.0 h1:F0tVjhYbuOCnvNcU3YSpO6b3Waw6Bimy4K0mM8y6MfY=
+codeberg.org/chavacava/garif v0.2.0/go.mod h1:P2BPbVbT4QcvLZrORc2T29szK3xEOlnl0GiPTJmEqBQ=
+codeberg.org/polyfloyd/go-errorlint v1.9.0 h1:VkdEEmA1VBpH6ecQoMR4LdphVI3fA4RrCh2an7YmodI=
+codeberg.org/polyfloyd/go-errorlint v1.9.0/go.mod h1:GPRRu2LzVijNn4YkrZYJfatQIdS+TrcK8rL5Xs24qw8=
+dev.gaijin.team/go/exhaustruct/v4 v4.0.0 h1:873r7aNneqoBB3IaFIzhvt2RFYTuHgmMjoKfwODoI1Y=
+dev.gaijin.team/go/exhaustruct/v4 v4.0.0/go.mod h1:aZ/k2o4Y05aMJtiux15x8iXaumE88YdiB0Ai4fXOzPI=
+dev.gaijin.team/go/golib v0.6.0 h1:v6nnznFTs4bppib/NyU1PQxobwDHwCXXl15P7DV5Zgo=
+dev.gaijin.team/go/golib v0.6.0/go.mod h1:uY1mShx8Z/aNHWDyAkZTkX+uCi5PdX7KsG1eDQa2AVE=
+dmitri.shuralyov.com/gpu/mtl v0.0.0-20190408044501-666a987793e9/go.mod h1:H6x//7gZCb22OMCxBHrMx7a5I7Hp++hsVxbQ4BYO7hU=
+github.com/4meepo/tagalign v1.4.3 h1:Bnu7jGWwbfpAie2vyl63Zup5KuRv21olsPIha53BJr8=
+github.com/4meepo/tagalign v1.4.3/go.mod h1:00WwRjiuSbrRJnSVeGWPLp2epS5Q/l4UEy0apLLS37c=
+github.com/Abirdcfly/dupword v0.1.7 h1:2j8sInznrje4I0CMisSL6ipEBkeJUJAmK1/lfoNGWrQ=
+github.com/Abirdcfly/dupword v0.1.7/go.mod h1:K0DkBeOebJ4VyOICFdppB23Q0YMOgVafM0zYW0n9lF4=
+github.com/AdminBenni/iota-mixing v1.0.0 h1:Os6lpjG2dp/AE5fYBPAA1zfa2qMdCAWwPMCgpwKq7wo=
+github.com/AdminBenni/iota-mixing v1.0.0/go.mod h1:i4+tpAaB+qMVIV9OK3m4/DAynOd5bQFaOu+2AhtBCNY=
+github.com/AlwxSin/noinlineerr v1.0.5 h1:RUjt63wk1AYWTXtVXbSqemlbVTb23JOSRiNsshj7TbY=
+github.com/AlwxSin/noinlineerr v1.0.5/go.mod h1:+QgkkoYrMH7RHvcdxdlI7vYYEdgeoFOVjU9sUhw/rQc=
+github.com/Antonboom/errname v1.1.1 h1:bllB7mlIbTVzO9jmSWVWLjxTEbGBVQ1Ff/ClQgtPw9Q=
+github.com/Antonboom/errname v1.1.1/go.mod h1:gjhe24xoxXp0ScLtHzjiXp0Exi1RFLKJb0bVBtWKCWQ=
+github.com/Antonboom/nilnil v1.1.1 h1:9Mdr6BYd8WHCDngQnNVV0b554xyisFioEKi30sksufQ=
+github.com/Antonboom/nilnil v1.1.1/go.mod h1:yCyAmSw3doopbOWhJlVci+HuyNRuHJKIv6V2oYQa8II=
+github.com/Antonboom/testifylint v1.6.4 h1:gs9fUEy+egzxkEbq9P4cpcMB6/G0DYdMeiFS87UiqmQ=
+github.com/Antonboom/testifylint v1.6.4/go.mod h1:YO33FROXX2OoUfwjz8g+gUxQXio5i9qpVy7nXGbxDD4=
+github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
+github.com/BurntSushi/toml v1.6.0 h1:dRaEfpa2VI55EwlIW72hMRHdWouJeRF7TPYhI+AUQjk=
+github.com/BurntSushi/toml v1.6.0/go.mod h1:ukJfTF/6rtPPRCnwkur4qwRxa8vTRFBF0uk2lLoLwho=
+github.com/BurntSushi/xgb v0.0.0-20160522181843-27f122750802/go.mod h1:IVnqGOEym/WlBOVXweHU+Q+/VP0lqqI8lqeDx9IjBqo=
+github.com/Djarvur/go-err113 v0.1.1 h1:eHfopDqXRwAi+YmCUas75ZE0+hoBHJ2GQNLYRSxao4g=
+github.com/Djarvur/go-err113 v0.1.1/go.mod h1:IaWJdYFLg76t2ihfflPZnM1LIQszWOsFDh2hhhAVF6k=
+github.com/Masterminds/semver/v3 v3.4.0 h1:Zog+i5UMtVoCU8oKka5P7i9q9HgrJeGzI9SA1Xbatp0=
+github.com/Masterminds/semver/v3 v3.4.0/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM=
+github.com/MirrexOne/unqueryvet v1.5.4 h1:38QOxShO7JmMWT+eCdDMbcUgGCOeJphVkzzRgyLJgsQ=
+github.com/MirrexOne/unqueryvet v1.5.4/go.mod h1:fs9Zq6eh1LRIhsDIsxf9PONVUjYdFHdtkHIgZdJnyPU=
+github.com/OpenPeeDeeP/depguard/v2 v2.2.1 h1:vckeWVESWp6Qog7UZSARNqfu/cZqvki8zsuj3piCMx4=
+github.com/OpenPeeDeeP/depguard/v2 v2.2.1/go.mod h1:q4DKzC4UcVaAvcfd41CZh0PWpGgzrVxUYBlgKNGquUo=
+github.com/alecthomas/assert/v2 v2.11.0 h1:2Q9r3ki8+JYXvGsDyBXwH3LcJ+WK5D0gc5E8vS6K3D0=
+github.com/alecthomas/assert/v2 v2.11.0/go.mod h1:Bze95FyfUr7x34QZrjL+XP+0qgp/zg8yS+TtBj1WA3k=
+github.com/alecthomas/chroma/v2 v2.23.1 h1:nv2AVZdTyClGbVQkIzlDm/rnhk1E9bU9nXwmZ/Vk/iY=
+github.com/alecthomas/chroma/v2 v2.23.1/go.mod h1:NqVhfBR0lte5Ouh3DcthuUCTUpDC9cxBOfyMbMQPs3o=
+github.com/alecthomas/go-check-sumtype v0.3.1 h1:u9aUvbGINJxLVXiFvHUlPEaD7VDULsrxJb4Aq31NLkU=
+github.com/alecthomas/go-check-sumtype v0.3.1/go.mod h1:A8TSiN3UPRw3laIgWEUOHHLPa6/r9MtoigdlP5h3K/E=
+github.com/alecthomas/repr v0.5.2 h1:SU73FTI9D1P5UNtvseffFSGmdNci/O6RsqzeXJtP0Qs=
+github.com/alecthomas/repr v0.5.2/go.mod h1:Fr0507jx4eOXV7AlPV6AVZLYrLIuIeSOWtW57eE/O/4=
+github.com/alecthomas/template v0.0.0-20160405071501-a0175ee3bccc/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
+github.com/alecthomas/template v0.0.0-20190718012654-fb15b899a751/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
+github.com/alecthomas/units v0.0.0-20151022065526-2efee857e7cf/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0=
+github.com/alecthomas/units v0.0.0-20190717042225-c3de453c63f4/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0=
+github.com/alecthomas/units v0.0.0-20190924025748-f65c72e2690d/go.mod h1:rBZYJk541a8SKzHPHnH3zbiI+7dagKZ0cgpgrD7Fyho=
+github.com/alexkohler/nakedret/v2 v2.0.6 h1:ME3Qef1/KIKr3kWX3nti3hhgNxw6aqN5pZmQiFSsuzQ=
+github.com/alexkohler/nakedret/v2 v2.0.6/go.mod h1:l3RKju/IzOMQHmsEvXwkqMDzHHvurNQfAgE1eVmT40Q=
+github.com/alexkohler/prealloc v1.1.0 h1:cKGRBqlXw5iyQGLYhrXrDlcHxugXpTq4tQ5c91wkf8M=
+github.com/alexkohler/prealloc v1.1.0/go.mod h1:fT39Jge3bQrfA7nPMDngUfvUbQGQeJyGQnR+913SCig=
+github.com/alfatraining/structtag v1.0.0 h1:2qmcUqNcCoyVJ0up879K614L9PazjBSFruTB0GOFjCc=
+github.com/alfatraining/structtag v1.0.0/go.mod h1:p3Xi5SwzTi+Ryj64DqjLWz7XurHxbGsq6y3ubePJPus=
+github.com/alingse/asasalint v0.0.11 h1:SFwnQXJ49Kx/1GghOFz1XGqHYKp21Kq1nHad/0WQRnw=
+github.com/alingse/asasalint v0.0.11/go.mod h1:nCaoMhw7a9kSJObvQyVzNTPBDbNpdocqrSP7t/cW5+I=
+github.com/alingse/nilnesserr v0.2.0 h1:raLem5KG7EFVb4UIDAXgrv3N2JIaffeKNtcEXkEWd/w=
+github.com/alingse/nilnesserr v0.2.0/go.mod h1:1xJPrXonEtX7wyTq8Dytns5P2hNzoWymVUIaKm4HNFg=
+github.com/ashanbrown/forbidigo/v2 v2.3.0 h1:OZZDOchCgsX5gvToVtEBoV2UWbFfI6RKQTir2UZzSxo=
+github.com/ashanbrown/forbidigo/v2 v2.3.0/go.mod h1:5p6VmsG5/1xx3E785W9fouMxIOkvY2rRV9nMdWadd6c=
+github.com/ashanbrown/makezero/v2 v2.1.0 h1:snuKYMbqosNokUKm+R6/+vOPs8yVAi46La7Ck6QYSaE=
+github.com/ashanbrown/makezero/v2 v2.1.0/go.mod h1:aEGT/9q3S8DHeE57C88z2a6xydvgx8J5hgXIGWgo0MY=
+github.com/aymanbagabas/go-osc52/v2 v2.0.1 h1:HwpRHbFMcZLEVr42D4p7XBqjyuxQH5SMiErDT4WkJ2k=
+github.com/aymanbagabas/go-osc52/v2 v2.0.1/go.mod h1:uYgXzlJ7ZpABp8OJ+exZzJJhRNQ2ASbcXHWsFqH8hp8=
+github.com/beorn7/perks v0.0.0-20180321164747-3a771d992973/go.mod h1:Dwedo/Wpr24TaqPxmxbtue+5NUziq4I4S80YR8gNf3Q=
+github.com/beorn7/perks v1.0.0/go.mod h1:KWe93zE9D1o94FZ5RNwFwVgaQK1VOXiVxmqh+CedLV8=
+github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
+github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
+github.com/bkielbasa/cyclop v1.2.3 h1:faIVMIGDIANuGPWH031CZJTi2ymOQBULs9H21HSMa5w=
+github.com/bkielbasa/cyclop v1.2.3/go.mod h1:kHTwA9Q0uZqOADdupvcFJQtp/ksSnytRMe8ztxG8Fuo=
+github.com/blizzy78/varnamelen v0.8.0 h1:oqSblyuQvFsW1hbBHh1zfwrKe3kcSj0rnXkKzsQ089M=
+github.com/blizzy78/varnamelen v0.8.0/go.mod h1:V9TzQZ4fLJ1DSrjVDfl89H7aMnTvKkApdHeyESmyR7k=
+github.com/bombsimon/wsl/v4 v4.7.0 h1:1Ilm9JBPRczjyUs6hvOPKvd7VL1Q++PL8M0SXBDf+jQ=
+github.com/bombsimon/wsl/v4 v4.7.0/go.mod h1:uV/+6BkffuzSAVYD+yGyld1AChO7/EuLrCF/8xTiapg=
+github.com/bombsimon/wsl/v5 v5.6.0 h1:4z+/sBqC5vUmSp1O0mS+czxwH9+LKXtCWtHH9rZGQL8=
+github.com/bombsimon/wsl/v5 v5.6.0/go.mod h1:Uqt2EfrMj2NV8UGoN1f1Y3m0NpUVCsUdrNCdet+8LvU=
+github.com/breml/bidichk v0.3.3 h1:WSM67ztRusf1sMoqH6/c4OBCUlRVTKq+CbSeo0R17sE=
+github.com/breml/bidichk v0.3.3/go.mod h1:ISbsut8OnjB367j5NseXEGGgO/th206dVa427kR8YTE=
+github.com/breml/errchkjson v0.4.1 h1:keFSS8D7A2T0haP9kzZTi7o26r7kE3vymjZNeNDRDwg=
+github.com/breml/errchkjson v0.4.1/go.mod h1:a23OvR6Qvcl7DG/Z4o0el6BRAjKnaReoPQFciAl9U3s=
+github.com/butuzov/ireturn v0.4.0 h1:+s76bF/PfeKEdbG8b54aCocxXmi0wvYdOVsWxVO7n8E=
+github.com/butuzov/ireturn v0.4.0/go.mod h1:ghI0FrCmap8pDWZwfPisFD1vEc56VKH4NpQUxDHta70=
+github.com/butuzov/mirror v1.3.0 h1:HdWCXzmwlQHdVhwvsfBb2Au0r3HyINry3bDWLYXiKoc=
+github.com/butuzov/mirror v1.3.0/go.mod h1:AEij0Z8YMALaq4yQj9CPPVYOyJQyiexpQEQgihajRfI=
+github.com/catenacyber/perfsprint v0.10.1 h1:u7Riei30bk46XsG8nknMhKLXG9BcXz3+3tl/WpKm0PQ=
+github.com/catenacyber/perfsprint v0.10.1/go.mod h1:DJTGsi/Zufpuus6XPGJyKOTMELe347o6akPvWG9Zcsc=
+github.com/ccojocar/zxcvbn-go v1.0.4 h1:FWnCIRMXPj43ukfX000kvBZvV6raSxakYr1nzyNrUcc=
+github.com/ccojocar/zxcvbn-go v1.0.4/go.mod h1:3GxGX+rHmueTUMvm5ium7irpyjmm7ikxYFOSJB21Das=
+github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
+github.com/cespare/xxhash/v2 v2.1.1/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
+github.com/cespare/xxhash/v2 v2.1.2/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
+github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
+github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
+github.com/charithe/durationcheck v0.0.11 h1:g1/EX1eIiKS57NTWsYtHDZ/APfeXKhye1DidBcABctk=
+github.com/charithe/durationcheck v0.0.11/go.mod h1:x5iZaixRNl8ctbM+3B2RrPG5t856TxRyVQEnbIEM2X4=
+github.com/charmbracelet/colorprofile v0.2.3-0.20250311203215-f60798e515dc h1:4pZI35227imm7yK2bGPcfpFEmuY1gc2YSTShr4iJBfs=
+github.com/charmbracelet/colorprofile v0.2.3-0.20250311203215-f60798e515dc/go.mod h1:X4/0JoqgTIPSFcRA/P6INZzIuyqdFY5rm8tb41s9okk=
+github.com/charmbracelet/lipgloss v1.1.0 h1:vYXsiLHVkK7fp74RkV7b2kq9+zDLoEU4MZoFqR/noCY=
+github.com/charmbracelet/lipgloss v1.1.0/go.mod h1:/6Q8FR2o+kj8rz4Dq0zQc3vYf7X+B0binUUBwA0aL30=
+github.com/charmbracelet/x/ansi v0.10.1 h1:rL3Koar5XvX0pHGfovN03f5cxLbCF2YvLeyz7D2jVDQ=
+github.com/charmbracelet/x/ansi v0.10.1/go.mod h1:3RQDQ6lDnROptfpWuUVIUG64bD2g2BgntdxH0Ya5TeE=
+github.com/charmbracelet/x/cellbuf v0.0.13-0.20250311204145-2c3ea96c31dd h1:vy0GVL4jeHEwG5YOXDmi86oYw2yuYUGqz6a8sLwg0X8=
+github.com/charmbracelet/x/cellbuf v0.0.13-0.20250311204145-2c3ea96c31dd/go.mod h1:xe0nKWGd3eJgtqZRaN9RjMtK7xUYchjzPr7q6kcvCCs=
+github.com/charmbracelet/x/term v0.2.1 h1:AQeHeLZ1OqSXhrAWpYUtZyX1T3zVxfpZuEQMIQaGIAQ=
+github.com/charmbracelet/x/term v0.2.1/go.mod h1:oQ4enTYFV7QN4m0i9mzHrViD7TQKvNEEkHUMCmsxdUg=
+github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWRnGsAI=
+github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e/go.mod h1:nSuG5e5PlCu98SY8svDHJxuZscDgtXS6KTTbou5AhLI=
+github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU=
+github.com/ckaznocha/intrange v0.3.1 h1:j1onQyXvHUsPWujDH6WIjhyH26gkRt/txNlV7LspvJs=
+github.com/ckaznocha/intrange v0.3.1/go.mod h1:QVepyz1AkUoFQkpEqksSYpNpUo3c5W7nWh/s6SHIJJk=
+github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
+github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
+github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
+github.com/curioswitch/go-reassign v0.3.0 h1:dh3kpQHuADL3cobV/sSGETA8DOv457dwl+fbBAhrQPs=
+github.com/curioswitch/go-reassign v0.3.0/go.mod h1:nApPCCTtqLJN/s8HfItCcKV0jIPwluBOvZP+dsJGA88=
+github.com/daixiang0/gci v0.13.7 h1:+0bG5eK9vlI08J+J/NWGbWPTNiXPG4WhNLJOkSxWITQ=
+github.com/daixiang0/gci v0.13.7/go.mod h1:812WVN6JLFY9S6Tv76twqmNqevN0pa3SX3nih0brVzQ=
+github.com/dave/dst v0.27.3 h1:P1HPoMza3cMEquVf9kKy8yXsFirry4zEnWOdYPOoIzY=
+github.com/dave/dst v0.27.3/go.mod h1:jHh6EOibnHgcUW3WjKHisiooEkYwqpHLBSX1iOBhEyc=
+github.com/dave/jennifer v1.7.1 h1:B4jJJDHelWcDhlRQxWeo0Npa/pYKBLrirAQoTN45txo=
+github.com/dave/jennifer v1.7.1/go.mod h1:nXbxhEmQfOZhWml3D1cDK5M1FLnMSozpbFN/m3RmGZc=
+github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/denis-tingaikin/go-header v0.5.0 h1:SRdnP5ZKvcO9KKRP1KJrhFR3RrlGuD+42t4429eC9k8=
+github.com/denis-tingaikin/go-header v0.5.0/go.mod h1:mMenU5bWrok6Wl2UsZjy+1okegmwQ3UgWl4V1D8gjlY=
+github.com/dlclark/regexp2 v1.11.5 h1:Q/sSnsKerHeCkc/jSTNq1oCm7KiVgUMZRDUoRu0JQZQ=
+github.com/dlclark/regexp2 v1.11.5/go.mod h1:DHkYz0B9wPfa6wondMfaivmHpzrQ3v9q8cnmRbL6yW8=
+github.com/envoyproxy/go-control-plane v0.9.0/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
+github.com/envoyproxy/go-control-plane v0.9.1-0.20191026205805-5f8ba28d4473/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
+github.com/envoyproxy/go-control-plane v0.9.4/go.mod h1:6rpuAdCZL397s3pYoYcLgu1mIlRU8Am5FuJP05cCM98=
+github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
+github.com/ettle/strcase v0.2.0 h1:fGNiVF21fHXpX1niBgk0aROov1LagYsOwV/xqKDKR/Q=
+github.com/ettle/strcase v0.2.0/go.mod h1:DajmHElDSaX76ITe3/VHVyMin4LWSJN5Z909Wp+ED1A=
+github.com/fatih/color v1.18.0 h1:S8gINlzdQ840/4pfAwic/ZE0djQEH3wM94VfqLTZcOM=
+github.com/fatih/color v1.18.0/go.mod h1:4FelSpRwEGDpQ12mAdzqdOukCy4u8WUtOY6lkT/6HfU=
+github.com/fatih/structtag v1.2.0 h1:/OdNE99OxoI/PqaW/SuSK9uxxT3f/tcSZgon/ssNSx4=
+github.com/fatih/structtag v1.2.0/go.mod h1:mBJUNpUnHmRKrKlQQlmCrh5PuhftFbNv8Ys4/aAZl94=
+github.com/firefart/nonamedreturns v1.0.6 h1:vmiBcKV/3EqKY3ZiPxCINmpS431OcE1S47AQUwhrg8E=
+github.com/firefart/nonamedreturns v1.0.6/go.mod h1:R8NisJnSIpvPWheCq0mNRXJok6D8h7fagJTF8EMEwCo=
+github.com/frankban/quicktest v1.14.3 h1:FJKSZTDHjyhriyC81FLQ0LY93eSai0ZyR/ZIkd3ZUKE=
+github.com/frankban/quicktest v1.14.3/go.mod h1:mgiwOwqx65TmIk1wJ6Q7wvnVMocbUorkibMOrVTHZps=
+github.com/fsnotify/fsnotify v1.5.4 h1:jRbGcIw6P2Meqdwuo0H1p6JVLbL5DHKAKlYndzMwVZI=
+github.com/fsnotify/fsnotify v1.5.4/go.mod h1:OVB6XrOHzAwXMpEM7uPOzcehqUV2UqJxmVXmkdnm1bU=
+github.com/fzipp/gocyclo v0.6.0 h1:lsblElZG7d3ALtGMx9fmxeTKZaLLpU8mET09yN4BBLo=
+github.com/fzipp/gocyclo v0.6.0/go.mod h1:rXPyn8fnlpa0R2csP/31uerbiVBugk5whMdlyaLkLoA=
+github.com/ghostiam/protogetter v0.3.20 h1:oW7OPFit2FxZOpmMRPP9FffU4uUpfeE/rEdE1f+MzD0=
+github.com/ghostiam/protogetter v0.3.20/go.mod h1:FjIu5Yfs6FT391m+Fjp3fbAYJ6rkL/J6ySpZBfnODuI=
+github.com/go-critic/go-critic v0.14.3 h1:5R1qH2iFeo4I/RJU8vTezdqs08Egi4u5p6vOESA0pog=
+github.com/go-critic/go-critic v0.14.3/go.mod h1:xwntfW6SYAd7h1OqDzmN6hBX/JxsEKl5up/Y2bsxgVQ=
+github.com/go-gl/glfw v0.0.0-20190409004039-e6da0acd62b1/go.mod h1:vR7hzQXu2zJy9AVAgeJqvqgH9Q5CA+iKCZ2gyEVpxRU=
+github.com/go-gl/glfw/v3.3/glfw v0.0.0-20191125211704-12ad95a8df72/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
+github.com/go-gl/glfw/v3.3/glfw v0.0.0-20200222043503-6f7a984d4dc4/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
+github.com/go-kit/kit v0.8.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
+github.com/go-kit/kit v0.9.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
+github.com/go-kit/log v0.1.0/go.mod h1:zbhenjAZHb184qTLMA9ZjW7ThYL0H2mk7Q6pNt4vbaY=
+github.com/go-logfmt/logfmt v0.3.0/go.mod h1:Qt1PoO58o5twSAckw1HlFXLmHsOX5/0LbT9GBnD5lWE=
+github.com/go-logfmt/logfmt v0.4.0/go.mod h1:3RMwSq7FuexP4Kalkev3ejPJsZTpXXBr9+V4qmtdjCk=
+github.com/go-logfmt/logfmt v0.5.0/go.mod h1:wCYkCAKZfumFQihp8CzCvQ3paCTfi41vtzG1KdI/P7A=
+github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
+github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/go-quicktest/qt v1.101.0 h1:O1K29Txy5P2OK0dGo59b7b0LR6wKfIhttaAhHUyn7eI=
+github.com/go-quicktest/qt v1.101.0/go.mod h1:14Bz/f7NwaXPtdYEgzsx46kqSxVwTbzVZsDC26tQJow=
+github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
+github.com/go-task/slim-sprig/v3 v3.0.0 h1:sUs3vkvUymDpBKi3qH1YSqBQk9+9D/8M2mN1vB6EwHI=
+github.com/go-task/slim-sprig/v3 v3.0.0/go.mod h1:W848ghGpv3Qj3dhTPRyJypKRiqCdHZiAzKg9hl15HA8=
+github.com/go-toolsmith/astcast v1.1.0 h1:+JN9xZV1A+Re+95pgnMgDboWNVnIMMQXwfBwLRPgSC8=
+github.com/go-toolsmith/astcast v1.1.0/go.mod h1:qdcuFWeGGS2xX5bLM/c3U9lewg7+Zu4mr+xPwZIB4ZU=
+github.com/go-toolsmith/astcopy v1.1.0 h1:YGwBN0WM+ekI/6SS6+52zLDEf8Yvp3n2seZITCUBt5s=
+github.com/go-toolsmith/astcopy v1.1.0/go.mod h1:hXM6gan18VA1T/daUEHCFcYiW8Ai1tIwIzHY6srfEAw=
+github.com/go-toolsmith/astequal v1.0.3/go.mod h1:9Ai4UglvtR+4up+bAD4+hCj7iTo4m/OXVTSLnCyTAx4=
+github.com/go-toolsmith/astequal v1.1.0/go.mod h1:sedf7VIdCL22LD8qIvv7Nn9MuWJruQA/ysswh64lffQ=
+github.com/go-toolsmith/astequal v1.2.0 h1:3Fs3CYZ1k9Vo4FzFhwwewC3CHISHDnVUPC4x0bI2+Cw=
+github.com/go-toolsmith/astequal v1.2.0/go.mod h1:c8NZ3+kSFtFY/8lPso4v8LuJjdJiUFVnSuU3s0qrrDY=
+github.com/go-toolsmith/astfmt v1.1.0 h1:iJVPDPp6/7AaeLJEruMsBUlOYCmvg0MoCfJprsOmcco=
+github.com/go-toolsmith/astfmt v1.1.0/go.mod h1:OrcLlRwu0CuiIBp/8b5PYF9ktGVZUjlNMV634mhwuQ4=
+github.com/go-toolsmith/astp v1.1.0 h1:dXPuCl6u2llURjdPLLDxJeZInAeZ0/eZwFJmqZMnpQA=
+github.com/go-toolsmith/astp v1.1.0/go.mod h1:0T1xFGz9hicKs8Z5MfAqSUitoUYS30pDMsRVIDHs8CA=
+github.com/go-toolsmith/pkgload v1.2.2 h1:0CtmHq/02QhxcF7E9N5LIFcYFsMR5rdovfqTtRKkgIk=
+github.com/go-toolsmith/pkgload v1.2.2/go.mod h1:R2hxLNRKuAsiXCo2i5J6ZQPhnPMOVtU+f0arbFPWCus=
+github.com/go-toolsmith/strparse v1.0.0/go.mod h1:YI2nUKP9YGZnL/L1/DLFBfixrcjslWct4wyljWhSRy8=
+github.com/go-toolsmith/strparse v1.1.0 h1:GAioeZUK9TGxnLS+qfdqNbA4z0SSm5zVNtCQiyP2Bvw=
+github.com/go-toolsmith/strparse v1.1.0/go.mod h1:7ksGy58fsaQkGQlY8WVoBFNyEPMGuJin1rfoPS4lBSQ=
+github.com/go-toolsmith/typep v1.1.0 h1:fIRYDyF+JywLfqzyhdiHzRop/GQDxxNhLGQ6gFUNHus=
+github.com/go-toolsmith/typep v1.1.0/go.mod h1:fVIw+7zjdsMxDA3ITWnH1yOiw1rnTQKCsF/sk2H/qig=
+github.com/go-viper/mapstructure/v2 v2.5.0 h1:vM5IJoUAy3d7zRSVtIwQgBj7BiWtMPfmPEgAXnvj1Ro=
+github.com/go-viper/mapstructure/v2 v2.5.0/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM=
+github.com/go-xmlfmt/xmlfmt v1.1.3 h1:t8Ey3Uy7jDSEisW2K3somuMKIpzktkWptA0iFCnRUWY=
+github.com/go-xmlfmt/xmlfmt v1.1.3/go.mod h1:aUCEOzzezBEjDBbFBoSiya/gduyIiWYRP6CnSFIV8AM=
+github.com/gobwas/glob v0.2.3 h1:A4xDbljILXROh+kObIiy5kIaPYD8e96x1tgBhUI5J+Y=
+github.com/gobwas/glob v0.2.3/go.mod h1:d3Ez4x06l9bZtSvzIay5+Yzi0fmZzPgnTbPcKjJAkT8=
+github.com/godoc-lint/godoc-lint v0.11.2 h1:Bp0FkJWoSdNsBikdNgIcgtaoo+xz6I/Y9s5WSBQUeeM=
+github.com/godoc-lint/godoc-lint v0.11.2/go.mod h1:iVpGdL1JCikNH2gGeAn3Hh+AgN5Gx/I/cxV+91L41jo=
+github.com/gofrs/flock v0.13.0 h1:95JolYOvGMqeH31+FC7D2+uULf6mG61mEZ/A8dRYMzw=
+github.com/gofrs/flock v0.13.0/go.mod h1:jxeyy9R1auM5S6JYDBhDt+E2TCo7DkratH4Pgi8P+Z0=
+github.com/gogo/protobuf v1.1.1/go.mod h1:r8qH/GZQm5c6nD/R0oafs1akxWv10x8SbQlK7atdtwQ=
+github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
+github.com/golang/groupcache v0.0.0-20190702054246-869f871628b6/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
+github.com/golang/groupcache v0.0.0-20191227052852-215e87163ea7/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
+github.com/golang/groupcache v0.0.0-20200121045136-8c9f03a8e57e/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
+github.com/golang/mock v1.1.1/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
+github.com/golang/mock v1.2.0/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
+github.com/golang/mock v1.3.1/go.mod h1:sBzyDLLjw3U8JLTeZvSv8jJB+tU5PVekmnlKIyFUx0Y=
+github.com/golang/mock v1.4.0/go.mod h1:UOMv5ysSaYNkG+OFQykRIcU/QvvxJf3p21QfJ2Bt3cw=
+github.com/golang/mock v1.4.1/go.mod h1:UOMv5ysSaYNkG+OFQykRIcU/QvvxJf3p21QfJ2Bt3cw=
+github.com/golang/mock v1.4.3/go.mod h1:UOMv5ysSaYNkG+OFQykRIcU/QvvxJf3p21QfJ2Bt3cw=
+github.com/golang/mock v1.4.4/go.mod h1:l3mdAwkq5BuhzHwde/uurv3sEJeZMXNpwsxVWU71h+4=
+github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
+github.com/golang/protobuf v1.3.1/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
+github.com/golang/protobuf v1.3.2/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
+github.com/golang/protobuf v1.3.3/go.mod h1:vzj43D7+SQXF/4pzW/hwtAqwc6iTitCiVSaWz5lYuqw=
+github.com/golang/protobuf v1.3.4/go.mod h1:vzj43D7+SQXF/4pzW/hwtAqwc6iTitCiVSaWz5lYuqw=
+github.com/golang/protobuf v1.3.5/go.mod h1:6O5/vntMXwX2lRkT1hjjk0nAC1IDOTvTlVgjlRvqsdk=
+github.com/golang/protobuf v1.4.0-rc.1/go.mod h1:ceaxUfeHdC40wWswd/P6IGgMaK3YpKi5j83Wpe3EHw8=
+github.com/golang/protobuf v1.4.0-rc.1.0.20200221234624-67d41d38c208/go.mod h1:xKAWHe0F5eneWXFV3EuXVDTCmh+JuBKY0li0aMyXATA=
+github.com/golang/protobuf v1.4.0-rc.2/go.mod h1:LlEzMj4AhA7rCAGe4KMBDvJI+AwstrUpVNzEA03Pprs=
+github.com/golang/protobuf v1.4.0-rc.4.0.20200313231945-b860323f09d0/go.mod h1:WU3c8KckQ9AFe+yFwt9sWVRKCVIyN9cPHBJSNnbL67w=
+github.com/golang/protobuf v1.4.0/go.mod h1:jodUvKwWbYaEsadDk5Fwe5c77LiNKVO9IDvqG2KuDX0=
+github.com/golang/protobuf v1.4.1/go.mod h1:U8fpvMrcmy5pZrNK1lt4xCsGvpyWQ/VVv6QDs8UjoX8=
+github.com/golang/protobuf v1.4.2/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
+github.com/golang/protobuf v1.4.3/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
+github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
+github.com/golang/protobuf v1.5.2/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
+github.com/golang/protobuf v1.5.3 h1:KhyjKVUg7Usr/dYsdSqoFveMYd5ko72D+zANwlG1mmg=
+github.com/golang/protobuf v1.5.3/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
+github.com/golangci/asciicheck v0.5.0 h1:jczN/BorERZwK8oiFBOGvlGPknhvq0bjnysTj4nUfo0=
+github.com/golangci/asciicheck v0.5.0/go.mod h1:5RMNAInbNFw2krqN6ibBxN/zfRFa9S6tA1nPdM0l8qQ=
+github.com/golangci/dupl v0.0.0-20250308024227-f665c8d69b32 h1:WUvBfQL6EW/40l6OmeSBYQJNSif4O11+bmWEz+C7FYw=
+github.com/golangci/dupl v0.0.0-20250308024227-f665c8d69b32/go.mod h1:NUw9Zr2Sy7+HxzdjIULge71wI6yEg1lWQr7Evcu8K0E=
+github.com/golangci/go-printf-func-name v0.1.1 h1:hIYTFJqAGp1iwoIfsNTpoq1xZAarogrvjO9AfiW3B4U=
+github.com/golangci/go-printf-func-name v0.1.1/go.mod h1:Es64MpWEZbh0UBtTAICOZiB+miW53w/K9Or/4QogJss=
+github.com/golangci/gofmt v0.0.0-20250106114630-d62b90e6713d h1:viFft9sS/dxoYY0aiOTsLKO2aZQAPT4nlQCsimGcSGE=
+github.com/golangci/gofmt v0.0.0-20250106114630-d62b90e6713d/go.mod h1:ivJ9QDg0XucIkmwhzCDsqcnxxlDStoTl89jDMIoNxKY=
+github.com/golangci/golangci-lint/v2 v2.11.3 h1:ySX1GtLwlwOEzcLKJifI/aIVesrcHDno+5mrro8rWes=
+github.com/golangci/golangci-lint/v2 v2.11.3/go.mod h1:HmDEVZuxz77cNLumPfNNHAFyMX/b7IbA0tpmAbwiVfo=
+github.com/golangci/golines v0.15.0 h1:Qnph25g8Y1c5fdo1X7GaRDGgnMHgnxh4Gk4VfPTtRx0=
+github.com/golangci/golines v0.15.0/go.mod h1:AZjXd23tbHMpowhtnGlj9KCNsysj72aeZVVHnVcZx10=
+github.com/golangci/misspell v0.8.0 h1:qvxQhiE2/5z+BVRo1kwYA8yGz+lOlu5Jfvtx2b04Jbg=
+github.com/golangci/misspell v0.8.0/go.mod h1:WZyyI2P3hxPY2UVHs3cS8YcllAeyfquQcKfdeE9AFVg=
+github.com/golangci/plugin-module-register v0.1.2 h1:e5WM6PO6NIAEcij3B053CohVp3HIYbzSuP53UAYgOpg=
+github.com/golangci/plugin-module-register v0.1.2/go.mod h1:1+QGTsKBvAIvPvoY/os+G5eoqxWn70HYDm2uvUyGuVw=
+github.com/golangci/revgrep v0.8.0 h1:EZBctwbVd0aMeRnNUsFogoyayvKHyxlV3CdUA46FX2s=
+github.com/golangci/revgrep v0.8.0/go.mod h1:U4R/s9dlXZsg8uJmaR1GrloUr14D7qDl8gi2iPXJH8k=
+github.com/golangci/swaggoswag v0.0.0-20250504205917-77f2aca3143e h1:ai0EfmVYE2bRA5htgAG9r7s3tHsfjIhN98WshBTJ9jM=
+github.com/golangci/swaggoswag v0.0.0-20250504205917-77f2aca3143e/go.mod h1:Vrn4B5oR9qRwM+f54koyeH3yzphlecwERs0el27Fr/s=
+github.com/golangci/unconvert v0.0.0-20250410112200-a129a6e6413e h1:gD6P7NEo7Eqtt0ssnqSJNNndxe69DOQ24A5h7+i3KpM=
+github.com/golangci/unconvert v0.0.0-20250410112200-a129a6e6413e/go.mod h1:h+wZwLjUTJnm/P2rwlbJdRPZXOzaT36/FwnPnY2inzc=
+github.com/google/btree v0.0.0-20180813153112-4030bb1f1f0c/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
+github.com/google/btree v1.0.0/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
+github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M=
+github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
+github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
+github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.4.1/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.5.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.5.1/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.5.2/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.5.4/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.5.8/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
+github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
+github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
+github.com/google/martian v2.1.0+incompatible/go.mod h1:9I4somxYTbIHy5NJKHRl3wXiIaQGbYVAs8BPL6v8lEs=
+github.com/google/martian/v3 v3.0.0/go.mod h1:y5Zk1BBys9G+gd6Jrk0W3cC1+ELVxBWuIGO+w/tUAp0=
+github.com/google/pprof v0.0.0-20181206194817-3ea8567a2e57/go.mod h1:zfwlbNMJ+OItoe0UupaVj+oy1omPYYDuagoSzA8v9mc=
+github.com/google/pprof v0.0.0-20190515194954-54271f7e092f/go.mod h1:zfwlbNMJ+OItoe0UupaVj+oy1omPYYDuagoSzA8v9mc=
+github.com/google/pprof v0.0.0-20191218002539-d4f498aebedc/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
+github.com/google/pprof v0.0.0-20200212024743-f11f1df84d12/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
+github.com/google/pprof v0.0.0-20200229191704-1ebb73c60ed3/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
+github.com/google/pprof v0.0.0-20200430221834-fc25d7d30c6d/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
+github.com/google/pprof v0.0.0-20200708004538-1a94d8640e99/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
+github.com/google/pprof v0.0.0-20260115054156-294ebfa9ad83 h1:z2ogiKUYzX5Is6zr/vP9vJGqPwcdqsWjOt+V8J7+bTc=
+github.com/google/pprof v0.0.0-20260115054156-294ebfa9ad83/go.mod h1:MxpfABSjhmINe3F1It9d+8exIHFvUqtLIRCdOGNXqiI=
+github.com/google/renameio v0.1.0/go.mod h1:KWCgfxg9yswjAJkECMjeO8J8rahYeXnNhOm40UhjYkI=
+github.com/googleapis/gax-go/v2 v2.0.4/go.mod h1:0Wqv26UfaUD9n4G6kQubkQ+KchISgw+vpHVxEJEs9eg=
+github.com/googleapis/gax-go/v2 v2.0.5/go.mod h1:DWXyrwAJ9X0FpwwEdw+IPEYBICEFu5mhpdKc/us6bOk=
+github.com/gordonklaus/ineffassign v0.2.0 h1:Uths4KnmwxNJNzq87fwQQDDnbNb7De00VOk9Nu0TySs=
+github.com/gordonklaus/ineffassign v0.2.0/go.mod h1:TIpymnagPSexySzs7F9FnO1XFTy8IT3a59vmZp5Y9Lw=
+github.com/gostaticanalysis/analysisutil v0.7.1 h1:ZMCjoue3DtDWQ5WyU16YbjbQEQ3VuzwxALrpYd+HeKk=
+github.com/gostaticanalysis/analysisutil v0.7.1/go.mod h1:v21E3hY37WKMGSnbsw2S/ojApNWb6C1//mXO48CXbVc=
+github.com/gostaticanalysis/comment v1.4.2/go.mod h1:KLUTGDv6HOCotCH8h2erHKmpci2ZoR8VPu34YA2uzdM=
+github.com/gostaticanalysis/comment v1.5.0 h1:X82FLl+TswsUMpMh17srGRuKaaXprTaytmEpgnKIDu8=
+github.com/gostaticanalysis/comment v1.5.0/go.mod h1:V6eb3gpCv9GNVqb6amXzEUX3jXLVK/AdA+IrAMSqvEc=
+github.com/gostaticanalysis/forcetypeassert v0.2.0 h1:uSnWrrUEYDr86OCxWa4/Tp2jeYDlogZiZHzGkWFefTk=
+github.com/gostaticanalysis/forcetypeassert v0.2.0/go.mod h1:M5iPavzE9pPqWyeiVXSFghQjljW1+l/Uke3PXHS6ILY=
+github.com/gostaticanalysis/nilerr v0.1.2 h1:S6nk8a9N8g062nsx63kUkF6AzbHGw7zzyHMcpu52xQU=
+github.com/gostaticanalysis/nilerr v0.1.2/go.mod h1:A19UHhoY3y8ahoL7YKz6sdjDtduwTSI4CsymaC2htPA=
+github.com/gostaticanalysis/testutil v0.3.1-0.20210208050101-bfb5c8eec0e4/go.mod h1:D+FIZ+7OahH3ePw/izIEeH5I06eKs1IKI4Xr64/Am3M=
+github.com/gostaticanalysis/testutil v0.5.0 h1:Dq4wT1DdTwTGCQQv3rl3IvD5Ld0E6HiY+3Zh0sUGqw8=
+github.com/gostaticanalysis/testutil v0.5.0/go.mod h1:OLQSbuM6zw2EvCcXTz1lVq5unyoNft372msDY0nY5Hs=
+github.com/hashicorp/go-immutable-radix/v2 v2.1.0 h1:CUW5RYIcysz+D3B+l1mDeXrQ7fUvGGCwJfdASSzbrfo=
+github.com/hashicorp/go-immutable-radix/v2 v2.1.0/go.mod h1:hgdqLXA4f6NIjRVisM1TJ9aOJVNRqKZj+xDGF6m7PBw=
+github.com/hashicorp/go-uuid v1.0.3 h1:2gKiV6YVmrJ1i2CKKa9obLvRieoRGviZFL26PcT/Co8=
+github.com/hashicorp/go-uuid v1.0.3/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
+github.com/hashicorp/go-version v1.2.1/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09ZGVZPK5anwXA=
+github.com/hashicorp/go-version v1.8.0 h1:KAkNb1HAiZd1ukkxDFGmokVZe1Xy9HG6NUp+bPle2i4=
+github.com/hashicorp/go-version v1.8.0/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09ZGVZPK5anwXA=
+github.com/hashicorp/golang-lru v0.5.0/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
+github.com/hashicorp/golang-lru v0.5.1/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
+github.com/hashicorp/golang-lru/v2 v2.0.7 h1:a+bsQ5rvGLjzHuww6tVxozPZFVghXaHOwFs4luLUK2k=
+github.com/hashicorp/golang-lru/v2 v2.0.7/go.mod h1:QeFd9opnmA6QUJc5vARoKUSoFhyfM2/ZepoAG6RGpeM=
+github.com/hashicorp/hcl v1.0.0 h1:0Anlzjpi4vEasTeNFn2mLJgTSwt0+6sfsiTG8qcWGx4=
+github.com/hashicorp/hcl v1.0.0/go.mod h1:E5yfLk+7swimpb2L/Alb/PJmXilQ/rhwaUYs4T20WEQ=
+github.com/hexops/gotextdiff v1.0.3 h1:gitA9+qJrrTCsiCl7+kh75nPqQt1cx4ZkudSTLoUqJM=
+github.com/hexops/gotextdiff v1.0.3/go.mod h1:pSWU5MAI3yDq+fZBTazCSJysOMbxWL1BSow5/V2vxeg=
+github.com/ianlancetaylor/demangle v0.0.0-20181102032728-5e5cf60278f6/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc=
+github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
+github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
+github.com/jgautheron/goconst v1.8.2 h1:y0XF7X8CikZ93fSNT6WBTb/NElBu9IjaY7CCYQrCMX4=
+github.com/jgautheron/goconst v1.8.2/go.mod h1:A0oxgBCHy55NQn6sYpO7UdnA9p+h7cPtoOZUmvNIako=
+github.com/jingyugao/rowserrcheck v1.1.1 h1:zibz55j/MJtLsjP1OF4bSdgXxwL1b+Vn7Tjzq7gFzUs=
+github.com/jingyugao/rowserrcheck v1.1.1/go.mod h1:4yvlZSDb3IyDTUZJUmpZfm2Hwok+Dtp+nu2qOq+er9c=
+github.com/jjti/go-spancheck v0.6.5 h1:lmi7pKxa37oKYIMScialXUK6hP3iY5F1gu+mLBPgYB8=
+github.com/jjti/go-spancheck v0.6.5/go.mod h1:aEogkeatBrbYsyW6y5TgDfihCulDYciL1B7rG2vSsrU=
+github.com/jpillora/backoff v1.0.0/go.mod h1:J/6gKK9jxlEcS3zixgDgUAsiuZ7yrSoa/FX5e0EB2j4=
+github.com/json-iterator/go v1.1.6/go.mod h1:+SdeFBvtyEkXs7REEP0seUULqWtbJapLOCVDaaPEHmU=
+github.com/json-iterator/go v1.1.10/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
+github.com/json-iterator/go v1.1.11/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
+github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
+github.com/jstemmer/go-junit-report v0.0.0-20190106144839-af01ea7f8024/go.mod h1:6v2b51hI/fHJwM22ozAgKL4VKDeJcHhJFhtBdhmNjmU=
+github.com/jstemmer/go-junit-report v0.9.1/go.mod h1:Brl9GWCQeLvo8nXZwPNNblvFj/XSXhF0NWZEnDohbsk=
+github.com/julienschmidt/httprouter v1.2.0/go.mod h1:SYymIcj16QtmaHHD7aYtjjsJG7VTCxuUUipMqKk8s4w=
+github.com/julienschmidt/httprouter v1.3.0/go.mod h1:JR6WtHb+2LUe8TCKY3cZOxFyyO8IZAc4RVcycCCAKdM=
+github.com/julz/importas v0.2.0 h1:y+MJN/UdL63QbFJHws9BVC5RpA2iq0kpjrFajTGivjQ=
+github.com/julz/importas v0.2.0/go.mod h1:pThlt589EnCYtMnmhmRYY/qn9lCf/frPOK+WMx3xiJY=
+github.com/karamaru-alpha/copyloopvar v1.2.2 h1:yfNQvP9YaGQR7VaWLYcfZUlRP2eo2vhExWKxD/fP6q0=
+github.com/karamaru-alpha/copyloopvar v1.2.2/go.mod h1:oY4rGZqZ879JkJMtX3RRkcXRkmUvH0x35ykgaKgsgJY=
+github.com/kisielk/errcheck v1.10.0 h1:Lvs/YAHP24YKg08LA8oDw2z9fJVme090RAXd90S+rrw=
+github.com/kisielk/errcheck v1.10.0/go.mod h1:kQxWMMVZgIkDq7U8xtG/n2juOjbLgZtedi0D+/VL/i8=
+github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
+github.com/kkHAIKE/contextcheck v1.1.6 h1:7HIyRcnyzxL9Lz06NGhiKvenXq7Zw6Q0UQu/ttjfJCE=
+github.com/kkHAIKE/contextcheck v1.1.6/go.mod h1:3dDbMRNBFaq8HFXWC1JyvDSPm43CmE6IuHam8Wr0rkg=
+github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
+github.com/konsorten/go-windows-terminal-sequences v1.0.3/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
+github.com/kr/logfmt v0.0.0-20140226030751-b84e30acd515/go.mod h1:+0opPa2QZZtGFBFZlji/RkVcI2GknAs/DXo4wKdlNEc=
+github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
+github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
+github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
+github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
+github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
+github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
+github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
+github.com/kulti/thelper v0.7.1 h1:fI8QITAoFVLx+y+vSyuLBP+rcVIB8jKooNSCT2EiI98=
+github.com/kulti/thelper v0.7.1/go.mod h1:NsMjfQEy6sd+9Kfw8kCP61W1I0nerGSYSFnGaxQkcbs=
+github.com/kunwardeep/paralleltest v1.0.15 h1:ZMk4Qt306tHIgKISHWFJAO1IDQJLc6uDyJMLyncOb6w=
+github.com/kunwardeep/paralleltest v1.0.15/go.mod h1:di4moFqtfz3ToSKxhNjhOZL+696QtJGCFe132CbBLGk=
+github.com/lasiar/canonicalheader v1.1.2 h1:vZ5uqwvDbyJCnMhmFYimgMZnJMjwljN5VGY0VKbMXb4=
+github.com/lasiar/canonicalheader v1.1.2/go.mod h1:qJCeLFS0G/QlLQ506T+Fk/fWMa2VmBUiEI2cuMK4djI=
+github.com/ldez/exptostd v0.4.5 h1:kv2ZGUVI6VwRfp/+bcQ6Nbx0ghFWcGIKInkG/oFn1aQ=
+github.com/ldez/exptostd v0.4.5/go.mod h1:QRjHRMXJrCTIm9WxVNH6VW7oN7KrGSht69bIRwvdFsM=
+github.com/ldez/gomoddirectives v0.8.0 h1:JqIuTtgvFC2RdH1s357vrE23WJF2cpDCPFgA/TWDGpk=
+github.com/ldez/gomoddirectives v0.8.0/go.mod h1:jutzamvZR4XYJLr0d5Honycp4Gy6GEg2mS9+2YX3F1Q=
+github.com/ldez/grignotin v0.10.1 h1:keYi9rYsgbvqAZGI1liek5c+jv9UUjbvdj3Tbn5fn4o=
+github.com/ldez/grignotin v0.10.1/go.mod h1:UlDbXFCARrXbWGNGP3S5vsysNXAPhnSuBufpTEbwOas=
+github.com/ldez/structtags v0.6.1 h1:bUooFLbXx41tW8SvkfwfFkkjPYvFFs59AAMgVg6DUBk=
+github.com/ldez/structtags v0.6.1/go.mod h1:YDxVSgDy/MON6ariaxLF2X09bh19qL7MtGBN5MrvbdY=
+github.com/ldez/tagliatelle v0.7.2 h1:KuOlL70/fu9paxuxbeqlicJnCspCRjH0x8FW+NfgYUk=
+github.com/ldez/tagliatelle v0.7.2/go.mod h1:PtGgm163ZplJfZMZ2sf5nhUT170rSuPgBimoyYtdaSI=
+github.com/ldez/usetesting v0.5.0 h1:3/QtzZObBKLy1F4F8jLuKJiKBjjVFi1IavpoWbmqLwc=
+github.com/ldez/usetesting v0.5.0/go.mod h1:Spnb4Qppf8JTuRgblLrEWb7IE6rDmUpGvxY3iRrzvDQ=
+github.com/leonklingele/grouper v1.1.2 h1:o1ARBDLOmmasUaNDesWqWCIFH3u7hoFlM84YrjT3mIY=
+github.com/leonklingele/grouper v1.1.2/go.mod h1:6D0M/HVkhs2yRKRFZUoGjeDy7EZTfFBE9gl4kjmIGkA=
+github.com/lucasb-eyer/go-colorful v1.2.0 h1:1nnpGOrhyZZuNyfu1QjKiUICQ74+3FNCN69Aj6K7nkY=
+github.com/lucasb-eyer/go-colorful v1.2.0/go.mod h1:R4dSotOR9KMtayYi1e77YzuveK+i7ruzyGqttikkLy0=
+github.com/macabu/inamedparam v0.2.0 h1:VyPYpOc10nkhI2qeNUdh3Zket4fcZjEWe35poddBCpE=
+github.com/macabu/inamedparam v0.2.0/go.mod h1:+Pee9/YfGe5LJ62pYXqB89lJ+0k5bsR8Wgz/C0Zlq3U=
+github.com/magiconair/properties v1.8.6 h1:5ibWZ6iY0NctNGWo87LalDlEZ6R41TqbbDamhfG/Qzo=
+github.com/magiconair/properties v1.8.6/go.mod h1:y3VJvCyxH9uVvJTWEGAELF3aiYNyPKd5NZ3oSwXrF60=
+github.com/manuelarte/embeddedstructfieldcheck v0.4.0 h1:3mAIyaGRtjK6EO9E73JlXLtiy7ha80b2ZVGyacxgfww=
+github.com/manuelarte/embeddedstructfieldcheck v0.4.0/go.mod h1:z8dFSyXqp+fC6NLDSljRJeNQJJDWnY7RoWFzV3PC6UM=
+github.com/manuelarte/funcorder v0.5.0 h1:llMuHXXbg7tD0i/LNw8vGnkDTHFpTnWqKPI85Rknc+8=
+github.com/manuelarte/funcorder v0.5.0/go.mod h1:Yt3CiUQthSBMBxjShjdXMexmzpP8YGvGLjrxJNkO2hA=
+github.com/maratori/testableexamples v1.0.1 h1:HfOQXs+XgfeRBJ+Wz0XfH+FHnoY9TVqL6Fcevpzy4q8=
+github.com/maratori/testableexamples v1.0.1/go.mod h1:XE2F/nQs7B9N08JgyRmdGjYVGqxWwClLPCGSQhXQSrQ=
+github.com/maratori/testpackage v1.1.2 h1:ffDSh+AgqluCLMXhM19f/cpvQAKygKAJXFl9aUjmbqs=
+github.com/maratori/testpackage v1.1.2/go.mod h1:8F24GdVDFW5Ew43Et02jamrVMNXLUNaOynhDssITGfc=
+github.com/matoous/godox v1.1.0 h1:W5mqwbyWrwZv6OQ5Z1a/DHGMOvXYCBP3+Ht7KMoJhq4=
+github.com/matoous/godox v1.1.0/go.mod h1:jgE/3fUXiTurkdHOLT5WEkThTSuE7yxHv5iWPa80afs=
+github.com/matryer/is v1.4.0 h1:sosSmIWwkYITGrxZ25ULNDeKiMNzFSr4V/eqBQP0PeE=
+github.com/matryer/is v1.4.0/go.mod h1:8I/i5uYgLzgsgEloJE1U6xx5HkBQpAZvepWuujKwMRU=
+github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE=
+github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
+github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
+github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
+github.com/mattn/go-runewidth v0.0.16 h1:E5ScNMtiwvlvB5paMFdw9p4kSQzbXFikJ5SQO6TULQc=
+github.com/mattn/go-runewidth v0.0.16/go.mod h1:Jdepj2loyihRzMpdS35Xk/zdY8IAYHsh153qUoGf23w=
+github.com/matttproud/golang_protobuf_extensions v1.0.1 h1:4hp9jkHxhMHkqkrB3Ix0jegS5sx/RkqARlsWZ6pIwiU=
+github.com/matttproud/golang_protobuf_extensions v1.0.1/go.mod h1:D8He9yQNgCq6Z5Ld7szi9bcBfOoFv/3dc6xSMkL2PC0=
+github.com/mgechev/revive v1.15.0 h1:vJ0HzSBzfNyPbHKolgiFjHxLek9KUijhqh42yGoqZ8Q=
+github.com/mgechev/revive v1.15.0/go.mod h1:LlAKO3QQe9OJ0pVZzI2GPa8CbXGZ/9lNpCGvK4T/a8A=
+github.com/mitchellh/go-homedir v1.1.0 h1:lukF9ziXFxDFPkA1vsr5zpc1XuPDn/wFntq5mG+4E0Y=
+github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
+github.com/mitchellh/mapstructure v1.5.0 h1:jeMsZIYE/09sWLaz43PL7Gy6RuMjD2eJVyuac5Z2hdY=
+github.com/mitchellh/mapstructure v1.5.0/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
+github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
+github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
+github.com/modern-go/reflect2 v0.0.0-20180701023420-4b7aa43c6742/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
+github.com/modern-go/reflect2 v1.0.1/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
+github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
+github.com/moricho/tparallel v0.3.2 h1:odr8aZVFA3NZrNybggMkYO3rgPRcqjeQUlBBFVxKHTI=
+github.com/moricho/tparallel v0.3.2/go.mod h1:OQ+K3b4Ln3l2TZveGCywybl68glfLEwFGqvnjok8b+U=
+github.com/muesli/termenv v0.16.0 h1:S5AlUN9dENB57rsbnkPyfdGuWIlkmzJjbFf0Tf5FWUc=
+github.com/muesli/termenv v0.16.0/go.mod h1:ZRfOIKPFDYQoDFF4Olj7/QJbW60Ol/kL1pU3VfY/Cnk=
+github.com/mwitkow/go-conntrack v0.0.0-20161129095857-cc309e4a2223/go.mod h1:qRWi+5nqEBWmkhHvq77mSJWrCKwh8bxhgT7d/eI7P4U=
+github.com/mwitkow/go-conntrack v0.0.0-20190716064945-2f068394615f/go.mod h1:qRWi+5nqEBWmkhHvq77mSJWrCKwh8bxhgT7d/eI7P4U=
+github.com/nakabonne/nestif v0.3.1 h1:wm28nZjhQY5HyYPx+weN3Q65k6ilSBxDb8v5S81B81U=
+github.com/nakabonne/nestif v0.3.1/go.mod h1:9EtoZochLn5iUprVDmDjqGKPofoUEBL8U4Ngq6aY7OE=
+github.com/nishanths/exhaustive v0.12.0 h1:vIY9sALmw6T/yxiASewa4TQcFsVYZQQRUQJhKRf3Swg=
+github.com/nishanths/exhaustive v0.12.0/go.mod h1:mEZ95wPIZW+x8kC4TgC+9YCUgiST7ecevsVDTgc2obs=
+github.com/nishanths/predeclared v0.2.2 h1:V2EPdZPliZymNAn79T8RkNApBjMmVKh5XRpLm/w98Vk=
+github.com/nishanths/predeclared v0.2.2/go.mod h1:RROzoN6TnGQupbC+lqggsOlcgysk3LMK/HI84Mp280c=
+github.com/nunnatsa/ginkgolinter v0.23.0 h1:x3o4DGYOWbBMP/VdNQKgSj+25aJKx2Pe6lHr8gBcgf8=
+github.com/nunnatsa/ginkgolinter v0.23.0/go.mod h1:9qN1+0akwXEccwV1CAcCDfcoBlWXHB+ML9884pL4SZ4=
+github.com/onsi/ginkgo/v2 v2.28.1 h1:S4hj+HbZp40fNKuLUQOYLDgZLwNUVn19N3Atb98NCyI=
+github.com/onsi/ginkgo/v2 v2.28.1/go.mod h1:CLtbVInNckU3/+gC8LzkGUb9oF+e8W8TdUsxPwvdOgE=
+github.com/onsi/gomega v1.39.1 h1:1IJLAad4zjPn2PsnhH70V4DKRFlrCzGBNrNaru+Vf28=
+github.com/onsi/gomega v1.39.1/go.mod h1:hL6yVALoTOxeWudERyfppUcZXjMwIMLnuSfruD2lcfg=
+github.com/otiai10/copy v1.2.0/go.mod h1:rrF5dJ5F0t/EWSYODDu4j9/vEeYHMkc8jt0zJChqQWw=
+github.com/otiai10/copy v1.14.0 h1:dCI/t1iTdYGtkvCuBG2BgR6KZa83PTclw4U5n2wAllU=
+github.com/otiai10/copy v1.14.0/go.mod h1:ECfuL02W+/FkTWZWgQqXPWZgW9oeKCSQ5qVfSc4qc4w=
+github.com/otiai10/curr v0.0.0-20150429015615-9b4961190c95/go.mod h1:9qAhocn7zKJG+0mI8eUu6xqkFDYS2kb2saOteoSB3cE=
+github.com/otiai10/curr v1.0.0/go.mod h1:LskTG5wDwr8Rs+nNQ+1LlxRjAtTZZjtJW4rMXl6j4vs=
+github.com/otiai10/mint v1.3.0/go.mod h1:F5AjcsTsWUqX+Na9fpHb52P8pcRX2CI6A3ctIT91xUo=
+github.com/otiai10/mint v1.3.1/go.mod h1:/yxELlJQ0ufhjUwhshSj+wFjZ78CnZ48/1wtmBH1OTc=
+github.com/pelletier/go-toml v1.9.5 h1:4yBQzkHv+7BHq2PQUZF3Mx0IYxG7LsP222s7Agd3ve8=
+github.com/pelletier/go-toml v1.9.5/go.mod h1:u1nR/EPcESfeI/szUZKdtJ0xRNbUoANCkoOuaOx1Y+c=
+github.com/pelletier/go-toml/v2 v2.2.4 h1:mye9XuhQ6gvn5h28+VilKrrPoQVanw5PMw/TB0t5Ec4=
+github.com/pelletier/go-toml/v2 v2.2.4/go.mod h1:2gIqNv+qfxSVS7cM2xJQKtLSTLUE9V8t9Stt+h56mCY=
+github.com/pkg/errors v0.8.0/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
+github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
+github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
+github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/prometheus/client_golang v0.9.1/go.mod h1:7SWBe2y4D6OKWSNQJUaRYU/AaXPKyh/dDVn+NZz0KFw=
+github.com/prometheus/client_golang v1.0.0/go.mod h1:db9x61etRT2tGnBNRi70OPL5FsnadC4Ky3P0J6CfImo=
+github.com/prometheus/client_golang v1.7.1/go.mod h1:PY5Wy2awLA44sXw4AOSfFBetzPP4j5+D6mVACh+pe2M=
+github.com/prometheus/client_golang v1.11.0/go.mod h1:Z6t4BnS23TR94PD6BsDNk8yVqroYurpAkEiz0P2BEV0=
+github.com/prometheus/client_golang v1.12.1 h1:ZiaPsmm9uiBeaSMRznKsCDNtPCS0T3JVDGF+06gjBzk=
+github.com/prometheus/client_golang v1.12.1/go.mod h1:3Z9XVyYiZYEO+YQWt3RD2R3jrbd179Rt297l4aS6nDY=
+github.com/prometheus/client_model v0.0.0-20180712105110-5c3871d89910/go.mod h1:MbSGuTsp3dbXC40dX6PRTWyKYBIrTGTE9sqQNg2J8bo=
+github.com/prometheus/client_model v0.0.0-20190129233127-fd36f4220a90/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
+github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
+github.com/prometheus/client_model v0.2.0 h1:uq5h0d+GuxiXLJLNABMgp2qUWDPiLvgCzz2dUR+/W/M=
+github.com/prometheus/client_model v0.2.0/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
+github.com/prometheus/common v0.4.1/go.mod h1:TNfzLD0ON7rHzMJeJkieUDPYmFC7Snx/y86RQel1bk4=
+github.com/prometheus/common v0.10.0/go.mod h1:Tlit/dnDKsSWFlCLTWaA1cyBgKHSMdTB80sz/V91rCo=
+github.com/prometheus/common v0.26.0/go.mod h1:M7rCNAaPfAosfx8veZJCuw84e35h3Cfd9VFqTh1DIvc=
+github.com/prometheus/common v0.32.1 h1:hWIdL3N2HoUx3B8j3YN9mWor0qhY/NlEKZEaXxuIRh4=
+github.com/prometheus/common v0.32.1/go.mod h1:vu+V0TpY+O6vW9J44gczi3Ap/oXXR10b+M/gUGO4Hls=
+github.com/prometheus/procfs v0.0.0-20181005140218-185b4288413d/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk=
+github.com/prometheus/procfs v0.0.2/go.mod h1:TjEm7ze935MbeOT/UhFTIMYKhuLP4wbCsTZCD3I8kEA=
+github.com/prometheus/procfs v0.1.3/go.mod h1:lV6e/gmhEcM9IjHGsFOCxxuZ+z1YqCvr4OA4YeYWdaU=
+github.com/prometheus/procfs v0.6.0/go.mod h1:cz+aTbrPOrUb4q7XlbU9ygM+/jj0fzG6c1xBZuNvfVA=
+github.com/prometheus/procfs v0.7.3 h1:4jVXhlkAyzOScmCkXBTOLRLTz8EeU+eyjrwB/EPq0VU=
+github.com/prometheus/procfs v0.7.3/go.mod h1:cz+aTbrPOrUb4q7XlbU9ygM+/jj0fzG6c1xBZuNvfVA=
+github.com/quasilyte/go-ruleguard v0.4.5 h1:AGY0tiOT5hJX9BTdx/xBdoCubQUAE2grkqY2lSwvZcA=
+github.com/quasilyte/go-ruleguard v0.4.5/go.mod h1:Vl05zJ538vcEEwu16V/Hdu7IYZWyKSwIy4c88Ro1kRE=
+github.com/quasilyte/go-ruleguard/dsl v0.3.23 h1:lxjt5B6ZCiBeeNO8/oQsegE6fLeCzuMRoVWSkXC4uvY=
+github.com/quasilyte/go-ruleguard/dsl v0.3.23/go.mod h1:KeCP03KrjuSO0H1kTuZQCWlQPulDV6YMIXmpQss17rU=
+github.com/quasilyte/gogrep v0.5.0 h1:eTKODPXbI8ffJMN+W2aE0+oL0z/nh8/5eNdiO34SOAo=
+github.com/quasilyte/gogrep v0.5.0/go.mod h1:Cm9lpz9NZjEoL1tgZ2OgeUKPIxL1meE7eo60Z6Sk+Ng=
+github.com/quasilyte/regex/syntax v0.0.0-20210819130434-b3f0c404a727 h1:TCg2WBOl980XxGFEZSS6KlBGIV0diGdySzxATTWoqaU=
+github.com/quasilyte/regex/syntax v0.0.0-20210819130434-b3f0c404a727/go.mod h1:rlzQ04UMyJXu/aOvhd8qT+hvDrFpiwqp8MRXDY9szc0=
+github.com/quasilyte/stdinfo v0.0.0-20220114132959-f7386bf02567 h1:M8mH9eK4OUR4lu7Gd+PU1fV2/qnDNfzT635KRSObncs=
+github.com/quasilyte/stdinfo v0.0.0-20220114132959-f7386bf02567/go.mod h1:DWNGW8A4Y+GyBgPuaQJuWiy0XYftx4Xm/y5Jqk9I6VQ=
+github.com/raeperd/recvcheck v0.2.0 h1:GnU+NsbiCqdC2XX5+vMZzP+jAJC5fht7rcVTAhX74UI=
+github.com/raeperd/recvcheck v0.2.0/go.mod h1:n04eYkwIR0JbgD73wT8wL4JjPC3wm0nFtzBnWNocnYU=
+github.com/rivo/uniseg v0.2.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc=
+github.com/rivo/uniseg v0.4.7 h1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ=
+github.com/rivo/uniseg v0.4.7/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88=
+github.com/rogpeppe/go-internal v1.3.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4=
+github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
+github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=
+github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
+github.com/ryancurrah/gomodguard v1.4.1 h1:eWC8eUMNZ/wM/PWuZBv7JxxqT5fiIKSIyTvjb7Elr+g=
+github.com/ryancurrah/gomodguard v1.4.1/go.mod h1:qnMJwV1hX9m+YJseXEBhd2s90+1Xn6x9dLz11ualI1I=
+github.com/ryanrolds/sqlclosecheck v0.5.1 h1:dibWW826u0P8jNLsLN+En7+RqWWTYrjCB9fJfSfdyCU=
+github.com/ryanrolds/sqlclosecheck v0.5.1/go.mod h1:2g3dUjoS6AL4huFdv6wn55WpLIDjY7ZgUR4J8HOO/XQ=
+github.com/sanposhiho/wastedassign/v2 v2.1.0 h1:crurBF7fJKIORrV85u9UUpePDYGWnwvv3+A96WvwXT0=
+github.com/sanposhiho/wastedassign/v2 v2.1.0/go.mod h1:+oSmSC+9bQ+VUAxA66nBb0Z7N8CK7mscKTDYC6aIek4=
+github.com/santhosh-tekuri/jsonschema/v6 v6.0.2 h1:KRzFb2m7YtdldCEkzs6KqmJw4nqEVZGK7IN2kJkjTuQ=
+github.com/santhosh-tekuri/jsonschema/v6 v6.0.2/go.mod h1:JXeL+ps8p7/KNMjDQk3TCwPpBy0wYklyWTfbkIzdIFU=
+github.com/sashamelentyev/interfacebloat v1.1.0 h1:xdRdJp0irL086OyW1H/RTZTr1h/tMEOsumirXcOJqAw=
+github.com/sashamelentyev/interfacebloat v1.1.0/go.mod h1:+Y9yU5YdTkrNvoX0xHc84dxiN1iBi9+G8zZIhPVoNjQ=
+github.com/sashamelentyev/usestdlibvars v1.29.0 h1:8J0MoRrw4/NAXtjQqTHrbW9NN+3iMf7Knkq057v4XOQ=
+github.com/sashamelentyev/usestdlibvars v1.29.0/go.mod h1:8PpnjHMk5VdeWlVb4wCdrB8PNbLqZ3wBZTZWkrpZZL8=
+github.com/securego/gosec/v2 v2.24.8-0.20260309165252-619ce2117e08 h1:AoLtJX4WUtZkhhUUMFy3GgecAALp/Mb4S1iyQOA2s0U=
+github.com/securego/gosec/v2 v2.24.8-0.20260309165252-619ce2117e08/go.mod h1:+XLCJiRE95ga77XInNELh2M6zQP+PdqiT9Zpm0D9Wpk=
+github.com/sergi/go-diff v1.2.0 h1:XU+rvMAioB0UC3q1MFrIQy4Vo5/4VsRDQQXHsEya6xQ=
+github.com/sergi/go-diff v1.2.0/go.mod h1:STckp+ISIX8hZLjrqAeVduY0gWCT9IjLuqbuNXdaHfM=
+github.com/shurcooL/go v0.0.0-20180423040247-9e1955d9fb6e/go.mod h1:TDJrrUr11Vxrven61rcy3hJMUqaf/CLWYhHNPmT14Lk=
+github.com/shurcooL/go-goon v0.0.0-20170922171312-37c2f522c041/go.mod h1:N5mDOmsrJOB+vfqUK+7DmDyjhSLIIBnXo9lvZJj3MWQ=
+github.com/sirupsen/logrus v1.2.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPxbbu5VWo=
+github.com/sirupsen/logrus v1.4.2/go.mod h1:tLMulIdttU9McNUspp0xgXVQah82FyeX6MwdIuYE2rE=
+github.com/sirupsen/logrus v1.6.0/go.mod h1:7uNnSEd1DgxDLC74fIahvMZmmYsHGZGEOFrfsX/uA88=
+github.com/sirupsen/logrus v1.9.4 h1:TsZE7l11zFCLZnZ+teH4Umoq5BhEIfIzfRDZ1Uzql2w=
+github.com/sirupsen/logrus v1.9.4/go.mod h1:ftWc9WdOfJ0a92nsE2jF5u5ZwH8Bv2zdeOC42RjbV2g=
+github.com/sivchari/containedctx v1.0.3 h1:x+etemjbsh2fB5ewm5FeLNi5bUjK0V8n0RB+Wwfd0XE=
+github.com/sivchari/containedctx v1.0.3/go.mod h1:c1RDvCbnJLtH4lLcYD/GqwiBSSf4F5Qk0xld2rBqzJ4=
+github.com/sonatard/noctx v0.5.0 h1:e/jdaqAsuWVOKQ0P6NWiIdDNHmHT5SwuuSfojFjzwrw=
+github.com/sonatard/noctx v0.5.0/go.mod h1:64XdbzFb18XL4LporKXp8poqZtPKbCrqQ402CV+kJas=
+github.com/sourcegraph/go-diff v0.7.0 h1:9uLlrd5T46OXs5qpp8L/MTltk0zikUGi0sNNyCpA8G0=
+github.com/sourcegraph/go-diff v0.7.0/go.mod h1:iBszgVvyxdc8SFZ7gm69go2KDdt3ag071iBaWPF6cjs=
+github.com/spf13/afero v1.15.0 h1:b/YBCLWAJdFWJTN9cLhiXXcD7mzKn9Dm86dNnfyQw1I=
+github.com/spf13/afero v1.15.0/go.mod h1:NC2ByUVxtQs4b3sIUphxK0NioZnmxgyCrfzeuq8lxMg=
+github.com/spf13/cast v1.5.0 h1:rj3WzYc11XZaIZMPKmwP96zkFEnnAmV8s6XbB2aY32w=
+github.com/spf13/cast v1.5.0/go.mod h1:SpXXQ5YoyJw6s3/6cMTQuxvgRl3PCJiyaX9p6b155UU=
+github.com/spf13/cobra v1.10.2 h1:DMTTonx5m65Ic0GOoRY2c16WCbHxOOw6xxezuLaBpcU=
+github.com/spf13/cobra v1.10.2/go.mod h1:7C1pvHqHw5A4vrJfjNwvOdzYu0Gml16OCs2GRiTUUS4=
+github.com/spf13/jwalterweatherman v1.1.0 h1:ue6voC5bR5F8YxI5S67j9i582FU4Qvo2bmqnqMYADFk=
+github.com/spf13/jwalterweatherman v1.1.0/go.mod h1:aNWZUN0dPAAO/Ljvb5BEdw96iTZ0EXowPYD95IqWIGo=
+github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/spf13/pflag v1.0.9/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
+github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/spf13/viper v1.12.0 h1:CZ7eSOd3kZoaYDLbXnmzgQI5RlciuXBMA+18HwHRfZQ=
+github.com/spf13/viper v1.12.0/go.mod h1:b6COn30jlNxbm/V2IqWiNWkJ+vZNiMNksliPCiuKtSI=
+github.com/ssgreg/nlreturn/v2 v2.2.1 h1:X4XDI7jstt3ySqGU86YGAURbxw3oTDPK9sPEi6YEwQ0=
+github.com/ssgreg/nlreturn/v2 v2.2.1/go.mod h1:E/iiPB78hV7Szg2YfRgyIrk1AD6JVMTRkkxBiELzh2I=
+github.com/stbenjam/no-sprintf-host-port v0.3.1 h1:AyX7+dxI4IdLBPtDbsGAyqiTSLpCP9hWRrXQDU4Cm/g=
+github.com/stbenjam/no-sprintf-host-port v0.3.1/go.mod h1:ODbZesTCHMVKthBHskvUUexdcNHAQRXk9NpSsL8p/HQ=
+github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/objx v0.5.2 h1:xuMeJ0Sdp5ZMRXx/aWO6RZxdr3beISkG5/G/aIRr3pY=
+github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
+github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
+github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
+github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
+github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
+github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
+github.com/subosito/gotenv v1.4.1 h1:jyEFiXpy21Wm81FBN71l9VoMMV8H8jG+qIK3GCpY6Qs=
+github.com/subosito/gotenv v1.4.1/go.mod h1:ayKnFf/c6rvx/2iiLrJUk1e6plDbT3edrFNGqEflhK0=
+github.com/tenntenn/modver v1.0.1 h1:2klLppGhDgzJrScMpkj9Ujy3rXPUspSjAcev9tSEBgA=
+github.com/tenntenn/modver v1.0.1/go.mod h1:bePIyQPb7UeioSRkw3Q0XeMhYZSMx9B8ePqg6SAMGH0=
+github.com/tenntenn/text/transform v0.0.0-20200319021203-7eef512accb3 h1:f+jULpRQGxTSkNYKJ51yaw6ChIqO+Je8UqsTKN/cDag=
+github.com/tenntenn/text/transform v0.0.0-20200319021203-7eef512accb3/go.mod h1:ON8b8w4BN/kE1EOhwT0o+d62W65a6aPw1nouo9LMgyY=
+github.com/tetafro/godot v1.5.4 h1:u1ww+gqpRLiIA16yF2PV1CV1n/X3zhyezbNXC3E14Sg=
+github.com/tetafro/godot v1.5.4/go.mod h1:eOkMrVQurDui411nBY2FA05EYH01r14LuWY/NrVDVcU=
+github.com/timakin/bodyclose v0.0.0-20241222091800-1db5c5ca4d67 h1:9LPGD+jzxMlnk5r6+hJnar67cgpDIz/iyD+rfl5r2Vk=
+github.com/timakin/bodyclose v0.0.0-20241222091800-1db5c5ca4d67/go.mod h1:mkjARE7Yr8qU23YcGMSALbIxTQ9r9QBVahQOBRfU460=
+github.com/timonwong/loggercheck v0.11.0 h1:jdaMpYBl+Uq9mWPXv1r8jc5fC3gyXx4/WGwTnnNKn4M=
+github.com/timonwong/loggercheck v0.11.0/go.mod h1:HEAWU8djynujaAVX7QI65Myb8qgfcZ1uKbdpg3ZzKl8=
+github.com/tomarrell/wrapcheck/v2 v2.12.0 h1:H/qQ1aNWz/eeIhxKAFvkfIA+N7YDvq6TWVFL27Of9is=
+github.com/tomarrell/wrapcheck/v2 v2.12.0/go.mod h1:AQhQuZd0p7b6rfW+vUwHm5OMCGgp63moQ9Qr/0BpIWo=
+github.com/tommy-muehle/go-mnd/v2 v2.5.1 h1:NowYhSdyE/1zwK9QCLeRb6USWdoif80Ie+v+yU8u1Zw=
+github.com/tommy-muehle/go-mnd/v2 v2.5.1/go.mod h1:WsUAkMJMYww6l/ufffCD3m+P7LEvr8TnZn9lwVDlgzw=
+github.com/ultraware/funlen v0.2.0 h1:gCHmCn+d2/1SemTdYMiKLAHFYxTYz7z9VIDRaTGyLkI=
+github.com/ultraware/funlen v0.2.0/go.mod h1:ZE0q4TsJ8T1SQcjmkhN/w+MceuatI6pBFSxxyteHIJA=
+github.com/ultraware/whitespace v0.2.0 h1:TYowo2m9Nfj1baEQBjuHzvMRbp19i+RCcRYrSWoFa+g=
+github.com/ultraware/whitespace v0.2.0/go.mod h1:XcP1RLD81eV4BW8UhQlpaR+SDc2givTvyI8a586WjW8=
+github.com/uudashr/gocognit v1.2.1 h1:CSJynt5txTnORn/DkhiB4mZjwPuifyASC8/6Q0I/QS4=
+github.com/uudashr/gocognit v1.2.1/go.mod h1:acaubQc6xYlXFEMb9nWX2dYBzJ/bIjEkc1zzvyIZg5Q=
+github.com/uudashr/iface v1.4.1 h1:J16Xl1wyNX9ofhpHmQ9h9gk5rnv2A6lX/2+APLTo0zU=
+github.com/uudashr/iface v1.4.1/go.mod h1:pbeBPlbuU2qkNDn0mmfrxP2X+wjPMIQAy+r1MBXSXtg=
+github.com/xen0n/gosmopolitan v1.3.0 h1:zAZI1zefvo7gcpbCOrPSHJZJYA9ZgLfJqtKzZ5pHqQM=
+github.com/xen0n/gosmopolitan v1.3.0/go.mod h1:rckfr5T6o4lBtM1ga7mLGKZmLxswUoH1zxHgNXOsEt4=
+github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e h1:JVG44RsyaB9T2KIHavMF/ppJZNG9ZpyihvCd0w101no=
+github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e/go.mod h1:RbqR21r5mrJuqunuUZ/Dhy/avygyECGrLceyNeo4LiM=
+github.com/yagipy/maintidx v1.0.0 h1:h5NvIsCz+nRDapQ0exNv4aJ0yXSI0420omVANTv3GJM=
+github.com/yagipy/maintidx v1.0.0/go.mod h1:0qNf/I/CCZXSMhsRsrEPDZ+DkekpKLXAJfsTACwgXLk=
+github.com/yeya24/promlinter v0.3.0 h1:JVDbMp08lVCP7Y6NP3qHroGAO6z2yGKQtS5JsjqtoFs=
+github.com/yeya24/promlinter v0.3.0/go.mod h1:cDfJQQYv9uYciW60QT0eeHlFodotkYZlL+YcPQN+mW4=
+github.com/ykadowak/zerologlint v0.1.5 h1:Gy/fMz1dFQN9JZTPjv1hxEk+sRWm05row04Yoolgdiw=
+github.com/ykadowak/zerologlint v0.1.5/go.mod h1:KaUskqF3e/v59oPmdq1U1DnKcuHokl2/K1U4pmIELKg=
+github.com/yuin/goldmark v1.1.25/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
+github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
+github.com/yuin/goldmark v1.1.32/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
+github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
+github.com/yuin/goldmark v1.3.5/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1Zlc8k=
+github.com/yuin/goldmark v1.4.1/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1Zlc8k=
+github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
+gitlab.com/bosi/decorder v0.4.2 h1:qbQaV3zgwnBZ4zPMhGLW4KZe7A7NwxEhJx39R3shffo=
+gitlab.com/bosi/decorder v0.4.2/go.mod h1:muuhHoaJkA9QLcYHq4Mj8FJUwDZ+EirSHRiaTcTf6T8=
+go-simpler.org/assert v0.9.0 h1:PfpmcSvL7yAnWyChSjOz6Sp6m9j5lyK8Ok9pEL31YkQ=
+go-simpler.org/assert v0.9.0/go.mod h1:74Eqh5eI6vCK6Y5l3PI8ZYFXG4Sa+tkr70OIPJAUr28=
+go-simpler.org/musttag v0.14.0 h1:XGySZATqQYSEV3/YTy+iX+aofbZZllJaqwFWs+RTtSo=
+go-simpler.org/musttag v0.14.0/go.mod h1:uP8EymctQjJ4Z1kUnjX0u2l60WfUdQxCwSNKzE1JEOE=
+go-simpler.org/sloglint v0.11.1 h1:xRbPepLT/MHPTCA6TS/wNfZrDzkGvCCqUv4Bdwc3H7s=
+go-simpler.org/sloglint v0.11.1/go.mod h1:2PowwiCOK8mjiF+0KGifVOT8ZsCNiFzvfyJeJOIt8MQ=
+go.augendre.info/arangolint v0.4.0 h1:xSCZjRoS93nXazBSg5d0OGCi9APPLNMmmLrC995tR50=
+go.augendre.info/arangolint v0.4.0/go.mod h1:l+f/b4plABuFISuKnTGD4RioXiCCgghv2xqst/xOvAA=
+go.augendre.info/fatcontext v0.9.0 h1:Gt5jGD4Zcj8CDMVzjOJITlSb9cEch54hjRRlN3qDojE=
+go.augendre.info/fatcontext v0.9.0/go.mod h1:L94brOAT1OOUNue6ph/2HnwxoNlds9aXDF2FcUntbNw=
+go.opencensus.io v0.21.0/go.mod h1:mSImk1erAIZhrmZN+AvHh14ztQfjbGwt4TtuofqLduU=
+go.opencensus.io v0.22.0/go.mod h1:+kGneAE2xo2IficOXnaByMWTGM9T73dGwxeWcUqIpI8=
+go.opencensus.io v0.22.2/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
+go.opencensus.io v0.22.3/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
+go.opencensus.io v0.22.4/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
+go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
+go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
+go.uber.org/multierr v1.10.0 h1:S0h4aNzvfcFsC3dRF1jLoaov7oRaKqRGC/pUEJ2yvPQ=
+go.uber.org/multierr v1.10.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y=
+go.uber.org/zap v1.27.0 h1:aJMhYGrd5QSmlpLMr2MftRKl7t8J8PTZPA732ud/XR8=
+go.uber.org/zap v1.27.0/go.mod h1:GB2qFLM7cTU87MWRP2mPIjqfIDnGu+VIO4V/SdhGo2E=
+go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
+go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
+golang.org/x/crypto v0.0.0-20180904163835-0709b304e793/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
+golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
+golang.org/x/crypto v0.0.0-20190510104115-cbcb75029529/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
+golang.org/x/crypto v0.0.0-20190605123033-f99c8df09eb5/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
+golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
+golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
+golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
+golang.org/x/crypto v0.13.0/go.mod h1:y6Z2r+Rw4iayiXXAIxJIDAJ1zMW4yaTpebo8fPOliYc=
+golang.org/x/crypto v0.14.0/go.mod h1:MVFd36DqK4CsrnJYDkBA3VC4m2GkXAM0PvzMCn4JQf4=
+golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
+golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
+golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8=
+golang.org/x/exp v0.0.0-20190829153037-c13cbed26979/go.mod h1:86+5VVa7VpoJ4kLfm080zCjGlMRFzhUhsZKEZO7MGek=
+golang.org/x/exp v0.0.0-20191030013958-a1ab85dbe136/go.mod h1:JXzH8nQsPlswgeRAPE3MuO9GYsAcnJvJ4vnMwN/5qkY=
+golang.org/x/exp v0.0.0-20191129062945-2f5052295587/go.mod h1:2RIsYlXP63K8oxa1u096TMicItID8zy7Y6sNkU49FU4=
+golang.org/x/exp v0.0.0-20191227195350-da58074b4299/go.mod h1:2RIsYlXP63K8oxa1u096TMicItID8zy7Y6sNkU49FU4=
+golang.org/x/exp v0.0.0-20200119233911-0405dc783f0a/go.mod h1:2RIsYlXP63K8oxa1u096TMicItID8zy7Y6sNkU49FU4=
+golang.org/x/exp v0.0.0-20200207192155-f17229e696bd/go.mod h1:J/WKrq2StrnmMY6+EHIKF9dgMWnmCNThgcyBT1FY9mM=
+golang.org/x/exp v0.0.0-20200224162631-6cc2880d07d6/go.mod h1:3jZMyOhIsHpP37uCMkUooju7aAi5cS1Q23tOzKc+0MU=
+golang.org/x/exp v0.0.0-20250620022241-b7579e27df2b h1:M2rDM6z3Fhozi9O7NWsxAkg/yqS/lQJ6PmkyIV3YP+o=
+golang.org/x/exp v0.0.0-20250620022241-b7579e27df2b/go.mod h1:3//PLf8L/X+8b4vuAfHzxeRUl04Adcb341+IGKfnqS8=
+golang.org/x/exp/typeparams v0.0.0-20220428152302-39d4317da171/go.mod h1:AbB0pIl9nAr9wVwH+Z2ZpaocVmF5I4GyWCDIsVjR0bk=
+golang.org/x/exp/typeparams v0.0.0-20230203172020-98cc5a0785f9/go.mod h1:AbB0pIl9nAr9wVwH+Z2ZpaocVmF5I4GyWCDIsVjR0bk=
+golang.org/x/exp/typeparams v0.0.0-20260209203927-2842357ff358 h1:qWFG1Dj7TBjOjOvhEOkmyGPVoquqUKnIU0lEVLp8xyk=
+golang.org/x/exp/typeparams v0.0.0-20260209203927-2842357ff358/go.mod h1:4Mzdyp/6jzw9auFDJ3OMF5qksa7UvPnzKqTVGcb04ms=
+golang.org/x/image v0.0.0-20190227222117-0694c2d4d067/go.mod h1:kZ7UVZpmo3dzQBMxlp+ypCbDeSB+sBbTgSJuh5dn5js=
+golang.org/x/image v0.0.0-20190802002840-cff245a6509b/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
+golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
+golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU=
+golang.org/x/lint v0.0.0-20190301231843-5614ed5bae6f/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
+golang.org/x/lint v0.0.0-20190313153728-d0100b6bd8b3/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
+golang.org/x/lint v0.0.0-20190409202823-959b441ac422/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
+golang.org/x/lint v0.0.0-20190909230951-414d861bb4ac/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
+golang.org/x/lint v0.0.0-20190930215403-16217165b5de/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
+golang.org/x/lint v0.0.0-20191125180803-fdd1cda4f05f/go.mod h1:5qLYkcX4OjUUV8bRuDixDT3tpyyb+LUpUlRWLxfhWrs=
+golang.org/x/lint v0.0.0-20200130185559-910be7a94367/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
+golang.org/x/lint v0.0.0-20200302205851-738671d3881b/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
+golang.org/x/mobile v0.0.0-20190312151609-d3739f865fa6/go.mod h1:z+o9i4GpDbdi3rU15maQ/Ox0txvL9dWGYEHz965HBQE=
+golang.org/x/mobile v0.0.0-20190719004257-d2bd2a29d028/go.mod h1:E/iHnbuqvinMTCcRqshq8CkpyQDoeVncDDYHnLhea+o=
+golang.org/x/mod v0.0.0-20190513183733-4bf6d317e70e/go.mod h1:mXi4GBBbnImb6dmsKGUJ2LatrhH/nqhxcFungHvyanc=
+golang.org/x/mod v0.1.0/go.mod h1:0QHyrYULN0/3qlju5TqG8bIK38QM8yzMo5ekMj3DlcY=
+golang.org/x/mod v0.1.1-0.20191105210325-c90efee705ee/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg=
+golang.org/x/mod v0.1.1-0.20191107180719-034126e5016b/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg=
+golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
+golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
+golang.org/x/mod v0.4.1/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
+golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
+golang.org/x/mod v0.6.0-dev.0.20220106191415-9b9b3d81d5e3/go.mod h1:3p9vT2HGsQu2K1YbXdKPJLVgG5VJdoTa1poYQBtP1AY=
+golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
+golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
+golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
+golang.org/x/mod v0.13.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
+golang.org/x/mod v0.33.0 h1:tHFzIWbBifEmbwtGz65eaWyGiGZatSrT9prnU8DbVL8=
+golang.org/x/mod v0.33.0/go.mod h1:swjeQEj+6r7fODbD2cqrnje9PnziFuw4bmLbBZFrQ5w=
+golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20181114220301-adae6a3d119a/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20190108225652-1e06a53dbb7e/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20190213061140-3a22650c66bd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
+golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
+golang.org/x/net v0.0.0-20190501004415-9ce7a6920f09/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
+golang.org/x/net v0.0.0-20190503192946-f4e77d36d62c/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
+golang.org/x/net v0.0.0-20190603091049-60506f45cf65/go.mod h1:HSz+uSET+XFnRR8LxR5pz3Of3rY3CfYBVs4xY44aLks=
+golang.org/x/net v0.0.0-20190613194153-d28f0bde5980/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20190628185345-da137c7871d7/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20190724013045-ca1201d0de80/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20191209160850-c0dbc17a3553/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20200114155413-6afb5195e5aa/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20200202094626-16171245cfb2/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20200222125558-5a598a2470a0/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20200301022130-244492dfa37a/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20200324143707-d3edc9973b7e/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
+golang.org/x/net v0.0.0-20200501053045-e0ff5e5a1de5/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
+golang.org/x/net v0.0.0-20200506145744-7e3656a0809f/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
+golang.org/x/net v0.0.0-20200513185701-a91f0712d120/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
+golang.org/x/net v0.0.0-20200520182314-0ba52f642ac2/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
+golang.org/x/net v0.0.0-20200625001655-4c5254603344/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
+golang.org/x/net v0.0.0-20200707034311-ab3426394381/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
+golang.org/x/net v0.0.0-20200822124328-c89045814202/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
+golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
+golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
+golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96bSt6lcn1PtDYWL6XObtHCRCNQM=
+golang.org/x/net v0.0.0-20210525063256-abc453219eb5/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
+golang.org/x/net v0.0.0-20211015210444-4f30a5c0130f/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
+golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
+golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
+golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
+golang.org/x/net v0.15.0/go.mod h1:idbUs1IY1+zTqbi8yxTbhexhEEk5ur9LInksu6HrEpk=
+golang.org/x/net v0.16.0/go.mod h1:NxSsAGuq816PNPmqtQdLE42eU2Fs7NoRIZrHJAlaCOE=
+golang.org/x/net v0.51.0 h1:94R/GTO7mt3/4wIKpcR5gkGmRLOuE/2hNGeWq/GBIFo=
+golang.org/x/net v0.51.0/go.mod h1:aamm+2QF5ogm02fjy5Bb7CQ0WMt1/WVM7FtyaTLlA9Y=
+golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
+golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
+golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
+golang.org/x/oauth2 v0.0.0-20191202225959-858c2ad4c8b6/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
+golang.org/x/oauth2 v0.0.0-20200107190931-bf48bf16ab8d/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
+golang.org/x/oauth2 v0.0.0-20210514164344-f6687ab2804c/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
+golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20190227155943-e225da77a7e6/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20200317015054-43a5402ce75a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20200625203802-6e8e738ad208/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20201207232520-09787c993a3a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.3.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
+golang.org/x/sync v0.4.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
+golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=
+golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
+golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20181116152217-5ac8a444bdc5/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20190312061237-fead79001313/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20190422165155-953cdadca894/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20190502145724-3ef323f4f1fd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20190507160741-ecd444e8653b/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20190606165138-5da285871e9c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20190624142023-c5567b49c5d0/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20190726091711-fc99dfbffb4e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20191001151750-bb3f8db39f24/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20191204072324-ce4227a45e2e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20191228213918-04cbcbbfeed8/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200106162015-b016eb3dc98e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200113162924-86b910548bc1/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200122134326-e047566fdf82/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200202164722-d101bd2416d5/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200212091648-12a6c2dcc1e4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200223170610-d5e6a3e2c0ae/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200302150141-5c8b2ff67527/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200331124033-c3d80250170d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200501052902-10377860bb8e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200511232937-7e40ca221e25/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200515095857-1151b9dac4a9/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200523222454-059865788121/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200615200032-f1bc736245b1/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200625212154-ddb9806d33ae/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200803210538-64077c9b5642/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210124154548-22da62e12c0c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210330210617-4fbd30eecc44/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210510120138-977fb7262007/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20210603081109-ebe580a85c40/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20211019181941-9d821ace8654/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20211105183446-c75c47738b0c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220114195835-da31bd327af9/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220412211240-33da011f77ad/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.13.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.41.0 h1:Ivj+2Cp/ylzLiEU89QhWblYnOE9zerudt9Ftecq2C6k=
+golang.org/x/sys v0.41.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
+golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
+golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
+golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
+golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo=
+golang.org/x/term v0.12.0/go.mod h1:owVbMEjm3cBLCHdkQu9b1opXd4ETQWc3BhuQGKgXgvU=
+golang.org/x/term v0.13.0/go.mod h1:LTmsnFJwVN6bCy1rVCoS+qHT1HhALEFxKncY3WNNh4U=
+golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
+golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
+golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
+golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
+golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
+golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
+golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
+golang.org/x/text v0.34.0 h1:oL/Qq0Kdaqxa1KbNeMKwQq0reLCCaFtqu2eNuSeNHbk=
+golang.org/x/text v0.34.0/go.mod h1:homfLqTYRFyVYemLBFl5GgL/DWEiH5wcsQ5gSh1yziA=
+golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
+golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
+golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
+golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY=
+golang.org/x/tools v0.0.0-20190311212946-11955173bddd/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
+golang.org/x/tools v0.0.0-20190312151545-0bb0c0a6e846/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
+golang.org/x/tools v0.0.0-20190312170243-e65039ee4138/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
+golang.org/x/tools v0.0.0-20190425150028-36563e24a262/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
+golang.org/x/tools v0.0.0-20190506145303-2d16b83fe98c/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
+golang.org/x/tools v0.0.0-20190524140312-2c0ae7006135/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
+golang.org/x/tools v0.0.0-20190606124116-d0a3d012864b/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
+golang.org/x/tools v0.0.0-20190621195816-6e04913cbbac/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
+golang.org/x/tools v0.0.0-20190628153133-6cdbf07be9d0/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
+golang.org/x/tools v0.0.0-20190816200558-6889da9d5479/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.0.0-20190911174233-4f2ddba30aff/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.0.0-20191012152004-8de300cfc20a/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.0.0-20191113191852-77e3bb0ad9e7/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.0.0-20191115202509-3a792d9c32b2/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.0.0-20191125144606-a911d9008d1f/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.0.0-20191130070609-6e064ea0cf2d/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.0.0-20191216173652-a0e659d51361/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
+golang.org/x/tools v0.0.0-20191227053925-7b8e75db28f4/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
+golang.org/x/tools v0.0.0-20200117161641-43d50277825c/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
+golang.org/x/tools v0.0.0-20200122220014-bf1340f18c4a/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
+golang.org/x/tools v0.0.0-20200130002326-2f3ba24bd6e7/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
+golang.org/x/tools v0.0.0-20200204074204-1cc6d1ef6c74/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
+golang.org/x/tools v0.0.0-20200207183749-b753a1ba74fa/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
+golang.org/x/tools v0.0.0-20200212150539-ea181f53ac56/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
+golang.org/x/tools v0.0.0-20200224181240-023911ca70b2/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
+golang.org/x/tools v0.0.0-20200227222343-706bc42d1f0d/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
+golang.org/x/tools v0.0.0-20200304193943-95d2e580d8eb/go.mod h1:o4KQGtdN14AW+yjsvvwRTJJuXz8XRtIHtEnmAXLyFUw=
+golang.org/x/tools v0.0.0-20200312045724-11d5b4c81c7d/go.mod h1:o4KQGtdN14AW+yjsvvwRTJJuXz8XRtIHtEnmAXLyFUw=
+golang.org/x/tools v0.0.0-20200329025819-fd4102a86c65/go.mod h1:Sl4aGygMT6LrqrWclx+PTx3U+LnKx/seiNR+3G19Ar8=
+golang.org/x/tools v0.0.0-20200331025713-a30bf2db82d4/go.mod h1:Sl4aGygMT6LrqrWclx+PTx3U+LnKx/seiNR+3G19Ar8=
+golang.org/x/tools v0.0.0-20200501065659-ab2804fb9c9d/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
+golang.org/x/tools v0.0.0-20200512131952-2bc93b1c0c88/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
+golang.org/x/tools v0.0.0-20200515010526-7d3b6ebf133d/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
+golang.org/x/tools v0.0.0-20200618134242-20370b0cb4b2/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
+golang.org/x/tools v0.0.0-20200724022722-7017fd6b1305/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA=
+golang.org/x/tools v0.0.0-20200729194436-6467de6f59a7/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA=
+golang.org/x/tools v0.0.0-20200804011535-6c149bb5ef0d/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA=
+golang.org/x/tools v0.0.0-20200825202427-b303f430e36d/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA=
+golang.org/x/tools v0.1.1-0.20210205202024-ef80cdb6ec6d/go.mod h1:9bzcO0MWcOuT0tm1iBGzDVPshzfwoVvREIui8C+MHqU=
+golang.org/x/tools v0.1.1-0.20210302220138-2ac05c832e1a/go.mod h1:9bzcO0MWcOuT0tm1iBGzDVPshzfwoVvREIui8C+MHqU=
+golang.org/x/tools v0.1.1/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
+golang.org/x/tools v0.1.10/go.mod h1:Uh6Zz+xoGYZom868N8YTex3t7RhtHDBrE8Gzo9bV56E=
+golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
+golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
+golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58=
+golang.org/x/tools v0.14.0/go.mod h1:uYBEerGOWcJyEORxN+Ek8+TT266gXkNlHdJBwexUsBg=
+golang.org/x/tools v0.42.0 h1:uNgphsn75Tdz5Ji2q36v/nsFSfR/9BRFvqhGBaJGd5k=
+golang.org/x/tools v0.42.0/go.mod h1:Ma6lCIwGZvHK6XtgbswSoWroEkhugApmsXyrUmBhfr0=
+golang.org/x/tools/go/expect v0.1.1-deprecated h1:jpBZDwmgPhXsKZC6WhL20P4b/wmnpsEAGHaNy0n/rJM=
+golang.org/x/tools/go/expect v0.1.1-deprecated/go.mod h1:eihoPOH+FgIqa3FpoTwguz/bVUSGBlGQU67vpBeOrBY=
+golang.org/x/tools/go/packages/packagestest v0.1.1-deprecated h1:1h2MnaIAIXISqTFKdENegdpAgUXz6NrPEsbIeWaBRvM=
+golang.org/x/tools/go/packages/packagestest v0.1.1-deprecated/go.mod h1:RVAQXBGNv1ib0J382/DPCRS/BPnsGebyM1Gj5VSDpG8=
+golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+google.golang.org/api v0.4.0/go.mod h1:8k5glujaEP+g9n7WNsDg8QP6cUVNI86fCNMcbazEtwE=
+google.golang.org/api v0.7.0/go.mod h1:WtwebWUNSVBH/HAw79HIFXZNqEvBhG+Ra+ax0hx3E3M=
+google.golang.org/api v0.8.0/go.mod h1:o4eAsZoiT+ibD93RtjEohWalFOjRDx6CVaqeizhEnKg=
+google.golang.org/api v0.9.0/go.mod h1:o4eAsZoiT+ibD93RtjEohWalFOjRDx6CVaqeizhEnKg=
+google.golang.org/api v0.13.0/go.mod h1:iLdEw5Ide6rF15KTC1Kkl0iskquN2gFfn9o9XIsbkAI=
+google.golang.org/api v0.14.0/go.mod h1:iLdEw5Ide6rF15KTC1Kkl0iskquN2gFfn9o9XIsbkAI=
+google.golang.org/api v0.15.0/go.mod h1:iLdEw5Ide6rF15KTC1Kkl0iskquN2gFfn9o9XIsbkAI=
+google.golang.org/api v0.17.0/go.mod h1:BwFmGc8tA3vsd7r/7kR8DY7iEEGSU04BFxCo5jP/sfE=
+google.golang.org/api v0.18.0/go.mod h1:BwFmGc8tA3vsd7r/7kR8DY7iEEGSU04BFxCo5jP/sfE=
+google.golang.org/api v0.19.0/go.mod h1:BwFmGc8tA3vsd7r/7kR8DY7iEEGSU04BFxCo5jP/sfE=
+google.golang.org/api v0.20.0/go.mod h1:BwFmGc8tA3vsd7r/7kR8DY7iEEGSU04BFxCo5jP/sfE=
+google.golang.org/api v0.22.0/go.mod h1:BwFmGc8tA3vsd7r/7kR8DY7iEEGSU04BFxCo5jP/sfE=
+google.golang.org/api v0.24.0/go.mod h1:lIXQywCXRcnZPGlsd8NbLnOjtAoL6em04bJ9+z0MncE=
+google.golang.org/api v0.28.0/go.mod h1:lIXQywCXRcnZPGlsd8NbLnOjtAoL6em04bJ9+z0MncE=
+google.golang.org/api v0.29.0/go.mod h1:Lcubydp8VUV7KeIHD9z2Bys/sm/vGKnG1UHuDBSrHWM=
+google.golang.org/api v0.30.0/go.mod h1:QGmEvQ87FHZNiUVJkT14jQNYJ4ZJjdRF23ZXz5138Fc=
+google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
+google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
+google.golang.org/appengine v1.5.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
+google.golang.org/appengine v1.6.1/go.mod h1:i06prIuMbXzDqacNJfV5OdTW448YApPu5ww/cMBSeb0=
+google.golang.org/appengine v1.6.5/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
+google.golang.org/appengine v1.6.6/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
+google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
+google.golang.org/genproto v0.0.0-20190307195333-5fe7a883aa19/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
+google.golang.org/genproto v0.0.0-20190418145605-e7d98fc518a7/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
+google.golang.org/genproto v0.0.0-20190425155659-357c62f0e4bb/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
+google.golang.org/genproto v0.0.0-20190502173448-54afdca5d873/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
+google.golang.org/genproto v0.0.0-20190801165951-fa694d86fc64/go.mod h1:DMBHOl98Agz4BDEuKkezgsaosCRResVns1a3J2ZsMNc=
+google.golang.org/genproto v0.0.0-20190819201941-24fa4b261c55/go.mod h1:DMBHOl98Agz4BDEuKkezgsaosCRResVns1a3J2ZsMNc=
+google.golang.org/genproto v0.0.0-20190911173649-1774047e7e51/go.mod h1:IbNlFCBrqXvoKpeg0TB2l7cyZUmoaFKYIwrEpbDKLA8=
+google.golang.org/genproto v0.0.0-20191108220845-16a3f7862a1a/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
+google.golang.org/genproto v0.0.0-20191115194625-c23dd37a84c9/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
+google.golang.org/genproto v0.0.0-20191216164720-4f79533eabd1/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
+google.golang.org/genproto v0.0.0-20191230161307-f3c370f40bfb/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
+google.golang.org/genproto v0.0.0-20200115191322-ca5a22157cba/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
+google.golang.org/genproto v0.0.0-20200122232147-0452cf42e150/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
+google.golang.org/genproto v0.0.0-20200204135345-fa8e72b47b90/go.mod h1:GmwEX6Z4W5gMy59cAlVYjN9JhxgbQH6Gn+gFDQe2lzA=
+google.golang.org/genproto v0.0.0-20200212174721-66ed5ce911ce/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
+google.golang.org/genproto v0.0.0-20200224152610-e50cd9704f63/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
+google.golang.org/genproto v0.0.0-20200228133532-8c2c7df3a383/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
+google.golang.org/genproto v0.0.0-20200305110556-506484158171/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
+google.golang.org/genproto v0.0.0-20200312145019-da6875a35672/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
+google.golang.org/genproto v0.0.0-20200331122359-1ee6d9798940/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
+google.golang.org/genproto v0.0.0-20200430143042-b979b6f78d84/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
+google.golang.org/genproto v0.0.0-20200511104702-f5ebc3bea380/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
+google.golang.org/genproto v0.0.0-20200515170657-fc4c6c6a6587/go.mod h1:YsZOwe1myG/8QRHRsmBRE1LrgQY60beZKjly0O1fX9U=
+google.golang.org/genproto v0.0.0-20200526211855-cb27e3aa2013/go.mod h1:NbSheEEYHJ7i3ixzK3sjbqSGDJWnxyFXZblF3eUsNvo=
+google.golang.org/genproto v0.0.0-20200618031413-b414f8b61790/go.mod h1:jDfRM7FcilCzHH/e9qn6dsT145K34l5v+OpcnNgKAAA=
+google.golang.org/genproto v0.0.0-20200729003335-053ba62fc06f/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
+google.golang.org/genproto v0.0.0-20200804131852-c06518451d9c/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
+google.golang.org/genproto v0.0.0-20200825200019-8632dd797987/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
+google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
+google.golang.org/grpc v1.20.1/go.mod h1:10oTOabMzJvdu6/UiuZezV6QK5dSlG84ov/aaiqXj38=
+google.golang.org/grpc v1.21.1/go.mod h1:oYelfM1adQP15Ek0mdvEgi9Df8B9CZIaU1084ijfRaM=
+google.golang.org/grpc v1.23.0/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg=
+google.golang.org/grpc v1.25.1/go.mod h1:c3i+UQWmh7LiEpx4sFZnkU36qjEYZ0imhYfXVyQciAY=
+google.golang.org/grpc v1.26.0/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk=
+google.golang.org/grpc v1.27.0/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk=
+google.golang.org/grpc v1.27.1/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk=
+google.golang.org/grpc v1.28.0/go.mod h1:rpkK4SK4GF4Ach/+MFLZUBavHOvF2JJB5uozKKal+60=
+google.golang.org/grpc v1.29.1/go.mod h1:itym6AZVZYACWQqET3MqgPpjcuV5QH3BxFS3IjizoKk=
+google.golang.org/grpc v1.30.0/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak=
+google.golang.org/grpc v1.31.0/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak=
+google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
+google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
+google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=
+google.golang.org/protobuf v1.20.1-0.20200309200217-e05f789c0967/go.mod h1:A+miEFZTKqfCUM6K7xSMQL9OKL/b6hQv+e19PK+JZNE=
+google.golang.org/protobuf v1.21.0/go.mod h1:47Nbq4nVaFHyn7ilMalzfO3qCViNmqZ2kzikPIcrTAo=
+google.golang.org/protobuf v1.22.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
+google.golang.org/protobuf v1.23.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
+google.golang.org/protobuf v1.23.1-0.20200526195155-81db48ad09cc/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
+google.golang.org/protobuf v1.24.0/go.mod h1:r/3tXBNzIEhYS9I1OUVjXDlt8tc493IdKGjtUeSXeh4=
+google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlbajtzgsN7c=
+google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
+google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
+google.golang.org/protobuf v1.36.8 h1:xHScyCOEuuwZEc6UtSOvPbAT4zRh0xcNRYekJwfqyMc=
+google.golang.org/protobuf v1.36.8/go.mod h1:fuxRtAxBytpl4zzqUh6/eyUujkJdNiuEkXntxiD/uRU=
+gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
+gopkg.in/errgo.v2 v2.1.0/go.mod h1:hNsd1EY+bozCKY1Ytp96fpM3vjJbqLJn88ws8XvfDNI=
+gopkg.in/ini.v1 v1.67.0 h1:Dgnx+6+nfE+IfzjUEISNeydPJh9AXNNsWbGP9KzCsOA=
+gopkg.in/ini.v1 v1.67.0/go.mod h1:pNLf8WUiyNEtQjuu5G5vTm06TEv9tsIgeAvK8hOrP4k=
+gopkg.in/yaml.v2 v2.2.1/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.2.5/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.3.0/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
+gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
+gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
+gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
+honnef.co/go/tools v0.0.0-20190106161140-3f1c8253044a/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
+honnef.co/go/tools v0.0.0-20190418001031-e561f6794a2a/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
+honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
+honnef.co/go/tools v0.0.1-2019.2.3/go.mod h1:a3bituU0lyd329TUQxRnasdCoJDkEUEAqEt0JzvZhAg=
+honnef.co/go/tools v0.0.1-2020.1.3/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
+honnef.co/go/tools v0.0.1-2020.1.4/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
+honnef.co/go/tools v0.7.0 h1:w6WUp1VbkqPEgLz4rkBzH/CSU6HkoqNLp6GstyTx3lU=
+honnef.co/go/tools v0.7.0/go.mod h1:pm29oPxeP3P82ISxZDgIYeOaf9ta6Pi0EWvCFoLG2vc=
+mvdan.cc/gofumpt v0.9.2 h1:zsEMWL8SVKGHNztrx6uZrXdp7AX8r421Vvp23sz7ik4=
+mvdan.cc/gofumpt v0.9.2/go.mod h1:iB7Hn+ai8lPvofHd9ZFGVg2GOr8sBUw1QUWjNbmIL/s=
+mvdan.cc/unparam v0.0.0-20251027182757-5beb8c8f8f15 h1:ssMzja7PDPJV8FStj7hq9IKiuiKhgz9ErWw+m68e7DI=
+mvdan.cc/unparam v0.0.0-20251027182757-5beb8c8f8f15/go.mod h1:4M5MMXl2kW6fivUT6yRGpLLPNfuGtU2Z0cPvFquGDYU=
+rsc.io/binaryregexp v0.2.0/go.mod h1:qTv7/COck+e2FymRvadv62gMdZztPaShugOCi3I+8D8=
+rsc.io/quote/v3 v3.1.0/go.mod h1:yEA65RcK8LyAZtP9Kv3t0HmxON59tX3rD+tICJqUlj0=
+rsc.io/sampler v1.3.0/go.mod h1:T1hPZKmBbMNahiBKFy5HrXp6adAjACjK9JXDnKaTXpA=
diff --git a/authd-oidc-brokers/tools/semver/semver.go b/authd-oidc-brokers/tools/semver/semver.go
new file mode 100644
index 0000000000..78cdf44791
--- /dev/null
+++ b/authd-oidc-brokers/tools/semver/semver.go
@@ -0,0 +1,89 @@
+// Package semver implements comparison of semantic version strings.
+package main
+
+import (
+	"fmt"
+	"os"
+	"strings"
+
+	"golang.org/x/mod/semver"
+)
+
+func main() {
+	if len(os.Args) < 2 {
+		usage()
+		os.Exit(1)
+	}
+
+	switch os.Args[1] {
+	case "check":
+		if len(os.Args) != 3 {
+			fmt.Fprintf(os.Stderr, "Error: 'check' requires exactly one version argument\n")
+			usage()
+			os.Exit(1)
+		}
+		checkVersion(os.Args[2])
+
+	case "compare":
+		if len(os.Args) != 4 {
+			fmt.Fprintf(os.Stderr, "Error: 'compare' requires exactly two version arguments\n")
+			usage()
+			os.Exit(1)
+		}
+		compareVersions(os.Args[2], os.Args[3])
+
+	default:
+		fmt.Fprintf(os.Stderr, "Error: unknown command %q\n", os.Args[1])
+		usage()
+		os.Exit(1)
+	}
+}
+
+func usage() {
+	fmt.Fprintf(os.Stderr, `Usage: %[1]s <command> [arguments]
+
+Commands:
+  check <version>           Check if a version is valid
+  compare <ver1> <ver2>     Compare two versions
+
+Examples:
+  %[1]s check 1.2.3           # Prints "valid" or "invalid"
+  %[1]s compare 1.2.3 2.0.0   # Prints "less", "equal", or "greater"
+`, os.Args[0])
+}
+
+func addVPrefix(version string) string {
+	if !strings.HasPrefix(version, "v") {
+		return "v" + version
+	}
+	return version
+}
+
+func checkVersion(version string) {
+	v := addVPrefix(version)
+	if semver.IsValid(v) {
+		fmt.Println("valid")
+		return
+	}
+	fmt.Println("invalid")
+	os.Exit(1)
+}
+
+func compareVersions(ver1, ver2 string) {
+	v1 := addVPrefix(ver1)
+	v2 := addVPrefix(ver2)
+
+	if !semver.IsValid(v1) || !semver.IsValid(v2) {
+		fmt.Fprintf(os.Stderr, "Error: invalid semantic version format\n")
+		os.Exit(1)
+	}
+
+	switch semver.Compare(v1, v2) {
+	case -1:
+		fmt.Println("less")
+	case 0:
+		fmt.Println("equal")
+	case 1:
+		fmt.Println("greater")
+	}
+}
diff --git a/authd-oidc-brokers/tools/tools.go b/authd-oidc-brokers/tools/tools.go
new file mode 100644
index 0000000000..fe7e655d74
--- /dev/null
+++ b/authd-oidc-brokers/tools/tools.go
@@ -0,0 +1,9 @@
+// TiCS: disabled // This is a helper file to pin the tools versions that we use.
+
+//go:build tools
+
+package tools
+
+import (
+	_ "github.com/golangci/golangci-lint/v2/cmd/golangci-lint"
+)
diff --git a/cmd/authctl/group/group.go b/cmd/authctl/group/group.go
new file mode 100644
index 0000000000..01a7c2b88b
--- /dev/null
+++ b/cmd/authctl/group/group.go
@@ -0,0 +1,18 @@
+// Package group provides utilities for managing group operations.
+package group
+
+import (
+	"github.com/spf13/cobra"
+)
+
+// GroupCmd is a command to perform group-related operations.
+var GroupCmd = &cobra.Command{
+	Use:   "group",
+	Short: "Commands related to groups",
+	Args:  cobra.NoArgs,
+	RunE:  func(cmd *cobra.Command, args []string) error { return cmd.Usage() },
+}
+
+func init() {
+	GroupCmd.AddCommand(setGIDCmd)
+}
diff --git a/cmd/authctl/group/group_test.go b/cmd/authctl/group/group_test.go
new file mode 100644
index 0000000000..34d3093521
--- /dev/null
+++ b/cmd/authctl/group/group_test.go
@@ -0,0 +1,59 @@
+package group_test
+
+import (
+	"fmt"
+	"os"
+	"os/exec"
+	"testing"
+
+	"github.com/canonical/authd/internal/testutils"
+)
+
+var authctlPath string
+var daemonPath string
+
+func TestGroupCommand(t *testing.T) {
+	t.Parallel()
+
+	tests := map[string]struct {
+		args             []string
+		expectedExitCode int
+	}{
+		"Usage_message_when_no_args": {expectedExitCode: 0},
+		"Help_flag":                  {args: []string{"--help"}, expectedExitCode: 0},
+
+		"Error_on_invalid_command": {args: []string{"invalid-command"}, expectedExitCode: 1},
+		"Error_on_invalid_flag":    {args: []string{"--invalid-flag"}, expectedExitCode: 1},
+	}
+
+	for name, tc := range tests {
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			//nolint:gosec // G204 it's safe to use exec.Command with a variable here
+			cmd := exec.Command(authctlPath, append([]string{"group"}, tc.args...)...)
+			testutils.CheckCommand(t, cmd, tc.expectedExitCode)
+		})
+	}
+}
+
+func TestMain(m *testing.M) {
+	var authctlCleanup func()
+	var err error
+	authctlPath, authctlCleanup, err = testutils.BuildAuthctl()
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "Setup: %v\n", err)
+		os.Exit(1)
+	}
+	defer authctlCleanup()
+
+	var daemonCleanup func()
+	daemonPath, daemonCleanup, err = testutils.BuildAuthdWithExampleBroker()
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "Setup: %v\n", err)
+		os.Exit(1)
+	}
+	defer daemonCleanup()
+
+	m.Run()
+}
diff --git a/cmd/authctl/group/set-gid.go b/cmd/authctl/group/set-gid.go
new file mode 100644
index 0000000000..069570c51a
--- /dev/null
+++ b/cmd/authctl/group/set-gid.go
@@ -0,0 +1,80 @@
+package group
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"os"
+	"strconv"
+
+	"github.com/canonical/authd/cmd/authctl/internal/client"
+	"github.com/canonical/authd/cmd/authctl/internal/completion"
+	"github.com/canonical/authd/cmd/authctl/internal/log"
+	"github.com/canonical/authd/internal/proto/authd"
+	"github.com/spf13/cobra"
+)
+
+// setGIDCmd is a command to set the GID of a group managed by authd.
+var setGIDCmd = &cobra.Command{
+	Use:   "set-gid <group> <gid>",
+	Short: "Set the GID of a group managed by authd",
+	Long: `Set the GID of a group managed by authd to the specified value.
+
+The new GID must be unique and non-negative. The command must be run as root.
+
+When a group's GID is changed, any users whose primary group is set to this
+group will have the GID of their primary group updated. The home directories of
+these users, and any files within these directories that are owned by the group,
+will be updated to the new GID.
+
+Files outside users' home directories are not updated and must be changed
+manually. Note that changing a GID can be unsafe if files on the system are
+still owned by the original GID: those files may become accessible to a
+different group that is later assigned that GID.`,
+	Example: `  # Set the GID of group "staff" to 30000
+  authctl group set-gid staff 30000`,
+	Args:              cobra.ExactArgs(2),
+	ValidArgsFunction: completion.Groups,
+	RunE: func(cmd *cobra.Command, args []string) error {
+		name := args[0]
+		gidStr := args[1]
+		gid, err := strconv.ParseUint(gidStr, 10, 32)
+		if err != nil {
+			// Remove the "strconv.ParseUint: parsing ..." part from the error message
+			// because it doesn't add any useful information.
+			if unwrappedErr := errors.Unwrap(err); unwrappedErr != nil {
+				err = unwrappedErr
+			}
+			return fmt.Errorf("failed to parse GID %q: %w", gidStr, err)
+		}
+
+		client, err := client.NewUserServiceClient()
+		if err != nil {
+			return err
+		}
+
+		resp, err := client.SetGroupID(context.Background(), &authd.SetGroupIDRequest{
+			Name: name,
+			Id:   uint32(gid),
+			Lang: os.Getenv("LANG"),
+		})
+		if resp == nil {
+			return err
+		}
+
+		if resp.IdChanged {
+			log.Infof("GID of group '%s' set to %d.", name, gid)
+			if resp.HomeDirOwnerChanged {
+				log.Info("Updated ownership of the user's home directory.")
+			}
+			log.Info("Note: Ownership of files outside the user's home directory are not updated and must be changed manually.")
+		}
+
+		// Print any warnings returned by the server.
+		for _, warning := range resp.Warnings {
+			log.Warning(warning)
+		}
+
+		return err
+	},
+}
diff --git a/cmd/authctl/group/set-gid_test.go b/cmd/authctl/group/set-gid_test.go
new file mode 100644
index 0000000000..d26382f1df
--- /dev/null
+++ b/cmd/authctl/group/set-gid_test.go
@@ -0,0 +1,87 @@
+package group_test
+
+import (
+	"math"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strconv"
+	"testing"
+
+	"github.com/canonical/authd/internal/testutils"
+	"github.com/stretchr/testify/require"
+	"google.golang.org/grpc/codes"
+)
+
+func TestSetGIDCommand(t *testing.T) {
+	// We can't run these tests in parallel because the daemon with the example
+	// broker which we're using here uses userslocking.Z_ForTests_OverrideLocking()
+	// which makes userslocking.WriteLock() return an error immediately when the lock
+	// is already held - unlike the normal behavior which tries to acquire the lock
+	// for 15 seconds before returning an error.
+
+	daemonSocket := testutils.StartAuthd(t, daemonPath,
+		testutils.WithGroupFile(filepath.Join("testdata", "empty.group")),
+		testutils.WithPreviousDBState("one_user_and_group"),
+		testutils.WithCurrentUserAsRoot,
+	)
+
+	err := os.Setenv("AUTHD_SOCKET", daemonSocket)
+	require.NoError(t, err, "Failed to set AUTHD_SOCKET environment variable")
+
+	tests := map[string]struct {
+		args             []string
+		authdUnavailable bool
+
+		expectedExitCode int
+	}{
+		"Set_group_gid_success": {
+			args:             []string{"set-gid", "group1", "123456"},
+			expectedExitCode: 0,
+		},
+
+		"Error_when_group_does_not_exist": {
+			args:             []string{"set-gid", "invalidgroup", "123456"},
+			expectedExitCode: int(codes.NotFound),
+		},
+		"Error_when_gid_is_invalid": {
+			args:             []string{"set-gid", "group1", "invalidgid"},
+			expectedExitCode: 1,
+		},
+		"Error_when_gid_is_too_large": {
+			args:             []string{"set-gid", "group1", strconv.Itoa(math.MaxInt32 + 1)},
+			expectedExitCode: int(codes.Unknown),
+		},
+		"Error_when_gid_is_already_taken": {
+			args:             []string{"set-gid", "group1", "0"},
+			expectedExitCode: int(codes.Unknown),
+		},
+		"Error_when_gid_is_negative": {
+			args:             []string{"set-gid", "group1", "--", "-1000"},
+			expectedExitCode: 1,
+		},
+		"Error_when_authd_is_unavailable": {
+			args:             []string{"set-gid", "group1", "123456"},
+			authdUnavailable: true,
+			expectedExitCode: int(codes.Unavailable),
+		},
+	}
+
+	for name, tc := range tests {
+		t.Run(name, func(t *testing.T) {
+			if tc.authdUnavailable {
+				origValue := os.Getenv("AUTHD_SOCKET")
+				err := os.Setenv("AUTHD_SOCKET", "/non-existent")
+				require.NoError(t, err, "Failed to set AUTHD_SOCKET environment variable")
+				t.Cleanup(func() {
+					err := os.Setenv("AUTHD_SOCKET", origValue)
+					require.NoError(t, err, "Failed to restore AUTHD_SOCKET environment variable")
+				})
+			}
+
+			//nolint:gosec // G204 it's safe to use exec.Command with a variable here
+			cmd := exec.Command(authctlPath, append([]string{"group"}, tc.args...)...)
+			testutils.CheckCommand(t, cmd, tc.expectedExitCode)
+		})
+	}
+}
diff --git a/internal/users/db/testdata/golden/TestNew/New_migrates_database_to_lowercase_user_and_group_names b/cmd/authctl/group/testdata/db/one_user_and_group.db.yaml
similarity index 94%
rename from internal/users/db/testdata/golden/TestNew/New_migrates_database_to_lowercase_user_and_group_names
rename to cmd/authctl/group/testdata/db/one_user_and_group.db.yaml
index 0f479a482b..77567897ae 100644
--- a/internal/users/db/testdata/golden/TestNew/New_migrates_database_to_lowercase_user_and_group_names
+++ b/cmd/authctl/group/testdata/db/one_user_and_group.db.yaml
@@ -15,4 +15,3 @@ groups:
 users_to_groups:
     - uid: 1111
       gid: 11111
-schema_version: 1
diff --git a/cmd/authctl/group/testdata/empty.group b/cmd/authctl/group/testdata/empty.group
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/cmd/authctl/group/testdata/golden/TestGroupCommand/Error_on_invalid_command b/cmd/authctl/group/testdata/golden/TestGroupCommand/Error_on_invalid_command
new file mode 100644
index 0000000000..ecd4f9d8a8
--- /dev/null
+++ b/cmd/authctl/group/testdata/golden/TestGroupCommand/Error_on_invalid_command
@@ -0,0 +1,13 @@
+Usage:
+  authctl group [flags]
+  authctl group [command]
+
+Available Commands:
+  set-gid     Set the GID of a group managed by authd
+
+Flags:
+  -h, --help   help for group
+
+Use "authctl group [command] --help" for more information about a command.
+
+unknown command "invalid-command" for "authctl group"
diff --git a/cmd/authctl/group/testdata/golden/TestGroupCommand/Error_on_invalid_flag b/cmd/authctl/group/testdata/golden/TestGroupCommand/Error_on_invalid_flag
new file mode 100644
index 0000000000..7ca5da1f79
--- /dev/null
+++ b/cmd/authctl/group/testdata/golden/TestGroupCommand/Error_on_invalid_flag
@@ -0,0 +1,13 @@
+Usage:
+  authctl group [flags]
+  authctl group [command]
+
+Available Commands:
+  set-gid     Set the GID of a group managed by authd
+
+Flags:
+  -h, --help   help for group
+
+Use "authctl group [command] --help" for more information about a command.
+
+unknown flag: --invalid-flag
diff --git a/cmd/authctl/group/testdata/golden/TestGroupCommand/Help_flag b/cmd/authctl/group/testdata/golden/TestGroupCommand/Help_flag
new file mode 100644
index 0000000000..ad64bb0b01
--- /dev/null
+++ b/cmd/authctl/group/testdata/golden/TestGroupCommand/Help_flag
@@ -0,0 +1,13 @@
+Commands related to groups
+
+Usage:
+  authctl group [flags]
+  authctl group [command]
+
+Available Commands:
+  set-gid     Set the GID of a group managed by authd
+
+Flags:
+  -h, --help   help for group
+
+Use "authctl group [command] --help" for more information about a command.
diff --git a/cmd/authctl/group/testdata/golden/TestGroupCommand/Usage_message_when_no_args b/cmd/authctl/group/testdata/golden/TestGroupCommand/Usage_message_when_no_args
new file mode 100644
index 0000000000..1c53f30766
--- /dev/null
+++ b/cmd/authctl/group/testdata/golden/TestGroupCommand/Usage_message_when_no_args
@@ -0,0 +1,11 @@
+Usage:
+  authctl group [flags]
+  authctl group [command]
+
+Available Commands:
+  set-gid     Set the GID of a group managed by authd
+
+Flags:
+  -h, --help   help for group
+
+Use "authctl group [command] --help" for more information about a command.
diff --git a/cmd/authctl/group/testdata/golden/TestSetGIDCommand/Error_when_authd_is_unavailable b/cmd/authctl/group/testdata/golden/TestSetGIDCommand/Error_when_authd_is_unavailable
new file mode 100644
index 0000000000..ba5b5abcba
--- /dev/null
+++ b/cmd/authctl/group/testdata/golden/TestSetGIDCommand/Error_when_authd_is_unavailable
@@ -0,0 +1 @@
+Error: connection error: desc = "transport: Error while dialing: dial unix /non-existent: connect: no such file or directory"
diff --git a/cmd/authctl/group/testdata/golden/TestSetGIDCommand/Error_when_gid_is_already_taken b/cmd/authctl/group/testdata/golden/TestSetGIDCommand/Error_when_gid_is_already_taken
new file mode 100644
index 0000000000..673356ab64
--- /dev/null
+++ b/cmd/authctl/group/testdata/golden/TestSetGIDCommand/Error_when_gid_is_already_taken
@@ -0,0 +1 @@
+Error: GID 0 already exists
diff --git a/cmd/authctl/group/testdata/golden/TestSetGIDCommand/Error_when_gid_is_invalid b/cmd/authctl/group/testdata/golden/TestSetGIDCommand/Error_when_gid_is_invalid
new file mode 100644
index 0000000000..9fb3f91660
--- /dev/null
+++ b/cmd/authctl/group/testdata/golden/TestSetGIDCommand/Error_when_gid_is_invalid
@@ -0,0 +1 @@
+failed to parse GID "invalidgid": invalid syntax
diff --git a/cmd/authctl/group/testdata/golden/TestSetGIDCommand/Error_when_gid_is_negative b/cmd/authctl/group/testdata/golden/TestSetGIDCommand/Error_when_gid_is_negative
new file mode 100644
index 0000000000..91f9e8c76a
--- /dev/null
+++ b/cmd/authctl/group/testdata/golden/TestSetGIDCommand/Error_when_gid_is_negative
@@ -0,0 +1 @@
+failed to parse GID "-1000": invalid syntax
diff --git a/cmd/authctl/group/testdata/golden/TestSetGIDCommand/Error_when_gid_is_too_large b/cmd/authctl/group/testdata/golden/TestSetGIDCommand/Error_when_gid_is_too_large
new file mode 100644
index 0000000000..be456ffb84
--- /dev/null
+++ b/cmd/authctl/group/testdata/golden/TestSetGIDCommand/Error_when_gid_is_too_large
@@ -0,0 +1 @@
+Error: GID 2147483648 is too large to convert to int32
diff --git a/cmd/authctl/group/testdata/golden/TestSetGIDCommand/Error_when_group_does_not_exist b/cmd/authctl/group/testdata/golden/TestSetGIDCommand/Error_when_group_does_not_exist
new file mode 100644
index 0000000000..bcbc1916c2
--- /dev/null
+++ b/cmd/authctl/group/testdata/golden/TestSetGIDCommand/Error_when_group_does_not_exist
@@ -0,0 +1 @@
+Error: group "invalidgroup" not found
diff --git a/cmd/authctl/group/testdata/golden/TestSetGIDCommand/Set_group_gid_success b/cmd/authctl/group/testdata/golden/TestSetGIDCommand/Set_group_gid_success
new file mode 100644
index 0000000000..19d12d3e82
--- /dev/null
+++ b/cmd/authctl/group/testdata/golden/TestSetGIDCommand/Set_group_gid_success
@@ -0,0 +1,2 @@
+GID of group 'group1' set to 123456.
+Note: Ownership of files outside the user's home directory are not updated and must be changed manually.
diff --git a/cmd/authctl/internal/client/client.go b/cmd/authctl/internal/client/client.go
new file mode 100644
index 0000000000..fff6efe7ff
--- /dev/null
+++ b/cmd/authctl/internal/client/client.go
@@ -0,0 +1,35 @@
+// Package client provides a utility function to create a gRPC client for the authd service.
+package client
+
+import (
+	"fmt"
+	"os"
+	"regexp"
+
+	"github.com/canonical/authd/internal/consts"
+	"github.com/canonical/authd/internal/proto/authd"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/credentials/insecure"
+)
+
+// NewUserServiceClient creates and returns a new [authd.UserServiceClient].
+func NewUserServiceClient() (authd.UserServiceClient, error) {
+	authdSocket := os.Getenv("AUTHD_SOCKET")
+	if authdSocket == "" {
+		authdSocket = "unix://" + consts.DefaultSocketPath
+	}
+
+	// Check if the socket has a scheme, else default to "unix://"
+	schemeRegex := regexp.MustCompile(`^[a-zA-Z][a-zA-Z0-9+.-]*:`)
+	if !schemeRegex.MatchString(authdSocket) {
+		authdSocket = "unix://" + authdSocket
+	}
+
+	conn, err := grpc.NewClient(authdSocket, grpc.WithTransportCredentials(insecure.NewCredentials()))
+	if err != nil {
+		return nil, fmt.Errorf("failed to connect to authd: %w", err)
+	}
+
+	client := authd.NewUserServiceClient(conn)
+	return client, nil
+}
diff --git a/cmd/authctl/internal/completion/completion.go b/cmd/authctl/internal/completion/completion.go
new file mode 100644
index 0000000000..0070afd743
--- /dev/null
+++ b/cmd/authctl/internal/completion/completion.go
@@ -0,0 +1,77 @@
+// Package completion provides completion functions for authctl.
+package completion
+
+import (
+	"context"
+	"time"
+
+	"github.com/canonical/authd/cmd/authctl/internal/client"
+	"github.com/canonical/authd/internal/proto/authd"
+	"github.com/spf13/cobra"
+	"google.golang.org/grpc/status"
+)
+
+const timeout = 5 * time.Second
+
+// Users returns the list of authd users for shell completion.
+func Users(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
+	svc, err := client.NewUserServiceClient()
+	if err != nil {
+		return showError(err)
+	}
+
+	ctx, cancel := context.WithTimeout(cmd.Context(), timeout)
+	defer cancel()
+
+	resp, err := svc.ListUsers(ctx, &authd.Empty{})
+	if err != nil {
+		return showError(err)
+	}
+
+	var userNames []string
+	for _, user := range resp.Users {
+		userNames = append(userNames, user.Name)
+	}
+
+	return userNames, cobra.ShellCompDirectiveNoFileComp
+}
+
+// Groups returns the list of authd groups for shell completion.
+func Groups(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
+	c, err := client.NewUserServiceClient()
+	if err != nil {
+		return showError(err)
+	}
+
+	ctx, cancel := context.WithTimeout(cmd.Context(), timeout)
+	defer cancel()
+
+	resp, err := c.ListGroups(ctx, &authd.Empty{})
+	if err != nil {
+		return showError(err)
+	}
+
+	var groupNames []string
+	for _, group := range resp.Groups {
+		groupNames = append(groupNames, group.Name)
+	}
+
+	return groupNames, cobra.ShellCompDirectiveNoFileComp
+}
+
+// NoArgs returns no arguments and disables file completion.
+func NoArgs(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
+	return nil, cobra.ShellCompDirectiveNoFileComp
+}
+
+func showError(err error) ([]string, cobra.ShellCompDirective) {
+	if s, ok := status.FromError(err); ok {
+		return showMessage(s.Message())
+	}
+
+	return showMessage(err.Error())
+}
+
+func showMessage(msg string) ([]string, cobra.ShellCompDirective) {
+	return cobra.AppendActiveHelp(nil, msg), cobra.ShellCompDirectiveNoFileComp
+}
diff --git a/cmd/authctl/internal/docgen/main.go b/cmd/authctl/internal/docgen/main.go
new file mode 100644
index 0000000000..a479c15060
--- /dev/null
+++ b/cmd/authctl/internal/docgen/main.go
@@ -0,0 +1,84 @@
+// Package main generates CLI reference documentation.
+package main
+
+import (
+	"flag"
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+
+	"github.com/canonical/authd/cmd/authctl/root"
+	"github.com/spf13/cobra/doc"
+)
+
+func logf(format string, v ...any) {
+	fmt.Fprintf(os.Stderr, format+"\n", v...)
+}
+
+func log(v ...any) {
+	logf("%v", v...)
+}
+
+func fatalf(format string, v ...any) {
+	logf(format, v...)
+	os.Exit(1)
+}
+
+func fatal(v ...any) {
+	fatalf("%v", v...)
+}
+
+func main() {
+	out := flag.String("out", "", "output path (directory for markdown/rest, file for man)")
+	format := flag.String("format", "markdown", "markdown|man|rest")
+	front := flag.Bool("frontmatter", false, "prepend simple YAML front matter to markdown")
+	flag.Parse()
+
+	if *out == "" {
+		fatal("-out is required")
+	}
+
+	rootCmd := root.RootCmd
+	rootCmd.DisableAutoGenTag = true // stable, reproducible files (no timestamp footer)
+
+	switch *format {
+	case "markdown":
+		logf("Generating markdown documentation in %s", *out)
+		if err := os.MkdirAll(*out, 0o750); err != nil {
+			fatal(err)
+		}
+
+		if *front {
+			prep := func(filename string) string {
+				base := filepath.Base(filename)
+				name := strings.TrimSuffix(base, filepath.Ext(base))
+				title := strings.ReplaceAll(name, "_", " ")
+				return fmt.Sprintf("---\ntitle: %q\nslug: %q\ndescription: \"CLI reference for %s\"\n---\n\n", title, name, title)
+			}
+			link := func(name string) string { return strings.ToLower(name) }
+			if err := doc.GenMarkdownTreeCustom(rootCmd, *out, prep, link); err != nil {
+				fatal(err)
+			}
+		} else {
+			if err := doc.GenMarkdownTree(rootCmd, *out); err != nil {
+				fatal(err)
+			}
+		}
+	case "rest":
+		logf("Generating reStructuredText documentation in %s", *out)
+		if err := os.MkdirAll(*out, 0o750); err != nil {
+			fatal(err)
+		}
+		if err := doc.GenReSTTree(rootCmd, *out); err != nil {
+			fatal(err)
+		}
+	case "man":
+		logf("Generating man page in %s", *out)
+		if err := genManPage(rootCmd, *out); err != nil {
+			fatal(err)
+		}
+	default:
+		fatalf("unknown format: %s", *format)
+	}
+}
diff --git a/cmd/authctl/internal/docgen/manpage.go b/cmd/authctl/internal/docgen/manpage.go
new file mode 100644
index 0000000000..2e2bf186ac
--- /dev/null
+++ b/cmd/authctl/internal/docgen/manpage.go
@@ -0,0 +1,284 @@
+package main
+
+import (
+	"bytes"
+	"fmt"
+	"os"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/spf13/cobra"
+	"github.com/spf13/cobra/doc"
+	"github.com/spf13/pflag"
+)
+
+// genManPage generates a single man page for authctl and all its subcommands.
+// We can't use cobra's doc.GenManTree because it generates separate man
+// pages for each command, and we want a single page with all commands.
+func genManPage(cmd *cobra.Command, path string) error {
+	cmd.InitDefaultHelpFlag()
+	cmd.InitDefaultVersionFlag()
+
+	header := &doc.GenManHeader{Title: strings.ToUpper(cmd.Name()), Section: "1"}
+	fillHeader(header, cmd.CommandPath())
+
+	buf := new(bytes.Buffer)
+
+	// Header
+	fmt.Fprintf(buf, ".\\\" Generated from authctl man page generator\n")
+	fmt.Fprintf(buf, ".\\\" Do not edit manually\n")
+	fmt.Fprintf(buf, ".nh\n")
+	fmt.Fprintf(buf, ".TH \"%s\" \"%s\" \"%s\" \"%s\"\n",
+		header.Title, header.Section, header.Date.Format("2006-01-02"), header.Source)
+
+	// NAME
+	fmt.Fprintf(buf, ".SH NAME\n")
+	fmt.Fprintf(buf, "%s \\- %s\n", cmd.Name(), escapeRoff(cmd.Short))
+
+	// SYNOPSIS
+	fmt.Fprintf(buf, ".SH SYNOPSIS\n")
+	fmt.Fprintf(buf, "\\fB%s\\fP [\\fIoptions\\fP] \\fI<command>\\fP [\\fIargs\\fP]\n", cmd.Name())
+
+	// DESCRIPTION
+	desc := cmd.Long
+	if desc == "" {
+		desc = cmd.Short
+	}
+	desc = escapeRoff(desc)
+	// Make occurrences of the command name bold in the description
+	desc = strings.ReplaceAll(desc, cmd.Name(), "\\fB"+cmd.Name()+"\\fP")
+	fmt.Fprintf(buf, ".SH DESCRIPTION\n")
+	fmt.Fprintf(buf, "%s\n", desc)
+
+	// COMMANDS
+	fmt.Fprintf(buf, ".SH COMMANDS\n")
+	genCommandList(buf, cmd)
+
+	// OPTIONS
+	globalFlags := cmd.PersistentFlags()
+	if globalFlags.HasAvailableFlags() {
+		fmt.Fprintf(buf, ".SH OPTIONS\n")
+		fmt.Fprintf(buf, "The following options are understood:\n")
+		manPrintFlags(buf, globalFlags)
+	}
+
+	// SEE ALSO
+	fmt.Fprintf(buf, ".SH SEE ALSO\n")
+	fmt.Fprintf(buf, "For more information, please refer to the \\m[blue]\\fBauthd documentation\\fP\\m[][1]\\&.\n")
+
+	// NOTES
+	fmt.Fprintf(buf, ".SH NOTES\n")
+	fmt.Fprintf(buf, ".IP \" 1.\" 4\n")
+	fmt.Fprintf(buf, "authd documentation\n")
+	fmt.Fprintf(buf, ".RS 4\n")
+	fmt.Fprintf(buf, "\\%%https://documentation.ubuntu.com/authd\n")
+	fmt.Fprintf(buf, ".RE\n")
+
+	if !shouldWriteManPage(path, buf.Bytes()) {
+		return nil
+	}
+
+	return os.WriteFile(path, buf.Bytes(), 0600)
+}
+
+func genCommandList(buf *bytes.Buffer, cmd *cobra.Command) {
+	var commands []*cobra.Command
+	collectCommands(cmd, &commands)
+
+	for _, c := range commands {
+		// Calculate command name relative to root
+		// e.g. "user lock"
+		name := c.UseLine()
+		rootName := c.Root().Name()
+		if strings.HasPrefix(name, rootName+" ") {
+			// +1 for space
+			name = name[len(rootName)+1:]
+		}
+
+		// Split command and arguments
+		// Format: "command <arg1> <arg2>" -> "\fBcommand\fP \fI<arg1>\fP \fI<arg2>\fP"
+		parts := strings.Fields(name)
+		var formattedParts []string
+
+		for _, part := range parts {
+			if strings.HasPrefix(part, "<") && strings.HasSuffix(part, ">") {
+				// This is an argument - make it italic, keep angle brackets and lowercase
+				formattedParts = append(formattedParts, "\\fI"+part+"\\fP")
+			} else {
+				// This is part of the command - make it bold
+				formattedParts = append(formattedParts, "\\fB"+part+"\\fP")
+			}
+		}
+
+		formattedName := strings.Join(formattedParts, " ")
+
+		// Write command with proper roff formatting
+		fmt.Fprintf(buf, ".PP\n")
+		fmt.Fprintf(buf, "%s\n", formattedName)
+		fmt.Fprintf(buf, ".RS 4\n")
+
+		// Write description
+		desc := ""
+		if c.Long != "" {
+			desc = c.Long
+		} else if c.Short != "" {
+			desc = c.Short
+		}
+
+		if desc != "" {
+			// Escape special characters in description
+			desc = escapeRoff(desc)
+			// Write paragraphs
+			paragraphs := strings.Split(desc, "\n\n")
+			for i, para := range paragraphs {
+				para = strings.TrimSpace(para)
+				if para == "" {
+					continue
+				}
+				// Replace newlines within paragraph with spaces
+				para = strings.ReplaceAll(para, "\n", " ")
+				fmt.Fprintf(buf, "%s\n", para)
+				if i < len(paragraphs)-1 {
+					fmt.Fprintf(buf, ".sp\n") // Add spacing between paragraphs
+				}
+			}
+		}
+
+		// Options
+		flags := c.NonInheritedFlags()
+		if flags.HasAvailableFlags() {
+			fmt.Fprintf(buf, ".sp\n")
+			fmt.Fprintf(buf, "\\fBOptions:\\fP\n")
+			fmt.Fprintf(buf, ".sp\n")
+			manPrintFlags(buf, flags)
+		}
+
+		// .RE ends indented block
+		fmt.Fprintf(buf, ".RE\n")
+	}
+}
+func collectCommands(cmd *cobra.Command, res *[]*cobra.Command) {
+	for _, c := range cmd.Commands() {
+		if !c.IsAvailableCommand() || c.IsAdditionalHelpTopicCommand() {
+			continue
+		}
+		if len(c.Commands()) > 0 {
+			collectCommands(c, res)
+		} else {
+			*res = append(*res, c)
+		}
+	}
+}
+
+func fillHeader(header *doc.GenManHeader, name string) {
+	if header.Title == "" {
+		header.Title = strings.ToUpper(strings.ReplaceAll(name, " ", "\\-"))
+	}
+	if header.Section == "" {
+		header.Section = "1"
+	}
+	if header.Source == "" {
+		header.Source = "authd"
+	}
+	if header.Date == nil {
+		now := time.Now()
+		if epoch := os.Getenv("SOURCE_DATE_EPOCH"); epoch != "" {
+			unixEpoch, err := strconv.ParseInt(epoch, 10, 64)
+			if err == nil {
+				now = time.Unix(unixEpoch, 0)
+			}
+		}
+		header.Date = &now
+	}
+}
+
+func escapeRoff(s string) string {
+	// Escape backslashes - this is the main special character that needs escaping
+	s = strings.ReplaceAll(s, "\\", "\\\\")
+	return s
+}
+
+func manPrintFlags(buf *bytes.Buffer, flags *pflag.FlagSet) {
+	flags.VisitAll(func(flag *pflag.Flag) {
+		if len(flag.Deprecated) > 0 || flag.Hidden {
+			return
+		}
+
+		// Build flag name
+		fmt.Fprintf(buf, ".PP\n")
+
+		var flagStr string
+		if len(flag.Shorthand) > 0 && len(flag.ShorthandDeprecated) == 0 {
+			flagStr = fmt.Sprintf("\\fB\\-%s\\fP, \\fB\\-\\-%s\\fP", flag.Shorthand, flag.Name)
+		} else {
+			flagStr = fmt.Sprintf("\\fB\\-\\-%s\\fP", flag.Name)
+		}
+
+		// Add value specification for non-boolean flags
+		if flag.Value.Type() != "bool" {
+			if len(flag.NoOptDefVal) > 0 {
+				flagStr += " ["
+			} else {
+				flagStr += " "
+			}
+
+			// Format value based on type
+			valName := strings.ToUpper(flag.Name)
+			if flag.Value.Type() == "string" {
+				flagStr += fmt.Sprintf("\\fI%s\\fP", valName)
+			} else {
+				flagStr += fmt.Sprintf("\\fI%s\\fP", valName)
+			}
+
+			if len(flag.NoOptDefVal) > 0 {
+				flagStr += "]"
+			}
+		}
+
+		fmt.Fprintf(buf, "%s\n", flagStr)
+		fmt.Fprintf(buf, ".RS 4\n")
+		fmt.Fprintf(buf, "%s\n", escapeRoff(flag.Usage))
+
+		// Show default value if not empty and not boolean
+		if flag.Value.Type() != "bool" && flag.DefValue != "" {
+			fmt.Fprintf(buf, ".sp\n")
+			fmt.Fprintf(buf, "Defaults to \\fI%s\\fP\\&.\n", escapeRoff(flag.DefValue))
+		}
+
+		fmt.Fprintf(buf, ".RE\n")
+	})
+}
+
+// stripDate returns the given man page data with the date removed.
+func stripDate(data []byte) []byte {
+	lines := strings.Split(string(data), "\n")
+	var out []string
+	for _, line := range lines {
+		if strings.HasPrefix(line, ".TH ") {
+			parts := strings.Fields(line)
+			if len(parts) >= 5 {
+				parts[3] = "" // Remove date
+				line = strings.Join(parts, " ")
+			}
+		}
+		out = append(out, line)
+	}
+	return []byte(strings.Join(out, "\n"))
+}
+
+func shouldWriteManPage(path string, content []byte) bool {
+	existing, err := os.ReadFile(path)
+	if err != nil {
+		// The man page doesn't exist yet, so we should write it
+		return true
+	}
+
+	if bytes.Equal(stripDate(existing), stripDate(content)) {
+		// The man page is unchanged (except for the date), so don't write it
+		log("Man page is up-to-date")
+		return false
+	}
+
+	return true
+}
diff --git a/cmd/authctl/internal/log/log.go b/cmd/authctl/internal/log/log.go
new file mode 100644
index 0000000000..fda728ce1c
--- /dev/null
+++ b/cmd/authctl/internal/log/log.go
@@ -0,0 +1,70 @@
+// Package log provides logging functions for authctl.
+package log
+
+import (
+	"fmt"
+	"os"
+	"sync"
+
+	"golang.org/x/term"
+)
+
+var useColor = sync.OnceValue(func() bool {
+	if os.Getenv("NO_COLOR") != "" {
+		return false
+	}
+
+	return term.IsTerminal(int(os.Stderr.Fd()))
+})
+
+// Info prints a message to stderr.
+func Info(a ...any) {
+	fmt.Fprintln(os.Stderr, fmt.Sprint(a...))
+}
+
+// Infof prints a formatted message to stderr.
+func Infof(format string, args ...any) {
+	Info(fmt.Sprintf(format, args...))
+}
+
+// Notice prints a message to stderr in bold.
+func Notice(a ...any) {
+	if !useColor() {
+		fmt.Fprintln(os.Stderr, fmt.Sprint(a...))
+		return
+	}
+	fmt.Fprintln(os.Stderr, "\033[0;1;39m"+fmt.Sprint(a...)+"\033[0m")
+}
+
+// Noticef prints a formatted message to stderr in bold.
+func Noticef(format string, args ...any) {
+	Notice(fmt.Sprintf(format, args...))
+}
+
+// Warning prints a message to stderr in yellow.
+func Warning(a ...any) {
+	if !useColor() {
+		fmt.Fprintln(os.Stderr, fmt.Sprint(a...))
+		return
+	}
+	fmt.Fprintln(os.Stderr, "\033[0;1;38:5:185m"+fmt.Sprint(a...)+"\033[0m")
+}
+
+// Warningf prints a formatted message to stderr in yellow.
+func Warningf(format string, args ...any) {
+	Warning(fmt.Sprintf(format, args...))
+}
+
+// Error prints a message to stderr in red.
+func Error(a ...any) {
+	if !useColor() {
+		fmt.Fprintln(os.Stderr, fmt.Sprint(a...))
+		return
+	}
+	fmt.Fprintln(os.Stderr, "\033[1;31m"+fmt.Sprint(a...)+"\033[0m")
+}
+
+// Errorf prints a formatted message to stderr in red.
+func Errorf(format string, args ...any) {
+	Error(fmt.Sprintf(format, args...))
+}
diff --git a/cmd/authctl/main.go b/cmd/authctl/main.go
new file mode 100644
index 0000000000..ea154b7ce9
--- /dev/null
+++ b/cmd/authctl/main.go
@@ -0,0 +1,38 @@
+// Package main implements Cobra commands for management operations on authd.
+package main
+
+import (
+	"os"
+
+	"github.com/canonical/authd/cmd/authctl/internal/log"
+	"github.com/canonical/authd/cmd/authctl/root"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+)
+
+func main() {
+	if err := root.RootCmd.Execute(); err != nil {
+		s, ok := status.FromError(err)
+		if !ok {
+			// If the error is not a gRPC status, we print it as is.
+			log.Error(err.Error())
+			os.Exit(1)
+		}
+
+		// If the error is a gRPC status, we print the message and exit with the gRPC status code.
+		switch s.Code() {
+		case codes.PermissionDenied:
+			log.Errorf("Permission denied: %s", s.Message())
+		default:
+			log.Errorf("Error: %s", s.Message())
+		}
+		code := int(s.Code())
+		if code < 0 || code > 255 {
+			// We cannot exit with a negative code or a code greater than 255,
+			// so we map it to 1 in that case.
+			code = 1
+		}
+
+		os.Exit(code)
+	}
+}
diff --git a/cmd/authctl/main_test.go b/cmd/authctl/main_test.go
new file mode 100644
index 0000000000..52c2a0ee62
--- /dev/null
+++ b/cmd/authctl/main_test.go
@@ -0,0 +1,52 @@
+package main_test
+
+import (
+	"fmt"
+	"os"
+	"os/exec"
+	"testing"
+
+	"github.com/canonical/authd/internal/testutils"
+)
+
+var authctlPath string
+
+func TestRootCommand(t *testing.T) {
+	t.Parallel()
+
+	tests := map[string]struct {
+		args             []string
+		expectedExitCode int
+	}{
+		"Usage_message_when_no_args": {expectedExitCode: 0},
+		"Help_command":               {args: []string{"help"}, expectedExitCode: 0},
+		"Help_flag":                  {args: []string{"--help"}, expectedExitCode: 0},
+		"Completion_command":         {args: []string{"completion"}, expectedExitCode: 0},
+
+		"Error_on_invalid_command": {args: []string{"invalid-command"}, expectedExitCode: 1},
+		"Error_on_invalid_flag":    {args: []string{"--invalid-flag"}, expectedExitCode: 1},
+	}
+
+	for name, tc := range tests {
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			//nolint:gosec // G204 it's safe to use exec.Command with a variable here
+			cmd := exec.Command(authctlPath, tc.args...)
+			testutils.CheckCommand(t, cmd, tc.expectedExitCode)
+		})
+	}
+}
+
+func TestMain(m *testing.M) {
+	var cleanup func()
+	var err error
+	authctlPath, cleanup, err = testutils.BuildAuthctl()
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "Setup: %v\n", err)
+		os.Exit(1)
+	}
+	defer cleanup()
+
+	m.Run()
+}
diff --git a/cmd/authctl/root/root.go b/cmd/authctl/root/root.go
new file mode 100644
index 0000000000..591eee4d18
--- /dev/null
+++ b/cmd/authctl/root/root.go
@@ -0,0 +1,38 @@
+// Package root contains the root command for authctl.
+package root
+
+import (
+	"github.com/canonical/authd/cmd/authctl/group"
+	"github.com/canonical/authd/cmd/authctl/user"
+	"github.com/spf13/cobra"
+)
+
+// RootCmd is the root command for authctl.
+var RootCmd = &cobra.Command{
+	Use:   "authctl",
+	Short: "Manage authd users and groups",
+	Long:  "authctl is a command-line tool for managing users and groups handled by authd.",
+	PersistentPreRun: func(cmd *cobra.Command, args []string) {
+		// The command was successfully parsed, so we don't want cobra to print usage information on error.
+		cmd.SilenceUsage = true
+	},
+	CompletionOptions: cobra.CompletionOptions{
+		HiddenDefaultCmd: true,
+	},
+	// Avoid the "Auto generated by spf13/cobra" line in the generated markdown docs
+	DisableAutoGenTag: true,
+	// We handle errors ourselves
+	SilenceErrors: true,
+	Args:          cobra.NoArgs,
+	RunE:          func(cmd *cobra.Command, args []string) error { return cmd.Usage() },
+}
+
+func init() {
+	// Disable command sorting by name. This makes cobra print the commands in the
+	// order they are added to the root command and adds the `help` and `completion`
+	// commands at the end.
+	cobra.EnableCommandSorting = false
+
+	RootCmd.AddCommand(user.UserCmd)
+	RootCmd.AddCommand(group.GroupCmd)
+}
diff --git a/cmd/authctl/testdata/golden/TestRootCommand/Completion_command b/cmd/authctl/testdata/golden/TestRootCommand/Completion_command
new file mode 100644
index 0000000000..fb3a14a225
--- /dev/null
+++ b/cmd/authctl/testdata/golden/TestRootCommand/Completion_command
@@ -0,0 +1,16 @@
+Generate the autocompletion script for authctl for the specified shell.
+See each sub-command's help for details on how to use the generated script.
+
+Usage:
+  authctl completion [command]
+
+Available Commands:
+  bash        Generate the autocompletion script for bash
+  zsh         Generate the autocompletion script for zsh
+  fish        Generate the autocompletion script for fish
+  powershell  Generate the autocompletion script for powershell
+
+Flags:
+  -h, --help   help for completion
+
+Use "authctl completion [command] --help" for more information about a command.
diff --git a/cmd/authctl/testdata/golden/TestRootCommand/Error_on_invalid_command b/cmd/authctl/testdata/golden/TestRootCommand/Error_on_invalid_command
new file mode 100644
index 0000000000..ffcf63f66e
--- /dev/null
+++ b/cmd/authctl/testdata/golden/TestRootCommand/Error_on_invalid_command
@@ -0,0 +1,15 @@
+Usage:
+  authctl [flags]
+  authctl [command]
+
+Available Commands:
+  user        Commands related to users
+  group       Commands related to groups
+  help        Help about any command
+
+Flags:
+  -h, --help   help for authctl
+
+Use "authctl [command] --help" for more information about a command.
+
+unknown command "invalid-command" for "authctl"
diff --git a/cmd/authctl/testdata/golden/TestRootCommand/Error_on_invalid_flag b/cmd/authctl/testdata/golden/TestRootCommand/Error_on_invalid_flag
new file mode 100644
index 0000000000..427c0c5bf3
--- /dev/null
+++ b/cmd/authctl/testdata/golden/TestRootCommand/Error_on_invalid_flag
@@ -0,0 +1,15 @@
+Usage:
+  authctl [flags]
+  authctl [command]
+
+Available Commands:
+  user        Commands related to users
+  group       Commands related to groups
+  help        Help about any command
+
+Flags:
+  -h, --help   help for authctl
+
+Use "authctl [command] --help" for more information about a command.
+
+unknown flag: --invalid-flag
diff --git a/cmd/authctl/testdata/golden/TestRootCommand/Help_command b/cmd/authctl/testdata/golden/TestRootCommand/Help_command
new file mode 100644
index 0000000000..cbd8f4dc4a
--- /dev/null
+++ b/cmd/authctl/testdata/golden/TestRootCommand/Help_command
@@ -0,0 +1,15 @@
+authctl is a command-line tool for managing users and groups handled by authd.
+
+Usage:
+  authctl [flags]
+  authctl [command]
+
+Available Commands:
+  user        Commands related to users
+  group       Commands related to groups
+  help        Help about any command
+
+Flags:
+  -h, --help   help for authctl
+
+Use "authctl [command] --help" for more information about a command.
diff --git a/cmd/authctl/testdata/golden/TestRootCommand/Help_flag b/cmd/authctl/testdata/golden/TestRootCommand/Help_flag
new file mode 100644
index 0000000000..cbd8f4dc4a
--- /dev/null
+++ b/cmd/authctl/testdata/golden/TestRootCommand/Help_flag
@@ -0,0 +1,15 @@
+authctl is a command-line tool for managing users and groups handled by authd.
+
+Usage:
+  authctl [flags]
+  authctl [command]
+
+Available Commands:
+  user        Commands related to users
+  group       Commands related to groups
+  help        Help about any command
+
+Flags:
+  -h, --help   help for authctl
+
+Use "authctl [command] --help" for more information about a command.
diff --git a/cmd/authctl/testdata/golden/TestRootCommand/Usage_message_when_no_args b/cmd/authctl/testdata/golden/TestRootCommand/Usage_message_when_no_args
new file mode 100644
index 0000000000..d2577969fd
--- /dev/null
+++ b/cmd/authctl/testdata/golden/TestRootCommand/Usage_message_when_no_args
@@ -0,0 +1,13 @@
+Usage:
+  authctl [flags]
+  authctl [command]
+
+Available Commands:
+  user        Commands related to users
+  group       Commands related to groups
+  help        Help about any command
+
+Flags:
+  -h, --help   help for authctl
+
+Use "authctl [command] --help" for more information about a command.
diff --git a/cmd/authctl/user/lock.go b/cmd/authctl/user/lock.go
new file mode 100644
index 0000000000..c0d3caa23e
--- /dev/null
+++ b/cmd/authctl/user/lock.go
@@ -0,0 +1,32 @@
+package user
+
+import (
+	"context"
+
+	"github.com/canonical/authd/cmd/authctl/internal/client"
+	"github.com/canonical/authd/cmd/authctl/internal/completion"
+	"github.com/canonical/authd/internal/proto/authd"
+	"github.com/spf13/cobra"
+)
+
+// lockCmd is a command to lock (disable) a user.
+var lockCmd = &cobra.Command{
+	Use:               "lock <user>",
+	Short:             "Lock (disable) a user managed by authd",
+	Long:              `Lock a user so that they cannot log in.`,
+	Args:              cobra.ExactArgs(1),
+	ValidArgsFunction: completion.Users,
+	RunE: func(cmd *cobra.Command, args []string) error {
+		client, err := client.NewUserServiceClient()
+		if err != nil {
+			return err
+		}
+
+		_, err = client.LockUser(context.Background(), &authd.LockUserRequest{Name: args[0]})
+		if err != nil {
+			return err
+		}
+
+		return nil
+	},
+}
diff --git a/cmd/authctl/user/lock_test.go b/cmd/authctl/user/lock_test.go
new file mode 100644
index 0000000000..cbc13c203f
--- /dev/null
+++ b/cmd/authctl/user/lock_test.go
@@ -0,0 +1,44 @@
+package user_test
+
+import (
+	"os"
+	"os/exec"
+	"path/filepath"
+	"testing"
+
+	"github.com/canonical/authd/internal/testutils"
+	"github.com/stretchr/testify/require"
+	"google.golang.org/grpc/codes"
+)
+
+func TestUserLockCommand(t *testing.T) {
+	t.Parallel()
+
+	daemonSocket := testutils.StartAuthd(t, daemonPath,
+		testutils.WithGroupFile(filepath.Join("testdata", "empty.group")),
+		testutils.WithPreviousDBState("one_user_and_group"),
+		testutils.WithCurrentUserAsRoot,
+	)
+
+	err := os.Setenv("AUTHD_SOCKET", daemonSocket)
+	require.NoError(t, err, "Failed to set AUTHD_SOCKET environment variable")
+
+	tests := map[string]struct {
+		args             []string
+		expectedExitCode int
+	}{
+		"Lock_user_success": {args: []string{"lock", "user1@example.com"}, expectedExitCode: 0},
+
+		"Error_locking_invalid_user": {args: []string{"lock", "invaliduser"}, expectedExitCode: int(codes.NotFound)},
+	}
+
+	for name, tc := range tests {
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			//nolint:gosec // G204 it's safe to use exec.Command with a variable here
+			cmd := exec.Command(authctlPath, append([]string{"user"}, tc.args...)...)
+			testutils.CheckCommand(t, cmd, tc.expectedExitCode)
+		})
+	}
+}
diff --git a/cmd/authctl/user/set-uid.go b/cmd/authctl/user/set-uid.go
new file mode 100644
index 0000000000..f87cdcc60f
--- /dev/null
+++ b/cmd/authctl/user/set-uid.go
@@ -0,0 +1,86 @@
+package user
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"os"
+	"strconv"
+
+	"github.com/canonical/authd/cmd/authctl/internal/client"
+	"github.com/canonical/authd/cmd/authctl/internal/completion"
+	"github.com/canonical/authd/cmd/authctl/internal/log"
+	"github.com/canonical/authd/internal/proto/authd"
+	"github.com/spf13/cobra"
+)
+
+// setUIDCmd is a command to set the UID of a user managed by authd.
+var setUIDCmd = &cobra.Command{
+	Use:   "set-uid <user> <uid>",
+	Short: "Set the UID of a user managed by authd",
+	Long: `Set the UID of a user managed by authd to the specified value.
+
+The new UID must be unique and non-negative. The command must be run as root.
+
+The ownership of the user's home directory, and any files within the directory
+that the user owns, will automatically be updated to the new UID.
+
+Files outside the user's home directory are not updated and must be changed
+manually. Note that changing a UID can be unsafe if files on the system are
+still owned by the original UID: those files may become accessible to a
+different account that is later assigned that UID.`,
+	Example: `  # Set the UID of user "alice" to 15000
+  authctl user set-uid alice 15000`,
+	Args:              cobra.ExactArgs(2),
+	ValidArgsFunction: setUIDCompletionFunc,
+	RunE: func(cmd *cobra.Command, args []string) error {
+		name := args[0]
+		uidStr := args[1]
+		uid, err := strconv.ParseUint(uidStr, 10, 32)
+		if err != nil {
+			// Remove the "strconv.ParseUint: parsing ..." part from the error message
+			// because it doesn't add any useful information.
+			if unwrappedErr := errors.Unwrap(err); unwrappedErr != nil {
+				err = unwrappedErr
+			}
+			return fmt.Errorf("failed to parse UID %q: %w", uidStr, err)
+		}
+
+		client, err := client.NewUserServiceClient()
+		if err != nil {
+			return err
+		}
+
+		resp, err := client.SetUserID(context.Background(), &authd.SetUserIDRequest{
+			Name: name,
+			Id:   uint32(uid),
+			Lang: os.Getenv("LANG"),
+		})
+		if resp == nil {
+			return err
+		}
+
+		if resp.IdChanged {
+			log.Infof("UID of user '%s' set to %d.", name, uid)
+			if resp.HomeDirOwnerChanged {
+				log.Info("Updated ownership of the user's home directory.")
+			}
+			log.Info("Note: Ownership of files outside the user's home directory are not updated and must be changed manually.")
+		}
+
+		// Print any warnings returned by the server.
+		for _, warning := range resp.Warnings {
+			log.Warning(warning)
+		}
+
+		return err
+	},
+}
+
+func setUIDCompletionFunc(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
+	if len(args) == 0 {
+		return completion.Users(cmd, args, toComplete)
+	}
+
+	return nil, cobra.ShellCompDirectiveNoFileComp
+}
diff --git a/cmd/authctl/user/set-uid_test.go b/cmd/authctl/user/set-uid_test.go
new file mode 100644
index 0000000000..276169b4f2
--- /dev/null
+++ b/cmd/authctl/user/set-uid_test.go
@@ -0,0 +1,87 @@
+package user_test
+
+import (
+	"math"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strconv"
+	"testing"
+
+	"github.com/canonical/authd/internal/testutils"
+	"github.com/stretchr/testify/require"
+	"google.golang.org/grpc/codes"
+)
+
+func TestSetUIDCommand(t *testing.T) {
+	// We can't run these tests in parallel because the daemon with the example
+	// broker which we're using here uses userslocking.Z_ForTests_OverrideLocking()
+	// which makes userslocking.WriteLock() return an error immediately when the lock
+	// is already held - unlike the normal behavior which tries to acquire the lock
+	// for 15 seconds before returning an error.
+
+	daemonSocket := testutils.StartAuthd(t, daemonPath,
+		testutils.WithGroupFile(filepath.Join("testdata", "empty.group")),
+		testutils.WithPreviousDBState("one_user_and_group"),
+		testutils.WithCurrentUserAsRoot,
+	)
+
+	err := os.Setenv("AUTHD_SOCKET", daemonSocket)
+	require.NoError(t, err, "Failed to set AUTHD_SOCKET environment variable")
+
+	tests := map[string]struct {
+		args             []string
+		authdUnavailable bool
+
+		expectedExitCode int
+	}{
+		"Set_user_uid_success": {
+			args:             []string{"set-uid", "user1@example.com", "123456"},
+			expectedExitCode: 0,
+		},
+
+		"Error_when_user_does_not_exist": {
+			args:             []string{"set-uid", "invaliduser", "123456"},
+			expectedExitCode: int(codes.NotFound),
+		},
+		"Error_when_uid_is_invalid": {
+			args:             []string{"set-uid", "user1@example.com", "invaliduid"},
+			expectedExitCode: 1,
+		},
+		"Error_when_uid_is_too_large": {
+			args:             []string{"set-uid", "user1@example.com", strconv.Itoa(math.MaxInt32 + 1)},
+			expectedExitCode: int(codes.Unknown),
+		},
+		"Error_when_uid_is_already_taken": {
+			args:             []string{"set-uid", "user1@example.com", "0"},
+			expectedExitCode: int(codes.Unknown),
+		},
+		"Error_when_uid_is_negative": {
+			args:             []string{"set-uid", "user1@example.com", "--", "-1000"},
+			expectedExitCode: 1,
+		},
+		"Error_when_authd_is_unavailable": {
+			args:             []string{"set-uid", "user1@example.com", "123456"},
+			authdUnavailable: true,
+			expectedExitCode: int(codes.Unavailable),
+		},
+	}
+
+	for name, tc := range tests {
+		t.Run(name, func(t *testing.T) {
+			if tc.authdUnavailable {
+				origValue := os.Getenv("AUTHD_SOCKET")
+				err := os.Setenv("AUTHD_SOCKET", "/non-existent")
+				require.NoError(t, err, "Failed to set AUTHD_SOCKET environment variable")
+				t.Cleanup(func() {
+					err := os.Setenv("AUTHD_SOCKET", origValue)
+					require.NoError(t, err, "Failed to restore AUTHD_SOCKET environment variable")
+				})
+			}
+
+			//nolint:gosec // G204 it's safe to use exec.Command with a variable here
+			cmd := exec.Command(authctlPath, append([]string{"user"}, tc.args...)...)
+			testutils.CheckCommand(t, cmd, tc.expectedExitCode)
+		})
+	}
+}
diff --git a/internal/users/db/testdata/golden/TestUpdateUserEntry/Update_last_login_time_for_user b/cmd/authctl/user/testdata/db/one_user_and_group.db.yaml
similarity index 72%
rename from internal/users/db/testdata/golden/TestUpdateUserEntry/Update_last_login_time_for_user
rename to cmd/authctl/user/testdata/db/one_user_and_group.db.yaml
index 5d9b092038..39af2b587b 100644
--- a/internal/users/db/testdata/golden/TestUpdateUserEntry/Update_last_login_time_for_user
+++ b/cmd/authctl/user/testdata/db/one_user_and_group.db.yaml
@@ -1,13 +1,13 @@
 users:
-    - name: user1
+    - name: user1@example.com
       uid: 1111
       gid: 11111
       gecos: |-
         User1 gecos
         On multiple lines
-      dir: /home/user1
+      dir: /home/user1@example.com
       shell: /bin/bash
-      last_login: 2020-01-01T00:00:00Z
+      broker_id: broker-id
 groups:
     - name: group1
       gid: 11111
diff --git a/cmd/authctl/user/testdata/empty.group b/cmd/authctl/user/testdata/empty.group
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/cmd/authctl/user/testdata/golden/TestSetUIDCommand/Error_when_authd_is_unavailable b/cmd/authctl/user/testdata/golden/TestSetUIDCommand/Error_when_authd_is_unavailable
new file mode 100644
index 0000000000..ba5b5abcba
--- /dev/null
+++ b/cmd/authctl/user/testdata/golden/TestSetUIDCommand/Error_when_authd_is_unavailable
@@ -0,0 +1 @@
+Error: connection error: desc = "transport: Error while dialing: dial unix /non-existent: connect: no such file or directory"
diff --git a/cmd/authctl/user/testdata/golden/TestSetUIDCommand/Error_when_uid_is_already_taken b/cmd/authctl/user/testdata/golden/TestSetUIDCommand/Error_when_uid_is_already_taken
new file mode 100644
index 0000000000..ed14c2f9ad
--- /dev/null
+++ b/cmd/authctl/user/testdata/golden/TestSetUIDCommand/Error_when_uid_is_already_taken
@@ -0,0 +1 @@
+Error: UID 0 already exists
diff --git a/cmd/authctl/user/testdata/golden/TestSetUIDCommand/Error_when_uid_is_invalid b/cmd/authctl/user/testdata/golden/TestSetUIDCommand/Error_when_uid_is_invalid
new file mode 100644
index 0000000000..acf1ab1bfd
--- /dev/null
+++ b/cmd/authctl/user/testdata/golden/TestSetUIDCommand/Error_when_uid_is_invalid
@@ -0,0 +1 @@
+failed to parse UID "invaliduid": invalid syntax
diff --git a/cmd/authctl/user/testdata/golden/TestSetUIDCommand/Error_when_uid_is_negative b/cmd/authctl/user/testdata/golden/TestSetUIDCommand/Error_when_uid_is_negative
new file mode 100644
index 0000000000..6345a0adf3
--- /dev/null
+++ b/cmd/authctl/user/testdata/golden/TestSetUIDCommand/Error_when_uid_is_negative
@@ -0,0 +1 @@
+failed to parse UID "-1000": invalid syntax
diff --git a/cmd/authctl/user/testdata/golden/TestSetUIDCommand/Error_when_uid_is_too_large b/cmd/authctl/user/testdata/golden/TestSetUIDCommand/Error_when_uid_is_too_large
new file mode 100644
index 0000000000..e89c9a4386
--- /dev/null
+++ b/cmd/authctl/user/testdata/golden/TestSetUIDCommand/Error_when_uid_is_too_large
@@ -0,0 +1 @@
+Error: UID 2147483648 is too large to convert to int32
diff --git a/cmd/authctl/user/testdata/golden/TestSetUIDCommand/Error_when_user_does_not_exist b/cmd/authctl/user/testdata/golden/TestSetUIDCommand/Error_when_user_does_not_exist
new file mode 100644
index 0000000000..93dd7dd5ff
--- /dev/null
+++ b/cmd/authctl/user/testdata/golden/TestSetUIDCommand/Error_when_user_does_not_exist
@@ -0,0 +1 @@
+Error: user "invaliduser" not found
diff --git a/cmd/authctl/user/testdata/golden/TestSetUIDCommand/Set_user_uid_success b/cmd/authctl/user/testdata/golden/TestSetUIDCommand/Set_user_uid_success
new file mode 100644
index 0000000000..45b83a8c2e
--- /dev/null
+++ b/cmd/authctl/user/testdata/golden/TestSetUIDCommand/Set_user_uid_success
@@ -0,0 +1,2 @@
+UID of user 'user1@example.com' set to 123456.
+Note: Ownership of files outside the user's home directory are not updated and must be changed manually.
diff --git a/cmd/authctl/user/testdata/golden/TestUserCommand/Error_on_invalid_command b/cmd/authctl/user/testdata/golden/TestUserCommand/Error_on_invalid_command
new file mode 100644
index 0000000000..a66b03e2c9
--- /dev/null
+++ b/cmd/authctl/user/testdata/golden/TestUserCommand/Error_on_invalid_command
@@ -0,0 +1,15 @@
+Usage:
+  authctl user [flags]
+  authctl user [command]
+
+Available Commands:
+  lock        Lock (disable) a user managed by authd
+  unlock      Unlock (enable) a user managed by authd
+  set-uid     Set the UID of a user managed by authd
+
+Flags:
+  -h, --help   help for user
+
+Use "authctl user [command] --help" for more information about a command.
+
+unknown command "invalid-command" for "authctl user"
diff --git a/cmd/authctl/user/testdata/golden/TestUserCommand/Error_on_invalid_flag b/cmd/authctl/user/testdata/golden/TestUserCommand/Error_on_invalid_flag
new file mode 100644
index 0000000000..3408cec6d8
--- /dev/null
+++ b/cmd/authctl/user/testdata/golden/TestUserCommand/Error_on_invalid_flag
@@ -0,0 +1,15 @@
+Usage:
+  authctl user [flags]
+  authctl user [command]
+
+Available Commands:
+  lock        Lock (disable) a user managed by authd
+  unlock      Unlock (enable) a user managed by authd
+  set-uid     Set the UID of a user managed by authd
+
+Flags:
+  -h, --help   help for user
+
+Use "authctl user [command] --help" for more information about a command.
+
+unknown flag: --invalid-flag
diff --git a/cmd/authctl/user/testdata/golden/TestUserCommand/Help_flag b/cmd/authctl/user/testdata/golden/TestUserCommand/Help_flag
new file mode 100644
index 0000000000..ee4765c1cc
--- /dev/null
+++ b/cmd/authctl/user/testdata/golden/TestUserCommand/Help_flag
@@ -0,0 +1,15 @@
+Commands related to users
+
+Usage:
+  authctl user [flags]
+  authctl user [command]
+
+Available Commands:
+  lock        Lock (disable) a user managed by authd
+  unlock      Unlock (enable) a user managed by authd
+  set-uid     Set the UID of a user managed by authd
+
+Flags:
+  -h, --help   help for user
+
+Use "authctl user [command] --help" for more information about a command.
diff --git a/cmd/authctl/user/testdata/golden/TestUserCommand/Usage_message_when_no_args b/cmd/authctl/user/testdata/golden/TestUserCommand/Usage_message_when_no_args
new file mode 100644
index 0000000000..d83ced5684
--- /dev/null
+++ b/cmd/authctl/user/testdata/golden/TestUserCommand/Usage_message_when_no_args
@@ -0,0 +1,13 @@
+Usage:
+  authctl user [flags]
+  authctl user [command]
+
+Available Commands:
+  lock        Lock (disable) a user managed by authd
+  unlock      Unlock (enable) a user managed by authd
+  set-uid     Set the UID of a user managed by authd
+
+Flags:
+  -h, --help   help for user
+
+Use "authctl user [command] --help" for more information about a command.
diff --git a/cmd/authctl/user/testdata/golden/TestUserLockCommand/Error_locking_invalid_user b/cmd/authctl/user/testdata/golden/TestUserLockCommand/Error_locking_invalid_user
new file mode 100644
index 0000000000..93dd7dd5ff
--- /dev/null
+++ b/cmd/authctl/user/testdata/golden/TestUserLockCommand/Error_locking_invalid_user
@@ -0,0 +1 @@
+Error: user "invaliduser" not found
diff --git a/cmd/authctl/user/testdata/golden/TestUserLockCommand/Lock_user_success b/cmd/authctl/user/testdata/golden/TestUserLockCommand/Lock_user_success
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/cmd/authctl/user/unlock.go b/cmd/authctl/user/unlock.go
new file mode 100644
index 0000000000..66811a0a0f
--- /dev/null
+++ b/cmd/authctl/user/unlock.go
@@ -0,0 +1,32 @@
+package user
+
+import (
+	"context"
+
+	"github.com/canonical/authd/cmd/authctl/internal/client"
+	"github.com/canonical/authd/cmd/authctl/internal/completion"
+	"github.com/canonical/authd/internal/proto/authd"
+	"github.com/spf13/cobra"
+)
+
+// unlockCmd is a command to unlock (enable) a user.
+var unlockCmd = &cobra.Command{
+	Use:               "unlock <user>",
+	Short:             "Unlock (enable) a user managed by authd",
+	Long:              `Unlock a locked user so that they can log in again.`,
+	Args:              cobra.ExactArgs(1),
+	ValidArgsFunction: completion.Users,
+	RunE: func(cmd *cobra.Command, args []string) error {
+		client, err := client.NewUserServiceClient()
+		if err != nil {
+			return err
+		}
+
+		_, err = client.UnlockUser(context.Background(), &authd.UnlockUserRequest{Name: args[0]})
+		if err != nil {
+			return err
+		}
+
+		return nil
+	},
+}
diff --git a/cmd/authctl/user/user.go b/cmd/authctl/user/user.go
new file mode 100644
index 0000000000..109743aa17
--- /dev/null
+++ b/cmd/authctl/user/user.go
@@ -0,0 +1,20 @@
+// Package user provides utilities for managing user operations.
+package user
+
+import (
+	"github.com/spf13/cobra"
+)
+
+// UserCmd is a command to perform user-related operations.
+var UserCmd = &cobra.Command{
+	Use:   "user",
+	Short: "Commands related to users",
+	Args:  cobra.NoArgs,
+	RunE:  func(cmd *cobra.Command, args []string) error { return cmd.Usage() },
+}
+
+func init() {
+	UserCmd.AddCommand(lockCmd)
+	UserCmd.AddCommand(unlockCmd)
+	UserCmd.AddCommand(setUIDCmd)
+}
diff --git a/cmd/authctl/user/user_test.go b/cmd/authctl/user/user_test.go
new file mode 100644
index 0000000000..5010e8cc74
--- /dev/null
+++ b/cmd/authctl/user/user_test.go
@@ -0,0 +1,59 @@
+package user_test
+
+import (
+	"fmt"
+	"os"
+	"os/exec"
+	"testing"
+
+	"github.com/canonical/authd/internal/testutils"
+)
+
+var authctlPath string
+var daemonPath string
+
+func TestUserCommand(t *testing.T) {
+	t.Parallel()
+
+	tests := map[string]struct {
+		args             []string
+		expectedExitCode int
+	}{
+		"Usage_message_when_no_args": {expectedExitCode: 0},
+		"Help_flag":                  {args: []string{"--help"}, expectedExitCode: 0},
+
+		"Error_on_invalid_command": {args: []string{"invalid-command"}, expectedExitCode: 1},
+		"Error_on_invalid_flag":    {args: []string{"--invalid-flag"}, expectedExitCode: 1},
+	}
+
+	for name, tc := range tests {
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			//nolint:gosec // G204 it's safe to use exec.Command with a variable here
+			cmd := exec.Command(authctlPath, append([]string{"user"}, tc.args...)...)
+			testutils.CheckCommand(t, cmd, tc.expectedExitCode)
+		})
+	}
+}
+
+func TestMain(m *testing.M) {
+	var authctlCleanup func()
+	var err error
+	authctlPath, authctlCleanup, err = testutils.BuildAuthctl()
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "Setup: %v\n", err)
+		os.Exit(1)
+	}
+	defer authctlCleanup()
+
+	var daemonCleanup func()
+	daemonPath, daemonCleanup, err = testutils.BuildAuthdWithExampleBroker()
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "Setup: %v\n", err)
+		os.Exit(1)
+	}
+	defer daemonCleanup()
+
+	m.Run()
+}
diff --git a/cmd/authd/daemon/config.go b/cmd/authd/daemon/config.go
index 883bdf7001..3a2e7aa0ee 100644
--- a/cmd/authd/daemon/config.go
+++ b/cmd/authd/daemon/config.go
@@ -4,20 +4,19 @@ import (
 	"context"
 	"errors"
 	"fmt"
-	"log/slog"
 	"os"
 	"path/filepath"
 	"strings"
 
+	"github.com/canonical/authd/internal/consts"
+	"github.com/canonical/authd/internal/decorate"
+	"github.com/canonical/authd/log"
 	"github.com/spf13/cobra"
 	"github.com/spf13/viper"
-	"github.com/ubuntu/authd/internal/consts"
-	"github.com/ubuntu/authd/log"
-	"github.com/ubuntu/decorate"
 )
 
 // initViperConfig sets verbosity level and add config env variables and file support based on name prefix.
-func initViperConfig(name string, cmd *cobra.Command, vip *viper.Viper) (err error) {
+func initViperConfig(name string, cmd *cobra.Command, vip *viper.Viper, configDir string) (err error) {
 	defer decorate.OnError(&err, "can't load configuration")
 
 	// Force a visit of the local flags so persistent flags for all parents are merged.
@@ -37,7 +36,7 @@ func initViperConfig(name string, cmd *cobra.Command, vip *viper.Viper) (err err
 		vip.SetConfigName(name)
 		vip.AddConfigPath("./")
 		vip.AddConfigPath("$HOME/")
-		vip.AddConfigPath("/etc/authd/")
+		vip.AddConfigPath(configDir)
 		// Add the executable path to the config search path.
 		if binPath, err := os.Executable(); err != nil {
 			log.Warningf(context.Background(), "Failed to get current executable path, not adding it as a config dir: %v", err)
@@ -94,6 +93,5 @@ func setVerboseMode(level int) {
 		log.SetLevel(log.InfoLevel)
 	default:
 		log.SetLevel(log.DebugLevel)
-		slog.SetLogLoggerLevel(slog.LevelDebug)
 	}
 }
diff --git a/cmd/authd/daemon/daemon.go b/cmd/authd/daemon/daemon.go
index e5afc2980e..966de7d3bf 100644
--- a/cmd/authd/daemon/daemon.go
+++ b/cmd/authd/daemon/daemon.go
@@ -6,14 +6,14 @@ import (
 	"fmt"
 	"runtime"
 
+	"github.com/canonical/authd/internal/consts"
+	"github.com/canonical/authd/internal/daemon"
+	"github.com/canonical/authd/internal/decorate"
+	"github.com/canonical/authd/internal/services"
+	"github.com/canonical/authd/internal/users"
+	"github.com/canonical/authd/log"
 	"github.com/spf13/cobra"
 	"github.com/spf13/viper"
-	"github.com/ubuntu/authd/internal/consts"
-	"github.com/ubuntu/authd/internal/daemon"
-	"github.com/ubuntu/authd/internal/services"
-	"github.com/ubuntu/authd/internal/users"
-	"github.com/ubuntu/authd/log"
-	"github.com/ubuntu/decorate"
 )
 
 // cmdName is the binary name for the agent.
@@ -48,22 +48,41 @@ type daemonConfig struct {
 	UsersConfig *users.Config `mapstructure:",squash" yaml:",inline"`
 }
 
+type options struct {
+	configDir string
+}
+
+// Option is a function that modifies configuration options for the daemon.
+type Option func(*options)
+
+// WithConfigDir sets the configuration directory for the daemon.
+func WithConfigDir(configDir string) Option {
+	return func(o *options) {
+		o.configDir = configDir
+	}
+}
+
 // New registers commands and return a new App.
-func New() *App {
+func New(args ...Option) *App {
+	opts := &options{configDir: consts.DefaultConfigDir}
+	for _, arg := range args {
+		arg(opts)
+	}
+
 	a := App{ready: make(chan struct{})}
 	a.rootCmd = cobra.Command{
 		Use:                                                                                 fmt.Sprintf("%s COMMAND", cmdName),
 		Short:/*i18n.G(*/ "Authentication daemon",                                           /*)*/
 		Long:/*i18n.G(*/ "Authentication daemon bridging the system with external brokers.", /*)*/
 		Args:                                                                                cobra.NoArgs,
-		PersistentPreRunE: func(cmd *cobra.Command, args []string) error {
+		PersistentPreRun: func(cmd *cobra.Command, args []string) {
 			// First thing, initialize the journal handler
 			log.InitJournalHandler(false)
 
 			// Command parsing has been successful. Returns to not print usage anymore.
 			a.rootCmd.SilenceUsage = true
-			// TODO: before or after?  cmd.LocalFlags()
-
+		},
+		RunE: func(cmd *cobra.Command, args []string) error {
 			// Set config defaults
 			a.config = daemonConfig{
 				Paths: systemPaths{
@@ -75,7 +94,7 @@ func New() *App {
 			}
 
 			// Install and unmarshall configuration
-			if err := initViperConfig(cmdName, &a.rootCmd, a.viper); err != nil {
+			if err := initViperConfig(cmdName, &a.rootCmd, a.viper, opts.configDir); err != nil {
 				return err
 			}
 			if err := a.viper.Unmarshal(&a.config); err != nil {
@@ -85,6 +104,11 @@ func New() *App {
 			setVerboseMode(a.config.Verbosity)
 			log.Debugf(context.Background(), "Verbosity: %d", a.config.Verbosity)
 
+			// If we are only checking the configuration, we exit now.
+			if check, _ := cmd.Flags().GetBool("check-config"); check {
+				return nil
+			}
+
 			if err := maybeMigrateOldDBDir(oldDBDir, a.config.Paths.Database); err != nil {
 				return err
 			}
@@ -93,13 +117,14 @@ func New() *App {
 				return err
 			}
 
-			return nil
-		},
-		RunE: func(cmd *cobra.Command, args []string) error {
 			return a.serve(a.config)
 		},
 		// We display usage error ourselves
 		SilenceErrors: true,
+		// Don't add a completion subcommand, authd is not a CLI tool.
+		CompletionOptions: cobra.CompletionOptions{
+			DisableDefaultCmd: true,
+		},
 	}
 	viper := viper.New()
 
@@ -107,6 +132,8 @@ func New() *App {
 
 	installVerbosityFlag(&a.rootCmd, a.viper)
 	installConfigFlag(&a.rootCmd)
+	// Install the --check-config flag to check the configuration and exit.
+	a.rootCmd.Flags().Bool("check-config", false /*i18n.G(*/, "check configuration and exit" /*)*/)
 
 	// subcommands
 	a.installVersion()
diff --git a/cmd/authd/daemon/daemon_test.go b/cmd/authd/daemon/daemon_test.go
index 7dc47b279b..9e6b5afd8a 100644
--- a/cmd/authd/daemon/daemon_test.go
+++ b/cmd/authd/daemon/daemon_test.go
@@ -11,13 +11,14 @@ import (
 	"testing"
 	"time"
 
+	"github.com/canonical/authd/cmd/authd/daemon"
+	"github.com/canonical/authd/internal/consts"
+	"github.com/canonical/authd/internal/fileutils"
+	"github.com/canonical/authd/internal/testutils"
+	"github.com/canonical/authd/internal/users"
+	userslocking "github.com/canonical/authd/internal/users/locking"
+	"github.com/canonical/authd/log"
 	"github.com/stretchr/testify/require"
-	"github.com/ubuntu/authd/cmd/authd/daemon"
-	"github.com/ubuntu/authd/internal/consts"
-	"github.com/ubuntu/authd/internal/fileutils"
-	"github.com/ubuntu/authd/internal/testutils"
-	"github.com/ubuntu/authd/internal/users"
-	"github.com/ubuntu/authd/log"
 )
 
 func TestHelp(t *testing.T) {
@@ -29,15 +30,6 @@ func TestHelp(t *testing.T) {
 	require.NoErrorf(t, err, "Run should not return an error with argument --help. Stdout: %v", getStdout())
 }
 
-func TestCompletion(t *testing.T) {
-	a := daemon.NewForTests(t, nil, "completion", "bash")
-
-	getStdout := captureStdout(t)
-
-	err := a.Run()
-	require.NoError(t, err, "Completion should not start the daemon. Stdout: %v", getStdout())
-}
-
 func TestVersion(t *testing.T) {
 	a := daemon.NewForTests(t, nil, "version")
 
@@ -58,7 +50,7 @@ func TestVersion(t *testing.T) {
 }
 
 func TestNoUsageError(t *testing.T) {
-	a := daemon.NewForTests(t, nil, "completion", "bash")
+	a := daemon.NewForTests(t, nil, "version")
 
 	getStdout := captureStdout(t)
 	err := a.Run()
@@ -284,10 +276,8 @@ func TestConfigLoad(t *testing.T) {
 }
 
 func TestAutoDetectConfig(t *testing.T) {
-	customizedSocketPath := filepath.Join(t.TempDir(), "mysocket")
 	var config daemon.DaemonConfig
 	config.Verbosity = 1
-	config.Paths.Socket = customizedSocketPath
 
 	configPath := daemon.GenerateTestConfig(t, &config)
 	configNextToBinaryPath := filepath.Join(filepath.Dir(os.Args[0]), "authd.yaml")
@@ -296,31 +286,23 @@ func TestAutoDetectConfig(t *testing.T) {
 	// Remove configuration next binary for other tests to not pick it up.
 	defer os.Remove(configNextToBinaryPath)
 
-	a := daemon.New()
+	// Avoid that an existing config file in the config directory is picked up.
+	opt := daemon.WithConfigDir(t.TempDir())
 
-	wg := sync.WaitGroup{}
-	wg.Add(1)
-	go func() {
-		defer wg.Done()
-		err := a.Run()
-		require.NoError(t, err, "Run should exits without any error")
-	}()
-	a.WaitReady()
-	time.Sleep(50 * time.Millisecond)
+	a := daemon.New(opt)
+	a.SetArgs("--check-config")
 
-	defer wg.Wait()
-	defer a.Quit()
+	err = a.Run()
+	require.NoError(t, err, "Run should not return an error")
 
-	_, err = os.Stat(customizedSocketPath)
-	require.NoError(t, err, "Socket should exist")
 	require.Equal(t, 1, a.Config().Verbosity, "Verbosity is set from config")
 	require.Equal(t, &users.DefaultConfig, a.Config().UsersConfig, "Default Users Config")
 }
 
 func TestNoConfigSetDefaults(t *testing.T) {
 	a := daemon.New()
-	// Use version to still run preExec to load no config but without running server
-	a.SetArgs("version")
+
+	a.SetArgs("--check-config")
 
 	err := a.Run()
 	require.NoError(t, err, "Run should not return an error")
@@ -334,8 +316,7 @@ func TestNoConfigSetDefaults(t *testing.T) {
 
 func TestBadConfigReturnsError(t *testing.T) {
 	a := daemon.New()
-	// Use version to still run preExec to load no config but without running server
-	a.SetArgs("version", "--config", "/does/not/exist.yaml")
+	a.SetArgs("--check-config", "--config", "/does/not/exist.yaml")
 
 	err := a.Run()
 	require.Error(t, err, "Run should return an error on config file")
@@ -420,5 +401,8 @@ func TestMain(m *testing.M) {
 	}
 	defer cleanup()
 
+	userslocking.Z_ForTests_OverrideLocking()
+	defer userslocking.Z_ForTests_RestoreLocking()
+
 	m.Run()
 }
diff --git a/cmd/authd/daemon/integrationtests.go b/cmd/authd/daemon/integrationtests.go
index 3e79123fd3..07f5b605cd 100644
--- a/cmd/authd/daemon/integrationtests.go
+++ b/cmd/authd/daemon/integrationtests.go
@@ -6,7 +6,7 @@ import (
 	"fmt"
 	"os"
 
-	"github.com/ubuntu/authd/internal/testsdetection"
+	"github.com/canonical/authd/internal/testsdetection"
 )
 
 // load any behaviour modifiers from env variable.
diff --git a/cmd/authd/daemon/migration.go b/cmd/authd/daemon/migration.go
index 6b56f41415..ea4ae7374b 100644
--- a/cmd/authd/daemon/migration.go
+++ b/cmd/authd/daemon/migration.go
@@ -6,11 +6,11 @@ import (
 	"os"
 	"path/filepath"
 
-	"github.com/ubuntu/authd/internal/consts"
-	"github.com/ubuntu/authd/internal/fileutils"
-	"github.com/ubuntu/authd/internal/users/db"
-	"github.com/ubuntu/authd/internal/users/db/bbolt"
-	"github.com/ubuntu/authd/log"
+	"github.com/canonical/authd/internal/consts"
+	"github.com/canonical/authd/internal/fileutils"
+	"github.com/canonical/authd/internal/users/db"
+	"github.com/canonical/authd/internal/users/db/bbolt"
+	"github.com/canonical/authd/log"
 )
 
 func maybeMigrateOldDBDir(oldPath, newPath string) error {
diff --git a/cmd/authd/daemon/migration_test.go b/cmd/authd/daemon/migration_test.go
index 4677b0da49..9bef906265 100644
--- a/cmd/authd/daemon/migration_test.go
+++ b/cmd/authd/daemon/migration_test.go
@@ -5,13 +5,14 @@ import (
 	"path/filepath"
 	"testing"
 
+	"github.com/canonical/authd/internal/consts"
+	"github.com/canonical/authd/internal/fileutils"
+	"github.com/canonical/authd/internal/testutils/golden"
+	"github.com/canonical/authd/internal/users/db"
+	"github.com/canonical/authd/internal/users/db/bbolt"
+	localgrouptestutils "github.com/canonical/authd/internal/users/localentries/testutils"
+	userslocking "github.com/canonical/authd/internal/users/locking"
 	"github.com/stretchr/testify/require"
-	"github.com/ubuntu/authd/internal/consts"
-	"github.com/ubuntu/authd/internal/fileutils"
-	"github.com/ubuntu/authd/internal/testutils/golden"
-	"github.com/ubuntu/authd/internal/users/db"
-	"github.com/ubuntu/authd/internal/users/db/bbolt"
-	userslocking "github.com/ubuntu/authd/internal/users/locking"
 )
 
 func TestMaybeMigrateOldDBDir(t *testing.T) {
@@ -127,8 +128,7 @@ func TestMaybeMigrateBBoltToSQLite(t *testing.T) {
 
 	// Make the userslocking package use a locking mechanism which doesn't
 	// require root privileges.
-	userslocking.Z_ForTests_OverrideLocking()
-	t.Cleanup(userslocking.Z_ForTests_RestoreLocking)
+	userslocking.Z_ForTests_OverrideLockingWithCleanup(t)
 
 	testCases := map[string]struct {
 		bboltExists      bool
@@ -187,10 +187,8 @@ func TestMaybeMigrateBBoltToSQLite(t *testing.T) {
 			err := fileutils.CopyFile(groupFile, tempGroupFile)
 			require.NoError(t, err, "failed to copy group file for testing")
 
-			// Make the db package use the temporary group file
-			origGroupFile := db.Z_ForTests_GetGroupFile()
-			db.Z_ForTests_SetGroupFile(tempGroupFile)
-			t.Cleanup(func() { db.Z_ForTests_SetGroupFile(origGroupFile) })
+			// Make the localentries package use the test group file.
+			tempGroupFile = localgrouptestutils.SetupGroupMock(t, tempGroupFile)
 
 			migrated, err := maybeMigrateBBoltToSQLite(dbDir)
 			if tc.wantError {
diff --git a/cmd/authd/daemon/testdata/golden/TestMaybeMigrateBBoltToSQLite/Migration_if_bbolt_exists_and_sqlite_does_not_exist/db b/cmd/authd/daemon/testdata/golden/TestMaybeMigrateBBoltToSQLite/Migration_if_bbolt_exists_and_sqlite_does_not_exist/db
index 9a59a4ead0..064aef046d 100644
--- a/cmd/authd/daemon/testdata/golden/TestMaybeMigrateBBoltToSQLite/Migration_if_bbolt_exists_and_sqlite_does_not_exist/db
+++ b/cmd/authd/daemon/testdata/golden/TestMaybeMigrateBBoltToSQLite/Migration_if_bbolt_exists_and_sqlite_does_not_exist/db
@@ -1,32 +1,32 @@
 users:
-    - name: user1
+    - name: user1@example.com
       uid: 1111
       gid: 11111
       gecos: |-
         User1 gecos
         On multiple lines
-      dir: /home/user1
+      dir: /home/user1@example.com
       shell: /bin/bash
       broker_id: broker-id
-    - name: user2
+    - name: user2@example.com
       uid: 2222
       gid: 22222
       gecos: User2
-      dir: /home/user2
+      dir: /home/user2@example.com
       shell: /bin/dash
       broker_id: broker-id
-    - name: user3
+    - name: user3@example.com
       uid: 3333
       gid: 33333
       gecos: User3
-      dir: /home/user3
+      dir: /home/user3@example.com
       shell: /bin/zsh
       broker_id: broker-id
-    - name: userwithoutbroker
+    - name: userwithoutbroker@example.com
       uid: 4444
       gid: 44444
       gecos: userwithoutbroker
-      dir: /home/userwithoutbroker
+      dir: /home/userwithoutbroker@example.com
       shell: /bin/sh
 groups:
     - name: group1
@@ -61,4 +61,4 @@ users_to_groups:
       gid: 44444
     - uid: 4444
       gid: 99999
-schema_version: 1
+schema_version: 2
diff --git a/cmd/authd/daemon/testdata/golden/TestMaybeMigrateBBoltToSQLite/Migration_if_bbolt_exists_and_sqlite_does_not_exist/group b/cmd/authd/daemon/testdata/golden/TestMaybeMigrateBBoltToSQLite/Migration_if_bbolt_exists_and_sqlite_does_not_exist/group
index d284122dc2..1a1e08e363 100644
--- a/cmd/authd/daemon/testdata/golden/TestMaybeMigrateBBoltToSQLite/Migration_if_bbolt_exists_and_sqlite_does_not_exist/group
+++ b/cmd/authd/daemon/testdata/golden/TestMaybeMigrateBBoltToSQLite/Migration_if_bbolt_exists_and_sqlite_does_not_exist/group
@@ -1,5 +1,5 @@
 root:x:0:
 other-local-group:x:1234:
-other-local-group-with-users:x:4321:user-foo,user-bar
-group1:x:11111:user1
-UpperCaseGroup:x:11111:user1,user3
+other-local-group-with-users:x:4321:user-foo@example.com,user-bar@example.com
+group1:x:11111:user1@example.com
+UpperCaseGroup:x:11112:user1@example.com,user3@example.com
diff --git a/cmd/authd/daemon/testdata/group b/cmd/authd/daemon/testdata/group
index 121f89c7e0..4b212d8698 100644
--- a/cmd/authd/daemon/testdata/group
+++ b/cmd/authd/daemon/testdata/group
@@ -1,5 +1,5 @@
 root:x:0:
 other-local-group:x:1234:
-other-local-group-with-users:x:4321:user-foo,user-bar
-group1:x:11111:user1
-UpperCaseGroup:x:11111:user1,User3
+other-local-group-with-users:x:4321:user-foo@example.com,user-bar@example.com
+group1:x:11111:user1@example.com
+UpperCaseGroup:x:11112:user1@example.com,User3@example.com
diff --git a/cmd/authd/daemon/testdata/multiple_users_and_groups.db.yaml b/cmd/authd/daemon/testdata/multiple_users_and_groups.db.yaml
index 6bee451a8e..297031d118 100644
--- a/cmd/authd/daemon/testdata/multiple_users_and_groups.db.yaml
+++ b/cmd/authd/daemon/testdata/multiple_users_and_groups.db.yaml
@@ -23,15 +23,15 @@ GroupToUsers:
   "44444": '{"GID":33333,"UIDs":[4444]}'
   "99999": '{"GID":99999,"UIDs":[1111,2222,3333,4444]}'
 UserByID:
-  "1111": '{"Name":"user1","UID":1111,"GID":11111,"Gecos":"User1 gecos\nOn multiple lines","Dir":"/home/user1","Shell":"/bin/bash","LastPwdChange":-1,"MaxPwdAge":-1,"PwdWarnPeriod":-1,"PwdInactivity":-1,"MinPwdAge":-1,"ExpirationDate":-1}'
-  "2222": '{"Name":"user2","UID":2222,"GID":22222,"Gecos":"User2","Dir":"/home/user2","Shell":"/bin/dash","LastPwdChange":-1,"MaxPwdAge":-1,"PwdWarnPeriod":-1,"PwdInactivity":-1,"MinPwdAge":-1,"ExpirationDate":-1}'
-  "3333": '{"Name":"User3","UID":3333,"GID":33333,"Gecos":"User3","Dir":"/home/user3","Shell":"/bin/zsh","LastPwdChange":-1,"MaxPwdAge":-1,"PwdWarnPeriod":-1,"PwdInactivity":-1,"MinPwdAge":-1,"ExpirationDate":-1}'
-  "4444": '{"Name":"userwithoutbroker","UID":4444,"GID":44444,"Gecos":"userwithoutbroker","Dir":"/home/userwithoutbroker","Shell":"/bin/sh","LastPwdChange":-1,"MaxPwdAge":-1,"PwdWarnPeriod":-1,"PwdInactivity":-1,"MinPwdAge":-1,"ExpirationDate":-1}'
+  "1111": '{"Name":"user1@example.com","UID":1111,"GID":11111,"Gecos":"User1 gecos\nOn multiple lines","Dir":"/home/user1@example.com","Shell":"/bin/bash","LastPwdChange":-1,"MaxPwdAge":-1,"PwdWarnPeriod":-1,"PwdInactivity":-1,"MinPwdAge":-1,"ExpirationDate":-1}'
+  "2222": '{"Name":"user2@example.com","UID":2222,"GID":22222,"Gecos":"User2","Dir":"/home/user2@example.com","Shell":"/bin/dash","LastPwdChange":-1,"MaxPwdAge":-1,"PwdWarnPeriod":-1,"PwdInactivity":-1,"MinPwdAge":-1,"ExpirationDate":-1}'
+  "3333": '{"Name":"User3@example.com","UID":3333,"GID":33333,"Gecos":"User3","Dir":"/home/user3@example.com","Shell":"/bin/zsh","LastPwdChange":-1,"MaxPwdAge":-1,"PwdWarnPeriod":-1,"PwdInactivity":-1,"MinPwdAge":-1,"ExpirationDate":-1}'
+  "4444": '{"Name":"userwithoutbroker@example.com","UID":4444,"GID":44444,"Gecos":"userwithoutbroker","Dir":"/home/userwithoutbroker@example.com","Shell":"/bin/sh","LastPwdChange":-1,"MaxPwdAge":-1,"PwdWarnPeriod":-1,"PwdInactivity":-1,"MinPwdAge":-1,"ExpirationDate":-1}'
 UserByName:
-  user1: '{"Name":"user1","UID":1111,"GID":11111,"Gecos":"User1 gecos\nOn multiple lines","Dir":"/home/user1","Shell":"/bin/bash","LastPwdChange":-1,"MaxPwdAge":-1,"PwdWarnPeriod":-1,"PwdInactivity":-1,"MinPwdAge":-1,"ExpirationDate":-1}'
-  user2: '{"Name":"user2","UID":2222,"GID":22222,"Gecos":"User2","Dir":"/home/user2","Shell":"/bin/dash","LastPwdChange":-1,"MaxPwdAge":-1,"PwdWarnPeriod":-1,"PwdInactivity":-1,"MinPwdAge":-1,"ExpirationDate":-1}'
-  User3: '{"Name":"User3","UID":3333,"GID":33333,"Gecos":"User3","Dir":"/home/user3","Shell":"/bin/zsh","LastPwdChange":-1,"MaxPwdAge":-1,"PwdWarnPeriod":-1,"PwdInactivity":-1,"MinPwdAge":-1,"ExpirationDate":-1}'
-  userwithoutbroker: '{"Name":"userwithoutbroker","UID":4444,"GID":44444,"Gecos":"userwithoutbroker","Dir":"/home/userwithoutbroker","Shell":"/bin/sh","LastPwdChange":-1,"MaxPwdAge":-1,"PwdWarnPeriod":-1,"PwdInactivity":-1,"MinPwdAge":-1,"ExpirationDate":-1}'
+  user1@example.com: '{"Name":"user1@example.com","UID":1111,"GID":11111,"Gecos":"User1 gecos\nOn multiple lines","Dir":"/home/user1@example.com","Shell":"/bin/bash","LastPwdChange":-1,"MaxPwdAge":-1,"PwdWarnPeriod":-1,"PwdInactivity":-1,"MinPwdAge":-1,"ExpirationDate":-1}'
+  user2@example.com: '{"Name":"user2@example.com","UID":2222,"GID":22222,"Gecos":"User2","Dir":"/home/user2@example.com","Shell":"/bin/dash","LastPwdChange":-1,"MaxPwdAge":-1,"PwdWarnPeriod":-1,"PwdInactivity":-1,"MinPwdAge":-1,"ExpirationDate":-1}'
+  User3@example.com: '{"Name":"User3@example.com","UID":3333,"GID":33333,"Gecos":"User3","Dir":"/home/user3@example.com","Shell":"/bin/zsh","LastPwdChange":-1,"MaxPwdAge":-1,"PwdWarnPeriod":-1,"PwdInactivity":-1,"MinPwdAge":-1,"ExpirationDate":-1}'
+  userwithoutbroker@example.com: '{"Name":"userwithoutbroker@example.com","UID":4444,"GID":44444,"Gecos":"userwithoutbroker","Dir":"/home/userwithoutbroker@example.com","Shell":"/bin/sh","LastPwdChange":-1,"MaxPwdAge":-1,"PwdWarnPeriod":-1,"PwdInactivity":-1,"MinPwdAge":-1,"ExpirationDate":-1}'
 UserToGroups:
   "1111": '{"UID":1111,"GIDs":[11111,99999]}'
   "2222": '{"UID":2222,"GIDs":[22222,99999]}'
diff --git a/cmd/authd/daemon/version.go b/cmd/authd/daemon/version.go
index 60507ff37a..ff57a743b5 100644
--- a/cmd/authd/daemon/version.go
+++ b/cmd/authd/daemon/version.go
@@ -3,8 +3,8 @@ package daemon
 import (
 	"fmt"
 
+	"github.com/canonical/authd/internal/consts"
 	"github.com/spf13/cobra"
-	"github.com/ubuntu/authd/internal/consts"
 )
 
 func (a *App) installVersion() {
diff --git a/cmd/authd/integrationtests.go b/cmd/authd/integrationtests.go
index 85c1e86ff0..0ddac28156 100644
--- a/cmd/authd/integrationtests.go
+++ b/cmd/authd/integrationtests.go
@@ -5,14 +5,13 @@
 package main
 
 import (
+	"fmt"
 	"os"
-	"strings"
 
-	"github.com/ubuntu/authd/internal/services/permissions"
-	"github.com/ubuntu/authd/internal/testsdetection"
-	"github.com/ubuntu/authd/internal/users/db"
-	"github.com/ubuntu/authd/internal/users/localentries"
-	userslocking "github.com/ubuntu/authd/internal/users/locking"
+	"github.com/canonical/authd/internal/services/permissions"
+	"github.com/canonical/authd/internal/testsdetection"
+	"github.com/canonical/authd/internal/users/localentries"
+	userslocking "github.com/canonical/authd/internal/users/locking"
 )
 
 // load any behaviour modifiers from env variable.
@@ -23,14 +22,15 @@ func init() {
 		permissions.Z_ForTests_DefaultCurrentUserAsRoot()
 	}
 
-	gpasswdArgs := os.Getenv("AUTHD_INTEGRATIONTESTS_GPASSWD_ARGS")
-	grpFilePath := os.Getenv("AUTHD_INTEGRATIONTESTS_GPASSWD_GRP_FILE_PATH")
-	if gpasswdArgs == "" || grpFilePath == "" {
-		panic("AUTHD_INTEGRATIONTESTS_GPASSWD_ARGS and AUTHD_INTEGRATIONTESTS_GPASSWD_GRP_FILE_PATH must be set")
+	grpFilePath := os.Getenv(localentries.Z_ForTests_GroupFilePathEnv)
+	if grpFilePath == "" {
+		panic(fmt.Sprintf("%q must be set", localentries.Z_ForTests_GroupFilePathEnv))
 	}
-	localentries.Z_ForTests_SetGpasswdCmd(strings.Split(gpasswdArgs, " "))
-	localentries.Z_ForTests_SetGroupPath(grpFilePath)
-	db.Z_ForTests_SetGroupFile(grpFilePath)
+	grpFileOutputPath := os.Getenv(localentries.Z_ForTests_GroupFileOutputPathEnv)
+	if grpFileOutputPath == "" {
+		grpFileOutputPath = grpFilePath
+	}
+	localentries.Z_ForTests_SetGroupPath(grpFilePath, grpFileOutputPath)
 
 	userslocking.Z_ForTests_OverrideLocking()
 }
diff --git a/cmd/authd/main.go b/cmd/authd/main.go
index 8314ec27e3..ee13942b63 100644
--- a/cmd/authd/main.go
+++ b/cmd/authd/main.go
@@ -8,8 +8,8 @@ import (
 	"sync"
 	"syscall"
 
-	"github.com/ubuntu/authd/cmd/authd/daemon"
-	"github.com/ubuntu/authd/log"
+	"github.com/canonical/authd/cmd/authd/daemon"
+	"github.com/canonical/authd/log"
 )
 
 //FIXME go:generate go run ../generate_completion_documentation.go completion ../../generated
@@ -55,13 +55,16 @@ func installSignalHandler(a app) func() {
 		for {
 			switch v, ok := <-c; v {
 			case syscall.SIGINT, syscall.SIGTERM:
+				log.Infof(context.Background(), "Received signal %d (%s), exiting...", v, v.String())
 				a.Quit()
 				return
 			case syscall.SIGHUP:
 				if a.Hup() {
+					log.Info(context.Background(), "Received SIGHUP, exiting...")
 					a.Quit()
 					return
 				}
+				log.Info(context.Background(), "Received SIGHUP, but nothing to do")
 			default:
 				// channel was closed: we exited
 				if !ok {
diff --git a/debian/authd-config/authd.yaml b/debian/authd-config/authd.yaml
index 5dc865272d..42e127ef55 100644
--- a/debian/authd-config/authd.yaml
+++ b/debian/authd-config/authd.yaml
@@ -11,13 +11,14 @@
 ## These define the minimum and maximum UID and GID values assigned
 ## to users and groups by authd.
 ##
-## Ensure that these ranges do not overlap with other ID ranges in use,
-## such as those specified in /etc/subuid or /etc/subgid.
+## Ensure these ranges do not overlap with other UID/GID ranges in use.
+## For common ranges typically used on Linux, see:
+## https://systemd.io/UIDS-GIDS/#summary
 ##
 ## Note: The user private group (the group named after the user) is always
 ## created with the same GID as the user’s UID, regardless of the GID_MIN
 ## and GID_MAX values.
-#UID_MIN: 1000000000
-#UID_MAX: 1999999999
-#GID_MIN: 1000000000
-#GID_MAX: 1999999999
+#UID_MIN: 10000
+#UID_MAX: 60000
+#GID_MIN: 10000
+#GID_MAX: 60000
diff --git a/debian/authd.gdm-authd.pam b/debian/authd.gdm-authd.pam
index 32e8bb66ab..2c6000f506 100644
--- a/debian/authd.gdm-authd.pam
+++ b/debian/authd.gdm-authd.pam
@@ -1,6 +1,6 @@
 #%PAM-1.0
 auth    [success=ok user_unknown=ignore default=bad] pam_succeed_if.so user != root quiet_success
-auth    [success=1 ignore=ignore default=die authinfo_unavail=ignore] pam_authd.so
+auth    [success=1 ignore=ignore default=die authinfo_unavail=ignore module_unknown=ignore] pam_authd.so
 # If authd ignored the request => local broker is selected,
 # then we continue with normal stack
 auth    substack        common-auth
diff --git a/debian/authd.service.in b/debian/authd.service.in
index dc4041f8d3..b3729ad741 100644
--- a/debian/authd.service.in
+++ b/debian/authd.service.in
@@ -1,5 +1,5 @@
 [Unit]
-Description=Authd daemon service
+Description=authd daemon service
 After=authd.socket
 Requires=authd.socket
 PartOf=authd.socket
@@ -34,7 +34,6 @@ StateDirectoryMode=0700
 
 # This always corresponds to /etc/authd
 ConfigurationDirectory=authd
-ConfigurationDirectoryMode=0700
 
 # Prevent writing to /usr and bootloader paths.
 # We don't use "full" or "strict", because home paths can be anywhere and so we need
@@ -87,5 +86,11 @@ SystemCallFilter=@system-service
 # This makes all files and directories not associated with process management invisible in /proc
 ProcSubset=pid
 
-# gpasswd requires this specific capability to alter the shadow files
-CapabilityBoundingSet=CAP_CHOWN
+# CAP_CHOWN: Required by gpasswd to alter the shadow files.
+# CAP_DAC_READ_SEARCH: Required by the chown system call to change ownership of
+#                      files not owned by the user. We need this to change the
+#                      ownership of the user's home directory when changing the
+#                      user's UID.
+# CAP_SYS_PTRACE: Required by CheckUserBusy used by SetUserID to check if any
+#                 running processes are owned by the UID being modified.
+CapabilityBoundingSet=CAP_CHOWN CAP_DAC_READ_SEARCH CAP_SYS_PTRACE
diff --git a/debian/authd.socket b/debian/authd.socket
index 6dc1ec94b6..9461261261 100644
--- a/debian/authd.socket
+++ b/debian/authd.socket
@@ -1,5 +1,5 @@
 [Unit]
-Description=Socket activation for Authd daemon
+Description=Socket activation for authd daemon
 # Ensure there's no ordering cycle since authd needs to start after dbus
 DefaultDependencies=No
 Wants=dbus.service
diff --git a/debian/changelog b/debian/changelog
index 9a95c8a15b..b4490b3170 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,20 @@
+authd (0.6.0~pre2) UNRELEASED; urgency=medium
+
+  * Change default UID/GID range to 10000:60000.
+  * Add authctl, a command-line tool to manage authd users and groups.
+  * Deny login if session is offline and user or device is disabled.
+  * Allow setting the same local password when redoing device authentication.
+  * Make errors when checking home dir owner during startup non-fatal.
+  * Fix authentication behaviour when refresh token is missing.
+  * Fix GDM broken when authd is uninstalled.
+  * Avoid races when getting user and group entries.
+  * Use lckpwdf to lock the database when manipulating users or groups.
+  * Improve error messages.
+  * debian/control: Install missing build dependency systemd-dev.
+  * debian/postrm: Remove /etc/pam.d/gdm-authd.
+
+ -- Adrian Dombeck <adrian.dombeck@canonical.com>  Thu, 19 Mar 2026 13:04:09 +0100
+
 authd (0.5.11) resolute; urgency=medium
 
   * Skip flaky tests in autopkgtests and during deb build.
@@ -37,7 +54,7 @@ authd (0.5.8) resolute; urgency=medium
     many of our vendored dependencies do not declare a copyright holder.
   * needs-packaging: LP: #2136731
 
- -- Adrian Dombeck <adrian.dombeck@canonical.com>  Tue, 23 Feb 2026 11:58:00 +0100
+ -- Adrian Dombeck <adrian.dombeck@canonical.com>  Mon, 23 Feb 2026 11:58:00 +0100
 
 authd (0.5.7) resolute; urgency=medium
 
diff --git a/debian/control b/debian/control
index c4cfd7ee59..16a917b89b 100644
--- a/debian/control
+++ b/debian/control
@@ -11,28 +11,31 @@ Build-Depends: debhelper-compat (= 13),
                dh-exec,
                dh-golang,
                dctrl-tools,
+               cargo (>= 1.82) | cargo-1.82,
 # FIXME: We need cargo-vendor-filterer starting from plucky, but noble isn't ready yet
 # so workaround it, making it kind of optional, and requiring it only on versions after
 # noble (controlled via base-files version that matches the one in noble).
                cargo-vendor-filterer | base-files (<< 13.5),
-               golang-go (>= 2:1.23~) | golang-1.23-go,
+               golang-go (>= 2:1.25~) | golang-1.25-go,
                libc6-dev (>= 2.35),
                libglib2.0-dev,
                libpam0g-dev,
                libpwquality-dev,
                pkgconf,
                protobuf-compiler,
+               systemd-dev,
+               uidmap <!nocheck>,
 Standards-Version: 4.6.2
-XS-Go-Import-Path: github.com/ubuntu/authd
-XS-Vendored-Sources-Rust: adler2@2.0.0, aho-corasick@1.1.3, anyhow@1.0.98, async-trait@0.1.88, atomic-waker@1.1.2, autocfg@1.4.0, axum-core@0.5.2, axum@0.8.4, base64@0.22.1, bitflags@2.9.0, bytes@1.10.1, cc@1.2.21, cfg-if@1.0.0, chrono@0.4.41, colored@2.2.0, crc32fast@1.4.2, ctor-proc-macro@0.0.5, ctor@0.4.2, deranged@0.4.0, dtor-proc-macro@0.0.5, dtor@0.0.6, either@1.15.0, equivalent@1.0.2, errno@0.3.11, fastrand@2.3.0, fixedbitset@0.5.7, flate2@1.1.1, fnv@1.0.7, futures-channel@0.3.31, futures-core@0.3.31, futures-sink@0.3.31, futures-task@0.3.31, futures-util@0.3.31, getrandom@0.3.2, h2@0.4.10, hashbrown@0.15.3, heck@0.5.0, hex@0.4.3, hostname@0.4.1, http-body-util@0.1.3, http-body@1.0.1, http@1.3.1, httparse@1.10.1, httpdate@1.0.3, hyper-timeout@0.5.2, hyper-util@0.1.11, hyper@1.6.0, iana-time-zone@0.1.63, indexmap@2.9.0, itertools@0.14.0, itoa@1.0.15, lazy_static@1.5.0, libc@0.2.172, libnss@0.9.0, linux-raw-sys@0.4.15, linux-raw-sys@0.9.4, log@0.4.27, matchit@0.8.4, memchr@2.7.4, mime@0.3.17, miniz_oxide@0.8.8, mio@1.0.3, multimap@0.10.0, num-conv@0.1.0, num-traits@0.2.19, num_threads@0.1.7, once_cell@1.21.3, paste@1.0.15, percent-encoding@2.3.1, petgraph@0.7.1, pin-project-internal@1.1.10, pin-project-lite@0.2.16, pin-project@1.1.10, pin-utils@0.1.0, powerfmt@0.2.0, prettyplease@0.2.32, proc-macro2@1.0.95, procfs-core@0.17.0, procfs@0.17.0, prost-build@0.13.5, prost-derive@0.13.5, prost-types@0.13.5, prost@0.13.5, quote@1.0.40, regex-automata@0.4.9, regex-syntax@0.8.5, regex@1.11.1, rustix@0.38.44, rustix@1.0.7, rustversion@1.0.20, serde@1.0.219, shlex@1.3.0, simple_logger@5.0.0, slab@0.4.9, smallvec@1.15.0, socket2@0.5.9, syn@2.0.101, sync_wrapper@1.0.2, syslog@7.0.0, tempfile@3.19.1, time-core@0.1.4, time-macros@0.2.22, time@0.3.41, tokio-macros@2.5.0, tokio-stream@0.1.17, tokio-util@0.7.15, tokio@1.45.0, tonic-build@0.13.1, tonic@0.13.1, tower-layer@0.3.3, tower-service@0.3.3, tower@0.4.13, tower@0.5.2, tracing-attributes@0.1.28, tracing-core@0.1.33, tracing@0.1.41, try-lock@0.2.5, unicode-ident@1.0.18, want@0.3.1
-Homepage: https://github.com/ubuntu/authd
-Vcs-Browser: https://github.com/ubuntu/authd
-Vcs-Git: https://github.com/ubuntu/authd.git
+XS-Go-Import-Path: github.com/canonical/authd
+XS-Vendored-Sources-Rust: adler2@2.0.1, aho-corasick@1.1.3, anyhow@1.0.99, async-trait@0.1.89, atomic-waker@1.1.2, autocfg@1.5.0, axum-core@0.5.2, axum@0.8.4, base64@0.22.1, bitflags@2.9.3, bytes@1.11.1, cc@1.2.34, cfg-if@1.0.3, chrono@0.4.41, colored@2.2.0, crc32fast@1.5.0, ctor-proc-macro@0.0.6, ctor@0.5.0, deranged@0.4.0, dtor-proc-macro@0.0.6, dtor@0.1.0, either@1.15.0, equivalent@1.0.2, errno@0.3.13, fastrand@2.3.0, fixedbitset@0.5.7, flate2@1.1.2, fnv@1.0.7, futures-channel@0.3.31, futures-core@0.3.31, futures-sink@0.3.31, futures-task@0.3.31, futures-util@0.3.31, getrandom@0.3.3, h2@0.4.12, hashbrown@0.15.5, heck@0.5.0, hex@0.4.3, hostname@0.4.1, http-body-util@0.1.3, http-body@1.0.1, http@1.3.1, httparse@1.10.1, httpdate@1.0.3, hyper-timeout@0.5.2, hyper-util@0.1.16, hyper@1.7.0, iana-time-zone@0.1.63, indexmap@2.11.0, itertools@0.14.0, itoa@1.0.15, lazy_static@1.5.0, libc@0.2.175, libnss@0.9.0, linux-raw-sys@0.4.15, linux-raw-sys@0.9.4, log@0.4.27, matchit@0.8.4, memchr@2.7.5, mime@0.3.17, miniz_oxide@0.8.9, mio@1.0.4, multimap@0.10.1, num-conv@0.1.0, num-traits@0.2.19, num_threads@0.1.7, once_cell@1.21.3, paste@1.0.15, percent-encoding@2.3.2, petgraph@0.7.1, pin-project-internal@1.1.10, pin-project-lite@0.2.16, pin-project@1.1.10, pin-utils@0.1.0, powerfmt@0.2.0, prettyplease@0.2.37, proc-macro2@1.0.101, procfs-core@0.17.0, procfs@0.17.0, prost-build@0.14.1, prost-derive@0.14.1, prost-types@0.14.1, prost@0.14.1, pulldown-cmark-to-cmark@21.0.0, pulldown-cmark@0.13.0, quote@1.0.40, regex-automata@0.4.10, regex-syntax@0.8.6, regex@1.11.2, rustix@0.38.44, rustix@1.0.8, rustversion@1.0.22, serde@1.0.219, shlex@1.3.0, simple_logger@5.0.0, slab@0.4.11, smallvec@1.15.1, socket2@0.6.0, syn@2.0.106, sync_wrapper@1.0.2, syslog@7.0.0, tempfile@3.21.0, time-core@0.1.4, time-macros@0.2.22, time@0.3.41, tokio-macros@2.5.0, tokio-stream@0.1.17, tokio-util@0.7.16, tokio@1.47.1, tonic-build@0.14.2, tonic-prost-build@0.14.2, tonic-prost@0.14.2, tonic@0.14.2, tower-layer@0.3.3, tower-service@0.3.3, tower@0.4.13, tower@0.5.2, tracing-attributes@0.1.30, tracing-core@0.1.34, tracing@0.1.41, try-lock@0.2.5, unicase@2.8.1, unicode-ident@1.0.18, want@0.3.1
+Homepage: https://github.com/canonical/authd
+Vcs-Browser: https://github.com/canonical/authd
+Vcs-Git: https://github.com/canonical/authd.git
 Description: Authentication daemon for cloud-based identity provider
- Authd is a versatile authentication service designed to seamlessly integrate
+ authd is a versatile authentication service designed to seamlessly integrate
  with cloud identity providers like OpenID Connect and Entra ID. It offers a
  secure interface for system authentication, supporting cloud-based identity
- management. Authd features a modular structure, facilitating straightforward
+ management. authd features a modular structure, facilitating straightforward
  integration with different cloud services maintaining strong security and
  effective user authentication.
 
diff --git a/debian/copyright b/debian/copyright
index 3fa1764cde..778f1c07ba 100644
--- a/debian/copyright
+++ b/debian/copyright
@@ -55,11 +55,19 @@ Files: vendor/github.com/coreos/*
 Copyright: 2015-2018 CoreOS, Inc.
 License: Apache-2.0
 
+Files: vendor/github.com/coreos/go-systemd/v22/activation/files.go
+Copyright: 2026 RedHat, Inc.
+License: Apache-2.0
+
 Files: vendor/github.com/coreos/go-systemd/v22/daemon/sdnotify.go
 Copyright: 2014 Docker, Inc.
            2015-2018 CoreOS, Inc.
 License: Apache-2.0
 
+Files: vendor/github.com/cpuguy83/*
+Copyright: 2014 Brian Goff
+License: Expat
+
 Files: vendor/github.com/davecgh/*
 Copyright: 2012-2016 Dave Collins <dave@davec.name>
 License: ISC
@@ -165,6 +173,10 @@ Files: vendor/github.com/rivo/*
 Copyright: 2019 Oliver Kuederle
 License: Expat
 
+Files: vendor/github.com/russross/*
+Copyright: 2011 Russ Ross <russ@russross.com>
+License: BSD-2-clause
+
 Files: vendor/github.com/sagikazarmark/*
 Copyright: 2023 Márk Sági-Kazár <mark.sagikazar@gmail.com>
 License: Expat
@@ -173,14 +185,6 @@ Files: vendor/github.com/sahilm/*
 Copyright: 2017 Sahil Muthoo
 License: Expat
 
-Files: vendor/github.com/sirupsen/*
-Copyright: 2014 Simon Eskildsen
-License: Expat
-
-Files: vendor/github.com/sirupsen/logrus/alt_exit.go
-Copyright: 2012 Miki Tebeka <miki.tebeka@gmail.com>
-License: Expat
-
 Files: vendor/github.com/skip2/*
 Copyright: 2014 Tom Harwood
 License: Expat
@@ -246,10 +250,6 @@ Files: vendor/github.com/subosito/*
 Copyright: 2013 Alif Rachmawadi
 License: Expat
 
-Files: vendor/github.com/ubuntu/*
-Copyright: 2022-2023 Canonical Ltd.
-License: Expat
-
 Files: vendor/github.com/xo/*
 Copyright: 2016 Anmol Sethi
 License: Expat
@@ -258,28 +258,56 @@ Files: vendor/go.etcd.io/*
 Copyright: 2013 Ben Johnson
 License: Expat
 
-Files: vendor/go.uber.org/*
-Copyright: 2016-2021 Uber Technologies, Inc.
+Files: vendor/go.yaml.in/*
+Copyright: 2006-2011 Kirill Simonov
+           2011 staring in  when the project was ported over:
+           2011-2016 Canonical Ltd.
+License: Apache-2.0 or Expat
+
+Files: vendor/go.yaml.in/yaml/v3/README.md
+Copyright: 2006-2011 Kirill Simonov
+           2011 staring in  when the project was ported over:
+           2011-2016 Canonical Ltd.
 License: Expat
 
+Files: vendor/go.yaml.in/yaml/v3/apic.go
+       vendor/go.yaml.in/yaml/v3/emitterc.go
+       vendor/go.yaml.in/yaml/v3/parserc.go
+       vendor/go.yaml.in/yaml/v3/readerc.go
+       vendor/go.yaml.in/yaml/v3/scannerc.go
+       vendor/go.yaml.in/yaml/v3/writerc.go
+       vendor/go.yaml.in/yaml/v3/yamlh.go
+       vendor/go.yaml.in/yaml/v3/yamlprivateh.go
+Copyright: 2006-2010 Kirill Simonov
+           2011-2019 Canonical Ltd
+License: Expat
+
+Files: vendor/go.yaml.in/yaml/v3/decode.go
+       vendor/go.yaml.in/yaml/v3/encode.go
+       vendor/go.yaml.in/yaml/v3/resolve.go
+       vendor/go.yaml.in/yaml/v3/sorter.go
+       vendor/go.yaml.in/yaml/v3/yaml.go
+Copyright: 2011-2019 Canonical Ltd
+License: Apache-2.0
+
 Files: vendor/golang.org/*
 Copyright: 2009-2025 The Go Authors.
 License: BSD-3-clause
 
 Files: vendor/google.golang.org/genproto/*
-Copyright: 2024 Google LLC
+Copyright: 2025 Google LLC
 License: Apache-2.0
 
 Files: vendor/google.golang.org/grpc/*
-Copyright: 2014-2024 The gRPC Authors
+Copyright: 2014-2025 The gRPC Authors
 License: Apache-2.0
 
 Files: vendor/google.golang.org/grpc/CONTRIBUTING.md
-Copyright: message template
+Copyright: message*
 License: Apache-2.0
 
 Files: vendor/google.golang.org/protobuf/*
-Copyright: 2018-2024 The Go Authors.
+Copyright: 2018-2025 The Go Authors.
 License: BSD-3-clause
 
 Files: vendor/google.golang.org/protobuf/types/*
@@ -410,10 +438,19 @@ License: Apache-2.0 or Expat
 Files: vendor_rust/ctor/*
 License: Apache-2.0 or Expat
 
+Files: vendor_rust/ctor-proc-macro/*
+License: Apache-2.0 or Expat
+
 Files: vendor_rust/deranged/*
 Copyright: 2024 Jacob Pratt et al.
 License: Apache-2.0 or Expat
 
+Files: vendor_rust/dtor/*
+License: Apache-2.0 or Expat
+
+Files: vendor_rust/dtor-proc-macro/*
+License: Apache-2.0 or Expat
+
 Files: vendor_rust/either/*
 License: Apache-2.0 or Expat
 
@@ -629,7 +666,7 @@ Files: vendor_rust/paste/*
 License: Apache-2.0 or Expat
 
 Files: vendor_rust/percent-encoding/*
-Copyright: 2013-2022 The rust-url developers.
+Copyright: 2013-2025 The rust-url developers.
 License: Apache-2.0 or Expat
 
 Files: vendor_rust/petgraph/*
@@ -684,6 +721,18 @@ Files: vendor_rust/prost-types/*
 Copyright: 2017 Dan Burkert
 License: Apache-2.0
 
+Files: vendor_rust/pulldown-cmark/*
+Copyright: 2015-2017 Google Inc.
+License: Expat
+
+Files: vendor_rust/pulldown-cmark-to-cmark/*
+License: Apache-2.0
+
+Files: vendor_rust/pulldown-cmark/src/linklabel.rs
+       vendor_rust/pulldown-cmark/src/tree.rs
+Copyright: 2018 Google LLC
+License: Expat
+
 Files: vendor_rust/quote/*
 License: Apache-2.0 or Expat
 
@@ -842,6 +891,10 @@ Copyright: 2016 Alex Crichton
            2018-2023 Sean McArthur
 License: Expat
 
+Files: vendor_rust/unicase/*
+Copyright: 2014-2017 Sean McArthur
+License: Apache-2.0 or Expat
+
 Files: vendor_rust/unicode-ident/*
 Copyright: 1991-2023 Unicode, Inc.
 License: Apache-2.0 or Expat or Unicode-DFS-2016
diff --git a/debian/dirs b/debian/dirs
new file mode 100644
index 0000000000..842bc5b918
--- /dev/null
+++ b/debian/dirs
@@ -0,0 +1 @@
+etc/authd/brokers.d
diff --git a/debian/install b/debian/install
index 094a6ed57d..b5b56345ae 100755
--- a/debian/install
+++ b/debian/install
@@ -3,6 +3,9 @@
 # Install daemon
 usr/bin/authd ${env:AUTHD_DAEMONS_PATH}
 
+# Install CLI tool
+usr/bin/authctl /usr/bin/
+
 # Install authd config file
 debian/authd-config/authd.yaml /etc/authd/
 
@@ -18,3 +21,8 @@ ${env:BUILT_PAM_LIBS_PATH}/go-exec/pam_authd_exec.so ${env:AUTHD_PAM_MODULES_PAT
 
 # Install NSS library with right soname
 target/${DEB_HOST_RUST_TYPE}/release/libnss_authd.so => /usr/lib/${DEB_TARGET_GNU_TYPE}/libnss_authd.so.2
+
+# Shell completion scripts
+shell-completion/bash/authctl /usr/share/bash-completion/completions/
+shell-completion/zsh/_authctl /usr/share/zsh/vendor-completions/
+shell-completion/fish/authctl.fish /usr/share/fish/vendor_completions.d/
diff --git a/debian/manpages b/debian/manpages
new file mode 100644
index 0000000000..70602a5c77
--- /dev/null
+++ b/debian/manpages
@@ -0,0 +1,2 @@
+man/authctl.1
+
diff --git a/debian/pam-configs/authd.in b/debian/pam-configs/authd.in
index 09e6421435..ef0ea83159 100644
--- a/debian/pam-configs/authd.in
+++ b/debian/pam-configs/authd.in
@@ -1,4 +1,4 @@
-Name: Authd authentication
+Name: authd authentication
 Default: yes
 Priority: 1050
 
diff --git a/debian/rules b/debian/rules
index 3459460e09..0539b8f255 100755
--- a/debian/rules
+++ b/debian/rules
@@ -44,7 +44,10 @@ export AUTHD_SKIP_EXTERNAL_DEPENDENT_TESTS=1
 export AUTHD_SKIP_ROOT_TESTS := 1
 
 # Defines the targets to be built as part of dh_auto_build
-export DH_GOLANG_BUILDPKG := $(AUTHD_GO_PACKAGE)/... \
+export DH_GOLANG_BUILDPKG := \
+    $(AUTHD_GO_PACKAGE)/cmd/authctl \
+    $(AUTHD_GO_PACKAGE)/cmd/authd \
+	$(AUTHD_GO_PACKAGE)/pam \
 	$(NULL)
 
 # We add the required backported version to the $PATH so that if it exists, then
@@ -88,6 +91,8 @@ override_dh_auto_configure:
 		env DEB_CARGO_CRATE="$(DEB_SOURCE)_$(DEB_VERSION_UPSTREAM)" \
 		  $(CARGO_PATH) prepare-debian "$(CARGO_VENDOR_DIR)"; \
 	else \
+	    echo "cargo version: $$(cargo --version)"; \
+	    echo "cargo-vendor-filterer version: $$(cargo-vendor-filterer --version)"; \
 		dh_auto_configure --buildsystem=cargo; \
 	fi
 
diff --git a/debian/source/options b/debian/source/options
index fea6b8c873..09cd43aebf 100644
--- a/debian/source/options
+++ b/debian/source/options
@@ -1,9 +1,17 @@
-tar-ignore = */.git*
-tar-ignore = */.go*
-tar-ignore = */.editor*
-tar-ignore = */.mailmap
-tar-ignore = */.vscode
-tar-ignore = *.so
-tar-ignore = *.o
+tar-ignore = authd/.git*
+tar-ignore = authd/.go*
+tar-ignore = authd/.editor*
+tar-ignore = authd/.vscode
+tar-ignore = authd/authd-oidc-brokers
 tar-ignore = authd/docs
-tar-ignore = vendor_rust/*.a
+tar-ignore = authd/e2e-tests
+tar-ignore = authd/snap
+
+tar-ignore = authd/vendor/*/.git*
+tar-ignore = authd/vendor/*/.go*
+tar-ignore = authd/vendor/*/.editor*
+tar-ignore = authd/vendor/*/.mailmap
+
+tar-ignore = *.a
+tar-ignore = *.o
+tar-ignore = *.so
diff --git a/debian/tests/run-tests.sh b/debian/tests/run-tests.sh
index 0b82478d99..abfa1bb857 100755
--- a/debian/tests/run-tests.sh
+++ b/debian/tests/run-tests.sh
@@ -2,6 +2,7 @@
 
 set -exuo pipefail
 
+# Skip tests which depend on vhs which is not available in the build environment.
 export AUTHD_SKIP_EXTERNAL_DEPENDENT_TESTS=1
 
 # Skip flaky tests because we don't want autopkgtests to fail, which would cause
@@ -14,4 +15,4 @@ export GOTOOLCHAIN=local
 PATH=$PATH:$("$(dirname "$0")"/../get-depends-go-bin-path.sh)
 export PATH
 
-go test -v ./...
+go test ./...
diff --git a/debian/vendor-rust.sh b/debian/vendor-rust.sh
index a0c899b449..1fedf6e1d1 100755
--- a/debian/vendor-rust.sh
+++ b/debian/vendor-rust.sh
@@ -12,6 +12,10 @@ if ! command -v cargo-vendor-filterer 2>/dev/null; then
     exit 3
 fi
 
+# Print the versions of cargo and cargo-vendor-filterer for debugging purposes.
+echo "Using cargo version: $(${CARGO_PATH} --version)"
+echo "Using cargo-vendor-filterer version: $(cargo-vendor-filterer --version)"
+
 # Some crates are shipped with .a files, which get removed by the helpers during the package build as a safety measure.
 # This results in cargo failing to compile, since the files (which are listed in the checksums) are not there anymore.
 # For those crates, we need to replace their checksum with a more general one that only lists the crate checksum, instead of each file.
diff --git a/docs/.custom_wordlist.txt b/docs/.custom_wordlist.txt
index 6798e78afb..b3a7856c4b 100644
--- a/docs/.custom_wordlist.txt
+++ b/docs/.custom_wordlist.txt
@@ -1,15 +1,21 @@
 alice
 amd
 auth
+authctl
 authd
+authd's
 biometric
+cleartext
 Center
+config
 DBus
 entra
 filesystem
+Fosstodon
 fstab
 ESC
 GDM
+GID
 GIDs
 gRPC
 github
@@ -17,29 +23,41 @@ grpc
 hostname
 https
 IDMAP
+IdP
+init
 io
+jinja
 KDC
 Kerberos
+Keycloak
+keycloak
 keytab
 Keytab
 Keytabs
+libpwquality
 linux
+makefile
+MDM
 mountpoint
 msentraid
 NFS
 nss
 OAuth
 OIDC
+Okta
 OpenID
 ppa
 PR
 protoc
 PRs
 repo
+sandboxing
 smartcard
 sshd
 styleguide
 sudo
+systemd
+templating
 TPM
 ubuntu
 UEFI
diff --git a/docs/.sphinx/.markdownlint.json b/docs/.sphinx/.markdownlint.json
deleted file mode 100644
index 536f9ea929..0000000000
--- a/docs/.sphinx/.markdownlint.json
+++ /dev/null
@@ -1,21 +0,0 @@
-{
-    "default": false,
-    "MD003": {
-        "style": "atx"
-    },
-    "MD014": true,
-    "MD018": true,
-    "MD022": true,
-    "MD023": true,
-    "MD026": {
-        "punctuation": ".,;。，；"
-    },
-    "MD031": {
-        "list_items": false
-    },
-    "MD032": true,
-    "MD035": true,
-    "MD042": true,
-    "MD045": true,
-    "MD052": true
-}
\ No newline at end of file
diff --git a/docs/.sphinx/.pymarkdown.json b/docs/.sphinx/.pymarkdown.json
new file mode 100644
index 0000000000..2c4c669dbf
--- /dev/null
+++ b/docs/.sphinx/.pymarkdown.json
@@ -0,0 +1,46 @@
+{
+    "plugins": {
+        "selectively_enable_rules": true,
+        "heading-style": {
+            "enabled": true,
+            "style": "atx"
+        },
+        "commands-show-output": {
+            "enabled": true
+        },
+        "no-missing-space-atx": {
+            "enabled": true
+        },
+        "blanks-around-headings": {
+            "enabled": true
+        },
+        "heading-start-left": {
+            "enabled": true
+        },
+        "no-trailing-punctuation": {
+            "enabled": true,
+            "punctuation": ".,;。，；"
+        },
+        "blanks-around-fences": {
+            "enabled": true,
+            "list_items": false
+        },
+        "blanks-around-lists": {
+            "enabled": true
+        },
+        "hr-style": {
+            "enabled": true
+        },
+        "no-empty-links": {
+            "enabled": true
+        },
+        "no-alt-text": {
+            "enabled": true
+        }
+    },
+    "extensions": {
+        "front-matter" : {
+            "enabled" : true
+        }
+    }
+}
diff --git a/docs/.sphinx/.wordlist.txt b/docs/.sphinx/.wordlist.txt
deleted file mode 100644
index be5021a1f6..0000000000
--- a/docs/.sphinx/.wordlist.txt
+++ /dev/null
@@ -1,64 +0,0 @@
-ACME
-ACME's
-addons
-AGPLv
-API
-APIs
-balancer
-Charmhub
-CLI
-DCO
-Diátaxis
-Dqlite
-dropdown
-EBS
-EKS
-enablement
-favicon
-Furo
-Git
-GitHub
-Grafana
-IAM
-installable
-JSON
-Juju
-Kubeflow
-Kubernetes
-Launchpad
-linter
-LTS
-LXD
-Makefile
-Makefiles
-Matrix
-Mattermost
-MicroCeph
-MicroCloud
-MicroOVN
-MyST
-namespace
-namespaces
-NodePort
-Numbat
-observability
-OEM
-OLM
-Permalink
-pre
-Quickstart
-ReadMe
-reST
-reStructuredText
-roadmap
-RTD
-subdirectories
-subfolders
-subtree
-TODO
-Ubuntu
-UI
-UUID
-VM
-webhook
-YAML
diff --git a/docs/.sphinx/_static/cookie-banner.css b/docs/.sphinx/_static/cookie-banner.css
new file mode 100644
index 0000000000..afcf7922a5
--- /dev/null
+++ b/docs/.sphinx/_static/cookie-banner.css
@@ -0,0 +1,82 @@
+/* Cookie policy styling WILL BE REMOVED when implementation of new theme with vanilla is implemented */
+.cookie-policy {
+    overflow: auto;
+    top: 35%;
+    z-index: 50;
+    position: fixed;
+}
+
+dialog.cookie-policy {
+    background-color: var(--color-code-background);
+    color: var(--color-code-foreground);
+    height: auto;
+    max-height: 60vh;
+    max-width: 40rem;
+    padding: 0 1rem 0 1rem;
+    width: auto;
+}
+
+header.p-modal__header {
+    margin-bottom: .5rem;
+}
+
+header.p-modal__header::after {
+    background-color: #d9d9d9;
+    content: "";
+    height: 1px;
+    left: 0;
+    margin-left: 1rem;
+    margin-right: 1rem;
+    position: absolute;
+    right: 0;
+}
+
+h2#cookie-policy-title.p-modal__title {
+    align-self: flex-end;
+    font-size: 1.5rem;
+    font-style: normal;
+    font-weight: 275;
+    line-height: 2rem;
+    margin: 0 0 1.05rem 0;
+    padding: 0.45rem 0 0 0;
+}
+
+.cookie-policy p {
+    font-size: 1rem;
+    line-height: 1.5rem;
+    margin-top: 0;
+    padding-top: .4rem;
+}
+
+.cookie-policy p a {
+    text-decoration: none;
+    color: var(--color-link);
+}
+.cookie-policy button {
+    border-style: solid;
+    border-width: 1.5px;
+    cursor: pointer;
+    display: inline-block;
+    font-size: 1rem;
+    font-weight: 400;
+    justify-content: center;
+    line-height: 1.5rem;
+    padding: calc(.4rem - 1px) 1rem;
+    text-align: center;
+    text-decoration: none;
+    transition-duration: .1s;
+    transition-property: background-color,border-color;
+    transition-timing-function: cubic-bezier(0.55,0.055,0.675,0.19);
+}
+
+.cookie-policy button {
+    background-color: #fff;
+    border-color: rgba(0,0,0,0.56);
+    color: #000;
+}
+
+.cookie-policy .p-button--positive {
+    background-color: #0e8420;
+    border-color: #0e8420;
+    color: #fff;
+}
diff --git a/docs/.sphinx/_static/js/bundle.js b/docs/.sphinx/_static/js/bundle.js
new file mode 100644
index 0000000000..a79e20ca87
--- /dev/null
+++ b/docs/.sphinx/_static/js/bundle.js
@@ -0,0 +1 @@
+(()=>{"use strict";function e(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertySymbols(e);t&&(o=o.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,o)}return n}function t(t){for(var n=1;n<arguments.length;n++){var o=null!=arguments[n]?arguments[n]:{};n%2?e(Object(o),!0).forEach((function(e){r(t,e,o[e])})):Object.getOwnPropertyDescriptors?Object.defineProperties(t,Object.getOwnPropertyDescriptors(o)):e(Object(o)).forEach((function(e){Object.defineProperty(t,e,Object.getOwnPropertyDescriptor(o,e))}))}return t}function n(e){return n="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(e){return typeof e}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":typeof e},n(e)}function o(e,t){if(!(e instanceof t))throw new TypeError("Cannot call a class as a function")}function i(e,t){for(var n=0;n<t.length;n++){var o=t[n];o.enumerable=o.enumerable||!1,o.configurable=!0,"value"in o&&(o.writable=!0),Object.defineProperty(e,c(o.key),o)}}function a(e,t,n){return t&&i(e.prototype,t),n&&i(e,n),Object.defineProperty(e,"prototype",{writable:!1}),e}function r(e,t,n){return(t=c(t))in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function c(e){var t=function(e){if("object"!=typeof e||null===e)return e;var t=e[Symbol.toPrimitive];if(void 0!==t){var n=t.call(e,"string");if("object"!=typeof n)return n;throw new TypeError("@@toPrimitive must return a primitive value.")}return String(e)}(e);return"symbol"==typeof t?t:String(t)}var s=[{id:"essential",enableSwitcher:!1,content:{default:{title:"Essential",description:"Enables the site's core functionality, such as navigation, access to secure areas, video players and payments. The site cannot function properly without these cookies; they can only be disabled by changing your browser preferences."},zh:{title:"必要性",description:"启用网站核心功能，例如导航，访问安全区域，视频播放器和支付。没有这些cookie网站不能正常工作；它们仅可通过修改浏览器偏好设置禁用。"},ja:{title:"エッセンシャル",description:"移動、保護されている情報へのアクセス、動画再生、支払など、サイトの基本的な機能が有効になります。これらのクッキーが有効になっていない（お使いのブラウザの設定を変更することによってクッキーが無効化されている）場合、サイトは正しく表示されません。"}}},{id:"performance",enableSwitcher:!0,content:{default:{title:"Performance",description:"Collects information on site usage, for example, which pages are most frequently visited."},zh:{title:"表现性",description:"网站使用信息收集，例如哪些网页被频繁访问。"},ja:{title:"パフォーマンス",description:"サイトの利用状況に関する情報を収集します。例として、どのページの訪問頻度が高いかのような情報です。"}}},{id:"functionality",enableSwitcher:!0,content:{default:{title:"Functionality",description:"Recognises you when you return to our site. This enables us to personalise content, greet you by name, remember your preferences, and helps you share pages on social networks."},zh:{title:"功能性",description:"当你返回到我们网站时能识别您。这使得我们能个性化内容，欢迎您，记住您的偏好设置，以及帮助您分享网页到社交媒体。"},ja:{title:"機能性",description:"お客様がサイトを再訪問したときに、お客様であることを認識します。この設定では、お客様に合わせたコンテンツの表示、お客様のお名前を用いたあいさつメッセージの表示、お客様の傾向の記録を当社が行えるようになります。また、お客様がソーシャルネットワークでページをシェアできるようになります。"}}}],l={default:{notification:{title:"Your tracker settings",body1:"We use cookies and similar methods to recognise visitors and remember preferences. We also use them to measure campaign effectiveness and analyse site traffic.",body2:"By selecting ‘Accept‘, you consent to the use of these methods by us and trusted third parties.",body3:'For further details or to change your consent choices at any time see our <a href="https://ubuntu.com/legal/data-privacy?cp=hide#cookies">cookie policy</a>.',buttonAccept:"Accept all and visit site",buttonManage:"Manage your tracker settings"},manager:{title:"Tracking choices",body1:"We use cookies to recognise visitors and remember your preferences.",body2:"They enhance user experience, personalise content and ads, provide social media features, measure campaign effectiveness, and analyse site traffic.",body3:"Select the types of trackers you consent to, both by us, and third parties.",body4:'Learn more at <a href="https://ubuntu.com/legal/data-privacy?cp=hide#cookies">data privacy: cookie policy</a> - you can change your choices at any time from the footer of the site.',acceptAll:"Accept all",acceptAllHelp:'This will switch all toggles "ON".',SavePreferences:"Save preferences"}},zh:{notification:{title:"您的追踪器设置",body1:"我们使用cookie和相似的方法来识别访问者和记住偏好设置。我们也用它们来衡量活动的效果和网站流量分析。",body2:"选择”接受“，您同意我们和受信的第三方来使用这些方式。",body3:'更多内容或者随时地变更您的同意选择，请点击我们的 <a href="https://ubuntu.com/legal/data-privacy?cp=hide#cookies">cookie策略</a>.',buttonAccept:"接受全部和访问网站",buttonManage:"管理您的追踪器设置"},manager:{title:"追踪选项",body1:"我们使用cookie来识别访问者和记住您的偏好设置",body2:"它们增强用户体验，使内容和广告个性化，提供社交媒体功能，衡量活动效果和网站流量分析。",body3:"选择您同意授予我们和受信的第三方的追踪类型。",body4:'点击<a href="https://ubuntu.com/legal/data-privacy?cp=hide#cookies">数据隐私：cookie策略</a>了解更多，您可以在网站底部随时更改您的选择。',acceptAll:"接受全部",acceptAllHelp:"这将把全部开关变为”开启“。",SavePreferences:"保存偏好设置"}},ja:{notification:{title:"トラッキング機能の設定",body1:"当社は、当社のウェブサイトを訪問された方の識別や傾向の記録を行うために、クッキーおよび類似の手法を利用します。また、キャンペーンの効果の測定やサイトのトラフィックの分析にもクッキーを利用します。",body2:"「同意」を選択すると、当社および信頼できる第三者による上記の手法の利用に同意したものとみなされます。",body3:'詳細または同意の変更については、いつでも当社の<a href="https://ubuntu.com/legal/data-privacy?cp=hide#cookies">クッキーに関するポリシー</a>をご覧になることができます。',buttonAccept:"すべて同意してサイトにアクセス",buttonManage:"トラッキング機能の設定の管理"},manager:{title:"トラッキング機能の選択",body1:"当社は、当社のウェブサイトを訪問された方の識別や傾向の記録を行うために、クッキーを利用します。",body2:"クッキーは、お客様の利便性の向上、お客様に合わせたコンテンツや広告の表示、ソーシャルメディア機能の提供、キャンペーンの効果の測定、サイトのトラフィックの分析に役立ちます。",body3:"当社および第三者によるトラッキング機能のタイプから、お客様が同意されるものをお選びください。",body4:'詳細は、<a href="https://ubuntu.com/legal/data-privacy?cp=hide#cookies">データプライバシー：クッキーに関するポリシー</a>をご覧ください。お客様が選んだ設定は、本サイトの下部からいつでも変更できます。',acceptAll:"すべて同意",acceptAllHelp:"同意されるとすべての設定が「ON」に切り替わります。",SavePreferences:"設定を保存"}}},d={ad_storage:"denied",ad_user_data:"denied",ad_personalization:"denied",analytics_storage:"denied",functionality_storage:"denied",personalization_storage:"denied",security_storage:"denied"},u=["security_storage"],p=["ad_storage","ad_user_data","ad_personalization","analytics_storage"],f=["functionality_storage","personalization_storage"],h=["ad_storage","ad_user_data","ad_personalization","analytics_storage","functionality_storage","personalization_storage"],y=function(e){var t=new Date;t.setTime(t.getTime()+31536e6);var n="expires="+t.toUTCString();document.cookie="_cookies_accepted="+e+"; "+n+"; samesite=lax;path=/;",S(e)&&_()},b=function(){for(var e=document.cookie.split(";"),t="",n="",o=0;o<e.length;o++){for(var i=e[o];" "==i.charAt(0);)i=i.substring(1);n=i.substring(18,i.length),0===i.indexOf("_cookies_accepted=")&&"true"!==n&&(t=n)}return t},g=function(e){return l[e]?l[e]:l.default},m=function(e,t){return e.content[t]?e.content[t]:e.content.default},v=function(e){var t=k(d,e);w(t)},k=function(e,n){var o=t({},e);return u.forEach((function(e){o[e]="granted"})),"performance"===n?p.forEach((function(e){o[e]="granted"})):"functionality"===n?f.forEach((function(e){o[e]="granted"})):"all"===n&&h.forEach((function(e){o[e]="granted"})),o},w=function(e){window.gtag("consent","update",e)},_=function(){"object"===("undefined"==typeof dataLayer?"undefined":n(dataLayer))&&dataLayer.push({event:"pageview"})},S=function(e){return"all"==e||"performance"==e},j=function(){function e(t,n,i){o(this,e),this.container=t,this.renderManager=n,this.destroyComponent=i}return a(e,[{key:"getNotificationMarkup",value:function(e){var t=g(e);return'\n      <div class="p-modal" id="modal">\n        <div class="p-modal__dialog" role="dialog" aria-labelledby="cookie-policy-title" aria-describedby="cookie-policy-content">\n        <header class="p-modal__header">\n          <h2 class="p-modal__title" id="cookie-policy-title">'.concat(t.notification.title,'</h2>\n        </header>\n        <div id="cookie-policy-content">\n          <p>').concat(t.notification.body1,"</p>\n          <p>").concat(t.notification.body2,"</p>\n          <p>").concat(t.notification.body3,'</p>\n          <p class="u-no-margin--bottom">\n            <button class="p-button--positive js-close" id="cookie-policy-button-accept">').concat(t.notification.buttonAccept,'</button>\n            <button class="p-button js-manage">').concat(t.notification.buttonManage,"</button>\n          </p>\n        </div>\n      </div>")}},{key:"render",value:function(e){this.container.innerHTML=this.getNotificationMarkup(e),this.initaliseListeners()}},{key:"initaliseListeners",value:function(){var e=this;this.container.querySelector(".js-close").addEventListener("click",(function(t){y("all"),v("all"),e.destroyComponent()})),this.container.querySelector(".js-manage").addEventListener("click",(function(t){e.renderManager()}))}}]),e}(),L=function(){function e(t,n,i){o(this,e),this.language=i,this.id=t.id,this.title=m(t,i).title,this.description=m(t,i).description,this.enableSwitcher=t.enableSwitcher,this.container=n,this.element,this.render()}return a(e,[{key:"render",value:function(){var e=this.cookieIsTrue(),t=document.createElement("div");t.classList.add("u-sv3"),t.innerHTML="\n      ".concat('<label class="u-float-right p-switch">\n          <input type="checkbox" class="p-switch__input js-'.concat(this.id,'-switch" ').concat((e||!this.enableSwitcher)&&'checked="" ',"\n            ").concat(!this.enableSwitcher&&'disabled="disabled"','>\n          <span class="p-switch__slider"></span>\n        </label>'),"\n      <h4>",this.title,"</h4>\n      <p>").concat(this.description,"</p>"),this.container.appendChild(t),this.element=t.querySelector(".js-".concat(this.id,"-switch"))}},{key:"cookieIsTrue",value:function(){var e=b();return!(!e||e!==this.id&&"all"!==e)||e&&e===this.id}},{key:"isChecked",value:function(){return!!this.element&&this.element.checked}},{key:"getId",value:function(){return this.id}}]),e}(),E=function(){function e(t,n){o(this,e),this.container=t,this.controlsStore=[],this.destroyComponent=n}return a(e,[{key:"getManagerMarkup",value:function(e){var t=g(e).manager;return'\n    <div class="p-modal" id="modal">\n    <div class="p-modal__dialog" role="dialog" aria-labelledby="modal-title" aria-describedby="modal-description">\n      <header class="p-modal__header">\n        <h2 class="p-modal__title" id="modal-title">'.concat(t.title,'</h2>\n      </header>\n      <p id="modal-description">').concat(t.body1,"</p>\n      <p>").concat(t.body2,"</p>\n      <p>").concat(t.body3,"</p>\n      <p>").concat(t.body4,'</p>\n      <p><button class="p-button--positive u-no-margin--bottom js-close">').concat(t.acceptAll,"</button></p>\n      <p>").concat(t.acceptAllHelp,'</p>\n      <hr />\n      <div class="controls"></div>\n      <button class="p-button js-save-preferences">').concat(t.SavePreferences,"</button>\n    </div>\n  </div>")}},{key:"render",value:function(e){var t=this;this.container.innerHTML=this.getManagerMarkup(e);var n=this.container.querySelector(".controls");s.forEach((function(o){var i=new L(o,n,e);t.controlsStore.push(i)})),this.initaliseListeners()}},{key:"initaliseListeners",value:function(){var e=this;this.container.querySelector(".js-close").addEventListener("click",(function(){y("all"),v("all"),e.destroyComponent()})),this.container.querySelector(".js-save-preferences").addEventListener("click",(function(){e.savePreferences(),e.destroyComponent()}))}},{key:"savePreferences",value:function(){var e=this.controlsStore.filter((function(e){return e.isChecked()}));this.controlsStore.length===e.length?y("all"):this.controlsStore.forEach((function(e){e.isChecked()&&y(e.getId())})),function(e){var n=e.filter((function(e){return e.isChecked()})),o=t({},d);n.forEach((function(e){o=k(o,e.id)})),w(o)}(this.controlsStore)}}]),e}();window.gtag||(window.dataLayer=window.dataLayer||[],window.gtag=function(){dataLayer.push(arguments)},window.gtag("consent","default",d));var O=function(){var e=arguments.length>0&&void 0!==arguments[0]?arguments[0]:null,t=null,n=document.documentElement.lang,o=!1,i=function(e){e&&e.preventDefault(),null===t&&((t=document.createElement("dialog")).classList.add("cookie-policy"),t.setAttribute("open",!0),document.body.appendChild(t),new j(t,a,r).render(n),document.getElementById("cookie-policy-button-accept").focus())},a=function(){new E(t,r).render(n)},r=function(){"function"==typeof e&&e(),document.body.removeChild(t),t=null},c=function(){if(!o){var e;o=!0,(e=b())&&v(e);var t=document.querySelector(".js-revoke-cookie-manager");t&&t.addEventListener("click",i),function(){var e=b();return!e||"true"==e}()&&"hide"!==new URLSearchParams(window.location.search).get("cp")&&i()}};"loading"===document.readyState?document.addEventListener("DOMContentLoaded",c,!1):c()},P=function(e){document.cookie.match(new RegExp("(^| )"+e+"=([^;]+)"))},A=P("_cookies_accepted");function M(){var e,t;if(("all"===(null===(e=A=P("_cookies_accepted"))||void 0===e?void 0:e[2])||"performance"===(null===(t=A)||void 0===t?void 0:t[2]))&&!P("user_id")){var n=([1e7]+-1e3+-4e3+-8e3+-1e11).replace(/[018]/g,(function(e){return(e^crypto.getRandomValues(new Uint8Array(1))[0]&15>>e/4).toString(16)}));document.cookie="user_id="+n+";max-age=31536000;",dataLayer.push({user_id:n})}}A?(M(),O()):O(M)})();
diff --git a/docs/.sphinx/_static/version-warning.css b/docs/.sphinx/_static/version-warning.css
new file mode 100644
index 0000000000..c52703b15f
--- /dev/null
+++ b/docs/.sphinx/_static/version-warning.css
@@ -0,0 +1,17 @@
+/* Use subtle bg with strongly contrasting fg */
+.version-warning {
+    padding: 5px;
+    width: 100%;
+    text-align: center;
+    font-size: var(--font-size--small);
+    background-color: #EAE9E7;
+    color: #111;
+}
+
+/* Fix one fg color as only one bg color */
+.version-warning a {
+    color: #06C;
+}
+.version-warning a:visited {
+    color: #872EE0;
+}
diff --git a/docs/.sphinx/_templates/footer.html b/docs/.sphinx/_templates/footer.html
new file mode 100644
index 0000000000..9eab890443
--- /dev/null
+++ b/docs/.sphinx/_templates/footer.html
@@ -0,0 +1,105 @@
+{# ru-fu: copied from Furo, with modifications as stated below. Modifications are marked 'mod:'. #}
+
+<div class="related-pages">
+  {# mod: Per-page navigation #}
+  {% if meta %}
+    {% if 'sequential_nav' in meta %}
+      {% set sequential_nav = meta.sequential_nav %}
+    {% endif %}
+  {% endif %}
+  {# mod: Conditional wrappers to control page navigation buttons #}
+  {% if sequential_nav != "none" -%}
+    {% if next and (sequential_nav == "next" or sequential_nav == "both") -%}
+      <a class="next-page" href="{{ next.link }}">
+        <div class="page-info">
+          <div class="context">
+            <span>{{ _("Next") }}</span>
+          </div>
+          <div class="title">{{ next.title }}</div>
+        </div>
+        <svg class="furo-related-icon"><use href="#svg-arrow-right"></use></svg>
+      </a>
+    {%- endif %}
+    {% if prev and (sequential_nav == "prev" or sequential_nav == "both") -%}
+      <a class="prev-page" href="{{ prev.link }}">
+        <svg class="furo-related-icon"><use href="#svg-arrow-right"></use></svg>
+        <div class="page-info">
+          <div class="context">
+            <span>{{ _("Previous") }}</span>
+          </div>
+          {% if prev.link == pathto(root_doc) %}
+            <div class="title">{{ _("Home") }}</div>
+          {% else %}
+            <div class="title">{{ prev.title }}</div>
+          {% endif %}
+        </div>
+      </a>
+    {%- endif %}
+  {%- endif %}
+</div>
+<div class="bottom-of-page">
+  <div class="left-details">
+    {%- if show_copyright %}
+    <div class="copyright">
+      {%- if hasdoc('copyright') %}
+        {% trans path=pathto('copyright'), copyright=copyright|e -%}
+          <a href="{{ path }}">&copy; {{ copyright }} {{ author }}</a>
+        {%- endtrans %}
+      {%- else %}
+        {% trans copyright=copyright|e -%}
+          &copy; {{ copyright }} {{ author }}
+        {%- endtrans %}
+      {%- endif %}
+    </div>
+    {%- endif %}
+    {%- if license and license.name -%}
+      {%- if license.url -%}
+      <div class="license">
+        This page is licensed under <a href="{{ license.url }}">{{ license.name }}</a>
+      </div>
+      {%- else -%}
+      <div class="license">
+        This page is licensed under {{ license.name }}
+      </div>
+      {%- endif -%}
+    {%- endif -%}
+
+    {# mod: removed "Made with" #}
+
+    {%- if last_updated -%}
+    <div class="last-updated">
+      {% trans last_updated=last_updated|e -%}
+        Last updated on {{ last_updated }}
+      {%- endtrans -%}
+    </div>
+    {%- endif %}
+
+    {%- if show_source and has_source and sourcename %}
+    <div class="show-source">
+      <a class="muted-link" href="{{ pathto('_sources/' + sourcename, true)|e }}"
+         rel="nofollow">Show source</a>
+    </div>
+    {%- endif %}
+  </div>
+  <div>
+   {% if has_contributor_listing and display_contributors and pagename and page_source_suffix %}
+       {% set contributors = get_contributors_for_file(pagename, page_source_suffix) %}
+       {% if contributors %}
+          {% if contributors | length > 1 %}
+              <a class="display-contributors">Thanks to the {{ contributors |length }} contributors!</a>
+          {% else %}
+              <a class="display-contributors">Thanks to our contributor!</a>
+          {% endif %}
+          <div id="overlay"></div>
+          <ul class="all-contributors">
+              {% for contributor in contributors %}
+                  <li>
+                      <a href="{{ contributor[1] }}" class="contributor">{{ contributor[0] }}</a>
+                  </li>
+              {% endfor %}
+          </ul>
+       {% endif %}
+   {% endif %}
+  </div>
+  <div class="right-details"><a href="" class="js-revoke-cookie-manager muted-link">Manage your tracker settings</a></div>
+</div>
diff --git a/docs/.sphinx/_templates/header.html b/docs/.sphinx/_templates/header.html
index 30c52c5c8b..c42be925e5 100644
--- a/docs/.sphinx/_templates/header.html
+++ b/docs/.sphinx/_templates/header.html
@@ -1,43 +1,77 @@
 <header id="header" class="p-navigation">
 
+  <!-- Google Tag Manager -->
+  <script>
+    (function(w, d, s, l, i) {
+      w[l] = w[l] || [];
+      w[l].push({
+        'gtm.start': new Date().getTime(),
+        event: 'gtm.js'
+      });
+      var f = d.getElementsByTagName(s)[0];
+      var j = d.createElement(s);
+      var dl = '';
+      if (l != 'dataLayer') {
+          dl = '&l=' + l;
+      }
+      j.async = true;
+      j.src = 'https://www.googletagmanager.com/gtm.js?id=' + i + dl;
+      f.parentNode.insertBefore(j, f);
+    })(window, document, 'script', 'dataLayer', 'GTM-KNX3CJC');
+  </script>
+
   <div class="p-navigation__nav" role="menubar">
 
     <ul class="p-navigation__links" role="menu">
 
       <li>
+        {% if product_page %}
         <a class="p-logo" href="https://{{ product_page }}" aria-current="page">
           <img src="{{ pathto(product_tag,1) }}" alt="Logo" class="p-logo-image">
           <div class="p-logo-text p-heading--4">{{ project }}
           </div>
         </a>
+        {% else %}
+        <div class="p-logo">
+          <img src="{{ pathto(product_tag,1) }}" alt="Logo" class="p-logo-image">
+          <div class="p-logo-text p-heading--4">{{ project }}
+          </div>
+        </div>
+        {% endif %}
       </li>
 
       <li class="nav-ubuntu-com">
+        {% if product_page %}
         <a href="https://{{ product_page }}" class="p-navigation__link">{{ product_page }}</a>
+        {% endif %}
       </li>
 
-      <li>
-        <a href="#" class="p-navigation__link nav-more-links">More resources</a>
-        <ul class="more-links-dropdown">
-
+      <li class="nav-dropdown">
+        <a href="#" class="p-navigation__link nav-more-links"
+           id="more-resources-toggle"
+           aria-haspopup="true"
+           aria-expanded="false">
+          More resources
+        </a>
+        <ul class="more-links-dropdown" aria-labelledby="more-resources-toggle">
           {% if discourse %}
           <li>
             <a href="{{ discourse }}" class="p-navigation__sub-link p-dropdown__link">Discourse</a>
           </li>
           {% endif %}
-
+      
           {% if mattermost %}
           <li>
             <a href="{{ mattermost }}" class="p-navigation__sub-link p-dropdown__link">Mattermost</a>
           </li>
           {% endif %}
-
+      
           {% if matrix %}
           <li>
             <a href="{{ matrix }}" class="p-navigation__sub-link p-dropdown__link">Matrix</a>
           </li>
           {% endif %}
-
+      
           {% if github_url %}
           <li>
             <a href="{{ github_url }}" class="p-navigation__sub-link p-dropdown__link">GitHub</a>
diff --git a/docs/.sphinx/_templates/page.html b/docs/.sphinx/_templates/page.html
new file mode 100644
index 0000000000..1bfc14545f
--- /dev/null
+++ b/docs/.sphinx/_templates/page.html
@@ -0,0 +1,52 @@
+
+{% extends "furo/page.html" %}
+
+{% block footer %}
+   {% include "footer.html" %}
+{% endblock footer %}
+
+{% block body -%}
+   {% include "header.html" %}
+   <!-- NOTE: need to inject version warning if not using standard stable/latest on RTD -->
+   {% include "version-warning.html" %}
+   {{ super() }}
+{%- endblock body %}
+
+{% if meta and ((meta.discourse and discourse_prefix) or meta.relatedlinks) %}
+   {% set furo_hide_toc_orig = furo_hide_toc %}
+   {% set furo_hide_toc=false %}
+{% endif %}
+
+{% block right_sidebar %}
+<div class="toc-sticky toc-scroll">
+   {% if not furo_hide_toc_orig %}
+    <div class="toc-title-container">
+      <span class="toc-title">
+       {{ _("Contents") }}
+      </span>
+    </div>
+    <div class="toc-tree-container">
+      <div class="toc-tree">
+        {{ toc }}
+      </div>
+    </div>
+   {% endif %}
+    {% if meta and ((meta.discourse and discourse_prefix) or meta.relatedlinks) %}
+    <div class="relatedlinks-title-container">
+      <span class="relatedlinks-title">
+       Related links
+      </span>
+    </div>
+    <div class="relatedlinks-container">
+      <div class="relatedlinks">
+        {% if meta.discourse and discourse_prefix %}
+          {{ discourse_links(meta.discourse) }}
+        {% endif %}
+        {% if meta.relatedlinks %}
+          {{ related_links(meta.relatedlinks) }}
+        {% endif %}
+      </div>
+    </div>
+    {% endif %}
+  </div>
+{% endblock right_sidebar %}
diff --git a/docs/.sphinx/_templates/version-warning.html b/docs/.sphinx/_templates/version-warning.html
new file mode 100644
index 0000000000..88126d9f9e
--- /dev/null
+++ b/docs/.sphinx/_templates/version-warning.html
@@ -0,0 +1,20 @@
+{# define the current page and strip the index from the URL #}
+{% set clean_pagename = pagename | replace('/index', '') | replace('index', '') %}
+
+<header id="header" class="p-navigation">
+
+  <div class="p-navigation__nav">
+
+        {% if version == "edge-docs" %}
+        <div class="version-warning">
+          <p class="version-warning-content">
+          This is the <strong>edge</strong> version. Some features may not be available in the stable release.
+          Read the <a href="{{ ogp_site_url }}/{{ clean_pagename }}"><strong>stable</strong></a> version of the documentation.
+          </p>
+        </div>
+        {% else %}
+        {# Show no warning for non-edge versions — no HTML output #}
+        {% endif %}
+
+  </div>
+</header>
diff --git a/docs/.sphinx/get_vale_conf.py b/docs/.sphinx/get_vale_conf.py
index 46f57d8943..13e7966f86 100644
--- a/docs/.sphinx/get_vale_conf.py
+++ b/docs/.sphinx/get_vale_conf.py
@@ -17,7 +17,7 @@
 
 SPHINX_DIR = os.path.join(os.getcwd(), ".sphinx")
 
-GITHUB_REPO = "canonical/praecepta"
+GITHUB_REPO = "canonical/documentation-style-guide"
 GITHUB_CLONE_URL = f"https://github.com/{GITHUB_REPO}.git"
 
 # Source paths to copy from repo
@@ -31,12 +31,12 @@
 def clone_repo_and_copy_paths(file_source_dest, overwrite=False):
     """
     Clone the repository to a temporary directory and copy required files
-    
+
     Args:
         file_source_dest: dictionary of file paths to copy from the repository,
             and their destination paths
         overwrite: boolean flag to overwrite existing files in the destination
-    
+
     Returns:
         bool: True if all files were copied successfully, False otherwise
     """
@@ -52,8 +52,8 @@ def clone_repo_and_copy_paths(file_source_dest, overwrite=False):
 
     try:
         result = subprocess.run(
-            clone_cmd, 
-            capture_output=True, 
+            clone_cmd,
+            capture_output=True,
             text=True,
             check=True
         )
@@ -73,7 +73,7 @@ def clone_repo_and_copy_paths(file_source_dest, overwrite=False):
             continue
 
         if not copy_files_to_path(source_path, dest, overwrite):
-            is_copy_success = False            
+            is_copy_success = False
             logging.error("Failed to copy %s to %s", source_path, dest)
 
     # Clean up temporary directory
@@ -85,12 +85,12 @@ def clone_repo_and_copy_paths(file_source_dest, overwrite=False):
 def copy_files_to_path(source_path, dest_path, overwrite=False):
     """
     Copy a file or directory from source to destination
-    
+
     Args:
         source_path: Path to the source file or directory
         dest_path: Path to the destination
         overwrite: Boolean flag to overwrite existing files in the destination
-        
+
     Returns:
         bool: True if copy was successful, False otherwise
     """
@@ -138,7 +138,7 @@ def main():
     # Parse command line arguments, default to overwrite_enabled = True
     overwrite_enabled = not parse_arguments().no_overwrite
 
-    # Download into /tmp through git clone 
+    # Download into /tmp through git clone
     if not clone_repo_and_copy_paths(vale_files_dict, overwrite=overwrite_enabled):
         logging.error("Failed to download files from repository")
         return 1
diff --git a/docs/.sphinx/images/Canonical-logo-4x.png b/docs/.sphinx/images/Canonical-logo-4x.png
deleted file mode 100644
index fd75696eb5..0000000000
Binary files a/docs/.sphinx/images/Canonical-logo-4x.png and /dev/null differ
diff --git a/docs/.sphinx/images/front-page-light.pdf b/docs/.sphinx/images/front-page-light.pdf
deleted file mode 100644
index bb68cdf8f5..0000000000
Binary files a/docs/.sphinx/images/front-page-light.pdf and /dev/null differ
diff --git a/docs/.sphinx/images/normal-page-footer.pdf b/docs/.sphinx/images/normal-page-footer.pdf
deleted file mode 100644
index dfd73cbc7e..0000000000
Binary files a/docs/.sphinx/images/normal-page-footer.pdf and /dev/null differ
diff --git a/docs/.sphinx/metrics/build_metrics.py b/docs/.sphinx/metrics/build_metrics.py
new file mode 100755
index 0000000000..457849c8a5
--- /dev/null
+++ b/docs/.sphinx/metrics/build_metrics.py
@@ -0,0 +1,93 @@
+#!/usr/bin/python3
+
+import sys
+import argparse
+from pathlib import Path
+from html.parser import HTMLParser
+from urllib.parse import urlsplit
+
+
+class MetricsParser(HTMLParser):
+    def __init__(self):
+        super().__init__()
+        self.int_link_count = 0
+        self.ext_link_count = 0
+        self.fragment_count = 0
+        self.image_count = 0
+        self.in_object = 0
+
+    @property
+    def link_count(self):
+        return self.fragment_count + self.int_link_count + self.ext_link_count
+
+    def read(self, file):
+        """
+        Read *file* (a file-like object with a ``read`` method returning
+        strings) a chunk at a time, feeding each chunk to the parser.
+        """
+        # Ensure the parser state is reset before each file (just in case
+        # there's an erroneous dangling <object>)
+        self.reset()
+        self.in_object = 0
+        while True:
+            # Parse 1MB chunks at a time
+            buf = file.read(1024**2)
+            if not buf:
+                break
+            self.feed(buf)
+
+    def handle_starttag(self, tag, attrs):
+        """
+        Count <a>, <img>, and <object> tags to determine the number of internal
+        and external links, and the number of images.
+        """
+        attrs = dict(attrs)
+        if tag == 'a' and 'href' in attrs:
+            # If there's no href, it's an anchor; if there's no hostname
+            # (netloc) or path, it's just a fragment link within the page
+            url = urlsplit(attrs['href'])
+            if url.netloc:
+                self.ext_link_count += 1
+            elif url.path:
+                self.int_link_count += 1
+            else:
+                self.fragment_count += 1
+        elif tag == 'object':
+            # <object> tags are a bit complex as they nest to offer fallbacks
+            # and may contain an <img> fallback. We only want to count the
+            # outer-most <object> in this case
+            if self.in_object == 0:
+                self.image_count += 1
+            self.in_object += 1
+        elif tag == 'img' and self.in_object == 0:
+            self.image_count += 1
+
+    def handle_endtag(self, tag):
+        if tag == 'object':
+            # Never let in_object be negative
+            self.in_object = max(0, self.in_object - 1)
+
+
+def main(args=None):
+    parser = argparse.ArgumentParser()
+    parser.add_argument(
+        'build_dir', metavar='build-dir', nargs='?', default='.',
+        help="The directory to scan for HTML files")
+    config = parser.parse_args(args)
+
+    parser = MetricsParser()
+    for path in Path(config.build_dir).rglob('*.html'):
+        with path.open('r', encoding='utf-8', errors='replace') as f:
+            parser.read(f)
+
+    print('Summarising metrics for build files (.html)...')
+    print(f'\tlinks: {parser.link_count} ('
+          f'{parser.fragment_count} #frag…, '
+          f'{parser.int_link_count} /int…, '
+          f'{parser.ext_link_count} https://ext…'
+          ')')
+    print(f'\timages: {parser.image_count}')
+
+
+if __name__ == '__main__':
+    sys.exit(main())
diff --git a/docs/.sphinx/metrics/build_metrics.sh b/docs/.sphinx/metrics/build_metrics.sh
deleted file mode 100755
index bd1ff1cb4c..0000000000
--- a/docs/.sphinx/metrics/build_metrics.sh
+++ /dev/null
@@ -1,15 +0,0 @@
-#!/bin/bash
-# shellcheck disable=all
-
-links=0
-images=0
-
-# count number of links
-links=$(find . -type d -path './.sphinx' -prune -o -name '*.html' -exec cat {} + | grep -o "<a " | wc -l)
-# count number of images
-images=$(find . -type d -path './.sphinx' -prune -o -name '*.html' -exec cat {} + | grep -o "<img " | wc -l)
-
-# summarise latest metrics
-echo "Summarising metrics for build files (.html)..."
-echo -e "\tlinks: $links"
-echo -e "\timages: $images"
diff --git a/docs/.sphinx/spellingcheck.yaml b/docs/.sphinx/spellingcheck.yaml
deleted file mode 100644
index 417a541cfe..0000000000
--- a/docs/.sphinx/spellingcheck.yaml
+++ /dev/null
@@ -1,30 +0,0 @@
-matrix:
-  - name: rST files
-    aspell:
-      lang: en
-      d: en_US
-    dictionary:
-      wordlists:
-        - .sphinx/.wordlist.txt
-        - .custom_wordlist.txt
-      output: .sphinx/.wordlist.dic
-    sources:
-      - _build/**/*.html
-    pipeline:
-      - pyspelling.filters.html:
-          comments: false
-          attributes:
-            - title
-            - alt
-          ignores:
-            - code
-            - pre
-            - spellexception
-            - link
-            - title
-            - div.relatedlinks
-            - strong.command
-            - div.visually-hidden
-            - img
-            - a.p-navigation__link
-            - a.contributor
diff --git a/docs/.sphinx/update_sp.py b/docs/.sphinx/update_sp.py
index 4b70aa4885..576cfcd219 100755
--- a/docs/.sphinx/update_sp.py
+++ b/docs/.sphinx/update_sp.py
@@ -16,13 +16,16 @@
 import subprocess
 import sys
 from requests.exceptions import RequestException
+from packaging.version import parse as parse_version
 
-SPHINX_DIR = os.path.join(os.getcwd(), ".sphinx")
+SPHINX_DIR = os.path.abspath(os.path.dirname(__file__))
+DOCS_DIR = os.path.abspath(os.path.join(SPHINX_DIR, '..'))
+REQUIREMENTS = os.path.join(DOCS_DIR, "requirements.txt")
 SPHINX_UPDATE_DIR = os.path.join(SPHINX_DIR, "update")
 GITHUB_REPO = "canonical/sphinx-docs-starter-pack"
 GITHUB_API_BASE = f"https://api.github.com/repos/{GITHUB_REPO}"
 GITHUB_API_SPHINX_DIR = f"{GITHUB_API_BASE}/contents/docs/.sphinx"
-GITHUB_RAW_BASE = f"https://raw.githubusercontent.com/{GITHUB_REPO}/check-log"
+GITHUB_RAW_BASE = f"https://raw.githubusercontent.com/{GITHUB_REPO}/main"
 
 TIMEOUT = 10  # seconds
 
@@ -36,7 +39,7 @@ def main():
     logging.debug("Checking local version")
     try:
         with open(os.path.join(SPHINX_DIR, "version")) as f:
-            current_version = f.read().strip()
+            local_version = f.read().strip()
     except FileNotFoundError:
         print("WARNING\nWARNING\nWARNING")
         print(
@@ -44,20 +47,20 @@ def main():
         )
         print("You may experience issues using this functionality.")
         logging.debug("No local version found. Setting version to None")
-        current_version = "None"
+        local_version = "None"
     except Exception as e:
         logging.debug(e)
         raise Exception("ERROR executing check local version")
-    logging.debug(f"Local version = {current_version}")
+    logging.debug(f"Local version = {local_version}")
 
     # Check release version
     latest_release = query_api(GITHUB_API_BASE + "/releases/latest").json()["tag_name"]
-    logging.debug(f"current release = {latest_release}")
+    logging.debug(f"Latest release = {latest_release}")
 
-    # Perform actions only if versions are different
+    # Perform actions only if local version is older than release version
     logging.debug("Comparing versions")
-    if current_version != latest_release:
-        logging.debug("Difference identified in current version and release version.")
+    if parse_version(local_version) < parse_version(latest_release):
+        logging.debug("Local version is older than the release version.")
         print("Starter pack is out of date.\n")
 
         # Identify and download '.sphinx' dir files to '.sphinx/update'
@@ -73,7 +76,7 @@ def main():
         # Provide changelog to identify other significant changes
         changelog = query_api(GITHUB_RAW_BASE + "/CHANGELOG.md")
         logging.debug("Changelog obtained")
-        version_regex = re.compile(r"#+ +" + re.escape(current_version) + r" *\n")
+        version_regex = re.compile(r"#+ +" + re.escape(local_version) + r" *\n")
         print("SEE CURRENT CHANGELOG:")
         print(re.split(version_regex, changelog.text)[0])
 
@@ -102,7 +105,7 @@ def main():
     # Check requirements are the same
     new_requirements = []
     try:
-        with open("requirements.txt", "r") as file:
+        with open(REQUIREMENTS, "r") as file:
             logging.debug("Checking requirements")
 
             local_reqs = set(file.read().splitlines()) - {""}
@@ -112,7 +115,7 @@ def main():
 
             new_requirements = requirements - local_reqs
 
-            for req in requirements - local_reqs:
+            for req in new_requirements:
                 logging.debug(f"{req} not found in local requirements.txt")
 
             for req in requirements & local_reqs:
@@ -120,7 +123,7 @@ def main():
 
             if new_requirements != set():
                 print(
-                    "You may need to add the following pacakges to your requirements.txt file:"
+                    "You may need to add the following packages to your requirements.txt file:"
                 )
                 for r in new_requirements:
                     print(f"{r}\n")
@@ -205,7 +208,7 @@ def update_static_files():
     # Writes return value for parent function
     if new_file_list != []:
         # Provides more information on new files
-        with open("NEWFILES.txt", "w") as f:
+        with open(f"{SPHINX_DIR}/NEWFILES.txt", "w") as f:
             for entry in new_file_list:
                 f.write(f"{entry}\n")
         logging.debug("Some downloaded files are new")
diff --git a/docs/.sphinx/version b/docs/.sphinx/version
index 7dea76edb3..3a3cd8cc8b 100644
--- a/docs/.sphinx/version
+++ b/docs/.sphinx/version
@@ -1 +1 @@
-1.0.1
+1.3.1
diff --git a/docs/Makefile b/docs/Makefile
index a6553b8e19..1e57a974ee 100644
--- a/docs/Makefile
+++ b/docs/Makefile
@@ -7,17 +7,18 @@
 SPHINXDIR       = .sphinx
 SPHINXOPTS      ?= -c . -d $(SPHINXDIR)/.doctrees -j auto
 SPHINXBUILD     ?= $(VENVDIR)/bin/sphinx-build
-SOURCEDIR       = .
+SOURCEDIR       ?= .
 BUILDDIR        = _build
-VENVDIR         = $(SPHINXDIR)/venv
+VENVDIR         ?= $(SPHINXDIR)/venv
 PA11Y           = $(SPHINXDIR)/node_modules/pa11y/bin/pa11y.js --config $(SPHINXDIR)/pa11y.json
-VENV         	   = $(VENVDIR)/bin/activate
+VENV            = $(VENVDIR)/bin/activate
 TARGET          = *
-ALLFILES        =  *.rst **/*.rst
 METRICSDIR      = $(SOURCEDIR)/.sphinx/metrics
 REQPDFPACKS     = latexmk fonts-freefont-otf texlive-latex-recommended texlive-latex-extra texlive-fonts-recommended texlive-font-utils texlive-lang-cjk texlive-xetex plantuml xindy tex-gyre dvipng
 CONFIRM_SUDO    ?= N
 VALE_CONFIG     = $(SPHINXDIR)/vale.ini
+VALEDIR         = $(SPHINXDIR)/venv/lib/python*/site-packages/vale
+VOCAB_CANONICAL = $(SPHINXDIR)/styles/config/vocabularies/Canonical
 SPHINX_HOST     ?= 127.0.0.1
 SPHINX_PORT     ?= 8000
 
@@ -31,6 +32,7 @@ help:
 	@echo "* clean built doc files:                     make clean-doc"
 	@echo "* clean full environment:                    make clean"
 	@echo "* check links:                               make linkcheck"
+	@echo "* check markdown:                            make lint-md"
 	@echo "* check spelling:                            make spelling"
 	@echo "* check spelling (without building again):   make spellcheck"
 	@echo "* check inclusive language:                  make woke"
@@ -42,10 +44,10 @@ help:
 	@echo "-------------------------------------------------------------"
 	@echo
 
-.PHONY: full-help spellcheck-install pa11y-install install run html \
-        epub serve clean clean-doc spelling spellcheck linkcheck woke \
-        allmetrics pa11y pdf-prep-force pdf-prep pdf vale-install vale \
-		update
+.PHONY: help full-help html epub pdf linkcheck spelling spellcheck woke \
+        vale pa11y run serve install pa11y-install   \
+        vale-install pdf-prep pdf-prep-force clean clean-doc allmetrics \
+        update lint-md
 
 full-help: $(VENVDIR)
 	@. $(VENV); $(SPHINXBUILD) -M help "$(SOURCEDIR)" "$(BUILDDIR)" $(SPHINXOPTS) $(O)
@@ -54,10 +56,8 @@ full-help: $(VENVDIR)
 
 # If requirements are updated, venv should be rebuilt and timestamped.
 $(VENVDIR):
-	python3 -c "import venv" || \
-        (echo "You must install python3-venv before you can build the documentation."; exit 1)
 	@echo "... setting up virtualenv"
-	python3 -m venv $(VENVDIR)
+	python3 -m venv $(VENVDIR) || { echo "You must install python3-venv before you can build the documentation."; exit 1; }
 	. $(VENV); pip install $(PIPOPTS) --require-virtualenv \
 	    --upgrade -r requirements.txt \
             --log $(VENVDIR)/pip_install.log
@@ -66,42 +66,30 @@ $(VENVDIR):
 	@. $(VENV); pip list --local --format=freeze > $(VENVDIR)/pip_list.txt
 	@touch $(VENVDIR)
 
-spellcheck-install:
-	@type aspell >/dev/null 2>&1 || \
-	{ \
-		echo "Installing system-wide \"aspell\" packages..."; \
-		confirm_sudo=$(CONFIRM_SUDO); \
-		if [ "$$confirm_sudo" != "y" ] && [ "$$confirm_sudo" != "Y" ]; then \
-			read -p "This requires sudo privileges. Proceed? [y/N]: " confirm_sudo; \
-		fi; \
-		if [ "$$confirm_sudo" = "y" ] || [ "$$confirm_sudo" = "Y" ]; then \
-			sudo apt-get install aspell aspell-en; \
-		else \
-			echo "Installation cancelled."; \
-		fi \
-	}
-
 pa11y-install:
-	@type $(PA11Y) >/dev/null 2>&1 || { \
+	@command -v $(PA11Y) >/dev/null || { \
 			echo "Installing \"pa11y\" from npm..."; echo; \
 			mkdir -p $(SPHINXDIR)/node_modules/ ; \
 			npm install --prefix $(SPHINXDIR) pa11y; \
 		}
 
+pymarkdownlnt-install:
+	@. $(VENV); test -d $(SPHINXDIR)/venv/lib/python*/site-packages/pymarkdown || pip install pymarkdownlnt
+
 install: $(VENVDIR)
 
 run: install
 	. $(VENV); $(VENVDIR)/bin/sphinx-autobuild -b dirhtml --host $(SPHINX_HOST) --port $(SPHINX_PORT) "$(SOURCEDIR)" "$(BUILDDIR)" $(SPHINXOPTS)
 
-# Doesn't depend on $(BUILDDIR) to rebuild properly at every run.
+# Does not depend on $(BUILDDIR) to rebuild properly at every run.
 html: install
-	. $(VENV); $(SPHINXBUILD) -W --keep-going -b dirhtml "$(SOURCEDIR)" "$(BUILDDIR)" -w $(SPHINXDIR)/warnings.txt $(SPHINXOPTS)
+	. $(VENV); $(SPHINXBUILD) --fail-on-warning --keep-going -b dirhtml "$(SOURCEDIR)" "$(BUILDDIR)" -w $(SPHINXDIR)/warnings.txt $(SPHINXOPTS)
 
 epub: install
 	. $(VENV); $(SPHINXBUILD) -b epub "$(SOURCEDIR)" "$(BUILDDIR)" -w $(SPHINXDIR)/warnings.txt $(SPHINXOPTS)
 
 serve: html
-	cd "$(BUILDDIR)"; python3 -m http.server --bind 127.0.0.1 8000
+	cd "$(BUILDDIR)"; python3 -m http.server --bind $(SPHINX_HOST) $(SPHINX_PORT)
 
 clean: clean-doc
 	@test ! -e "$(VENVDIR)" -o -d "$(VENVDIR)" -a "$(abspath $(VENVDIR))" != "$(VENVDIR)"
@@ -114,11 +102,6 @@ clean-doc:
 	git clean -fx "$(BUILDDIR)"
 	rm -rf $(SPHINXDIR)/.doctrees
 
-spellcheck: spellcheck-install
-	. $(VENV) ; python3 -m pyspelling -c $(SPHINXDIR)/spellingcheck.yaml -j $(shell nproc)
-
-spelling: html spellcheck
-
 linkcheck: install
 	. $(VENV) ; $(SPHINXBUILD) -b linkcheck "$(SOURCEDIR)" "$(BUILDDIR)" $(SPHINXOPTS) || { grep --color -F "[broken]" "$(BUILDDIR)/output.txt"; exit 1; }
 	exit 0
@@ -126,34 +109,39 @@ linkcheck: install
 pa11y: pa11y-install html
 	find $(BUILDDIR) -name *.html -print0 | xargs -n 1 -0 $(PA11Y)
 
+lint-md: pymarkdownlnt-install
+	@. $(VENV); pymarkdownlnt --config $(SPHINXDIR)/.pymarkdown.json scan --recurse --exclude=./$(SPHINXDIR)/** $(SOURCEDIR)
+
 vale-install: install
-	@. $(VENV); test -d $(SPHINXDIR)/venv/lib/python*/site-packages/vale || pip install rst2html vale
 	@. $(VENV); test -f $(VALE_CONFIG) || python3 $(SPHINXDIR)/get_vale_conf.py
 	@echo '.Name=="Canonical.400-Enforce-inclusive-terms"' > $(SPHINXDIR)/styles/woke.filter
 	@echo '.Level=="error" and .Name!="Canonical.500-Repeated-words" and .Name!="Canonical.000-US-spellcheck"' > $(SPHINXDIR)/styles/error.filter
 	@echo '.Name=="Canonical.000-US-spellcheck"' > $(SPHINXDIR)/styles/spelling.filter
-	@. $(VENV); find $(SPHINXDIR)/venv/lib/python*/site-packages/vale/vale_bin -size 195c -exec vale --version \;
+	@. $(VENV); find $(VALEDIR)/vale_bin -size 195c -exec vale --version \;
 
 woke: vale-install
-	@cat $(SPHINXDIR)/styles/config/vocabularies/Canonical/accept.txt > $(SPHINXDIR)/styles/config/vocabularies/Canonical/accept_backup.txt
-	@cat $(SPHINXDIR)/.wordlist.txt $(SOURCEDIR)/.custom_wordlist.txt >> $(SPHINXDIR)/styles/config/vocabularies/Canonical/accept.txt
+	@cat $(VOCAB_CANONICAL)/accept.txt > $(VOCAB_CANONICAL)/accept_backup.txt
+	@cat $(SOURCEDIR)/.custom_wordlist.txt >> $(VOCAB_CANONICAL)/accept.txt
 	@echo "Running Vale acceptable term check against $(TARGET). To change target set TARGET= with make command"
 	@. $(VENV); vale --config="$(VALE_CONFIG)" --filter='$(SPHINXDIR)/styles/woke.filter' --glob='*.{md,rst}' $(TARGET)
-	@cat $(SPHINXDIR)/styles/config/vocabularies/Canonical/accept_backup.txt > $(SPHINXDIR)/styles/config/vocabularies/Canonical/accept.txt && rm $(SPHINXDIR)/styles/config/vocabularies/Canonical/accept_backup.txt
+	@cat $(VOCAB_CANONICAL)/accept_backup.txt > $(VOCAB_CANONICAL)/accept.txt && rm $(VOCAB_CANONICAL)/accept_backup.txt
 
 vale: vale-install
-	@cat $(SPHINXDIR)/styles/config/vocabularies/Canonical/accept.txt > $(SPHINXDIR)/styles/config/vocabularies/Canonical/accept_backup.txt
-	@cat $(SPHINXDIR)/.wordlist.txt $(SOURCEDIR)/.custom_wordlist.txt >> $(SPHINXDIR)/styles/config/vocabularies/Canonical/accept.txt
+	@cat $(VOCAB_CANONICAL)/accept.txt > $(VOCAB_CANONICAL)/accept_backup.txt
+	@cat $(SOURCEDIR)/.custom_wordlist.txt >> $(VOCAB_CANONICAL)/accept.txt
 	@echo "Running Vale against $(TARGET). To change target set TARGET= with make command"
 	@. $(VENV); vale --config="$(VALE_CONFIG)" --filter='$(SPHINXDIR)/styles/error.filter' --glob='*.{md,rst}' $(TARGET)
-	@cat $(SPHINXDIR)/styles/config/vocabularies/Canonical/accept_backup.txt > $(SPHINXDIR)/styles/config/vocabularies/Canonical/accept.txt && rm $(SPHINXDIR)/styles/config/vocabularies/Canonical/accept_backup.txt
+	@cat $(VOCAB_CANONICAL)/accept_backup.txt > $(VOCAB_CANONICAL)/accept.txt && rm $(VOCAB_CANONICAL)/accept_backup.txt
 
-vale-spelling: vale-install
-	@cat $(SPHINXDIR)/styles/config/vocabularies/Canonical/accept.txt > $(SPHINXDIR)/styles/config/vocabularies/Canonical/accept_backup.txt
-	@cat $(SPHINXDIR)/.wordlist.txt $(SOURCEDIR)/.custom_wordlist.txt >> $(SPHINXDIR)/styles/config/vocabularies/Canonical/accept.txt
+spelling: vale-install
+	@cat $(VOCAB_CANONICAL)/accept.txt > $(VOCAB_CANONICAL)/accept_backup.txt
+	@cat $(SOURCEDIR)/.custom_wordlist.txt >> $(VOCAB_CANONICAL)/accept.txt
 	@echo "Running Vale against $(TARGET). To change target set TARGET= with make command"
 	@. $(VENV); vale --config="$(VALE_CONFIG)" --filter='$(SPHINXDIR)/styles/spelling.filter' --glob='*.{md,rst}' $(TARGET)
-	@cat $(SPHINXDIR)/styles/config/vocabularies/Canonical/accept_backup.txt > $(SPHINXDIR)/styles/config/vocabularies/Canonical/accept.txt && rm $(SPHINXDIR)/styles/config/vocabularies/Canonical/accept_backup.txt
+	@cat $(VOCAB_CANONICAL)/accept_backup.txt > $(VOCAB_CANONICAL)/accept.txt && rm $(VOCAB_CANONICAL)/accept_backup.txt
+
+spellcheck: spelling
+	@echo "Please note that the \`make spellcheck\` command is being deprecated in favor of \`make spelling\`"
 
 pdf-prep: install
 	@for packageName in $(REQPDFPACKS); do (dpkg-query -W -f='$${Status}' $$packageName 2>/dev/null | \
@@ -181,11 +169,11 @@ allmetrics: html
 	@echo "Recording documentation metrics..."
 	@echo "Checking for existence of vale..."
 	. $(VENV)
-	@. $(VENV); test -d $(SPHINXDIR)/venv/lib/python*/site-packages/vale || pip install vale
+	@. $(VENV); test -d $(VALEDIR) || pip install vale
 	@. $(VENV); test -f $(VALE_CONFIG) || python3 $(SPHINXDIR)/get_vale_conf.py
-	@. $(VENV); find $(SPHINXDIR)/venv/lib/python*/site-packages/vale/vale_bin -size 195c -exec vale --config "$(VALE_CONFIG)" $(TARGET) > /dev/null \;
+	@. $(VENV); find $(VALEDIR)/vale_bin -size 195c -exec vale --config "$(VALE_CONFIG)" $(TARGET) > /dev/null \;
 	@eval '$(METRICSDIR)/source_metrics.sh $(PWD)'
-	@eval '$(METRICSDIR)/build_metrics.sh $(PWD) $(METRICSDIR)'
+	@. $(VENV); python3 $(METRICSDIR)/build_metrics.py $(BUILDDIR)
 
 update: install
 	@. $(VENV); .sphinx/update_sp.py
@@ -193,4 +181,5 @@ update: install
 # Catch-all target: route all unknown targets to Sphinx using the new
 # "make mode" option.  $(O) is meant as a shortcut for $(SPHINXOPTS).
 %:
+	$(MAKE) --no-print-directory install
 	. $(VENV); $(SPHINXBUILD) -M $@ "$(SOURCEDIR)" "$(BUILDDIR)" $(SPHINXOPTS) $(O)
diff --git a/docs/assets/authd-architecture.png b/docs/assets/authd-architecture.png
deleted file mode 100644
index 7c0f9f89e2..0000000000
Binary files a/docs/assets/authd-architecture.png and /dev/null differ
diff --git a/docs/assets/authd-architecture.svg b/docs/assets/authd-architecture.svg
new file mode 100644
index 0000000000..ad47c9c144
--- /dev/null
+++ b/docs/assets/authd-architecture.svg
@@ -0,0 +1,99 @@
+<svg width="1073" height="451" viewBox="0 0 1073 451" fill="none" xmlns="http://www.w3.org/2000/svg">
+<rect width="1073" height="451" fill="#F3F3F3"/>
+<rect x="24.5" y="24.5" width="816" height="402" fill="white" stroke="#666666"/>
+<rect x="247" y="40" width="377" height="371" fill="#FAEEEB"/>
+<rect x="649" y="40" width="176" height="371" fill="#E3F5F7"/>
+<path d="M63.36 69V57.912H65.152V62.44H70.256V57.912H72.048V69H70.256V63.976H65.152V69H63.36ZM78.1583 69.208C77.3903 69.208 76.7076 69.0267 76.1103 68.664C75.5129 68.3013 75.0436 67.7893 74.7023 67.128C74.3716 66.4667 74.2063 65.6987 74.2063 64.824C74.2063 63.9387 74.3769 63.1707 74.7183 62.52C75.0596 61.8693 75.5289 61.3627 76.1263 61C76.7236 60.6373 77.4009 60.456 78.1583 60.456C78.9369 60.456 79.6196 60.6373 80.2063 61C80.8036 61.3627 81.2676 61.8693 81.5983 62.52C81.9396 63.1707 82.1103 63.9387 82.1103 64.824C82.1103 65.6987 81.9449 66.4667 81.6143 67.128C81.2836 67.7893 80.8249 68.3013 80.2383 68.664C79.6516 69.0267 78.9583 69.208 78.1583 69.208ZM78.1583 67.72C78.6169 67.72 79.0063 67.6027 79.3263 67.368C79.6569 67.1227 79.9076 66.7867 80.0783 66.36C80.2596 65.9227 80.3503 65.4107 80.3503 64.824C80.3503 64.2373 80.2596 63.7307 80.0783 63.304C79.9076 62.8667 79.6569 62.5307 79.3263 62.296C79.0063 62.0613 78.6169 61.944 78.1583 61.944C77.7103 61.944 77.3209 62.0613 76.9903 62.296C76.6596 62.5307 76.4036 62.8667 76.2223 63.304C76.0516 63.7307 75.9663 64.2373 75.9663 64.824C75.9663 65.4107 76.0516 65.9227 76.2223 66.36C76.4036 66.7867 76.6596 67.1227 76.9903 67.368C77.3209 67.6027 77.7103 67.72 78.1583 67.72ZM86.2023 69.208C85.4663 69.208 84.8796 69.144 84.4423 69.016C84.0049 68.888 83.7063 68.792 83.5463 68.728L83.8823 67.288C84.1169 67.384 84.4263 67.4907 84.8103 67.608C85.2049 67.7253 85.6689 67.784 86.2023 67.784C86.7249 67.784 87.1303 67.7147 87.4183 67.576C87.7063 67.4267 87.8503 67.176 87.8503 66.824C87.8503 66.6 87.7863 66.4187 87.6583 66.28C87.5409 66.1307 87.3543 65.992 87.0983 65.864C86.8529 65.736 86.5223 65.592 86.1063 65.432C85.6583 65.2507 85.2529 65.0587 84.8903 64.856C84.5276 64.6533 84.2396 64.3973 84.0263 64.088C83.8236 63.768 83.7223 63.3573 83.7223 62.856C83.7223 62.3653 83.8449 61.944 84.0903 61.592C84.3356 61.2293 84.6876 60.952 85.1463 60.76C85.6049 60.5573 86.1543 60.456 86.7943 60.456C87.3276 60.456 87.8023 60.504 88.2183 60.6C88.6449 60.6853 88.9596 60.776 89.1623 60.872L88.8423 62.264C88.6396 62.1787 88.3783 62.0933 88.0583 62.008C87.7489 61.912 87.3436 61.864 86.8423 61.864C86.4263 61.864 86.0849 61.9387 85.8183 62.088C85.5516 62.2373 85.4183 62.472 85.4183 62.792C85.4183 63.0053 85.4716 63.1867 85.5783 63.336C85.6849 63.4747 85.8556 63.608 86.0903 63.736C86.3249 63.8533 86.6343 63.9813 87.0182 64.12C87.5836 64.344 88.0529 64.568 88.4263 64.792C88.7996 65.0053 89.0823 65.272 89.2743 65.592C89.4663 65.912 89.5623 66.3173 89.5623 66.808C89.5623 67.3307 89.4289 67.7733 89.1623 68.136C88.8956 68.488 88.5116 68.7547 88.0103 68.936C87.5089 69.1173 86.9063 69.208 86.2023 69.208ZM94.3951 69.176C93.6165 69.176 93.0085 69.0427 92.5711 68.776C92.1338 68.5093 91.8245 68.12 91.6431 67.608C91.4725 67.0853 91.3871 66.4613 91.3871 65.736V58.392L93.0831 58.104V60.664H96.1711V62.088H93.0831V65.768C93.0831 66.248 93.1365 66.632 93.2431 66.92C93.3605 67.1973 93.5311 67.4 93.7551 67.528C93.9791 67.6453 94.2618 67.704 94.6031 67.704C94.9445 67.704 95.2485 67.6667 95.5151 67.592C95.7925 67.5173 96.0271 67.4373 96.2191 67.352L96.5071 68.712C96.2938 68.8187 96.0058 68.92 95.6431 69.016C95.2805 69.1227 94.8645 69.176 94.3951 69.176ZM103.89 69.208C103.154 69.208 102.567 69.144 102.13 69.016C101.692 68.888 101.394 68.792 101.234 68.728L101.57 67.288C101.804 67.384 102.114 67.4907 102.498 67.608C102.892 67.7253 103.356 67.784 103.89 67.784C104.412 67.784 104.818 67.7147 105.106 67.576C105.394 67.4267 105.538 67.176 105.538 66.824C105.538 66.6 105.474 66.4187 105.346 66.28C105.228 66.1307 105.042 65.992 104.786 65.864C104.54 65.736 104.21 65.592 103.794 65.432C103.346 65.2507 102.94 65.0587 102.578 64.856C102.215 64.6533 101.927 64.3973 101.714 64.088C101.511 63.768 101.41 63.3573 101.41 62.856C101.41 62.3653 101.532 61.944 101.778 61.592C102.023 61.2293 102.375 60.952 102.834 60.76C103.292 60.5573 103.842 60.456 104.482 60.456C105.015 60.456 105.49 60.504 105.906 60.6C106.332 60.6853 106.647 60.776 106.85 60.872L106.53 62.264C106.327 62.1787 106.066 62.0933 105.746 62.008C105.436 61.912 105.031 61.864 104.53 61.864C104.114 61.864 103.772 61.9387 103.506 62.088C103.239 62.2373 103.106 62.472 103.106 62.792C103.106 63.0053 103.159 63.1867 103.266 63.336C103.372 63.4747 103.543 63.608 103.778 63.736C104.012 63.8533 104.322 63.9813 104.706 64.12C105.271 64.344 105.74 64.568 106.114 64.792C106.487 65.0053 106.77 65.272 106.962 65.592C107.154 65.912 107.25 66.3173 107.25 66.808C107.25 67.3307 107.116 67.7733 106.85 68.136C106.583 68.488 106.199 68.7547 105.698 68.936C105.196 69.1173 104.594 69.208 103.89 69.208ZM109.411 71.992C109.091 71.992 108.797 71.9547 108.531 71.88C108.264 71.816 108.067 71.7573 107.939 71.704L108.243 70.328C108.392 70.3813 108.563 70.4293 108.755 70.472C108.957 70.5253 109.16 70.552 109.363 70.552C109.715 70.552 110.008 70.4933 110.243 70.376C110.488 70.2693 110.701 70.0933 110.883 69.848C111.064 69.6027 111.229 69.288 111.379 68.904C110.963 68.1253 110.557 67.2933 110.163 66.408C109.768 65.512 109.4 64.584 109.059 63.624C108.717 62.6533 108.408 61.6667 108.131 60.664H109.939C110.056 61.1227 110.195 61.624 110.355 62.168C110.515 62.7013 110.691 63.2507 110.883 63.816C111.075 64.3813 111.283 64.9467 111.507 65.512C111.731 66.0667 111.96 66.6053 112.195 67.128C112.451 66.424 112.685 65.72 112.899 65.016C113.112 64.312 113.309 63.5973 113.491 62.872C113.683 62.136 113.869 61.4 114.051 60.664H115.795C115.517 61.7093 115.224 62.7333 114.915 63.736C114.616 64.728 114.296 65.6827 113.955 66.6C113.624 67.5173 113.267 68.4027 112.883 69.256C112.605 69.896 112.312 70.4187 112.003 70.824C111.704 71.2293 111.347 71.5227 110.931 71.704C110.525 71.896 110.019 71.992 109.411 71.992ZM119.343 69.208C118.607 69.208 118.02 69.144 117.583 69.016C117.146 68.888 116.847 68.792 116.687 68.728L117.023 67.288C117.258 67.384 117.567 67.4907 117.951 67.608C118.346 67.7253 118.81 67.784 119.343 67.784C119.866 67.784 120.271 67.7147 120.559 67.576C120.847 67.4267 120.991 67.176 120.991 66.824C120.991 66.6 120.927 66.4187 120.799 66.28C120.682 66.1307 120.495 65.992 120.239 65.864C119.994 65.736 119.663 65.592 119.247 65.432C118.799 65.2507 118.394 65.0587 118.031 64.856C117.668 64.6533 117.38 64.3973 117.167 64.088C116.964 63.768 116.863 63.3573 116.863 62.856C116.863 62.3653 116.986 61.944 117.231 61.592C117.476 61.2293 117.828 60.952 118.287 60.76C118.746 60.5573 119.295 60.456 119.935 60.456C120.468 60.456 120.943 60.504 121.359 60.6C121.786 60.6853 122.1 60.776 122.303 60.872L121.983 62.264C121.78 62.1787 121.519 62.0933 121.199 62.008C120.89 61.912 120.484 61.864 119.983 61.864C119.567 61.864 119.226 61.9387 118.959 62.088C118.692 62.2373 118.559 62.472 118.559 62.792C118.559 63.0053 118.612 63.1867 118.719 63.336C118.826 63.4747 118.996 63.608 119.231 63.736C119.466 63.8533 119.775 63.9813 120.159 64.12C120.724 64.344 121.194 64.568 121.567 64.792C121.94 65.0053 122.223 65.272 122.415 65.592C122.607 65.912 122.703 66.3173 122.703 66.808C122.703 67.3307 122.57 67.7733 122.303 68.136C122.036 68.488 121.652 68.7547 121.151 68.936C120.65 69.1173 120.047 69.208 119.343 69.208ZM127.536 69.176C126.757 69.176 126.149 69.0427 125.712 68.776C125.274 68.5093 124.965 68.12 124.784 67.608C124.613 67.0853 124.528 66.4613 124.528 65.736V58.392L126.224 58.104V60.664H129.312V62.088H126.224V65.768C126.224 66.248 126.277 66.632 126.384 66.92C126.501 67.1973 126.672 67.4 126.896 67.528C127.12 67.6453 127.402 67.704 127.744 67.704C128.085 67.704 128.389 67.6667 128.656 67.592C128.933 67.5173 129.168 67.4373 129.36 67.352L129.648 68.712C129.434 68.8187 129.146 68.92 128.784 69.016C128.421 69.1227 128.005 69.176 127.536 69.176ZM134.884 69.192C133.892 69.192 133.081 69.0053 132.452 68.632C131.833 68.248 131.375 67.7307 131.076 67.08C130.777 66.4293 130.628 65.688 130.628 64.856C130.628 63.8747 130.809 63.0587 131.172 62.408C131.545 61.7573 132.02 61.272 132.596 60.952C133.183 60.6213 133.801 60.456 134.452 60.456C135.188 60.456 135.823 60.6107 136.356 60.92C136.9 61.2187 137.316 61.6773 137.604 62.296C137.903 62.9147 138.052 63.6933 138.052 64.632C138.052 64.7387 138.047 64.856 138.036 64.984C138.036 65.112 138.031 65.2293 138.02 65.336H132.388C132.441 66.0827 132.687 66.664 133.124 67.08C133.561 67.496 134.207 67.704 135.06 67.704C135.561 67.704 135.999 67.6613 136.372 67.576C136.756 67.48 137.049 67.384 137.252 67.288L137.508 68.696C137.305 68.8027 136.959 68.9093 136.468 69.016C135.988 69.1333 135.46 69.192 134.884 69.192ZM132.42 64.072H136.372C136.361 63.6453 136.281 63.272 136.132 62.952C135.993 62.6213 135.785 62.3653 135.508 62.184C135.241 61.992 134.895 61.896 134.468 61.896C134.052 61.896 133.695 61.9973 133.396 62.2C133.108 62.4027 132.879 62.6693 132.708 63C132.548 63.3307 132.452 63.688 132.42 64.072ZM140.139 69V60.952C140.501 60.8453 140.965 60.744 141.531 60.648C142.096 60.5413 142.731 60.488 143.435 60.488C144 60.488 144.469 60.5627 144.843 60.712C145.227 60.8613 145.536 61.0693 145.771 61.336C145.931 61.2187 146.139 61.096 146.395 60.968C146.651 60.8293 146.949 60.7173 147.291 60.632C147.632 60.536 147.989 60.488 148.363 60.488C149.237 60.488 149.899 60.6533 150.347 60.984C150.805 61.304 151.115 61.752 151.275 62.328C151.445 62.8933 151.531 63.5547 151.531 64.312V69H149.819V64.632C149.819 64.0027 149.771 63.496 149.675 63.112C149.589 62.7173 149.424 62.4293 149.179 62.248C148.944 62.056 148.603 61.96 148.155 61.96C147.899 61.96 147.659 61.992 147.435 62.056C147.211 62.12 147.013 62.2 146.843 62.296C146.672 62.3813 146.544 62.456 146.459 62.52C146.544 62.776 146.603 63.0587 146.635 63.368C146.677 63.6773 146.699 64.008 146.699 64.36V69H144.987V64.632C144.987 64.0027 144.939 63.496 144.843 63.112C144.747 62.7173 144.576 62.4293 144.331 62.248C144.096 62.056 143.749 61.96 143.291 61.96C143.067 61.96 142.859 61.9707 142.667 61.992C142.485 62.0027 142.325 62.024 142.187 62.056C142.048 62.0773 141.936 62.0987 141.851 62.12V69H140.139Z" fill="black"/>
+<path d="M267 69.176C266.339 69.176 265.757 69.0907 265.256 68.92C264.755 68.7493 264.365 68.4667 264.088 68.072C263.811 67.6773 263.672 67.1547 263.672 66.504C263.672 65.8747 263.827 65.368 264.136 64.984C264.456 64.6 264.883 64.328 265.416 64.168C265.949 63.9973 266.536 63.912 267.176 63.912C267.475 63.912 267.768 63.9333 268.056 63.976C268.355 64.008 268.563 64.0453 268.68 64.088V63.72C268.68 63.4 268.627 63.1013 268.52 62.824C268.424 62.5467 268.243 62.3227 267.976 62.152C267.72 61.9813 267.347 61.896 266.856 61.896C266.344 61.896 265.912 61.9333 265.56 62.008C265.219 62.0827 264.947 62.1573 264.744 62.232L264.52 60.824C264.744 60.7387 265.08 60.6587 265.528 60.584C265.976 60.4987 266.472 60.456 267.016 60.456C267.848 60.456 268.504 60.5947 268.984 60.872C269.475 61.1387 269.821 61.5173 270.024 62.008C270.227 62.488 270.328 63.048 270.328 63.688V68.792C270.061 68.856 269.629 68.936 269.032 69.032C268.445 69.128 267.768 69.176 267 69.176ZM267.16 67.8C267.48 67.8 267.768 67.7893 268.024 67.768C268.291 67.7467 268.509 67.72 268.68 67.688V65.32C268.573 65.288 268.403 65.2507 268.168 65.208C267.944 65.1653 267.683 65.144 267.384 65.144C267.064 65.144 266.749 65.1813 266.44 65.256C266.141 65.32 265.891 65.448 265.688 65.64C265.485 65.8213 265.384 66.0933 265.384 66.456C265.384 66.9573 265.544 67.3093 265.864 67.512C266.184 67.704 266.616 67.8 267.16 67.8ZM276.14 69.176C275.255 69.176 274.556 69.016 274.044 68.696C273.543 68.3653 273.185 67.912 272.972 67.336C272.759 66.7493 272.652 66.0773 272.652 65.32V60.664H274.364V65.016C274.364 65.656 274.423 66.1733 274.54 66.568C274.668 66.9627 274.871 67.2507 275.148 67.432C275.436 67.6027 275.815 67.688 276.284 67.688C276.615 67.688 276.919 67.672 277.196 67.64C277.484 67.608 277.687 67.576 277.804 67.544V60.664H279.516V68.712C279.153 68.808 278.679 68.9093 278.092 69.016C277.516 69.1227 276.865 69.176 276.14 69.176ZM284.958 69.176C284.179 69.176 283.571 69.0427 283.134 68.776C282.696 68.5093 282.387 68.12 282.206 67.608C282.035 67.0853 281.95 66.4613 281.95 65.736V58.392L283.646 58.104V60.664H286.734V62.088H283.646V65.768C283.646 66.248 283.699 66.632 283.806 66.92C283.923 67.1973 284.094 67.4 284.318 67.528C284.542 67.6453 284.824 67.704 285.166 67.704C285.507 67.704 285.811 67.6667 286.078 67.592C286.355 67.5173 286.59 67.4373 286.782 67.352L287.07 68.712C286.856 68.8187 286.568 68.92 286.206 69.016C285.843 69.1227 285.427 69.176 284.958 69.176ZM288.654 69V56.872L290.366 56.584V60.792C290.612 60.696 290.884 60.6213 291.182 60.568C291.492 60.5147 291.79 60.488 292.078 60.488C292.974 60.488 293.668 60.648 294.158 60.968C294.649 61.288 294.996 61.736 295.198 62.312C295.401 62.888 295.502 63.5547 295.502 64.312V69H293.79V64.632C293.79 63.9813 293.732 63.464 293.614 63.08C293.508 62.6853 293.316 62.4027 293.038 62.232C292.761 62.0507 292.377 61.96 291.886 61.96C291.694 61.96 291.497 61.976 291.294 62.008C291.092 62.04 290.905 62.0773 290.734 62.12C290.574 62.1627 290.452 62.2 290.366 62.232V69H288.654ZM301.696 69.192C300.832 69.192 300.085 69.0213 299.456 68.68C298.827 68.328 298.336 67.8267 297.984 67.176C297.643 66.5253 297.472 65.752 297.472 64.856C297.472 63.9813 297.621 63.2187 297.92 62.568C298.219 61.9067 298.645 61.3947 299.2 61.032C299.765 60.6693 300.443 60.488 301.232 60.488C301.659 60.488 302.037 60.5413 302.368 60.648C302.709 60.7547 302.992 60.872 303.216 61V56.872L304.912 56.584V68.744C304.677 68.808 304.389 68.8773 304.048 68.952C303.707 69.0267 303.339 69.0853 302.944 69.128C302.549 69.1707 302.133 69.192 301.696 69.192ZM301.712 67.72C302.075 67.72 302.379 67.704 302.624 67.672C302.88 67.6293 303.077 67.592 303.216 67.56V62.504C303.045 62.376 302.8 62.2533 302.48 62.136C302.171 62.0187 301.829 61.96 301.456 61.96C301.061 61.96 300.72 62.0293 300.432 62.168C300.155 62.296 299.925 62.488 299.744 62.744C299.563 63 299.429 63.304 299.344 63.656C299.269 63.9973 299.232 64.3813 299.232 64.808C299.232 65.4053 299.333 65.9227 299.536 66.36C299.739 66.7973 300.021 67.1333 300.384 67.368C300.757 67.6027 301.2 67.72 301.712 67.72Z" fill="black"/>
+<path d="M666.36 69V57.912H668.152V69H666.36ZM674.54 69.192C673.676 69.192 672.929 69.0213 672.3 68.68C671.67 68.328 671.18 67.8267 670.828 67.176C670.486 66.5253 670.316 65.752 670.316 64.856C670.316 63.9813 670.465 63.2187 670.764 62.568C671.062 61.9067 671.489 61.3947 672.044 61.032C672.609 60.6693 673.286 60.488 674.076 60.488C674.502 60.488 674.881 60.5413 675.212 60.648C675.553 60.7547 675.836 60.872 676.06 61V56.872L677.756 56.584V68.744C677.521 68.808 677.233 68.8773 676.892 68.952C676.55 69.0267 676.182 69.0853 675.788 69.128C675.393 69.1707 674.977 69.192 674.54 69.192ZM674.556 67.72C674.918 67.72 675.222 67.704 675.468 67.672C675.724 67.6293 675.921 67.592 676.06 67.56V62.504C675.889 62.376 675.644 62.2533 675.324 62.136C675.014 62.0187 674.673 61.96 674.3 61.96C673.905 61.96 673.564 62.0293 673.276 62.168C672.998 62.296 672.769 62.488 672.588 62.744C672.406 63 672.273 63.304 672.188 63.656C672.113 63.9973 672.076 64.3813 672.076 64.808C672.076 65.4053 672.177 65.9227 672.38 66.36C672.582 66.7973 672.865 67.1333 673.228 67.368C673.601 67.6027 674.044 67.72 674.556 67.72ZM684.056 69.192C683.064 69.192 682.253 69.0053 681.624 68.632C681.005 68.248 680.547 67.7307 680.248 67.08C679.949 66.4293 679.8 65.688 679.8 64.856C679.8 63.8747 679.981 63.0587 680.344 62.408C680.717 61.7573 681.192 61.272 681.768 60.952C682.355 60.6213 682.973 60.456 683.624 60.456C684.36 60.456 684.995 60.6107 685.528 60.92C686.072 61.2187 686.488 61.6773 686.776 62.296C687.075 62.9147 687.224 63.6933 687.224 64.632C687.224 64.7387 687.219 64.856 687.208 64.984C687.208 65.112 687.203 65.2293 687.192 65.336H681.56C681.613 66.0827 681.859 66.664 682.296 67.08C682.733 67.496 683.379 67.704 684.232 67.704C684.733 67.704 685.171 67.6613 685.544 67.576C685.928 67.48 686.221 67.384 686.424 67.288L686.68 68.696C686.477 68.8027 686.131 68.9093 685.64 69.016C685.16 69.1333 684.632 69.192 684.056 69.192ZM681.592 64.072H685.544C685.533 63.6453 685.453 63.272 685.304 62.952C685.165 62.6213 684.957 62.3653 684.68 62.184C684.413 61.992 684.067 61.896 683.64 61.896C683.224 61.896 682.867 61.9973 682.568 62.2C682.28 62.4027 682.051 62.6693 681.88 63C681.72 63.3307 681.624 63.688 681.592 64.072ZM689.311 69V60.952C689.673 60.8453 690.143 60.744 690.719 60.648C691.305 60.5413 691.961 60.488 692.687 60.488C693.593 60.488 694.297 60.648 694.799 60.968C695.3 61.288 695.652 61.736 695.855 62.312C696.057 62.888 696.159 63.5547 696.159 64.312V69H694.447V64.632C694.447 63.9813 694.388 63.464 694.271 63.08C694.164 62.6853 693.972 62.4027 693.695 62.232C693.417 62.0507 693.028 61.96 692.527 61.96C692.207 61.96 691.908 61.9813 691.631 62.024C691.353 62.056 691.151 62.088 691.023 62.12V69H689.311ZM701.52 69.176C700.741 69.176 700.133 69.0427 699.696 68.776C699.259 68.5093 698.949 68.12 698.768 67.608C698.597 67.0853 698.512 66.4613 698.512 65.736V58.392L700.208 58.104V60.664H703.296V62.088H700.208V65.768C700.208 66.248 700.261 66.632 700.368 66.92C700.485 67.1973 700.656 67.4 700.88 67.528C701.104 67.6453 701.387 67.704 701.728 67.704C702.069 67.704 702.373 67.6667 702.64 67.592C702.917 67.5173 703.152 67.4373 703.344 67.352L703.632 68.712C703.419 68.8187 703.131 68.92 702.768 69.016C702.405 69.1227 701.989 69.176 701.52 69.176ZM705.217 69V60.664H706.929V69H705.217ZM706.081 58.952C705.782 58.952 705.521 58.8507 705.297 58.648C705.083 58.4453 704.977 58.1787 704.977 57.848C704.977 57.5067 705.083 57.24 705.297 57.048C705.521 56.8453 705.782 56.744 706.081 56.744C706.379 56.744 706.635 56.8453 706.849 57.048C707.073 57.24 707.185 57.5067 707.185 57.848C707.185 58.1787 707.073 58.4453 706.849 58.648C706.635 58.8507 706.379 58.952 706.081 58.952ZM712.364 69.176C711.585 69.176 710.977 69.0427 710.54 68.776C710.103 68.5093 709.793 68.12 709.612 67.608C709.441 67.0853 709.356 66.4613 709.356 65.736V58.392L711.052 58.104V60.664H714.14V62.088H711.052V65.768C711.052 66.248 711.105 66.632 711.212 66.92C711.329 67.1973 711.5 67.4 711.724 67.528C711.948 67.6453 712.231 67.704 712.572 67.704C712.913 67.704 713.217 67.6667 713.484 67.592C713.761 67.5173 713.996 67.4373 714.188 67.352L714.476 68.712C714.263 68.8187 713.975 68.92 713.612 69.016C713.249 69.1227 712.833 69.176 712.364 69.176ZM716.411 71.992C716.091 71.992 715.797 71.9547 715.531 71.88C715.264 71.816 715.067 71.7573 714.939 71.704L715.243 70.328C715.392 70.3813 715.563 70.4293 715.755 70.472C715.957 70.5253 716.16 70.552 716.363 70.552C716.715 70.552 717.008 70.4933 717.243 70.376C717.488 70.2693 717.701 70.0933 717.883 69.848C718.064 69.6027 718.229 69.288 718.379 68.904C717.963 68.1253 717.557 67.2933 717.163 66.408C716.768 65.512 716.4 64.584 716.059 63.624C715.717 62.6533 715.408 61.6667 715.131 60.664H716.939C717.056 61.1227 717.195 61.624 717.355 62.168C717.515 62.7013 717.691 63.2507 717.883 63.816C718.075 64.3813 718.283 64.9467 718.507 65.512C718.731 66.0667 718.96 66.6053 719.195 67.128C719.451 66.424 719.685 65.72 719.899 65.016C720.112 64.312 720.309 63.5973 720.491 62.872C720.683 62.136 720.869 61.4 721.051 60.664H722.795C722.517 61.7093 722.224 62.7333 721.915 63.736C721.616 64.728 721.296 65.6827 720.955 66.6C720.624 67.5173 720.267 68.4027 719.883 69.256C719.605 69.896 719.312 70.4187 719.003 70.824C718.704 71.2293 718.347 71.5227 717.931 71.704C717.525 71.896 717.019 71.992 716.411 71.992ZM731.261 69.192C730.834 69.192 730.418 69.1707 730.013 69.128C729.618 69.0853 729.25 69.0267 728.909 68.952C728.578 68.8773 728.29 68.808 728.045 68.744V56.872L729.757 56.584V61C729.981 60.872 730.264 60.7547 730.605 60.648C730.957 60.5413 731.346 60.488 731.773 60.488C732.573 60.488 733.25 60.6693 733.805 61.032C734.36 61.3947 734.781 61.9067 735.069 62.568C735.357 63.2187 735.501 63.9707 735.501 64.824C735.501 65.72 735.325 66.4987 734.973 67.16C734.632 67.8107 734.146 68.312 733.517 68.664C732.888 69.016 732.136 69.192 731.261 69.192ZM731.245 67.72C731.768 67.72 732.21 67.6027 732.573 67.368C732.946 67.1333 733.229 66.7973 733.421 66.36C733.624 65.9227 733.725 65.4053 733.725 64.808C733.725 64.3813 733.682 63.9973 733.597 63.656C733.522 63.304 733.394 63 733.213 62.744C733.032 62.488 732.797 62.296 732.509 62.168C732.232 62.0293 731.896 61.96 731.501 61.96C731.138 61.96 730.797 62.0187 730.477 62.136C730.168 62.2533 729.928 62.376 729.757 62.504V67.56C729.896 67.592 730.088 67.6293 730.333 67.672C730.589 67.704 730.893 67.72 731.245 67.72ZM737.529 69V61.064C737.871 60.936 738.303 60.808 738.825 60.68C739.359 60.552 739.972 60.488 740.665 60.488C740.868 60.488 741.081 60.504 741.305 60.536C741.54 60.5573 741.764 60.5893 741.977 60.632C742.191 60.6747 742.356 60.7173 742.473 60.76L742.169 62.2C742.02 62.1467 741.807 62.0933 741.529 62.04C741.252 61.9867 740.927 61.96 740.553 61.96C740.255 61.96 739.983 61.9867 739.737 62.04C739.503 62.0827 739.337 62.12 739.241 62.152V69H737.529ZM747.33 69.208C746.562 69.208 745.879 69.0267 745.282 68.664C744.685 68.3013 744.215 67.7893 743.874 67.128C743.543 66.4667 743.378 65.6987 743.378 64.824C743.378 63.9387 743.549 63.1707 743.89 62.52C744.231 61.8693 744.701 61.3627 745.298 61C745.895 60.6373 746.573 60.456 747.33 60.456C748.109 60.456 748.791 60.6373 749.378 61C749.975 61.3627 750.439 61.8693 750.77 62.52C751.111 63.1707 751.282 63.9387 751.282 64.824C751.282 65.6987 751.117 66.4667 750.786 67.128C750.455 67.7893 749.997 68.3013 749.41 68.664C748.823 69.0267 748.13 69.208 747.33 69.208ZM747.33 67.72C747.789 67.72 748.178 67.6027 748.498 67.368C748.829 67.1227 749.079 66.7867 749.25 66.36C749.431 65.9227 749.522 65.4107 749.522 64.824C749.522 64.2373 749.431 63.7307 749.25 63.304C749.079 62.8667 748.829 62.5307 748.498 62.296C748.178 62.0613 747.789 61.944 747.33 61.944C746.882 61.944 746.493 62.0613 746.162 62.296C745.831 62.5307 745.575 62.8667 745.394 63.304C745.223 63.7307 745.138 64.2373 745.138 64.824C745.138 65.4107 745.223 65.9227 745.394 66.36C745.575 66.7867 745.831 67.1227 746.162 67.368C746.493 67.6027 746.882 67.72 747.33 67.72ZM753.326 69V56.872L755.038 56.584V64.04C755.283 63.784 755.55 63.5067 755.838 63.208C756.126 62.9093 756.414 62.6053 756.702 62.296C757.001 61.976 757.273 61.6773 757.518 61.4C757.774 61.112 757.993 60.8667 758.174 60.664H760.206C759.865 61.0373 759.491 61.4427 759.086 61.88C758.681 62.3067 758.27 62.7333 757.854 63.16C757.449 63.5867 757.043 63.9973 756.638 64.392C756.979 64.648 757.326 64.9627 757.678 65.336C758.03 65.7093 758.377 66.1093 758.718 66.536C759.07 66.9627 759.39 67.3893 759.678 67.816C759.977 68.232 760.227 68.6267 760.43 69H758.462C758.185 68.5307 757.849 68.0507 757.454 67.56C757.07 67.0587 756.67 66.5893 756.254 66.152C755.838 65.7147 755.433 65.3573 755.038 65.08V69H753.326ZM765.337 69.192C764.345 69.192 763.535 69.0053 762.905 68.632C762.287 68.248 761.828 67.7307 761.529 67.08C761.231 66.4293 761.081 65.688 761.081 64.856C761.081 63.8747 761.263 63.0587 761.625 62.408C761.999 61.7573 762.473 61.272 763.049 60.952C763.636 60.6213 764.255 60.456 764.905 60.456C765.641 60.456 766.276 60.6107 766.809 60.92C767.353 61.2187 767.769 61.6773 768.057 62.296C768.356 62.9147 768.505 63.6933 768.505 64.632C768.505 64.7387 768.5 64.856 768.489 64.984C768.489 65.112 768.484 65.2293 768.473 65.336H762.841C762.895 66.0827 763.14 66.664 763.577 67.08C764.015 67.496 764.66 67.704 765.513 67.704C766.015 67.704 766.452 67.6613 766.825 67.576C767.209 67.48 767.503 67.384 767.705 67.288L767.961 68.696C767.759 68.8027 767.412 68.9093 766.921 69.016C766.441 69.1333 765.913 69.192 765.337 69.192ZM762.873 64.072H766.825C766.815 63.6453 766.735 63.272 766.585 62.952C766.447 62.6213 766.239 62.3653 765.961 62.184C765.695 61.992 765.348 61.896 764.921 61.896C764.505 61.896 764.148 61.9973 763.849 62.2C763.561 62.4027 763.332 62.6693 763.161 63C763.001 63.3307 762.905 63.688 762.873 64.072ZM770.592 69V61.064C770.933 60.936 771.365 60.808 771.888 60.68C772.421 60.552 773.034 60.488 773.728 60.488C773.93 60.488 774.144 60.504 774.368 60.536C774.602 60.5573 774.826 60.5893 775.04 60.632C775.253 60.6747 775.418 60.7173 775.536 60.76L775.232 62.2C775.082 62.1467 774.869 62.0933 774.592 62.04C774.314 61.9867 773.989 61.96 773.616 61.96C773.317 61.96 773.045 61.9867 772.8 62.04C772.565 62.0827 772.4 62.12 772.304 62.152V69H770.592ZM779.015 69.208C778.279 69.208 777.692 69.144 777.255 69.016C776.817 68.888 776.519 68.792 776.359 68.728L776.695 67.288C776.929 67.384 777.239 67.4907 777.623 67.608C778.017 67.7253 778.481 67.784 779.015 67.784C779.537 67.784 779.943 67.7147 780.231 67.576C780.519 67.4267 780.663 67.176 780.663 66.824C780.663 66.6 780.599 66.4187 780.471 66.28C780.353 66.1307 780.167 65.992 779.911 65.864C779.665 65.736 779.335 65.592 778.919 65.432C778.471 65.2507 778.065 65.0587 777.703 64.856C777.34 64.6533 777.052 64.3973 776.839 64.088C776.636 63.768 776.535 63.3573 776.535 62.856C776.535 62.3653 776.657 61.944 776.903 61.592C777.148 61.2293 777.5 60.952 777.959 60.76C778.417 60.5573 778.967 60.456 779.607 60.456C780.14 60.456 780.615 60.504 781.031 60.6C781.457 60.6853 781.772 60.776 781.975 60.872L781.655 62.264C781.452 62.1787 781.191 62.0933 780.871 62.008C780.561 61.912 780.156 61.864 779.655 61.864C779.239 61.864 778.897 61.9387 778.631 62.088C778.364 62.2373 778.231 62.472 778.231 62.792C778.231 63.0053 778.284 63.1867 778.391 63.336C778.497 63.4747 778.668 63.608 778.903 63.736C779.137 63.8533 779.447 63.9813 779.831 64.12C780.396 64.344 780.865 64.568 781.239 64.792C781.612 65.0053 781.895 65.272 782.087 65.592C782.279 65.912 782.375 66.3173 782.375 66.808C782.375 67.3307 782.241 67.7733 781.975 68.136C781.708 68.488 781.324 68.7547 780.823 68.936C780.321 69.1173 779.719 69.208 779.015 69.208Z" fill="black"/>
+<path d="M867.36 69V57.912H869.152V69H867.36ZM875.54 69.192C874.676 69.192 873.929 69.0213 873.3 68.68C872.67 68.328 872.18 67.8267 871.828 67.176C871.486 66.5253 871.316 65.752 871.316 64.856C871.316 63.9813 871.465 63.2187 871.764 62.568C872.062 61.9067 872.489 61.3947 873.044 61.032C873.609 60.6693 874.286 60.488 875.076 60.488C875.502 60.488 875.881 60.5413 876.212 60.648C876.553 60.7547 876.836 60.872 877.06 61V56.872L878.756 56.584V68.744C878.521 68.808 878.233 68.8773 877.892 68.952C877.55 69.0267 877.182 69.0853 876.788 69.128C876.393 69.1707 875.977 69.192 875.54 69.192ZM875.556 67.72C875.918 67.72 876.222 67.704 876.468 67.672C876.724 67.6293 876.921 67.592 877.06 67.56V62.504C876.889 62.376 876.644 62.2533 876.324 62.136C876.014 62.0187 875.673 61.96 875.3 61.96C874.905 61.96 874.564 62.0293 874.276 62.168C873.998 62.296 873.769 62.488 873.588 62.744C873.406 63 873.273 63.304 873.188 63.656C873.113 63.9973 873.076 64.3813 873.076 64.808C873.076 65.4053 873.177 65.9227 873.38 66.36C873.582 66.7973 873.865 67.1333 874.228 67.368C874.601 67.6027 875.044 67.72 875.556 67.72ZM885.056 69.192C884.064 69.192 883.253 69.0053 882.624 68.632C882.005 68.248 881.547 67.7307 881.248 67.08C880.949 66.4293 880.8 65.688 880.8 64.856C880.8 63.8747 880.981 63.0587 881.344 62.408C881.717 61.7573 882.192 61.272 882.768 60.952C883.355 60.6213 883.973 60.456 884.624 60.456C885.36 60.456 885.995 60.6107 886.528 60.92C887.072 61.2187 887.488 61.6773 887.776 62.296C888.075 62.9147 888.224 63.6933 888.224 64.632C888.224 64.7387 888.219 64.856 888.208 64.984C888.208 65.112 888.203 65.2293 888.192 65.336H882.56C882.613 66.0827 882.859 66.664 883.296 67.08C883.733 67.496 884.379 67.704 885.232 67.704C885.733 67.704 886.171 67.6613 886.544 67.576C886.928 67.48 887.221 67.384 887.424 67.288L887.68 68.696C887.477 68.8027 887.131 68.9093 886.64 69.016C886.16 69.1333 885.632 69.192 885.056 69.192ZM882.592 64.072H886.544C886.533 63.6453 886.453 63.272 886.304 62.952C886.165 62.6213 885.957 62.3653 885.68 62.184C885.413 61.992 885.067 61.896 884.64 61.896C884.224 61.896 883.867 61.9973 883.568 62.2C883.28 62.4027 883.051 62.6693 882.88 63C882.72 63.3307 882.624 63.688 882.592 64.072ZM890.311 69V60.952C890.673 60.8453 891.143 60.744 891.719 60.648C892.305 60.5413 892.961 60.488 893.687 60.488C894.593 60.488 895.297 60.648 895.799 60.968C896.3 61.288 896.652 61.736 896.855 62.312C897.057 62.888 897.159 63.5547 897.159 64.312V69H895.447V64.632C895.447 63.9813 895.388 63.464 895.271 63.08C895.164 62.6853 894.972 62.4027 894.695 62.232C894.417 62.0507 894.028 61.96 893.527 61.96C893.207 61.96 892.908 61.9813 892.631 62.024C892.353 62.056 892.151 62.088 892.023 62.12V69H890.311ZM902.52 69.176C901.741 69.176 901.133 69.0427 900.696 68.776C900.259 68.5093 899.949 68.12 899.768 67.608C899.597 67.0853 899.512 66.4613 899.512 65.736V58.392L901.208 58.104V60.664H904.296V62.088H901.208V65.768C901.208 66.248 901.261 66.632 901.368 66.92C901.485 67.1973 901.656 67.4 901.88 67.528C902.104 67.6453 902.387 67.704 902.728 67.704C903.069 67.704 903.373 67.6667 903.64 67.592C903.917 67.5173 904.152 67.4373 904.344 67.352L904.632 68.712C904.419 68.8187 904.131 68.92 903.768 69.016C903.405 69.1227 902.989 69.176 902.52 69.176ZM906.217 69V60.664H907.929V69H906.217ZM907.081 58.952C906.782 58.952 906.521 58.8507 906.297 58.648C906.083 58.4453 905.977 58.1787 905.977 57.848C905.977 57.5067 906.083 57.24 906.297 57.048C906.521 56.8453 906.782 56.744 907.081 56.744C907.379 56.744 907.635 56.8453 907.849 57.048C908.073 57.24 908.185 57.5067 908.185 57.848C908.185 58.1787 908.073 58.4453 907.849 58.648C907.635 58.8507 907.379 58.952 907.081 58.952ZM913.364 69.176C912.585 69.176 911.977 69.0427 911.54 68.776C911.103 68.5093 910.793 68.12 910.612 67.608C910.441 67.0853 910.356 66.4613 910.356 65.736V58.392L912.052 58.104V60.664H915.14V62.088H912.052V65.768C912.052 66.248 912.105 66.632 912.212 66.92C912.329 67.1973 912.5 67.4 912.724 67.528C912.948 67.6453 913.231 67.704 913.572 67.704C913.913 67.704 914.217 67.6667 914.484 67.592C914.761 67.5173 914.996 67.4373 915.188 67.352L915.476 68.712C915.263 68.8187 914.975 68.92 914.612 69.016C914.249 69.1227 913.833 69.176 913.364 69.176ZM917.411 71.992C917.091 71.992 916.797 71.9547 916.531 71.88C916.264 71.816 916.067 71.7573 915.939 71.704L916.243 70.328C916.392 70.3813 916.563 70.4293 916.755 70.472C916.957 70.5253 917.16 70.552 917.363 70.552C917.715 70.552 918.008 70.4933 918.243 70.376C918.488 70.2693 918.701 70.0933 918.883 69.848C919.064 69.6027 919.229 69.288 919.379 68.904C918.963 68.1253 918.557 67.2933 918.163 66.408C917.768 65.512 917.4 64.584 917.059 63.624C916.717 62.6533 916.408 61.6667 916.131 60.664H917.939C918.056 61.1227 918.195 61.624 918.355 62.168C918.515 62.7013 918.691 63.2507 918.883 63.816C919.075 64.3813 919.283 64.9467 919.507 65.512C919.731 66.0667 919.96 66.6053 920.195 67.128C920.451 66.424 920.685 65.72 920.899 65.016C921.112 64.312 921.309 63.5973 921.491 62.872C921.683 62.136 921.869 61.4 922.051 60.664H923.795C923.517 61.7093 923.224 62.7333 922.915 63.736C922.616 64.728 922.296 65.6827 921.955 66.6C921.624 67.5173 921.267 68.4027 920.883 69.256C920.605 69.896 920.312 70.4187 920.003 70.824C919.704 71.2293 919.347 71.5227 918.931 71.704C918.525 71.896 918.019 71.992 917.411 71.992ZM929.045 71.96V60.952C929.29 60.8667 929.578 60.792 929.909 60.728C930.25 60.6533 930.618 60.5947 931.013 60.552C931.418 60.5093 931.834 60.488 932.261 60.488C933.136 60.488 933.888 60.664 934.517 61.016C935.146 61.368 935.632 61.8693 935.973 62.52C936.325 63.1707 936.501 63.944 936.501 64.84C936.501 65.6933 936.357 66.4453 936.069 67.096C935.781 67.7467 935.36 68.2587 934.805 68.632C934.25 68.9947 933.573 69.176 932.773 69.176C932.346 69.176 931.957 69.1227 931.605 69.016C931.264 68.9093 930.981 68.7867 930.757 68.648V71.96H929.045ZM932.501 67.704C932.896 67.704 933.232 67.6347 933.509 67.496C933.797 67.3573 934.032 67.1653 934.213 66.92C934.394 66.664 934.522 66.3653 934.597 66.024C934.682 65.6827 934.725 65.2987 934.725 64.872C934.725 64.264 934.624 63.7467 934.421 63.32C934.229 62.8827 933.946 62.5467 933.573 62.312C933.21 62.0773 932.768 61.96 932.245 61.96C931.893 61.96 931.589 61.976 931.333 62.008C931.088 62.04 930.896 62.0773 930.757 62.12V67.16C930.928 67.2773 931.168 67.4 931.477 67.528C931.797 67.6453 932.138 67.704 932.501 67.704ZM938.529 69V61.064C938.871 60.936 939.303 60.808 939.825 60.68C940.359 60.552 940.972 60.488 941.665 60.488C941.868 60.488 942.081 60.504 942.305 60.536C942.54 60.5573 942.764 60.5893 942.977 60.632C943.191 60.6747 943.356 60.7173 943.473 60.76L943.169 62.2C943.02 62.1467 942.807 62.0933 942.529 62.04C942.252 61.9867 941.927 61.96 941.553 61.96C941.255 61.96 940.983 61.9867 940.737 62.04C940.503 62.0827 940.337 62.12 940.241 62.152V69H938.529ZM948.33 69.208C947.562 69.208 946.879 69.0267 946.282 68.664C945.685 68.3013 945.215 67.7893 944.874 67.128C944.543 66.4667 944.378 65.6987 944.378 64.824C944.378 63.9387 944.549 63.1707 944.89 62.52C945.231 61.8693 945.701 61.3627 946.298 61C946.895 60.6373 947.573 60.456 948.33 60.456C949.109 60.456 949.791 60.6373 950.378 61C950.975 61.3627 951.439 61.8693 951.77 62.52C952.111 63.1707 952.282 63.9387 952.282 64.824C952.282 65.6987 952.117 66.4667 951.786 67.128C951.455 67.7893 950.997 68.3013 950.41 68.664C949.823 69.0267 949.13 69.208 948.33 69.208ZM948.33 67.72C948.789 67.72 949.178 67.6027 949.498 67.368C949.829 67.1227 950.079 66.7867 950.25 66.36C950.431 65.9227 950.522 65.4107 950.522 64.824C950.522 64.2373 950.431 63.7307 950.25 63.304C950.079 62.8667 949.829 62.5307 949.498 62.296C949.178 62.0613 948.789 61.944 948.33 61.944C947.882 61.944 947.493 62.0613 947.162 62.296C946.831 62.5307 946.575 62.8667 946.394 63.304C946.223 63.7307 946.138 64.2373 946.138 64.824C946.138 65.4107 946.223 65.9227 946.394 66.36C946.575 66.7867 946.831 67.1227 947.162 67.368C947.493 67.6027 947.882 67.72 948.33 67.72ZM956.345 69C956.078 68.4453 955.801 67.848 955.513 67.208C955.235 66.568 954.963 65.896 954.697 65.192C954.43 64.488 954.169 63.7573 953.913 63C953.667 62.2427 953.433 61.464 953.209 60.664H955.017C955.177 61.3147 955.374 62.0293 955.609 62.808C955.843 63.576 956.094 64.328 956.361 65.064C956.627 65.8 956.878 66.4507 957.113 67.016C957.294 66.6 957.481 66.1253 957.673 65.592C957.875 65.0587 958.067 64.5093 958.249 63.944C958.441 63.3787 958.617 62.8133 958.777 62.248C958.947 61.6827 959.097 61.1547 959.225 60.664H960.969C960.745 61.464 960.505 62.2427 960.249 63C960.003 63.7573 959.742 64.488 959.465 65.192C959.198 65.896 958.926 66.568 958.649 67.208C958.382 67.848 958.11 68.4453 957.833 69H956.345ZM962.451 69V60.664H964.163V69H962.451ZM963.315 58.952C963.016 58.952 962.755 58.8507 962.531 58.648C962.318 58.4453 962.211 58.1787 962.211 57.848C962.211 57.5067 962.318 57.24 962.531 57.048C962.755 56.8453 963.016 56.744 963.315 56.744C963.614 56.744 963.87 56.8453 964.083 57.048C964.307 57.24 964.419 57.5067 964.419 57.848C964.419 58.1787 964.307 58.4453 964.083 58.648C963.87 58.8507 963.614 58.952 963.315 58.952ZM970.43 69.192C969.566 69.192 968.82 69.0213 968.19 68.68C967.561 68.328 967.07 67.8267 966.718 67.176C966.377 66.5253 966.206 65.752 966.206 64.856C966.206 63.9813 966.356 63.2187 966.654 62.568C966.953 61.9067 967.38 61.3947 967.934 61.032C968.5 60.6693 969.177 60.488 969.966 60.488C970.393 60.488 970.772 60.5413 971.102 60.648C971.444 60.7547 971.726 60.872 971.95 61V56.872L973.646 56.584V68.744C973.412 68.808 973.124 68.8773 972.782 68.952C972.441 69.0267 972.073 69.0853 971.678 69.128C971.284 69.1707 970.868 69.192 970.43 69.192ZM970.446 67.72C970.809 67.72 971.113 67.704 971.358 67.672C971.614 67.6293 971.812 67.592 971.95 67.56V62.504C971.78 62.376 971.534 62.2533 971.214 62.136C970.905 62.0187 970.564 61.96 970.19 61.96C969.796 61.96 969.454 62.0293 969.166 62.168C968.889 62.296 968.66 62.488 968.478 62.744C968.297 63 968.164 63.304 968.078 63.656C968.004 63.9973 967.966 64.3813 967.966 64.808C967.966 65.4053 968.068 65.9227 968.27 66.36C968.473 66.7973 968.756 67.1333 969.118 67.368C969.492 67.6027 969.934 67.72 970.446 67.72ZM979.947 69.192C978.955 69.192 978.144 69.0053 977.515 68.632C976.896 68.248 976.437 67.7307 976.139 67.08C975.84 66.4293 975.691 65.688 975.691 64.856C975.691 63.8747 975.872 63.0587 976.235 62.408C976.608 61.7573 977.083 61.272 977.659 60.952C978.245 60.6213 978.864 60.456 979.515 60.456C980.251 60.456 980.885 60.6107 981.419 60.92C981.963 61.2187 982.379 61.6773 982.667 62.296C982.965 62.9147 983.115 63.6933 983.115 64.632C983.115 64.7387 983.109 64.856 983.099 64.984C983.099 65.112 983.093 65.2293 983.083 65.336H977.451C977.504 66.0827 977.749 66.664 978.187 67.08C978.624 67.496 979.269 67.704 980.123 67.704C980.624 67.704 981.061 67.6613 981.435 67.576C981.819 67.48 982.112 67.384 982.315 67.288L982.571 68.696C982.368 68.8027 982.021 68.9093 981.531 69.016C981.051 69.1333 980.523 69.192 979.947 69.192ZM977.483 64.072H981.435C981.424 63.6453 981.344 63.272 981.195 62.952C981.056 62.6213 980.848 62.3653 980.571 62.184C980.304 61.992 979.957 61.896 979.531 61.896C979.115 61.896 978.757 61.9973 978.459 62.2C978.171 62.4027 977.941 62.6693 977.771 63C977.611 63.3307 977.515 63.688 977.483 64.072ZM985.201 69V61.064C985.542 60.936 985.974 60.808 986.497 60.68C987.03 60.552 987.644 60.488 988.337 60.488C988.54 60.488 988.753 60.504 988.977 60.536C989.212 60.5573 989.436 60.5893 989.649 60.632C989.862 60.6747 990.028 60.7173 990.145 60.76L989.841 62.2C989.692 62.1467 989.478 62.0933 989.201 62.04C988.924 61.9867 988.598 61.96 988.225 61.96C987.926 61.96 987.654 61.9867 987.409 62.04C987.174 62.0827 987.009 62.12 986.913 62.152V69H985.201ZM993.624 69.208C992.888 69.208 992.301 69.144 991.864 69.016C991.427 68.888 991.128 68.792 990.968 68.728L991.304 67.288C991.539 67.384 991.848 67.4907 992.232 67.608C992.627 67.7253 993.091 67.784 993.624 67.784C994.147 67.784 994.552 67.7147 994.84 67.576C995.128 67.4267 995.272 67.176 995.272 66.824C995.272 66.6 995.208 66.4187 995.08 66.28C994.963 66.1307 994.776 65.992 994.52 65.864C994.275 65.736 993.944 65.592 993.528 65.432C993.08 65.2507 992.675 65.0587 992.312 64.856C991.949 64.6533 991.661 64.3973 991.448 64.088C991.245 63.768 991.144 63.3573 991.144 62.856C991.144 62.3653 991.267 61.944 991.512 61.592C991.757 61.2293 992.109 60.952 992.568 60.76C993.027 60.5573 993.576 60.456 994.216 60.456C994.749 60.456 995.224 60.504 995.64 60.6C996.067 60.6853 996.381 60.776 996.584 60.872L996.264 62.264C996.061 62.1787 995.8 62.0933 995.48 62.008C995.171 61.912 994.765 61.864 994.264 61.864C993.848 61.864 993.507 61.9387 993.24 62.088C992.973 62.2373 992.84 62.472 992.84 62.792C992.84 63.0053 992.893 63.1867 993 63.336C993.107 63.4747 993.277 63.608 993.512 63.736C993.747 63.8533 994.056 63.9813 994.44 64.12C995.005 64.344 995.475 64.568 995.848 64.792C996.221 65.0053 996.504 65.272 996.696 65.592C996.888 65.912 996.984 66.3173 996.984 66.808C996.984 67.3307 996.851 67.7733 996.584 68.136C996.317 68.488 995.933 68.7547 995.432 68.936C994.931 69.1173 994.328 69.208 993.624 69.208Z" fill="black"/>
+<path d="M62 349L57 346.113V351.887L62 349ZM62 125V124.5H48V125V125.5H62V125ZM40 133H39.5V341H40H40.5V133H40ZM48 349V349.5H57.5V349V348.5H48V349ZM40 341H39.5C39.5 345.694 43.3056 349.5 48 349.5V349V348.5C43.8579 348.5 40.5 345.142 40.5 341H40ZM48 125V124.5C43.3056 124.5 39.5 128.306 39.5 133H40H40.5C40.5 128.858 43.8579 125.5 48 125.5V125Z" fill="#666666"/>
+<path d="M62 349L57 346.113V351.887L62 349ZM62 197V196.5H48V197V197.5H62V197ZM40 205H39.5V341H40H40.5V205H40ZM48 349V349.5H57.5V349V348.5H48V349ZM40 341H39.5C39.5 345.694 43.3056 349.5 48 349.5V349V348.5C43.8579 348.5 40.5 345.142 40.5 341H40ZM48 197V196.5C43.3056 196.5 39.5 200.306 39.5 205H40H40.5C40.5 200.858 43.8579 197.5 48 197.5V197Z" fill="#666666"/>
+<path d="M62 349L57 346.113V351.887L62 349ZM62 274V273.5H48V274V274.5H62V274ZM40 282H39.5V341H40H40.5V282H40ZM48 349V349.5H57.5V349V348.5H48V349ZM40 341H39.5C39.5 345.694 43.3056 349.5 48 349.5V349V348.5C43.8579 348.5 40.5 345.142 40.5 341H40ZM48 274V273.5C43.3056 273.5 39.5 277.306 39.5 282H40H40.5C40.5 277.858 43.8579 274.5 48 274.5V274Z" fill="#666666"/>
+<path d="M665 349L660 351.887V346.113L665 349ZM649.021 340.979L648.521 340.977L649.021 340.979ZM660.5 349V349.5H657.021V349V348.5H660.5V349ZM649.021 340.979L648.521 340.977L649.014 157.02L649.514 157.021L650.014 157.023L649.521 340.98L649.021 340.979ZM641.514 149V149.5H607.536V149V148.5H641.514V149ZM649.514 157.021L649.014 157.02C649.026 152.87 645.664 149.5 641.514 149.5V149V148.5C646.218 148.5 650.027 152.319 650.014 157.023L649.514 157.021ZM657.021 349V349.5C652.318 349.5 648.509 345.681 648.521 340.977L649.021 340.979L649.521 340.98C649.51 345.13 652.871 348.5 657.021 348.5V349Z" fill="#666666"/>
+<path d="M665 249L660 251.887L660 246.113L665 249ZM660.5 249L660.5 249.5L657.277 249.5L657.277 249L657.277 248.5L660.5 248.5L660.5 249ZM649.277 240.957L648.777 240.955L649.223 157.04L649.723 157.043L650.223 157.045L649.777 240.96L649.277 240.957ZM641.723 149L641.723 149.5L608 149.5L608 149L608 148.5L641.723 148.5V149ZM649.723 157.043L649.223 157.04C649.245 152.882 645.881 149.5 641.723 149.5L641.723 149V148.5C646.435 148.5 650.248 152.333 650.223 157.045L649.723 157.043ZM657.277 249L657.277 249.5C652.565 249.5 648.752 245.667 648.777 240.955L649.277 240.957L649.777 240.96C649.755 245.118 653.119 248.5 657.277 248.5L657.277 249Z" fill="#666666"/>
+<path d="M665 149L660 151.887V146.113L665 149ZM660.5 149V149.5H649.234V149V148.5H660.5V149ZM649.234 149V148.5H649.766V149V149.5H649.234V149ZM649.766 149V149.5H608V149V148.5H649.766V149Z" fill="#666666"/>
+<path d="M263 149L258 151.887V146.113L263 149ZM206 122V121.5H239V122V122.5H206V122ZM247 130H247.5L247.5 141H247H246.5L246.5 130L247 130ZM255 149V148.5H258.5V149V149.5H255V149ZM247 141H247.5C247.5 145.142 250.858 148.5 255 148.5V149V149.5C250.306 149.5 246.5 145.694 246.5 141H247ZM239 122V121.5C243.694 121.5 247.5 125.306 247.5 130H247L246.5 130C246.5 125.858 243.142 122.5 239 122.5V122Z" fill="#666666"/>
+<path d="M263 149L258 151.887V146.113L263 149ZM247 157H247.5H247ZM206 274V273.5H239V274V274.5H206V274ZM247 266H246.5L246.5 157L247 157H247.5L247.5 266H247ZM255 149V148.5H258.5V149V149.5H255V149ZM247 157L246.5 157C246.5 152.305 250.306 148.5 255 148.5V149V149.5C250.858 149.5 247.5 152.858 247.5 157H247ZM239 274V273.5C243.142 273.5 246.5 270.142 246.5 266H247H247.5C247.5 270.694 243.694 274.5 239 274.5V274Z" fill="#666666"/>
+<path d="M263 149L258 151.887V146.113L263 149ZM247 157H247.5H247ZM247 185.718H247.5H247ZM206 193.718V193.218H239V193.718V194.218H206V193.718ZM247 185.718H246.5L246.5 157H247H247.5L247.5 185.718H247ZM255 149V148.5H258.5V149V149.5H255V149ZM247 157H246.5C246.5 152.305 250.306 148.5 255 148.5V149V149.5C250.858 149.5 247.5 152.858 247.5 157H247ZM239 193.718V193.218C243.142 193.218 246.5 189.861 246.5 185.718H247H247.5C247.5 190.413 243.694 194.218 239 194.218V193.718Z" fill="#666666"/>
+<path d="M464 149L459 151.887V146.113L464 149ZM446 157L446.5 157L446 157ZM401 349V348.5H438V349V349.5H401V349ZM446 341H445.5L445.5 157H446L446.5 157L446.5 341H446ZM454 149V148.5H459.5V149V149.5H454V149ZM446 157H445.5C445.5 152.306 449.306 148.5 454 148.5V149V149.5C449.858 149.5 446.5 152.858 446.5 157L446 157ZM438 349V348.5C442.142 348.5 445.5 345.142 445.5 341H446H446.5C446.5 345.694 442.694 349.5 438 349.5V349Z" fill="#666666"/>
+<rect width="144" height="67" transform="translate(62 103)" fill="#F3F3F3"/>
+<path d="M76.096 128.224C75.1147 128.224 74.2347 128 73.456 127.552C72.688 127.104 72.08 126.453 71.632 125.6C71.1947 124.736 70.976 123.685 70.976 122.448C70.976 121.211 71.2107 120.165 71.68 119.312C72.16 118.448 72.7947 117.792 73.584 117.344C74.384 116.896 75.264 116.672 76.224 116.672C76.7893 116.672 77.2853 116.715 77.712 116.8C78.1387 116.885 78.5013 116.987 78.8 117.104C79.0987 117.221 79.3227 117.333 79.472 117.44L79.072 118.496C78.7733 118.283 78.368 118.112 77.856 117.984C77.3547 117.845 76.8107 117.776 76.224 117.776C75.4773 117.776 74.8053 117.952 74.208 118.304C73.6213 118.656 73.152 119.179 72.8 119.872C72.4587 120.565 72.288 121.424 72.288 122.448C72.288 123.397 72.4373 124.224 72.736 124.928C73.0347 125.632 73.4773 126.176 74.064 126.56C74.6613 126.944 75.3973 127.136 76.272 127.136C76.784 127.136 77.2107 127.109 77.552 127.056C77.904 126.992 78.144 126.939 78.272 126.896V122.688H79.52V127.696C79.3173 127.781 78.912 127.888 78.304 128.016C77.7067 128.155 76.9707 128.224 76.096 128.224ZM84.8014 128.096C84.3534 128.096 83.8787 128.075 83.3774 128.032C82.876 127.989 82.428 127.915 82.0334 127.808V117.12C82.428 117.013 82.876 116.939 83.3774 116.896C83.8894 116.843 84.3694 116.816 84.8174 116.816C86.0227 116.816 87.084 117.024 88.0014 117.44C88.9187 117.845 89.6334 118.464 90.1454 119.296C90.668 120.128 90.9294 121.179 90.9294 122.448C90.9294 123.707 90.668 124.757 90.1454 125.6C89.6334 126.432 88.9187 127.056 88.0014 127.472C87.084 127.888 86.0174 128.096 84.8014 128.096ZM84.9294 127.024C86.4867 127.024 87.6547 126.619 88.4334 125.808C89.2227 124.987 89.6174 123.867 89.6174 122.448C89.6174 121.029 89.228 119.915 88.4494 119.104C87.6707 118.293 86.5027 117.888 84.9454 117.888C84.4227 117.888 84.0334 117.904 83.7774 117.936C83.5214 117.968 83.356 117.989 83.2814 118V126.912C83.356 126.923 83.516 126.944 83.7614 126.976C84.0067 127.008 84.396 127.024 84.9294 127.024ZM93.0583 128C93.1009 127.019 93.1489 126.043 93.2023 125.072C93.2556 124.101 93.3143 123.152 93.3783 122.224C93.4423 121.285 93.5116 120.373 93.5863 119.488C93.6609 118.592 93.7463 117.733 93.8423 116.912H94.9623C95.2716 117.424 95.5969 118.021 95.9383 118.704C96.2903 119.376 96.6423 120.085 96.9943 120.832C97.3463 121.568 97.6823 122.293 98.0023 123.008C98.3329 123.723 98.6263 124.368 98.8823 124.944C99.1383 124.368 99.4263 123.723 99.7463 123.008C100.077 122.293 100.418 121.568 100.77 120.832C101.122 120.085 101.474 119.376 101.826 118.704C102.178 118.021 102.504 117.424 102.802 116.912H103.858C103.954 117.733 104.04 118.592 104.114 119.488C104.2 120.373 104.269 121.285 104.322 122.224C104.386 123.152 104.445 124.101 104.498 125.072C104.562 126.043 104.616 127.019 104.658 128H103.41C103.368 126.912 103.32 125.845 103.266 124.8C103.224 123.744 103.17 122.725 103.106 121.744C103.042 120.763 102.968 119.835 102.882 118.96C102.776 119.163 102.605 119.499 102.37 119.968C102.146 120.427 101.89 120.96 101.602 121.568C101.314 122.165 101.021 122.779 100.722 123.408C100.434 124.037 100.168 124.619 99.9223 125.152C99.6876 125.685 99.5063 126.107 99.3783 126.416H98.3063C98.1783 126.107 97.9916 125.685 97.7463 125.152C97.5116 124.619 97.2449 124.037 96.9463 123.408C96.6583 122.779 96.3703 122.165 96.0823 121.568C95.7943 120.96 95.5329 120.427 95.2983 119.968C95.0743 119.499 94.9089 119.163 94.8023 118.96C94.7169 119.835 94.6423 120.763 94.5783 121.744C94.5143 122.725 94.4556 123.744 94.4023 124.8C94.3596 125.845 94.3169 126.912 94.2743 128H93.0583Z" fill="black"/>
+<rect width="144" height="67" transform="translate(62 178)" fill="#F3F3F3"/>
+<path d="M73.584 203.144C73.072 203.123 72.6453 203.037 72.304 202.888C71.9733 202.739 71.728 202.509 71.568 202.2C71.408 201.88 71.328 201.453 71.328 200.92V190.792L72.528 190.584V200.84C72.528 201.352 72.6187 201.683 72.8 201.832C72.992 201.981 73.312 202.088 73.76 202.152L73.584 203.144ZM78.8595 203.192C78.1235 203.192 77.4675 203.016 76.8915 202.664C76.3155 202.301 75.8622 201.795 75.5315 201.144C75.2115 200.493 75.0515 199.731 75.0515 198.856C75.0515 197.981 75.2115 197.224 75.5315 196.584C75.8622 195.933 76.3155 195.427 76.8915 195.064C77.4675 194.701 78.1235 194.52 78.8595 194.52C79.6062 194.52 80.2675 194.701 80.8435 195.064C81.4195 195.427 81.8675 195.933 82.1875 196.584C82.5182 197.224 82.6835 197.981 82.6835 198.856C82.6835 199.731 82.5182 200.493 82.1875 201.144C81.8675 201.795 81.4195 202.301 80.8435 202.664C80.2782 203.016 79.6168 203.192 78.8595 203.192ZM78.8595 202.12C79.3928 202.12 79.8515 201.987 80.2355 201.72C80.6195 201.453 80.9128 201.075 81.1155 200.584C81.3288 200.093 81.4355 199.517 81.4355 198.856C81.4355 198.195 81.3288 197.619 81.1155 197.128C80.9128 196.637 80.6195 196.259 80.2355 195.992C79.8515 195.725 79.3928 195.592 78.8595 195.592C78.3368 195.592 77.8835 195.725 77.4995 195.992C77.1155 196.259 76.8168 196.637 76.6035 197.128C76.4008 197.619 76.2995 198.195 76.2995 198.856C76.2995 199.517 76.4008 200.093 76.6035 200.584C76.8168 201.075 77.1155 201.453 77.4995 201.72C77.8835 201.987 78.3368 202.12 78.8595 202.12ZM87.4989 206.008C86.9762 206.008 86.4909 205.965 86.0429 205.88C85.5949 205.795 85.2109 205.699 84.8909 205.592L85.1309 204.536C85.3975 204.643 85.7495 204.739 86.1869 204.824C86.6242 204.92 87.0722 204.968 87.5309 204.968C88.1709 204.968 88.6882 204.888 89.0829 204.728C89.4775 204.568 89.7655 204.312 89.9469 203.96C90.1389 203.608 90.2349 203.144 90.2349 202.568V202.04C90.0855 202.147 89.8295 202.28 89.4669 202.44C89.1042 202.589 88.6402 202.664 88.0749 202.664C87.4242 202.664 86.8162 202.531 86.2509 202.264C85.6962 201.987 85.2482 201.555 84.9069 200.968C84.5762 200.381 84.4109 199.613 84.4109 198.664C84.4109 197.875 84.5655 197.171 84.8749 196.552C85.1949 195.933 85.6482 195.448 86.2349 195.096C86.8322 194.733 87.5415 194.552 88.3629 194.552C89.1095 194.552 89.7229 194.605 90.2029 194.712C90.6935 194.808 91.0935 194.904 91.4029 195V202.504C91.4029 203.752 91.0775 204.648 90.4269 205.192C89.7869 205.736 88.8109 206.008 87.4989 206.008ZM88.1229 201.608C88.5602 201.608 88.9655 201.544 89.3389 201.416C89.7229 201.288 90.0162 201.139 90.2189 200.968V195.816C90.0482 195.763 89.8242 195.715 89.5469 195.672C89.2695 195.629 88.8802 195.608 88.3789 195.608C87.8029 195.608 87.3122 195.736 86.9069 195.992C86.5015 196.248 86.1922 196.611 85.9789 197.08C85.7655 197.539 85.6589 198.072 85.6589 198.68C85.6589 199.203 85.7282 199.651 85.8669 200.024C86.0055 200.397 86.1922 200.701 86.4269 200.936C86.6615 201.171 86.9229 201.341 87.2109 201.448C87.5095 201.555 87.8135 201.608 88.1229 201.608ZM94.094 203V194.712H95.294V203H94.094ZM94.702 192.728C94.4673 192.728 94.2647 192.648 94.094 192.488C93.934 192.328 93.854 192.115 93.854 191.848C93.854 191.592 93.934 191.384 94.094 191.224C94.2647 191.064 94.4673 190.984 94.702 190.984C94.9367 190.984 95.134 191.064 95.294 191.224C95.4647 191.384 95.55 191.592 95.55 191.848C95.55 192.115 95.4647 192.328 95.294 192.488C95.134 192.648 94.9367 192.728 94.702 192.728ZM97.9846 203V195C98.3153 194.915 98.7473 194.819 99.2806 194.712C99.814 194.605 100.454 194.552 101.201 194.552C102.065 194.552 102.737 194.712 103.217 195.032C103.697 195.352 104.033 195.8 104.225 196.376C104.427 196.941 104.529 197.603 104.529 198.36V203H103.329V198.696C103.329 197.939 103.259 197.336 103.121 196.888C102.982 196.44 102.747 196.115 102.417 195.912C102.086 195.709 101.627 195.608 101.041 195.608C100.593 195.608 100.198 195.635 99.8566 195.688C99.5153 195.741 99.2913 195.784 99.1846 195.816V203H97.9846Z" fill="black"/>
+<rect width="144" height="67" transform="translate(62 253)" fill="#F3F3F3"/>
+<path d="M73.12 278.192C72.4053 278.192 71.8453 278.128 71.44 278C71.0453 277.883 70.7787 277.792 70.64 277.728L70.928 276.672C71.0453 276.715 71.2853 276.805 71.648 276.944C72.0107 277.083 72.5013 277.152 73.12 277.152C73.7067 277.152 74.1813 277.061 74.544 276.88C74.9067 276.699 75.088 276.384 75.088 275.936C75.088 275.648 75.024 275.419 74.896 275.248C74.768 275.067 74.56 274.901 74.272 274.752C73.9947 274.603 73.6107 274.432 73.12 274.24C72.704 274.069 72.32 273.888 71.968 273.696C71.616 273.504 71.328 273.259 71.104 272.96C70.8907 272.661 70.784 272.277 70.784 271.808C70.784 271.349 70.9013 270.949 71.136 270.608C71.3707 270.267 71.7013 270 72.128 269.808C72.5653 269.616 73.0827 269.52 73.68 269.52C74.2347 269.52 74.704 269.568 75.088 269.664C75.472 269.76 75.744 269.845 75.904 269.92L75.632 270.96C75.4933 270.885 75.2693 270.8 74.96 270.704C74.6507 270.597 74.2133 270.544 73.648 270.544C73.2 270.544 72.8107 270.64 72.48 270.832C72.1493 271.013 71.984 271.307 71.984 271.712C71.984 272 72.0533 272.235 72.192 272.416C72.3307 272.587 72.5387 272.741 72.816 272.88C73.0933 273.019 73.4347 273.168 73.84 273.328C74.2987 273.509 74.7093 273.701 75.072 273.904C75.4453 274.096 75.744 274.347 75.968 274.656C76.192 274.965 76.304 275.376 76.304 275.888C76.304 276.389 76.176 276.816 75.92 277.168C75.664 277.509 75.296 277.765 74.816 277.936C74.3467 278.107 73.7813 278.192 73.12 278.192ZM80.0575 278.192C79.3428 278.192 78.7828 278.128 78.3775 278C77.9828 277.883 77.7162 277.792 77.5775 277.728L77.8655 276.672C77.9828 276.715 78.2228 276.805 78.5855 276.944C78.9482 277.083 79.4388 277.152 80.0575 277.152C80.6442 277.152 81.1188 277.061 81.4815 276.88C81.8442 276.699 82.0255 276.384 82.0255 275.936C82.0255 275.648 81.9615 275.419 81.8335 275.248C81.7055 275.067 81.4975 274.901 81.2095 274.752C80.9322 274.603 80.5482 274.432 80.0575 274.24C79.6415 274.069 79.2575 273.888 78.9055 273.696C78.5535 273.504 78.2655 273.259 78.0415 272.96C77.8282 272.661 77.7215 272.277 77.7215 271.808C77.7215 271.349 77.8388 270.949 78.0735 270.608C78.3082 270.267 78.6388 270 79.0655 269.808C79.5028 269.616 80.0202 269.52 80.6175 269.52C81.1722 269.52 81.6415 269.568 82.0255 269.664C82.4095 269.76 82.6815 269.845 82.8415 269.92L82.5695 270.96C82.4308 270.885 82.2068 270.8 81.8975 270.704C81.5882 270.597 81.1508 270.544 80.5855 270.544C80.1375 270.544 79.7482 270.64 79.4175 270.832C79.0868 271.013 78.9215 271.307 78.9215 271.712C78.9215 272 78.9908 272.235 79.1295 272.416C79.2682 272.587 79.4762 272.741 79.7535 272.88C80.0308 273.019 80.3722 273.168 80.7775 273.328C81.2362 273.509 81.6468 273.701 82.0095 273.904C82.3828 274.096 82.6815 274.347 82.9055 274.656C83.1295 274.965 83.2415 275.376 83.2415 275.888C83.2415 276.389 83.1135 276.816 82.8575 277.168C82.6015 277.509 82.2335 277.765 81.7535 277.936C81.2842 278.107 80.7188 278.192 80.0575 278.192ZM85.219 278V265.792L86.419 265.584V269.92C86.7283 269.803 87.0537 269.712 87.395 269.648C87.747 269.584 88.0883 269.552 88.419 269.552C89.2937 269.552 89.971 269.712 90.451 270.032C90.931 270.352 91.267 270.8 91.459 271.376C91.6617 271.941 91.763 272.603 91.763 273.36V278H90.563V273.696C90.563 272.939 90.4937 272.336 90.355 271.888C90.2163 271.44 89.9817 271.115 89.651 270.912C89.3203 270.709 88.8563 270.608 88.259 270.608C88.035 270.608 87.7897 270.635 87.523 270.688C87.267 270.731 87.0377 270.779 86.835 270.832C86.6323 270.885 86.4937 270.928 86.419 270.96V278H85.219ZM97.9756 278.192C97.165 278.192 96.4503 278.021 95.8316 277.68C95.213 277.328 94.733 276.832 94.3916 276.192C94.0503 275.541 93.8796 274.768 93.8796 273.872C93.8796 273.019 94.0236 272.267 94.3116 271.616C94.6103 270.965 95.037 270.459 95.5916 270.096C96.157 269.723 96.8343 269.536 97.6236 269.536C98.1356 269.536 98.5836 269.611 98.9676 269.76C99.3623 269.899 99.6556 270.037 99.8476 270.176V265.792L101.032 265.584V277.744C100.829 277.808 100.578 277.877 100.28 277.952C99.981 278.016 99.6396 278.069 99.2556 278.112C98.8823 278.165 98.4556 278.192 97.9756 278.192ZM97.9916 277.12C98.461 277.12 98.845 277.099 99.1436 277.056C99.453 277.003 99.6876 276.955 99.8476 276.912V271.296C99.6663 271.147 99.389 270.997 99.0156 270.848C98.6423 270.688 98.221 270.608 97.7516 270.608C97.2716 270.608 96.861 270.693 96.5196 270.864C96.189 271.024 95.917 271.253 95.7036 271.552C95.501 271.851 95.3516 272.197 95.2556 272.592C95.1703 272.987 95.1276 273.408 95.1276 273.856C95.1276 274.549 95.245 275.141 95.4796 275.632C95.725 276.112 96.061 276.48 96.4876 276.736C96.925 276.992 97.4263 277.12 97.9916 277.12Z" fill="black"/>
+<rect width="144" height="67" transform="translate(62 328)" fill="#F3F3F3"/>
+<path d="M73.584 353.144C73.072 353.123 72.6453 353.037 72.304 352.888C71.9733 352.739 71.728 352.509 71.568 352.2C71.408 351.88 71.328 351.453 71.328 350.92V340.792L72.528 340.584V350.84C72.528 351.352 72.6187 351.683 72.8 351.832C72.992 351.981 73.312 352.088 73.76 352.152L73.584 353.144ZM75.5315 353V344.712H76.7315V353H75.5315ZM76.1395 342.728C75.9048 342.728 75.7022 342.648 75.5315 342.488C75.3715 342.328 75.2915 342.115 75.2915 341.848C75.2915 341.592 75.3715 341.384 75.5315 341.224C75.7022 341.064 75.9048 340.984 76.1395 340.984C76.3742 340.984 76.5715 341.064 76.7315 341.224C76.9022 341.384 76.9875 341.592 76.9875 341.848C76.9875 342.115 76.9022 342.328 76.7315 342.488C76.5715 342.648 76.3742 342.728 76.1395 342.728ZM82.4781 353.192C82.0088 353.192 81.5821 353.165 81.1981 353.112C80.8141 353.069 80.4728 353.016 80.1741 352.952C79.8861 352.877 79.6355 352.808 79.4221 352.744V340.792L80.6221 340.584V345.176C80.8141 345.037 81.1021 344.899 81.4861 344.76C81.8808 344.611 82.3341 344.536 82.8461 344.536C83.6461 344.536 84.3235 344.723 84.8781 345.096C85.4328 345.459 85.8541 345.965 86.1421 346.616C86.4408 347.267 86.5901 348.013 86.5901 348.856C86.5901 349.752 86.4195 350.525 86.0781 351.176C85.7368 351.816 85.2568 352.312 84.6381 352.664C84.0195 353.016 83.2995 353.192 82.4781 353.192ZM82.4621 352.12C83.0381 352.12 83.5395 351.992 83.9661 351.736C84.4035 351.48 84.7395 351.112 84.9741 350.632C85.2088 350.141 85.3261 349.549 85.3261 348.856C85.3261 348.408 85.2781 347.987 85.1821 347.592C85.0968 347.197 84.9475 346.851 84.7341 346.552C84.5315 346.253 84.2595 346.024 83.9181 345.864C83.5875 345.693 83.1821 345.608 82.7021 345.608C82.2435 345.608 81.8275 345.688 81.4541 345.848C81.0808 345.997 80.8035 346.147 80.6221 346.296V351.912C80.7715 351.955 80.9955 352.003 81.2941 352.056C81.6035 352.099 81.9928 352.12 82.4621 352.12ZM92.2695 353.176C91.3948 353.176 90.6642 353 90.0775 352.648C89.4908 352.285 89.0482 351.779 88.7495 351.128C88.4508 350.477 88.3015 349.725 88.3015 348.872C88.3015 348.008 88.4562 347.251 88.7655 346.6C89.0748 345.949 89.5175 345.443 90.0935 345.08C90.6802 344.707 91.3735 344.52 92.1735 344.52C92.6108 344.52 93.0268 344.557 93.4215 344.632C93.8162 344.707 94.1255 344.803 94.3495 344.92L94.0455 345.928C93.8322 345.832 93.5922 345.752 93.3255 345.688C93.0588 345.624 92.7068 345.592 92.2695 345.592C91.3842 345.592 90.7068 345.88 90.2375 346.456C89.7788 347.032 89.5495 347.837 89.5495 348.872C89.5495 349.512 89.6455 350.077 89.8375 350.568C90.0295 351.048 90.3388 351.427 90.7655 351.704C91.1922 351.971 91.7575 352.104 92.4615 352.104C92.8775 352.104 93.2402 352.056 93.5495 351.96C93.8695 351.864 94.1042 351.779 94.2535 351.704L94.4935 352.728C94.2908 352.835 93.9815 352.936 93.5655 353.032C93.1495 353.128 92.7175 353.176 92.2695 353.176Z" fill="black"/>
+<path d="M102.073 355.59C101.597 354.993 101.177 354.339 100.813 353.63C100.459 352.93 100.179 352.174 99.9733 351.362C99.7773 350.55 99.6793 349.701 99.6793 348.814C99.6793 347.918 99.7773 347.069 99.9733 346.266C100.179 345.454 100.459 344.693 100.813 343.984C101.177 343.275 101.597 342.626 102.073 342.038L102.829 342.542C102.353 343.139 101.961 343.765 101.653 344.418C101.345 345.071 101.112 345.762 100.953 346.49C100.804 347.218 100.729 347.993 100.729 348.814C100.729 350.046 100.902 351.175 101.247 352.202C101.593 353.229 102.12 354.19 102.829 355.086L102.073 355.59ZM106.364 355.632C105.907 355.632 105.482 355.595 105.09 355.52C104.698 355.445 104.362 355.361 104.082 355.268L104.292 354.344C104.526 354.437 104.834 354.521 105.216 354.596C105.599 354.68 105.991 354.722 106.392 354.722C106.952 354.722 107.405 354.652 107.75 354.512C108.096 354.372 108.348 354.148 108.506 353.84C108.674 353.532 108.758 353.126 108.758 352.622V352.16C108.628 352.253 108.404 352.37 108.086 352.51C107.769 352.641 107.363 352.706 106.868 352.706C106.299 352.706 105.767 352.589 105.272 352.356C104.787 352.113 104.395 351.735 104.096 351.222C103.807 350.709 103.662 350.037 103.662 349.206C103.662 348.515 103.798 347.899 104.068 347.358C104.348 346.817 104.745 346.392 105.258 346.084C105.781 345.767 106.402 345.608 107.12 345.608C107.774 345.608 108.31 345.655 108.73 345.748C109.16 345.832 109.51 345.916 109.78 346V352.566C109.78 353.658 109.496 354.442 108.926 354.918C108.366 355.394 107.512 355.632 106.364 355.632ZM106.91 351.782C107.293 351.782 107.648 351.726 107.974 351.614C108.31 351.502 108.567 351.371 108.744 351.222V346.714C108.595 346.667 108.399 346.625 108.156 346.588C107.914 346.551 107.573 346.532 107.134 346.532C106.63 346.532 106.201 346.644 105.846 346.868C105.492 347.092 105.221 347.409 105.034 347.82C104.848 348.221 104.754 348.688 104.754 349.22C104.754 349.677 104.815 350.069 104.936 350.396C105.058 350.723 105.221 350.989 105.426 351.194C105.632 351.399 105.86 351.549 106.112 351.642C106.374 351.735 106.64 351.782 106.91 351.782ZM115.313 353.154C114.464 353.154 113.773 352.991 113.241 352.664C112.718 352.337 112.331 351.889 112.079 351.32C111.836 350.751 111.715 350.102 111.715 349.374C111.715 348.525 111.869 347.82 112.177 347.26C112.485 346.7 112.882 346.28 113.367 346C113.862 345.72 114.38 345.58 114.921 345.58C115.528 345.58 116.05 345.711 116.489 345.972C116.937 346.224 117.282 346.616 117.525 347.148C117.768 347.671 117.889 348.338 117.889 349.15C117.889 349.215 117.884 349.295 117.875 349.388C117.875 349.472 117.87 349.551 117.861 349.626H112.807C112.844 350.447 113.064 351.087 113.465 351.544C113.876 351.992 114.51 352.216 115.369 352.216C115.845 352.216 116.232 352.174 116.531 352.09C116.839 351.997 117.058 351.917 117.189 351.852L117.371 352.734C117.24 352.809 116.984 352.897 116.601 353C116.228 353.103 115.798 353.154 115.313 353.154ZM112.835 348.772H116.825C116.816 348.296 116.736 347.89 116.587 347.554C116.438 347.209 116.223 346.947 115.943 346.77C115.672 346.583 115.336 346.49 114.935 346.49C114.524 346.49 114.165 346.597 113.857 346.812C113.549 347.027 113.306 347.307 113.129 347.652C112.961 347.997 112.863 348.371 112.835 348.772ZM122.226 353.154C121.61 353.154 121.124 353.047 120.77 352.832C120.415 352.617 120.163 352.295 120.014 351.866C119.874 351.437 119.804 350.9 119.804 350.256V343.648L120.854 343.466V345.748H123.696V346.63H120.854V350.34C120.854 350.853 120.91 351.245 121.022 351.516C121.143 351.787 121.311 351.973 121.526 352.076C121.75 352.169 122.011 352.216 122.31 352.216C122.664 352.216 122.958 352.174 123.192 352.09C123.434 352.006 123.626 351.931 123.766 351.866L123.99 352.72C123.85 352.804 123.616 352.897 123.29 353C122.972 353.103 122.618 353.154 122.226 353.154ZM126.322 348.604L125.454 347.974C125.65 347.722 125.832 347.503 126 347.316C126.168 347.129 126.34 346.947 126.518 346.77C126.704 346.583 126.91 346.387 127.134 346.182C126.91 346.154 126.7 346.126 126.504 346.098C126.308 346.07 126.116 346.042 125.93 346.014C125.743 345.986 125.552 345.949 125.356 345.902C125.16 345.846 124.95 345.785 124.726 345.72L125.048 344.712C125.346 344.805 125.612 344.903 125.846 345.006C126.079 345.109 126.308 345.221 126.532 345.342C126.756 345.454 127.003 345.58 127.274 345.72C127.218 345.403 127.171 345.141 127.134 344.936C127.096 344.731 127.068 344.549 127.05 344.39C127.031 344.231 127.017 344.068 127.008 343.9C126.998 343.732 126.989 343.531 126.98 343.298H128.03C128.02 343.606 128.006 343.863 127.988 344.068C127.978 344.273 127.955 344.497 127.918 344.74C127.89 344.973 127.834 345.3 127.75 345.72C128.011 345.58 128.254 345.454 128.478 345.342C128.702 345.23 128.93 345.123 129.164 345.02C129.406 344.908 129.672 344.805 129.962 344.712L130.284 345.72C130.06 345.785 129.85 345.846 129.654 345.902C129.458 345.949 129.266 345.986 129.08 346.014C128.902 346.042 128.716 346.07 128.52 346.098C128.324 346.126 128.114 346.154 127.89 346.182C128.114 346.387 128.314 346.583 128.492 346.77C128.669 346.947 128.842 347.129 129.01 347.316C129.187 347.503 129.369 347.722 129.556 347.974L128.688 348.604C128.51 348.352 128.356 348.114 128.226 347.89C128.095 347.666 127.974 347.437 127.862 347.204C127.759 346.971 127.642 346.723 127.512 346.462C127.381 346.723 127.26 346.971 127.148 347.204C127.036 347.437 126.914 347.666 126.784 347.89C126.653 348.114 126.499 348.352 126.322 348.604ZM132 353V346C132.29 345.925 132.668 345.841 133.134 345.748C133.601 345.655 134.161 345.608 134.814 345.608C135.57 345.608 136.158 345.748 136.578 346.028C136.998 346.308 137.292 346.7 137.46 347.204C137.638 347.699 137.726 348.277 137.726 348.94V353H136.676V349.234C136.676 348.571 136.616 348.044 136.494 347.652C136.373 347.26 136.168 346.975 135.878 346.798C135.589 346.621 135.188 346.532 134.674 346.532C134.282 346.532 133.937 346.555 133.638 346.602C133.34 346.649 133.144 346.686 133.05 346.714V353H132ZM142.196 353.154C141.674 353.154 141.207 353.079 140.796 352.93C140.386 352.781 140.064 352.538 139.83 352.202C139.597 351.866 139.48 351.423 139.48 350.872C139.48 350.34 139.611 349.911 139.872 349.584C140.134 349.248 140.493 349.005 140.95 348.856C141.417 348.707 141.94 348.632 142.518 348.632C142.78 348.632 143.055 348.655 143.344 348.702C143.634 348.749 143.816 348.791 143.89 348.828V348.408C143.89 348.091 143.848 347.787 143.764 347.498C143.69 347.199 143.531 346.957 143.288 346.77C143.046 346.583 142.677 346.49 142.182 346.49C141.669 346.49 141.277 346.527 141.006 346.602C140.736 346.677 140.535 346.737 140.404 346.784L140.264 345.888C140.432 345.813 140.689 345.743 141.034 345.678C141.38 345.613 141.786 345.58 142.252 345.58C142.915 345.58 143.438 345.697 143.82 345.93C144.212 346.163 144.492 346.485 144.66 346.896C144.838 347.297 144.926 347.759 144.926 348.282V352.832C144.73 352.879 144.38 352.944 143.876 353.028C143.372 353.112 142.812 353.154 142.196 353.154ZM142.35 352.258C142.677 352.258 142.971 352.249 143.232 352.23C143.494 352.202 143.713 352.169 143.89 352.132V349.696C143.797 349.649 143.638 349.603 143.414 349.556C143.19 349.509 142.901 349.486 142.546 349.486C142.248 349.486 141.944 349.519 141.636 349.584C141.328 349.649 141.067 349.78 140.852 349.976C140.647 350.172 140.544 350.466 140.544 350.858C140.544 351.381 140.708 351.745 141.034 351.95C141.361 352.155 141.8 352.258 142.35 352.258ZM147.19 353V346C147.479 345.925 147.848 345.841 148.296 345.748C148.744 345.655 149.299 345.608 149.962 345.608C150.428 345.608 150.825 345.673 151.152 345.804C151.488 345.935 151.758 346.131 151.964 346.392C152.048 346.327 152.197 346.233 152.412 346.112C152.626 345.981 152.897 345.865 153.224 345.762C153.56 345.659 153.938 345.608 154.358 345.608C155.104 345.608 155.664 345.753 156.038 346.042C156.42 346.322 156.677 346.714 156.808 347.218C156.938 347.713 157.004 348.287 157.004 348.94V353H155.954V349.234C155.954 348.618 155.912 348.114 155.828 347.722C155.744 347.321 155.58 347.022 155.338 346.826C155.095 346.63 154.736 346.532 154.26 346.532C153.914 346.532 153.611 346.574 153.35 346.658C153.098 346.733 152.888 346.821 152.72 346.924C152.561 347.027 152.444 347.106 152.37 347.162C152.454 347.395 152.514 347.661 152.552 347.96C152.598 348.259 152.622 348.571 152.622 348.898V353H151.572V349.234C151.572 348.618 151.53 348.114 151.446 347.722C151.362 347.321 151.194 347.022 150.942 346.826C150.699 346.63 150.33 346.532 149.836 346.532C149.565 346.532 149.318 346.546 149.094 346.574C148.879 346.593 148.697 346.616 148.548 346.644C148.408 346.672 148.305 346.695 148.24 346.714V353H147.19ZM159.486 355.59V342.038H160.48V355.59H159.486ZM165.863 353.14C165.135 353.14 164.557 353.005 164.127 352.734C163.707 352.454 163.404 352.062 163.217 351.558C163.04 351.054 162.951 350.471 162.951 349.808V345.748H164.001V349.528C164.001 350.181 164.067 350.704 164.197 351.096C164.328 351.488 164.538 351.773 164.827 351.95C165.126 352.118 165.518 352.202 166.003 352.202C166.395 352.202 166.741 352.183 167.039 352.146C167.347 352.099 167.548 352.062 167.641 352.034V345.748H168.677V352.748C168.397 352.823 168.019 352.907 167.543 353C167.077 353.093 166.517 353.14 165.863 353.14ZM171.033 353V345.748H172.083V353H171.033ZM171.565 344.012C171.36 344.012 171.183 343.942 171.033 343.802C170.893 343.662 170.823 343.475 170.823 343.242C170.823 343.018 170.893 342.836 171.033 342.696C171.183 342.556 171.36 342.486 171.565 342.486C171.771 342.486 171.943 342.556 172.083 342.696C172.233 342.836 172.307 343.018 172.307 343.242C172.307 343.475 172.233 343.662 172.083 343.802C171.943 343.942 171.771 344.012 171.565 344.012ZM177.602 353.168C176.892 353.168 176.267 353.019 175.726 352.72C175.184 352.412 174.764 351.978 174.466 351.418C174.167 350.849 174.018 350.172 174.018 349.388C174.018 348.641 174.144 347.983 174.396 347.414C174.657 346.845 175.03 346.401 175.516 346.084C176.01 345.757 176.603 345.594 177.294 345.594C177.742 345.594 178.134 345.659 178.47 345.79C178.815 345.911 179.072 346.033 179.24 346.154V342.318L180.276 342.136V352.776C180.098 352.832 179.879 352.893 179.618 352.958C179.356 353.014 179.058 353.061 178.722 353.098C178.395 353.145 178.022 353.168 177.602 353.168ZM177.616 352.23C178.026 352.23 178.362 352.211 178.624 352.174C178.894 352.127 179.1 352.085 179.24 352.048V347.134C179.081 347.003 178.838 346.873 178.512 346.742C178.185 346.602 177.816 346.532 177.406 346.532C176.986 346.532 176.626 346.607 176.328 346.756C176.038 346.896 175.8 347.097 175.614 347.358C175.436 347.619 175.306 347.923 175.222 348.268C175.147 348.613 175.11 348.982 175.11 349.374C175.11 349.981 175.212 350.499 175.418 350.928C175.632 351.348 175.926 351.67 176.3 351.894C176.682 352.118 177.121 352.23 177.616 352.23ZM182.319 355.59L181.577 355.086C182.053 354.489 182.445 353.863 182.753 353.21C183.061 352.557 183.29 351.866 183.439 351.138C183.589 350.41 183.663 349.635 183.663 348.814C183.663 347.993 183.589 347.218 183.439 346.49C183.29 345.762 183.061 345.071 182.753 344.418C182.445 343.765 182.053 343.139 181.577 342.542L182.319 342.038C182.795 342.626 183.215 343.275 183.579 343.984C183.943 344.693 184.223 345.454 184.419 346.266C184.625 347.069 184.727 347.918 184.727 348.814C184.727 349.701 184.625 350.55 184.419 351.362C184.223 352.174 183.943 352.93 183.579 353.63C183.215 354.339 182.795 354.993 182.319 355.59Z" fill="black" fill-opacity="0.6"/>
+<rect width="144" height="92" transform="translate(464 303)" fill="white"/>
+<path d="M478.08 328.24C477.109 328.24 476.235 328.016 475.456 327.568C474.688 327.12 474.08 326.469 473.632 325.616C473.195 324.752 472.976 323.696 472.976 322.448C472.976 321.52 473.115 320.699 473.392 319.984C473.669 319.259 474.048 318.651 474.528 318.16C475.019 317.669 475.573 317.301 476.192 317.056C476.821 316.8 477.477 316.672 478.16 316.672C478.725 316.672 479.216 316.72 479.632 316.816C480.059 316.901 480.411 317.003 480.688 317.12C480.965 317.237 481.168 317.339 481.296 317.424L480.896 318.48C480.629 318.32 480.283 318.165 479.856 318.016C479.44 317.867 478.933 317.792 478.336 317.792C477.461 317.792 476.72 317.989 476.112 318.384C475.515 318.768 475.061 319.312 474.752 320.016C474.443 320.709 474.288 321.525 474.288 322.464C474.288 323.403 474.437 324.224 474.736 324.928C475.035 325.621 475.472 326.16 476.048 326.544C476.635 326.928 477.349 327.12 478.192 327.12C478.896 327.12 479.483 327.056 479.952 326.928C480.421 326.789 480.784 326.651 481.04 326.512L481.376 327.568C481.205 327.675 480.832 327.813 480.256 327.984C479.691 328.155 478.965 328.24 478.08 328.24ZM485.684 328.176C485.087 328.176 484.553 328.091 484.084 327.92C483.615 327.749 483.247 327.472 482.98 327.088C482.713 326.704 482.58 326.197 482.58 325.568C482.58 324.96 482.729 324.469 483.028 324.096C483.327 323.712 483.737 323.435 484.26 323.264C484.793 323.093 485.391 323.008 486.052 323.008C486.351 323.008 486.665 323.035 486.996 323.088C487.327 323.141 487.535 323.189 487.62 323.232V322.752C487.62 322.389 487.572 322.043 487.476 321.712C487.391 321.371 487.209 321.093 486.932 320.88C486.655 320.667 486.233 320.56 485.668 320.56C485.081 320.56 484.633 320.603 484.324 320.688C484.015 320.773 483.785 320.843 483.636 320.896L483.476 319.872C483.668 319.787 483.961 319.707 484.356 319.632C484.751 319.557 485.215 319.52 485.748 319.52C486.505 319.52 487.103 319.653 487.54 319.92C487.988 320.187 488.308 320.555 488.5 321.024C488.703 321.483 488.804 322.011 488.804 322.608V327.808C488.58 327.861 488.18 327.936 487.604 328.032C487.028 328.128 486.388 328.176 485.684 328.176ZM485.86 327.152C486.233 327.152 486.569 327.141 486.868 327.12C487.167 327.088 487.417 327.051 487.62 327.008V324.224C487.513 324.171 487.332 324.117 487.076 324.064C486.82 324.011 486.489 323.984 486.084 323.984C485.743 323.984 485.396 324.021 485.044 324.096C484.692 324.171 484.393 324.32 484.148 324.544C483.913 324.768 483.796 325.104 483.796 325.552C483.796 326.149 483.983 326.565 484.356 326.8C484.729 327.035 485.231 327.152 485.86 327.152ZM494.879 328.176C494.004 328.176 493.274 328 492.687 327.648C492.1 327.285 491.658 326.779 491.359 326.128C491.06 325.477 490.911 324.725 490.911 323.872C490.911 323.008 491.066 322.251 491.375 321.6C491.684 320.949 492.127 320.443 492.703 320.08C493.29 319.707 493.983 319.52 494.783 319.52C495.22 319.52 495.636 319.557 496.031 319.632C496.426 319.707 496.735 319.803 496.959 319.92L496.655 320.928C496.442 320.832 496.202 320.752 495.935 320.688C495.668 320.624 495.316 320.592 494.879 320.592C493.994 320.592 493.316 320.88 492.847 321.456C492.388 322.032 492.159 322.837 492.159 323.872C492.159 324.512 492.255 325.077 492.447 325.568C492.639 326.048 492.948 326.427 493.375 326.704C493.802 326.971 494.367 327.104 495.071 327.104C495.487 327.104 495.85 327.056 496.159 326.96C496.479 326.864 496.714 326.779 496.863 326.704L497.103 327.728C496.9 327.835 496.591 327.936 496.175 328.032C495.759 328.128 495.327 328.176 494.879 328.176ZM498.828 328V315.792L500.028 315.584V319.92C500.338 319.803 500.663 319.712 501.004 319.648C501.356 319.584 501.698 319.552 502.028 319.552C502.903 319.552 503.58 319.712 504.06 320.032C504.54 320.352 504.876 320.8 505.068 321.376C505.271 321.941 505.372 322.603 505.372 323.36V328H504.172V323.696C504.172 322.939 504.103 322.336 503.964 321.888C503.826 321.44 503.591 321.115 503.26 320.912C502.93 320.709 502.466 320.608 501.868 320.608C501.644 320.608 501.399 320.635 501.132 320.688C500.876 320.731 500.647 320.779 500.444 320.832C500.242 320.885 500.103 320.928 500.028 320.96V328H498.828ZM511.601 328.176C510.63 328.176 509.841 327.989 509.233 327.616C508.636 327.243 508.193 326.731 507.905 326.08C507.628 325.429 507.489 324.688 507.489 323.856C507.489 322.885 507.665 322.08 508.017 321.44C508.369 320.8 508.822 320.32 509.377 320C509.942 319.68 510.534 319.52 511.153 319.52C511.846 319.52 512.444 319.669 512.945 319.968C513.457 320.256 513.852 320.704 514.129 321.312C514.406 321.909 514.545 322.672 514.545 323.6C514.545 323.675 514.54 323.765 514.529 323.872C514.529 323.968 514.524 324.059 514.513 324.144H508.737C508.78 325.083 509.03 325.813 509.489 326.336C509.958 326.848 510.684 327.104 511.665 327.104C512.209 327.104 512.652 327.056 512.993 326.96C513.345 326.853 513.596 326.763 513.745 326.688L513.953 327.696C513.804 327.781 513.51 327.883 513.073 328C512.646 328.117 512.156 328.176 511.601 328.176ZM508.769 323.168H513.329C513.318 322.624 513.228 322.16 513.057 321.776C512.886 321.381 512.641 321.083 512.321 320.88C512.012 320.667 511.628 320.56 511.169 320.56C510.7 320.56 510.289 320.683 509.937 320.928C509.585 321.173 509.308 321.493 509.105 321.888C508.913 322.283 508.801 322.709 508.769 323.168Z" fill="black"/>
+<path fill-rule="evenodd" clip-rule="evenodd" d="M496 344.5C500.193 344.5 504.014 345.234 506.805 346.442C508.199 347.046 509.36 347.778 510.179 348.616C510.883 349.337 511.35 350.157 511.469 351.047H511.5V374.506C511.5 375.57 511 376.543 510.179 377.384C509.36 378.222 508.199 378.953 506.805 379.557C504.014 380.765 500.193 381.5 496 381.5C491.807 381.5 487.986 380.765 485.195 379.557C483.801 378.953 482.64 378.222 481.821 377.384C481 376.543 480.5 375.57 480.5 374.506V351.047H480.531C480.65 350.157 481.117 349.337 481.821 348.616C482.64 347.778 483.801 347.046 485.195 346.442C487.986 345.234 491.807 344.5 496 344.5ZM510.5 369.356C510.399 369.478 510.292 369.597 510.179 369.713C509.36 370.551 508.199 371.282 506.805 371.886C504.014 373.094 500.193 373.829 496 373.829C491.807 373.829 487.986 373.094 485.195 371.886C483.801 371.282 482.64 370.551 481.821 369.713C481.708 369.597 481.601 369.478 481.5 369.356V374.506C481.5 375.235 481.839 375.971 482.536 376.685C483.236 377.4 484.273 378.068 485.593 378.64C488.231 379.781 491.91 380.5 496 380.5C500.09 380.5 503.769 379.781 506.407 378.64C507.727 378.068 508.764 377.4 509.464 376.685C510.161 375.971 510.5 375.235 510.5 374.506V369.356ZM510.5 361.686C510.399 361.807 510.292 361.926 510.179 362.042C509.36 362.88 508.199 363.611 506.805 364.215C504.014 365.423 500.193 366.158 496 366.158C491.807 366.158 487.986 365.423 485.195 364.215C483.801 363.611 482.64 362.88 481.821 362.042C481.708 361.926 481.601 361.807 481.5 361.686V366.835C481.5 367.564 481.839 368.3 482.536 369.014C483.236 369.729 484.273 370.397 485.593 370.969C488.231 372.111 491.91 372.829 496 372.829C500.09 372.829 503.769 372.111 506.407 370.969C507.727 370.397 508.764 369.729 509.464 369.014C510.161 368.3 510.5 367.564 510.5 366.835V361.686ZM510.5 354.014C510.399 354.135 510.292 354.255 510.179 354.371C509.36 355.209 508.199 355.941 506.805 356.545C504.014 357.753 500.193 358.487 496 358.487C491.807 358.487 487.986 357.753 485.195 356.545C483.801 355.941 482.64 355.209 481.821 354.371C481.708 354.255 481.601 354.135 481.5 354.014V359.164C481.5 359.894 481.839 360.629 482.536 361.343C483.235 362.059 484.273 362.727 485.593 363.298C488.231 364.44 491.91 365.158 496 365.158C500.09 365.158 503.769 364.44 506.407 363.298C507.727 362.727 508.765 362.059 509.464 361.343C510.161 360.629 510.5 359.894 510.5 359.164V354.014ZM496 345.5C491.91 345.5 488.231 346.219 485.593 347.36C484.273 347.932 483.236 348.6 482.536 349.315C481.839 350.029 481.5 350.765 481.5 351.494C481.5 352.224 481.839 352.959 482.536 353.673C483.236 354.389 484.273 355.056 485.593 355.627C488.231 356.769 491.91 357.487 496 357.487C500.09 357.487 503.769 356.769 506.407 355.627C507.727 355.056 508.764 354.389 509.464 353.673C510.161 352.959 510.5 352.224 510.5 351.494C510.5 350.765 510.161 350.029 509.464 349.315C508.764 348.6 507.727 347.932 506.407 347.36C503.769 346.219 500.09 345.5 496 345.5Z" fill="black"/>
+<path d="M508 359.5C508 360.052 507.552 360.5 507 360.5C506.448 360.5 506 360.052 506 359.5C506 358.948 506.448 358.5 507 358.5C507.552 358.5 508 358.948 508 359.5Z" fill="black"/>
+<path d="M508 367C508 367.552 507.552 368 507 368C506.448 368 506 367.552 506 367C506 366.448 506.448 366 507 366C507.552 366 508 366.448 508 367Z" fill="black"/>
+<path d="M508 374.5C508 375.052 507.552 375.5 507 375.5C506.448 375.5 506 375.052 506 374.5C506 373.948 506.448 373.5 507 373.5C507.552 373.5 508 373.948 508 374.5Z" fill="black"/>
+<rect width="144" height="92" transform="translate(464 103)" fill="white"/>
+<path d="M475.856 128.176C475.259 128.176 474.725 128.091 474.256 127.92C473.787 127.749 473.419 127.472 473.152 127.088C472.885 126.704 472.752 126.197 472.752 125.568C472.752 124.96 472.901 124.469 473.2 124.096C473.499 123.712 473.909 123.435 474.432 123.264C474.965 123.093 475.563 123.008 476.224 123.008C476.523 123.008 476.837 123.035 477.168 123.088C477.499 123.141 477.707 123.189 477.792 123.232V122.752C477.792 122.389 477.744 122.043 477.648 121.712C477.563 121.371 477.381 121.093 477.104 120.88C476.827 120.667 476.405 120.56 475.84 120.56C475.253 120.56 474.805 120.603 474.496 120.688C474.187 120.773 473.957 120.843 473.808 120.896L473.648 119.872C473.84 119.787 474.133 119.707 474.528 119.632C474.923 119.557 475.387 119.52 475.92 119.52C476.677 119.52 477.275 119.653 477.712 119.92C478.16 120.187 478.48 120.555 478.672 121.024C478.875 121.483 478.976 122.011 478.976 122.608V127.808C478.752 127.861 478.352 127.936 477.776 128.032C477.2 128.128 476.56 128.176 475.856 128.176ZM476.032 127.152C476.405 127.152 476.741 127.141 477.04 127.12C477.339 127.088 477.589 127.051 477.792 127.008V124.224C477.685 124.171 477.504 124.117 477.248 124.064C476.992 124.011 476.661 123.984 476.256 123.984C475.915 123.984 475.568 124.021 475.216 124.096C474.864 124.171 474.565 124.32 474.32 124.544C474.085 124.768 473.968 125.104 473.968 125.552C473.968 126.149 474.155 126.565 474.528 126.8C474.901 127.035 475.403 127.152 476.032 127.152ZM484.795 128.16C483.963 128.16 483.301 128.005 482.811 127.696C482.331 127.376 481.984 126.928 481.771 126.352C481.568 125.776 481.467 125.109 481.467 124.352V119.712H482.667V124.032C482.667 124.779 482.741 125.376 482.891 125.824C483.04 126.272 483.28 126.597 483.611 126.8C483.952 126.992 484.4 127.088 484.955 127.088C485.403 127.088 485.797 127.067 486.139 127.024C486.491 126.971 486.72 126.928 486.827 126.896V119.712H488.011V127.712C487.691 127.797 487.259 127.893 486.715 128C486.181 128.107 485.541 128.16 484.795 128.16ZM493.407 128.176C492.703 128.176 492.149 128.053 491.743 127.808C491.338 127.563 491.05 127.195 490.879 126.704C490.719 126.213 490.639 125.6 490.639 124.864V117.312L491.839 117.104V119.712H495.087V120.72H491.839V124.96C491.839 125.547 491.903 125.995 492.031 126.304C492.17 126.613 492.362 126.827 492.607 126.944C492.863 127.051 493.162 127.104 493.503 127.104C493.909 127.104 494.245 127.056 494.511 126.96C494.789 126.864 495.007 126.779 495.167 126.704L495.423 127.68C495.263 127.776 494.997 127.883 494.623 128C494.261 128.117 493.855 128.176 493.407 128.176ZM496.985 128V115.792L498.185 115.584V119.92C498.494 119.803 498.819 119.712 499.161 119.648C499.513 119.584 499.854 119.552 500.185 119.552C501.059 119.552 501.737 119.712 502.217 120.032C502.697 120.352 503.033 120.8 503.225 121.376C503.427 121.941 503.529 122.603 503.529 123.36V128H502.329V123.696C502.329 122.939 502.259 122.336 502.121 121.888C501.982 121.44 501.747 121.115 501.417 120.912C501.086 120.709 500.622 120.608 500.025 120.608C499.801 120.608 499.555 120.635 499.289 120.688C499.033 120.731 498.803 120.779 498.601 120.832C498.398 120.885 498.259 120.928 498.185 120.96V128H496.985ZM509.741 128.192C508.931 128.192 508.216 128.021 507.597 127.68C506.979 127.328 506.499 126.832 506.157 126.192C505.816 125.541 505.645 124.768 505.645 123.872C505.645 123.019 505.789 122.267 506.077 121.616C506.376 120.965 506.803 120.459 507.357 120.096C507.923 119.723 508.6 119.536 509.389 119.536C509.901 119.536 510.349 119.611 510.733 119.76C511.128 119.899 511.421 120.037 511.613 120.176V115.792L512.797 115.584V127.744C512.595 127.808 512.344 127.877 512.045 127.952C511.747 128.016 511.405 128.069 511.021 128.112C510.648 128.165 510.221 128.192 509.741 128.192ZM509.757 127.12C510.227 127.12 510.611 127.099 510.909 127.056C511.219 127.003 511.453 126.955 511.613 126.912V121.296C511.432 121.147 511.155 120.997 510.781 120.848C510.408 120.688 509.987 120.608 509.517 120.608C509.037 120.608 508.627 120.693 508.285 120.864C507.955 121.024 507.683 121.253 507.469 121.552C507.267 121.851 507.117 122.197 507.021 122.592C506.936 122.987 506.893 123.408 506.893 123.856C506.893 124.549 507.011 125.141 507.245 125.632C507.491 126.112 507.827 126.48 508.253 126.736C508.691 126.992 509.192 127.12 509.757 127.12ZM520.917 128.192C520.202 128.192 519.642 128.128 519.237 128C518.842 127.883 518.576 127.792 518.437 127.728L518.725 126.672C518.842 126.715 519.082 126.805 519.445 126.944C519.808 127.083 520.298 127.152 520.917 127.152C521.504 127.152 521.978 127.061 522.341 126.88C522.704 126.699 522.885 126.384 522.885 125.936C522.885 125.648 522.821 125.419 522.693 125.248C522.565 125.067 522.357 124.901 522.069 124.752C521.792 124.603 521.408 124.432 520.917 124.24C520.501 124.069 520.117 123.888 519.765 123.696C519.413 123.504 519.125 123.259 518.901 122.96C518.688 122.661 518.581 122.277 518.581 121.808C518.581 121.349 518.698 120.949 518.933 120.608C519.168 120.267 519.498 120 519.925 119.808C520.362 119.616 520.88 119.52 521.477 119.52C522.032 119.52 522.501 119.568 522.885 119.664C523.269 119.76 523.541 119.845 523.701 119.92L523.429 120.96C523.29 120.885 523.066 120.8 522.757 120.704C522.448 120.597 522.01 120.544 521.445 120.544C520.997 120.544 520.608 120.64 520.277 120.832C519.946 121.013 519.781 121.307 519.781 121.712C519.781 122 519.85 122.235 519.989 122.416C520.128 122.587 520.336 122.741 520.613 122.88C520.89 123.019 521.232 123.168 521.637 123.328C522.096 123.509 522.506 123.701 522.869 123.904C523.242 124.096 523.541 124.347 523.765 124.656C523.989 124.965 524.101 125.376 524.101 125.888C524.101 126.389 523.973 126.816 523.717 127.168C523.461 127.509 523.093 127.765 522.613 127.936C522.144 128.107 521.578 128.192 520.917 128.192ZM529.71 128.176C528.74 128.176 527.95 127.989 527.342 127.616C526.745 127.243 526.302 126.731 526.014 126.08C525.737 125.429 525.598 124.688 525.598 123.856C525.598 122.885 525.774 122.08 526.126 121.44C526.478 120.8 526.932 120.32 527.486 120C528.052 119.68 528.644 119.52 529.262 119.52C529.956 119.52 530.553 119.669 531.054 119.968C531.566 120.256 531.961 120.704 532.238 121.312C532.516 121.909 532.654 122.672 532.654 123.6C532.654 123.675 532.649 123.765 532.638 123.872C532.638 123.968 532.633 124.059 532.622 124.144H526.846C526.889 125.083 527.14 125.813 527.598 126.336C528.068 126.848 528.793 127.104 529.774 127.104C530.318 127.104 530.761 127.056 531.102 126.96C531.454 126.853 531.705 126.763 531.854 126.688L532.062 127.696C531.913 127.781 531.62 127.883 531.182 128C530.756 128.117 530.265 128.176 529.71 128.176ZM526.878 123.168H531.438C531.428 122.624 531.337 122.16 531.166 121.776C530.996 121.381 530.75 121.083 530.43 120.88C530.121 120.667 529.737 120.56 529.278 120.56C528.809 120.56 528.398 120.683 528.046 120.928C527.694 121.173 527.417 121.493 527.214 121.888C527.022 122.283 526.91 122.709 526.878 123.168ZM534.907 128V120.096C535.184 119.979 535.563 119.861 536.043 119.744C536.533 119.616 537.12 119.552 537.803 119.552C538.027 119.552 538.245 119.568 538.459 119.6C538.683 119.621 538.88 119.653 539.051 119.696C539.232 119.728 539.365 119.76 539.451 119.792L539.211 120.816C539.115 120.773 538.933 120.731 538.667 120.688C538.4 120.635 538.059 120.608 537.643 120.608C537.237 120.608 536.901 120.64 536.635 120.704C536.368 120.757 536.192 120.805 536.107 120.848V128H534.907ZM543.328 128C543.062 127.435 542.79 126.827 542.512 126.176C542.235 125.525 541.963 124.848 541.696 124.144C541.43 123.44 541.174 122.72 540.928 121.984C540.694 121.237 540.48 120.48 540.288 119.712H541.552C541.723 120.448 541.936 121.243 542.192 122.096C542.459 122.939 542.742 123.765 543.04 124.576C543.35 125.376 543.643 126.08 543.92 126.688C544.134 126.24 544.352 125.728 544.576 125.152C544.8 124.576 545.019 123.979 545.232 123.36C545.446 122.731 545.643 122.107 545.824 121.488C546.006 120.859 546.16 120.267 546.288 119.712H547.488C547.296 120.48 547.078 121.237 546.832 121.984C546.598 122.72 546.347 123.44 546.08 124.144C545.814 124.848 545.542 125.525 545.264 126.176C544.998 126.827 544.726 127.435 544.448 128H543.328ZM549.141 128V119.712H550.341V128H549.141ZM549.749 117.728C549.514 117.728 549.312 117.648 549.141 117.488C548.981 117.328 548.901 117.115 548.901 116.848C548.901 116.592 548.981 116.384 549.141 116.224C549.312 116.064 549.514 115.984 549.749 115.984C549.984 115.984 550.181 116.064 550.341 116.224C550.512 116.384 550.597 116.592 550.597 116.848C550.597 117.115 550.512 117.328 550.341 117.488C550.181 117.648 549.984 117.728 549.749 117.728ZM556.52 128.176C555.645 128.176 554.914 128 554.328 127.648C553.741 127.285 553.298 126.779 553 126.128C552.701 125.477 552.552 124.725 552.552 123.872C552.552 123.008 552.706 122.251 553.016 121.6C553.325 120.949 553.768 120.443 554.344 120.08C554.93 119.707 555.624 119.52 556.424 119.52C556.861 119.52 557.277 119.557 557.672 119.632C558.066 119.707 558.376 119.803 558.6 119.92L558.296 120.928C558.082 120.832 557.842 120.752 557.576 120.688C557.309 120.624 556.957 120.592 556.52 120.592C555.634 120.592 554.957 120.88 554.488 121.456C554.029 122.032 553.799 122.837 553.799 123.872C553.799 124.512 553.896 125.077 554.088 125.568C554.28 126.048 554.589 126.427 555.016 126.704C555.442 126.971 556.008 127.104 556.712 127.104C557.128 127.104 557.49 127.056 557.8 126.96C558.12 126.864 558.354 126.779 558.504 126.704L558.744 127.728C558.541 127.835 558.232 127.936 557.816 128.032C557.4 128.128 556.968 128.176 556.52 128.176ZM564.054 128.176C563.083 128.176 562.294 127.989 561.686 127.616C561.089 127.243 560.646 126.731 560.358 126.08C560.081 125.429 559.942 124.688 559.942 123.856C559.942 122.885 560.118 122.08 560.47 121.44C560.822 120.8 561.275 120.32 561.83 120C562.395 119.68 562.987 119.52 563.606 119.52C564.299 119.52 564.897 119.669 565.398 119.968C565.91 120.256 566.305 120.704 566.582 121.312C566.859 121.909 566.998 122.672 566.998 123.6C566.998 123.675 566.993 123.765 566.982 123.872C566.982 123.968 566.977 124.059 566.966 124.144H561.19C561.233 125.083 561.483 125.813 561.942 126.336C562.411 126.848 563.137 127.104 564.118 127.104C564.662 127.104 565.105 127.056 565.446 126.96C565.798 126.853 566.049 126.763 566.198 126.688L566.406 127.696C566.257 127.781 565.963 127.883 565.526 128C565.099 128.117 564.609 128.176 564.054 128.176ZM561.222 123.168H565.782C565.771 122.624 565.681 122.16 565.51 121.776C565.339 121.381 565.094 121.083 564.774 120.88C564.465 120.667 564.081 120.56 563.622 120.56C563.153 120.56 562.742 120.683 562.39 120.928C562.038 121.173 561.761 121.493 561.558 121.888C561.366 122.283 561.254 122.709 561.222 123.168Z" fill="black"/>
+<path d="M514.22 163C514.22 166.54 513.19 169.96 511.25 172.91C509.3 175.86 506.56 178.15 503.31 179.55C500.06 180.94 496.51 181.34 493.03 180.72C489.73 180.13 486.7 178.63 484.22 176.4H488.76V175.4H482.83V181.33H483.83V177.4C486.4 179.62 489.49 181.11 492.85 181.71C493.97 181.91 495.11 182.01 496.24 182.01C498.79 182.01 501.33 181.49 503.71 180.47C507.14 179 510.04 176.58 512.09 173.47C514.14 170.36 515.23 166.74 515.23 163.01H514.23L514.22 163Z" fill="black"/>
+<path d="M508.61 144.68V148.61C506.05 146.41 502.97 144.92 499.64 144.31C495.97 143.64 492.21 144.06 488.77 145.52C485.33 146.99 482.43 149.41 480.37 152.52C478.31 155.64 477.22 159.27 477.22 163H478.22C478.22 159.46 479.25 156.03 481.2 153.08C483.15 150.13 485.9 147.83 489.16 146.45C492.42 145.07 495.98 144.66 499.46 145.3C502.74 145.9 505.76 147.39 508.23 149.61H503.69V150.61H509.62V144.68H508.62H508.61Z" fill="black"/>
+<path d="M512.96 158.26C511.58 158.26 510.46 157.14 510.46 155.76C510.46 154.38 511.58 153.26 512.96 153.26C514.34 153.26 515.46 154.38 515.46 155.76C515.46 157.14 514.34 158.26 512.96 158.26ZM512.96 154.26C512.13 154.26 511.46 154.93 511.46 155.76C511.46 156.59 512.13 157.26 512.96 157.26C513.79 157.26 514.46 156.59 514.46 155.76C514.46 154.93 513.79 154.26 512.96 154.26Z" fill="black"/>
+<path d="M479.03 173.19C477.65 173.19 476.53 172.07 476.53 170.69C476.53 169.31 477.65 168.19 479.03 168.19C480.41 168.19 481.53 169.31 481.53 170.69C481.53 172.07 480.41 173.19 479.03 173.19ZM479.03 169.19C478.2 169.19 477.53 169.86 477.53 170.69C477.53 171.52 478.2 172.19 479.03 172.19C479.86 172.19 480.53 171.52 480.53 170.69C480.53 169.86 479.86 169.19 479.03 169.19Z" fill="black"/>
+<path d="M498.47 174H493.96L493.23 171.62C493.02 171.11 492.63 170.65 492.16 170.36C491.62 170.03 490.99 169.92 490.39 170.05L488.26 170.51L486.02 166.5L487.42 164.84C487.85 164.33 488.09 163.67 488.09 162.99C488.09 162.31 487.85 161.65 487.42 161.14L486.02 159.49L488.23 155.49L490.61 155.99C491.13 156.05 491.66 155.93 492.13 155.64C492.66 155.31 493.07 154.8 493.28 154.18L493.97 152.01H498.48L499.15 154.13C499.35 154.77 499.77 155.31 500.32 155.65C500.86 155.98 501.49 156.09 502.09 155.96L504.22 155.5L506.43 159.53L505.04 161.18C504.61 161.69 504.38 162.34 504.38 163.02C504.38 163.7 504.62 164.36 505.04 164.86L506.43 166.51L504.22 170.54L502.09 170.08C501.48 169.95 500.85 170.06 500.32 170.39C499.77 170.73 499.36 171.26 499.16 171.91L498.48 174.01L498.47 174ZM494.7 173H497.74L498.19 171.6C498.46 170.73 499.03 169.99 499.79 169.53C500.55 169.07 501.44 168.92 502.29 169.1L503.69 169.4L505.21 166.62L504.26 165.5C503.68 164.81 503.36 163.93 503.36 163.01C503.36 162.09 503.68 161.21 504.26 160.52L505.21 159.39L503.69 156.62L502.29 156.92C501.43 157.1 500.54 156.95 499.79 156.49C499.03 156.03 498.46 155.29 498.19 154.42L497.74 153H494.7L494.25 154.41C493.98 155.28 493.41 156.02 492.65 156.48C491.99 156.88 491.22 157.05 490.47 156.96L490.17 156.91L488.74 156.61L487.22 159.36L488.17 160.48C488.75 161.17 489.08 162.06 489.08 162.98C489.08 163.9 488.77 164.75 488.21 165.43L488.17 165.48L487.22 166.6L488.77 169.36L490.17 169.06C491.02 168.88 491.92 169.03 492.67 169.49C493.32 169.89 493.85 170.51 494.15 171.24L494.26 171.54L494.69 172.99L494.7 173Z" fill="black"/>
+<path d="M496.22 167C494.01 167 492.22 165.21 492.22 163C492.22 160.79 494.01 159 496.22 159C498.43 159 500.22 160.79 500.22 163C500.22 165.21 498.43 167 496.22 167ZM496.22 160C494.57 160 493.22 161.35 493.22 163C493.22 164.65 494.57 166 496.22 166C497.87 166 499.22 164.65 499.22 163C499.22 161.35 497.87 160 496.22 160Z" fill="black"/>
+<rect width="144" height="92" transform="translate(263 103)" fill="white"/>
+<path d="M272.424 128V117.12C272.829 117.013 273.293 116.939 273.816 116.896C274.349 116.843 274.84 116.816 275.288 116.816C276.856 116.816 278.029 117.12 278.808 117.728C279.597 118.325 279.992 119.179 279.992 120.288C279.992 121.131 279.795 121.808 279.4 122.32C279.016 122.832 278.456 123.205 277.72 123.44C276.995 123.664 276.12 123.776 275.096 123.776H273.672V128H272.424ZM273.672 122.704H274.984C275.741 122.704 276.397 122.64 276.952 122.512C277.507 122.373 277.933 122.128 278.232 121.776C278.541 121.424 278.696 120.923 278.696 120.272C278.696 119.643 278.536 119.157 278.216 118.816C277.896 118.475 277.48 118.235 276.968 118.096C276.456 117.957 275.912 117.888 275.336 117.888C274.963 117.888 274.637 117.904 274.36 117.936C274.093 117.957 273.864 117.979 273.672 118V122.704ZM280.051 128C280.627 126.453 281.155 125.045 281.635 123.776C282.115 122.507 282.584 121.317 283.043 120.208C283.512 119.088 284.008 117.989 284.531 116.912H285.651C286.035 117.723 286.403 118.544 286.755 119.376C287.117 120.197 287.475 121.051 287.827 121.936C288.179 122.821 288.541 123.765 288.915 124.768C289.299 125.76 289.704 126.837 290.131 128H288.771C288.579 127.467 288.392 126.96 288.211 126.48C288.029 125.989 287.859 125.509 287.699 125.04H282.419C282.248 125.509 282.072 125.989 281.891 126.48C281.709 126.96 281.528 127.467 281.347 128H280.051ZM282.787 123.984H287.331C287.128 123.451 286.931 122.933 286.739 122.432C286.547 121.931 286.355 121.445 286.163 120.976C285.981 120.507 285.795 120.053 285.603 119.616C285.421 119.168 285.235 118.731 285.043 118.304C284.861 118.731 284.675 119.168 284.483 119.616C284.301 120.053 284.115 120.507 283.923 120.976C283.741 121.445 283.555 121.931 283.363 122.432C283.171 122.933 282.979 123.451 282.787 123.984ZM291.449 128C291.492 127.019 291.54 126.043 291.593 125.072C291.646 124.101 291.705 123.152 291.769 122.224C291.833 121.285 291.902 120.373 291.977 119.488C292.052 118.592 292.137 117.733 292.233 116.912H293.353C293.662 117.424 293.988 118.021 294.329 118.704C294.681 119.376 295.033 120.085 295.385 120.832C295.737 121.568 296.073 122.293 296.393 123.008C296.724 123.723 297.017 124.368 297.273 124.944C297.529 124.368 297.817 123.723 298.137 123.008C298.468 122.293 298.809 121.568 299.161 120.832C299.513 120.085 299.865 119.376 300.217 118.704C300.569 118.021 300.894 117.424 301.193 116.912H302.249C302.345 117.733 302.43 118.592 302.505 119.488C302.59 120.373 302.66 121.285 302.713 122.224C302.777 123.152 302.836 124.101 302.889 125.072C302.953 126.043 303.006 127.019 303.049 128H301.801C301.758 126.912 301.71 125.845 301.657 124.8C301.614 123.744 301.561 122.725 301.497 121.744C301.433 120.763 301.358 119.835 301.273 118.96C301.166 119.163 300.996 119.499 300.761 119.968C300.537 120.427 300.281 120.96 299.993 121.568C299.705 122.165 299.412 122.779 299.113 123.408C298.825 124.037 298.558 124.619 298.313 125.152C298.078 125.685 297.897 126.107 297.769 126.416H296.697C296.569 126.107 296.382 125.685 296.137 125.152C295.902 124.619 295.636 124.037 295.337 123.408C295.049 122.779 294.761 122.165 294.473 121.568C294.185 120.96 293.924 120.427 293.689 119.968C293.465 119.499 293.3 119.163 293.193 118.96C293.108 119.835 293.033 120.763 292.969 121.744C292.905 122.725 292.846 123.744 292.793 124.8C292.75 125.845 292.708 126.912 292.665 128H291.449ZM309.203 128V120C309.534 119.915 309.955 119.819 310.467 119.712C310.979 119.605 311.614 119.552 312.371 119.552C312.905 119.552 313.358 119.627 313.731 119.776C314.115 119.925 314.425 120.149 314.659 120.448C314.755 120.373 314.926 120.267 315.171 120.128C315.417 119.979 315.726 119.845 316.099 119.728C316.483 119.611 316.915 119.552 317.395 119.552C318.249 119.552 318.889 119.717 319.315 120.048C319.753 120.368 320.046 120.816 320.195 121.392C320.345 121.957 320.419 122.613 320.419 123.36V128H319.219V123.696C319.219 122.992 319.171 122.416 319.075 121.968C318.979 121.509 318.793 121.168 318.515 120.944C318.238 120.72 317.827 120.608 317.283 120.608C316.889 120.608 316.542 120.656 316.243 120.752C315.955 120.837 315.715 120.939 315.523 121.056C315.342 121.173 315.209 121.264 315.123 121.328C315.219 121.595 315.289 121.899 315.331 122.24C315.385 122.581 315.411 122.939 315.411 123.312V128H314.211V123.696C314.211 122.992 314.163 122.416 314.067 121.968C313.971 121.509 313.779 121.168 313.491 120.944C313.214 120.72 312.793 120.608 312.227 120.608C311.918 120.608 311.635 120.624 311.379 120.656C311.134 120.677 310.926 120.704 310.755 120.736C310.595 120.768 310.478 120.795 310.403 120.816V128H309.203ZM326.344 128.192C325.608 128.192 324.952 128.016 324.376 127.664C323.8 127.301 323.347 126.795 323.016 126.144C322.696 125.493 322.536 124.731 322.536 123.856C322.536 122.981 322.696 122.224 323.016 121.584C323.347 120.933 323.8 120.427 324.376 120.064C324.952 119.701 325.608 119.52 326.344 119.52C327.091 119.52 327.752 119.701 328.328 120.064C328.904 120.427 329.352 120.933 329.672 121.584C330.003 122.224 330.168 122.981 330.168 123.856C330.168 124.731 330.003 125.493 329.672 126.144C329.352 126.795 328.904 127.301 328.328 127.664C327.763 128.016 327.101 128.192 326.344 128.192ZM326.344 127.12C326.877 127.12 327.336 126.987 327.72 126.72C328.104 126.453 328.397 126.075 328.6 125.584C328.813 125.093 328.92 124.517 328.92 123.856C328.92 123.195 328.813 122.619 328.6 122.128C328.397 121.637 328.104 121.259 327.72 120.992C327.336 120.725 326.877 120.592 326.344 120.592C325.821 120.592 325.368 120.725 324.984 120.992C324.6 121.259 324.301 121.637 324.088 122.128C323.885 122.619 323.784 123.195 323.784 123.856C323.784 124.517 323.885 125.093 324.088 125.584C324.301 126.075 324.6 126.453 324.984 126.72C325.368 126.987 325.821 127.12 326.344 127.12ZM335.991 128.192C335.181 128.192 334.466 128.021 333.847 127.68C333.229 127.328 332.749 126.832 332.407 126.192C332.066 125.541 331.895 124.768 331.895 123.872C331.895 123.019 332.039 122.267 332.327 121.616C332.626 120.965 333.053 120.459 333.607 120.096C334.173 119.723 334.85 119.536 335.639 119.536C336.151 119.536 336.599 119.611 336.983 119.76C337.378 119.899 337.671 120.037 337.863 120.176V115.792L339.047 115.584V127.744C338.845 127.808 338.594 127.877 338.295 127.952C337.997 128.016 337.655 128.069 337.271 128.112C336.898 128.165 336.471 128.192 335.991 128.192ZM336.007 127.12C336.477 127.12 336.861 127.099 337.159 127.056C337.469 127.003 337.703 126.955 337.863 126.912V121.296C337.682 121.147 337.405 120.997 337.031 120.848C336.658 120.688 336.237 120.608 335.767 120.608C335.287 120.608 334.877 120.693 334.535 120.864C334.205 121.024 333.933 121.253 333.719 121.552C333.517 121.851 333.367 122.197 333.271 122.592C333.186 122.987 333.143 123.408 333.143 123.856C333.143 124.549 333.261 125.141 333.495 125.632C333.741 126.112 334.077 126.48 334.503 126.736C334.941 126.992 335.442 127.12 336.007 127.12ZM344.967 128.16C344.135 128.16 343.473 128.005 342.983 127.696C342.503 127.376 342.156 126.928 341.943 126.352C341.74 125.776 341.639 125.109 341.639 124.352V119.712H342.839V124.032C342.839 124.779 342.913 125.376 343.063 125.824C343.212 126.272 343.452 126.597 343.783 126.8C344.124 126.992 344.572 127.088 345.127 127.088C345.575 127.088 345.969 127.067 346.311 127.024C346.663 126.971 346.892 126.928 346.999 126.896V119.712H348.183V127.712C347.863 127.797 347.431 127.893 346.887 128C346.353 128.107 345.713 128.16 344.967 128.16ZM353.115 128.144C352.603 128.123 352.177 128.037 351.835 127.888C351.505 127.739 351.259 127.509 351.099 127.2C350.939 126.88 350.859 126.453 350.859 125.92V115.792L352.059 115.584V125.84C352.059 126.352 352.15 126.683 352.331 126.832C352.523 126.981 352.843 127.088 353.291 127.152L353.115 128.144ZM358.695 128.176C357.724 128.176 356.935 127.989 356.327 127.616C355.729 127.243 355.287 126.731 354.999 126.08C354.721 125.429 354.583 124.688 354.583 123.856C354.583 122.885 354.759 122.08 355.111 121.44C355.463 120.8 355.916 120.32 356.471 120C357.036 119.68 357.628 119.52 358.247 119.52C358.94 119.52 359.537 119.669 360.039 119.968C360.551 120.256 360.945 120.704 361.223 121.312C361.5 121.909 361.639 122.672 361.639 123.6C361.639 123.675 361.633 123.765 361.623 123.872C361.623 123.968 361.617 124.059 361.607 124.144H355.831C355.873 125.083 356.124 125.813 356.583 126.336C357.052 126.848 357.777 127.104 358.759 127.104C359.303 127.104 359.745 127.056 360.087 126.96C360.439 126.853 360.689 126.763 360.839 126.688L361.047 127.696C360.897 127.781 360.604 127.883 360.167 128C359.74 128.117 359.249 128.176 358.695 128.176ZM355.863 123.168H360.423C360.412 122.624 360.321 122.16 360.151 121.776C359.98 121.381 359.735 121.083 359.415 120.88C359.105 120.667 358.721 120.56 358.263 120.56C357.793 120.56 357.383 120.683 357.031 120.928C356.679 121.173 356.401 121.493 356.199 121.888C356.007 122.283 355.895 122.709 355.863 123.168Z" fill="black"/>
+<path d="M303.76 148.703L312.505 153.543V172.884L303.76 177.724L294.999 182.573L286.24 177.724L277.495 172.884V153.542L286.24 148.703L294.999 143.854L303.76 148.703Z" stroke="black" stroke-width="0.99"/>
+<path d="M277.942 153.841L295 163.354M295 163.354L312.058 153.841M295 163.354V182.053" stroke="black"/>
+<rect width="144" height="92" transform="translate(665 103)" fill="white"/>
+<path d="M679.208 128.24C678.269 128.24 677.4 128.021 676.6 127.584C675.811 127.147 675.176 126.501 674.696 125.648C674.216 124.784 673.976 123.717 673.976 122.448C673.976 121.499 674.115 120.667 674.392 119.952C674.669 119.227 675.048 118.624 675.528 118.144C676.019 117.653 676.579 117.285 677.208 117.04C677.837 116.795 678.504 116.672 679.208 116.672C680.157 116.672 681.027 116.891 681.816 117.328C682.605 117.755 683.24 118.4 683.72 119.264C684.2 120.117 684.44 121.179 684.44 122.448C684.44 123.717 684.2 124.784 683.72 125.648C683.24 126.501 682.605 127.147 681.816 127.584C681.027 128.021 680.157 128.24 679.208 128.24ZM679.208 127.12C680.008 127.12 680.701 126.933 681.288 126.56C681.875 126.176 682.328 125.637 682.648 124.944C682.968 124.24 683.128 123.408 683.128 122.448C683.128 121.488 682.968 120.661 682.648 119.968C682.328 119.264 681.875 118.725 681.288 118.352C680.701 117.979 680.008 117.792 679.208 117.792C678.408 117.792 677.715 117.979 677.128 118.352C676.541 118.725 676.088 119.264 675.768 119.968C675.448 120.661 675.288 121.488 675.288 122.448C675.288 123.408 675.448 124.24 675.768 124.944C676.088 125.637 676.541 126.176 677.128 126.56C677.715 126.933 678.408 127.12 679.208 127.12ZM686.846 128V116.912H688.094V128H686.846ZM693.708 128.096C693.26 128.096 692.785 128.075 692.284 128.032C691.782 127.989 691.334 127.915 690.94 127.808V117.12C691.334 117.013 691.782 116.939 692.284 116.896C692.796 116.843 693.276 116.816 693.724 116.816C694.929 116.816 695.99 117.024 696.908 117.44C697.825 117.845 698.54 118.464 699.052 119.296C699.574 120.128 699.836 121.179 699.836 122.448C699.836 123.707 699.574 124.757 699.052 125.6C698.54 126.432 697.825 127.056 696.908 127.472C695.99 127.888 694.924 128.096 693.708 128.096ZM693.836 127.024C695.393 127.024 696.561 126.619 697.34 125.808C698.129 124.987 698.524 123.867 698.524 122.448C698.524 121.029 698.134 119.915 697.356 119.104C696.577 118.293 695.409 117.888 693.852 117.888C693.329 117.888 692.94 117.904 692.684 117.936C692.428 117.968 692.262 117.989 692.188 118V126.912C692.262 126.923 692.422 126.944 692.668 126.976C692.913 127.008 693.302 127.024 693.836 127.024ZM706.893 128.24C705.922 128.24 705.047 128.016 704.269 127.568C703.501 127.12 702.893 126.469 702.445 125.616C702.007 124.752 701.789 123.696 701.789 122.448C701.789 121.52 701.927 120.699 702.205 119.984C702.482 119.259 702.861 118.651 703.341 118.16C703.831 117.669 704.386 117.301 705.005 117.056C705.634 116.8 706.29 116.672 706.973 116.672C707.538 116.672 708.029 116.72 708.445 116.816C708.871 116.901 709.223 117.003 709.501 117.12C709.778 117.237 709.981 117.339 710.109 117.424L709.709 118.48C709.442 118.32 709.095 118.165 708.669 118.016C708.253 117.867 707.746 117.792 707.149 117.792C706.274 117.792 705.533 117.989 704.924 118.384C704.327 118.768 703.874 119.312 703.565 120.016C703.255 120.709 703.101 121.525 703.101 122.464C703.101 123.403 703.25 124.224 703.549 124.928C703.847 125.621 704.285 126.16 704.861 126.544C705.447 126.928 706.162 127.12 707.005 127.12C707.709 127.12 708.295 127.056 708.765 126.928C709.234 126.789 709.597 126.651 709.852 126.512L710.189 127.568C710.018 127.675 709.645 127.813 709.069 127.984C708.503 128.155 707.778 128.24 706.893 128.24ZM718.681 128.192C718.212 128.192 717.785 128.165 717.401 128.112C717.017 128.069 716.676 128.016 716.377 127.952C716.089 127.877 715.839 127.808 715.625 127.744V115.792L716.825 115.584V120.176C717.017 120.037 717.305 119.899 717.689 119.76C718.084 119.611 718.537 119.536 719.049 119.536C719.849 119.536 720.527 119.723 721.081 120.096C721.636 120.459 722.057 120.965 722.345 121.616C722.644 122.267 722.793 123.013 722.793 123.856C722.793 124.752 722.623 125.525 722.281 126.176C721.94 126.816 721.46 127.312 720.841 127.664C720.223 128.016 719.503 128.192 718.681 128.192ZM718.665 127.12C719.241 127.12 719.743 126.992 720.169 126.736C720.607 126.48 720.943 126.112 721.177 125.632C721.412 125.141 721.529 124.549 721.529 123.856C721.529 123.408 721.481 122.987 721.385 122.592C721.3 122.197 721.151 121.851 720.937 121.552C720.735 121.253 720.463 121.024 720.121 120.864C719.791 120.693 719.385 120.608 718.905 120.608C718.447 120.608 718.031 120.688 717.657 120.848C717.284 120.997 717.007 121.147 716.825 121.296V126.912C716.975 126.955 717.199 127.003 717.497 127.056C717.807 127.099 718.196 127.12 718.665 127.12ZM724.985 128V120.096C725.262 119.979 725.641 119.861 726.121 119.744C726.611 119.616 727.198 119.552 727.881 119.552C728.105 119.552 728.323 119.568 728.537 119.6C728.761 119.621 728.958 119.653 729.129 119.696C729.31 119.728 729.443 119.76 729.529 119.792L729.289 120.816C729.193 120.773 729.011 120.731 728.745 120.688C728.478 120.635 728.137 120.608 727.721 120.608C727.315 120.608 726.979 120.64 726.713 120.704C726.446 120.757 726.27 120.805 726.185 120.848V128H724.985ZM734.36 128.192C733.624 128.192 732.968 128.016 732.392 127.664C731.816 127.301 731.362 126.795 731.032 126.144C730.712 125.493 730.552 124.731 730.552 123.856C730.552 122.981 730.712 122.224 731.032 121.584C731.362 120.933 731.816 120.427 732.392 120.064C732.968 119.701 733.624 119.52 734.36 119.52C735.106 119.52 735.768 119.701 736.344 120.064C736.92 120.427 737.368 120.933 737.688 121.584C738.018 122.224 738.184 122.981 738.184 123.856C738.184 124.731 738.018 125.493 737.688 126.144C737.368 126.795 736.92 127.301 736.344 127.664C735.778 128.016 735.117 128.192 734.36 128.192ZM734.36 127.12C734.893 127.12 735.352 126.987 735.736 126.72C736.12 126.453 736.413 126.075 736.616 125.584C736.829 125.093 736.936 124.517 736.936 123.856C736.936 123.195 736.829 122.619 736.616 122.128C736.413 121.637 736.12 121.259 735.736 120.992C735.352 120.725 734.893 120.592 734.36 120.592C733.837 120.592 733.384 120.725 733 120.992C732.616 121.259 732.317 121.637 732.104 122.128C731.901 122.619 731.799 123.195 731.799 123.856C731.799 124.517 731.901 125.093 732.104 125.584C732.317 126.075 732.616 126.453 733 126.72C733.384 126.987 733.837 127.12 734.36 127.12ZM740.391 128V115.792L741.591 115.584V123.36C741.847 123.104 742.135 122.816 742.455 122.496C742.775 122.176 743.1 121.845 743.431 121.504C743.762 121.163 744.071 120.837 744.359 120.528C744.647 120.219 744.892 119.947 745.095 119.712H746.519C746.199 120.053 745.82 120.448 745.383 120.896C744.956 121.344 744.519 121.797 744.071 122.256C743.634 122.704 743.228 123.109 742.855 123.472C743.196 123.707 743.548 124.005 743.911 124.368C744.284 124.72 744.652 125.104 745.015 125.52C745.378 125.936 745.714 126.357 746.023 126.784C746.343 127.211 746.615 127.616 746.839 128H745.447C745.127 127.456 744.743 126.923 744.295 126.4C743.847 125.867 743.388 125.381 742.919 124.944C742.45 124.507 742.007 124.155 741.591 123.888V128H740.391ZM751.835 128.176C750.865 128.176 750.075 127.989 749.467 127.616C748.87 127.243 748.427 126.731 748.139 126.08C747.862 125.429 747.723 124.688 747.723 123.856C747.723 122.885 747.899 122.08 748.251 121.44C748.603 120.8 749.057 120.32 749.611 120C750.177 119.68 750.769 119.52 751.387 119.52C752.081 119.52 752.678 119.669 753.179 119.968C753.691 120.256 754.086 120.704 754.363 121.312C754.641 121.909 754.779 122.672 754.779 123.6C754.779 123.675 754.774 123.765 754.763 123.872C754.763 123.968 754.758 124.059 754.747 124.144H748.971C749.014 125.083 749.265 125.813 749.723 126.336C750.193 126.848 750.918 127.104 751.899 127.104C752.443 127.104 752.886 127.056 753.227 126.96C753.579 126.853 753.83 126.763 753.979 126.688L754.187 127.696C754.038 127.781 753.745 127.883 753.307 128C752.881 128.117 752.39 128.176 751.835 128.176ZM749.003 123.168H753.563C753.553 122.624 753.462 122.16 753.291 121.776C753.121 121.381 752.875 121.083 752.555 120.88C752.246 120.667 751.862 120.56 751.403 120.56C750.934 120.56 750.523 120.683 750.171 120.928C749.819 121.173 749.542 121.493 749.339 121.888C749.147 122.283 749.035 122.709 749.003 123.168ZM757.032 128V120.096C757.309 119.979 757.688 119.861 758.168 119.744C758.658 119.616 759.245 119.552 759.928 119.552C760.152 119.552 760.37 119.568 760.584 119.6C760.808 119.621 761.005 119.653 761.176 119.696C761.357 119.728 761.49 119.76 761.576 119.792L761.336 120.816C761.24 120.773 761.058 120.731 760.792 120.688C760.525 120.635 760.184 120.608 759.768 120.608C759.362 120.608 759.026 120.64 758.76 120.704C758.493 120.757 758.317 120.805 758.232 120.848V128H757.032Z" fill="black"/>
+<path d="M693.032 179C693.012 179.164 693 179.331 693 179.5C693 179.669 693.012 179.836 693.032 180H682V179H693.032ZM712 179V180H700.968C700.988 179.836 701 179.669 701 179.5C701 179.331 700.988 179.164 700.968 179H712ZM697.5 175.531C697.336 175.511 697.169 175.5 697 175.5C696.831 175.5 696.664 175.511 696.5 175.531V171H697.5V175.531Z" fill="black"/>
+<path d="M697 177C698.381 177 699.5 178.119 699.5 179.5C699.5 180.881 698.381 182 697 182C695.619 182 694.5 180.881 694.5 179.5C694.5 178.119 695.619 177 697 177ZM697 178C696.172 178 695.5 178.672 695.5 179.5C695.5 180.328 696.172 181 697 181C697.828 181 698.5 180.328 698.5 179.5C698.5 178.672 697.828 178 697 178Z" fill="black"/>
+<path d="M697 160.15C697.58 160.15 698.049 160.62 698.05 161.199C698.05 161.613 697.81 161.97 697.463 162.141L698.05 165.4H695.95L696.536 162.14C696.189 161.968 695.95 161.612 695.95 161.199C695.95 160.62 696.42 160.15 697 160.15Z" fill="black"/>
+<rect x="687" y="154.7" width="20" height="15.8" rx="1" stroke="black" stroke-linejoin="round"/>
+<path d="M691 155V149C691 145.686 693.686 143 697 143C700.314 143 703 145.686 703 149V155" stroke="black" stroke-linejoin="round"/>
+<rect width="183" height="92" transform="translate(866 103)" fill="white"/>
+<path d="M880.208 128.24C879.269 128.24 878.4 128.021 877.6 127.584C876.811 127.147 876.176 126.501 875.696 125.648C875.216 124.784 874.976 123.717 874.976 122.448C874.976 121.499 875.115 120.667 875.392 119.952C875.669 119.227 876.048 118.624 876.528 118.144C877.019 117.653 877.579 117.285 878.208 117.04C878.837 116.795 879.504 116.672 880.208 116.672C881.157 116.672 882.027 116.891 882.816 117.328C883.605 117.755 884.24 118.4 884.72 119.264C885.2 120.117 885.44 121.179 885.44 122.448C885.44 123.717 885.2 124.784 884.72 125.648C884.24 126.501 883.605 127.147 882.816 127.584C882.027 128.021 881.157 128.24 880.208 128.24ZM880.208 127.12C881.008 127.12 881.701 126.933 882.288 126.56C882.875 126.176 883.328 125.637 883.648 124.944C883.968 124.24 884.128 123.408 884.128 122.448C884.128 121.488 883.968 120.661 883.648 119.968C883.328 119.264 882.875 118.725 882.288 118.352C881.701 117.979 881.008 117.792 880.208 117.792C879.408 117.792 878.715 117.979 878.128 118.352C877.541 118.725 877.088 119.264 876.768 119.968C876.448 120.661 876.288 121.488 876.288 122.448C876.288 123.408 876.448 124.24 876.768 124.944C877.088 125.637 877.541 126.176 878.128 126.56C878.715 126.933 879.408 127.12 880.208 127.12ZM890.47 128.176C889.766 128.176 889.211 128.053 888.806 127.808C888.401 127.563 888.113 127.195 887.942 126.704C887.782 126.213 887.702 125.6 887.702 124.864V117.312L888.902 117.104V119.712H892.15V120.72H888.902V124.96C888.902 125.547 888.966 125.995 889.094 126.304C889.233 126.613 889.425 126.827 889.67 126.944C889.926 127.051 890.225 127.104 890.566 127.104C890.971 127.104 891.307 127.056 891.574 126.96C891.851 126.864 892.07 126.779 892.23 126.704L892.486 127.68C892.326 127.776 892.059 127.883 891.686 128C891.323 128.117 890.918 128.176 890.47 128.176ZM894.047 128V115.792L895.247 115.584V119.92C895.556 119.803 895.882 119.712 896.223 119.648C896.575 119.584 896.916 119.552 897.247 119.552C898.122 119.552 898.799 119.712 899.279 120.032C899.759 120.352 900.095 120.8 900.287 121.376C900.49 121.941 900.591 122.603 900.591 123.36V128H899.391V123.696C899.391 122.939 899.322 122.336 899.183 121.888C899.044 121.44 898.81 121.115 898.479 120.912C898.148 120.709 897.684 120.608 897.087 120.608C896.863 120.608 896.618 120.635 896.351 120.688C896.095 120.731 895.866 120.779 895.663 120.832C895.46 120.885 895.322 120.928 895.247 120.96V128H894.047ZM906.82 128.176C905.849 128.176 905.06 127.989 904.452 127.616C903.854 127.243 903.412 126.731 903.124 126.08C902.846 125.429 902.708 124.688 902.708 123.856C902.708 122.885 902.884 122.08 903.236 121.44C903.588 120.8 904.041 120.32 904.596 120C905.161 119.68 905.753 119.52 906.372 119.52C907.065 119.52 907.662 119.669 908.164 119.968C908.676 120.256 909.07 120.704 909.348 121.312C909.625 121.909 909.764 122.672 909.764 123.6C909.764 123.675 909.758 123.765 909.748 123.872C909.748 123.968 909.742 124.059 909.732 124.144H903.956C903.998 125.083 904.249 125.813 904.708 126.336C905.177 126.848 905.902 127.104 906.884 127.104C907.428 127.104 907.87 127.056 908.212 126.96C908.564 126.853 908.814 126.763 908.964 126.688L909.172 127.696C909.022 127.781 908.729 127.883 908.292 128C907.865 128.117 907.374 128.176 906.82 128.176ZM903.988 123.168H908.548C908.537 122.624 908.446 122.16 908.276 121.776C908.105 121.381 907.86 121.083 907.54 120.88C907.23 120.667 906.846 120.56 906.388 120.56C905.918 120.56 905.508 120.683 905.156 120.928C904.804 121.173 904.526 121.493 904.324 121.888C904.132 122.283 904.02 122.709 903.988 123.168ZM912.016 128V120.096C912.293 119.979 912.672 119.861 913.152 119.744C913.643 119.616 914.229 119.552 914.912 119.552C915.136 119.552 915.355 119.568 915.568 119.6C915.792 119.621 915.989 119.653 916.16 119.696C916.341 119.728 916.475 119.76 916.56 119.792L916.32 120.816C916.224 120.773 916.043 120.731 915.776 120.688C915.509 120.635 915.168 120.608 914.752 120.608C914.347 120.608 914.011 120.64 913.744 120.704C913.477 120.757 913.301 120.805 913.216 120.848V128H912.016ZM921.735 128V119.712H922.935V128H921.735ZM922.343 117.728C922.108 117.728 921.905 117.648 921.735 117.488C921.575 117.328 921.495 117.115 921.495 116.848C921.495 116.592 921.575 116.384 921.735 116.224C921.905 116.064 922.108 115.984 922.343 115.984C922.577 115.984 922.775 116.064 922.935 116.224C923.105 116.384 923.191 116.592 923.191 116.848C923.191 117.115 923.105 117.328 922.935 117.488C922.775 117.648 922.577 117.728 922.343 117.728ZM929.241 128.192C928.431 128.192 927.716 128.021 927.097 127.68C926.479 127.328 925.999 126.832 925.657 126.192C925.316 125.541 925.145 124.768 925.145 123.872C925.145 123.019 925.289 122.267 925.577 121.616C925.876 120.965 926.303 120.459 926.857 120.096C927.423 119.723 928.1 119.536 928.889 119.536C929.401 119.536 929.849 119.611 930.233 119.76C930.628 119.899 930.921 120.037 931.113 120.176V115.792L932.297 115.584V127.744C932.095 127.808 931.844 127.877 931.545 127.952C931.247 128.016 930.905 128.069 930.521 128.112C930.148 128.165 929.721 128.192 929.241 128.192ZM929.257 127.12C929.727 127.12 930.111 127.099 930.409 127.056C930.719 127.003 930.953 126.955 931.113 126.912V121.296C930.932 121.147 930.655 120.997 930.281 120.848C929.908 120.688 929.487 120.608 929.017 120.608C928.537 120.608 928.127 120.693 927.785 120.864C927.455 121.024 927.183 121.253 926.969 121.552C926.767 121.851 926.617 122.197 926.521 122.592C926.436 122.987 926.393 123.408 926.393 123.856C926.393 124.549 926.511 125.141 926.745 125.632C926.991 126.112 927.327 126.48 927.753 126.736C928.191 126.992 928.692 127.12 929.257 127.12ZM938.617 128.176C937.646 128.176 936.857 127.989 936.249 127.616C935.651 127.243 935.209 126.731 934.921 126.08C934.643 125.429 934.505 124.688 934.505 123.856C934.505 122.885 934.681 122.08 935.033 121.44C935.385 120.8 935.838 120.32 936.393 120C936.958 119.68 937.55 119.52 938.169 119.52C938.862 119.52 939.459 119.669 939.961 119.968C940.473 120.256 940.867 120.704 941.145 121.312C941.422 121.909 941.561 122.672 941.561 123.6C941.561 123.675 941.555 123.765 941.545 123.872C941.545 123.968 941.539 124.059 941.529 124.144H935.753C935.795 125.083 936.046 125.813 936.505 126.336C936.974 126.848 937.699 127.104 938.681 127.104C939.225 127.104 939.667 127.056 940.009 126.96C940.361 126.853 940.611 126.763 940.761 126.688L940.969 127.696C940.819 127.781 940.526 127.883 940.089 128C939.662 128.117 939.171 128.176 938.617 128.176ZM935.785 123.168H940.345C940.334 122.624 940.243 122.16 940.073 121.776C939.902 121.381 939.657 121.083 939.337 120.88C939.027 120.667 938.643 120.56 938.185 120.56C937.715 120.56 937.305 120.683 936.953 120.928C936.601 121.173 936.323 121.493 936.121 121.888C935.929 122.283 935.817 122.709 935.785 123.168ZM943.813 128V120C944.143 119.915 944.575 119.819 945.109 119.712C945.642 119.605 946.282 119.552 947.029 119.552C947.893 119.552 948.565 119.712 949.045 120.032C949.525 120.352 949.861 120.8 950.053 121.376C950.255 121.941 950.357 122.603 950.357 123.36V128H949.157V123.696C949.157 122.939 949.087 122.336 948.949 121.888C948.81 121.44 948.575 121.115 948.245 120.912C947.914 120.709 947.455 120.608 946.869 120.608C946.421 120.608 946.026 120.635 945.685 120.688C945.343 120.741 945.119 120.784 945.013 120.816V128H943.813ZM955.657 128.176C954.953 128.176 954.399 128.053 953.993 127.808C953.588 127.563 953.3 127.195 953.129 126.704C952.969 126.213 952.889 125.6 952.889 124.864V117.312L954.089 117.104V119.712H957.337V120.72H954.089V124.96C954.089 125.547 954.153 125.995 954.281 126.304C954.42 126.613 954.612 126.827 954.857 126.944C955.113 127.051 955.412 127.104 955.753 127.104C956.159 127.104 956.495 127.056 956.761 126.96C957.039 126.864 957.257 126.779 957.417 126.704L957.673 127.68C957.513 127.776 957.247 127.883 956.873 128C956.511 128.117 956.105 128.176 955.657 128.176ZM959.235 128V119.712H960.435V128H959.235ZM959.843 117.728C959.608 117.728 959.405 117.648 959.235 117.488C959.075 117.328 958.995 117.115 958.995 116.848C958.995 116.592 959.075 116.384 959.235 116.224C959.405 116.064 959.608 115.984 959.843 115.984C960.077 115.984 960.275 116.064 960.435 116.224C960.605 116.384 960.691 116.592 960.691 116.848C960.691 117.115 960.605 117.328 960.435 117.488C960.275 117.648 960.077 117.728 959.843 117.728ZM965.829 128.176C965.125 128.176 964.571 128.053 964.165 127.808C963.76 127.563 963.472 127.195 963.301 126.704C963.141 126.213 963.061 125.6 963.061 124.864V117.312L964.261 117.104V119.712H967.509V120.72H964.261V124.96C964.261 125.547 964.325 125.995 964.453 126.304C964.592 126.613 964.784 126.827 965.029 126.944C965.285 127.051 965.584 127.104 965.925 127.104C966.331 127.104 966.667 127.056 966.933 126.96C967.211 126.864 967.429 126.779 967.589 126.704L967.845 127.68C967.685 127.776 967.419 127.883 967.045 128C966.683 128.117 966.277 128.176 965.829 128.176ZM969.31 131.008C969.043 131.008 968.793 130.976 968.558 130.912C968.323 130.848 968.169 130.795 968.094 130.752L968.334 129.776C968.398 129.808 968.531 129.851 968.734 129.904C968.937 129.968 969.139 130 969.342 130C969.737 130 970.073 129.941 970.35 129.824C970.627 129.707 970.873 129.509 971.086 129.232C971.299 128.955 971.497 128.581 971.678 128.112C971.219 127.269 970.782 126.379 970.366 125.44C969.961 124.501 969.587 123.547 969.246 122.576C968.905 121.605 968.617 120.651 968.382 119.712H969.646C969.763 120.213 969.907 120.752 970.078 121.328C970.259 121.904 970.457 122.501 970.67 123.12C970.894 123.739 971.139 124.368 971.406 125.008C971.673 125.637 971.955 126.261 972.254 126.88C972.553 126.037 972.814 125.243 973.038 124.496C973.262 123.739 973.47 122.976 973.662 122.208C973.854 121.429 974.051 120.597 974.254 119.712H975.454C975.219 120.736 974.958 121.749 974.67 122.752C974.393 123.755 974.094 124.72 973.774 125.648C973.465 126.565 973.134 127.435 972.782 128.256C972.515 128.896 972.233 129.419 971.934 129.824C971.635 130.229 971.278 130.528 970.862 130.72C970.457 130.912 969.939 131.008 969.31 131.008ZM980.797 130.96V120C981.01 119.925 981.261 119.856 981.549 119.792C981.848 119.728 982.189 119.675 982.573 119.632C982.957 119.579 983.384 119.552 983.853 119.552C984.674 119.552 985.394 119.728 986.013 120.08C986.632 120.421 987.112 120.917 987.453 121.568C987.794 122.208 987.965 122.976 987.965 123.872C987.965 124.715 987.816 125.461 987.517 126.112C987.229 126.763 986.808 127.275 986.253 127.648C985.698 128.011 985.021 128.192 984.221 128.192C983.709 128.192 983.256 128.123 982.861 127.984C982.477 127.835 982.189 127.691 981.997 127.552V130.96H980.797ZM984.077 127.12C984.557 127.12 984.962 127.04 985.293 126.88C985.634 126.709 985.906 126.475 986.109 126.176C986.322 125.877 986.472 125.536 986.557 125.152C986.653 124.757 986.701 124.336 986.701 123.888C986.701 123.195 986.584 122.603 986.349 122.112C986.114 121.621 985.778 121.248 985.341 120.992C984.914 120.736 984.413 120.608 983.837 120.608C983.368 120.608 982.978 120.635 982.669 120.688C982.37 120.731 982.146 120.773 981.997 120.816V126.432C982.178 126.571 982.456 126.72 982.829 126.88C983.202 127.04 983.618 127.12 984.077 127.12ZM990.157 128V120.096C990.434 119.979 990.813 119.861 991.293 119.744C991.783 119.616 992.37 119.552 993.053 119.552C993.277 119.552 993.495 119.568 993.709 119.6C993.933 119.621 994.13 119.653 994.301 119.696C994.482 119.728 994.615 119.76 994.701 119.792L994.461 120.816C994.365 120.773 994.183 120.731 993.917 120.688C993.65 120.635 993.309 120.608 992.893 120.608C992.487 120.608 992.151 120.64 991.885 120.704C991.618 120.757 991.442 120.805 991.357 120.848V128H990.157ZM999.531 128.192C998.795 128.192 998.139 128.016 997.563 127.664C996.987 127.301 996.534 126.795 996.203 126.144C995.883 125.493 995.723 124.731 995.723 123.856C995.723 122.981 995.883 122.224 996.203 121.584C996.534 120.933 996.987 120.427 997.563 120.064C998.139 119.701 998.795 119.52 999.531 119.52C1000.28 119.52 1000.94 119.701 1001.52 120.064C1002.09 120.427 1002.54 120.933 1002.86 121.584C1003.19 122.224 1003.36 122.981 1003.36 123.856C1003.36 124.731 1003.19 125.493 1002.86 126.144C1002.54 126.795 1002.09 127.301 1001.52 127.664C1000.95 128.016 1000.29 128.192 999.531 128.192ZM999.531 127.12C1000.06 127.12 1000.52 126.987 1000.91 126.72C1001.29 126.453 1001.58 126.075 1001.79 125.584C1002 125.093 1002.11 124.517 1002.11 123.856C1002.11 123.195 1002 122.619 1001.79 122.128C1001.58 121.637 1001.29 121.259 1000.91 120.992C1000.52 120.725 1000.06 120.592 999.531 120.592C999.009 120.592 998.555 120.725 998.171 120.992C997.787 121.259 997.489 121.637 997.275 122.128C997.073 122.619 996.971 123.195 996.971 123.856C996.971 124.517 997.073 125.093 997.275 125.584C997.489 126.075 997.787 126.453 998.171 126.72C998.555 126.987 999.009 127.12 999.531 127.12ZM1007.53 128C1007.26 127.435 1006.99 126.827 1006.72 126.176C1006.44 125.525 1006.17 124.848 1005.9 124.144C1005.63 123.44 1005.38 122.72 1005.13 121.984C1004.9 121.237 1004.68 120.48 1004.49 119.712H1005.76C1005.93 120.448 1006.14 121.243 1006.4 122.096C1006.66 122.939 1006.94 123.765 1007.24 124.576C1007.55 125.376 1007.85 126.08 1008.12 126.688C1008.34 126.24 1008.56 125.728 1008.78 125.152C1009 124.576 1009.22 123.979 1009.44 123.36C1009.65 122.731 1009.85 122.107 1010.03 121.488C1010.21 120.859 1010.36 120.267 1010.49 119.712H1011.69C1011.5 120.48 1011.28 121.237 1011.04 121.984C1010.8 122.72 1010.55 123.44 1010.28 124.144C1010.02 124.848 1009.74 125.525 1009.47 126.176C1009.2 126.827 1008.93 127.435 1008.65 128H1007.53ZM1013.34 128V119.712H1014.54V128H1013.34ZM1013.95 117.728C1013.72 117.728 1013.51 117.648 1013.34 117.488C1013.18 117.328 1013.1 117.115 1013.1 116.848C1013.1 116.592 1013.18 116.384 1013.34 116.224C1013.51 116.064 1013.72 115.984 1013.95 115.984C1014.19 115.984 1014.38 116.064 1014.54 116.224C1014.71 116.384 1014.8 116.592 1014.8 116.848C1014.8 117.115 1014.71 117.328 1014.54 117.488C1014.38 117.648 1014.19 117.728 1013.95 117.728ZM1020.85 128.192C1020.04 128.192 1019.33 128.021 1018.71 127.68C1018.09 127.328 1017.61 126.832 1017.27 126.192C1016.93 125.541 1016.75 124.768 1016.75 123.872C1016.75 123.019 1016.9 122.267 1017.19 121.616C1017.49 120.965 1017.91 120.459 1018.47 120.096C1019.03 119.723 1019.71 119.536 1020.5 119.536C1021.01 119.536 1021.46 119.611 1021.84 119.76C1022.24 119.899 1022.53 120.037 1022.72 120.176V115.792L1023.91 115.584V127.744C1023.7 127.808 1023.45 127.877 1023.15 127.952C1022.86 128.016 1022.51 128.069 1022.13 128.112C1021.76 128.165 1021.33 128.192 1020.85 128.192ZM1020.87 127.12C1021.34 127.12 1021.72 127.099 1022.02 127.056C1022.33 127.003 1022.56 126.955 1022.72 126.912V121.296C1022.54 121.147 1022.26 120.997 1021.89 120.848C1021.52 120.688 1021.1 120.608 1020.63 120.608C1020.15 120.608 1019.74 120.693 1019.39 120.864C1019.06 121.024 1018.79 121.253 1018.58 121.552C1018.38 121.851 1018.23 122.197 1018.13 122.592C1018.05 122.987 1018 123.408 1018 123.856C1018 124.549 1018.12 125.141 1018.35 125.632C1018.6 126.112 1018.94 126.48 1019.36 126.736C1019.8 126.992 1020.3 127.12 1020.87 127.12ZM1030.23 128.176C1029.26 128.176 1028.47 127.989 1027.86 127.616C1027.26 127.243 1026.82 126.731 1026.53 126.08C1026.25 125.429 1026.11 124.688 1026.11 123.856C1026.11 122.885 1026.29 122.08 1026.64 121.44C1026.99 120.8 1027.45 120.32 1028 120C1028.57 119.68 1029.16 119.52 1029.78 119.52C1030.47 119.52 1031.07 119.669 1031.57 119.968C1032.08 120.256 1032.48 120.704 1032.75 121.312C1033.03 121.909 1033.17 122.672 1033.17 123.6C1033.17 123.675 1033.16 123.765 1033.15 123.872C1033.15 123.968 1033.15 124.059 1033.14 124.144H1027.36C1027.4 125.083 1027.66 125.813 1028.11 126.336C1028.58 126.848 1029.31 127.104 1030.29 127.104C1030.83 127.104 1031.28 127.056 1031.62 126.96C1031.97 126.853 1032.22 126.763 1032.37 126.688L1032.58 127.696C1032.43 127.781 1032.14 127.883 1031.7 128C1031.27 128.117 1030.78 128.176 1030.23 128.176ZM1027.39 123.168H1031.95C1031.94 122.624 1031.85 122.16 1031.68 121.776C1031.51 121.381 1031.27 121.083 1030.95 120.88C1030.64 120.667 1030.25 120.56 1029.79 120.56C1029.32 120.56 1028.91 120.683 1028.56 120.928C1028.21 121.173 1027.93 121.493 1027.73 121.888C1027.54 122.283 1027.43 122.709 1027.39 123.168ZM1035.42 128V120.096C1035.7 119.979 1036.08 119.861 1036.56 119.744C1037.05 119.616 1037.64 119.552 1038.32 119.552C1038.54 119.552 1038.76 119.568 1038.97 119.6C1039.2 119.621 1039.4 119.653 1039.57 119.696C1039.75 119.728 1039.88 119.76 1039.97 119.792L1039.73 120.816C1039.63 120.773 1039.45 120.731 1039.18 120.688C1038.92 120.635 1038.57 120.608 1038.16 120.608C1037.75 120.608 1037.42 120.64 1037.15 120.704C1036.88 120.757 1036.71 120.805 1036.62 120.848V128H1035.42Z" fill="black"/>
+<path fill-rule="evenodd" clip-rule="evenodd" d="M901.186 149C906.196 149 910.217 153 910.217 157.923L910.211 158.143C910.187 158.652 910.094 159.147 910.093 159.154C915.041 159.216 919 163.154 919 168.077L918.988 168.536C918.747 173.246 914.822 177 909.969 177H886.031L885.564 176.988C880.928 176.757 877.245 173.094 877.012 168.536L877 168.077C877 163.954 879.784 160.352 883.866 159.429V157.984C883.866 154.908 886.402 152.446 889.495 152.446L889.749 152.452C891.017 152.51 892.22 152.996 893.206 153.861C894.752 150.908 897.845 149 901.186 149ZM901.186 150C898.224 150 895.469 151.695 894.092 154.325L893.502 155.452L892.547 154.613C891.674 153.847 890.608 153.446 889.495 153.446C886.935 153.446 884.866 155.479 884.866 157.984V160.228L884.087 160.403C880.472 161.221 878 164.409 878 168.077C878 172.439 881.564 176 886.031 176H909.969C914.436 176 918 172.439 918 168.077C918 163.713 914.493 160.208 910.08 160.153L908.888 160.139L909.11 158.967V158.965C909.111 158.962 909.112 158.956 909.113 158.948C909.116 158.933 909.121 158.91 909.126 158.88C909.136 158.819 909.149 158.73 909.163 158.626C909.191 158.411 909.217 158.151 909.217 157.923C909.217 153.562 905.653 150 901.186 150Z" fill="black"/>
+<rect width="144" height="92" transform="translate(665 203)" fill="white"/>
+<path d="M674.424 228V216.912H680.952V217.984H675.672V221.648H680.376V222.704H675.672V226.928H681.352V228H674.424ZM683.313 228V220C683.643 219.915 684.075 219.819 684.609 219.712C685.142 219.605 685.782 219.552 686.529 219.552C687.393 219.552 688.065 219.712 688.545 220.032C689.025 220.352 689.361 220.8 689.553 221.376C689.755 221.941 689.857 222.603 689.857 223.36V228H688.657V223.696C688.657 222.939 688.587 222.336 688.449 221.888C688.31 221.44 688.075 221.115 687.745 220.912C687.414 220.709 686.955 220.608 686.369 220.608C685.921 220.608 685.526 220.635 685.185 220.688C684.843 220.741 684.619 220.784 684.513 220.816V228H683.313ZM695.157 228.176C694.453 228.176 693.899 228.053 693.493 227.808C693.088 227.563 692.8 227.195 692.629 226.704C692.469 226.213 692.389 225.6 692.389 224.864V217.312L693.589 217.104V219.712H696.837V220.72H693.589V224.96C693.589 225.547 693.653 225.995 693.781 226.304C693.92 226.613 694.112 226.827 694.357 226.944C694.613 227.051 694.912 227.104 695.253 227.104C695.659 227.104 695.995 227.056 696.261 226.96C696.539 226.864 696.757 226.779 696.917 226.704L697.173 227.68C697.013 227.776 696.747 227.883 696.373 228C696.011 228.117 695.605 228.176 695.157 228.176ZM698.735 228V220.096C699.012 219.979 699.391 219.861 699.871 219.744C700.361 219.616 700.948 219.552 701.631 219.552C701.855 219.552 702.073 219.568 702.287 219.6C702.511 219.621 702.708 219.653 702.879 219.696C703.06 219.728 703.193 219.76 703.279 219.792L703.039 220.816C702.943 220.773 702.761 220.731 702.495 220.688C702.228 220.635 701.887 220.608 701.471 220.608C701.065 220.608 700.729 220.64 700.463 220.704C700.196 220.757 700.02 220.805 699.935 220.848V228H698.735ZM707.294 228.176C706.696 228.176 706.163 228.091 705.694 227.92C705.224 227.749 704.856 227.472 704.59 227.088C704.323 226.704 704.19 226.197 704.19 225.568C704.19 224.96 704.339 224.469 704.638 224.096C704.936 223.712 705.347 223.435 705.87 223.264C706.403 223.093 707 223.008 707.661 223.008C707.96 223.008 708.275 223.035 708.606 223.088C708.936 223.141 709.144 223.189 709.23 223.232V222.752C709.23 222.389 709.182 222.043 709.086 221.712C709 221.371 708.819 221.093 708.542 220.88C708.264 220.667 707.843 220.56 707.278 220.56C706.691 220.56 706.243 220.603 705.934 220.688C705.624 220.773 705.395 220.843 705.246 220.896L705.086 219.872C705.278 219.787 705.571 219.707 705.966 219.632C706.36 219.557 706.824 219.52 707.358 219.52C708.115 219.52 708.712 219.653 709.15 219.92C709.598 220.187 709.918 220.555 710.11 221.024C710.312 221.483 710.414 222.011 710.414 222.608V227.808C710.19 227.861 709.79 227.936 709.214 228.032C708.638 228.128 707.998 228.176 707.294 228.176ZM707.47 227.152C707.843 227.152 708.179 227.141 708.478 227.12C708.776 227.088 709.027 227.051 709.23 227.008V224.224C709.123 224.171 708.942 224.117 708.686 224.064C708.43 224.011 708.099 223.984 707.694 223.984C707.352 223.984 707.006 224.021 706.654 224.096C706.302 224.171 706.003 224.32 705.758 224.544C705.523 224.768 705.406 225.104 705.406 225.552C705.406 226.149 705.592 226.565 705.966 226.8C706.339 227.035 706.84 227.152 707.47 227.152ZM716.737 228V216.912H717.985V228H716.737ZM723.598 228.096C723.15 228.096 722.676 228.075 722.174 228.032C721.673 227.989 721.225 227.915 720.83 227.808V217.12C721.225 217.013 721.673 216.939 722.174 216.896C722.686 216.843 723.166 216.816 723.614 216.816C724.82 216.816 725.881 217.024 726.798 217.44C727.716 217.845 728.43 218.464 728.942 219.296C729.465 220.128 729.726 221.179 729.726 222.448C729.726 223.707 729.465 224.757 728.942 225.6C728.43 226.432 727.716 227.056 726.798 227.472C725.881 227.888 724.814 228.096 723.598 228.096ZM723.726 227.024C725.284 227.024 726.452 226.619 727.23 225.808C728.02 224.987 728.414 223.867 728.414 222.448C728.414 221.029 728.025 219.915 727.246 219.104C726.468 218.293 725.3 217.888 723.742 217.888C723.22 217.888 722.83 217.904 722.574 217.936C722.318 217.968 722.153 217.989 722.078 218V226.912C722.153 226.923 722.313 226.944 722.558 226.976C722.804 227.008 723.193 227.024 723.726 227.024ZM738.759 228.192C738.29 228.192 737.863 228.165 737.479 228.112C737.095 228.069 736.754 228.016 736.455 227.952C736.167 227.877 735.917 227.808 735.703 227.744V215.792L736.903 215.584V220.176C737.095 220.037 737.383 219.899 737.767 219.76C738.162 219.611 738.615 219.536 739.127 219.536C739.927 219.536 740.605 219.723 741.159 220.096C741.714 220.459 742.135 220.965 742.423 221.616C742.722 222.267 742.871 223.013 742.871 223.856C742.871 224.752 742.701 225.525 742.359 226.176C742.018 226.816 741.538 227.312 740.919 227.664C740.301 228.016 739.581 228.192 738.759 228.192ZM738.743 227.12C739.319 227.12 739.821 226.992 740.247 226.736C740.685 226.48 741.021 226.112 741.255 225.632C741.49 225.141 741.607 224.549 741.607 223.856C741.607 223.408 741.559 222.987 741.463 222.592C741.378 222.197 741.229 221.851 741.015 221.552C740.813 221.253 740.541 221.024 740.199 220.864C739.869 220.693 739.463 220.608 738.983 220.608C738.525 220.608 738.109 220.688 737.735 220.848C737.362 220.997 737.085 221.147 736.903 221.296V226.912C737.053 226.955 737.277 227.003 737.575 227.056C737.885 227.099 738.274 227.12 738.743 227.12ZM745.063 228V220.096C745.34 219.979 745.719 219.861 746.199 219.744C746.689 219.616 747.276 219.552 747.959 219.552C748.183 219.552 748.401 219.568 748.615 219.6C748.839 219.621 749.036 219.653 749.207 219.696C749.388 219.728 749.521 219.76 749.607 219.792L749.367 220.816C749.271 220.773 749.089 220.731 748.823 220.688C748.556 220.635 748.215 220.608 747.799 220.608C747.393 220.608 747.057 220.64 746.791 220.704C746.524 220.757 746.348 220.805 746.263 220.848V228H745.063ZM754.438 228.192C753.702 228.192 753.046 228.016 752.47 227.664C751.894 227.301 751.44 226.795 751.11 226.144C750.79 225.493 750.63 224.731 750.63 223.856C750.63 222.981 750.79 222.224 751.11 221.584C751.44 220.933 751.894 220.427 752.47 220.064C753.046 219.701 753.702 219.52 754.438 219.52C755.184 219.52 755.846 219.701 756.422 220.064C756.998 220.427 757.446 220.933 757.766 221.584C758.096 222.224 758.262 222.981 758.262 223.856C758.262 224.731 758.096 225.493 757.766 226.144C757.446 226.795 756.998 227.301 756.422 227.664C755.856 228.016 755.195 228.192 754.438 228.192ZM754.438 227.12C754.971 227.12 755.43 226.987 755.814 226.72C756.198 226.453 756.491 226.075 756.694 225.584C756.907 225.093 757.014 224.517 757.014 223.856C757.014 223.195 756.907 222.619 756.694 222.128C756.491 221.637 756.198 221.259 755.814 220.992C755.43 220.725 754.971 220.592 754.438 220.592C753.915 220.592 753.462 220.725 753.078 220.992C752.694 221.259 752.395 221.637 752.182 222.128C751.979 222.619 751.878 223.195 751.878 223.856C751.878 224.517 751.979 225.093 752.182 225.584C752.395 226.075 752.694 226.453 753.078 226.72C753.462 226.987 753.915 227.12 754.438 227.12ZM760.469 228V215.792L761.669 215.584V223.36C761.925 223.104 762.213 222.816 762.533 222.496C762.853 222.176 763.178 221.845 763.509 221.504C763.84 221.163 764.149 220.837 764.437 220.528C764.725 220.219 764.97 219.947 765.173 219.712H766.597C766.277 220.053 765.898 220.448 765.461 220.896C765.034 221.344 764.597 221.797 764.149 222.256C763.712 222.704 763.306 223.109 762.933 223.472C763.274 223.707 763.626 224.005 763.989 224.368C764.362 224.72 764.73 225.104 765.093 225.52C765.456 225.936 765.792 226.357 766.101 226.784C766.421 227.211 766.693 227.616 766.917 228H765.525C765.205 227.456 764.821 226.923 764.373 226.4C763.925 225.867 763.466 225.381 762.997 224.944C762.528 224.507 762.085 224.155 761.669 223.888V228H760.469ZM771.914 228.176C770.943 228.176 770.154 227.989 769.546 227.616C768.948 227.243 768.506 226.731 768.218 226.08C767.94 225.429 767.802 224.688 767.802 223.856C767.802 222.885 767.978 222.08 768.33 221.44C768.682 220.8 769.135 220.32 769.69 220C770.255 219.68 770.847 219.52 771.466 219.52C772.159 219.52 772.756 219.669 773.258 219.968C773.77 220.256 774.164 220.704 774.442 221.312C774.719 221.909 774.858 222.672 774.858 223.6C774.858 223.675 774.852 223.765 774.842 223.872C774.842 223.968 774.836 224.059 774.826 224.144H769.049C769.092 225.083 769.343 225.813 769.802 226.336C770.271 226.848 770.996 227.104 771.978 227.104C772.522 227.104 772.964 227.056 773.306 226.96C773.658 226.853 773.908 226.763 774.058 226.688L774.266 227.696C774.116 227.781 773.823 227.883 773.386 228C772.959 228.117 772.468 228.176 771.914 228.176ZM769.082 223.168H773.642C773.631 222.624 773.54 222.16 773.37 221.776C773.199 221.381 772.954 221.083 772.634 220.88C772.324 220.667 771.94 220.56 771.482 220.56C771.012 220.56 770.602 220.683 770.25 220.928C769.898 221.173 769.62 221.493 769.418 221.888C769.226 222.283 769.114 222.709 769.082 223.168ZM777.11 228V220.096C777.387 219.979 777.766 219.861 778.246 219.744C778.736 219.616 779.323 219.552 780.006 219.552C780.23 219.552 780.448 219.568 780.662 219.6C780.886 219.621 781.083 219.653 781.254 219.696C781.435 219.728 781.568 219.76 781.654 219.792L781.414 220.816C781.318 220.773 781.136 220.731 780.87 220.688C780.603 220.635 780.262 220.608 779.846 220.608C779.44 220.608 779.104 220.64 778.838 220.704C778.571 220.757 778.395 220.805 778.31 220.848V228H777.11Z" fill="black"/>
+<path d="M693.032 279C693.012 279.164 693 279.331 693 279.5C693 279.669 693.012 279.836 693.032 280H682V279H693.032ZM712 279V280H700.968C700.988 279.836 701 279.669 701 279.5C701 279.331 700.988 279.164 700.968 279H712ZM697.5 275.531C697.336 275.511 697.169 275.5 697 275.5C696.831 275.5 696.664 275.511 696.5 275.531V271H697.5V275.531Z" fill="black"/>
+<path d="M697 277C698.381 277 699.5 278.119 699.5 279.5C699.5 280.881 698.381 282 697 282C695.619 282 694.5 280.881 694.5 279.5C694.5 278.119 695.619 277 697 277ZM697 278C696.172 278 695.5 278.672 695.5 279.5C695.5 280.328 696.172 281 697 281C697.828 281 698.5 280.328 698.5 279.5C698.5 278.672 697.828 278 697 278Z" fill="black"/>
+<path d="M697 260.15C697.58 260.15 698.049 260.62 698.05 261.199C698.05 261.613 697.81 261.97 697.463 262.141L698.05 265.4H695.95L696.536 262.14C696.189 261.968 695.95 261.612 695.95 261.199C695.95 260.62 696.42 260.15 697 260.15Z" fill="black"/>
+<rect x="687" y="254.7" width="20" height="15.8" rx="1" stroke="black" stroke-linejoin="round"/>
+<path d="M691 255V249C691 245.686 693.686 243 697 243C700.314 243 703 245.686 703 249V255" stroke="black" stroke-linejoin="round"/>
+<rect width="183" height="92" transform="translate(866 203)" fill="white"/>
+<path d="M875.424 228V216.912H881.952V217.984H876.672V221.648H881.376V222.704H876.672V226.928H882.352V228H875.424ZM884.313 228V220C884.643 219.915 885.075 219.819 885.609 219.712C886.142 219.605 886.782 219.552 887.529 219.552C888.393 219.552 889.065 219.712 889.545 220.032C890.025 220.352 890.361 220.8 890.553 221.376C890.755 221.941 890.857 222.603 890.857 223.36V228H889.657V223.696C889.657 222.939 889.587 222.336 889.449 221.888C889.31 221.44 889.075 221.115 888.745 220.912C888.414 220.709 887.955 220.608 887.369 220.608C886.921 220.608 886.526 220.635 886.185 220.688C885.843 220.741 885.619 220.784 885.513 220.816V228H884.313ZM896.157 228.176C895.453 228.176 894.899 228.053 894.493 227.808C894.088 227.563 893.8 227.195 893.629 226.704C893.469 226.213 893.389 225.6 893.389 224.864V217.312L894.589 217.104V219.712H897.837V220.72H894.589V224.96C894.589 225.547 894.653 225.995 894.781 226.304C894.92 226.613 895.112 226.827 895.357 226.944C895.613 227.051 895.912 227.104 896.253 227.104C896.659 227.104 896.995 227.056 897.261 226.96C897.539 226.864 897.757 226.779 897.917 226.704L898.173 227.68C898.013 227.776 897.747 227.883 897.373 228C897.011 228.117 896.605 228.176 896.157 228.176ZM899.735 228V220.096C900.012 219.979 900.391 219.861 900.871 219.744C901.361 219.616 901.948 219.552 902.631 219.552C902.855 219.552 903.073 219.568 903.287 219.6C903.511 219.621 903.708 219.653 903.879 219.696C904.06 219.728 904.193 219.76 904.279 219.792L904.039 220.816C903.943 220.773 903.761 220.731 903.495 220.688C903.228 220.635 902.887 220.608 902.471 220.608C902.065 220.608 901.729 220.64 901.463 220.704C901.196 220.757 901.02 220.805 900.935 220.848V228H899.735ZM908.294 228.176C907.696 228.176 907.163 228.091 906.694 227.92C906.224 227.749 905.856 227.472 905.59 227.088C905.323 226.704 905.19 226.197 905.19 225.568C905.19 224.96 905.339 224.469 905.638 224.096C905.936 223.712 906.347 223.435 906.87 223.264C907.403 223.093 908 223.008 908.661 223.008C908.96 223.008 909.275 223.035 909.606 223.088C909.936 223.141 910.144 223.189 910.23 223.232V222.752C910.23 222.389 910.182 222.043 910.086 221.712C910 221.371 909.819 221.093 909.542 220.88C909.264 220.667 908.843 220.56 908.278 220.56C907.691 220.56 907.243 220.603 906.934 220.688C906.624 220.773 906.395 220.843 906.246 220.896L906.086 219.872C906.278 219.787 906.571 219.707 906.966 219.632C907.36 219.557 907.824 219.52 908.358 219.52C909.115 219.52 909.712 219.653 910.15 219.92C910.598 220.187 910.918 220.555 911.11 221.024C911.312 221.483 911.414 222.011 911.414 222.608V227.808C911.19 227.861 910.79 227.936 910.214 228.032C909.638 228.128 908.998 228.176 908.294 228.176ZM908.47 227.152C908.843 227.152 909.179 227.141 909.478 227.12C909.776 227.088 910.027 227.051 910.23 227.008V224.224C910.123 224.171 909.942 224.117 909.686 224.064C909.43 224.011 909.099 223.984 908.694 223.984C908.352 223.984 908.006 224.021 907.654 224.096C907.302 224.171 907.003 224.32 906.758 224.544C906.523 224.768 906.406 225.104 906.406 225.552C906.406 226.149 906.592 226.565 906.966 226.8C907.339 227.035 907.84 227.152 908.47 227.152ZM917.737 228V216.912H918.985V228H917.737ZM924.598 228.096C924.15 228.096 923.676 228.075 923.174 228.032C922.673 227.989 922.225 227.915 921.83 227.808V217.12C922.225 217.013 922.673 216.939 923.174 216.896C923.686 216.843 924.166 216.816 924.614 216.816C925.82 216.816 926.881 217.024 927.798 217.44C928.716 217.845 929.43 218.464 929.942 219.296C930.465 220.128 930.726 221.179 930.726 222.448C930.726 223.707 930.465 224.757 929.942 225.6C929.43 226.432 928.716 227.056 927.798 227.472C926.881 227.888 925.814 228.096 924.598 228.096ZM924.726 227.024C926.284 227.024 927.452 226.619 928.23 225.808C929.02 224.987 929.414 223.867 929.414 222.448C929.414 221.029 929.025 219.915 928.246 219.104C927.468 218.293 926.3 217.888 924.742 217.888C924.22 217.888 923.83 217.904 923.574 217.936C923.318 217.968 923.153 217.989 923.078 218V226.912C923.153 226.923 923.313 226.944 923.558 226.976C923.804 227.008 924.193 227.024 924.726 227.024Z" fill="black"/>
+<path fill-rule="evenodd" clip-rule="evenodd" d="M901.186 249C906.196 249 910.217 253 910.217 257.923L910.211 258.143C910.187 258.652 910.094 259.147 910.093 259.154C915.041 259.216 919 263.154 919 268.077L918.988 268.536C918.747 273.246 914.822 277 909.969 277H886.031L885.564 276.988C880.928 276.757 877.245 273.094 877.012 268.536L877 268.077C877 263.954 879.784 260.352 883.866 259.429V257.984C883.866 254.908 886.402 252.446 889.495 252.446L889.749 252.452C891.017 252.51 892.22 252.996 893.206 253.861C894.752 250.908 897.845 249 901.186 249ZM901.186 250C898.224 250 895.469 251.695 894.092 254.325L893.502 255.452L892.547 254.613C891.674 253.847 890.608 253.446 889.495 253.446C886.935 253.446 884.866 255.479 884.866 257.984V260.228L884.087 260.403C880.472 261.221 878 264.409 878 268.077C878 272.439 881.564 276 886.031 276H909.969C914.436 276 918 272.439 918 268.077C918 263.713 914.493 260.208 910.08 260.153L908.888 260.139L909.11 258.967V258.965C909.111 258.962 909.112 258.956 909.113 258.948C909.116 258.933 909.121 258.91 909.126 258.88C909.136 258.819 909.149 258.73 909.163 258.626C909.191 258.411 909.217 258.151 909.217 257.923C909.217 253.562 905.653 250 901.186 250Z" fill="black"/>
+<rect width="144" height="92" transform="translate(263 303)" fill="white"/>
+<path d="M272.424 328V316.912H273.416C273.843 317.371 274.291 317.893 274.76 318.48C275.229 319.067 275.699 319.68 276.168 320.32C276.648 320.949 277.112 321.584 277.56 322.224C278.008 322.864 278.419 323.477 278.792 324.064C279.176 324.651 279.501 325.179 279.768 325.648V316.912H281V328H279.96C279.715 327.552 279.4 327.024 279.016 326.416C278.632 325.797 278.211 325.147 277.752 324.464C277.293 323.771 276.819 323.083 276.328 322.4C275.848 321.707 275.373 321.061 274.904 320.464C274.445 319.856 274.029 319.333 273.656 318.896V328H272.424ZM286.294 328.24C285.43 328.24 284.71 328.144 284.134 327.952C283.569 327.76 283.179 327.6 282.966 327.472L283.366 326.416C283.59 326.544 283.947 326.699 284.438 326.88C284.939 327.061 285.558 327.152 286.294 327.152C287.137 327.152 287.787 327.003 288.246 326.704C288.705 326.395 288.934 325.909 288.934 325.248C288.934 324.736 288.806 324.336 288.55 324.048C288.305 323.749 287.974 323.509 287.558 323.328C287.153 323.136 286.705 322.944 286.214 322.752C285.617 322.517 285.094 322.272 284.646 322.016C284.209 321.749 283.867 321.429 283.622 321.056C283.387 320.672 283.27 320.192 283.27 319.616C283.27 318.976 283.414 318.437 283.702 318C283.99 317.563 284.406 317.232 284.95 317.008C285.494 316.784 286.139 316.672 286.886 316.672C287.505 316.672 288.075 316.752 288.598 316.912C289.131 317.061 289.542 317.227 289.83 317.408L289.414 318.448C289.105 318.235 288.726 318.064 288.278 317.936C287.841 317.808 287.371 317.744 286.87 317.744C286.187 317.744 285.627 317.883 285.19 318.16C284.753 318.437 284.534 318.891 284.534 319.52C284.534 319.947 284.641 320.293 284.854 320.56C285.067 320.827 285.361 321.051 285.734 321.232C286.107 321.413 286.529 321.6 286.998 321.792C287.606 322.027 288.15 322.277 288.63 322.544C289.121 322.8 289.51 323.136 289.798 323.552C290.086 323.957 290.23 324.507 290.23 325.2C290.23 325.872 290.07 326.432 289.75 326.88C289.43 327.328 288.977 327.669 288.39 327.904C287.803 328.128 287.105 328.24 286.294 328.24ZM294.685 328.24C293.821 328.24 293.101 328.144 292.525 327.952C291.959 327.76 291.57 327.6 291.357 327.472L291.757 326.416C291.981 326.544 292.338 326.699 292.829 326.88C293.33 327.061 293.949 327.152 294.685 327.152C295.527 327.152 296.178 327.003 296.637 326.704C297.095 326.395 297.325 325.909 297.325 325.248C297.325 324.736 297.197 324.336 296.941 324.048C296.695 323.749 296.365 323.509 295.949 323.328C295.543 323.136 295.095 322.944 294.605 322.752C294.007 322.517 293.485 322.272 293.037 322.016C292.599 321.749 292.258 321.429 292.013 321.056C291.778 320.672 291.661 320.192 291.661 319.616C291.661 318.976 291.805 318.437 292.093 318C292.381 317.563 292.797 317.232 293.341 317.008C293.885 316.784 294.53 316.672 295.277 316.672C295.895 316.672 296.466 316.752 296.989 316.912C297.522 317.061 297.933 317.227 298.221 317.408L297.805 318.448C297.495 318.235 297.117 318.064 296.669 317.936C296.231 317.808 295.762 317.744 295.261 317.744C294.578 317.744 294.018 317.883 293.581 318.16C293.143 318.437 292.924 318.891 292.924 319.52C292.924 319.947 293.031 320.293 293.245 320.56C293.458 320.827 293.751 321.051 294.125 321.232C294.498 321.413 294.919 321.6 295.389 321.792C295.997 322.027 296.541 322.277 297.021 322.544C297.511 322.8 297.901 323.136 298.189 323.552C298.477 323.957 298.621 324.507 298.621 325.2C298.621 325.872 298.461 326.432 298.141 326.88C297.821 327.328 297.367 327.669 296.781 327.904C296.194 328.128 295.495 328.24 294.685 328.24ZM304.203 328V320C304.534 319.915 304.955 319.819 305.467 319.712C305.979 319.605 306.614 319.552 307.371 319.552C307.905 319.552 308.358 319.627 308.731 319.776C309.115 319.925 309.425 320.149 309.659 320.448C309.755 320.373 309.926 320.267 310.171 320.128C310.417 319.979 310.726 319.845 311.099 319.728C311.483 319.611 311.915 319.552 312.395 319.552C313.249 319.552 313.889 319.717 314.315 320.048C314.753 320.368 315.046 320.816 315.195 321.392C315.345 321.957 315.419 322.613 315.419 323.36V328H314.219V323.696C314.219 322.992 314.171 322.416 314.075 321.968C313.979 321.509 313.793 321.168 313.515 320.944C313.238 320.72 312.827 320.608 312.283 320.608C311.889 320.608 311.542 320.656 311.243 320.752C310.955 320.837 310.715 320.939 310.523 321.056C310.342 321.173 310.209 321.264 310.123 321.328C310.219 321.595 310.289 321.899 310.331 322.24C310.385 322.581 310.411 322.939 310.411 323.312V328H309.211V323.696C309.211 322.992 309.163 322.416 309.067 321.968C308.971 321.509 308.779 321.168 308.491 320.944C308.214 320.72 307.793 320.608 307.227 320.608C306.918 320.608 306.635 320.624 306.379 320.656C306.134 320.677 305.926 320.704 305.755 320.736C305.595 320.768 305.478 320.795 305.403 320.816V328H304.203ZM321.344 328.192C320.608 328.192 319.952 328.016 319.376 327.664C318.8 327.301 318.347 326.795 318.016 326.144C317.696 325.493 317.536 324.731 317.536 323.856C317.536 322.981 317.696 322.224 318.016 321.584C318.347 320.933 318.8 320.427 319.376 320.064C319.952 319.701 320.608 319.52 321.344 319.52C322.091 319.52 322.752 319.701 323.328 320.064C323.904 320.427 324.352 320.933 324.672 321.584C325.003 322.224 325.168 322.981 325.168 323.856C325.168 324.731 325.003 325.493 324.672 326.144C324.352 326.795 323.904 327.301 323.328 327.664C322.763 328.016 322.101 328.192 321.344 328.192ZM321.344 327.12C321.877 327.12 322.336 326.987 322.72 326.72C323.104 326.453 323.397 326.075 323.6 325.584C323.813 325.093 323.92 324.517 323.92 323.856C323.92 323.195 323.813 322.619 323.6 322.128C323.397 321.637 323.104 321.259 322.72 320.992C322.336 320.725 321.877 320.592 321.344 320.592C320.821 320.592 320.368 320.725 319.984 320.992C319.6 321.259 319.301 321.637 319.088 322.128C318.885 322.619 318.784 323.195 318.784 323.856C318.784 324.517 318.885 325.093 319.088 325.584C319.301 326.075 319.6 326.453 319.984 326.72C320.368 326.987 320.821 327.12 321.344 327.12ZM330.991 328.192C330.181 328.192 329.466 328.021 328.847 327.68C328.229 327.328 327.749 326.832 327.407 326.192C327.066 325.541 326.895 324.768 326.895 323.872C326.895 323.019 327.039 322.267 327.327 321.616C327.626 320.965 328.053 320.459 328.607 320.096C329.173 319.723 329.85 319.536 330.639 319.536C331.151 319.536 331.599 319.611 331.983 319.76C332.378 319.899 332.671 320.037 332.863 320.176V315.792L334.047 315.584V327.744C333.845 327.808 333.594 327.877 333.295 327.952C332.997 328.016 332.655 328.069 332.271 328.112C331.898 328.165 331.471 328.192 330.991 328.192ZM331.007 327.12C331.477 327.12 331.861 327.099 332.159 327.056C332.469 327.003 332.703 326.955 332.863 326.912V321.296C332.682 321.147 332.405 320.997 332.031 320.848C331.658 320.688 331.237 320.608 330.767 320.608C330.287 320.608 329.877 320.693 329.535 320.864C329.205 321.024 328.933 321.253 328.719 321.552C328.517 321.851 328.367 322.197 328.271 322.592C328.186 322.987 328.143 323.408 328.143 323.856C328.143 324.549 328.261 325.141 328.495 325.632C328.741 326.112 329.077 326.48 329.503 326.736C329.941 326.992 330.442 327.12 331.007 327.12ZM339.967 328.16C339.135 328.16 338.473 328.005 337.983 327.696C337.503 327.376 337.156 326.928 336.943 326.352C336.74 325.776 336.639 325.109 336.639 324.352V319.712H337.839V324.032C337.839 324.779 337.913 325.376 338.063 325.824C338.212 326.272 338.452 326.597 338.783 326.8C339.124 326.992 339.572 327.088 340.127 327.088C340.575 327.088 340.969 327.067 341.311 327.024C341.663 326.971 341.892 326.928 341.999 326.896V319.712H343.183V327.712C342.863 327.797 342.431 327.893 341.887 328C341.353 328.107 340.713 328.16 339.967 328.16ZM348.115 328.144C347.603 328.123 347.177 328.037 346.835 327.888C346.505 327.739 346.259 327.509 346.099 327.2C345.939 326.88 345.859 326.453 345.859 325.92V315.792L347.059 315.584V325.84C347.059 326.352 347.15 326.683 347.331 326.832C347.523 326.981 347.843 327.088 348.291 327.152L348.115 328.144ZM353.695 328.176C352.724 328.176 351.935 327.989 351.327 327.616C350.729 327.243 350.287 326.731 349.999 326.08C349.721 325.429 349.583 324.688 349.583 323.856C349.583 322.885 349.759 322.08 350.111 321.44C350.463 320.8 350.916 320.32 351.471 320C352.036 319.68 352.628 319.52 353.247 319.52C353.94 319.52 354.537 319.669 355.039 319.968C355.551 320.256 355.945 320.704 356.223 321.312C356.5 321.909 356.639 322.672 356.639 323.6C356.639 323.675 356.633 323.765 356.623 323.872C356.623 323.968 356.617 324.059 356.607 324.144H350.831C350.873 325.083 351.124 325.813 351.583 326.336C352.052 326.848 352.777 327.104 353.759 327.104C354.303 327.104 354.745 327.056 355.087 326.96C355.439 326.853 355.689 326.763 355.839 326.688L356.047 327.696C355.897 327.781 355.604 327.883 355.167 328C354.74 328.117 354.249 328.176 353.695 328.176ZM350.863 323.168H355.423C355.412 322.624 355.321 322.16 355.151 321.776C354.98 321.381 354.735 321.083 354.415 320.88C354.105 320.667 353.721 320.56 353.263 320.56C352.793 320.56 352.383 320.683 352.031 320.928C351.679 321.173 351.401 321.493 351.199 321.888C351.007 322.283 350.895 322.709 350.863 323.168Z" fill="black"/>
+<path d="M303.76 348.703L312.505 353.543V372.884L303.76 377.724L294.999 382.572L286.24 377.724L277.495 372.884V353.542L286.24 348.703L294.999 343.854L303.76 348.703Z" stroke="black" stroke-width="0.99"/>
+<path d="M277.942 353.841L295 363.354M295 363.354L312.058 353.841M295 363.354V382.053" stroke="black"/>
+<rect width="144" height="92" transform="translate(665 303)" fill="white"/>
+<path d="M679.08 328.24C678.109 328.24 677.235 328.016 676.456 327.568C675.688 327.12 675.08 326.469 674.632 325.616C674.195 324.752 673.976 323.696 673.976 322.448C673.976 321.52 674.115 320.699 674.392 319.984C674.669 319.259 675.048 318.651 675.528 318.16C676.019 317.669 676.573 317.301 677.192 317.056C677.821 316.8 678.477 316.672 679.16 316.672C679.725 316.672 680.216 316.72 680.632 316.816C681.059 316.901 681.411 317.003 681.688 317.12C681.965 317.237 682.168 317.339 682.296 317.424L681.896 318.48C681.629 318.32 681.283 318.165 680.856 318.016C680.44 317.867 679.933 317.792 679.336 317.792C678.461 317.792 677.72 317.989 677.112 318.384C676.515 318.768 676.061 319.312 675.752 320.016C675.443 320.709 675.288 321.525 675.288 322.464C675.288 323.403 675.437 324.224 675.736 324.928C676.035 325.621 676.472 326.16 677.048 326.544C677.635 326.928 678.349 327.12 679.192 327.12C679.896 327.12 680.483 327.056 680.952 326.928C681.421 326.789 681.784 326.651 682.04 326.512L682.376 327.568C682.205 327.675 681.832 327.813 681.256 327.984C680.691 328.155 679.965 328.24 679.08 328.24ZM687.248 328.16C686.416 328.16 685.755 328.005 685.264 327.696C684.784 327.376 684.437 326.928 684.224 326.352C684.021 325.776 683.92 325.109 683.92 324.352V319.712H685.12V324.032C685.12 324.779 685.195 325.376 685.344 325.824C685.493 326.272 685.733 326.597 686.064 326.8C686.405 326.992 686.853 327.088 687.408 327.088C687.856 327.088 688.251 327.067 688.592 327.024C688.944 326.971 689.173 326.928 689.28 326.896V319.712H690.464V327.712C690.144 327.797 689.712 327.893 689.168 328C688.635 328.107 687.995 328.16 687.248 328.16ZM694.933 328.192C694.218 328.192 693.658 328.128 693.253 328C692.858 327.883 692.591 327.792 692.453 327.728L692.741 326.672C692.858 326.715 693.098 326.805 693.461 326.944C693.823 327.083 694.314 327.152 694.933 327.152C695.519 327.152 695.994 327.061 696.357 326.88C696.719 326.699 696.901 326.384 696.901 325.936C696.901 325.648 696.837 325.419 696.709 325.248C696.581 325.067 696.373 324.901 696.085 324.752C695.807 324.603 695.423 324.432 694.933 324.24C694.517 324.069 694.133 323.888 693.781 323.696C693.429 323.504 693.141 323.259 692.917 322.96C692.703 322.661 692.597 322.277 692.597 321.808C692.597 321.349 692.714 320.949 692.949 320.608C693.183 320.267 693.514 320 693.941 319.808C694.378 319.616 694.895 319.52 695.493 319.52C696.047 319.52 696.517 319.568 696.901 319.664C697.285 319.76 697.557 319.845 697.717 319.92L697.445 320.96C697.306 320.885 697.082 320.8 696.773 320.704C696.463 320.597 696.026 320.544 695.461 320.544C695.013 320.544 694.623 320.64 694.293 320.832C693.962 321.013 693.797 321.307 693.797 321.712C693.797 322 693.866 322.235 694.005 322.416C694.143 322.587 694.351 322.741 694.629 322.88C694.906 323.019 695.247 323.168 695.653 323.328C696.111 323.509 696.522 323.701 696.885 323.904C697.258 324.096 697.557 324.347 697.781 324.656C698.005 324.965 698.117 325.376 698.117 325.888C698.117 326.389 697.989 326.816 697.733 327.168C697.477 327.509 697.109 327.765 696.629 327.936C696.159 328.107 695.594 328.192 694.933 328.192ZM702.798 328.176C702.094 328.176 701.539 328.053 701.134 327.808C700.729 327.563 700.441 327.195 700.27 326.704C700.11 326.213 700.03 325.6 700.03 324.864V317.312L701.23 317.104V319.712H704.478V320.72H701.23V324.96C701.23 325.547 701.294 325.995 701.422 326.304C701.561 326.613 701.753 326.827 701.998 326.944C702.254 327.051 702.553 327.104 702.894 327.104C703.299 327.104 703.635 327.056 703.902 326.96C704.179 326.864 704.398 326.779 704.558 326.704L704.814 327.68C704.654 327.776 704.387 327.883 704.014 328C703.651 328.117 703.246 328.176 702.798 328.176ZM709.672 328.192C708.936 328.192 708.28 328.016 707.704 327.664C707.128 327.301 706.675 326.795 706.344 326.144C706.024 325.493 705.864 324.731 705.864 323.856C705.864 322.981 706.024 322.224 706.344 321.584C706.675 320.933 707.128 320.427 707.704 320.064C708.28 319.701 708.936 319.52 709.672 319.52C710.419 319.52 711.08 319.701 711.656 320.064C712.232 320.427 712.68 320.933 713 321.584C713.331 322.224 713.496 322.981 713.496 323.856C713.496 324.731 713.331 325.493 713 326.144C712.68 326.795 712.232 327.301 711.656 327.664C711.091 328.016 710.429 328.192 709.672 328.192ZM709.672 327.12C710.205 327.12 710.664 326.987 711.048 326.72C711.432 326.453 711.725 326.075 711.928 325.584C712.141 325.093 712.248 324.517 712.248 323.856C712.248 323.195 712.141 322.619 711.928 322.128C711.725 321.637 711.432 321.259 711.048 320.992C710.664 320.725 710.205 320.592 709.672 320.592C709.149 320.592 708.696 320.725 708.312 320.992C707.928 321.259 707.629 321.637 707.416 322.128C707.213 322.619 707.112 323.195 707.112 323.856C707.112 324.517 707.213 325.093 707.416 325.584C707.629 326.075 707.928 326.453 708.312 326.72C708.696 326.987 709.149 327.12 709.672 327.12ZM715.703 328V320C716.034 319.915 716.455 319.819 716.967 319.712C717.479 319.605 718.114 319.552 718.871 319.552C719.405 319.552 719.858 319.627 720.231 319.776C720.615 319.925 720.925 320.149 721.159 320.448C721.255 320.373 721.426 320.267 721.671 320.128C721.917 319.979 722.226 319.845 722.599 319.728C722.983 319.611 723.415 319.552 723.895 319.552C724.749 319.552 725.389 319.717 725.815 320.048C726.253 320.368 726.546 320.816 726.695 321.392C726.845 321.957 726.919 322.613 726.919 323.36V328H725.719V323.696C725.719 322.992 725.671 322.416 725.575 321.968C725.479 321.509 725.293 321.168 725.015 320.944C724.738 320.72 724.327 320.608 723.783 320.608C723.389 320.608 723.042 320.656 722.743 320.752C722.455 320.837 722.215 320.939 722.023 321.056C721.842 321.173 721.709 321.264 721.623 321.328C721.719 321.595 721.789 321.899 721.831 322.24C721.885 322.581 721.911 322.939 721.911 323.312V328H720.711V323.696C720.711 322.992 720.663 322.416 720.567 321.968C720.471 321.509 720.279 321.168 719.991 320.944C719.714 320.72 719.293 320.608 718.727 320.608C718.418 320.608 718.135 320.624 717.879 320.656C717.634 320.677 717.426 320.704 717.255 320.736C717.095 320.768 716.978 320.795 716.903 320.816V328H715.703ZM736.228 328.192C735.759 328.192 735.332 328.165 734.948 328.112C734.564 328.069 734.223 328.016 733.924 327.952C733.636 327.877 733.385 327.808 733.172 327.744V315.792L734.372 315.584V320.176C734.564 320.037 734.852 319.899 735.236 319.76C735.631 319.611 736.084 319.536 736.596 319.536C737.396 319.536 738.073 319.723 738.628 320.096C739.183 320.459 739.604 320.965 739.892 321.616C740.191 322.267 740.34 323.013 740.34 323.856C740.34 324.752 740.169 325.525 739.828 326.176C739.487 326.816 739.007 327.312 738.388 327.664C737.769 328.016 737.049 328.192 736.228 328.192ZM736.212 327.12C736.788 327.12 737.289 326.992 737.716 326.736C738.153 326.48 738.489 326.112 738.724 325.632C738.959 325.141 739.076 324.549 739.076 323.856C739.076 323.408 739.028 322.987 738.932 322.592C738.847 322.197 738.697 321.851 738.484 321.552C738.281 321.253 738.009 321.024 737.668 320.864C737.337 320.693 736.932 320.608 736.452 320.608C735.993 320.608 735.577 320.688 735.204 320.848C734.831 320.997 734.553 321.147 734.372 321.296V326.912C734.521 326.955 734.745 327.003 735.044 327.056C735.353 327.099 735.743 327.12 736.212 327.12ZM742.532 328V320.096C742.809 319.979 743.188 319.861 743.668 319.744C744.158 319.616 744.745 319.552 745.428 319.552C745.652 319.552 745.87 319.568 746.084 319.6C746.308 319.621 746.505 319.653 746.676 319.696C746.857 319.728 746.99 319.76 747.076 319.792L746.836 320.816C746.74 320.773 746.558 320.731 746.292 320.688C746.025 320.635 745.684 320.608 745.268 320.608C744.862 320.608 744.526 320.64 744.26 320.704C743.993 320.757 743.817 320.805 743.732 320.848V328H742.532ZM751.906 328.192C751.17 328.192 750.514 328.016 749.938 327.664C749.362 327.301 748.909 326.795 748.578 326.144C748.258 325.493 748.098 324.731 748.098 323.856C748.098 322.981 748.258 322.224 748.578 321.584C748.909 320.933 749.362 320.427 749.938 320.064C750.514 319.701 751.17 319.52 751.906 319.52C752.653 319.52 753.314 319.701 753.89 320.064C754.466 320.427 754.914 320.933 755.234 321.584C755.565 322.224 755.73 322.981 755.73 323.856C755.73 324.731 755.565 325.493 755.234 326.144C754.914 326.795 754.466 327.301 753.89 327.664C753.325 328.016 752.664 328.192 751.906 328.192ZM751.906 327.12C752.44 327.12 752.898 326.987 753.282 326.72C753.666 326.453 753.96 326.075 754.162 325.584C754.376 325.093 754.482 324.517 754.482 323.856C754.482 323.195 754.376 322.619 754.162 322.128C753.96 321.637 753.666 321.259 753.282 320.992C752.898 320.725 752.44 320.592 751.906 320.592C751.384 320.592 750.93 320.725 750.546 320.992C750.162 321.259 749.864 321.637 749.65 322.128C749.448 322.619 749.346 323.195 749.346 323.856C749.346 324.517 749.448 325.093 749.65 325.584C749.864 326.075 750.162 326.453 750.546 326.72C750.93 326.987 751.384 327.12 751.906 327.12ZM757.938 328V315.792L759.138 315.584V323.36C759.394 323.104 759.682 322.816 760.002 322.496C760.322 322.176 760.647 321.845 760.978 321.504C761.308 321.163 761.618 320.837 761.906 320.528C762.194 320.219 762.439 319.947 762.642 319.712H764.066C763.746 320.053 763.367 320.448 762.93 320.896C762.503 321.344 762.066 321.797 761.618 322.256C761.18 322.704 760.775 323.109 760.402 323.472C760.743 323.707 761.095 324.005 761.458 324.368C761.831 324.72 762.199 325.104 762.562 325.52C762.924 325.936 763.26 326.357 763.57 326.784C763.89 327.211 764.162 327.616 764.386 328H762.994C762.674 327.456 762.29 326.923 761.842 326.4C761.394 325.867 760.935 325.381 760.466 324.944C759.996 324.507 759.554 324.155 759.138 323.888V328H757.938ZM769.382 328.176C768.412 328.176 767.622 327.989 767.014 327.616C766.417 327.243 765.974 326.731 765.686 326.08C765.409 325.429 765.27 324.688 765.27 323.856C765.27 322.885 765.446 322.08 765.798 321.44C766.15 320.8 766.604 320.32 767.158 320C767.724 319.68 768.316 319.52 768.934 319.52C769.628 319.52 770.225 319.669 770.726 319.968C771.238 320.256 771.633 320.704 771.91 321.312C772.188 321.909 772.326 322.672 772.326 323.6C772.326 323.675 772.321 323.765 772.31 323.872C772.31 323.968 772.305 324.059 772.294 324.144H766.518C766.561 325.083 766.812 325.813 767.27 326.336C767.74 326.848 768.465 327.104 769.446 327.104C769.99 327.104 770.433 327.056 770.774 326.96C771.126 326.853 771.377 326.763 771.526 326.688L771.734 327.696C771.585 327.781 771.292 327.883 770.854 328C770.428 328.117 769.937 328.176 769.382 328.176ZM766.55 323.168H771.11C771.1 322.624 771.009 322.16 770.838 321.776C770.668 321.381 770.422 321.083 770.102 320.88C769.793 320.667 769.409 320.56 768.95 320.56C768.481 320.56 768.07 320.683 767.718 320.928C767.366 321.173 767.089 321.493 766.886 321.888C766.694 322.283 766.582 322.709 766.55 323.168ZM774.578 328V320.096C774.856 319.979 775.234 319.861 775.714 319.744C776.205 319.616 776.792 319.552 777.474 319.552C777.698 319.552 777.917 319.568 778.13 319.6C778.354 319.621 778.552 319.653 778.722 319.696C778.904 319.728 779.037 319.76 779.122 319.792L778.882 320.816C778.786 320.773 778.605 320.731 778.338 320.688C778.072 320.635 777.73 320.608 777.314 320.608C776.909 320.608 776.573 320.64 776.306 320.704C776.04 320.757 775.864 320.805 775.778 320.848V328H774.578Z" fill="black"/>
+<path d="M693.032 379C693.012 379.164 693 379.331 693 379.5C693 379.669 693.012 379.836 693.032 380H682V379H693.032ZM712 379V380H700.968C700.988 379.836 701 379.669 701 379.5C701 379.331 700.988 379.164 700.968 379H712ZM697.5 375.531C697.336 375.511 697.169 375.5 697 375.5C696.831 375.5 696.664 375.511 696.5 375.531V371H697.5V375.531Z" fill="black"/>
+<path d="M697 377C698.381 377 699.5 378.119 699.5 379.5C699.5 380.881 698.381 382 697 382C695.619 382 694.5 380.881 694.5 379.5C694.5 378.119 695.619 377 697 377ZM697 378C696.172 378 695.5 378.672 695.5 379.5C695.5 380.328 696.172 381 697 381C697.828 381 698.5 380.328 698.5 379.5C698.5 378.672 697.828 378 697 378Z" fill="black"/>
+<path d="M697 360.15C697.58 360.15 698.049 360.62 698.05 361.199C698.05 361.613 697.81 361.97 697.463 362.141L698.05 365.4H695.95L696.536 362.14C696.189 361.968 695.95 361.612 695.95 361.199C695.95 360.62 696.42 360.15 697 360.15Z" fill="black"/>
+<rect x="687" y="354.7" width="20" height="15.8" rx="1" stroke="black" stroke-linejoin="round"/>
+<path d="M691 355V349C691 345.686 693.686 343 697 343C700.314 343 703 345.686 703 349V355" stroke="black" stroke-linejoin="round"/>
+<rect width="183" height="92" transform="translate(866 303)" fill="white"/>
+<path d="M880.208 328.24C879.269 328.24 878.4 328.021 877.6 327.584C876.811 327.147 876.176 326.501 875.696 325.648C875.216 324.784 874.976 323.717 874.976 322.448C874.976 321.499 875.115 320.667 875.392 319.952C875.669 319.227 876.048 318.624 876.528 318.144C877.019 317.653 877.579 317.285 878.208 317.04C878.837 316.795 879.504 316.672 880.208 316.672C881.157 316.672 882.027 316.891 882.816 317.328C883.605 317.755 884.24 318.4 884.72 319.264C885.2 320.117 885.44 321.179 885.44 322.448C885.44 323.717 885.2 324.784 884.72 325.648C884.24 326.501 883.605 327.147 882.816 327.584C882.027 328.021 881.157 328.24 880.208 328.24ZM880.208 327.12C881.008 327.12 881.701 326.933 882.288 326.56C882.875 326.176 883.328 325.637 883.648 324.944C883.968 324.24 884.128 323.408 884.128 322.448C884.128 321.488 883.968 320.661 883.648 319.968C883.328 319.264 882.875 318.725 882.288 318.352C881.701 317.979 881.008 317.792 880.208 317.792C879.408 317.792 878.715 317.979 878.128 318.352C877.541 318.725 877.088 319.264 876.768 319.968C876.448 320.661 876.288 321.488 876.288 322.448C876.288 323.408 876.448 324.24 876.768 324.944C877.088 325.637 877.541 326.176 878.128 326.56C878.715 326.933 879.408 327.12 880.208 327.12ZM887.846 328V316.912H889.094V328H887.846ZM894.708 328.096C894.26 328.096 893.785 328.075 893.284 328.032C892.782 327.989 892.334 327.915 891.94 327.808V317.12C892.334 317.013 892.782 316.939 893.284 316.896C893.796 316.843 894.276 316.816 894.724 316.816C895.929 316.816 896.99 317.024 897.908 317.44C898.825 317.845 899.54 318.464 900.052 319.296C900.574 320.128 900.836 321.179 900.836 322.448C900.836 323.707 900.574 324.757 900.052 325.6C899.54 326.432 898.825 327.056 897.908 327.472C896.99 327.888 895.924 328.096 894.708 328.096ZM894.836 327.024C896.393 327.024 897.561 326.619 898.34 325.808C899.129 324.987 899.524 323.867 899.524 322.448C899.524 321.029 899.134 319.915 898.356 319.104C897.577 318.293 896.409 317.888 894.852 317.888C894.329 317.888 893.94 317.904 893.684 317.936C893.428 317.968 893.262 317.989 893.188 318V326.912C893.262 326.923 893.422 326.944 893.668 326.976C893.913 327.008 894.302 327.024 894.836 327.024ZM907.893 328.24C906.922 328.24 906.047 328.016 905.269 327.568C904.501 327.12 903.893 326.469 903.445 325.616C903.007 324.752 902.789 323.696 902.789 322.448C902.789 321.52 902.927 320.699 903.205 319.984C903.482 319.259 903.861 318.651 904.341 318.16C904.831 317.669 905.386 317.301 906.005 317.056C906.634 316.8 907.29 316.672 907.973 316.672C908.538 316.672 909.029 316.72 909.445 316.816C909.871 316.901 910.223 317.003 910.501 317.12C910.778 317.237 910.981 317.339 911.109 317.424L910.709 318.48C910.442 318.32 910.095 318.165 909.669 318.016C909.253 317.867 908.746 317.792 908.149 317.792C907.274 317.792 906.533 317.989 905.924 318.384C905.327 318.768 904.874 319.312 904.565 320.016C904.255 320.709 904.101 321.525 904.101 322.464C904.101 323.403 904.25 324.224 904.549 324.928C904.847 325.621 905.285 326.16 905.861 326.544C906.447 326.928 907.162 327.12 908.005 327.12C908.709 327.12 909.295 327.056 909.765 326.928C910.234 326.789 910.597 326.651 910.852 326.512L911.189 327.568C911.018 327.675 910.645 327.813 910.069 327.984C909.503 328.155 908.778 328.24 907.893 328.24ZM916.625 330.96V320C916.839 319.925 917.089 319.856 917.377 319.792C917.676 319.728 918.017 319.675 918.401 319.632C918.785 319.579 919.212 319.552 919.681 319.552C920.503 319.552 921.223 319.728 921.841 320.08C922.46 320.421 922.94 320.917 923.281 321.568C923.623 322.208 923.793 322.976 923.793 323.872C923.793 324.715 923.644 325.461 923.345 326.112C923.057 326.763 922.636 327.275 922.081 327.648C921.527 328.011 920.849 328.192 920.049 328.192C919.537 328.192 919.084 328.123 918.689 327.984C918.305 327.835 918.017 327.691 917.825 327.552V330.96H916.625ZM919.905 327.12C920.385 327.12 920.791 327.04 921.121 326.88C921.463 326.709 921.735 326.475 921.937 326.176C922.151 325.877 922.3 325.536 922.385 325.152C922.481 324.757 922.529 324.336 922.529 323.888C922.529 323.195 922.412 322.603 922.177 322.112C921.943 321.621 921.607 321.248 921.169 320.992C920.743 320.736 920.241 320.608 919.665 320.608C919.196 320.608 918.807 320.635 918.497 320.688C918.199 320.731 917.975 320.773 917.825 320.816V326.432C918.007 326.571 918.284 326.72 918.657 326.88C919.031 327.04 919.447 327.12 919.905 327.12ZM925.985 328V320.096C926.262 319.979 926.641 319.861 927.121 319.744C927.611 319.616 928.198 319.552 928.881 319.552C929.105 319.552 929.323 319.568 929.537 319.6C929.761 319.621 929.958 319.653 930.129 319.696C930.31 319.728 930.443 319.76 930.529 319.792L930.289 320.816C930.193 320.773 930.011 320.731 929.745 320.688C929.478 320.635 929.137 320.608 928.721 320.608C928.315 320.608 927.979 320.64 927.713 320.704C927.446 320.757 927.27 320.805 927.185 320.848V328H925.985ZM935.36 328.192C934.624 328.192 933.968 328.016 933.392 327.664C932.816 327.301 932.362 326.795 932.032 326.144C931.712 325.493 931.552 324.731 931.552 323.856C931.552 322.981 931.712 322.224 932.032 321.584C932.362 320.933 932.816 320.427 933.392 320.064C933.968 319.701 934.624 319.52 935.36 319.52C936.106 319.52 936.768 319.701 937.344 320.064C937.92 320.427 938.368 320.933 938.688 321.584C939.018 322.224 939.184 322.981 939.184 323.856C939.184 324.731 939.018 325.493 938.688 326.144C938.368 326.795 937.92 327.301 937.344 327.664C936.778 328.016 936.117 328.192 935.36 328.192ZM935.36 327.12C935.893 327.12 936.352 326.987 936.736 326.72C937.12 326.453 937.413 326.075 937.616 325.584C937.829 325.093 937.936 324.517 937.936 323.856C937.936 323.195 937.829 322.619 937.616 322.128C937.413 321.637 937.12 321.259 936.736 320.992C936.352 320.725 935.893 320.592 935.36 320.592C934.837 320.592 934.384 320.725 934 320.992C933.616 321.259 933.317 321.637 933.104 322.128C932.901 322.619 932.799 323.195 932.799 323.856C932.799 324.517 932.901 325.093 933.104 325.584C933.317 326.075 933.616 326.453 934 326.72C934.384 326.987 934.837 327.12 935.36 327.12ZM943.36 328C943.093 327.435 942.821 326.827 942.544 326.176C942.266 325.525 941.994 324.848 941.728 324.144C941.461 323.44 941.205 322.72 940.96 321.984C940.725 321.237 940.512 320.48 940.32 319.712H941.584C941.754 320.448 941.968 321.243 942.224 322.096C942.49 322.939 942.773 323.765 943.072 324.576C943.381 325.376 943.674 326.08 943.952 326.688C944.165 326.24 944.384 325.728 944.608 325.152C944.832 324.576 945.05 323.979 945.264 323.36C945.477 322.731 945.674 322.107 945.856 321.488C946.037 320.859 946.192 320.267 946.32 319.712H947.52C947.328 320.48 947.109 321.237 946.864 321.984C946.629 322.72 946.378 323.44 946.112 324.144C945.845 324.848 945.573 325.525 945.296 326.176C945.029 326.827 944.757 327.435 944.48 328H943.36ZM949.172 328V319.712H950.372V328H949.172ZM949.78 317.728C949.545 317.728 949.343 317.648 949.172 317.488C949.012 317.328 948.932 317.115 948.932 316.848C948.932 316.592 949.012 316.384 949.172 316.224C949.343 316.064 949.545 315.984 949.78 315.984C950.015 315.984 950.212 316.064 950.372 316.224C950.543 316.384 950.628 316.592 950.628 316.848C950.628 317.115 950.543 317.328 950.372 317.488C950.212 317.648 950.015 317.728 949.78 317.728ZM956.679 328.192C955.868 328.192 955.153 328.021 954.535 327.68C953.916 327.328 953.436 326.832 953.095 326.192C952.753 325.541 952.583 324.768 952.583 323.872C952.583 323.019 952.727 322.267 953.015 321.616C953.313 320.965 953.74 320.459 954.295 320.096C954.86 319.723 955.537 319.536 956.327 319.536C956.839 319.536 957.287 319.611 957.671 319.76C958.065 319.899 958.359 320.037 958.551 320.176V315.792L959.735 315.584V327.744C959.532 327.808 959.281 327.877 958.983 327.952C958.684 328.016 958.343 328.069 957.959 328.112C957.585 328.165 957.159 328.192 956.679 328.192ZM956.695 327.12C957.164 327.12 957.548 327.099 957.847 327.056C958.156 327.003 958.391 326.955 958.551 326.912V321.296C958.369 321.147 958.092 320.997 957.719 320.848C957.345 320.688 956.924 320.608 956.455 320.608C955.975 320.608 955.564 320.693 955.223 320.864C954.892 321.024 954.62 321.253 954.407 321.552C954.204 321.851 954.055 322.197 953.959 322.592C953.873 322.987 953.831 323.408 953.831 323.856C953.831 324.549 953.948 325.141 954.183 325.632C954.428 326.112 954.764 326.48 955.191 326.736C955.628 326.992 956.129 327.12 956.695 327.12ZM966.054 328.176C965.083 328.176 964.294 327.989 963.686 327.616C963.089 327.243 962.646 326.731 962.358 326.08C962.081 325.429 961.942 324.688 961.942 323.856C961.942 322.885 962.118 322.08 962.47 321.44C962.822 320.8 963.275 320.32 963.83 320C964.395 319.68 964.987 319.52 965.606 319.52C966.299 319.52 966.897 319.669 967.398 319.968C967.91 320.256 968.305 320.704 968.582 321.312C968.859 321.909 968.998 322.672 968.998 323.6C968.998 323.675 968.993 323.765 968.982 323.872C968.982 323.968 968.977 324.059 968.966 324.144H963.19C963.233 325.083 963.483 325.813 963.942 326.336C964.411 326.848 965.137 327.104 966.118 327.104C966.662 327.104 967.105 327.056 967.446 326.96C967.798 326.853 968.049 326.763 968.198 326.688L968.406 327.696C968.257 327.781 967.963 327.883 967.526 328C967.099 328.117 966.609 328.176 966.054 328.176ZM963.222 323.168H967.782C967.771 322.624 967.681 322.16 967.51 321.776C967.339 321.381 967.094 321.083 966.774 320.88C966.465 320.667 966.081 320.56 965.622 320.56C965.153 320.56 964.742 320.683 964.39 320.928C964.038 321.173 963.761 321.493 963.558 321.888C963.366 322.283 963.254 322.709 963.222 323.168ZM971.25 328V320.096C971.528 319.979 971.906 319.861 972.386 319.744C972.877 319.616 973.464 319.552 974.146 319.552C974.37 319.552 974.589 319.568 974.802 319.6C975.026 319.621 975.224 319.653 975.394 319.696C975.576 319.728 975.709 319.76 975.794 319.792L975.554 320.816C975.458 320.773 975.277 320.731 975.01 320.688C974.744 320.635 974.402 320.608 973.986 320.608C973.581 320.608 973.245 320.64 972.978 320.704C972.712 320.757 972.536 320.805 972.45 320.848V328H971.25Z" fill="black"/>
+<path fill-rule="evenodd" clip-rule="evenodd" d="M901.186 349C906.196 349 910.217 353 910.217 357.923L910.211 358.143C910.187 358.652 910.094 359.147 910.093 359.154C915.041 359.216 919 363.154 919 368.077L918.988 368.536C918.747 373.246 914.822 377 909.969 377H886.031L885.564 376.988C880.928 376.757 877.245 373.094 877.012 368.536L877 368.077C877 363.954 879.784 360.352 883.866 359.429V357.984C883.866 354.908 886.402 352.446 889.495 352.446L889.749 352.452C891.017 352.51 892.22 352.996 893.206 353.861C894.752 350.908 897.845 349 901.186 349ZM901.186 350C898.224 350 895.469 351.695 894.092 354.325L893.502 355.452L892.547 354.613C891.674 353.847 890.608 353.446 889.495 353.446C886.935 353.446 884.866 355.479 884.866 357.984V360.228L884.087 360.403C880.472 361.221 878 364.409 878 368.077C878 372.439 881.564 376 886.031 376H909.969C914.436 376 918 372.439 918 368.077C918 363.713 914.493 360.208 910.08 360.153L908.888 360.139L909.11 358.967V358.965C909.111 358.962 909.112 358.956 909.113 358.948C909.116 358.933 909.121 358.91 909.126 358.88C909.136 358.819 909.149 358.73 909.163 358.626C909.191 358.411 909.217 358.151 909.217 357.923C909.217 353.562 905.653 350 901.186 350Z" fill="black"/>
+<path d="M263 349L258 346.113V351.887L263 349ZM258.5 349V348.5H206V349V349.5H258.5V349Z" fill="#666666"/>
+<path d="M536 303L538.887 298L533.113 298L536 303ZM536 298.5L536.5 298.5L536.5 195L536 195L535.5 195L535.5 298.5L536 298.5Z" fill="#666666"/>
+<path d="M464 149L459 146.113V151.887L464 149ZM459.5 149V148.5H407V149V149.5H459.5V149Z" fill="#666666"/>
+<mask id="path-65-outside-1_3431_544" maskUnits="userSpaceOnUse" x="828" y="146.5" width="13" height="205" fill="black">
+<rect fill="white" x="828" y="146.5" width="13" height="205"/>
+<path d="M839 349.5H830V348.5H839V349.5ZM839 249.5H830V248.5H839V249.5ZM839 149.5H830V148.5H839V149.5Z"/>
+</mask>
+<path d="M839 349.5H830V348.5H839V349.5ZM839 249.5H830V248.5H839V249.5ZM839 149.5H830V148.5H839V149.5Z" fill="white"/>
+<path d="M839 349.5V351.5H841V349.5H839ZM830 349.5H828V351.5H830V349.5ZM830 348.5V346.5H828V348.5H830ZM839 348.5H841V346.5H839V348.5ZM839 249.5V251.5H841V249.5H839ZM830 249.5H828V251.5H830V249.5ZM830 248.5V246.5H828V248.5H830ZM839 248.5H841V246.5H839V248.5ZM839 149.5V151.5H841V149.5H839ZM830 149.5H828V151.5H830V149.5ZM830 148.5V146.5H828V148.5H830ZM839 148.5H841V146.5H839V148.5ZM839 349.5V347.5H830V349.5V351.5H839V349.5ZM830 349.5H832V348.5H830H828V349.5H830ZM830 348.5V350.5H839V348.5V346.5H830V348.5ZM839 348.5H837V349.5H839H841V348.5H839ZM839 249.5V247.5H830V249.5V251.5H839V249.5ZM830 249.5H832V248.5H830H828V249.5H830ZM830 248.5V250.5H839V248.5V246.5H830V248.5ZM839 248.5H837V249.5H839H841V248.5H839ZM839 149.5V147.5H830V149.5V151.5H839V149.5ZM830 149.5H832V148.5H830H828V149.5H830ZM830 148.5V150.5H839V148.5V146.5H830V148.5ZM839 148.5H837V149.5H839H841V148.5H839Z" fill="white" mask="url(#path-65-outside-1_3431_544)"/>
+<path d="M866 149L861 146.113V151.887L866 149ZM809 149V149.5H811.036V149V148.5H809V149ZM815.107 149V149.5H819.179V149V148.5H815.107V149ZM823.25 149V149.5H827.321V149V148.5H823.25V149ZM831.393 149V149.5H835.464V149V148.5H831.393V149ZM839.536 149V149.5H843.607V149V148.5H839.536V149ZM847.679 149V149.5H851.75V149V148.5H847.679V149ZM855.821 149V149.5H859.893V149V148.5H855.821V149Z" fill="#666666"/>
+<path d="M866 249L861 246.113V251.887L866 249ZM809 249V249.5H811.036V249V248.5H809V249ZM815.107 249V249.5H819.179V249V248.5H815.107V249ZM823.25 249V249.5H827.321V249V248.5H823.25V249ZM831.393 249V249.5H835.464V249V248.5H831.393V249ZM839.536 249V249.5H843.607V249V248.5H839.536V249ZM847.679 249V249.5H851.75V249V248.5H847.679V249ZM855.821 249V249.5H859.893V249V248.5H855.821V249Z" fill="#666666"/>
+<path d="M866 349L861 346.113V351.887L866 349ZM809 349V349.5H811.036V349V348.5H809V349ZM815.107 349V349.5H819.179V349V348.5H815.107V349ZM823.25 349V349.5H827.321V349V348.5H823.25V349ZM831.393 349V349.5H835.464V349V348.5H831.393V349ZM839.536 349V349.5H843.607V349V348.5H839.536V349ZM847.679 349V349.5H851.75V349V348.5H847.679V349ZM855.821 349V349.5H859.893V349V348.5H855.821V349Z" fill="#666666"/>
+<path d="M209.902 116.618C209.799 116.618 209.664 116.599 209.496 116.562C209.328 116.534 209.197 116.501 209.104 116.464L209.244 115.624C209.319 115.643 209.412 115.661 209.524 115.68C209.636 115.699 209.748 115.708 209.86 115.708C210.215 115.708 210.485 115.643 210.672 115.512C210.868 115.381 210.999 115.185 211.064 114.924C211.139 114.663 211.176 114.336 211.176 113.944V106.748H212.226V113.902C212.226 114.509 212.147 115.013 211.988 115.414C211.829 115.825 211.577 116.128 211.232 116.324C210.896 116.52 210.453 116.618 209.902 116.618ZM211.708 105.012C211.503 105.012 211.325 104.942 211.176 104.802C211.036 104.662 210.966 104.475 210.966 104.242C210.966 104.018 211.036 103.836 211.176 103.696C211.325 103.556 211.503 103.486 211.708 103.486C211.913 103.486 212.086 103.556 212.226 103.696C212.375 103.836 212.45 104.018 212.45 104.242C212.45 104.475 212.375 104.662 212.226 104.802C212.086 104.942 211.913 105.012 211.708 105.012ZM216.134 114.168C215.509 114.168 215.019 114.112 214.664 114C214.319 113.897 214.086 113.818 213.964 113.762L214.216 112.838C214.319 112.875 214.529 112.955 214.846 113.076C215.164 113.197 215.593 113.258 216.134 113.258C216.648 113.258 217.063 113.179 217.38 113.02C217.698 112.861 217.856 112.586 217.856 112.194C217.856 111.942 217.8 111.741 217.688 111.592C217.576 111.433 217.394 111.289 217.142 111.158C216.9 111.027 216.564 110.878 216.134 110.71C215.77 110.561 215.434 110.402 215.126 110.234C214.818 110.066 214.566 109.851 214.37 109.59C214.184 109.329 214.09 108.993 214.09 108.582C214.09 108.181 214.193 107.831 214.398 107.532C214.604 107.233 214.893 107 215.266 106.832C215.649 106.664 216.102 106.58 216.624 106.58C217.11 106.58 217.52 106.622 217.856 106.706C218.192 106.79 218.43 106.865 218.57 106.93L218.332 107.84C218.211 107.775 218.015 107.7 217.744 107.616C217.474 107.523 217.091 107.476 216.596 107.476C216.204 107.476 215.864 107.56 215.574 107.728C215.285 107.887 215.14 108.143 215.14 108.498C215.14 108.75 215.201 108.955 215.322 109.114C215.444 109.263 215.626 109.399 215.868 109.52C216.111 109.641 216.41 109.772 216.764 109.912C217.166 110.071 217.525 110.239 217.842 110.416C218.169 110.584 218.43 110.803 218.626 111.074C218.822 111.345 218.92 111.704 218.92 112.152C218.92 112.591 218.808 112.964 218.584 113.272C218.36 113.571 218.038 113.795 217.618 113.944C217.208 114.093 216.713 114.168 216.134 114.168ZM223.563 114.168C222.919 114.168 222.345 114.014 221.841 113.706C221.337 113.389 220.94 112.945 220.651 112.376C220.371 111.807 220.231 111.139 220.231 110.374C220.231 109.609 220.371 108.946 220.651 108.386C220.94 107.817 221.337 107.373 221.841 107.056C222.345 106.739 222.919 106.58 223.563 106.58C224.216 106.58 224.795 106.739 225.299 107.056C225.803 107.373 226.195 107.817 226.475 108.386C226.764 108.946 226.909 109.609 226.909 110.374C226.909 111.139 226.764 111.807 226.475 112.376C226.195 112.945 225.803 113.389 225.299 113.706C224.804 114.014 224.225 114.168 223.563 114.168ZM223.563 113.23C224.029 113.23 224.431 113.113 224.767 112.88C225.103 112.647 225.359 112.315 225.537 111.886C225.723 111.457 225.817 110.953 225.817 110.374C225.817 109.795 225.723 109.291 225.537 108.862C225.359 108.433 225.103 108.101 224.767 107.868C224.431 107.635 224.029 107.518 223.563 107.518C223.105 107.518 222.709 107.635 222.373 107.868C222.037 108.101 221.775 108.433 221.589 108.862C221.411 109.291 221.323 109.795 221.323 110.374C221.323 110.953 221.411 111.457 221.589 111.886C221.775 112.315 222.037 112.647 222.373 112.88C222.709 113.113 223.105 113.23 223.563 113.23ZM228.84 114V107C229.129 106.925 229.507 106.841 229.974 106.748C230.441 106.655 231.001 106.608 231.654 106.608C232.41 106.608 232.998 106.748 233.418 107.028C233.838 107.308 234.132 107.7 234.3 108.204C234.477 108.699 234.566 109.277 234.566 109.94V114H233.516V110.234C233.516 109.571 233.455 109.044 233.334 108.652C233.213 108.26 233.007 107.975 232.718 107.798C232.429 107.621 232.027 107.532 231.514 107.532C231.122 107.532 230.777 107.555 230.478 107.602C230.179 107.649 229.983 107.686 229.89 107.714V114H228.84Z" fill="#666666"/>
+<path d="M414.458 144.632C414.001 144.632 413.576 144.595 413.184 144.52C412.792 144.445 412.456 144.361 412.176 144.268L412.386 143.344C412.619 143.437 412.927 143.521 413.31 143.596C413.693 143.68 414.085 143.722 414.486 143.722C415.046 143.722 415.499 143.652 415.844 143.512C416.189 143.372 416.441 143.148 416.6 142.84C416.768 142.532 416.852 142.126 416.852 141.622V141.16C416.721 141.253 416.497 141.37 416.18 141.51C415.863 141.641 415.457 141.706 414.962 141.706C414.393 141.706 413.861 141.589 413.366 141.356C412.881 141.113 412.489 140.735 412.19 140.222C411.901 139.709 411.756 139.037 411.756 138.206C411.756 137.515 411.891 136.899 412.162 136.358C412.442 135.817 412.839 135.392 413.352 135.084C413.875 134.767 414.495 134.608 415.214 134.608C415.867 134.608 416.404 134.655 416.824 134.748C417.253 134.832 417.603 134.916 417.874 135V141.566C417.874 142.658 417.589 143.442 417.02 143.918C416.46 144.394 415.606 144.632 414.458 144.632ZM415.004 140.782C415.387 140.782 415.741 140.726 416.068 140.614C416.404 140.502 416.661 140.371 416.838 140.222V135.714C416.689 135.667 416.493 135.625 416.25 135.588C416.007 135.551 415.667 135.532 415.228 135.532C414.724 135.532 414.295 135.644 413.94 135.868C413.585 136.092 413.315 136.409 413.128 136.82C412.941 137.221 412.848 137.688 412.848 138.22C412.848 138.677 412.909 139.069 413.03 139.396C413.151 139.723 413.315 139.989 413.52 140.194C413.725 140.399 413.954 140.549 414.206 140.642C414.467 140.735 414.733 140.782 415.004 140.782ZM420.299 142V132.48C420.653 132.387 421.059 132.321 421.517 132.284C421.974 132.237 422.394 132.214 422.777 132.214C424.111 132.214 425.124 132.471 425.815 132.984C426.515 133.488 426.865 134.235 426.865 135.224C426.865 135.943 426.678 136.517 426.305 136.946C425.931 137.375 425.432 137.683 424.807 137.87C424.965 138.066 425.157 138.323 425.381 138.64C425.614 138.948 425.857 139.293 426.109 139.676C426.361 140.049 426.603 140.437 426.837 140.838C427.079 141.239 427.285 141.627 427.453 142H426.263C426.011 141.515 425.726 141.029 425.409 140.544C425.101 140.049 424.797 139.587 424.499 139.158C424.2 138.729 423.934 138.369 423.701 138.08C423.57 138.089 423.435 138.099 423.295 138.108C423.164 138.117 423.033 138.122 422.903 138.122H421.391V142H420.299ZM421.391 137.212H422.623C423.211 137.212 423.738 137.17 424.205 137.086C424.671 136.993 425.04 136.801 425.311 136.512C425.591 136.223 425.731 135.789 425.731 135.21C425.731 134.659 425.595 134.239 425.325 133.95C425.063 133.651 424.713 133.446 424.275 133.334C423.845 133.213 423.383 133.152 422.889 133.152C422.562 133.152 422.273 133.166 422.021 133.194C421.769 133.213 421.559 133.231 421.391 133.25V137.212ZM429.035 142V132.48C429.39 132.387 429.796 132.321 430.253 132.284C430.72 132.237 431.149 132.214 431.541 132.214C432.913 132.214 433.94 132.48 434.621 133.012C435.312 133.535 435.657 134.281 435.657 135.252C435.657 135.989 435.484 136.582 435.139 137.03C434.803 137.478 434.313 137.805 433.669 138.01C433.034 138.206 432.269 138.304 431.373 138.304H430.127V142H429.035ZM430.127 137.366H431.275C431.938 137.366 432.512 137.31 432.997 137.198C433.482 137.077 433.856 136.862 434.117 136.554C434.388 136.246 434.523 135.807 434.523 135.238C434.523 134.687 434.383 134.263 434.103 133.964C433.823 133.665 433.459 133.455 433.011 133.334C432.563 133.213 432.087 133.152 431.583 133.152C431.256 133.152 430.972 133.166 430.729 133.194C430.496 133.213 430.295 133.231 430.127 133.25V137.366ZM441.476 142.21C440.627 142.21 439.862 142.014 439.18 141.622C438.508 141.23 437.976 140.661 437.584 139.914C437.202 139.158 437.01 138.234 437.01 137.142C437.01 136.33 437.132 135.611 437.374 134.986C437.617 134.351 437.948 133.819 438.368 133.39C438.798 132.961 439.283 132.639 439.824 132.424C440.375 132.2 440.949 132.088 441.546 132.088C442.041 132.088 442.47 132.13 442.834 132.214C443.208 132.289 443.516 132.377 443.758 132.48C444.001 132.583 444.178 132.671 444.29 132.746L443.94 133.67C443.707 133.53 443.404 133.395 443.03 133.264C442.666 133.133 442.223 133.068 441.7 133.068C440.935 133.068 440.286 133.241 439.754 133.586C439.232 133.922 438.835 134.398 438.564 135.014C438.294 135.621 438.158 136.335 438.158 137.156C438.158 137.977 438.289 138.696 438.55 139.312C438.812 139.919 439.194 140.39 439.698 140.726C440.212 141.062 440.837 141.23 441.574 141.23C442.19 141.23 442.704 141.174 443.114 141.062C443.525 140.941 443.842 140.819 444.066 140.698L444.36 141.622C444.211 141.715 443.884 141.837 443.38 141.986C442.886 142.135 442.251 142.21 441.476 142.21Z" fill="#666666"/>
+<path d="M615.668 142.084C615.276 142.084 614.861 142.065 614.422 142.028C613.983 141.991 613.591 141.925 613.246 141.832V132.48C613.591 132.387 613.983 132.321 614.422 132.284C614.87 132.237 615.29 132.214 615.682 132.214C616.737 132.214 617.665 132.396 618.468 132.76C619.271 133.115 619.896 133.656 620.344 134.384C620.801 135.112 621.03 136.031 621.03 137.142C621.03 138.243 620.801 139.163 620.344 139.9C619.896 140.628 619.271 141.174 618.468 141.538C617.665 141.902 616.732 142.084 615.668 142.084ZM615.78 141.146C617.143 141.146 618.165 140.791 618.846 140.082C619.537 139.363 619.882 138.383 619.882 137.142C619.882 135.901 619.541 134.925 618.86 134.216C618.179 133.507 617.157 133.152 615.794 133.152C615.337 133.152 614.996 133.166 614.772 133.194C614.548 133.222 614.403 133.241 614.338 133.25V141.048C614.403 141.057 614.543 141.076 614.758 141.104C614.973 141.132 615.313 141.146 615.78 141.146ZM625.553 142.084C625.329 142.084 625.063 142.07 624.755 142.042C624.456 142.023 624.162 141.995 623.873 141.958C623.583 141.921 623.336 141.874 623.131 141.818V132.48C623.364 132.415 623.625 132.363 623.915 132.326C624.213 132.289 624.507 132.261 624.797 132.242C625.095 132.223 625.366 132.214 625.609 132.214C626.327 132.214 626.981 132.293 627.569 132.452C628.166 132.601 628.642 132.863 628.997 133.236C629.361 133.6 629.543 134.104 629.543 134.748C629.543 135.252 629.412 135.686 629.151 136.05C628.899 136.414 628.553 136.671 628.115 136.82C628.675 136.969 629.132 137.231 629.487 137.604C629.841 137.968 630.019 138.514 630.019 139.242C630.019 140.175 629.65 140.885 628.913 141.37C628.185 141.846 627.065 142.084 625.553 142.084ZM625.665 141.16C626.225 141.16 626.747 141.109 627.233 141.006C627.727 140.903 628.124 140.712 628.423 140.432C628.721 140.152 628.871 139.751 628.871 139.228C628.871 138.509 628.628 138.024 628.143 137.772C627.657 137.52 626.995 137.394 626.155 137.394H624.209V141.076C624.358 141.095 624.568 141.113 624.839 141.132C625.109 141.151 625.385 141.16 625.665 141.16ZM624.209 136.484H625.973C626.439 136.484 626.855 136.437 627.219 136.344C627.592 136.251 627.886 136.083 628.101 135.84C628.315 135.588 628.423 135.238 628.423 134.79C628.423 134.183 628.166 133.759 627.653 133.516C627.149 133.264 626.481 133.138 625.651 133.138C625.333 133.138 625.053 133.147 624.811 133.166C624.568 133.175 624.367 133.194 624.209 133.222V136.484ZM634.775 142.14C634.047 142.14 633.469 142.005 633.039 141.734C632.619 141.454 632.316 141.062 632.129 140.558C631.952 140.054 631.863 139.471 631.863 138.808V134.748H632.913V138.528C632.913 139.181 632.979 139.704 633.109 140.096C633.24 140.488 633.45 140.773 633.739 140.95C634.038 141.118 634.43 141.202 634.915 141.202C635.307 141.202 635.653 141.183 635.951 141.146C636.259 141.099 636.46 141.062 636.553 141.034V134.748H637.589V141.748C637.309 141.823 636.931 141.907 636.455 142C635.989 142.093 635.429 142.14 634.775 142.14ZM641.5 142.168C640.874 142.168 640.384 142.112 640.03 142C639.684 141.897 639.451 141.818 639.33 141.762L639.582 140.838C639.684 140.875 639.894 140.955 640.212 141.076C640.529 141.197 640.958 141.258 641.5 141.258C642.013 141.258 642.428 141.179 642.746 141.02C643.063 140.861 643.222 140.586 643.222 140.194C643.222 139.942 643.166 139.741 643.054 139.592C642.942 139.433 642.76 139.289 642.508 139.158C642.265 139.027 641.929 138.878 641.5 138.71C641.136 138.561 640.8 138.402 640.492 138.234C640.184 138.066 639.932 137.851 639.736 137.59C639.549 137.329 639.456 136.993 639.456 136.582C639.456 136.181 639.558 135.831 639.764 135.532C639.969 135.233 640.258 135 640.632 134.832C641.014 134.664 641.467 134.58 641.99 134.58C642.475 134.58 642.886 134.622 643.222 134.706C643.558 134.79 643.796 134.865 643.936 134.93L643.698 135.84C643.576 135.775 643.38 135.7 643.11 135.616C642.839 135.523 642.456 135.476 641.962 135.476C641.57 135.476 641.229 135.56 640.94 135.728C640.65 135.887 640.506 136.143 640.506 136.498C640.506 136.75 640.566 136.955 640.688 137.114C640.809 137.263 640.991 137.399 641.234 137.52C641.476 137.641 641.775 137.772 642.13 137.912C642.531 138.071 642.89 138.239 643.208 138.416C643.534 138.584 643.796 138.803 643.992 139.074C644.188 139.345 644.286 139.704 644.286 140.152C644.286 140.591 644.174 140.964 643.95 141.272C643.726 141.571 643.404 141.795 642.984 141.944C642.573 142.093 642.078 142.168 641.5 142.168Z" fill="#666666"/>
+<path d="M414.458 368.632C414.001 368.632 413.576 368.595 413.184 368.52C412.792 368.445 412.456 368.361 412.176 368.268L412.386 367.344C412.619 367.437 412.927 367.521 413.31 367.596C413.693 367.68 414.085 367.722 414.486 367.722C415.046 367.722 415.499 367.652 415.844 367.512C416.189 367.372 416.441 367.148 416.6 366.84C416.768 366.532 416.852 366.126 416.852 365.622V365.16C416.721 365.253 416.497 365.37 416.18 365.51C415.863 365.641 415.457 365.706 414.962 365.706C414.393 365.706 413.861 365.589 413.366 365.356C412.881 365.113 412.489 364.735 412.19 364.222C411.901 363.709 411.756 363.037 411.756 362.206C411.756 361.515 411.891 360.899 412.162 360.358C412.442 359.817 412.839 359.392 413.352 359.084C413.875 358.767 414.495 358.608 415.214 358.608C415.867 358.608 416.404 358.655 416.824 358.748C417.253 358.832 417.603 358.916 417.874 359V365.566C417.874 366.658 417.589 367.442 417.02 367.918C416.46 368.394 415.606 368.632 414.458 368.632ZM415.004 364.782C415.387 364.782 415.741 364.726 416.068 364.614C416.404 364.502 416.661 364.371 416.838 364.222V359.714C416.689 359.667 416.493 359.625 416.25 359.588C416.007 359.551 415.667 359.532 415.228 359.532C414.724 359.532 414.295 359.644 413.94 359.868C413.585 360.092 413.315 360.409 413.128 360.82C412.941 361.221 412.848 361.688 412.848 362.22C412.848 362.677 412.909 363.069 413.03 363.396C413.151 363.723 413.315 363.989 413.52 364.194C413.725 364.399 413.954 364.549 414.206 364.642C414.467 364.735 414.733 364.782 415.004 364.782ZM420.299 366V356.48C420.653 356.387 421.059 356.321 421.517 356.284C421.974 356.237 422.394 356.214 422.777 356.214C424.111 356.214 425.124 356.471 425.815 356.984C426.515 357.488 426.865 358.235 426.865 359.224C426.865 359.943 426.678 360.517 426.305 360.946C425.931 361.375 425.432 361.683 424.807 361.87C424.965 362.066 425.157 362.323 425.381 362.64C425.614 362.948 425.857 363.293 426.109 363.676C426.361 364.049 426.603 364.437 426.837 364.838C427.079 365.239 427.285 365.627 427.453 366H426.263C426.011 365.515 425.726 365.029 425.409 364.544C425.101 364.049 424.797 363.587 424.499 363.158C424.2 362.729 423.934 362.369 423.701 362.08C423.57 362.089 423.435 362.099 423.295 362.108C423.164 362.117 423.033 362.122 422.903 362.122H421.391V366H420.299ZM421.391 361.212H422.623C423.211 361.212 423.738 361.17 424.205 361.086C424.671 360.993 425.04 360.801 425.311 360.512C425.591 360.223 425.731 359.789 425.731 359.21C425.731 358.659 425.595 358.239 425.325 357.95C425.063 357.651 424.713 357.446 424.275 357.334C423.845 357.213 423.383 357.152 422.889 357.152C422.562 357.152 422.273 357.166 422.021 357.194C421.769 357.213 421.559 357.231 421.391 357.25V361.212ZM429.035 366V356.48C429.39 356.387 429.796 356.321 430.253 356.284C430.72 356.237 431.149 356.214 431.541 356.214C432.913 356.214 433.94 356.48 434.621 357.012C435.312 357.535 435.657 358.281 435.657 359.252C435.657 359.989 435.484 360.582 435.139 361.03C434.803 361.478 434.313 361.805 433.669 362.01C433.034 362.206 432.269 362.304 431.373 362.304H430.127V366H429.035ZM430.127 361.366H431.275C431.938 361.366 432.512 361.31 432.997 361.198C433.482 361.077 433.856 360.862 434.117 360.554C434.388 360.246 434.523 359.807 434.523 359.238C434.523 358.687 434.383 358.263 434.103 357.964C433.823 357.665 433.459 357.455 433.011 357.334C432.563 357.213 432.087 357.152 431.583 357.152C431.256 357.152 430.972 357.166 430.729 357.194C430.496 357.213 430.295 357.231 430.127 357.25V361.366ZM441.476 366.21C440.627 366.21 439.862 366.014 439.18 365.622C438.508 365.23 437.976 364.661 437.584 363.914C437.202 363.158 437.01 362.234 437.01 361.142C437.01 360.33 437.132 359.611 437.374 358.986C437.617 358.351 437.948 357.819 438.368 357.39C438.798 356.961 439.283 356.639 439.824 356.424C440.375 356.2 440.949 356.088 441.546 356.088C442.041 356.088 442.47 356.13 442.834 356.214C443.208 356.289 443.516 356.377 443.758 356.48C444.001 356.583 444.178 356.671 444.29 356.746L443.94 357.67C443.707 357.53 443.404 357.395 443.03 357.264C442.666 357.133 442.223 357.068 441.7 357.068C440.935 357.068 440.286 357.241 439.754 357.586C439.232 357.922 438.835 358.398 438.564 359.014C438.294 359.621 438.158 360.335 438.158 361.156C438.158 361.977 438.289 362.696 438.55 363.312C438.812 363.919 439.194 364.39 439.698 364.726C440.212 365.062 440.837 365.23 441.574 365.23C442.19 365.23 442.704 365.174 443.114 365.062C443.525 364.941 443.842 364.819 444.066 364.698L444.36 365.622C444.211 365.715 443.884 365.837 443.38 365.986C442.886 366.135 442.251 366.21 441.476 366.21Z" fill="#666666"/>
+<path d="M211.176 188.59V179C211.363 178.935 211.582 178.874 211.834 178.818C212.095 178.762 212.394 178.715 212.73 178.678C213.066 178.631 213.439 178.608 213.85 178.608C214.569 178.608 215.199 178.762 215.74 179.07C216.281 179.369 216.701 179.803 217 180.372C217.299 180.932 217.448 181.604 217.448 182.388C217.448 183.125 217.317 183.779 217.056 184.348C216.804 184.917 216.435 185.365 215.95 185.692C215.465 186.009 214.872 186.168 214.172 186.168C213.724 186.168 213.327 186.107 212.982 185.986C212.646 185.855 212.394 185.729 212.226 185.608V188.59H211.176ZM214.046 185.23C214.466 185.23 214.821 185.16 215.11 185.02C215.409 184.871 215.647 184.665 215.824 184.404C216.011 184.143 216.141 183.844 216.216 183.508C216.3 183.163 216.342 182.794 216.342 182.402C216.342 181.795 216.239 181.277 216.034 180.848C215.829 180.419 215.535 180.092 215.152 179.868C214.779 179.644 214.34 179.532 213.836 179.532C213.425 179.532 213.085 179.555 212.814 179.602C212.553 179.639 212.357 179.677 212.226 179.714V184.628C212.385 184.749 212.627 184.88 212.954 185.02C213.281 185.16 213.645 185.23 214.046 185.23ZM221.563 186.154C221.041 186.154 220.574 186.079 220.163 185.93C219.753 185.781 219.431 185.538 219.197 185.202C218.964 184.866 218.847 184.423 218.847 183.872C218.847 183.34 218.978 182.911 219.239 182.584C219.501 182.248 219.86 182.005 220.317 181.856C220.784 181.707 221.307 181.632 221.885 181.632C222.147 181.632 222.422 181.655 222.711 181.702C223.001 181.749 223.183 181.791 223.257 181.828V181.408C223.257 181.091 223.215 180.787 223.131 180.498C223.057 180.199 222.898 179.957 222.655 179.77C222.413 179.583 222.044 179.49 221.549 179.49C221.036 179.49 220.644 179.527 220.373 179.602C220.103 179.677 219.902 179.737 219.771 179.784L219.631 178.888C219.799 178.813 220.056 178.743 220.401 178.678C220.747 178.613 221.153 178.58 221.619 178.58C222.282 178.58 222.805 178.697 223.187 178.93C223.579 179.163 223.859 179.485 224.027 179.896C224.205 180.297 224.293 180.759 224.293 181.282V185.832C224.097 185.879 223.747 185.944 223.243 186.028C222.739 186.112 222.179 186.154 221.563 186.154ZM221.717 185.258C222.044 185.258 222.338 185.249 222.599 185.23C222.861 185.202 223.08 185.169 223.257 185.132V182.696C223.164 182.649 223.005 182.603 222.781 182.556C222.557 182.509 222.268 182.486 221.913 182.486C221.615 182.486 221.311 182.519 221.003 182.584C220.695 182.649 220.434 182.78 220.219 182.976C220.014 183.172 219.911 183.466 219.911 183.858C219.911 184.381 220.075 184.745 220.401 184.95C220.728 185.155 221.167 185.258 221.717 185.258ZM226.557 186V179C226.846 178.925 227.215 178.841 227.663 178.748C228.111 178.655 228.666 178.608 229.329 178.608C229.796 178.608 230.192 178.673 230.519 178.804C230.855 178.935 231.126 179.131 231.331 179.392C231.415 179.327 231.564 179.233 231.779 179.112C231.994 178.981 232.264 178.865 232.591 178.762C232.927 178.659 233.305 178.608 233.725 178.608C234.472 178.608 235.032 178.753 235.405 179.042C235.788 179.322 236.044 179.714 236.175 180.218C236.306 180.713 236.371 181.287 236.371 181.94V186H235.321V182.234C235.321 181.618 235.279 181.114 235.195 180.722C235.111 180.321 234.948 180.022 234.705 179.826C234.462 179.63 234.103 179.532 233.627 179.532C233.282 179.532 232.978 179.574 232.717 179.658C232.465 179.733 232.255 179.821 232.087 179.924C231.928 180.027 231.812 180.106 231.737 180.162C231.821 180.395 231.882 180.661 231.919 180.96C231.966 181.259 231.989 181.571 231.989 181.898V186H230.939V182.234C230.939 181.618 230.897 181.114 230.813 180.722C230.729 180.321 230.561 180.022 230.309 179.826C230.066 179.63 229.698 179.532 229.203 179.532C228.932 179.532 228.685 179.546 228.461 179.574C228.246 179.593 228.064 179.616 227.915 179.644C227.775 179.672 227.672 179.695 227.607 179.714V186H226.557Z" fill="#666666"/>
+<path d="M211.176 269.59V260C211.363 259.935 211.582 259.874 211.834 259.818C212.095 259.762 212.394 259.715 212.73 259.678C213.066 259.631 213.439 259.608 213.85 259.608C214.569 259.608 215.199 259.762 215.74 260.07C216.281 260.369 216.701 260.803 217 261.372C217.299 261.932 217.448 262.604 217.448 263.388C217.448 264.125 217.317 264.779 217.056 265.348C216.804 265.917 216.435 266.365 215.95 266.692C215.465 267.009 214.872 267.168 214.172 267.168C213.724 267.168 213.327 267.107 212.982 266.986C212.646 266.855 212.394 266.729 212.226 266.608V269.59H211.176ZM214.046 266.23C214.466 266.23 214.821 266.16 215.11 266.02C215.409 265.871 215.647 265.665 215.824 265.404C216.011 265.143 216.141 264.844 216.216 264.508C216.3 264.163 216.342 263.794 216.342 263.402C216.342 262.795 216.239 262.277 216.034 261.848C215.829 261.419 215.535 261.092 215.152 260.868C214.779 260.644 214.34 260.532 213.836 260.532C213.425 260.532 213.085 260.555 212.814 260.602C212.553 260.639 212.357 260.677 212.226 260.714V265.628C212.385 265.749 212.627 265.88 212.954 266.02C213.281 266.16 213.645 266.23 214.046 266.23ZM221.563 267.154C221.041 267.154 220.574 267.079 220.163 266.93C219.753 266.781 219.431 266.538 219.197 266.202C218.964 265.866 218.847 265.423 218.847 264.872C218.847 264.34 218.978 263.911 219.239 263.584C219.501 263.248 219.86 263.005 220.317 262.856C220.784 262.707 221.307 262.632 221.885 262.632C222.147 262.632 222.422 262.655 222.711 262.702C223.001 262.749 223.183 262.791 223.257 262.828V262.408C223.257 262.091 223.215 261.787 223.131 261.498C223.057 261.199 222.898 260.957 222.655 260.77C222.413 260.583 222.044 260.49 221.549 260.49C221.036 260.49 220.644 260.527 220.373 260.602C220.103 260.677 219.902 260.737 219.771 260.784L219.631 259.888C219.799 259.813 220.056 259.743 220.401 259.678C220.747 259.613 221.153 259.58 221.619 259.58C222.282 259.58 222.805 259.697 223.187 259.93C223.579 260.163 223.859 260.485 224.027 260.896C224.205 261.297 224.293 261.759 224.293 262.282V266.832C224.097 266.879 223.747 266.944 223.243 267.028C222.739 267.112 222.179 267.154 221.563 267.154ZM221.717 266.258C222.044 266.258 222.338 266.249 222.599 266.23C222.861 266.202 223.08 266.169 223.257 266.132V263.696C223.164 263.649 223.005 263.603 222.781 263.556C222.557 263.509 222.268 263.486 221.913 263.486C221.615 263.486 221.311 263.519 221.003 263.584C220.695 263.649 220.434 263.78 220.219 263.976C220.014 264.172 219.911 264.466 219.911 264.858C219.911 265.381 220.075 265.745 220.401 265.95C220.728 266.155 221.167 266.258 221.717 266.258ZM226.557 267V260C226.846 259.925 227.215 259.841 227.663 259.748C228.111 259.655 228.666 259.608 229.329 259.608C229.796 259.608 230.192 259.673 230.519 259.804C230.855 259.935 231.126 260.131 231.331 260.392C231.415 260.327 231.564 260.233 231.779 260.112C231.994 259.981 232.264 259.865 232.591 259.762C232.927 259.659 233.305 259.608 233.725 259.608C234.472 259.608 235.032 259.753 235.405 260.042C235.788 260.322 236.044 260.714 236.175 261.218C236.306 261.713 236.371 262.287 236.371 262.94V267H235.321V263.234C235.321 262.618 235.279 262.114 235.195 261.722C235.111 261.321 234.948 261.022 234.705 260.826C234.462 260.63 234.103 260.532 233.627 260.532C233.282 260.532 232.978 260.574 232.717 260.658C232.465 260.733 232.255 260.821 232.087 260.924C231.928 261.027 231.812 261.106 231.737 261.162C231.821 261.395 231.882 261.661 231.919 261.96C231.966 262.259 231.989 262.571 231.989 262.898V267H230.939V263.234C230.939 262.618 230.897 262.114 230.813 261.722C230.729 261.321 230.561 261.022 230.309 260.826C230.066 260.63 229.698 260.532 229.203 260.532C228.932 260.532 228.685 260.546 228.461 260.574C228.246 260.593 228.064 260.616 227.915 260.644C227.775 260.672 227.672 260.695 227.607 260.714V267H226.557Z" fill="#666666"/>
+</svg>
diff --git a/docs/assets/configure-registration.png b/docs/assets/configure-registration.png
deleted file mode 100644
index bd1cce3bc4..0000000000
Binary files a/docs/assets/configure-registration.png and /dev/null differ
diff --git a/docs/assets/app-registration.png b/docs/assets/entraid-app-registration.png
similarity index 100%
rename from docs/assets/app-registration.png
rename to docs/assets/entraid-app-registration.png
diff --git a/docs/assets/graph-permissions.png b/docs/assets/entraid-graph-permissions.png
similarity index 100%
rename from docs/assets/graph-permissions.png
rename to docs/assets/entraid-graph-permissions.png
diff --git a/docs/assets/new-registration.png b/docs/assets/entraid-new-registration.png
similarity index 100%
rename from docs/assets/new-registration.png
rename to docs/assets/entraid-new-registration.png
diff --git a/docs/assets/keycloak-create-client.png b/docs/assets/keycloak-create-client.png
new file mode 100644
index 0000000000..cb63b02ae7
Binary files /dev/null and b/docs/assets/keycloak-create-client.png differ
diff --git a/docs/conf.py b/docs/conf.py
index 8464a8b895..07019b73f0 100644
--- a/docs/conf.py
+++ b/docs/conf.py
@@ -1,5 +1,4 @@
 import datetime
-import ast
 import os
 import yaml
 
@@ -71,7 +70,7 @@
 # NOTE: The Open Graph Protocol (OGP) enhances page display in a social graph
 #       and is used by social media platforms; see https://ogp.me/
 
-ogp_site_url = "https://documentation.ubuntu/authd/en/stable"
+ogp_site_url = "https://documentation.ubuntu.com/authd/stable-docs"
 
 
 # Preview name of the documentation website
@@ -85,7 +84,7 @@
 #
 # TODO: To customise the preview image, update as needed.
 
-ogp_image = "https://assets.ubuntu.com/v1/253da317-image-document-ubuntudocs.svg"
+ogp_image = "https://assets.ubuntu.com/v1/cc828679-docs_illustration.svg"
 
 
 # Product favicon; shown in bookmarks, browser tabs, etc.
@@ -98,7 +97,12 @@
 # Dictionary of values to pass into the Sphinx context for all pages:
 # https://www.sphinx-doc.org/en/master/usage/configuration.html#confval-html_context
 
+version = os.getenv("READTHEDOCS_VERSION", "")
+
 html_context = {
+    # Used for rendering version information and links in authd documentation
+    "version": version,
+    "ogp_site_url": ogp_site_url,
     # Product page URL; can be different from product docs URL
     #
     # TODO: Change to your product website URL,
@@ -107,7 +111,7 @@
     # TODO: If there's no such website,
     #       remove the {{ product_page }} link from the page header template
     #       (usually .sphinx/_templates/header.html; also, see README.rst).
-    "product_page": "github.com/ubuntu/authd",
+    "product_page": "github.com/canonical/authd",
     # Product tag image; the orange part of your logo, shown in the page header
     #
     # TODO: To add a tag image, uncomment and update as needed.
@@ -133,13 +137,15 @@
     #
     # NOTE: If set, links for viewing the documentation source files
     #       and creating GitHub issues are added at the bottom of each page.
-    "github_url": "https://github.com/ubuntu/authd",
+    "github_url": "https://github.com/canonical/authd",
     # Docs branch in the repo; used in links for viewing the source files
     #
     # TODO: To customise the branch, uncomment and update as needed.
     "repo_default_branch": "main",
     # Docs location in the repo; used in links for viewing the source files
     #
+
+
     # TODO: To customise the directory, uncomment and update as needed.
     "repo_folder": "/docs/",
     # TODO: To enable or disable the Previous / Next buttons at the bottom of pages
@@ -151,6 +157,13 @@
     "github_issues": "enabled",
 }
 
+html_extra_path = []
+
+# Allow opt-in build of the OpenAPI "Hello" example so docs stay clean by default.
+if os.getenv("OPENAPI", ""):
+    tags.add("openapi")
+    html_extra_path.append("how-to/assets/openapi.yaml")
+
 # TODO: To enable the edit button on pages, uncomment and change the link to a
 # public repository on GitHub or Launchpad. Any of the following link domains
 # are accepted:
@@ -159,7 +172,7 @@
 # - https://git.launchpad.net/example
 #
 html_theme_options = {
-    "source_edit_link": "https://github.com/ubuntu/authd",
+    "source_edit_link": "https://github.com/canonical/authd",
 }
 
 # Project slug; see https://meta.discourse.org/t/what-is-category-slug/87897
@@ -173,26 +186,36 @@
 # Sitemap configuration: https://sphinx-sitemap.readthedocs.io/
 #######################
 
-# Base URL of RTD hosted project
+# Use RTD canonical URL to ensure duplicate pages have a specific canonical URL
+
+html_baseurl = os.environ.get("READTHEDOCS_CANONICAL_URL", "/")
 
-html_baseurl = "https://documentation.ubuntu.com/authd/"
+# sphinx-sitemap uses html_baseurl to generate the full URL for each page:
 
-# URL scheme. Add language and version scheme elements manually e.g. '{0}/{1}/{{link}}'.format(os.environ['READTHEDOCS_LANGUAGE'], os.environ['READTHEDOCS_VERSION'])
+sitemap_url_scheme = '{link}'
 
-# When configured with RTD variables, check for RTD environment so manual runs succeed:
+# Include `lastmod` dates in the sitemap:
 
-if "READTHEDOCS_VERSION" in os.environ:
-    version = os.environ["READTHEDOCS_VERSION"]
-    sitemap_url_scheme = "{version}{link}"
-else:
-    sitemap_url_scheme = "stable/{link}"
+sitemap_show_lastmod = True
 
+# Exclude generated pages from the sitemap:
+
+sitemap_excludes = [
+    '404/',
+    'genindex/',
+    'search/',
+]
+
+# TODO: Add more pages to sitemap_excludes if needed. Wildcards are supported.
+#       For example, to exclude module pages generated by autodoc, add '_modules/*'.
+
+#######################
 # Template and asset locations
+#######################
 
-# html_static_path = [".sphinx/_static"]
+html_static_path = [".sphinx/_static"]
 templates_path = [".sphinx/_templates"]
 
-
 #############
 # Redirects #
 #############
@@ -217,12 +240,19 @@
 #
 # TODO: Remove or adjust the ACME entry after you update the contributing guide
 
-linkcheck_ignore = ["http://127.0.0.1:8000"]
+linkcheck_ignore = [
+    "http://127.0.0.1:8000",
+    "https://matrix.to/#/#documentation:ubuntu.com",  # the linkchecker struggles with hashes
+]
 
 
 # A regex list of URLs where anchors are ignored by 'make linkcheck'
 
-linkcheck_anchors_ignore_for_url = [r"https://github\.com/.*"]
+linkcheck_anchors_ignore_for_url = [
+    r"https://github\.com/.*",
+    # Using anchors on manpages.ubuntu.com leads to false positives
+    r"https://manpages\.ubuntu\.com/.*",
+]
 
 # give linkcheck multiple tries on failure
 # linkcheck_timeout = 30
@@ -249,41 +279,40 @@
 # https://www.sphinx-doc.org/en/master/usage/extensions/index.html
 
 # NOTE: The canonical_sphinx extension is required for the starter pack.
-#       It automatically enables the following extensions:
-#       - custom-rst-roles
-#       - myst_parser
-#       - notfound.extension
-#       - related-links
-#       - sphinx_copybutton
-#       - sphinx_design
-#       - sphinx_reredirects
-#       - sphinx_tabs.tabs
-#       - sphinxcontrib.jquery
-#       - sphinxext.opengraph
-#       - terminal-output
-#       - youtube-links
 
 extensions = [
     "canonical_sphinx",
+    "notfound.extension",
+    "sphinx_design",
+    "sphinx_reredirects",
+    "sphinx_tabs.tabs",
+    "sphinxcontrib.jquery",
+    "sphinxext.opengraph",
+    "sphinx_config_options",
+    "sphinx_contributor_listing",
+    "sphinx_filtered_toctree",
+    "sphinx_related_links",
+    "sphinx_roles",
+    "sphinx_terminal",
+    "sphinx_ubuntu_images",
+    "sphinx_youtube_links",
     "sphinxcontrib.cairosvgconverter",
     "sphinx_last_updated_by_git",
     "sphinx.ext.intersphinx",
     "sphinx_sitemap",
 ]
 
-
 # Excludes files or directories from processing
 
 # exclude_patterns = []
 
 # Adds custom CSS files, located under 'html_static_path'
 
-# html_css_files = []
-
+html_css_files = ["cookie-banner.css", "version-warning.css"]
 
 # Adds custom JavaScript files, located under 'html_static_path'
 
-# html_js_files = []
+html_js_files = ["js/bundle.js"]
 
 
 # Specifies a reST snippet to be appended to each .rst file
@@ -308,8 +337,8 @@
 # NOTE: If set, adding ':manpage:' to an .rst file
 #       adds a link to the corresponding man section at the bottom of the page.
 
-# manpages_url = f'https://manpages.ubuntu.com/manpages/{codename}/en/' + \
-#     f'man{section}/{page}.{section}.html'
+# manpages_url = 'https://manpages.ubuntu.com/manpages/{codename}/en/' + \
+#     'man{section}/{page}.{section}.html'
 
 
 # Specifies a reST snippet to be prepended to each .rst file
@@ -340,9 +369,13 @@
 
 # Add configuration for intersphinx mapping
 
-# intersphinx_mapping = {
-#     "starter-pack": (
-#         "https://canonical-example-product-documentation.readthedocs-hosted.com/en/latest",
-#         None,
-#     )
-# }
+intersphinx_mapping = {
+    'starter-pack': ('https://canonical-example-product-documentation.readthedocs-hosted.com/en/latest', None),
+    'sphinxcontrib-mermaid': ('https://sphinxcontrib-mermaid-demo.readthedocs.io/en/latest', None)
+}
+
+# Suppress warnings
+
+suppress_warnings = [
+    "myst.header", # Suppress warnings relating to headers of autogenerated Cobra docs
+]
diff --git a/docs/explanation/authd-architecture.md b/docs/explanation/authd-architecture.md
index f9adfbb0d6..28e852f3cb 100644
--- a/docs/explanation/authd-architecture.md
+++ b/docs/explanation/authd-architecture.md
@@ -1,3 +1,10 @@
+---
+myst:
+  html_meta:
+    "description lang=en":
+      "authd has a modular architecture, consisting of an authentication daemon and an identity broker."
+---
+
 # authd architecture
 
 authd can help organizations ensure secure identity and access management by enabling seamless cloud-based authentication of Ubuntu machines.
@@ -6,19 +13,19 @@ Links are provided at the end to support further reading.
 
 ## Architecture components
 
-authd acts as an interface between the host system and external identity providers. 
+authd acts as an interface between the host system and external identity providers.
 Remote information is cached when authenticating with authd, which improves performance while also facilitating offline access.
 
 The diagram below illustrates the components of authd and their communication methods:
 
-![Isometric architecture diagram of authd.](../assets/authd-architecture.png)
+![Isometric architecture diagram for authd.](../assets/authd-architecture.svg)
 
 The architecture of authd consists of the following components:
 
 * The **authentication daemon** (authd): a daemon that runs on the host and manages access to the authentication service.
 * An **identity broker**: a trusted component running on the host and serving as an interface with the identity provider.
 * The **identity provider**: the remote service that manages digital identities, such as Microsoft Entra ID.
-* A **PAM module**: the library that handles the authentication tasks of applications on the system. The authentication tasks that are currently handled by PAM include GDM, login, ssh and sudo. Support for webview is being developed. 
+* A **PAM module**: the library that handles the authentication tasks of applications on the system. The authentication tasks that are currently handled by PAM include GDM, login, ssh and sudo. Support for webview is being developed.
 * An **NSS module**: a module that queries authd to retrieve user information from the cache.
 
 ```{note}
@@ -37,11 +44,11 @@ The broker is a trusted component within the system and serves as the interface
 
 Internal components of authd, such as PAM and NSS modules, communicate over gRPC. The advantage of gRPC is that it delivers high performance and native streaming, with built-in security for efficient and secure communication in distributed systems.
 
-The communication between authd and the brokers is done over DBus. DBus supports message broadcasting and enables efficient resource sharing. The communication only goes from the authentication daemon to the broker, which responds to requests. The transactions are encrypted, ensuring that communications between the broker and authd are secure.
+The communication between authd and the brokers is done over D-Bus. D-Bus supports message broadcasting and enables efficient resource sharing. The communication only goes from the authentication daemon to the broker, which responds to requests. The transactions are encrypted, ensuring that communications between the broker and authd are secure.
 
 ## Links
 
-* [Microsoft Entra fundamentals documentation](https://learn.microsoft.com/en-us/entra/fundamentals/)  
-* [OpenID Connect (OIDC) on the Microsoft identity platform](https://learn.microsoft.com/en-us/entra/identity-platform/v2-protocols-oidc)   
-* [What is OpenID Connect and what do you use it for? \- Auth0](https://auth0.com/intro-to-iam/what-is-openid-connect-oidc)  
-* [What Is OpenID Connect (OIDC)? | Microsoft Security](https://www.microsoft.com/en-us/security/business/security-101/what-is-openid-connect-oidc) 
+* [Microsoft Entra fundamentals documentation](https://learn.microsoft.com/en-us/entra/fundamentals/)
+* [OpenID Connect (OIDC) on the Microsoft identity platform](https://learn.microsoft.com/en-us/entra/identity-platform/v2-protocols-oidc)
+* [What is OpenID Connect and what do you use it for? \- Auth0](https://auth0.com/intro-to-iam/what-is-openid-connect-oidc)
+* [What Is OpenID Connect (OIDC)? | Microsoft Security](https://www.microsoft.com/en-us/security/business/security-101/what-is-openid-connect-oidc)
diff --git a/docs/explanation/index.md b/docs/explanation/index.md
index 7cf4e058f7..fcf34505e4 100644
--- a/docs/explanation/index.md
+++ b/docs/explanation/index.md
@@ -1,12 +1,44 @@
+---
+myst:
+  html_meta:
+    "description lang=en":
+      "authd explanation guides covering architecture, security, and documentation."
+---
+
 (explanation)=
 
 # Explanation
 
-Read about the modular design of authd and how it interfaces with
-multiple cloud providers through different identity brokers.
+These guides explain how authd works.
+
+## Architecture
+
+authd has a modular design and can interface with multiple identity providers
+through different identity brokers.
 
 ```{toctree}
 :titlesonly:
 
 authd architecture <authd-architecture>
 ```
+
+## Security
+
+Learn about key design decisions, security practices, and configuration options
+that affect the security of authd.
+
+```{toctree}
+:titlesonly:
+
+authd security overview <security>
+```
+
+## Documentation
+
+Information about the authd documentation itself.
+
+```{toctree}
+:titlesonly:
+
+Structure of the authd documentation <structure-of-authd-documentation>
+```
diff --git a/docs/explanation/security.md b/docs/explanation/security.md
new file mode 100644
index 0000000000..8b4c2c7177
--- /dev/null
+++ b/docs/explanation/security.md
@@ -0,0 +1,211 @@
+---
+myst:
+  html_meta:
+    "description lang=en":
+      "Design decisions, security practices, and configurations affecting authd security."
+---
+
+# Security overview for authd
+
+authd lets Ubuntu systems verify user identities through trusted cloud identity
+providers and integrate those identities into local logins securely.
+
+This overview outlines the key design decisions, security practices, and
+configuration options that affect the security of authd, and provides guidance
+for administrators on deploying authd securely.
+
+## Deploying authd securely as an administrator
+
+The first section of this overview provides guidance for administrators on
+deploying authd securely, and the second section explains design decisions that
+were made to enhance the security of authd.
+
+### Package updates
+
+Keeping authd up to date is essential to ensure that security fixes are applied
+as soon as they are available.
+
+A full authd installation consists of both the authd Debian package and at least
+one broker snap. Snaps are updated automatically. Further information is
+provided in the [snap documentation on managing updates](https://snapcraft.io/docs/managing-updates).
+
+Update Debian packages regularly, either manually or by enabling
+[automatic updates](https://documentation.ubuntu.com/server/how-to/software/automatic-updates/).
+
+### Security of the identity provider
+
+As described in the [authd architecture](authd-architecture.md) explanation,
+users authenticate with an identity provider, such as Microsoft Entra ID or
+Google IAM. The security of any system using authd therefore depends on the
+security of the configured identity provider.
+
+Ensure that only authorized administrators have access to the identity provider.
+Administrators can add or remove users or change user credentials, which allows
+them to grant, revoke, or modify access to systems using authd.
+
+### Allowed users
+
+In addition to access control at the identity provider's side, allowed users can
+be restricted locally. See the [Configure allowed users](ref::config-allowed-users)
+section for details.
+
+Ensure that only users who should have system access are configured as allowed
+users.
+
+### Local password
+
+To improve usability, authd allows users to create a local password after
+successfully authenticating with the identity provider. This password can then
+be used for subsequent logins without repeating the full identity provider
+authentication flow.
+
+#### Password strength
+
+Strong passwords are critical to prevent unauthorized access.
+
+authd uses libpwquality to enforce password complexity requirements. See the
+[Configure password quality](ref::config-pwquality) section for details.
+
+#### Force provider authentication
+
+If the identity provider is reachable during login, authd verifies that the user
+is still allowed to authenticate with the identity provider. If the user’s
+account has been disabled or removed, login is denied.
+
+By default, if the identity provider cannot be reached (for example, due to
+network issues), users can still log in with their local password. This is to
+prevent accidental lockouts, but it also allows users whose access has been
+revoked at the identity provider to log in while offline.
+
+To enforce verification with the identity provider even when offline, enable the
+[force_provider_authentication](ref::config-force-provider-auth) setting.
+
+### Login via SSH
+
+#### SSH public key authentication
+
+If SSH public key authentication is enabled, users whose access has been revoked
+at the identity provider can still log in using their SSH keys. This is because
+SSH key authentication does not involve authd.
+
+To prevent users with revoked access from logging in with SSH, disable public
+key authentication for users managed by authd, by adding the following to by
+adding the following to `/etc/ssh/sshd_config.d/authd.conf` or directly to
+`/etc/ssh/sshd_config`:
+
+```text
+Match User *@example.com
+    PubkeyAuthentication no
+```
+
+```{note}
+Replace `@example.com` with the domain of your identity provider.
+```
+
+#### SSH password authentication
+
+As described in the [SSH configuration](ref::ssh-configuration) section, PAM
+integration must be enabled in sshd:
+
+```text
+UsePAM yes
+KbdInteractiveAuthentication yes
+```
+
+This setup allows users managed by authd to log in through PAM.
+It also enables PAM-based login for local Unix accounts, even when
+`PasswordAuthentication no` is set.
+
+Administrators who want to deviate from the default SSH configuration and
+disallow password authentication for non-authd users can do so safely by using a
+match block that re-enables keyboard-interactive authentication only for authd
+users:
+
+```text
+KbdInteractiveAuthentication no
+PasswordAuthentication no
+
+Match User *@example.com
+    KbdInteractiveAuthentication yes
+```
+
+```{note}
+Replace `@example.com` with the domain of your identity provider.
+```
+
+### UID and GID conflicts
+
+When a new user logs in for the first time, or when a user is added to a new
+group in the identity provider (for providers that support group management, see
+[Group management](https://documentation.ubuntu.com/authd/stable-docs/reference/group-management/)),
+authd automatically assigns a unique user ID (UID) and group ID (GID).
+
+Before assigning a UID or GID, authd checks that there are no collisions with
+existing users or groups on the system. However, if a user or group is later
+removed, or if the entire authd database (`/var/lib/authd/authd.sqlite3`) is
+deleted, previously assigned IDs can be reused for new users or groups.
+
+This reuse can allow unintended access to files or directories owned by the old
+user, as the new user would inherit their numeric UID or GID.
+
+To avoid this risk:
+
+* Do not remove the authd database.
+* Remove all files and directories owned by any users that you delete,
+  especially if they contain sensitive data.
+
+```{important}
+A tool for removing authd users along with their home directories will be
+provided in the future.
+```
+
+## How authd is designed for security
+
+This section describes how authd is built to protect stored data and limit
+system exposure.
+
+### Stored secrets
+
+authd stores user secrets under
+`/var/snap/authd-<broker>/current/<issuer>/<user>/`.
+
+That directory is created with mode `0700`, ensuring that only root can access
+it.
+
+The secrets that authd stores are described below.
+
+#### Local password
+
+A salted Argon2id hash of the local password is stored for verification. Hashing
+parameters:
+* Memory: 64 KB
+* Iterations: 1
+* Parallelism: 1
+
+#### Tokens and user information
+
+Tokens and user data retrieved during authentication — including the OAuth 2.0
+refresh token and OpenID Connect `UserInfo` response — are cached to support
+login with the local password. These values are currently stored in cleartext.
+
+We recommend enabling [full disk encryption](https://documentation.ubuntu.com/security/docs/security-features/storage/encryption-full-disk/)
+to protect these secrets in case of device theft or loss.
+
+### Sandboxing
+
+authd uses sandboxing to limit system exposure:
+
+* The authd brokers run as [strictly confined](https://snapcraft.io/docs/snap-confinement)
+  snaps. Their only granted interface is network, required to communicate with
+  the identity provider.
+* The authd service uses
+  [systemd sandboxing options](https://manpages.ubuntu.com/manpages/noble/en/man5/systemd.exec.5.html#sandboxing)
+  to restrict access to system resources.
+
+Because authd acts as an authentication service, a vulnerability in authd could
+still be exploited to gain full root privileges.
+
+## Reporting a vulnerability
+
+See the [authd security policy](https://github.com/canonical/authd?tab=security-ov-file#security-ov-file)
+for details on how to report security vulnerabilities in authd.
diff --git a/docs/explanation/structure-of-authd-documentation.md b/docs/explanation/structure-of-authd-documentation.md
new file mode 100644
index 0000000000..0399cf9547
--- /dev/null
+++ b/docs/explanation/structure-of-authd-documentation.md
@@ -0,0 +1,16 @@
+---
+myst:
+  html_meta:
+    "description lang=en":
+      "The authd documentation uses the Diátaxis structure."
+---
+
+# Structure of authd documentation
+
+The authd documentation uses the [Diátaxis structure](https://diataxis.fr/).
+
+Currently, the documentation consists of how-to guides, references, and explanations:
+
+* A [how-to guide](/howto/index) provides you with the steps necessary for completing specific tasks.
+* A [reference](/reference/index) gives you concise and factual information to support your understanding.
+* An [explanation](/explanation/index) includes topic overviews and additional context on the software.
diff --git a/docs/generate.go b/docs/generate.go
new file mode 100644
index 0000000000..9977e4d443
--- /dev/null
+++ b/docs/generate.go
@@ -0,0 +1,7 @@
+//go:build generate
+
+// TiCS: disabled // This is a helper file to generate the CLI documentation
+
+//go:generate sh -c "go run ../cmd/authctl/internal/docgen -format markdown -out reference/cli"
+
+package docs
diff --git a/docs/howto/changing-versions.md b/docs/howto/changing-versions.md
new file mode 100644
index 0000000000..912ff8adfb
--- /dev/null
+++ b/docs/howto/changing-versions.md
@@ -0,0 +1,95 @@
+---
+myst:
+  html_meta:
+    "description lang=en": "Change to the edge release of authd to test new features and bug fixes."
+---
+
+(ref::changing-versions)=
+# Changing authd versions
+
+To test new features or check if a bug has been fixed in a new version,
+you can switch to edge releases of authd and its brokers.
+
+```{warning}
+Do not use the edge PPA in a production system, because it may apply changes to
+the authd database in a non-reversible way, which can make it difficult to roll
+back to the stable version of authd.
+```
+
+## Switch authd to the edge PPA
+
+The [edge
+PPA](https://launchpad.net/~ubuntu-enterprise-desktop/+archive/ubuntu/authd-edge) contains
+the latest fixes and features for authd, in addition to its GNOME Shell (GDM)
+counterpart.
+
+```shell
+sudo add-apt-repository ppa:ubuntu-enterprise-desktop/authd-edge
+sudo apt install authd gnome-shell
+```
+
+Keep in mind that this version is not tested and may be incompatible with the current released version of the brokers.
+
+To switch back to the stable version of authd:
+
+```shell
+sudo apt install ppa-purge
+sudo ppa-purge ppa:ubuntu-enterprise-desktop/authd-edge
+```
+
+## Switch broker snap to the edge channel
+
+You can also switch to the edge channel of the broker snap:
+
+::::{tab-set}
+:sync-group: broker
+
+:::{tab-item} Google IAM
+:sync: google
+
+```shell
+sudo snap switch authd-google --edge
+sudo snap refresh authd-google
+```
+:::
+
+:::{tab-item} Microsoft Entra ID
+:sync: msentraid
+
+```shell
+sudo snap switch authd-msentraid --edge
+sudo snap refresh authd-msentraid
+```
+:::
+::::
+
+Keep in mind that this version is not tested and may be incompatible with the current released version of authd.
+
+To switch back to stable after trying the edge channel:
+
+::::{tab-set}
+:sync-group: broker
+
+:::{tab-item} Google IAM
+:sync: google
+
+```shell
+sudo snap switch authd-google --stable
+sudo snap refresh authd-google
+```
+:::
+
+:::{tab-item} Microsoft Entra ID
+:sync: msentraid
+
+```shell
+sudo snap switch authd-msentraid --stable
+sudo snap refresh authd-msentraid
+```
+:::
+::::
+
+```{note}
+If using an edge release, you can read the
+[edge version of the documentation](https://documentation.ubuntu.com/authd/edge-docs/)
+```
diff --git a/docs/howto/configure-authd.md b/docs/howto/configure-authd.md
index 1b95279ad1..4fa0001b10 100644
--- a/docs/howto/configure-authd.md
+++ b/docs/howto/configure-authd.md
@@ -1,13 +1,16 @@
 ---
 myst:
   html_meta:
-    "description lang=en": "Configure authd and its identity brokers to enable authentication of Ubuntu devices with multiple cloud identity providers, including Google IAM and Microsoft Entra ID."
+    "description lang=en": "Configure authd and its identity brokers to enable
+    authentication of Ubuntu devices with multiple cloud identity providers,
+    including Google IAM, Microsoft Entra ID, and Keycloak."
 ---
 
-# Configure authd for cloud identity providers
+(ref::config)=
+# Configure authd for identity providers
 
 This guide shows how to configure identity brokers to support authentication of
-Ubuntu devices with authd and your chosen cloud provider.
+Ubuntu devices with authd and your chosen identity provider.
 
 ```{admonition} Logging in multiple users with authd
 :class: tip
@@ -30,7 +33,8 @@ Create the directory that will contain the declaration files of the broker(s):
 sudo mkdir -p /etc/authd/brokers.d/
 ```
 
-Then copy the `.conf` file from your chosen broker snap package:
+Then copy the `.conf` file from the broker snap package corresponding to the
+identity provider you want to use:
 
 :::::{tab-set}
 :sync-group: broker
@@ -51,10 +55,19 @@ sudo cp /snap/authd-google/current/conf/authd/google.conf /etc/authd/brokers.d/
 sudo cp /snap/authd-msentraid/current/conf/authd/msentraid.conf /etc/authd/brokers.d/
 ```
 
+::::
+
+::::{tab-item} Keycloak
+:sync: keycloak
+
+```shell
+sudo cp /snap/authd-oidc/current/conf/authd/oidc.conf /etc/authd/brokers.d/
+```
+
 ::::
 :::::
 
-This file is used to declare the brokers available on the system. 
+This file is used to declare the brokers available on the system.
 
 ```{note}
 Several brokers can be enabled at the same time.
@@ -71,27 +84,25 @@ broker can then use to authenticate users.
 ::::{tab-item} Google IAM
 :sync: google
 
-### Google IAM
-
-Register a new application in Google IAM. Once the application is registered, note the `Client ID` and the `Client secret`. These values are respectively the `<CLIENT_ID>` and `<CLIENT_SECRET>` that will be used in the next section.
+To register a new application in Google IAM, go to the [Credentials page](https://console.cloud.google.com/apis/credentials).
 
-To register a new application go to the [Credentials page](https://console.cloud.google.com/apis/credentials).
-
-Click `Create credentials > OAuth client ID`.
+Click {menuselection}`Create credentials --> OAuth client ID`.
 
 ![Menu showing selection of Create credentials > OAuth client ID.](../assets/google-app-registration.png)
 
-Select the `TVs and Limited Input devices` application type.
+Select the {guilabel}`TVs and Limited Input devices` application type.
 
 ![Menu showing app type.](../assets/google-choose-app-type.png)
 
-Name your OAuth 2.0 client and click `Create`.
+Name your OAuth 2.0 client and click {guilabel}`Create`.
 
-Your app's `Client ID` and `Client Secret` will be shown on your page, store them somewhere as you will need them in the next step.
+Your app's `Client ID` and `Client secret` will be shown on the page, store them
+somewhere as you will need them in the next step.
 
 ![Screen showing app credentials.](../assets/google-app-credentials.png)
 
-For more detailed information please refer to the [OAuth 2.0 for TV and Limited-Input Device Applications documentation](https://developers.google.com/identity/protocols/oauth2/limited-input-device).
+For more detailed information please refer to the [OAuth 2.0 for TV and
+Limited-Input Device Applications documentation](https://developers.google.com/identity/protocols/oauth2/limited-input-device).
 
 
 ::::
@@ -99,29 +110,88 @@ For more detailed information please refer to the [OAuth 2.0 for TV and Limited-
 ::::{tab-item} Microsoft Entra ID
 :sync: msentraid
 
-Register a new application in the Microsoft Azure portal. Once the application is registered, note the `Application (client) ID` and the `Directory (tenant) ID` from the `Overview` menu. These IDs are respectively a `<CLIENT_ID>` and `<ISSUER_ID>` that will be used in the next section.
-
-To register a new application, in Entra, select the menu `Identity > Applications > App registration`
+Register a new application in the Microsoft Entra admin center. To register a 
+new application, select the menu {menuselection}`Entra ID --> App registrations`:
 
-![Menu showing selection of App registrations under Applications.](../assets/app-registration.png)
+![Menu showing selection of App registrations under Applications.](../assets/entraid-app-registration.png)
 
-Then `New registration`
+Then {guilabel}`New registration`:
 
-![User interface showing selection of New registration in App registrations.](../assets/new-registration.png)
+![User interface showing selection of New registration in App registrations.](../assets/entraid-new-registration.png)
 
-And configure it as follows:
+Choose a name for the application, for example "Ubuntu authd", and the
+appropriate account type for your use case. Then click on {guilabel}`Register`
+to create the application.
 
-![Configuration screen for the new registration.](../assets/configure-registration.png)
+Once registered, note the {guilabel}`Application (client) ID` and the
+{guilabel}`Directory (tenant) ID`. These IDs correspond to the `<CLIENT_ID>` and
+`<ISSUER_ID>`, respectively, which are used in the next section.
 
-Under `Manage`, in the `API permissions` menu, set the following Microsoft Graph permissions:
+In {menuselection}`Manage --> API permissions`, set the following **Microsoft
+Graph** permissions:
 
-![Configuration screen for Microsoft Graph permissions.](../assets/graph-permissions.png)
+![Configuration screen for Microsoft Graph permissions.](../assets/entraid-graph-permissions.png)
 
 Ensure the API permission type is set to **Delegated** for each permission.
 
-Finally, as the supported authentication mechanism is the device workflow, you need to allow the public client workflows. Under `Manage`, in the `Authentication` menu, under `Advanced settings`, ensure that `Allow public client flows` is set to **Yes**.
+The {guilabel}`GroupMember.Read.All` permission needs admin consent. Click on
+{guilabel}`Grant admin consent for <TENANT_NAME>` to provide this consent.
 
-[The Microsoft documentation](https://learn.microsoft.com/en-us/entra/identity-platform/quickstart-register-app) provides detailed instructions for registering an application with the Microsoft identity platform.
+Finally, as the supported authentication mechanism is the device workflow, you
+need to allow the public client workflows. In {menuselection}`Manage -->
+Authentication (Preview) --> Settings`, ensure that {guilabel}`Allow public
+client flows` is set to **Enabled**.
+
+[The Microsoft documentation](https://learn.microsoft.com/en-us/entra/identity-platform/quickstart-register-app)
+provides detailed instructions for registering an application with the Microsoft
+identity platform.
+
+### Redirect URI
+
+If you plan to use the device registration feature (see [configure device
+registration](#configure-device-registration)), you need to configure a redirect
+URI for the application. Go to {menuselection}`Manage --> Authentication
+(Preview)`, click on {guilabel}`Add Redirect URI`, then choose {guilabel}`Mobile
+and desktop applications` and select the following URI:
+
+```
+https://login.microsoftonline.com/common/oauth2/nativeclient
+```
+
+::::
+
+::::{tab-item} Keycloak
+:sync: keycloak
+
+Register a new client in Keycloak. Go to {menuselection}`Manage --> Clients` and
+create the client.
+
+![Create client button being clicked.](../assets/keycloak-create-client.png)
+
+Configure the client as follows:
+
+1. General settings
+    * Set the client type to {guilabel}`OpenID Connect`.
+    * Pick a valid client ID, for example, `ubuntu-authd`.
+      This corresponds to the `<CLIENT_ID>` which is used in the next section.
+2. Capability config
+    * (Optional) Enable client authentication
+    * Enable the {guilabel}`OAuth 2.0 Device Authorization Grant` authentication
+      flow.
+3. Login settings
+   * No need to change anything here.
+
+Finally, click on {guilabel}`Save` to create the client.
+
+If you enabled client authentication, find the client secret in the
+{guilabel}`Credentials` tab. This corresponds to the `<CLIENT_SECRET>` in the
+next section.
+
+```{admonition} Set email addresses for users
+:class: tip
+Make sure that all users who should be able to log in through this broker have
+an email address configured in Keycloak.
+```
 
 ::::
 :::::
@@ -129,7 +199,8 @@ Finally, as the supported authentication mechanism is the device workflow, you n
 
 ## Broker configuration
 
-Now we can configure the broker. Note that different brokers can require different configuration data.
+Now we can configure the broker. Note that different brokers can require
+different configuration data.
 
 :::::{tab-set}
 :sync-group: broker
@@ -144,7 +215,6 @@ To configure Google IAM, edit  `/var/snap/authd-google/current/broker.conf`:
 issuer = https://accounts.google.com
 client_id = <CLIENT_ID>
 client_secret = <CLIENT_SECRET>
-force_provider_authentication = false
 ```
 ::::
 
@@ -157,18 +227,39 @@ To configure Entra ID, edit  `/var/snap/authd-msentraid/current/broker.conf`:
 [oidc]
 issuer = https://login.microsoftonline.com/<ISSUER_ID>/v2.0
 client_id = <CLIENT_ID>
-force_provider_authentication = false
 ```
+::::
+
+::::{tab-item} Keycloak
+:sync: keycloak
+
+To configure the authd-oidc broker for Keycloak, edit
+`/var/snap/authd-oidc/current/broker.conf`:
+
+```ini
+[oidc]
+issuer = https://<host>/realms/<realm-name>
+client_id = <CLIENT_ID>
+```
+
+If you enabled client authentication, you also need to add the client secret:
+
+```ini
+client_secret = <CLIENT_SECRET>
+```
+
 ::::
 :::::
 
+(ref::config-force-provider-auth)=
 ## Force remote authentication with the identity provider
 
-By default, remote authentication with the identity provider only happens
-if there is a working internet connection and the provider is reachable during login.
+By default, remote authentication with the identity provider only happens if
+there is a working internet connection and the provider is reachable during
+login.
 
-If you want to force remote authentication, even when the provider is unreachable,
-enable it as follows:
+If you want to force remote authentication, even when the provider is
+unreachable, enable it as follows:
 
 ```ini
 [oidc]
@@ -180,6 +271,24 @@ force_provider_authentication = true
 In some cases, this may prevent login, such as when there are network issues.
 ```
 
+(ref::config-extra-scopes)=
+
+## Configure extra scopes
+
+Some identity providers require additional OIDC scopes beyond the default ones
+to function correctly. For example, Okta requires the `offline_access` scope to
+return a refresh token in the authentication response.
+
+You can specify extra scopes in the `oidc` section of the broker configuration
+file:
+
+```ini
+[oidc]
+...
+## Comma-separated list of extra OIDC scopes to request
+extra_scopes = offline_access
+```
+
 (ref::config-allowed-users)=
 ## Configure allowed users
 
@@ -218,9 +327,10 @@ identity provider) are configured in the `users` section of the
 #owner =
 ```
 
-By default, the first person to log in to the machine is automatically registered
-as the owner. If you wish to override this behavior then specify a list of allowed
-users with the `allowed_users` option, while omitting the `OWNER` keyword:
+By default, the first person to log in to the machine is automatically
+registered as the owner. If you wish to override this behavior then specify a
+list of allowed users with the `allowed_users` option, while omitting the
+`OWNER` keyword:
 
 ```text
 allowed_users = person1@email.com,person2@email.com
@@ -233,13 +343,140 @@ option:
 owner = your@email.com
 ```
 
-Explicitly setting an empty owner, has the same effect as omitting the `OWNER` keyword
-in `allowed_users`:
+Explicitly setting an empty owner, has the same effect as omitting the `OWNER`
+keyword in `allowed_users`:
 
 ```text
 owner = ""
 ```
 
+:::::{admonition} Only my first logged-in user has access to the machine?
+:class: important
+By default, the first logged-in user is defined as the "owner" and only the
+owner can log in.
+To allow more users to log in, update the list of allowed users.
+
+If an administrator is the first to log in to a machine and becomes the owner,
+they can ensure that the next user to log in becomes the owner by removing the
+`20-owner-autoregistration.conf` file:
+
+::::{tab-set}
+:sync-group: broker
+
+:::{tab-item} Google IAM
+:sync: google
+
+```shell
+sudo rm /var/snap/authd-google/current/broker.conf.d/20-owner-autoregistration.conf
+```
+:::
+
+:::{tab-item} Microsoft Entra ID
+:sync: msentraid
+
+```shell
+sudo rm /var/snap/authd-msentraid/current/broker.conf.d/20-owner-autoregistration.conf
+```
+:::
+
+:::{tab-item} Keycloak
+:sync: keycloak
+
+```shell
+sudo rm /var/snap/authd-oidc/current/broker.conf.d/20-owner-autoregistration.conf
+```
+:::
+::::
+
+
+This file is generated when a user logs in and becomes the owner. If it is
+removed, it will be regenerated on the next successful login.
+
+:::::
+
+(ref::config-user-groups)=
+## Configure user groups
+
+Some brokers support adding users to groups that are configured in the identity
+provider.
+
+> See the [group management reference](reference::group-management) for more details.
+
+In addition, you can configure extra groups for authd users.
+On login, the users are added to these groups automatically.
+Specify any extra groups in the `users` section of the broker
+configuration file:
+
+```ini
+[users]
+## A comma-separated list of local groups which authd users will be
+## added to upon login.
+## Example: extra_groups = users
+#extra_groups =
+```
+
+There is also an `owner_extra_groups` option for specifying additional local
+groups, to which only the user with the [owner role](#configure-allowed-users)
+is added:
+
+```ini
+## Like 'extra_groups', but only the user assigned the owner role
+## will be added to these groups.
+## Example: owner_extra_groups = sudo,lpadmin
+#owner_extra_groups =
+```
+
+(ref::device-registration)=
+## Configure device registration
+
+:::::{tab-set}
+:sync-group: broker
+
+::::{tab-item} Google IAM
+:sync: google
+
+The Google IAM broker does not support device registration.
+::::
+
+::::{tab-item} Microsoft Entra ID
+:sync: msentraid
+
+When using the Microsoft Entra ID broker, you can enable automatic device
+registration, which allows administrators to manage registered devices in the
+Microsoft Entra admin center.
+
+Automatic device registration can be enabled with the `register_device`
+option in the `msentraid` section of the broker configuration file:
+
+```ini
+[msentraid]
+## Enable automatic device registration with Microsoft Entra ID
+## when a user logs in through this broker.
+##
+## If set to true, authd will attempt to register the local machine
+## as a device in Entra ID upon successful login.
+##
+## If set to false (the default), device registration will be skipped.
+#register_device = false
+```
+
+```{admonition} Changing this option forces re-authentication
+:class: note
+When changing this option, users are forced to re-authenticate via device
+authentication on the next login.
+```
+
+```{admonition} Set the redirect URI
+:class: tip
+Make sure that the application in the Microsoft Entra admin center has a
+redirect URI configured as described in [Redirect URI](#redirect-uri).
+```
+::::
+
+::::{tab-item} Keycloak
+:sync: keycloak
+
+The authd-oidc broker does not support device registration.
 ::::
 :::::
 
@@ -251,7 +488,8 @@ When a configuration file is added you have to restart authd:
 sudo systemctl restart authd
 ```
 
-When the configuration of a broker is updated, you also have to restart the broker:
+When the configuration of a broker is updated, you also have to restart the
+broker:
 
 :::::{tab-set}
 :sync-group: broker
@@ -272,9 +510,73 @@ sudo snap restart authd-google
 sudo snap restart authd-msentraid
 ```
 
+::::
+
+::::{tab-item} Keycloak
+:sync: keycloak
+
+```shell
+sudo snap restart authd-oidc
+```
+
 ::::
 :::::
 
-## System configuration
+## Configure login timeout
+
+By default on Ubuntu, the login timeout is 60s.
+
+This may be too brief for a device code flow authentication.
+
+It can be modified by changing the value of `LOGIN_TIMEOUT` in `/etc/login.defs`.
+
+## Configure the authd service
+
+The authd service is configured in `/etc/authd/authd.yaml`.
+
+This provides configuration options for logging verbosity and UID/GID ranges.
+
+(ref::config-pwquality)=
+## Configure password quality
+
+You can change authd's local password policy to ensure that users always set
+strong passwords.
+
+If your mobile device management (MDM) solution includes a compliance check for
+the passwords of authd users, you may also need to configure authd's password
+policy so that it matches that of the MDM.
+
+authd depends on the libpwquality library, which supports configuring password
+quality.
+
+To configure the local password policy for authd, create a drop file in
+`/etc/security/pwquality.conf.d/`.
+This will override the default values in `/etc/security/pwquality.conf`.
+
+First, create a directory for the custom configuration file:
+
+```shell
+sudo mkdir -p /etc/security/pwquality.conf.d/
+```
+
+Then edit the file to add your settings.
+
+```shell
+sudoedit /etc/security/pwquality.conf.d/99_custom-options.conf
+```
+
+For example, if your policy requires that passwords have a 14 character minimum,
+edit the drop file to set the value for `minlen`:
+
+```{code-block} diff
+:caption: /etc/security/pwquality.conf.d/99_custom-options.conf
+# This file overrides the defaults set in /etc/security/pwquality.conf
+# Refer to the pwquality file for additional configuration options.
+# Minimum acceptable size for the new password (plus one if
+# credits are not disabled which is the default). (See pam_cracklib manual.)
+# Cannot be set to lower value than 6 (default is 8).
+minlen = 14
+```
 
-By default on Ubuntu, the login timeout is 60s. This may be too brief for a device code flow authentication. It can be set to a different value by changing the value of `LOGIN_TIMEOUT` in `/etc/login.defs`
+> The [man pages](https://manpages.ubuntu.com/manpages/noble/man5/pwquality.conf.5.html)
+provide a full list of configuration options for the libpwquality library.
diff --git a/docs/howto/contributing.md b/docs/howto/contributing.md
index 962118c0f9..a48a630771 100644
--- a/docs/howto/contributing.md
+++ b/docs/howto/contributing.md
@@ -1,3 +1,9 @@
+---
+myst:
+  html_meta:
+    "description lang=en": "Guidelines on contributing to the authd code and documentation."
+---
+
 % Include content from [../CONTRIBUTING.md](../CONTRIBUTING.md)
 ```{include} ../../CONTRIBUTING.md
     :start-after: <!-- Include start contributing intro -->
diff --git a/docs/howto/enter-recovery-mode.md b/docs/howto/enter-recovery-mode.md
new file mode 100644
index 0000000000..2e349fd210
--- /dev/null
+++ b/docs/howto/enter-recovery-mode.md
@@ -0,0 +1,32 @@
+---
+myst:
+  html_meta:
+    "description lang=en": "Guide on entering recovery mode after a failed login attempt with authd."
+---
+
+# How to enter recovery mode after failed login
+
+If authd and/or the broker are missing, corrupted, or broken in any way, a user may
+be prevented from logging in.
+
+To get access to the system for modifying configurations and installations in
+such cases, there are two main options:
+
+1. Log in as root user or another local user with administrator privileges
+2. Boot into recovery mode to get root access
+
+The steps required for entering recovery mode are included below.
+
+## Boot into recovery mode
+
+If it is not possible to log in with the root user account or another local
+user account with administrator privileges, the user can boot into recovery
+mode:
+
+1. Reboot the device
+2. During the reboot, press and hold the right <kbd>SHIFT</kbd> key
+3. When the Grub menu appears, select `advanced options for Ubuntu`
+4. Choose `recovery mode` for the correct kernel version
+5. Select `drop to root shell prompt`
+
+The user then has access to the root filesystem and can proceed with debugging.
diff --git a/docs/howto/index.md b/docs/howto/index.md
index 9021e152de..48d2ac3c86 100644
--- a/docs/howto/index.md
+++ b/docs/howto/index.md
@@ -1,46 +1,80 @@
+---
+myst:
+  html_meta:
+    "description lang=en":
+      "authd how-to guides covering installation, configuration, user login, network file systems, and contributing."
+---
+
 (howtos)=
 
 # How-to guides
 
+These guides walk you through key operations you can perform with authd.
+
 ## Installation and configuration
 
-Install authd and identity brokers then configure them for your cloud identity
-provider.
+Installation of the authd daemon and an identity broker is required to support
+authentication of Ubuntu devices, with various options available for
+configuring authentication behavior and user management:
 
 ```{toctree}
 :titlesonly:
 
-Install authd <install-authd>
-Configure authd <configure-authd>
+Installing authd <install-authd>
+Configuring authd <configure-authd>
 ```
 
 ## Login and authentication
 
-Read about how users can authenticate when
-logging into Ubuntu Desktop or Server.
-
+Users can log in and authenticate on Ubuntu Desktop or Ubuntu Server, with
+authd supporting both GDM and SSH:
 
 ```{toctree}
 :titlesonly:
 
-Log in with GDM <login-gdm>
-Log in with SSH <login-ssh>
+Logging in with GDM <login-gdm>
+Logging in with SSH <login-ssh>
 ```
 
 ## Network file systems
 
-Learn how to use authd with different network file systems.
+If using a network file system to access shared directories from
+authd-enabled machines, you can use ID mapping:
+
+```{toctree}
+:titlesonly:
+
+Using authd with NFS <use-with-nfs>
+Using authd with Samba <use-with-samba>
+```
+
+## Debugging and troubleshooting
+
+When troubleshooting authd, you may need to work with logs or enter recovery
+mode:
+
+```{toctree}
+:titlesonly:
+
+Accessing and configuring logs <logging>
+Entering recovery mode on failed login <enter-recovery-mode>
+```
+
+## Updating and upgrading
+
+Use the stable version of authd for production use, or switch to the edge
+version to try new features:
 
 ```{toctree}
 :titlesonly:
 
-Use authd with NFS <use-with-nfs>
-Use authd with Samba <use-with-samba>
+Changing authd versions <changing-versions>
 ```
 
 ## Contributing to authd
 
-Contribute to the development of authd and its brokers.
+Contribute to the development of authd and its brokers, in addition to the
+authd documentation:
 
 ```{toctree}
 :titlesonly:
diff --git a/docs/howto/install-authd.md b/docs/howto/install-authd.md
index 3863bb144b..e82999e279 100644
--- a/docs/howto/install-authd.md
+++ b/docs/howto/install-authd.md
@@ -5,7 +5,7 @@ myst:
 ---
 
 (howto::install)=
-# Install authd and brokers for cloud identity providers
+# Install authd and brokers for identity providers
 
 This project consists of two components:
 * **authd**: The authentication daemon responsible for managing access to the authentication mechanism.
@@ -22,11 +22,10 @@ authd is delivered as a Debian package for Ubuntu Desktop and Ubuntu Server.
 
 You can install authd from the [stable PPA](https://launchpad.net/~ubuntu-enterprise-desktop/+archive/ubuntu/authd).
 
-To add this PPA to your system's software sources, run the following commands:
+To add this PPA to your system's software sources, run the following command:
 
 ```shell
 sudo add-apt-repository ppa:ubuntu-enterprise-desktop/authd
-sudo apt update
 ```
 
 ```{note}
@@ -59,8 +58,8 @@ sudo apt install authd
 
 ## Install brokers
 
-The brokers are provided as Snap packages and are available from the Snap
-Store.
+The brokers are provided as snap packages and are available from the Snap Store.
+Install the broker corresponding to the identity provider that you want to use:
 
 :::::{tab-set}
 :sync-group: broker
@@ -81,7 +80,7 @@ authenticate against Google IAM.
 ::::{tab-item} Microsoft Entra ID
 :sync: msentraid
 
-To install the MS Entra ID broker, run the following command:
+To install the Microsoft Entra ID broker, run the following command:
 
 ```shell
 sudo snap install authd-msentraid
@@ -91,4 +90,20 @@ At this stage, you have installed the main service and an identity broker to
 authenticate against Microsoft Entra ID.
 
 ::::
+
+::::{tab-item} Keycloak
+:sync: keycloak
+
+Keycloak can be used with the generic OIDC broker. Install the broker with the
+following command:
+
+```shell
+sudo snap install authd-oidc
+```
+
+At this stage, you have installed the main service and an identity broker to
+authenticate against Keycloak or any other OIDC provider.
+
+::::
+
 :::::
diff --git a/docs/howto/logging.md b/docs/howto/logging.md
new file mode 100644
index 0000000000..e626ea3648
--- /dev/null
+++ b/docs/howto/logging.md
@@ -0,0 +1,178 @@
+---
+myst:
+  html_meta:
+    "description lang=en": "Get logs from authd and configure logging behavior."
+---
+
+(ref::logging)=
+# Accessing and configuring logs
+
+Logs are generated for authd and its brokers, which can help when
+troubleshooting and reporting bugs.
+
+## authd
+
+`authd` logs to the system journal.
+
+For `authd` entries, run:
+
+```shell
+sudo journalctl -u authd.service
+```
+
+If you want logs for authd and all brokers on the system, run:
+
+```shell
+sudo journalctl -u authd.service -u "snap.authd-*.service"
+```
+
+For specific broker entries run the command for your chosen broker:
+
+::::{tab-set}
+:sync-group: broker
+
+:::{tab-item} Google IAM
+:sync: google
+
+```shell
+sudo journalctl -u snap.authd-google.authd-google.service
+```
+:::
+
+:::{tab-item} Microsoft Entra ID
+:sync: msentraid
+
+```shell
+sudo journalctl -u snap.authd-msentraid.authd-msentraid.service
+```
+:::
+::::
+
+For the GDM integration:
+
+```shell
+sudo journalctl /usr/bin/gnome-shell
+```
+
+For anything else or more broader investigation, use `sudo journalctl`.
+
+## Configure logging verbosity
+
+You can increase the verbosity of the logs in different ways.
+
+### PAM module
+
+To increase the verbosity of the PAM messages,
+append `debug=true` to all lines that include `pam_authd_exec.so` or `pam_authd.so`
+in the PAM configuration files in `/etc/pam.d/` :
+
+```shell
+sudo sed -i '/pam_authd_exec\.so\|pam_authd\.so/ s/$/ debug=true/' /etc/pam.d/*
+```
+
+### NSS module
+
+To get more info on NSS requests to authd,
+export the `AUTHD_NSS_INFO=stderr` environment variable on any program using the
+authd NSS module.
+
+### authd service
+
+To increase the verbosity of the service itself, edit the service file:
+
+```shell
+sudo systemctl edit authd.service
+```
+
+Add the following lines to the override file and make sure to add `-vv` at the
+end of the `authd` command:
+
+```ini
+[Service]
+ExecStart=
+ExecStart=/usr/libexec/authd -vv
+```
+
+Then you need to restart the service with `sudo systemctl restart authd`.
+
+### GDM
+
+Ensure the lines in `/etc/gdm3/custom.conf` are not commented:
+
+```ini
+[debug]
+# Uncomment the line below to turn on debugging
+# More verbose logs
+# Additionally lets the X server dump core if it crashes
+Enable=true
+```
+
+Then you need to restart the service with `sudo systemctl restart gdm`.
+
+### authd broker service
+
+To increase the verbosity of the broker service, edit the service file:
+
+::::{tab-set}
+:sync-group: broker
+
+:::{tab-item} Google IAM
+:sync: google
+
+```shell
+sudo systemctl edit snap.authd-google.authd-google.service
+```
+:::
+
+:::{tab-item} Microsoft Entra ID
+:sync: msentraid
+
+```shell
+sudo systemctl edit snap.authd-msentraid.authd-msentraid.service
+```
+:::
+::::
+
+Add the following lines to the override file and make sure to add `-vv` to the
+exec command:
+
+::::{tab-set}
+:sync-group: broker
+
+:::{tab-item} Google IAM
+:sync: google
+
+```ini
+[Service]
+ExecStart=
+ExecStart=/usr/bin/snap run authd-google -vv
+```
+:::
+
+:::{tab-item} Microsoft Entra ID
+:sync: msentraid
+
+```ini
+[Service]
+ExecStart=
+ExecStart=/usr/bin/snap run authd-msentraid -vv
+```
+::::
+
+You will then need to restart the service with:
+
+::::{tab-set}
+:sync-group: broker
+
+:::{tab-item} Google IAM
+:sync: google
+
+`sudo snap restart authd-google`.
+:::
+
+:::{tab-item} Microsoft Entra ID
+:sync: msentraid
+
+`sudo snap restart authd-msentraid`.
+:::
+::::
diff --git a/docs/howto/login-gdm.md b/docs/howto/login-gdm.md
index 46740fecf0..5a3b634e44 100644
--- a/docs/howto/login-gdm.md
+++ b/docs/howto/login-gdm.md
@@ -1,9 +1,15 @@
+---
+myst:
+  html_meta:
+    "description lang=en": "Use authd for cloud-based login to Ubuntu with GDM."
+---
+
 # Log in with GDM
 
 ## Logging in with a remote provider
 
 Once the system is configured you can log into your system using your remote provider credentials and the device code flow.
-In this example, we are going to use MS Entra ID as the remote provider but the process is equivalent for other providers.
+In this example, we are going to use Microsoft Entra ID as the remote provider but the process is equivalent for other providers.
 
 > See all the available providers: [Install brokers](./install-authd.md#install-brokers)
 
diff --git a/docs/howto/login-ssh.md b/docs/howto/login-ssh.md
index f791bd5558..a772ec0359 100644
--- a/docs/howto/login-ssh.md
+++ b/docs/howto/login-ssh.md
@@ -1,9 +1,16 @@
+---
+myst:
+  html_meta:
+    "description lang=en": "Use authd for cloud-based login to Ubuntu with SSH."
+---
+
 # Log in with SSH
 
 ## Server configuration
 
 To enable SSH access with `authd` you must configure `sshd` and the broker.
 
+(ref::ssh-configuration)=
 ### SSH configuration
 
 To configure SSH, create a file `/etc/ssh/sshd_config.d/authd.conf` with the following content:
@@ -44,7 +51,7 @@ ssh_allowed_suffixes = @example.com,@ubuntu.com
 
 Once this is all set up, you can ssh to the server in the same way that you would do with any server: `ssh <username>@<host>`. The format of `<username>` is the user handle on the provider, such as `user@domain.tld`.
 
-For instance, here is an example using MS Entra ID as a provider:
+For instance, here is an example using Microsoft Entra ID as a provider:
 
 ```shell
 ssh user@domain.tld@remote.host
diff --git a/docs/howto/use-with-nfs.md b/docs/howto/use-with-nfs.md
index ab90c1abbf..845d780d11 100644
--- a/docs/howto/use-with-nfs.md
+++ b/docs/howto/use-with-nfs.md
@@ -1,3 +1,9 @@
+---
+myst:
+  html_meta:
+    "description lang=en": "Use authd with an NFS server."
+---
+
 # Using authd with NFS
 
 The user identifiers (UIDs) and group identifiers (GIDs) assigned by authd are
diff --git a/docs/howto/use-with-samba.md b/docs/howto/use-with-samba.md
index d1b090aa59..655cba9b95 100644
--- a/docs/howto/use-with-samba.md
+++ b/docs/howto/use-with-samba.md
@@ -1,3 +1,9 @@
+---
+myst:
+  html_meta:
+    "description lang=en": "Use authd with a Samba server."
+---
+
 # Using authd with Samba
 
 The user identifiers (UIDs) and group identifiers (GIDs) assigned by authd are
diff --git a/docs/index.md b/docs/index.md
index 26d0785a87..4ef631317b 100644
--- a/docs/index.md
+++ b/docs/index.md
@@ -13,8 +13,8 @@ authentication, enabling cloud-based identity management for Ubuntu Desktop and
 Server.
 
 authd has a modular design, comprising an authentication daemon and various
-identity brokers. This enables authd to support a growing list of cloud
-identity providers. Currently, authd supports authentication with both [MS
+identity brokers. This enables authd to support a growing list of identity 
+providers. Currently, authd supports authentication with both [MS
 Entra ID](https://learn.microsoft.com/en-us/entra/fundamentals/whatis) and
 [Google IAM](https://cloud.google.com/iam/docs/overview). An example broker is
 also provided to help developers create new brokers for additional identity
@@ -24,14 +24,7 @@ If an organization is pursuing cloud-based authentication of Ubuntu
 workstations and servers, authd is a secure and versatile service to support a
 full transition to the cloud.
 
-## In this documentation
-
-<!-- NOTE: changed grid layout as there is only three cards -->
-::::::{grid} 1 1 1 1
-
-:::::{grid-item-card} [How-to guides](howto/index)
-
-**Step-by-step guides** covering key operations for your chosen identity provider.
+## Supported identity providers
 
 ::::{tab-set}
 :sync-group: broker
@@ -43,39 +36,30 @@ full transition to the cloud.
 * <a href="howto/configure-authd/?broker=google">Configure the Google IAM broker</a>
 :::
 
-:::{tab-item} MS Entra ID
+:::{tab-item} Microsoft Entra ID
 :sync: msentraid
 
-* <a href="howto/install-authd/?broker=msentraid">Install authd and the MS Entra ID broker</a>
-* <a href="howto/configure-authd/?broker=msentraid">Configure the MS Entra ID broker</a>
+* <a href="howto/install-authd/?broker=msentraid">Install authd and the Microsoft Entra ID broker</a>
+* <a href="howto/configure-authd/?broker=msentraid">Configure the Microsoft Entra ID broker</a>
 :::
+:::{tab-item} Keycloak
+:sync: keycloak
 
-::::::
-
-::::::{grid} 1 1 2 2
-:reverse:
-
-:::::{grid-item-card} [Reference](reference/index)
-:link: reference/index
-:link-type: doc
-
-**Technical information** on supported cloud providers and troubleshooting authd.
-:::::
-
-:::::{grid-item-card} [Explanation](explanation/index)
-:link: explanation/index
-:link-type: doc
+* <a href="howto/install-authd/?broker=keycloak">Install authd and the generic OIDC broker</a>
+* <a href="howto/configure-authd/?broker=keycloak">Configure the generic OIDC broker for Keycloak</a>
+:::
 
-**Architecture reference for authd**, showing how its brokers interface with multiple cloud
-providers.
 :::::
 
-::::::
-
-Documentation for the [stable](https://canonical-authd.readthedocs-hosted.com/en/stable/) release of authd and the [latest](https://canonical-authd.readthedocs-hosted.com/en/latest/) development version are
-both available.
+## In this documentation
 
----------
+* **Setup**: [Installing authd](/howto/install-authd/) • [Configuring authd](/howto/configure-authd/) • [Changing authd versions](/howto/changing-versions/)
+* **User login**: [Logging in with GDM](/howto/login-gdm/) • [Logging in with SSH](/howto/login-ssh/)
+* **Deployment**: [Deploying with Landscape](/reference/landscape-deploy/) • [Deploying with cloud-init](/reference/cloud-init-deploy/)
+* **Network file systems**: [Using with NFS](/howto/use-with-nfs/) • [Using with Samba](/howto/use-with-samba/)
+* **authd design**: [Architecture](/explanation/authd-architecture/) • [Security overview](/explanation/security/)
+* **Troubleshooting**: [Accessing logs](/howto/logging/) • [Entering recovery mode on failed login](/howto/enter-recovery-mode/)
+* **Documentation**: [How this documentation is structured](/explanation/structure-of-authd-documentation)
 
 ## Project and community
 
diff --git a/docs/reference/cli/authctl.md b/docs/reference/cli/authctl.md
new file mode 100644
index 0000000000..0bfe0cc8c0
--- /dev/null
+++ b/docs/reference/cli/authctl.md
@@ -0,0 +1,23 @@
+## authctl
+
+Manage authd users and groups
+
+### Synopsis
+
+authctl is a command-line tool for managing users and groups handled by authd.
+
+```
+authctl [flags]
+```
+
+### Options
+
+```
+  -h, --help   help for authctl
+```
+
+### SEE ALSO
+
+* [authctl group](authctl_group.md)	 - Commands related to groups
+* [authctl user](authctl_user.md)	 - Commands related to users
+
diff --git a/docs/reference/cli/authctl_group.md b/docs/reference/cli/authctl_group.md
new file mode 100644
index 0000000000..1275b8e579
--- /dev/null
+++ b/docs/reference/cli/authctl_group.md
@@ -0,0 +1,19 @@
+## authctl group
+
+Commands related to groups
+
+```
+authctl group [flags]
+```
+
+### Options
+
+```
+  -h, --help   help for group
+```
+
+### SEE ALSO
+
+* [authctl](authctl.md)	 - Manage authd users and groups
+* [authctl group set-gid](authctl_group_set-gid.md)	 - Set the GID of a group managed by authd
+
diff --git a/docs/reference/cli/authctl_group_set-gid.md b/docs/reference/cli/authctl_group_set-gid.md
new file mode 100644
index 0000000000..d008b4a93b
--- /dev/null
+++ b/docs/reference/cli/authctl_group_set-gid.md
@@ -0,0 +1,41 @@
+## authctl group set-gid
+
+Set the GID of a group managed by authd
+
+### Synopsis
+
+Set the GID of a group managed by authd to the specified value.
+
+The new GID must be unique and non-negative. The command must be run as root.
+
+When a group's GID is changed, any users whose primary group is set to this
+group will have the GID of their primary group updated. The home directories of
+these users, and any files within these directories that are owned by the group,
+will be updated to the new GID.
+
+Files outside users' home directories are not updated and must be changed
+manually. Note that changing a GID can be unsafe if files on the system are
+still owned by the original GID: those files may become accessible to a
+different group that is later assigned that GID.
+
+```
+authctl group set-gid <group> <gid> [flags]
+```
+
+### Examples
+
+```
+  # Set the GID of group "staff" to 30000
+  authctl group set-gid staff 30000
+```
+
+### Options
+
+```
+  -h, --help   help for set-gid
+```
+
+### SEE ALSO
+
+* [authctl group](authctl_group.md)	 - Commands related to groups
+
diff --git a/docs/reference/cli/authctl_user.md b/docs/reference/cli/authctl_user.md
new file mode 100644
index 0000000000..b1911a0393
--- /dev/null
+++ b/docs/reference/cli/authctl_user.md
@@ -0,0 +1,21 @@
+## authctl user
+
+Commands related to users
+
+```
+authctl user [flags]
+```
+
+### Options
+
+```
+  -h, --help   help for user
+```
+
+### SEE ALSO
+
+* [authctl](authctl.md)	 - Manage authd users and groups
+* [authctl user lock](authctl_user_lock.md)	 - Lock (disable) a user managed by authd
+* [authctl user set-uid](authctl_user_set-uid.md)	 - Set the UID of a user managed by authd
+* [authctl user unlock](authctl_user_unlock.md)	 - Unlock (enable) a user managed by authd
+
diff --git a/docs/reference/cli/authctl_user_lock.md b/docs/reference/cli/authctl_user_lock.md
new file mode 100644
index 0000000000..b44c1614c6
--- /dev/null
+++ b/docs/reference/cli/authctl_user_lock.md
@@ -0,0 +1,22 @@
+## authctl user lock
+
+Lock (disable) a user managed by authd
+
+### Synopsis
+
+Lock a user so that they cannot log in.
+
+```
+authctl user lock <user> [flags]
+```
+
+### Options
+
+```
+  -h, --help   help for lock
+```
+
+### SEE ALSO
+
+* [authctl user](authctl_user.md)	 - Commands related to users
+
diff --git a/docs/reference/cli/authctl_user_set-uid.md b/docs/reference/cli/authctl_user_set-uid.md
new file mode 100644
index 0000000000..ffe0e081c6
--- /dev/null
+++ b/docs/reference/cli/authctl_user_set-uid.md
@@ -0,0 +1,39 @@
+## authctl user set-uid
+
+Set the UID of a user managed by authd
+
+### Synopsis
+
+Set the UID of a user managed by authd to the specified value.
+
+The new UID must be unique and non-negative. The command must be run as root.
+
+The ownership of the user's home directory, and any files within the directory
+that the user owns, will automatically be updated to the new UID.
+
+Files outside the user's home directory are not updated and must be changed
+manually. Note that changing a UID can be unsafe if files on the system are
+still owned by the original UID: those files may become accessible to a
+different account that is later assigned that UID.
+
+```
+authctl user set-uid <user> <uid> [flags]
+```
+
+### Examples
+
+```
+  # Set the UID of user "alice" to 15000
+  authctl user set-uid alice 15000
+```
+
+### Options
+
+```
+  -h, --help   help for set-uid
+```
+
+### SEE ALSO
+
+* [authctl user](authctl_user.md)	 - Commands related to users
+
diff --git a/docs/reference/cli/authctl_user_unlock.md b/docs/reference/cli/authctl_user_unlock.md
new file mode 100644
index 0000000000..5babeffc5c
--- /dev/null
+++ b/docs/reference/cli/authctl_user_unlock.md
@@ -0,0 +1,22 @@
+## authctl user unlock
+
+Unlock (enable) a user managed by authd
+
+### Synopsis
+
+Unlock a locked user so that they can log in again.
+
+```
+authctl user unlock <user> [flags]
+```
+
+### Options
+
+```
+  -h, --help   help for unlock
+```
+
+### SEE ALSO
+
+* [authctl user](authctl_user.md)	 - Commands related to users
+
diff --git a/docs/reference/cli/index.md b/docs/reference/cli/index.md
new file mode 100644
index 0000000000..c9f8a20962
--- /dev/null
+++ b/docs/reference/cli/index.md
@@ -0,0 +1,35 @@
+# authctl reference
+
+The `authctl` command line tool is used to manage authd users and groups.
+
+Available commands:
+
+```{toctree}
+:titlesonly:
+:hidden:
+authctl
+```
+
+```{toctree}
+:titlesonly:
+:hidden:
+authctl_user
+```
+
+```{toctree}
+:titlesonly:
+authctl_user_lock
+authctl_user_unlock
+authctl_user_set-uid
+```
+
+```{toctree}
+:titlesonly:
+:hidden:
+authctl_group
+```
+
+```{toctree}
+:titlesonly:
+authctl_group_set-gid
+```
diff --git a/docs/reference/cloud-init-deploy.md b/docs/reference/cloud-init-deploy.md
new file mode 100644
index 0000000000..9050e24e7b
--- /dev/null
+++ b/docs/reference/cloud-init-deploy.md
@@ -0,0 +1,173 @@
+---
+myst:
+  html_meta:
+    "description lang=en": "Deploy authd at scale with cloud-init."
+---
+
+# Reference snippets for cloud-init provisioning
+
+[Cloud-init](https://cloudinit.readthedocs.io/en/latest/) is an
+industry-standard method for cloud instance initialization. It can also be used
+to provision client machines during Ubuntu installation.
+
+This page provides example snippets, which can be used in your own cloud config
+YAML files to deploy and configure authd on Ubuntu at scale.
+
+## Setup
+
+If using these snippets as part of a
+[cloud config](https://docs.cloud-init.io/en/latest/explanation/format/cloud-config.html#user-data-formats-cloud-config)
+file, set the appropriate header, identifying the file to cloud-init with
+`#cloud-config` and enabling Jinja templating with `## template: jinja`.
+
+```yaml
+## template: jinja
+#cloud-config
+```
+
+## Variables
+
+Define the necessary environmental variables:
+
+```jinja
+{% set ISSUER_ID = '<your_issuer_id>' %}
+{% set CLIENT_ID = '<your_client_id>' %}
+```
+
+## Install authd
+
+Add the authd PPA to the system's software sources and install authd:
+
+```yaml
+apt:
+  sources:
+      source1:
+          source: 'ppa:ubuntu-enterprise-desktop/authd'
+
+packages:
+  - authd
+```
+
+## Install broker
+
+Install the broker as a snap:
+
+:::::{tab-set}
+:sync-group: broker
+
+::::{tab-item} Google IAM
+:sync: google
+
+```yaml
+snap:
+ commands:
+   - ['install', 'authd-google']
+```
+
+::::
+
+::::{tab-item} Microsoft Entra ID
+:sync: msentraid
+
+```yaml
+snap:
+ commands:
+   - ['install', 'authd-msentraid']
+```
+
+::::
+:::::
+
+
+```{tip}
+For more information on installing authd and its brokers, read the
+[installation guide](howto::install).
+```
+
+## Install authd and apply configurations
+
+To complete the setup:
+
+* Configure SSH for user login
+* Upgrade packages
+* Configure authd and the broker
+* Restart the services for the changes to take effect
+
+```{important}
+Edit the allowed suffixes as appropriate.
+```
+
+:::::{tab-set}
+:sync-group: broker
+
+::::{tab-item} Google IAM
+:sync: google
+
+```yaml
+write_files:
+  - path: /etc/ssh/sshd_config.d/authd.conf
+    content: |
+      UsePAM yes
+      Match User *@example.com
+          KbdInteractiveAuthentication yes
+
+runcmd:
+  - apt-get upgrade -y
+  - sed -i 's|<CLIENT_ID>|{{ CLIENT_ID }}|g; s|<ISSUER_ID>|{{ ISSUER_ID }}|g' /var/snap/authd-google/current/broker.conf
+  - echo 'ssh_allowed_suffixes = @example.com' >> /var/snap/authd-google/current/broker.conf
+  - sed -i 's/^\(LOGIN_TIMEOUT\t\t\)[0-9]\+/\1360/' /etc/login.defs
+  - mkdir -p /etc/authd/brokers.d/
+  - cp /snap/authd-google/current/conf/authd/google.conf /etc/authd/brokers.d/
+  - snap restart authd-google
+  - systemctl restart authd ssh
+```
+
+::::
+
+::::{tab-item} Microsoft Entra ID
+:sync: msentraid
+
+
+```yaml
+write_files:
+  - path: /etc/ssh/sshd_config.d/authd.conf
+    content: |
+      UsePAM yes
+      Match User *@example.onmicrosoft.com
+          KbdInteractiveAuthentication yes
+
+runcmd:
+  - apt-get upgrade -y
+  - sed -i 's|<CLIENT_ID>|{{ CLIENT_ID }}|g; s|<ISSUER_ID>|{{ ISSUER_ID }}|g' /var/snap/authd-msentraid/current/broker.conf
+  - echo 'ssh_allowed_suffixes = @example.onmicrosoft.com' >> /var/snap/authd-msentraid/current/broker.conf
+  - sed -i 's/^\(LOGIN_TIMEOUT\t\t\)[0-9]\+/\1360/' /etc/login.defs
+  - mkdir -p /etc/authd/brokers.d/
+  - cp /snap/authd-msentraid/current/conf/authd/msentraid.conf /etc/authd/brokers.d/
+  - snap restart authd-msentraid
+  - systemctl restart authd ssh
+```
+
+::::
+
+:::::
+
+
+```{tip}
+For more information on configuring authd, read the [configuration
+guide](ref::config).
+```
+
+## Authentication
+
+Once the script is deployed, user login should be possible with authd.
+
+For example, [using SSH](../howto/login-ssh.md):
+
+```text
+ssh <username>@<host>
+```
+
+## Additional information
+
+* [Blog on Entra ID authentication on Ubuntu at scale](https://ubuntu.com/blog/entra-id-authentication-on-ubuntu-at-scale-with-landscape)
+* [Video on Entra ID authentication on Ubuntu Desktop at scale](https://www.youtube.com/watch?v=1tYNEby5-hw)
diff --git a/docs/reference/cloud-providers.md b/docs/reference/cloud-providers.md
deleted file mode 100644
index 0ebf890429..0000000000
--- a/docs/reference/cloud-providers.md
+++ /dev/null
@@ -1,14 +0,0 @@
-# Cloud providers that authd supports
-
-authd supports cloud providers through its identity brokers.
-Each broker is available as a snap.
-Several brokers can be installed and enabled on a system.
-
-| Provider       | Broker snap                                             | Install as a snap             | Configure                                                           | Provider docs                                                            |
-| ---            | ---                                                     | ---                           | ---                                                                 | ---                                                                      |
-| Google IAM     | [authd-google](https://snapcraft.io/authd-google)       | `snap install authd-google`   | <a href="../../howto/configure-authd/?broker=google">Google IAM guide</a>   | [Google](https://cloud.google.com/iam/docs/overview)  |
-| MS Entra ID    | [authd-msentraid](https://snapcraft.io/authd-msentraid) | `snap install authd-msentraid`| <a href="../../howto/configure-authd/?broker=msentraid">MS Entra ID guide</a>  | [Microsoft](https://learn.microsoft.com/en-us/entra/fundamentals/whatis)                     |
-
-```{note}
-Support for multiple additional providers is planned for future releases of authd.
-```
diff --git a/docs/reference/group-management.md b/docs/reference/group-management.md
index 12a7fdb3d9..0fe392a865 100644
--- a/docs/reference/group-management.md
+++ b/docs/reference/group-management.md
@@ -1,15 +1,25 @@
+---
+myst:
+  html_meta:
+    "description lang=en": "Management of groups using authd with Microsoft Entra ID."
+---
+
+(reference::group-management)=
 # Group management
 
 Groups are used to manage users that all need the same access and permissions to resources.
 Groups from the remote provider can be mapped into local Linux groups for the user.
 
+In addition, you can configure extra groups
+[in the broker configuration file](ref::config-user-groups).
+
 ```{note}
   Groups are currently supported for the `msentraid` broker.
 ```
 
-## MS Entra ID
+## Microsoft Entra ID
 
-MS Entra ID supports creating groups and adding users to them.
+Microsoft Entra ID supports creating groups and adding users to them.
 
 > See [Manage Microsoft Entra groups and group membership](https://learn.microsoft.com/en-us/entra/fundamentals/how-to-manage-groups)
 
diff --git a/docs/reference/identity-providers.md b/docs/reference/identity-providers.md
new file mode 100644
index 0000000000..8e604537fb
--- /dev/null
+++ b/docs/reference/identity-providers.md
@@ -0,0 +1,22 @@
+---
+myst:
+  html_meta:
+    "description lang=en": "Identity providers supported by authd."
+---
+
+# Identity providers that authd supports
+
+authd supports identity providers through its identity brokers.
+Each broker is available as a snap.
+Several brokers can be installed and enabled on a system.
+
+| Provider       | Broker snap                                             | Install as a snap              | Configure                                                                            | Provider docs                                                            |
+| ---            |---------------------------------------------------------|--------------------------------|--------------------------------------------------------------------------------------|--------------------------------------------------------------------------|
+| Google IAM     | [authd-google](https://snapcraft.io/authd-google)       | `snap install authd-google`    | <a href="../../howto/configure-authd/?broker=google">Google IAM guide</a>            | [Google](https://cloud.google.com/iam/docs/overview)                     |
+| Microsoft Entra ID    | [authd-msentraid](https://snapcraft.io/authd-msentraid) | `snap install authd-msentraid` | <a href="../../howto/configure-authd/?broker=msentraid">Microsoft Entra ID guide</a> | [Microsoft](https://learn.microsoft.com/en-us/entra/fundamentals/whatis) |
+| Keycloak | [authd-oidc](https://snapcraft.io/authd-oidc)           | `snap install authd-oidc`      | <a href="../../howto/configure-authd/?broker=keycloak">Keycloak guide</a>            | [Keycloak](https://www.keycloak.org/documentation)  |
+
+
+```{note}
+Support for multiple additional providers is planned for future releases of authd.
+```
diff --git a/docs/reference/index.md b/docs/reference/index.md
index b77d1a9146..f81490548c 100644
--- a/docs/reference/index.md
+++ b/docs/reference/index.md
@@ -1,21 +1,30 @@
+---
+myst:
+  html_meta:
+    "description lang=en":
+      "authd reference pages covering supported providers, troubleshooting, groups management, and deployment."
+---
+
 (reference)=
 
 # Reference
 
+These guides provide technical information about authd.
+
 ## Providers
 
-Find the cloud providers and brokers currently supported by authd.
+Multiple identity providers and brokers are supported by authd:
 
 ```{toctree}
 :titlesonly:
 
-Cloud providers <cloud-providers>
+Identity providers that authd supports <identity-providers>
 ```
 
 ## Troubleshooting
 
-Read tips on troubleshooting the authd authentication service and its identity
-brokers.
+The documentation includes several pages that are helpful when troubleshooting
+authd:
 
 ```{toctree}
 :titlesonly:
@@ -25,10 +34,34 @@ Troubleshooting <troubleshooting>
 
 ## Groups
 
-Learn more about managing groups with authd and MS Entra ID.
+Managing groups of users that need the same access and permissions to resources
+is supported by the Microsoft Entra ID broker for authd:
 
 ```{toctree}
 :titlesonly:
 
 Group management <group-management>
 ```
+## Deployment
+
+Deploying authd at scale can be achieved with Landscape or cloud-init.
+The documentation includes snippets to get you started.
+
+```{toctree}
+:titlesonly:
+
+Deploying and configuring authd with Landscape <landscape-deploy>
+Deploying and configuring authd with cloud-init <cloud-init-deploy>
+```
+
+## Command line tool (authctl)
+
+The `authctl` command line tool is used to manage authd users and groups.
+
+Available commands:
+
+```{toctree}
+:titlesonly:
+
+Command line tool (authctl) <cli/index>
+```
diff --git a/docs/reference/landscape-deploy.md b/docs/reference/landscape-deploy.md
new file mode 100644
index 0000000000..9d845d0a09
--- /dev/null
+++ b/docs/reference/landscape-deploy.md
@@ -0,0 +1,165 @@
+---
+myst:
+  html_meta:
+    "description lang=en": "Deploy authd at scale with Landscape and remote script execution."
+---
+
+# Reference snippets for Landscape deployment script
+
+[Landscape](https://documentation.ubuntu.com/landscape/) is a systems
+management tool for the remote provisioning and management of Ubuntu machines.
+
+Landscape can be used to [remotely execute
+scripts](https://documentation.ubuntu.com/landscape/how-to-guides/web-portal/web-portal-24-04-or-later/use-script-profiles/)
+on client machines.
+
+This page provides example snippets that can be used in your own deployment
+scripts to install and configure authd on Ubuntu machines at scale.
+
+```{note}
+When you deploy the final script using Landscape,
+ensure that the script is run as the `root` user.
+```
+
+## Setup
+
+Define the following environmental variables:
+
+```bash
+ISSUER_ID=<ISSUER_ID>
+CLIENT_ID=<CLIENT_ID>
+```
+
+## Installation
+
+Install the authd deb and the broker snap:
+
+:::::{tab-set}
+:sync-group: broker
+
+::::{tab-item} Google IAM
+:sync: google
+
+```shell
+add-apt-repository -y ppa:ubuntu-enterprise-desktop/authd
+apt-get upgrade -y
+apt-get install -y authd
+snap install authd-google
+```
+::::
+
+
+::::{tab-item} Microsoft Entra ID
+:sync: msentraid
+
+```shell
+add-apt-repository -y ppa:ubuntu-enterprise-desktop/authd
+apt-get upgrade -y
+apt-get install -y authd
+snap install authd-msentraid
+```
+
+::::
+
+
+:::::
+
+```{tip}
+For more information on installing authd and its brokers, read the
+[installation guide](howto::install).
+```
+
+## Configuration
+
+Configure authd and the broker:
+
+:::::{tab-set}
+:sync-group: broker
+
+::::{tab-item} Google IAM
+:sync: google
+
+```shell
+sed -i "s|<CLIENT_ID>|$CLIENT_ID|g; s|<ISSUER_ID>|$ISSUER_ID|g" /var/snap/authd-google/current/broker.conf
+echo "ssh_allowed_suffixes = @example.com" >> /var/snap/authd-google/current/broker.conf
+mkdir -p /etc/authd/brokers.d/
+cp /snap/authd-google/current/conf/authd/google.conf /etc/authd/brokers.d/
+cat <<EOF >> /etc/ssh/sshd_config.d/authd.conf
+UsePAM yes
+Match User *@example.com
+    KbdInteractiveAuthentication yes
+EOF
+```
+
+::::
+
+::::{tab-item} Microsoft Entra ID
+:sync: msentraid
+
+```shell
+sed -i "s|<CLIENT_ID>|$CLIENT_ID|g; s|<ISSUER_ID>|$ISSUER_ID|g" /var/snap/authd-msentraid/current/broker.conf
+echo "ssh_allowed_suffixes = @example.onmicrosoft.com" >> /var/snap/authd-msentraid/current/broker.conf
+mkdir -p /etc/authd/brokers.d/
+cp /snap/authd-msentraid/current/conf/authd/msentraid.conf /etc/authd/brokers.d/
+cat <<EOF >> /etc/ssh/sshd_config.d/authd.conf
+UsePAM yes
+Match User *@example.onmicrosoft.com
+    KbdInteractiveAuthentication yes
+EOF
+```
+
+::::
+
+:::::
+
+```{tip}
+For more information on configuring authd, read the [configuration
+guide](ref::config).
+```
+
+## Restart the services
+
+Restart the authd daemon, the broker snap, and the SSH service:
+
+:::::{tab-set}
+:sync-group: broker
+
+::::{tab-item} Google IAM
+:sync: google
+
+```shell
+systemctl restart authd ssh
+snap restart authd-google
+```
+
+::::
+
+::::{tab-item} Microsoft Entra ID
+:sync: msentraid
+
+```shell
+systemctl restart authd ssh
+snap restart authd-msentraid
+```
+
+::::
+
+:::::
+
+When you have a complete script, add it to the Landscape dashboard to run as
+the `root` user before executing on the target machines.
+
+## Authentication
+
+Once the script is deployed, user login should be possible with authd.
+
+For example, [using SSH](../howto/login-ssh.md):
+
+```text
+ssh <username>@<host>
+```
+
+## Additional information
+
+* [Blog on Entra ID authentication on Ubuntu at scale](https://ubuntu.com/blog/entra-id-authentication-on-ubuntu-at-scale-with-landscape)
+* [Video on Entra ID authentication on Ubuntu Desktop at scale](https://www.youtube.com/watch?v=1tYNEby5-hw)
diff --git a/docs/reference/troubleshooting.md b/docs/reference/troubleshooting.md
index 7455e2a64f..a018086c9d 100644
--- a/docs/reference/troubleshooting.md
+++ b/docs/reference/troubleshooting.md
@@ -6,313 +6,46 @@ myst:
 
 # Troubleshooting
 
-This page includes tips for troubleshooting authd and the identity
-brokers for different cloud providers.
+This page includes links to authd documentation that may be helpful when
+troubleshooting.
 
 ## Logging
 
-### authd
+Logs are generated for authd and its brokers, which can be useful when
+troubleshooting and reporting bugs.
 
-`authd` logs to the system journal.
+To learn how to get logs and configure logging behavior, read the dedicated
+[guide on logging](ref::logging).
 
-For `authd` entries, run:
+## Changing versions
 
-```shell
-sudo journalctl -u authd.service
-```
+To test new features or check if a bug has been fixed in a new version,
+you can switch to edge releases for authd and its brokers.
 
-If you want logs for authd and all brokers on the system, run:
+This is described in the [guide on changing
+versions](ref::changing-versions).
 
-```shell
-sudo journalctl -u authd.service -u "snap.authd-*.service"
-```
+## Only the first logged-in user can get access
 
-For specific broker entries run the command for your chosen broker:
+This is the expected behavior, as the first logged-in user becomes the owner
+and only the owner has access by default.
 
-::::{tab-set}
-:sync-group: broker
+To change access you can make the next logged-in user the owner or add more
+allowed users.
 
-:::{tab-item} Google IAM
-:sync: google
+Guidelines on [configuring allowed users](ref::config-allowed-users) are
+outlined in the [configuring authd guide](ref::config).
 
-```shell
-sudo journalctl -u snap.authd-google.authd-google.service
-```
-:::
-
-:::{tab-item} MS Entra ID
-:sync: msentraid
-
-```shell
-sudo journalctl -u snap.authd-msentraid.authd-msentraid.service
-```
-:::
-::::
-
-
-For the GDM integration:
-
-```shell
-sudo journalctl /usr/bin/gnome-shell
-```
-
-For anything else or more broader investigation, use `sudo journalctl`.
-
-### Logging verbosity
-
-You can increase the verbosity of the logs in different ways.
-
-#### PAM module
-
-Append `debug=true` to all the lines with `pam_authd_exec.so` or `pam_authd.so` in the PAM configuration files (`common-auth`, `gdm-authd`...) in `/etc/pam.d/` to increase the verbosity of the PAM messages.
-
-#### NSS module
-
-Export `AUTHD_NSS_INFO=stderr` environment variable on any program using the authd NSS module to get more info on NSS requests to authd.
-
-#### authd service
-
-To increase the verbosity of the service itself, edit the service file:
-
-```shell
-sudo systemctl edit authd.service
-```
-
-Add the following lines to the override file and make sure to add `-vv` at the end of the `authd` command:
-
-```ini
-[Service]
-ExecStart=
-ExecStart=/usr/libexec/authd -vv
-```
-
-Then you need to restart the service with `sudo systemctl restart authd`.
-
-#### GDM
-
-Ensure the lines in `/etc/gdm3/custom.conf` are not commented:
-
-```ini
-[debug]
-# Uncomment the line below to turn on debugging
-# More verbose logs
-# Additionally lets the X server dump core if it crashes
-Enable=true
-```
-
-Then you need to restart the service with `sudo systemctl restart gdm`.
-
-#### authd broker service
-
-To increase the verbosity of the broker service, edit the service file:
-
-::::{tab-set}
-:sync-group: broker
-
-:::{tab-item} Google IAM
-:sync: google
-
-```shell
-sudo systemctl edit snap.authd-google.authd-google.service
-```
-:::
-
-:::{tab-item} MS Entra ID
-:sync: msentraid
-
-```shell
-sudo systemctl edit snap.authd-msentraid.authd-msentraid.service
-```
-:::
-::::
-
-Add the following lines to the override file and make sure to add `-vv` to the exec command:
-
-::::{tab-set}
-:sync-group: broker
-
-:::{tab-item} Google IAM
-:sync: google
-
-```ini
-[Service]
-ExecStart=
-ExecStart=/usr/bin/snap run authd-google -vv
-```
-:::
-
-:::{tab-item} MS Entra ID
-:sync: msentraid
-
-```ini
-[Service]
-ExecStart=
-ExecStart=/usr/bin/snap run authd-msentraid -vv
-```
-::::
-
-You will then need to restart the service with:
-
-::::{tab-set}
-:sync-group: broker
-
-:::{tab-item} Google IAM
-:sync: google
-
-`sudo snap restart authd-google`.
-:::
-
-:::{tab-item} MS Entra ID
-:sync: msentraid
-
-`sudo snap restart authd-msentraid`.
-:::
-::::
-
-## Switch authd to the edge PPA
-
-Maybe your issue is already fixed! You can try switching to the [edge PPA](https://launchpad.net/~ubuntu-enterprise-desktop/+archive/ubuntu/authd-edge), which contains the
-latest fixes and features for authd, in addition to its GNOME Shell (GDM)
-counterpart.
-
-```{warning}
-Do not use the edge PPA in a production system, because it may apply changes to
-the authd database in a non-reversible way, which can make it difficult to roll
-back to the stable version of authd.
-```
-
-```shell
-sudo add-apt-repository ppa:ubuntu-enterprise-desktop/authd-edge
-sudo apt update
-sudo apt install authd gnome-shell
-```
-
-Keep in mind that this version is not tested and may be incompatible with the current released version of the brokers.
-
-To switch back to the stable version of authd:
-
-```shell
-sudo apt install ppa-purge
-sudo ppa-purge ppa:ubuntu-enterprise-desktop/authd-edge
-```
-
-```{note}
-If using an edge release, you can read the
-[latest development version of the documentation](https://canonical-authd.readthedocs-hosted.com/en/latest/)
-```
-
-## Switch broker snap to the edge channel
-
-Maybe your issue is already fixed! You should try switching to the edge channel of the broker snap. You can easily do that with:
-
-::::{tab-set}
-:sync-group: broker
-
-:::{tab-item} Google IAM
-:sync: google
-
-```shell
-sudo snap switch authd-google --edge
-sudo snap refresh authd-google
-```
-:::
-
-:::{tab-item} MS Entra ID
-:sync: msentraid
-
-```shell
-sudo snap switch authd-msentraid --edge
-sudo snap refresh authd-msentraid
-```
-:::
-::::
-
-Keep in mind that this version is not tested and may be incompatible with the current released version of authd. You should switch back to stable after trying the edge channel:
-
-::::{tab-set}
-:sync-group: broker
-
-:::{tab-item} Google IAM
-:sync: google
-
-```shell
-sudo snap switch authd-google --stable
-sudo snap refresh authd-google
-```
-:::
-
-:::{tab-item} MS Entra ID
-:sync: msentraid
-
-```shell
-sudo snap switch authd-msentraid --stable
-sudo snap refresh authd-msentraid
-```
-:::
-::::
-
-```{note}
-If using an edge release, you can read the
-[latest development version of the documentation](https://canonical-authd.readthedocs-hosted.com/en/latest/)
-```
-
-## Common issues
-
-### Only the first logged-in user can get access to a machine
-
-This is the expected behavior.
-
-By default, the first logged-in user is defined as the "owner" and only the
-owner can log in.
-
-For other users to gain access after authentication, they must be added to
-`allowed_users` in the `broker.conf` file.
-This is outlined in the [guide for configuring authd](ref::config-allowed-users).
-
-See below the relevant line in the configuration, showing both the owner and
-an additional user:
-
-```ini
-[users]
-allowed_users = OWNER,additionaluser1@example.com
-```
-
-If an administrator is the first to log in to a machine and becomes the owner,
-they can ensure that the next user to log in becomes the owner by removing the
-`20-owner-autoregistration.conf` file:
-
-::::{tab-set}
-:sync-group: broker
-
-:::{tab-item} Google IAM
-:sync: google
-
-```shell
-sudo rm /var/snap/authd-google/current/broker.conf.d/20-owner-autoregistration.conf
-```
-:::
-
-:::{tab-item} MS Entra ID
-:sync: msentraid
-
-```shell
-sudo rm /var/snap/authd-msentraid/current/broker.conf.d/20-owner-autoregistration.conf
-```
-:::
-::::
-
-
-This file is generated when a user logs in and becomes the owner. If it is
-removed, it will be regenerated on the next successful login.
-
-### File ownership on shared network resources (e.g. NFS, Samba)
+## File ownership on shared network resources (NFS, Samba)
 
 The user identifiers (UIDs) and group identifiers (GIDs) assigned by authd are
 unique to each machine. This means that when using authd with NFS or Samba, the
 UIDs and GIDs of users and groups on the server will not match those on the
 client machines, which leads to permission issues.
 
-To avoid these issues, you can use ID mapping. For more information, see
+To avoid these issues, you can use ID mapping. For more information, see the
+dedicated guides on NFS and Samba:
+
 * [Using authd with NFS](../howto/use-with-nfs)
 * [Using authd with Samba](../howto/use-with-samba)
 
@@ -321,24 +54,5 @@ To avoid these issues, you can use ID mapping. For more information, see
 If authd and/or the broker are missing, corrupted, or broken in any way, a user may
 be prevented from logging in.
 
-To get access to the system for modifying configurations and installations in
-such cases, there are two main options:
-
-1. Log in as root user or another local user with administrator privileges
-2. Boot into recovery mode to get root access
-
-The steps required for entering recovery mode are included below.
-
-### Boot into recovery mode
-
-If it is not possible to log in with the root user account or another local
-user account with administrator privileges, the user can boot into recovery
-mode:
-
-1. Reboot the device
-2. During the reboot, press and hold the right <kbd>SHIFT</kbd> key
-3. When the Grub menu appears, select `advanced options for Ubuntu`
-4. Choose `recovery mode` for the correct kernel version
-5. Select `drop to root shell prompt`
-
-The user then has access to the root filesystem and can proceed with debugging.
+When this occurs, you can [boot into recovery mode](../howto/enter-recovery-mode.md) to
+access to the system for modifying configurations and installations.
diff --git a/docs/requirements.txt b/docs/requirements.txt
index ec6fab5cb9..caaa865c40 100644
--- a/docs/requirements.txt
+++ b/docs/requirements.txt
@@ -1,4 +1,32 @@
-canonical-sphinx[full]
+# Canonical theme (still needed for Furo theme and custom templates)
+canonical-sphinx>=0.5.1
+
+# Extensions previously auto-loaded by canonical-sphinx
+myst-parser~=4.0
+sphinx-autobuild
+sphinx-design
+sphinx-notfound-page
+sphinx-reredirects
+sphinx-tabs
+sphinxcontrib-jquery
+sphinxext-opengraph
+
+# Extra extensions, previously bundled as canonical-sphinx-extensions
+sphinx-config-options>=0.1.0
+sphinx-contributor-listing>=0.1.0
+sphinx-filtered-toctree>=0.1.0
+sphinx-related-links>=0.1.1
+sphinx-roles>=0.1.0
+sphinx-terminal>=1.0.2
+sphinx-ubuntu-images>=0.1.0
+sphinx-youtube-links>=0.1.0
+
+# Other dependencies
+packaging
 sphinxcontrib-svg2pdfconverter[CairoSVG]
 sphinx-last-updated-by-git
 sphinx-sitemap
+
+# Vale dependencies
+rst2html
+vale
diff --git a/docs/reuse/links.txt b/docs/reuse/links.txt
index f9d3d5cdc5..af3c3b54fd 100644
--- a/docs/reuse/links.txt
+++ b/docs/reuse/links.txt
@@ -1 +1,46 @@
-.. _link text: https://example.com
+.. _Canonical Documentation Style Guide: https://docs.ubuntu.com/styleguide/en
+.. _Canonical Reference Library: https://library.canonical.com/
+.. _Canonical Sphinx: https://github.com/canonical/canonical-sphinx
+.. _change log: https://github.com/canonical/sphinx-docs-starter-pack/wiki/Change-log
+.. _csv-table reference: https://docutils.sourceforge.io/docs/ref/rst/directives.html#csv-table
+.. _csv-table reference (MyST): https://mystmd.org/guide/directives#directive-csv-table
+.. _Diátaxis: https://diataxis.fr/
+.. _Example product documentation: https://canonical-example-product-documentation.readthedocs-hosted.com/
+.. _Example product documentation repository: https://github.com/canonical/example-product-documentation
+.. _`file-wide metadata`: https://www.sphinx-doc.org/en/master/usage/restructuredtext/field-lists.html
+.. _Five golden rules for compliant alt text: https://abilitynet.org.uk/resources/digital-accessibility/five-golden-rules-compliant-alt-text
+.. _`Furo documentation`: https://pradyunsg.me/furo/quickstart/
+.. _grid tables: https://docutils.sourceforge.io/docs/ref/rst/restructuredtext.html#grid-tables
+.. _`Hiding Contents sidebar`: https://pradyunsg.me/furo/customisation/toc/
+.. _How to connect your Read the Docs account to your Git provider: https://docs.readthedocs.com/platform/stable/guides/connecting-git-account.html
+.. _How to manually configure a Git repository integration: https://docs.readthedocs.com/platform/stable/guides/setup/git-repo-manual.html
+.. _How to publish documentation on Read the Docs: https://library.canonical.com/documentation/publish-on-read-the-docs
+.. _Level AA conformance: https://www.w3.org/WAI/WCAG2AA-Conformance
+.. _list tables: https://docutils.sourceforge.io/docs/ref/rst/directives.html#list-table
+.. _manual import: https://readthedocs.com/dashboard/import/manual/
+.. _Markdown: https://commonmark.org/
+.. _MyST: https://myst-parser.readthedocs.io/
+.. _Open Graph: https://ogp.me/
+.. _Pa11y: https://pa11y.org/
+.. _Pa11y readme: https://github.com/pa11y/pa11y#command-line-configuration
+.. _Pygments documentation: https://pygments.org/languages/
+.. _Read the Docs at Canonical: https://library.canonical.com/documentation/read-the-docs-at-canonical
+.. _reStructuredText: https://www.sphinx-doc.org/en/master/usage/restructuredtext/index.html
+.. _`Sphinx`: https://www.sphinx-doc.org/
+.. _`Sphinx configuration`: https://www.sphinx-doc.org/en/master/usage/configuration.html
+.. _Sphinx DataTables: https://sharm294.github.io/sphinx-datatables/
+.. _Sphinx design: https://sphinx-design.readthedocs.io/en/latest/
+.. _Sphinx documentation starter pack:
+.. _Sphinx documentation starter pack repository: https://github.com/canonical/sphinx-docs-starter-pack
+.. _Sphinx documentation starter pack documentation: https://canonical-starter-pack.readthedocs-hosted.com/
+.. _`Sphinx extensions`: https://www.sphinx-doc.org/en/master/usage/extensions/index.html
+.. _Sphinx tabs: https://sphinx-tabs.readthedocs.io/en/latest/
+.. _tables: https://www.sphinx-doc.org/en/master/usage/restructuredtext/directives.html#table-directives
+.. _toctree: https://www.sphinx-doc.org/en/master/usage/restructuredtext/directives.html#directive-toctree
+.. _Vale: https://vale.sh/
+.. _Vale rules: https://github.com/canonical/documentation-style-guide
+.. _Web Content Accessibility Guidelines (WCAG) 2.2: https://www.w3.org/TR/WCAG22/
+
+
+.. SHORTCUTS
+.. |RST| replace:: :abbr:`reST (reStructuredText)`
diff --git a/e2e-tests/.gitignore b/e2e-tests/.gitignore
new file mode 100644
index 0000000000..600c8159f1
--- /dev/null
+++ b/e2e-tests/.gitignore
@@ -0,0 +1,3 @@
+/vm/config.sh
+/.yarf
+
diff --git a/e2e-tests/install-deps.sh b/e2e-tests/install-deps.sh
new file mode 100755
index 0000000000..eb42c406d3
--- /dev/null
+++ b/e2e-tests/install-deps.sh
@@ -0,0 +1,23 @@
+#!/bin/bash
+
+set -euo pipefail
+
+# Install packages required for running the e2e tests
+sudo apt-get update && sudo apt-get -y install \
+    bsdutils \
+    ffmpeg \
+    gir1.2-webkit2-4.1 \
+    libcairo2-dev \
+    libgirepository-2.0-dev \
+    libvirt-clients-qemu \
+    libvirt-daemon-system \
+    libxkbcommon-dev \
+    qemu-kvm \
+    python3-cairo \
+    python3-gi \
+    python3-tk \
+    socat \
+    systemd-journal-remote \
+    unclutter \
+    xtightvncviewer \
+    xvfb
diff --git a/e2e-tests/r2-worker/.gitignore b/e2e-tests/r2-worker/.gitignore
new file mode 100644
index 0000000000..b75a0fa9c3
--- /dev/null
+++ b/e2e-tests/r2-worker/.gitignore
@@ -0,0 +1 @@
+.wrangler/
diff --git a/e2e-tests/r2-worker/src/index.js b/e2e-tests/r2-worker/src/index.js
new file mode 100644
index 0000000000..cf995aa153
--- /dev/null
+++ b/e2e-tests/r2-worker/src/index.js
@@ -0,0 +1,56 @@
+export default {
+  async fetch(request, env) {
+    const url = new URL(request.url);
+    const path = decodeURIComponent(url.pathname.replace(/^\//, ""));
+
+    // Try to serve the file directly
+    const object = await env.BUCKET.get(path);
+    if (object) {
+      const headers = new Headers();
+      object.writeHttpMetadata(headers);
+      return new Response(object.body, { headers });
+    }
+
+    // Try to serve the log.html file
+    const prefix = path ? path.replace(/\/?$/, "/") : "";
+    const logObject = await env.BUCKET.get(`${prefix}log.html`);
+    if (logObject) {
+      const headers = new Headers();
+      logObject.writeHttpMetadata(headers);
+      return new Response(logObject.body, { headers });
+    }
+
+    // Otherwise, list the directory
+    const listing = await env.BUCKET.list({ prefix, delimiter: "/" });
+
+    if (!listing.objects.length && !listing.delimitedPrefixes.length) {
+      return new Response("Not found", { status: 404 });
+    }
+
+    // Calculate parent path for '..' link
+    let parent = null;
+    if (prefix) {
+      const trimmed = prefix.replace(/\/$/, "");
+      const idx = trimmed.lastIndexOf("/");
+      parent = idx === -1 ? "" : trimmed.slice(0, idx + 1);
+    }
+
+    const rows = [
+      // Add '..' row if not at root
+      ...(parent !== null ? [`<li><a href="/${parent}">..</a></li>`] : []),
+      ...listing.delimitedPrefixes.map(p => {
+        const name = p.replace(prefix, "");
+        return `<li><a href="/${p}">${name}</a></li>`;
+      }),
+      ...listing.objects.map(o => {
+        const name = o.key.replace(prefix, "");
+        return `<li><a href="/${o.key}">${name}</a></li>`;
+      }),
+    ].join("\n");
+
+    return new Response(
+      `<!DOCTYPE html><html><body><h1>/${prefix}</h1><ul>${rows}</ul></body></html>`,
+      { headers: { "content-type": "text/html" } }
+    );
+  },
+};
diff --git a/e2e-tests/r2-worker/wrangler.toml b/e2e-tests/r2-worker/wrangler.toml
new file mode 100644
index 0000000000..68afbe5b1b
--- /dev/null
+++ b/e2e-tests/r2-worker/wrangler.toml
@@ -0,0 +1,7 @@
+name = "authd-e2e-test-logs"
+main = "src/index.js"
+compatibility_date = "2026-01-01"
+
+[[r2_buckets]]
+binding = "BUCKET"
+bucket_name = "authd-e2e-test-logs"
diff --git a/e2e-tests/resources/authd-google/Browser.py b/e2e-tests/resources/authd-google/Browser.py
new file mode 100644
index 0000000000..02cb786197
--- /dev/null
+++ b/e2e-tests/resources/authd-google/Browser.py
@@ -0,0 +1,47 @@
+import os
+import subprocess
+
+from robot.api.deco import keyword, library  # type: ignore
+from robot.api import logger
+
+SCRIPT_DIR = os.path.dirname(os.path.abspath(__file__))
+
+def run_command(args, env=None):
+    if env is None:
+        env = os.environ
+
+    result = subprocess.run(args, env=env, stderr=subprocess.PIPE, text=True)
+    if result.returncode == 0:
+        return
+
+    cmd = " ".join(args)
+    raise RuntimeError(f"Command '{cmd}' failed with exit code {result.returncode}:\n{result.stderr}")
+
+
+@library
+class Browser:
+    """Library for browser automation using a headless browser.
+    """
+
+    @keyword
+    async def login(self, usercode: str, output_dir: str = "."):
+        """Perform device authentication with the given username, password and
+        usercode using a browser automation script. The window opened by the
+        script is run off screen using Xvfb.
+        """
+
+        command = [
+            os.path.join(SCRIPT_DIR, "browser_login.py"),
+            usercode,
+            "--output-dir", output_dir,
+        ]
+
+        if not os.getenv("SHOW_WEBVIEW"):
+            command = [
+                          "/usr/bin/env",
+                          "GDK_BACKEND=x11",
+                          "xvfb-run", "-a",
+                          "--",
+                      ] + command
+
+        run_command(command)
diff --git a/e2e-tests/resources/authd-google/broker.resource b/e2e-tests/resources/authd-google/broker.resource
new file mode 100644
index 0000000000..09ce1cca19
--- /dev/null
+++ b/e2e-tests/resources/authd-google/broker.resource
@@ -0,0 +1,292 @@
+*** Settings ***
+Documentation       MS Google specific resources for the tests
+
+Resource            ../kvm.resource
+Resource            ../authd/utils.resource
+Resource            ../authd/authd.resource
+Library             ./Browser.py    AS    Browser
+Library             Hid.py    AS    Hid
+Library             String
+
+*** Variables ***
+${AUTHD_BROKER_CFG}    /etc/authd/brokers.d/google.conf
+${GOOGLE_BROKER_CFG}    /var/snap/authd-google/current/broker.conf
+${GOOGLE_BROKER_CFG_DIR}    /var/snap/authd-google/current/broker.conf.d
+
+
+*** Keywords ***
+Enable Edge Broker
+    SSH.Execute    sudo snap refresh authd-google --edge
+
+
+Disable Broker And Purge Config
+    SSH.Execute    sudo snap stop authd-google
+    SSH.Execute    sudo rm ${AUTHD_BROKER_CFG}
+    SSH.Execute    sudo systemctl restart authd.service
+
+
+Log In With Remote User Through CLI: QR Code
+    [Arguments]    ${username}    ${local_password}
+    Start Log In With Remote User Through CLI: QR Code    ${username}
+    Select Provider
+    Continue Log In With Remote User: Authenticate In External Browser
+    Continue Log In With Remote User Through CLI: Define Local Password    ${username}    ${local_password}
+
+
+Start Log In With Remote User Through CLI: QR Code
+    [Arguments]    ${username}
+    Try machinectl login Prompt
+    Hid.Type String    ${username}
+    Hid.Keys Combo    Return
+
+    # Check that the provider selection contains the Google provider
+    Match Text    Select your provider    15
+
+
+Select Provider
+    # Check that the provider selection contains the Google provider
+    Match Text    Select your provider    15
+    Match Text    2. Google
+
+    # Select the Google provider
+    Hid.Type String    2
+    Builtin.Sleep    2
+
+Regenerate QR Code
+    # As long as we are in the login process, we can regenerate the QR code
+    Match Text    Request new code    120
+    Hid.Keys Combo    Return
+    Match Text    google.com/device    15
+
+
+Continue Log In With Remote User: Authenticate In External Browser
+    # Wait until the verification URL and login code are displayed
+    Match Text    google.com/device
+    # Read the user code.
+    ${text} =    Read Text
+    ${user_code} =    StringUtils.First Match    (https:\/\/)?google.com\/device\n((Login code: )?(([A-Za-z\- ]+)))    ${text}
+    # The OCR sometimes reads spaces in the user code, even though there are none,
+    # so remove any spaces.
+    ${user_code} =    Remove String    ${user_code}    ${SPACE}
+    # The user code is all uppercase, but sometimes the OCR reads some letters as lowercase,
+    # so convert it to uppercase to handle that.
+    ${user_code} =    String.Convert To Upper Case    ${user_code}
+
+    Browser.Login    ${user_code}    ${SUITE_OUTPUT_DIR}
+
+
+Continue Log In With Remote User Through CLI: Define Local Password
+    [Arguments]    ${username}    ${local_password}
+    # The terminal should now be visible and focused again.
+    # Check that we're prompted to set a local password.
+    Match Text    New password:    120
+
+    # Set a local password
+    Hid.Type String    ${local_password}
+    Hid.Keys Combo    Return
+
+    # Confirm the local password
+    Match Text    Confirm password:
+    Hid.Type String    ${local_password}
+    Hid.Keys Combo    Return
+
+    # Wait for the login to complete
+    ${timeout_sec} =    Set Variable    120
+    Match Text    ${username}@ubuntu    ${timeout_sec}
+
+
+Log In With Remote User Through CLI: Local Password
+    [Arguments]    ${username}    ${local_password}
+    Try machinectl login Prompt
+    Hid.Type String    ${username}
+    Hid.Keys Combo    Return
+    Builtin.Sleep    2
+    Match Text    Enter your local password:    120
+    Hid.Type String    ${local_password}
+    Hid.Keys Combo    Return
+    Builtin.Sleep    2
+    Match Text    ${username}@ubuntu:~$    120
+
+
+# Uses sed to change the broker configuration.
+# It should match both commented and uncommented lines.
+# The full commands looks like:
+#     sed -i 's/#*${config_key} = .*/${config_key} = ${config_value}/g' ${GOOGLE_BROKER_CFG}
+Change Broker Configuration
+    [Arguments]    ${config_key}    ${config_value}
+    SSH.Execute    sudo sed -i 's/^#*${config_key} =.*/${config_key} = ${config_value}/g' ${GOOGLE_BROKER_CFG}
+    SSH.Execute    sudo snap restart authd-google
+
+
+# Pretty much the same as the function above, but since YARF does not have support for
+# shifted characters yet, we need to do some workarounds.
+Change allowed_users In Broker Configuration
+    [Arguments]    ${config_value}
+    SSH.Execute    sudo sed -i 's/^#*allowed_users =.*/allowed_users = ${config_value}/g' ${GOOGLE_BROKER_CFG}
+    SSH.Execute    sudo snap restart authd-google
+
+
+Comment Key In Broker Configuration
+    [Arguments]    ${config_key}
+    SSH.Execute    sudo sed -i 's/^#*${config_key} =.*/#${config_key} = .*/g' ${GOOGLE_BROKER_CFG}
+    SSH.Execute    sudo snap restart authd-google
+
+
+Log In With Remote User Through SSH: QR Code
+    [Arguments]    ${username}    ${local_password}
+    Start Log In With Remote User Through SSH: QR Code    ${username}
+    Select Provider through SSH
+    Continue Log In With Remote User: Authenticate In External Browser
+    Continue Log In With Remote User Through SSH: QR Code
+    Continue Log In With Remote User Through SSH: Define Local Password    ${username}    ${local_password}
+
+
+Start Log In With Remote User Through SSH: QR Code
+    [Arguments]    ${username}
+    Hid.Type String    ssh ${username}@localhost
+    Hid.Keys Combo    Return
+    Builtin.Sleep    2
+    Hid.Type String    yes
+    Hid.Keys Combo    Return
+
+
+Select Provider through SSH
+    Match Text    2. Google    120
+    Match Text    Choose your provider:    120
+    Hid.Type String    2
+    Hid.Keys Combo    Return
+
+
+Continue Log In With Remote User Through SSH: QR Code
+    Match Text    Choose action:    120
+    Hid.Type String    1
+    Hid.Keys Combo    Return
+
+
+Continue Log In With Remote User Through SSH: Define Local Password
+    [Arguments]    ${username}    ${local_password}
+    Match Text    Create a local password:    120
+    Hid.Type String    ${local_password}
+    Hid.Keys Combo    Return
+
+    Match Text    Confirm Password:    120
+    Hid.Type String    ${local_password}
+    Hid.Keys Combo    Return
+
+    Match Text    ${username}@ubuntu:~$    120
+
+
+Log In With Remote User Through SSH: Local Password
+    [Arguments]    ${username}    ${local_password}
+    Hid.Type String    ssh ${username}@localhost
+    Hid.Keys Combo    Return
+    Match Text    Enter your local password:    120
+    Hid.Type String    ${local_password}
+    Hid.Keys Combo    Return
+    Match Text    ${username}@ubuntu:~$    120
+
+
+Log In With Remote User Through GDM: QR Code
+    [Arguments]    ${username}    ${local_password}
+    Start Log In With Remote User Through GDM: QR Code    ${username}
+    Select Broker Through GDM
+    Continue Log In With Remote User: Authenticate In External Browser
+    Continue Log In With Remote User Through GDM: Define Local Password    ${local_password}
+
+
+
+Start Log In With Remote User Through GDM: QR Code
+    [Arguments]    ${username}
+    Match Text    Not listed    180
+    Move Pointer To Not listed
+    Left Button Click
+
+    # Enter the username
+    Match Text    Username
+    Hid.Type String    ${username}
+    Hid.Keys Combo    Return
+
+
+Select Broker Through GDM
+    Match Text    Select the broker    120
+    Move Pointer To Google
+    Left Button Click
+    Builtin.Sleep    1
+
+
+Continue Log In With Remote User Through GDM: Define Local Password
+    [Arguments]    ${local_password}
+    Match Text    Create a local password    120
+    Hid.Type String    ${local_password}
+    Hid.Keys Combo    Return
+
+    Match Text   Please, type the new passphrase again    120
+    Hid.Type String    ${local_password}
+    Hid.Keys Combo    Return
+
+    Wait Until Desktop Ready
+
+
+Log In With Remote User Through GDM: Local Password
+    [Arguments]    ${username}    ${local_password}
+    Match Text    Not listed    180
+    Move Pointer To Not listed
+    Left Button Click
+    # Enter the username
+    Match Text    Username
+    Hid.Type String    ${username}
+    Hid.Keys Combo    Return
+
+    # Enter the password
+    Match Text    Password
+    Hid.Type String    ${local_password}
+    Hid.Keys Combo    Return
+
+    Wait Until Desktop Ready
+
+
+Check If User Was Added Properly
+    [Arguments]    ${username}
+    Get NSS Passwd Entry For Remote User    ${username}
+    Check User Information    ${username}
+
+
+Check User Information
+    [Arguments]    ${username}
+    Match Text    ${username}:x:    120
+
+
+Check Configuration Value
+    [Arguments]    ${config_key}    ${expected_value}
+    Hid.Type String    cat ${GOOGLE_BROKER_CFG}
+    # TODO: Even though the Hid.Type String works for most characters now, it seems like there are still issues with
+    # some special characters like `|`, so we still need the workaround here.
+    Hid.Keys Combo    Shift_L    |
+    Hid.Type String    grep ${config_key}
+    Hid.Keys Combo    Return
+    Match Text    ${expected_value}    120
+
+
+Check If Owner Was Registered
+    [Arguments]    ${username}
+    Hid.Type String    cat ${GOOGLE_BROKER_CFG_DIR}/20-owner-autoregistration.conf
+    Hid.Keys Combo    Return
+    Match Text    owner = ${username}    120
+
+
+Check Home Directory
+    [Arguments]    ${username}
+    Hid.Type String    echo $HOME
+    Hid.Keys Combo    Return
+    Match Text    /home/${username}    120
+    Hid.Type String    stat -c %U:%G $HOME
+    Hid.Keys Combo    Return
+    Match Text    ${username}:${username}
+
+
+Check That Remote User Is Not Allowed To Log In
+    Match Text    authentication failure: user not allowed in broker configuration    120
+
+
+Check That Login Is Handled By PAM Unix
+    Match Text    Password:
diff --git a/e2e-tests/resources/authd-google/browser_login.py b/e2e-tests/resources/authd-google/browser_login.py
new file mode 100755
index 0000000000..efc48e5949
--- /dev/null
+++ b/e2e-tests/resources/authd-google/browser_login.py
@@ -0,0 +1,129 @@
+#!/usr/bin/env python3
+import argparse
+import locale
+
+import gi, os, sys
+
+gi.require_version("Gtk", "3.0")
+gi.require_version("Gdk", "3.0")
+gi.require_version("WebKit2", "4.1")
+
+from gi.repository import Gdk, Gtk  # type: ignore # The interpreter usually does not recognize imports from gi.repository
+
+# The import will be resolved at runtime, which means that the directory structure will be something like:
+# test_run_dir/
+#   resources/
+#     authd/
+#       browser_window.py <- the dependency
+#     authd-msentraid/
+#       browser_login.py  <- this file
+sys.path.append(os.path.abspath(os.path.join(os.path.dirname(__file__), "..", "authd")))
+from browser_window import (
+    BrowserWindow,
+    ascii_string_to_key_events,
+)  # type: ignore # This is resolved at runtime
+
+from generate_totp import generate_totp # type: ignore # This is resolved at runtime
+
+SNAPSHOT_INDEX = 0
+
+
+def main():
+    parser = argparse.ArgumentParser()
+
+    parser.add_argument("device_code")
+    parser.add_argument("--output-dir", required=False, default=os.path.realpath(os.curdir))
+    parser.add_argument("--show-webview", action="store_true")
+    args = parser.parse_args()
+
+    username = os.getenv("E2E_USER")
+    password = os.getenv("E2E_PASSWORD")
+    totp_secret = os.getenv("TOTP_SECRET")
+    if username is None or password is None or totp_secret is None:
+        print("E2E_USER, E2E_PASSWORD, and TOTP_SECRET environment variables must be set", file=sys.stderr)
+        sys.exit(1)
+
+    locale.setlocale(locale.LC_ALL, "C")
+
+    screenshot_dir = os.path.join(args.output_dir, "webview-snapshots")
+    os.makedirs(screenshot_dir, exist_ok=True)
+
+    Gtk.init(None)
+
+    repeat = True
+    retried_tls_error = False
+    while repeat:
+        repeat = False
+
+        browser = BrowserWindow()
+        browser.show_all()
+        browser.start_recording()
+
+        try:
+            login(browser, username, password, args.device_code, totp_secret, screenshot_dir)
+        except TimeoutError as e:
+            # Sometimes the page can't be loaded due to TLS errors, retry once
+            if not retried_tls_error:
+                try:
+                    browser.wait_for_pattern("Unacceptable TLS certificate", timeout_ms=1000)
+                    repeat = True
+                    retried_tls_error = True
+                except TimeoutError:
+                    pass
+            if not repeat:
+                raise e
+        finally:
+            if browser.get_mapped():
+                browser.capture_snapshot(screenshot_dir, "failure")
+            browser.stop_recording(os.path.join(args.output_dir, "Webview_Recording.webm"))
+            browser.destroy()
+
+
+def login(browser, username: str, password: str, device_code: str, totp_secret: str, screenshot_dir: str = "."):
+    browser.web_view.load_uri("https://accounts.google.com/o/oauth2/device/usercode?hl=en&flowName=DeviceOAuth")
+    browser.wait_for_stable_page()
+    browser.capture_snapshot(screenshot_dir, "page-loaded")
+
+    browser.wait_for_pattern("Enter the code displayed on your device")
+    browser.wait_for_stable_page()
+    browser.capture_snapshot(screenshot_dir, "device-login-enter-code")
+    browser.send_key_taps(
+        ascii_string_to_key_events(device_code) + [Gdk.KEY_Return])
+
+    browser.wait_for_pattern("Sign in", timeout_ms=20000)
+    browser.wait_for_stable_page()
+    browser.capture_snapshot(screenshot_dir, "device-login-enter-username")
+    browser.send_key_taps(
+        ascii_string_to_key_events(username) + [Gdk.KEY_Return])
+
+    browser.wait_for_pattern("Enter your password")
+    browser.wait_for_stable_page()
+    browser.capture_snapshot(screenshot_dir, "device-login-enter-password")
+    browser.send_key_taps(
+        ascii_string_to_key_events(password) + [Gdk.KEY_Return])
+
+    browser.wait_for_pattern("2-Step Verification", timeout_ms=20000)
+    browser.wait_for_stable_page()
+    browser.capture_snapshot(screenshot_dir, "device-login-enter-totp-code")
+    browser.send_key_taps(
+        ascii_string_to_key_events(generate_totp(totp_secret)) + [Gdk.KEY_Return])
+
+    browser.wait_for_pattern("Choose an account")
+    browser.wait_for_stable_page()
+    browser.capture_snapshot(screenshot_dir, "device-login-choose-account")
+    browser.send_key_taps([Gdk.KEY_Return])
+
+    browser.wait_for_pattern("signing back in", timeout_ms=20000)
+    browser.wait_for_stable_page()
+    browser.capture_snapshot(screenshot_dir, "device-login-confirmation")
+    # Sadly, just pressing Enter is not enough here, we need to tab to the correct button.
+    browser.send_key_taps([Gdk.KEY_Tab, Gdk.KEY_Tab, Gdk.KEY_Tab, Gdk.KEY_Tab, Gdk.KEY_Tab])
+    browser.send_key_taps([Gdk.KEY_Return])
+
+    browser.wait_for_pattern("Continue on your device")
+    browser.wait_for_stable_page()
+    browser.capture_snapshot(screenshot_dir, "device-login-success")
+
+
+if __name__ == "__main__":
+    main()
diff --git a/e2e-tests/resources/authd-msentraid/Browser.py b/e2e-tests/resources/authd-msentraid/Browser.py
new file mode 100644
index 0000000000..c25ac8faa0
--- /dev/null
+++ b/e2e-tests/resources/authd-msentraid/Browser.py
@@ -0,0 +1,43 @@
+import os
+import subprocess
+
+from robot.api.deco import keyword, library  # type: ignore
+from robot.api import logger
+
+SCRIPT_DIR = os.path.dirname(os.path.abspath(__file__))
+
+def run_command(args):
+    result = subprocess.run(args, stderr=subprocess.PIPE, text=True)
+    if result.returncode == 0:
+        return
+
+    cmd = " ".join(args)
+    raise RuntimeError(f"Command '{cmd}' failed with exit code {result.returncode}:\n{result.stderr}")
+
+
+@library
+class Browser:
+    """Library for browser automation using a headless browser.
+    """
+
+    @keyword
+    async def login(self, usercode: str, output_dir: str = "."):
+        """Perform device authentication with the given username, password and
+        usercode using a browser automation script. The window opened by the
+        script is run off screen using Xvfb.
+        """
+        command = [
+            os.path.join(SCRIPT_DIR, "browser_login.py"),
+            usercode,
+            "--output-dir", output_dir,
+        ]
+
+        if not os.getenv("SHOW_WEBVIEW"):
+            command = [
+                          "/usr/bin/env",
+                          "GDK_BACKEND=x11",
+                          "xvfb-run", "-a",
+                          "--",
+                      ] + command
+
+        run_command(command)
diff --git a/e2e-tests/resources/authd-msentraid/broker.resource b/e2e-tests/resources/authd-msentraid/broker.resource
new file mode 100644
index 0000000000..aba58957ed
--- /dev/null
+++ b/e2e-tests/resources/authd-msentraid/broker.resource
@@ -0,0 +1,301 @@
+*** Settings ***
+Documentation       MS Entra ID specific resources for the tests
+
+Resource            ../kvm.resource
+Resource            ../authd/utils.resource
+Resource            ../authd/authd.resource
+Library             ./Browser.py    AS    Browser
+Library             Hid.py    AS    Hid
+Library             String
+
+*** Variables ***
+${ENTRAID_RESOURCES}    ${CURDIR}
+
+${AUTHD_BROKER_CFG}    /etc/authd/brokers.d/msentraid.conf
+${ENTRAID_BROKER_CFG}    /var/snap/authd-msentraid/current/broker.conf
+${ENTRAID_BROKER_CFG_DIR}    /var/snap/authd-msentraid/current/broker.conf.d
+
+${remote_group}    e2e-test-group
+
+
+*** Keywords ***
+Enable Edge Broker
+    SSH.Execute    sudo snap refresh authd-msentraid --edge
+
+
+Disable Broker And Purge Config
+    SSH.Execute    sudo snap stop authd-msentraid
+    SSH.Execute    sudo rm ${AUTHD_BROKER_CFG}
+    SSH.Execute    sudo systemctl restart authd.service
+
+
+Log In With Remote User Through CLI: QR Code
+    [Arguments]    ${username}    ${local_password}
+    Start Log In With Remote User Through CLI: QR Code    ${username}
+    Select Provider
+    Continue Log In With Remote User: Authenticate In External Browser
+    Continue Log In With Remote User Through CLI: Define Local Password    ${username}    ${local_password}
+
+
+Start Log In With Remote User Through CLI: QR Code
+    [Arguments]    ${username}
+    Try machinectl login Prompt
+    Hid.Type String    ${username}
+    Hid.Keys Combo    Return
+
+    # Check that the provider selection contains the Entra ID provider
+    Match Text    Select your provider    15
+
+
+Select Provider
+    # Check that the provider selection contains the Entra ID provider
+    Match Text    Select your provider    15
+    Match Text    2. Microsoft Entra ID
+
+    # Select the Entra ID provider
+    Hid.Type String    2
+    Builtin.Sleep    2
+
+Regenerate QR Code
+    # As long as we are in the login process, we can regenerate the QR code
+    Match Text    Request new code    120
+    Hid.Keys Combo    Return
+    Match Text    login.microsoft.com/device    15
+
+
+Continue Log In With Remote User: Authenticate In External Browser
+    # Wait until the verification URL and login code are displayed
+    Match Text    login.microsoft.com/device
+    # Read the user code.
+    ${text} =    Read Text
+    ${user_code} =    StringUtils.First Match    (https://)?login.microsoft.com/device\n((Login code: )?([A-Za-z0-9]+))    ${text}
+    # The user code is all uppercase, but sometimes the OCR reads some letters as lowercase,
+    # so convert it to uppercase to handle that.
+    ${user_code} =    String.Convert To Upper Case    ${user_code}
+
+    Browser.Login    ${user_code}    ${SUITE_OUTPUT_DIR}
+
+
+Continue Log In With Remote User Through CLI: Define Local Password
+    [Arguments]    ${username}    ${local_password}
+    # The terminal should now be visible and focused again.
+    # Check that we're prompted to set a local password.
+    Match Text    New password:    120
+
+    # Set a local password
+    Hid.Type String    ${local_password}
+    Hid.Keys Combo    Return
+
+    # Confirm the local password
+    Match Text    Confirm password:
+    Hid.Type String    ${local_password}
+    Hid.Keys Combo    Return
+
+    # Wait for the login to complete
+    ${timeout_sec} =    Set Variable    120
+    Match Text    ${username}@ubuntu    ${timeout_sec}
+
+
+Log In With Remote User Through CLI: Local Password
+    [Arguments]    ${username}    ${local_password}
+    Try machinectl login Prompt
+    Hid.Type String    ${username}
+    Hid.Keys Combo    Return
+    Builtin.Sleep    2
+    Match Text    Enter your local password:    120
+    Hid.Type String    ${local_password}
+    Hid.Keys Combo    Return
+    Builtin.Sleep    2
+    Match Text    ${username}@ubuntu:~$    120
+
+
+# Uses sed to change the broker configuration.
+# It should match both commented and uncommented lines.
+# The full commands looks like:
+#     sed -i 's/#*${config_key} = .*/${config_key} = ${config_value}/g' ${ENTRAID_BROKER_CFG}
+Change Broker Configuration
+    [Arguments]    ${config_key}    ${config_value}
+    SSH.Execute    sudo sed -i 's/^#*${config_key} =.*/${config_key} = ${config_value}/g' ${ENTRAID_BROKER_CFG}
+    SSH.Execute    sudo snap restart authd-msentraid
+
+
+# Pretty much the same as the function above, but since YARF does not have support for
+# shifted characters yet, we need to do some workarounds.
+Change allowed_users In Broker Configuration
+    [Arguments]    ${config_value}
+    SSH.Execute    sudo sed -i 's/^#*allowed_users =.*/allowed_users = ${config_value}/g' ${ENTRAID_BROKER_CFG}
+    SSH.Execute    sudo snap restart authd-msentraid
+
+
+Comment Key In Broker Configuration
+    [Arguments]    ${config_key}
+    SSH.Execute    sudo sed -i 's/^#*${config_key} =.*/#${config_key} = .*/g' ${ENTRAID_BROKER_CFG}
+    SSH.Execute    sudo snap restart authd-msentraid
+
+
+Log In With Remote User Through SSH: QR Code
+    [Arguments]    ${username}    ${local_password}
+    Start Log In With Remote User Through SSH: QR Code    ${username}
+    Select Provider through SSH
+    Continue Log In With Remote User: Authenticate In External Browser
+    Continue Log In With Remote User Through SSH: QR Code
+    Continue Log In With Remote User Through SSH: Define Local Password    ${username}    ${local_password}
+
+
+Start Log In With Remote User Through SSH: QR Code
+    [Arguments]    ${username}
+    Hid.Type String    ssh ${username}@localhost
+    Hid.Keys Combo    Return
+    Builtin.Sleep    2
+    Hid.Type String    yes
+    Hid.Keys Combo    Return
+
+
+Select Provider through SSH
+    Match Text    2. Microsoft Entra ID    120
+    Match Text    Choose your provider:    120
+    Hid.Type String    2
+    Hid.Keys Combo    Return
+
+
+Continue Log In With Remote User Through SSH: QR Code
+    Match Text    Choose action:    120
+    Hid.Type String    1
+    Hid.Keys Combo    Return
+
+
+Continue Log In With Remote User Through SSH: Define Local Password
+    [Arguments]    ${username}    ${local_password}
+    Match Text    Create a local password:    120
+    Hid.Type String    ${local_password}
+    Hid.Keys Combo    Return
+
+    Match Text    Confirm Password:    120
+    Hid.Type String    ${local_password}
+    Hid.Keys Combo    Return
+
+    Match Text    ${username}@ubuntu:~$    120
+
+
+Log In With Remote User Through SSH: Local Password
+    [Arguments]    ${username}    ${local_password}
+    Hid.Type String    ssh ${username}@localhost
+    Hid.Keys Combo    Return
+    Match Text    Enter your local password:    120
+    Hid.Type String    ${local_password}
+    Hid.Keys Combo    Return
+    Match Text    ${username}@ubuntu:~$    120
+
+
+Log In With Remote User Through GDM: QR Code
+    [Arguments]    ${username}    ${local_password}
+    Start Log In With Remote User Through GDM: QR Code    ${username}
+    Select Broker Through GDM
+    Continue Log In With Remote User: Authenticate In External Browser
+    Continue Log In With Remote User Through GDM: Define Local Password    ${local_password}
+
+
+
+Start Log In With Remote User Through GDM: QR Code
+    [Arguments]    ${username}
+    Match Text    Not listed    180
+    Move Pointer To Not listed
+    Left Button Click
+
+    # Enter the username
+    Match Text    Username
+    Hid.Type String    ${username}
+    Hid.Keys Combo    Return
+
+
+Select Broker Through GDM
+    Match Text    Select the broker    120
+    Move Pointer To Microsoft Entra ID
+    Left Button Click
+    Builtin.Sleep    1
+
+
+Continue Log In With Remote User Through GDM: Define Local Password
+    [Arguments]    ${local_password}
+    Match Text    Create a local password    120
+    Hid.Type String    ${local_password}
+    Hid.Keys Combo    Return
+
+    Match Text   Please, type the new passphrase again    120
+    Hid.Type String    ${local_password}
+    Hid.Keys Combo    Return
+
+    Wait Until Desktop Ready
+
+
+Log In With Remote User Through GDM: Local Password
+    [Arguments]    ${username}    ${local_password}
+    Match Text    Not listed    180
+    Move Pointer To Not listed
+    Left Button Click
+    # Enter the username
+    Match Text    Username
+    Hid.Type String    ${username}
+    Hid.Keys Combo    Return
+
+    # Enter the password
+    Match Text    Password
+    Hid.Type String    ${local_password}
+    Hid.Keys Combo    Return
+
+    Wait Until Desktop Ready
+
+
+Check If User Was Added Properly
+    [Arguments]    ${username}
+    Get NSS Passwd Entry For Remote User    ${username}
+    Check User Information    ${username}
+    Get NSS Group Entries For Remote User    ${username}
+    Check User Groups    ${username}    ${remote_group}
+    Check That Remote User Can Run Sudo Commands    ${local_password}
+
+
+Check User Information
+    [Arguments]    ${username}
+    Match Text    ${username}:x:    120
+
+
+Check User Groups
+    [Arguments]    ${username}    ${remote_group}
+    Match Text    ${username} sudo ${remote_group}    120
+
+
+Check Configuration Value
+    [Arguments]    ${config_key}    ${expected_value}
+    Hid.Type String    cat ${ENTRAID_BROKER_CFG}
+    # TODO: Even though the Hid.Type String works for most characters now, it seems like there are still issues with
+    # some special characters like `|`, so we still need the workaround here.
+    Hid.Keys Combo    Shift_L    |
+    Hid.Type String    grep ${config_key}
+    Hid.Keys Combo    Return
+    Match Text    ${expected_value}    120
+
+
+Check If Owner Was Registered
+    [Arguments]    ${username}
+    Hid.Type String    cat ${ENTRAID_BROKER_CFG_DIR}/20-owner-autoregistration.conf
+    Hid.Keys Combo    Return
+    Match Text    owner = ${username}    120
+
+
+Check Home Directory
+    [Arguments]    ${username}
+    Hid.Type String    echo $HOME
+    Hid.Keys Combo    Return
+    Match Text    /home/${username}    120
+    Hid.Type String    stat -c %U:%G $HOME
+    Hid.Keys Combo    Return
+    Match Text    ${username}:${username}
+
+
+Check That Remote User Is Not Allowed To Log In
+    Match Text    authentication failure: user not allowed in broker configuration    120
+
+
+Check That Login Is Handled By PAM Unix
+    Match Text    Password:
diff --git a/e2e-tests/resources/authd-msentraid/browser_login.py b/e2e-tests/resources/authd-msentraid/browser_login.py
new file mode 100755
index 0000000000..869ac76920
--- /dev/null
+++ b/e2e-tests/resources/authd-msentraid/browser_login.py
@@ -0,0 +1,117 @@
+#!/usr/bin/env python3
+import argparse
+import locale
+
+import gi, os, sys
+
+gi.require_version("Gtk", "3.0")
+gi.require_version("Gdk", "3.0")
+gi.require_version("WebKit2", "4.1")
+
+from gi.repository import Gdk, Gtk  # type: ignore # The interpreter usually does not recognize imports from gi.repository
+
+# The import will be resolved at runtime, which means that the directory structure will be something like:
+# test_run_dir/
+#   resources/
+#     authd/
+#       browser_window.py <- the dependency
+#     authd-msentraid/
+#       browser_login.py  <- this file
+sys.path.append(os.path.abspath(os.path.join(os.path.dirname(__file__), "..", "authd")))
+from browser_window import (
+    BrowserWindow,
+    ascii_string_to_key_events,
+)  # type: ignore # This is resolved at runtime
+
+from generate_totp import generate_totp # type: ignore # This is resolved at runtime
+
+SNAPSHOT_INDEX = 0
+
+def main():
+    parser = argparse.ArgumentParser()
+
+    parser.add_argument("device_code")
+    parser.add_argument("--output-dir", required=False, default=os.path.realpath(os.curdir))
+    parser.add_argument("--show-webview", action="store_true")
+    args = parser.parse_args()
+
+    username = os.getenv("E2E_USER")
+    password = os.getenv("E2E_PASSWORD")
+    totp_secret = os.getenv("TOTP_SECRET")
+    if username is None or password is None or totp_secret is None:
+        print("E2E_USER, E2E_PASSWORD, and TOTP_SECRET environment variables must be set", file=sys.stderr)
+        sys.exit(1)
+
+    locale.setlocale(locale.LC_ALL, "C")
+
+    screenshot_dir = os.path.join(args.output_dir, "webview-snapshots")
+    os.makedirs(screenshot_dir, exist_ok=True)
+
+    Gtk.init(None)
+
+    repeat = True
+    retried_tls_error = False
+    while repeat:
+        repeat = False
+
+        browser = BrowserWindow()
+        browser.show_all()
+        browser.start_recording()
+
+        try:
+            login(browser, username, password, args.device_code, totp_secret, screenshot_dir)
+        except TimeoutError:
+            # Sometimes the page can't be loaded due to TLS errors, retry once
+            if not retried_tls_error:
+                browser.wait_for_pattern("Unacceptable TLS certificate", timeout_ms=1000)
+                repeat = True
+                retried_tls_error = True
+        finally:
+            if browser.get_mapped():
+                browser.capture_snapshot(screenshot_dir, "failure")
+            browser.stop_recording(os.path.join(args.output_dir, "Webview_Recording.webm"))
+            browser.destroy()
+
+
+def login(browser, username: str, password: str, device_code: str, totp_secret: str, screenshot_dir: str = "."):
+    browser.web_view.load_uri("https://login.microsoft.com/device")
+    browser.wait_for_stable_page()
+    browser.capture_snapshot(screenshot_dir, "page-loaded")
+
+    browser.wait_for_pattern("Enter code to allow access")
+    browser.wait_for_stable_page()
+    browser.capture_snapshot(screenshot_dir, "device-login-enter-code")
+    browser.send_key_taps(
+        ascii_string_to_key_events(device_code) + [Gdk.KEY_Return])
+
+    browser.wait_for_pattern("Sign in", timeout_ms=20000)
+    browser.wait_for_stable_page()
+    browser.capture_snapshot(screenshot_dir, "device-login-enter-username")
+    browser.send_key_taps(
+        ascii_string_to_key_events(username) + [Gdk.KEY_Return])
+
+    browser.wait_for_pattern("Enter password")
+    browser.wait_for_stable_page()
+    browser.capture_snapshot(screenshot_dir, "device-login-enter-password")
+    browser.send_key_taps(
+        ascii_string_to_key_events(password) + [Gdk.KEY_Return])
+
+    match = browser.wait_for_pattern(r"(Enter code|Are you trying to sign in)")
+    browser.wait_for_stable_page()
+    if match == "Enter code":
+        browser.capture_snapshot(screenshot_dir, "device-login-enter-totp-code")
+        browser.send_key_taps(
+            ascii_string_to_key_events(generate_totp(totp_secret)) + [Gdk.KEY_Return])
+        browser.wait_for_pattern("Are you trying to sign in")
+        browser.wait_for_stable_page()
+
+    browser.capture_snapshot(screenshot_dir, "device-login-confirm-signin")
+    browser.send_key_taps([Gdk.KEY_Return])
+
+    browser.wait_for_pattern("You have signed in")
+    browser.wait_for_stable_page()
+    browser.capture_snapshot(screenshot_dir, "device-login-success")
+
+
+if __name__ == "__main__":
+    main()
diff --git a/e2e-tests/resources/authd/ExecUtils.py b/e2e-tests/resources/authd/ExecUtils.py
new file mode 100644
index 0000000000..619d7583af
--- /dev/null
+++ b/e2e-tests/resources/authd/ExecUtils.py
@@ -0,0 +1,43 @@
+from robot.api import logger
+
+import subprocess
+
+
+def check_call(*args, **kwargs):
+    try:
+        return subprocess.check_call(*args, **kwargs)
+    except subprocess.SubprocessError as e:
+        if hasattr(e, 'stderr') and e.stderr:
+            logger.error(e.stderr)
+        raise e
+
+
+def check_output(*args, **kwargs):
+    try:
+        return subprocess.check_output(*args, **kwargs)
+    except subprocess.SubprocessError as e:
+        if hasattr(e, 'stderr') and e.stderr:
+            logger.error(e.stderr)
+        raise e
+
+
+def run(*args, **kwargs):
+    try:
+        return subprocess.run(*args, **kwargs)
+    except subprocess.SubprocessError as e:
+        if hasattr(e, 'stderr') and e.stderr:
+            logger.error(e.stderr)
+        raise e
+
+
+class Popen(subprocess.Popen):
+    def __init__(self, *args, **kwargs):
+        super().__init__(*args, **kwargs)
+
+    def communicate(self, *args, **kwargs):
+        try:
+            return super().communicate(*args, **kwargs)
+        except subprocess.SubprocessError as e:
+            if hasattr(e, 'stderr') and e.stderr:
+                logger.error(e.stderr)
+            raise e
diff --git a/e2e-tests/resources/authd/Journal.py b/e2e-tests/resources/authd/Journal.py
new file mode 100644
index 0000000000..8183791f6c
--- /dev/null
+++ b/e2e-tests/resources/authd/Journal.py
@@ -0,0 +1,131 @@
+import os
+from ansi2html import Ansi2HTMLConverter
+import select
+import subprocess
+import time
+
+from robot.api import logger
+from robot.api.deco import keyword, library  # type: ignore
+from robot.libraries.BuiltIn import BuiltIn
+
+import ExecUtils
+import VMUtils
+
+HOST_CID = 2 # 2 always refers to the host
+PORT = 55000
+
+
+@library
+class Journal:
+    process = None
+    output_dir = None
+
+    @keyword
+    async def start_receiving_journal(self) -> None:
+        """
+        Start receiving journal entries from the VM via vsock.
+        """
+        if self.process:
+            return
+
+        suite_output_dir = BuiltIn().get_variable_value('${SUITE_OUTPUT_DIR}')
+        self.output_dir = os.path.join(suite_output_dir, "journal")
+        os.makedirs(self.output_dir, exist_ok=True)
+
+        if os.getenv("SYSTEMD_SUPPORTS_VSOCK"):
+            self.process = ExecUtils.Popen(
+                [
+                    "/lib/systemd/systemd-journal-remote",
+                    f"--listen-raw=vsock:{HOST_CID}:{PORT}",
+                    f"--output={self.output_dir}",
+                ],
+            )
+        else:
+            self.process = stream_journal_from_vm_via_tcp(output_dir=self.output_dir)
+
+    @keyword
+    async def stop_receiving_journal(self) -> None:
+        """
+        Stop receiving journal entries from the VM.
+        """
+        if self.process:
+            self.process.terminate()
+            self.process.wait()
+            self.process = None
+
+    @keyword
+    async def log_journal(self) -> None:
+        """
+        Log the journal entries received from the VM.
+        """
+        output = ExecUtils.check_output(
+            [
+                'journalctl',
+                '--no-pager',
+                '--directory', self.output_dir,
+            ],
+            env={'SYSTEMD_COLORS': 'true'},
+            text=True,
+        )
+
+        html_output = Ansi2HTMLConverter(inline=True).convert(output, full=False)
+        logger.info(html_output, html=True)
+
+def stream_journal_from_vm_via_tcp(output_dir, timeout=60):
+    vm_name = VMUtils.vm_name()
+    vm_ip = VMUtils.vm_ip()
+    deadline = time.time() + timeout
+
+    while time.time() < deadline:
+        # Start socat to connect to the VM's TCP port
+        socat = subprocess.Popen(
+            ["socat", "-d", "-d", f"TCP:{vm_ip}:{PORT}", "-"],
+            stdout=subprocess.PIPE,
+            stderr=subprocess.PIPE,
+            text=True,
+            bufsize=1,
+        )
+
+        connected = False
+        stderr_buf = []
+
+        # Read socat's stderr until we see a successful connection or timeout
+        while True:
+            r, _, _ = select.select([socat.stderr], [], [], 1)
+            if not r:
+                if socat.poll() is not None:
+                    break
+                continue
+
+            line = socat.stderr.readline()
+            if not line:
+                break
+
+            stderr_buf.append(line)
+
+            if "successfully connected" in line:
+                connected = True
+                break
+
+        if not connected:
+            logger.error("".join(stderr_buf))
+            socat.kill()
+            time.sleep(1)
+            continue
+
+        # TCP connection confirmed
+        journal_remote = subprocess.Popen(
+            [
+                "/lib/systemd/systemd-journal-remote",
+                f"--output={output_dir}/{vm_name}.journal",
+                "-",
+            ],
+            stdin=socat.stdout,
+        )
+
+        socat.stdout.close()
+        return journal_remote
+
+    raise RuntimeError(
+        f"Failed to connect to VM journal stream within {timeout}s"
+    )
diff --git a/e2e-tests/resources/authd/SSH.py b/e2e-tests/resources/authd/SSH.py
new file mode 100644
index 0000000000..db50a8d9f2
--- /dev/null
+++ b/e2e-tests/resources/authd/SSH.py
@@ -0,0 +1,46 @@
+import os.path
+
+from robot.api import logger
+from robot.api.deco import keyword, library  # type: ignore
+
+import ExecUtils
+
+SCRIPT_DIR = os.path.dirname(os.path.abspath(__file__))
+SSH_SCRIPT = os.path.abspath(os.path.join(SCRIPT_DIR, "ssh.sh"))
+
+@library
+class SSH:
+    @keyword
+    async def execute(self, command: str, timeout: int|None = 30) -> str:
+        """
+        Run a command via SSH and return its output.
+
+        Args:
+            command: The command to run.
+            timeout: Duration in seconds after which the command is terminated
+                     if it's still running. The default timeout is 30 seconds.
+                     Use 'None' to run without timeout.
+        Returns:
+            The output of the command.
+        """
+        result = ExecUtils.run(
+            [SSH_SCRIPT, "--", command],
+            check=True,
+            capture_output=True,
+            text=True,
+            timeout=timeout,
+        )
+
+        stdout = result.stdout.strip()
+        if len(stdout) == 0:
+            logger.debug(f"stdout: <empty>")
+        else:
+            logger.debug(f"stdout: {stdout}")
+
+        stderr = result.stderr.strip()
+        if len(stderr) == 0:
+            logger.debug(f"stderr: <empty>")
+        else:
+            logger.debug(f"stderr: {stderr}")
+
+        return stdout
diff --git a/e2e-tests/resources/authd/Snapshot.py b/e2e-tests/resources/authd/Snapshot.py
new file mode 100644
index 0000000000..6951b54ca9
--- /dev/null
+++ b/e2e-tests/resources/authd/Snapshot.py
@@ -0,0 +1,21 @@
+from robot.api.deco import keyword, library  # type: ignore
+
+import ExecUtils
+import VMUtils
+
+
+@library
+class Snapshot:
+    @keyword
+    async def restore(self, name: str) -> None:
+        """
+        Revert the VM to the specified snapshot.
+
+        Args:
+            name: The name of the snapshot to revert to.
+        """
+        vm_name = VMUtils.vm_name()
+        ExecUtils.run(
+            ["virsh", "snapshot-revert", vm_name, name],
+            check=True,
+        )
diff --git a/e2e-tests/resources/authd/StringUtils.py b/e2e-tests/resources/authd/StringUtils.py
new file mode 100644
index 0000000000..73a9f857ab
--- /dev/null
+++ b/e2e-tests/resources/authd/StringUtils.py
@@ -0,0 +1,31 @@
+from robot.api import logger
+from robot.api.deco import keyword, library  # type: ignore
+
+
+@library
+class StringUtils:
+    @keyword
+    async def first_match(self, regex: str, text: str) -> str:
+        """
+        Match a regex against a string and return the first match.
+
+        Args:
+            regex: The regex to match.
+            text: The text to match against.
+
+        Returns:
+            The first match.
+        """
+        import re
+
+        match = re.search(regex, text)
+        if match:
+            logger.debug(f"Matched regex '{regex}' against text '{text}': {match.groups()}")
+
+            # In some cases, we need to match the text with whitespaces due to OCR inaccuracies.
+            # So let's ensure we remove those whitespaces from the match.
+            cleaned_match = re.sub(r"\s+", "", match.group(len(match.groups())))
+            return cleaned_match
+
+        else:
+            raise ValueError(f"No match found for {regex} in {text}")
diff --git a/e2e-tests/resources/authd/VMUtils.py b/e2e-tests/resources/authd/VMUtils.py
new file mode 100644
index 0000000000..28d282aa38
--- /dev/null
+++ b/e2e-tests/resources/authd/VMUtils.py
@@ -0,0 +1,34 @@
+import os
+import subprocess
+import time
+
+VM_NAME_BASE="e2e-runner"
+
+def vm_name() -> str:
+    release = os.environ.get("RELEASE")
+    if not release:
+        raise Exception("RELEASE environment variable is not set")
+    return f"{VM_NAME_BASE}-{release}"
+
+
+def vm_ip(timeout=60):
+    deadline = time.time() + timeout
+
+    while time.time() < deadline:
+        p = subprocess.run(
+            ["virsh", "domifaddr", "--domain", vm_name(), "--source", "agent"],
+            stdout=subprocess.PIPE,
+            text=True,
+            check=False,
+        )
+
+        for line in p.stdout.splitlines():
+            parts = line.split()
+            if len(parts) >= 4 and parts[2] == "ipv4":
+                ip = parts[3].split("/")[0]
+                if ip != "127.0.0.1":
+                    return ip
+
+        time.sleep(1)
+
+    raise RuntimeError(f"Timed out waiting for IPv4 address of VM '{vm_name()}'")
diff --git a/e2e-tests/resources/authd/VNCRecorder.py b/e2e-tests/resources/authd/VNCRecorder.py
new file mode 100644
index 0000000000..7a05076cdb
--- /dev/null
+++ b/e2e-tests/resources/authd/VNCRecorder.py
@@ -0,0 +1,142 @@
+import ctypes
+import subprocess
+import signal
+import os
+import time
+
+from robot.api.deco import library, keyword
+from robot.api import logger
+from robot.libraries.BuiltIn import BuiltIn
+
+PR_SET_PDEATHSIG = 1
+SIGTERM = 15
+
+# Ensure child processes are terminated when the parent process dies
+def set_death_signal():
+    libc = ctypes.CDLL('libc.so.6')
+    libc.prctl(PR_SET_PDEATHSIG, SIGTERM)
+
+def find_unused_display() -> int:
+    used = set()
+    for name in os.listdir('/tmp/.X11-unix'):
+        if name.startswith('X'):
+            try:
+                used.add(int(name[1:]))
+            except ValueError:
+                continue
+    for num in range(99, 200):
+        if num not in used:
+            return num
+    raise RuntimeError("No unused display found")
+
+def wait_for_xvfb(display_num: int, timeout: float = 10.0):
+    socket_path = f'/tmp/.X11-unix/X{display_num}'
+    deadline = time.monotonic() + timeout
+    while time.monotonic() < deadline:
+        if os.path.exists(socket_path):
+            return
+        time.sleep(0.1)
+    raise RuntimeError(f"Xvfb display :{display_num} did not become ready in time")
+
+def stop_process(proc: subprocess.Popen, stop_signal: int = signal.SIGTERM):
+    """Terminate a process, killing it if it doesn't stop in time, and log its stderr."""
+    if not proc:
+        return
+    name = proc.args[0]
+    try:
+        proc.send_signal(stop_signal)
+        _, stderr = proc.communicate(timeout=5)
+    except subprocess.TimeoutExpired:
+        logger.warn(f"{name} did not terminate, killing it.")
+        proc.kill()
+        _, stderr = proc.communicate(timeout=5)
+    msg = f"{name} exited with exit code {proc.returncode}."
+    if stderr:
+        msg += f" stderr:\n{stderr}"
+    logger.info(msg)
+
+@library
+class VNCRecorder:
+
+    def __init__(self):
+        self._xvfb_proc = None
+        self._unclutter_proc = None
+        self._viewer_proc = None
+        self._ffmpeg_proc = None
+
+    @keyword
+    def start_recording(self, host='localhost', port=5901, resolution='1280x800'):
+        """Start recording the VNC session to a video file."""
+        output_dir = str(BuiltIn().get_variable_value('${SUITE_OUTPUT_DIR}'))
+        output_path = os.path.join(output_dir, 'VM_Recording.webm')
+
+        display_num = find_unused_display()
+        display = f':{display_num}'
+
+        # Start a virtual X server for the VNC session
+        cmd = ['Xvfb', display, '-screen', '0', f'{resolution}x24']
+        logger.info(f"Starting Xvfb with command: {' '.join(cmd)}")
+        self._xvfb_proc = subprocess.Popen(
+            cmd,
+            text=True,
+            stderr=subprocess.PIPE,
+            preexec_fn=set_death_signal,
+        )
+        wait_for_xvfb(display_num)
+
+        # Run unclutter to hide the mouse cursor so it doesn't show up in the recording
+        cmd = ['unclutter', '-display', display, '-root', '-idle', '0.1']
+        logger.info(f"Starting unclutter with command: {' '.join(cmd)}")
+        self._unclutter_proc = subprocess.Popen(
+            cmd,
+            text=True,
+            stderr=subprocess.PIPE,
+            preexec_fn=set_death_signal,
+        )
+
+        # Start a VNC viewer on the virtual X server
+        env = os.environ.copy()
+        env['DISPLAY'] = display
+        cmd = ['xtightvncviewer', '-shared', '-viewonly', '-fullscreen',
+               f'{host}:{port}']
+        logger.info(f"Starting xtightvncviewer with command: {' '.join(cmd)}")
+        self._viewer_proc = subprocess.Popen(
+            cmd,
+            env=env,
+            text=True,
+            stderr=subprocess.PIPE,
+            preexec_fn=set_death_signal,
+        )
+
+        # Give the viewer a moment to start and connect to the VNC server
+        # before starting ffmpeg to avoid recording a black screen
+        time.sleep(0.1)
+
+        # Record the VNC session to a video file
+        cmd = ['ffmpeg',
+               '-loglevel', 'warning',
+               '-y',
+               '-f', 'x11grab',
+               '-r', '25',
+               '-s', resolution,
+               '-i', f'{display}.0',
+               '-codec:v', 'libvpx-vp9',
+               '-preset', 'fast',
+               '-crf', '23',
+               output_path]
+        logger.info(f"Starting ffmpeg with command: {' '.join(cmd)}")
+        self._ffmpeg_proc = subprocess.Popen(
+            cmd,
+            text=True,
+            stdin=subprocess.DEVNULL,
+            stderr=subprocess.PIPE,
+            preexec_fn=set_death_signal,
+        )
+
+    @keyword
+    def stop_recording(self):
+        """Stop recording and clean up."""
+        stop_process(self._ffmpeg_proc, signal.SIGINT)
+        stop_process(self._viewer_proc)
+        stop_process(self._unclutter_proc)
+        stop_process(self._xvfb_proc)
diff --git a/e2e-tests/resources/authd/VideoLogger.py b/e2e-tests/resources/authd/VideoLogger.py
new file mode 100644
index 0000000000..dde8ba6fca
--- /dev/null
+++ b/e2e-tests/resources/authd/VideoLogger.py
@@ -0,0 +1,23 @@
+from robot.api import logger
+from robot.api.deco import keyword, library  # type: ignore
+from robot.libraries.BuiltIn import BuiltIn
+import glob
+import os
+import base64
+
+@library
+class VideoLogger:
+    """Robot library exposing the `Log Videos` keyword."""
+
+    @keyword
+    def log_videos(self):
+        output_dir = str(BuiltIn().get_variable_value('${SUITE_OUTPUT_DIR}'))
+        pattern = os.path.join(output_dir, '*.webm')
+        videos = sorted(glob.glob(pattern))
+        for path in videos:
+            title = os.path.basename(path).removesuffix('.webm').replace('_', ' ')
+            with open(path, 'rb') as f:
+                data = f.read()
+            b64 = base64.b64encode(data).decode('utf-8')
+            html = f'<video controls style="max-width: 50%" src="data:video/webm;base64,{b64}"></video>'
+            BuiltIn().set_test_message(f'*HTML*<h3>{title}</h3>{html}', append=True, separator='\n')
diff --git a/e2e-tests/resources/authd/authd.resource b/e2e-tests/resources/authd/authd.resource
new file mode 100644
index 0000000000..5b01c715bb
--- /dev/null
+++ b/e2e-tests/resources/authd/authd.resource
@@ -0,0 +1,94 @@
+*** Settings ***
+Documentation       Authd related test resources
+
+Resource            ../kvm.resource
+Resource            ./utils.resource
+
+
+*** Variables ***
+${local_password}    qwer1234
+
+
+*** Keywords ***
+Enable Edge Repository For Authd
+    SSH.Execute    sudo add-apt-repository ppa:ubuntu-enterprise-desktop/authd-edge -y  timeout=300
+
+
+Disable Authd Socket And Service
+    SSH.Execute    sudo systemctl mask --now authd.socket
+    SSH.Execute    sudo systemctl mask --now authd.service
+
+
+Get NSS Passwd Entry For Remote User
+    [Arguments]    ${username}
+    Hid.Type String    getent passwd ${username}
+    Hid.Keys Combo    Return
+
+
+Get NSS Group Entries For Remote User
+    [Arguments]    ${username}
+    Hid.Type String    groups ${username}
+    Hid.Keys Combo    Return
+
+
+Change Password
+    [Arguments]    ${local_password}    ${new_password}
+    Hid.Type String    passwd
+    Hid.Keys Combo    Return
+
+    Match Text    Enter your local password:    15
+    Builtin.Sleep    2
+    Hid.Type String    ${local_password}
+    Hid.Keys Combo    Return
+
+    Match Text    New password:    15
+    Builtin.Sleep    2
+    Hid.Type String    ${new_password}
+    Hid.Keys Combo    Return
+
+    Match Text    Confirm password:    15
+    Builtin.Sleep    2
+    Hid.Type String    ${new_password}
+    Hid.Keys Combo    Return
+
+    Match Text    passwd: password updated successfully    15
+
+
+Try Log In With Remote User
+    [Arguments]    ${username}
+    Try machinectl login Prompt
+    Hid.Type String    ${username}
+    Hid.Keys Combo    Return
+
+
+# Conditional checks
+Check That Remote User Has No Available Authentication Modes
+    Match Text    Error connecting to provider. Check your network connection.    120
+
+
+Check That Log In Fails Because Authd Is Disabled
+    Match Text    could not connect to unix:///run/authd.sock    120
+
+
+Check That User Is Redirected To Local Broker
+    Match Text    Password:    120
+
+
+Check That Authenticated User Does Not Match Requested User
+    [Arguments]    ${requested_user}
+    Match Text    Authentication failure: requested username "${requested_user}" does not match the authenticated username    120
+
+
+Check That Remote User Can Run Sudo Commands
+    [Arguments]    ${local_password}
+    Hid.Type String    sudo touch sudo-test.txt
+    Hid.Keys Combo    Return
+    Builtin.Sleep    2
+    Match Text    Enter your local password:    15
+    Builtin.Sleep    2
+    Hid.Type String    ${local_password}
+    Hid.Keys Combo    Return
+    Builtin.Sleep    2
+    Hid.Type String    ls -l
+    Hid.Keys Combo    Return
+    Match Text    sudo-test.txt    15
diff --git a/e2e-tests/resources/authd/browser_window.py b/e2e-tests/resources/authd/browser_window.py
new file mode 100644
index 0000000000..e0abf78259
--- /dev/null
+++ b/e2e-tests/resources/authd/browser_window.py
@@ -0,0 +1,436 @@
+import cairo
+import json
+import gi
+import os
+import tempfile
+import traceback
+import sys
+
+import ExecUtils
+
+gi.require_version("Gtk", "3.0")
+gi.require_version("Gdk", "3.0")
+gi.require_version("WebKit2", "4.1")
+
+from gi.repository import (
+    Gdk,
+    Gtk,
+    GLib,
+    Gio,
+    WebKit2 as WebKit
+)  # type: ignore
+
+
+class BrowserWindow(Gtk.Window):
+    def __init__(self):
+        super().__init__(
+            window_position=Gtk.WindowPosition.CENTER,
+            default_width=1024,
+            default_height=768,
+            border_width=0,
+            title="Authd Tests Browser Window",
+        )
+
+        self._draw_monitors_cancellable = None
+        self._draw_monitors = []
+        self._snapshots_indexes = {}
+        self._snapshotting = False
+        self._recording_path = None
+        self._recording_fps = 0
+        self._recording_cancellable = None
+        self._recoding_cancellable_id = 0
+
+        self.web_view = WebKit.WebView()
+        self.web_view.get_settings().enableJavascript = True
+        self.web_view.get_settings().set_javascript_can_open_windows_automatically(
+            False
+        )
+        self.web_view.get_settings().set_user_agent(
+            "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:143.0) Gecko/20100101 Firefox/143.0"
+        )
+
+        self.web_view.set_can_default(True)
+
+        self.web_view.set_state_flags(
+            Gtk.StateFlags.ACTIVE | Gtk.StateFlags.FOCUSED, True
+        )
+
+        def on_event(_, event):
+            if (
+                event.type != Gdk.EventType.KEY_PRESS
+                and event.type != Gdk.EventType.KEY_RELEASE
+            ):
+                return
+            return False
+
+        self.web_view.add_events(
+            Gdk.EventMask.ALL_EVENTS_MASK
+            & ~(Gdk.EventMask.EXPOSURE_MASK | Gdk.EventMask.STRUCTURE_MASK)
+        )
+        self.web_view.connect("event", on_event)
+
+        self.load_state = WebKit.LoadEvent.STARTED
+
+        def on_load_changed(_, load_event):
+            self.load_state = load_event
+
+        self.web_view.connect("load-changed", on_load_changed)
+
+        self._overlay = Gtk.Overlay()
+        self._overlay.add(self.web_view)
+
+        self.add(self._overlay)
+
+        self.web_view.grab_default()
+        self.web_view.grab_focus()
+
+        self.connect("destroy", lambda _wv: self._on_destroy())
+
+    def _on_destroy(self):
+        if self._draw_monitors_cancellable:
+            self._draw_monitors_cancellable.cancel()
+
+        self.stop_recording()
+
+    def draw_event_connect(self, callback):
+        idle_id = 0
+
+        def on_idle():
+            nonlocal idle_id
+
+            for cb in self._draw_monitors:
+                cb()
+            idle_id = 0
+            return False
+
+        def on_draw_event(_, _cr):
+            nonlocal idle_id
+
+            if self._snapshotting:
+                return False
+
+            if not idle_id:
+                idle_id = GLib.idle_add(on_idle)
+            return False
+
+        self._draw_monitors.append(callback)
+        signal_id = self.web_view.connect_after("draw", on_draw_event)
+
+        def on_cancelled():
+            self._draw_monitors_cancellable = None
+
+            if idle_id:
+                GLib.source_remove(idle_id)
+
+            self.web_view.disconnect(signal_id)
+
+        if not self._draw_monitors_cancellable:
+            self._draw_monitors_cancellable = Gio.Cancellable()
+            self._draw_monitors_cancellable.connect(on_cancelled)
+
+    def draw_event_disconnect(self, callback):
+        self._draw_monitors.remove(callback)
+
+        if not self._draw_monitors and self._draw_monitors_cancellable:
+            self._draw_monitors_cancellable.cancel()
+
+    def wait_for_page_loaded(self):
+        if self.load_state == WebKit.LoadEvent.FINISHED:
+            return
+
+        loop = GLib.MainLoop()
+
+        def on_load_changed(_, load_event):
+            if load_event != WebKit.LoadEvent.FINISHED:
+                return
+
+            loop.quit()
+
+        signal_id = self.web_view.connect("load-changed", on_load_changed)
+        loop.run()
+        self.web_view.disconnect(signal_id)
+
+    def wait_for_stable_page(self):
+        self.wait_for_page_loaded()
+
+        # This overlay serves us to ensure that focus-related elements of the
+        # page (such as the cursor blinking) aren't affecting our page changes
+        # check mechanism.
+        # So we add an overlay and temporarily steal the focus.
+        overlay = Gtk.Button()
+        overlay.set_opacity(0)
+        self._overlay.add_overlay(overlay)
+        overlay.show()
+        overlay.grab_focus()
+
+        loop = GLib.MainLoop()
+
+        def on_timeout():
+            loop.quit()
+            return False
+
+        draw_timeout = 750
+        timeout = GLib.timeout_add(draw_timeout, on_timeout)
+
+        def on_draw_event():
+            nonlocal timeout
+
+            GLib.source_remove(timeout)
+            timeout = GLib.timeout_add(draw_timeout, on_timeout)
+
+        self.draw_event_connect(on_draw_event)
+        loop.run()
+        self.draw_event_disconnect(on_draw_event)
+
+        overlay.destroy()
+        self.web_view.grab_focus()
+
+    def wait_for_pattern(self, pattern, timeout_ms=5000,
+                         poll_interval_ms=100) -> str|None:
+        """Wait until `text` is present in the page's visible text and return the matched substring."""
+        loop = GLib.MainLoop()
+        cancellable = Gio.Cancellable()
+        inject_delay_id = 0
+        timeout_id = 0
+        found = None
+
+        # Use json.dumps / JSON.parse to safely escape the text into a JS string literal
+        # Return the first match (or empty string if none)
+        js = """(function(){
+                        try {
+                            var pattern = JSON.parse(`%s`);
+                            var re = new RegExp(pattern);
+                            var body = document && document.body && document.body.innerText ? document.body.innerText : '';
+                            var m = body.match(re);
+                            return m ? m[0] : '';
+                        } catch (e) {
+                            return '';
+                        }
+                    })()""" % json.dumps(pattern)
+
+        def on_js_finished(web_view, result):
+            nonlocal inject_delay_id, found
+
+            final_action = cancellable.cancel
+            try:
+                res = web_view.run_javascript_finish(result)
+                js_value = res.get_js_value()
+                match_str = js_value.to_string()
+                if not match_str:
+                    # Retry
+                    final_action = lambda: None
+                    inject_javascript()
+                    return
+
+                found = match_str
+            except GLib.Error as e:
+                if e.matches(Gio.io_error_quark(), Gio.IOErrorEnum.CANCELLED):
+                    return
+                raise e
+            except Exception as e:
+                raise e
+            finally:
+                final_action()
+
+        def on_inject_js_timeout():
+            nonlocal inject_delay_id
+
+            self.web_view.run_javascript(js, cancellable, on_js_finished)
+            inject_delay_id = 0
+            return False
+
+        def inject_javascript():
+            nonlocal inject_delay_id
+
+            inject_delay_id = GLib.timeout_add(poll_interval_ms, on_inject_js_timeout)
+
+        def on_cancelled():
+            loop.quit()
+
+            if timeout_id:
+                GLib.source_remove(timeout_id)
+
+            if inject_delay_id:
+                GLib.source_remove(inject_delay_id)
+
+        connect_id = cancellable.connect(on_cancelled)
+        timeout_id = GLib.timeout_add(timeout_ms, cancellable.cancel)
+
+        inject_javascript()
+        loop.run()
+
+        cancellable.disconnect(connect_id)
+
+        if not found:
+            raise TimeoutError(f"Timed out waiting for text: \"{pattern}\"")
+
+        return found
+
+    def send_key(self, event_type, key):
+        default_seat = Gdk.Display.get_default().get_default_seat()
+        event = Gdk.Event.new(event_type)
+        event.set_device(default_seat.get_keyboard())
+        event.set_source_device(default_seat.get_keyboard())
+        event.window = self.web_view.get_window()
+        event.send_event = True
+        event.keyval = key
+
+        loop = GLib.MainLoop()
+
+        def on_event(_, event):
+            if event.type == event_type and event.keyval == key:
+                loop.quit()
+            return False
+
+        self.web_view.connect("event", on_event)
+        event.put()
+        loop.run()
+
+    def send_key_tap(self, key):
+        self.send_key(Gdk.EventType.KEY_PRESS, key)
+        self.send_key(Gdk.EventType.KEY_RELEASE, key)
+
+    def send_key_taps(self, key_taps):
+        for kt in key_taps:
+            self.send_key_tap(kt)
+
+    def _run_async_task(self, task_function, cancellable: Gio.Cancellable = None,
+                        wait: bool = True):
+        loop = None
+        ret = False
+
+        def callback(_obj, result):
+            nonlocal ret
+
+            try:
+                ret = result.propagate_boolean()
+            except GLib.Error as e:
+                if e.matches(Gio.io_error_quark(), Gio.IOErrorEnum.CANCELLED):
+                    return
+            except Exception as e:
+                raise e
+            finally:
+                if loop:
+                    loop.quit()
+
+        def thread_func(t, _so, _td, _c):
+            try:
+                task_function()
+                t.return_boolean(True)
+            except GLib.Error as e:
+                t.return_error(e)
+            except Exception as e:
+                print(traceback.format_exc(), file=sys.stderr)
+                t.return_error(GLib.Error(f"{e}"))
+
+        if wait:
+            loop = GLib.MainLoop()
+
+        task = Gio.Task.new(source_object=self, cancellable=cancellable,
+                            callback=callback)
+        task.run_in_thread(thread_func)
+
+        if wait:
+            loop.run()
+            return ret
+
+        return True
+
+    def capture_snapshot(self, path: str, filename: str = "snapshot", ext: str = "png",
+                         sync: bool = True, cancellable: Gio.Cancellable = None):
+        view_window = self.web_view.get_window()
+        scale = view_window.get_scale_factor()
+        width = view_window.get_width() * scale
+        height = view_window.get_height() * scale
+
+        # Create an offscreen surface
+        try:
+            # This is failing in older PyGObject versions, so let's try both ways.
+            surface = view_window.create_similar_image_surface(cairo.Format.ARGB32,
+                                                               width, height, scale)
+        except ValueError:
+            surface = cairo.ImageSurface(cairo.Format.ARGB32, width, height)
+            surface.set_device_scale(scale, scale)
+
+        ctx = cairo.Context(surface)
+
+        # Render the window contents onto the Cairo surface, blocking any
+        # draw event handler to prevent reentrance
+        self._snapshotting = True
+        self.web_view.draw(ctx)
+        self._snapshotting = False
+
+        # Write to file
+        snapshot_index = self._snapshots_indexes.setdefault(path, 0)
+        file_path = os.path.join(path, f"{snapshot_index:05}-{filename}.{ext}")
+        self._snapshots_indexes[path] += 1
+
+        self._run_async_task(lambda: surface.write_to_png(file_path),
+                             cancellable=cancellable, wait=sync)
+        return file_path
+
+    def start_recording(self, fps: int = 5):
+        if self._recording_cancellable:
+            raise Exception("Recording is already in progress")
+
+        cancellable = Gio.Cancellable()
+        timeout = 0
+        max_delay_ms = 1000 / fps
+
+        self._recording_path = tempfile.TemporaryDirectory(prefix="authd-browser")
+
+        def save_snapshot():
+            nonlocal timeout
+
+            self.capture_snapshot(self._recording_path.name,
+                                  filename="frame", sync=False,
+                                  cancellable=cancellable)
+
+            timeout = GLib.timeout_add(max_delay_ms, save_snapshot)
+
+        save_snapshot()
+
+        def on_cancelled():
+            if timeout:
+                GLib.source_remove(timeout)
+
+            self._recording_cancellable = None
+
+        self._recoding_cancellable_id = cancellable.connect(on_cancelled)
+        self._recording_cancellable = cancellable
+        self._recording_fps = fps
+
+    def stop_recording(self, rendered_output: str = None):
+        if not self._recording_cancellable:
+            return
+
+        cancellable = self._recording_cancellable
+        self._recording_cancellable.cancel()
+        cancellable.disconnect(self._recoding_cancellable_id)
+        self._recoding_cancellable_id = 0
+
+        if rendered_output:
+            self._run_async_task(lambda: render_video(self._recording_path.name,
+                                                      rendered_output,
+                                                      self._recording_fps))
+
+        self._recording_path.cleanup()
+        self._recording_fps = 0
+
+
+def ascii_string_to_key_events(string):
+    if len(string) != len(string.encode()):
+        raise TypeError(f"{string} is not an ascii string")
+    return [ord(ch) for ch in list(string)]
+
+
+def render_video(screenshot_dir: str, video_path: str, framerate: int = 1):
+    ExecUtils.check_call([
+        "ffmpeg",
+        "-loglevel", "warning",
+        "-y",
+        "-framerate", str(framerate),
+        "-pattern_type", "glob",
+        "-i", f"{screenshot_dir}/*.png",
+        video_path,
+    ])
diff --git a/e2e-tests/resources/authd/generate_totp.py b/e2e-tests/resources/authd/generate_totp.py
new file mode 100644
index 0000000000..6edb79364b
--- /dev/null
+++ b/e2e-tests/resources/authd/generate_totp.py
@@ -0,0 +1,34 @@
+#!/usr/bin/env python3
+
+import argparse
+import base64
+import hashlib
+import hmac
+import struct
+import time
+
+TIME_WINDOW = 5
+
+def generate_totp(secret: str) -> str:
+    # The code is generated according to the current time and is valid for 30 seconds.
+    # This means that if we generate the code just before the time window changes,
+    # it might be invalid by the time we use it. To avoid this, we make sure the time
+    # is safely within a new window before generating the code.
+    while time.time() % 30 > (30 - TIME_WINDOW):
+        continue
+
+    key = base64.b32decode(secret, True)
+    msg = struct.pack(">Q", int(time.time()) // 30)
+    hashed_obj = hmac.new(key, msg, hashlib.sha1).digest()
+    o = hashed_obj[19] & 15
+
+    totp_code = (struct.unpack(">I", hashed_obj[o:o + 4])[0] & 0x7fffffff) % 1000000
+
+    return f"{totp_code:06d}"
+
+if __name__ == "__main__":
+    parser = argparse.ArgumentParser()
+    parser.add_argument("totp_secret")
+    args = parser.parse_args()
+
+    print(generate_totp(args.totp_secret))
diff --git a/e2e-tests/resources/authd/ssh.sh b/e2e-tests/resources/authd/ssh.sh
new file mode 120000
index 0000000000..bc4d02d7cc
--- /dev/null
+++ b/e2e-tests/resources/authd/ssh.sh
@@ -0,0 +1 @@
+../../vm/ssh.sh
\ No newline at end of file
diff --git a/e2e-tests/resources/authd/utils.resource b/e2e-tests/resources/authd/utils.resource
new file mode 100644
index 0000000000..7679ec83a6
--- /dev/null
+++ b/e2e-tests/resources/authd/utils.resource
@@ -0,0 +1,208 @@
+*** Settings ***
+Documentation       authd test resources
+
+Resource            ../kvm.resource
+Library             ./Journal.py    AS    Journal
+Library             ./StringUtils.py    AS    StringUtils
+Library             ./VideoLogger.py    AS    VideoLogger
+Library             ./VNCRecorder.py   AS    VNCRecorder
+Library             ./Snapshot.py    AS    Snapshot
+Library             ./SSH.py    AS    SSH
+Library             Process
+Library             OperatingSystem
+
+
+*** Variables ***
+${SUITE_OUTPUT_DIR}    ${OUTPUT DIR}/${SUITE NAME}
+
+
+*** Keywords ***
+Log In
+    Set OCR Confidence Threshold    0.94
+    Set OCR Coincidence Threshold    92
+    Match Text    Not listed    300
+    Wait Until User Selected
+    Hid.Type String    ubuntu
+    Hid.Keys Combo    Return
+    Wait Until Desktop Ready
+
+
+Wait Until User Selected
+    Wait Until Keyword Succeeds    120 sec    1 sec
+    ...    Try Select User
+
+
+Try Select User
+    Hid.Keys Combo    Return
+    Match Text    Password
+
+
+Log Out
+    Run Command    gnome-session-quit --logout --no-prompt
+
+
+Wait Until Desktop Ready
+    Wait Until Keyword Succeeds    1 min    1 sec
+    ...    Try Desktop Ready
+
+
+Try Desktop Ready
+    Hid.Move Pointer To Proportional    1    1
+    BuiltIn.Sleep    1
+    Hid.Move Pointer To Proportional    0    1
+    Match Text    Show Apps    10
+
+
+Open Terminal
+    Run Command    x-terminal-emulator
+    Hid.Move Pointer To Proportional    1    1
+    Match Text    @ubuntu:~$    120
+    Hid.Keys Combo    F11
+    Hid.Move Pointer To Proportional    1    1
+    Match Text    @ubuntu:~$    120
+
+
+Open Terminal In Sudo Mode
+    Open Terminal
+    Enter Sudo Mode In Terminal
+
+
+Enter Sudo Mode In Terminal
+    Hid.Type String    clear
+    Hid.Keys Combo    Return
+    Hid.Type String    sudo -s
+    Hid.Keys Combo    Return
+    Match Text    root@ubuntu    120
+    Hid.Type String    clear
+    Hid.Keys Combo    Return
+    Match Text    root@ubuntu    120
+
+
+Close Focused Window
+    Hid.Keys Combo    Alt_L   F4
+
+
+Close Terminal In Sudo Mode
+    Hid.Type String    clear
+    Hid.Keys Combo    Return
+    Match Text    root@ubuntu    120
+    Hid.Type String    exit
+    Hid.Keys Combo    Return
+    Close Focused Window
+
+
+Log Out From Terminal Session
+    Match Text    @ubuntu    120
+    # We are in a machinectl session, so we need to ^] thrice to exit properly
+    Hid.Keys Combo    Control_L    ]
+    Hid.Keys Combo    Control_L    ]
+    Hid.Keys Combo    Control_L    ]
+
+
+Log Out From SSH Session
+    Hid.Type String    exit
+    Hid.Keys Combo    Return
+    Match Text    ubuntu@ubuntu    120
+
+
+Run Command In Terminal
+    [Arguments]    ${command}    ${timeout}=${600}
+    Open Terminal
+    # Y21kLWZpbmlzaGVkCg== is the base64 encoding of "cmd-finished\n"
+    # We use it to avoid that the `Match Text` below matches the command itself,
+    # before the first clear is executed.
+    Hid.Type String   clear && ${command} && echo Y21kLWZpbmlzaGVkCg== | base64 -d
+    Hid.Keys Combo    Return
+    Match Text    cmd-finished    ${timeout}
+    Close Focused Window
+
+
+Left Button Click
+    BuiltIn.Sleep    0.5
+    Click LEFT Button
+    BuiltIn.Sleep    0.5
+    Hid.Move Pointer To Proportional    1    1
+
+
+Run Command
+    [Arguments]    ${command}
+    Hid.Keys Combo    Alt_L    F2
+    Match Text    Run a Command    15
+    Hid.Type String    ${command}
+    Wait Until Keyword Succeeds    5s    1s    Submit Run Command Dialog
+
+Submit Run Command Dialog
+    Hid.Keys Combo    Return
+    # Ensure the dialog is closed, because sometimes the Return keypress does
+    # not trigger the command execution and the dialog remains open.
+    ${matches}=    Find Text    Run a Command
+    Should Be Empty    ${matches}
+
+
+Start Application
+    [Arguments]    ${application}
+    Run Command    ${application}
+
+
+Cancel Operation
+    Match Text    @ubuntu    15
+    Hid.Keys Combo    Control_L    C
+
+
+Update And Upgrade Packages
+    SSH.Execute    sudo apt-get update
+    SSH.Execute    sudo apt-get upgrade -y    timeout=1200
+
+
+Sync System Time
+    ${output} =    SSH.Execute    nm-online -q && sudo systemctl restart systemd-timesyncd
+    Log    ${output}    level=DEBUG
+    ${output} =   SSH.Execute    timedatectl show -p NTPSynchronized | grep -q NTPSynchronized=yes
+    Log    ${output}    level=DEBUG
+
+
+Wait Until System Time Synced
+    Wait Until Keyword Succeeds    1 min    1 sec
+    ...    Sync System Time
+
+
+Try machinectl login Prompt
+    VAR    ${tries}    3
+    WHILE    ${tries} > 0
+        Hid.Type String    machinectl login
+        Hid.Keys Combo    Return
+        ${match} =     Run Keyword And Return Status
+        ...    Match Text    ubuntu login:    120
+        IF   '${match}' == 'True'
+            BREAK
+        END
+        Hid.Keys Combo    Control_L    ]
+        Hid.Keys Combo    Control_L    ]
+        Hid.Keys Combo    Control_L    ]
+        ${tries} =    Evaluate    ${tries} - 1
+    END
+
+
+### Setup ###
+
+Restore Snapshot
+    [Arguments]    ${snapshot_name}
+    Snapshot.Restore    ${snapshot_name}
+    Wait Until System Time Synced
+
+Common Test Setup
+    Set Suite Metadata    Ubuntu Version   %{RELEASE}    top=True
+    Set Suite Metadata    Broker    %{BROKER}    top=True
+    Journal.Start Receiving Journal
+    VNCRecorder.Start Recording
+
+### Teardown ###
+
+Log Videos On Error
+    Run Keyword If    '${TEST STATUS}' == 'FAIL'    VideoLogger.Log videos
+
+Common Test Teardown
+    VNCRecorder.Stop Recording
+    Journal.Stop Receiving Journal
+    Journal.Log Journal
+    Log Videos On Error
diff --git a/e2e-tests/resources/broker b/e2e-tests/resources/broker
new file mode 120000
index 0000000000..ae269fc808
--- /dev/null
+++ b/e2e-tests/resources/broker
@@ -0,0 +1 @@
+authd-msentraid
\ No newline at end of file
diff --git a/e2e-tests/resources/kvm.resource b/e2e-tests/resources/kvm.resource
new file mode 120000
index 0000000000..4ea3cde0f5
--- /dev/null
+++ b/e2e-tests/resources/kvm.resource
@@ -0,0 +1 @@
+../.yarf/yarf/rf_libraries/resources/kvm.resource
\ No newline at end of file
diff --git a/e2e-tests/resources/video_input_vars.py b/e2e-tests/resources/video_input_vars.py
new file mode 120000
index 0000000000..fd85248b4e
--- /dev/null
+++ b/e2e-tests/resources/video_input_vars.py
@@ -0,0 +1 @@
+../.yarf/yarf/rf_libraries/variables/video_input_vars.py
\ No newline at end of file
diff --git a/e2e-tests/run-tests.sh b/e2e-tests/run-tests.sh
new file mode 100755
index 0000000000..9c5838c2ab
--- /dev/null
+++ b/e2e-tests/run-tests.sh
@@ -0,0 +1,195 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+set -x
+
+usage() {
+    cat << EOF
+Usage: $0 [options] [test.robot...]
+
+Runs YARF end-to-end tests against a libvirt VM configured with the specified broker.
+For each test the script reverts the VM to a broker-specific snapshot, links
+test resources and launches the test via robot framework.
+
+Required environment variables (or use the corresponding command-line options):
+  E2E_USER           The username used for authd login in the tests
+  E2E_PASSWORD       The password used for authd login in the tests
+  TOTP_SECRET        The secret used to generate OTP codes for the E2E_USER's MFA
+  BROKER             The broker to test (e.g., authd-msentraid)
+
+Prerequisites:
+  - A libvirt domain as set up by the vm/provision.sh script, with the snapshots:
+      \${BROKER}-installed
+      \${BROKER}-stable-installed
+
+  - YARF must be installed via the setup_yarf.sh script
+
+Options:
+  -u, --user <name>            Username for the tests (can also be set via E2E_USER environment variable)
+  -p, --password <password>    Password for the tests (can also be set via E2E_PASSWORD environment variable)
+  -s, --totp-secret <secret>   Secret to generate OTP codes for the user's MFA (can also be set via TOTP_SECRET environment variable)
+  -b, --broker <broker>        Broker to test (can also be set via BROKER environment variable)
+  -r, --release <release>      Ubuntu release to test (e.g., 'questing', can also be set via RELEASE environment variable)
+  -o, --output-dir DIR         Directory to store test outputs (default: temporary directory)
+  -h, --help                   Show this help message and exit
+      --rerunfailed            Re-run only the tests that failed in the previous run
+EOF
+}
+
+ROOT_DIR=$(dirname "$(readlink -f "$0")")
+TESTS_DIR="${ROOT_DIR}/tests"
+TEST_RUNS_DIR="${XDG_RUNTIME_DIR}/authd-e2e-test-runs"
+
+# Parse command line arguments
+TESTS_TO_RUN=""
+OUTPUT_DIR=""
+while [[ $# -gt 0 ]]; do
+    key="$1"
+
+    case $key in
+        --user|-u)
+            E2E_USER="$2"
+            shift 2
+            ;;
+        --password|-p)
+            E2E_PASSWORD="$2"
+            shift 2
+            ;;
+        --broker|-b)
+            BROKER="$2"
+            shift 2
+            ;;
+        --release|-r)
+            RELEASE="$2"
+            shift 2
+            ;;
+        --totp-secret|-s)
+            TOTP_SECRET="$2"
+            shift 2
+            ;;
+        --rerunfailed)
+            RERUNFAILED=1
+            shift
+            ;;
+        --output-dir|-o)
+            OUTPUT_DIR="$2"
+            shift 2
+            ;;
+        -h|--help)
+            usage
+            exit 0
+            ;;
+        --)
+            shift
+            break
+            ;;
+        -*)
+            echo "Unknown option: $1"
+            usage
+            exit 1
+            ;;
+        *)
+            TESTS_TO_RUN="${TESTS_TO_RUN} ${TESTS_DIR}/$(basename "${1}")"
+            shift
+            ;;
+    esac
+done
+
+if [ -z "${E2E_USER:-}" ] || [ -z "${E2E_PASSWORD:-}" ] || [ -z "${BROKER:-}" ] || [ -z "${RELEASE:-}" ] || [ -z "${TOTP_SECRET:-}" ]; then
+    echo >&2  "Error: E2E_USER, E2E_PASSWORD, BROKER, RELEASE, and TOTP_SECRET must be set either as environment variables or via command line arguments."
+    usage
+    exit 1
+fi
+
+VM_NAME=${VM_NAME:-"e2e-runner-${RELEASE}"}
+
+if [ -z "${TESTS_TO_RUN}" ]; then
+    echo "Running all tests in ${TESTS_DIR}"
+    TESTS_TO_RUN=$(find "${TESTS_DIR}" -type f -name "*.robot")
+fi
+
+PREVIOUS_TEST_RUN_DIR=$(readlink -f "${TEST_RUNS_DIR}/${BROKER}-latest" || true)
+if [ -n "${RERUNFAILED:-}" ] && [ -z "${PREVIOUS_TEST_RUN_DIR}" ]; then
+    echo >&2 "Error: No previous test run found to rerun failed tests from."
+    exit 1
+fi
+
+systemd_ver=$(systemctl --version | awk 'NR==1 {print $2}')
+if dpkg --compare-versions "$systemd_ver" "ge" "256"; then
+    SYSTEMD_SUPPORTS_VSOCK=1
+fi
+
+ROBOT_ARGS=()
+if [ -n "${RERUNFAILED:-}" ]; then
+    echo "Rerunning failed tests from previous run in ${PREVIOUS_TEST_RUN_DIR}"
+    ROBOT_ARGS+=(--rerunfailed "${PREVIOUS_TEST_RUN_DIR}/output.xml")
+fi
+
+# Launch the domain if it's not already running, so that we can get its VNC port
+if ! virsh domstate "${VM_NAME}" | grep -q '^running'; then
+    # For some reason, when using external snapshot and the host was rebooted,
+    # `virsh start` fails with a permission denied error.
+    # Reverting to a snapshot first fixes this (and since it's a live snapshot,
+    # we don't need to start the VM afterwards).
+    virsh snapshot-revert "${VM_NAME}" "${BROKER}-installed"
+fi
+VNC_PORT=$(virsh vncdisplay "${VM_NAME}" | cut -d':' -f2)
+
+# Create a temporary test run directory
+mkdir -p "${TEST_RUNS_DIR}"
+TEST_RUN_DIR=$(mktemp -d --tmpdir="${TEST_RUNS_DIR}" "${BROKER}-XXXXXX")
+ln -sf --no-target-directory "${TEST_RUN_DIR}" "${TEST_RUNS_DIR}/${BROKER}-latest"
+cd "${TEST_RUN_DIR}"
+
+if [ -z "${OUTPUT_DIR:-}" ]; then
+    OUTPUT_DIR=output
+    echo "No output directory specified, using current test run directory."
+fi
+
+mkdir -p "${OUTPUT_DIR}" resources
+
+# Activate YARF environment
+YARF_DIR="${ROOT_DIR}/.yarf"
+if [ ! -d "${YARF_DIR}" ]; then
+    echo >&2  "YARF directory not found at ${YARF_DIR}. Please run setup_yarf.sh first."
+    exit 1
+fi
+# shellcheck disable=SC1091 # Avoid info message about not following sourced file
+source "${YARF_DIR}/.venv/bin/activate"
+
+# Create symlinks to the resources directory
+mkdir -p tests/resources
+for resource in "${ROOT_DIR}/resources/"*; do
+    ln -s "${resource}" "tests/resources/$(basename "${resource}")"
+done
+ln -sf --no-target-directory "${BROKER}" tests/resources/broker
+
+# Create symlinks to the test files
+for test_file in $TESTS_TO_RUN; do
+    ln -s "${test_file}" tests
+done
+
+# Make YARF not log videos, we log them ourselves in the test case error message.
+YARF_LOG_VIDEO=0
+
+env \
+    E2E_USER="$E2E_USER" \
+    E2E_PASSWORD="$E2E_PASSWORD" \
+    TOTP_SECRET="$TOTP_SECRET" \
+    BROKER="$BROKER" \
+    RELEASE="$RELEASE" \
+    VNC_PORT="$VNC_PORT" \
+    SYSTEMD_SUPPORTS_VSOCK="${SYSTEMD_SUPPORTS_VSOCK:-}" \
+    YARF_LOG_VIDEO="${YARF_LOG_VIDEO}" \
+    robot \
+        --consolecolors on \
+        --loglevel DEBUG \
+        --pythonpath "${YARF_DIR}/yarf/rf_libraries/libraries/vnc" \
+        --outputdir "${OUTPUT_DIR}" \
+        "${ROBOT_ARGS[@]}" \
+        "$@" \
+        tests \
+        | grep -v "<video controls style" \
+        || test_result=$?
+
+exit "${test_result:-0}"
diff --git a/e2e-tests/setup-yarf.sh b/e2e-tests/setup-yarf.sh
new file mode 100755
index 0000000000..f0f9a364aa
--- /dev/null
+++ b/e2e-tests/setup-yarf.sh
@@ -0,0 +1,36 @@
+#!/usr/bin/env bash
+set -euo pipefail
+set -x
+
+YARF_REPO_URL="https://github.com/adombeck/yarf"
+
+SCRIPT_DIR=$(dirname "$(readlink -f "$0")")
+YARF_DIR="${SCRIPT_DIR}/.yarf"
+
+# Clone the YARF repository if it doesn't exist
+if [ ! -d "$YARF_DIR" ]; then
+    echo "Cloning YARF repository into $YARF_DIR..."
+    git clone --depth=1 "$YARF_REPO_URL" "$YARF_DIR"
+else
+    echo "YARF repository already exists at $YARF_DIR, pulling latest changes..."
+    cd "$YARF_DIR"
+    git pull
+fi
+
+# Install uv snap if not already installed
+if ! command -v uv &> /dev/null; then
+    echo "Installing uv snap..."
+    sudo snap install --classic astral-uv
+else
+    echo "uv snap already installed"
+fi
+
+# Set up YARF in a virtual environment using uv
+cd "$YARF_DIR"
+uv sync
+uv pip install '.[develop]'
+# We need pygobject in the Python environment for some tests
+uv pip install pygobject
+# We need ansi2html to log colored journalctl output as HTML
+uv pip install ansi2html
+uv pip install "$YARF_DIR"
diff --git a/e2e-tests/testing.md b/e2e-tests/testing.md
new file mode 100644
index 0000000000..6dfa7b5cfe
--- /dev/null
+++ b/e2e-tests/testing.md
@@ -0,0 +1,361 @@
+# End-to-end tests
+
+## Explanation
+
+The end-to-end tests are implemented using [YARF](https://github.com/canonical/yarf). They cover a wide range of scenarios,
+both for authd and the brokers.
+
+## Setting up the environment
+
+Running the tests locally requires a bit of setting up. This is a step-by-step guide to get you started.
+
+:memo: **Note:** This process is automated through the `e2e-tests/vm/provision.sh` script, which you can use instead of following the steps below manually.
+
+### 1. Install the required dependencies
+
+The tests have mainly two sets of dependencies: one required to configure and run the VM and one to build YARF from source.
+
+- Virtualization dependencies:
+
+    ```text
+    cloud-image-utils
+    libvirt-clients-qemu
+    libvirt-daemon-system
+    qemu-kvm
+    socat
+    wget
+    ```
+
+    Those are all part of the archive and can be installed on Ubuntu with:
+
+    ```bash
+    sudo ./e2e-tests/vm/install-provision-deps.sh
+    ```
+
+- Test-run dependencies:
+
+    ```text
+    ffmpeg
+    gir1.2-webkit2-4.1
+    libxkbcommon-dev
+    libcairo2-dev
+    libgirepository-2.0-dev
+    python3-tk
+    python3-gi
+    python3-cairo
+    xvfb    
+    ```
+
+    Those are all part of the archive and can be installed on Ubuntu with:
+
+    ```bash
+    sudo ./e2e-tests/install-deps.sh
+    ```
+
+### 2. Setup the VM
+
+The tests need a VM to run. This can be easily setup by using the domain definition and cloud-init configuration provided in the repository.
+
+1. Download the latest Ubuntu Desktop image (and resize it):
+
+    ```bash
+    wget https://cloud-images.ubuntu.com/questing/current/questing-server-cloudimg-amd64.img
+
+    qemu-img resize questing-server-cloudimg-amd64.img 10G
+    ```
+
+2. Create the cloud-init iso using the provided configuration in `e2e-tests/vm/cloud-init-template.yaml`:
+   1. Update the file with the ssh key that will be used to access the VM.
+   2. Create a directory and copy the YAML file there. The file must be named `user-data`.
+   3. Create the `seed.iso` file using `cloud-localds`.
+
+        ```bash
+
+        mkdir -p /tmp/seed/
+
+        SSH_PUBLIC_KEY=$(cat "${SSH_PUBLIC_KEY_FILE}") \
+            envsubst < e2e-tests/vm/cloud-init-template.yaml > /tmp/seed/user-data
+
+        cloud-localds /tmp/seed.iso /tmp/seed/user-data
+        ```
+
+3. Define the VM using the provided XML in `e2e-tests/vm/e2e-runner-template.xml`:
+   1. Edit the XML and set the correct paths for the disk image.
+
+        ```bash
+        IMAGE_FILE=${IMAGE_FILE} \
+        envsubst < e2e-tests/vm/e2e-runner-template.xml > /tmp/e2e-runner.xml
+        ```
+
+   2. Define the VM with `virsh`:
+
+        ```bash
+        virsh define /tmp/e2e-runner.xml
+        ```
+
+4. Attach the cloud-init iso to the VM:
+
+    ```bash
+    virsh attach-disk --domain e2e-runner --source /tmp/seed.iso --target sda --type cdrom --config
+    ```
+
+5. Start the domain and wait for it to finish the initial setup:
+
+    ```bash
+    virsh start e2e-runner
+    ```
+
+    - The cloud-init process will take a few moments to finish. You can check the progress by connecting to the VM's console:
+
+        ```bash
+        virsh console e2e-runner
+        ```
+
+    - The domain will automatically shutdown once the initial setup is complete, so you need to start it again.
+
+        ```bash
+        virsh start e2e-runner
+
+        # It will take a while, so make sure to wait until it's up and running
+        sleep 180s
+        ```
+
+    - Now that the initial setup is done, we need to create a snapshot of this fresh state, so we can revert to it later when installing authd.
+
+        ```bash
+        virsh snapshot-create-as e2e-runner --name initial-setup --reuse-external
+        ```
+
+### 3. Install authd and the brokers
+
+Now that the VM is ready, we need to install authd and the brokers we want to test.
+
+:memo: **Note:** You can find scripts for the installation processes at the [end of the section](#Scripts-to-automate-the-installation-and-configuration-of-authd-and-brokers).
+
+#### 1. Install authd (stable and edge versions)
+
+- This can be done either through GUI or by SSH. For simplicity, we will use SSH here.
+
+- The default username is `ubuntu` and the password is whatever you set in the cloud-init file.
+- The VM uses `socat` to forward the SSH port over VSOCK, so the SSH command will look like this:
+
+    ```bash
+    ssh -o ProxyCommand="socat - VSOCK-CONNECT:1000:22" -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -o LogLevel=ERROR ubuntu@localhost
+    ```
+
+- From now on, the command will be referred to as `ssh_vm` for simplicity. You can use the `e2e-tests/vm/ssh.sh` script instead of typing the full command every time.
+- Now we can proceed to install authd and the brokers. The following steps need to be repeated for each version of authd we want to test (stable and edge).
+
+##### Install authd
+
+1. Revert to the "fresh install" snapshot:
+
+    ```bash
+    virsh snapshot-revert e2e-runner fresh-install
+    ```
+
+2. Install authd:
+
+    ```bash
+    ssh_vm "sudo DEBIAN_FRONTEND=noninteractive add-apt-repository -y ppa:ubuntu-enterprise-desktop/authd-edge"
+    ssh_vm "sudo DEBIAN_FRONTEND=noninteractive apt-get install -y authd"
+    ```
+
+3. Create a snapshot of this state, so we can revert to it later when we proceed to configure the brokers.
+
+    ```bash
+    virsh snapshot-create-as e2e-runner --name authd-installed --reuse-external
+    ```
+
+4. Repeat the above steps for the stable version of authd, just changing the PPA to `ppa:ubuntu-enterprise-desktop/authd` and naming the snapshot `authd-stable-installed`.
+
+#### 2. Install the desired brokers
+
+Repeat the following steps for each version of each broker you want to test;
+
+1. Revert to the desired authd snapshot (either stable or edge) to ensure a clean state:
+
+    ```bash
+    virsh snapshot-revert e2e-runner "authd-<version>-installed"
+    ```
+
+2. Install the desired broker (replace `${broker}` and `${channel}` with the desired values):
+
+    ```bash
+    ssh_vm "sudo snap install ${broker} --channel=${channel}"
+    ```
+
+3. Configure authd to recognize the installed broker.
+
+    ```bash
+    ssh_vm "sudo mkdir -p /etc/authd/brokers.d"
+    ssh_vm "sudo cp /snap/${broker}/current/conf/authd/${broker}.conf /etc/authd/brokers.d/"
+    ```
+
+4. Configure the installed broker:
+
+    ```bash
+    ssh_vm "sudo sed -i -e 's|<ISSUER_ID>|'${ISSUER_ID}'|g' \
+                          -e 's|<CLIENT_ID>|'${CLIENT_ID}'|g' \
+                          -e 's|#ssh_allowed_suffixes_first_auth =|ssh_allowed_suffixes_first_auth = '${E2E_USER}|g' \
+                          /var/snap/${broker}/current/broker.conf"
+    ```
+
+5. Restart authd and the broker to apply the changes.
+
+    ```bash
+    ssh_vm "sudo systemctl restart authd.service"
+
+    # This could fail sometimes if the restart is triggered too quickly, so don't be afraid to wait a couple of seconds and retry
+    ssh_vm "sudo snap restart ${broker}"
+    ```
+
+6. Reboot the VM to ensure the snapshot is taken from the login screen.
+
+    ```bash
+    virsh reboot e2e-runner
+
+    # Wait a while for the VM to reboot
+    sleep 180s
+    ```
+
+7. Create a snapshot of this state, so we can revert to it later when running the tests.
+
+    ```bash
+    virsh snapshot-create-as e2e-runner --name "${broker}-${channel}-installed" --reuse-external
+    ```
+
+#### Scripts to automate the installation and configuration of authd and brokers
+
+##### Script to install authd (both stable and edge versions)
+
+```bash
+#!/usr/bin/env bash
+
+set -eux
+
+declare -a versions=("edge" "stable")
+for version in "${versions[@]}"; do
+    echo "Setting up authd - $version"
+
+    virsh snapshot-revert e2e-runner initial-setup
+
+    PPA="ppa:ubuntu-enterprise-desktop/authd-edge"
+    if [[ "$version" == "stable" ]]; then
+    PPA="ppa:ubuntu-enterprise-desktop/authd"
+    fi
+
+    ssh_vm "sudo DEBIAN_FRONTEND=noninteractive add-apt-repository -y $PPA"
+    ssh_vm "sudo DEBIAN_FRONTEND=noninteractive apt-get install -y authd"
+
+    # Create snapshot to be used as base for broker configuration
+    virsh snapshot-create-as e2e-runner --name "authd-$version-installed" --reuse-external
+done
+```
+
+##### Script to automate the above steps for both stable and edge versions of authd and the broker
+
+Update the variables at the top of the script to match your desired broker and configuration.
+
+```bash
+#!/usr/bin/env bash
+
+set -eux
+
+broker="desired_broker_name" # Change to the desired broker name
+
+declare -a channels=("edge" "stable")
+for channel in "${channels[@]}"; do
+    echo "Setting up $broker broker - $channel"
+
+    virsh snapshot-revert e2e-runner "authd-$channel-installed"
+
+    # Install broker, configure and restart services
+    ssh_vm "sudo snap install ${broker} --channel=${channel} && \
+            sudo mkdir -p /etc/authd/brokers.d && \
+            sudo cp /snap/${broker}/current/conf/authd/${broker_config} /etc/authd/brokers.d/ && \
+            sudo sed -i -e 's|<ISSUER_ID>|'${ISSUER_ID}'|g' \
+                        -e 's|<CLIENT_ID>|'${CLIENT_ID}'|g' \
+                        -e 's|#ssh_allowed_suffixes_first_auth =|ssh_allowed_suffixes_first_auth = '${AUTHD_USER}|g' \
+                        /var/snap/${broker}/current/broker.conf && \
+            sudo systemctl restart authd.service && \
+            sudo snap restart ${broker}"
+
+    # Reboot VM and wait until it's back
+    virsh reboot e2e-runner
+
+    retry --times 10 --delay 3 -- ssh_vm "systemctl is-system-running --wait"
+
+    # Create snapshot for broker configured state
+    virsh snapshot-create-as e2e-runner --name "$broker-$channel-installed" --reuse-external
+done
+```
+
+## Building YARF
+
+Now that the VM is ready with authd and the desired brokers installed and configured, we need to build YARF in order to run the tests.
+
+:memo: **Note:** This process is automated through the `e2e-tests/setup-yarf.sh` script, which you can use instead of following the steps below manually.
+
+1. Clone the YARF repository (either directly or by forking it first):
+
+    ```bash
+    git clone https://github.com/canonical/yarf
+    ```
+
+2. Build and set up the virtual environment
+    1. Install `uv`
+
+        ```bash
+        sudo snap install --classic astral-uv
+        ```
+
+    2. Build YARF
+
+        ```bash
+        cd {path_to_yarf_repo}
+
+        uv sync
+
+        uv pip install '.[develop]'
+        source .venv/bin/activate
+        uv pip install pygobject
+        ```
+
+        :bulb: **Tip:** YARF will be built inside a virtual environment, so every time you want to run it, the environment needs to be activated
+
+        ```bash
+        source {path_to_yarf_repo}/.venv/bin/activate
+        ```
+
+## Running the tests
+
+Now that everything is set up, we can finally run the tests. Make sure to activate the YARF virtual environment first.
+In order to facilitate running the tests, the `e2e-tests/run-tests.sh` script is provided.
+
+- Some environment variables need to be set before running the script:
+  - `E2E_USER` - The username to use for the tests
+  - `E2E_PASSWORD` - The remote password to use for the tests
+  - `BROKER` - The broker to test (e.g., authd-msentraid)
+
+- Optionally, you can set:
+  - `SNAPSHOT_ON_FAIL` - If set, a snapshot will be taken if a test fail. Default is "false".
+  - `SHOW_WEBVIEW` - If set, the tests will run with a visible window. Default is "false" (headless).
+
+- If the script is run without arguments, it will run all the tests. You can also provide a specific test file and it will run only that test.
+
+ ```bash
+ export E2E_USER="your_username"
+ export E2E_PASSWORD="your_password"
+ export BROKER="your_broker_name" # e.g. authd-msentraid
+ export SNAPSHOT_ON_FAIL="true" # optional
+ export SHOW_WEBVIEW="true" # optional
+
+ # To run all tests
+ ./e2e-tests/run-tests.sh
+
+ # To run a single test file
+ ./e2e-tests/run-tests.sh tests/test_name.robot
+ ```
+
+It will take care of creating and linking the necessary directories and files, reverting to the correct snapshot, and running YARF with the correct parameters. By default, the files will be saved in `/tmp/e2e-testrun-${BROKER}`.
diff --git a/e2e-tests/tests/authd_disabled.robot b/e2e-tests/tests/authd_disabled.robot
new file mode 100644
index 0000000000..1277afb0bf
--- /dev/null
+++ b/e2e-tests/tests/authd_disabled.robot
@@ -0,0 +1,46 @@
+*** Settings ***
+Resource        ./resources/authd/utils.resource
+Resource        ./resources/authd/authd.resource
+
+Resource        ./resources/broker/broker.resource
+
+# Test Tags       robot:exit-on-failure
+
+Test Setup    Test Setup
+Test Teardown   Test Teardown
+
+
+*** Keywords ***
+Test Setup
+    Restore Snapshot    %{BROKER}-installed
+    Common Test Setup
+
+Test Teardown
+    Common Test Teardown
+
+
+*** Variables ***
+${username}    %{E2E_USER}
+
+
+*** Test Cases ***
+Test that disabling authd prevents remote logins
+    [Documentation]    This test verifies that when authd is disabled, remote users cannot log in, while local users can still access the system.
+
+    # Log in with local user
+    Log In
+
+    # Disable authd
+    Disable Authd Socket And Service
+
+    # Ensure local sudo user can still log in
+    Open Terminal
+    Enter Sudo Mode In Terminal
+    Close Terminal In Sudo Mode
+
+    # Check that remote user cannot log in
+    Open Terminal In Sudo Mode
+    Try Log In With Remote User    ${username}
+    Check That Log In Fails Because Authd Is Disabled
+    Cancel Operation
+    Close Terminal In Sudo Mode
diff --git a/e2e-tests/tests/broker_disabled.robot b/e2e-tests/tests/broker_disabled.robot
new file mode 100644
index 0000000000..3329f90689
--- /dev/null
+++ b/e2e-tests/tests/broker_disabled.robot
@@ -0,0 +1,46 @@
+*** Settings ***
+Resource        ./resources/authd/utils.resource
+Resource        ./resources/authd/authd.resource
+
+Resource        ./resources/broker/broker.resource
+
+# Test Tags       robot:exit-on-failure
+
+Test Setup    Test Setup
+Test Teardown   Test Teardown
+
+
+*** Keywords ***
+Test Setup
+    Restore Snapshot    %{BROKER}-installed
+    Common Test Setup
+
+Test Teardown
+    Common Test Teardown
+
+
+*** Variables ***
+${username}    %{E2E_USER}
+
+
+*** Test Cases ***
+Test that disabling broker prevents remote logins
+    [Documentation]    This test verifies that when the broker is disabled, remote users cannot log in, while local users can still access the system.
+
+    # Log in with local user
+    Log In
+
+    # Disable broker
+    Disable Broker And Purge Config
+
+    # Ensure local sudo user can still log in
+    Open Terminal
+    Enter Sudo Mode In Terminal
+    Close Terminal In Sudo Mode
+
+    # Check that remote user cannot log in
+    Open Terminal In Sudo Mode
+    Try Log In With Remote User    ${username}
+    Check That User Is Redirected To Local Broker
+    Cancel Operation
+    Close Terminal In Sudo Mode
diff --git a/e2e-tests/tests/config_issuer_invalid.robot b/e2e-tests/tests/config_issuer_invalid.robot
new file mode 100644
index 0000000000..e18df1671f
--- /dev/null
+++ b/e2e-tests/tests/config_issuer_invalid.robot
@@ -0,0 +1,41 @@
+*** Settings ***
+Resource        ./resources/authd/utils.resource
+Resource        ./resources/authd/authd.resource
+
+Resource        ./resources/broker/broker.resource
+
+# Test Tags       robot:exit-on-failure
+
+Test Setup    Test Setup
+Test Teardown   Test Teardown
+
+
+*** Keywords ***
+Test Setup
+    Restore Snapshot    %{BROKER}-installed
+    Common Test Setup
+
+Test Teardown
+    Common Test Teardown
+
+
+*** Variables ***
+${username}    %{E2E_USER}
+${local_password}    qwer1234
+
+
+*** Test Cases ***
+Test that invalid broker issuer prevents remote logins
+    [Documentation]    This test verifies that when the broker is configured with an invalid issuer, remote users cannot log in, while local users can still access the system.
+
+    # Log in with local user
+    Log In
+
+    # Change broker configuration to an invalid issuer
+    Change Broker Configuration    issuer    invalid
+
+    # Try to log in with remote user when broker has invalid issuer
+    Open Terminal
+    Start Log In With Remote User Through CLI: QR Code    ${username}
+    Select Provider
+    Check That Remote User Has No Available Authentication Modes
diff --git a/e2e-tests/tests/config_owner_auto_update.robot b/e2e-tests/tests/config_owner_auto_update.robot
new file mode 100644
index 0000000000..b9431cf43b
--- /dev/null
+++ b/e2e-tests/tests/config_owner_auto_update.robot
@@ -0,0 +1,42 @@
+*** Settings ***
+Resource        ./resources/authd/utils.resource
+Resource        ./resources/authd/authd.resource
+
+Resource        ./resources/broker/broker.resource
+
+# Test Tags       robot:exit-on-failure
+
+Test Setup    Test Setup
+Test Teardown   Test Teardown
+
+
+*** Keywords ***
+Test Setup
+    Restore Snapshot    %{BROKER}-installed
+    Common Test Setup
+
+Test Teardown
+    Common Test Teardown
+
+
+*** Variables ***
+${username}    %{E2E_USER}
+${local_password}    qwer1234
+
+
+*** Test Cases ***
+Test that owner is auto-updated in broker configuration
+    [Documentation]    This test verifies that when a local user logs in, the broker configuration is automatically updated to set the owner to the logged-in user.
+
+    # Log in with local user
+    Log In
+
+    # Try to log in with remote user
+    Open Terminal
+    Log In With Remote User Through CLI: QR Code    ${username}    ${local_password}
+    Log Out From Terminal Session
+    Close Focused Window
+
+    # Check that owner was updated in broker configuration
+    Open Terminal In Sudo Mode
+    Check If Owner Was Registered    ${username}
diff --git a/e2e-tests/tests/deny_login_if_user_not_allowed.robot b/e2e-tests/tests/deny_login_if_user_not_allowed.robot
new file mode 100644
index 0000000000..a8528b0cb8
--- /dev/null
+++ b/e2e-tests/tests/deny_login_if_user_not_allowed.robot
@@ -0,0 +1,41 @@
+*** Settings ***
+Resource        ./resources/authd/utils.resource
+Resource        ./resources/authd/authd.resource
+
+Resource        ./resources/broker/broker.resource
+
+# Test Tags       robot:exit-on-failure
+
+Test Setup    Test Setup
+Test Teardown   Test Teardown
+
+
+*** Keywords ***
+Test Setup
+    Restore Snapshot    %{BROKER}-installed
+    Common Test Setup
+
+Test Teardown
+    Common Test Teardown
+
+
+*** Variables ***
+${username}    %{E2E_USER}
+
+
+*** Test Cases ***
+Test that changing owner prevents remote logins
+    [Documentation]    This test verifies that when the broker owner is changed to a different user, the original remote user cannot log in, while local users can still access the system.
+
+    # Log in with local user
+    Log In
+
+    # Change owner to another user
+    Change Broker Configuration    owner    different-user
+
+    # Log in with remote user with device authentication
+    Open Terminal
+    Start Log In With Remote User Through CLI: QR Code    ${username}
+    Select Provider
+    Continue Log In With Remote User: Authenticate In External Browser
+    Check That Remote User Is Not Allowed To Log In
diff --git a/e2e-tests/tests/deny_login_if_username_does_not_match.robot b/e2e-tests/tests/deny_login_if_username_does_not_match.robot
new file mode 100644
index 0000000000..30df81891c
--- /dev/null
+++ b/e2e-tests/tests/deny_login_if_username_does_not_match.robot
@@ -0,0 +1,40 @@
+*** Settings ***
+Resource        ./resources/authd/utils.resource
+Resource        ./resources/authd/authd.resource
+
+Resource        ./resources/broker/broker.resource
+
+# Test Tags       robot:exit-on-failure
+
+Test Setup    Test Setup
+Test Teardown   Test Teardown
+
+
+*** Keywords ***
+Test Setup
+    Restore Snapshot    %{BROKER}-installed
+    Common Test Setup
+
+Test Teardown
+    Common Test Teardown
+
+
+*** Variables ***
+${username}    %{E2E_USER}
+${local_password}    qwer1234
+${remote_group}    %{E2E_USER}-group
+
+
+*** Test Cases ***
+Test that login fails if usernames do not match
+    [Documentation]    This test verifies that when attempting to log in with a remote user whose username does not match the requested username, the login fails, while local users can still access the system.
+
+    # Log in with local user
+    Log In
+
+    # Fail to log in if usernames do not match
+    Open Terminal
+    Start Log In With Remote User Through CLI: QR Code   different_user
+    Select Provider
+    Continue Log In With Remote User: Authenticate In External Browser
+    Check That Authenticated User Does Not Match Requested User    different_user
diff --git a/e2e-tests/tests/login.robot b/e2e-tests/tests/login.robot
new file mode 100644
index 0000000000..7166021375
--- /dev/null
+++ b/e2e-tests/tests/login.robot
@@ -0,0 +1,43 @@
+*** Settings ***
+Resource        ./resources/authd/utils.resource
+Resource        ./resources/authd/authd.resource
+Resource        ./resources/broker/broker.resource
+
+# Test Tags       robot:exit-on-failure
+
+Test Setup    Test Setup
+Test Teardown   Test Teardown
+
+
+*** Keywords ***
+Test Setup
+    Restore Snapshot    %{BROKER}-installed
+    Common Test Setup
+
+Test Teardown
+    Common Test Teardown
+
+
+*** Variables ***
+${username}    %{E2E_USER}
+${local_password}    qwer1234
+
+
+*** Test Cases ***
+Test login with CLI
+    [Documentation]    Test login via CLI with device authentication and local password.
+
+    # Log in with local user
+    Log In
+
+    # Log in with remote user with device authentication
+    Open Terminal
+    Log In With Remote User Through CLI: QR Code    ${username}    ${local_password}
+    # Check remote user is properly added to the system
+    Check If User Was Added Properly    ${username}
+    Log Out From Terminal Session
+    Close Focused Window
+
+    # Log in with remote user with local password
+    Open Terminal In Sudo Mode
+    Log In With Remote User Through CLI: Local Password    ${username}    ${local_password}
diff --git a/e2e-tests/tests/login_gdm.robot b/e2e-tests/tests/login_gdm.robot
new file mode 100644
index 0000000000..471123ec13
--- /dev/null
+++ b/e2e-tests/tests/login_gdm.robot
@@ -0,0 +1,42 @@
+*** Settings ***
+Resource        ./resources/authd/utils.resource
+Resource        ./resources/authd/authd.resource
+
+Resource        ./resources/broker/broker.resource
+
+# Test Tags       robot:exit-on-failure
+
+Test Setup    Test Setup
+Test Teardown   Test Teardown
+
+
+*** Keywords ***
+Test Setup
+    Restore Snapshot    %{BROKER}-installed
+    Common Test Setup
+
+Test Teardown
+    Common Test Teardown
+
+
+*** Variables ***
+${username}    %{E2E_USER}
+${local_password}    qwer1234
+${remote_group}    %{E2E_USER}-group
+
+
+*** Test Cases ***
+Test login with GDM
+    [Documentation]    Test login via GDM with device authentication and local password.
+
+    # Log in with remote user with device authentication via GDM
+    Log In With Remote User Through GDM: QR Code    ${username}    ${local_password}
+
+    # Check remote user is properly added to the system
+    Open Terminal
+    Check If User Was Added Properly    ${username}
+    Close Focused Window
+    Log Out
+
+    # Log in with remote user with local password via GDM
+    Log In With Remote User Through GDM: Local Password    ${username}    ${local_password}
diff --git a/e2e-tests/tests/migration_authd.robot b/e2e-tests/tests/migration_authd.robot
new file mode 100644
index 0000000000..c7affa488e
--- /dev/null
+++ b/e2e-tests/tests/migration_authd.robot
@@ -0,0 +1,56 @@
+*** Settings ***
+Resource        ./resources/authd/utils.resource
+Resource        ./resources/authd/authd.resource
+
+Resource        ./resources/broker/broker.resource
+
+# Test Tags       robot:exit-on-failure
+
+Test Setup    Test Setup
+Test Teardown   Test Teardown
+
+
+*** Keywords ***
+Test Setup
+    Restore Snapshot    %{BROKER}-stable-installed
+    Common Test Setup
+
+Test Teardown
+    Common Test Teardown
+
+
+*** Variables ***
+${username}    %{E2E_USER}
+${local_password}    qwer1234
+${remote_group}    %{E2E_USER}-group
+
+
+*** Test Cases ***
+Test login after updating authd to edge version
+    [Documentation]    Test login via CLI with device authentication and local password after switching to the edge PPA for authd.
+
+    # Log in with local user
+    Log In
+
+    # Log in with remote user with device authentication
+    Open Terminal
+    Log In With Remote User Through CLI: QR Code    ${username}    ${local_password}
+    # Check remote user is properly added to the system
+    Check If User Was Added Properly    ${username}
+    Log Out From Terminal Session
+    Close Focused Window
+
+    # Log in with remote user with local password
+    Open Terminal In Sudo Mode
+    Log In With Remote User Through CLI: Local Password    ${username}    ${local_password}
+    Log Out From Terminal Session
+    Close Terminal In Sudo Mode
+
+    # Switch to the edge PPA for authd
+    Enable Edge Repository For Authd
+    Update And Upgrade Packages
+
+    # Log in with remote user with local password after upgrading
+    Open Terminal In Sudo Mode
+    Log In With Remote User Through CLI: Local Password    ${username}    ${local_password}
+    Check Home Directory    ${username}
diff --git a/e2e-tests/tests/migration_authd_broker.robot b/e2e-tests/tests/migration_authd_broker.robot
new file mode 100644
index 0000000000..b9f661df79
--- /dev/null
+++ b/e2e-tests/tests/migration_authd_broker.robot
@@ -0,0 +1,57 @@
+*** Settings ***
+Resource        ./resources/authd/utils.resource
+Resource        ./resources/authd/authd.resource
+
+Resource        ./resources/broker/broker.resource
+
+# Test Tags       robot:exit-on-failure
+
+Test Setup    Test Setup
+Test Teardown   Test Teardown
+
+
+*** Keywords ***
+Test Setup
+    Restore Snapshot    %{BROKER}-stable-installed
+    Common Test Setup
+
+Test Teardown
+    Common Test Teardown
+
+
+*** Variables ***
+${username}    %{E2E_USER}
+${local_password}    qwer1234
+${remote_group}    %{E2E_USER}-group
+
+
+*** Test Cases ***
+Test login after upgrading authd and broker to edge channel
+    [Documentation]    This test verifies that after upgrading both authd and the broker to the edge channel, remote users can still log in using device authentication and local password, and their accounts are properly set up on the system.
+
+    # Log in with local user
+    Log In
+
+    # Log in with remote user with device authentication
+    Open Terminal
+    Log In With Remote User Through CLI: QR Code    ${username}    ${local_password}
+    # Check remote user is properly added to the system
+    Check If User Was Added Properly    ${username}
+    Log Out From Terminal Session
+    Close Focused Window
+
+    # Log in with remote user with local password
+    Open Terminal In Sudo Mode
+    Log In With Remote User Through CLI: Local Password    ${username}    ${local_password}
+    Log Out From Terminal Session
+    Close Terminal In Sudo Mode
+
+    # Switch to the edge channel for the broker snap and the edge PPA for authd
+    Enable Edge Repository For Authd
+    Enable Edge Broker
+    Update And Upgrade Packages
+
+    # Log in with remote user with local password after upgrading
+    Open Terminal In Sudo Mode
+    Log In With Remote User Through CLI: Local Password    ${username}    ${local_password}
+    Check Home Directory    ${username}
diff --git a/e2e-tests/tests/migration_broker.robot b/e2e-tests/tests/migration_broker.robot
new file mode 100644
index 0000000000..91c55ef837
--- /dev/null
+++ b/e2e-tests/tests/migration_broker.robot
@@ -0,0 +1,56 @@
+*** Settings ***
+Resource        ./resources/authd/utils.resource
+Resource        ./resources/authd/authd.resource
+
+Resource        ./resources/broker/broker.resource
+
+# Test Tags       robot:exit-on-failure
+
+Test Setup    Test Setup
+Test Teardown   Test Teardown
+
+
+*** Keywords ***
+Test Setup
+    Restore Snapshot    %{BROKER}-stable-installed
+    Common Test Setup
+
+Test Teardown
+    Common Test Teardown
+
+
+*** Variables ***
+${username}    %{E2E_USER}
+${local_password}    qwer1234
+${remote_group}    %{E2E_USER}-group
+
+
+*** Test Cases ***
+Test login with broker on edge channel
+    [Documentation]    Test login with broker on edge channel with device authentication and local password, before and after upgrading authd and broker to edge channel.
+
+    # Log in with local user
+    Log In
+
+    # Log in with remote user with device authentication
+    Open Terminal
+    Log In With Remote User Through CLI: QR Code    ${username}    ${local_password}
+    # Check remote user is properly added to the system
+    Check If User Was Added Properly    ${username}
+    Log Out From Terminal Session
+    Close Focused Window
+
+    # Log in with remote user with local password
+    Open Terminal In Sudo Mode
+    Log In With Remote User Through CLI: Local Password    ${username}    ${local_password}
+    Log Out From Terminal Session
+    Close Terminal In Sudo Mode
+
+    # Switch to edge channel for the broker snap
+    Enable Edge Broker
+    Update And Upgrade Packages
+
+    # Log in with remote user with local password after upgrading
+    Open Terminal In Sudo Mode
+    Log In With Remote User Through CLI: Local Password    ${username}    ${local_password}
+    Check Home Directory    ${username}
diff --git a/e2e-tests/tests/mixed_case_username.robot b/e2e-tests/tests/mixed_case_username.robot
new file mode 100644
index 0000000000..132d21e194
--- /dev/null
+++ b/e2e-tests/tests/mixed_case_username.robot
@@ -0,0 +1,45 @@
+*** Settings ***
+Resource        ./resources/authd/utils.resource
+Resource        ./resources/authd/authd.resource
+
+Resource        ./resources/broker/broker.resource
+
+# Test Tags       robot:exit-on-failure
+
+Test Setup    Test Setup
+Test Teardown   Test Teardown
+
+
+*** Keywords ***
+Test Setup
+    Restore Snapshot    %{BROKER}-installed
+    Common Test Setup
+
+Test Teardown
+    Common Test Teardown
+
+
+*** Variables ***
+${username}    %{E2E_USER}
+${local_password}    qwer1234
+${remote_group}    %{E2E_USER}-group
+
+
+*** Test Cases ***
+Test login with mixed case username
+    [Documentation]    Test login with mixed case username via CLI with device authentication and local password.
+
+    # Log in with local user
+    Log In
+
+    # Log in with remote user using mixed case username with device authentication
+    Open Terminal
+    Log In With Remote User Through CLI: QR Code    ${username}    ${local_password}
+    # Check remote user is properly added to the system
+    Check If User Was Added Properly    ${username}
+    Log Out From Terminal Session
+    Close Focused Window
+
+    # Log in with remote user using mixed case username with local password
+    Open Terminal In Sudo Mode
+    Log In With Remote User Through CLI: Local Password    ${username}    ${local_password}
diff --git a/e2e-tests/tests/password_change.robot b/e2e-tests/tests/password_change.robot
new file mode 100644
index 0000000000..948998c570
--- /dev/null
+++ b/e2e-tests/tests/password_change.robot
@@ -0,0 +1,51 @@
+*** Settings ***
+Resource        ./resources/authd/utils.resource
+Resource        ./resources/authd/authd.resource
+
+Resource        ./resources/broker/broker.resource
+
+# Test Tags       robot:exit-on-failure
+
+Test Setup    Test Setup
+Test Teardown   Test Teardown
+
+
+*** Keywords ***
+Test Setup
+    Restore Snapshot    %{BROKER}-installed
+    Common Test Setup
+
+Test Teardown
+    Common Test Teardown
+
+
+*** Variables ***
+${username}    %{E2E_USER}
+${local_password}    qwer1234
+${new_password}    passwd1234
+${remote_group}    %{E2E_USER}-group
+
+
+*** Test Cases ***
+Test changing local password of remote user
+    [Documentation]    This test verifies that a remote user can change their local password and subsequently log in using the new password.
+
+    # Log in with local user
+    Log In
+
+    # Log in with remote user with device authentication
+    Open Terminal
+    Log In With Remote User Through CLI: QR Code    ${username}    ${local_password}
+    Log Out From Terminal Session
+    Close Focused Window
+
+    # Change local password of remote user
+    Open Terminal
+    Log In With Remote User Through CLI: Local Password    ${username}    ${local_password}
+    Change Password    ${local_password}    ${new_password}
+    Log Out From Terminal Session
+    Close Focused Window
+
+    # Log in with remote user with local password
+    Open Terminal In Sudo Mode
+    Log In With Remote User Through CLI: Local Password    ${username}    ${new_password}
diff --git a/e2e-tests/tests/regenerate_qrcode.robot b/e2e-tests/tests/regenerate_qrcode.robot
new file mode 100644
index 0000000000..668cb80b9a
--- /dev/null
+++ b/e2e-tests/tests/regenerate_qrcode.robot
@@ -0,0 +1,53 @@
+*** Settings ***
+Resource        ./resources/authd/utils.resource
+Resource        ./resources/authd/authd.resource
+
+Resource        ./resources/broker/broker.resource
+
+# Test Tags       robot:exit-on-failure
+
+Test Setup    Test Setup
+Test Teardown   Test Teardown
+
+
+*** Keywords ***
+Test Setup
+    Restore Snapshot    %{BROKER}-installed
+    Common Test Setup
+
+Test Teardown
+    Common Test Teardown
+
+
+*** Variables ***
+${username}    %{E2E_USER}
+${local_password}    qwer1234
+${remote_group}    %{E2E_USER}-group
+
+
+*** Test Cases ***
+Test login with CLI and QR code regeneration
+    [Documentation]    This test verifies that a remote user can log in using device authentication via CLI with QR code regeneration, and subsequently log in using a local password.
+
+    # Log in with local user
+    Log In
+
+    # Log in with remote user with device authentication
+    Open Terminal
+    Start Log In With Remote User Through CLI: QR Code   ${username}
+    Select Provider
+    # Let's try regenerating the QR code a couple of times
+    Regenerate QR Code
+    Regenerate QR Code
+    Regenerate QR Code
+    # Now we should be able to log in with the remote user using the latest QR code
+    Continue Log In With Remote User: Authenticate In External Browser
+    Continue Log In With Remote User Through CLI: Define Local Password   ${username}    ${local_password}
+    # Check remote user is properly added to the system
+    Check If User Was Added Properly    ${username}
+    Log Out From Terminal Session
+    Close Focused Window
+
+    # Log in with remote user with local password
+    Open Terminal In Sudo Mode
+    Log In With Remote User Through CLI: Local Password    ${username}    ${local_password}
diff --git a/e2e-tests/tests/resources b/e2e-tests/tests/resources
new file mode 120000
index 0000000000..35a4f7acc6
--- /dev/null
+++ b/e2e-tests/tests/resources
@@ -0,0 +1 @@
+../resources
\ No newline at end of file
diff --git a/e2e-tests/tests/ssh_deny_login_if_prefix_not_allowed.robot b/e2e-tests/tests/ssh_deny_login_if_prefix_not_allowed.robot
new file mode 100644
index 0000000000..b7cad0d18c
--- /dev/null
+++ b/e2e-tests/tests/ssh_deny_login_if_prefix_not_allowed.robot
@@ -0,0 +1,39 @@
+*** Settings ***
+Resource        ./resources/authd/utils.resource
+Resource        ./resources/authd/authd.resource
+
+Resource        ./resources/broker/broker.resource
+
+# Test Tags       robot:exit-on-failure
+
+Test Setup    Test Setup
+Test Teardown   Test Teardown
+
+
+*** Keywords ***
+Test Setup
+    Restore Snapshot    %{BROKER}-installed
+    Common Test Setup
+    Change Broker Configuration    ssh_allowed_suffixes_first_auth    %{E2E_USER}
+
+Test Teardown
+    Common Test Teardown
+
+*** Variables ***
+${local_password}    qwer1234
+${remote_group}    %{E2E_USER}-group
+
+
+*** Test Cases ***
+Test that login is denied if user is not allowed to log in via SSH
+    [Documentation]    Test that login via SSH is denied when the user is not allowed by the ssh_allowed_suffixes_first_auth setting.
+
+    # Log in with local user
+    Log In
+
+    # Try to log in with not allowed remote user with device authentication through SSH
+    ${domain} =    Fetch From Right    %{E2E_USER}    @
+    ${username} =    Set Variable    other-user@${domain}
+    Open Terminal
+    Start Log In With Remote User Through SSH: QR Code    ${username}
+    Check That Login Is Handled By PAM Unix
diff --git a/e2e-tests/tests/ssh_login.robot b/e2e-tests/tests/ssh_login.robot
new file mode 100644
index 0000000000..325e754c2e
--- /dev/null
+++ b/e2e-tests/tests/ssh_login.robot
@@ -0,0 +1,46 @@
+*** Settings ***
+Resource        ./resources/authd/utils.resource
+Resource        ./resources/authd/authd.resource
+
+Resource        ./resources/broker/broker.resource
+
+# Test Tags       robot:exit-on-failure
+
+Test Setup    Test Setup
+Test Teardown   Test Teardown
+
+
+*** Keywords ***
+Test Setup
+    Restore Snapshot    %{BROKER}-installed
+    Common Test Setup
+    Change Broker Configuration    ssh_allowed_suffixes_first_auth    %{E2E_USER}
+
+Test Teardown
+    Common Test Teardown
+
+
+*** Variables ***
+${username}    %{E2E_USER}
+${local_password}    qwer1234
+${remote_group}    %{E2E_USER}-group
+
+
+*** Test Cases ***
+Test login with SSH
+    [Documentation]    Test login via SSH with device authentication and local password.
+
+    # Log in with local user
+    Log In
+
+    # Log in with remote user with device authentication through SSH
+    Open Terminal
+    Log In With Remote User Through SSH: QR Code    ${username}    ${local_password}
+    # Check remote user is properly added to the system
+    Check If User Was Added Properly    ${username}
+    Log Out From SSH Session
+    Close Focused Window
+
+    # Log in with remote user with local password through SSH
+    Open Terminal
+    Log In With Remote User Through SSH: Local Password    ${username}    ${local_password}
diff --git a/e2e-tests/vm/cloud-init-template-noble.yaml b/e2e-tests/vm/cloud-init-template-noble.yaml
new file mode 100644
index 0000000000..0ece561a38
--- /dev/null
+++ b/e2e-tests/vm/cloud-init-template-noble.yaml
@@ -0,0 +1,146 @@
+#cloud-config
+password: ubuntu
+ssh_pwauth: true
+users:
+  - name: ubuntu
+    sudo: ['ALL=(ALL) NOPASSWD:ALL']
+    lock_passwd: false
+    gecos: Ubuntu
+    groups: sudo
+    homedir: /home/ubuntu
+    shell: /bin/bash
+    ssh_authorized_keys:
+      - ${SSH_PUBLIC_KEY}
+chpasswd:
+  expire: false
+  users:
+    - {name: ubuntu, password: ubuntu, type: text}
+
+package_update: true
+package_upgrade: true
+packages:
+  - fonts-ubuntu
+  - gdm3
+  - gnome-shell
+  - gnome-shell-extension-ubuntu-dock
+  - gnome-terminal
+  - gsettings-ubuntu-schemas
+  - openssh-server
+  - policykit-desktop-privileges
+  # Required to get the VM's IP address
+  - qemu-guest-agent
+  # Required to bind sshd to VSOCK socket and to forward the journal to the host
+  - socat
+  # Required for add-apt-repository
+  - software-properties-common
+  - spice-vdagent
+  - systemd-container
+  - systemd-timesyncd
+  - ubuntu-settings
+  - yaru-theme-gtk
+  - yaru-theme-icon
+
+write_files:
+  - path: /etc/dconf/profile/user
+    content: |
+      user-db:user
+      system-db:local
+
+  # Configure dconf
+  - path: /etc/dconf/db/local.d/00-e2e-tests-requirements
+    content: |
+      # Disable automatic suspend when plugged in
+      [org/gnome/settings-daemon/plugins/power]
+      sleep-inactive-ac-type='nothing'
+      sleep-inactive-ac-timeout=0
+
+      # Disable screen blanking
+      [org/gnome/desktop/session]
+      idle-delay=uint32 0
+
+      # Use larger text for better OCR results
+      [org/gnome/desktop/interface]
+      text-scaling-factor=1.25
+
+  # Configure dconf for GDM
+  - path: /usr/share/gdm/dconf/00-e2e-tests-requirements
+    content: |
+      # Use larger text for better OCR results
+      [org/gnome/desktop/interface]
+      text-scaling-factor=1.25
+
+  - path: /etc/ssh/sshd_config.d/authd.conf
+    content: |
+      UsePAM yes
+      Match User *@*
+          KbdInteractiveAuthentication yes
+
+  # Bind sshd to VSOCK socket
+  - path: /etc/systemd/system/sshd-vsock.service
+    content: |
+      [Unit]
+      Description=SSH over VSOCK
+      After=network.target
+
+      [Service]
+      ExecStart=/usr/bin/socat VSOCK-LISTEN:22,reuseaddr,fork TCP:127.0.0.1:22
+      Restart=always
+      RestartSec=5
+
+      [Install]
+      WantedBy=multi-user.target
+
+  # Export the journal to the host
+  - path: /etc/systemd/system/journal-export.service
+    content: |
+      [Unit]
+      Description=Exports the journal to the host
+      After=systemd-journald.service
+      After=network.target
+      Requires=network.target
+      # Disable rate limiting
+      StartLimitIntervalSec=0
+
+      [Service]
+      Type=simple
+      ExecStart=/bin/bash -o pipefail -c 'journalctl -b --lines=all -o export -f | socat - ${SOCAT_ADDRESS}'
+      OOMScoreAdjust=-1000
+      Restart=always
+      RestartSec=1
+
+      [Install]
+      WantedBy=basic.target
+
+  # Hide login banner to avoid cluttering the terminal with messages that make
+  # OCR results less predictable.
+  - path: /etc/skel/.hushlogin
+    content: ""
+
+runcmd:
+  # Disable apport
+  - sed -i 's/enabled=1/enabled=0/' /etc/default/apport
+  - systemctl mask --now apport.service
+  # Increase the default login timeout
+  - sed -i 's/^\(LOGIN_TIMEOUT\t\t\)[0-9]\+/\1360/' /etc/login.defs
+  # Update dconf database
+  - dconf update
+  # Disable systemd-networkd-wait-online to speed up boot time
+  - sudo systemctl mask systemd-networkd-wait-online.service
+  # Enable our systemd services
+  - sudo systemctl enable sshd-vsock.service
+  - sudo systemctl enable journal-export.service
+  # Avoid APT downloads and upgrades during the tests
+  - sudo systemctl mask apt-daily.service
+  - sudo systemctl mask apt-daily.timer
+  - sudo systemctl mask apt-daily-upgrade.service
+  - sudo systemctl mask apt-daily-upgrade.timer
+  - sudo systemctl mask unattended-upgrades.service
+  - sudo rm -f /etc/apt/apt.conf.d/20auto-upgrades /etc/apt/apt.conf.d/50unattended-upgrades
+
+final_message: "Provisioning finished after $UPTIME seconds"
+
+power_state:
+  mode: poweroff
+  message: Shutting down instance after initial setup
+  condition: True
+  timeout: 30
diff --git a/e2e-tests/vm/cloud-init-template-questing.yaml b/e2e-tests/vm/cloud-init-template-questing.yaml
new file mode 100644
index 0000000000..bc4e18dbe2
--- /dev/null
+++ b/e2e-tests/vm/cloud-init-template-questing.yaml
@@ -0,0 +1,124 @@
+#cloud-config
+password: ubuntu
+ssh_pwauth: true
+users:
+  - name: ubuntu
+    sudo: ['ALL=(ALL) NOPASSWD:ALL']
+    lock_passwd: false
+    gecos: Ubuntu
+    groups: sudo
+    homedir: /home/ubuntu
+    shell: /bin/bash
+    ssh_authorized_keys:
+      - ${SSH_PUBLIC_KEY}
+chpasswd:
+  expire: false
+  users:
+    - {name: ubuntu, password: ubuntu, type: text}
+
+package_update: true
+package_upgrade: true
+packages:
+  - fonts-ubuntu
+  - gdm3
+  - gnome-shell
+  - gnome-shell-extension-ubuntu-dock
+  - gsettings-ubuntu-schemas
+  - openssh-server
+  - policykit-desktop-privileges
+  # Required to get the VM's IP address
+  - qemu-guest-agent
+  # Default terminal on questing
+  - ptyxis
+  # Required to forward the journal to the host
+  - socat
+  - spice-vdagent
+  # Required for add-apt-repository
+  - software-properties-common
+  - systemd-container
+  - systemd-timesyncd
+  - ubuntu-settings
+  - yaru-theme-gtk
+  - yaru-theme-icon
+
+write_files:
+  - path: /etc/dconf/profile/user
+    content: |
+      user-db:user
+      system-db:local
+
+  # Configure dconf
+  - path: /etc/dconf/db/local.d/00-e2e-tests-requirements
+    content: |
+      # Disable automatic suspend when plugged in
+      [org/gnome/settings-daemon/plugins/power]
+      sleep-inactive-ac-type='nothing'
+      sleep-inactive-ac-timeout=0
+
+      # Disable screen blanking
+      [org/gnome/desktop/session]
+      idle-delay=uint32 0
+
+      # Use larger text for better OCR results
+      [org/gnome/desktop/interface]
+      text-scaling-factor=1.25
+
+  - path: /etc/ssh/sshd_config.d/authd.conf
+    content: |
+      UsePAM yes
+      Match User *@*
+          KbdInteractiveAuthentication yes
+
+  # Export the journal to the host
+  - path: /etc/systemd/system/journal-export.service
+    content: |
+      [Unit]
+      Description=Exports the journal to the host
+      After=systemd-journald.service
+      After=network.target
+      Requires=network.target
+      # Disable rate limiting
+      StartLimitIntervalSec=0
+
+      [Service]
+      Type=simple
+      ExecStart=/bin/bash -o pipefail -c 'journalctl -b --lines=all -o export -f | socat - ${SOCAT_ADDRESS}'
+      OOMScoreAdjust=-1000
+      Restart=always
+      RestartSec=1
+
+      [Install]
+      WantedBy=basic.target
+
+  # Hide login banner to avoid cluttering the terminal with messages that make
+  # OCR results less predictable.
+  - path: /etc/skel/.hushlogin
+    content: ""
+
+runcmd:
+  # Disable apport
+  - sed -i 's/enabled=1/enabled=0/' /etc/default/apport
+  - systemctl mask --now apport.service
+  # Increase the default login timeout
+  - sed -i 's/^\(LOGIN_TIMEOUT\t\t\)[0-9]\+/\1360/' /etc/login.defs
+  # Update dconf database
+  - dconf update
+  # Disable systemd-networkd-wait-online to speed up boot time
+  - sudo systemctl mask systemd-networkd-wait-online.service
+  # Enable our systemd services
+  - sudo systemctl enable journal-export.service
+  # Avoid APT downloads and upgrades during the tests
+  - sudo systemctl mask apt-daily.service
+  - sudo systemctl mask apt-daily.timer
+  - sudo systemctl mask apt-daily-upgrade.service
+  - sudo systemctl mask apt-daily-upgrade.timer
+  - sudo systemctl mask unattended-upgrades.service
+  - sudo rm -f /etc/apt/apt.conf.d/20auto-upgrades /etc/apt/apt.conf.d/50unattended-upgrades
+
+final_message: "Provisioning finished after $UPTIME seconds"
+
+power_state:
+  mode: poweroff
+  message: Shutting down instance after initial setup
+  condition: True
+  timeout: 30
diff --git a/e2e-tests/vm/config.sh.template b/e2e-tests/vm/config.sh.template
new file mode 100644
index 0000000000..fe260907c9
--- /dev/null
+++ b/e2e-tests/vm/config.sh.template
@@ -0,0 +1,16 @@
+# Provisioning configuration file for authd end-to-end tests
+# Copy this template to config.sh and customize the values for your environment.
+
+export SSH_PUBLIC_KEY_FILE="${HOME}/.ssh/id_rsa.pub"
+export VM_NAME_BASE=e2e-runner
+export RELEASE=questing
+
+# authd-msentraid broker configuration
+export AUTHD_MSENTRAID_ISSUER_ID=
+export AUTHD_MSENTRAID_CLIENT_ID=
+export AUTHD_MSENTRAID_USER=
+
+# authd-google broker configuration
+export AUTHD_GOOGLE_CLIENT_ID=
+export AUTHD_GOOGLE_CLIENT_SECRET=
+export AUTHD_GOOGLE_USER=
diff --git a/e2e-tests/vm/e2e-runner-template.xml b/e2e-tests/vm/e2e-runner-template.xml
new file mode 100644
index 0000000000..e97f4a7d48
--- /dev/null
+++ b/e2e-tests/vm/e2e-runner-template.xml
@@ -0,0 +1,70 @@
+<domain type='kvm'>
+    <name>${VM_NAME}</name>
+    <memory unit='GiB'>8</memory>
+    <currentMemory unit='GiB'>8</currentMemory>
+    <vcpu>8</vcpu>
+    <os>
+        <type arch='x86_64' machine='pc-q35-8.2'>hvm</type>
+        <boot dev='hd' />
+    </os>
+    <features>
+        <acpi />
+        <apic />
+        <vmport state='off' />
+    </features>
+    <cpu mode='host-model'/>
+    <clock offset='utc'/>
+    <on_poweroff>destroy</on_poweroff>
+    <on_reboot>restart</on_reboot>
+    <on_crash>destroy</on_crash>
+    <devices>
+        <emulator>/usr/bin/qemu-system-x86_64</emulator>
+        <disk type='file' device='disk'>
+            <driver name='qemu' type='qcow2' />
+	        <source file='${IMAGE_FILE}' />
+            <target dev='vda' bus='virtio' />
+            <address type='pci' domain='0x0000' bus='0x04' slot='0x00' function='0x0' />
+        </disk>
+        <controller type='sata' index='0'/>
+        <controller type='virtio-serial' index='0'/>
+        <interface type='network'>
+            <source network='default' />
+            <model type='virtio' />
+            <address type='pci' domain='0x0000' bus='0x01' slot='0x00' function='0x0' />
+        </interface>
+        <channel type='spicevmc'>
+            <target type='virtio' name='com.redhat.spice.0' />
+            <address type='virtio-serial' controller='0' bus='0' port='2' />
+        </channel>
+        <channel type="unix">
+            <target type="virtio" name="org.qemu.guest_agent.0"/>
+            <address type="virtio-serial" controller="0" bus="0" port="1"/>
+        </channel>
+        <input type='tablet' bus='usb'/>
+        <graphics type='spice' autoport='yes'>
+            <clipboard copypaste='yes'/>
+            <mouse mode='client'/>
+        </graphics>
+        <graphics type="vnc" autoport="yes" sharePolicy="force-shared">
+            <listen type="address" />
+            <clipboard copypaste='yes'/>
+            <mouse mode='client'/>
+        </graphics>
+        <video>
+            <model type='virtio' heads='1' primary='yes' vram='300000'/>
+            <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x0' />
+        </video>
+        <sound model='ich6'/>
+        <vsock model="virtio">
+            <cid auto="yes" />
+            <address type="pci" domain="0x0000" bus="0x07" slot="0x00" function="0x0" />
+        </vsock>
+        <serial type='pty'>
+            <target port='0'/>
+        </serial>
+        <console type='pty'>
+            <target type='serial' port='0'/>
+        </console>
+    </devices>
+    <seclabel type="none" model="apparmor"/>
+</domain>
diff --git a/e2e-tests/vm/helpers/virsh b/e2e-tests/vm/helpers/virsh
new file mode 100755
index 0000000000..be0c547990
--- /dev/null
+++ b/e2e-tests/vm/helpers/virsh
@@ -0,0 +1,4 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+exec sudo -E /usr/bin/virsh "$@"
diff --git a/e2e-tests/vm/install-provision-deps.sh b/e2e-tests/vm/install-provision-deps.sh
new file mode 100755
index 0000000000..39a5491969
--- /dev/null
+++ b/e2e-tests/vm/install-provision-deps.sh
@@ -0,0 +1,16 @@
+#!/bin/bash
+
+set -euo pipefail
+
+# Install packages required for provisioning the e2e-tests VM
+sudo apt-get update && sudo apt-get -y install \
+    bsdutils \
+    cloud-image-utils \
+    guestfish \
+    libvirt-clients-qemu \
+    libvirt-daemon-system \
+    qemu-kvm \
+    retry \
+    socat \
+    xvfb \
+    wget
diff --git a/e2e-tests/vm/lib/libprovision.sh b/e2e-tests/vm/lib/libprovision.sh
new file mode 100755
index 0000000000..9b9bdb5745
--- /dev/null
+++ b/e2e-tests/vm/lib/libprovision.sh
@@ -0,0 +1,85 @@
+#!/bin/bash
+
+function assert_env_vars() {
+    local missing=()
+    if [ "$#" -eq 0 ]; then
+        return
+    fi
+
+    for var in "$@"; do
+        # treat unset or empty as missing
+        if [ -z "${!var:-}" ]; then
+            missing+=("$var")
+        fi
+    done
+
+    if [ "${#missing[@]}" -ne 0 ]; then
+        printf 'Missing required env vars: %s\n' "${missing[*]}" >&2
+        printf 'Create a config file from the template at e2e-tests/vm/config.sh.template\n' >&2
+        printf 'or set the missing variables in the environment.\n' >&2
+        exit 1
+    fi
+}
+
+function has_snapshot() {
+    local snapshot_name="$1"
+    virsh snapshot-list "${VM_NAME}" | grep -q "${snapshot_name}"
+}
+
+function force_create_snapshot() {
+    local snapshot_name="$1"
+    if has_snapshot "${snapshot_name}"; then
+        time virsh snapshot-delete --domain "${VM_NAME}" --snapshotname "${snapshot_name}"
+    fi
+
+    if virsh domstate "${VM_NAME}" | grep -q '^running'; then
+        # If the VM is running, we have to use --memspec to create the snapshot
+        local memfile="${IMAGE%.qcow2}-${snapshot_name}.mem"
+        time virsh snapshot-create-as \
+          --domain "${VM_NAME}" \
+          --name "${snapshot_name}" \
+          --memspec "${memfile},snapshot=external"
+        return
+    fi
+
+    time virsh snapshot-create-as --domain "${VM_NAME}" --name "${snapshot_name}" --disk-only
+}
+
+function restore_snapshot_and_sync_time() {
+    local snapshot_name="$1"
+    virsh snapshot-revert "${VM_NAME}" --snapshotname "${snapshot_name}"
+    sync_time
+}
+
+function sync_time() {
+    local cmd="nm-online -q && \
+sudo systemctl restart systemd-timesyncd.service && \
+timedatectl show -p NTPSynchronized --value | grep -q yes"
+    retry --times 10 --delay 3 -- "$SSH" -- "$cmd"
+}
+
+function wait_for_system_running() {
+    # Wait until we can connect via SSH
+    retry --times 30 --delay 3 -- "$SSH" -- true
+    # shellcheck disable=SC2016
+    local cmd='output=$(systemctl is-system-running --wait) || [ $output = degraded ]'
+    retry --times 3 --delay 3 -- timeout 30 "$SSH" -- "$cmd"
+}
+
+function reboot_system() {
+    shutdown_system
+    boot_system
+}
+
+function shutdown_system() {
+    # For some reason, `virsh shutdown` sometimes doesn't cause the VM
+    # to shut down, so we retry it a few times.
+    local cmd="virsh shutdown \"${VM_NAME}\" && \
+virsh await \"${VM_NAME}\" --condition domain-inactive --timeout 5"
+    retry --times 3 --delay 1 -- sh -c "$cmd"
+}
+
+function boot_system() {
+    virsh start "${VM_NAME}"
+    wait_for_system_running
+}
diff --git a/e2e-tests/vm/provision-authd.sh b/e2e-tests/vm/provision-authd.sh
new file mode 100755
index 0000000000..856015293b
--- /dev/null
+++ b/e2e-tests/vm/provision-authd.sh
@@ -0,0 +1,282 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+SCRIPT_DIR="$(dirname "$(readlink -f "$0")")"
+LIB_DIR="${SCRIPT_DIR}/lib"
+SSH="${SCRIPT_DIR}/ssh.sh"
+DATA_DIR="${XDG_DATA_HOME:-$HOME/.local/share}/authd-e2e-tests"
+
+usage(){
+    cat << EOF
+Usage: $0 [--config-file <file>] [--authd-deb <deb>] [--broker-snap <snap>]
+
+Options:
+   --config-file <file>  Path to the configuration file (default: config.sh)
+   --force              Force installation of authd and brokers even if snapshots already exist.
+                        The existing snapshots will be deleted and recreated with the new installation.
+   --broker <broker>    The broker to install ("authd-google", "authd-msentraid", ...)
+   --authd-deb <deb>    Path to the authd deb file to install (default: install from the edge PPA)
+   --broker-snap <snap> Path to the broker snap file to install (default: install from the edge channel)
+  -h, --help             Show this help message and exit
+
+Provisions authd in the VM for end-to-end tests
+EOF
+}
+
+while [[ $# -gt 0 ]]; do
+    case "$1" in
+        --config-file)
+            CONFIG_FILE="$2"
+            shift 2
+            ;;
+        --force)
+            FORCE=true
+            shift
+            ;;
+        --broker)
+            BROKER="$2"
+            shift 2
+            ;;
+        --authd-deb)
+            AUTHD_DEB="$2"
+            shift 2
+            ;;
+        --broker-snap)
+            BROKER_SNAP="$2"
+            shift 2
+            ;;
+        -h|--help)
+            usage
+            exit 0
+            ;;
+        -*)
+            echo >&2 "Unknown option: $1"
+            exit 1
+            ;;
+        *)
+            echo >&2 "Unexpected positional argument: $1"
+            exit 1
+    esac
+done
+
+# Validate --authd-deb if provided
+if [ -n "${AUTHD_DEB:-}" ] && [ ! -f "${AUTHD_DEB}" ]; then
+    echo "authd deb file '${AUTHD_DEB}' not found." >&2
+    exit 1
+fi
+
+# Validate --broker-snap if provided
+if [ -n "${BROKER_SNAP:-}" ] && [ ! -f "${BROKER_SNAP}" ]; then
+    echo "Broker snap file '${BROKER_SNAP}' not found." >&2
+    exit 1
+fi
+
+# Validate config file if provided
+if [ -n "${CONFIG_FILE:-}" ] && [ ! -f "${CONFIG_FILE}" ]; then
+    echo "Configuration file '${CONFIG_FILE}' not found." >&2
+    exit 1
+fi
+
+# Set default config file if not provided
+if [ -z "${CONFIG_FILE:-}" ]; then
+    CONFIG_FILE="${SCRIPT_DIR}/config.sh"
+fi
+
+# Load the configuration file (if it exists)
+if [ -f "${CONFIG_FILE}" ]; then
+    # shellcheck source=config.sh disable=SC1091
+    source "${CONFIG_FILE}"
+fi
+
+# shellcheck source=lib/libprovision.sh
+source "${LIB_DIR}/libprovision.sh"
+
+assert_env_vars RELEASE VM_NAME_BASE
+
+ARTIFACTS_DIR="${ARTIFACTS_DIR:-${DATA_DIR}/${RELEASE}}"
+
+if [ -z "${VM_NAME:-}" ]; then
+    VM_NAME="${VM_NAME_BASE}-${RELEASE}"
+fi
+
+# Check if we have all required artifacts
+IMAGE="${ARTIFACTS_DIR}/${VM_NAME}.qcow2"
+if [ ! -f "${IMAGE}" ]; then
+    echo "Image not found: ${IMAGE}. Please run e2e-tests/vm/provision-ubuntu.sh first."
+    exit 1
+fi
+
+LIBVIRT_XML="${ARTIFACTS_DIR}/${VM_NAME_BASE}.xml"
+if [ ! -f "${LIBVIRT_XML}" ]; then
+    echo "Libvirt XML file not found: ${LIBVIRT_XML}. Please run e2e-tests/vm/provision-ubuntu.sh first."
+    exit 1
+fi
+
+INITIAL_SETUP_SNAPSHOT="initial-setup"
+AUTHD_STABLE_SNAPSHOT="authd-stable-installed"
+BROKER_STABLE_SNAPSHOT="${BROKER}-stable-installed"
+AUTHD_SNAPSHOT="authd-installed"
+BROKER_SNAPSHOT="${BROKER}-installed"
+
+function install_broker() {
+    local broker="$1"
+    local channel
+    local snap_file
+
+    case "$2" in
+        --channel)
+            channel="$3"
+            ;;
+        --snap)
+            snap_file="$3"
+            ;;
+    esac
+
+    local broker_config="${broker#authd-}.conf"
+
+    # Get the issuer ID from the environment variable corresponding to the broker.
+    # For example, for broker "authd-msentraid", we use "AUTHD_MSENTRAID_ISSUER_ID".
+    local broker_prefix="${broker^^}"
+    broker_prefix="${broker_prefix//-/_}"
+    local issuer_id_var="${broker_prefix}_ISSUER_ID"
+    local client_id_var="${broker_prefix}_CLIENT_ID"
+    local client_secret_var="${broker_prefix}_CLIENT_SECRET"
+
+    # Assert that required environment variables are set.
+    # The issuer ID is optional (authd-google has a default one).
+    # The client secret is also optional (authd-msentraid does not require it).
+    assert_env_vars "${client_id_var}"
+
+    local issuer_id="${!issuer_id_var:-}"
+    local client_id="${!client_id_var}"
+    local client_secret="${!client_secret_var:-}"
+
+    if [ -n "${snap_file:-}" ]; then
+        # Copy the local snap to the VM and install it
+        local remote_snap
+        remote_snap="/home/ubuntu/$(basename "${snap_file}")"
+        scp_to_vm "${snap_file}" "${remote_snap}"
+        $SSH sudo snap install --dangerous "${remote_snap}"
+    else
+        # Install the snap from the specified channel
+        $SSH sudo snap install "${broker}" --channel="${channel}"
+    fi
+
+    # Configure broker and restart services
+    $SSH bash -euo pipefail -s <<-EOF
+		sudo mkdir -p /etc/authd/brokers.d
+		sudo cp /snap/${broker}/current/conf/authd/${broker_config} /etc/authd/brokers.d/
+		sudo sed -i \
+			-e "s|<ISSUER_ID>|${issuer_id}|g" \
+			-e "s|<CLIENT_ID>|${client_id}|g" \
+			-e "s|<CLIENT_SECRET>|${client_secret}|g" \
+			/var/snap/${broker}/current/broker.conf
+		echo 'verbosity: 2' | sudo tee /var/snap/${broker}/current/${broker}.yaml
+		sudo systemctl restart authd.service
+		sudo snap restart "${broker}"
+	EOF
+
+    # Reboot VM and wait until it's back
+    virsh reboot "${VM_NAME}"
+    wait_for_system_running
+}
+
+function scp_to_vm() {
+    local local_path="$1"
+    local remote_path="$2"
+    local cid
+    cid=$(virsh dumpxml "${VM_NAME}" | \
+          xmllint --xpath 'string(//vsock/cid/@address)' -)
+    scp \
+      -o ProxyCommand="socat - VSOCK-CONNECT:${cid}:22" \
+      -o UserKnownHostsFile=/dev/null \
+      -o StrictHostKeyChecking=no \
+      -o LogLevel=ERROR \
+      "${local_path}" "ubuntu@localhost:${remote_path}"
+}
+
+# Print executed commands to ease debugging
+set -x
+
+# Define the VM
+if ! virsh dominfo "${VM_NAME}" &> /dev/null; then
+    virsh define "${LIBVIRT_XML}"
+fi
+
+if has_snapshot "$INITIAL_SETUP_SNAPSHOT"; then
+    PRE_AUTHD_SNAPSHOT="${INITIAL_SETUP_SNAPSHOT}"
+else
+    PRE_AUTHD_SNAPSHOT="pre-authd-setup"
+fi
+
+if has_snapshot "$PRE_AUTHD_SNAPSHOT"; then
+    restore_snapshot_and_sync_time "$PRE_AUTHD_SNAPSHOT"
+else
+    # Ensure the VM is running to perform initial setup
+    boot_system
+    # Create a pre-authd setup snapshot
+    force_create_snapshot "$PRE_AUTHD_SNAPSHOT"
+fi
+
+if [ -z "${FORCE:-}" ] && has_snapshot "${AUTHD_STABLE_SNAPSHOT}"; then
+    restore_snapshot_and_sync_time "${AUTHD_STABLE_SNAPSHOT}"
+else
+    # Install authd stable and create a snapshot
+    PPA="ubuntu-enterprise-desktop/authd"
+    $SSH "sudo add-apt-repository -y ppa:${PPA}"
+    $SSH "sudo apt-get install -y authd"
+    force_create_snapshot "${AUTHD_STABLE_SNAPSHOT}"
+fi
+
+if [ -z "${FORCE:-}" ] && has_snapshot "${BROKER_STABLE_SNAPSHOT}"; then
+    restore_snapshot_and_sync_time "${BROKER_STABLE_SNAPSHOT}"
+else
+    install_broker "${BROKER}" --channel "stable"
+    # Snapshot this broker installation
+    force_create_snapshot "${BROKER_STABLE_SNAPSHOT}"
+fi
+
+# Remove the authd-stable-installed snapshot which is no longer needed
+# virsh snapshot-delete --domain "${VM_NAME}" --snapshotname "authd-stable-installed"
+
+# Revert to the pre-authd setup snapshot before installing the version to test
+restore_snapshot_and_sync_time "$PRE_AUTHD_SNAPSHOT"
+
+# Add the edge PPA. We also need that when installing authd from a deb file,
+# because it depends on gnome-shell from the edge PPA.
+PPA="ubuntu-enterprise-desktop/authd-edge"
+$SSH "sudo add-apt-repository -y ppa:${PPA}"
+
+# Configure authd to be verbose. We do this before installing authd to avoid
+# having to restart the service after installation (just a simple optimization).
+$SSH bash -euo pipefail -s <<-EOF
+    sudo mkdir -p /etc/systemd/system/authd.service.d
+    cat <<-UNIT | sudo tee /etc/systemd/system/authd.service.d/override.conf
+		[Service]
+		ExecStart=
+		ExecStart=/usr/libexec/authd -vv
+	UNIT
+EOF
+
+# Install the version of authd to test
+if [ -n "${AUTHD_DEB:-}" ]; then
+    scp_to_vm "${AUTHD_DEB}" "/home/ubuntu/$(basename "${AUTHD_DEB}")"
+    $SSH sudo apt-get install -y "/home/ubuntu/$(basename "${AUTHD_DEB}")"
+else
+    $SSH "sudo apt-get install -y authd"
+fi
+
+force_create_snapshot "${AUTHD_SNAPSHOT}"
+
+# Install the brokers for the version of authd to test.
+if [ -n "${BROKER_SNAP:-}" ]; then
+    install_broker "${BROKER}" --snap "${BROKER_SNAP}"
+else
+    install_broker "${BROKER}" --channel "edge"
+fi
+
+force_create_snapshot "${BROKER_SNAPSHOT}"
+
+# Remove the authd-installed snapshot which is no longer needed
+virsh snapshot-delete --domain "${VM_NAME}" --snapshotname "${AUTHD_SNAPSHOT}"
diff --git a/e2e-tests/vm/provision-ubuntu.sh b/e2e-tests/vm/provision-ubuntu.sh
new file mode 100755
index 0000000000..dddf32d723
--- /dev/null
+++ b/e2e-tests/vm/provision-ubuntu.sh
@@ -0,0 +1,236 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+SCRIPT_DIR="$(dirname "$(readlink -f "$0")")"
+LIB_DIR="${SCRIPT_DIR}/lib"
+SSH="${SCRIPT_DIR}/ssh.sh"
+LIBVIRT_XML_TEMPLATE="${SCRIPT_DIR}/e2e-runner-template.xml"
+CACHE_DIR="${XDG_CACHE_HOME:-$HOME/.cache}/authd-e2e-tests"
+DATA_DIR="${XDG_DATA_HOME:-$HOME/.local/share}/authd-e2e-tests"
+
+usage(){
+    cat << EOF
+Usage: $0 [--config-file <file>] [--force]
+
+Options:
+   --config-file <file>  Path to the configuration file (default: config.sh)
+   --force               Force provisioning: remove existing VM and artifacts and create a fresh VM
+   --no-snapshot         Do not create a snapshot after initial setup
+  -h, --help             Show this help message and exit
+
+Provisions the VM for end-to-end tests
+EOF
+}
+
+while [[ $# -gt 0 ]]; do
+    case "$1" in
+        --config-file)
+            CONFIG_FILE="$2"
+            shift 2
+            ;;
+        --force)
+            FORCE=true
+            shift
+            ;;
+        --no-snapshot)
+            NO_SNAPSHOT=true
+            shift
+            ;;
+        -h|--help)
+            usage
+            exit 0
+            ;;
+        -*)
+            echo >&2 "Unknown option: $1"
+            exit 1
+            ;;
+        *)
+            echo >&2 "Unexpected positional argument: $1"
+            exit 1
+    esac
+done
+
+# Validate config file if provided
+if [ -n "${CONFIG_FILE:-}" ] && [ ! -f "${CONFIG_FILE}" ]; then
+    echo "Configuration file '${CONFIG_FILE}' not found." >&2
+    exit 1
+fi
+
+# Set default config file if not provided
+if [ -z "${CONFIG_FILE:-}" ]; then
+    CONFIG_FILE="${SCRIPT_DIR}/config.sh"
+fi
+
+# Load the configuration file (if it exists)
+if [ -f "${CONFIG_FILE}" ]; then
+    # shellcheck source=config.sh disable=SC1091
+    source "${CONFIG_FILE}"
+fi
+
+# shellcheck source=lib/libprovision.sh
+source "${LIB_DIR}/libprovision.sh"
+
+assert_env_vars RELEASE VM_NAME_BASE SSH_PUBLIC_KEY_FILE
+
+# Validate SSH public key file
+if [ ! -f "${SSH_PUBLIC_KEY_FILE}" ]; then
+    echo "SSH public key file not found: ${SSH_PUBLIC_KEY_FILE}"
+    exit 1
+fi
+
+if [[ "${SSH_PUBLIC_KEY_FILE}" != *.pub ]]; then
+    echo "SSH public key file must have a .pub extension"
+    exit 1
+fi
+
+# Cache sudo password early
+sudo -v
+
+# Installing all the packages can take some time, so we set the timeout to 15 minutes
+CLOUT_INIT_TIMEOUT=900
+
+ARTIFACTS_DIR="${ARTIFACTS_DIR:-${DATA_DIR}/${RELEASE}}"
+CLOUD_INIT_TEMPLATE="${SCRIPT_DIR}/cloud-init-template-${RELEASE}.yaml"
+
+if [ -z "${VM_NAME:-}" ]; then
+    VM_NAME="${VM_NAME_BASE}-${RELEASE}"
+fi
+
+function cloud_init_finished() {
+    local image=$1
+    sudo guestfish --ro -a "${image}" -i stat /var/lib/cloud/instance/boot-finished &>/dev/null
+}
+
+function cloud_init_successful() {
+    local image=$1
+    if ! sudo guestfish --ro -a "${image}" -i cat /var/lib/cloud/data/result.json | grep -q '"errors": \[\]'; then
+        # Print the result.json to show the errors
+        sudo guestfish --ro -a "${image}" -i cat /var/lib/cloud/data/result.json
+        return 1
+    fi
+}
+
+# Print executed commands to ease debugging
+set -x
+
+# Download the image
+IMAGE_URL="https://cloud-images.ubuntu.com/${RELEASE}/current/${RELEASE}-server-cloudimg-amd64.img"
+SOURCE_IMAGE="${CACHE_DIR}/$(basename "${IMAGE_URL}")"
+if [ ! -f "${SOURCE_IMAGE}" ]; then
+    mkdir -p "${CACHE_DIR}"
+    wget "${CI:+--progress=dot:giga}" -O "${SOURCE_IMAGE}" "${IMAGE_URL}"
+else
+    echo "Source image already exists: ${SOURCE_IMAGE}"
+fi
+
+if [ "${FORCE:-}" = true ]; then
+    echo "Force provisioning enabled. Removing existing VM and artifacts."
+
+    # Destroy and undefine the VM if it exists
+    if virsh dominfo "${VM_NAME}" &> /dev/null; then
+        if virsh domstate "${VM_NAME}" | grep -q '^running'; then
+            virsh destroy "${VM_NAME}"
+        fi
+        virsh undefine "${VM_NAME}" --snapshots-metadata
+    fi
+
+    # Remove artifacts of this VM
+    rm -rf "${ARTIFACTS_DIR}"
+fi
+
+# Copy and resize the image
+IMAGE="${ARTIFACTS_DIR}/${VM_NAME}.qcow2"
+if [ ! -f "${IMAGE}" ]; then
+    mkdir -p "${ARTIFACTS_DIR}"
+    cp "${SOURCE_IMAGE}" "${IMAGE}"
+
+    qemu-img resize "${IMAGE}" 10G
+else
+    echo "Image already exists: ${IMAGE}"
+fi
+
+# Create a cloud-init ISO
+CLOUD_INIT_ISO="${ARTIFACTS_DIR}/seed.iso"
+if [ ! -f "${CLOUD_INIT_ISO}" ]; then
+    CLOUD_INIT_DIR="$(mktemp -d)"
+    trap 'rm -rf ${CLOUD_INIT_DIR}' EXIT
+
+    systemd_ver=$(systemctl --version | awk 'NR==1 {print $2}')
+    if dpkg --compare-versions "$systemd_ver" "ge" "256"; then
+        SOCAT_ADDRESS="VSOCK-CONNECT:2:55000"
+    else
+        SOCAT_ADDRESS="TCP-LISTEN:55000,bind=0.0.0.0,reuseaddr"
+    fi
+
+    SSH_PUBLIC_KEY=$(cat "${SSH_PUBLIC_KEY_FILE}") \
+      SOCAT_ADDRESS="${SOCAT_ADDRESS}" \
+      envsubst < "${CLOUD_INIT_TEMPLATE}" > "${CLOUD_INIT_DIR}/user-data"
+
+    cloud-localds "${CLOUD_INIT_ISO}" "${CLOUD_INIT_DIR}/user-data"
+else
+    echo "Cloud-init ISO already exists: ${CLOUD_INIT_ISO}"
+fi
+
+# Create the libvirt XML
+LIBVIRT_XML="${ARTIFACTS_DIR}/${VM_NAME_BASE}.xml"
+if [ ! -f "${LIBVIRT_XML}" ]; then
+    IMAGE_FILE=${IMAGE} \
+    VM_NAME=${VM_NAME} \
+      envsubst < "${LIBVIRT_XML_TEMPLATE}" > "${LIBVIRT_XML}"
+else
+    echo "Libvirt XML file already exists: ${LIBVIRT_XML}"
+fi
+
+# Define the VM
+if ! virsh dominfo "${VM_NAME}" &> /dev/null; then
+    virsh define "${LIBVIRT_XML}"
+else
+    echo "VM already defined: ${VM_NAME}"
+fi
+
+# Attach the cloud-init ISO
+if ! virsh domblklist "${VM_NAME}" | grep -q "seed.iso"; then
+    virsh attach-disk "${VM_NAME}" "${CLOUD_INIT_ISO}" vdb --targetbus virtio --type disk --mode readonly --config
+else
+    echo "Cloud-init ISO already attached to VM: ${VM_NAME}"
+fi
+
+# Ensure the VM is shut off before proceeding
+if virsh domstate "${VM_NAME}" | grep -q '^running'; then
+    virsh destroy "${VM_NAME}"
+fi
+
+# Start the VM and wait for it to finish the initial setup
+if ! cloud_init_finished "${IMAGE}"; then
+    # Start the VM to let cloud-init do its work
+    virsh start "${VM_NAME}"
+
+    # Print the console output and wait until cloud-init has finished and the VM has shut down
+    echo "Waiting for VM to finish cloud-init setup..."
+    script -q -e -f /dev/null -c "virsh console $VM_NAME" &
+    VM_CONSOLE_PID=$!
+
+    timeout "${CLOUT_INIT_TIMEOUT}" retry --delay 1 -- \
+      sh -c "sudo virsh domstate \"${VM_NAME}\" | grep -q '^shut off'"
+
+    kill "${VM_CONSOLE_PID}" || true
+
+    # Check if the cloud-init finished successfully
+    if ! cloud_init_successful "${IMAGE}"; then
+        echo "cloud-init did not finish successfully." >&2
+        exit 1
+    fi
+
+    # Detach the cloud-init ISO
+    virsh detach-disk "${VM_NAME}" vdb --config
+
+    if [ -z "${NO_SNAPSHOT:-}" ]; then
+        boot_system
+        # Create a snapshot of the initial setup
+        force_create_snapshot "initial-setup"
+    fi
+else
+    echo "Cloud-init has already finished."
+    restore_snapshot_and_sync_time "initial-setup"
+fi
diff --git a/e2e-tests/vm/provision.sh b/e2e-tests/vm/provision.sh
new file mode 100755
index 0000000000..48f473ceb2
--- /dev/null
+++ b/e2e-tests/vm/provision.sh
@@ -0,0 +1,53 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+SCRIPT_DIR="$(dirname "$(readlink -f "$0")")"
+CONFIG_FILE="${SCRIPT_DIR}/config.sh"
+
+usage(){
+    cat << EOF
+Usage: $0 [--config-file <config file>] [--force]
+
+Options:
+  --config-file <config file>  Path to the configuration file (default: config.sh)
+  --force                      Force provisioning: remove existing VM and artifacts and create a fresh VM
+  -h, --help                   Show this help message and exit
+
+Provisions the VM for end-to-end tests
+EOF
+}
+
+# Parse command line arguments
+while [[ $# -gt 0 ]]; do
+    case "$1" in
+        --config-file)
+            CONFIG_FILE="$2"
+            shift 2
+            ;;
+        --force)
+            FORCE="true"
+            shift
+            ;;
+        -h|--help)
+            usage
+            exit 0
+            ;;
+        -*)
+            echo >&2 "Unknown option: $1"
+            exit 1
+            ;;
+        *)
+            echo >&2 "Unexpected positional argument: $1"
+            exit 1
+    esac
+done
+
+# Print executed commands to ease debugging
+set -x
+
+# Provision the VM with Ubuntu
+"${SCRIPT_DIR}/provision-ubuntu.sh" --config-file "${CONFIG_FILE}" ${FORCE:+--force}
+
+# Provision authd in the VM
+"${SCRIPT_DIR}/provision-authd.sh" --config-file "${CONFIG_FILE}"
diff --git a/e2e-tests/vm/ssh.sh b/e2e-tests/vm/ssh.sh
new file mode 100755
index 0000000000..679ed0d285
--- /dev/null
+++ b/e2e-tests/vm/ssh.sh
@@ -0,0 +1,54 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+usage(){
+    cat << EOF
+
+    Usage: $0 --release <release> [ssh options]
+
+    SSH into the e2e-test VM for the specified Ubuntu release.
+
+    Example:
+      $0 --release questing
+EOF
+}
+
+while [[ $# -gt 0 ]]; do
+    case $1 in
+        -h|--help)
+            print_usage
+            exit 0
+            ;;
+        --release|-r)
+            RELEASE="$2"
+            shift 2
+            ;;
+        --)
+            shift
+            break
+            ;;
+        *)
+            # Pass other options to ssh
+            break
+    esac
+done
+
+
+if [ -z "${RELEASE:-}" ]; then
+    echo "Error: Missing required argument <release>"
+    usage
+    exit 1
+fi
+
+VM_NAME="e2e-runner-${RELEASE}"
+
+CID=$(virsh dumpxml "${VM_NAME}" | \
+      xmllint --xpath 'string(//vsock/cid/@address)' -)
+
+exec ssh \
+  -o ProxyCommand="socat - VSOCK-CONNECT:${CID}:22" \
+  -o UserKnownHostsFile=/dev/null \
+  -o StrictHostKeyChecking=no \
+  -o LogLevel=ERROR \
+  ubuntu@localhost "$@"
diff --git a/examplebroker/broker.go b/examplebroker/broker.go
index b78a1157de..e710db66f7 100644
--- a/examplebroker/broker.go
+++ b/examplebroker/broker.go
@@ -26,11 +26,11 @@ import (
 	"sync"
 	"time"
 
+	"github.com/canonical/authd/internal/brokers/auth"
+	"github.com/canonical/authd/internal/brokers/layouts"
+	"github.com/canonical/authd/internal/brokers/layouts/entries"
+	"github.com/canonical/authd/log"
 	"github.com/google/uuid"
-	"github.com/ubuntu/authd/internal/brokers/auth"
-	"github.com/ubuntu/authd/internal/brokers/layouts"
-	"github.com/ubuntu/authd/internal/brokers/layouts/entries"
-	"github.com/ubuntu/authd/log"
 	"golang.org/x/exp/slices"
 )
 
@@ -186,12 +186,12 @@ var (
 
 	emailMode = func(userName string) authMode {
 		return authMode{
-			id:             fmt.Sprintf("entry_or_wait_for_%s_gmail.com", userName),
-			selectionLabel: fmt.Sprintf("Send URL to %s@gmail.com", userName),
-			email:          fmt.Sprintf("%s@gmail.com", userName),
+			id:             fmt.Sprintf("entry_or_wait_for_%s", userName),
+			selectionLabel: fmt.Sprintf("Send URL to %s", userName),
+			email:          userName,
 			ui: map[string]string{
 				layouts.Type: layouts.Form,
-				layouts.Label: fmt.Sprintf("Click on the link received at %s@gmail.com or enter the code:",
+				layouts.Label: fmt.Sprintf("Click on the link received at %s or enter the code:",
 					userName),
 				layouts.Entry: entries.Chars,
 				layouts.Wait:  layouts.True,
@@ -275,19 +275,19 @@ func (b *Broker) NewSession(ctx context.Context, username, lang, mode string) (s
 	}
 
 	switch username {
-	case "user-mfa":
+	case "user-mfa@example.com":
 		info.neededAuthSteps = 3
-	case "user-needs-reset":
+	case "user-needs-reset@example.com":
 		fallthrough
-	case "user-needs-reset2":
+	case "user-needs-reset2@example.com":
 		info.neededAuthSteps = 2
 		info.pwdChange = mustReset
-	case "user-can-reset":
+	case "user-can-reset@example.com":
 		fallthrough
-	case "user-can-reset2":
+	case "user-can-reset2@example.com":
 		info.neededAuthSteps = 2
 		info.pwdChange = canReset
-	case "user-mfa-with-reset":
+	case "user-mfa-with-reset@example.com":
 		info.neededAuthSteps = 3
 		info.pwdChange = canReset
 	case UserIntegrationUnexistent:
@@ -627,14 +627,22 @@ func (b *Broker) IsAuthenticated(ctx context.Context, sessionID, authenticationD
 
 	// Cleans up the IsAuthenticated context when the call is done.
 	defer func() {
+		cancel()
 		b.isAuthenticatedCallsMu.Lock()
 		delete(b.isAuthenticatedCalls, sessionID)
 		b.isAuthenticatedCallsMu.Unlock()
 	}()
 
 	access, data = b.handleIsAuthenticated(ctx, sessionInfo, authData)
+
+	if ctx.Err() != nil {
+		log.Debugf(ctx, "IsAuthenticated for session %s was cancelled: %v", sessionID, ctx.Err())
+		return auth.Cancelled, `{"message": "authentication request cancelled"}`, ctx.Err()
+	}
+
 	log.Debugf(context.TODO(), "Authentication result on session %s (%s) for user %q: %q - %#v",
 		sessionInfo.sessionMode, sessionID, sessionInfo.username, access, data)
+
 	if access == auth.Granted && sessionInfo.currentAuthStep < sessionInfo.neededAuthSteps {
 		data = ""
 		if sessionInfo.pwdChange != noReset && sessionInfo.sessionMode == auth.SessionModeLogin {
@@ -853,6 +861,7 @@ func (b *Broker) cancelIsAuthenticatedUnlocked(_ context.Context, sessionID stri
 }
 
 // UserPreCheck checks if the user is known to the broker.
+// It returns the user info in JSON format if the user is valid, or an empty string if the user is not allowed.
 func (b *Broker) UserPreCheck(ctx context.Context, username string) (string, error) {
 	if strings.HasPrefix(username, "user-") && strings.Contains(username, "integration") &&
 		strings.Contains(username, fmt.Sprintf("-%s-", UserIntegrationPreCheckValue)) {
@@ -862,7 +871,8 @@ func (b *Broker) UserPreCheck(ctx context.Context, username string) (string, err
 	exampleUsersMu.Lock()
 	defer exampleUsersMu.Unlock()
 	if _, exists := exampleUsers[username]; !exists {
-		return "", fmt.Errorf("user %q does not exist", username)
+		// The username does not match any of the allowed suffixes.
+		return "", nil
 	}
 	return userInfoFromName(username), nil
 }
@@ -965,10 +975,10 @@ func userInfoFromName(name string) string {
 	}
 
 	switch name {
-	case "user-local-groups":
+	case "user-local-groups@example.com":
 		user.Groups = append(user.Groups, groupJSONInfo{Name: "localgroup", UGID: ""})
 
-	case "user-sudo":
+	case "user-sudo@example.com":
 		user.Groups = append(user.Groups, groupJSONInfo{Name: "sudo", UGID: ""}, groupJSONInfo{Name: "admin", UGID: ""})
 	}
 
diff --git a/examplebroker/com.ubuntu.auth.ExampleBroker.xml b/examplebroker/com.ubuntu.auth.ExampleBroker.xml
index f4932b3fc2..86b1d78ed7 100644
--- a/examplebroker/com.ubuntu.auth.ExampleBroker.xml
+++ b/examplebroker/com.ubuntu.auth.ExampleBroker.xml
@@ -36,6 +36,7 @@
     </method>
     <method name="UserPreCheck">
         <arg type="s" direction="in" name="username"/>
+        <arg type="s" direction="out" name="userInfo"/>
   </method>
     <method name="CancelIsAuthenticated">
         <arg type="s" direction="in" name="sessionID"/>
diff --git a/examplebroker/dbus.go b/examplebroker/dbus.go
index 76df614acc..e9517d6cb9 100644
--- a/examplebroker/dbus.go
+++ b/examplebroker/dbus.go
@@ -7,9 +7,9 @@ import (
 	"os"
 	"path/filepath"
 
+	"github.com/canonical/authd/internal/decorate"
 	"github.com/godbus/dbus/v5"
 	"github.com/godbus/dbus/v5/introspect"
-	"github.com/ubuntu/decorate"
 )
 
 const (
diff --git a/examplebroker/users.go b/examplebroker/users.go
index 8917bfcce3..24d2e815d4 100644
--- a/examplebroker/users.go
+++ b/examplebroker/users.go
@@ -9,25 +9,25 @@ type userInfoBroker struct {
 var (
 	exampleUsersMu = sync.RWMutex{}
 	exampleUsers   = map[string]userInfoBroker{
-		"user1":               {Password: "goodpass"},
-		"user2":               {Password: "goodpass"},
-		"user3":               {Password: "goodpass"},
-		"user-ssh":            {Password: "goodpass"},
-		"user-ssh2":           {Password: "goodpass"},
-		"user-mfa":            {Password: "goodpass"},
-		"user-mfa-with-reset": {Password: "goodpass"},
-		"user-needs-reset":    {Password: "goodpass"},
-		"user-needs-reset2":   {Password: "goodpass"},
-		"user-can-reset":      {Password: "goodpass"},
-		"user-can-reset2":     {Password: "goodpass"},
-		"user-local-groups":   {Password: "goodpass"},
-		"user-pre-check":      {Password: "goodpass"},
-		"user-sudo":           {Password: "goodpass"},
+		"user1@example.com":               {Password: "goodpass"},
+		"user2@example.com":               {Password: "goodpass"},
+		"user3@example.com":               {Password: "goodpass"},
+		"user-ssh@example.com":            {Password: "goodpass"},
+		"user-ssh2@example.com":           {Password: "goodpass"},
+		"user-mfa@example.com":            {Password: "goodpass"},
+		"user-mfa-with-reset@example.com": {Password: "goodpass"},
+		"user-needs-reset@example.com":    {Password: "goodpass"},
+		"user-needs-reset2@example.com":   {Password: "goodpass"},
+		"user-can-reset@example.com":      {Password: "goodpass"},
+		"user-can-reset2@example.com":     {Password: "goodpass"},
+		"user-local-groups@example.com":   {Password: "goodpass"},
+		"user-pre-check@example.com":      {Password: "goodpass"},
+		"user-sudo@example.com":           {Password: "goodpass"},
 	}
 )
 
 const (
-	// UserIntegrationPrefix is the prefix for an user for integration tests.
+	// UserIntegrationPrefix is the prefix for a user for integration tests.
 	UserIntegrationPrefix = "user-integration-"
 	// UserIntegrationMfaPrefix is the prefix for an mfa user for integration tests.
 	UserIntegrationMfaPrefix = "user-mfa-integration-"
@@ -48,8 +48,8 @@ const (
 	// UserIntegrationPreCheckPrefix is the prefix for a pre-check user for integration tests.
 	UserIntegrationPreCheckPrefix = UserIntegrationPrefix + UserIntegrationPreCheckValue + "-"
 	// UserIntegrationUnexistent is an unexistent user leading to a non-existent user error.
-	UserIntegrationUnexistent = "user-unexistent"
-	// UserIntegrationAuthModesPrefix is the prefix for an user listing for supported auth modes.
+	UserIntegrationUnexistent = "user-unexistent@example.com"
+	// UserIntegrationAuthModesPrefix is the prefix for a user listing for supported auth modes.
 	// The modes can be exposed as list, in the form: `user-auth-modes-id1,id2,id3-integration-whatever`.
 	UserIntegrationAuthModesPrefix = "user-auth-modes-"
 )
diff --git a/go.mod b/go.mod
index 94b049fd9e..74bf99e362 100644
--- a/go.mod
+++ b/go.mod
@@ -1,34 +1,34 @@
-module github.com/ubuntu/authd
+module github.com/canonical/authd
 
-go 1.23.0
+go 1.25.0
 
-toolchain go1.23.10
+toolchain go1.25.8
 
 require (
 	github.com/charmbracelet/bubbles v0.20.0
 	github.com/charmbracelet/bubbletea v1.3.4
 	github.com/charmbracelet/lipgloss v1.1.0
-	github.com/charmbracelet/x/term v0.2.1
-	github.com/coreos/go-systemd/v22 v22.5.0
-	github.com/godbus/dbus/v5 v5.1.0
+	github.com/charmbracelet/x/term v0.2.2
+	github.com/coreos/go-systemd/v22 v22.7.0
+	github.com/godbus/dbus/v5 v5.2.2
 	github.com/google/uuid v1.6.0
-	github.com/mattn/go-sqlite3 v1.14.28
+	github.com/mattn/go-sqlite3 v1.14.34
 	github.com/msteinert/pam/v2 v2.0.0
 	github.com/muesli/termenv v0.16.0
 	github.com/otiai10/copy v1.14.1
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2
 	github.com/skip2/go-qrcode v0.0.0-20200617195104-da1b6568686e
-	github.com/spf13/cobra v1.9.1
-	github.com/spf13/viper v1.20.1
-	github.com/stretchr/testify v1.10.0
-	github.com/ubuntu/decorate v0.0.0-20230606064312-bc4ac83958d6
-	go.etcd.io/bbolt v1.4.0
+	github.com/spf13/cobra v1.10.2
+	github.com/spf13/pflag v1.0.10
+	github.com/spf13/viper v1.21.0
+	github.com/stretchr/testify v1.11.1
+	go.etcd.io/bbolt v1.4.3
 	golang.org/x/exp v0.0.0-20230905200255-921286631fa9
-	golang.org/x/sys v0.32.0
-	golang.org/x/term v0.31.0
-	google.golang.org/grpc v1.72.2
-	google.golang.org/protobuf v1.36.6
-	gopkg.in/ini.v1 v1.67.0
+	golang.org/x/sys v0.41.0
+	golang.org/x/term v0.40.0
+	google.golang.org/grpc v1.79.1
+	google.golang.org/protobuf v1.36.11
+	gopkg.in/ini.v1 v1.67.1
 	gopkg.in/yaml.v3 v3.0.1
 	gorbe.io/go/osrelease v0.3.0
 )
@@ -39,10 +39,11 @@ require (
 	github.com/charmbracelet/colorprofile v0.2.3-0.20250311203215-f60798e515dc // indirect
 	github.com/charmbracelet/x/ansi v0.8.0 // indirect
 	github.com/charmbracelet/x/cellbuf v0.0.13-0.20250311204145-2c3ea96c31dd // indirect
+	github.com/cpuguy83/go-md2man/v2 v2.0.6 // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
 	github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f // indirect
-	github.com/fsnotify/fsnotify v1.8.0 // indirect
-	github.com/go-viper/mapstructure/v2 v2.2.1 // indirect
+	github.com/fsnotify/fsnotify v1.9.0 // indirect
+	github.com/go-viper/mapstructure/v2 v2.4.0 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/lucasb-eyer/go-colorful v1.2.0 // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect
@@ -51,23 +52,21 @@ require (
 	github.com/muesli/ansi v0.0.0-20230316100256-276c6243b2f6 // indirect
 	github.com/muesli/cancelreader v0.2.2 // indirect
 	github.com/otiai10/mint v1.6.3 // indirect
-	github.com/pelletier/go-toml/v2 v2.2.3 // indirect
+	github.com/pelletier/go-toml/v2 v2.2.4 // indirect
 	github.com/rivo/uniseg v0.4.7 // indirect
-	github.com/sagikazarmark/locafero v0.7.0 // indirect
+	github.com/russross/blackfriday/v2 v2.1.0 // indirect
+	github.com/sagikazarmark/locafero v0.11.0 // indirect
 	github.com/sahilm/fuzzy v0.1.1 // indirect
-	github.com/sirupsen/logrus v1.9.3 // indirect
-	github.com/sourcegraph/conc v0.3.0 // indirect
-	github.com/spf13/afero v1.12.0 // indirect
-	github.com/spf13/cast v1.7.1 // indirect
-	github.com/spf13/pflag v1.0.6 // indirect
+	github.com/sourcegraph/conc v0.3.1-0.20240121214520-5f936abd7ae8 // indirect
+	github.com/spf13/afero v1.15.0 // indirect
+	github.com/spf13/cast v1.10.0 // indirect
 	github.com/subosito/gotenv v1.6.0 // indirect
 	github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect
-	go.uber.org/atomic v1.9.0 // indirect
-	go.uber.org/multierr v1.9.0 // indirect
-	golang.org/x/net v0.38.0 // indirect
-	golang.org/x/sync v0.12.0 // indirect
-	golang.org/x/text v0.23.0 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20250324211829-b45e905df463 // indirect
+	go.yaml.in/yaml/v3 v3.0.4 // indirect
+	golang.org/x/net v0.48.0 // indirect
+	golang.org/x/sync v0.19.0 // indirect
+	golang.org/x/text v0.32.0 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20251202230838-ff82c1b0f217 // indirect
 )
 
 // FIXME: Use released version once we have one!
diff --git a/go.sum b/go.sum
index 95e8d2bdc5..96e33e17d8 100644
--- a/go.sum
+++ b/go.sum
@@ -4,6 +4,8 @@ github.com/atotto/clipboard v0.1.4 h1:EH0zSVneZPSuFR11BlR9YppQTVDbh5+16AmcJi4g1z
 github.com/atotto/clipboard v0.1.4/go.mod h1:ZY9tmq7sm5xIbd9bOK4onWV4S6X0u6GY7Vn0Yu86PYI=
 github.com/aymanbagabas/go-osc52/v2 v2.0.1 h1:HwpRHbFMcZLEVr42D4p7XBqjyuxQH5SMiErDT4WkJ2k=
 github.com/aymanbagabas/go-osc52/v2 v2.0.1/go.mod h1:uYgXzlJ7ZpABp8OJ+exZzJJhRNQ2ASbcXHWsFqH8hp8=
+github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
+github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/charmbracelet/bubbles v0.20.0 h1:jSZu6qD8cRQ6k9OMfR1WlM+ruM8fkPWkHvQWD9LIutE=
 github.com/charmbracelet/bubbles v0.20.0/go.mod h1:39slydyswPy+uVOHZ5x/GjwVAFkCsV8IIVy+4MhzwwU=
 github.com/charmbracelet/bubbletea v1.3.4 h1:kCg7B+jSCFPLYRA52SDZjr51kG/fMUEoPoZrkaDHyoI=
@@ -16,10 +18,11 @@ github.com/charmbracelet/x/ansi v0.8.0 h1:9GTq3xq9caJW8ZrBTe0LIe2fvfLR/bYXKTx2ll
 github.com/charmbracelet/x/ansi v0.8.0/go.mod h1:wdYl/ONOLHLIVmQaxbIYEC/cRKOQyjTkowiI4blgS9Q=
 github.com/charmbracelet/x/cellbuf v0.0.13-0.20250311204145-2c3ea96c31dd h1:vy0GVL4jeHEwG5YOXDmi86oYw2yuYUGqz6a8sLwg0X8=
 github.com/charmbracelet/x/cellbuf v0.0.13-0.20250311204145-2c3ea96c31dd/go.mod h1:xe0nKWGd3eJgtqZRaN9RjMtK7xUYchjzPr7q6kcvCCs=
-github.com/charmbracelet/x/term v0.2.1 h1:AQeHeLZ1OqSXhrAWpYUtZyX1T3zVxfpZuEQMIQaGIAQ=
-github.com/charmbracelet/x/term v0.2.1/go.mod h1:oQ4enTYFV7QN4m0i9mzHrViD7TQKvNEEkHUMCmsxdUg=
-github.com/coreos/go-systemd/v22 v22.5.0 h1:RrqgGjYQKalulkV8NGVIfkXQf6YYmOyiJKk8iXXhfZs=
-github.com/coreos/go-systemd/v22 v22.5.0/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc=
+github.com/charmbracelet/x/term v0.2.2 h1:xVRT/S2ZcKdhhOuSP4t5cLi5o+JxklsoEObBSgfgZRk=
+github.com/charmbracelet/x/term v0.2.2/go.mod h1:kF8CY5RddLWrsgVwpw4kAa6TESp6EB5y3uxGLeCqzAI=
+github.com/coreos/go-systemd/v22 v22.7.0 h1:LAEzFkke61DFROc7zNLX/WA2i5J8gYqe0rSj9KI28KA=
+github.com/coreos/go-systemd/v22 v22.7.0/go.mod h1:xNUYtjHu2EDXbsxz1i41wouACIwT7Ybq9o0BQhMwD0w=
+github.com/cpuguy83/go-md2man/v2 v2.0.6 h1:XJtiaUW6dEEqVuZiMTn1ldk455QWwEIsMIJlo5vtkx0=
 github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
@@ -29,21 +32,20 @@ github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f h1:Y/CXytFA4m6
 github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f/go.mod h1:vw97MGsxSvLiUE2X8qFplwetxpGLQrlU1Q9AUEIzCaM=
 github.com/frankban/quicktest v1.14.6 h1:7Xjx+VpznH+oBnejlPUj8oUpdxnVs4f8XU8WnHkI4W8=
 github.com/frankban/quicktest v1.14.6/go.mod h1:4ptaffx2x8+WTWXmUCuVU6aPUX1/Mz7zb5vbUoiM6w0=
-github.com/fsnotify/fsnotify v1.8.0 h1:dAwr6QBTBZIkG8roQaJjGof0pp0EeF+tNV7YBP3F/8M=
-github.com/fsnotify/fsnotify v1.8.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0=
-github.com/go-logr/logr v1.4.2 h1:6pFjapn8bFcIbiKo3XT4j/BhANplGihG6tvd+8rYgrY=
-github.com/go-logr/logr v1.4.2/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/fsnotify/fsnotify v1.9.0 h1:2Ml+OJNzbYCTzsxtv8vKSFD9PbJjmhYF14k/jKC7S9k=
+github.com/fsnotify/fsnotify v1.9.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0=
+github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
+github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
 github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
 github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
-github.com/go-viper/mapstructure/v2 v2.2.1 h1:ZAaOCxANMuZx5RCeg0mBdEZk7DZasvvZIxtHqx8aGss=
-github.com/go-viper/mapstructure/v2 v2.2.1/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM=
-github.com/godbus/dbus/v5 v5.0.4/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
-github.com/godbus/dbus/v5 v5.1.0 h1:4KLkAxT3aOY8Li4FRJe/KvhoNFFxo0m6fNuFUO8QJUk=
-github.com/godbus/dbus/v5 v5.1.0/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
+github.com/go-viper/mapstructure/v2 v2.4.0 h1:EBsztssimR/CONLSZZ04E8qAkxNYq4Qp9LvH92wZUgs=
+github.com/go-viper/mapstructure/v2 v2.4.0/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM=
+github.com/godbus/dbus/v5 v5.2.2 h1:TUR3TgtSVDmjiXOgAAyaZbYmIeP3DPkld3jgKGV8mXQ=
+github.com/godbus/dbus/v5 v5.2.2/go.mod h1:3AAv2+hPq5rdnr5txxxRwiGjPXamgoIHgz9FPBfOp3c=
 github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
 github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
-github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
-github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
+github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
@@ -62,8 +64,8 @@ github.com/mattn/go-localereader v0.0.1 h1:ygSAOl7ZXTx4RdPYinUpg6W99U8jWvWi9Ye2J
 github.com/mattn/go-localereader v0.0.1/go.mod h1:8fBrzywKY7BI3czFoHkuzRoWE9C+EiG4R1k4Cjx5p88=
 github.com/mattn/go-runewidth v0.0.16 h1:E5ScNMtiwvlvB5paMFdw9p4kSQzbXFikJ5SQO6TULQc=
 github.com/mattn/go-runewidth v0.0.16/go.mod h1:Jdepj2loyihRzMpdS35Xk/zdY8IAYHsh153qUoGf23w=
-github.com/mattn/go-sqlite3 v1.14.28 h1:ThEiQrnbtumT+QMknw63Befp/ce/nUPgBPMlRFEum7A=
-github.com/mattn/go-sqlite3 v1.14.28/go.mod h1:Uh1q+B4BYcTPb+yiD3kU8Ct7aC0hY9fxUwlHK0RXw+Y=
+github.com/mattn/go-sqlite3 v1.14.34 h1:3NtcvcUnFBPsuRcno8pUtupspG/GM+9nZ88zgJcp6Zk=
+github.com/mattn/go-sqlite3 v1.14.34/go.mod h1:Uh1q+B4BYcTPb+yiD3kU8Ct7aC0hY9fxUwlHK0RXw+Y=
 github.com/muesli/ansi v0.0.0-20230316100256-276c6243b2f6 h1:ZK8zHtRHOkbHy6Mmr5D264iyp3TiX5OmNcI5cIARiQI=
 github.com/muesli/ansi v0.0.0-20230316100256-276c6243b2f6/go.mod h1:CJlz5H+gyd6CUWT45Oy4q24RdLyn7Md9Vj2/ldJBSIo=
 github.com/muesli/cancelreader v0.2.2 h1:3I4Kt4BQjOR54NavqnDogx/MIoWBFa0StPA8ELUXHmA=
@@ -74,8 +76,8 @@ github.com/otiai10/copy v1.14.1 h1:5/7E6qsUMBaH5AnQ0sSLzzTg1oTECmcCmT6lvF45Na8=
 github.com/otiai10/copy v1.14.1/go.mod h1:oQwrEDDOci3IM8dJF0d8+jnbfPDllW6vUjNc3DoZm9I=
 github.com/otiai10/mint v1.6.3 h1:87qsV/aw1F5as1eH1zS/yqHY85ANKVMgkDrf9rcxbQs=
 github.com/otiai10/mint v1.6.3/go.mod h1:MJm72SBthJjz8qhefc4z1PYEieWmy8Bku7CjcAqyUSM=
-github.com/pelletier/go-toml/v2 v2.2.3 h1:YmeHyLY8mFWbdkNWwpr+qIL2bEqT0o95WSdkNHvL12M=
-github.com/pelletier/go-toml/v2 v2.2.3/go.mod h1:MfCQTFTvCcUyyvvwm1+G6H/jORL20Xlb6rzQu9GuUkc=
+github.com/pelletier/go-toml/v2 v2.2.4 h1:mye9XuhQ6gvn5h28+VilKrrPoQVanw5PMw/TB0t5Ec4=
+github.com/pelletier/go-toml/v2 v2.2.4/go.mod h1:2gIqNv+qfxSVS7cM2xJQKtLSTLUE9V8t9Stt+h56mCY=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
@@ -84,82 +86,83 @@ github.com/rivo/uniseg v0.4.7 h1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ=
 github.com/rivo/uniseg v0.4.7/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88=
 github.com/rogpeppe/go-internal v1.9.0 h1:73kH8U+JUqXU8lRuOHeVHaa/SZPifC7BkcraZVejAe8=
 github.com/rogpeppe/go-internal v1.9.0/go.mod h1:WtVeX8xhTBvf0smdhujwtBcq4Qrzq/fJaraNFVN+nFs=
+github.com/russross/blackfriday/v2 v2.1.0 h1:JIOH55/0cWyOuilr9/qlrm0BSXldqnqwMsf35Ld67mk=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
-github.com/sagikazarmark/locafero v0.7.0 h1:5MqpDsTGNDhY8sGp0Aowyf0qKsPrhewaLSsFaodPcyo=
-github.com/sagikazarmark/locafero v0.7.0/go.mod h1:2za3Cg5rMaTMoG/2Ulr9AwtFaIppKXTRYnozin4aB5k=
+github.com/sagikazarmark/locafero v0.11.0 h1:1iurJgmM9G3PA/I+wWYIOw/5SyBtxapeHDcg+AAIFXc=
+github.com/sagikazarmark/locafero v0.11.0/go.mod h1:nVIGvgyzw595SUSUE6tvCp3YYTeHs15MvlmU87WwIik=
 github.com/sahilm/fuzzy v0.1.1 h1:ceu5RHF8DGgoi+/dR5PsECjCDH1BE3Fnmpo7aVXOdRA=
 github.com/sahilm/fuzzy v0.1.1/go.mod h1:VFvziUEIMCrT6A6tw2RFIXPXXmzXbOsSHF0DOI8ZK9Y=
-github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
-github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
 github.com/skip2/go-qrcode v0.0.0-20200617195104-da1b6568686e h1:MRM5ITcdelLK2j1vwZ3Je0FKVCfqOLp5zO6trqMLYs0=
 github.com/skip2/go-qrcode v0.0.0-20200617195104-da1b6568686e/go.mod h1:XV66xRDqSt+GTGFMVlhk3ULuV0y9ZmzeVGR4mloJI3M=
-github.com/sourcegraph/conc v0.3.0 h1:OQTbbt6P72L20UqAkXXuLOj79LfEanQ+YQFNpLA9ySo=
-github.com/sourcegraph/conc v0.3.0/go.mod h1:Sdozi7LEKbFPqYX2/J+iBAM6HpqSLTASQIKqDmF7Mt0=
-github.com/spf13/afero v1.12.0 h1:UcOPyRBYczmFn6yvphxkn9ZEOY65cpwGKb5mL36mrqs=
-github.com/spf13/afero v1.12.0/go.mod h1:ZTlWwG4/ahT8W7T0WQ5uYmjI9duaLQGy3Q2OAl4sk/4=
-github.com/spf13/cast v1.7.1 h1:cuNEagBQEHWN1FnbGEjCXL2szYEXqfJPbP2HNUaca9Y=
-github.com/spf13/cast v1.7.1/go.mod h1:ancEpBxwJDODSW/UG4rDrAqiKolqNNh2DX3mk86cAdo=
-github.com/spf13/cobra v1.9.1 h1:CXSaggrXdbHK9CF+8ywj8Amf7PBRmPCOJugH954Nnlo=
-github.com/spf13/cobra v1.9.1/go.mod h1:nDyEzZ8ogv936Cinf6g1RU9MRY64Ir93oCnqb9wxYW0=
-github.com/spf13/pflag v1.0.6 h1:jFzHGLGAlb3ruxLB8MhbI6A8+AQX/2eW4qeyNZXNp2o=
-github.com/spf13/pflag v1.0.6/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
-github.com/spf13/viper v1.20.1 h1:ZMi+z/lvLyPSCoNtFCpqjy0S4kPbirhpTMwl8BkW9X4=
-github.com/spf13/viper v1.20.1/go.mod h1:P9Mdzt1zoHIG8m2eZQinpiBjo6kCmZSKBClNNqjJvu4=
+github.com/sourcegraph/conc v0.3.1-0.20240121214520-5f936abd7ae8 h1:+jumHNA0Wrelhe64i8F6HNlS8pkoyMv5sreGx2Ry5Rw=
+github.com/sourcegraph/conc v0.3.1-0.20240121214520-5f936abd7ae8/go.mod h1:3n1Cwaq1E1/1lhQhtRK2ts/ZwZEhjcQeJQ1RuC6Q/8U=
+github.com/spf13/afero v1.15.0 h1:b/YBCLWAJdFWJTN9cLhiXXcD7mzKn9Dm86dNnfyQw1I=
+github.com/spf13/afero v1.15.0/go.mod h1:NC2ByUVxtQs4b3sIUphxK0NioZnmxgyCrfzeuq8lxMg=
+github.com/spf13/cast v1.10.0 h1:h2x0u2shc1QuLHfxi+cTJvs30+ZAHOGRic8uyGTDWxY=
+github.com/spf13/cast v1.10.0/go.mod h1:jNfB8QC9IA6ZuY2ZjDp0KtFO2LZZlg4S/7bzP6qqeHo=
+github.com/spf13/cobra v1.10.2 h1:DMTTonx5m65Ic0GOoRY2c16WCbHxOOw6xxezuLaBpcU=
+github.com/spf13/cobra v1.10.2/go.mod h1:7C1pvHqHw5A4vrJfjNwvOdzYu0Gml16OCs2GRiTUUS4=
+github.com/spf13/pflag v1.0.9/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
+github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/spf13/viper v1.21.0 h1:x5S+0EU27Lbphp4UKm1C+1oQO+rKx36vfCoaVebLFSU=
+github.com/spf13/viper v1.21.0/go.mod h1:P0lhsswPGWD/1lZJ9ny3fYnVqxiegrlNrEmgLjbTCAY=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
-github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
-github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
-github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
+github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
+github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
+github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
+github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
+github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
+github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
+github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
 github.com/subosito/gotenv v1.6.0 h1:9NlTDc1FTs4qu0DDq7AEtTPNw6SVm7uBMsUCUjABIf8=
 github.com/subosito/gotenv v1.6.0/go.mod h1:Dk4QP5c2W3ibzajGcXpNraDfq2IrhjMIvMSWPKKo0FU=
-github.com/ubuntu/decorate v0.0.0-20230606064312-bc4ac83958d6 h1:J0625LLHcZxxnnKCdr2iBbTtYjUiv6KkM6NpGisuQ3Q=
-github.com/ubuntu/decorate v0.0.0-20230606064312-bc4ac83958d6/go.mod h1:edGgz97NOqS2oqzbKrZqO9YU9neosRrkEZbVJVQynAA=
 github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e h1:JVG44RsyaB9T2KIHavMF/ppJZNG9ZpyihvCd0w101no=
 github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e/go.mod h1:RbqR21r5mrJuqunuUZ/Dhy/avygyECGrLceyNeo4LiM=
-go.etcd.io/bbolt v1.4.0 h1:TU77id3TnN/zKr7CO/uk+fBCwF2jGcMuw2B/FMAzYIk=
-go.etcd.io/bbolt v1.4.0/go.mod h1:AsD+OCi/qPN1giOX1aiLAha3o1U8rAz65bvN4j0sRuk=
-go.opentelemetry.io/auto/sdk v1.1.0 h1:cH53jehLUN6UFLY71z+NDOiNJqDdPRaXzTel0sJySYA=
-go.opentelemetry.io/auto/sdk v1.1.0/go.mod h1:3wSPjt5PWp2RhlCcmmOial7AvC4DQqZb7a7wCow3W8A=
-go.opentelemetry.io/otel v1.34.0 h1:zRLXxLCgL1WyKsPVrgbSdMN4c0FMkDAskSTQP+0hdUY=
-go.opentelemetry.io/otel v1.34.0/go.mod h1:OWFPOQ+h4G8xpyjgqo4SxJYdDQ/qmRH+wivy7zzx9oI=
-go.opentelemetry.io/otel/metric v1.34.0 h1:+eTR3U0MyfWjRDhmFMxe2SsW64QrZ84AOhvqS7Y+PoQ=
-go.opentelemetry.io/otel/metric v1.34.0/go.mod h1:CEDrp0fy2D0MvkXE+dPV7cMi8tWZwX3dmaIhwPOaqHE=
-go.opentelemetry.io/otel/sdk v1.34.0 h1:95zS4k/2GOy069d321O8jWgYsW3MzVV+KuSPKp7Wr1A=
-go.opentelemetry.io/otel/sdk v1.34.0/go.mod h1:0e/pNiaMAqaykJGKbi+tSjWfNNHMTxoC9qANsCzbyxU=
-go.opentelemetry.io/otel/sdk/metric v1.34.0 h1:5CeK9ujjbFVL5c1PhLuStg1wxA7vQv7ce1EK0Gyvahk=
-go.opentelemetry.io/otel/sdk/metric v1.34.0/go.mod h1:jQ/r8Ze28zRKoNRdkjCZxfs6YvBTG1+YIqyFVFYec5w=
-go.opentelemetry.io/otel/trace v1.34.0 h1:+ouXS2V8Rd4hp4580a8q23bg0azF2nI8cqLYnC8mh/k=
-go.opentelemetry.io/otel/trace v1.34.0/go.mod h1:Svm7lSjQD7kG7KJ/MUHPVXSDGz2OX4h0M2jHBhmSfRE=
-go.uber.org/atomic v1.9.0 h1:ECmE8Bn/WFTYwEW/bpKD3M8VtR/zQVbavAoalC1PYyE=
-go.uber.org/atomic v1.9.0/go.mod h1:fEN4uk6kAWBTFdckzkM89CLk9XfWZrxpCo0nPH17wJc=
-go.uber.org/multierr v1.9.0 h1:7fIwc/ZtS0q++VgcfqFDxSBZVv/Xo49/SYnDFupUwlI=
-go.uber.org/multierr v1.9.0/go.mod h1:X2jQV1h+kxSjClGpnseKVIxpmcjrj7MNnI0bnlfKTVQ=
+go.etcd.io/bbolt v1.4.3 h1:dEadXpI6G79deX5prL3QRNP6JB8UxVkqo4UPnHaNXJo=
+go.etcd.io/bbolt v1.4.3/go.mod h1:tKQlpPaYCVFctUIgFKFnAlvbmB3tpy1vkTnDWohtc0E=
+go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=
+go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y=
+go.opentelemetry.io/otel v1.39.0 h1:8yPrr/S0ND9QEfTfdP9V+SiwT4E0G7Y5MO7p85nis48=
+go.opentelemetry.io/otel v1.39.0/go.mod h1:kLlFTywNWrFyEdH0oj2xK0bFYZtHRYUdv1NklR/tgc8=
+go.opentelemetry.io/otel/metric v1.39.0 h1:d1UzonvEZriVfpNKEVmHXbdf909uGTOQjA0HF0Ls5Q0=
+go.opentelemetry.io/otel/metric v1.39.0/go.mod h1:jrZSWL33sD7bBxg1xjrqyDjnuzTUB0x1nBERXd7Ftcs=
+go.opentelemetry.io/otel/sdk v1.39.0 h1:nMLYcjVsvdui1B/4FRkwjzoRVsMK8uL/cj0OyhKzt18=
+go.opentelemetry.io/otel/sdk v1.39.0/go.mod h1:vDojkC4/jsTJsE+kh+LXYQlbL8CgrEcwmt1ENZszdJE=
+go.opentelemetry.io/otel/sdk/metric v1.39.0 h1:cXMVVFVgsIf2YL6QkRF4Urbr/aMInf+2WKg+sEJTtB8=
+go.opentelemetry.io/otel/sdk/metric v1.39.0/go.mod h1:xq9HEVH7qeX69/JnwEfp6fVq5wosJsY1mt4lLfYdVew=
+go.opentelemetry.io/otel/trace v1.39.0 h1:2d2vfpEDmCJ5zVYz7ijaJdOF59xLomrvj7bjt6/qCJI=
+go.opentelemetry.io/otel/trace v1.39.0/go.mod h1:88w4/PnZSazkGzz/w84VHpQafiU4EtqqlVdxWy+rNOA=
+go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
+go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
 golang.org/x/exp v0.0.0-20230905200255-921286631fa9 h1:GoHiUyI/Tp2nVkLI2mCxVkOjsbSXD66ic0XW0js0R9g=
 golang.org/x/exp v0.0.0-20230905200255-921286631fa9/go.mod h1:S2oDrQGGwySpoQPVqRShND87VCbxmc6bL1Yd2oYrm6k=
-golang.org/x/net v0.38.0 h1:vRMAPTMaeGqVhG5QyLJHqNDwecKTomGeqbnfZyKlBI8=
-golang.org/x/net v0.38.0/go.mod h1:ivrbrMbzFq5J41QOQh0siUuly180yBYtLp+CKbEaFx8=
-golang.org/x/sync v0.12.0 h1:MHc5BpPuC30uJk597Ri8TV3CNZcTLu6B6z4lJy+g6Jw=
-golang.org/x/sync v0.12.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
+golang.org/x/net v0.48.0 h1:zyQRTTrjc33Lhh0fBgT/H3oZq9WuvRR5gPC70xpDiQU=
+golang.org/x/net v0.48.0/go.mod h1:+ndRgGjkh8FGtu1w1FGbEC31if4VrNVMuKTgcAAnQRY=
+golang.org/x/sync v0.19.0 h1:vV+1eWNmZ5geRlYjzm2adRgW2/mcpevXNg50YZtPCE4=
+golang.org/x/sync v0.19.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
 golang.org/x/sys v0.0.0-20210809222454-d867a43fc93e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.32.0 h1:s77OFDvIQeibCmezSnk/q6iAfkdiQaJi4VzroCFrN20=
-golang.org/x/sys v0.32.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
-golang.org/x/term v0.31.0 h1:erwDkOK1Msy6offm1mOgvspSkslFnIGsFnxOKoufg3o=
-golang.org/x/term v0.31.0/go.mod h1:R4BeIy7D95HzImkxGkTW1UQTtP54tio2RyHz7PwK0aw=
-golang.org/x/text v0.23.0 h1:D71I7dUrlY+VX0gQShAThNGHFxZ13dGLBHQLVl1mJlY=
-golang.org/x/text v0.23.0/go.mod h1:/BLNzu4aZCJ1+kcD0DNRotWKage4q2rGVAg4o22unh4=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20250324211829-b45e905df463 h1:e0AIkUUhxyBKh6ssZNrAMeqhA7RKUj42346d1y02i2g=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20250324211829-b45e905df463/go.mod h1:qQ0YXyHHx3XkvlzUtpXDkS29lDSafHMZBAZDc03LQ3A=
-google.golang.org/grpc v1.72.2 h1:TdbGzwb82ty4OusHWepvFWGLgIbNo1/SUynEN0ssqv8=
-google.golang.org/grpc v1.72.2/go.mod h1:wH5Aktxcg25y1I3w7H69nHfXdOG3UiadoBtjh3izSDM=
-google.golang.org/protobuf v1.36.6 h1:z1NpPI8ku2WgiWnf+t9wTPsn6eP1L7ksHUlkfLvd9xY=
-google.golang.org/protobuf v1.36.6/go.mod h1:jduwjTPXsFjZGTmRluh+L6NjiWu7pchiJ2/5YcXBHnY=
+golang.org/x/sys v0.41.0 h1:Ivj+2Cp/ylzLiEU89QhWblYnOE9zerudt9Ftecq2C6k=
+golang.org/x/sys v0.41.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
+golang.org/x/term v0.40.0 h1:36e4zGLqU4yhjlmxEaagx2KuYbJq3EwY8K943ZsHcvg=
+golang.org/x/term v0.40.0/go.mod h1:w2P8uVp06p2iyKKuvXIm7N/y0UCRt3UfJTfZ7oOpglM=
+golang.org/x/text v0.32.0 h1:ZD01bjUt1FQ9WJ0ClOL5vxgxOI/sVCNgX1YtKwcY0mU=
+golang.org/x/text v0.32.0/go.mod h1:o/rUWzghvpD5TXrTIBuJU77MTaN0ljMWE47kxGJQ7jY=
+gonum.org/v1/gonum v0.16.0 h1:5+ul4Swaf3ESvrOnidPp4GZbzf0mxVQpDCYUQE7OJfk=
+gonum.org/v1/gonum v0.16.0/go.mod h1:fef3am4MQ93R2HHpKnLk4/Tbh/s0+wqD5nfa6Pnwy4E=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20251202230838-ff82c1b0f217 h1:gRkg/vSppuSQoDjxyiGfN4Upv/h/DQmIR10ZU8dh4Ww=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20251202230838-ff82c1b0f217/go.mod h1:7i2o+ce6H/6BluujYR+kqX3GKH+dChPTQU19wjRPiGk=
+google.golang.org/grpc v1.79.1 h1:zGhSi45ODB9/p3VAawt9a+O/MULLl9dpizzNNpq7flY=
+google.golang.org/grpc v1.79.1/go.mod h1:KmT0Kjez+0dde/v2j9vzwoAScgEPx/Bw1CYChhHLrHQ=
+google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
+google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15 h1:YR8cESwS4TdDjEe65xsg0ogRM/Nc3DYOhEAlW+xobZo=
 gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/ini.v1 v1.67.0 h1:Dgnx+6+nfE+IfzjUEISNeydPJh9AXNNsWbGP9KzCsOA=
-gopkg.in/ini.v1 v1.67.0/go.mod h1:pNLf8WUiyNEtQjuu5G5vTm06TEv9tsIgeAvK8hOrP4k=
+gopkg.in/ini.v1 v1.67.1 h1:tVBILHy0R6e4wkYOn3XmiITt/hEVH4TFMYvAX2Ytz6k=
+gopkg.in/ini.v1 v1.67.1/go.mod h1:x/cyOwCgZqOkJoDIJ3c1KNHMo10+nLGAhh+kn3Zizss=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
diff --git a/gotestcov b/gotestcov
index 349a466c5a..8e191694d1 100755
--- a/gotestcov
+++ b/gotestcov
@@ -27,7 +27,7 @@ cov_dir="${projectroot}/coverage"
 mkdir -p "${cov_dir}"
 
 # start http server on 6061 if none
-if ! $(nc -z localhost 6061); then
+if ! nc -z localhost 6061; then
     nohup python3 -m http.server --directory "${cov_dir}" 6061 1>/dev/null 2>&1 &
 fi
 
@@ -40,7 +40,7 @@ mkdir -p "${raw_cov_dir}"
 # Overriding the default coverage directory is currently not an exported flag of go test
 # We need to override it using the test.gocoverdir flag instead.
 #TODO: Update when https://go-review.googlesource.com/c/go/+/456595 is merged.
-go test -cover -covermode=set -coverpkg=./... $@  -shuffle=on -args -test.gocoverdir="${raw_cov_dir}"
+go test -cover -covermode=set -coverpkg=./... "$@"  -shuffle=on -args -test.gocoverdir="${raw_cov_dir}"
 
 # Convert the raw coverage data into textfmt so we can merge the Rust one into it
 go tool covdata textfmt -i="${raw_cov_dir}" -o="${cov_dir}/coverage.out"
diff --git a/internal/brokers/broker.go b/internal/brokers/broker.go
index dcde2a3f0b..eddc7da7ff 100644
--- a/internal/brokers/broker.go
+++ b/internal/brokers/broker.go
@@ -10,12 +10,12 @@ import (
 	"strings"
 	"sync"
 
+	"github.com/canonical/authd/internal/brokers/auth"
+	"github.com/canonical/authd/internal/brokers/layouts"
+	"github.com/canonical/authd/internal/decorate"
+	"github.com/canonical/authd/internal/users/types"
+	"github.com/canonical/authd/log"
 	"github.com/godbus/dbus/v5"
-	"github.com/ubuntu/authd/internal/brokers/auth"
-	"github.com/ubuntu/authd/internal/brokers/layouts"
-	"github.com/ubuntu/authd/internal/users/types"
-	"github.com/ubuntu/authd/log"
-	"github.com/ubuntu/decorate"
 	"golang.org/x/exp/slices"
 )
 
@@ -151,17 +151,27 @@ func (b Broker) IsAuthenticated(ctx context.Context, sessionID, authenticationDa
 
 	select {
 	case <-done:
+		if errors.Is(err, context.Canceled) {
+			log.Debugf(ctx, "Authentication for session %s was canceled", sessionID)
+			return auth.Cancelled, "{}", nil
+		}
 		if err != nil {
 			return "", "", err
 		}
 	case <-ctx.Done():
+		log.Warningf(ctx, "Authentication aborted: PAM client disconnected unexpectedly (session %s)", sessionID)
+		log.Debugf(ctx, "Cancelling broker authentication (session %s)", sessionID)
 		b.cancelIsAuthenticated(ctx, sessionID)
 		<-done
+		if err != nil && !errors.Is(err, context.Canceled) {
+			log.Errorf(ctx, "Authentication failed: %v", err)
+		}
+		return auth.Cancelled, "{}", nil
 	}
 
 	// Validate access authentication.
 	if !slices.Contains(auth.Replies, access) {
-		return "", "", fmt.Errorf("invalid access authentication key: %v", access)
+		return "", "", fmt.Errorf("invalid broker response: %q", access)
 	}
 
 	if data == "" {
diff --git a/internal/brokers/broker_test.go b/internal/brokers/broker_test.go
index bc7eb4ba66..7abd54ff03 100644
--- a/internal/brokers/broker_test.go
+++ b/internal/brokers/broker_test.go
@@ -9,12 +9,12 @@ import (
 	"testing"
 	"time"
 
+	"github.com/canonical/authd/internal/brokers"
+	"github.com/canonical/authd/internal/brokers/auth"
+	"github.com/canonical/authd/internal/brokers/layouts"
+	"github.com/canonical/authd/internal/testutils"
+	"github.com/canonical/authd/internal/testutils/golden"
 	"github.com/stretchr/testify/require"
-	"github.com/ubuntu/authd/internal/brokers"
-	"github.com/ubuntu/authd/internal/brokers/auth"
-	"github.com/ubuntu/authd/internal/brokers/layouts"
-	"github.com/ubuntu/authd/internal/testutils"
-	"github.com/ubuntu/authd/internal/testutils/golden"
 )
 
 var supportedLayouts = map[string]map[string]string{
@@ -326,9 +326,9 @@ func TestUserPreCheck(t *testing.T) {
 
 		wantErr bool
 	}{
-		"Successfully_pre-check_user": {username: "user-pre-check"},
+		"Successfully_pre-check_user": {username: "user-pre-check@example.com"},
 
-		"Error_if_user_is_not_available": {username: "unexistent", wantErr: true},
+		"Error_if_user_is_not_available": {username: "unexistent@example.com", wantErr: true},
 	}
 	for name, tc := range tests {
 		t.Run(name, func(t *testing.T) {
diff --git a/internal/brokers/dbusbroker.go b/internal/brokers/dbusbroker.go
index 853a1199f7..759ad247fa 100644
--- a/internal/brokers/dbusbroker.go
+++ b/internal/brokers/dbusbroker.go
@@ -5,10 +5,10 @@ import (
 	"errors"
 	"fmt"
 
+	"github.com/canonical/authd/internal/decorate"
+	"github.com/canonical/authd/internal/services/errmessages"
+	"github.com/canonical/authd/log"
 	"github.com/godbus/dbus/v5"
-	"github.com/ubuntu/authd/internal/services/errmessages"
-	"github.com/ubuntu/authd/log"
-	"github.com/ubuntu/decorate"
 	"gopkg.in/ini.v1"
 )
 
@@ -152,6 +152,9 @@ func (b dbusBroker) call(ctx context.Context, method string, args ...interface{}
 		if errors.As(err, &dbusError) && dbusError.Name == "org.freedesktop.DBus.Error.ServiceUnknown" {
 			err = fmt.Errorf("couldn't connect to broker %q. Is it running?", b.name)
 		}
+		if errors.As(err, &dbusError) && dbusError.Name == "com.ubuntu.authd.Canceled" {
+			return nil, context.Canceled
+		}
 		return nil, errmessages.NewToDisplayError(err)
 	}
 
diff --git a/internal/brokers/internal_test.go b/internal/brokers/internal_test.go
index 41abe2727c..17d6df31e2 100644
--- a/internal/brokers/internal_test.go
+++ b/internal/brokers/internal_test.go
@@ -4,8 +4,8 @@ import (
 	"encoding/json"
 	"testing"
 
+	"github.com/canonical/authd/internal/testutils/golden"
 	"github.com/stretchr/testify/require"
-	"github.com/ubuntu/authd/internal/testutils/golden"
 )
 
 // These are used to test the JSON unmarshaling of the User struct.
diff --git a/internal/brokers/layouts/layouts_test.go b/internal/brokers/layouts/layouts_test.go
index 652bc50348..a8707b0dd3 100644
--- a/internal/brokers/layouts/layouts_test.go
+++ b/internal/brokers/layouts/layouts_test.go
@@ -4,9 +4,9 @@ import (
 	"fmt"
 	"testing"
 
+	"github.com/canonical/authd/internal/brokers/layouts"
+	"github.com/canonical/authd/internal/brokers/layouts/entries"
 	"github.com/stretchr/testify/require"
-	"github.com/ubuntu/authd/internal/brokers/layouts"
-	"github.com/ubuntu/authd/internal/brokers/layouts/entries"
 )
 
 func TestOptionalItems(t *testing.T) {
diff --git a/internal/brokers/manager.go b/internal/brokers/manager.go
index f5f5b0a242..43e9be1295 100644
--- a/internal/brokers/manager.go
+++ b/internal/brokers/manager.go
@@ -12,9 +12,9 @@ import (
 	"strings"
 	"sync"
 
+	"github.com/canonical/authd/internal/decorate"
+	"github.com/canonical/authd/log"
 	"github.com/godbus/dbus/v5"
-	"github.com/ubuntu/authd/log"
-	"github.com/ubuntu/decorate"
 )
 
 // Manager is the object that manages the available brokers and the session->broker and user->broker relationships.
@@ -132,9 +132,6 @@ func (m *Manager) SetDefaultBrokerForUser(brokerID, username string) error {
 		return fmt.Errorf("invalid broker: %v", err)
 	}
 
-	// authd uses lowercase usernames
-	username = strings.ToLower(username)
-
 	m.usersToBrokerMu.Lock()
 	defer m.usersToBrokerMu.Unlock()
 	m.usersToBroker[username] = broker
@@ -166,7 +163,7 @@ func (m *Manager) BrokerFromSessionID(id string) (broker *Broker, err error) {
 	return broker, nil
 }
 
-// NewSession create a new session for the broker and store the sesssionID on the manager.
+// NewSession create a new session for the broker and store the sessionID on the manager.
 func (m *Manager) NewSession(brokerID, username, lang, mode string) (sessionID string, encryptionKey string, err error) {
 	broker, err := m.brokerFromID(brokerID)
 	if err != nil {
@@ -206,9 +203,7 @@ func (m *Manager) EndSession(sessionID string) error {
 	return nil
 }
 
-// BrokerExists returns true if the brokerID is known by the manager. It can
-// happen that a broker which was stored in the database is not available anymore
-// because the user removed the configuration file.
+// BrokerExists returns true if the brokerID is known by the manager.
 func (m *Manager) BrokerExists(brokerID string) bool {
 	_, exists := m.brokers[brokerID]
 	return exists
diff --git a/internal/brokers/manager_test.go b/internal/brokers/manager_test.go
index 6eeb65b661..fa916689d4 100644
--- a/internal/brokers/manager_test.go
+++ b/internal/brokers/manager_test.go
@@ -9,12 +9,12 @@ import (
 	"sync"
 	"testing"
 
+	"github.com/canonical/authd/internal/brokers"
+	"github.com/canonical/authd/internal/brokers/auth"
+	"github.com/canonical/authd/internal/testutils"
+	"github.com/canonical/authd/internal/testutils/golden"
+	"github.com/canonical/authd/log"
 	"github.com/stretchr/testify/require"
-	"github.com/ubuntu/authd/internal/brokers"
-	"github.com/ubuntu/authd/internal/brokers/auth"
-	"github.com/ubuntu/authd/internal/testutils"
-	"github.com/ubuntu/authd/internal/testutils/golden"
-	"github.com/ubuntu/authd/log"
 )
 
 var (
@@ -90,14 +90,14 @@ func TestSetDefaultBrokerForUser(t *testing.T) {
 				want.ID = "does not exist"
 			}
 
-			err = m.SetDefaultBrokerForUser(want.ID, "user")
+			err = m.SetDefaultBrokerForUser(want.ID, "user@example.com")
 			if tc.wantErr {
 				require.Error(t, err, "SetDefaultBrokerForUser should return an error, but did not")
 				return
 			}
 			require.NoError(t, err, "SetDefaultBrokerForUser should not return an error, but did")
 
-			got := m.BrokerForUser("user")
+			got := m.BrokerForUser("user@example.com")
 			require.Equal(t, want.ID, got.ID, "SetDefaultBrokerForUser should have assiged the expected broker, but did not")
 		})
 	}
@@ -109,11 +109,11 @@ func TestBrokerForUser(t *testing.T) {
 	m, err := brokers.NewManager(context.Background(), filepath.Join(brokerConfFixtures, "valid_brokers"), nil)
 	require.NoError(t, err, "Setup: could not create manager")
 
-	err = m.SetDefaultBrokerForUser(brokers.LocalBrokerName, "user")
+	err = m.SetDefaultBrokerForUser(brokers.LocalBrokerName, "user@example.com")
 	require.NoError(t, err, "Setup: could not set default broker")
 
 	// Broker for user should return the assigned broker
-	got := m.BrokerForUser("user")
+	got := m.BrokerForUser("user@example.com")
 	require.Equal(t, brokers.LocalBrokerName, got.ID, "BrokerForUser should return the assigned broker, but did not")
 
 	// Broker for user should return nil if no broker is assigned
@@ -319,9 +319,10 @@ func TestStartAndEndSession(t *testing.T) {
 
 	// Fetches the broker IDs
 	for _, broker := range m.AvailableBrokers() {
-		if broker.Name == b1.Name {
+		switch broker.Name {
+		case b1.Name:
 			b1.ID = broker.ID
-		} else if broker.Name == b2.Name {
+		case b2.Name:
 			b2.ID = broker.ID
 		}
 	}
@@ -333,7 +334,7 @@ func TestStartAndEndSession(t *testing.T) {
 	wg.Add(1)
 	go func() {
 		defer wg.Done()
-		id, key, err := m.NewSession(b1.ID, "user1", "some_lang", "auth")
+		id, key, err := m.NewSession(b1.ID, "user1@example.com", "some_lang", "auth")
 		firstID, firstKey, firstErr = &id, &key, &err
 	}()
 	wg.Add(1)
@@ -347,7 +348,7 @@ func TestStartAndEndSession(t *testing.T) {
 	require.NoError(t, *firstErr, "First NewSession should not return an error, but did")
 	require.NoError(t, *secondErr, "Second NewSession should not return an error, but did")
 
-	require.Equal(t, b1.ID+"-"+testutils.GenerateSessionID("user1"),
+	require.Equal(t, b1.ID+"-"+testutils.GenerateSessionID("user1@example.com"),
 		*firstID, "First NewSession should return the expected session ID, but did not")
 	require.Equal(t, testutils.GenerateEncryptionKey(b1.Name),
 		*firstKey, "First NewSession should return the expected encryption key, but did not")
diff --git a/internal/brokers/testdata/golden/TestIsAuthenticated/Adds_default_groups_even_if_broker_did_not_set_them b/internal/brokers/testdata/golden/TestIsAuthenticated/Adds_default_groups_even_if_broker_did_not_set_them
index 45f177b9cc..6f5d818a13 100644
--- a/internal/brokers/testdata/golden/TestIsAuthenticated/Adds_default_groups_even_if_broker_did_not_set_them
+++ b/internal/brokers/testdata/golden/TestIsAuthenticated/Adds_default_groups_even_if_broker_did_not_set_them
@@ -1,4 +1,4 @@
 FIRST CALL:
 	access: granted
-	data: {"Name":"TestIsAuthenticated/Adds_default_groups_even_if_broker_did_not_set_them_separator_ia_info_empty_groups","UID":0,"Gecos":"gecos for ia_info_empty_groups","Dir":"/home/ia_info_empty_groups","Shell":"/bin/sh/ia_info_empty_groups","Groups":[]}
+	data: {"Name":"ia_info_empty_groups@example.com","UID":0,"Gecos":"gecos for ia_info_empty_groups@example.com","Dir":"/home/ia_info_empty_groups@example.com","Shell":"/bin/sh/ia_info_empty_groups@example.com","Groups":[]}
 	err: <nil>
diff --git a/internal/brokers/testdata/golden/TestIsAuthenticated/Error_when_broker_returns_invalid_access b/internal/brokers/testdata/golden/TestIsAuthenticated/Error_when_broker_returns_invalid_access
index de5552af7d..d1620d22a9 100644
--- a/internal/brokers/testdata/golden/TestIsAuthenticated/Error_when_broker_returns_invalid_access
+++ b/internal/brokers/testdata/golden/TestIsAuthenticated/Error_when_broker_returns_invalid_access
@@ -1,4 +1,4 @@
 FIRST CALL:
 	access: 
 	data: 
-	err: invalid access authentication key: invalid
+	err: invalid broker response: "invalid"
diff --git a/internal/brokers/testdata/golden/TestIsAuthenticated/Error_when_calling_IsAuthenticated_a_second_time_without_cancelling b/internal/brokers/testdata/golden/TestIsAuthenticated/Error_when_calling_IsAuthenticated_a_second_time_without_cancelling
index 08b13f8ea7..85cd38ebae 100644
--- a/internal/brokers/testdata/golden/TestIsAuthenticated/Error_when_calling_IsAuthenticated_a_second_time_without_cancelling
+++ b/internal/brokers/testdata/golden/TestIsAuthenticated/Error_when_calling_IsAuthenticated_a_second_time_without_cancelling
@@ -1,6 +1,6 @@
 FIRST CALL:
 	access: granted
-	data: {"Name":"TestIsAuthenticated/Error_when_calling_IsAuthenticated_a_second_time_without_cancelling_separator_ia_second_call","UID":0,"Gecos":"gecos for ia_second_call","Dir":"/home/ia_second_call","Shell":"/bin/sh/ia_second_call","Groups":[{"Name":"group-ia_second_call","GID":null,"UGID":"ugid-ia_second_call"}]}
+	data: {"Name":"ia_second_call@example.com","UID":0,"Gecos":"gecos for ia_second_call@example.com","Dir":"/home/ia_second_call@example.com","Shell":"/bin/sh/ia_second_call@example.com","Groups":[{"Name":"group-ia_second_call@example.com","GID":null,"UGID":"ugid-ia_second_call@example.com"}]}
 	err: <nil>
 SECOND CALL:
 	access: 
diff --git a/internal/brokers/testdata/golden/TestIsAuthenticated/No_error_when_broker_returns_userinfo_with_empty_gecos b/internal/brokers/testdata/golden/TestIsAuthenticated/No_error_when_broker_returns_userinfo_with_empty_gecos
index 9935dc5064..4da9b1bc19 100644
--- a/internal/brokers/testdata/golden/TestIsAuthenticated/No_error_when_broker_returns_userinfo_with_empty_gecos
+++ b/internal/brokers/testdata/golden/TestIsAuthenticated/No_error_when_broker_returns_userinfo_with_empty_gecos
@@ -1,4 +1,4 @@
 FIRST CALL:
 	access: granted
-	data: {"Name":"TestIsAuthenticated/No_error_when_broker_returns_userinfo_with_empty_gecos_separator_ia_info_empty_gecos","UID":0,"Gecos":"","Dir":"/home/ia_info_empty_gecos","Shell":"/bin/sh/ia_info_empty_gecos","Groups":[{"Name":"group-ia_info_empty_gecos","GID":null,"UGID":"ugid-ia_info_empty_gecos"}]}
+	data: {"Name":"ia_info_empty_gecos@example.com","UID":0,"Gecos":"","Dir":"/home/ia_info_empty_gecos@example.com","Shell":"/bin/sh/ia_info_empty_gecos@example.com","Groups":[{"Name":"group-ia_info_empty_gecos@example.com","GID":null,"UGID":"ugid-ia_info_empty_gecos@example.com"}]}
 	err: <nil>
diff --git a/internal/brokers/testdata/golden/TestIsAuthenticated/No_error_when_broker_returns_userinfo_with_group_with_empty_UGID b/internal/brokers/testdata/golden/TestIsAuthenticated/No_error_when_broker_returns_userinfo_with_group_with_empty_UGID
index 465fe734fb..e3343d5e7a 100644
--- a/internal/brokers/testdata/golden/TestIsAuthenticated/No_error_when_broker_returns_userinfo_with_group_with_empty_UGID
+++ b/internal/brokers/testdata/golden/TestIsAuthenticated/No_error_when_broker_returns_userinfo_with_group_with_empty_UGID
@@ -1,4 +1,4 @@
 FIRST CALL:
 	access: granted
-	data: {"Name":"TestIsAuthenticated/No_error_when_broker_returns_userinfo_with_group_with_empty_UGID_separator_ia_info_empty_ugid","UID":0,"Gecos":"gecos for ia_info_empty_ugid","Dir":"/home/ia_info_empty_ugid","Shell":"/bin/sh/ia_info_empty_ugid","Groups":[{"Name":"group-ia_info_empty_ugid","GID":null,"UGID":""}]}
+	data: {"Name":"ia_info_empty_ugid@example.com","UID":0,"Gecos":"gecos for ia_info_empty_ugid@example.com","Dir":"/home/ia_info_empty_ugid@example.com","Shell":"/bin/sh/ia_info_empty_ugid@example.com","Groups":[{"Name":"group-ia_info_empty_ugid@example.com","GID":null,"UGID":""}]}
 	err: <nil>
diff --git a/internal/brokers/testdata/golden/TestIsAuthenticated/No_error_when_broker_returns_userinfo_with_mismatching_username b/internal/brokers/testdata/golden/TestIsAuthenticated/No_error_when_broker_returns_userinfo_with_mismatching_username
index 8d6b55633b..6883f59433 100644
--- a/internal/brokers/testdata/golden/TestIsAuthenticated/No_error_when_broker_returns_userinfo_with_mismatching_username
+++ b/internal/brokers/testdata/golden/TestIsAuthenticated/No_error_when_broker_returns_userinfo_with_mismatching_username
@@ -1,4 +1,4 @@
 FIRST CALL:
 	access: granted
-	data: {"Name":"different_username","UID":0,"Gecos":"gecos for ia_info_mismatching_user_name","Dir":"/home/ia_info_mismatching_user_name","Shell":"/bin/sh/ia_info_mismatching_user_name","Groups":[{"Name":"group-ia_info_mismatching_user_name","GID":null,"UGID":"ugid-ia_info_mismatching_user_name"}]}
+	data: {"Name":"different_username@example.com","UID":0,"Gecos":"gecos for ia_info_mismatching_user_name@example.com","Dir":"/home/ia_info_mismatching_user_name@example.com","Shell":"/bin/sh/ia_info_mismatching_user_name@example.com","Groups":[{"Name":"group-ia_info_mismatching_user_name@example.com","GID":null,"UGID":"ugid-ia_info_mismatching_user_name@example.com"}]}
 	err: <nil>
diff --git a/internal/brokers/testdata/golden/TestIsAuthenticated/Successfully_authenticate b/internal/brokers/testdata/golden/TestIsAuthenticated/Successfully_authenticate
index 4e42881e05..e2d4f94097 100644
--- a/internal/brokers/testdata/golden/TestIsAuthenticated/Successfully_authenticate
+++ b/internal/brokers/testdata/golden/TestIsAuthenticated/Successfully_authenticate
@@ -1,4 +1,4 @@
 FIRST CALL:
 	access: granted
-	data: {"Name":"TestIsAuthenticated/Successfully_authenticate_separator_success","UID":0,"Gecos":"gecos for success","Dir":"/home/success","Shell":"/bin/sh/success","Groups":[{"Name":"group-success","GID":null,"UGID":"ugid-success"}]}
+	data: {"Name":"success@example.com","UID":0,"Gecos":"gecos for success@example.com","Dir":"/home/success@example.com","Shell":"/bin/sh/success@example.com","Groups":[{"Name":"group-success@example.com","GID":null,"UGID":"ugid-success@example.com"}]}
 	err: <nil>
diff --git a/internal/brokers/testdata/golden/TestIsAuthenticated/Successfully_authenticate_after_cancelling_first_call b/internal/brokers/testdata/golden/TestIsAuthenticated/Successfully_authenticate_after_cancelling_first_call
index e85276ef53..84a6f76fcc 100644
--- a/internal/brokers/testdata/golden/TestIsAuthenticated/Successfully_authenticate_after_cancelling_first_call
+++ b/internal/brokers/testdata/golden/TestIsAuthenticated/Successfully_authenticate_after_cancelling_first_call
@@ -4,5 +4,5 @@ FIRST CALL:
 	err: <nil>
 SECOND CALL:
 	access: granted
-	data: {"Name":"TestIsAuthenticated/Successfully_authenticate_after_cancelling_first_call_separator_ia_second_call","UID":0,"Gecos":"gecos for ia_second_call","Dir":"/home/ia_second_call","Shell":"/bin/sh/ia_second_call","Groups":[{"Name":"group-ia_second_call","GID":null,"UGID":"ugid-ia_second_call"}]}
+	data: {"Name":"ia_second_call@example.com","UID":0,"Gecos":"gecos for ia_second_call@example.com","Dir":"/home/ia_second_call@example.com","Shell":"/bin/sh/ia_second_call@example.com","Groups":[{"Name":"group-ia_second_call@example.com","GID":null,"UGID":"ugid-ia_second_call@example.com"}]}
 	err: <nil>
diff --git a/internal/brokers/testdata/golden/TestUserPreCheck/Successfully_pre-check_user b/internal/brokers/testdata/golden/TestUserPreCheck/Successfully_pre-check_user
index f30e55c2f6..5b8ab8cb9a 100644
--- a/internal/brokers/testdata/golden/TestUserPreCheck/Successfully_pre-check_user
+++ b/internal/brokers/testdata/golden/TestUserPreCheck/Successfully_pre-check_user
@@ -1,9 +1,9 @@
 {
-		"name": "user-pre-check",
+		"name": "user-pre-check@example.com",
 		"uuid": "",
-		"gecos": "gecos for user-pre-check",
-		"dir": "/home/user-pre-check",
-		"shell": "/bin/sh/user-pre-check",
-		"avatar": "avatar for user-pre-check",
-		"groups": [ {"name": "group-user-pre-check", "ugid": "ugid-user-pre-check"} ]
+		"gecos": "gecos for user-pre-check@example.com",
+		"dir": "/home/user-pre-check@example.com",
+		"shell": "/bin/sh/user-pre-check@example.com",
+		"avatar": "avatar for user-pre-check@example.com",
+		"groups": [ {"name": "group-user-pre-check@example.com", "ugid": "ugid-user-pre-check@example.com"} ]
 	}
\ No newline at end of file
diff --git a/internal/brokers/withexamples.go b/internal/brokers/withexamples.go
index 30b906696a..e773f8848d 100644
--- a/internal/brokers/withexamples.go
+++ b/internal/brokers/withexamples.go
@@ -6,9 +6,9 @@ import (
 	"context"
 	"os"
 
-	"github.com/ubuntu/authd/examplebroker"
-	"github.com/ubuntu/authd/internal/testutils"
-	"github.com/ubuntu/authd/log"
+	"github.com/canonical/authd/examplebroker"
+	"github.com/canonical/authd/internal/testutils"
+	"github.com/canonical/authd/log"
 )
 
 // useExampleBrokers starts a mock system bus and exports the examplebroker in it.
diff --git a/internal/consts/consts.go b/internal/consts/consts.go
index 2058306f3a..d9c386ae28 100644
--- a/internal/consts/consts.go
+++ b/internal/consts/consts.go
@@ -1,7 +1,7 @@
 // Package consts defines the constants used by the project
 package consts
 
-import log "github.com/ubuntu/authd/log"
+import log "github.com/canonical/authd/log"
 
 var (
 	// Version is the version of the executable.
@@ -24,6 +24,9 @@ const (
 	// DefaultDatabaseDir is the default directory for the database.
 	DefaultDatabaseDir = "/var/lib/authd/"
 
+	// DefaultConfigDir is the default configuration directory.
+	DefaultConfigDir = "/etc/authd/"
+
 	// DefaultDatabaseFileName is the default file name for the database.
 	DefaultDatabaseFileName = "authd.sqlite3"
 
diff --git a/internal/daemon/daemon.go b/internal/daemon/daemon.go
index df6f8f7f00..04d9522a8e 100644
--- a/internal/daemon/daemon.go
+++ b/internal/daemon/daemon.go
@@ -7,10 +7,10 @@ import (
 	"net"
 	"os"
 
+	"github.com/canonical/authd/internal/decorate"
+	"github.com/canonical/authd/log"
 	"github.com/coreos/go-systemd/v22/activation"
 	"github.com/coreos/go-systemd/v22/daemon"
-	"github.com/ubuntu/authd/log"
-	"github.com/ubuntu/decorate"
 	"google.golang.org/grpc"
 )
 
@@ -132,13 +132,12 @@ func (d *Daemon) Serve(ctx context.Context) (err error) {
 // Quit gracefully quits listening loop and stops the grpc server.
 // It can drops any existing connexion is force is true.
 func (d Daemon) Quit(ctx context.Context, force bool) {
-	log.Infof(ctx, "Stopping daemon requested for socket %s.", d.lis.Addr())
 	if force {
 		d.grpcServer.Stop()
 		return
 	}
 
-	log.Info(ctx, "Wait for active requests to close.")
+	log.Info(ctx, "Waiting for pending requests to finish")
 	d.grpcServer.GracefulStop()
-	log.Debug(ctx, "All connections have now ended.")
+	log.Info(ctx, "gRPC server gracefully stopped")
 }
diff --git a/internal/daemon/daemon_test.go b/internal/daemon/daemon_test.go
index 984296820b..941462844a 100644
--- a/internal/daemon/daemon_test.go
+++ b/internal/daemon/daemon_test.go
@@ -10,17 +10,17 @@ import (
 	"testing"
 	"time"
 
+	"github.com/canonical/authd/internal/consts"
+	"github.com/canonical/authd/internal/daemon"
+	"github.com/canonical/authd/internal/daemon/testdata/grpctestservice"
+	"github.com/canonical/authd/internal/grpcutils"
+	"github.com/canonical/authd/internal/services/errmessages"
+	"github.com/canonical/authd/internal/testutils"
 	"github.com/stretchr/testify/require"
-	"github.com/ubuntu/authd/internal/consts"
-	"github.com/ubuntu/authd/internal/daemon"
-	"github.com/ubuntu/authd/internal/daemon/testdata/grpctestservice"
-	"github.com/ubuntu/authd/internal/grpcutils"
-	"github.com/ubuntu/authd/internal/services/errmessages"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/credentials/insecure"
 	"google.golang.org/grpc/health"
 	healthgrpc "google.golang.org/grpc/health/grpc_health_v1"
-	healthpb "google.golang.org/grpc/health/grpc_health_v1"
 )
 
 func TestNew(t *testing.T) {
@@ -204,6 +204,10 @@ func TestServe(t *testing.T) {
 func TestQuit(t *testing.T) {
 	t.Parallel()
 
+	if testing.Short() {
+		t.Skip("skipping test in short mode.")
+	}
+
 	testCases := map[string]struct {
 		force bool
 
@@ -225,7 +229,7 @@ func TestQuit(t *testing.T) {
 				var service testGRPCService
 				grpctestservice.RegisterTestServiceServer(grpcServer, service)
 				hc := health.NewServer()
-				hc.SetServingStatus(consts.ServiceName, healthpb.HealthCheckResponse_SERVING)
+				hc.SetServingStatus(consts.ServiceName, healthgrpc.HealthCheckResponse_SERVING)
 				healthgrpc.RegisterHealthServer(grpcServer, hc)
 				return grpcServer
 			}
@@ -245,7 +249,7 @@ func TestQuit(t *testing.T) {
 			}()
 
 			// make sure Serve() is called. Even std golang grpc has this timeout in tests
-			time.Sleep(100 * time.Millisecond)
+			time.Sleep(testutils.MultipliedSleepDuration(100 * time.Millisecond))
 
 			var disconnectClient func()
 			if tc.activeConnection {
@@ -254,14 +258,14 @@ func TestQuit(t *testing.T) {
 				require.True(t, connected, "new connection should be made allowed")
 			}
 
-			// Request quitting.
-			quiteDone := make(chan struct{})
+			// Request server shutdown
+			shutdownRequested := make(chan struct{})
 			go func() {
-				defer close(quiteDone)
+				defer close(shutdownRequested)
 				d.Quit(context.Background(), tc.force)
 			}()
 
-			time.Sleep(100 * time.Millisecond)
+			time.Sleep(testutils.MultipliedSleepDuration(100 * time.Millisecond))
 
 			// Any new connection is disallowed
 			connected, _ := createClientConnection(t, socketPath)
@@ -269,25 +273,35 @@ func TestQuit(t *testing.T) {
 
 			serverHasQuit := func() bool {
 				select {
-				case _, running := <-quiteDone:
-					return !running
+				case _, ok := <-shutdownRequested:
+					return !ok
 				default:
 					return false
 				}
 			}
 
 			if !tc.activeConnection || tc.force {
-				require.Eventually(t, serverHasQuit, 100*time.Millisecond, 10*time.Millisecond, "Server should quit with no active connection or force")
+				require.Eventually(t,
+					serverHasQuit,
+					testutils.MultipliedSleepDuration(100*time.Millisecond),
+					testutils.MultipliedSleepDuration(10*time.Millisecond),
+					"Server should quit with no active connection or force",
+				)
 				return
 			}
 
-			time.Sleep(100 * time.Millisecond)
+			time.Sleep(testutils.MultipliedSleepDuration(100 * time.Millisecond))
 			require.False(t, serverHasQuit(), "Server should still be running because of active connection and not forced")
 
 			// drop connection
 			disconnectClient()
 
-			require.Eventually(t, serverHasQuit, 100*time.Millisecond, 10*time.Millisecond, "Server should quit with no more active connection")
+			require.Eventually(t,
+				serverHasQuit,
+				testutils.MultipliedSleepDuration(200*time.Millisecond),
+				testutils.MultipliedSleepDuration(10*time.Millisecond),
+				"Server should quit with no more active connection",
+			)
 		})
 	}
 }
diff --git a/internal/daemon/testdata/grpctestservice/grpctestservice.proto b/internal/daemon/testdata/grpctestservice/grpctestservice.proto
index 0dc4a7cf85..d180c3bbc7 100644
--- a/internal/daemon/testdata/grpctestservice/grpctestservice.proto
+++ b/internal/daemon/testdata/grpctestservice/grpctestservice.proto
@@ -1,6 +1,6 @@
 syntax = "proto3";
 
-option go_package = "github.com/ubuntu/authd/internal/daemon/testdata/grpctestservice";
+option go_package = "github.com/canonical/authd/internal/daemon/testdata/grpctestservice";
 
 package grpctestservice;
 
diff --git a/internal/decorate/decorate.go b/internal/decorate/decorate.go
new file mode 100644
index 0000000000..b648f06e4c
--- /dev/null
+++ b/internal/decorate/decorate.go
@@ -0,0 +1,41 @@
+// Package decorate contains various helpers to decorate errors with fewer lines of code in functions.
+package decorate
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/canonical/authd/log"
+)
+
+// OnError prefixes any error with format/args.
+func OnError(err *error, format string, args ...interface{}) {
+	if *err != nil {
+		s := fmt.Sprintf(format, args...)
+		*err = fmt.Errorf("%s: %w", s, *err)
+	}
+}
+
+// LogOnError logs only any errors without failing.
+func LogOnError(err error) {
+	LogOnErrorContext(context.Background(), err)
+}
+
+// LogOnErrorContext logs any errors without failing. It takes a context.
+func LogOnErrorContext(ctx context.Context, err error) {
+	if err != nil {
+		log.Warning(ctx, err)
+	}
+}
+
+// LogFuncOnError logs only any errors returned by f without failing.
+func LogFuncOnError(f func() error) {
+	LogFuncOnErrorContext(context.Background(), f)
+}
+
+// LogFuncOnErrorContext logs only error returned by f without failing. It takes a context.
+func LogFuncOnErrorContext(ctx context.Context, f func() error) {
+	if err := f(); err != nil {
+		log.Warning(ctx, err)
+	}
+}
diff --git a/internal/errno/errno_c.go b/internal/errno/errno_c.go
index ccc0e2eea2..1c00409a6a 100644
--- a/internal/errno/errno_c.go
+++ b/internal/errno/errno_c.go
@@ -36,6 +36,8 @@ const (
 	ErrBadf Error = C.EBADF
 	// ErrPerm is the errno EPERM.
 	ErrPerm Error = C.EPERM
+	// ErrIntr is the errno EINTR.
+	ErrIntr Error = C.EINTR
 )
 
 // All these functions are expected to be called while this mutex is locked.
diff --git a/internal/errno/errno_c_test.go b/internal/errno/errno_c_test.go
index e959699e36..e8f95e03d0 100644
--- a/internal/errno/errno_c_test.go
+++ b/internal/errno/errno_c_test.go
@@ -4,8 +4,8 @@ import (
 	"errors"
 	"testing"
 
+	"github.com/canonical/authd/internal/errno"
 	"github.com/stretchr/testify/require"
-	"github.com/ubuntu/authd/internal/errno"
 )
 
 func TestNoError(t *testing.T) {
diff --git a/internal/fileutils/fileutils.go b/internal/fileutils/fileutils.go
index d7f5f8815c..c401915315 100644
--- a/internal/fileutils/fileutils.go
+++ b/internal/fileutils/fileutils.go
@@ -5,8 +5,12 @@ import (
 	"errors"
 	"fmt"
 	"io"
+	"io/fs"
 	"os"
 	"path/filepath"
+	"syscall"
+
+	"golang.org/x/sys/unix"
 )
 
 // FileExists checks if a file exists at the given path.
@@ -103,3 +107,94 @@ func Lrename(oldPath, newPath string) error {
 
 	return os.Rename(oldPath, newPath)
 }
+
+// LockDir creates a lock file in the specified directory and acquires an exclusive lock on it.
+// It blocks until the lock is available and returns an unlock function to release the lock.
+func LockDir(dir string) (func() error, error) {
+	lockPath := filepath.Join(dir, ".lock")
+	f, err := os.OpenFile(lockPath, os.O_CREATE|os.O_RDWR, 0600)
+	if err != nil {
+		return nil, err
+	}
+
+	//nolint:gosec // G115 - file descriptors are small non-negative integers; uintptr→int is safe here.
+	if err := unix.Flock(int(f.Fd()), unix.LOCK_EX); err != nil {
+		_ = f.Close()
+		return nil, err
+	}
+
+	unlock := func() error {
+		//nolint:gosec // G115 - file descriptors are small non-negative integers; uintptr→int is safe here.
+		if err := unix.Flock(int(f.Fd()), unix.LOCK_UN); err != nil {
+			_ = f.Close()
+			return err
+		}
+		return f.Close()
+	}
+
+	return unlock, nil
+}
+
+// ChownUIDArgs is used to specify the UID to change ownership from and to.
+type ChownUIDArgs struct {
+	FromUID uint32
+	ToUID   uint32
+}
+
+// ChownGIDArgs is used to specify the GID to change group ownership from and to.
+type ChownGIDArgs struct {
+	FromGID uint32
+	ToGID   uint32
+}
+
+// ChownRecursiveFrom changes ownership of files and directories under the
+// specified root directory from the current UID/GID (fromUID, fromGID) to the
+// new UID/GID (toUID, toGID).
+//
+// It mirrors the behavior of chown_tree from shadow-utils:
+// https://github.com/shadow-maint/shadow/blob/e7ccd3df6845c184d155a2dd573f52d239c94337/lib/chowndir.c#L129-L141
+//
+// Symlinks are not followed.
+//
+// If uidArgs/gidArgs is nil, change of ownership for UID/GID is skipped.
+// If both uidArgs and gidArgs are nil, an error is returned.
+func ChownRecursiveFrom(root string, uidArgs *ChownUIDArgs, gidArgs *ChownGIDArgs) error {
+	if uidArgs == nil && gidArgs == nil {
+		return fmt.Errorf("ChownRecursiveFrom: at least one of uidArgs or gidArgs must be non-nil")
+	}
+
+	r, err := os.OpenRoot(root)
+	if err != nil {
+		return err
+	}
+	defer r.Close()
+
+	return fs.WalkDir(r.FS(), ".", func(path string, d fs.DirEntry, err error) error {
+		if err != nil {
+			return err
+		}
+
+		info, err := d.Info()
+		if err != nil {
+			return err
+		}
+		stat, ok := info.Sys().(*syscall.Stat_t)
+		if !ok {
+			return fmt.Errorf("failed to get raw stat for %q", path)
+		}
+
+		if uidArgs != nil && stat.Uid == uidArgs.FromUID {
+			if err := r.Lchown(path, int(uidArgs.ToUID), -1); err != nil {
+				return fmt.Errorf("failed to change ownership: %w", err)
+			}
+		}
+
+		if gidArgs != nil && stat.Gid == gidArgs.FromGID {
+			if err := r.Lchown(path, -1, int(gidArgs.ToGID)); err != nil {
+				return fmt.Errorf("failed to change group ownership: %w", err)
+			}
+		}
+
+		return nil
+	})
+}
diff --git a/internal/fileutils/fileutils_test.go b/internal/fileutils/fileutils_test.go
index ddfebe7a3c..48676267ae 100644
--- a/internal/fileutils/fileutils_test.go
+++ b/internal/fileutils/fileutils_test.go
@@ -2,13 +2,19 @@ package fileutils_test
 
 import (
 	"errors"
+	"fmt"
 	"os"
+	"os/exec"
 	"path/filepath"
+	"syscall"
 	"testing"
+	"time"
 
+	"github.com/canonical/authd/internal/fileutils"
+	"github.com/canonical/authd/internal/testutils"
+	"github.com/canonical/authd/internal/testutils/golden"
 	"github.com/google/uuid"
 	"github.com/stretchr/testify/require"
-	"github.com/ubuntu/authd/internal/fileutils"
 )
 
 // errAny represents any error type, for testing purposes.
@@ -352,3 +358,217 @@ func TestLrename(t *testing.T) {
 		})
 	}
 }
+
+func TestLockDir(t *testing.T) {
+	t.Parallel()
+
+	tempDir := t.TempDir()
+
+	// First lock should succeed
+	t.Log("Acquiring first lock")
+	unlock, err := fileutils.LockDir(tempDir)
+	require.NoError(t, err, "LockDir should not return an error")
+
+	// Second lock should block, so we run it in a goroutine and check it doesn't return immediately
+	unlockCh := make(chan func() error, 1)
+	go func() {
+		t.Log("Acquiring second lock (should block)")
+		unlock2, err := fileutils.LockDir(tempDir)
+		t.Logf("Second LockDir returned with error: %v", err)
+		unlockCh <- unlock2
+	}()
+	select {
+	case <-unlockCh:
+		require.Fail(t, "LockDir should block when trying to lock an already locked directory")
+	case <-time.After(testutils.MultipliedSleepDuration(100 * time.Millisecond)):
+		// Expected behavior, LockDir is blocking
+	}
+
+	// Unlock the first lock
+	t.Log("Releasing first lock")
+	err = unlock()
+	require.NoError(t, err, "Unlock should not return an error")
+
+	// Now we should be able to acquire the lock again
+	select {
+	case unlock = <-unlockCh:
+		// Expected behavior, LockDir returned after the first lock was released
+		t.Log("Releasing lock")
+		err = unlock()
+		require.NoError(t, err, "Unlock should not return an error")
+	case <-time.After(testutils.MultipliedSleepDuration(5 * time.Second)):
+		require.Fail(t, "LockDir should have returned after the first lock was released")
+	}
+}
+
+func TestChownRecursiveFrom(t *testing.T) {
+	t.Parallel()
+
+	tests := map[string]struct {
+		uidArgs            *fileutils.ChownUIDArgs
+		gidArgs            *fileutils.ChownGIDArgs
+		readOnlyFilesystem bool
+		rootDoesNotExist   bool
+		fileUID            uint32
+		fileGID            uint32
+		dirUID             uint32
+		dirGID             uint32
+
+		wantError      bool
+		wantErrorMatch string
+	}{
+		"Successfully_change_owner": {
+			uidArgs: &fileutils.ChownUIDArgs{FromUID: 0, ToUID: 1},
+		},
+		"Successfully_change_group": {
+			gidArgs: &fileutils.ChownGIDArgs{FromGID: 0, ToGID: 1},
+		},
+		"Successfully_change_owner_and_group": {
+			uidArgs: &fileutils.ChownUIDArgs{FromUID: 0, ToUID: 1},
+			gidArgs: &fileutils.ChownGIDArgs{FromGID: 0, ToGID: 1},
+		},
+		"Group_not_changed_when_GID_does_not_match": {
+			uidArgs: &fileutils.ChownUIDArgs{FromUID: 0, ToUID: 1},
+			gidArgs: &fileutils.ChownGIDArgs{FromGID: 2, ToGID: 1},
+		},
+		"Owner_not_changed_when_UID_does_not_match": {
+			uidArgs: &fileutils.ChownUIDArgs{FromUID: 2, ToUID: 1},
+			gidArgs: &fileutils.ChownGIDArgs{FromGID: 0, ToGID: 1},
+		},
+		"Change_only_the_file_owner": {
+			uidArgs: &fileutils.ChownUIDArgs{FromUID: 2, ToUID: 1},
+			gidArgs: &fileutils.ChownGIDArgs{FromGID: 2, ToGID: 1},
+			fileUID: 2,
+		},
+		"Change_only_the_file_group": {
+			uidArgs: &fileutils.ChownUIDArgs{FromUID: 2, ToUID: 1},
+			gidArgs: &fileutils.ChownGIDArgs{FromGID: 2, ToGID: 1},
+			fileGID: 2,
+		},
+		"Change_only_the_file_owner_and_group": {
+			uidArgs: &fileutils.ChownUIDArgs{FromUID: 2, ToUID: 1},
+			gidArgs: &fileutils.ChownGIDArgs{FromGID: 2, ToGID: 1},
+			fileUID: 2,
+			fileGID: 2,
+		},
+		"Change_only_the_directory_owner": {
+			uidArgs: &fileutils.ChownUIDArgs{FromUID: 2, ToUID: 1},
+			gidArgs: &fileutils.ChownGIDArgs{FromGID: 2, ToGID: 1},
+			dirUID:  2,
+		},
+		"Change_only_the_directory_group": {
+			uidArgs: &fileutils.ChownUIDArgs{FromUID: 2, ToUID: 1},
+			gidArgs: &fileutils.ChownGIDArgs{FromGID: 2, ToGID: 1},
+			dirGID:  2,
+		},
+		"Change_only_the_directory_owner_and_group": {
+			uidArgs: &fileutils.ChownUIDArgs{FromUID: 2, ToUID: 1},
+			gidArgs: &fileutils.ChownGIDArgs{FromGID: 2, ToGID: 1},
+			dirUID:  2,
+			dirGID:  2,
+		},
+		"No_change_if_ownership_is_same_as_current": {
+			uidArgs: &fileutils.ChownUIDArgs{FromUID: 2, ToUID: 0},
+			gidArgs: &fileutils.ChownGIDArgs{FromGID: 2, ToGID: 0},
+		},
+		"No_change_if_no_file_matches_fromUID": {
+			uidArgs: &fileutils.ChownUIDArgs{FromUID: 1, ToUID: 0},
+		},
+		"No_change_if_no_file_matches_fromGID": {
+			gidArgs: &fileutils.ChownGIDArgs{FromGID: 1, ToGID: 0},
+		},
+
+		"Error_if_UID_args_and_GID_args_are_both_nil": {
+			wantError: true, wantErrorMatch: "at least one of uidArgs or gidArgs must be non-nil",
+		},
+		"Error_when_filesystem_is_read_only": {
+			uidArgs:            &fileutils.ChownUIDArgs{FromUID: 0, ToUID: 1},
+			readOnlyFilesystem: true, wantError: true, wantErrorMatch: "read-only file system",
+		},
+		"Error_when_root_does_not_exist": {
+			uidArgs:          &fileutils.ChownUIDArgs{FromUID: 0, ToUID: 1},
+			rootDoesNotExist: true, wantError: true, wantErrorMatch: "no such file or directory",
+		},
+	}
+	for name, tc := range tests {
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			if !testutils.RunningInBubblewrap() {
+				testutils.RunTestInBubbleWrap(t)
+				return
+			}
+
+			tempDir := testutils.TempDir(t)
+			targetDir := filepath.Join(tempDir, "dir")
+			subDir := filepath.Join(targetDir, "subdir")
+			filePath := filepath.Join(subDir, "file")
+			err := os.MkdirAll(subDir, 0o700)
+			require.NoError(t, err)
+			err = fileutils.Touch(filePath)
+			require.NoError(t, err)
+			err = os.Chown(targetDir, int(tc.dirUID), int(tc.dirGID))
+			require.NoError(t, err)
+			err = os.Chown(subDir, int(tc.dirUID), int(tc.dirGID))
+			require.NoError(t, err)
+			err = os.Chown(filePath, int(tc.fileUID), int(tc.fileGID))
+			require.NoError(t, err)
+
+			symlinkTarget := filepath.Join(tempDir, "symlink_target")
+			err = fileutils.Touch(symlinkTarget)
+			require.NoError(t, err)
+			symlink := filepath.Join(targetDir, "symlink")
+			err = os.Symlink(symlinkTarget, symlink)
+			require.NoError(t, err)
+
+			root := targetDir
+			if tc.rootDoesNotExist {
+				root = filepath.Join(tempDir, "nonexistent_dir")
+			}
+
+			if tc.readOnlyFilesystem {
+				//nolint:gosec // G204 it's safe to use exec.Command with a variable here
+				cmd := exec.Command("mount", "--read-only", "-t", "tmpfs", "tmpfs", targetDir)
+				cmd.Stderr = os.Stderr
+				err = cmd.Run()
+				require.NoError(t, err)
+				defer func() {
+					//nolint:gosec // G204 it's safe to use exec.Command with a variable here
+					cmd := exec.Command("umount", targetDir)
+					cmd.Stderr = os.Stderr
+					_ = cmd.Run()
+				}()
+			}
+
+			err = fileutils.ChownRecursiveFrom(root, tc.uidArgs, tc.gidArgs)
+			t.Logf("ChownRecursiveFrom error: %v", err)
+			if tc.wantError {
+				require.Error(t, err)
+				require.Contains(t, err.Error(), tc.wantErrorMatch)
+				return
+			}
+			require.NoError(t, err)
+
+			// The symlink target should not be changed
+			fileInfo, err := os.Stat(symlinkTarget)
+			require.NoError(t, err)
+			stat, ok := fileInfo.Sys().(*syscall.Stat_t)
+			require.True(t, ok, "File should have a syscall.Stat_t")
+			require.Equal(t, uint32(0), stat.Uid, "Symlink target UID should not have changed")
+			require.Equal(t, uint32(0), stat.Gid, "Symlink target GID should not have changed")
+
+			// Check ownership
+			var s string
+			for _, f := range []string{targetDir, subDir, filePath} {
+				fileInfo, err := os.Stat(f)
+				require.NoError(t, err)
+				stat, ok := fileInfo.Sys().(*syscall.Stat_t)
+				require.True(t, ok, "File should have a syscall.Stat_t")
+				relPath, err := filepath.Rel(tempDir, f)
+				require.NoError(t, err)
+				s += fmt.Sprintf("%s: %d:%d\n", relPath, stat.Uid, stat.Gid)
+			}
+			golden.CheckOrUpdate(t, s)
+		})
+	}
+}
diff --git a/internal/fileutils/testdata/golden/TestChownRecursiveFrom/Change_only_the_directory_group b/internal/fileutils/testdata/golden/TestChownRecursiveFrom/Change_only_the_directory_group
new file mode 100644
index 0000000000..7608bf62c6
--- /dev/null
+++ b/internal/fileutils/testdata/golden/TestChownRecursiveFrom/Change_only_the_directory_group
@@ -0,0 +1,3 @@
+dir: 0:1
+dir/subdir: 0:1
+dir/subdir/file: 0:0
diff --git a/internal/fileutils/testdata/golden/TestChownRecursiveFrom/Change_only_the_directory_owner b/internal/fileutils/testdata/golden/TestChownRecursiveFrom/Change_only_the_directory_owner
new file mode 100644
index 0000000000..17fe7d57a2
--- /dev/null
+++ b/internal/fileutils/testdata/golden/TestChownRecursiveFrom/Change_only_the_directory_owner
@@ -0,0 +1,3 @@
+dir: 1:0
+dir/subdir: 1:0
+dir/subdir/file: 0:0
diff --git a/internal/fileutils/testdata/golden/TestChownRecursiveFrom/Change_only_the_directory_owner_and_group b/internal/fileutils/testdata/golden/TestChownRecursiveFrom/Change_only_the_directory_owner_and_group
new file mode 100644
index 0000000000..83296d7a12
--- /dev/null
+++ b/internal/fileutils/testdata/golden/TestChownRecursiveFrom/Change_only_the_directory_owner_and_group
@@ -0,0 +1,3 @@
+dir: 1:1
+dir/subdir: 1:1
+dir/subdir/file: 0:0
diff --git a/internal/fileutils/testdata/golden/TestChownRecursiveFrom/Change_only_the_file_group b/internal/fileutils/testdata/golden/TestChownRecursiveFrom/Change_only_the_file_group
new file mode 100644
index 0000000000..aaf51617f1
--- /dev/null
+++ b/internal/fileutils/testdata/golden/TestChownRecursiveFrom/Change_only_the_file_group
@@ -0,0 +1,3 @@
+dir: 0:0
+dir/subdir: 0:0
+dir/subdir/file: 0:1
diff --git a/internal/fileutils/testdata/golden/TestChownRecursiveFrom/Change_only_the_file_owner b/internal/fileutils/testdata/golden/TestChownRecursiveFrom/Change_only_the_file_owner
new file mode 100644
index 0000000000..b86045e63f
--- /dev/null
+++ b/internal/fileutils/testdata/golden/TestChownRecursiveFrom/Change_only_the_file_owner
@@ -0,0 +1,3 @@
+dir: 0:0
+dir/subdir: 0:0
+dir/subdir/file: 1:0
diff --git a/internal/fileutils/testdata/golden/TestChownRecursiveFrom/Change_only_the_file_owner_and_group b/internal/fileutils/testdata/golden/TestChownRecursiveFrom/Change_only_the_file_owner_and_group
new file mode 100644
index 0000000000..5f56fccb03
--- /dev/null
+++ b/internal/fileutils/testdata/golden/TestChownRecursiveFrom/Change_only_the_file_owner_and_group
@@ -0,0 +1,3 @@
+dir: 0:0
+dir/subdir: 0:0
+dir/subdir/file: 1:1
diff --git a/internal/fileutils/testdata/golden/TestChownRecursiveFrom/Group_not_changed_when_GID_does_not_match b/internal/fileutils/testdata/golden/TestChownRecursiveFrom/Group_not_changed_when_GID_does_not_match
new file mode 100644
index 0000000000..c30b0b1127
--- /dev/null
+++ b/internal/fileutils/testdata/golden/TestChownRecursiveFrom/Group_not_changed_when_GID_does_not_match
@@ -0,0 +1,3 @@
+dir: 1:0
+dir/subdir: 1:0
+dir/subdir/file: 1:0
diff --git a/internal/fileutils/testdata/golden/TestChownRecursiveFrom/No_change_if_no_file_matches_fromGID b/internal/fileutils/testdata/golden/TestChownRecursiveFrom/No_change_if_no_file_matches_fromGID
new file mode 100644
index 0000000000..54ea53452b
--- /dev/null
+++ b/internal/fileutils/testdata/golden/TestChownRecursiveFrom/No_change_if_no_file_matches_fromGID
@@ -0,0 +1,3 @@
+dir: 0:0
+dir/subdir: 0:0
+dir/subdir/file: 0:0
diff --git a/internal/fileutils/testdata/golden/TestChownRecursiveFrom/No_change_if_no_file_matches_fromUID b/internal/fileutils/testdata/golden/TestChownRecursiveFrom/No_change_if_no_file_matches_fromUID
new file mode 100644
index 0000000000..54ea53452b
--- /dev/null
+++ b/internal/fileutils/testdata/golden/TestChownRecursiveFrom/No_change_if_no_file_matches_fromUID
@@ -0,0 +1,3 @@
+dir: 0:0
+dir/subdir: 0:0
+dir/subdir/file: 0:0
diff --git a/internal/fileutils/testdata/golden/TestChownRecursiveFrom/No_change_if_ownership_is_same_as_current b/internal/fileutils/testdata/golden/TestChownRecursiveFrom/No_change_if_ownership_is_same_as_current
new file mode 100644
index 0000000000..54ea53452b
--- /dev/null
+++ b/internal/fileutils/testdata/golden/TestChownRecursiveFrom/No_change_if_ownership_is_same_as_current
@@ -0,0 +1,3 @@
+dir: 0:0
+dir/subdir: 0:0
+dir/subdir/file: 0:0
diff --git a/internal/fileutils/testdata/golden/TestChownRecursiveFrom/Owner_not_changed_when_UID_does_not_match b/internal/fileutils/testdata/golden/TestChownRecursiveFrom/Owner_not_changed_when_UID_does_not_match
new file mode 100644
index 0000000000..82dc505efc
--- /dev/null
+++ b/internal/fileutils/testdata/golden/TestChownRecursiveFrom/Owner_not_changed_when_UID_does_not_match
@@ -0,0 +1,3 @@
+dir: 0:1
+dir/subdir: 0:1
+dir/subdir/file: 0:1
diff --git a/internal/fileutils/testdata/golden/TestChownRecursiveFrom/Successfully_change_group b/internal/fileutils/testdata/golden/TestChownRecursiveFrom/Successfully_change_group
new file mode 100644
index 0000000000..82dc505efc
--- /dev/null
+++ b/internal/fileutils/testdata/golden/TestChownRecursiveFrom/Successfully_change_group
@@ -0,0 +1,3 @@
+dir: 0:1
+dir/subdir: 0:1
+dir/subdir/file: 0:1
diff --git a/internal/fileutils/testdata/golden/TestChownRecursiveFrom/Successfully_change_owner b/internal/fileutils/testdata/golden/TestChownRecursiveFrom/Successfully_change_owner
new file mode 100644
index 0000000000..c30b0b1127
--- /dev/null
+++ b/internal/fileutils/testdata/golden/TestChownRecursiveFrom/Successfully_change_owner
@@ -0,0 +1,3 @@
+dir: 1:0
+dir/subdir: 1:0
+dir/subdir/file: 1:0
diff --git a/internal/fileutils/testdata/golden/TestChownRecursiveFrom/Successfully_change_owner_and_group b/internal/fileutils/testdata/golden/TestChownRecursiveFrom/Successfully_change_owner_and_group
new file mode 100644
index 0000000000..fe8a889e6b
--- /dev/null
+++ b/internal/fileutils/testdata/golden/TestChownRecursiveFrom/Successfully_change_owner_and_group
@@ -0,0 +1,3 @@
+dir: 1:1
+dir/subdir: 1:1
+dir/subdir/file: 1:1
diff --git a/internal/grpcutils/grpcutils.go b/internal/grpcutils/grpcutils.go
index ee001c968b..b0c691bdd9 100644
--- a/internal/grpcutils/grpcutils.go
+++ b/internal/grpcutils/grpcutils.go
@@ -6,8 +6,8 @@ import (
 	"fmt"
 	"time"
 
-	"github.com/ubuntu/authd/internal/consts"
-	"github.com/ubuntu/authd/log"
+	"github.com/canonical/authd/internal/consts"
+	"github.com/canonical/authd/log"
 	"google.golang.org/grpc"
 	healthgrpc "google.golang.org/grpc/health/grpc_health_v1"
 )
diff --git a/internal/proto/authd/authd.pb.go b/internal/proto/authd/authd.pb.go
index 3c619673b2..556a17b4ac 100644
--- a/internal/proto/authd/authd.pb.go
+++ b/internal/proto/authd/authd.pb.go
@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.5
-// 	protoc        v5.29.0
+// 	protoc-gen-go v1.36.10
+// 	protoc        v6.33.1
 // source: authd.proto
 
 package authd
@@ -993,6 +993,94 @@ func (x *GetUserByIDRequest) GetId() uint32 {
 	return 0
 }
 
+type LockUserRequest struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Name          string                 `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *LockUserRequest) Reset() {
+	*x = LockUserRequest{}
+	mi := &file_authd_proto_msgTypes[18]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *LockUserRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*LockUserRequest) ProtoMessage() {}
+
+func (x *LockUserRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_authd_proto_msgTypes[18]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use LockUserRequest.ProtoReflect.Descriptor instead.
+func (*LockUserRequest) Descriptor() ([]byte, []int) {
+	return file_authd_proto_rawDescGZIP(), []int{18}
+}
+
+func (x *LockUserRequest) GetName() string {
+	if x != nil {
+		return x.Name
+	}
+	return ""
+}
+
+type UnlockUserRequest struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Name          string                 `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *UnlockUserRequest) Reset() {
+	*x = UnlockUserRequest{}
+	mi := &file_authd_proto_msgTypes[19]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *UnlockUserRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*UnlockUserRequest) ProtoMessage() {}
+
+func (x *UnlockUserRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_authd_proto_msgTypes[19]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use UnlockUserRequest.ProtoReflect.Descriptor instead.
+func (*UnlockUserRequest) Descriptor() ([]byte, []int) {
+	return file_authd_proto_rawDescGZIP(), []int{19}
+}
+
+func (x *UnlockUserRequest) GetName() string {
+	if x != nil {
+		return x.Name
+	}
+	return ""
+}
+
 type GetGroupByNameRequest struct {
 	state         protoimpl.MessageState `protogen:"open.v1"`
 	Name          string                 `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
@@ -1002,7 +1090,7 @@ type GetGroupByNameRequest struct {
 
 func (x *GetGroupByNameRequest) Reset() {
 	*x = GetGroupByNameRequest{}
-	mi := &file_authd_proto_msgTypes[18]
+	mi := &file_authd_proto_msgTypes[20]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1014,7 +1102,7 @@ func (x *GetGroupByNameRequest) String() string {
 func (*GetGroupByNameRequest) ProtoMessage() {}
 
 func (x *GetGroupByNameRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_authd_proto_msgTypes[18]
+	mi := &file_authd_proto_msgTypes[20]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1027,7 +1115,7 @@ func (x *GetGroupByNameRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use GetGroupByNameRequest.ProtoReflect.Descriptor instead.
 func (*GetGroupByNameRequest) Descriptor() ([]byte, []int) {
-	return file_authd_proto_rawDescGZIP(), []int{18}
+	return file_authd_proto_rawDescGZIP(), []int{20}
 }
 
 func (x *GetGroupByNameRequest) GetName() string {
@@ -1046,7 +1134,7 @@ type GetGroupByIDRequest struct {
 
 func (x *GetGroupByIDRequest) Reset() {
 	*x = GetGroupByIDRequest{}
-	mi := &file_authd_proto_msgTypes[19]
+	mi := &file_authd_proto_msgTypes[21]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1058,7 +1146,7 @@ func (x *GetGroupByIDRequest) String() string {
 func (*GetGroupByIDRequest) ProtoMessage() {}
 
 func (x *GetGroupByIDRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_authd_proto_msgTypes[19]
+	mi := &file_authd_proto_msgTypes[21]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1071,7 +1159,7 @@ func (x *GetGroupByIDRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use GetGroupByIDRequest.ProtoReflect.Descriptor instead.
 func (*GetGroupByIDRequest) Descriptor() ([]byte, []int) {
-	return file_authd_proto_rawDescGZIP(), []int{19}
+	return file_authd_proto_rawDescGZIP(), []int{21}
 }
 
 func (x *GetGroupByIDRequest) GetId() uint32 {
@@ -1081,6 +1169,250 @@ func (x *GetGroupByIDRequest) GetId() uint32 {
 	return 0
 }
 
+type SetUserIDRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	Name  string                 `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
+	Id    uint32                 `protobuf:"varint,2,opt,name=id,proto3" json:"id,omitempty"`
+	// The language to use for any warnings returned.
+	// Note: This is currently not implemented and warnings are always in English.
+	Lang          string `protobuf:"bytes,3,opt,name=lang,proto3" json:"lang,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *SetUserIDRequest) Reset() {
+	*x = SetUserIDRequest{}
+	mi := &file_authd_proto_msgTypes[22]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *SetUserIDRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*SetUserIDRequest) ProtoMessage() {}
+
+func (x *SetUserIDRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_authd_proto_msgTypes[22]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use SetUserIDRequest.ProtoReflect.Descriptor instead.
+func (*SetUserIDRequest) Descriptor() ([]byte, []int) {
+	return file_authd_proto_rawDescGZIP(), []int{22}
+}
+
+func (x *SetUserIDRequest) GetName() string {
+	if x != nil {
+		return x.Name
+	}
+	return ""
+}
+
+func (x *SetUserIDRequest) GetId() uint32 {
+	if x != nil {
+		return x.Id
+	}
+	return 0
+}
+
+func (x *SetUserIDRequest) GetLang() string {
+	if x != nil {
+		return x.Lang
+	}
+	return ""
+}
+
+type SetUserIDResponse struct {
+	state               protoimpl.MessageState `protogen:"open.v1"`
+	IdChanged           bool                   `protobuf:"varint,1,opt,name=id_changed,json=idChanged,proto3" json:"id_changed,omitempty"`
+	HomeDirOwnerChanged bool                   `protobuf:"varint,2,opt,name=home_dir_owner_changed,json=homeDirOwnerChanged,proto3" json:"home_dir_owner_changed,omitempty"`
+	Warnings            []string               `protobuf:"bytes,3,rep,name=warnings,proto3" json:"warnings,omitempty"`
+	unknownFields       protoimpl.UnknownFields
+	sizeCache           protoimpl.SizeCache
+}
+
+func (x *SetUserIDResponse) Reset() {
+	*x = SetUserIDResponse{}
+	mi := &file_authd_proto_msgTypes[23]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *SetUserIDResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*SetUserIDResponse) ProtoMessage() {}
+
+func (x *SetUserIDResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_authd_proto_msgTypes[23]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use SetUserIDResponse.ProtoReflect.Descriptor instead.
+func (*SetUserIDResponse) Descriptor() ([]byte, []int) {
+	return file_authd_proto_rawDescGZIP(), []int{23}
+}
+
+func (x *SetUserIDResponse) GetIdChanged() bool {
+	if x != nil {
+		return x.IdChanged
+	}
+	return false
+}
+
+func (x *SetUserIDResponse) GetHomeDirOwnerChanged() bool {
+	if x != nil {
+		return x.HomeDirOwnerChanged
+	}
+	return false
+}
+
+func (x *SetUserIDResponse) GetWarnings() []string {
+	if x != nil {
+		return x.Warnings
+	}
+	return nil
+}
+
+type SetGroupIDRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	Name  string                 `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
+	Id    uint32                 `protobuf:"varint,2,opt,name=id,proto3" json:"id,omitempty"`
+	// The language to use for any warnings returned.
+	// Note: This is currently not implemented and warnings are always in English.
+	Lang          string `protobuf:"bytes,3,opt,name=lang,proto3" json:"lang,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *SetGroupIDRequest) Reset() {
+	*x = SetGroupIDRequest{}
+	mi := &file_authd_proto_msgTypes[24]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *SetGroupIDRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*SetGroupIDRequest) ProtoMessage() {}
+
+func (x *SetGroupIDRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_authd_proto_msgTypes[24]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use SetGroupIDRequest.ProtoReflect.Descriptor instead.
+func (*SetGroupIDRequest) Descriptor() ([]byte, []int) {
+	return file_authd_proto_rawDescGZIP(), []int{24}
+}
+
+func (x *SetGroupIDRequest) GetName() string {
+	if x != nil {
+		return x.Name
+	}
+	return ""
+}
+
+func (x *SetGroupIDRequest) GetId() uint32 {
+	if x != nil {
+		return x.Id
+	}
+	return 0
+}
+
+func (x *SetGroupIDRequest) GetLang() string {
+	if x != nil {
+		return x.Lang
+	}
+	return ""
+}
+
+type SetGroupIDResponse struct {
+	state               protoimpl.MessageState `protogen:"open.v1"`
+	IdChanged           bool                   `protobuf:"varint,1,opt,name=id_changed,json=idChanged,proto3" json:"id_changed,omitempty"`
+	HomeDirOwnerChanged bool                   `protobuf:"varint,2,opt,name=home_dir_owner_changed,json=homeDirOwnerChanged,proto3" json:"home_dir_owner_changed,omitempty"`
+	Warnings            []string               `protobuf:"bytes,3,rep,name=warnings,proto3" json:"warnings,omitempty"`
+	unknownFields       protoimpl.UnknownFields
+	sizeCache           protoimpl.SizeCache
+}
+
+func (x *SetGroupIDResponse) Reset() {
+	*x = SetGroupIDResponse{}
+	mi := &file_authd_proto_msgTypes[25]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *SetGroupIDResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*SetGroupIDResponse) ProtoMessage() {}
+
+func (x *SetGroupIDResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_authd_proto_msgTypes[25]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use SetGroupIDResponse.ProtoReflect.Descriptor instead.
+func (*SetGroupIDResponse) Descriptor() ([]byte, []int) {
+	return file_authd_proto_rawDescGZIP(), []int{25}
+}
+
+func (x *SetGroupIDResponse) GetIdChanged() bool {
+	if x != nil {
+		return x.IdChanged
+	}
+	return false
+}
+
+func (x *SetGroupIDResponse) GetHomeDirOwnerChanged() bool {
+	if x != nil {
+		return x.HomeDirOwnerChanged
+	}
+	return false
+}
+
+func (x *SetGroupIDResponse) GetWarnings() []string {
+	if x != nil {
+		return x.Warnings
+	}
+	return nil
+}
+
 type User struct {
 	state         protoimpl.MessageState `protogen:"open.v1"`
 	Name          string                 `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
@@ -1095,7 +1427,7 @@ type User struct {
 
 func (x *User) Reset() {
 	*x = User{}
-	mi := &file_authd_proto_msgTypes[20]
+	mi := &file_authd_proto_msgTypes[26]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1107,7 +1439,7 @@ func (x *User) String() string {
 func (*User) ProtoMessage() {}
 
 func (x *User) ProtoReflect() protoreflect.Message {
-	mi := &file_authd_proto_msgTypes[20]
+	mi := &file_authd_proto_msgTypes[26]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1120,7 +1452,7 @@ func (x *User) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use User.ProtoReflect.Descriptor instead.
 func (*User) Descriptor() ([]byte, []int) {
-	return file_authd_proto_rawDescGZIP(), []int{20}
+	return file_authd_proto_rawDescGZIP(), []int{26}
 }
 
 func (x *User) GetName() string {
@@ -1174,7 +1506,7 @@ type Users struct {
 
 func (x *Users) Reset() {
 	*x = Users{}
-	mi := &file_authd_proto_msgTypes[21]
+	mi := &file_authd_proto_msgTypes[27]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1186,7 +1518,7 @@ func (x *Users) String() string {
 func (*Users) ProtoMessage() {}
 
 func (x *Users) ProtoReflect() protoreflect.Message {
-	mi := &file_authd_proto_msgTypes[21]
+	mi := &file_authd_proto_msgTypes[27]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1199,7 +1531,7 @@ func (x *Users) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use Users.ProtoReflect.Descriptor instead.
 func (*Users) Descriptor() ([]byte, []int) {
-	return file_authd_proto_rawDescGZIP(), []int{21}
+	return file_authd_proto_rawDescGZIP(), []int{27}
 }
 
 func (x *Users) GetUsers() []*User {
@@ -1222,7 +1554,7 @@ type Group struct {
 
 func (x *Group) Reset() {
 	*x = Group{}
-	mi := &file_authd_proto_msgTypes[22]
+	mi := &file_authd_proto_msgTypes[28]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1234,7 +1566,7 @@ func (x *Group) String() string {
 func (*Group) ProtoMessage() {}
 
 func (x *Group) ProtoReflect() protoreflect.Message {
-	mi := &file_authd_proto_msgTypes[22]
+	mi := &file_authd_proto_msgTypes[28]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1247,7 +1579,7 @@ func (x *Group) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use Group.ProtoReflect.Descriptor instead.
 func (*Group) Descriptor() ([]byte, []int) {
-	return file_authd_proto_rawDescGZIP(), []int{22}
+	return file_authd_proto_rawDescGZIP(), []int{28}
 }
 
 func (x *Group) GetName() string {
@@ -1287,7 +1619,7 @@ type Groups struct {
 
 func (x *Groups) Reset() {
 	*x = Groups{}
-	mi := &file_authd_proto_msgTypes[23]
+	mi := &file_authd_proto_msgTypes[29]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1299,7 +1631,7 @@ func (x *Groups) String() string {
 func (*Groups) ProtoMessage() {}
 
 func (x *Groups) ProtoReflect() protoreflect.Message {
-	mi := &file_authd_proto_msgTypes[23]
+	mi := &file_authd_proto_msgTypes[29]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1312,7 +1644,7 @@ func (x *Groups) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use Groups.ProtoReflect.Descriptor instead.
 func (*Groups) Descriptor() ([]byte, []int) {
-	return file_authd_proto_rawDescGZIP(), []int{23}
+	return file_authd_proto_rawDescGZIP(), []int{29}
 }
 
 func (x *Groups) GetGroups() []*Group {
@@ -1333,7 +1665,7 @@ type ABResponse_BrokerInfo struct {
 
 func (x *ABResponse_BrokerInfo) Reset() {
 	*x = ABResponse_BrokerInfo{}
-	mi := &file_authd_proto_msgTypes[24]
+	mi := &file_authd_proto_msgTypes[30]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1345,7 +1677,7 @@ func (x *ABResponse_BrokerInfo) String() string {
 func (*ABResponse_BrokerInfo) ProtoMessage() {}
 
 func (x *ABResponse_BrokerInfo) ProtoReflect() protoreflect.Message {
-	mi := &file_authd_proto_msgTypes[24]
+	mi := &file_authd_proto_msgTypes[30]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1392,7 +1724,7 @@ type GAMResponse_AuthenticationMode struct {
 
 func (x *GAMResponse_AuthenticationMode) Reset() {
 	*x = GAMResponse_AuthenticationMode{}
-	mi := &file_authd_proto_msgTypes[25]
+	mi := &file_authd_proto_msgTypes[31]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1404,7 +1736,7 @@ func (x *GAMResponse_AuthenticationMode) String() string {
 func (*GAMResponse_AuthenticationMode) ProtoMessage() {}
 
 func (x *GAMResponse_AuthenticationMode) ProtoReflect() protoreflect.Message {
-	mi := &file_authd_proto_msgTypes[25]
+	mi := &file_authd_proto_msgTypes[31]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1449,7 +1781,7 @@ type IARequest_AuthenticationData struct {
 
 func (x *IARequest_AuthenticationData) Reset() {
 	*x = IARequest_AuthenticationData{}
-	mi := &file_authd_proto_msgTypes[26]
+	mi := &file_authd_proto_msgTypes[32]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1461,7 +1793,7 @@ func (x *IARequest_AuthenticationData) String() string {
 func (*IARequest_AuthenticationData) ProtoMessage() {}
 
 func (x *IARequest_AuthenticationData) ProtoReflect() protoreflect.Message {
-	mi := &file_authd_proto_msgTypes[26]
+	mi := &file_authd_proto_msgTypes[32]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1551,210 +1883,166 @@ func (*IARequest_AuthenticationData_Challenge) isIARequest_AuthenticationData_It
 
 var File_authd_proto protoreflect.FileDescriptor
 
-var file_authd_proto_rawDesc = string([]byte{
-	0x0a, 0x0b, 0x61, 0x75, 0x74, 0x68, 0x64, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x05, 0x61,
-	0x75, 0x74, 0x68, 0x64, 0x22, 0x07, 0x0a, 0x05, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x22, 0x28, 0x0a,
-	0x0a, 0x47, 0x50, 0x42, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1a, 0x0a, 0x08, 0x75,
-	0x73, 0x65, 0x72, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x75,
-	0x73, 0x65, 0x72, 0x6e, 0x61, 0x6d, 0x65, 0x22, 0x36, 0x0a, 0x0b, 0x47, 0x50, 0x42, 0x52, 0x65,
-	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x27, 0x0a, 0x0f, 0x70, 0x72, 0x65, 0x76, 0x69, 0x6f,
-	0x75, 0x73, 0x5f, 0x62, 0x72, 0x6f, 0x6b, 0x65, 0x72, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x0e, 0x70, 0x72, 0x65, 0x76, 0x69, 0x6f, 0x75, 0x73, 0x42, 0x72, 0x6f, 0x6b, 0x65, 0x72, 0x22,
-	0xb4, 0x01, 0x0a, 0x0a, 0x41, 0x42, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x41,
-	0x0a, 0x0d, 0x62, 0x72, 0x6f, 0x6b, 0x65, 0x72, 0x73, 0x5f, 0x69, 0x6e, 0x66, 0x6f, 0x73, 0x18,
-	0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1c, 0x2e, 0x61, 0x75, 0x74, 0x68, 0x64, 0x2e, 0x41, 0x42,
-	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x2e, 0x42, 0x72, 0x6f, 0x6b, 0x65, 0x72, 0x49,
-	0x6e, 0x66, 0x6f, 0x52, 0x0c, 0x62, 0x72, 0x6f, 0x6b, 0x65, 0x72, 0x73, 0x49, 0x6e, 0x66, 0x6f,
-	0x73, 0x1a, 0x63, 0x0a, 0x0a, 0x42, 0x72, 0x6f, 0x6b, 0x65, 0x72, 0x49, 0x6e, 0x66, 0x6f, 0x12,
-	0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12,
-	0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e,
-	0x61, 0x6d, 0x65, 0x12, 0x22, 0x0a, 0x0a, 0x62, 0x72, 0x61, 0x6e, 0x64, 0x5f, 0x69, 0x63, 0x6f,
-	0x6e, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x48, 0x00, 0x52, 0x09, 0x62, 0x72, 0x61, 0x6e, 0x64,
-	0x49, 0x63, 0x6f, 0x6e, 0x88, 0x01, 0x01, 0x42, 0x0d, 0x0a, 0x0b, 0x5f, 0x62, 0x72, 0x61, 0x6e,
-	0x64, 0x5f, 0x69, 0x63, 0x6f, 0x6e, 0x22, 0x22, 0x0a, 0x0e, 0x53, 0x74, 0x72, 0x69, 0x6e, 0x67,
-	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x10, 0x0a, 0x03, 0x6d, 0x73, 0x67, 0x18,
-	0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6d, 0x73, 0x67, 0x22, 0x80, 0x01, 0x0a, 0x09, 0x53,
-	0x42, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1b, 0x0a, 0x09, 0x62, 0x72, 0x6f, 0x6b,
-	0x65, 0x72, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x62, 0x72, 0x6f,
-	0x6b, 0x65, 0x72, 0x49, 0x64, 0x12, 0x1a, 0x0a, 0x08, 0x75, 0x73, 0x65, 0x72, 0x6e, 0x61, 0x6d,
-	0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x75, 0x73, 0x65, 0x72, 0x6e, 0x61, 0x6d,
-	0x65, 0x12, 0x12, 0x0a, 0x04, 0x6c, 0x61, 0x6e, 0x67, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x04, 0x6c, 0x61, 0x6e, 0x67, 0x12, 0x26, 0x0a, 0x04, 0x6d, 0x6f, 0x64, 0x65, 0x18, 0x04, 0x20,
-	0x01, 0x28, 0x0e, 0x32, 0x12, 0x2e, 0x61, 0x75, 0x74, 0x68, 0x64, 0x2e, 0x53, 0x65, 0x73, 0x73,
-	0x69, 0x6f, 0x6e, 0x4d, 0x6f, 0x64, 0x65, 0x52, 0x04, 0x6d, 0x6f, 0x64, 0x65, 0x22, 0x52, 0x0a,
-	0x0a, 0x53, 0x42, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x1d, 0x0a, 0x0a, 0x73,
-	0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x09, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x49, 0x64, 0x12, 0x25, 0x0a, 0x0e, 0x65, 0x6e,
-	0x63, 0x72, 0x79, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x6b, 0x65, 0x79, 0x18, 0x02, 0x20, 0x01,
-	0x28, 0x09, 0x52, 0x0d, 0x65, 0x6e, 0x63, 0x72, 0x79, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x4b, 0x65,
-	0x79, 0x22, 0x6e, 0x0a, 0x0a, 0x47, 0x41, 0x4d, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12,
-	0x1d, 0x0a, 0x0a, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20,
-	0x01, 0x28, 0x09, 0x52, 0x09, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x49, 0x64, 0x12, 0x41,
-	0x0a, 0x14, 0x73, 0x75, 0x70, 0x70, 0x6f, 0x72, 0x74, 0x65, 0x64, 0x5f, 0x75, 0x69, 0x5f, 0x6c,
-	0x61, 0x79, 0x6f, 0x75, 0x74, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x0f, 0x2e, 0x61,
-	0x75, 0x74, 0x68, 0x64, 0x2e, 0x55, 0x49, 0x4c, 0x61, 0x79, 0x6f, 0x75, 0x74, 0x52, 0x12, 0x73,
-	0x75, 0x70, 0x70, 0x6f, 0x72, 0x74, 0x65, 0x64, 0x55, 0x69, 0x4c, 0x61, 0x79, 0x6f, 0x75, 0x74,
-	0x73, 0x22, 0xbe, 0x02, 0x0a, 0x08, 0x55, 0x49, 0x4c, 0x61, 0x79, 0x6f, 0x75, 0x74, 0x12, 0x12,
-	0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x74, 0x79,
-	0x70, 0x65, 0x12, 0x19, 0x0a, 0x05, 0x6c, 0x61, 0x62, 0x65, 0x6c, 0x18, 0x02, 0x20, 0x01, 0x28,
-	0x09, 0x48, 0x00, 0x52, 0x05, 0x6c, 0x61, 0x62, 0x65, 0x6c, 0x88, 0x01, 0x01, 0x12, 0x1b, 0x0a,
-	0x06, 0x62, 0x75, 0x74, 0x74, 0x6f, 0x6e, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x48, 0x01, 0x52,
-	0x06, 0x62, 0x75, 0x74, 0x74, 0x6f, 0x6e, 0x88, 0x01, 0x01, 0x12, 0x17, 0x0a, 0x04, 0x77, 0x61,
-	0x69, 0x74, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x48, 0x02, 0x52, 0x04, 0x77, 0x61, 0x69, 0x74,
-	0x88, 0x01, 0x01, 0x12, 0x19, 0x0a, 0x05, 0x65, 0x6e, 0x74, 0x72, 0x79, 0x18, 0x05, 0x20, 0x01,
-	0x28, 0x09, 0x48, 0x03, 0x52, 0x05, 0x65, 0x6e, 0x74, 0x72, 0x79, 0x88, 0x01, 0x01, 0x12, 0x1d,
-	0x0a, 0x07, 0x63, 0x6f, 0x6e, 0x74, 0x65, 0x6e, 0x74, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09, 0x48,
-	0x04, 0x52, 0x07, 0x63, 0x6f, 0x6e, 0x74, 0x65, 0x6e, 0x74, 0x88, 0x01, 0x01, 0x12, 0x17, 0x0a,
-	0x04, 0x63, 0x6f, 0x64, 0x65, 0x18, 0x07, 0x20, 0x01, 0x28, 0x09, 0x48, 0x05, 0x52, 0x04, 0x63,
-	0x6f, 0x64, 0x65, 0x88, 0x01, 0x01, 0x12, 0x2a, 0x0a, 0x0e, 0x72, 0x65, 0x6e, 0x64, 0x65, 0x72,
-	0x73, 0x5f, 0x71, 0x72, 0x63, 0x6f, 0x64, 0x65, 0x18, 0x08, 0x20, 0x01, 0x28, 0x08, 0x48, 0x06,
-	0x52, 0x0d, 0x72, 0x65, 0x6e, 0x64, 0x65, 0x72, 0x73, 0x51, 0x72, 0x63, 0x6f, 0x64, 0x65, 0x88,
-	0x01, 0x01, 0x42, 0x08, 0x0a, 0x06, 0x5f, 0x6c, 0x61, 0x62, 0x65, 0x6c, 0x42, 0x09, 0x0a, 0x07,
-	0x5f, 0x62, 0x75, 0x74, 0x74, 0x6f, 0x6e, 0x42, 0x07, 0x0a, 0x05, 0x5f, 0x77, 0x61, 0x69, 0x74,
-	0x42, 0x08, 0x0a, 0x06, 0x5f, 0x65, 0x6e, 0x74, 0x72, 0x79, 0x42, 0x0a, 0x0a, 0x08, 0x5f, 0x63,
-	0x6f, 0x6e, 0x74, 0x65, 0x6e, 0x74, 0x42, 0x07, 0x0a, 0x05, 0x5f, 0x63, 0x6f, 0x64, 0x65, 0x42,
-	0x11, 0x0a, 0x0f, 0x5f, 0x72, 0x65, 0x6e, 0x64, 0x65, 0x72, 0x73, 0x5f, 0x71, 0x72, 0x63, 0x6f,
-	0x64, 0x65, 0x22, 0xa3, 0x01, 0x0a, 0x0b, 0x47, 0x41, 0x4d, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e,
-	0x73, 0x65, 0x12, 0x58, 0x0a, 0x14, 0x61, 0x75, 0x74, 0x68, 0x65, 0x6e, 0x74, 0x69, 0x63, 0x61,
-	0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x6d, 0x6f, 0x64, 0x65, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b,
-	0x32, 0x25, 0x2e, 0x61, 0x75, 0x74, 0x68, 0x64, 0x2e, 0x47, 0x41, 0x4d, 0x52, 0x65, 0x73, 0x70,
-	0x6f, 0x6e, 0x73, 0x65, 0x2e, 0x41, 0x75, 0x74, 0x68, 0x65, 0x6e, 0x74, 0x69, 0x63, 0x61, 0x74,
-	0x69, 0x6f, 0x6e, 0x4d, 0x6f, 0x64, 0x65, 0x52, 0x13, 0x61, 0x75, 0x74, 0x68, 0x65, 0x6e, 0x74,
-	0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x4d, 0x6f, 0x64, 0x65, 0x73, 0x1a, 0x3a, 0x0a, 0x12,
-	0x41, 0x75, 0x74, 0x68, 0x65, 0x6e, 0x74, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x4d, 0x6f,
-	0x64, 0x65, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02,
-	0x69, 0x64, 0x12, 0x14, 0x0a, 0x05, 0x6c, 0x61, 0x62, 0x65, 0x6c, 0x18, 0x02, 0x20, 0x01, 0x28,
-	0x09, 0x52, 0x05, 0x6c, 0x61, 0x62, 0x65, 0x6c, 0x22, 0x61, 0x0a, 0x0a, 0x53, 0x41, 0x4d, 0x52,
-	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1d, 0x0a, 0x0a, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f,
-	0x6e, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x73, 0x65, 0x73, 0x73,
-	0x69, 0x6f, 0x6e, 0x49, 0x64, 0x12, 0x34, 0x0a, 0x16, 0x61, 0x75, 0x74, 0x68, 0x65, 0x6e, 0x74,
-	0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x6d, 0x6f, 0x64, 0x65, 0x5f, 0x69, 0x64, 0x18,
-	0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x14, 0x61, 0x75, 0x74, 0x68, 0x65, 0x6e, 0x74, 0x69, 0x63,
-	0x61, 0x74, 0x69, 0x6f, 0x6e, 0x4d, 0x6f, 0x64, 0x65, 0x49, 0x64, 0x22, 0x44, 0x0a, 0x0b, 0x53,
-	0x41, 0x4d, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x35, 0x0a, 0x0e, 0x75, 0x69,
-	0x5f, 0x6c, 0x61, 0x79, 0x6f, 0x75, 0x74, 0x5f, 0x69, 0x6e, 0x66, 0x6f, 0x18, 0x01, 0x20, 0x01,
-	0x28, 0x0b, 0x32, 0x0f, 0x2e, 0x61, 0x75, 0x74, 0x68, 0x64, 0x2e, 0x55, 0x49, 0x4c, 0x61, 0x79,
-	0x6f, 0x75, 0x74, 0x52, 0x0c, 0x75, 0x69, 0x4c, 0x61, 0x79, 0x6f, 0x75, 0x74, 0x49, 0x6e, 0x66,
-	0x6f, 0x22, 0x86, 0x02, 0x0a, 0x09, 0x49, 0x41, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12,
-	0x1d, 0x0a, 0x0a, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20,
-	0x01, 0x28, 0x09, 0x52, 0x09, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x49, 0x64, 0x12, 0x54,
-	0x0a, 0x13, 0x61, 0x75, 0x74, 0x68, 0x65, 0x6e, 0x74, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e,
-	0x5f, 0x64, 0x61, 0x74, 0x61, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x23, 0x2e, 0x61, 0x75,
-	0x74, 0x68, 0x64, 0x2e, 0x49, 0x41, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x2e, 0x41, 0x75,
-	0x74, 0x68, 0x65, 0x6e, 0x74, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x44, 0x61, 0x74, 0x61,
-	0x52, 0x12, 0x61, 0x75, 0x74, 0x68, 0x65, 0x6e, 0x74, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e,
-	0x44, 0x61, 0x74, 0x61, 0x1a, 0x83, 0x01, 0x0a, 0x12, 0x41, 0x75, 0x74, 0x68, 0x65, 0x6e, 0x74,
-	0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x44, 0x61, 0x74, 0x61, 0x12, 0x18, 0x0a, 0x06, 0x73,
-	0x65, 0x63, 0x72, 0x65, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x48, 0x00, 0x52, 0x06, 0x73,
-	0x65, 0x63, 0x72, 0x65, 0x74, 0x12, 0x14, 0x0a, 0x04, 0x77, 0x61, 0x69, 0x74, 0x18, 0x02, 0x20,
-	0x01, 0x28, 0x09, 0x48, 0x00, 0x52, 0x04, 0x77, 0x61, 0x69, 0x74, 0x12, 0x14, 0x0a, 0x04, 0x73,
-	0x6b, 0x69, 0x70, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x48, 0x00, 0x52, 0x04, 0x73, 0x6b, 0x69,
-	0x70, 0x12, 0x1f, 0x0a, 0x09, 0x63, 0x68, 0x61, 0x6c, 0x6c, 0x65, 0x6e, 0x67, 0x65, 0x18, 0xe7,
-	0x07, 0x20, 0x01, 0x28, 0x09, 0x48, 0x00, 0x52, 0x09, 0x63, 0x68, 0x61, 0x6c, 0x6c, 0x65, 0x6e,
-	0x67, 0x65, 0x42, 0x06, 0x0a, 0x04, 0x69, 0x74, 0x65, 0x6d, 0x22, 0x36, 0x0a, 0x0a, 0x49, 0x41,
-	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x16, 0x0a, 0x06, 0x61, 0x63, 0x63, 0x65,
-	0x73, 0x73, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x61, 0x63, 0x63, 0x65, 0x73, 0x73,
-	0x12, 0x10, 0x0a, 0x03, 0x6d, 0x73, 0x67, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6d,
-	0x73, 0x67, 0x22, 0x47, 0x0a, 0x0c, 0x53, 0x44, 0x42, 0x46, 0x55, 0x52, 0x65, 0x71, 0x75, 0x65,
-	0x73, 0x74, 0x12, 0x1b, 0x0a, 0x09, 0x62, 0x72, 0x6f, 0x6b, 0x65, 0x72, 0x5f, 0x69, 0x64, 0x18,
-	0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x62, 0x72, 0x6f, 0x6b, 0x65, 0x72, 0x49, 0x64, 0x12,
-	0x1a, 0x0a, 0x08, 0x75, 0x73, 0x65, 0x72, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28,
-	0x09, 0x52, 0x08, 0x75, 0x73, 0x65, 0x72, 0x6e, 0x61, 0x6d, 0x65, 0x22, 0x2a, 0x0a, 0x09, 0x45,
-	0x53, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1d, 0x0a, 0x0a, 0x73, 0x65, 0x73, 0x73,
-	0x69, 0x6f, 0x6e, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x73, 0x65,
-	0x73, 0x73, 0x69, 0x6f, 0x6e, 0x49, 0x64, 0x22, 0x52, 0x0a, 0x14, 0x47, 0x65, 0x74, 0x55, 0x73,
-	0x65, 0x72, 0x42, 0x79, 0x4e, 0x61, 0x6d, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12,
-	0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e,
-	0x61, 0x6d, 0x65, 0x12, 0x26, 0x0a, 0x0e, 0x73, 0x68, 0x6f, 0x75, 0x6c, 0x64, 0x50, 0x72, 0x65,
-	0x43, 0x68, 0x65, 0x63, 0x6b, 0x18, 0x02, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0e, 0x73, 0x68, 0x6f,
-	0x75, 0x6c, 0x64, 0x50, 0x72, 0x65, 0x43, 0x68, 0x65, 0x63, 0x6b, 0x22, 0x24, 0x0a, 0x12, 0x47,
-	0x65, 0x74, 0x55, 0x73, 0x65, 0x72, 0x42, 0x79, 0x49, 0x44, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
-	0x74, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x02, 0x69,
-	0x64, 0x22, 0x2b, 0x0a, 0x15, 0x47, 0x65, 0x74, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x42, 0x79, 0x4e,
-	0x61, 0x6d, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61,
-	0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x22, 0x25,
-	0x0a, 0x13, 0x47, 0x65, 0x74, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x42, 0x79, 0x49, 0x44, 0x52, 0x65,
-	0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28,
-	0x0d, 0x52, 0x02, 0x69, 0x64, 0x22, 0x84, 0x01, 0x0a, 0x04, 0x55, 0x73, 0x65, 0x72, 0x12, 0x12,
-	0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61,
-	0x6d, 0x65, 0x12, 0x10, 0x0a, 0x03, 0x75, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0d, 0x52,
-	0x03, 0x75, 0x69, 0x64, 0x12, 0x10, 0x0a, 0x03, 0x67, 0x69, 0x64, 0x18, 0x03, 0x20, 0x01, 0x28,
-	0x0d, 0x52, 0x03, 0x67, 0x69, 0x64, 0x12, 0x14, 0x0a, 0x05, 0x67, 0x65, 0x63, 0x6f, 0x73, 0x18,
-	0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x67, 0x65, 0x63, 0x6f, 0x73, 0x12, 0x18, 0x0a, 0x07,
-	0x68, 0x6f, 0x6d, 0x65, 0x64, 0x69, 0x72, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x68,
-	0x6f, 0x6d, 0x65, 0x64, 0x69, 0x72, 0x12, 0x14, 0x0a, 0x05, 0x73, 0x68, 0x65, 0x6c, 0x6c, 0x18,
-	0x06, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x73, 0x68, 0x65, 0x6c, 0x6c, 0x22, 0x2a, 0x0a, 0x05,
-	0x55, 0x73, 0x65, 0x72, 0x73, 0x12, 0x21, 0x0a, 0x05, 0x75, 0x73, 0x65, 0x72, 0x73, 0x18, 0x01,
-	0x20, 0x03, 0x28, 0x0b, 0x32, 0x0b, 0x2e, 0x61, 0x75, 0x74, 0x68, 0x64, 0x2e, 0x55, 0x73, 0x65,
-	0x72, 0x52, 0x05, 0x75, 0x73, 0x65, 0x72, 0x73, 0x22, 0x5f, 0x0a, 0x05, 0x47, 0x72, 0x6f, 0x75,
-	0x70, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x10, 0x0a, 0x03, 0x67, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01,
-	0x28, 0x0d, 0x52, 0x03, 0x67, 0x69, 0x64, 0x12, 0x18, 0x0a, 0x07, 0x6d, 0x65, 0x6d, 0x62, 0x65,
-	0x72, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x09, 0x52, 0x07, 0x6d, 0x65, 0x6d, 0x62, 0x65, 0x72,
-	0x73, 0x12, 0x16, 0x0a, 0x06, 0x70, 0x61, 0x73, 0x73, 0x77, 0x64, 0x18, 0x04, 0x20, 0x01, 0x28,
-	0x09, 0x52, 0x06, 0x70, 0x61, 0x73, 0x73, 0x77, 0x64, 0x22, 0x2e, 0x0a, 0x06, 0x47, 0x72, 0x6f,
-	0x75, 0x70, 0x73, 0x12, 0x24, 0x0a, 0x06, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x18, 0x01, 0x20,
-	0x03, 0x28, 0x0b, 0x32, 0x0c, 0x2e, 0x61, 0x75, 0x74, 0x68, 0x64, 0x2e, 0x47, 0x72, 0x6f, 0x75,
-	0x70, 0x52, 0x06, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x2a, 0x3c, 0x0a, 0x0b, 0x53, 0x65, 0x73,
-	0x73, 0x69, 0x6f, 0x6e, 0x4d, 0x6f, 0x64, 0x65, 0x12, 0x0d, 0x0a, 0x09, 0x55, 0x4e, 0x44, 0x45,
-	0x46, 0x49, 0x4e, 0x45, 0x44, 0x10, 0x00, 0x12, 0x09, 0x0a, 0x05, 0x4c, 0x4f, 0x47, 0x49, 0x4e,
-	0x10, 0x01, 0x12, 0x13, 0x0a, 0x0f, 0x43, 0x48, 0x41, 0x4e, 0x47, 0x45, 0x5f, 0x50, 0x41, 0x53,
-	0x53, 0x57, 0x4f, 0x52, 0x44, 0x10, 0x02, 0x32, 0xd3, 0x03, 0x0a, 0x03, 0x50, 0x41, 0x4d, 0x12,
-	0x33, 0x0a, 0x10, 0x41, 0x76, 0x61, 0x69, 0x6c, 0x61, 0x62, 0x6c, 0x65, 0x42, 0x72, 0x6f, 0x6b,
-	0x65, 0x72, 0x73, 0x12, 0x0c, 0x2e, 0x61, 0x75, 0x74, 0x68, 0x64, 0x2e, 0x45, 0x6d, 0x70, 0x74,
-	0x79, 0x1a, 0x11, 0x2e, 0x61, 0x75, 0x74, 0x68, 0x64, 0x2e, 0x41, 0x42, 0x52, 0x65, 0x73, 0x70,
-	0x6f, 0x6e, 0x73, 0x65, 0x12, 0x3a, 0x0a, 0x11, 0x47, 0x65, 0x74, 0x50, 0x72, 0x65, 0x76, 0x69,
-	0x6f, 0x75, 0x73, 0x42, 0x72, 0x6f, 0x6b, 0x65, 0x72, 0x12, 0x11, 0x2e, 0x61, 0x75, 0x74, 0x68,
-	0x64, 0x2e, 0x47, 0x50, 0x42, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x12, 0x2e, 0x61,
-	0x75, 0x74, 0x68, 0x64, 0x2e, 0x47, 0x50, 0x42, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
-	0x12, 0x33, 0x0a, 0x0c, 0x53, 0x65, 0x6c, 0x65, 0x63, 0x74, 0x42, 0x72, 0x6f, 0x6b, 0x65, 0x72,
-	0x12, 0x10, 0x2e, 0x61, 0x75, 0x74, 0x68, 0x64, 0x2e, 0x53, 0x42, 0x52, 0x65, 0x71, 0x75, 0x65,
-	0x73, 0x74, 0x1a, 0x11, 0x2e, 0x61, 0x75, 0x74, 0x68, 0x64, 0x2e, 0x53, 0x42, 0x52, 0x65, 0x73,
-	0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x3f, 0x0a, 0x16, 0x47, 0x65, 0x74, 0x41, 0x75, 0x74, 0x68,
-	0x65, 0x6e, 0x74, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x4d, 0x6f, 0x64, 0x65, 0x73, 0x12,
-	0x11, 0x2e, 0x61, 0x75, 0x74, 0x68, 0x64, 0x2e, 0x47, 0x41, 0x4d, 0x52, 0x65, 0x71, 0x75, 0x65,
-	0x73, 0x74, 0x1a, 0x12, 0x2e, 0x61, 0x75, 0x74, 0x68, 0x64, 0x2e, 0x47, 0x41, 0x4d, 0x52, 0x65,
-	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x41, 0x0a, 0x18, 0x53, 0x65, 0x6c, 0x65, 0x63, 0x74,
-	0x41, 0x75, 0x74, 0x68, 0x65, 0x6e, 0x74, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x4d, 0x6f,
-	0x64, 0x65, 0x12, 0x11, 0x2e, 0x61, 0x75, 0x74, 0x68, 0x64, 0x2e, 0x53, 0x41, 0x4d, 0x52, 0x65,
-	0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x12, 0x2e, 0x61, 0x75, 0x74, 0x68, 0x64, 0x2e, 0x53, 0x41,
-	0x4d, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x36, 0x0a, 0x0f, 0x49, 0x73, 0x41,
-	0x75, 0x74, 0x68, 0x65, 0x6e, 0x74, 0x69, 0x63, 0x61, 0x74, 0x65, 0x64, 0x12, 0x10, 0x2e, 0x61,
-	0x75, 0x74, 0x68, 0x64, 0x2e, 0x49, 0x41, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x11,
-	0x2e, 0x61, 0x75, 0x74, 0x68, 0x64, 0x2e, 0x49, 0x41, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73,
-	0x65, 0x12, 0x2c, 0x0a, 0x0a, 0x45, 0x6e, 0x64, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x12,
-	0x10, 0x2e, 0x61, 0x75, 0x74, 0x68, 0x64, 0x2e, 0x45, 0x53, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
-	0x74, 0x1a, 0x0c, 0x2e, 0x61, 0x75, 0x74, 0x68, 0x64, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x12,
-	0x3c, 0x0a, 0x17, 0x53, 0x65, 0x74, 0x44, 0x65, 0x66, 0x61, 0x75, 0x6c, 0x74, 0x42, 0x72, 0x6f,
-	0x6b, 0x65, 0x72, 0x46, 0x6f, 0x72, 0x55, 0x73, 0x65, 0x72, 0x12, 0x13, 0x2e, 0x61, 0x75, 0x74,
-	0x68, 0x64, 0x2e, 0x53, 0x44, 0x42, 0x46, 0x55, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a,
-	0x0c, 0x2e, 0x61, 0x75, 0x74, 0x68, 0x64, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x32, 0xcb, 0x02,
-	0x0a, 0x0b, 0x55, 0x73, 0x65, 0x72, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x12, 0x39, 0x0a,
-	0x0d, 0x47, 0x65, 0x74, 0x55, 0x73, 0x65, 0x72, 0x42, 0x79, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x1b,
-	0x2e, 0x61, 0x75, 0x74, 0x68, 0x64, 0x2e, 0x47, 0x65, 0x74, 0x55, 0x73, 0x65, 0x72, 0x42, 0x79,
-	0x4e, 0x61, 0x6d, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x0b, 0x2e, 0x61, 0x75,
-	0x74, 0x68, 0x64, 0x2e, 0x55, 0x73, 0x65, 0x72, 0x12, 0x35, 0x0a, 0x0b, 0x47, 0x65, 0x74, 0x55,
-	0x73, 0x65, 0x72, 0x42, 0x79, 0x49, 0x44, 0x12, 0x19, 0x2e, 0x61, 0x75, 0x74, 0x68, 0x64, 0x2e,
-	0x47, 0x65, 0x74, 0x55, 0x73, 0x65, 0x72, 0x42, 0x79, 0x49, 0x44, 0x52, 0x65, 0x71, 0x75, 0x65,
-	0x73, 0x74, 0x1a, 0x0b, 0x2e, 0x61, 0x75, 0x74, 0x68, 0x64, 0x2e, 0x55, 0x73, 0x65, 0x72, 0x12,
-	0x27, 0x0a, 0x09, 0x4c, 0x69, 0x73, 0x74, 0x55, 0x73, 0x65, 0x72, 0x73, 0x12, 0x0c, 0x2e, 0x61,
-	0x75, 0x74, 0x68, 0x64, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x1a, 0x0c, 0x2e, 0x61, 0x75, 0x74,
-	0x68, 0x64, 0x2e, 0x55, 0x73, 0x65, 0x72, 0x73, 0x12, 0x3c, 0x0a, 0x0e, 0x47, 0x65, 0x74, 0x47,
-	0x72, 0x6f, 0x75, 0x70, 0x42, 0x79, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x1c, 0x2e, 0x61, 0x75, 0x74,
-	0x68, 0x64, 0x2e, 0x47, 0x65, 0x74, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x42, 0x79, 0x4e, 0x61, 0x6d,
-	0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x0c, 0x2e, 0x61, 0x75, 0x74, 0x68, 0x64,
-	0x2e, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x12, 0x38, 0x0a, 0x0c, 0x47, 0x65, 0x74, 0x47, 0x72, 0x6f,
-	0x75, 0x70, 0x42, 0x79, 0x49, 0x44, 0x12, 0x1a, 0x2e, 0x61, 0x75, 0x74, 0x68, 0x64, 0x2e, 0x47,
-	0x65, 0x74, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x42, 0x79, 0x49, 0x44, 0x52, 0x65, 0x71, 0x75, 0x65,
-	0x73, 0x74, 0x1a, 0x0c, 0x2e, 0x61, 0x75, 0x74, 0x68, 0x64, 0x2e, 0x47, 0x72, 0x6f, 0x75, 0x70,
-	0x12, 0x29, 0x0a, 0x0a, 0x4c, 0x69, 0x73, 0x74, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x12, 0x0c,
-	0x2e, 0x61, 0x75, 0x74, 0x68, 0x64, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x1a, 0x0d, 0x2e, 0x61,
-	0x75, 0x74, 0x68, 0x64, 0x2e, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x42, 0x2e, 0x5a, 0x2c, 0x67,
-	0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x75, 0x62, 0x75, 0x6e, 0x74, 0x75,
-	0x2f, 0x61, 0x75, 0x74, 0x68, 0x64, 0x2f, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2f,
-	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2f, 0x61, 0x75, 0x74, 0x68, 0x64, 0x62, 0x06, 0x70, 0x72, 0x6f,
-	0x74, 0x6f, 0x33,
-})
+const file_authd_proto_rawDesc = "" +
+	"\n" +
+	"\vauthd.proto\x12\x05authd\"\a\n" +
+	"\x05Empty\"(\n" +
+	"\n" +
+	"GPBRequest\x12\x1a\n" +
+	"\busername\x18\x01 \x01(\tR\busername\"6\n" +
+	"\vGPBResponse\x12'\n" +
+	"\x0fprevious_broker\x18\x01 \x01(\tR\x0epreviousBroker\"\xb4\x01\n" +
+	"\n" +
+	"ABResponse\x12A\n" +
+	"\rbrokers_infos\x18\x01 \x03(\v2\x1c.authd.ABResponse.BrokerInfoR\fbrokersInfos\x1ac\n" +
+	"\n" +
+	"BrokerInfo\x12\x0e\n" +
+	"\x02id\x18\x01 \x01(\tR\x02id\x12\x12\n" +
+	"\x04name\x18\x02 \x01(\tR\x04name\x12\"\n" +
+	"\n" +
+	"brand_icon\x18\x03 \x01(\tH\x00R\tbrandIcon\x88\x01\x01B\r\n" +
+	"\v_brand_icon\"\"\n" +
+	"\x0eStringResponse\x12\x10\n" +
+	"\x03msg\x18\x01 \x01(\tR\x03msg\"\x80\x01\n" +
+	"\tSBRequest\x12\x1b\n" +
+	"\tbroker_id\x18\x01 \x01(\tR\bbrokerId\x12\x1a\n" +
+	"\busername\x18\x02 \x01(\tR\busername\x12\x12\n" +
+	"\x04lang\x18\x03 \x01(\tR\x04lang\x12&\n" +
+	"\x04mode\x18\x04 \x01(\x0e2\x12.authd.SessionModeR\x04mode\"R\n" +
+	"\n" +
+	"SBResponse\x12\x1d\n" +
+	"\n" +
+	"session_id\x18\x01 \x01(\tR\tsessionId\x12%\n" +
+	"\x0eencryption_key\x18\x02 \x01(\tR\rencryptionKey\"n\n" +
+	"\n" +
+	"GAMRequest\x12\x1d\n" +
+	"\n" +
+	"session_id\x18\x01 \x01(\tR\tsessionId\x12A\n" +
+	"\x14supported_ui_layouts\x18\x02 \x03(\v2\x0f.authd.UILayoutR\x12supportedUiLayouts\"\xbe\x02\n" +
+	"\bUILayout\x12\x12\n" +
+	"\x04type\x18\x01 \x01(\tR\x04type\x12\x19\n" +
+	"\x05label\x18\x02 \x01(\tH\x00R\x05label\x88\x01\x01\x12\x1b\n" +
+	"\x06button\x18\x03 \x01(\tH\x01R\x06button\x88\x01\x01\x12\x17\n" +
+	"\x04wait\x18\x04 \x01(\tH\x02R\x04wait\x88\x01\x01\x12\x19\n" +
+	"\x05entry\x18\x05 \x01(\tH\x03R\x05entry\x88\x01\x01\x12\x1d\n" +
+	"\acontent\x18\x06 \x01(\tH\x04R\acontent\x88\x01\x01\x12\x17\n" +
+	"\x04code\x18\a \x01(\tH\x05R\x04code\x88\x01\x01\x12*\n" +
+	"\x0erenders_qrcode\x18\b \x01(\bH\x06R\rrendersQrcode\x88\x01\x01B\b\n" +
+	"\x06_labelB\t\n" +
+	"\a_buttonB\a\n" +
+	"\x05_waitB\b\n" +
+	"\x06_entryB\n" +
+	"\n" +
+	"\b_contentB\a\n" +
+	"\x05_codeB\x11\n" +
+	"\x0f_renders_qrcode\"\xa3\x01\n" +
+	"\vGAMResponse\x12X\n" +
+	"\x14authentication_modes\x18\x01 \x03(\v2%.authd.GAMResponse.AuthenticationModeR\x13authenticationModes\x1a:\n" +
+	"\x12AuthenticationMode\x12\x0e\n" +
+	"\x02id\x18\x01 \x01(\tR\x02id\x12\x14\n" +
+	"\x05label\x18\x02 \x01(\tR\x05label\"a\n" +
+	"\n" +
+	"SAMRequest\x12\x1d\n" +
+	"\n" +
+	"session_id\x18\x01 \x01(\tR\tsessionId\x124\n" +
+	"\x16authentication_mode_id\x18\x02 \x01(\tR\x14authenticationModeId\"D\n" +
+	"\vSAMResponse\x125\n" +
+	"\x0eui_layout_info\x18\x01 \x01(\v2\x0f.authd.UILayoutR\fuiLayoutInfo\"\x86\x02\n" +
+	"\tIARequest\x12\x1d\n" +
+	"\n" +
+	"session_id\x18\x01 \x01(\tR\tsessionId\x12T\n" +
+	"\x13authentication_data\x18\x02 \x01(\v2#.authd.IARequest.AuthenticationDataR\x12authenticationData\x1a\x83\x01\n" +
+	"\x12AuthenticationData\x12\x18\n" +
+	"\x06secret\x18\x01 \x01(\tH\x00R\x06secret\x12\x14\n" +
+	"\x04wait\x18\x02 \x01(\tH\x00R\x04wait\x12\x14\n" +
+	"\x04skip\x18\x03 \x01(\tH\x00R\x04skip\x12\x1f\n" +
+	"\tchallenge\x18\xe7\a \x01(\tH\x00R\tchallengeB\x06\n" +
+	"\x04item\"6\n" +
+	"\n" +
+	"IAResponse\x12\x16\n" +
+	"\x06access\x18\x01 \x01(\tR\x06access\x12\x10\n" +
+	"\x03msg\x18\x02 \x01(\tR\x03msg\"G\n" +
+	"\fSDBFURequest\x12\x1b\n" +
+	"\tbroker_id\x18\x01 \x01(\tR\bbrokerId\x12\x1a\n" +
+	"\busername\x18\x02 \x01(\tR\busername\"*\n" +
+	"\tESRequest\x12\x1d\n" +
+	"\n" +
+	"session_id\x18\x01 \x01(\tR\tsessionId\"R\n" +
+	"\x14GetUserByNameRequest\x12\x12\n" +
+	"\x04name\x18\x01 \x01(\tR\x04name\x12&\n" +
+	"\x0eshouldPreCheck\x18\x02 \x01(\bR\x0eshouldPreCheck\"$\n" +
+	"\x12GetUserByIDRequest\x12\x0e\n" +
+	"\x02id\x18\x01 \x01(\rR\x02id\"%\n" +
+	"\x0fLockUserRequest\x12\x12\n" +
+	"\x04name\x18\x01 \x01(\tR\x04name\"'\n" +
+	"\x11UnlockUserRequest\x12\x12\n" +
+	"\x04name\x18\x01 \x01(\tR\x04name\"+\n" +
+	"\x15GetGroupByNameRequest\x12\x12\n" +
+	"\x04name\x18\x01 \x01(\tR\x04name\"%\n" +
+	"\x13GetGroupByIDRequest\x12\x0e\n" +
+	"\x02id\x18\x01 \x01(\rR\x02id\"J\n" +
+	"\x10SetUserIDRequest\x12\x12\n" +
+	"\x04name\x18\x01 \x01(\tR\x04name\x12\x0e\n" +
+	"\x02id\x18\x02 \x01(\rR\x02id\x12\x12\n" +
+	"\x04lang\x18\x03 \x01(\tR\x04lang\"\x83\x01\n" +
+	"\x11SetUserIDResponse\x12\x1d\n" +
+	"\n" +
+	"id_changed\x18\x01 \x01(\bR\tidChanged\x123\n" +
+	"\x16home_dir_owner_changed\x18\x02 \x01(\bR\x13homeDirOwnerChanged\x12\x1a\n" +
+	"\bwarnings\x18\x03 \x03(\tR\bwarnings\"K\n" +
+	"\x11SetGroupIDRequest\x12\x12\n" +
+	"\x04name\x18\x01 \x01(\tR\x04name\x12\x0e\n" +
+	"\x02id\x18\x02 \x01(\rR\x02id\x12\x12\n" +
+	"\x04lang\x18\x03 \x01(\tR\x04lang\"\x84\x01\n" +
+	"\x12SetGroupIDResponse\x12\x1d\n" +
+	"\n" +
+	"id_changed\x18\x01 \x01(\bR\tidChanged\x123\n" +
+	"\x16home_dir_owner_changed\x18\x02 \x01(\bR\x13homeDirOwnerChanged\x12\x1a\n" +
+	"\bwarnings\x18\x03 \x03(\tR\bwarnings\"\x84\x01\n" +
+	"\x04User\x12\x12\n" +
+	"\x04name\x18\x01 \x01(\tR\x04name\x12\x10\n" +
+	"\x03uid\x18\x02 \x01(\rR\x03uid\x12\x10\n" +
+	"\x03gid\x18\x03 \x01(\rR\x03gid\x12\x14\n" +
+	"\x05gecos\x18\x04 \x01(\tR\x05gecos\x12\x18\n" +
+	"\ahomedir\x18\x05 \x01(\tR\ahomedir\x12\x14\n" +
+	"\x05shell\x18\x06 \x01(\tR\x05shell\"*\n" +
+	"\x05Users\x12!\n" +
+	"\x05users\x18\x01 \x03(\v2\v.authd.UserR\x05users\"_\n" +
+	"\x05Group\x12\x12\n" +
+	"\x04name\x18\x01 \x01(\tR\x04name\x12\x10\n" +
+	"\x03gid\x18\x02 \x01(\rR\x03gid\x12\x18\n" +
+	"\amembers\x18\x03 \x03(\tR\amembers\x12\x16\n" +
+	"\x06passwd\x18\x04 \x01(\tR\x06passwd\".\n" +
+	"\x06Groups\x12$\n" +
+	"\x06groups\x18\x01 \x03(\v2\f.authd.GroupR\x06groups*<\n" +
+	"\vSessionMode\x12\r\n" +
+	"\tUNDEFINED\x10\x00\x12\t\n" +
+	"\x05LOGIN\x10\x01\x12\x13\n" +
+	"\x0fCHANGE_PASSWORD\x10\x022\xd3\x03\n" +
+	"\x03PAM\x123\n" +
+	"\x10AvailableBrokers\x12\f.authd.Empty\x1a\x11.authd.ABResponse\x12:\n" +
+	"\x11GetPreviousBroker\x12\x11.authd.GPBRequest\x1a\x12.authd.GPBResponse\x123\n" +
+	"\fSelectBroker\x12\x10.authd.SBRequest\x1a\x11.authd.SBResponse\x12?\n" +
+	"\x16GetAuthenticationModes\x12\x11.authd.GAMRequest\x1a\x12.authd.GAMResponse\x12A\n" +
+	"\x18SelectAuthenticationMode\x12\x11.authd.SAMRequest\x1a\x12.authd.SAMResponse\x126\n" +
+	"\x0fIsAuthenticated\x12\x10.authd.IARequest\x1a\x11.authd.IAResponse\x12,\n" +
+	"\n" +
+	"EndSession\x12\x10.authd.ESRequest\x1a\f.authd.Empty\x12<\n" +
+	"\x17SetDefaultBrokerForUser\x12\x13.authd.SDBFURequest\x1a\f.authd.Empty2\xb6\x04\n" +
+	"\vUserService\x129\n" +
+	"\rGetUserByName\x12\x1b.authd.GetUserByNameRequest\x1a\v.authd.User\x125\n" +
+	"\vGetUserByID\x12\x19.authd.GetUserByIDRequest\x1a\v.authd.User\x12'\n" +
+	"\tListUsers\x12\f.authd.Empty\x1a\f.authd.Users\x120\n" +
+	"\bLockUser\x12\x16.authd.LockUserRequest\x1a\f.authd.Empty\x124\n" +
+	"\n" +
+	"UnlockUser\x12\x18.authd.UnlockUserRequest\x1a\f.authd.Empty\x12>\n" +
+	"\tSetUserID\x12\x17.authd.SetUserIDRequest\x1a\x18.authd.SetUserIDResponse\x12A\n" +
+	"\n" +
+	"SetGroupID\x12\x18.authd.SetGroupIDRequest\x1a\x19.authd.SetGroupIDResponse\x12<\n" +
+	"\x0eGetGroupByName\x12\x1c.authd.GetGroupByNameRequest\x1a\f.authd.Group\x128\n" +
+	"\fGetGroupByID\x12\x1a.authd.GetGroupByIDRequest\x1a\f.authd.Group\x12)\n" +
+	"\n" +
+	"ListGroups\x12\f.authd.Empty\x1a\r.authd.GroupsB1Z/github.com/canonical/authd/internal/proto/authdb\x06proto3"
 
 var (
 	file_authd_proto_rawDescOnce sync.Once
@@ -1769,7 +2057,7 @@ func file_authd_proto_rawDescGZIP() []byte {
 }
 
 var file_authd_proto_enumTypes = make([]protoimpl.EnumInfo, 1)
-var file_authd_proto_msgTypes = make([]protoimpl.MessageInfo, 27)
+var file_authd_proto_msgTypes = make([]protoimpl.MessageInfo, 33)
 var file_authd_proto_goTypes = []any{
 	(SessionMode)(0),                       // 0: authd.SessionMode
 	(*Empty)(nil),                          // 1: authd.Empty
@@ -1790,25 +2078,31 @@ var file_authd_proto_goTypes = []any{
 	(*ESRequest)(nil),                      // 16: authd.ESRequest
 	(*GetUserByNameRequest)(nil),           // 17: authd.GetUserByNameRequest
 	(*GetUserByIDRequest)(nil),             // 18: authd.GetUserByIDRequest
-	(*GetGroupByNameRequest)(nil),          // 19: authd.GetGroupByNameRequest
-	(*GetGroupByIDRequest)(nil),            // 20: authd.GetGroupByIDRequest
-	(*User)(nil),                           // 21: authd.User
-	(*Users)(nil),                          // 22: authd.Users
-	(*Group)(nil),                          // 23: authd.Group
-	(*Groups)(nil),                         // 24: authd.Groups
-	(*ABResponse_BrokerInfo)(nil),          // 25: authd.ABResponse.BrokerInfo
-	(*GAMResponse_AuthenticationMode)(nil), // 26: authd.GAMResponse.AuthenticationMode
-	(*IARequest_AuthenticationData)(nil),   // 27: authd.IARequest.AuthenticationData
+	(*LockUserRequest)(nil),                // 19: authd.LockUserRequest
+	(*UnlockUserRequest)(nil),              // 20: authd.UnlockUserRequest
+	(*GetGroupByNameRequest)(nil),          // 21: authd.GetGroupByNameRequest
+	(*GetGroupByIDRequest)(nil),            // 22: authd.GetGroupByIDRequest
+	(*SetUserIDRequest)(nil),               // 23: authd.SetUserIDRequest
+	(*SetUserIDResponse)(nil),              // 24: authd.SetUserIDResponse
+	(*SetGroupIDRequest)(nil),              // 25: authd.SetGroupIDRequest
+	(*SetGroupIDResponse)(nil),             // 26: authd.SetGroupIDResponse
+	(*User)(nil),                           // 27: authd.User
+	(*Users)(nil),                          // 28: authd.Users
+	(*Group)(nil),                          // 29: authd.Group
+	(*Groups)(nil),                         // 30: authd.Groups
+	(*ABResponse_BrokerInfo)(nil),          // 31: authd.ABResponse.BrokerInfo
+	(*GAMResponse_AuthenticationMode)(nil), // 32: authd.GAMResponse.AuthenticationMode
+	(*IARequest_AuthenticationData)(nil),   // 33: authd.IARequest.AuthenticationData
 }
 var file_authd_proto_depIdxs = []int32{
-	25, // 0: authd.ABResponse.brokers_infos:type_name -> authd.ABResponse.BrokerInfo
+	31, // 0: authd.ABResponse.brokers_infos:type_name -> authd.ABResponse.BrokerInfo
 	0,  // 1: authd.SBRequest.mode:type_name -> authd.SessionMode
 	9,  // 2: authd.GAMRequest.supported_ui_layouts:type_name -> authd.UILayout
-	26, // 3: authd.GAMResponse.authentication_modes:type_name -> authd.GAMResponse.AuthenticationMode
+	32, // 3: authd.GAMResponse.authentication_modes:type_name -> authd.GAMResponse.AuthenticationMode
 	9,  // 4: authd.SAMResponse.ui_layout_info:type_name -> authd.UILayout
-	27, // 5: authd.IARequest.authentication_data:type_name -> authd.IARequest.AuthenticationData
-	21, // 6: authd.Users.users:type_name -> authd.User
-	23, // 7: authd.Groups.groups:type_name -> authd.Group
+	33, // 5: authd.IARequest.authentication_data:type_name -> authd.IARequest.AuthenticationData
+	27, // 6: authd.Users.users:type_name -> authd.User
+	29, // 7: authd.Groups.groups:type_name -> authd.Group
 	1,  // 8: authd.PAM.AvailableBrokers:input_type -> authd.Empty
 	2,  // 9: authd.PAM.GetPreviousBroker:input_type -> authd.GPBRequest
 	6,  // 10: authd.PAM.SelectBroker:input_type -> authd.SBRequest
@@ -1820,25 +2114,33 @@ var file_authd_proto_depIdxs = []int32{
 	17, // 16: authd.UserService.GetUserByName:input_type -> authd.GetUserByNameRequest
 	18, // 17: authd.UserService.GetUserByID:input_type -> authd.GetUserByIDRequest
 	1,  // 18: authd.UserService.ListUsers:input_type -> authd.Empty
-	19, // 19: authd.UserService.GetGroupByName:input_type -> authd.GetGroupByNameRequest
-	20, // 20: authd.UserService.GetGroupByID:input_type -> authd.GetGroupByIDRequest
-	1,  // 21: authd.UserService.ListGroups:input_type -> authd.Empty
-	4,  // 22: authd.PAM.AvailableBrokers:output_type -> authd.ABResponse
-	3,  // 23: authd.PAM.GetPreviousBroker:output_type -> authd.GPBResponse
-	7,  // 24: authd.PAM.SelectBroker:output_type -> authd.SBResponse
-	10, // 25: authd.PAM.GetAuthenticationModes:output_type -> authd.GAMResponse
-	12, // 26: authd.PAM.SelectAuthenticationMode:output_type -> authd.SAMResponse
-	14, // 27: authd.PAM.IsAuthenticated:output_type -> authd.IAResponse
-	1,  // 28: authd.PAM.EndSession:output_type -> authd.Empty
-	1,  // 29: authd.PAM.SetDefaultBrokerForUser:output_type -> authd.Empty
-	21, // 30: authd.UserService.GetUserByName:output_type -> authd.User
-	21, // 31: authd.UserService.GetUserByID:output_type -> authd.User
-	22, // 32: authd.UserService.ListUsers:output_type -> authd.Users
-	23, // 33: authd.UserService.GetGroupByName:output_type -> authd.Group
-	23, // 34: authd.UserService.GetGroupByID:output_type -> authd.Group
-	24, // 35: authd.UserService.ListGroups:output_type -> authd.Groups
-	22, // [22:36] is the sub-list for method output_type
-	8,  // [8:22] is the sub-list for method input_type
+	19, // 19: authd.UserService.LockUser:input_type -> authd.LockUserRequest
+	20, // 20: authd.UserService.UnlockUser:input_type -> authd.UnlockUserRequest
+	23, // 21: authd.UserService.SetUserID:input_type -> authd.SetUserIDRequest
+	25, // 22: authd.UserService.SetGroupID:input_type -> authd.SetGroupIDRequest
+	21, // 23: authd.UserService.GetGroupByName:input_type -> authd.GetGroupByNameRequest
+	22, // 24: authd.UserService.GetGroupByID:input_type -> authd.GetGroupByIDRequest
+	1,  // 25: authd.UserService.ListGroups:input_type -> authd.Empty
+	4,  // 26: authd.PAM.AvailableBrokers:output_type -> authd.ABResponse
+	3,  // 27: authd.PAM.GetPreviousBroker:output_type -> authd.GPBResponse
+	7,  // 28: authd.PAM.SelectBroker:output_type -> authd.SBResponse
+	10, // 29: authd.PAM.GetAuthenticationModes:output_type -> authd.GAMResponse
+	12, // 30: authd.PAM.SelectAuthenticationMode:output_type -> authd.SAMResponse
+	14, // 31: authd.PAM.IsAuthenticated:output_type -> authd.IAResponse
+	1,  // 32: authd.PAM.EndSession:output_type -> authd.Empty
+	1,  // 33: authd.PAM.SetDefaultBrokerForUser:output_type -> authd.Empty
+	27, // 34: authd.UserService.GetUserByName:output_type -> authd.User
+	27, // 35: authd.UserService.GetUserByID:output_type -> authd.User
+	28, // 36: authd.UserService.ListUsers:output_type -> authd.Users
+	1,  // 37: authd.UserService.LockUser:output_type -> authd.Empty
+	1,  // 38: authd.UserService.UnlockUser:output_type -> authd.Empty
+	24, // 39: authd.UserService.SetUserID:output_type -> authd.SetUserIDResponse
+	26, // 40: authd.UserService.SetGroupID:output_type -> authd.SetGroupIDResponse
+	29, // 41: authd.UserService.GetGroupByName:output_type -> authd.Group
+	29, // 42: authd.UserService.GetGroupByID:output_type -> authd.Group
+	30, // 43: authd.UserService.ListGroups:output_type -> authd.Groups
+	26, // [26:44] is the sub-list for method output_type
+	8,  // [8:26] is the sub-list for method input_type
 	8,  // [8:8] is the sub-list for extension type_name
 	8,  // [8:8] is the sub-list for extension extendee
 	0,  // [0:8] is the sub-list for field type_name
@@ -1850,8 +2152,8 @@ func file_authd_proto_init() {
 		return
 	}
 	file_authd_proto_msgTypes[8].OneofWrappers = []any{}
-	file_authd_proto_msgTypes[24].OneofWrappers = []any{}
-	file_authd_proto_msgTypes[26].OneofWrappers = []any{
+	file_authd_proto_msgTypes[30].OneofWrappers = []any{}
+	file_authd_proto_msgTypes[32].OneofWrappers = []any{
 		(*IARequest_AuthenticationData_Secret)(nil),
 		(*IARequest_AuthenticationData_Wait)(nil),
 		(*IARequest_AuthenticationData_Skip)(nil),
@@ -1863,7 +2165,7 @@ func file_authd_proto_init() {
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: unsafe.Slice(unsafe.StringData(file_authd_proto_rawDesc), len(file_authd_proto_rawDesc)),
 			NumEnums:      1,
-			NumMessages:   27,
+			NumMessages:   33,
 			NumExtensions: 0,
 			NumServices:   2,
 		},
diff --git a/internal/proto/authd/authd.proto b/internal/proto/authd/authd.proto
index 9ecf9264eb..df108d0f51 100644
--- a/internal/proto/authd/authd.proto
+++ b/internal/proto/authd/authd.proto
@@ -1,7 +1,7 @@
 syntax = "proto3";
 package authd;
 
-option go_package = "github.com/ubuntu/authd/internal/proto/authd";
+option go_package = "github.com/canonical/authd/internal/proto/authd";
 
 message Empty {
 }
@@ -133,6 +133,11 @@ service UserService {
   rpc GetUserByName(GetUserByNameRequest) returns (User);
   rpc GetUserByID(GetUserByIDRequest) returns (User);
   rpc ListUsers(Empty) returns (Users);
+  rpc LockUser(LockUserRequest) returns (Empty);
+  rpc UnlockUser(UnlockUserRequest) returns (Empty);
+  rpc SetUserID(SetUserIDRequest) returns (SetUserIDResponse);
+  rpc SetGroupID(SetGroupIDRequest) returns (SetGroupIDResponse);
+
   rpc GetGroupByName(GetGroupByNameRequest) returns (Group);
   rpc GetGroupByID(GetGroupByIDRequest) returns (Group);
   rpc ListGroups(Empty) returns (Groups);
@@ -147,6 +152,14 @@ message GetUserByIDRequest{
   uint32 id = 1;
 }
 
+message LockUserRequest{
+  string name = 1;
+}
+
+message UnlockUserRequest{
+  string name = 1;
+}
+
 message GetGroupByNameRequest{
   string name = 1;
 }
@@ -155,6 +168,34 @@ message GetGroupByIDRequest{
   uint32 id = 1;
 }
 
+message SetUserIDRequest {
+  string name = 1;
+  uint32 id = 2;
+  // The language to use for any warnings returned.
+  // Note: This is currently not implemented and warnings are always in English.
+  string lang = 3;
+}
+
+message SetUserIDResponse {
+  bool id_changed = 1;
+  bool home_dir_owner_changed = 2;
+  repeated string warnings = 3;
+}
+
+message SetGroupIDRequest {
+  string name = 1;
+  uint32 id = 2;
+  // The language to use for any warnings returned.
+  // Note: This is currently not implemented and warnings are always in English.
+  string lang = 3;
+}
+
+message SetGroupIDResponse {
+  bool id_changed = 1;
+  bool home_dir_owner_changed = 2;
+  repeated string warnings = 3;
+}
+
 message User {
   string name = 1;
   uint32 uid = 2;
diff --git a/internal/proto/authd/authd_grpc.pb.go b/internal/proto/authd/authd_grpc.pb.go
index 9cae2925b1..8685f6fdca 100644
--- a/internal/proto/authd/authd_grpc.pb.go
+++ b/internal/proto/authd/authd_grpc.pb.go
@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
-// - protoc-gen-go-grpc v1.5.1
-// - protoc             v5.29.0
+// - protoc-gen-go-grpc v1.6.0
+// - protoc             v6.33.1
 // source: authd.proto
 
 package authd
@@ -154,28 +154,28 @@ type PAMServer interface {
 type UnimplementedPAMServer struct{}
 
 func (UnimplementedPAMServer) AvailableBrokers(context.Context, *Empty) (*ABResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method AvailableBrokers not implemented")
+	return nil, status.Error(codes.Unimplemented, "method AvailableBrokers not implemented")
 }
 func (UnimplementedPAMServer) GetPreviousBroker(context.Context, *GPBRequest) (*GPBResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method GetPreviousBroker not implemented")
+	return nil, status.Error(codes.Unimplemented, "method GetPreviousBroker not implemented")
 }
 func (UnimplementedPAMServer) SelectBroker(context.Context, *SBRequest) (*SBResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method SelectBroker not implemented")
+	return nil, status.Error(codes.Unimplemented, "method SelectBroker not implemented")
 }
 func (UnimplementedPAMServer) GetAuthenticationModes(context.Context, *GAMRequest) (*GAMResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method GetAuthenticationModes not implemented")
+	return nil, status.Error(codes.Unimplemented, "method GetAuthenticationModes not implemented")
 }
 func (UnimplementedPAMServer) SelectAuthenticationMode(context.Context, *SAMRequest) (*SAMResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method SelectAuthenticationMode not implemented")
+	return nil, status.Error(codes.Unimplemented, "method SelectAuthenticationMode not implemented")
 }
 func (UnimplementedPAMServer) IsAuthenticated(context.Context, *IARequest) (*IAResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method IsAuthenticated not implemented")
+	return nil, status.Error(codes.Unimplemented, "method IsAuthenticated not implemented")
 }
 func (UnimplementedPAMServer) EndSession(context.Context, *ESRequest) (*Empty, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method EndSession not implemented")
+	return nil, status.Error(codes.Unimplemented, "method EndSession not implemented")
 }
 func (UnimplementedPAMServer) SetDefaultBrokerForUser(context.Context, *SDBFURequest) (*Empty, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method SetDefaultBrokerForUser not implemented")
+	return nil, status.Error(codes.Unimplemented, "method SetDefaultBrokerForUser not implemented")
 }
 func (UnimplementedPAMServer) mustEmbedUnimplementedPAMServer() {}
 func (UnimplementedPAMServer) testEmbeddedByValue()             {}
@@ -188,7 +188,7 @@ type UnsafePAMServer interface {
 }
 
 func RegisterPAMServer(s grpc.ServiceRegistrar, srv PAMServer) {
-	// If the following call pancis, it indicates UnimplementedPAMServer was
+	// If the following call panics, it indicates UnimplementedPAMServer was
 	// embedded by pointer and is nil.  This will cause panics if an
 	// unimplemented method is ever invoked, so we test this at initialization
 	// time to prevent it from happening at runtime later due to I/O.
@@ -390,6 +390,10 @@ const (
 	UserService_GetUserByName_FullMethodName  = "/authd.UserService/GetUserByName"
 	UserService_GetUserByID_FullMethodName    = "/authd.UserService/GetUserByID"
 	UserService_ListUsers_FullMethodName      = "/authd.UserService/ListUsers"
+	UserService_LockUser_FullMethodName       = "/authd.UserService/LockUser"
+	UserService_UnlockUser_FullMethodName     = "/authd.UserService/UnlockUser"
+	UserService_SetUserID_FullMethodName      = "/authd.UserService/SetUserID"
+	UserService_SetGroupID_FullMethodName     = "/authd.UserService/SetGroupID"
 	UserService_GetGroupByName_FullMethodName = "/authd.UserService/GetGroupByName"
 	UserService_GetGroupByID_FullMethodName   = "/authd.UserService/GetGroupByID"
 	UserService_ListGroups_FullMethodName     = "/authd.UserService/ListGroups"
@@ -402,6 +406,10 @@ type UserServiceClient interface {
 	GetUserByName(ctx context.Context, in *GetUserByNameRequest, opts ...grpc.CallOption) (*User, error)
 	GetUserByID(ctx context.Context, in *GetUserByIDRequest, opts ...grpc.CallOption) (*User, error)
 	ListUsers(ctx context.Context, in *Empty, opts ...grpc.CallOption) (*Users, error)
+	LockUser(ctx context.Context, in *LockUserRequest, opts ...grpc.CallOption) (*Empty, error)
+	UnlockUser(ctx context.Context, in *UnlockUserRequest, opts ...grpc.CallOption) (*Empty, error)
+	SetUserID(ctx context.Context, in *SetUserIDRequest, opts ...grpc.CallOption) (*SetUserIDResponse, error)
+	SetGroupID(ctx context.Context, in *SetGroupIDRequest, opts ...grpc.CallOption) (*SetGroupIDResponse, error)
 	GetGroupByName(ctx context.Context, in *GetGroupByNameRequest, opts ...grpc.CallOption) (*Group, error)
 	GetGroupByID(ctx context.Context, in *GetGroupByIDRequest, opts ...grpc.CallOption) (*Group, error)
 	ListGroups(ctx context.Context, in *Empty, opts ...grpc.CallOption) (*Groups, error)
@@ -445,6 +453,46 @@ func (c *userServiceClient) ListUsers(ctx context.Context, in *Empty, opts ...gr
 	return out, nil
 }
 
+func (c *userServiceClient) LockUser(ctx context.Context, in *LockUserRequest, opts ...grpc.CallOption) (*Empty, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(Empty)
+	err := c.cc.Invoke(ctx, UserService_LockUser_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *userServiceClient) UnlockUser(ctx context.Context, in *UnlockUserRequest, opts ...grpc.CallOption) (*Empty, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(Empty)
+	err := c.cc.Invoke(ctx, UserService_UnlockUser_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *userServiceClient) SetUserID(ctx context.Context, in *SetUserIDRequest, opts ...grpc.CallOption) (*SetUserIDResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(SetUserIDResponse)
+	err := c.cc.Invoke(ctx, UserService_SetUserID_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *userServiceClient) SetGroupID(ctx context.Context, in *SetGroupIDRequest, opts ...grpc.CallOption) (*SetGroupIDResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(SetGroupIDResponse)
+	err := c.cc.Invoke(ctx, UserService_SetGroupID_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
 func (c *userServiceClient) GetGroupByName(ctx context.Context, in *GetGroupByNameRequest, opts ...grpc.CallOption) (*Group, error) {
 	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(Group)
@@ -482,6 +530,10 @@ type UserServiceServer interface {
 	GetUserByName(context.Context, *GetUserByNameRequest) (*User, error)
 	GetUserByID(context.Context, *GetUserByIDRequest) (*User, error)
 	ListUsers(context.Context, *Empty) (*Users, error)
+	LockUser(context.Context, *LockUserRequest) (*Empty, error)
+	UnlockUser(context.Context, *UnlockUserRequest) (*Empty, error)
+	SetUserID(context.Context, *SetUserIDRequest) (*SetUserIDResponse, error)
+	SetGroupID(context.Context, *SetGroupIDRequest) (*SetGroupIDResponse, error)
 	GetGroupByName(context.Context, *GetGroupByNameRequest) (*Group, error)
 	GetGroupByID(context.Context, *GetGroupByIDRequest) (*Group, error)
 	ListGroups(context.Context, *Empty) (*Groups, error)
@@ -496,22 +548,34 @@ type UserServiceServer interface {
 type UnimplementedUserServiceServer struct{}
 
 func (UnimplementedUserServiceServer) GetUserByName(context.Context, *GetUserByNameRequest) (*User, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method GetUserByName not implemented")
+	return nil, status.Error(codes.Unimplemented, "method GetUserByName not implemented")
 }
 func (UnimplementedUserServiceServer) GetUserByID(context.Context, *GetUserByIDRequest) (*User, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method GetUserByID not implemented")
+	return nil, status.Error(codes.Unimplemented, "method GetUserByID not implemented")
 }
 func (UnimplementedUserServiceServer) ListUsers(context.Context, *Empty) (*Users, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method ListUsers not implemented")
+	return nil, status.Error(codes.Unimplemented, "method ListUsers not implemented")
+}
+func (UnimplementedUserServiceServer) LockUser(context.Context, *LockUserRequest) (*Empty, error) {
+	return nil, status.Error(codes.Unimplemented, "method LockUser not implemented")
+}
+func (UnimplementedUserServiceServer) UnlockUser(context.Context, *UnlockUserRequest) (*Empty, error) {
+	return nil, status.Error(codes.Unimplemented, "method UnlockUser not implemented")
+}
+func (UnimplementedUserServiceServer) SetUserID(context.Context, *SetUserIDRequest) (*SetUserIDResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method SetUserID not implemented")
+}
+func (UnimplementedUserServiceServer) SetGroupID(context.Context, *SetGroupIDRequest) (*SetGroupIDResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method SetGroupID not implemented")
 }
 func (UnimplementedUserServiceServer) GetGroupByName(context.Context, *GetGroupByNameRequest) (*Group, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method GetGroupByName not implemented")
+	return nil, status.Error(codes.Unimplemented, "method GetGroupByName not implemented")
 }
 func (UnimplementedUserServiceServer) GetGroupByID(context.Context, *GetGroupByIDRequest) (*Group, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method GetGroupByID not implemented")
+	return nil, status.Error(codes.Unimplemented, "method GetGroupByID not implemented")
 }
 func (UnimplementedUserServiceServer) ListGroups(context.Context, *Empty) (*Groups, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method ListGroups not implemented")
+	return nil, status.Error(codes.Unimplemented, "method ListGroups not implemented")
 }
 func (UnimplementedUserServiceServer) mustEmbedUnimplementedUserServiceServer() {}
 func (UnimplementedUserServiceServer) testEmbeddedByValue()                     {}
@@ -524,7 +588,7 @@ type UnsafeUserServiceServer interface {
 }
 
 func RegisterUserServiceServer(s grpc.ServiceRegistrar, srv UserServiceServer) {
-	// If the following call pancis, it indicates UnimplementedUserServiceServer was
+	// If the following call panics, it indicates UnimplementedUserServiceServer was
 	// embedded by pointer and is nil.  This will cause panics if an
 	// unimplemented method is ever invoked, so we test this at initialization
 	// time to prevent it from happening at runtime later due to I/O.
@@ -588,6 +652,78 @@ func _UserService_ListUsers_Handler(srv interface{}, ctx context.Context, dec fu
 	return interceptor(ctx, in, info, handler)
 }
 
+func _UserService_LockUser_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(LockUserRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(UserServiceServer).LockUser(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: UserService_LockUser_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(UserServiceServer).LockUser(ctx, req.(*LockUserRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _UserService_UnlockUser_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(UnlockUserRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(UserServiceServer).UnlockUser(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: UserService_UnlockUser_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(UserServiceServer).UnlockUser(ctx, req.(*UnlockUserRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _UserService_SetUserID_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(SetUserIDRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(UserServiceServer).SetUserID(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: UserService_SetUserID_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(UserServiceServer).SetUserID(ctx, req.(*SetUserIDRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _UserService_SetGroupID_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(SetGroupIDRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(UserServiceServer).SetGroupID(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: UserService_SetGroupID_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(UserServiceServer).SetGroupID(ctx, req.(*SetGroupIDRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
 func _UserService_GetGroupByName_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
 	in := new(GetGroupByNameRequest)
 	if err := dec(in); err != nil {
@@ -661,6 +797,22 @@ var UserService_ServiceDesc = grpc.ServiceDesc{
 			MethodName: "ListUsers",
 			Handler:    _UserService_ListUsers_Handler,
 		},
+		{
+			MethodName: "LockUser",
+			Handler:    _UserService_LockUser_Handler,
+		},
+		{
+			MethodName: "UnlockUser",
+			Handler:    _UserService_UnlockUser_Handler,
+		},
+		{
+			MethodName: "SetUserID",
+			Handler:    _UserService_SetUserID_Handler,
+		},
+		{
+			MethodName: "SetGroupID",
+			Handler:    _UserService_SetGroupID_Handler,
+		},
 		{
 			MethodName: "GetGroupByName",
 			Handler:    _UserService_GetGroupByName_Handler,
diff --git a/internal/services/errmessages/redactor.go b/internal/services/errmessages/redactor.go
index 217bdfe956..3fa37dd059 100644
--- a/internal/services/errmessages/redactor.go
+++ b/internal/services/errmessages/redactor.go
@@ -6,7 +6,6 @@ import (
 	"errors"
 	"fmt"
 
-	"github.com/ubuntu/authd/log"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
@@ -18,7 +17,6 @@ import (
 func RedactErrorInterceptor(ctx context.Context, req any, _ *grpc.UnaryServerInfo, handler grpc.UnaryHandler) (any, error) {
 	m, err := handler(ctx, req)
 	if err != nil {
-		log.Warning(context.TODO(), err.Error())
 		var redactedError ToDisplayError
 		if !errors.As(err, &redactedError) {
 			return m, err
@@ -54,6 +52,9 @@ func FormatErrorMessage(ctx context.Context, method string, req, reply any, cc *
 	// likely means that IsAuthenticated got cancelled, so we need to keep the error intact
 	case codes.Canceled:
 		break
+	case codes.PermissionDenied:
+		// permission denied, just format it
+		err = fmt.Errorf("permission denied: %v", st.Message())
 	// grpc error, just format it
 	default:
 		err = fmt.Errorf("error %s from server: %v", st.Code(), st.Message())
diff --git a/internal/services/manager.go b/internal/services/manager.go
index dab6bcc3b6..1c28c3e031 100644
--- a/internal/services/manager.go
+++ b/internal/services/manager.go
@@ -4,19 +4,18 @@ package services
 import (
 	"context"
 
-	"github.com/ubuntu/authd/internal/brokers"
-	"github.com/ubuntu/authd/internal/consts"
-	"github.com/ubuntu/authd/internal/proto/authd"
-	"github.com/ubuntu/authd/internal/services/errmessages"
-	"github.com/ubuntu/authd/internal/services/pam"
-	"github.com/ubuntu/authd/internal/services/permissions"
-	"github.com/ubuntu/authd/internal/services/user"
-	"github.com/ubuntu/authd/internal/users"
-	"github.com/ubuntu/authd/log"
+	"github.com/canonical/authd/internal/brokers"
+	"github.com/canonical/authd/internal/consts"
+	"github.com/canonical/authd/internal/proto/authd"
+	"github.com/canonical/authd/internal/services/errmessages"
+	"github.com/canonical/authd/internal/services/pam"
+	"github.com/canonical/authd/internal/services/permissions"
+	"github.com/canonical/authd/internal/services/user"
+	"github.com/canonical/authd/internal/users"
+	"github.com/canonical/authd/log"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/health"
 	healthgrpc "google.golang.org/grpc/health/grpc_health_v1"
-	healthpb "google.golang.org/grpc/health/grpc_health_v1"
 )
 
 // Manager mediate the whole business logic of the application.
@@ -67,7 +66,7 @@ func (m Manager) RegisterGRPCServices(ctx context.Context) *grpc.Server {
 	// We may provide status per each service, but for now we only care about the global state.
 	// Also, we're serving by default because all the brokers have been initialized at this
 	// point, so no need to start in NOT_SERVING mode and then update it accordingly.
-	defer healthCheck.SetServingStatus(consts.ServiceName, healthpb.HealthCheckResponse_SERVING)
+	defer healthCheck.SetServingStatus(consts.ServiceName, healthgrpc.HealthCheckResponse_SERVING)
 
 	authd.RegisterUserServiceServer(grpcServer, m.userService)
 	authd.RegisterPAMServer(grpcServer, m.pamService)
diff --git a/internal/services/manager_test.go b/internal/services/manager_test.go
index 997c8efcfa..01fd3f59e7 100644
--- a/internal/services/manager_test.go
+++ b/internal/services/manager_test.go
@@ -10,13 +10,13 @@ import (
 	"slices"
 	"testing"
 
+	"github.com/canonical/authd/internal/proto/authd"
+	"github.com/canonical/authd/internal/services"
+	"github.com/canonical/authd/internal/services/errmessages"
+	"github.com/canonical/authd/internal/testutils"
+	"github.com/canonical/authd/internal/testutils/golden"
+	"github.com/canonical/authd/internal/users"
 	"github.com/stretchr/testify/require"
-	"github.com/ubuntu/authd/internal/proto/authd"
-	"github.com/ubuntu/authd/internal/services"
-	"github.com/ubuntu/authd/internal/services/errmessages"
-	"github.com/ubuntu/authd/internal/testutils"
-	"github.com/ubuntu/authd/internal/testutils/golden"
-	"github.com/ubuntu/authd/internal/users"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/credentials/insecure"
 )
diff --git a/internal/services/pam/pam.go b/internal/services/pam/pam.go
index 6125eb6731..3f0d9349ae 100644
--- a/internal/services/pam/pam.go
+++ b/internal/services/pam/pam.go
@@ -9,15 +9,15 @@ import (
 	"os/user"
 	"strings"
 
-	"github.com/ubuntu/authd/internal/brokers"
-	"github.com/ubuntu/authd/internal/brokers/auth"
-	"github.com/ubuntu/authd/internal/brokers/layouts"
-	"github.com/ubuntu/authd/internal/proto/authd"
-	"github.com/ubuntu/authd/internal/services/permissions"
-	"github.com/ubuntu/authd/internal/users"
-	"github.com/ubuntu/authd/internal/users/types"
-	"github.com/ubuntu/authd/log"
-	"github.com/ubuntu/decorate"
+	"github.com/canonical/authd/internal/brokers"
+	"github.com/canonical/authd/internal/brokers/auth"
+	"github.com/canonical/authd/internal/brokers/layouts"
+	"github.com/canonical/authd/internal/decorate"
+	"github.com/canonical/authd/internal/proto/authd"
+	"github.com/canonical/authd/internal/services/permissions"
+	"github.com/canonical/authd/internal/users"
+	"github.com/canonical/authd/internal/users/types"
+	"github.com/canonical/authd/log"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
 	"google.golang.org/protobuf/encoding/protojson"
@@ -63,26 +63,29 @@ func (s Service) AvailableBrokers(ctx context.Context, _ *authd.Empty) (*authd.A
 // GetPreviousBroker returns the previous broker set for a given user, if any.
 // If the user is not in our cache/database, it will try to check if it’s on the system, and return then "local".
 func (s Service) GetPreviousBroker(ctx context.Context, req *authd.GPBRequest) (*authd.GPBResponse, error) {
+	// authd usernames are lowercase
+	username := strings.ToLower(req.GetUsername())
+
 	// Use in memory cache first
-	if b := s.brokerManager.BrokerForUser(req.GetUsername()); b != nil {
+	if b := s.brokerManager.BrokerForUser(username); b != nil {
 		return &authd.GPBResponse{PreviousBroker: b.ID}, nil
 	}
 
 	// Load from database.
-	brokerID, err := s.userManager.BrokerForUser(req.GetUsername())
+	brokerID, err := s.userManager.BrokerForUser(username)
 	// User is not in our database.
 	if err != nil && errors.Is(err, users.NoDataFoundError{}) {
 		// FIXME: this part will not be here in the v2 API version, as we won’t have GetPreviousBroker and handle
 		// autoselection silently in authd.
 		// User not in database, if there is only the local broker available, return this one without saving it.
 		if len(s.brokerManager.AvailableBrokers()) == 1 {
-			log.Debugf(ctx, "User %q is not handled by authd and only local broker: select it.", req.GetUsername())
+			log.Debugf(ctx, "GetPreviousBroker: User %q not found in database and only local broker available, selecting local broker", req.GetUsername())
 			return &authd.GPBResponse{PreviousBroker: brokers.LocalBrokerName}, nil
 		}
 
 		// User not accessible through NSS, first time login or no valid user. Anyway, no broker selected.
-		if _, err := user.Lookup(req.GetUsername()); err != nil {
-			log.Debugf(ctx, "User %q is unknown", req.GetUsername())
+		if _, err := user.Lookup(username); err != nil {
+			log.Debugf(ctx, "GetPreviousBroker: User %q not found", username)
 			return &authd.GPBResponse{}, nil
 		}
 
@@ -90,29 +93,31 @@ func (s Service) GetPreviousBroker(ctx context.Context, req *authd.GPBRequest) (
 		// service (passwd, winbind, sss…) is handling that user.
 		brokerID = brokers.LocalBrokerName
 	} else if err != nil {
-		log.Infof(ctx, "Could not get previous broker for user %q from database: %v", req.GetUsername(), err)
+		log.Infof(ctx, "GetPreviousBroker: Could not get broker for user %q from database: %v", username, err)
 		return &authd.GPBResponse{}, nil
 	}
 
 	// No error but the brokerID is empty (broker in database but default broker not stored yet due no successful login)
 	if brokerID == "" {
-		log.Infof(ctx, "No assigned broker for user %q from database", req.GetUsername())
+		log.Infof(ctx, "GetPreviousBroker: No broker set for user %q, letting the user select a new one", username)
 		return &authd.GPBResponse{}, nil
 	}
 
+	// Check if the broker still exists. Its config file might have been removed from the config directory after the
+	// user logged in the last time, in which case we let the user select a new broker.
 	if !s.brokerManager.BrokerExists(brokerID) {
-		log.Warningf(ctx, "Last used broker %q is not available for user %q, letting the user select a new one", brokerID, req.GetUsername())
+		log.Warningf(ctx, "GetPreviousBroker: Broker %q set for user %q does not exist, letting the user select a new one", brokerID, req.GetUsername())
 		return &authd.GPBResponse{}, nil
 	}
 
-	// Database the broker which should be used for the user, so that we don't have to query the database again next time -
+	// Cache the broker which should be used for the user, so that we don't have to query the database again next time -
 	// except if the broker is the local broker, because then the decision to use the local broker should be made each
 	// time the user tries to log in, based on whether the user is provided by any other NSS service.
 	if brokerID == brokers.LocalBrokerName {
 		return &authd.GPBResponse{PreviousBroker: brokerID}, nil
 	}
-	if err = s.brokerManager.SetDefaultBrokerForUser(brokerID, req.GetUsername()); err != nil {
-		log.Warningf(ctx, "Could not set default broker %q for user %q: %v", brokerID, req.GetUsername(), err)
+	if err = s.brokerManager.SetDefaultBrokerForUser(brokerID, username); err != nil {
+		log.Warningf(ctx, "GetPreviousBroker: Could not cache broker %q for user %q: %v", brokerID, username, err)
 		return &authd.GPBResponse{}, nil
 	}
 
@@ -123,19 +128,17 @@ func (s Service) GetPreviousBroker(ctx context.Context, req *authd.GPBRequest) (
 
 // SelectBroker starts a new session and selects the requested broker for the user.
 func (s Service) SelectBroker(ctx context.Context, req *authd.SBRequest) (resp *authd.SBResponse, err error) {
-	defer decorate.OnError(&err, "can't start authentication transaction")
-
-	username := req.GetUsername()
+	// authd usernames are lowercase
+	username := strings.ToLower(req.GetUsername())
 	brokerID := req.GetBrokerId()
 	lang := req.GetLang()
 
-	// authd usernames are lowercase
-	username = strings.ToLower(username)
-
 	if username == "" {
+		log.Errorf(ctx, "SelectBroker: No user name provided")
 		return nil, status.Error(codes.InvalidArgument, "no user name provided")
 	}
 	if brokerID == "" {
+		log.Errorf(ctx, "SelectBroker: No broker selected")
 		return nil, status.Error(codes.InvalidArgument, "no broker selected")
 	}
 	if lang == "" {
@@ -149,19 +152,21 @@ func (s Service) SelectBroker(ctx context.Context, req *authd.SBRequest) (resp *
 	case authd.SessionMode_CHANGE_PASSWORD:
 		mode = auth.SessionModeChangePassword
 	default:
+		log.Errorf(ctx, "SelectBroker: Invalid session mode %q", req.GetMode())
 		return nil, status.Error(codes.InvalidArgument, "invalid session mode")
 	}
 
 	// Create a session and Memorize selected broker for it.
 	sessionID, encryptionKey, err := s.brokerManager.NewSession(brokerID, username, lang, mode)
 	if err != nil {
+		log.Errorf(ctx, "SelectBroker: Could not create session for user %q with broker %q: %v", username, brokerID, err)
 		return nil, err
 	}
 
 	return &authd.SBResponse{
 		SessionId:     sessionID,
 		EncryptionKey: encryptionKey,
-	}, err
+	}, nil
 }
 
 // GetAuthenticationModes fetches a list of authentication modes supported by the broker depending on the session information.
@@ -170,11 +175,13 @@ func (s Service) GetAuthenticationModes(ctx context.Context, req *authd.GAMReque
 
 	sessionID := req.GetSessionId()
 	if sessionID == "" {
+		log.Errorf(ctx, "GetAuthenticationModes: No session ID provided")
 		return nil, status.Error(codes.InvalidArgument, "no session ID provided")
 	}
 
 	broker, err := s.brokerManager.BrokerFromSessionID(sessionID)
 	if err != nil {
+		log.Errorf(ctx, "GetAuthenticationModes: Could not get broker for session %q: %v", sessionID, err)
 		return nil, err
 	}
 
@@ -182,6 +189,7 @@ func (s Service) GetAuthenticationModes(ctx context.Context, req *authd.GAMReque
 	for _, l := range req.GetSupportedUiLayouts() {
 		layout, err := uiLayoutToMap(l)
 		if err != nil {
+			log.Errorf(ctx, "GetAuthenticationModes: Invalid UI layout %v: %v", l, err)
 			return nil, err
 		}
 		supportedLayouts = append(supportedLayouts, layout)
@@ -189,6 +197,7 @@ func (s Service) GetAuthenticationModes(ctx context.Context, req *authd.GAMReque
 
 	authenticationModes, err := broker.GetAuthenticationModes(ctx, sessionID, supportedLayouts)
 	if err != nil {
+		log.Errorf(ctx, "GetAuthenticationModes: Could not get authentication modes for session %q: %v", sessionID, err)
 		return nil, err
 	}
 
@@ -213,19 +222,23 @@ func (s Service) SelectAuthenticationMode(ctx context.Context, req *authd.SAMReq
 	authenticationModeID := req.GetAuthenticationModeId()
 
 	if sessionID == "" {
+		log.Errorf(ctx, "SelectAuthenticationMode: No session ID provided")
 		return nil, status.Error(codes.InvalidArgument, "no session ID provided")
 	}
 	if authenticationModeID == "" {
+		log.Errorf(ctx, "SelectAuthenticationMode: No authentication mode provided")
 		return nil, status.Error(codes.InvalidArgument, "no authentication mode provided")
 	}
 
 	broker, err := s.brokerManager.BrokerFromSessionID(sessionID)
 	if err != nil {
+		log.Errorf(ctx, "SelectAuthenticationMode: Could not get broker for session %q: %v", sessionID, err)
 		return nil, err
 	}
 
 	uiLayoutInfo, err := broker.SelectAuthenticationMode(ctx, sessionID, authenticationModeID)
 	if err != nil {
+		log.Errorf(ctx, "SelectAuthenticationMode: Could not select authentication mode %q for session %q: %v", authenticationModeID, sessionID, err)
 		return nil, err
 	}
 
@@ -236,25 +249,27 @@ func (s Service) SelectAuthenticationMode(ctx context.Context, req *authd.SAMReq
 
 // IsAuthenticated returns broker answer to authentication request.
 func (s Service) IsAuthenticated(ctx context.Context, req *authd.IARequest) (resp *authd.IAResponse, err error) {
-	defer decorate.OnError(&err, "can't check authentication")
-
 	sessionID := req.GetSessionId()
 	if sessionID == "" {
+		log.Errorf(ctx, "IsAuthenticated: No session ID provided")
 		return nil, status.Error(codes.InvalidArgument, "no session ID provided")
 	}
 
 	broker, err := s.brokerManager.BrokerFromSessionID(sessionID)
 	if err != nil {
+		log.Errorf(ctx, "IsAuthenticated: Could not get broker for session %q: %v", sessionID, err)
 		return nil, err
 	}
 
 	authenticationDataJSON, err := protojson.Marshal(req.GetAuthenticationData())
 	if err != nil {
+		log.Errorf(ctx, "IsAuthenticated: Could not marshal authentication data for session %q: %v", sessionID, err)
 		return nil, err
 	}
 
 	access, data, err := broker.IsAuthenticated(ctx, sessionID, string(authenticationDataJSON))
 	if err != nil {
+		log.Errorf(ctx, "IsAuthenticated: Could not check authentication for session %q: %v", sessionID, err)
 		return nil, err
 	}
 
@@ -269,11 +284,34 @@ func (s Service) IsAuthenticated(ctx context.Context, req *authd.IARequest) (res
 
 	var uInfo types.UserInfo
 	if err := json.Unmarshal([]byte(data), &uInfo); err != nil {
+		log.Errorf(ctx, "IsAuthenticated: Could not unmarshal user data for session %q: %v", sessionID, err)
 		return nil, fmt.Errorf("user data from broker invalid: %v", err)
 	}
 
+	// authd uses lowercase user and group names
+	uInfo.Name = strings.ToLower(uInfo.Name)
+	for i, g := range uInfo.Groups {
+		uInfo.Groups[i].Name = strings.ToLower(g.Name)
+	}
+
+	// Check if the user is locked. We can only do this after the broker has granted access, because we want to avoid
+	// leaking whether a user exists or not to unauthenticated users.
+	// TODO: We might want to let the broker know whether the user is locked or not, so that it can avoid storing any
+	//       updated tokens or user info on disk.
+	userIsLocked, err := s.userManager.IsUserLocked(uInfo.Name)
+	if err != nil && !errors.Is(err, users.NoDataFoundError{}) {
+		log.Errorf(ctx, "IsAuthenticated: Could not check if user %q is locked: %v", uInfo.Name, err)
+		return nil, fmt.Errorf("could not check if user %q is locked: %w", uInfo.Name, err)
+	}
+	// Throw an error if the user trying to authenticate already exists in the database and is locked
+	if err == nil && userIsLocked {
+		log.Noticef(ctx, "Authentication failure: user %q is locked", uInfo.Name)
+		return nil, status.Error(codes.PermissionDenied, fmt.Sprintf("user %s is locked", uInfo.Name))
+	}
+
 	// Update database and local groups on granted auth.
 	if err := s.userManager.UpdateUser(uInfo); err != nil {
+		log.Errorf(ctx, "IsAuthenticated: Could not update user %q in database: %v", uInfo.Name, err)
 		return nil, err
 	}
 
@@ -287,21 +325,29 @@ func (s Service) IsAuthenticated(ctx context.Context, req *authd.IARequest) (res
 func (s Service) SetDefaultBrokerForUser(ctx context.Context, req *authd.SDBFURequest) (empty *authd.Empty, err error) {
 	defer decorate.OnError(&err, "can't set default broker %q for user %q", req.GetBrokerId(), req.GetUsername())
 
-	if req.GetUsername() == "" {
+	// authd usernames are lowercase
+	username := strings.ToLower(req.GetUsername())
+	brokerID := req.GetBrokerId()
+
+	if username == "" {
+		log.Errorf(ctx, "SetDefaultBrokerForUser: No user name given")
 		return nil, status.Error(codes.InvalidArgument, "no user name given")
 	}
 
 	// Don't allow setting the default broker to the local broker, because the decision to use the local broker should
 	// be made each time the user tries to log in, based on whether the user is provided by any other NSS service.
-	if req.GetBrokerId() == brokers.LocalBrokerName {
+	if brokerID == brokers.LocalBrokerName {
+		log.Errorf(ctx, "SetDefaultBrokerForUser: Can't set local broker as default for user %q", username)
 		return nil, status.Error(codes.InvalidArgument, "can't set local broker as default")
 	}
 
-	if err = s.brokerManager.SetDefaultBrokerForUser(req.GetBrokerId(), req.GetUsername()); err != nil {
+	if err = s.brokerManager.SetDefaultBrokerForUser(brokerID, username); err != nil {
+		log.Errorf(ctx, "SetDefaultBrokerForUser: Could not set default broker %q for user %q: %v", brokerID, username, err)
 		return &authd.Empty{}, err
 	}
 
-	if err = s.userManager.UpdateBrokerForUser(req.GetUsername(), req.GetBrokerId()); err != nil {
+	if err = s.userManager.UpdateBrokerForUser(username, brokerID); err != nil {
+		log.Errorf(ctx, "SetDefaultBrokerForUser: Could not update broker for user %q in database: %v", username, err)
 		return &authd.Empty{}, err
 	}
 
@@ -314,6 +360,7 @@ func (s Service) EndSession(ctx context.Context, req *authd.ESRequest) (empty *a
 
 	sessionID := req.GetSessionId()
 	if sessionID == "" {
+		log.Errorf(ctx, "EndSession: No session ID given")
 		return nil, status.Error(codes.InvalidArgument, "no session id given")
 	}
 
diff --git a/internal/services/pam/pam_test.go b/internal/services/pam/pam_test.go
index f900139617..77beba8367 100644
--- a/internal/services/pam/pam_test.go
+++ b/internal/services/pam/pam_test.go
@@ -14,22 +14,22 @@ import (
 	"testing"
 	"time"
 
+	"github.com/canonical/authd/internal/brokers"
+	"github.com/canonical/authd/internal/brokers/auth"
+	"github.com/canonical/authd/internal/brokers/layouts"
+	"github.com/canonical/authd/internal/proto/authd"
+	"github.com/canonical/authd/internal/services/errmessages"
+	"github.com/canonical/authd/internal/services/pam"
+	"github.com/canonical/authd/internal/services/permissions"
+	"github.com/canonical/authd/internal/testutils"
+	"github.com/canonical/authd/internal/testutils/golden"
+	"github.com/canonical/authd/internal/users"
+	"github.com/canonical/authd/internal/users/db"
+	localgroupstestutils "github.com/canonical/authd/internal/users/localentries/testutils"
+	userslocking "github.com/canonical/authd/internal/users/locking"
+	userstestutils "github.com/canonical/authd/internal/users/testutils"
+	"github.com/canonical/authd/log"
 	"github.com/stretchr/testify/require"
-	"github.com/ubuntu/authd/internal/brokers"
-	"github.com/ubuntu/authd/internal/brokers/auth"
-	"github.com/ubuntu/authd/internal/brokers/layouts"
-	"github.com/ubuntu/authd/internal/proto/authd"
-	"github.com/ubuntu/authd/internal/services/errmessages"
-	"github.com/ubuntu/authd/internal/services/pam"
-	"github.com/ubuntu/authd/internal/services/permissions"
-	"github.com/ubuntu/authd/internal/testutils"
-	"github.com/ubuntu/authd/internal/testutils/golden"
-	"github.com/ubuntu/authd/internal/users"
-	"github.com/ubuntu/authd/internal/users/db"
-	"github.com/ubuntu/authd/internal/users/idgenerator"
-	localgroupstestutils "github.com/ubuntu/authd/internal/users/localentries/testutils"
-	userstestutils "github.com/ubuntu/authd/internal/users/testutils"
-	"github.com/ubuntu/authd/log"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/credentials/insecure"
 )
@@ -134,15 +134,16 @@ func TestGetPreviousBroker(t *testing.T) {
 		wantBroker string
 		wantErr    bool
 	}{
-		"Success_getting_previous_broker":                          {user: "userwithbroker", wantBroker: mockBrokerGeneratedID},
+		"Success_getting_previous_broker":                          {user: "userwithbroker@example.com", wantBroker: mockBrokerGeneratedID},
 		"For_local_user,_get_local_broker":                         {user: currentUsername, wantBroker: brokers.LocalBrokerName},
-		"For_unmanaged_user_and_only_one_broker,_get_local_broker": {user: "nonexistent", onlyLocalBroker: true, wantBroker: brokers.LocalBrokerName},
+		"For_unmanaged_user_and_only_one_broker,_get_local_broker": {user: "nonexistent@example.com", onlyLocalBroker: true, wantBroker: brokers.LocalBrokerName},
+		"Username_is_case_insensitive":                             {user: "UserWithBroker@example.com", wantBroker: mockBrokerGeneratedID},
 
-		"Returns_empty_when_user_does_not_exist":         {user: "nonexistent", wantBroker: ""},
-		"Returns_empty_when_user_does_not_have_a_broker": {user: "userwithoutbroker", wantBroker: ""},
-		"Returns_empty_when_broker_is_not_available":     {user: "userwithinactivebroker", wantBroker: ""},
+		"Returns_empty_when_user_does_not_exist":         {user: "nonexistent@example.com", wantBroker: ""},
+		"Returns_empty_when_user_does_not_have_a_broker": {user: "userwithoutbroker@example.com", wantBroker: ""},
+		"Returns_empty_when_broker_is_not_available":     {user: "userwithinactivebroker@example.com", wantBroker: ""},
 
-		"Error_when_not_root": {user: "userwithbroker", currentUserNotRoot: true, wantErr: true},
+		"Error_when_not_root": {user: "userwithbroker@example.com", currentUserNotRoot: true, wantErr: true},
 	}
 	for name, tc := range tests {
 		t.Run(name, func(t *testing.T) {
@@ -193,29 +194,40 @@ func TestSelectBroker(t *testing.T) {
 		brokerID    string
 		username    string
 		sessionMode string
+		existingDB  string
 
 		currentUserNotRoot bool
 
 		wantErr bool
 	}{
-		"Successfully_select_a_broker_and_creates_auth_session":   {username: "success", sessionMode: auth.SessionModeLogin},
-		"Successfully_select_a_broker_and_creates_passwd_session": {username: "success", sessionMode: auth.SessionModeChangePassword},
+		"Successfully_select_a_broker_and_creates_auth_session":   {username: "success@example.com", sessionMode: auth.SessionModeLogin},
+		"Successfully_select_a_broker_and_creates_passwd_session": {username: "success@example.com", sessionMode: auth.SessionModeChangePassword},
 
-		"Error_when_not_root":                             {username: "success", currentUserNotRoot: true, wantErr: true},
+		"Error_when_not_root":                             {username: "success@example.com", currentUserNotRoot: true, wantErr: true},
 		"Error_when_username_is_empty":                    {wantErr: true},
 		"Error_when_mode_is_empty":                        {sessionMode: "-", wantErr: true},
 		"Error_when_mode_does_not_exist":                  {sessionMode: "does not exist", wantErr: true},
-		"Error_when_brokerID_is_empty":                    {username: "empty broker", brokerID: "-", wantErr: true},
-		"Error_when_broker_does_not_exist":                {username: "no broker", brokerID: "does not exist", wantErr: true},
-		"Error_when_broker_does_not_provide_a_session_ID": {username: "ns_no_id", wantErr: true},
-		"Error_when_starting_the_session":                 {username: "ns_error", wantErr: true},
+		"Error_when_brokerID_is_empty":                    {username: "empty broker@example.com", brokerID: "-", wantErr: true},
+		"Error_when_broker_does_not_exist":                {username: "no broker@example.com", brokerID: "does not exist", wantErr: true},
+		"Error_when_broker_does_not_provide_a_session_ID": {username: "ns_no_id@example.com", wantErr: true},
+		"Error_when_starting_the_session":                 {username: "ns_error@example.com", wantErr: true},
 	}
 	for name, tc := range tests {
 		t.Run(name, func(t *testing.T) {
 			t.Parallel()
 
+			cacheDir := t.TempDir()
+			if tc.existingDB != "" {
+				err := db.Z_ForTests_CreateDBFromYAML(filepath.Join(testutils.TestFamilyPath(t), tc.existingDB), cacheDir)
+				require.NoError(t, err, "Setup: could not create database from testdata")
+			}
+
+			m, err := users.NewManager(users.DefaultConfig, cacheDir)
+			require.NoError(t, err, "Setup: could not create user manager")
+			t.Cleanup(func() { _ = m.Stop() })
+
 			pm := newPermissionManager(t, tc.currentUserNotRoot)
-			client := newPamClient(t, nil, globalBrokerManager, &pm)
+			client := newPamClient(t, m, globalBrokerManager, &pm)
 
 			switch tc.brokerID {
 			case "":
@@ -271,14 +283,14 @@ func TestGetAuthenticationModes(t *testing.T) {
 		wantErr bool
 	}{
 		"Successfully_get_authentication_modes":          {},
-		"Successfully_get_multiple_authentication_modes": {username: "gam_multiple_modes"},
+		"Successfully_get_multiple_authentication_modes": {username: "gam_multiple_modes@example.com"},
 
 		"Error_when_not_root":                     {currentUserNotRoot: true, wantErr: true},
 		"Error_when_sessionID_is_empty":           {sessionID: "-", wantErr: true},
 		"Error_when_passing_invalid_layout":       {supportedUILayouts: []*authd.UILayout{emptyType}, wantErr: true},
 		"Error_when_sessionID_is_invalid":         {sessionID: "invalid-session", wantErr: true},
-		"Error_when_getting_authentication_modes": {username: "gam_error", wantErr: true},
-		"Error_when_broker_returns_invalid_modes": {username: "gam_invalid", wantErr: true},
+		"Error_when_getting_authentication_modes": {username: "gam_error@example.com", wantErr: true},
+		"Error_when_broker_returns_invalid_modes": {username: "gam_invalid@example.com", wantErr: true},
 	}
 	for name, tc := range tests {
 		t.Run(name, func(t *testing.T) {
@@ -336,24 +348,24 @@ func TestSelectAuthenticationMode(t *testing.T) {
 
 		wantErr bool
 	}{
-		"Successfully_select_mode_with_required_value":         {username: "sam_success_required_entry", supportedUILayouts: []*authd.UILayout{requiredEntry}},
-		"Successfully_select_mode_with_missing_optional_value": {username: "sam_missing_optional_entry", supportedUILayouts: []*authd.UILayout{optionalEntry}},
+		"Successfully_select_mode_with_required_value":         {username: "sam_success_required_entry@example.com", supportedUILayouts: []*authd.UILayout{requiredEntry}},
+		"Successfully_select_mode_with_missing_optional_value": {username: "sam_missing_optional_entry@example.com", supportedUILayouts: []*authd.UILayout{optionalEntry}},
 
 		// service errors
-		"Error_when_not_root":                {username: "sam_success_required_entry", currentUserNotRoot: true, wantErr: true},
+		"Error_when_not_root":                {username: "sam_success_required_entry@example.com", currentUserNotRoot: true, wantErr: true},
 		"Error_when_sessionID_is_empty":      {sessionID: "-", wantErr: true},
 		"Error_when_session_ID_is_invalid":   {sessionID: "invalid-session", wantErr: true},
 		"Error_when_no_authmode_is_selected": {sessionID: "no auth mode", authMode: "-", wantErr: true},
 
 		// broker errors
-		"Error_when_selecting_invalid_auth_mode":                     {username: "sam_error", supportedUILayouts: []*authd.UILayout{requiredEntry}, wantErr: true},
-		"Error_when_broker_does_not_have_validators_for_the_session": {username: "does not matter", noValidators: true, wantErr: true},
+		"Error_when_selecting_invalid_auth_mode":                     {username: "sam_error@example.com", supportedUILayouts: []*authd.UILayout{requiredEntry}, wantErr: true},
+		"Error_when_broker_does_not_have_validators_for_the_session": {username: "does not matter@example.com", noValidators: true, wantErr: true},
 
 		/* Layout errors */
-		"Error_when_returns_no_layout":                     {username: "sam_no_layout", supportedUILayouts: []*authd.UILayout{requiredEntry}, wantErr: true},
-		"Error_when_returns_layout_with_no_type":           {username: "sam_no_layout_type", supportedUILayouts: []*authd.UILayout{requiredEntry}, wantErr: true},
-		"Error_when_returns_layout_without_required_value": {username: "sam_missing_required_entry", supportedUILayouts: []*authd.UILayout{requiredEntry}, wantErr: true},
-		"Error_when_returns_layout_with_unknown_field":     {username: "sam_unknown_field", supportedUILayouts: []*authd.UILayout{requiredEntry}, wantErr: true},
+		"Error_when_returns_no_layout":                     {username: "sam_no_layout@example.com", supportedUILayouts: []*authd.UILayout{requiredEntry}, wantErr: true},
+		"Error_when_returns_layout_with_no_type":           {username: "sam_no_layout_type@example.com", supportedUILayouts: []*authd.UILayout{requiredEntry}, wantErr: true},
+		"Error_when_returns_layout_without_required_value": {username: "sam_missing_required_entry@example.com", supportedUILayouts: []*authd.UILayout{requiredEntry}, wantErr: true},
+		"Error_when_returns_layout_with_unknown_field":     {username: "sam_unknown_field@example.com", supportedUILayouts: []*authd.UILayout{requiredEntry}, wantErr: true},
 	}
 	for name, tc := range tests {
 		t.Run(name, func(t *testing.T) {
@@ -424,27 +436,30 @@ func TestIsAuthenticated(t *testing.T) {
 
 		// There is no wantErr as it's stored in the golden file.
 	}{
-		"Successfully_authenticate":                           {username: "success"},
-		"Successfully_authenticate_if_first_call_is_canceled": {username: "ia_second_call", secondCall: true, cancelFirstCall: true},
-		"Denies_authentication_when_broker_times_out":         {username: "ia_timeout"},
-		"Update_existing_DB_on_success":                       {username: "success", existingDB: "cache-with-user.db"},
-		"Update_local_groups":                                 {username: "success_with_local_groups", localGroupsFile: "valid.group"},
+		"Successfully_authenticate":                            {username: "success@example.com"},
+		"Successfully_authenticate_if_first_call_is_canceled":  {username: "ia_second_call@example.com", secondCall: true, cancelFirstCall: true},
+		"Denies_authentication_when_broker_times_out":          {username: "ia_timeout@example.com"},
+		"Update_existing_DB_on_success":                        {username: "success@example.com", existingDB: "cache-with-user.db"},
+		"Update_local_groups":                                  {username: "success_with_local_groups@example.com", localGroupsFile: "valid.group"},
+		"Successfully_authenticate_user_with_uppercase":        {username: "SUCCESS@example.com"},
+		"Successfully_authenticate_with_groups_with_uppercase": {username: "success_with_uppercase_groups@example.com"},
 
 		// service errors
-		"Error_when_not_root":           {username: "success", currentUserNotRoot: true},
+		"Error_when_not_root":           {username: "success@example.com", currentUserNotRoot: true},
 		"Error_when_sessionID_is_empty": {sessionID: "-"},
 		"Error_when_there_is_no_broker": {sessionID: "invalid-session"},
+		"Error_when_user_is_locked":     {username: "locked@example.com", existingDB: "cache-with-locked-user.db"},
 
 		// broker errors
-		"Error_when_authenticating":                         {username: "ia_error"},
-		"Error_on_empty_data_even_if_granted":               {username: "ia_empty_data"},
-		"Error_when_broker_returns_invalid_access":          {username: "ia_invalid_access"},
-		"Error_when_broker_returns_invalid_data":            {username: "ia_invalid_data"},
-		"Error_when_broker_returns_invalid_userinfo":        {username: "ia_invalid_userinfo"},
-		"Error_when_calling_second_time_without_cancelling": {username: "ia_second_call", secondCall: true},
+		"Error_when_authenticating":                         {username: "ia_error@example.com"},
+		"Error_on_empty_data_even_if_granted":               {username: "ia_empty_data@example.com"},
+		"Error_when_broker_returns_invalid_access":          {username: "ia_invalid_access@example.com"},
+		"Error_when_broker_returns_invalid_data":            {username: "ia_invalid_data@example.com"},
+		"Error_when_broker_returns_invalid_userinfo":        {username: "ia_invalid_userinfo@example.com"},
+		"Error_when_calling_second_time_without_cancelling": {username: "ia_second_call@example.com", secondCall: true},
 
 		// local group error
-		"Error_on_updating_local_groups_with_unexisting_file": {username: "success_with_local_groups", localGroupsFile: "does_not_exists.group"},
+		"Error_on_updating_local_groups_with_unexisting_file": {username: "success_with_local_groups@example.com", localGroupsFile: "does_not_exists.group"},
 	}
 	for name, tc := range tests {
 		t.Run(name, func(t *testing.T) {
@@ -452,9 +467,10 @@ func TestIsAuthenticated(t *testing.T) {
 				t.Parallel()
 			}
 
-			var destCmdsFile string
+			var destGroupFile string
 			if tc.localGroupsFile != "" {
-				destCmdsFile = localgroupstestutils.SetupGPasswdMock(t, filepath.Join(testutils.TestFamilyPath(t), tc.localGroupsFile))
+				destGroupFile = localgroupstestutils.SetupGroupMock(t,
+					filepath.Join(testutils.TestFamilyPath(t), tc.localGroupsFile))
 			}
 
 			dbDir := t.TempDir()
@@ -464,9 +480,9 @@ func TestIsAuthenticated(t *testing.T) {
 			}
 
 			managerOpts := []users.Option{
-				users.WithIDGenerator(&idgenerator.IDGeneratorMock{
+				users.WithIDGenerator(&users.IDGeneratorMock{
 					UIDsToGenerate: []uint32{1111},
-					GIDsToGenerate: []uint32{22222},
+					GIDsToGenerate: []uint32{22222, 33333, 44444},
 				}),
 			}
 
@@ -534,12 +550,26 @@ func TestIsAuthenticated(t *testing.T) {
 			got = permissions.Z_ForTests_IdempotentPermissionError(got)
 			golden.CheckOrUpdate(t, got, golden.WithPath("IsAuthenticated"))
 
+			// Check that all usernames in the database are lowercase
+			allUsers, err := m.AllUsers()
+			require.NoError(t, err, "Setup: failed to get users from manager")
+			for _, u := range allUsers {
+				require.Equal(t, strings.ToLower(u.Name), u.Name, "all usernames in the database should be lowercase")
+			}
+
+			// Check that all groups in the database are lowercase
+			groups, err := m.AllGroups()
+			require.NoError(t, err, "Setup: failed to get groups from manager")
+			for _, group := range groups {
+				require.Equal(t, strings.ToLower(group.Name), group.Name, "all groups in the database should be lowercase")
+			}
+
 			// Check that database has been updated too.
-			gotDB, err := db.Z_ForTests_DumpNormalizedYAML(userstestutils.GetManagerDB(m))
+			gotDB, err := db.Z_ForTests_DumpNormalizedYAML(userstestutils.DBManager(m))
 			require.NoError(t, err, "Setup: failed to dump database for comparing")
 			golden.CheckOrUpdate(t, gotDB, golden.WithPath("cache.db"))
 
-			localgroupstestutils.RequireGPasswdOutput(t, destCmdsFile, filepath.Join(golden.Path(t), "gpasswd.output"))
+			localgroupstestutils.RequireGroupFile(t, destGroupFile, golden.Path(t))
 		})
 	}
 }
@@ -551,14 +581,14 @@ func TestIDGeneration(t *testing.T) {
 	tests := map[string]struct {
 		username string
 	}{
-		"Generate_ID": {username: "success"},
+		"Generate_ID": {username: "success@example.com"},
 	}
 	for name, tc := range tests {
 		t.Run(name, func(t *testing.T) {
 			t.Parallel()
 
 			managerOpts := []users.Option{
-				users.WithIDGenerator(&idgenerator.IDGeneratorMock{
+				users.WithIDGenerator(&users.IDGeneratorMock{
 					UIDsToGenerate: []uint32{1111},
 					GIDsToGenerate: []uint32{22222},
 				}),
@@ -581,7 +611,7 @@ func TestIDGeneration(t *testing.T) {
 			require.NoError(t, err, "Setup: could not authenticate user")
 			require.Equal(t, "granted", resp.GetAccess(), "Setup: authentication should be granted")
 
-			gotDB, err := db.Z_ForTests_DumpNormalizedYAML(userstestutils.GetManagerDB(m))
+			gotDB, err := db.Z_ForTests_DumpNormalizedYAML(userstestutils.DBManager(m))
 			require.NoError(t, err, "Setup: failed to dump database for comparing")
 			golden.CheckOrUpdate(t, gotDB, golden.WithPath("cache.db"))
 		})
@@ -598,14 +628,15 @@ func TestSetDefaultBrokerForUser(t *testing.T) {
 
 		wantErr bool
 	}{
-		"Set_default_broker_for_existing_user_with_no_broker":   {username: "usersetbroker"},
-		"Update_default_broker_for_existing_user_with_a_broker": {username: "userupdatebroker"},
+		"Set_default_broker_for_existing_user_with_no_broker":   {username: "usersetbroker@example.com"},
+		"Update_default_broker_for_existing_user_with_a_broker": {username: "userupdatebroker@example.com"},
+		"Username_is_case_insensitive":                          {username: "UserSetBroker@example.com"},
 
-		"Error_when_setting_default_broker_to_local_broker": {username: "userlocalbroker", brokerID: brokers.LocalBrokerName, wantErr: true},
-		"Error_when_not_root":                               {username: "usersetbroker", currentUserNotRoot: true, wantErr: true},
+		"Error_when_setting_default_broker_to_local_broker": {username: "userlocalbroker@example.com", brokerID: brokers.LocalBrokerName, wantErr: true},
+		"Error_when_not_root":                               {username: "usersetbroker@example.com", currentUserNotRoot: true, wantErr: true},
 		"Error_when_username_is_empty":                      {wantErr: true},
-		"Error_when_user_does_not_exist_":                   {username: "doesnotexist", wantErr: true},
-		"Error_when_broker_does_not_exist":                  {username: "userwithbroker", brokerID: "does not exist", wantErr: true},
+		"Error_when_user_does_not_exist_":                   {username: "doesnotexist@example.com", wantErr: true},
+		"Error_when_broker_does_not_exist":                  {username: "userwithbroker@example.com", brokerID: "does not exist", wantErr: true},
 	}
 	for name, tc := range tests {
 		t.Run(name, func(t *testing.T) {
@@ -641,7 +672,7 @@ func TestSetDefaultBrokerForUser(t *testing.T) {
 			require.Equal(t, tc.brokerID, gpbResp.GetPreviousBroker(), "SetDefaultBrokerForUser should set the default broker as expected")
 
 			// Check that database has been updated too.
-			gotDB, err := db.Z_ForTests_DumpNormalizedYAML(userstestutils.GetManagerDB(m))
+			gotDB, err := db.Z_ForTests_DumpNormalizedYAML(userstestutils.DBManager(m))
 			require.NoError(t, err, "Setup: failed to dump database for comparing")
 			golden.CheckOrUpdate(t, gotDB, golden.WithPath("cache.db"))
 		})
@@ -659,12 +690,12 @@ func TestEndSession(t *testing.T) {
 
 		wantErr bool
 	}{
-		"Successfully_end_session": {username: "success"},
+		"Successfully_end_session": {username: "success@example.com"},
 
-		"Error_when_not_root":             {username: "success", currentUserNotRoot: true, wantErr: true},
+		"Error_when_not_root":             {username: "success@example.com", currentUserNotRoot: true, wantErr: true},
 		"Error_when_sessionID_is_empty":   {sessionID: "-", wantErr: true},
 		"Error_when_sessionID_is_invalid": {sessionID: "invalid-session", wantErr: true},
-		"Error_when_ending_session":       {username: "es_error", wantErr: true},
+		"Error_when_ending_session":       {username: "es_error@example.com", wantErr: true},
 	}
 	for name, tc := range tests {
 		t.Run(name, func(t *testing.T) {
@@ -700,10 +731,6 @@ func TestEndSession(t *testing.T) {
 	}
 }
 
-func TestMockgpasswd(t *testing.T) {
-	localgroupstestutils.Mockgpasswd(t)
-}
-
 // initBrokers starts dbus mock brokers on the system bus. It returns its config path.
 func initBrokers() (brokerConfigPath string, cleanup func(), err error) {
 	tmpDir, err := os.MkdirTemp("", "authd-internal-pam-tests-")
@@ -809,6 +836,10 @@ func getMockBrokerGeneratedID(brokerManager *brokers.Manager) (string, error) {
 func startSession(t *testing.T, client authd.PAMClient, username string) string {
 	t.Helper()
 
+	if username == "" {
+		username = "user@example.com"
+	}
+
 	// Prefixes the username to avoid concurrency issues.
 	username = t.Name() + testutils.IDSeparator + username
 
@@ -857,12 +888,11 @@ func setupGlobalBrokerMock() (cleanup func(), err error) {
 }
 
 func TestMain(m *testing.M) {
-	if os.Getenv("GO_WANT_HELPER_PROCESS") != "" {
-		os.Exit(m.Run())
-	}
-
 	log.SetLevel(log.DebugLevel)
 
+	userslocking.Z_ForTests_OverrideLocking()
+	defer userslocking.Z_ForTests_RestoreLocking()
+
 	cleanup, err := setupGlobalBrokerMock()
 	if err != nil {
 		cleanup()
diff --git a/internal/services/pam/permissions.go b/internal/services/pam/permissions.go
index c06e6d508b..47d4347b7a 100644
--- a/internal/services/pam/permissions.go
+++ b/internal/services/pam/permissions.go
@@ -4,5 +4,5 @@ import "context"
 
 // CheckGlobalAccess denies all requests not coming from the root user.
 func (s Service) CheckGlobalAccess(ctx context.Context, method string) error {
-	return s.permissionManager.IsRequestFromRoot(ctx)
+	return s.permissionManager.CheckRequestIsFromRoot(ctx)
 }
diff --git a/internal/services/pam/testdata/TestGetPreviousBroker/get-previous-broker.db b/internal/services/pam/testdata/TestGetPreviousBroker/get-previous-broker.db
index 30e9585266..033edb64bb 100644
--- a/internal/services/pam/testdata/TestGetPreviousBroker/get-previous-broker.db
+++ b/internal/services/pam/testdata/TestGetPreviousBroker/get-previous-broker.db
@@ -1,25 +1,25 @@
 users:
-    - name: userwithbroker
+    - name: userwithbroker@example.com
       uid: 1111
       gid: 11111
       gecos: |-
         userwithbroker gecos
         On multiple lines
-      dir: /home/userwithbroker
+      dir: /home/userwithbroker@example.com
       shell: /bin/bash
       broker_id: MOCKBROKERID
-    - name: userwithinactivebroker
+    - name: userwithinactivebroker@example.com
       uid: 2222
       gid: 22222
       gecos: userwithinactivebroker
-      dir: /home/userwithinactivebroker
+      dir: /home/userwithinactivebroker@example.com
       shell: /bin/dash
       broker_id: inactive-broker-id
-    - name: userwithoutbroker
+    - name: userwithoutbroker@example.com
       uid: 3333
       gid: 33333
       gecos: userwithoutbroker
-      dir: /home/userwithoutbroker
+      dir: /home/userwithoutbroker@example.com
       shell: /bin/zsh
 groups:
     - name: group1
diff --git a/internal/services/pam/testdata/TestIsAuthenticated/cache-with-locked-user.db b/internal/services/pam/testdata/TestIsAuthenticated/cache-with-locked-user.db
new file mode 100644
index 0000000000..05fe2dd42d
--- /dev/null
+++ b/internal/services/pam/testdata/TestIsAuthenticated/cache-with-locked-user.db
@@ -0,0 +1,16 @@
+users:
+    - name: locked@example.com
+      uid: 1111
+      gid: 11111
+      gecos: gecos for other user
+      dir: /home/locked@example.com
+      shell: /bin/bash
+      broker_id: broker-id
+      locked: true
+groups:
+    - name: group1
+      gid: 11111
+      ugid: ugid
+users_to_groups:
+    - uid: 1111
+      gid: 11111
diff --git a/internal/services/pam/testdata/TestIsAuthenticated/cache-with-user.db b/internal/services/pam/testdata/TestIsAuthenticated/cache-with-user.db
index 45d25289dc..d2c3a93c03 100644
--- a/internal/services/pam/testdata/TestIsAuthenticated/cache-with-user.db
+++ b/internal/services/pam/testdata/TestIsAuthenticated/cache-with-user.db
@@ -1,9 +1,9 @@
 users:
-    - name: otheruser
+    - name: otheruser@example.com
       uid: 77777
       gid: 88888
       gecos: gecos for other user
-      dir: /home/otheruser
+      dir: /home/otheruser@example.com
       shell: /bin/sh/otheruser
       broker_id: broker-id
 groups:
diff --git a/internal/services/pam/testdata/TestIsAuthenticated/valid.group b/internal/services/pam/testdata/TestIsAuthenticated/valid.group
index f3dce64ae9..2ebaf20f75 100644
--- a/internal/services/pam/testdata/TestIsAuthenticated/valid.group
+++ b/internal/services/pam/testdata/TestIsAuthenticated/valid.group
@@ -1,6 +1,6 @@
-localgroup1:x:41:otheruser,success_with_local_groups,otheruser2
-localgroup2:x:42:success_with_local_groups
-localgroup3:x:43:otheruser2
-localgroup4:x:44:otheruser2
-cloudgroup1:x:9998:otheruser3
-cloudgroup2:x:9999:otheruser4
+localgroup1:x:41:otheruser@example.com,success_with_local_groups@example.com,otheruser2@example.com
+localgroup2:x:42:success_with_local_groups@example.com
+localgroup3:x:43:otheruser2@example.com
+localgroup4:x:44:otheruser2@example.com
+cloudgroup1:x:9998:otheruser3@example.com
+cloudgroup2:x:9999:otheruser4@example.com
diff --git a/internal/services/pam/testdata/TestSetDefaultBrokerForUser/set-default-broker.db b/internal/services/pam/testdata/TestSetDefaultBrokerForUser/set-default-broker.db
index d673c81210..e39a8aa932 100644
--- a/internal/services/pam/testdata/TestSetDefaultBrokerForUser/set-default-broker.db
+++ b/internal/services/pam/testdata/TestSetDefaultBrokerForUser/set-default-broker.db
@@ -1,37 +1,37 @@
 users:
-    - name: userwithbroker
+    - name: userwithbroker@example.com
       uid: 1111
       gid: 11111
       gecos: |-
         userwithbroker gecos
         On multiple lines
-      dir: /home/userwithbroker
+      dir: /home/userwithbroker@example.com
       shell: /bin/bash
       broker_id: broker-id
-    - name: userwithinactivebroker
+    - name: userwithinactivebroker@example.com
       uid: 2222
       gid: 22222
       gecos: userwithinactivebroker
-      dir: /home/userwithinactivebroker
+      dir: /home/userwithinactivebroker@example.com
       shell: /bin/dash
       broker_id: inactive-broker-id
-    - name: userlocalbroker
+    - name: userlocalbroker@example.com
       uid: 3333
       gid: 33333
       gecos: userlocalbroker
-      dir: /home/userlocalbroker
+      dir: /home/userlocalbroker@example.com
       shell: /bin/zsh
-    - name: usersetbroker
+    - name: usersetbroker@example.com
       uid: 4444
       gid: 44444
       gecos: usersetbroker
-      dir: /home/usersetbroker
+      dir: /home/usersetbroker@example.com
       shell: /bin/dash
-    - name: userupdatebroker
+    - name: userupdatebroker@example.com
       uid: 5555
       gid: 55555
       gecos: userupdatebroker
-      dir: /home/userupdatebroker
+      dir: /home/userupdatebroker@example.com
       shell: /bin/zsh
       broker_id: tobereplaced-broker-id
 groups:
diff --git a/internal/services/pam/testdata/golden/TestIDGeneration/Generate_ID/cache.db b/internal/services/pam/testdata/golden/TestIDGeneration/Generate_ID/cache.db
index 375d7c41a3..46987965c5 100644
--- a/internal/services/pam/testdata/golden/TestIDGeneration/Generate_ID/cache.db
+++ b/internal/services/pam/testdata/golden/TestIDGeneration/Generate_ID/cache.db
@@ -1,20 +1,20 @@
 users:
-    - name: testidgeneration_separator_success
+    - name: success@example.com
       uid: 1111
       gid: 1111
-      gecos: gecos for success
-      dir: /home/success
-      shell: /bin/sh/success
+      gecos: gecos for success@example.com
+      dir: /home/success@example.com
+      shell: /bin/sh/success@example.com
 groups:
-    - name: testidgeneration_separator_success
+    - name: success@example.com
       gid: 1111
-      ugid: testidgeneration_separator_success
-    - name: group-success
+      ugid: success@example.com
+    - name: group-success@example.com
       gid: 22222
-      ugid: ugid-success
+      ugid: ugid-success@example.com
 users_to_groups:
     - uid: 1111
       gid: 1111
     - uid: 1111
       gid: 22222
-schema_version: 1
+schema_version: 2
diff --git a/internal/services/pam/testdata/golden/TestIsAuthenticated/Denies_authentication_when_broker_times_out/cache.db b/internal/services/pam/testdata/golden/TestIsAuthenticated/Denies_authentication_when_broker_times_out/cache.db
index 8bd98be48c..03de3ff950 100644
--- a/internal/services/pam/testdata/golden/TestIsAuthenticated/Denies_authentication_when_broker_times_out/cache.db
+++ b/internal/services/pam/testdata/golden/TestIsAuthenticated/Denies_authentication_when_broker_times_out/cache.db
@@ -1,4 +1,4 @@
 users: []
 groups: []
 users_to_groups: []
-schema_version: 1
+schema_version: 2
diff --git a/internal/services/pam/testdata/golden/TestIsAuthenticated/Error_on_empty_data_even_if_granted/IsAuthenticated b/internal/services/pam/testdata/golden/TestIsAuthenticated/Error_on_empty_data_even_if_granted/IsAuthenticated
index 91c579daab..9077010ef2 100644
--- a/internal/services/pam/testdata/golden/TestIsAuthenticated/Error_on_empty_data_even_if_granted/IsAuthenticated
+++ b/internal/services/pam/testdata/golden/TestIsAuthenticated/Error_on_empty_data_even_if_granted/IsAuthenticated
@@ -1,4 +1,4 @@
 FIRST CALL:
 	access: 
 	msg: 
-	err: can't check authentication: missing key "userinfo" in returned message, got: {}
+	err: missing key "userinfo" in returned message, got: {}
diff --git a/internal/services/pam/testdata/golden/TestIsAuthenticated/Error_on_empty_data_even_if_granted/cache.db b/internal/services/pam/testdata/golden/TestIsAuthenticated/Error_on_empty_data_even_if_granted/cache.db
index 8bd98be48c..03de3ff950 100644
--- a/internal/services/pam/testdata/golden/TestIsAuthenticated/Error_on_empty_data_even_if_granted/cache.db
+++ b/internal/services/pam/testdata/golden/TestIsAuthenticated/Error_on_empty_data_even_if_granted/cache.db
@@ -1,4 +1,4 @@
 users: []
 groups: []
 users_to_groups: []
-schema_version: 1
+schema_version: 2
diff --git a/internal/services/pam/testdata/golden/TestIsAuthenticated/Error_on_updating_local_groups_with_unexisting_file/IsAuthenticated b/internal/services/pam/testdata/golden/TestIsAuthenticated/Error_on_updating_local_groups_with_unexisting_file/IsAuthenticated
index bfed5941be..8ced0f180c 100644
--- a/internal/services/pam/testdata/golden/TestIsAuthenticated/Error_on_updating_local_groups_with_unexisting_file/IsAuthenticated
+++ b/internal/services/pam/testdata/golden/TestIsAuthenticated/Error_on_updating_local_groups_with_unexisting_file/IsAuthenticated
@@ -1,4 +1,4 @@
 FIRST CALL:
 	access: 
 	msg: 
-	err: can't check authentication: failed to update user "testisauthenticated/error_on_updating_local_groups_with_unexisting_file_separator_success_with_local_groups": could not update local groups for user "testisauthenticated/error_on_updating_local_groups_with_unexisting_file_separator_success_with_local_groups": could not fetch existing local group: open testdata/TestIsAuthenticated/does_not_exists.group: no such file or directory
+	err: failed to update user "success_with_local_groups@example.com": could not update local groups for user "success_with_local_groups@example.com": could not fetch existing local group: open : no such file or directory
diff --git a/internal/services/pam/testdata/golden/TestIsAuthenticated/Error_on_updating_local_groups_with_unexisting_file/cache.db b/internal/services/pam/testdata/golden/TestIsAuthenticated/Error_on_updating_local_groups_with_unexisting_file/cache.db
index 963c89e45e..c6f6c0a54a 100644
--- a/internal/services/pam/testdata/golden/TestIsAuthenticated/Error_on_updating_local_groups_with_unexisting_file/cache.db
+++ b/internal/services/pam/testdata/golden/TestIsAuthenticated/Error_on_updating_local_groups_with_unexisting_file/cache.db
@@ -1,20 +1,20 @@
 users:
-    - name: testisauthenticated/error_on_updating_local_groups_with_unexisting_file_separator_success_with_local_groups
+    - name: success_with_local_groups@example.com
       uid: 1111
       gid: 1111
-      gecos: gecos for success_with_local_groups
-      dir: /home/success_with_local_groups
-      shell: /bin/sh/success_with_local_groups
+      gecos: gecos for success_with_local_groups@example.com
+      dir: /home/success_with_local_groups@example.com
+      shell: /bin/sh/success_with_local_groups@example.com
 groups:
-    - name: testisauthenticated/error_on_updating_local_groups_with_unexisting_file_separator_success_with_local_groups
+    - name: success_with_local_groups@example.com
       gid: 1111
-      ugid: testisauthenticated/error_on_updating_local_groups_with_unexisting_file_separator_success_with_local_groups
-    - name: group-success_with_local_groups
+      ugid: success_with_local_groups@example.com
+    - name: group-success_with_local_groups@example.com
       gid: 22222
-      ugid: ugid-success_with_local_groups
+      ugid: ugid-success_with_local_groups@example.com
 users_to_groups:
     - uid: 1111
       gid: 1111
     - uid: 1111
       gid: 22222
-schema_version: 1
+schema_version: 2
diff --git a/internal/services/pam/testdata/golden/TestIsAuthenticated/Error_when_authenticating/cache.db b/internal/services/pam/testdata/golden/TestIsAuthenticated/Error_when_authenticating/cache.db
index 8bd98be48c..03de3ff950 100644
--- a/internal/services/pam/testdata/golden/TestIsAuthenticated/Error_when_authenticating/cache.db
+++ b/internal/services/pam/testdata/golden/TestIsAuthenticated/Error_when_authenticating/cache.db
@@ -1,4 +1,4 @@
 users: []
 groups: []
 users_to_groups: []
-schema_version: 1
+schema_version: 2
diff --git a/internal/services/pam/testdata/golden/TestIsAuthenticated/Error_when_broker_returns_invalid_access/IsAuthenticated b/internal/services/pam/testdata/golden/TestIsAuthenticated/Error_when_broker_returns_invalid_access/IsAuthenticated
index 49f1b2961e..419342ae13 100644
--- a/internal/services/pam/testdata/golden/TestIsAuthenticated/Error_when_broker_returns_invalid_access/IsAuthenticated
+++ b/internal/services/pam/testdata/golden/TestIsAuthenticated/Error_when_broker_returns_invalid_access/IsAuthenticated
@@ -1,4 +1,4 @@
 FIRST CALL:
 	access: 
 	msg: 
-	err: can't check authentication: invalid access authentication key: invalid
+	err: invalid broker response: "invalid"
diff --git a/internal/services/pam/testdata/golden/TestIsAuthenticated/Error_when_broker_returns_invalid_access/cache.db b/internal/services/pam/testdata/golden/TestIsAuthenticated/Error_when_broker_returns_invalid_access/cache.db
index 8bd98be48c..03de3ff950 100644
--- a/internal/services/pam/testdata/golden/TestIsAuthenticated/Error_when_broker_returns_invalid_access/cache.db
+++ b/internal/services/pam/testdata/golden/TestIsAuthenticated/Error_when_broker_returns_invalid_access/cache.db
@@ -1,4 +1,4 @@
 users: []
 groups: []
 users_to_groups: []
-schema_version: 1
+schema_version: 2
diff --git a/internal/services/pam/testdata/golden/TestIsAuthenticated/Error_when_broker_returns_invalid_data/IsAuthenticated b/internal/services/pam/testdata/golden/TestIsAuthenticated/Error_when_broker_returns_invalid_data/IsAuthenticated
index 2a70683dd0..bd72dfbe47 100644
--- a/internal/services/pam/testdata/golden/TestIsAuthenticated/Error_when_broker_returns_invalid_data/IsAuthenticated
+++ b/internal/services/pam/testdata/golden/TestIsAuthenticated/Error_when_broker_returns_invalid_data/IsAuthenticated
@@ -1,5 +1,5 @@
 FIRST CALL:
 	access: 
 	msg: 
-	err: can't check authentication: response returned by the broker is not a valid json: invalid character 'i' looking for beginning of value
+	err: response returned by the broker is not a valid json: invalid character 'i' looking for beginning of value
 Broker returned: invalid
diff --git a/internal/services/pam/testdata/golden/TestIsAuthenticated/Error_when_broker_returns_invalid_data/cache.db b/internal/services/pam/testdata/golden/TestIsAuthenticated/Error_when_broker_returns_invalid_data/cache.db
index 8bd98be48c..03de3ff950 100644
--- a/internal/services/pam/testdata/golden/TestIsAuthenticated/Error_when_broker_returns_invalid_data/cache.db
+++ b/internal/services/pam/testdata/golden/TestIsAuthenticated/Error_when_broker_returns_invalid_data/cache.db
@@ -1,4 +1,4 @@
 users: []
 groups: []
 users_to_groups: []
-schema_version: 1
+schema_version: 2
diff --git a/internal/services/pam/testdata/golden/TestIsAuthenticated/Error_when_broker_returns_invalid_userinfo/IsAuthenticated b/internal/services/pam/testdata/golden/TestIsAuthenticated/Error_when_broker_returns_invalid_userinfo/IsAuthenticated
index b917b0921c..b071345de3 100644
--- a/internal/services/pam/testdata/golden/TestIsAuthenticated/Error_when_broker_returns_invalid_userinfo/IsAuthenticated
+++ b/internal/services/pam/testdata/golden/TestIsAuthenticated/Error_when_broker_returns_invalid_userinfo/IsAuthenticated
@@ -1,4 +1,4 @@
 FIRST CALL:
 	access: 
 	msg: 
-	err: can't check authentication: message is not JSON formatted: json: cannot unmarshal string into Go value of type types.UserInfo
+	err: message is not JSON formatted: json: cannot unmarshal string into Go value of type types.UserInfo
diff --git a/internal/services/pam/testdata/golden/TestIsAuthenticated/Error_when_broker_returns_invalid_userinfo/cache.db b/internal/services/pam/testdata/golden/TestIsAuthenticated/Error_when_broker_returns_invalid_userinfo/cache.db
index 8bd98be48c..03de3ff950 100644
--- a/internal/services/pam/testdata/golden/TestIsAuthenticated/Error_when_broker_returns_invalid_userinfo/cache.db
+++ b/internal/services/pam/testdata/golden/TestIsAuthenticated/Error_when_broker_returns_invalid_userinfo/cache.db
@@ -1,4 +1,4 @@
 users: []
 groups: []
 users_to_groups: []
-schema_version: 1
+schema_version: 2
diff --git a/internal/services/pam/testdata/golden/TestIsAuthenticated/Error_when_calling_second_time_without_cancelling/IsAuthenticated b/internal/services/pam/testdata/golden/TestIsAuthenticated/Error_when_calling_second_time_without_cancelling/IsAuthenticated
index c21d0db68a..34c71e32a9 100644
--- a/internal/services/pam/testdata/golden/TestIsAuthenticated/Error_when_calling_second_time_without_cancelling/IsAuthenticated
+++ b/internal/services/pam/testdata/golden/TestIsAuthenticated/Error_when_calling_second_time_without_cancelling/IsAuthenticated
@@ -5,4 +5,4 @@ FIRST CALL:
 SECOND CALL:
 	access: 
 	msg: 
-	err: broker "BrokerMock": IsAuthenticated already running for session "testisauthenticated/error_when_calling_second_time_without_cancelling_separator_ia_second_call-session_id"
+	err: broker "BrokerMock": IsAuthenticated already running for session "testisauthenticated/error_when_calling_second_time_without_cancelling_separator_ia_second_call@example.com-session_id"
diff --git a/internal/services/pam/testdata/golden/TestIsAuthenticated/Error_when_calling_second_time_without_cancelling/cache.db b/internal/services/pam/testdata/golden/TestIsAuthenticated/Error_when_calling_second_time_without_cancelling/cache.db
index cef36229a8..da22195b18 100644
--- a/internal/services/pam/testdata/golden/TestIsAuthenticated/Error_when_calling_second_time_without_cancelling/cache.db
+++ b/internal/services/pam/testdata/golden/TestIsAuthenticated/Error_when_calling_second_time_without_cancelling/cache.db
@@ -1,20 +1,20 @@
 users:
-    - name: testisauthenticated/error_when_calling_second_time_without_cancelling_separator_ia_second_call
+    - name: ia_second_call@example.com
       uid: 1111
       gid: 1111
-      gecos: gecos for ia_second_call
-      dir: /home/ia_second_call
-      shell: /bin/sh/ia_second_call
+      gecos: gecos for ia_second_call@example.com
+      dir: /home/ia_second_call@example.com
+      shell: /bin/sh/ia_second_call@example.com
 groups:
-    - name: testisauthenticated/error_when_calling_second_time_without_cancelling_separator_ia_second_call
+    - name: ia_second_call@example.com
       gid: 1111
-      ugid: testisauthenticated/error_when_calling_second_time_without_cancelling_separator_ia_second_call
-    - name: group-ia_second_call
+      ugid: ia_second_call@example.com
+    - name: group-ia_second_call@example.com
       gid: 22222
-      ugid: ugid-ia_second_call
+      ugid: ugid-ia_second_call@example.com
 users_to_groups:
     - uid: 1111
       gid: 1111
     - uid: 1111
       gid: 22222
-schema_version: 1
+schema_version: 2
diff --git a/internal/services/pam/testdata/golden/TestIsAuthenticated/Error_when_not_root/IsAuthenticated b/internal/services/pam/testdata/golden/TestIsAuthenticated/Error_when_not_root/IsAuthenticated
index 960d5b8c2c..827eb715d3 100644
--- a/internal/services/pam/testdata/golden/TestIsAuthenticated/Error_when_not_root/IsAuthenticated
+++ b/internal/services/pam/testdata/golden/TestIsAuthenticated/Error_when_not_root/IsAuthenticated
@@ -1,4 +1,4 @@
 FIRST CALL:
 	access: 
 	msg: 
-	err: permission denied: this action is only allowed for root users. Current user is XXXX
+	err: only root can perform this operation
diff --git a/internal/services/pam/testdata/golden/TestIsAuthenticated/Error_when_not_root/cache.db b/internal/services/pam/testdata/golden/TestIsAuthenticated/Error_when_not_root/cache.db
index 8bd98be48c..03de3ff950 100644
--- a/internal/services/pam/testdata/golden/TestIsAuthenticated/Error_when_not_root/cache.db
+++ b/internal/services/pam/testdata/golden/TestIsAuthenticated/Error_when_not_root/cache.db
@@ -1,4 +1,4 @@
 users: []
 groups: []
 users_to_groups: []
-schema_version: 1
+schema_version: 2
diff --git a/internal/services/pam/testdata/golden/TestIsAuthenticated/Error_when_sessionID_is_empty/IsAuthenticated b/internal/services/pam/testdata/golden/TestIsAuthenticated/Error_when_sessionID_is_empty/IsAuthenticated
index 6ec3830d89..96ea6d8d5e 100644
--- a/internal/services/pam/testdata/golden/TestIsAuthenticated/Error_when_sessionID_is_empty/IsAuthenticated
+++ b/internal/services/pam/testdata/golden/TestIsAuthenticated/Error_when_sessionID_is_empty/IsAuthenticated
@@ -1,4 +1,4 @@
 FIRST CALL:
 	access: 
 	msg: 
-	err: error InvalidArgument from server: can't check authentication: rpc error: code = InvalidArgument desc = no session ID provided
+	err: error InvalidArgument from server: no session ID provided
diff --git a/internal/services/pam/testdata/golden/TestIsAuthenticated/Error_when_sessionID_is_empty/cache.db b/internal/services/pam/testdata/golden/TestIsAuthenticated/Error_when_sessionID_is_empty/cache.db
index 8bd98be48c..03de3ff950 100644
--- a/internal/services/pam/testdata/golden/TestIsAuthenticated/Error_when_sessionID_is_empty/cache.db
+++ b/internal/services/pam/testdata/golden/TestIsAuthenticated/Error_when_sessionID_is_empty/cache.db
@@ -1,4 +1,4 @@
 users: []
 groups: []
 users_to_groups: []
-schema_version: 1
+schema_version: 2
diff --git a/internal/services/pam/testdata/golden/TestIsAuthenticated/Error_when_there_is_no_broker/IsAuthenticated b/internal/services/pam/testdata/golden/TestIsAuthenticated/Error_when_there_is_no_broker/IsAuthenticated
index 5137dc5e62..10d7fab744 100644
--- a/internal/services/pam/testdata/golden/TestIsAuthenticated/Error_when_there_is_no_broker/IsAuthenticated
+++ b/internal/services/pam/testdata/golden/TestIsAuthenticated/Error_when_there_is_no_broker/IsAuthenticated
@@ -1,4 +1,4 @@
 FIRST CALL:
 	access: 
 	msg: 
-	err: can't check authentication: no broker found for session "invalid-session"
+	err: no broker found for session "invalid-session"
diff --git a/internal/services/pam/testdata/golden/TestIsAuthenticated/Error_when_there_is_no_broker/cache.db b/internal/services/pam/testdata/golden/TestIsAuthenticated/Error_when_there_is_no_broker/cache.db
index 8bd98be48c..03de3ff950 100644
--- a/internal/services/pam/testdata/golden/TestIsAuthenticated/Error_when_there_is_no_broker/cache.db
+++ b/internal/services/pam/testdata/golden/TestIsAuthenticated/Error_when_there_is_no_broker/cache.db
@@ -1,4 +1,4 @@
 users: []
 groups: []
 users_to_groups: []
-schema_version: 1
+schema_version: 2
diff --git a/internal/services/pam/testdata/golden/TestIsAuthenticated/Error_when_user_is_locked/IsAuthenticated b/internal/services/pam/testdata/golden/TestIsAuthenticated/Error_when_user_is_locked/IsAuthenticated
new file mode 100644
index 0000000000..10b91a2a57
--- /dev/null
+++ b/internal/services/pam/testdata/golden/TestIsAuthenticated/Error_when_user_is_locked/IsAuthenticated
@@ -0,0 +1,4 @@
+FIRST CALL:
+	access: 
+	msg: 
+	err: permission denied: user locked@example.com is locked
diff --git a/internal/services/pam/testdata/golden/TestIsAuthenticated/Error_when_user_is_locked/cache.db b/internal/services/pam/testdata/golden/TestIsAuthenticated/Error_when_user_is_locked/cache.db
new file mode 100644
index 0000000000..c4de41699a
--- /dev/null
+++ b/internal/services/pam/testdata/golden/TestIsAuthenticated/Error_when_user_is_locked/cache.db
@@ -0,0 +1,17 @@
+users:
+    - name: locked@example.com
+      uid: 1111
+      gid: 11111
+      gecos: gecos for other user
+      dir: /home/locked@example.com
+      shell: /bin/bash
+      broker_id: broker-id
+      locked: true
+groups:
+    - name: group1
+      gid: 11111
+      ugid: ugid
+users_to_groups:
+    - uid: 1111
+      gid: 11111
+schema_version: 2
diff --git a/internal/services/pam/testdata/golden/TestIsAuthenticated/Successfully_authenticate/cache.db b/internal/services/pam/testdata/golden/TestIsAuthenticated/Successfully_authenticate/cache.db
index 86305c92c1..46987965c5 100644
--- a/internal/services/pam/testdata/golden/TestIsAuthenticated/Successfully_authenticate/cache.db
+++ b/internal/services/pam/testdata/golden/TestIsAuthenticated/Successfully_authenticate/cache.db
@@ -1,20 +1,20 @@
 users:
-    - name: testisauthenticated/successfully_authenticate_separator_success
+    - name: success@example.com
       uid: 1111
       gid: 1111
-      gecos: gecos for success
-      dir: /home/success
-      shell: /bin/sh/success
+      gecos: gecos for success@example.com
+      dir: /home/success@example.com
+      shell: /bin/sh/success@example.com
 groups:
-    - name: testisauthenticated/successfully_authenticate_separator_success
+    - name: success@example.com
       gid: 1111
-      ugid: testisauthenticated/successfully_authenticate_separator_success
-    - name: group-success
+      ugid: success@example.com
+    - name: group-success@example.com
       gid: 22222
-      ugid: ugid-success
+      ugid: ugid-success@example.com
 users_to_groups:
     - uid: 1111
       gid: 1111
     - uid: 1111
       gid: 22222
-schema_version: 1
+schema_version: 2
diff --git a/internal/services/pam/testdata/golden/TestIsAuthenticated/Successfully_authenticate_if_first_call_is_canceled/cache.db b/internal/services/pam/testdata/golden/TestIsAuthenticated/Successfully_authenticate_if_first_call_is_canceled/cache.db
index 4b28b6b924..da22195b18 100644
--- a/internal/services/pam/testdata/golden/TestIsAuthenticated/Successfully_authenticate_if_first_call_is_canceled/cache.db
+++ b/internal/services/pam/testdata/golden/TestIsAuthenticated/Successfully_authenticate_if_first_call_is_canceled/cache.db
@@ -1,20 +1,20 @@
 users:
-    - name: testisauthenticated/successfully_authenticate_if_first_call_is_canceled_separator_ia_second_call
+    - name: ia_second_call@example.com
       uid: 1111
       gid: 1111
-      gecos: gecos for ia_second_call
-      dir: /home/ia_second_call
-      shell: /bin/sh/ia_second_call
+      gecos: gecos for ia_second_call@example.com
+      dir: /home/ia_second_call@example.com
+      shell: /bin/sh/ia_second_call@example.com
 groups:
-    - name: testisauthenticated/successfully_authenticate_if_first_call_is_canceled_separator_ia_second_call
+    - name: ia_second_call@example.com
       gid: 1111
-      ugid: testisauthenticated/successfully_authenticate_if_first_call_is_canceled_separator_ia_second_call
-    - name: group-ia_second_call
+      ugid: ia_second_call@example.com
+    - name: group-ia_second_call@example.com
       gid: 22222
-      ugid: ugid-ia_second_call
+      ugid: ugid-ia_second_call@example.com
 users_to_groups:
     - uid: 1111
       gid: 1111
     - uid: 1111
       gid: 22222
-schema_version: 1
+schema_version: 2
diff --git a/internal/services/pam/testdata/golden/TestIsAuthenticated/Successfully_authenticate_user_with_uppercase/IsAuthenticated b/internal/services/pam/testdata/golden/TestIsAuthenticated/Successfully_authenticate_user_with_uppercase/IsAuthenticated
new file mode 100644
index 0000000000..0db1ac0491
--- /dev/null
+++ b/internal/services/pam/testdata/golden/TestIsAuthenticated/Successfully_authenticate_user_with_uppercase/IsAuthenticated
@@ -0,0 +1,4 @@
+FIRST CALL:
+	access: granted
+	msg: 
+	err: <nil>
diff --git a/internal/services/pam/testdata/golden/TestIsAuthenticated/Successfully_authenticate_user_with_uppercase/cache.db b/internal/services/pam/testdata/golden/TestIsAuthenticated/Successfully_authenticate_user_with_uppercase/cache.db
new file mode 100644
index 0000000000..46987965c5
--- /dev/null
+++ b/internal/services/pam/testdata/golden/TestIsAuthenticated/Successfully_authenticate_user_with_uppercase/cache.db
@@ -0,0 +1,20 @@
+users:
+    - name: success@example.com
+      uid: 1111
+      gid: 1111
+      gecos: gecos for success@example.com
+      dir: /home/success@example.com
+      shell: /bin/sh/success@example.com
+groups:
+    - name: success@example.com
+      gid: 1111
+      ugid: success@example.com
+    - name: group-success@example.com
+      gid: 22222
+      ugid: ugid-success@example.com
+users_to_groups:
+    - uid: 1111
+      gid: 1111
+    - uid: 1111
+      gid: 22222
+schema_version: 2
diff --git a/internal/services/pam/testdata/golden/TestIsAuthenticated/Successfully_authenticate_with_groups_with_uppercase/IsAuthenticated b/internal/services/pam/testdata/golden/TestIsAuthenticated/Successfully_authenticate_with_groups_with_uppercase/IsAuthenticated
new file mode 100644
index 0000000000..0db1ac0491
--- /dev/null
+++ b/internal/services/pam/testdata/golden/TestIsAuthenticated/Successfully_authenticate_with_groups_with_uppercase/IsAuthenticated
@@ -0,0 +1,4 @@
+FIRST CALL:
+	access: granted
+	msg: 
+	err: <nil>
diff --git a/internal/services/pam/testdata/golden/TestIsAuthenticated/Successfully_authenticate_with_groups_with_uppercase/cache.db b/internal/services/pam/testdata/golden/TestIsAuthenticated/Successfully_authenticate_with_groups_with_uppercase/cache.db
new file mode 100644
index 0000000000..587e2a9701
--- /dev/null
+++ b/internal/services/pam/testdata/golden/TestIsAuthenticated/Successfully_authenticate_with_groups_with_uppercase/cache.db
@@ -0,0 +1,30 @@
+users:
+    - name: success_with_uppercase_groups@example.com
+      uid: 1111
+      gid: 1111
+      gecos: gecos for success_with_uppercase_groups@example.com
+      dir: /home/success_with_uppercase_groups@example.com
+      shell: /bin/sh/success_with_uppercase_groups@example.com
+groups:
+    - name: success_with_uppercase_groups@example.com
+      gid: 1111
+      ugid: success_with_uppercase_groups@example.com
+    - name: group-success_with_uppercase_groups@example.com
+      gid: 22222
+      ugid: ugid-success_with_uppercase_groups@example.com
+    - name: group1
+      gid: 33333
+      ugid: "12345678"
+    - name: group2
+      gid: 44444
+      ugid: "87654321"
+users_to_groups:
+    - uid: 1111
+      gid: 1111
+    - uid: 1111
+      gid: 22222
+    - uid: 1111
+      gid: 33333
+    - uid: 1111
+      gid: 44444
+schema_version: 2
diff --git a/internal/services/pam/testdata/golden/TestIsAuthenticated/Update_existing_DB_on_success/cache.db b/internal/services/pam/testdata/golden/TestIsAuthenticated/Update_existing_DB_on_success/cache.db
index 00ac6473e7..8929a8fa3b 100644
--- a/internal/services/pam/testdata/golden/TestIsAuthenticated/Update_existing_DB_on_success/cache.db
+++ b/internal/services/pam/testdata/golden/TestIsAuthenticated/Update_existing_DB_on_success/cache.db
@@ -1,21 +1,24 @@
 users:
-    - name: testisauthenticated/update_existing_db_on_success_separator_success
+    - name: success@example.com
       uid: 1111
       gid: 1111
-      gecos: gecos for success
-      dir: /home/success
-      shell: /bin/sh/success
-    - name: otheruser
+      gecos: gecos for success@example.com
+      dir: /home/success@example.com
+      shell: /bin/sh/success@example.com
+    - name: otheruser@example.com
       uid: 77777
       gid: 88888
       gecos: gecos for other user
-      dir: /home/otheruser
+      dir: /home/otheruser@example.com
       shell: /bin/sh/otheruser
       broker_id: broker-id
 groups:
-    - name: testisauthenticated/update_existing_db_on_success_separator_success
+    - name: success@example.com
       gid: 1111
-      ugid: testisauthenticated/update_existing_db_on_success_separator_success
+      ugid: success@example.com
+    - name: group-success@example.com
+      gid: 22222
+      ugid: ugid-success@example.com
     - name: group-success
       gid: 88888
       ugid: ugid-success
@@ -23,7 +26,7 @@ users_to_groups:
     - uid: 1111
       gid: 1111
     - uid: 1111
-      gid: 88888
+      gid: 22222
     - uid: 77777
       gid: 88888
-schema_version: 1
+schema_version: 2
diff --git a/internal/services/pam/testdata/golden/TestIsAuthenticated/Update_local_groups.group b/internal/services/pam/testdata/golden/TestIsAuthenticated/Update_local_groups.group
new file mode 100644
index 0000000000..1658d2ffbe
--- /dev/null
+++ b/internal/services/pam/testdata/golden/TestIsAuthenticated/Update_local_groups.group
@@ -0,0 +1,6 @@
+localgroup1:x:41:otheruser@example.com,success_with_local_groups@example.com,otheruser2@example.com
+localgroup2:x:42:success_with_local_groups@example.com
+localgroup3:x:43:otheruser2@example.com,success_with_local_groups@example.com
+localgroup4:x:44:otheruser2@example.com
+cloudgroup1:x:9998:otheruser3@example.com
+cloudgroup2:x:9999:otheruser4@example.com
diff --git a/internal/services/pam/testdata/golden/TestIsAuthenticated/Update_local_groups.group.backup b/internal/services/pam/testdata/golden/TestIsAuthenticated/Update_local_groups.group.backup
new file mode 100644
index 0000000000..2ebaf20f75
--- /dev/null
+++ b/internal/services/pam/testdata/golden/TestIsAuthenticated/Update_local_groups.group.backup
@@ -0,0 +1,6 @@
+localgroup1:x:41:otheruser@example.com,success_with_local_groups@example.com,otheruser2@example.com
+localgroup2:x:42:success_with_local_groups@example.com
+localgroup3:x:43:otheruser2@example.com
+localgroup4:x:44:otheruser2@example.com
+cloudgroup1:x:9998:otheruser3@example.com
+cloudgroup2:x:9999:otheruser4@example.com
diff --git a/internal/services/pam/testdata/golden/TestIsAuthenticated/Update_local_groups/cache.db b/internal/services/pam/testdata/golden/TestIsAuthenticated/Update_local_groups/cache.db
index 533c7c30fd..c6f6c0a54a 100644
--- a/internal/services/pam/testdata/golden/TestIsAuthenticated/Update_local_groups/cache.db
+++ b/internal/services/pam/testdata/golden/TestIsAuthenticated/Update_local_groups/cache.db
@@ -1,20 +1,20 @@
 users:
-    - name: testisauthenticated/update_local_groups_separator_success_with_local_groups
+    - name: success_with_local_groups@example.com
       uid: 1111
       gid: 1111
-      gecos: gecos for success_with_local_groups
-      dir: /home/success_with_local_groups
-      shell: /bin/sh/success_with_local_groups
+      gecos: gecos for success_with_local_groups@example.com
+      dir: /home/success_with_local_groups@example.com
+      shell: /bin/sh/success_with_local_groups@example.com
 groups:
-    - name: testisauthenticated/update_local_groups_separator_success_with_local_groups
+    - name: success_with_local_groups@example.com
       gid: 1111
-      ugid: testisauthenticated/update_local_groups_separator_success_with_local_groups
-    - name: group-success_with_local_groups
+      ugid: success_with_local_groups@example.com
+    - name: group-success_with_local_groups@example.com
       gid: 22222
-      ugid: ugid-success_with_local_groups
+      ugid: ugid-success_with_local_groups@example.com
 users_to_groups:
     - uid: 1111
       gid: 1111
     - uid: 1111
       gid: 22222
-schema_version: 1
+schema_version: 2
diff --git a/internal/services/pam/testdata/golden/TestIsAuthenticated/Update_local_groups/gpasswd.output b/internal/services/pam/testdata/golden/TestIsAuthenticated/Update_local_groups/gpasswd.output
deleted file mode 100644
index bf1a537a84..0000000000
--- a/internal/services/pam/testdata/golden/TestIsAuthenticated/Update_local_groups/gpasswd.output
+++ /dev/null
@@ -1,2 +0,0 @@
---add testisauthenticated/update_local_groups_separator_success_with_local_groups localgroup1
---add testisauthenticated/update_local_groups_separator_success_with_local_groups localgroup3
\ No newline at end of file
diff --git a/internal/services/pam/testdata/golden/TestSelectBroker/Successfully_select_a_broker_and_creates_auth_session b/internal/services/pam/testdata/golden/TestSelectBroker/Successfully_select_a_broker_and_creates_auth_session
index 3741ebd1b3..3ce70833d0 100644
--- a/internal/services/pam/testdata/golden/TestSelectBroker/Successfully_select_a_broker_and_creates_auth_session
+++ b/internal/services/pam/testdata/golden/TestSelectBroker/Successfully_select_a_broker_and_creates_auth_session
@@ -1,2 +1,2 @@
-ID: BROKER_ID-testselectbroker/successfully_select_a_broker_and_creates_auth_session_separator_success-session_id
+ID: BROKER_ID-testselectbroker/successfully_select_a_broker_and_creates_auth_session_separator_success@example.com-session_id
 Encryption Key: BrokerMock-key
diff --git a/internal/services/pam/testdata/golden/TestSelectBroker/Successfully_select_a_broker_and_creates_passwd_session b/internal/services/pam/testdata/golden/TestSelectBroker/Successfully_select_a_broker_and_creates_passwd_session
index 07deb75844..2cd5462a17 100644
--- a/internal/services/pam/testdata/golden/TestSelectBroker/Successfully_select_a_broker_and_creates_passwd_session
+++ b/internal/services/pam/testdata/golden/TestSelectBroker/Successfully_select_a_broker_and_creates_passwd_session
@@ -1,2 +1,2 @@
-ID: BROKER_ID-testselectbroker/successfully_select_a_broker_and_creates_passwd_session_separator_success-session_id
+ID: BROKER_ID-testselectbroker/successfully_select_a_broker_and_creates_passwd_session_separator_success@example.com-session_id
 Encryption Key: BrokerMock-key
diff --git a/internal/services/pam/testdata/golden/TestSetDefaultBrokerForUser/Set_default_broker_for_existing_user_with_no_broker/cache.db b/internal/services/pam/testdata/golden/TestSetDefaultBrokerForUser/Set_default_broker_for_existing_user_with_no_broker/cache.db
index 805aa6c6af..c125f34e1b 100644
--- a/internal/services/pam/testdata/golden/TestSetDefaultBrokerForUser/Set_default_broker_for_existing_user_with_no_broker/cache.db
+++ b/internal/services/pam/testdata/golden/TestSetDefaultBrokerForUser/Set_default_broker_for_existing_user_with_no_broker/cache.db
@@ -1,38 +1,38 @@
 users:
-    - name: userwithbroker
+    - name: userwithbroker@example.com
       uid: 1111
       gid: 11111
       gecos: |-
         userwithbroker gecos
         On multiple lines
-      dir: /home/userwithbroker
+      dir: /home/userwithbroker@example.com
       shell: /bin/bash
       broker_id: broker-id
-    - name: userwithinactivebroker
+    - name: userwithinactivebroker@example.com
       uid: 2222
       gid: 22222
       gecos: userwithinactivebroker
-      dir: /home/userwithinactivebroker
+      dir: /home/userwithinactivebroker@example.com
       shell: /bin/dash
       broker_id: inactive-broker-id
-    - name: userlocalbroker
+    - name: userlocalbroker@example.com
       uid: 3333
       gid: 33333
       gecos: userlocalbroker
-      dir: /home/userlocalbroker
+      dir: /home/userlocalbroker@example.com
       shell: /bin/zsh
-    - name: usersetbroker
+    - name: usersetbroker@example.com
       uid: 4444
       gid: 44444
       gecos: usersetbroker
-      dir: /home/usersetbroker
+      dir: /home/usersetbroker@example.com
       shell: /bin/dash
       broker_id: "1902181170"
-    - name: userupdatebroker
+    - name: userupdatebroker@example.com
       uid: 5555
       gid: 55555
       gecos: userupdatebroker
-      dir: /home/userupdatebroker
+      dir: /home/userupdatebroker@example.com
       shell: /bin/zsh
       broker_id: tobereplaced-broker-id
 groups:
@@ -73,4 +73,4 @@ users_to_groups:
       gid: 55555
     - uid: 5555
       gid: 99999
-schema_version: 1
+schema_version: 2
diff --git a/internal/services/pam/testdata/golden/TestSetDefaultBrokerForUser/Update_default_broker_for_existing_user_with_a_broker/cache.db b/internal/services/pam/testdata/golden/TestSetDefaultBrokerForUser/Update_default_broker_for_existing_user_with_a_broker/cache.db
index cf71a7de8c..f43fd66b6d 100644
--- a/internal/services/pam/testdata/golden/TestSetDefaultBrokerForUser/Update_default_broker_for_existing_user_with_a_broker/cache.db
+++ b/internal/services/pam/testdata/golden/TestSetDefaultBrokerForUser/Update_default_broker_for_existing_user_with_a_broker/cache.db
@@ -1,37 +1,37 @@
 users:
-    - name: userwithbroker
+    - name: userwithbroker@example.com
       uid: 1111
       gid: 11111
       gecos: |-
         userwithbroker gecos
         On multiple lines
-      dir: /home/userwithbroker
+      dir: /home/userwithbroker@example.com
       shell: /bin/bash
       broker_id: broker-id
-    - name: userwithinactivebroker
+    - name: userwithinactivebroker@example.com
       uid: 2222
       gid: 22222
       gecos: userwithinactivebroker
-      dir: /home/userwithinactivebroker
+      dir: /home/userwithinactivebroker@example.com
       shell: /bin/dash
       broker_id: inactive-broker-id
-    - name: userlocalbroker
+    - name: userlocalbroker@example.com
       uid: 3333
       gid: 33333
       gecos: userlocalbroker
-      dir: /home/userlocalbroker
+      dir: /home/userlocalbroker@example.com
       shell: /bin/zsh
-    - name: usersetbroker
+    - name: usersetbroker@example.com
       uid: 4444
       gid: 44444
       gecos: usersetbroker
-      dir: /home/usersetbroker
+      dir: /home/usersetbroker@example.com
       shell: /bin/dash
-    - name: userupdatebroker
+    - name: userupdatebroker@example.com
       uid: 5555
       gid: 55555
       gecos: userupdatebroker
-      dir: /home/userupdatebroker
+      dir: /home/userupdatebroker@example.com
       shell: /bin/zsh
       broker_id: "1902181170"
 groups:
@@ -72,4 +72,4 @@ users_to_groups:
       gid: 55555
     - uid: 5555
       gid: 99999
-schema_version: 1
+schema_version: 2
diff --git a/internal/services/pam/testdata/golden/TestSetDefaultBrokerForUser/Username_is_case_insensitive/cache.db b/internal/services/pam/testdata/golden/TestSetDefaultBrokerForUser/Username_is_case_insensitive/cache.db
new file mode 100644
index 0000000000..c125f34e1b
--- /dev/null
+++ b/internal/services/pam/testdata/golden/TestSetDefaultBrokerForUser/Username_is_case_insensitive/cache.db
@@ -0,0 +1,76 @@
+users:
+    - name: userwithbroker@example.com
+      uid: 1111
+      gid: 11111
+      gecos: |-
+        userwithbroker gecos
+        On multiple lines
+      dir: /home/userwithbroker@example.com
+      shell: /bin/bash
+      broker_id: broker-id
+    - name: userwithinactivebroker@example.com
+      uid: 2222
+      gid: 22222
+      gecos: userwithinactivebroker
+      dir: /home/userwithinactivebroker@example.com
+      shell: /bin/dash
+      broker_id: inactive-broker-id
+    - name: userlocalbroker@example.com
+      uid: 3333
+      gid: 33333
+      gecos: userlocalbroker
+      dir: /home/userlocalbroker@example.com
+      shell: /bin/zsh
+    - name: usersetbroker@example.com
+      uid: 4444
+      gid: 44444
+      gecos: usersetbroker
+      dir: /home/usersetbroker@example.com
+      shell: /bin/dash
+      broker_id: "1902181170"
+    - name: userupdatebroker@example.com
+      uid: 5555
+      gid: 55555
+      gecos: userupdatebroker
+      dir: /home/userupdatebroker@example.com
+      shell: /bin/zsh
+      broker_id: tobereplaced-broker-id
+groups:
+    - name: group1
+      gid: 11111
+      ugid: group1
+    - name: group2
+      gid: 22222
+      ugid: group2
+    - name: group3
+      gid: 33333
+      ugid: group3
+    - name: group4
+      gid: 44444
+      ugid: group4
+    - name: group5
+      gid: 55555
+      ugid: group5
+    - name: commongroup
+      gid: 99999
+      ugid: commongroup
+users_to_groups:
+    - uid: 1111
+      gid: 11111
+    - uid: 2222
+      gid: 22222
+    - uid: 2222
+      gid: 99999
+    - uid: 3333
+      gid: 33333
+    - uid: 3333
+      gid: 99999
+    - uid: 4444
+      gid: 44444
+    - uid: 4444
+      gid: 99999
+    - uid: 5555
+      gid: 55555
+    - uid: 5555
+      gid: 99999
+schema_version: 2
diff --git a/internal/services/permissions.go b/internal/services/permissions.go
index 0f8e0c6973..1c43c232e5 100644
--- a/internal/services/permissions.go
+++ b/internal/services/permissions.go
@@ -5,16 +5,18 @@ import (
 	"strings"
 
 	"google.golang.org/grpc"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
 )
 
 func (m Manager) globalPermissions(ctx context.Context, req interface{}, info *grpc.UnaryServerInfo, handler grpc.UnaryHandler) (interface{}, error) {
 	if strings.HasPrefix(info.FullMethod, "/authd.PAM/") {
 		if err := m.pamService.CheckGlobalAccess(ctx, info.FullMethod); err != nil {
-			return nil, err
+			return nil, status.Error(codes.PermissionDenied, err.Error())
 		}
 	} else if strings.HasPrefix(info.FullMethod, "/authd.NSS/") {
 		if err := m.userService.CheckGlobalAccess(ctx, info.FullMethod); err != nil {
-			return nil, err
+			return nil, status.Error(codes.PermissionDenied, err.Error())
 		}
 	}
 
diff --git a/internal/services/permissions/permissions.go b/internal/services/permissions/permissions.go
index 8d786a7b04..a2c00eb6d7 100644
--- a/internal/services/permissions/permissions.go
+++ b/internal/services/permissions/permissions.go
@@ -4,14 +4,10 @@ package permissions
 import (
 	"context"
 	"errors"
-	"fmt"
 
-	"github.com/ubuntu/decorate"
 	"google.golang.org/grpc/peer"
 )
 
-var permErrorFmt = "this action is only allowed for root users. Current user is %d"
-
 // Manager is an abstraction of permission process.
 type Manager struct {
 	rootUID uint32
@@ -35,17 +31,15 @@ func New(args ...Option) Manager {
 		arg(&opts)
 	}
 
-	//nolint:gosimple // S1016 Those structs are not the same conceptually.
+	//nolint:staticcheck // S1016 Those structs are not the same conceptually.
 	return Manager{
 		rootUID: opts.rootUID,
 	}
 }
 
-// IsRequestFromRoot returns nil if the request was performed by a root user.
+// CheckRequestIsFromRoot checks if the current gRPC request is from a root user and returns an error if not.
 // The pid and uid are extracted from peerCredsInfo in the gRPC context.
-func (m Manager) IsRequestFromRoot(ctx context.Context) (err error) {
-	defer decorate.OnError(&err, "permission denied")
-
+func (m Manager) CheckRequestIsFromRoot(ctx context.Context) (err error) {
 	p, ok := peer.FromContext(ctx)
 	if !ok {
 		return errors.New("context request doesn't have gRPC peer information")
@@ -56,7 +50,7 @@ func (m Manager) IsRequestFromRoot(ctx context.Context) (err error) {
 	}
 
 	if pci.uid != m.rootUID {
-		return fmt.Errorf(permErrorFmt, pci.uid)
+		return errors.New("only root can perform this operation")
 	}
 
 	return nil
diff --git a/internal/services/permissions/permissions_test.go b/internal/services/permissions/permissions_test.go
index 64dc933167..04605cabb4 100644
--- a/internal/services/permissions/permissions_test.go
+++ b/internal/services/permissions/permissions_test.go
@@ -6,8 +6,8 @@ import (
 	"os"
 	"testing"
 
+	"github.com/canonical/authd/internal/services/permissions"
 	"github.com/stretchr/testify/require"
-	"github.com/ubuntu/authd/internal/services/permissions"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/credentials"
 	"google.golang.org/grpc/peer"
@@ -66,13 +66,13 @@ func TestIsRequestFromRoot(t *testing.T) {
 			}
 			pm := permissions.New(opts...)
 
-			err := pm.IsRequestFromRoot(ctx)
+			err := pm.CheckRequestIsFromRoot(ctx)
 
 			if tc.wantErr {
-				require.Error(t, err, "IsRequestFromRoot should deny access but didn't")
+				require.Error(t, err, "CheckRequestIsFromRoot should deny access but didn't")
 				return
 			}
-			require.NoError(t, err, "IsRequestFromRoot should allow access but didn't")
+			require.NoError(t, err, "CheckRequestIsFromRoot should allow access but didn't")
 		})
 	}
 }
diff --git a/internal/services/permissions/servercreds.go b/internal/services/permissions/servercreds.go
index 99010891dd..72b3d71d3a 100644
--- a/internal/services/permissions/servercreds.go
+++ b/internal/services/permissions/servercreds.go
@@ -7,7 +7,7 @@ import (
 	"math"
 	"net"
 
-	"github.com/ubuntu/decorate"
+	"github.com/canonical/authd/internal/decorate"
 	"golang.org/x/sys/unix"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/credentials"
@@ -71,7 +71,7 @@ type peerCredsInfo struct {
 	pid int32
 }
 
-// AuthType returns a string encrypting uid and pid of caller.
+// AuthType returns a string containing the uid and pid of caller.
 func (p peerCredsInfo) AuthType() string {
 	return fmt.Sprintf("uid: %d, pid: %d", p.uid, p.pid)
 }
diff --git a/internal/services/permissions/testutils.go b/internal/services/permissions/testutils.go
index 58c5133c56..213fa5d1c3 100644
--- a/internal/services/permissions/testutils.go
+++ b/internal/services/permissions/testutils.go
@@ -6,11 +6,10 @@ package permissions
 import (
 	"fmt"
 	"math"
-	"os/user"
-	"strconv"
+	"os"
 	"strings"
 
-	"github.com/ubuntu/authd/internal/testsdetection"
+	"github.com/canonical/authd/internal/testsdetection"
 )
 
 // Z_ForTests_WithCurrentUserAsRoot returns an Option that sets the rootUID to the current user's UID.
@@ -29,13 +28,10 @@ func Z_ForTests_WithCurrentUserAsRoot() Option {
 func currentUserUID() uint32 {
 	testsdetection.MustBeTesting()
 
-	u, err := user.Current()
-	if err != nil {
-		panic(fmt.Sprintf("could not get current user: %v", err))
-	}
-	uid, err := strconv.ParseUint(u.Uid, 10, 0)
-	if err != nil || uid > math.MaxUint32 {
-		panic(fmt.Sprintf("current uid is not an uint32 (%v): %v", u.Uid, err))
+	uid := os.Geteuid()
+
+	if uid < 0 || uint64(uid) > math.MaxUint32 {
+		panic(fmt.Sprintf("current uid is not a valid uint32: %v", uid))
 	}
 
 	return uint32(uid)
diff --git a/internal/services/testdata/TestRegisterGRPCServices/golden b/internal/services/testdata/TestRegisterGRPCServices/golden
deleted file mode 100644
index 22990ce9f3..0000000000
--- a/internal/services/testdata/TestRegisterGRPCServices/golden
+++ /dev/null
@@ -1,54 +0,0 @@
-authd.NSS:
-    methods:
-        - name: GetGroupByID
-          isclientstream: false
-          isserverstream: false
-        - name: GetGroupByName
-          isclientstream: false
-          isserverstream: false
-        - name: GetGroupEntries
-          isclientstream: false
-          isserverstream: false
-        - name: GetPasswdByName
-          isclientstream: false
-          isserverstream: false
-        - name: GetPasswdByUID
-          isclientstream: false
-          isserverstream: false
-        - name: GetPasswdEntries
-          isclientstream: false
-          isserverstream: false
-        - name: GetShadowByName
-          isclientstream: false
-          isserverstream: false
-        - name: GetShadowEntries
-          isclientstream: false
-          isserverstream: false
-    metadata: authd.proto
-authd.PAM:
-    methods:
-        - name: AvailableBrokers
-          isclientstream: false
-          isserverstream: false
-        - name: EndSession
-          isclientstream: false
-          isserverstream: false
-        - name: GetAuthenticationModes
-          isclientstream: false
-          isserverstream: false
-        - name: GetPreviousBroker
-          isclientstream: false
-          isserverstream: false
-        - name: IsAuthenticated
-          isclientstream: false
-          isserverstream: false
-        - name: SelectAuthenticationMode
-          isclientstream: false
-          isserverstream: false
-        - name: SelectBroker
-          isclientstream: false
-          isserverstream: false
-        - name: SetDefaultBrokerForUser
-          isclientstream: false
-          isserverstream: false
-    metadata: authd.proto
diff --git a/internal/services/testdata/golden/TestRegisterGRPCServices b/internal/services/testdata/golden/TestRegisterGRPCServices
index eb115926b9..871d7f2387 100644
--- a/internal/services/testdata/golden/TestRegisterGRPCServices
+++ b/internal/services/testdata/golden/TestRegisterGRPCServices
@@ -45,6 +45,18 @@ authd.UserService:
         - name: ListUsers
           isclientstream: false
           isserverstream: false
+        - name: LockUser
+          isclientstream: false
+          isserverstream: false
+        - name: SetGroupID
+          isclientstream: false
+          isserverstream: false
+        - name: SetUserID
+          isclientstream: false
+          isserverstream: false
+        - name: UnlockUser
+          isclientstream: false
+          isserverstream: false
     metadata: authd.proto
 grpc.health.v1.Health:
     methods:
diff --git a/internal/services/user/testdata/default.db.yaml b/internal/services/user/testdata/default.db.yaml
index d96b4726f2..f75d3558fa 100644
--- a/internal/services/user/testdata/default.db.yaml
+++ b/internal/services/user/testdata/default.db.yaml
@@ -1,25 +1,25 @@
 users:
-    - name: user1
+    - name: user1@example.com
       uid: 1111
       gid: 11111
       gecos: |-
         User1 gecos
         On multiple lines
-      dir: /home/user1
+      dir: /home/user1@example.com
       shell: /bin/bash
       broker_id: broker-id
-    - name: user2
+    - name: user2@example.com
       uid: 2222
       gid: 22222
       gecos: User2
-      dir: /home/user2
+      dir: /home/user2@example.com
       shell: /bin/dash
       broker_id: broker-id
-    - name: user3
+    - name: user3@example.com
       uid: 3333
       gid: 33333
       gecos: User3
-      dir: /home/user3
+      dir: /home/user3@example.com
       shell: /bin/zsh
       broker_id: broker-id
 groups:
diff --git a/internal/services/user/testdata/golden/TestGetGroupByID/Return_existing_group b/internal/services/user/testdata/golden/TestGetGroupByID/Return_existing_group
index 3b895b5e0a..fda02fbd55 100644
--- a/internal/services/user/testdata/golden/TestGetGroupByID/Return_existing_group
+++ b/internal/services/user/testdata/golden/TestGetGroupByID/Return_existing_group
@@ -1,5 +1,5 @@
 name: group1
 gid: 11111
 members:
-    - user1
+    - user1@example.com
 passwd: ""
diff --git a/internal/services/user/testdata/golden/TestGetGroupByName/Return_existing_group b/internal/services/user/testdata/golden/TestGetGroupByName/Return_existing_group
index 3b895b5e0a..fda02fbd55 100644
--- a/internal/services/user/testdata/golden/TestGetGroupByName/Return_existing_group
+++ b/internal/services/user/testdata/golden/TestGetGroupByName/Return_existing_group
@@ -1,5 +1,5 @@
 name: group1
 gid: 11111
 members:
-    - user1
+    - user1@example.com
 passwd: ""
diff --git a/internal/services/user/testdata/golden/TestGetGroupByName/Return_existing_group_with_uppercase b/internal/services/user/testdata/golden/TestGetGroupByName/Return_existing_group_with_uppercase
new file mode 100644
index 0000000000..fda02fbd55
--- /dev/null
+++ b/internal/services/user/testdata/golden/TestGetGroupByName/Return_existing_group_with_uppercase
@@ -0,0 +1,5 @@
+name: group1
+gid: 11111
+members:
+    - user1@example.com
+passwd: ""
diff --git a/internal/services/user/testdata/golden/TestGetUserByID/Return_existing_user b/internal/services/user/testdata/golden/TestGetUserByID/Return_existing_user
index 6df55f12d9..cab50a71c7 100644
--- a/internal/services/user/testdata/golden/TestGetUserByID/Return_existing_user
+++ b/internal/services/user/testdata/golden/TestGetUserByID/Return_existing_user
@@ -1,8 +1,8 @@
-name: user1
+name: user1@example.com
 uid: 1111
 gid: 11111
 gecos: |-
     User1 gecos
     On multiple lines
-homedir: /home/user1
+homedir: /home/user1@example.com
 shell: /bin/bash
diff --git a/internal/services/user/testdata/golden/TestGetUserByName/Precheck_user_if_not_in_db b/internal/services/user/testdata/golden/TestGetUserByName/Precheck_user_if_not_in_db
index ce06b0424b..f048f3065a 100644
--- a/internal/services/user/testdata/golden/TestGetUserByName/Precheck_user_if_not_in_db
+++ b/internal/services/user/testdata/golden/TestGetUserByName/Precheck_user_if_not_in_db
@@ -1,6 +1,6 @@
-name: user-pre-check
+name: user-pre-check@example.com
 uid: 1234
 gid: 1234
-gecos: gecos for user-pre-check
-homedir: /home/user-pre-check
-shell: /bin/sh/user-pre-check
+gecos: gecos for user-pre-check@example.com
+homedir: /home/user-pre-check@example.com
+shell: /bin/sh/user-pre-check@example.com
diff --git a/internal/services/user/testdata/golden/TestGetUserByName/Prechecked_user_with_upper_cases_in_username_has_same_id_as_lower_case b/internal/services/user/testdata/golden/TestGetUserByName/Prechecked_user_with_upper_cases_in_username_has_same_id_as_lower_case
index ce06b0424b..f048f3065a 100644
--- a/internal/services/user/testdata/golden/TestGetUserByName/Prechecked_user_with_upper_cases_in_username_has_same_id_as_lower_case
+++ b/internal/services/user/testdata/golden/TestGetUserByName/Prechecked_user_with_upper_cases_in_username_has_same_id_as_lower_case
@@ -1,6 +1,6 @@
-name: user-pre-check
+name: user-pre-check@example.com
 uid: 1234
 gid: 1234
-gecos: gecos for user-pre-check
-homedir: /home/user-pre-check
-shell: /bin/sh/user-pre-check
+gecos: gecos for user-pre-check@example.com
+homedir: /home/user-pre-check@example.com
+shell: /bin/sh/user-pre-check@example.com
diff --git a/internal/services/user/testdata/golden/TestGetUserByName/Return_existing_user b/internal/services/user/testdata/golden/TestGetUserByName/Return_existing_user
index 6df55f12d9..cab50a71c7 100644
--- a/internal/services/user/testdata/golden/TestGetUserByName/Return_existing_user
+++ b/internal/services/user/testdata/golden/TestGetUserByName/Return_existing_user
@@ -1,8 +1,8 @@
-name: user1
+name: user1@example.com
 uid: 1111
 gid: 11111
 gecos: |-
     User1 gecos
     On multiple lines
-homedir: /home/user1
+homedir: /home/user1@example.com
 shell: /bin/bash
diff --git a/internal/services/user/testdata/golden/TestGetUserByName/Return_existing_user_with_uppercase b/internal/services/user/testdata/golden/TestGetUserByName/Return_existing_user_with_uppercase
new file mode 100644
index 0000000000..cab50a71c7
--- /dev/null
+++ b/internal/services/user/testdata/golden/TestGetUserByName/Return_existing_user_with_uppercase
@@ -0,0 +1,8 @@
+name: user1@example.com
+uid: 1111
+gid: 11111
+gecos: |-
+    User1 gecos
+    On multiple lines
+homedir: /home/user1@example.com
+shell: /bin/bash
diff --git a/internal/services/user/testdata/golden/TestListGroups/Return_all_groups b/internal/services/user/testdata/golden/TestListGroups/Return_all_groups
index a515069c76..8470429156 100644
--- a/internal/services/user/testdata/golden/TestListGroups/Return_all_groups
+++ b/internal/services/user/testdata/golden/TestListGroups/Return_all_groups
@@ -2,21 +2,21 @@ groups:
     - name: group1
       gid: 11111
       members:
-        - user1
+        - user1@example.com
       passwd: ""
     - name: group2
       gid: 22222
       members:
-        - user2
+        - user2@example.com
       passwd: ""
     - name: group3
       gid: 33333
       members:
-        - user3
+        - user3@example.com
       passwd: ""
     - name: commongroup
       gid: 99999
       members:
-        - user2
-        - user3
+        - user2@example.com
+        - user3@example.com
       passwd: ""
diff --git a/internal/services/user/testdata/golden/TestListUsers/Return_all_users b/internal/services/user/testdata/golden/TestListUsers/Return_all_users
index 215ec40212..0d40cfce52 100644
--- a/internal/services/user/testdata/golden/TestListUsers/Return_all_users
+++ b/internal/services/user/testdata/golden/TestListUsers/Return_all_users
@@ -1,20 +1,20 @@
-- name: user1
+- name: user1@example.com
   uid: 1111
   gid: 11111
   gecos: |-
     User1 gecos
     On multiple lines
-  homedir: /home/user1
+  homedir: /home/user1@example.com
   shell: /bin/bash
-- name: user2
+- name: user2@example.com
   uid: 2222
   gid: 22222
   gecos: User2
-  homedir: /home/user2
+  homedir: /home/user2@example.com
   shell: /bin/dash
-- name: user3
+- name: user3@example.com
   uid: 3333
   gid: 33333
   gecos: User3
-  homedir: /home/user3
+  homedir: /home/user3@example.com
   shell: /bin/zsh
diff --git a/internal/services/user/testdata/golden/TestLockUser/Successfully_lock_user b/internal/services/user/testdata/golden/TestLockUser/Successfully_lock_user
new file mode 100644
index 0000000000..e3fb626e42
--- /dev/null
+++ b/internal/services/user/testdata/golden/TestLockUser/Successfully_lock_user
@@ -0,0 +1,50 @@
+users:
+    - name: user1@example.com
+      uid: 1111
+      gid: 11111
+      gecos: |-
+        User1 gecos
+        On multiple lines
+      dir: /home/user1@example.com
+      shell: /bin/bash
+      broker_id: broker-id
+      locked: true
+    - name: user2@example.com
+      uid: 2222
+      gid: 22222
+      gecos: User2
+      dir: /home/user2@example.com
+      shell: /bin/dash
+      broker_id: broker-id
+    - name: user3@example.com
+      uid: 3333
+      gid: 33333
+      gecos: User3
+      dir: /home/user3@example.com
+      shell: /bin/zsh
+      broker_id: broker-id
+groups:
+    - name: group1
+      gid: 11111
+      ugid: group1
+    - name: group2
+      gid: 22222
+      ugid: group2
+    - name: group3
+      gid: 33333
+      ugid: group3
+    - name: commongroup
+      gid: 99999
+      ugid: commongroup
+users_to_groups:
+    - uid: 1111
+      gid: 11111
+    - uid: 2222
+      gid: 22222
+    - uid: 2222
+      gid: 99999
+    - uid: 3333
+      gid: 33333
+    - uid: 3333
+      gid: 99999
+schema_version: 2
diff --git a/internal/services/user/testdata/golden/TestLockUser/Successfully_lock_user_with_uppercase b/internal/services/user/testdata/golden/TestLockUser/Successfully_lock_user_with_uppercase
new file mode 100644
index 0000000000..e3fb626e42
--- /dev/null
+++ b/internal/services/user/testdata/golden/TestLockUser/Successfully_lock_user_with_uppercase
@@ -0,0 +1,50 @@
+users:
+    - name: user1@example.com
+      uid: 1111
+      gid: 11111
+      gecos: |-
+        User1 gecos
+        On multiple lines
+      dir: /home/user1@example.com
+      shell: /bin/bash
+      broker_id: broker-id
+      locked: true
+    - name: user2@example.com
+      uid: 2222
+      gid: 22222
+      gecos: User2
+      dir: /home/user2@example.com
+      shell: /bin/dash
+      broker_id: broker-id
+    - name: user3@example.com
+      uid: 3333
+      gid: 33333
+      gecos: User3
+      dir: /home/user3@example.com
+      shell: /bin/zsh
+      broker_id: broker-id
+groups:
+    - name: group1
+      gid: 11111
+      ugid: group1
+    - name: group2
+      gid: 22222
+      ugid: group2
+    - name: group3
+      gid: 33333
+      ugid: group3
+    - name: commongroup
+      gid: 99999
+      ugid: commongroup
+users_to_groups:
+    - uid: 1111
+      gid: 11111
+    - uid: 2222
+      gid: 22222
+    - uid: 2222
+      gid: 99999
+    - uid: 3333
+      gid: 33333
+    - uid: 3333
+      gid: 99999
+schema_version: 2
diff --git a/internal/services/user/testdata/golden/TestSetGroupID/Successfully_set_group_id b/internal/services/user/testdata/golden/TestSetGroupID/Successfully_set_group_id
new file mode 100644
index 0000000000..5b5a696198
--- /dev/null
+++ b/internal/services/user/testdata/golden/TestSetGroupID/Successfully_set_group_id
@@ -0,0 +1,3 @@
+idchanged: true
+homedirownerchanged: false
+warnings: []
diff --git a/internal/services/user/testdata/golden/TestSetGroupID/Successfully_set_group_id_with_uppercase b/internal/services/user/testdata/golden/TestSetGroupID/Successfully_set_group_id_with_uppercase
new file mode 100644
index 0000000000..5b5a696198
--- /dev/null
+++ b/internal/services/user/testdata/golden/TestSetGroupID/Successfully_set_group_id_with_uppercase
@@ -0,0 +1,3 @@
+idchanged: true
+homedirownerchanged: false
+warnings: []
diff --git a/internal/services/user/testdata/golden/TestSetUserID/Successfully_set_user_id b/internal/services/user/testdata/golden/TestSetUserID/Successfully_set_user_id
new file mode 100644
index 0000000000..5b5a696198
--- /dev/null
+++ b/internal/services/user/testdata/golden/TestSetUserID/Successfully_set_user_id
@@ -0,0 +1,3 @@
+idchanged: true
+homedirownerchanged: false
+warnings: []
diff --git a/internal/services/user/testdata/golden/TestSetUserID/Successfully_set_user_id_with_uppercase b/internal/services/user/testdata/golden/TestSetUserID/Successfully_set_user_id_with_uppercase
new file mode 100644
index 0000000000..5b5a696198
--- /dev/null
+++ b/internal/services/user/testdata/golden/TestSetUserID/Successfully_set_user_id_with_uppercase
@@ -0,0 +1,3 @@
+idchanged: true
+homedirownerchanged: false
+warnings: []
diff --git a/internal/services/user/testdata/golden/TestUnlockUser/Successfully_unlock_user b/internal/services/user/testdata/golden/TestUnlockUser/Successfully_unlock_user
new file mode 100644
index 0000000000..072c5e1aba
--- /dev/null
+++ b/internal/services/user/testdata/golden/TestUnlockUser/Successfully_unlock_user
@@ -0,0 +1,49 @@
+users:
+    - name: user1@example.com
+      uid: 1111
+      gid: 11111
+      gecos: |-
+        User1 gecos
+        On multiple lines
+      dir: /home/user1@example.com
+      shell: /bin/bash
+      broker_id: broker-id
+    - name: user2@example.com
+      uid: 2222
+      gid: 22222
+      gecos: User2
+      dir: /home/user2@example.com
+      shell: /bin/dash
+      broker_id: broker-id
+    - name: user3@example.com
+      uid: 3333
+      gid: 33333
+      gecos: User3
+      dir: /home/user3@example.com
+      shell: /bin/zsh
+      broker_id: broker-id
+groups:
+    - name: group1
+      gid: 11111
+      ugid: group1
+    - name: group2
+      gid: 22222
+      ugid: group2
+    - name: group3
+      gid: 33333
+      ugid: group3
+    - name: commongroup
+      gid: 99999
+      ugid: commongroup
+users_to_groups:
+    - uid: 1111
+      gid: 11111
+    - uid: 2222
+      gid: 22222
+    - uid: 2222
+      gid: 99999
+    - uid: 3333
+      gid: 33333
+    - uid: 3333
+      gid: 99999
+schema_version: 2
diff --git a/internal/services/user/testdata/golden/TestUnlockUser/Successfully_unlock_user_with_uppercase b/internal/services/user/testdata/golden/TestUnlockUser/Successfully_unlock_user_with_uppercase
new file mode 100644
index 0000000000..072c5e1aba
--- /dev/null
+++ b/internal/services/user/testdata/golden/TestUnlockUser/Successfully_unlock_user_with_uppercase
@@ -0,0 +1,49 @@
+users:
+    - name: user1@example.com
+      uid: 1111
+      gid: 11111
+      gecos: |-
+        User1 gecos
+        On multiple lines
+      dir: /home/user1@example.com
+      shell: /bin/bash
+      broker_id: broker-id
+    - name: user2@example.com
+      uid: 2222
+      gid: 22222
+      gecos: User2
+      dir: /home/user2@example.com
+      shell: /bin/dash
+      broker_id: broker-id
+    - name: user3@example.com
+      uid: 3333
+      gid: 33333
+      gecos: User3
+      dir: /home/user3@example.com
+      shell: /bin/zsh
+      broker_id: broker-id
+groups:
+    - name: group1
+      gid: 11111
+      ugid: group1
+    - name: group2
+      gid: 22222
+      ugid: group2
+    - name: group3
+      gid: 33333
+      ugid: group3
+    - name: commongroup
+      gid: 99999
+      ugid: commongroup
+users_to_groups:
+    - uid: 1111
+      gid: 11111
+    - uid: 2222
+      gid: 22222
+    - uid: 2222
+      gid: 99999
+    - uid: 3333
+      gid: 33333
+    - uid: 3333
+      gid: 99999
+schema_version: 2
diff --git a/internal/services/user/testdata/locked-user.db.yaml b/internal/services/user/testdata/locked-user.db.yaml
new file mode 100644
index 0000000000..ad6b646a8e
--- /dev/null
+++ b/internal/services/user/testdata/locked-user.db.yaml
@@ -0,0 +1,49 @@
+users:
+    - name: user1@example.com
+      uid: 1111
+      gid: 11111
+      gecos: |-
+        User1 gecos
+        On multiple lines
+      dir: /home/user1@example.com
+      shell: /bin/bash
+      broker_id: broker-id
+      locked: true
+    - name: user2@example.com
+      uid: 2222
+      gid: 22222
+      gecos: User2
+      dir: /home/user2@example.com
+      shell: /bin/dash
+      broker_id: broker-id
+    - name: user3@example.com
+      uid: 3333
+      gid: 33333
+      gecos: User3
+      dir: /home/user3@example.com
+      shell: /bin/zsh
+      broker_id: broker-id
+groups:
+    - name: group1
+      gid: 11111
+      ugid: group1
+    - name: group2
+      gid: 22222
+      ugid: group2
+    - name: group3
+      gid: 33333
+      ugid: group3
+    - name: commongroup
+      gid: 99999
+      ugid: commongroup
+users_to_groups:
+    - uid: 1111
+      gid: 11111
+    - uid: 2222
+      gid: 22222
+    - uid: 2222
+      gid: 99999
+    - uid: 3333
+      gid: 33333
+    - uid: 3333
+      gid: 99999
diff --git a/internal/services/user/user.go b/internal/services/user/user.go
index 0544028559..4d976d8297 100644
--- a/internal/services/user/user.go
+++ b/internal/services/user/user.go
@@ -8,12 +8,12 @@ import (
 	"fmt"
 	"strings"
 
-	"github.com/ubuntu/authd/internal/brokers"
-	"github.com/ubuntu/authd/internal/proto/authd"
-	"github.com/ubuntu/authd/internal/services/permissions"
-	"github.com/ubuntu/authd/internal/users"
-	"github.com/ubuntu/authd/internal/users/types"
-	"github.com/ubuntu/authd/log"
+	"github.com/canonical/authd/internal/brokers"
+	"github.com/canonical/authd/internal/proto/authd"
+	"github.com/canonical/authd/internal/services/permissions"
+	"github.com/canonical/authd/internal/users"
+	"github.com/canonical/authd/internal/users/types"
+	"github.com/canonical/authd/log"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
 )
@@ -40,8 +40,10 @@ func NewService(ctx context.Context, userManager *users.Manager, brokerManager *
 
 // GetUserByName returns the user entry for the given username.
 func (s Service) GetUserByName(ctx context.Context, req *authd.GetUserByNameRequest) (*authd.User, error) {
-	name := req.GetName()
+	// authd usernames are lowercase
+	name := strings.ToLower(req.GetName())
 	if name == "" {
+		log.Warningf(ctx, "GetUserByName: no user name provided")
 		return nil, status.Error(codes.InvalidArgument, "no user name provided")
 	}
 
@@ -50,15 +52,28 @@ func (s Service) GetUserByName(ctx context.Context, req *authd.GetUserByNameRequ
 		return userToProtobuf(user), nil
 	}
 
-	if !errors.Is(err, users.NoDataFoundError{}) || !req.GetShouldPreCheck() {
+	if !errors.Is(err, users.NoDataFoundError{}) {
+		log.Errorf(context.Background(), "GetUserByName: %v", err)
+		return nil, grpcError(err)
+	}
+
+	if !req.GetShouldPreCheck() {
+		// The user was not found in the database and pre-check is not requested.
+		// It often happens that NSS requests are sent for users that are not in the authd database, so to avoid
+		// spamming the logs, we only log this at debug level.
 		log.Debugf(context.Background(), "GetUserByName: %v", err)
 		return nil, grpcError(err)
 	}
 
 	// If the user is not found in the database, we check if it exists in at least one broker.
 	user, err = s.userPreCheck(ctx, name)
+	if errors.Is(err, errUserNotPermitted) {
+		err := fmt.Errorf("user %q is unknown and not authorized to log in via SSH for the first time by any configured broker", name)
+		log.Warningf(context.Background(), "GetUserByName: %v", err)
+		return nil, status.Error(codes.NotFound, err.Error())
+	}
 	if err != nil {
-		log.Debugf(context.Background(), "GetUserByName: %v", err)
+		log.Errorf(context.Background(), "GetUserByName: %v", err)
 		return nil, status.Error(codes.NotFound, err.Error())
 	}
 
@@ -68,11 +83,18 @@ func (s Service) GetUserByName(ctx context.Context, req *authd.GetUserByNameRequ
 // GetUserByID returns the user entry for the given user ID.
 func (s Service) GetUserByID(ctx context.Context, req *authd.GetUserByIDRequest) (*authd.User, error) {
 	if req.GetId() == 0 {
+		log.Warningf(ctx, "GetUserByID: no user ID provided")
 		return nil, status.Error(codes.InvalidArgument, "no user ID provided")
 	}
 
 	u, err := s.userManager.UserByID(req.Id)
+	if errors.Is(err, users.NoDataFoundError{}) {
+		// Only log this at debug level, see GetUserByName for details.
+		log.Debugf(context.Background(), "GetUserByID: %v", err)
+		return nil, grpcError(err)
+	}
 	if err != nil {
+		log.Errorf(context.Background(), "GetUserByID: %v", err)
 		return nil, grpcError(err)
 	}
 
@@ -83,6 +105,7 @@ func (s Service) GetUserByID(ctx context.Context, req *authd.GetUserByIDRequest)
 func (s Service) ListUsers(ctx context.Context, req *authd.Empty) (*authd.Users, error) {
 	allUsers, err := s.userManager.AllUsers()
 	if err != nil {
+		log.Errorf(context.Background(), "ListUsers: %v", err)
 		return nil, grpcError(err)
 	}
 
@@ -94,14 +117,64 @@ func (s Service) ListUsers(ctx context.Context, req *authd.Empty) (*authd.Users,
 	return &res, nil
 }
 
+// LockUser marks a user as locked.
+func (s Service) LockUser(ctx context.Context, req *authd.LockUserRequest) (*authd.Empty, error) {
+	if err := s.permissionManager.CheckRequestIsFromRoot(ctx); err != nil {
+		return nil, status.Error(codes.PermissionDenied, err.Error())
+	}
+
+	// authd uses lowercase usernames.
+	name := strings.ToLower(req.GetName())
+
+	if name == "" {
+		return nil, status.Error(codes.InvalidArgument, "no user name provided")
+	}
+
+	if err := s.userManager.LockUser(name); err != nil {
+		return nil, grpcError(err)
+	}
+
+	return &authd.Empty{}, nil
+}
+
+// UnlockUser marks a user as unlocked.
+func (s Service) UnlockUser(ctx context.Context, req *authd.UnlockUserRequest) (*authd.Empty, error) {
+	if err := s.permissionManager.CheckRequestIsFromRoot(ctx); err != nil {
+		return nil, status.Error(codes.PermissionDenied, err.Error())
+	}
+
+	// authd uses lowercase usernames.
+	name := strings.ToLower(req.GetName())
+
+	if name == "" {
+		return nil, status.Error(codes.InvalidArgument, "no user name provided")
+	}
+
+	if err := s.userManager.UnlockUser(name); err != nil {
+		return nil, grpcError(err)
+	}
+
+	return &authd.Empty{}, nil
+}
+
 // GetGroupByName returns the group entry for the given group name.
 func (s Service) GetGroupByName(ctx context.Context, req *authd.GetGroupByNameRequest) (*authd.Group, error) {
-	if req.GetName() == "" {
+	// authd uses lowercase group names.
+	name := strings.ToLower(req.GetName())
+
+	if name == "" {
+		log.Warningf(ctx, "GetGroupByName: no group name provided")
 		return nil, status.Error(codes.InvalidArgument, "no group name provided")
 	}
 
-	g, err := s.userManager.GroupByName(req.GetName())
+	g, err := s.userManager.GroupByName(name)
+	if errors.Is(err, users.NoDataFoundError{}) {
+		// Only log this at debug level, see GetUserByName for details
+		log.Debugf(context.Background(), "GetGroupByName: %v", err)
+		return nil, grpcError(err)
+	}
 	if err != nil {
+		log.Errorf(context.Background(), "GetGroupByName: %v", err)
 		return nil, grpcError(err)
 	}
 
@@ -111,11 +184,18 @@ func (s Service) GetGroupByName(ctx context.Context, req *authd.GetGroupByNameRe
 // GetGroupByID returns the group entry for the given group ID.
 func (s Service) GetGroupByID(ctx context.Context, req *authd.GetGroupByIDRequest) (*authd.Group, error) {
 	if req.GetId() == 0 {
+		log.Warningf(ctx, "GetGroupByID: no group ID provided")
 		return nil, status.Error(codes.InvalidArgument, "no group ID provided")
 	}
 
 	g, err := s.userManager.GroupByID(req.GetId())
+	if errors.Is(err, users.NoDataFoundError{}) {
+		// Only log this at debug level, see GetUserByName for details
+		log.Debugf(context.Background(), "GetGroupByID: %v", err)
+		return nil, grpcError(err)
+	}
 	if err != nil {
+		log.Errorf(context.Background(), "GetGroupByID: %v", err)
 		return nil, grpcError(err)
 	}
 
@@ -126,6 +206,7 @@ func (s Service) GetGroupByID(ctx context.Context, req *authd.GetGroupByIDReques
 func (s Service) ListGroups(ctx context.Context, req *authd.Empty) (*authd.Groups, error) {
 	allGroups, err := s.userManager.AllGroups()
 	if err != nil {
+		log.Errorf(context.Background(), "ListGroups: %v", err)
 		return nil, grpcError(err)
 	}
 
@@ -137,6 +218,58 @@ func (s Service) ListGroups(ctx context.Context, req *authd.Empty) (*authd.Group
 	return &res, nil
 }
 
+// SetUserID sets the UID of a user.
+func (s Service) SetUserID(ctx context.Context, req *authd.SetUserIDRequest) (*authd.SetUserIDResponse, error) {
+	if err := s.permissionManager.CheckRequestIsFromRoot(ctx); err != nil {
+		return nil, status.Error(codes.PermissionDenied, err.Error())
+	}
+
+	// authd uses lowercase usernames.
+	name := strings.ToLower(req.GetName())
+
+	if name == "" {
+		return nil, status.Error(codes.InvalidArgument, "no user name provided")
+	}
+
+	resp, err := s.userManager.SetUserID(name, req.GetId())
+	if err != nil {
+		log.Errorf(ctx, "SetUserID: %v", err)
+		return nil, grpcError(err)
+	}
+
+	return &authd.SetUserIDResponse{
+		IdChanged:           resp.IDChanged,
+		HomeDirOwnerChanged: resp.HomeDirOwnerChanged,
+		Warnings:            resp.Warnings,
+	}, nil
+}
+
+// SetGroupID sets the GID of a group.
+func (s Service) SetGroupID(ctx context.Context, req *authd.SetGroupIDRequest) (*authd.SetGroupIDResponse, error) {
+	if err := s.permissionManager.CheckRequestIsFromRoot(ctx); err != nil {
+		return nil, status.Error(codes.PermissionDenied, err.Error())
+	}
+
+	// authd uses lowercase group names.
+	name := strings.ToLower(req.GetName())
+
+	if name == "" {
+		return nil, status.Error(codes.InvalidArgument, "no group name provided")
+	}
+
+	resp, err := s.userManager.SetGroupID(name, req.GetId())
+	if err != nil {
+		log.Errorf(ctx, "SetGroupID: %v", err)
+		return nil, grpcError(err)
+	}
+
+	return &authd.SetGroupIDResponse{
+		IdChanged:           resp.IDChanged,
+		HomeDirOwnerChanged: resp.HomeDirOwnerChanged,
+		Warnings:            resp.Warnings,
+	}, nil
+}
+
 // userToProtobuf converts a types.UserEntry to authd.User.
 func userToProtobuf(u types.UserEntry) *authd.User {
 	return &authd.User{
@@ -159,12 +292,13 @@ func groupToProtobuf(g types.GroupEntry) *authd.Group {
 	}
 }
 
-// userPreCheck checks if the user exists in at least one broker.
-func (s Service) userPreCheck(ctx context.Context, username string) (types.UserEntry, error) {
-	// authd uses lowercase usernames.
-	username = strings.ToLower(username)
+var errUserNotPermitted = errors.New("user not permitted to log in via SSH for the first time")
 
-	// Check if the user exists in at least one broker.
+// userPreCheck checks if the user is permitted to log in via SSH for the first time.
+// It returns a types.UserEntry with a unique UID if the user is permitted to log in.
+// If the user is not permitted to log in by any broker, errUserNotPermitted is returned.
+func (s Service) userPreCheck(ctx context.Context, username string) (types.UserEntry, error) {
+	// Check if any broker permits the user to log in via SSH for the first time.
 	var userinfo string
 	var err error
 	for _, b := range s.brokerManager.AvailableBrokers() {
@@ -174,13 +308,23 @@ func (s Service) userPreCheck(ctx context.Context, username string) (types.UserE
 		}
 
 		userinfo, err = b.UserPreCheck(ctx, username)
-		if err == nil && userinfo != "" {
-			break
+		if err != nil {
+			// An unexpected error occurred while checking the user.
+			log.Errorf(ctx, "UserPreCheck: %v", err)
+			continue
+		}
+		if userinfo == "" {
+			// The broker does not permit the user to log in via SSH for the first time.
+			// This is an expected error, so we only log it at debug level.
+			log.Debugf(ctx, "UserPreCheck: %v", err)
+			continue
 		}
+		break
 	}
 
 	if err != nil || userinfo == "" {
-		return types.UserEntry{}, fmt.Errorf("user %q is not known by any broker", username)
+		// No broker permits the user to log in via SSH for the first time.
+		return types.UserEntry{}, errUserNotPermitted
 	}
 
 	var u types.UserEntry
@@ -204,7 +348,7 @@ func (s Service) userPreCheck(ctx context.Context, username string) (types.UserE
 // The NSS module uses this status code to determine the NSS status it should return.
 func grpcError(err error) error {
 	if errors.Is(err, users.NoDataFoundError{}) {
-		return status.Error(codes.NotFound, "")
+		return status.Error(codes.NotFound, err.Error())
 	}
 
 	return err
diff --git a/internal/services/user/user_test.go b/internal/services/user/user_test.go
index 1e82b84d63..d66721419b 100644
--- a/internal/services/user/user_test.go
+++ b/internal/services/user/user_test.go
@@ -6,21 +6,22 @@ import (
 	"net"
 	"os"
 	"path/filepath"
+	"strings"
 	"testing"
 
+	"github.com/canonical/authd/internal/brokers"
+	"github.com/canonical/authd/internal/proto/authd"
+	"github.com/canonical/authd/internal/services/errmessages"
+	"github.com/canonical/authd/internal/services/permissions"
+	"github.com/canonical/authd/internal/services/user"
+	"github.com/canonical/authd/internal/testutils"
+	"github.com/canonical/authd/internal/testutils/golden"
+	"github.com/canonical/authd/internal/users"
+	"github.com/canonical/authd/internal/users/db"
+	userslocking "github.com/canonical/authd/internal/users/locking"
+	userstestutils "github.com/canonical/authd/internal/users/testutils"
+	"github.com/canonical/authd/log"
 	"github.com/stretchr/testify/require"
-	"github.com/ubuntu/authd/internal/brokers"
-	"github.com/ubuntu/authd/internal/proto/authd"
-	"github.com/ubuntu/authd/internal/services/errmessages"
-	"github.com/ubuntu/authd/internal/services/permissions"
-	"github.com/ubuntu/authd/internal/services/user"
-	"github.com/ubuntu/authd/internal/testutils"
-	"github.com/ubuntu/authd/internal/testutils/golden"
-	"github.com/ubuntu/authd/internal/users"
-	"github.com/ubuntu/authd/internal/users/db"
-	"github.com/ubuntu/authd/internal/users/idgenerator"
-	localgroupstestutils "github.com/ubuntu/authd/internal/users/localentries/testutils"
-	"github.com/ubuntu/authd/log"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/credentials/insecure"
@@ -49,40 +50,64 @@ func TestGetUserByName(t *testing.T) {
 
 		dbFile         string
 		shouldPreCheck bool
+		closeDB        bool
 
 		wantErr          bool
 		wantErrNotExists bool
 	}{
-		"Return_existing_user":                               {username: "user1"},
-		"Return existing user with different capitalization": {username: "USER1"},
+		"Return_existing_user":                {username: "user1@example.com"},
+		"Return_existing_user_with_uppercase": {username: "user1@example.com"},
 
-		"Precheck_user_if_not_in_db": {username: "user-pre-check", shouldPreCheck: true},
-		"Prechecked_user_with_upper_cases_in_username_has_same_id_as_lower_case": {username: "User-Pre-Check", shouldPreCheck: true},
+		"Precheck_user_if_not_in_db": {username: "user-pre-check@example.com", shouldPreCheck: true},
+		"Prechecked_user_with_upper_cases_in_username_has_same_id_as_lower_case": {username: "User-Pre-Check@Example.com", shouldPreCheck: true},
 
-		"Error_with_typed_GRPC_notfound_code_on_unexisting_user": {username: "does-not-exists", wantErr: true, wantErrNotExists: true},
+		"Error_with_typed_GRPC_notfound_code_on_unexisting_user": {username: "does-not-exist@example.com", wantErr: true, wantErrNotExists: true},
 		"Error_on_missing_name":                                  {wantErr: true},
+		"Error_on_database_error":                                {username: "user1", closeDB: true, wantErr: true},
 
-		"Error_if_user_not_in_db_and_precheck_is_disabled": {username: "user-pre-check", wantErr: true, wantErrNotExists: true},
-		"Error_if_user_not_in_db_and_precheck_fails":       {username: "does-not-exist", dbFile: "empty.db.yaml", shouldPreCheck: true, wantErr: true, wantErrNotExists: true},
+		"Error_if_user_not_in_db_and_precheck_is_disabled":             {username: "user-pre-check@example.com", wantErr: true, wantErrNotExists: true},
+		"Error_if_user_not_in_db_and_precheck_fails":                   {username: "does-not-exist@example.com", dbFile: "empty.db.yaml", shouldPreCheck: true, wantErr: true, wantErrNotExists: true},
+		"Error_if_user_not_in_db_and_precheck_fails_for_existing_user": {username: "local-pre-check@example.com", dbFile: "empty.db.yaml", shouldPreCheck: true, wantErr: true, wantErrNotExists: true},
 	}
 	for name, tc := range tests {
 		t.Run(name, func(t *testing.T) {
-			// We don't care about gpasswd output here as it's already covered in the db unit tests.
-			_ = localgroupstestutils.SetupGPasswdMock(t, filepath.Join("testdata", "empty.group"))
+			if tc.shouldPreCheck {
+				userslocking.Z_ForTests_OverrideLockingWithCleanup(t)
+			}
+
+			client, m := newUserServiceClient(t, tc.dbFile)
+
+			if tc.closeDB {
+				// Close the database to trigger a database error
+				err := userstestutils.DBManager(m).Close()
+				require.NoError(t, err, "Setup: failed to close database")
+			}
 
-			client := newUserServiceClient(t, tc.dbFile)
+			u, err := client.GetUserByName(context.Background(), &authd.GetUserByNameRequest{Name: tc.username, ShouldPreCheck: tc.shouldPreCheck})
+			requireExpectedResult(t, "GetUserByName", u, err, tc.wantErr, tc.wantErrNotExists)
 
-			got, err := client.GetUserByName(context.Background(), &authd.GetUserByNameRequest{Name: tc.username, ShouldPreCheck: tc.shouldPreCheck})
-			requireExpectedResult(t, "GetUserByName", got, err, tc.wantErr, tc.wantErrNotExists)
+			// Check that the user name is lowercase
+			if u != nil {
+				require.Equal(t, u.Name, strings.ToLower(u.Name), "User name should be lowercase")
+			}
+
+			if !tc.shouldPreCheck || tc.wantErr {
+				return
+			}
+
+			_, err = client.GetUserByName(context.Background(), &authd.GetUserByNameRequest{Name: tc.username, ShouldPreCheck: false})
+			require.Error(t, err, "GetUserByName should return an error, but did not")
 		})
 	}
 }
 
+//nolint:dupl // This is not a duplicate test
 func TestGetUserByID(t *testing.T) {
 	tests := map[string]struct {
 		uid uint32
 
-		dbFile string
+		dbFile  string
+		closeDB bool
 
 		wantErr          bool
 		wantErrNotExists bool
@@ -90,14 +115,18 @@ func TestGetUserByID(t *testing.T) {
 		"Return_existing_user": {uid: 1111},
 
 		"Error_with_typed_GRPC_notfound_code_on_unexisting_user": {uid: 4242, wantErr: true, wantErrNotExists: true},
-		"Error_on_missing_uid": {wantErr: true},
+		"Error_on_missing_uid":    {wantErr: true},
+		"Error_on_database_error": {uid: 1111, closeDB: true, wantErr: true},
 	}
 	for name, tc := range tests {
 		t.Run(name, func(t *testing.T) {
-			// We don't care about gpasswd output here as it's already covered in the db unit tests.
-			_ = localgroupstestutils.SetupGPasswdMock(t, filepath.Join("testdata", "empty.group"))
+			client, m := newUserServiceClient(t, tc.dbFile)
 
-			client := newUserServiceClient(t, tc.dbFile)
+			if tc.closeDB {
+				// Close the database to trigger a database error
+				err := userstestutils.DBManager(m).Close()
+				require.NoError(t, err, "Setup: failed to close database")
+			}
 
 			got, err := client.GetUserByID(context.Background(), &authd.GetUserByIDRequest{Id: tc.uid})
 			requireExpectedResult(t, "GetUserByID", got, err, tc.wantErr, tc.wantErrNotExists)
@@ -109,34 +138,47 @@ func TestGetGroupByName(t *testing.T) {
 	tests := map[string]struct {
 		groupname string
 
-		dbFile string
+		dbFile  string
+		closeDB bool
 
 		wantErr          bool
 		wantErrNotExists bool
 	}{
-		"Return_existing_group": {groupname: "group1"},
+		"Return_existing_group":                {groupname: "group1"},
+		"Return_existing_group_with_uppercase": {groupname: "GROUP1"},
 
 		"Error_with_typed_GRPC_notfound_code_on_unexisting_user": {groupname: "does-not-exists", wantErr: true, wantErrNotExists: true},
 		"Error_on_missing_name":                                  {wantErr: true},
+		"Error_on_database_error":                                {groupname: "group1", closeDB: true, wantErr: true},
 	}
 	for name, tc := range tests {
 		t.Run(name, func(t *testing.T) {
-			// We don't care about gpasswd output here as it's already covered in the db unit tests.
-			_ = localgroupstestutils.SetupGPasswdMock(t, filepath.Join("testdata", "empty.group"))
+			client, m := newUserServiceClient(t, tc.dbFile)
 
-			client := newUserServiceClient(t, tc.dbFile)
+			if tc.closeDB {
+				// Close the database to trigger a database error
+				err := userstestutils.DBManager(m).Close()
+				require.NoError(t, err, "Setup: failed to close database")
+			}
+
+			group, err := client.GetGroupByName(context.Background(), &authd.GetGroupByNameRequest{Name: tc.groupname})
+			requireExpectedResult(t, "GetGroupByName", group, err, tc.wantErr, tc.wantErrNotExists)
 
-			got, err := client.GetGroupByName(context.Background(), &authd.GetGroupByNameRequest{Name: tc.groupname})
-			requireExpectedResult(t, "GetGroupByName", got, err, tc.wantErr, tc.wantErrNotExists)
+			// Check that the group name is lowercase
+			if group != nil {
+				require.Equal(t, group.Name, strings.ToLower(group.Name), "Group name should be lowercase")
+			}
 		})
 	}
 }
 
+//nolint:dupl // This is not a duplicate test
 func TestGetGroupByID(t *testing.T) {
 	tests := map[string]struct {
 		gid uint32
 
-		dbFile string
+		dbFile  string
+		closeDB bool
 
 		wantErr          bool
 		wantErrNotExists bool
@@ -144,14 +186,18 @@ func TestGetGroupByID(t *testing.T) {
 		"Return_existing_group": {gid: 11111},
 
 		"Error_with_typed_GRPC_notfound_code_on_unexisting_user": {gid: 4242, wantErr: true, wantErrNotExists: true},
-		"Error_on_missing_uid": {wantErr: true},
+		"Error_on_missing_uid":    {wantErr: true},
+		"Error_on_database_error": {gid: 11111, closeDB: true, wantErr: true},
 	}
 	for name, tc := range tests {
 		t.Run(name, func(t *testing.T) {
-			// We don't care about gpasswd output here as it's already covered in the db unit tests.
-			_ = localgroupstestutils.SetupGPasswdMock(t, filepath.Join("testdata", "empty.group"))
+			client, m := newUserServiceClient(t, tc.dbFile)
 
-			client := newUserServiceClient(t, tc.dbFile)
+			if tc.closeDB {
+				// Close the database to trigger a database error
+				err := userstestutils.DBManager(m).Close()
+				require.NoError(t, err, "Setup: failed to close database")
+			}
 
 			got, err := client.GetGroupByID(context.Background(), &authd.GetGroupByIDRequest{Id: tc.gid})
 			requireExpectedResult(t, "GetGroupByID", got, err, tc.wantErr, tc.wantErrNotExists)
@@ -161,23 +207,28 @@ func TestGetGroupByID(t *testing.T) {
 
 func TestListUsers(t *testing.T) {
 	tests := map[string]struct {
-		dbFile string
+		dbFile  string
+		closeDB bool
 
 		wantErr bool
 	}{
-		"Return_all_users": {},
-		"Return_no_users":  {dbFile: "empty.db.yaml"},
+		"Return_all_users":        {},
+		"Return_no_users":         {dbFile: "empty.db.yaml"},
+		"Error_on_database_error": {closeDB: true, wantErr: true},
 	}
 	for name, tc := range tests {
 		t.Run(name, func(t *testing.T) {
-			// We don't care about gpasswd output here as it's already covered in the db unit tests.
-			_ = localgroupstestutils.SetupGPasswdMock(t, filepath.Join("testdata", "empty.group"))
-
 			if tc.dbFile == "" {
 				tc.dbFile = "default.db.yaml"
 			}
 
-			client := newUserServiceClient(t, tc.dbFile)
+			client, m := newUserServiceClient(t, tc.dbFile)
+
+			if tc.closeDB {
+				// Close the database to trigger a database error
+				err := userstestutils.DBManager(m).Close()
+				require.NoError(t, err, "Setup: failed to close database")
+			}
 
 			resp, err := client.ListUsers(context.Background(), &authd.Empty{})
 			requireExpectedListResult(t, "ListUsers", resp.GetUsers(), err, tc.wantErr)
@@ -187,23 +238,28 @@ func TestListUsers(t *testing.T) {
 
 func TestListGroups(t *testing.T) {
 	tests := map[string]struct {
-		dbFile string
+		dbFile  string
+		closeDB bool
 
 		wantErr bool
 	}{
-		"Return_all_groups": {},
-		"Return_no_groups":  {dbFile: "empty.db.yaml"},
+		"Return_all_groups":       {},
+		"Return_no_groups":        {dbFile: "empty.db.yaml"},
+		"Error_on_database_error": {closeDB: true, wantErr: true},
 	}
 	for name, tc := range tests {
 		t.Run(name, func(t *testing.T) {
-			// We don't care about gpasswd output here as it's already covered in the db unit tests.
-			_ = localgroupstestutils.SetupGPasswdMock(t, filepath.Join("testdata", "empty.group"))
-
 			if tc.dbFile == "" {
 				tc.dbFile = "default.db.yaml"
 			}
 
-			client := newUserServiceClient(t, tc.dbFile)
+			client, m := newUserServiceClient(t, tc.dbFile)
+
+			if tc.closeDB {
+				// Close the database to trigger a database error
+				err := userstestutils.DBManager(m).Close()
+				require.NoError(t, err, "Setup: failed to close database")
+			}
 
 			resp, err := client.ListGroups(context.Background(), &authd.Empty{})
 			if tc.wantErr {
@@ -219,12 +275,156 @@ func TestListGroups(t *testing.T) {
 	}
 }
 
-func TestMockgpasswd(t *testing.T) {
-	localgroupstestutils.Mockgpasswd(t)
+func TestLockUser(t *testing.T) {
+	tests := map[string]struct {
+		sourceDB string
+
+		username           string
+		currentUserNotRoot bool
+
+		wantErr bool
+	}{
+		"Successfully_lock_user":                {username: "user1@example.com"},
+		"Successfully_lock_user_with_uppercase": {username: "user1@example.com"},
+
+		"Error_when_username_is_empty":   {wantErr: true},
+		"Error_when_user_does_not_exist": {username: "doesnotexist@example.com", wantErr: true},
+		"Error_when_not_root":            {username: "notroot@example.com", currentUserNotRoot: true, wantErr: true},
+	}
+	for name, tc := range tests {
+		t.Run(name, func(t *testing.T) {
+			client, m := newUserServiceClient(t, tc.sourceDB, tc.currentUserNotRoot)
+
+			_, err := client.LockUser(context.Background(), &authd.LockUserRequest{Name: tc.username})
+			if tc.wantErr {
+				require.Error(t, err, "LockUser should return an error, but did not")
+				return
+			}
+			require.NoError(t, err, "LockUser should not return an error, but did")
+
+			dbContent, err := db.Z_ForTests_DumpNormalizedYAML(userstestutils.DBManager(m))
+			require.NoError(t, err, "Setup: failed to dump database for comparing")
+			golden.CheckOrUpdate(t, dbContent)
+		})
+	}
+}
+
+func TestUnlockUser(t *testing.T) {
+	tests := map[string]struct {
+		sourceDB string
+
+		username           string
+		currentUserNotRoot bool
+
+		wantErr bool
+	}{
+		"Successfully_unlock_user":                {username: "user1@example.com"},
+		"Successfully_unlock_user_with_uppercase": {username: "user1@example.com"},
+
+		"Error_when_username_is_empty":   {wantErr: true},
+		"Error_when_user_does_not_exist": {username: "doesnotexist@example.com", wantErr: true},
+		"Error_when_not_root":            {username: "notroot@example.com", currentUserNotRoot: true, wantErr: true},
+	}
+	for name, tc := range tests {
+		t.Run(name, func(t *testing.T) {
+			if tc.sourceDB == "" {
+				tc.sourceDB = "locked-user.db.yaml"
+			}
+
+			client, m := newUserServiceClient(t, tc.sourceDB, tc.currentUserNotRoot)
+
+			_, err := client.UnlockUser(context.Background(), &authd.UnlockUserRequest{Name: tc.username})
+			if tc.wantErr {
+				require.Error(t, err, "UnlockUser should return an error, but did not")
+				return
+			}
+			require.NoError(t, err, "UnlockUser should not return an error, but did")
+
+			dbContent, err := db.Z_ForTests_DumpNormalizedYAML(userstestutils.DBManager(m))
+			require.NoError(t, err, "Setup: failed to dump database for comparing")
+			golden.CheckOrUpdate(t, dbContent)
+		})
+	}
+}
+
+//nolint:dupl // This is not a duplicate test
+func TestSetUserID(t *testing.T) {
+	tests := map[string]struct {
+		sourceDB string
+
+		username           string
+		newUID             uint32
+		currentUserNotRoot bool
+
+		wantErr bool
+	}{
+		"Successfully_set_user_id":                {username: "user1@example.com", newUID: 5555},
+		"Successfully_set_user_id_with_uppercase": {username: "USER1@EXAMPLE.COM", newUID: 5555},
+
+		"Error_when_username_is_empty":   {wantErr: true},
+		"Error_when_user_does_not_exist": {username: "doesnotexist@example.com", newUID: 5555, wantErr: true},
+		"Error_when_not_root":            {username: "user1@example.com", newUID: 5555, currentUserNotRoot: true, wantErr: true},
+	}
+	for name, tc := range tests {
+		t.Run(name, func(t *testing.T) {
+			if !tc.wantErr {
+				userslocking.Z_ForTests_OverrideLockingWithCleanup(t)
+			}
+
+			client, _ := newUserServiceClient(t, tc.sourceDB, tc.currentUserNotRoot)
+
+			resp, err := client.SetUserID(context.Background(), &authd.SetUserIDRequest{Name: tc.username, Id: tc.newUID})
+			if tc.wantErr {
+				require.Error(t, err, "SetUserID should return an error, but did not")
+				return
+			}
+			require.NoError(t, err, "SetUserID should not return an error, but did")
+
+			golden.CheckOrUpdateYAML(t, resp)
+		})
+	}
+}
+
+//nolint:dupl // This is not a duplicate test
+func TestSetGroupID(t *testing.T) {
+	tests := map[string]struct {
+		sourceDB string
+
+		groupname          string
+		newGID             uint32
+		currentUserNotRoot bool
+
+		wantErr bool
+	}{
+		"Successfully_set_group_id":                {groupname: "group1", newGID: 6666},
+		"Successfully_set_group_id_with_uppercase": {groupname: "GROUP1", newGID: 6666},
+
+		"Error_when_groupname_is_empty":   {wantErr: true},
+		"Error_when_group_does_not_exist": {groupname: "doesnotexist", newGID: 6666, wantErr: true},
+		"Error_when_not_root":             {groupname: "group1", newGID: 6666, currentUserNotRoot: true, wantErr: true},
+	}
+	for name, tc := range tests {
+		t.Run(name, func(t *testing.T) {
+			if !tc.wantErr {
+				userslocking.Z_ForTests_OverrideLockingWithCleanup(t)
+			}
+
+			client, _ := newUserServiceClient(t, tc.sourceDB, tc.currentUserNotRoot)
+
+			resp, err := client.SetGroupID(context.Background(), &authd.SetGroupIDRequest{Name: tc.groupname, Id: tc.newGID})
+			if tc.wantErr {
+				require.Error(t, err, "SetGroupID should return an error, but did not")
+				return
+			}
+			require.NoError(t, err, "SetGroupID should not return an error, but did")
+
+			golden.CheckOrUpdateYAML(t, resp)
+		})
+	}
 }
 
 // newUserServiceClient returns a new gRPC client for the CLI service.
-func newUserServiceClient(t *testing.T, dbFile string) (client authd.UserServiceClient) {
+func newUserServiceClient(t *testing.T, dbFile string, currentUserNotRoot ...bool) (client authd.UserServiceClient, userManager *users.Manager) {
 	t.Helper()
 
 	tmpDir, err := os.MkdirTemp("", "authd-socket-dir")
@@ -241,9 +441,15 @@ func newUserServiceClient(t *testing.T, dbFile string) (client authd.UserService
 		require.NoError(t, err, "Setup: could not create database from testdata")
 	}
 
-	userManager := newUserManagerForTests(t, dbFile)
+	userManager = newUserManagerForTests(t, dbFile)
 	brokerManager := newBrokersManagerForTests(t)
-	permissionsManager := permissions.New(permissions.Z_ForTests_WithCurrentUserAsRoot())
+
+	var permissionsManager permissions.Manager
+	if len(currentUserNotRoot) > 0 && currentUserNotRoot[0] {
+		permissionsManager = permissions.New()
+	} else {
+		permissionsManager = permissions.New(permissions.Z_ForTests_WithCurrentUserAsRoot())
+	}
 	service := user.NewService(context.Background(), userManager, brokerManager, &permissionsManager)
 
 	grpcServer := grpc.NewServer(permissions.WithUnixPeerCreds(), grpc.ChainUnaryInterceptor(enableCheckGlobalAccess(service), errmessages.RedactErrorInterceptor))
@@ -263,7 +469,7 @@ func newUserServiceClient(t *testing.T, dbFile string) (client authd.UserService
 
 	t.Cleanup(func() { _ = conn.Close() }) // We don't care about the error on cleanup
 
-	return authd.NewUserServiceClient(conn)
+	return authd.NewUserServiceClient(conn), userManager
 }
 
 func enableCheckGlobalAccess(s user.Service) grpc.UnaryServerInterceptor {
@@ -288,7 +494,7 @@ func newUserManagerForTests(t *testing.T, dbFile string) *users.Manager {
 	require.NoError(t, err, "Setup: could not create database from testdata")
 
 	managerOpts := []users.Option{
-		users.WithIDGenerator(&idgenerator.IDGeneratorMock{
+		users.WithIDGenerator(&users.IDGeneratorMock{
 			UIDsToGenerate: []uint32{1234},
 		}),
 	}
@@ -325,7 +531,9 @@ func requireExpectedResult[T authd.User | authd.Group](t *testing.T, funcName st
 		require.True(t, ok, "The error is always a gRPC error")
 		if wantErrNotExists {
 			require.Equal(t, codes.NotFound.String(), s.Code().String())
+			return
 		}
+		require.NotEqual(t, codes.NotFound.String(), s.Code().String())
 		return
 	}
 	require.NoError(t, err, fmt.Sprintf("%s should not return an error, but did", funcName))
@@ -350,11 +558,6 @@ func requireExpectedListResult[T authd.User | authd.Group](t *testing.T, funcNam
 }
 
 func TestMain(m *testing.M) {
-	// Needed to skip the test setup when running the gpasswd mock.
-	if os.Getenv("GO_WANT_HELPER_PROCESS") != "" {
-		os.Exit(m.Run())
-	}
-
 	log.SetLevel(log.DebugLevel)
 
 	cleanup, err := testutils.StartSystemBusMock()
diff --git a/internal/sliceutils/sliceutils.go b/internal/sliceutils/sliceutils.go
index 2276e959ee..7f8770d8a7 100644
--- a/internal/sliceutils/sliceutils.go
+++ b/internal/sliceutils/sliceutils.go
@@ -1,6 +1,8 @@
 // Package sliceutils provides utility functions for slices.
 package sliceutils
 
+import "slices"
+
 // Difference returns a slice with the elements that are in a but not in b.
 func Difference[T comparable](a, b []T) []T {
 	setB := make(map[T]struct{}, len(b))
@@ -17,6 +19,18 @@ func Difference[T comparable](a, b []T) []T {
 	return diff
 }
 
+// DifferenceFunc returns a slice with the elements that are in a but not in b,
+// supporting a function to compare the items.
+func DifferenceFunc[S ~[]E, E any](a, b S, f func(E, E) bool) S {
+	var diff S
+	for _, aItem := range a {
+		if !slices.ContainsFunc(b, func(bItem E) bool { return f(aItem, bItem) }) {
+			diff = append(diff, aItem)
+		}
+	}
+	return diff
+}
+
 // Intersection returns a slice with the elements that are in both a and b.
 func Intersection[T comparable](a, b []T) []T {
 	setB := make(map[T]struct{}, len(b))
@@ -32,3 +46,45 @@ func Intersection[T comparable](a, b []T) []T {
 	}
 	return intersection
 }
+
+// Map maps the slice to another slice of the same size, using the provided function.
+func Map[T any, S ~[]E, E any](a S, f func(E) T) []T {
+	if a == nil {
+		return nil
+	}
+
+	mapped := make([]T, 0, len(a))
+	for _, v := range a {
+		mapped = append(mapped, f(v))
+	}
+	return mapped
+}
+
+// EqualContent compares two slices, ensuring that their content is equal.
+func EqualContent[S ~[]E, E comparable](a S, b S) bool {
+	if len(a) != len(b) {
+		return false
+	}
+
+	for _, av := range a {
+		if !slices.Contains(b, av) {
+			return false
+		}
+	}
+	return true
+}
+
+// EqualContentFunc compares two slices, ensuring that their content is equal
+// using the provided function to compare.
+func EqualContentFunc[S ~[]E, E any](a S, b S, f func(E, E) bool) bool {
+	if len(a) != len(b) {
+		return false
+	}
+
+	for _, av := range a {
+		if !slices.ContainsFunc(b, func(bv E) bool { return f(av, bv) }) {
+			return false
+		}
+	}
+	return true
+}
diff --git a/internal/sliceutils/sliceutils_test.go b/internal/sliceutils/sliceutils_test.go
index 708d4d64fa..4546285283 100644
--- a/internal/sliceutils/sliceutils_test.go
+++ b/internal/sliceutils/sliceutils_test.go
@@ -1,10 +1,11 @@
 package sliceutils_test
 
 import (
+	"slices"
 	"testing"
 
+	"github.com/canonical/authd/internal/sliceutils"
 	"github.com/stretchr/testify/require"
-	"github.com/ubuntu/authd/internal/sliceutils"
 )
 
 func TestDifference(t *testing.T) {
@@ -45,6 +46,53 @@ func TestDifference(t *testing.T) {
 	}
 }
 
+func TestDifferenceFunc(t *testing.T) {
+	t.Parallel()
+
+	type notComparable struct {
+		i  int
+		ii []int
+	}
+
+	notComparableCompareFunc := func(a notComparable, b notComparable) bool {
+		return a.i == b.i && slices.Equal(a.ii, b.ii)
+	}
+
+	tests := map[string]struct {
+		a, b, want []notComparable
+	}{
+		"test_difference_between_two_slices": {
+			a:    []notComparable{{i: 1}, {i: 2}, {i: 3}, {i: 4}, {i: 5, ii: []int{1, 2}}},
+			b:    []notComparable{{i: 3}, {i: 4}, {i: 5}, {i: 6}, {i: 7}},
+			want: []notComparable{{i: 1}, {i: 2}, {i: 5, ii: []int{1, 2}}},
+		},
+		"test_difference_between_an_empty_slice_and_a_non-empty_slice": {
+			a:    []notComparable{},
+			b:    []notComparable{{i: 3}, {i: 4}, {i: 5}, {i: 6}, {i: 7}},
+			want: []notComparable(nil),
+		},
+		"test_difference_between_a_non-empty_slice_and_an_empty_slice": {
+			a:    []notComparable{{i: 1}, {i: 2}, {i: 3}, {i: 4}, {i: 5}},
+			b:    []notComparable{},
+			want: []notComparable{{i: 1}, {i: 2}, {i: 3}, {i: 4}, {i: 5}},
+		},
+		"test_difference_between_two_empty_slices": {
+			a:    []notComparable{},
+			b:    []notComparable{},
+			want: []notComparable(nil),
+		},
+	}
+
+	for name, tc := range tests {
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			got := sliceutils.DifferenceFunc(tc.a, tc.b, notComparableCompareFunc)
+			require.Equal(t, tc.want, got)
+		})
+	}
+}
+
 func TestIntersection(t *testing.T) {
 	t.Parallel()
 
@@ -82,3 +130,120 @@ func TestIntersection(t *testing.T) {
 		})
 	}
 }
+
+func TestMap(t *testing.T) {
+	t.Parallel()
+
+	type intStruct struct {
+		i int
+	}
+
+	tests := map[string]struct {
+		a    []intStruct
+		want []int
+	}{
+		"test_mapping_a_slice": {
+			a:    []intStruct{{1}, {2}, {3}, {4}, {5}},
+			want: []int{1, 2, 3, 4, 5},
+		},
+		"test_mapping_an empty_slice": {
+			a:    []intStruct{},
+			want: []int{},
+		},
+		"test_mapping_a_nil_slice": {
+			a:    []intStruct(nil),
+			want: []int(nil),
+		},
+	}
+
+	for name, tc := range tests {
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			got := sliceutils.Map(tc.a, func(s intStruct) int { return s.i })
+			require.Equal(t, tc.want, got)
+		})
+	}
+}
+
+func TestEqualsContentFunc(t *testing.T) {
+	t.Parallel()
+
+	type notComparable struct {
+		i  int
+		ii []int
+	}
+
+	notComparableCompareFunc := func(a, b notComparable) bool {
+		return a.i == b.i && sliceutils.EqualContent(a.ii, b.ii)
+	}
+
+	tests := map[string]struct {
+		a, b []notComparable
+		want bool
+	}{
+		"equal_slices_same_order": {
+			a:    []notComparable{{i: 1}, {i: 2}, {i: 3}},
+			b:    []notComparable{{i: 1}, {i: 2}, {i: 3}},
+			want: true,
+		},
+		"equal_slices_different_order": {
+			a:    []notComparable{{i: 1}, {i: 2}, {i: 3}},
+			b:    []notComparable{{i: 3}, {i: 1}, {i: 2}},
+			want: true,
+		},
+		"equal_with_nested_slices": {
+			a:    []notComparable{{i: 1, ii: []int{1, 2}}, {i: 2, ii: []int{3}}},
+			b:    []notComparable{{i: 2, ii: []int{3}}, {i: 1, ii: []int{1, 2}}},
+			want: true,
+		},
+		"equal_with_nested_slices_with_different_order": {
+			a:    []notComparable{{i: 1, ii: []int{1, 2}}, {i: 2, ii: []int{3}}},
+			b:    []notComparable{{i: 2, ii: []int{3}}, {i: 1, ii: []int{2, 1}}},
+			want: true,
+		},
+		"both_empty": {
+			a:    []notComparable{},
+			b:    []notComparable{},
+			want: true,
+		},
+		"both_nil": {
+			a:    nil,
+			b:    nil,
+			want: true,
+		},
+		"nil_and_empty": {
+			a:    nil,
+			b:    []notComparable{},
+			want: true,
+		},
+		"not_equal_different_lengths": {
+			a:    []notComparable{{i: 1}, {i: 2}},
+			b:    []notComparable{{i: 1}, {i: 2}, {i: 3}},
+			want: false,
+		},
+		"not_equal_different_content": {
+			a:    []notComparable{{i: 1}, {i: 2}, {i: 3}},
+			b:    []notComparable{{i: 1}, {i: 2}, {i: 4}},
+			want: false,
+		},
+		"not_equal_with_nested_slices_with_different_content": {
+			a:    []notComparable{{i: 1, ii: []int{1, 2}}, {i: 2, ii: []int{3}}},
+			b:    []notComparable{{i: 2, ii: []int{4}}, {i: 1, ii: []int{2, 1}}},
+			want: false,
+		},
+		"one_empty_one_nonempty": {
+			a:    []notComparable{},
+			b:    []notComparable{{i: 1}},
+			want: false,
+		},
+	}
+
+	for name, tc := range tests {
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+			got := sliceutils.EqualContentFunc(tc.a, tc.b, notComparableCompareFunc)
+			require.Equal(t, tc.want, got)
+		})
+	}
+}
diff --git a/internal/testlog/testlog.go b/internal/testlog/testlog.go
new file mode 100644
index 0000000000..d075cd529e
--- /dev/null
+++ b/internal/testlog/testlog.go
@@ -0,0 +1,241 @@
+// Package testlog provides utilities for logging test output.
+package testlog
+
+import (
+	"fmt"
+	"io"
+	"os"
+	"os/exec"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+)
+
+var (
+	isVerboseOnce sync.Once
+	isVerbose     bool
+)
+
+type runWithTimingOptions struct {
+	doNotSetStdoutAndStderr         bool
+	onlyPrintStdoutAndStderrOnError bool
+}
+
+// RunWithTimingOption is a function that configures the RunWithTiming function.
+type RunWithTimingOption func(options *runWithTimingOptions)
+
+// DoNotSetStdoutAndStderr prevents RunWithTiming from setting the stdout and stderr of the given command.
+// By default, RunWithTiming sets stdout and stderr to the test's output.
+func DoNotSetStdoutAndStderr() RunWithTimingOption {
+	return func(options *runWithTimingOptions) {
+		options.doNotSetStdoutAndStderr = true
+	}
+}
+
+// OnlyPrintStdoutAndStderrOnError makes RunWithTiming only print the stdout and stderr of the given command if it fails.
+func OnlyPrintStdoutAndStderrOnError() RunWithTimingOption {
+	return func(options *runWithTimingOptions) {
+		options.onlyPrintStdoutAndStderrOnError = true
+	}
+}
+
+// RunWithTiming runs the given command while logging its duration with the provided message.
+//
+//nolint:thelper // we do call t.Helper() if t is not nil
+func RunWithTiming(t *testing.T, msg string, cmd *exec.Cmd, options ...RunWithTimingOption) error {
+	if t != nil {
+		t.Helper()
+	}
+
+	w := testOutput(t)
+
+	opts := runWithTimingOptions{}
+	for _, f := range options {
+		f(&opts)
+	}
+
+	if opts.doNotSetStdoutAndStderr && opts.onlyPrintStdoutAndStderrOnError {
+		panic("onlyPrintStdoutAndStderrOnError and doNotSetStdoutAndStderr cannot be used together")
+	}
+
+	if !opts.doNotSetStdoutAndStderr && !opts.onlyPrintStdoutAndStderrOnError {
+		cmd.Stdout = w
+		cmd.Stderr = w
+	}
+
+	LogCommand(t, msg, cmd)
+	start := time.Now()
+
+	var err error
+	var out []byte
+	if opts.onlyPrintStdoutAndStderrOnError {
+		out, err = cmd.CombinedOutput()
+		if err != nil {
+			_, _ = w.Write(out)
+		}
+	} else {
+		err = cmd.Run()
+	}
+	duration := time.Since(start)
+
+	if err != nil {
+		fmt.Fprint(w, redSeparatorf("%s failed in %.3fs with %v", msg, duration.Seconds(), err)+"\n")
+	} else {
+		fmt.Fprint(w, separatorf("%s finished in %.3fs", msg, duration.Seconds())+"\n")
+	}
+
+	return err
+}
+
+// LogCommand logs the given command to stderr.
+//
+//nolint:thelper // we do call t.Helper() if t is not nil
+func LogCommand(t *testing.T, msg string, cmd *exec.Cmd) {
+	if t != nil {
+		t.Helper()
+	}
+	w := testOutput(t)
+
+	sep := "----------------------------------------"
+	fmt.Fprintf(w, "\n"+separator(msg)+"\ncommand: %s\n%s\nenvironment: %s\n%s\n", cmd.String(), sep, cmd.Env, sep)
+}
+
+// LogStartSeparatorf logs a separator to stderr with the given formatted message.
+//
+//nolint:thelper // we do call t.Helper() if t is not nil
+func LogStartSeparatorf(t *testing.T, s string, args ...any) {
+	if t != nil {
+		t.Helper()
+	}
+	w := testOutput(t)
+
+	fmt.Fprint(w, "\n"+separatorf(s, args...))
+}
+
+// LogStartSeparator logs a separator to stderr with the given message.
+//
+//nolint:thelper // we do call t.Helper() if t is not nil
+func LogStartSeparator(t *testing.T, args ...any) {
+	if t != nil {
+		t.Helper()
+	}
+	w := testOutput(t)
+
+	fmt.Fprint(w, "\n"+separator(args...))
+}
+
+// LogEndSeparatorf logs a separator to stderr with the given formatted message.
+//
+//nolint:thelper // we do call t.Helper() if t is not nil
+func LogEndSeparatorf(t *testing.T, s string, args ...any) {
+	if t != nil {
+		t.Helper()
+	}
+	w := testOutput(t)
+
+	fmt.Fprint(w, separatorf(s, args...)+"\n\n")
+}
+
+// LogEndSeparator logs a separator to stderr with the given message.
+//
+//nolint:thelper // we do call t.Helper() if t is not nil
+func LogEndSeparator(t *testing.T, args ...any) {
+	if t != nil {
+		t.Helper()
+	}
+	w := testOutput(t)
+
+	fmt.Fprint(w, separator(args...)+"\n\n")
+}
+
+// LogRedEndSeparatorf logs a separator to stderr with the given formatted message in red.
+//
+//nolint:thelper // we do call t.Helper() if t is not nil
+func LogRedEndSeparatorf(t *testing.T, s string, args ...any) {
+	if t != nil {
+		t.Helper()
+	}
+	w := testOutput(t)
+
+	fmt.Fprint(w, redSeparatorf(s, args...)+"\n\n")
+}
+
+// LogRedEndSeparator logs a separator to stderr with the given message in red.
+//
+//nolint:thelper // we do call t.Helper() if t is not nil
+func LogRedEndSeparator(t *testing.T, args ...any) {
+	if t != nil {
+		t.Helper()
+	}
+	w := testOutput(t)
+
+	fmt.Fprint(w, redSeparatorf("%s", fmt.Sprint(args...))+"\n\n")
+}
+
+// separatorf returns a formatted separator string for logging purposes.
+func separatorf(s string, args ...any) string {
+	return highCyan("===== " + fmt.Sprintf(s, args...) + " =====")
+}
+
+// separator returns a separator string for logging purposes.
+func separator(args ...any) string {
+	return highCyan("===== " + fmt.Sprint(args...) + " =====")
+}
+
+func redSeparatorf(s string, args ...any) string {
+	return highRed("===== " + fmt.Sprintf(s, args...) + " =====")
+}
+
+// highCyan returns a string with the given text in high-intensity cyan color for terminal output.
+func highCyan(s string) string {
+	return fmt.Sprintf("\033[1;36m%s\033[0m", s)
+}
+
+// highRed returns a string with the given text in high-intensity red color for terminal output.
+func highRed(s string) string {
+	return fmt.Sprintf("\033[1;31m%s\033[0m", s)
+}
+
+// testOutput returns the appropriate output writer for the test.
+//
+//nolint:thelper // we're not using t in any way that requires the helper annotation
+func testOutput(t *testing.T) io.Writer {
+	if t != nil {
+		return &syncWriter{w: t.Output()}
+	}
+	if verbose() {
+		return os.Stderr
+	}
+	return io.Discard
+}
+
+// verbose returns whether verbose mode is enabled.
+// testing.Verbose() should be used instead when possible, this function is only
+// needed because testing.Verbose() panics when called in a TestMain function.
+func verbose() bool {
+	isVerboseOnce.Do(func() {
+		for _, arg := range os.Args {
+			value, ok := strings.CutPrefix(arg, "-test.v=")
+			if !ok {
+				continue
+			}
+			isVerbose = value == "true"
+		}
+	})
+	return isVerbose
+}
+
+// syncWriter is a writer that synchronizes writes to its underlying writer.
+type syncWriter struct {
+	w  io.Writer
+	mu sync.Mutex
+}
+
+// Write writes to the underlying writer while synchronizing access.
+func (s *syncWriter) Write(p []byte) (n int, err error) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	return s.w.Write(p)
+}
diff --git a/internal/testsdetection/testdata/binary.go b/internal/testsdetection/testdata/binary.go
index dcf1b27407..f85f29ed60 100644
--- a/internal/testsdetection/testdata/binary.go
+++ b/internal/testsdetection/testdata/binary.go
@@ -6,7 +6,7 @@ import (
 	"fmt"
 	"os"
 
-	"github.com/ubuntu/authd/internal/testsdetection"
+	"github.com/canonical/authd/internal/testsdetection"
 )
 
 func main() {
diff --git a/internal/testsdetection/testsdetection_test.go b/internal/testsdetection/testsdetection_test.go
index 666c898052..67f1e5c047 100644
--- a/internal/testsdetection/testsdetection_test.go
+++ b/internal/testsdetection/testsdetection_test.go
@@ -5,9 +5,9 @@ import (
 	"os/exec"
 	"testing"
 
+	"github.com/canonical/authd/internal/testsdetection"
+	"github.com/canonical/authd/internal/testutils"
 	"github.com/stretchr/testify/require"
-	"github.com/ubuntu/authd/internal/testsdetection"
-	"github.com/ubuntu/authd/internal/testutils"
 )
 
 func TestMustBeTestingInTests(t *testing.T) {
diff --git a/internal/testutils/args.go b/internal/testutils/args.go
index ee70bcadca..a1564d1541 100644
--- a/internal/testutils/args.go
+++ b/internal/testutils/args.go
@@ -1,11 +1,12 @@
 package testutils
 
 import (
+	"math"
 	"os"
 	"runtime/debug"
 	"strconv"
-	"strings"
 	"sync"
+	"time"
 )
 
 var (
@@ -13,24 +14,24 @@ var (
 	isAsanOnce          sync.Once
 	isRace              bool
 	isRaceOnce          sync.Once
-	isVerbose           bool
-	isVerboseOnce       sync.Once
 	sleepMultiplier     float64
 	sleepMultiplierOnce sync.Once
+	testVerbosity       int
+	testVerbosityOnce   sync.Once
 )
 
-// IsVerbose returns whether the tests are running in verbose mode.
-func IsVerbose() bool {
-	isVerboseOnce.Do(func() {
-		for _, arg := range os.Args {
-			value, ok := strings.CutPrefix(arg, "-test.v=")
-			if !ok {
-				continue
+// TestVerbosity returns the verbosity level that should be used in tests.
+func TestVerbosity() int {
+	testVerbosityOnce.Do(func() {
+		if v := os.Getenv("AUTHD_TEST_VERBOSITY"); v != "" {
+			var err error
+			testVerbosity, err = strconv.Atoi(v)
+			if err != nil {
+				panic(err)
 			}
-			isVerbose = value == "true"
 		}
 	})
-	return isVerbose
+	return testVerbosity
 }
 
 func haveBuildFlag(flag string) bool {
@@ -66,6 +67,26 @@ func IsRace() bool {
 	return isRace
 }
 
+// GoBuildFlags returns the Go build flags that should be used when building binaries in tests.
+// It includes flags for coverage, address sanitizer, and race detection if they are enabled
+// in the current test environment.
+//
+// Note: The flags returned by this function must be the first arguments to the `go build` command,
+// because -cover is a "positional flag".
+func GoBuildFlags() []string {
+	var flags []string
+	if CoverDirForTests() != "" {
+		flags = append(flags, "-cover")
+	}
+	if IsAsan() {
+		flags = append(flags, "-asan")
+	}
+	if IsRace() {
+		flags = append(flags, "-race")
+	}
+	return flags
+}
+
 // SleepMultiplier returns the sleep multiplier to be used in tests.
 func SleepMultiplier() float64 {
 	sleepMultiplierOnce.Do(func() {
@@ -92,3 +113,27 @@ func SleepMultiplier() float64 {
 
 	return sleepMultiplier
 }
+
+// MultipliedSleepDuration returns a duration multiplied by the sleep multiplier
+// provided by [MultipliedSleepDuration].
+func MultipliedSleepDuration(in time.Duration) time.Duration {
+	return time.Duration(math.Round(float64(in) * SleepMultiplier()))
+}
+
+// IsCI returns whether the test is running in CI environment.
+var IsCI = sync.OnceValue(func() bool {
+	_, ok := os.LookupEnv("GITHUB_ACTIONS")
+	return ok
+})
+
+// IsDebianPackageBuild returns true if the tests are running in a Debian package build environment.
+var IsDebianPackageBuild = sync.OnceValue(func() bool {
+	_, ok := os.LookupEnv("DEB_BUILD_ARCH")
+	return ok
+})
+
+// IsAutoPkgTest returns true if the tests are running in an autopkgtest environment.
+var IsAutoPkgTest = sync.OnceValue(func() bool {
+	_, ok := os.LookupEnv("AUTOPKGTEST_TEST_ARCH")
+	return ok
+})
diff --git a/internal/testutils/artifacts.go b/internal/testutils/artifacts.go
new file mode 100644
index 0000000000..24f30f5aed
--- /dev/null
+++ b/internal/testutils/artifacts.go
@@ -0,0 +1,132 @@
+package testutils
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/canonical/authd/internal/fileutils"
+	"github.com/stretchr/testify/require"
+)
+
+const (
+	alwaysSaveArtifactsEnvVar = "AUTHD_TESTS_ARTIFACTS_ALWAYS_SAVE"
+)
+
+var (
+	authdTestSessionTime  = time.Now()
+	authdArtifactsDir     string
+	authdArtifactsDirOnce sync.Once
+)
+
+// ArtifactsDir returns the path to the directory where artifacts are stored.
+func ArtifactsDir(t *testing.T) string {
+	t.Helper()
+
+	authdArtifactsDirOnce.Do(func() {
+		authdArtifactsDir = createArtifactsDir(t)
+		t.Logf("Test artifacts directory: %s", authdArtifactsDir)
+	})
+
+	return authdArtifactsDir
+}
+
+func createArtifactsDir(t *testing.T) string {
+	t.Helper()
+
+	// We need to copy the artifacts to another directory, since the test directory will be cleaned up.
+	if dir := os.Getenv("AUTHD_TESTS_ARTIFACTS_PATH"); dir != "" {
+		if err := os.MkdirAll(dir, 0750); err != nil && !os.IsExist(err) {
+			require.NoError(t, err, "Teardown: could not create artifacts directory %q", authdArtifactsDir)
+		}
+		return dir
+	}
+
+	st := authdTestSessionTime
+	dirName := fmt.Sprintf("authd-test-artifacts-%d-%02d-%02dT%02d-%02d-%02d.%d-",
+		st.Year(), st.Month(), st.Day(), st.Hour(), st.Minute(), st.Second(),
+		st.UnixMilli())
+
+	dir, err := os.MkdirTemp(os.TempDir(), dirName)
+	require.NoError(t, err, "Teardown: could not create artifacts directory %q", authdArtifactsDir)
+
+	return dir
+}
+
+// saveFilesAsArtifacts saves the specified artifacts to a temporary directory if the test failed.
+func saveFilesAsArtifacts(t *testing.T, artifacts ...string) {
+	t.Helper()
+
+	dir := filepath.Join(ArtifactsDir(t), t.Name())
+	err := os.MkdirAll(dir, 0750)
+	require.NoError(t, err, "Teardown: could not create artifacts directory %q", dir)
+
+	// Copy the artifacts to the artifacts directory.
+	for _, artifact := range artifacts {
+		target := filepath.Join(dir, filepath.Base(artifact))
+		t.Logf("Teardown: Saving artifact: %q", target)
+		err = fileutils.CopyFile(artifact, target)
+		if err != nil {
+			t.Logf("Teardown: failed to copy artifact %q to %q: %v", artifact, dir, err)
+		}
+	}
+}
+
+// MaybeSaveFilesAsArtifactsOnCleanup saves the specified artifacts to a temporary directory if the test failed
+// or if the AUTHD_TESTS_ARTIFACTS_ALWAYS_SAVE environment variable is set.
+func MaybeSaveFilesAsArtifactsOnCleanup(t *testing.T, artifacts ...string) {
+	t.Helper()
+
+	t.Cleanup(func() {
+		if !t.Failed() && os.Getenv(alwaysSaveArtifactsEnvVar) == "" {
+			return
+		}
+		saveFilesAsArtifacts(t, artifacts...)
+	})
+}
+
+func saveBytesAsArtifact(t *testing.T, content []byte, filename string) {
+	t.Helper()
+
+	dir := filepath.Join(ArtifactsDir(t), t.Name())
+	err := os.MkdirAll(dir, 0750)
+	require.NoError(t, err, "Teardown: could not create artifacts directory %q", dir)
+
+	target := filepath.Join(dir, filename)
+	t.Logf("Teardown: Writing artifact: %q", target)
+
+	// Write the bytes to the artifacts directory.
+	err = os.WriteFile(target, content, 0600)
+	if err != nil {
+		t.Logf("Teardown: failed to write artifact %q to %q: %v", filename, dir, err)
+	}
+}
+
+// MaybeSaveBytesAsArtifactOnCleanup saves the specified bytes to a temporary directory if the test failed
+// or if the AUTHD_TESTS_ARTIFACTS_ALWAYS_SAVE environment variable is set.
+func MaybeSaveBytesAsArtifactOnCleanup(t *testing.T, content []byte, filename string) {
+	t.Helper()
+
+	t.Cleanup(func() {
+		if !t.Failed() && os.Getenv(alwaysSaveArtifactsEnvVar) == "" {
+			return
+		}
+		saveBytesAsArtifact(t, content, filename)
+	})
+}
+
+// MaybeSaveBufferAsArtifactOnCleanup saves the specified buffer to a temporary directory if the test failed
+// or if the AUTHD_TESTS_ARTIFACTS_ALWAYS_SAVE environment variable is set.
+func MaybeSaveBufferAsArtifactOnCleanup(t *testing.T, buf *SyncBuffer, filename string) {
+	t.Helper()
+
+	t.Cleanup(func() {
+		if !t.Failed() && os.Getenv(alwaysSaveArtifactsEnvVar) == "" {
+			return
+		}
+		saveBytesAsArtifact(t, buf.Bytes(), filename)
+	})
+}
diff --git a/internal/testutils/authctl.go b/internal/testutils/authctl.go
new file mode 100644
index 0000000000..feaf55e4a6
--- /dev/null
+++ b/internal/testutils/authctl.go
@@ -0,0 +1,32 @@
+package testutils
+
+import (
+	"fmt"
+	"os"
+	"os/exec"
+	"path/filepath"
+
+	"github.com/canonical/authd/internal/testlog"
+)
+
+// BuildAuthctl builds the authctl binary in a temporary directory for testing purposes.
+func BuildAuthctl() (binaryPath string, cleanup func(), err error) {
+	tempDir, err := os.MkdirTemp("", "authctl")
+	if err != nil {
+		return "", nil, fmt.Errorf("failed to create temp directory: %w", err)
+	}
+	cleanup = func() { os.RemoveAll(tempDir) }
+	binaryPath = filepath.Join(tempDir, "authctl")
+
+	cmd := exec.Command("go", "build")
+	cmd.Args = append(cmd.Args, GoBuildFlags()...)
+	cmd.Args = append(cmd.Args, "-o", binaryPath, "./cmd/authctl")
+	cmd.Dir = ProjectRoot()
+
+	if err := testlog.RunWithTiming(nil, "Building authctl", cmd); err != nil {
+		cleanup()
+		return "", nil, fmt.Errorf("failed to build authctl: %w", err)
+	}
+
+	return binaryPath, cleanup, nil
+}
diff --git a/internal/testutils/broker.go b/internal/testutils/broker.go
index 5b20f816e3..be6e31a316 100644
--- a/internal/testutils/broker.go
+++ b/internal/testutils/broker.go
@@ -3,6 +3,7 @@ package testutils
 import (
 	"bytes"
 	"context"
+	"errors"
 	"fmt"
 	"html/template"
 	"os"
@@ -11,9 +12,9 @@ import (
 	"sync"
 	"time"
 
+	"github.com/canonical/authd/internal/brokers/layouts"
 	"github.com/godbus/dbus/v5"
 	"github.com/godbus/dbus/v5/introspect"
-	"github.com/ubuntu/authd/internal/brokers/layouts"
 )
 
 const (
@@ -95,9 +96,12 @@ func StartBusBrokerMock(cfgDir string, brokerName string) (string, func(), error
 	}
 
 	reply, err := conn.RequestName(busName, dbus.NameFlagDoNotQueue)
-	if err != nil || reply != dbus.RequestNameReplyPrimaryOwner {
+	if err != nil {
 		conn.Close()
-		return "", nil, err
+		return "", nil, fmt.Errorf("can't get the D-Bus name %s: %w", busName, err)
+	}
+	if reply != dbus.RequestNameReplyPrimaryOwner {
+		return "", nil, errors.New("not a D-Bus primary name owner")
 	}
 
 	configPath, err := writeConfig(cfgDir, brokerName)
@@ -235,6 +239,7 @@ func (b *BrokerBusMock) IsAuthenticated(sessionID, authenticationData string) (a
 
 	// Cleans the call after it's done
 	defer func() {
+		cancel()
 		b.isAuthenticatedCallsMu.Lock()
 		delete(b.isAuthenticatedCalls, sessionID)
 		b.isAuthenticatedCallsMu.Unlock()
@@ -272,6 +277,13 @@ func (b *BrokerBusMock) IsAuthenticated(sessionID, authenticationData string) (a
 		extragroups := []groupJSONInfo{{Name: "localgroup1"}, {Name: "localgroup3"}}
 		data = fmt.Sprintf(`{"userinfo": %s}`, userInfoFromName(sessionID, extragroups))
 
+	case "success_with_uppercase_groups":
+		extragroups := []groupJSONInfo{
+			{Name: "GROUP1", UGID: "12345678"},
+			{Name: "GROUP2", UGID: "87654321"},
+		}
+		data = fmt.Sprintf(`{"userinfo": %s}`, userInfoFromName(sessionID, extragroups))
+
 	case "ia_invalid_access":
 		access = "invalid"
 
@@ -331,7 +343,7 @@ func (b *BrokerBusMock) CancelIsAuthenticated(sessionID string) (dbusErr *dbus.E
 
 // UserPreCheck returns default values to be used in tests or an error if requested.
 func (b *BrokerBusMock) UserPreCheck(username string) (userinfo string, dbusErr *dbus.Error) {
-	if strings.ToLower(username) != "user-pre-check" {
+	if username != "user-pre-check@example.com" && username != "local-pre-check" {
 		return "", dbus.MakeFailedError(fmt.Errorf("broker %q: UserPreCheck errored out", b.name))
 	}
 	return userInfoFromName(username, nil), nil
@@ -346,7 +358,9 @@ func parseSessionID(sessionID string) string {
 	if len(cut) == 0 {
 		return ""
 	}
-	return strings.TrimSuffix(cut[len(cut)-1], "-session_id")
+
+	parsedID := strings.TrimSuffix(cut[len(cut)-1], "-session_id")
+	return strings.TrimSuffix(parsedID, "@example.com")
 }
 
 type groupJSONInfo struct {
@@ -359,18 +373,18 @@ func userInfoFromName(sessionID string, extraGroups []groupJSONInfo) string {
 	// Default values
 	parsedID := parseSessionID(sessionID)
 
-	name := strings.TrimSuffix(sessionID, "-session_id")
-	group := "group-" + parsedID
-	home := "/home/" + parsedID
-	shell := "/bin/sh/" + parsedID
-	gecos := "gecos for " + parsedID
-	ugid := "ugid-" + parsedID
+	name := parsedID + "@example.com"
+	group := "group-" + name
+	home := "/home/" + name
+	shell := "/bin/sh/" + name
+	gecos := "gecos for " + name
+	ugid := "ugid-" + name
 
 	switch parsedID {
 	case "ia_info_empty_user_name":
 		name = ""
 	case "ia_info_mismatching_user_name":
-		name = "different_username"
+		name = "different_username@example.com"
 	case "ia_info_empty_group_name":
 		group = ""
 	case "ia_info_empty_ugid":
@@ -383,6 +397,9 @@ func userInfoFromName(sessionID string, extraGroups []groupJSONInfo) string {
 		home = "this is not a homedir"
 	case "ia_info_invalid_shell":
 		shell = "this is not a valid shell"
+	case "local-pre-check":
+		name = "root"
+		home = "/root"
 	}
 
 	groups := []groupJSONInfo{{Name: group, UGID: ugid}}
diff --git a/internal/testutils/bubblewrap.go b/internal/testutils/bubblewrap.go
index 0ed2e65acb..e8f7ac5c5e 100644
--- a/internal/testutils/bubblewrap.go
+++ b/internal/testutils/bubblewrap.go
@@ -1,16 +1,17 @@
 package testutils
 
 import (
-	"bytes"
+	"fmt"
 	"os"
 	"os/exec"
 	"path/filepath"
-	"strings"
 	"sync"
 	"testing"
 
+	"github.com/canonical/authd/internal/fileutils"
+	"github.com/canonical/authd/internal/testlog"
+	"github.com/canonical/authd/internal/testutils/golden"
 	"github.com/stretchr/testify/require"
-	"github.com/ubuntu/authd/internal/fileutils"
 )
 
 var (
@@ -19,71 +20,68 @@ var (
 
 	bubbleWrapNeedsSudoOnce sync.Once
 	bubbleWrapNeedsSudo     bool
+
+	copyBwrapOnce   sync.Once
+	copiedBwrapPath string
 )
 
-// SkipIfCannotRunBubbleWrap checks whether we can run tests running in bubblewrap or
-// skip the tests otherwise.
-func SkipIfCannotRunBubbleWrap(t *testing.T) {
+const bubbleWrapTestEnvVar = "BUBBLEWRAP_TEST"
+
+// RunningInBubblewrap returns true if the test is being run in bubblewrap.
+func RunningInBubblewrap() bool {
+	return os.Getenv(bubbleWrapTestEnvVar) == "1"
+}
+
+func canRunBubblewrap(t *testing.T) bool {
 	t.Helper()
 
 	if os.Geteuid() == 0 {
 		t.Log("Running as EUID 0")
-		return
+		return true
 	}
 
 	bubbleWrapSupportsUnprivilegedNamespacesOnce.Do(func() {
 		bubbleWrapSupportsUnprivilegedNamespaces = canUseUnprivilegedUserNamespaces(t)
 	})
 	if bubbleWrapSupportsUnprivilegedNamespaces {
-		t.Log("Can use unprivileged user namespaces")
-		return
+		return true
 	}
 
 	bubbleWrapNeedsSudoOnce.Do(func() {
-		bubbleWrapNeedsSudo = canUseSudoNonInteractively(t)
+		bubbleWrapNeedsSudo = canUseBwrapWithSudoNonInteractively(t)
 	})
-	if bubbleWrapNeedsSudo {
-		t.Log("Can use sudo non-interactively")
-	}
-
-	t.Skip("Skipping test: requires root privileges or unprivileged user namespaces")
+	return bubbleWrapNeedsSudo
 }
 
-// RunInBubbleWrapWithEnv runs the passed commands in bubble wrap sandbox with env variables.
-func RunInBubbleWrapWithEnv(t *testing.T, testDataPath string, env []string, args ...string) (string, error) {
+// RunTestInBubbleWrap runs the given test in bubblewrap.
+func RunTestInBubbleWrap(t *testing.T, args ...string) {
 	t.Helper()
 
-	SkipIfCannotRunBubbleWrap(t)
-	return runInBubbleWrap(t, bubbleWrapNeedsSudo, testDataPath, env, args...)
-}
+	RequireBubblewrap(t)
 
-// RunInBubbleWrap runs the passed commands in bubble wrap sandbox.
-func RunInBubbleWrap(t *testing.T, testDataPath string, args ...string) (string, error) {
-	t.Helper()
-
-	return RunInBubbleWrapWithEnv(t, testDataPath, nil, args...)
-}
+	etcDir := filepath.Join(TempDir(t), "etc")
+	err := os.MkdirAll(etcDir, 0700)
+	require.NoError(t, err, "Setup: could not create etc dir")
 
-func runInBubbleWrap(t *testing.T, withSudo bool, testDataPath string, env []string, args ...string) (string, error) {
-	t.Helper()
+	cwd, err := os.Getwd()
+	require.NoError(t, err, "Setup: could not get current working directory")
 
-	cmd := exec.Command("bwrap")
-	cmd.Env = AppendCovEnv(os.Environ())
-	cmd.Env = append(cmd.Env, env...)
+	// Copy files needed to create users and groups inside bubblewrap.
+	for _, f := range []string{"passwd", "group", "subgid"} {
+		err := fileutils.CopyFile("/etc/"+f, filepath.Join(etcDir, f))
+		require.NoError(t, err, "Setup: Copying /etc/%s to %s failed", f, etcDir)
+	}
 
-	if withSudo {
-		cmd.Args = append([]string{"sudo"}, cmd.Args...)
+	env := []string{
+		"PATH=" + MinimalPathEnv,
+		bubbleWrapTestEnvVar + "=1",
+		golden.UpdateGoldenFilesEnv + "=" + os.Getenv(golden.UpdateGoldenFilesEnv),
 	}
+	env = AppendCovEnv(env)
 
-	etcDir := filepath.Join(testDataPath, "etc")
-	err := os.MkdirAll(etcDir, 0700)
-	require.NoError(t, err, "Impossible to create /etc")
+	cmd := bubbleWrapCommand(t, env, bubbleWrapNeedsSudo)
 
 	cmd.Args = append(cmd.Args,
-		"--ro-bind", "/", "/",
-		"--dev", "/dev",
-		"--bind", os.TempDir(), os.TempDir(),
-		"--bind", testDataPath, testDataPath,
 		"--bind", etcDir, "/etc",
 
 		// Bind relevant etc files. We go manual here, since there's no
@@ -94,85 +92,180 @@ func runInBubbleWrap(t *testing.T, withSudo bool, testDataPath string, env []str
 		"--ro-bind", "/etc/localtime", "/etc/localtime",
 		"--ro-bind", "/etc/login.defs", "/etc/login.defs",
 		"--ro-bind", "/etc/nsswitch.conf", "/etc/nsswitch.conf",
-		"--ro-bind", "/etc/passwd", "/etc/passwd",
-		"--ro-bind", "/etc/shadow", "/etc/shadow",
-		"--ro-bind", "/etc/subgid", "/etc/subgid",
 		"--ro-bind", "/etc/sudo.conf", "/etc/sudo.conf",
 		"--ro-bind", "/etc/sudoers", "/etc/sudoers",
-		"--ro-bind", "/etc/timezone", "/etc/timezone",
+		"--ro-bind-try", "/etc/timezone", "/etc/timezone",
 		"--ro-bind", "/etc/pam.d", "/etc/pam.d",
 		"--ro-bind", "/etc/security", "/etc/security",
+		"--bind", cwd, cwd,
+
+		// Bind the test binary itself so that it can be run in bubblewrap.
+		"--bind", os.Args[0], os.Args[0],
 	)
 
-	replicateHostFile := func(file string) {
-		require.NotContains(t, cmd.Args, file,
-			"Setup: %q should not be managed by bwrap", file)
-		dst := filepath.Join(testDataPath, file)
-		err := fileutils.CopyFile(file, dst)
-		require.NoError(t, err, "Setup: Copying %q to %q failed", file, dst)
+	if coverDir := CoverDirForTests(); coverDir != "" {
+		cmd.Args = append(cmd.Args, "--bind", coverDir, coverDir)
 	}
 
-	// These are the files that we replicate in the bwrap environment and that
-	// can be safely modified or mocked in the test.
-	// Adapt this as needed, ensuring these files are not bound.
-	for _, f := range []string{
-		"/etc/group",
-	} {
-		replicateHostFile(f)
+	goldenDir := golden.Dir(t)
+	exists, err := fileutils.FileExists(goldenDir)
+	require.NoError(t, err, "Setup: could not check if golden dir exists")
+	if exists && golden.UpdateEnabled() {
+		// Bind the golden directory read-write so that the tests can update it.
+		cmd.Args = append(cmd.Args, "--bind", goldenDir, goldenDir)
 	}
+	cmd.Args = append(cmd.Args, args...)
 
-	if coverDir := CoverDirForTests(); coverDir != "" {
-		cmd.Args = append(cmd.Args, "--bind", coverDir, coverDir)
+	testCommand := []string{os.Args[0], "-test.run", "^" + t.Name() + "$"}
+	if testing.Verbose() {
+		testCommand = append(testCommand, "-test.v")
+	}
+	if c := CoverDirForTests(); c != "" {
+		testCommand = append(testCommand, fmt.Sprintf("-test.gocoverdir=%s", c))
 	}
+	cmd.Args = append(cmd.Args, testCommand...)
 
-	if os.Geteuid() != 0 && !withSudo {
-		cmd.Args = append(cmd.Args, "--unshare-user", "--uid", "0")
+	testlog.LogCommand(t, fmt.Sprintf("Running %s in bubblewrap", t.Name()), cmd)
+	err = cmd.Run()
+	if err != nil {
+		testlog.LogEndSeparator(t, fmt.Sprintf("%s in bubblewrap failed", t.Name()))
+		t.Fatalf("Running %s in bubblewrap failed: %v", t.Name(), err)
 	}
+	testlog.LogEndSeparator(t, fmt.Sprintf("%s in bubblewrap finished", t.Name()))
+}
 
-	cmd.Args = append(cmd.Args, args...)
+// RequireBubblewrap ensures that bubblewrap is available and usable for running tests.
+// It skips or fails the test if bubblewrap cannot be used in the current environment.
+func RequireBubblewrap(t *testing.T) {
+	t.Helper()
 
-	var b bytes.Buffer
-	cmd.Stdout = &b
-	cmd.Stderr = &b
-	if IsVerbose() {
-		cmd.Stderr = os.Stderr
-		cmd.Stdout = os.Stdout
+	if !canRunBubblewrap(t) {
+		if IsAutoPkgTest() && !IsCI() {
+			// On launchpad builders, we might not be able to run bubblewrap,
+			// but we don't want to fail the tests in that case.
+			t.Skip("Skipping test: cannot run bubblewrap")
+		}
+		require.Fail(t, "Cannot run bubblewrap")
 	}
+}
 
-	t.Log("Running command", strings.Join(args, " "))
-	err = cmd.Run()
-	output := strings.TrimSpace(b.String())
+// BubbleWrapCommand returns a command that runs in bubblewrap.
+func BubbleWrapCommand(t *testing.T, env []string) *exec.Cmd {
+	t.Helper()
+
+	RequireBubblewrap(t)
 
-	if !IsVerbose() {
-		t.Log(output)
+	return bubbleWrapCommand(t, env, bubbleWrapNeedsSudo)
+}
+
+func bubbleWrapCommand(t *testing.T, env []string, withSudo bool) *exec.Cmd {
+	t.Helper()
+	var cmd *exec.Cmd
+
+	// Since 25.10 Ubuntu ships the AppArmor profile /etc/apparmor.d/bwrap-userns-restrict
+	// which restricts bwrap and causes chown to fail with "Operation not permitted".
+	// We work around that by copying the bwrap binary to a temporary location so that
+	// the AppArmor profile is not applied.
+	copyBwrapOnce.Do(func() {
+		tempDir, err := os.MkdirTemp("", "authd-bwrap-")
+		require.NoError(t, err, "Setup: could not create temp dir for bwrap test data")
+		copiedBwrapPath = filepath.Join(tempDir, "bwrap")
+		err = fileutils.CopyFile("/usr/bin/bwrap", copiedBwrapPath)
+		require.NoError(t, err, "Setup: could not copy bubblewrap binary to temp location")
+	})
+
+	if withSudo {
+		t.Log("Running bubblewrap with sudo")
+		cmd = exec.Command("sudo")
+		cmd.Args = append(cmd.Args, env...)
+		cmd.Args = append(cmd.Args, copiedBwrapPath)
+	} else {
+		// To be able to use chown in bubblewrap, we need to run it in a user namespace
+		// with a uid mapping. Bubblewrap itself only supports mapping a single UID via
+		// --uid, so we use unshare to create a new user namespace with the desired mapping
+		// and run bwrap in that.
+		//nolint:gosec // We're not running untrusted code here.
+		cmd = exec.Command(
+			"unshare",
+			"--user",
+			"--map-root-user",
+			"--map-users=auto",
+			"--map-groups=auto",
+			copiedBwrapPath,
+		)
+		cmd.Env = env
 	}
-	return output, err
+
+	cmd.Args = append(cmd.Args,
+		"--ro-bind", "/", "/",
+		"--dev", "/dev",
+		"--tmpfs", "/tmp",
+	)
+
+	cmd.Stderr = t.Output()
+	cmd.Stdout = t.Output()
+
+	return cmd
 }
 
 func canUseUnprivilegedUserNamespaces(t *testing.T) bool {
 	t.Helper()
 
-	if out, err := runInBubbleWrap(t, false, t.TempDir(), nil, "/bin/true"); err != nil {
-		t.Logf("Can't use unprivileged user namespaces: %v\n%s", err, out)
+	if IsCI() {
+		// Try enabling unprivileged user namespaces in the CI.
+		cmd := exec.Command("sudo", "sysctl", "-w",
+			"kernel.unprivileged_userns_clone=1",
+			"kernel.apparmor_restrict_unprivileged_userns=0",
+			"user.max_user_namespaces=100000",
+		)
+		cmd.Stdout = t.Output()
+		cmd.Stderr = t.Output()
+		_ = cmd.Run()
+	}
+
+	// We don't try bubbleWrapCommand directly here, because that uses
+	// `unshare --map-user` via exec.Command and connects the process's
+	// stdout and stderr, which causes the command to hang forever if
+	// unprivileged user namespaces are disabled. We avoid that by first
+	// checking via `unshare --map-root-user` if unprivileged user namespaces
+	// are enabled.
+	cmd := exec.Command("unshare", "--map-root-user", "/bin/true")
+	cmd.Stdout = t.Output()
+	cmd.Stderr = t.Output()
+	testlog.LogCommand(t, "Checking unprivileged user namespaces", cmd)
+	if err := cmd.Run(); err != nil {
+		testlog.LogRedEndSeparator(t, "Cannot use unprivileged user namespaces")
+		return false
+	}
+	testlog.LogEndSeparator(t, "Can use unprivileged user namespaces")
+
+	cmd = bubbleWrapCommand(t, nil, false)
+	cmd.Args = append(cmd.Args, "/bin/true")
+	testlog.LogCommand(t, "Checking bubblewrap with unprivileged user namespaces", cmd)
+	if err := cmd.Run(); err != nil {
+		testlog.LogRedEndSeparator(t, "Cannot use bubblewrap with unprivileged user namespaces")
 		return false
 	}
 
+	testlog.LogEndSeparator(t, "Can use unprivileged user namespaces")
 	return true
 }
 
-func canUseSudoNonInteractively(t *testing.T) bool {
+func canUseBwrapWithSudoNonInteractively(t *testing.T) bool {
 	t.Helper()
 
-	cmd := exec.Command("sudo", "-Nnv")
-	if out, err := cmd.CombinedOutput(); err != nil {
-		t.Logf("Can't use sudo non-interactively: %v\n%s", err, out)
+	if !canUseSudoNonInteractively(t) {
 		return false
 	}
 
-	if out, err := runInBubbleWrap(t, true, t.TempDir(), nil, "/bin/true"); err != nil {
-		t.Logf("Can't use user namespaces: %v\n%s", err, out)
+	cmd := bubbleWrapCommand(t, nil, true)
+	cmd.Args = append(cmd.Args, "/bin/true")
+	testlog.LogCommand(t, "Checking bubblewrap with sudo", cmd)
+	if err := cmd.Run(); err != nil {
+		testlog.LogRedEndSeparatorf(t, "Cannot use bubblewrap with sudo: %v", err)
 		return false
 	}
 
+	testlog.LogEndSeparator(t, "Can use bubblewrap with sudo")
 	return true
 }
diff --git a/internal/testutils/coverage.go b/internal/testutils/coverage.go
index ef06d2e51d..c18aa62909 100644
--- a/internal/testutils/coverage.go
+++ b/internal/testutils/coverage.go
@@ -92,6 +92,6 @@ func CoverDirForTests() string {
 func writeGoCoverageLine(t *testing.T, w io.Writer, file string, lineNum, lineLength int, covered string) {
 	t.Helper()
 
-	_, err := w.Write([]byte(fmt.Sprintf("%s:%d.1,%d.%d 1 %s\n", file, lineNum, lineNum, lineLength, covered)))
+	_, err := fmt.Fprintf(w, "%s:%d.1,%d.%d 1 %s\n", file, lineNum, lineNum, lineLength, covered)
 	require.NoErrorf(t, err, "Teardown: can't write a write to golang compatible cover file : %v", err)
 }
diff --git a/internal/testutils/daemon.go b/internal/testutils/daemon.go
index d2512b206c..5ddc1d93c7 100644
--- a/internal/testutils/daemon.go
+++ b/internal/testutils/daemon.go
@@ -1,33 +1,37 @@
 package testutils
 
 import (
-	"bytes"
 	"context"
 	"errors"
 	"fmt"
+	"io"
 	"os"
 	"os/exec"
 	"path/filepath"
+	"slices"
+	"strings"
 	"syscall"
 	"testing"
 	"time"
 
+	"github.com/canonical/authd/internal/grpcutils"
+	"github.com/canonical/authd/internal/services/errmessages"
+	"github.com/canonical/authd/internal/testlog"
+	"github.com/canonical/authd/internal/users/db"
+	"github.com/canonical/authd/internal/users/localentries"
 	"github.com/stretchr/testify/require"
-	"github.com/ubuntu/authd/internal/grpcutils"
-	"github.com/ubuntu/authd/internal/services/errmessages"
-	"github.com/ubuntu/authd/internal/users/db"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/credentials/insecure"
 )
 
 type daemonOptions struct {
-	dbPath     string
-	existentDB string
-	socketPath string
-	pidFile    string
-	outputFile string
-	shared     bool
-	env        []string
+	dbPath                   string
+	existentDB               string
+	socketPath               string
+	pidFile                  string
+	saveOutputAsTestArtifact bool
+	shared                   bool
+	env                      []string
 }
 
 // DaemonOption represents an optional function that can be used to override some of the daemon default values.
@@ -69,10 +73,10 @@ func WithPidFile(pidFile string) DaemonOption {
 	}
 }
 
-// WithOutputFile sets the path where the process log will be saved.
-func WithOutputFile(outputFile string) DaemonOption {
+// WithOutputAsTestArtifact saves the daemon output to a test artifact.
+func WithOutputAsTestArtifact() DaemonOption {
 	return func(o *daemonOptions) {
-		o.outputFile = outputFile
+		o.saveOutputAsTestArtifact = true
 	}
 }
 
@@ -90,9 +94,44 @@ func WithHomeBaseDir(baseDir string) DaemonOption {
 	}
 }
 
-// RunDaemon runs the daemon in a separate process and returns the socket path and a channel that will be closed when
-// the daemon stops.
-func RunDaemon(ctx context.Context, t *testing.T, execPath string, args ...DaemonOption) (socketPath string, stopped chan struct{}) {
+// WithGroupFile sets the group file.
+func WithGroupFile(groupFile string) DaemonOption {
+	return func(o *daemonOptions) {
+		o.env = slices.DeleteFunc(o.env, func(e string) bool {
+			return strings.HasPrefix(e, localentries.Z_ForTests_GroupFilePathEnv+"=")
+		})
+		o.env = append(o.env, fmt.Sprintf("%s=%s", localentries.Z_ForTests_GroupFilePathEnv, groupFile))
+	}
+}
+
+// WithGroupFileOutput sets the group output file.
+func WithGroupFileOutput(groupFile string) DaemonOption {
+	return func(o *daemonOptions) {
+		o.env = slices.DeleteFunc(o.env, func(e string) bool {
+			return strings.HasPrefix(e, localentries.Z_ForTests_GroupFileOutputPathEnv+"=")
+		})
+		o.env = append(o.env, fmt.Sprintf("%s=%s", localentries.Z_ForTests_GroupFileOutputPathEnv, groupFile))
+	}
+}
+
+// WithCurrentUserAsRoot configures authd to accept the current user as root when checking permissions.
+// This is useful for integration tests where the current user is not root, but we want to
+// test the behavior as if it were root.
+var WithCurrentUserAsRoot DaemonOption = func(o *daemonOptions) {
+	o.env = append(o.env, "AUTHD_INTEGRATIONTESTS_CURRENT_USER_AS_ROOT=1")
+}
+
+// StartAuthd starts authd in a separate process and returns the socket path.
+func StartAuthd(t *testing.T, execPath string, args ...DaemonOption) (socketPath string) {
+	t.Helper()
+
+	socketPath, cancelFunc := StartAuthdWithCancel(t, execPath, args...)
+	t.Cleanup(cancelFunc)
+	return socketPath
+}
+
+// StartAuthdWithCancel starts authd in a separate process and returns the socket path and a cancel function.
+func StartAuthdWithCancel(t *testing.T, execPath string, args ...DaemonOption) (socketPath string, cancelFunc func()) {
 	t.Helper()
 
 	opts := &daemonOptions{}
@@ -128,16 +167,18 @@ paths:
 	configPath := filepath.Join(tempDir, "testconfig.yaml")
 	require.NoError(t, os.WriteFile(configPath, []byte(config), 0600), "Setup: failed to create config file for tests")
 
-	var cancel context.CancelCauseFunc
-	if opts.pidFile != "" {
-		ctx, cancel = context.WithCancelCause(ctx)
+	stopped := make(chan struct{})
+	ctx, cancel := context.WithCancelCause(context.Background())
+	cancelFunc = func() {
+		t.Log("Stopping authd...")
+		cancel(nil)
+		<-stopped
 	}
 
 	// #nosec:G204 - we control the command arguments in tests
 	cmd := exec.CommandContext(ctx, execPath, "-c", configPath)
-	opts.env = append(opts.env, os.Environ()...)
 	opts.env = append(opts.env, fmt.Sprintf("AUTHD_EXAMPLE_BROKER_SLEEP_MULTIPLIER=%f", SleepMultiplier()))
-	cmd.Env = AppendCovEnv(opts.env)
+	cmd.Env = append(AppendCovEnv(opts.env), MinimalPathEnv)
 
 	// This is the function that is called by CommandContext when the context is cancelled.
 	cmd.Cancel = func() error {
@@ -145,22 +186,38 @@ paths:
 		return cmd.Process.Signal(os.Signal(syscall.SIGTERM))
 	}
 
-	// Start the daemon
-	stopped = make(chan struct{})
+	// Start authd
+	start := time.Now()
 	processPid := make(chan int)
 	go func() {
 		defer close(stopped)
-		var b bytes.Buffer
-		cmd.Stdout = &b
-		cmd.Stderr = &b
+
+		// For shared authd instances, we can't redirect the output to the test log,
+		// because the instance could still be running after the test finishes.
+		if opts.shared {
+			cmd.Stdout = os.Stdout
+			cmd.Stderr = os.Stderr
+		} else {
+			cmd.Stdout = t.Output()
+			cmd.Stderr = t.Output()
+		}
+
+		if opts.saveOutputAsTestArtifact {
+			authdOutput := &SyncBuffer{}
+			cmd.Stdout = io.MultiWriter(cmd.Stdout, authdOutput)
+			cmd.Stderr = io.MultiWriter(cmd.Stderr, authdOutput)
+			MaybeSaveBufferAsArtifactOnCleanup(t, authdOutput, "authd.log")
+		}
+
+		testlog.LogCommand(t, "Starting authd", cmd)
 		err := cmd.Start()
-		require.NoError(t, err, "Setup: daemon cannot start %v", cmd.Args)
+		require.NoError(t, err, "Setup: authd failed to start")
 		if opts.pidFile != "" {
 			processPid <- cmd.Process.Pid
 		}
 
-		// When using a shared daemon we should not use the test parameter from now on
-		// since the test is referring to may not be the one actually running.
+		// For shared authd instances, stop using `t` beyond this point,
+		// because the test which it refers to might have already finished.
 		t := t
 		logger := t.Logf
 		errorIs := func(err, target error, format string, args ...any) {
@@ -179,30 +236,25 @@ paths:
 		}
 
 		err = cmd.Wait()
-		out := b.Bytes()
-		if opts.outputFile != "" {
-			logger("writing authd log files to %v", opts.outputFile)
-			if err := os.WriteFile(opts.outputFile, out, 0600); err != nil {
-				logger("TearDown: failed to save output file %q: %v", opts.outputFile, err)
-			}
-		}
-		errorIs(err, context.Canceled, "Setup: daemon stopped unexpectedly: %s", out)
+		errorIs(err, context.Canceled, "Setup: authd stopped unexpectedly")
 		if opts.pidFile != "" {
 			defer cancel(nil)
 			if err := os.Remove(opts.pidFile); err != nil {
 				logger("TearDown: failed to remove pid file %q: %v", opts.pidFile, err)
 			}
 		}
-		logger("Daemon stopped (%v)\n ##### Output #####\n %s \n ##### END #####", err, out)
+		logger("authd exited (%v)", err)
 	}()
 
 	conn, err := grpc.NewClient("unix://"+opts.socketPath, grpc.WithTransportCredentials(insecure.NewCredentials()), grpc.WithUnaryInterceptor(errmessages.FormatErrorMessage))
-	require.NoError(t, err, "Setup: could not connect to the daemon on %s", opts.socketPath)
+	require.NoError(t, err, "Setup: could not connect to authd on %s", opts.socketPath)
 	defer conn.Close()
 
-	// Block until the daemon is started and ready to accept connections.
+	// Block until authd has started and is ready to accept connections.
 	err = grpcutils.WaitForConnection(ctx, conn, time.Second*30)
-	require.NoError(t, err, "Setup: wait for daemon to be ready timed out")
+	require.NoError(t, err, "Setup: timeout waiting for authd to start")
+	duration := time.Since(start)
+	testlog.LogEndSeparatorf(t, "authd started in %.3fs", duration.Seconds())
 
 	if opts.pidFile != "" {
 		err := os.WriteFile(opts.pidFile, []byte(fmt.Sprint(<-processPid)), 0600)
@@ -223,11 +275,11 @@ paths:
 		}()
 	}
 
-	return opts.socketPath, stopped
+	return opts.socketPath, cancelFunc
 }
 
-// BuildDaemon builds the daemon executable and returns the binary path.
-func BuildDaemon(extraArgs ...string) (execPath string, cleanup func(), err error) {
+// BuildAuthdWithExampleBroker builds the authd executable and returns the binary path.
+func BuildAuthdWithExampleBroker() (execPath string, cleanup func(), err error) {
 	projectRoot := ProjectRoot()
 
 	tempDir, err := os.MkdirTemp("", "authd-tests-daemon")
@@ -239,23 +291,14 @@ func BuildDaemon(extraArgs ...string) (execPath string, cleanup func(), err erro
 	execPath = filepath.Join(tempDir, "authd")
 	cmd := exec.Command("go", "build")
 	cmd.Dir = projectRoot
-	if CoverDirForTests() != "" {
-		// -cover is a "positional flag", so it needs to come right after the "build" command.
-		cmd.Args = append(cmd.Args, "-cover")
-	}
-	if IsAsan() {
-		cmd.Args = append(cmd.Args, "-asan")
-	}
-	if IsRace() {
-		cmd.Args = append(cmd.Args, "-race")
-	}
+	cmd.Args = append(cmd.Args, GoBuildFlags()...)
 	cmd.Args = append(cmd.Args, "-gcflags=all=-N -l")
-	cmd.Args = append(cmd.Args, extraArgs...)
+	cmd.Args = append(cmd.Args, "-tags=withexamplebroker,integrationtests")
 	cmd.Args = append(cmd.Args, "-o", execPath, "./cmd/authd")
 
-	if out, err := cmd.CombinedOutput(); err != nil {
+	if err := testlog.RunWithTiming(nil, "Building authd", cmd); err != nil {
 		cleanup()
-		return "", nil, fmt.Errorf("failed to build daemon(%v): %s", err, out)
+		return "", nil, fmt.Errorf("failed to build authd: %v", err)
 	}
 
 	return execPath, cleanup, err
diff --git a/internal/testutils/dbus.go b/internal/testutils/dbus.go
index 116a3c706a..dcdb18bdb6 100644
--- a/internal/testutils/dbus.go
+++ b/internal/testutils/dbus.go
@@ -122,14 +122,21 @@ func StartSystemBusMock() (func(), error) {
 		return nil, err
 	}
 	prev, set := os.LookupEnv("DBUS_SYSTEM_BUS_ADDRESS")
-	os.Setenv("DBUS_SYSTEM_BUS_ADDRESS", busAddress)
+	err = os.Setenv("DBUS_SYSTEM_BUS_ADDRESS", busAddress)
+	if err != nil {
+		busCancel()
+		return nil, err
+	}
 
 	return func() {
 		busCancel()
 		if !set {
-			os.Unsetenv("DBUS_SYSTEM_BUS_ADDRESS")
+			err = os.Unsetenv("DBUS_SYSTEM_BUS_ADDRESS")
 		} else {
-			os.Setenv("DBUS_SYSTEM_BUS_ADDRESS", prev)
+			err = os.Setenv("DBUS_SYSTEM_BUS_ADDRESS", prev)
+		}
+		if err != nil {
+			panic(err)
 		}
 	}, nil
 }
@@ -151,5 +158,5 @@ func GetSystemBusConnection(t *testing.T) (*dbus.Conn, error) {
 // isRunning checks if the system bus mock is running.
 func isRunning() bool {
 	busAddr := os.Getenv("DBUS_SYSTEM_BUS_ADDRESS")
-	return !(busAddr == "" || busAddr == defaultSystemBusAddress)
+	return busAddr != "" && busAddr != defaultSystemBusAddress
 }
diff --git a/internal/testutils/exec.go b/internal/testutils/exec.go
new file mode 100644
index 0000000000..7866b49971
--- /dev/null
+++ b/internal/testutils/exec.go
@@ -0,0 +1,36 @@
+package testutils
+
+import (
+	"io"
+	"os/exec"
+	"path/filepath"
+	"testing"
+
+	"github.com/canonical/authd/internal/testlog"
+	"github.com/canonical/authd/internal/testutils/golden"
+	"github.com/stretchr/testify/require"
+)
+
+// CheckCommand runs the given command and:
+// * Checks that it exits with the expected exit code.
+// * Checks that the output matches the golden file.
+func CheckCommand(t *testing.T, cmd *exec.Cmd, expectedExitCode int) {
+	t.Helper()
+	basename := filepath.Base(cmd.Args[0])
+
+	output := &SyncBuffer{}
+	cmd.Stdout = io.MultiWriter(t.Output(), output)
+	cmd.Stderr = io.MultiWriter(t.Output(), output)
+	testlog.LogCommand(t, "Running "+basename, cmd)
+	err := cmd.Run()
+	exitcode := cmd.ProcessState.ExitCode()
+	testlog.LogEndSeparatorf(t, basename+" finished (exit code %d)", exitcode)
+
+	if expectedExitCode == 0 {
+		require.NoError(t, err, basename+" failed unexpectedly")
+	}
+
+	require.Equal(t, expectedExitCode, exitcode, "Unexpected exit code")
+
+	golden.CheckOrUpdate(t, output.String())
+}
diff --git a/internal/testutils/golden/golden.go b/internal/testutils/golden/golden.go
index 773cc770c7..cdd29ca94b 100644
--- a/internal/testutils/golden/golden.go
+++ b/internal/testutils/golden/golden.go
@@ -122,6 +122,9 @@ func LoadWithUpdate(t *testing.T, data string, options ...Option) string {
 	}
 
 	want, err := os.ReadFile(opts.path)
+	if errors.Is(err, fs.ErrNotExist) {
+		require.Fail(t, fmt.Sprintf("Golden file does not exist: %s", opts.path))
+	}
 	require.NoError(t, err, "Cannot load golden file")
 
 	return string(want)
@@ -157,20 +160,21 @@ func CheckValidGoldenFileName(t *testing.T, name string) {
 func Path(t *testing.T) string {
 	t.Helper()
 
-	cwd, err := os.Getwd()
-	require.NoError(t, err, "Cannot get current working directory")
+	for _, part := range strings.Split(t.Name(), "/") {
+		CheckValidGoldenFileName(t, part)
+	}
 
-	topLevelTest, subtest, subtestFound := strings.Cut(t.Name(), "/")
-	CheckValidGoldenFileName(t, topLevelTest)
+	return filepath.Join(Dir(t), t.Name())
+}
 
-	path := filepath.Join(cwd, "testdata", "golden", topLevelTest)
+// Dir returns the golden directory for the provided test.
+func Dir(t *testing.T) string {
+	t.Helper()
 
-	if !subtestFound {
-		return path
-	}
+	cwd, err := os.Getwd()
+	require.NoError(t, err, "Cannot get current working directory")
 
-	CheckValidGoldenFileName(t, subtest)
-	return filepath.Join(path, subtest)
+	return filepath.Join(cwd, "testdata", "golden")
 }
 
 // runDelta pipes the unified diff through the `delta` command for word-level diff and coloring.
@@ -220,6 +224,7 @@ func checkFileContent(t *testing.T, actual, expected, actualPath, expectedPath s
 	if actualPath != "Actual" {
 		msg += fmt.Sprintf("\nFile: %s", actualPath)
 	}
+	msg += "\n" + updateGoldenFileMessage
 
 	require.Failf(t, strings.Join([]string{
 		"Golden file content mismatch",
@@ -240,8 +245,12 @@ func checkGoldenFileEqualsFile(t *testing.T, path, goldenPath string) {
 
 	fileContent, err := os.ReadFile(path)
 	require.NoError(t, err, "Cannot read file %s", path)
+
 	goldenContent, err := os.ReadFile(goldenPath)
-	require.NoError(t, err, "Cannot read golden file %s", goldenPath)
+	if errors.Is(err, fs.ErrNotExist) {
+		require.Fail(t, fmt.Sprintf("Golden file does not exist: %s", goldenPath), createGoldenFileMessage)
+	}
+	require.NoError(t, err, "Cannot read golden file")
 
 	checkFileContent(t, string(fileContent), string(goldenContent), path, goldenPath)
 }
@@ -250,12 +259,16 @@ func checkGoldenFileEqualsString(t *testing.T, got, goldenPath string) {
 	t.Helper()
 
 	goldenContent, err := os.ReadFile(goldenPath)
-	require.NoError(t, err, "Cannot read golden file %s", goldenPath)
+	if errors.Is(err, fs.ErrNotExist) {
+		require.Fail(t, fmt.Sprintf("Golden file does not exist: %s", goldenPath), createGoldenFileMessage)
+	}
+	require.NoError(t, err, "Cannot read golden file")
 
 	checkFileContent(t, got, string(goldenContent), "Actual", goldenPath)
 }
 
-// CheckOrUpdateFileTree allows comparing a goldPath directory to p. Those can be updated via the dedicated flag.
+// CheckOrUpdateFileTree compares the content and attributes of the files in the provided directory with the golden directory.
+// If the update environment variable is set, the golden directory is updated with the content of the provided directory.
 func CheckOrUpdateFileTree(t *testing.T, path string, options ...Option) {
 	t.Helper()
 
@@ -304,7 +317,7 @@ func CheckOrUpdateFileTree(t *testing.T, path string, options ...Option) {
 
 		goldenFile, err := os.Stat(goldenFilePath)
 		if errors.Is(err, fs.ErrNotExist) {
-			require.Failf(t, "Unexpected file %s", p)
+			require.Fail(t, fmt.Sprintf("Golden file does not exist: %s", goldenFilePath), createGoldenFileMessage)
 		}
 		require.NoError(t, err, "Cannot get golden file %s", goldenFilePath)
 
@@ -388,3 +401,19 @@ func addEmptyMarker(p string) error {
 func UpdateEnabled() bool {
 	return update
 }
+
+func yellow(a ...any) string {
+	return fmt.Sprint("\033[0;93m", fmt.Sprint(a...), "\033[0m")
+}
+
+var createGoldenFileMessage = yellow(fmt.Sprintf(
+	"Run the tests with %s=true to create the golden file.\n"+
+		"Manually inspect its content afterwards to ensure it is correct.",
+	UpdateGoldenFilesEnv,
+))
+
+var updateGoldenFileMessage = yellow(fmt.Sprintf(
+	"Run the tests withs %s=true to update the golden file.\n"+
+		"Manually inspect its content afterwards to ensure it is correct.",
+	UpdateGoldenFilesEnv,
+))
diff --git a/internal/testutils/path.go b/internal/testutils/path.go
index 1e59d1c176..088f3a95d4 100644
--- a/internal/testutils/path.go
+++ b/internal/testutils/path.go
@@ -12,6 +12,9 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
+// MinimalPathEnv is the minimal PATH environment variable used to run tests.
+const MinimalPathEnv = "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin"
+
 // CurrentDir returns the current file directory.
 func CurrentDir() string {
 	// p is the path to the caller file
@@ -70,3 +73,28 @@ func TestFamilyPath(t *testing.T) string {
 
 	return filepath.Join("testdata", topLevelTest)
 }
+
+// TempDir returns a temporary directory for the test.
+// If the SKIP_CLEANUP environment variable is set, it creates a temp dir
+// that is not automatically removed after the test.
+func TempDir(t *testing.T) string {
+	t.Helper()
+
+	skipCleanup := os.Getenv("SKIP_CLEANUP") != ""
+
+	if RunningInBubblewrap() {
+		// When running in bubblewrap, we don't need to cleanup temporary directories
+		// because they only exist inside the bubblewrap sandbox anyway, and we don't
+		// want the tests to fail if the temporary directory cannot be removed for
+		// some reason.
+		skipCleanup = true
+	}
+
+	if skipCleanup {
+		tempDir, err := os.MkdirTemp("", "authd-bwrap-testdata-")
+		require.NoError(t, err, "Setup: could not create temp dir for bwrap test data")
+		return tempDir
+	}
+
+	return t.TempDir()
+}
diff --git a/internal/testutils/root.go b/internal/testutils/root.go
new file mode 100644
index 0000000000..26cb85d459
--- /dev/null
+++ b/internal/testutils/root.go
@@ -0,0 +1,88 @@
+package testutils
+
+import (
+	"fmt"
+	"os"
+	"os/exec"
+	"sync"
+	"testing"
+
+	"github.com/canonical/authd/internal/testlog"
+	"github.com/canonical/authd/internal/testutils/golden"
+)
+
+var (
+	needsSudoOnce sync.Once
+	needsSudo     bool
+)
+
+// RunningAsRoot returns true if the current process is running as root.
+func RunningAsRoot() bool {
+	return os.Geteuid() == 0
+}
+
+// SkipIfCannotRunAsRoot checks whether we can run tests as root or skip the tests otherwise.
+func SkipIfCannotRunAsRoot(t *testing.T) {
+	t.Helper()
+
+	if os.Geteuid() == 0 {
+		t.Log("Running as EUID 0")
+		return
+	}
+
+	needsSudoOnce.Do(func() {
+		needsSudo = canUseSudoNonInteractively(t)
+	})
+	if needsSudo {
+		return
+	}
+
+	t.Skip("Skipping test: requires root privileges")
+}
+
+// RunTestAsRoot runs the given test as root.
+func RunTestAsRoot(t *testing.T, args ...string) {
+	t.Helper()
+
+	SkipIfCannotRunAsRoot(t)
+
+	if v := os.Getenv(golden.UpdateGoldenFilesEnv); v != "" {
+		args = append(args, fmt.Sprintf("%s=%s", golden.UpdateGoldenFilesEnv, v))
+	}
+
+	testCommand := []string{os.Args[0], "-test.run", "^" + t.Name() + "$"}
+	if testing.Verbose() {
+		testCommand = append(testCommand, "-test.v")
+	}
+	if c := CoverDirForTests(); c != "" {
+		testCommand = append(testCommand, fmt.Sprintf("-test.gocoverdir=%s", c))
+	}
+	args = append(args, testCommand...)
+
+	cmd := exec.Command("sudo", "-n")
+	cmd.Args = append(cmd.Args, args...)
+	cmd.Stdout = t.Output()
+	cmd.Stderr = t.Output()
+	testlog.LogCommand(t, fmt.Sprintf("Running %s as root", t.Name()), cmd)
+	err := cmd.Run()
+	if err != nil {
+		testlog.LogEndSeparator(t, fmt.Sprintf("%s as root failed", t.Name()))
+		t.Fatalf("Running %s as root failed: %v", t.Name(), err)
+	}
+	testlog.LogEndSeparator(t, fmt.Sprintf("%s as root finished", t.Name()))
+}
+
+func canUseSudoNonInteractively(t *testing.T) bool {
+	t.Helper()
+
+	cmd := exec.Command("sudo", "-n", "true")
+	cmd.Stdout = t.Output()
+	cmd.Stderr = t.Output()
+	testlog.LogCommand(t, "Checking if we can use sudo non-interactively", cmd)
+	if err := cmd.Run(); err != nil {
+		testlog.LogRedEndSeparator(t, "Cannot use sudo non-interactively")
+		return false
+	}
+	testlog.LogEndSeparator(t, "Can use sudo non-interactively")
+	return true
+}
diff --git a/internal/testutils/rust.go b/internal/testutils/rust.go
index 7480142f00..bd1211ff66 100644
--- a/internal/testutils/rust.go
+++ b/internal/testutils/rust.go
@@ -11,6 +11,8 @@ import (
 	"strings"
 	"testing"
 
+	"github.com/canonical/authd/internal/fileutils"
+	"github.com/canonical/authd/internal/testlog"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
@@ -74,14 +76,15 @@ func BuildRustNSSLib(t *testing.T, disableCoverage bool, features ...string) (li
 	cargo, isNightly, err := getCargoPath()
 	require.NoError(t, err, "Setup: looking for cargo")
 
-	// Note that for developing purposes and avoiding keeping building the rust program dependencies,
-	// TEST_RUST_TARGET environment variable can be set to an absolute path to keep iterative
-	// build artifacts.
+	// Store the build artifacts in a common temp directory, so that they can be reused between tests.
 	target := os.Getenv("TEST_RUST_TARGET")
 	if target == "" {
-		target = t.TempDir()
+		target = filepath.Join(os.TempDir(), "authd-tests-rust-build-artifacts")
 	}
 
+	err = os.MkdirAll(target, 0700)
+	require.NoError(t, err, "Setup: could not create Rust target dir")
+
 	rustDir := filepath.Join(projectRoot, "nss")
 	if !disableCoverage {
 		rustCovEnv = trackRustCoverage(t, target, rustDir)
@@ -89,10 +92,22 @@ func BuildRustNSSLib(t *testing.T, disableCoverage bool, features ...string) (li
 
 	features = append([]string{"integration_tests", "custom_socket"}, features...)
 
+	t.Logf("Locking Rust target dir %s", target)
+	unlock, err := fileutils.LockDir(target)
+	require.NoError(t, err, "Setup: could not lock Rust target dir")
+	defer func() {
+		require.NoError(t, unlock(), "Setup: could not unlock Rust target dir")
+		t.Logf("Unlocked Rust target dir %s", target)
+	}()
+	t.Logf("Locked Rust target dir %s", target)
+
 	// Builds the nss library.
-	// #nosec:G204 - we control the command arguments in tests
-	cmd := exec.Command(cargo, "build", "--verbose",
-		"--features", strings.Join(features, ","), "--target-dir", target)
+	//nolint:gosec // G702 - test-only code; cargo path is from getCargoPath(), args are controlled.
+	cmd := exec.Command(cargo, "build", "--features", strings.Join(features, ","), "--target-dir", target)
+	if TestVerbosity() > 0 {
+		cmd.Args = append(cmd.Args, "--verbose")
+	}
+	// dpkg-buildflags sets many relevant environment variables, so we pass the whole environment.
 	cmd.Env = append(os.Environ(), rustCovEnv...)
 	cmd.Dir = projectRoot
 
@@ -100,9 +115,8 @@ func BuildRustNSSLib(t *testing.T, disableCoverage bool, features ...string) (li
 		cmd.Env = append(cmd.Env, "RUSTFLAGS=-Zsanitizer=address")
 	}
 
-	t.Log("Building NSS library...", cmd.Args)
-	out, err := cmd.CombinedOutput()
-	require.NoError(t, err, "Setup: could not build Rust NSS library: %s", out)
+	err = testlog.RunWithTiming(t, "Building NSS library", cmd)
+	require.NoError(t, err, "Setup: could not build Rust NSS library")
 
 	// When building the crate with dh-cargo, this env is set to indicate which architecture the code
 	// is being compiled to. When it's set, the compiled is stored under target/$(DEB_HOST_RUST_TYPE)/debug,
@@ -111,9 +125,10 @@ func BuildRustNSSLib(t *testing.T, disableCoverage bool, features ...string) (li
 	// If the env is not set, the target stays the same.
 	target = filepath.Join(target, os.Getenv("DEB_HOST_RUST_TYPE"))
 
-	// Creates a symlink for the compiled library with the expected versioned name.
-	libPath = filepath.Join(target, "libnss_authd.so.2")
-	if err = os.Symlink(filepath.Join(target, "debug", "libnss_authd.so"), libPath); err != nil {
+	// Copy the library with the expected versioned name to a temporary directory, so that we can safely use
+	// it from there after unlocking the target directory, which allows other tests to rebuild the library.
+	libPath = filepath.Join(t.TempDir(), "libnss_authd.so.2")
+	if err = fileutils.CopyFile(filepath.Join(target, "debug", "libnss_authd.so"), libPath); err != nil {
 		require.ErrorIs(t, err, os.ErrExist, "Setup: failed to create versioned link to the library")
 	}
 
diff --git a/internal/testutils/sync.go b/internal/testutils/sync.go
new file mode 100644
index 0000000000..1e6666a6ce
--- /dev/null
+++ b/internal/testutils/sync.go
@@ -0,0 +1,31 @@
+package testutils
+
+import (
+	"bytes"
+	"sync"
+)
+
+// SyncBuffer is a mutex-protected buffer to avoid data races.
+type SyncBuffer struct {
+	mu  sync.RWMutex
+	buf bytes.Buffer
+}
+
+func (s *SyncBuffer) Write(p []byte) (n int, err error) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return s.buf.Write(p)
+}
+
+// Bytes returns the buffer content.
+func (s *SyncBuffer) Bytes() []byte {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+	return s.buf.Bytes()
+}
+
+func (s *SyncBuffer) String() string {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+	return s.buf.String()
+}
diff --git a/internal/users/db/bbolt/db.go b/internal/users/db/bbolt/db.go
index 74ca508690..5f5be3887a 100644
--- a/internal/users/db/bbolt/db.go
+++ b/internal/users/db/bbolt/db.go
@@ -11,7 +11,7 @@ import (
 	"sync"
 	"syscall"
 
-	"github.com/ubuntu/decorate"
+	"github.com/canonical/authd/internal/decorate"
 	"go.etcd.io/bbolt"
 )
 
diff --git a/internal/users/db/bbolt/delete.go b/internal/users/db/bbolt/delete.go
index a71e0ae822..7c956a7e35 100644
--- a/internal/users/db/bbolt/delete.go
+++ b/internal/users/db/bbolt/delete.go
@@ -8,29 +8,10 @@ import (
 	"slices"
 	"strconv"
 
-	"github.com/ubuntu/authd/log"
-	"github.com/ubuntu/decorate"
+	"github.com/canonical/authd/log"
 	"go.etcd.io/bbolt"
 )
 
-// DeleteUser removes the user from the database.
-func (c *Database) DeleteUser(uid uint32) error {
-	c.mu.RLock()
-	defer c.mu.RUnlock()
-
-	return c.db.Update(func(tx *bbolt.Tx) error {
-		buckets, err := getAllBuckets(tx)
-		if err != nil {
-			return err
-		}
-
-		if err := deleteUser(buckets, uid); err != nil {
-			return err
-		}
-		return nil
-	})
-}
-
 // deleteUserFromGroup removes the uid from the group.
 // If the group is empty after the uid gets removed, the group is deleted from the database.
 func deleteUserFromGroup(buckets map[string]bucketWithName, uid, gid uint32) error {
@@ -48,44 +29,6 @@ func deleteUserFromGroup(buckets map[string]bucketWithName, uid, gid uint32) err
 	return nil
 }
 
-// deleteUser removes the user from the database.
-func deleteUser(buckets map[string]bucketWithName, uid uint32) (err error) {
-	defer decorate.OnError(&err, "could not remove user %d from db", uid)
-
-	u, err := getFromBucket[UserDB](buckets[userByIDBucketName], uid)
-	if err != nil {
-		return err
-	}
-
-	userToGroups, err := getFromBucket[userToGroupsDB](buckets[userToGroupsBucketName], uid)
-	if err != nil {
-		return err
-	}
-	for _, gid := range userToGroups.GIDs {
-		if err := deleteUserFromGroup(buckets, uid, gid); err != nil {
-			return err
-		}
-	}
-
-	uidKey := []byte(strconv.FormatUint(uint64(u.UID), 10))
-
-	// Delete user
-	// Delete calls fail if the transaction is read only, so we should panic if this function is called in that context.
-	if err = buckets[userToGroupsBucketName].Delete(uidKey); err != nil {
-		panic(fmt.Sprintf("programming error: delete is not allowed in a RO transaction: %v", err))
-	}
-	if err = buckets[userByIDBucketName].Delete(uidKey); err != nil {
-		panic(fmt.Sprintf("programming error: delete is not allowed in a RO transaction: %v", err))
-	}
-	if err = buckets[userByNameBucketName].Delete([]byte(u.Name)); err != nil {
-		panic(fmt.Sprintf("programming error: delete is not allowed in a RO transaction: %v", err))
-	}
-	if err = buckets[userToBrokerBucketName].Delete(uidKey); err != nil {
-		panic(fmt.Sprintf("programming error: delete is not allowed in a RO transaction: %v", err))
-	}
-	return nil
-}
-
 // deleteOrphanedUsers removes users from the UserByID bucket that are not in the UserByName bucket.
 func deleteOrphanedUsers(db *bbolt.DB) error {
 	log.Debug(context.TODO(), "Cleaning up orphaned user records")
@@ -151,12 +94,3 @@ func deleteOrphanedUser(buckets map[string]bucketWithName, uid uint32) (err erro
 
 	return nil
 }
-
-// deleteRenamedGroup removes a group record with the given Name from groupByName bucket.
-func deleteRenamedGroup(buckets map[string]bucketWithName, groupName string) (err error) {
-	// Delete calls fail if the transaction is read only, so we should panic if this function is called in that context.
-	if err = buckets[groupByNameBucketName].Delete([]byte(groupName)); err != nil {
-		panic(fmt.Sprintf("programming error: delete is not allowed in a RO transaction: %v", err))
-	}
-	return nil
-}
diff --git a/internal/users/db/bbolt/getgroups.go b/internal/users/db/bbolt/getgroups.go
index 056be06e94..7b8f69c893 100644
--- a/internal/users/db/bbolt/getgroups.go
+++ b/internal/users/db/bbolt/getgroups.go
@@ -23,21 +23,6 @@ func NewGroupDB(name string, gid uint32, ugid string, members []string) GroupDB
 	}
 }
 
-// GroupByID returns a group matching this gid or an error if the database is corrupted or no entry was found.
-func (c *Database) GroupByID(gid uint32) (GroupDB, error) {
-	return getGroup(c, groupByIDBucketName, gid)
-}
-
-// GroupByName returns a group matching a given name or an error if the database is corrupted or no entry was found.
-func (c *Database) GroupByName(name string) (GroupDB, error) {
-	return getGroup(c, groupByNameBucketName, name)
-}
-
-// GroupByUGID returns a group matching this ugid or an error if the database is corrupted or no entry was found.
-func (c *Database) GroupByUGID(ugid string) (GroupDB, error) {
-	return getGroup(c, groupByUGIDBucketName, ugid)
-}
-
 // UserGroups returns all groups for a given user or an error if the database is corrupted or no entry was found.
 func (c *Database) UserGroups(uid uint32) ([]GroupDB, error) {
 	c.mu.RLock()
@@ -140,48 +125,6 @@ func (c *Database) AllGroups() (all []GroupDB, err error) {
 	return all, nil
 }
 
-// getGroup returns a group matching the key and its members or an error if the database is corrupted
-// or no entry was found.
-func getGroup[K uint32 | string](c *Database, bucketName string, key K) (GroupDB, error) {
-	var groupName string
-	var gid uint32
-	var ugid string
-	var users []string
-
-	c.mu.RLock()
-	defer c.mu.RUnlock()
-	err := c.db.View(func(tx *bbolt.Tx) error {
-		buckets, err := getAllBuckets(tx)
-		if err != nil {
-			return err
-		}
-
-		// Get id, name and ugid of the group.
-		g, err := getFromBucket[groupDB](buckets[bucketName], key)
-		if err != nil {
-			return err
-		}
-
-		groupName = g.Name
-		gid = g.GID
-		ugid = g.UGID
-
-		// Get user names in the group.
-		users, err = getUsersInGroup(buckets, gid)
-		if err != nil {
-			return err
-		}
-
-		return nil
-	})
-
-	if err != nil {
-		return GroupDB{}, err
-	}
-
-	return NewGroupDB(groupName, gid, ugid, users), nil
-}
-
 // usersInGroup returns all user names in a given group. It returns an error if the database is corrupted.
 func getUsersInGroup(buckets map[string]bucketWithName, gid uint32) (users []string, err error) {
 	usersInGroup, err := getFromBucket[groupToUsersDB](buckets[groupToUsersBucketName], gid)
diff --git a/internal/users/db/bbolt/getusers.go b/internal/users/db/bbolt/getusers.go
index 56c8ed6e94..e4602bedc0 100644
--- a/internal/users/db/bbolt/getusers.go
+++ b/internal/users/db/bbolt/getusers.go
@@ -7,29 +7,6 @@ import (
 	"go.etcd.io/bbolt"
 )
 
-// NewUserDB creates a new UserDB.
-func NewUserDB(name string, uid, gid uint32, gecos, dir, shell string) UserDB {
-	return UserDB{
-		Name:           name,
-		UID:            uid,
-		GID:            gid,
-		Gecos:          gecos,
-		Dir:            dir,
-		Shell:          shell,
-		LastPwdChange:  -1,
-		MaxPwdAge:      -1,
-		PwdWarnPeriod:  -1,
-		PwdInactivity:  -1,
-		MinPwdAge:      -1,
-		ExpirationDate: -1,
-	}
-}
-
-// UserByID returns a user matching this uid or an error if the database is corrupted or no entry was found.
-func (c *Database) UserByID(uid uint32) (UserDB, error) {
-	return getUser(c, userByIDBucketName, uid)
-}
-
 // UserByName returns a user matching this name or an error if the database is corrupted or no entry was found.
 func (c *Database) UserByName(name string) (UserDB, error) {
 	return getUser(c, userByNameBucketName, name)
@@ -62,7 +39,7 @@ func (c *Database) AllUsers() (all []UserDB, err error) {
 	return all, nil
 }
 
-// getUser returns an user matching the key or an error if the database is corrupted or no entry was found.
+// getUser returns a user matching the key or an error if the database is corrupted or no entry was found.
 func getUser[K uint32 | string](c *Database, bucketName string, key K) (u UserDB, err error) {
 	c.mu.RLock()
 	defer c.mu.RUnlock()
diff --git a/internal/users/db/bbolt/testutils.go b/internal/users/db/bbolt/testutils.go
index 5068c56d12..b97b0f48c8 100644
--- a/internal/users/db/bbolt/testutils.go
+++ b/internal/users/db/bbolt/testutils.go
@@ -9,7 +9,7 @@ import (
 	"strings"
 	"time"
 
-	"github.com/ubuntu/authd/internal/testsdetection"
+	"github.com/canonical/authd/internal/testsdetection"
 	"go.etcd.io/bbolt"
 	"gopkg.in/yaml.v3"
 )
diff --git a/internal/users/db/bbolt/update.go b/internal/users/db/bbolt/update.go
index 9cafea4132..87053f3549 100644
--- a/internal/users/db/bbolt/update.go
+++ b/internal/users/db/bbolt/update.go
@@ -1,155 +1,11 @@
 package bbolt
 
 import (
-	"context"
 	"encoding/json"
-	"errors"
 	"fmt"
-	"slices"
 	"strconv"
-
-	"github.com/ubuntu/authd/log"
-	"go.etcd.io/bbolt"
 )
 
-// UpdateUserEntry inserts or updates user and group buckets from the user information.
-func (c *Database) UpdateUserEntry(user UserDB, authdGroups []GroupDB, localGroups []string) error {
-	c.mu.RLock()
-	defer c.mu.RUnlock()
-
-	err := c.db.Update(func(tx *bbolt.Tx) error {
-		buckets, err := getAllBuckets(tx)
-		if err != nil {
-			return err
-		}
-
-		previousGroupsForCurrentUser, err := getFromBucket[userToGroupsDB](buckets[userToGroupsBucketName], user.UID)
-		// No data is valid and means this is the first insertion.
-		if err != nil && !errors.Is(err, NoDataFoundError{}) {
-			return err
-		}
-
-		/* 1. Handle user update */
-		if err := updateUser(buckets, user); err != nil {
-			return err
-		}
-
-		/* 2. Handle groups update */
-		if err := updateGroups(buckets, authdGroups); err != nil {
-			return err
-		}
-
-		/* 3. Users and groups mapping buckets */
-		if err := updateUsersAndGroups(buckets, user.UID, authdGroups, previousGroupsForCurrentUser.GIDs); err != nil {
-			return err
-		}
-
-		/* 4. Update user to local groups bucket */
-		updateBucket(buckets[userToLocalGroupsBucketName], user.UID, localGroups)
-
-		return nil
-	})
-
-	return err
-}
-
-// updateUser updates both user buckets with userContent.
-func updateUser(buckets map[string]bucketWithName, userContent UserDB) error {
-	existingUser, err := getFromBucket[UserDB](buckets[userByIDBucketName], userContent.UID)
-	if err != nil && !errors.Is(err, NoDataFoundError{}) {
-		return err
-	}
-
-	// If a user with the same UID exists, we need to ensure that it's the same user or fail the update otherwise.
-	if existingUser.Name != "" && existingUser.Name != userContent.Name {
-		log.Errorf(context.TODO(), "UID for user %q already in use by user %q", userContent.Name, existingUser.Name)
-		return errors.New("UID already in use by a different user")
-	}
-
-	// Ensure that we use the same homedir as the one we have in the database.
-	if existingUser.Dir != "" && existingUser.Dir != userContent.Dir {
-		log.Warningf(context.TODO(), "User %q already has a homedir. The existing %q one will be kept instead of %q", userContent.Name, existingUser.Dir, userContent.Dir)
-		userContent.Dir = existingUser.Dir
-	}
-
-	// Update user buckets
-	log.Debugf(context.Background(), "Updating entry of user %q (UID: %d)", userContent.Name, userContent.UID)
-	updateBucket(buckets[userByIDBucketName], userContent.UID, userContent)
-	updateBucket(buckets[userByNameBucketName], userContent.Name, userContent)
-
-	return nil
-}
-
-// updateUser updates all group buckets with groupContent.
-func updateGroups(buckets map[string]bucketWithName, groupContents []GroupDB) error {
-	for _, groupContent := range groupContents {
-		existingGroup, err := getFromBucket[groupDB](buckets[groupByIDBucketName], groupContent.GID)
-		if err != nil && !errors.Is(err, NoDataFoundError{}) {
-			return err
-		}
-		groupExists := !errors.Is(err, NoDataFoundError{})
-
-		// If a group with the same GID exists, we need to ensure that it's the same group or fail the update otherwise.
-		// Ignore the case that the UGID of the existing group is empty, which means that the group was stored without a
-		// UGID, which was the case before https://github.com/ubuntu/authd/pull/647.
-		if groupExists && existingGroup.UGID != "" && existingGroup.UGID != groupContent.UGID {
-			log.Errorf(context.TODO(), "GID %d for group with UGID %q already in use by a group with UGID %q", groupContent.GID, groupContent.UGID, existingGroup.UGID)
-			return fmt.Errorf("GID for group %q already in use by a different group", groupContent.Name)
-		}
-
-		// Same GID and UGID but a different Name can happen due to group renaming at provider's end.
-		if groupExists && existingGroup.Name != groupContent.Name {
-			// The record being pointed by the existing group name in the groupByName bucket should be deleted.
-			if err := deleteRenamedGroup(buckets, existingGroup.Name); err != nil {
-				return err
-			}
-		}
-
-		// Update group buckets
-		updateBucket(buckets[groupByIDBucketName], groupContent.GID, groupDB{Name: groupContent.Name, GID: groupContent.GID, UGID: groupContent.UGID})
-		updateBucket(buckets[groupByNameBucketName], groupContent.Name, groupDB{Name: groupContent.Name, GID: groupContent.GID, UGID: groupContent.UGID})
-
-		if groupContent.UGID != "" {
-			updateBucket(buckets[groupByUGIDBucketName], groupContent.UGID, groupDB{Name: groupContent.Name, GID: groupContent.GID, UGID: groupContent.UGID})
-		}
-	}
-
-	return nil
-}
-
-// updateUserAndGroups updates the pivot table for user to groups and group to users. It handles any update
-// to groups uid is not part of anymore.
-func updateUsersAndGroups(buckets map[string]bucketWithName, uid uint32, groupContents []GroupDB, previousGIDs []uint32) error {
-	var currentGIDs []uint32
-	for _, groupContent := range groupContents {
-		currentGIDs = append(currentGIDs, groupContent.GID)
-		grpToUsers, err := getFromBucket[groupToUsersDB](buckets[groupToUsersBucketName], groupContent.GID)
-		// No data is valid and means that this is the first time we record it.
-		if err != nil && !errors.Is(err, NoDataFoundError{}) {
-			return err
-		}
-
-		grpToUsers.GID = groupContent.GID
-		if !slices.Contains(grpToUsers.UIDs, uid) {
-			grpToUsers.UIDs = append(grpToUsers.UIDs, uid)
-		}
-		updateBucket(buckets[groupToUsersBucketName], groupContent.GID, grpToUsers)
-	}
-	updateBucket(buckets[userToGroupsBucketName], uid, userToGroupsDB{UID: uid, GIDs: currentGIDs})
-
-	// Remove UID from any groups this user is not part of anymore.
-	for _, previousGID := range previousGIDs {
-		if slices.Contains(currentGIDs, previousGID) {
-			continue
-		}
-		if err := deleteUserFromGroup(buckets, uid, previousGID); err != nil {
-			return err
-		}
-	}
-
-	return nil
-}
-
 // updateBucket is a generic function to update any bucket. It panics if we call it in RO transaction.
 func updateBucket[K uint32 | string](bucket bucketWithName, key K, value any) {
 	data, err := json.Marshal(value)
@@ -172,25 +28,3 @@ func updateBucket[K uint32 | string](bucket bucketWithName, key K, value any) {
 		panic(fmt.Sprintf("programming error: Put is not executed in a RW transaction: %v", err))
 	}
 }
-
-// UpdateBrokerForUser updates the last broker the user successfully authenticated with.
-func (c *Database) UpdateBrokerForUser(username, brokerID string) error {
-	c.mu.RLock()
-	defer c.mu.RUnlock()
-
-	u, err := c.UserByName(username)
-	if err != nil {
-		return err
-	}
-
-	err = c.db.Update(func(tx *bbolt.Tx) error {
-		bucket, err := getBucket(tx, userToBrokerBucketName)
-		if err != nil {
-			return err
-		}
-		updateBucket(bucket, u.UID, brokerID)
-		return nil
-	})
-
-	return err
-}
diff --git a/internal/users/db/db.go b/internal/users/db/db.go
index 198548b9fa..43c9d44d7e 100644
--- a/internal/users/db/db.go
+++ b/internal/users/db/db.go
@@ -12,11 +12,11 @@ import (
 	"sync"
 	"syscall"
 
+	"github.com/canonical/authd/internal/consts"
+	"github.com/canonical/authd/internal/fileutils"
+	"github.com/canonical/authd/log"
 	// sqlite3 driver.
 	_ "github.com/mattn/go-sqlite3"
-	"github.com/ubuntu/authd/internal/consts"
-	"github.com/ubuntu/authd/internal/fileutils"
-	"github.com/ubuntu/authd/log"
 )
 
 var (
@@ -29,7 +29,10 @@ var (
 type Manager struct {
 	db   *sql.DB
 	path string
-	mu   sync.RWMutex
+	// mu protects concurrent updates of the database. It's needed because some
+	// operations require temporarily disabling the foreign key constraints
+	// during which concurrent updates to the database could violate them.
+	mu sync.Mutex
 }
 
 // queryable is an interface to execute SQL queries. Both sql.DB and sql.Tx implement this interface.
@@ -88,7 +91,7 @@ func New(dbDir string) (*Manager, error) {
 		}
 	}
 
-	m := &Manager{db: db, path: dbPath, mu: sync.RWMutex{}}
+	m := &Manager{db: db, path: dbPath, mu: sync.Mutex{}}
 	err = m.maybeApplyMigrations()
 	if err != nil {
 		return nil, err
@@ -175,15 +178,34 @@ func RemoveDB(dbDir string) error {
 	return os.Remove(filepath.Join(dbDir, consts.DefaultDatabaseFileName))
 }
 
+// NewUIDNotFoundError returns a NoDataFoundError for the given user ID.
+func NewUIDNotFoundError(uid uint32) NoDataFoundError {
+	return NoDataFoundError{fmt.Sprintf("user with UID %d not found", uid)}
+}
+
+// NewGIDNotFoundError returns a NoDataFoundError for the given group ID.
+func NewGIDNotFoundError(gid uint32) NoDataFoundError {
+	return NoDataFoundError{fmt.Sprintf("group with GID %d not found", gid)}
+}
+
+// NewUserNotFoundError returns a NoDataFoundError for the given user name.
+func NewUserNotFoundError(name string) NoDataFoundError {
+	return NoDataFoundError{fmt.Sprintf("user %q not found", name)}
+}
+
+// NewGroupNotFoundError returns a NoDataFoundError for the given group name.
+func NewGroupNotFoundError(name string) NoDataFoundError {
+	return NoDataFoundError{fmt.Sprintf("group %q not found", name)}
+}
+
 // NoDataFoundError is returned when we didn’t find a matching entry.
 type NoDataFoundError struct {
-	key   string
-	table string
+	msg string
 }
 
 // Error implements the error interface.
 func (err NoDataFoundError) Error() string {
-	return fmt.Sprintf("no result matching %v in %v", err.key, err.table)
+	return err.msg
 }
 
 // Is makes this error insensitive to the key and table names.
diff --git a/internal/users/db/db_test.go b/internal/users/db/db_test.go
index cc17c73460..47cce2060f 100644
--- a/internal/users/db/db_test.go
+++ b/internal/users/db/db_test.go
@@ -8,13 +8,15 @@ import (
 	"path/filepath"
 	"testing"
 
+	"github.com/canonical/authd/internal/consts"
+	"github.com/canonical/authd/internal/fileutils"
+	"github.com/canonical/authd/internal/testutils/golden"
+	"github.com/canonical/authd/internal/users/db"
+	"github.com/canonical/authd/internal/users/localentries"
+	localgrouptestutils "github.com/canonical/authd/internal/users/localentries/testutils"
+	userslocking "github.com/canonical/authd/internal/users/locking"
+	"github.com/canonical/authd/log"
 	"github.com/stretchr/testify/require"
-	"github.com/ubuntu/authd/internal/consts"
-	"github.com/ubuntu/authd/internal/fileutils"
-	"github.com/ubuntu/authd/internal/testutils/golden"
-	"github.com/ubuntu/authd/internal/users/db"
-	userslocking "github.com/ubuntu/authd/internal/users/locking"
-	"github.com/ubuntu/authd/log"
 )
 
 func TestNew(t *testing.T) {
@@ -116,8 +118,8 @@ func TestDatabaseRemovedWhenSchemaCreationFails(t *testing.T) {
 func TestMigrationToLowercaseUserAndGroupNames(t *testing.T) {
 	// Create a database from the testdata
 	dbDir := t.TempDir()
-	dbFile := "one_users_multiple_groups_with_uppercase.db.yaml"
-	err := db.Z_ForTests_CreateDBFromYAML(filepath.Join("testdata", dbFile), dbDir)
+	sqlDump := "TestMigrationToLowercaseUserAndGroupNames/one_users_multiple_groups_with_uppercase.sql"
+	err := db.Z_ForTests_CreateDBFromDump(filepath.Join("testdata", sqlDump), dbDir)
 	require.NoError(t, err, "Setup: could not create database from testdata")
 
 	// Create a temporary user group file for testing
@@ -129,14 +131,12 @@ LocalTestGroup:x:12345:TestUser
 `), 0600)
 	require.NoError(t, err, "Setup: could not create group file")
 
-	// Make the db package use the temporary group file
-	origGroupFile := db.GroupFile()
-	db.SetGroupFile(groupsFilePath)
-	t.Cleanup(func() { db.SetGroupFile(origGroupFile) })
+	// Make the localentries package use the test group file.
+	t.Cleanup(localentries.Z_ForTests_RestoreDefaultOptions)
+	localentries.Z_ForTests_SetGroupPath(groupsFilePath, groupsFilePath)
 
 	// Make the userutils package to use test locking for the group file
-	userslocking.Z_ForTests_OverrideLocking()
-	t.Cleanup(userslocking.Z_ForTests_RestoreLocking)
+	userslocking.Z_ForTests_OverrideLockingWithCleanup(t)
 
 	// Run the migrations
 	m, err := db.New(dbDir)
@@ -153,11 +153,6 @@ LocalTestGroup:x:12345:TestUser
 	require.NoError(t, err)
 
 	golden.CheckOrUpdate(t, string(userGroupContent), golden.WithPath("groups"))
-
-	// Check the content of the backup group file
-	userGroupBackupContent, err := os.ReadFile(db.GroupFileBackupPath())
-	require.NoError(t, err)
-	golden.CheckOrUpdate(t, string(userGroupBackupContent), golden.WithPath("groups-backup"))
 }
 
 func TestMigrationToLowercaseUserAndGroupNamesEmptyDB(t *testing.T) {
@@ -172,14 +167,11 @@ func TestMigrationToLowercaseUserAndGroupNamesEmptyDB(t *testing.T) {
 	err = fileutils.Touch(groupsFilePath)
 	require.NoError(t, err, "Setup: could not create group file")
 
-	// Make the db package use the temporary group file
-	origGroupFile := db.GroupFile()
-	db.SetGroupFile(groupsFilePath)
-	t.Cleanup(func() { db.SetGroupFile(origGroupFile) })
+	// Make the localentries package use the test group file.
+	groupsFilePath = localgrouptestutils.SetupGroupMock(t, groupsFilePath)
 
 	// Make the userutils package to use test locking for the group file
-	userslocking.Z_ForTests_OverrideLocking()
-	t.Cleanup(userslocking.Z_ForTests_RestoreLocking)
+	userslocking.Z_ForTests_OverrideLockingWithCleanup(t)
 
 	// Run the migrations
 	m, err := db.New(dbDir)
@@ -191,22 +183,14 @@ func TestMigrationToLowercaseUserAndGroupNamesEmptyDB(t *testing.T) {
 
 	golden.CheckOrUpdate(t, dbContent, golden.WithPath("db"))
 
-	// Check the content of the user group file
-	userGroupContent, err := os.ReadFile(groupsFilePath)
-	require.NoError(t, err)
-
-	golden.CheckOrUpdate(t, string(userGroupContent), golden.WithPath("groups"))
-
-	// Check the content of the backup group file
-	_, err = os.Stat(db.GroupFileBackupPath())
-	require.ErrorIs(t, err, os.ErrNotExist, "No backup should exist")
+	require.NoFileExists(t, groupsFilePath, "No new group file should have been created")
 }
 
 func TestMigrationToLowercaseUserAndGroupNamesAlreadyUpdated(t *testing.T) {
 	// Create a database from the testdata
 	dbDir := t.TempDir()
-	dbFile := "one_users_multiple_groups_with_uppercase.db.yaml"
-	err := db.Z_ForTests_CreateDBFromYAML(filepath.Join("testdata", dbFile), dbDir)
+	sqlDump := "TestMigrationToLowercaseUserAndGroupNames/one_users_multiple_groups_with_uppercase.sql"
+	err := db.Z_ForTests_CreateDBFromDump(filepath.Join("testdata", sqlDump), dbDir)
 	require.NoError(t, err, "Setup: could not create database from testdata")
 
 	// Create a temporary user group file for testing
@@ -214,14 +198,11 @@ func TestMigrationToLowercaseUserAndGroupNamesAlreadyUpdated(t *testing.T) {
 	err = os.WriteFile(groupsFilePath, []byte("LocalTestGroup:x:12345:testuser\n"), 0600)
 	require.NoError(t, err, "Setup: could not create group file")
 
-	// Make the db package use the temporary group file
-	origGroupFile := db.GroupFile()
-	db.SetGroupFile(groupsFilePath)
-	t.Cleanup(func() { db.SetGroupFile(origGroupFile) })
+	// Make the localentries package use the test group file.
+	groupsFilePath = localgrouptestutils.SetupGroupMock(t, groupsFilePath)
 
 	// Make the userutils package to use test locking for the group file
-	userslocking.Z_ForTests_OverrideLocking()
-	t.Cleanup(userslocking.Z_ForTests_RestoreLocking)
+	userslocking.Z_ForTests_OverrideLockingWithCleanup(t)
 
 	// Run the migrations
 	m, err := db.New(dbDir)
@@ -233,22 +214,14 @@ func TestMigrationToLowercaseUserAndGroupNamesAlreadyUpdated(t *testing.T) {
 
 	golden.CheckOrUpdate(t, dbContent, golden.WithPath("db"))
 
-	// Check the content of the user group file
-	userGroupContent, err := os.ReadFile(groupsFilePath)
-	require.NoError(t, err)
-
-	golden.CheckOrUpdate(t, string(userGroupContent), golden.WithPath("groups"))
-
-	// Check the content of the backup group file
-	_, err = os.Stat(db.GroupFileBackupPath())
-	require.ErrorIs(t, err, os.ErrNotExist, "No backup should exist")
+	require.NoFileExists(t, groupsFilePath, "No new group file should have been created")
 }
 
 func TestMigrationToLowercaseUserAndGroupNamesWithSymlinkedGroupFile(t *testing.T) {
 	// Create a database from the testdata
 	dbDir := t.TempDir()
-	dbFile := "one_users_multiple_groups_with_uppercase.db.yaml"
-	err := db.Z_ForTests_CreateDBFromYAML(filepath.Join("testdata", dbFile), dbDir)
+	sqlDump := "TestMigrationToLowercaseUserAndGroupNames/one_users_multiple_groups_with_uppercase.sql"
+	err := db.Z_ForTests_CreateDBFromDump(filepath.Join("testdata", sqlDump), dbDir)
 	require.NoError(t, err, "Setup: could not create database from testdata")
 
 	// Create a temporary user group file for testing
@@ -260,14 +233,12 @@ func TestMigrationToLowercaseUserAndGroupNamesWithSymlinkedGroupFile(t *testing.
 	err = os.Symlink(realGroupsPath, groupsFilePath)
 	require.NoError(t, err, "Setup: could not symlink group file")
 
-	// Make the db package use the temporary group file
-	origGroupFile := db.GroupFile()
-	db.SetGroupFile(groupsFilePath)
-	t.Cleanup(func() { db.SetGroupFile(origGroupFile) })
+	// Make the localentries package use the test group file.
+	t.Cleanup(localentries.Z_ForTests_RestoreDefaultOptions)
+	localentries.Z_ForTests_SetGroupPath(groupsFilePath, groupsFilePath)
 
 	// Make the userutils package to use test locking for the group file
-	userslocking.Z_ForTests_OverrideLocking()
-	t.Cleanup(userslocking.Z_ForTests_RestoreLocking)
+	userslocking.Z_ForTests_OverrideLockingWithCleanup(t)
 
 	// Run the migrations
 	m, err := db.New(dbDir)
@@ -291,7 +262,8 @@ func TestMigrationToLowercaseUserAndGroupNamesWithSymlinkedGroupFile(t *testing.
 	golden.CheckOrUpdate(t, string(userGroupContent), golden.WithPath("groups"))
 
 	// Check the content of the backup group file
-	usersGroupBackupContent, err := os.ReadFile(db.GroupFileBackupPath())
+	backupFilePath := groupsFilePath + "-"
+	usersGroupBackupContent, err := os.ReadFile(backupFilePath)
 	require.NoError(t, err)
 	golden.CheckOrUpdate(t, string(usersGroupBackupContent), golden.WithPath("groups-backup"))
 }
@@ -299,8 +271,8 @@ func TestMigrationToLowercaseUserAndGroupNamesWithSymlinkedGroupFile(t *testing.
 func TestMigrationToLowercaseUserAndGroupNamesWithPreviousBackup(t *testing.T) {
 	// Create a database from the testdata
 	dbDir := t.TempDir()
-	dbFile := "one_users_multiple_groups_fully_uppercase.db.yaml"
-	err := db.Z_ForTests_CreateDBFromYAML(filepath.Join("testdata", dbFile), dbDir)
+	sqlDump := "TestMigrationToLowercaseUserAndGroupNames/one_users_multiple_groups_fully_uppercase.sql"
+	err := db.Z_ForTests_CreateDBFromDump(filepath.Join("testdata", sqlDump), dbDir)
 	require.NoError(t, err, "Setup: could not create database from testdata")
 
 	// Create a temporary user group file for testing
@@ -309,18 +281,17 @@ func TestMigrationToLowercaseUserAndGroupNamesWithPreviousBackup(t *testing.T) {
 	err = os.WriteFile(groupsFilePath, originalGroupFileContents, 0600)
 	require.NoError(t, err, "Setup: could not create group file")
 
-	// Make the db package use the temporary group file
-	origGroupFile := db.GroupFile()
-	db.SetGroupFile(groupsFilePath)
-	t.Cleanup(func() { db.SetGroupFile(origGroupFile) })
+	// Make the localentries package use the test group file.
+	t.Cleanup(localentries.Z_ForTests_RestoreDefaultOptions)
+	localentries.Z_ForTests_SetGroupPath(groupsFilePath, groupsFilePath)
 
+	backupFilePath := groupsFilePath + "-"
 	// Create a temporary user group file backup for testing
-	err = os.WriteFile(db.GroupFileBackupPath(), []byte("LocalTestGroup:x:12345:TestUserBackup\n"), 0600)
+	err = os.WriteFile(backupFilePath, []byte("LocalTestGroup:x:12345:TestUserBackup\n"), 0600)
 	require.NoError(t, err, "Setup: could not create group file")
 
 	// Make the userutils package to use test locking for the group file
-	userslocking.Z_ForTests_OverrideLocking()
-	t.Cleanup(userslocking.Z_ForTests_RestoreLocking)
+	userslocking.Z_ForTests_OverrideLockingWithCleanup(t)
 
 	// Run the migrations
 	m, err := db.New(dbDir)
@@ -333,13 +304,13 @@ func TestMigrationToLowercaseUserAndGroupNamesWithPreviousBackup(t *testing.T) {
 	golden.CheckOrUpdate(t, dbContent, golden.WithPath("db"))
 
 	// Check the content of the user group file
-	userGroupContent, err := os.ReadFile(db.GroupFile())
+	userGroupContent, err := os.ReadFile(groupsFilePath)
 	require.NoError(t, err)
 
 	golden.CheckOrUpdate(t, string(userGroupContent), golden.WithPath("groups"))
 
 	// Check the content of the backup group file
-	userGroupBackupContent, err := os.ReadFile(db.GroupFileBackupPath())
+	userGroupBackupContent, err := os.ReadFile(backupFilePath)
 	require.NoError(t, err)
 	golden.CheckOrUpdate(t, string(userGroupBackupContent), golden.WithPath("groups-backup"))
 }
@@ -347,8 +318,8 @@ func TestMigrationToLowercaseUserAndGroupNamesWithPreviousBackup(t *testing.T) {
 func TestMigrationToLowercaseUserAndGroupNamesWithSymlinkedPreviousBackup(t *testing.T) {
 	// Create a database from the testdata
 	dbDir := t.TempDir()
-	dbFile := "one_users_multiple_groups_fully_uppercase.db.yaml"
-	err := db.Z_ForTests_CreateDBFromYAML(filepath.Join("testdata", dbFile), dbDir)
+	sqlDump := "TestMigrationToLowercaseUserAndGroupNames/one_users_multiple_groups_fully_uppercase.sql"
+	err := db.Z_ForTests_CreateDBFromDump(filepath.Join("testdata", sqlDump), dbDir)
 	require.NoError(t, err, "Setup: could not create database from testdata")
 
 	// Create a temporary user group file for testing
@@ -357,10 +328,9 @@ func TestMigrationToLowercaseUserAndGroupNamesWithSymlinkedPreviousBackup(t *tes
 	err = os.WriteFile(groupsFilePath, originalGroupFileContents, 0600)
 	require.NoError(t, err, "Setup: could not create group file")
 
-	// Make the db package use the temporary group file
-	origGroupFile := db.GroupFile()
-	db.SetGroupFile(groupsFilePath)
-	t.Cleanup(func() { db.SetGroupFile(origGroupFile) })
+	// Make the localentries package use the test group file.
+	t.Cleanup(localentries.Z_ForTests_RestoreDefaultOptions)
+	localentries.Z_ForTests_SetGroupPath(groupsFilePath, groupsFilePath)
 
 	// Create a temporary user group file backup for testing
 	realGroupsBackup := filepath.Join(t.TempDir(), "groups-backup")
@@ -368,12 +338,12 @@ func TestMigrationToLowercaseUserAndGroupNamesWithSymlinkedPreviousBackup(t *tes
 	require.NoError(t, err, "Setup: could not create group file")
 
 	// Symlink it to the backup path
-	err = os.Symlink(realGroupsBackup, db.GroupFileBackupPath())
+	backupFilePath := groupsFilePath + "-"
+	err = os.Symlink(realGroupsBackup, backupFilePath)
 	require.NoError(t, err, "Setup: could not create group file backup symlink")
 
 	// Make the userutils package to use test locking for the group file
-	userslocking.Z_ForTests_OverrideLocking()
-	t.Cleanup(userslocking.Z_ForTests_RestoreLocking)
+	userslocking.Z_ForTests_OverrideLockingWithCleanup(t)
 
 	// Run the migrations
 	m, err := db.New(dbDir)
@@ -386,18 +356,18 @@ func TestMigrationToLowercaseUserAndGroupNamesWithSymlinkedPreviousBackup(t *tes
 	golden.CheckOrUpdate(t, dbContent, golden.WithPath("db"))
 
 	// Check the content of the user group file
-	userGroupContent, err := os.ReadFile(db.GroupFile())
+	userGroupContent, err := os.ReadFile(groupsFilePath)
 	require.NoError(t, err)
 
 	golden.CheckOrUpdate(t, string(userGroupContent), golden.WithPath("groups"))
 
 	// Ensure the backup is not anymore a symlink
-	fi, err := os.Lstat(db.GroupFileBackupPath())
+	fi, err := os.Lstat(backupFilePath)
 	require.NoError(t, err)
 	require.Zero(t, fi.Mode()&os.ModeSymlink, "Group file backup must not be a symlink")
 
 	// Check the content of the backup group file
-	userGroupBackupContent, err := os.ReadFile(db.GroupFileBackupPath())
+	userGroupBackupContent, err := os.ReadFile(backupFilePath)
 	require.NoError(t, err)
 	golden.CheckOrUpdate(t, string(userGroupBackupContent), golden.WithPath("groups-backup"))
 }
@@ -405,8 +375,8 @@ func TestMigrationToLowercaseUserAndGroupNamesWithSymlinkedPreviousBackup(t *tes
 func TestMigrationToLowercaseUserAndGroupNamesFails(t *testing.T) {
 	// Create a database from the testdata
 	dbDir := t.TempDir()
-	dbFile := "one_users_multiple_groups_fully_uppercase.db.yaml"
-	err := db.Z_ForTests_CreateDBFromYAML(filepath.Join("testdata", dbFile), dbDir)
+	sqlDump := "TestMigrationToLowercaseUserAndGroupNames/one_users_multiple_groups_fully_uppercase.sql"
+	err := db.Z_ForTests_CreateDBFromDump(filepath.Join("testdata", sqlDump), dbDir)
 	require.NoError(t, err, "Setup: could not create database from testdata")
 
 	// Create a temporary user group file for testing
@@ -418,25 +388,23 @@ func TestMigrationToLowercaseUserAndGroupNamesFails(t *testing.T) {
 	err = os.Chmod(groupsFilePath, 0000)
 	require.NoError(t, err, "Setup: setting chmod to %q", groupsFilePath)
 
-	// Make the db package use the temporary group file
-	origGroupFile := db.GroupFile()
-	db.SetGroupFile(groupsFilePath)
-	t.Cleanup(func() { db.SetGroupFile(origGroupFile) })
+	// Make the localentries package use the test group file.
+	t.Cleanup(localentries.Z_ForTests_RestoreDefaultOptions)
+	localentries.Z_ForTests_SetGroupPath(groupsFilePath, groupsFilePath)
 
 	// Make the userutils package to use test locking for the group file
-	userslocking.Z_ForTests_OverrideLocking()
-	t.Cleanup(userslocking.Z_ForTests_RestoreLocking)
+	userslocking.Z_ForTests_OverrideLockingWithCleanup(t)
 
 	// Run the migrations
 	m, err := db.New(dbDir)
 	require.Error(t, err, "Updating db fails")
 	require.Nil(t, m, "Db should be unset")
 
-	err = os.Chmod(db.GroupFile(), 0600)
-	require.NoError(t, err, "Setup: setting chmod to %q", db.GroupFile())
+	err = os.Chmod(groupsFilePath, 0600)
+	require.NoError(t, err, "Setup: setting chmod to %q", groupsFilePath)
 
 	// Check the content of the user group file
-	userGroupContent, err := os.ReadFile(db.GroupFile())
+	userGroupContent, err := os.ReadFile(groupsFilePath)
 	require.NoError(t, err)
 
 	golden.CheckOrUpdate(t, string(userGroupContent), golden.WithPath("groups"))
@@ -445,8 +413,8 @@ func TestMigrationToLowercaseUserAndGroupNamesFails(t *testing.T) {
 func TestMigrationToLowercaseUserAndGroupNamesWithBackupFailure(t *testing.T) {
 	// Create a database from the testdata
 	dbDir := t.TempDir()
-	dbFile := "one_users_multiple_groups_with_uppercase.db.yaml"
-	err := db.Z_ForTests_CreateDBFromYAML(filepath.Join("testdata", dbFile), dbDir)
+	sqlDump := "TestMigrationToLowercaseUserAndGroupNames/one_users_multiple_groups_with_uppercase.sql"
+	err := db.Z_ForTests_CreateDBFromDump(filepath.Join("testdata", sqlDump), dbDir)
 	require.NoError(t, err, "Setup: could not create database from testdata")
 
 	// Create a temporary user group file for testing
@@ -454,22 +422,21 @@ func TestMigrationToLowercaseUserAndGroupNamesWithBackupFailure(t *testing.T) {
 	err = os.WriteFile(groupsFilePath, []byte("LocalTestGroup:x:12345:TestUser\n"), 0600)
 	require.NoError(t, err, "Setup: could not create group file")
 
-	// Make the db package use the temporary group file
-	origGroupFile := db.GroupFile()
-	db.SetGroupFile(groupsFilePath)
-	t.Cleanup(func() { db.SetGroupFile(origGroupFile) })
+	// Make the localentries package use the test group file.
+	t.Cleanup(localentries.Z_ForTests_RestoreDefaultOptions)
+	localentries.Z_ForTests_SetGroupPath(groupsFilePath, groupsFilePath)
 
 	// To trigger all the errors we should handle, we create a non-empty
 	// directory as backup file. So that we cannot copy or remove it.
-	err = os.Mkdir(db.GroupFileBackupPath(), 0700)
-	require.NoError(t, err, "Setup: creating directory %q", db.GroupFileBackupPath())
+	backupFilePath := groupsFilePath + "-"
+	err = os.Mkdir(backupFilePath, 0700)
+	require.NoError(t, err, "Setup: creating directory %q", backupFilePath)
 
-	err = fileutils.Touch(filepath.Join(db.GroupFileBackupPath(), "a-file"))
-	require.NoError(t, err, "Setup: touching a file in %q", db.GroupFileBackupPath())
+	err = fileutils.Touch(filepath.Join(backupFilePath, "a-file"))
+	require.NoError(t, err, "Setup: touching a file in %q", backupFilePath)
 
 	// Make the userutils package to use test locking for the group file
-	userslocking.Z_ForTests_OverrideLocking()
-	t.Cleanup(userslocking.Z_ForTests_RestoreLocking)
+	userslocking.Z_ForTests_OverrideLockingWithCleanup(t)
 
 	// Run the migrations
 	m, err := db.New(dbDir)
@@ -488,6 +455,24 @@ func TestMigrationToLowercaseUserAndGroupNamesWithBackupFailure(t *testing.T) {
 	golden.CheckOrUpdate(t, string(userGroupContent), golden.WithPath("groups"))
 }
 
+func TestMigrationAddLockedColumnToUsersTable(t *testing.T) {
+	// Create a database from the testdata
+	dbDir := t.TempDir()
+	sqlDump := "TestMigrationAddLockedColumnToUsersTable/one_user_and_group_without_locked_column.sql"
+	err := db.Z_ForTests_CreateDBFromDump(filepath.Join("testdata", sqlDump), dbDir)
+	require.NoError(t, err, "Setup: could not create database from testdata")
+
+	// Run the migrations
+	m, err := db.New(dbDir)
+	require.NoError(t, err)
+
+	// Check the content of the SQLite database
+	dbContent, err := db.Z_ForTests_DumpNormalizedYAML(m)
+	require.NoError(t, err)
+
+	golden.CheckOrUpdate(t, dbContent)
+}
+
 func TestUpdateUserEntry(t *testing.T) {
 	t.Parallel()
 
@@ -533,13 +518,6 @@ func TestUpdateUserEntry(t *testing.T) {
 			Dir:   "/home/user1",
 			Shell: "/bin/bash",
 		},
-		"user1-with-capitalization": {
-			Name:  "User1",
-			UID:   1111,
-			Gecos: "User1 gecos\nOn multiple lines",
-			Dir:   "/home/user1",
-			Shell: "/bin/bash",
-		},
 		"user3": {
 			Name:  "user3",
 			UID:   3333,
@@ -577,7 +555,6 @@ func TestUpdateUserEntry(t *testing.T) {
 		"Update_user_does_not_change_homedir_if_it_exists":        {userCase: "user1-new-homedir", dbFile: "one_user_and_group"},
 		"Update_user_does_not_change_shell_if_it_exists":          {userCase: "user1-new-shell", dbFile: "one_user_and_group"},
 		"Update_user_by_removing_optional_gecos_field_if_not_set": {userCase: "user1-without-gecos", dbFile: "one_user_and_group"},
-		"Updating_user_with_different_capitalization":             {userCase: "user1-with-capitalization", dbFile: "one_user_and_group"},
 
 		// Group updates
 		"Update_user_by_adding_a_new_group":         {groupCases: []string{"group1", "group2"}, dbFile: "one_user_and_group"},
@@ -875,6 +852,167 @@ func TestUpdateBrokerForUser(t *testing.T) {
 	require.Error(t, err, "UpdateBrokerForUser for a nonexistent user should return an error")
 }
 
+func TestUpdateLockedFieldForUser(t *testing.T) {
+	t.Parallel()
+
+	c := initDB(t, "one_user_and_group")
+
+	// Update broker for existent user
+	err := c.UpdateLockedFieldForUser("user1", true)
+	require.NoError(t, err, "UpdateLockedFieldForUser for an existent user should not return an error")
+
+	// Error when updating broker for nonexistent user
+	err = c.UpdateLockedFieldForUser("nonexistent", false)
+	require.Error(t, err, "UpdateLockedFieldForUser for a nonexistent user should return an error")
+}
+
+func TestSetUserID(t *testing.T) {
+	t.Parallel()
+
+	tests := map[string]struct {
+		nonExistentUser bool
+		uidAlreadyInUse bool
+		uidAlreadySet   bool
+
+		wantErr         bool
+		wantErrType     error
+		wantUnchangedDB bool
+	}{
+		"Set_user_id_for_existing_user": {},
+		"No_op_if_uid_is_already_set":   {uidAlreadySet: true, wantUnchangedDB: true},
+
+		"Error_on_nonexistent_user":   {nonExistentUser: true, wantErrType: db.NoDataFoundError{}},
+		"Error_if_uid_already_in_use": {uidAlreadyInUse: true, wantErr: true},
+	}
+	for name, tc := range tests {
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			m := initDB(t, "multiple_users_and_groups")
+
+			username := "user1"
+			if tc.nonExistentUser {
+				username = "nonexistent"
+			}
+
+			var newUID uint32 = 1234
+			if tc.uidAlreadyInUse {
+				newUID = 2222
+			}
+			if tc.uidAlreadySet {
+				newUID = 1111
+			}
+
+			var oldDBContent string
+			var err error
+			if tc.wantUnchangedDB {
+				oldDBContent, err = db.Z_ForTests_DumpNormalizedYAML(m)
+				require.NoError(t, err)
+			}
+
+			err = m.SetUserID(username, newUID)
+			log.Infof(context.Background(), "SetUserID error: %v", err)
+
+			if tc.wantErrType != nil {
+				require.ErrorIs(t, err, tc.wantErrType, "SetUserID should return expected error")
+				return
+			}
+			if tc.wantErr {
+				require.Error(t, err, "SetUserID should return an error but didn't")
+				return
+			}
+			require.NoError(t, err, "SetUserID should not return an error on existing user")
+
+			dbContent, err := db.Z_ForTests_DumpNormalizedYAML(m)
+			require.NoError(t, err)
+
+			if tc.wantUnchangedDB {
+				require.Equal(t, oldDBContent, dbContent, "SetUserID should not change the database content")
+				return
+			}
+
+			golden.CheckOrUpdate(t, dbContent)
+		})
+	}
+}
+
+func TestSetGroupID(t *testing.T) {
+	t.Parallel()
+
+	tests := map[string]struct {
+		nonExistentGroup bool
+		gidAlreadyInUse  bool
+		gidAlreadySet    bool
+
+		wantErr         bool
+		wantErrType     error
+		wantUnchangedDB bool
+	}{
+		"Set_group_id_for_existing_group": {},
+		"No_op_if_gid_is_already_set":     {gidAlreadySet: true, wantUnchangedDB: true},
+
+		"Error_on_nonexistent_group":  {nonExistentGroup: true, wantErrType: db.NoDataFoundError{}},
+		"Error_if_gid_already_in_use": {gidAlreadyInUse: true, wantErr: true},
+	}
+	for name, tc := range tests {
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			m := initDB(t, "multiple_users_and_groups")
+
+			groupName := "group1"
+			if tc.nonExistentGroup {
+				groupName = "nonexistent"
+			}
+
+			var newGID uint32 = 12345
+			if tc.gidAlreadyInUse {
+				newGID = 22222 // gid used by group2 in test data
+			}
+			if tc.gidAlreadySet {
+				newGID = 11111 // current gid of group1 in test data
+			}
+
+			var oldDBContent string
+			var err error
+			if tc.wantUnchangedDB {
+				oldDBContent, err = db.Z_ForTests_DumpNormalizedYAML(m)
+				require.NoError(t, err)
+			}
+
+			users, err := m.SetGroupID(groupName, newGID)
+			log.Infof(context.Background(), "SetGroupID error: %v", err)
+
+			if tc.wantErrType != nil {
+				require.ErrorIs(t, err, tc.wantErrType, "SetGroupID should return expected error")
+				return
+			}
+			if tc.wantErr {
+				require.Error(t, err, "SetGroupID should return an error but didn't")
+				return
+			}
+			require.NoError(t, err, "SetGroupID should not return an error on existing group")
+
+			// Check the returned users list
+			if tc.gidAlreadySet {
+				require.Nil(t, users, "SetGroupID should return nil users list if gid was already set")
+			} else {
+				require.Len(t, users, 1, "SetGroupID should return a non-empty users list")
+			}
+
+			dbContent, err := db.Z_ForTests_DumpNormalizedYAML(m)
+			require.NoError(t, err)
+
+			if tc.wantUnchangedDB {
+				require.Equal(t, oldDBContent, dbContent, "SetGroupID should not change the database content")
+				return
+			}
+
+			golden.CheckOrUpdate(t, dbContent)
+		})
+	}
+}
+
 func TestRemoveDb(t *testing.T) {
 	t.Parallel()
 
@@ -928,6 +1066,55 @@ func TestDeleteUser(t *testing.T) {
 	}
 }
 
+// TestBackwardCompatibilityAndMigrations covers loading legacy schemas (e.g., v2 with INT ugid)
+// and migrating older schemas (e.g., v1 without 'locked' column) to the latest schema.
+func TestBackwardCompatibilityAndMigrations(t *testing.T) {
+	t.Parallel()
+
+	tests := map[string]struct {
+		dump string
+	}{
+		"SchemaV2_IntUGID":        {dump: filepath.Join("testdata", "TestLoadSchemaV2WithIntUGID", "one_user_and_group_v2.sql")},
+		"SchemaV1_NoLockedColumn": {dump: filepath.Join("testdata", "TestMigrationAddLockedColumnToUsersTable", "one_user_and_group_without_locked_column.sql")},
+	}
+
+	for name, tc := range tests {
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			tempDir := t.TempDir()
+
+			err := db.Z_ForTests_CreateDBFromDump(tc.dump, tempDir)
+			require.NoError(t, err, "Setup: could not create database from dump")
+
+			// Open using current manager, it'll trigger a migration depending on schema_version.
+			m, err := db.New(tempDir)
+			require.NoError(t, err, "Setup: could not open manager for database")
+			t.Cleanup(func() { _ = m.Close() })
+
+			// Validate user can be read and that locked is false (either set or default).
+			u, err := m.UserByID(1111)
+			require.NoError(t, err, "Should read user from DB")
+			require.Equal(t, "user1", u.Name)
+			require.EqualValues(t, 11111, u.GID)
+			require.False(t, u.Locked, "locked should be false in both old and migrated schemas")
+
+			// Validate group and members. ugid should read as string regardless of underlying type.
+			g, err := m.GroupWithMembersByID(11111)
+			require.NoError(t, err, "Should read group from DB")
+			require.Equal(t, "group1", g.Name)
+			require.Equal(t, "12345678", g.UGID)
+			require.Len(t, g.Users, 1)
+			require.Equal(t, "user1", g.Users[0])
+
+			// Also ensure lookup by UGID works with string input.
+			gByUGID, err := m.GroupByUGID("12345678")
+			require.NoError(t, err)
+			require.EqualValues(t, 11111, gByUGID.GID)
+		})
+	}
+}
+
 // initDB returns a new database ready to be used alongside its database directory.
 func initDB(t *testing.T, dbFile string) *db.Manager {
 	t.Helper()
diff --git a/internal/users/db/export_test.go b/internal/users/db/export_test.go
index 6c0350243b..932ad0928f 100644
--- a/internal/users/db/export_test.go
+++ b/internal/users/db/export_test.go
@@ -5,21 +5,6 @@ func (m *Manager) Path() string {
 	return m.path
 }
 
-// GroupFile exposes the path to the group file for testing.
-func GroupFile() string {
-	return groupFile
-}
-
-// GroupFileBackupPath exposes the path to the group file backup for testing.
-func GroupFileBackupPath() string {
-	return groupFileBackupPath()
-}
-
-// SetGroupFile sets the path to the group file for testing.
-func SetGroupFile(path string) {
-	groupFile = path
-}
-
 // GetCreateSchemaQuery exposes the query to create the schema for testing.
 func GetCreateSchemaQuery() string {
 	return createSchemaQuery
diff --git a/internal/users/db/groups.go b/internal/users/db/groups.go
index ba0278e3ac..0382e6f1dd 100644
--- a/internal/users/db/groups.go
+++ b/internal/users/db/groups.go
@@ -4,7 +4,6 @@ import (
 	"database/sql"
 	"errors"
 	"fmt"
-	"strconv"
 )
 
 // GroupRow represents a group in the database.
@@ -46,7 +45,7 @@ func groupByID(db queryable, gid uint32) (GroupRow, error) {
 	var g GroupRow
 	err := row.Scan(&g.Name, &g.GID, &g.UGID)
 	if errors.Is(err, sql.ErrNoRows) {
-		return GroupRow{}, NoDataFoundError{key: strconv.FormatUint(uint64(gid), 10), table: "groups"}
+		return GroupRow{}, NewGIDNotFoundError(gid)
 	}
 	if err != nil {
 		return GroupRow{}, fmt.Errorf("query error: %w", err)
@@ -93,7 +92,7 @@ func groupByName(db queryable, name string) (GroupRow, error) {
 	var g GroupRow
 	err := row.Scan(&g.Name, &g.GID, &g.UGID)
 	if errors.Is(err, sql.ErrNoRows) {
-		return GroupRow{}, NoDataFoundError{key: name, table: "groups"}
+		return GroupRow{}, NewGroupNotFoundError(name)
 	}
 	if err != nil {
 		return GroupRow{}, fmt.Errorf("query error: %w", err)
@@ -140,7 +139,7 @@ func groupByUGID(db queryable, ugid string) (GroupRow, error) {
 	var g GroupRow
 	err := row.Scan(&g.Name, &g.GID, &g.UGID)
 	if errors.Is(err, sql.ErrNoRows) {
-		return GroupRow{}, NoDataFoundError{key: ugid, table: "groups"}
+		return GroupRow{}, NewGroupNotFoundError(ugid)
 	}
 	if err != nil {
 		return GroupRow{}, fmt.Errorf("query error: %w", err)
diff --git a/internal/users/db/migration.go b/internal/users/db/migration.go
index 91d2d21f16..5d70ac8bd6 100644
--- a/internal/users/db/migration.go
+++ b/internal/users/db/migration.go
@@ -4,21 +4,14 @@ import (
 	"context"
 	"errors"
 	"fmt"
-	"io/fs"
-	"os"
-	"path/filepath"
-	"slices"
 	"strings"
 
-	"github.com/ubuntu/authd/internal/fileutils"
-	"github.com/ubuntu/authd/internal/users/db/bbolt"
-	"github.com/ubuntu/authd/internal/users/localentries"
-	userslocking "github.com/ubuntu/authd/internal/users/locking"
-	"github.com/ubuntu/authd/log"
+	"github.com/canonical/authd/internal/decorate"
+	"github.com/canonical/authd/internal/users/db/bbolt"
+	"github.com/canonical/authd/internal/users/localentries"
+	"github.com/canonical/authd/log"
 )
 
-var groupFile = localentries.GroupFile
-
 // MigrateFromBBoltToSQLite migrates data from bbolt to SQLite.
 func MigrateFromBBoltToSQLite(dbDir string) error {
 	m, err := New(dbDir)
@@ -178,20 +171,25 @@ var schemaMigrations = []schemaMigration{
 				err = commitOrRollBackTransaction(err, tx)
 			}()
 
-			users, err := allUsers(tx)
+			rows, err := tx.Query(`SELECT name FROM users`)
 			if err != nil {
 				return fmt.Errorf("failed to get users from database: %w", err)
 			}
+			defer rows.Close()
 
 			var oldNames, newNames []string
-			for _, u := range users {
-				oldNames = append(oldNames, u.Name)
-				newNames = append(newNames, strings.ToLower(u.Name))
+			for rows.Next() {
+				var name string
+				if err := rows.Scan(&name); err != nil {
+					return fmt.Errorf("failed to scan user name: %w", err)
+				}
+				oldNames = append(oldNames, name)
+				newNames = append(newNames, strings.ToLower(name))
 			}
 
 			if err := renameUsersInGroupFile(oldNames, newNames); err != nil {
 				return fmt.Errorf("failed to rename users in %s file: %w",
-					groupFile, err)
+					localentries.GroupFile, err)
 			}
 
 			// Delete groups that would cause unique constraint violations
@@ -206,6 +204,40 @@ var schemaMigrations = []schemaMigration{
 			return err
 		},
 	},
+	{
+		description: "Add column 'locked' to users table",
+		migrate: func(m *Manager) error {
+			// Start a transaction to ensure atomicity
+			tx, err := m.db.Begin()
+			if err != nil {
+				return fmt.Errorf("failed to start transaction: %w", err)
+			}
+
+			// Ensure the transaction is committed or rolled back
+			defer func() {
+				err = commitOrRollBackTransaction(err, tx)
+			}()
+
+			// Check if the 'locked' column already exists
+			var exists bool
+			err = tx.QueryRow("SELECT EXISTS(SELECT 1 FROM pragma_table_info('users') WHERE name = 'locked')").Scan(&exists)
+			if err != nil {
+				return fmt.Errorf("failed to check if 'locked' column exists: %w", err)
+			}
+			if exists {
+				log.Debug(context.Background(), "'locked' column already exists in users table, skipping migration")
+				return nil
+			}
+
+			// Add the 'locked' column to the users table
+			_, err = tx.Exec("ALTER TABLE users ADD COLUMN locked BOOLEAN DEFAULT FALSE")
+			if err != nil {
+				return fmt.Errorf("failed to add 'locked' column to users table: %w", err)
+			}
+
+			return nil
+		},
+	},
 }
 
 func (m *Manager) maybeApplyMigrations() error {
@@ -242,17 +274,12 @@ func (m *Manager) maybeApplyMigrations() error {
 	return nil
 }
 
-func groupFileTemporaryPath() string {
-	return fmt.Sprintf("%s+", groupFile)
-}
-
-func groupFileBackupPath() string {
-	return fmt.Sprintf("%s-", groupFile)
-}
-
 // renameUsersInGroupFile renames users in the /etc/group file.
-func renameUsersInGroupFile(oldNames, newNames []string) error {
-	log.Debugf(context.Background(), "Renaming users in %q: %v -> %v", groupFile,
+func renameUsersInGroupFile(oldNames, newNames []string) (err error) {
+	decorate.OnError(&err, "failed to rename users in local groups: %v -> %v",
+		oldNames, newNames)
+
+	log.Debugf(context.Background(), "Renaming users in local groups: %v -> %v",
 		oldNames, newNames)
 
 	if len(oldNames) == 0 && len(newNames) == 0 {
@@ -260,106 +287,27 @@ func renameUsersInGroupFile(oldNames, newNames []string) error {
 		return nil
 	}
 
-	// Note that we can't use gpasswd here because `gpasswd --add` checks for the existence of the user, which causes an
-	// NSS request to be sent to authd, but authd is not ready yet because we are still migrating the database.
-	err := userslocking.WriteLock()
+	entries, entriesUnlock, err := localentries.WithUserDBLock()
 	if err != nil {
-		return fmt.Errorf("failed to lock group file: %w", err)
+		return err
 	}
-	defer func() {
-		if err := userslocking.WriteUnlock(); err != nil {
-			log.Warningf(context.Background(), "Failed to unlock group file: %v", err)
-		}
-	}()
+	defer func() { err = errors.Join(err, entriesUnlock()) }()
 
-	content, err := os.ReadFile(groupFile)
+	groups, err := localentries.GetGroupEntries(entries)
 	if err != nil {
-		return fmt.Errorf("error reading %s: %w", groupFile, err)
+		return err
 	}
-
-	oldLines := strings.Split(string(content), "\n")
-	var newLines []string
-
-	for _, line := range oldLines {
-		if line == "" {
-			continue
-		}
-
-		fields := strings.SplitN(line, ":", 4)
-		if len(fields) != 4 {
-			return fmt.Errorf("unexpected number of fields in %s line (expected 4, got %d): %s",
-				groupFile, len(fields), line)
-		}
-
-		users := strings.Split(fields[3], ",")
-		for j, user := range users {
+	for idx, group := range groups {
+		for j, user := range group.Users {
 			for k, oldName := range oldNames {
 				if user == oldName {
-					users[j] = newNames[k]
+					groups[idx].Users[j] = newNames[k]
 				}
 			}
 		}
-
-		fields[3] = strings.Join(users, ",")
-		newLines = append(newLines, strings.Join(fields, ":"))
-	}
-
-	// Add final new line to the group file.
-	newLines = append(newLines, "")
-
-	if slices.Compare(oldLines, newLines) == 0 {
-		return nil
-	}
-
-	backupPath := groupFileBackupPath()
-	oldBackup := ""
-
-	if tmpDir, err := os.MkdirTemp(os.TempDir(), "authd-migration-backup"); err == nil {
-		defer os.Remove(tmpDir)
-
-		b := filepath.Join(tmpDir, filepath.Base(backupPath))
-		err := fileutils.CopyFile(backupPath, b)
-		if err == nil {
-			oldBackup = b
-			defer os.Remove(oldBackup)
-		}
-		if err != nil && !errors.Is(err, os.ErrNotExist) {
-			log.Warningf(context.Background(), "Failed to create backup of %q: %v",
-				backupPath, err)
-		}
-	}
-
-	if err := os.Remove(backupPath); err != nil && !errors.Is(err, os.ErrNotExist) {
-		log.Warningf(context.Background(), "Failed to remove group file backup: %v", err)
-	}
-
-	backupAction := os.Rename
-	if fi, _ := os.Lstat(groupFile); fi != nil && fi.Mode()&fs.ModeSymlink != 0 {
-		backupAction = fileutils.CopyFile
-	}
-	if err := backupAction(groupFile, backupPath); err != nil {
-		log.Warningf(context.Background(), "Failed make a backup for the group file: %v", err)
-
-		if oldBackup != "" {
-			// Backup of current group file failed, let's restore the old backup.
-			if err := fileutils.Lrename(oldBackup, backupPath); err != nil {
-				log.Warningf(context.Background(), "Failed restoring %q to %q: %v",
-					oldBackup, backupPath, err)
-			}
-		}
-	}
-
-	tempPath := groupFileTemporaryPath()
-	//nolint:gosec // G306 /etc/group should indeed have 0644 permissions
-	if err := os.WriteFile(tempPath, []byte(strings.Join(newLines, "\n")), 0644); err != nil {
-		return fmt.Errorf("error writing %s: %w", tempPath, err)
-	}
-
-	if err := fileutils.Lrename(tempPath, groupFile); err != nil {
-		return fmt.Errorf("error renaming %s to %s: %w", tempPath, groupFile, err)
 	}
 
-	return nil
+	return localentries.SaveGroupEntries(entries, groups)
 }
 
 func removeGroupsWithNameConflicts(db queryable) error {
diff --git a/internal/users/db/sql/create_schema.sql b/internal/users/db/sql/create_schema.sql
index 35351d6d64..668fcc6b90 100644
--- a/internal/users/db/sql/create_schema.sql
+++ b/internal/users/db/sql/create_schema.sql
@@ -5,24 +5,25 @@ CREATE TABLE IF NOT EXISTS users (
     gecos     TEXT DEFAULT "",
     dir       TEXT DEFAULT "",
     shell     TEXT DEFAULT "/bin/bash",
-    broker_id TEXT DEFAULT ""
+    broker_id TEXT DEFAULT "",
+    locked    BOOLEAN DEFAULT FALSE
 );
 CREATE UNIQUE INDEX "idx_user_name" ON users ("name");
 
-CREATE TABLE IF NOT EXISTS GROUPS (
+CREATE TABLE IF NOT EXISTS groups (
     name TEXT NOT NULL,  -- Uniqueness is enforced by the index below
     gid  INT PRIMARY KEY, -- Uniqueness and not NULL is enforced by PRIMARY KEY
-    ugid INT NOT NULL    -- Uniqueness is enforced by the index below
+    ugid TEXT NOT NULL    -- Uniqueness is enforced by the index below
 );
-CREATE UNIQUE INDEX "idx_group_name" ON GROUPS ("name");
-CREATE UNIQUE INDEX "idx_group_ugid" ON GROUPS ("ugid");
+CREATE UNIQUE INDEX "idx_group_name" ON groups ("name");
+CREATE UNIQUE INDEX "idx_group_ugid" ON groups ("ugid");
 
 CREATE TABLE IF NOT EXISTS users_to_groups (
     uid INT NOT NULL,
     gid INT NOT NULL,
     PRIMARY KEY (uid, gid),
     FOREIGN KEY (uid) REFERENCES users (uid) ON DELETE CASCADE,
-    FOREIGN KEY (gid) REFERENCES GROUPS (gid) ON DELETE CASCADE
+    FOREIGN KEY (gid) REFERENCES groups (gid) ON DELETE CASCADE
 );
 
 CREATE TABLE IF NOT EXISTS users_to_local_groups (
diff --git a/internal/users/db/testdata/TestLoadSchemaV2WithIntUGID/one_user_and_group_v2.sql b/internal/users/db/testdata/TestLoadSchemaV2WithIntUGID/one_user_and_group_v2.sql
new file mode 100644
index 0000000000..9fcd97b672
--- /dev/null
+++ b/internal/users/db/testdata/TestLoadSchemaV2WithIntUGID/one_user_and_group_v2.sql
@@ -0,0 +1,54 @@
+PRAGMA foreign_keys=OFF;
+BEGIN TRANSACTION;
+CREATE TABLE IF NOT EXISTS users (
+    name      TEXT NOT NULL,
+    uid       INT PRIMARY KEY,
+    gid       INT NOT NULL,
+    gecos     TEXT DEFAULT "",
+    dir       TEXT DEFAULT "",
+    shell     TEXT DEFAULT "/bin/bash",
+    broker_id TEXT DEFAULT "",
+    locked    BOOLEAN DEFAULT FALSE
+);
+CREATE UNIQUE INDEX "idx_user_name" ON users ("name");
+
+CREATE TABLE IF NOT EXISTS GROUPS (
+    name TEXT NOT NULL,
+    gid  INT PRIMARY KEY,
+    ugid INT NOT NULL
+);
+CREATE UNIQUE INDEX "idx_group_name" ON GROUPS ("name");
+CREATE UNIQUE INDEX "idx_group_ugid" ON GROUPS ("ugid");
+
+CREATE TABLE IF NOT EXISTS users_to_groups (
+    uid INT NOT NULL,
+    gid INT NOT NULL,
+    PRIMARY KEY (uid, gid),
+    FOREIGN KEY (uid) REFERENCES users (uid) ON DELETE CASCADE,
+    FOREIGN KEY (gid) REFERENCES GROUPS (gid) ON DELETE CASCADE
+);
+
+CREATE TABLE IF NOT EXISTS users_to_local_groups (
+    uid        INT NOT NULL,
+    group_name TEXT NOT NULL,
+    PRIMARY KEY (uid, group_name),
+    FOREIGN KEY (uid) REFERENCES users (uid) ON DELETE CASCADE
+);
+
+CREATE TABLE IF NOT EXISTS schema_version (
+    version INT PRIMARY KEY
+);
+
+-- Seed data using the old schema (ugid as INT)
+INSERT INTO users (name, uid, gid, gecos, dir, shell, broker_id, locked)
+VALUES ('user1', 1111, 11111, 'User1 gecos', '/home/user1', '/bin/bash', 'broker-id', FALSE);
+
+INSERT INTO GROUPS (name, gid, ugid)
+VALUES ('group1', 11111, 12345678);
+
+INSERT INTO users_to_groups (uid, gid)
+VALUES (1111, 11111);
+
+-- Old schema v2
+INSERT INTO schema_version VALUES (2);
+COMMIT;
\ No newline at end of file
diff --git a/internal/users/db/testdata/TestMigrationAddLockedColumnToUsersTable/one_user_and_group_without_locked_column.sql b/internal/users/db/testdata/TestMigrationAddLockedColumnToUsersTable/one_user_and_group_without_locked_column.sql
new file mode 100644
index 0000000000..6272520784
--- /dev/null
+++ b/internal/users/db/testdata/TestMigrationAddLockedColumnToUsersTable/one_user_and_group_without_locked_column.sql
@@ -0,0 +1,40 @@
+PRAGMA foreign_keys=OFF;
+BEGIN TRANSACTION;
+CREATE TABLE users (
+    name      TEXT NOT NULL,  -- Uniqueness is enforced by the index below
+    uid       INT PRIMARY KEY, -- Uniqueness and not NULL is enforced by PRIMARY KEY
+    gid       INT NOT NULL,
+    gecos     TEXT DEFAULT "",
+    dir       TEXT DEFAULT "",
+    shell     TEXT DEFAULT "/bin/bash",
+    broker_id TEXT DEFAULT ""
+);
+INSERT INTO users VALUES('user1',1111,11111,replace('User1 gecos\nOn multiple lines','\n',char(10)),'/home/user1','/bin/bash','broker-id');
+CREATE TABLE GROUPS (
+    name TEXT NOT NULL,  -- Uniqueness is enforced by the index below
+    gid  INT PRIMARY KEY, -- Uniqueness and not NULL is enforced by PRIMARY KEY
+    ugid INT NOT NULL    -- Uniqueness is enforced by the index below
+);
+INSERT INTO "GROUPS" VALUES('group1',11111,12345678);
+CREATE TABLE users_to_groups (
+    uid INT NOT NULL,
+    gid INT NOT NULL,
+    PRIMARY KEY (uid, gid),
+    FOREIGN KEY (uid) REFERENCES users (uid) ON DELETE CASCADE,
+    FOREIGN KEY (gid) REFERENCES GROUPS (gid) ON DELETE CASCADE
+);
+INSERT INTO users_to_groups VALUES(1111,11111);
+CREATE TABLE users_to_local_groups (
+    uid        INT NOT NULL,
+    group_name TEXT NOT NULL,
+    PRIMARY KEY (uid, group_name),
+    FOREIGN KEY (uid) REFERENCES users (uid) ON DELETE CASCADE
+);
+CREATE TABLE schema_version (
+    version INT PRIMARY KEY
+);
+INSERT INTO schema_version VALUES(1);
+CREATE UNIQUE INDEX "idx_user_name" ON users ("name");
+CREATE UNIQUE INDEX "idx_group_name" ON GROUPS ("name");
+CREATE UNIQUE INDEX "idx_group_ugid" ON GROUPS ("ugid");
+COMMIT;
diff --git a/internal/users/db/testdata/TestMigrationToLowercaseUserAndGroupNames/one_users_multiple_groups_fully_uppercase.sql b/internal/users/db/testdata/TestMigrationToLowercaseUserAndGroupNames/one_users_multiple_groups_fully_uppercase.sql
new file mode 100644
index 0000000000..fb50c5c091
--- /dev/null
+++ b/internal/users/db/testdata/TestMigrationToLowercaseUserAndGroupNames/one_users_multiple_groups_fully_uppercase.sql
@@ -0,0 +1,42 @@
+PRAGMA foreign_keys=OFF;
+BEGIN TRANSACTION;
+CREATE TABLE users (
+    name      TEXT NOT NULL,  -- Uniqueness is enforced by the index below
+    uid       INT PRIMARY KEY, -- Uniqueness and not NULL is enforced by PRIMARY KEY
+    gid       INT NOT NULL,
+    gecos     TEXT DEFAULT "",
+    dir       TEXT DEFAULT "",
+    shell     TEXT DEFAULT "/bin/bash",
+    broker_id TEXT DEFAULT ""
+);
+INSERT INTO users VALUES('TESTUSER',1111,11111,'testuser gecos','/home/testuser','/bin/bash','broker-id');
+CREATE TABLE GROUPS (
+    name TEXT NOT NULL,  -- Uniqueness is enforced by the index below
+    gid  INT PRIMARY KEY, -- Uniqueness and not NULL is enforced by PRIMARY KEY
+    ugid INT NOT NULL    -- Uniqueness is enforced by the index below
+);
+INSERT INTO "GROUPS" VALUES('testgroup',11111,12345678);
+INSERT INTO "GROUPS" VALUES('TESTGROUP',22222,56781234);
+CREATE TABLE users_to_groups (
+    uid INT NOT NULL,
+    gid INT NOT NULL,
+    PRIMARY KEY (uid, gid),
+    FOREIGN KEY (uid) REFERENCES users (uid) ON DELETE CASCADE,
+    FOREIGN KEY (gid) REFERENCES GROUPS (gid) ON DELETE CASCADE
+);
+INSERT INTO users_to_groups VALUES(1111,11111);
+INSERT INTO users_to_groups VALUES(1111,22222);
+CREATE TABLE users_to_local_groups (
+    uid        INT NOT NULL,
+    group_name TEXT NOT NULL,
+    PRIMARY KEY (uid, group_name),
+    FOREIGN KEY (uid) REFERENCES users (uid) ON DELETE CASCADE
+);
+CREATE TABLE schema_version (
+    version INT PRIMARY KEY
+);
+INSERT INTO schema_version VALUES(0);
+CREATE UNIQUE INDEX "idx_user_name" ON users ("name");
+CREATE UNIQUE INDEX "idx_group_name" ON GROUPS ("name");
+CREATE UNIQUE INDEX "idx_group_ugid" ON GROUPS ("ugid");
+COMMIT;
diff --git a/internal/users/db/testdata/TestMigrationToLowercaseUserAndGroupNames/one_users_multiple_groups_with_uppercase.sql b/internal/users/db/testdata/TestMigrationToLowercaseUserAndGroupNames/one_users_multiple_groups_with_uppercase.sql
new file mode 100644
index 0000000000..53664d2c6a
--- /dev/null
+++ b/internal/users/db/testdata/TestMigrationToLowercaseUserAndGroupNames/one_users_multiple_groups_with_uppercase.sql
@@ -0,0 +1,42 @@
+PRAGMA foreign_keys=OFF;
+BEGIN TRANSACTION;
+CREATE TABLE users (
+    name      TEXT NOT NULL,  -- Uniqueness is enforced by the index below
+    uid       INT PRIMARY KEY, -- Uniqueness and not NULL is enforced by PRIMARY KEY
+    gid       INT NOT NULL,
+    gecos     TEXT DEFAULT "",
+    dir       TEXT DEFAULT "",
+    shell     TEXT DEFAULT "/bin/bash",
+    broker_id TEXT DEFAULT ""
+);
+INSERT INTO users VALUES('TestUser',1111,11111,'testuser gecos','/home/testuser','/bin/bash','broker-id');
+CREATE TABLE GROUPS (
+    name TEXT NOT NULL,  -- Uniqueness is enforced by the index below
+    gid  INT PRIMARY KEY, -- Uniqueness and not NULL is enforced by PRIMARY KEY
+    ugid INT NOT NULL    -- Uniqueness is enforced by the index below
+);
+INSERT INTO "GROUPS" VALUES('testgroup',11111,12345678);
+INSERT INTO "GROUPS" VALUES('TestGroup',22222,56781234);
+CREATE TABLE users_to_groups (
+    uid INT NOT NULL,
+    gid INT NOT NULL,
+    PRIMARY KEY (uid, gid),
+    FOREIGN KEY (uid) REFERENCES users (uid) ON DELETE CASCADE,
+    FOREIGN KEY (gid) REFERENCES GROUPS (gid) ON DELETE CASCADE
+);
+INSERT INTO users_to_groups VALUES(1111,11111);
+INSERT INTO users_to_groups VALUES(1111,22222);
+CREATE TABLE users_to_local_groups (
+    uid        INT NOT NULL,
+    group_name TEXT NOT NULL,
+    PRIMARY KEY (uid, group_name),
+    FOREIGN KEY (uid) REFERENCES users (uid) ON DELETE CASCADE
+);
+CREATE TABLE schema_version (
+    version INT PRIMARY KEY
+);
+INSERT INTO schema_version VALUES(0);
+CREATE UNIQUE INDEX "idx_user_name" ON users ("name");
+CREATE UNIQUE INDEX "idx_group_name" ON GROUPS ("name");
+CREATE UNIQUE INDEX "idx_group_ugid" ON GROUPS ("ugid");
+COMMIT;
diff --git a/internal/users/db/testdata/golden/TestAllUsers/Get_users_only_rely_on_valid_userByID b/internal/users/db/testdata/golden/TestAllUsers/Get_users_only_rely_on_valid_userByID
deleted file mode 100644
index 9a105be784..0000000000
--- a/internal/users/db/testdata/golden/TestAllUsers/Get_users_only_rely_on_valid_userByID
+++ /dev/null
@@ -1,38 +0,0 @@
-- name: user1
-  uid: 1111
-  gid: 11111
-  gecos: |-
-    User1 gecos
-    On multiple lines
-  dir: /home/user1
-  shell: /bin/bash
-  lastpwdchange: -1
-  maxpwdage: -1
-  pwdwarnperiod: -1
-  pwdinactivity: -1
-  minpwdage: -1
-  expirationdate: -1
-- name: user2
-  uid: 2222
-  gid: 22222
-  gecos: User2
-  dir: /home/user2
-  shell: /bin/dash
-  lastpwdchange: -1
-  maxpwdage: -1
-  pwdwarnperiod: -1
-  pwdinactivity: -1
-  minpwdage: -1
-  expirationdate: -1
-- name: user3
-  uid: 3333
-  gid: 33333
-  gecos: User3
-  dir: /home/user3
-  shell: /bin/zsh
-  lastpwdchange: -1
-  maxpwdage: -1
-  pwdwarnperiod: -1
-  pwdinactivity: -1
-  minpwdage: -1
-  expirationdate: -1
diff --git a/internal/users/db/testdata/golden/TestBrokerForUser b/internal/users/db/testdata/golden/TestBrokerForUser
deleted file mode 100644
index ffe84c0bce..0000000000
--- a/internal/users/db/testdata/golden/TestBrokerForUser
+++ /dev/null
@@ -1 +0,0 @@
-broker-id
\ No newline at end of file
diff --git a/internal/users/db/testdata/golden/TestDeleteUser/Deleting_existing_user_keeps_other_group_members_intact b/internal/users/db/testdata/golden/TestDeleteUser/Deleting_existing_user_keeps_other_group_members_intact
index d5bf84ebf8..5b781502ba 100644
--- a/internal/users/db/testdata/golden/TestDeleteUser/Deleting_existing_user_keeps_other_group_members_intact
+++ b/internal/users/db/testdata/golden/TestDeleteUser/Deleting_existing_user_keeps_other_group_members_intact
@@ -48,4 +48,4 @@ users_to_groups:
       gid: 44444
     - uid: 4444
       gid: 99999
-schema_version: 1
+schema_version: 2
diff --git a/internal/users/db/testdata/golden/TestDeleteUser/Deleting_last_user_from_a_group_keeps_the_group_record b/internal/users/db/testdata/golden/TestDeleteUser/Deleting_last_user_from_a_group_keeps_the_group_record
index 2ff9b6e1f5..bbfb783e2c 100644
--- a/internal/users/db/testdata/golden/TestDeleteUser/Deleting_last_user_from_a_group_keeps_the_group_record
+++ b/internal/users/db/testdata/golden/TestDeleteUser/Deleting_last_user_from_a_group_keeps_the_group_record
@@ -4,4 +4,4 @@ groups:
       gid: 11111
       ugid: "12345678"
 users_to_groups: []
-schema_version: 1
+schema_version: 2
diff --git a/internal/users/db/testdata/golden/TestNew/New_migrates_database_to_lowercase_usernames b/internal/users/db/testdata/golden/TestMigrationAddLockedColumnToUsersTable
similarity index 88%
rename from internal/users/db/testdata/golden/TestNew/New_migrates_database_to_lowercase_usernames
rename to internal/users/db/testdata/golden/TestMigrationAddLockedColumnToUsersTable
index 56bcad61a0..df1e19d597 100644
--- a/internal/users/db/testdata/golden/TestNew/New_migrates_database_to_lowercase_usernames
+++ b/internal/users/db/testdata/golden/TestMigrationAddLockedColumnToUsersTable
@@ -9,10 +9,10 @@ users:
       shell: /bin/bash
       broker_id: broker-id
 groups:
-    - name: Group1
+    - name: group1
       gid: 11111
       ugid: "12345678"
 users_to_groups:
     - uid: 1111
       gid: 11111
-schema_version: 1
+schema_version: 2
diff --git a/internal/users/db/testdata/golden/TestMigrationToLowercaseUserAndGroupNames/db b/internal/users/db/testdata/golden/TestMigrationToLowercaseUserAndGroupNames/db
index da365938b4..c2312b979b 100644
--- a/internal/users/db/testdata/golden/TestMigrationToLowercaseUserAndGroupNames/db
+++ b/internal/users/db/testdata/golden/TestMigrationToLowercaseUserAndGroupNames/db
@@ -13,4 +13,4 @@ groups:
 users_to_groups:
     - uid: 1111
       gid: 11111
-schema_version: 1
+schema_version: 2
diff --git a/internal/users/db/testdata/golden/TestMigrationToLowercaseUserAndGroupNames/groups-backup b/internal/users/db/testdata/golden/TestMigrationToLowercaseUserAndGroupNames/groups-backup
deleted file mode 100644
index 68df9429eb..0000000000
--- a/internal/users/db/testdata/golden/TestMigrationToLowercaseUserAndGroupNames/groups-backup
+++ /dev/null
@@ -1,4 +0,0 @@
-root:x:0:
-other-local-group:x:1234:
-other-local-group-with-users:x:4321:user-foo,user-bar
-LocalTestGroup:x:12345:TestUser
diff --git a/internal/users/db/testdata/golden/TestMigrationToLowercaseUserAndGroupNamesAlreadyUpdated/db b/internal/users/db/testdata/golden/TestMigrationToLowercaseUserAndGroupNamesAlreadyUpdated/db
index da365938b4..c2312b979b 100644
--- a/internal/users/db/testdata/golden/TestMigrationToLowercaseUserAndGroupNamesAlreadyUpdated/db
+++ b/internal/users/db/testdata/golden/TestMigrationToLowercaseUserAndGroupNamesAlreadyUpdated/db
@@ -13,4 +13,4 @@ groups:
 users_to_groups:
     - uid: 1111
       gid: 11111
-schema_version: 1
+schema_version: 2
diff --git a/internal/users/db/testdata/golden/TestMigrationToLowercaseUserAndGroupNamesAlreadyUpdated/groups b/internal/users/db/testdata/golden/TestMigrationToLowercaseUserAndGroupNamesAlreadyUpdated/groups
deleted file mode 100644
index 1e941b4c8f..0000000000
--- a/internal/users/db/testdata/golden/TestMigrationToLowercaseUserAndGroupNamesAlreadyUpdated/groups
+++ /dev/null
@@ -1 +0,0 @@
-LocalTestGroup:x:12345:testuser
diff --git a/internal/users/db/testdata/golden/TestMigrationToLowercaseUserAndGroupNamesEmptyDB/db b/internal/users/db/testdata/golden/TestMigrationToLowercaseUserAndGroupNamesEmptyDB/db
index 8bd98be48c..03de3ff950 100644
--- a/internal/users/db/testdata/golden/TestMigrationToLowercaseUserAndGroupNamesEmptyDB/db
+++ b/internal/users/db/testdata/golden/TestMigrationToLowercaseUserAndGroupNamesEmptyDB/db
@@ -1,4 +1,4 @@
 users: []
 groups: []
 users_to_groups: []
-schema_version: 1
+schema_version: 2
diff --git a/internal/users/db/testdata/golden/TestMigrationToLowercaseUserAndGroupNamesWithBackupFailure/db b/internal/users/db/testdata/golden/TestMigrationToLowercaseUserAndGroupNamesWithBackupFailure/db
index da365938b4..c2312b979b 100644
--- a/internal/users/db/testdata/golden/TestMigrationToLowercaseUserAndGroupNamesWithBackupFailure/db
+++ b/internal/users/db/testdata/golden/TestMigrationToLowercaseUserAndGroupNamesWithBackupFailure/db
@@ -13,4 +13,4 @@ groups:
 users_to_groups:
     - uid: 1111
       gid: 11111
-schema_version: 1
+schema_version: 2
diff --git a/internal/users/db/testdata/golden/TestMigrationToLowercaseUserAndGroupNamesWithPreviousBackup/db b/internal/users/db/testdata/golden/TestMigrationToLowercaseUserAndGroupNamesWithPreviousBackup/db
index da365938b4..c2312b979b 100644
--- a/internal/users/db/testdata/golden/TestMigrationToLowercaseUserAndGroupNamesWithPreviousBackup/db
+++ b/internal/users/db/testdata/golden/TestMigrationToLowercaseUserAndGroupNamesWithPreviousBackup/db
@@ -13,4 +13,4 @@ groups:
 users_to_groups:
     - uid: 1111
       gid: 11111
-schema_version: 1
+schema_version: 2
diff --git a/internal/users/db/testdata/golden/TestMigrationToLowercaseUserAndGroupNamesWithSymlinkedGroupFile/db b/internal/users/db/testdata/golden/TestMigrationToLowercaseUserAndGroupNamesWithSymlinkedGroupFile/db
index da365938b4..c2312b979b 100644
--- a/internal/users/db/testdata/golden/TestMigrationToLowercaseUserAndGroupNamesWithSymlinkedGroupFile/db
+++ b/internal/users/db/testdata/golden/TestMigrationToLowercaseUserAndGroupNamesWithSymlinkedGroupFile/db
@@ -13,4 +13,4 @@ groups:
 users_to_groups:
     - uid: 1111
       gid: 11111
-schema_version: 1
+schema_version: 2
diff --git a/internal/users/db/testdata/golden/TestMigrationToLowercaseUserAndGroupNamesWithSymlinkedPreviousBackup/db b/internal/users/db/testdata/golden/TestMigrationToLowercaseUserAndGroupNamesWithSymlinkedPreviousBackup/db
index da365938b4..c2312b979b 100644
--- a/internal/users/db/testdata/golden/TestMigrationToLowercaseUserAndGroupNamesWithSymlinkedPreviousBackup/db
+++ b/internal/users/db/testdata/golden/TestMigrationToLowercaseUserAndGroupNamesWithSymlinkedPreviousBackup/db
@@ -13,4 +13,4 @@ groups:
 users_to_groups:
     - uid: 1111
       gid: 11111
-schema_version: 1
+schema_version: 2
diff --git a/internal/users/db/testdata/golden/TestNew/New_with_already_existing_database b/internal/users/db/testdata/golden/TestNew/New_with_already_existing_database
index 9a59a4ead0..9c042d2317 100644
--- a/internal/users/db/testdata/golden/TestNew/New_with_already_existing_database
+++ b/internal/users/db/testdata/golden/TestNew/New_with_already_existing_database
@@ -61,4 +61,4 @@ users_to_groups:
       gid: 44444
     - uid: 4444
       gid: 99999
-schema_version: 1
+schema_version: 2
diff --git a/internal/users/db/testdata/golden/TestNew/New_without_any_initialized_database b/internal/users/db/testdata/golden/TestNew/New_without_any_initialized_database
index 8bd98be48c..03de3ff950 100644
--- a/internal/users/db/testdata/golden/TestNew/New_without_any_initialized_database
+++ b/internal/users/db/testdata/golden/TestNew/New_without_any_initialized_database
@@ -1,4 +1,4 @@
 users: []
 groups: []
 users_to_groups: []
-schema_version: 1
+schema_version: 2
diff --git a/internal/users/db/testdata/golden/TestSetGroupID/Set_group_id_for_existing_group b/internal/users/db/testdata/golden/TestSetGroupID/Set_group_id_for_existing_group
new file mode 100644
index 0000000000..45d9ebc940
--- /dev/null
+++ b/internal/users/db/testdata/golden/TestSetGroupID/Set_group_id_for_existing_group
@@ -0,0 +1,64 @@
+users:
+    - name: user1
+      uid: 1111
+      gid: 12345
+      gecos: |-
+        User1 gecos
+        On multiple lines
+      dir: /home/user1
+      shell: /bin/bash
+      broker_id: broker-id
+    - name: user2
+      uid: 2222
+      gid: 22222
+      gecos: User2
+      dir: /home/user2
+      shell: /bin/dash
+      broker_id: broker-id
+    - name: user3
+      uid: 3333
+      gid: 33333
+      gecos: User3
+      dir: /home/user3
+      shell: /bin/zsh
+      broker_id: broker-id
+    - name: userwithoutbroker
+      uid: 4444
+      gid: 44444
+      gecos: userwithoutbroker
+      dir: /home/userwithoutbroker
+      shell: /bin/sh
+groups:
+    - name: group1
+      gid: 12345
+      ugid: "12345678"
+    - name: group2
+      gid: 22222
+      ugid: "56781234"
+    - name: group3
+      gid: 33333
+      ugid: "34567812"
+    - name: group4
+      gid: 44444
+      ugid: "45678123"
+    - name: commongroup
+      gid: 99999
+      ugid: "87654321"
+users_to_groups:
+    - uid: 1111
+      gid: 12345
+    - uid: 1111
+      gid: 99999
+    - uid: 2222
+      gid: 22222
+    - uid: 2222
+      gid: 99999
+    - uid: 3333
+      gid: 33333
+    - uid: 3333
+      gid: 99999
+    - uid: 4444
+      gid: 44444
+    - uid: 4444
+      gid: 99999
+schema_version: 2
diff --git a/internal/users/db/testdata/golden/TestSetUserID/No_op_if_uid_is_already_set b/internal/users/db/testdata/golden/TestSetUserID/No_op_if_uid_is_already_set
new file mode 100644
index 0000000000..9c042d2317
--- /dev/null
+++ b/internal/users/db/testdata/golden/TestSetUserID/No_op_if_uid_is_already_set
@@ -0,0 +1,64 @@
+users:
+    - name: user1
+      uid: 1111
+      gid: 11111
+      gecos: |-
+        User1 gecos
+        On multiple lines
+      dir: /home/user1
+      shell: /bin/bash
+      broker_id: broker-id
+    - name: user2
+      uid: 2222
+      gid: 22222
+      gecos: User2
+      dir: /home/user2
+      shell: /bin/dash
+      broker_id: broker-id
+    - name: user3
+      uid: 3333
+      gid: 33333
+      gecos: User3
+      dir: /home/user3
+      shell: /bin/zsh
+      broker_id: broker-id
+    - name: userwithoutbroker
+      uid: 4444
+      gid: 44444
+      gecos: userwithoutbroker
+      dir: /home/userwithoutbroker
+      shell: /bin/sh
+groups:
+    - name: group1
+      gid: 11111
+      ugid: "12345678"
+    - name: group2
+      gid: 22222
+      ugid: "56781234"
+    - name: group3
+      gid: 33333
+      ugid: "34567812"
+    - name: group4
+      gid: 44444
+      ugid: "45678123"
+    - name: commongroup
+      gid: 99999
+      ugid: "87654321"
+users_to_groups:
+    - uid: 1111
+      gid: 11111
+    - uid: 1111
+      gid: 99999
+    - uid: 2222
+      gid: 22222
+    - uid: 2222
+      gid: 99999
+    - uid: 3333
+      gid: 33333
+    - uid: 3333
+      gid: 99999
+    - uid: 4444
+      gid: 44444
+    - uid: 4444
+      gid: 99999
+schema_version: 2
diff --git a/internal/users/db/testdata/golden/TestSetUserID/Set_user_id_for_existing_user b/internal/users/db/testdata/golden/TestSetUserID/Set_user_id_for_existing_user
new file mode 100644
index 0000000000..d2f3a1e78b
--- /dev/null
+++ b/internal/users/db/testdata/golden/TestSetUserID/Set_user_id_for_existing_user
@@ -0,0 +1,64 @@
+users:
+    - name: user1
+      uid: 1234
+      gid: 11111
+      gecos: |-
+        User1 gecos
+        On multiple lines
+      dir: /home/user1
+      shell: /bin/bash
+      broker_id: broker-id
+    - name: user2
+      uid: 2222
+      gid: 22222
+      gecos: User2
+      dir: /home/user2
+      shell: /bin/dash
+      broker_id: broker-id
+    - name: user3
+      uid: 3333
+      gid: 33333
+      gecos: User3
+      dir: /home/user3
+      shell: /bin/zsh
+      broker_id: broker-id
+    - name: userwithoutbroker
+      uid: 4444
+      gid: 44444
+      gecos: userwithoutbroker
+      dir: /home/userwithoutbroker
+      shell: /bin/sh
+groups:
+    - name: group1
+      gid: 11111
+      ugid: "12345678"
+    - name: group2
+      gid: 22222
+      ugid: "56781234"
+    - name: group3
+      gid: 33333
+      ugid: "34567812"
+    - name: group4
+      gid: 44444
+      ugid: "45678123"
+    - name: commongroup
+      gid: 99999
+      ugid: "87654321"
+users_to_groups:
+    - uid: 1234
+      gid: 11111
+    - uid: 1234
+      gid: 99999
+    - uid: 2222
+      gid: 22222
+    - uid: 2222
+      gid: 99999
+    - uid: 3333
+      gid: 33333
+    - uid: 3333
+      gid: 99999
+    - uid: 4444
+      gid: 44444
+    - uid: 4444
+      gid: 99999
+schema_version: 2
diff --git a/internal/users/db/testdata/golden/TestUpdateUserEntry/Add_user_to_group_from_another_user b/internal/users/db/testdata/golden/TestUpdateUserEntry/Add_user_to_group_from_another_user
index 827c703025..71f41b4662 100644
--- a/internal/users/db/testdata/golden/TestUpdateUserEntry/Add_user_to_group_from_another_user
+++ b/internal/users/db/testdata/golden/TestUpdateUserEntry/Add_user_to_group_from_another_user
@@ -60,4 +60,4 @@ users_to_groups:
       gid: 44444
     - uid: 4444
       gid: 99999
-schema_version: 1
+schema_version: 2
diff --git a/internal/users/db/testdata/golden/TestUpdateUserEntry/Insert_new_user b/internal/users/db/testdata/golden/TestUpdateUserEntry/Insert_new_user
index 362a15f68b..1ead371466 100644
--- a/internal/users/db/testdata/golden/TestUpdateUserEntry/Insert_new_user
+++ b/internal/users/db/testdata/golden/TestUpdateUserEntry/Insert_new_user
@@ -14,4 +14,4 @@ groups:
 users_to_groups:
     - uid: 1111
       gid: 11111
-schema_version: 1
+schema_version: 2
diff --git a/internal/users/db/testdata/golden/TestUpdateUserEntry/Insert_new_user_without_optional_gecos_field b/internal/users/db/testdata/golden/TestUpdateUserEntry/Insert_new_user_without_optional_gecos_field
index db54d238d5..3d09a971c2 100644
--- a/internal/users/db/testdata/golden/TestUpdateUserEntry/Insert_new_user_without_optional_gecos_field
+++ b/internal/users/db/testdata/golden/TestUpdateUserEntry/Insert_new_user_without_optional_gecos_field
@@ -12,4 +12,4 @@ groups:
 users_to_groups:
     - uid: 1111
       gid: 11111
-schema_version: 1
+schema_version: 2
diff --git a/internal/users/db/testdata/golden/TestUpdateUserEntry/Remove_group_from_user b/internal/users/db/testdata/golden/TestUpdateUserEntry/Remove_group_from_user
index 36b5459a96..647653fdc9 100644
--- a/internal/users/db/testdata/golden/TestUpdateUserEntry/Remove_group_from_user
+++ b/internal/users/db/testdata/golden/TestUpdateUserEntry/Remove_group_from_user
@@ -17,4 +17,4 @@ groups:
 users_to_groups:
     - uid: 1111
       gid: 22222
-schema_version: 1
+schema_version: 2
diff --git a/internal/users/db/testdata/golden/TestUpdateUserEntry/Remove_user_from_a_group_still_part_from_another_user b/internal/users/db/testdata/golden/TestUpdateUserEntry/Remove_user_from_a_group_still_part_from_another_user
index 411a1de501..a5079149a7 100644
--- a/internal/users/db/testdata/golden/TestUpdateUserEntry/Remove_user_from_a_group_still_part_from_another_user
+++ b/internal/users/db/testdata/golden/TestUpdateUserEntry/Remove_user_from_a_group_still_part_from_another_user
@@ -58,4 +58,4 @@ users_to_groups:
       gid: 44444
     - uid: 4444
       gid: 99999
-schema_version: 1
+schema_version: 2
diff --git a/internal/users/db/testdata/golden/TestUpdateUserEntry/Update_only_user_even_if_we_have_multiple_of_them b/internal/users/db/testdata/golden/TestUpdateUserEntry/Update_only_user_even_if_we_have_multiple_of_them
index 187cd238b6..03418546c1 100644
--- a/internal/users/db/testdata/golden/TestUpdateUserEntry/Update_only_user_even_if_we_have_multiple_of_them
+++ b/internal/users/db/testdata/golden/TestUpdateUserEntry/Update_only_user_even_if_we_have_multiple_of_them
@@ -58,4 +58,4 @@ users_to_groups:
       gid: 44444
     - uid: 4444
       gid: 99999
-schema_version: 1
+schema_version: 2
diff --git a/internal/users/db/testdata/golden/TestUpdateUserEntry/Update_user_by_adding_a_new_default_group b/internal/users/db/testdata/golden/TestUpdateUserEntry/Update_user_by_adding_a_new_default_group
index e9f01e9d24..6b7a9c27c0 100644
--- a/internal/users/db/testdata/golden/TestUpdateUserEntry/Update_user_by_adding_a_new_default_group
+++ b/internal/users/db/testdata/golden/TestUpdateUserEntry/Update_user_by_adding_a_new_default_group
@@ -19,4 +19,4 @@ users_to_groups:
       gid: 11111
     - uid: 1111
       gid: 22222
-schema_version: 1
+schema_version: 2
diff --git a/internal/users/db/testdata/golden/TestUpdateUserEntry/Update_user_by_adding_a_new_group b/internal/users/db/testdata/golden/TestUpdateUserEntry/Update_user_by_adding_a_new_group
index cee0af7d4b..e4576a7e71 100644
--- a/internal/users/db/testdata/golden/TestUpdateUserEntry/Update_user_by_adding_a_new_group
+++ b/internal/users/db/testdata/golden/TestUpdateUserEntry/Update_user_by_adding_a_new_group
@@ -19,4 +19,4 @@ users_to_groups:
       gid: 11111
     - uid: 1111
       gid: 22222
-schema_version: 1
+schema_version: 2
diff --git a/internal/users/db/testdata/golden/TestUpdateUserEntry/Update_user_by_adding_a_new_local_group b/internal/users/db/testdata/golden/TestUpdateUserEntry/Update_user_by_adding_a_new_local_group
index 362a15f68b..1ead371466 100644
--- a/internal/users/db/testdata/golden/TestUpdateUserEntry/Update_user_by_adding_a_new_local_group
+++ b/internal/users/db/testdata/golden/TestUpdateUserEntry/Update_user_by_adding_a_new_local_group
@@ -14,4 +14,4 @@ groups:
 users_to_groups:
     - uid: 1111
       gid: 11111
-schema_version: 1
+schema_version: 2
diff --git a/internal/users/db/testdata/golden/TestUpdateUserEntry/Update_user_by_changing_attributes b/internal/users/db/testdata/golden/TestUpdateUserEntry/Update_user_by_changing_attributes
index 244a44410e..5d1fe51aeb 100644
--- a/internal/users/db/testdata/golden/TestUpdateUserEntry/Update_user_by_changing_attributes
+++ b/internal/users/db/testdata/golden/TestUpdateUserEntry/Update_user_by_changing_attributes
@@ -12,4 +12,4 @@ groups:
 users_to_groups:
     - uid: 1111
       gid: 11111
-schema_version: 1
+schema_version: 2
diff --git a/internal/users/db/testdata/golden/TestUpdateUserEntry/Update_user_by_removing_optional_gecos_field_if_not_set b/internal/users/db/testdata/golden/TestUpdateUserEntry/Update_user_by_removing_optional_gecos_field_if_not_set
index db54d238d5..3d09a971c2 100644
--- a/internal/users/db/testdata/golden/TestUpdateUserEntry/Update_user_by_removing_optional_gecos_field_if_not_set
+++ b/internal/users/db/testdata/golden/TestUpdateUserEntry/Update_user_by_removing_optional_gecos_field_if_not_set
@@ -12,4 +12,4 @@ groups:
 users_to_groups:
     - uid: 1111
       gid: 11111
-schema_version: 1
+schema_version: 2
diff --git a/internal/users/db/testdata/golden/TestUpdateUserEntry/Update_user_by_renaming_a_group b/internal/users/db/testdata/golden/TestUpdateUserEntry/Update_user_by_renaming_a_group
index 40eb47d5c3..fbecc4550e 100644
--- a/internal/users/db/testdata/golden/TestUpdateUserEntry/Update_user_by_renaming_a_group
+++ b/internal/users/db/testdata/golden/TestUpdateUserEntry/Update_user_by_renaming_a_group
@@ -14,4 +14,4 @@ groups:
 users_to_groups:
     - uid: 1111
       gid: 11111
-schema_version: 1
+schema_version: 2
diff --git a/internal/users/db/testdata/golden/TestUpdateUserEntry/Update_user_does_not_change_homedir_if_it_exists b/internal/users/db/testdata/golden/TestUpdateUserEntry/Update_user_does_not_change_homedir_if_it_exists
index 362a15f68b..1ead371466 100644
--- a/internal/users/db/testdata/golden/TestUpdateUserEntry/Update_user_does_not_change_homedir_if_it_exists
+++ b/internal/users/db/testdata/golden/TestUpdateUserEntry/Update_user_does_not_change_homedir_if_it_exists
@@ -14,4 +14,4 @@ groups:
 users_to_groups:
     - uid: 1111
       gid: 11111
-schema_version: 1
+schema_version: 2
diff --git a/internal/users/db/testdata/golden/TestUpdateUserEntry/Update_user_does_not_change_shell_if_it_exists b/internal/users/db/testdata/golden/TestUpdateUserEntry/Update_user_does_not_change_shell_if_it_exists
index 362a15f68b..1ead371466 100644
--- a/internal/users/db/testdata/golden/TestUpdateUserEntry/Update_user_does_not_change_shell_if_it_exists
+++ b/internal/users/db/testdata/golden/TestUpdateUserEntry/Update_user_does_not_change_shell_if_it_exists
@@ -14,4 +14,4 @@ groups:
 users_to_groups:
     - uid: 1111
       gid: 11111
-schema_version: 1
+schema_version: 2
diff --git a/internal/users/db/testdata/one_users_multiple_groups_fully_uppercase.db.yaml b/internal/users/db/testdata/one_users_multiple_groups_fully_uppercase.db.yaml
deleted file mode 100644
index 52e8d06c22..0000000000
--- a/internal/users/db/testdata/one_users_multiple_groups_fully_uppercase.db.yaml
+++ /dev/null
@@ -1,21 +0,0 @@
-users:
-    - name: TESTUSER
-      uid: 1111
-      gid: 11111
-      gecos: testuser gecos
-      dir: /home/testuser
-      shell: /bin/bash
-      broker_id: broker-id
-groups:
-    - name: testgroup
-      gid: 11111
-      ugid: "12345678"
-    - name: TESTGROUP
-      gid: 22222
-      ugid: "56781234"
-users_to_groups:
-    - uid: 1111
-      gid: 11111
-    - uid: 1111
-      gid: 22222
-schema_version: 0
diff --git a/internal/users/db/testdata/one_users_multiple_groups_with_uppercase.db.yaml b/internal/users/db/testdata/one_users_multiple_groups_with_uppercase.db.yaml
deleted file mode 100644
index 1dd632c19c..0000000000
--- a/internal/users/db/testdata/one_users_multiple_groups_with_uppercase.db.yaml
+++ /dev/null
@@ -1,21 +0,0 @@
-users:
-    - name: TestUser
-      uid: 1111
-      gid: 11111
-      gecos: testuser gecos
-      dir: /home/testuser
-      shell: /bin/bash
-      broker_id: broker-id
-groups:
-    - name: testgroup
-      gid: 11111
-      ugid: "12345678"
-    - name: TestGroup
-      gid: 22222
-      ugid: "56781234"
-users_to_groups:
-    - uid: 1111
-      gid: 11111
-    - uid: 1111
-      gid: 22222
-schema_version: 0
diff --git a/internal/users/db/testutils.go b/internal/users/db/testutils.go
index 46af9e508c..4df94f73fd 100644
--- a/internal/users/db/testutils.go
+++ b/internal/users/db/testutils.go
@@ -5,6 +5,7 @@ package db
 
 import (
 	"context"
+	"database/sql"
 	"errors"
 	"fmt"
 	"io"
@@ -12,8 +13,10 @@ import (
 	"path/filepath"
 	"sort"
 
-	"github.com/ubuntu/authd/internal/testsdetection"
-	"github.com/ubuntu/authd/log"
+	"github.com/canonical/authd/internal/consts"
+	"github.com/canonical/authd/internal/fileutils"
+	"github.com/canonical/authd/internal/testsdetection"
+	"github.com/canonical/authd/log"
 	"gopkg.in/yaml.v3"
 )
 
@@ -201,18 +204,51 @@ func createDBFromYAMLReader(r io.Reader, destDir string) (err error) {
 	return nil
 }
 
-// Z_ForTests_GetGroupFile returns the path to the group file.
+// Z_ForTests_CreateDBFromDump creates the database from the provided SQLite dump file.
 //
 // nolint:revive,nolintlint // We want to use underscores in the function name here.
-func Z_ForTests_GetGroupFile() string {
+func Z_ForTests_CreateDBFromDump(dumpFile, destDir string) error {
 	testsdetection.MustBeTesting()
 
-	return groupFile
-}
+	dumpFile, err := filepath.Abs(dumpFile)
+	if err != nil {
+		return err
+	}
 
-// Z_ForTests_SetGroupFile sets the group file to the provided path.
-//
-// nolint:revive,nolintlint // We want to use underscores in the function name here.
-func Z_ForTests_SetGroupFile(groupFilePath string) {
-	groupFile = groupFilePath
+	log.Debugf(context.Background(), "Creating SQLite database from dump %s", dumpFile)
+
+	dbPath := filepath.Join(destDir, consts.DefaultDatabaseFileName)
+	if err := os.MkdirAll(destDir, 0700); err != nil {
+		return fmt.Errorf("could not create database directory %s: %w", destDir, err)
+	}
+	if err := fileutils.Touch(dbPath); err != nil {
+		return fmt.Errorf("could not create database file %s: %w", dbPath, err)
+	}
+
+	db, err := sql.Open("sqlite3", fmt.Sprintf("file:%s?cache=shared", dbPath))
+	if err != nil {
+		return fmt.Errorf("could not open database file %s: %w", dbPath, err)
+	}
+
+	// Enable foreign key support (this needs to be done for each connection, so we can't do it in the schema).
+	_, err = db.Exec("PRAGMA foreign_keys = ON;")
+	if err != nil {
+		return fmt.Errorf("failed to enable foreign keys: %w", err)
+	}
+
+	dumpContent, err := os.ReadFile(dumpFile)
+	if err != nil {
+		return fmt.Errorf("could not read dump file %s: %w", dumpFile, err)
+	}
+	// Execute the dump content.
+	_, err = db.Exec(string(dumpContent))
+	if err != nil {
+		return fmt.Errorf("could not execute dump content: %w", err)
+	}
+
+	if err := db.Close(); err != nil {
+		return fmt.Errorf("could not close database: %w", err)
+	}
+
+	return nil
 }
diff --git a/internal/users/db/update.go b/internal/users/db/update.go
index 52e3e0747c..7c420d09f9 100644
--- a/internal/users/db/update.go
+++ b/internal/users/db/update.go
@@ -4,16 +4,15 @@ import (
 	"context"
 	"errors"
 	"fmt"
-	"strings"
 
+	"github.com/canonical/authd/log"
 	"github.com/mattn/go-sqlite3"
-	"github.com/ubuntu/authd/log"
 )
 
 // UpdateUserEntry inserts or updates user and group records from the user information.
 func (m *Manager) UpdateUserEntry(user UserRow, authdGroups []GroupRow, localGroups []string) (err error) {
-	// authd uses lowercase usernames
-	user.Name = strings.ToLower(user.Name)
+	m.mu.Lock()
+	defer m.mu.Unlock()
 
 	// Start a transaction
 	tx, err := m.db.Begin()
@@ -60,8 +59,10 @@ func handleUserUpdate(db queryable, u UserRow) error {
 
 	// If a user with the same UID exists, we need to ensure that it's the same user or fail the update otherwise.
 	if existingUser.Name != "" && existingUser.Name != u.Name {
-		log.Errorf(context.TODO(), "UID for user %q already in use by user %q", u.Name, existingUser.Name)
-		return errors.New("UID already in use by a different user")
+		log.Errorf(context.TODO(), "UID %d for user %q already in use by user %q",
+			u.UID, u.Name, existingUser.Name)
+		return fmt.Errorf("UID for user %q already in use by a different user %q",
+			u.Name, existingUser.Name)
 	}
 
 	// Ensure that we use the same homedir as the one we have in the database.
@@ -90,10 +91,11 @@ func handleGroupsUpdate(db queryable, groups []GroupRow) error {
 
 		// If a group with the same GID exists, we need to ensure that it's the same group or fail the update otherwise.
 		// Ignore the case that the UGID of the existing group is empty, which means that the group was stored without a
-		// UGID, which was the case before https://github.com/ubuntu/authd/pull/647.
+		// UGID, which was the case before https://github.com/canonical/authd/pull/647.
 		if groupExists && existingGroup.UGID != "" && existingGroup.UGID != group.UGID {
 			log.Errorf(context.TODO(), "GID %d for group with UGID %q already in use by a group with UGID %q", group.GID, group.UGID, existingGroup.UGID)
-			return fmt.Errorf("GID for group %q already in use by a different group", group.Name)
+			return fmt.Errorf("GID for group %q already in use by a different group %q",
+				group.Name, existingGroup.Name)
 		}
 
 		log.Debugf(context.Background(), "Updating entry of group %q (%+v)", group.Name, group)
@@ -124,13 +126,13 @@ func handleUsersToGroupsUpdate(db queryable, uid uint32, groups []GroupRow) erro
 				// GID exist.
 				_, userErr := userByID(db, uid)
 				if errors.Is(userErr, NoDataFoundError{}) {
-					err = fmt.Errorf("%w (user with UID %d does not exist)", err, uid)
+					err = fmt.Errorf("%w (%w)", err, userErr)
 				} else if userErr != nil {
 					err = errors.Join(err, fmt.Errorf("failed to check if user with UID %d exists: %w", uid, userErr))
 				}
 				_, groupErr := groupByID(db, group.GID)
 				if errors.Is(groupErr, NoDataFoundError{}) {
-					err = fmt.Errorf("%w (group with GID %d does not exist)", err, group.GID)
+					err = fmt.Errorf("%w (%w)", err, groupErr)
 				} else if groupErr != nil {
 					err = errors.Join(err, fmt.Errorf("failed to check if group with GID %d exists: %w", group.GID, groupErr))
 				}
@@ -161,8 +163,8 @@ func handleUsersToLocalGroupsUpdate(db queryable, uid uint32, localGroups []stri
 
 // UpdateBrokerForUser updates the last broker the user successfully authenticated with.
 func (m *Manager) UpdateBrokerForUser(username, brokerID string) error {
-	// authd uses lowercase usernames
-	username = strings.ToLower(username)
+	m.mu.Lock()
+	defer m.mu.Unlock()
 
 	query := `UPDATE users SET broker_id = ? WHERE name = ?`
 	res, err := m.db.Exec(query, brokerID, username)
@@ -174,8 +176,200 @@ func (m *Manager) UpdateBrokerForUser(username, brokerID string) error {
 		return fmt.Errorf("failed to get rows affected: %w", err)
 	}
 	if rowsAffected == 0 {
-		return NoDataFoundError{table: "users", key: username}
+		return NewUserNotFoundError(username)
 	}
 
 	return nil
 }
+
+// UpdateLockedFieldForUser sets the "locked" field of a user record.
+func (m *Manager) UpdateLockedFieldForUser(username string, locked bool) error {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+
+	query := `UPDATE users SET locked = ? WHERE name = ?`
+	res, err := m.db.Exec(query, locked, username)
+	if err != nil {
+		return fmt.Errorf("failed to update locked field for user: %w", err)
+	}
+	rowsAffected, err := res.RowsAffected()
+	if err != nil {
+		return fmt.Errorf("failed to get rows affected: %w", err)
+	}
+	if rowsAffected == 0 {
+		return NewUserNotFoundError(username)
+	}
+
+	return nil
+}
+
+// SetUserID updates the UID of a user.
+func (m *Manager) SetUserID(username string, newUID uint32) error {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+
+	// Temporarily disable foreign key constraints to allow updating the UID without violating constraints.
+	// SQLite does not allow disabling foreign key constraints in a transaction,
+	// so we do it before starting the transaction. See https://www.sqlite.org/foreignkeys.html#fk_enable
+	if _, err := m.db.Exec(`PRAGMA foreign_keys = OFF`); err != nil {
+		return err
+	}
+	defer func() {
+		// Re-enable foreign key constraints after the operation
+		if _, err := m.db.Exec(`PRAGMA foreign_keys = ON`); err != nil {
+			log.Errorf(context.TODO(), "Failed to re-enable foreign keys: %v", err)
+		}
+	}()
+
+	// Start a transaction
+	tx, err := m.db.Begin()
+	if err != nil {
+		return fmt.Errorf("failed to start transaction: %w", err)
+	}
+
+	// Ensure the transaction is committed or rolled back
+	defer func() {
+		err = commitOrRollBackTransaction(err, tx)
+	}()
+
+	// Check if the new UID is already in use
+	existingUser, err := userByID(tx, newUID)
+	if err != nil && !errors.Is(err, NoDataFoundError{}) {
+		return fmt.Errorf("failed to check if new UID is already in use: %w", err)
+	}
+	if existingUser.Name != "" && existingUser.Name != username {
+		log.Errorf(context.TODO(), "UID %d already in use by user %q", newUID, existingUser.Name)
+		return fmt.Errorf("UID %d already in use by a different user", newUID)
+	}
+	if existingUser.Name == username {
+		log.Debugf(context.TODO(), "User %q already has UID %d, no update needed", username, newUID)
+		return nil
+	}
+
+	// Get the old UID of the user
+	oldUser, err := userByName(tx, username)
+	if errors.Is(err, NoDataFoundError{}) {
+		return err
+	}
+	if err != nil {
+		return fmt.Errorf("failed to get user by name: %w", err)
+	}
+	oldUID := oldUser.UID
+
+	// Update the users table
+	if _, err := tx.Exec(`UPDATE users SET uid = ? WHERE name = ?`, newUID, username); err != nil {
+		return err
+	}
+
+	// Update the users_to_groups table
+	if _, err := tx.Exec(`UPDATE users_to_groups SET uid = ? WHERE uid = ?`, newUID, oldUID); err != nil {
+		return err
+	}
+
+	// Update the users_to_local_groups table
+	if _, err := tx.Exec(`UPDATE users_to_local_groups SET uid = ? WHERE uid = ?`, newUID, oldUID); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+// SetGroupID updates the GID of a group and returns the list of users whose primary group was updated.
+func (m *Manager) SetGroupID(groupName string, newGID uint32) ([]UserRow, error) {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+
+	// Temporarily disable foreign key constraints to allow updating the GID without violating constraints.
+	// SQLite does not allow disabling foreign key constraints in a transaction,
+	// so we do it before starting the transaction. See https://www.sqlite.org/foreignkeys.html#fk_enable
+	if _, err := m.db.Exec(`PRAGMA foreign_keys = OFF`); err != nil {
+		return nil, err
+	}
+	defer func() {
+		// Re-enable foreign key constraints after the operation
+		if _, err := m.db.Exec(`PRAGMA foreign_keys = ON`); err != nil {
+			log.Errorf(context.TODO(), "Failed to re-enable foreign keys: %v", err)
+		}
+	}()
+
+	// Start a transaction
+	tx, err := m.db.Begin()
+	if err != nil {
+		return nil, fmt.Errorf("failed to start transaction: %w", err)
+	}
+
+	// Ensure the transaction is committed or rolled back
+	defer func() {
+		err = commitOrRollBackTransaction(err, tx)
+	}()
+
+	// Check if the new GID is already in use
+	existingGroup, err := groupByID(tx, newGID)
+	if err != nil && !errors.Is(err, NoDataFoundError{}) {
+		return nil, fmt.Errorf("failed to check if new GID is already in use: %w", err)
+	}
+	if existingGroup.Name != "" && existingGroup.Name != groupName {
+		log.Errorf(context.TODO(), "GID %d already in use by group %q", newGID, existingGroup.Name)
+		return nil, fmt.Errorf("GID %d already in use by a different group", newGID)
+	}
+	if existingGroup.Name == groupName {
+		log.Debugf(context.TODO(), "Group %q already has GID %d, no update needed", groupName, newGID)
+		return nil, nil
+	}
+
+	// Get the old GID of the group
+	oldGroup, err := groupByName(tx, groupName)
+	if errors.Is(err, NoDataFoundError{}) {
+		return nil, err
+	}
+	if err != nil {
+		return nil, fmt.Errorf("failed to get group by name: %w", err)
+	}
+	oldGID := oldGroup.GID
+
+	// Get the list of users whose primary group is the old GID
+	query := `SELECT name, uid, gid, gecos, dir, shell, broker_id, locked FROM users WHERE gid = ?`
+	rows, err := tx.Query(query, oldGID)
+	if err != nil {
+		return nil, fmt.Errorf("failed to get users with old group as primary group: %w", err)
+	}
+	defer closeRows(rows)
+
+	var users []UserRow
+	for rows.Next() {
+		var u UserRow
+		err := rows.Scan(&u.Name, &u.UID, &u.GID, &u.Gecos, &u.Dir, &u.Shell, &u.BrokerID, &u.Locked)
+		if err != nil {
+			return nil, fmt.Errorf("scan error: %w", err)
+		}
+		users = append(users, u)
+	}
+
+	// Update the groups table
+	if _, err := tx.Exec(`UPDATE groups SET gid = ? WHERE name = ?`, newGID, groupName); err != nil {
+		return nil, err
+	}
+
+	// Update the primary groups of the users table
+	if _, err := tx.Exec(`UPDATE users SET gid = ? WHERE gid = ?`, newGID, oldGID); err != nil {
+		return nil, err
+	}
+
+	// Update the users_to_groups table
+	if _, err := tx.Exec(`UPDATE users_to_groups SET gid = ? WHERE gid = ?`, newGID, oldGID); err != nil {
+		// If a foreign key error occurs, enrich it similarly to users handling if needed.
+		var sqliteErr sqlite3.Error
+		if errors.As(err, &sqliteErr) && sqliteErr.ExtendedCode == sqlite3.ErrConstraintForeignKey {
+			// Check existence to provide clearer message
+			_, groupErr := groupByID(tx, newGID)
+			if errors.Is(groupErr, NoDataFoundError{}) {
+				err = fmt.Errorf("%w (%w)", err, groupErr)
+			} else if groupErr != nil {
+				err = errors.Join(err, fmt.Errorf("failed to check if group with GID %d exists: %w", newGID, groupErr))
+			}
+		}
+		return nil, fmt.Errorf("failed to update users_to_groups for GID change: %w", err)
+	}
+
+	return users, nil
+}
diff --git a/internal/users/db/usergroups.go b/internal/users/db/usergroups.go
index 837219e7d1..a48235b614 100644
--- a/internal/users/db/usergroups.go
+++ b/internal/users/db/usergroups.go
@@ -3,9 +3,8 @@ package db
 import (
 	"context"
 	"fmt"
-	"strconv"
 
-	"github.com/ubuntu/authd/log"
+	"github.com/canonical/authd/log"
 )
 
 // UserGroups returns all groups for a given user or an error if the database is corrupted or no entry was found.
@@ -43,7 +42,7 @@ func userGroups(db queryable, uid uint32) ([]GroupRow, error) {
 	}
 
 	if len(groups) == 0 {
-		return nil, NoDataFoundError{key: strconv.FormatUint(uint64(uid), 10), table: "users_to_groups"}
+		return nil, NewUIDNotFoundError(uid)
 	}
 
 	return groups, nil
@@ -51,6 +50,9 @@ func userGroups(db queryable, uid uint32) ([]GroupRow, error) {
 
 // RemoveUserFromGroup removes a user from a group.
 func (m *Manager) RemoveUserFromGroup(uid, gid uint32) error {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+
 	query := `DELETE FROM users_to_groups WHERE uid = ? AND gid = ?`
 	_, err := m.db.Exec(query, uid, gid)
 	return err
@@ -122,7 +124,7 @@ func removeUserFromAllGroups(db queryable, uid uint32) error {
 		return fmt.Errorf("failed to get rows affected: %w", err)
 	}
 	if rowsAffected == 0 {
-		return NoDataFoundError{table: "users_to_groups", key: strconv.FormatUint(uint64(uid), 10)}
+		return NoDataFoundError{fmt.Sprintf("no groups found for user with UID %d", uid)}
 	}
 
 	return nil
diff --git a/internal/users/db/userlocalgroups.go b/internal/users/db/userlocalgroups.go
index 5c65d22982..b2e09cf81c 100644
--- a/internal/users/db/userlocalgroups.go
+++ b/internal/users/db/userlocalgroups.go
@@ -6,7 +6,11 @@ import (
 
 // UserLocalGroups returns all local groups for a given user or an error if the database is corrupted or no entry was found.
 func (m *Manager) UserLocalGroups(uid uint32) ([]string, error) {
-	rows, err := m.db.Query(`SELECT group_name FROM users_to_local_groups WHERE uid = ?`, uid)
+	return userLocalGroups(m.db, uid)
+}
+
+func userLocalGroups(db queryable, uid uint32) ([]string, error) {
+	rows, err := db.Query(`SELECT group_name FROM users_to_local_groups WHERE uid = ?`, uid)
 	if err != nil {
 		return nil, fmt.Errorf("query error: %w", err)
 	}
diff --git a/internal/users/db/users.go b/internal/users/db/users.go
index f41d2c0f52..60efe3d204 100644
--- a/internal/users/db/users.go
+++ b/internal/users/db/users.go
@@ -5,15 +5,13 @@ import (
 	"database/sql"
 	"errors"
 	"fmt"
-	"strconv"
-	"strings"
 
-	"github.com/ubuntu/authd/log"
+	"github.com/canonical/authd/log"
 )
 
-const allUserColumns = "name, uid, gid, gecos, dir, shell, broker_id"
-const publicUserColumns = "name, uid, gid, gecos, dir, shell, broker_id"
-const allUserColumnsWithPlaceholders = "name = ?, uid = ?, gid = ?, gecos = ?, dir = ?, shell = ?, broker_id = ?"
+const allUserColumns = "name, uid, gid, gecos, dir, shell, broker_id, locked"
+const publicUserColumns = "name, uid, gid, gecos, dir, shell, broker_id, locked"
+const allUserColumnsWithPlaceholders = "name = ?, uid = ?, gid = ?, gecos = ?, dir = ?, shell = ?, broker_id = ?, locked = ?"
 
 // UserRow represents a user row in the database.
 type UserRow struct {
@@ -26,6 +24,8 @@ type UserRow struct {
 
 	// BrokerID specifies the broker the user last successfully authenticated with.
 	BrokerID string `yaml:"broker_id,omitempty"`
+
+	Locked bool `yaml:"locked,omitempty"`
 }
 
 // NewUserRow creates a new UserRow.
@@ -50,9 +50,9 @@ func userByID(db queryable, uid uint32) (UserRow, error) {
 	row := db.QueryRow(query, uid)
 
 	var u UserRow
-	err := row.Scan(&u.Name, &u.UID, &u.GID, &u.Gecos, &u.Dir, &u.Shell, &u.BrokerID)
+	err := row.Scan(&u.Name, &u.UID, &u.GID, &u.Gecos, &u.Dir, &u.Shell, &u.BrokerID, &u.Locked)
 	if errors.Is(err, sql.ErrNoRows) {
-		return UserRow{}, NoDataFoundError{key: strconv.FormatUint(uint64(uid), 10), table: "users"}
+		return UserRow{}, NewUIDNotFoundError(uid)
 	}
 	if err != nil {
 		return UserRow{}, fmt.Errorf("query error: %w", err)
@@ -63,16 +63,17 @@ func userByID(db queryable, uid uint32) (UserRow, error) {
 
 // UserByName returns a user matching this name or an error if the database is corrupted or no entry was found.
 func (m *Manager) UserByName(name string) (UserRow, error) {
-	// authd uses lowercase usernames
-	name = strings.ToLower(name)
+	return userByName(m.db, name)
+}
 
+func userByName(db queryable, name string) (UserRow, error) {
 	query := fmt.Sprintf(`SELECT %s FROM users WHERE name = ?`, publicUserColumns)
-	row := m.db.QueryRow(query, name)
+	row := db.QueryRow(query, name)
 
 	var u UserRow
-	err := row.Scan(&u.Name, &u.UID, &u.GID, &u.Gecos, &u.Dir, &u.Shell, &u.BrokerID)
+	err := row.Scan(&u.Name, &u.UID, &u.GID, &u.Gecos, &u.Dir, &u.Shell, &u.BrokerID, &u.Locked)
 	if errors.Is(err, sql.ErrNoRows) {
-		return UserRow{}, NoDataFoundError{key: name, table: "users"}
+		return UserRow{}, NewUserNotFoundError(name)
 	}
 	if err != nil {
 		return UserRow{}, fmt.Errorf("query error: %w", err)
@@ -97,7 +98,7 @@ func allUsers(db queryable) ([]UserRow, error) {
 	var users []UserRow
 	for rows.Next() {
 		var u UserRow
-		err := rows.Scan(&u.Name, &u.UID, &u.GID, &u.Gecos, &u.Dir, &u.Shell, &u.BrokerID)
+		err := rows.Scan(&u.Name, &u.UID, &u.GID, &u.Gecos, &u.Dir, &u.Shell, &u.BrokerID, &u.Locked)
 		if err != nil {
 			return nil, fmt.Errorf("scan error: %w", err)
 		}
@@ -150,8 +151,8 @@ func userExists(db queryable, u UserRow) (bool, error) {
 // insertUser inserts a new user into the database.
 func insertUser(db queryable, u UserRow) error {
 	log.Debugf(context.Background(), "Inserting user %v", u.Name)
-	query := fmt.Sprintf(`INSERT INTO users (%s) VALUES (?, ?, ?, ?, ?, ?, ?)`, allUserColumns)
-	_, err := db.Exec(query, u.Name, u.UID, u.GID, u.Gecos, u.Dir, u.Shell, u.BrokerID)
+	query := fmt.Sprintf(`INSERT INTO users (%s) VALUES (?, ?, ?, ?, ?, ?, ?, ?)`, allUserColumns)
+	_, err := db.Exec(query, u.Name, u.UID, u.GID, u.Gecos, u.Dir, u.Shell, u.BrokerID, u.Locked)
 	if err != nil {
 		return fmt.Errorf("insert user error: %w", err)
 	}
@@ -162,7 +163,7 @@ func insertUser(db queryable, u UserRow) error {
 func updateUserByID(db queryable, u UserRow) error {
 	log.Debugf(context.Background(), "Updating user %v", u.Name)
 	query := fmt.Sprintf(`UPDATE users SET %s WHERE uid = ?`, allUserColumnsWithPlaceholders)
-	_, err := db.Exec(query, u.Name, u.UID, u.GID, u.Gecos, u.Dir, u.Shell, u.BrokerID, u.UID)
+	_, err := db.Exec(query, u.Name, u.UID, u.GID, u.Gecos, u.Dir, u.Shell, u.BrokerID, u.Locked, u.UID)
 	if err != nil {
 		return fmt.Errorf("update user error: %w", err)
 	}
@@ -171,6 +172,9 @@ func updateUserByID(db queryable, u UserRow) error {
 
 // DeleteUser removes the user from the database.
 func (m *Manager) DeleteUser(uid uint32) error {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+
 	query := `DELETE FROM users WHERE uid = ?`
 	res, err := m.db.Exec(query, uid)
 	if err != nil {
@@ -181,8 +185,39 @@ func (m *Manager) DeleteUser(uid uint32) error {
 		return fmt.Errorf("failed to get rows affected: %w", err)
 	}
 	if rowsAffected == 0 {
-		return NoDataFoundError{table: "users", key: strconv.FormatUint(uint64(uid), 10)}
+		return NewUIDNotFoundError(uid)
 	}
 
 	return nil
 }
+
+// UserWithGroups returns a user and their groups, including local groups, in a single transaction.
+func (m *Manager) UserWithGroups(name string) (u UserRow, groups []GroupRow, localGroups []string, err error) {
+	// Start a transaction
+	tx, err := m.db.Begin()
+	if err != nil {
+		return UserRow{}, nil, nil, fmt.Errorf("failed to start transaction: %w", err)
+	}
+
+	// Ensure the transaction is committed or rolled back
+	defer func() {
+		err = commitOrRollBackTransaction(err, tx)
+	}()
+
+	u, err = userByName(tx, name)
+	if err != nil {
+		return UserRow{}, nil, nil, err
+	}
+
+	groups, err = userGroups(tx, u.UID)
+	if err != nil {
+		return UserRow{}, nil, nil, fmt.Errorf("failed to get groups: %w", err)
+	}
+
+	localGroups, err = userLocalGroups(tx, u.UID)
+	if err != nil {
+		return UserRow{}, nil, nil, fmt.Errorf("failed to get local groups: %w", err)
+	}
+
+	return u, groups, localGroups, nil
+}
diff --git a/internal/users/defs.go b/internal/users/defs.go
index d566c2c0a1..786c9e1fe5 100644
--- a/internal/users/defs.go
+++ b/internal/users/defs.go
@@ -1,8 +1,9 @@
 package users
 
 import (
-	"github.com/ubuntu/authd/internal/users/db"
-	"github.com/ubuntu/authd/internal/users/types"
+	"github.com/canonical/authd/internal/sliceutils"
+	"github.com/canonical/authd/internal/users/db"
+	"github.com/canonical/authd/internal/users/types"
 )
 
 // userEntryFromUserRow returns a UserEntry from a UserRow.
@@ -17,6 +18,32 @@ func userEntryFromUserRow(u db.UserRow) types.UserEntry {
 	}
 }
 
+// userInfoFromUserRow returns a UserInfo from a [db.UserRow] and [db.GroupRow]
+// and local groups slices.
+func userInfoFromUserAndGroupRows(u db.UserRow, groups []db.GroupRow, localGroups []string) *types.UserInfo {
+	ui := &types.UserInfo{
+		Name:  u.Name,
+		UID:   u.UID,
+		Gecos: u.Gecos,
+		Dir:   u.Dir,
+		Shell: u.Shell,
+		Groups: sliceutils.Map(groups, func(g db.GroupRow) types.GroupInfo {
+			gid := g.GID
+			return types.GroupInfo{
+				Name: g.Name,
+				GID:  &gid,
+				UGID: g.UGID,
+			}
+		}),
+	}
+
+	for _, lg := range localGroups {
+		ui.Groups = append(ui.Groups, types.GroupInfo{Name: lg})
+	}
+
+	return ui
+}
+
 // shadowEntryFromUserRow returns a ShadowEntry from a UserRow.
 func shadowEntryFromUserRow(u db.UserRow) types.ShadowEntry {
 	return types.ShadowEntry{
diff --git a/internal/users/export_test.go b/internal/users/export_test.go
index 387f7418d0..3d4673af8a 100644
--- a/internal/users/export_test.go
+++ b/internal/users/export_test.go
@@ -1,9 +1,28 @@
 package users
 
 import (
-	"github.com/ubuntu/authd/internal/users/tempentries"
+	"github.com/canonical/authd/internal/users/db"
+	"github.com/canonical/authd/internal/users/types"
 )
 
-func (m *Manager) TemporaryRecords() *tempentries.TemporaryRecords {
-	return m.temporaryRecords
+func (m *Manager) DB() *db.Manager {
+	return m.db
 }
+
+func (m *Manager) RealIDGenerator() *IDGenerator {
+	//nolint:forcetypeassert  // We really want to panic if it's not true.
+	return m.idGenerator.(*IDGenerator)
+}
+
+func (m *Manager) GetOldUserInfoFromDB(name string) (oldUserInfo *types.UserInfo, err error) {
+	return m.getOldUserInfoFromDB(name)
+}
+
+func CompareNewUserInfoWithUserInfoFromDB(newUserInfo, dbUserInfo types.UserInfo) bool {
+	return compareNewUserInfoWithUserInfoFromDB(newUserInfo, dbUserInfo)
+}
+
+const (
+	SystemdDynamicUIDMin = systemdDynamicUIDMin
+	SystemdDynamicUIDMax = systemdDynamicUIDMax
+)
diff --git a/internal/users/generate.go b/internal/users/generate.go
new file mode 100644
index 0000000000..3fa911b7d5
--- /dev/null
+++ b/internal/users/generate.go
@@ -0,0 +1,3 @@
+package users
+
+//go:generate go run -tags generate ./idlimitsgenerator/
diff --git a/internal/users/idgenerator.go b/internal/users/idgenerator.go
new file mode 100644
index 0000000000..f3409444a4
--- /dev/null
+++ b/internal/users/idgenerator.go
@@ -0,0 +1,308 @@
+package users
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"math"
+	"slices"
+	"sort"
+
+	"github.com/canonical/authd/internal/users/localentries"
+	"github.com/canonical/authd/log"
+)
+
+// IDGeneratorIface is the interface that must be implemented by the ID generator.
+type IDGeneratorIface interface {
+	GenerateUID(lockedEntries *localentries.UserDBLocked, owner IDOwner) (uid uint32, cleanup func(), err error)
+	GenerateGID(lockedEntries *localentries.UserDBLocked, owner IDOwner) (gid uint32, cleanup func(), err error)
+}
+
+// IDOwner is the interface that must be implemented by the IDs owner to provide
+// the currently used UIDs and GIDs.
+type IDOwner interface {
+	UsedUIDs() ([]uint32, error)
+	UsedGIDs() ([]uint32, error)
+}
+
+// IDGenerator is an ID generator that generates UIDs and GIDs in a specific range.
+type IDGenerator struct {
+	UIDMin uint32
+	UIDMax uint32
+	GIDMin uint32
+	GIDMax uint32
+
+	// IDs generated but not saved to the database yet.
+	// This is used to avoid generating the same ID multiple times.
+	// We don't differentiate between UIDs and GIDs here, because:
+	// * When picking a UID, we avoid IDs which we already used as GIDs,
+	//   because the UID is also used as the GID of the user private group.
+	// * When picking a GID, we avoid IDs which we already used as UIDs,
+	//   because those are also GIDs of the user private groups.
+	pendingIDs []uint32
+}
+
+// If no valid ID is found after this many attempts, something is likely wrong.
+// A possible cause is another NSS source using the same ID range.
+// We want users to report such cases, so we can consider including IDs
+// from other NSS sources when determining which candidates to exclude.
+const maxIDGenerateIterations = 1000
+
+// Special Linux UIDs, see https://systemd.io/UIDS-GIDS/
+const (
+	rootID         uint32 = 0
+	nobodyID       uint32 = 65534
+	uidT32MinusOne uint32 = math.MaxUint32
+	uidT16MinusOne uint32 = math.MaxUint16
+)
+
+// GenerateUID generates a random UID in the configured range.
+func (g *IDGenerator) GenerateUID(lockedEntries *localentries.UserDBLocked, owner IDOwner) (uint32, func(), error) {
+	return g.generateID(lockedEntries, owner, generateID{
+		idType:        "UID",
+		minID:         g.UIDMin,
+		maxID:         g.UIDMax,
+		getUsedIDs:    g.getUsedIDs,
+		isAvailableID: g.isUIDAvailable,
+	})
+}
+
+// GenerateGID generates a random GID in the configured range.
+func (g *IDGenerator) GenerateGID(lockedEntries *localentries.UserDBLocked, owner IDOwner) (uint32, func(), error) {
+	return g.generateID(lockedEntries, owner, generateID{
+		idType:        "GID",
+		minID:         g.GIDMin,
+		maxID:         g.GIDMax,
+		getUsedIDs:    g.getUsedGIDs,
+		isAvailableID: g.isGIDAvailable,
+	})
+}
+
+// This is an utility struct to allow code sharing simplifying the arguments passing.
+type generateID struct {
+	idType        string
+	minID, maxID  uint32
+	isAvailableID func(*localentries.UserDBLocked, uint32) (bool, error)
+	getUsedIDs    func(*localentries.UserDBLocked, IDOwner) ([]uint32, error)
+}
+
+func (g *IDGenerator) generateID(lockedEntries *localentries.UserDBLocked, owner IDOwner, args generateID) (id uint32, cleanup func(), err error) {
+	if args.minID > args.maxID {
+		return 0, nil, errors.New("minID must be less than or equal to maxID")
+	}
+
+	usedIDs, err := args.getUsedIDs(lockedEntries, owner)
+	if err != nil {
+		return 0, nil, err
+	}
+
+	// Add pending IDs to the used IDs to ensure we don't generate the same ID again
+	usedIDs = append(usedIDs, g.pendingIDs...)
+
+	usedIDs = normalizeUsedIDs(usedIDs, args.minID, args.maxID)
+
+	maxAttempts := min(maxIDGenerateIterations, args.maxID-args.minID+1)
+
+	for range maxAttempts {
+		id, pos, err := getIDCandidate(args.minID, args.maxID, usedIDs)
+		if err != nil {
+			return 0, nil, err
+		}
+
+		available, err := args.isAvailableID(lockedEntries, id)
+		if err != nil {
+			return 0, nil, err
+		}
+
+		if !available {
+			// Keep track of the id, but preserving usedIDs sorted, since we
+			// use the binary search to add elements to it.
+			usedIDs = slices.Insert(usedIDs, pos, id)
+
+			// If the GID is not available, try the next candidate
+			log.Debugf(context.Background(), "%s %d is already used", args.idType, id)
+			continue
+		}
+
+		g.pendingIDs = append(g.pendingIDs, id)
+		cleanup = func() {
+			idx := slices.Index(g.pendingIDs, id)
+			g.pendingIDs = append(g.pendingIDs[:idx], g.pendingIDs[idx+1:]...)
+		}
+		return id, cleanup, nil
+	}
+
+	return 0, nil, fmt.Errorf("failed to find a valid %s for after %d attempts",
+		args.idType, maxAttempts)
+}
+
+func getIDCandidate(minID, maxID uint32, usedIDs []uint32) (id uint32, uniqueIDsPos int, err error) {
+	// Pick the preferred ID candidate, starting with minID.
+	preferredID := minID
+
+	if len(usedIDs) > 0 {
+		// If there are used IDs, we prefer the next ID above the highest used.
+		// Note that this may overflow, and so go back to 0, but the next check
+		// will adjust the value to the minID.
+		preferredID = usedIDs[len(usedIDs)-1] + 1
+
+		// Ensure that the preferred ID is not less than the minimum ID.
+		preferredID = max(preferredID, minID)
+	}
+
+	// Try IDs starting from the preferred ID up to the maximum ID.
+	// Overflows are avoided by the "id < math.MaxUint32" condition.
+	for id := preferredID; id <= maxID && id < math.MaxUint32; id++ {
+		if isReservedID(id) {
+			continue
+		}
+
+		pos, found := slices.BinarySearch(usedIDs, id)
+		if found {
+			continue
+		}
+
+		return id, pos, nil
+	}
+
+	// Fallback: try IDs from the minimum ID up to the preferred ID.
+	// Overflows are avoided by "id < preferredID" condition, because
+	// preferredID is a uint32, so the condition must be false when
+	// id == math.MaxUint32.
+	for id := minID; id < preferredID && id <= maxID; id++ {
+		if isReservedID(id) {
+			continue
+		}
+
+		pos, found := slices.BinarySearch(usedIDs, id)
+		if found {
+			continue
+		}
+
+		return id, pos, nil
+	}
+
+	return 0, -1, errors.New("no available ID in range")
+}
+
+func isReservedID(id uint32) bool {
+	switch id {
+	case rootID,
+		nobodyID,
+		uidT32MinusOne,
+		uidT16MinusOne:
+		return true
+	default:
+		return false
+	}
+}
+
+func (g *IDGenerator) isUIDAvailable(lockedEntries *localentries.UserDBLocked, uid uint32) (bool, error) {
+	if unique, err := lockedEntries.IsUniqueUID(uid); !unique || err != nil {
+		return false, err
+	}
+
+	return true, nil
+}
+
+func (g *IDGenerator) isGIDAvailable(lockedEntries *localentries.UserDBLocked, gid uint32) (bool, error) {
+	if unique, err := lockedEntries.IsUniqueGID(gid); !unique || err != nil {
+		return false, err
+	}
+
+	return true, nil
+}
+
+func (g *IDGenerator) getUsedIDs(lockedEntries *localentries.UserDBLocked, owner IDOwner) ([]uint32, error) {
+	usedUIDs, err := g.getUsedUIDs(lockedEntries, owner)
+	if err != nil {
+		return nil, err
+	}
+
+	// For the user ID we also need to exclude all the GIDs, since the user
+	// private group ID will match its own uid, so if we don't do this, we may
+	// have a clash later on, when trying to add the group for this user.
+	usedGIDs, err := g.getUsedGIDs(lockedEntries, owner)
+	if err != nil {
+		return nil, err
+	}
+
+	return append(usedUIDs, usedGIDs...), nil
+}
+
+func (g *IDGenerator) getUsedUIDs(lockedEntries *localentries.UserDBLocked, owner IDOwner) ([]uint32, error) {
+	// Get the users from the authd database and pre-auth users.
+	uids, err := owner.UsedUIDs()
+	if err != nil {
+		return nil, err
+	}
+
+	// Get the user entries from the passwd file. We don't use NSS here,
+	// because for picking the next higher ID we only want to consider the users
+	// in /etc/passwd and in the authd database, not from other sources like LDAP.
+	userEntries, err := lockedEntries.GetLocalUserEntries()
+	if err != nil {
+		return nil, err
+	}
+	for _, user := range userEntries {
+		uids = append(uids, user.UID)
+	}
+
+	return uids, nil
+}
+
+func (g *IDGenerator) getUsedGIDs(lockedEntries *localentries.UserDBLocked, owner IDOwner) ([]uint32, error) {
+	gids, err := owner.UsedGIDs()
+	if err != nil {
+		return nil, err
+	}
+
+	// Get the group entries from the passwd file. We don't use NSS here,
+	// because for picking the next higher ID we only want to consider the groups
+	// in /etc/group and the users in /etc/group and in the authd database, not
+	// from other sources like LDAP (in case merge method is used).
+	groupEntries, err := lockedEntries.GetLocalGroupEntries()
+	if err != nil {
+		return nil, err
+	}
+	for _, group := range groupEntries {
+		gids = append(gids, group.GID)
+	}
+
+	// And include users GIDs too.
+	userEntries, err := lockedEntries.GetLocalUserEntries()
+	if err != nil {
+		return nil, err
+	}
+	for _, user := range userEntries {
+		gids = append(gids, user.GID)
+	}
+
+	return gids, nil
+}
+
+func normalizeUsedIDs(usedIDs []uint32, minID, maxID uint32) []uint32 {
+	// Sort usedIDs so we can binary search
+	sort.Slice(usedIDs, func(i, j int) bool { return usedIDs[i] < usedIDs[j] })
+
+	// Cut off usedIDs to the range we care about
+	if len(usedIDs) > 0 && usedIDs[0] < minID {
+		// Find the first ID >= minID
+		firstIndex := slices.IndexFunc(usedIDs, func(id uint32) bool { return id >= minID })
+		if firstIndex != -1 {
+			// Slice usedIDs to start from the first ID >= minID
+			usedIDs = usedIDs[firstIndex:]
+		}
+	}
+	if len(usedIDs) > 0 && usedIDs[len(usedIDs)-1] > maxID {
+		// Find the last ID <= maxID
+		lastIndex := slices.IndexFunc(usedIDs, func(id uint32) bool { return id > maxID })
+		if lastIndex != -1 {
+			// Slice usedIDs to end at the last ID <= maxID
+			usedIDs = usedIDs[:lastIndex]
+		}
+	}
+
+	// Remove duplicates from usedIDs
+	return slices.Compact(usedIDs)
+}
diff --git a/internal/users/idgenerator/idgenerator.go b/internal/users/idgenerator/idgenerator.go
deleted file mode 100644
index f95dd605bd..0000000000
--- a/internal/users/idgenerator/idgenerator.go
+++ /dev/null
@@ -1,38 +0,0 @@
-// Package idgenerator provides an ID generator that generates UIDs and GIDs in a specific range.
-package idgenerator
-
-import (
-	"crypto/rand"
-	"math/big"
-)
-
-// IDGenerator is an ID generator that generates UIDs and GIDs in a specific range.
-type IDGenerator struct {
-	UIDMin uint32
-	UIDMax uint32
-	GIDMin uint32
-	GIDMax uint32
-}
-
-// GenerateUID generates a random UID in the configured range.
-func (g *IDGenerator) GenerateUID() (uint32, error) {
-	return generateID(g.UIDMin, g.UIDMax)
-}
-
-// GenerateGID generates a random GID in the configured range.
-func (g *IDGenerator) GenerateGID() (uint32, error) {
-	return generateID(g.GIDMin, g.GIDMax)
-}
-
-func generateID(minID, maxID uint32) (uint32, error) {
-	diff := int64(maxID - minID)
-	// Generate a cryptographically secure random number between 0 and diff
-	nBig, err := rand.Int(rand.Reader, big.NewInt(diff+1))
-	if err != nil {
-		return 0, err
-	}
-
-	// Add minID to get a number in the desired range
-	//nolint:gosec // This conversion is safe because we only generate UIDs which are positive and smaller than uint32.
-	return uint32(nBig.Int64()) + minID, nil
-}
diff --git a/internal/users/idgenerator/idgenerator_test.go b/internal/users/idgenerator/idgenerator_test.go
deleted file mode 100644
index 845099c36b..0000000000
--- a/internal/users/idgenerator/idgenerator_test.go
+++ /dev/null
@@ -1,31 +0,0 @@
-package idgenerator
-
-import (
-	"testing"
-
-	"github.com/stretchr/testify/require"
-)
-
-func TestGenerateID(t *testing.T) {
-	t.Parallel()
-
-	tests := map[string]struct {
-		input string
-		idMin uint32
-		idMax uint32
-	}{
-		"Generated_ID_is_within_the_defined_range":        {input: "test", idMin: 1000, idMax: 2000},
-		"Generate_ID_with_minimum_ID_equal_to_maximum_ID": {input: "test", idMin: 1000, idMax: 1000},
-	}
-	for name, tc := range tests {
-		t.Run(name, func(t *testing.T) {
-			t.Parallel()
-
-			id, err := generateID(tc.idMin, tc.idMax)
-			require.NoError(t, err, "GenerateID should not have failed")
-
-			require.GreaterOrEqual(t, id, tc.idMin, "GenerateID should return an ID greater or equal to the minimum")
-			require.LessOrEqual(t, id, tc.idMax, "GenerateID should return an ID less or equal to the maximum")
-		})
-	}
-}
diff --git a/internal/users/idgenerator/testutils.go b/internal/users/idgenerator/testutils.go
deleted file mode 100644
index 81375cb288..0000000000
--- a/internal/users/idgenerator/testutils.go
+++ /dev/null
@@ -1,30 +0,0 @@
-package idgenerator
-
-import "fmt"
-
-// IDGeneratorMock is a mock implementation of the IDGenerator interface.
-// revive:disable-next-line:exported // We don't want to call this type just "Mock"
-type IDGeneratorMock struct {
-	UIDsToGenerate []uint32
-	GIDsToGenerate []uint32
-}
-
-// GenerateUID generates a UID.
-func (g *IDGeneratorMock) GenerateUID() (uint32, error) {
-	if len(g.UIDsToGenerate) == 0 {
-		return 0, fmt.Errorf("no more UIDs to generate")
-	}
-	uid := g.UIDsToGenerate[0]
-	g.UIDsToGenerate = g.UIDsToGenerate[1:]
-	return uid, nil
-}
-
-// GenerateGID generates a GID.
-func (g *IDGeneratorMock) GenerateGID() (uint32, error) {
-	if len(g.GIDsToGenerate) == 0 {
-		return 0, fmt.Errorf("no more GIDs to generate")
-	}
-	gid := g.GIDsToGenerate[0]
-	g.GIDsToGenerate = g.GIDsToGenerate[1:]
-	return gid, nil
-}
diff --git a/internal/users/idgenerator_test.go b/internal/users/idgenerator_test.go
new file mode 100644
index 0000000000..a2419c5589
--- /dev/null
+++ b/internal/users/idgenerator_test.go
@@ -0,0 +1,390 @@
+package users
+
+import (
+	"errors"
+	"fmt"
+	"math"
+	"testing"
+
+	"github.com/canonical/authd/internal/users/localentries"
+	"github.com/stretchr/testify/require"
+)
+
+func TestGetIDCandidate(t *testing.T) {
+	t.Parallel()
+
+	tests := map[string]struct {
+		idMin uint32
+		idMax uint32
+		used  []uint32
+
+		wantPos int
+		wantID  uint32
+		wantErr bool
+	}{
+		"Generated_ID_is_within_the_defined_range": {
+			idMin: 1000, idMax: 2000,
+			wantID:  1000,
+			wantPos: 0,
+		},
+		"Generate_ID_with_minimum_ID_equal_to_maximum_ID": {
+			idMin: 1000, idMax: 1000,
+			wantID:  1000,
+			wantPos: 0,
+		},
+		"UsedIDs_outside_range_are_ignored": {
+			idMin: 1000, idMax: 2000,
+			used:    []uint32{1, 2, 3, 999, 2001, 3000},
+			wantID:  1000,
+			wantPos: 4,
+		},
+		"UsedIDs_in_middle_of_range": {
+			idMin: 1000, idMax: 1005,
+			used:    []uint32{1002, 1003},
+			wantID:  1004,
+			wantPos: 2,
+		},
+		"UsedIDs_at_the_end_of_range": {
+			idMin: 1000, idMax: 1005,
+			used:    []uint32{1002, 1005},
+			wantID:  1000,
+			wantPos: 0,
+		},
+		"UsedIDs_minID_equals_maxID_and_unused": {
+			idMin: 1000, idMax: 1000,
+			wantID:  1000,
+			wantPos: 0,
+		},
+		"UsedIDs_last_value_is_smaller_than_the_minimum_id": {
+			idMin: 1000, idMax: 2000,
+			used:    []uint32{20, 100},
+			wantID:  1000,
+			wantPos: 2,
+		},
+		"Intermediate_value_after_MaxUint32_is_reached": {
+			idMin: math.MaxUint32 - 2, idMax: math.MaxUint32,
+			used:    []uint32{math.MaxUint32 - 2, math.MaxUint32},
+			wantID:  math.MaxUint32 - 1,
+			wantPos: 1,
+		},
+
+		"Error_if_no_available_ID_in_range": {
+			idMin: 1000, idMax: 2000,
+			used: func() []uint32 {
+				used := make([]uint32, 0, 1001)
+				for i := uint32(1000); i <= 2000; i++ {
+					used = append(used, i)
+				}
+				return used
+			}(),
+			wantErr: true,
+		},
+		"Error_if_usedIDs_minID_equals_maxID_and_is_used": {
+			idMin: 1000, idMax: 1000,
+			used:    []uint32{1000},
+			wantErr: true,
+		},
+		"Error_if_minID_greater_than_maxID": {
+			idMin: 100000, idMax: 10000,
+			wantErr: true,
+		},
+		"Error_if_all_the_values_next_to_MaxUint32_are_used": {
+			idMin: math.MaxUint32 - 2, idMax: math.MaxUint32,
+			used:    []uint32{math.MaxUint32 - 2, math.MaxUint32 - 1, math.MaxUint32},
+			wantErr: true,
+		},
+		"Error_if_only_MaxUint32_is_available": {
+			idMin:   math.MaxUint32,
+			idMax:   math.MaxUint32,
+			wantErr: true,
+		},
+	}
+
+	for name, tc := range tests {
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			id, pos, err := getIDCandidate(tc.idMin, tc.idMax, tc.used)
+			if tc.wantErr {
+				require.Error(t, err, "getIDCandidate not returned an error as expected")
+				require.Equal(t, -1, pos, "getIDCandidate did not return the expected usedIDs position")
+				return
+			}
+
+			require.NoError(t, err, "getIDCandidate returned an unexpected error")
+			require.GreaterOrEqual(t, int(id), int(tc.idMin), "ID is less than idMin")
+			require.LessOrEqual(t, int(id), int(tc.idMax), "ID is greater than idMax")
+			require.GreaterOrEqual(t, pos, 0, "Position is not greater or equal 0")
+			require.Equal(t, int(tc.wantID), int(id), "Generated ID does not match expected value")
+			require.Equal(t, tc.wantPos, pos, "getIDCandidate returned unexpected position in usedIDs")
+		})
+	}
+}
+
+type IDOwnerMock struct {
+	usedUIDs []uint32
+	usedGIDs []uint32
+}
+
+func (m IDOwnerMock) UsedUIDs() ([]uint32, error) { return m.usedUIDs, nil }
+func (m IDOwnerMock) UsedGIDs() ([]uint32, error) { return m.usedGIDs, nil }
+
+func TestGenerateIDMocked(t *testing.T) {
+	t.Parallel()
+
+	allAvailableIDsFunc := func(_ *localentries.UserDBLocked, u uint32) (bool, error) {
+		return true, nil
+	}
+	noAvailableIDFunc := func(_ *localentries.UserDBLocked, u uint32) (bool, error) {
+		return false, nil
+	}
+	noUsedIDFunc := func(_ *localentries.UserDBLocked, o IDOwner) ([]uint32, error) {
+		return nil, nil
+	}
+	getOwnerUsedUIDsFunc := func(_ *localentries.UserDBLocked, o IDOwner) ([]uint32, error) {
+		return o.UsedUIDs()
+	}
+	getOwnerUsedGIDsFunc := func(_ *localentries.UserDBLocked, o IDOwner) ([]uint32, error) {
+		return o.UsedGIDs()
+	}
+
+	tests := map[string]struct {
+		genID          generateID
+		owner          IDOwner
+		generator      IDGenerator
+		noCleanupCheck bool
+
+		wantErr bool
+		wantID  uint32
+	}{
+		"Generated_ID_is_within_the_defined_range": {
+			genID: generateID{
+				idType: "UID",
+				minID:  10000, maxID: 10010,
+				isAvailableID: allAvailableIDsFunc,
+				getUsedIDs:    noUsedIDFunc,
+			},
+			wantID: 10000,
+		},
+		"Generated_ID_when_only_one_possible_value_is_available": {
+			genID: generateID{
+				idType: "UID",
+				minID:  10000, maxID: 10000,
+				isAvailableID: allAvailableIDsFunc,
+				getUsedIDs:    noUsedIDFunc,
+			},
+			wantID: 10000,
+		},
+		"Owner_with_some_used_UIDs": {
+			genID: generateID{
+				idType: "UID",
+				minID:  500, maxID: 505,
+				isAvailableID: allAvailableIDsFunc,
+				getUsedIDs:    getOwnerUsedUIDsFunc,
+			},
+			owner:  IDOwnerMock{usedUIDs: []uint32{500, 501, 502}},
+			wantID: 503,
+		},
+		"Owner_with_some_used_GIDs": {
+			genID: generateID{
+				idType: "GID",
+				minID:  200, maxID: 202,
+				isAvailableID: allAvailableIDsFunc,
+				getUsedIDs:    getOwnerUsedGIDsFunc,
+			},
+			owner:  IDOwnerMock{usedGIDs: []uint32{200}},
+			wantID: 201,
+		},
+		"Owner_with_no_used_IDs": {
+			genID: generateID{
+				idType: "UID",
+				minID:  300, maxID: 301,
+				isAvailableID: allAvailableIDsFunc,
+				getUsedIDs:    getOwnerUsedUIDsFunc,
+			},
+			owner:  IDOwnerMock{usedUIDs: nil},
+			wantID: 300,
+		},
+		"PendingIDs_are_considered": {
+			genID: generateID{
+				idType: "UID",
+				minID:  100, maxID: 105,
+				isAvailableID: allAvailableIDsFunc,
+				getUsedIDs:    noUsedIDFunc,
+			},
+			generator:      IDGenerator{pendingIDs: []uint32{100, 101, 102}},
+			wantID:         103,
+			noCleanupCheck: true,
+		},
+		"Used_ids_are_always_sorted": {
+			genID: generateID{
+				idType: "UID",
+				minID:  300, maxID: 303,
+				isAvailableID: func(_ *localentries.UserDBLocked, u uint32) (bool, error) {
+					return u == 302, nil
+				},
+				getUsedIDs: getOwnerUsedUIDsFunc,
+			},
+			owner:  IDOwnerMock{usedUIDs: []uint32{300, 303}},
+			wantID: 302,
+		},
+		"Root_uid_is_always_skipped": {
+			genID: generateID{
+				idType: "UID",
+				minID:  0, maxID: 1,
+				isAvailableID: allAvailableIDsFunc,
+				getUsedIDs:    noUsedIDFunc,
+			},
+			wantID: 1,
+		},
+		"Nobody_and_uid-t_16bit_are_always_skipped": {
+			genID: generateID{
+				idType: "UID",
+				minID:  nobodyID, maxID: nobodyID + 2,
+				isAvailableID: allAvailableIDsFunc,
+				getUsedIDs:    noUsedIDFunc,
+			},
+			wantID: nobodyID + 2,
+		},
+		"uid-t_32bit_is_always_skipped": {
+			genID: generateID{
+				idType: "UID",
+				minID:  uidT32MinusOne - 2, maxID: uidT32MinusOne,
+				isAvailableID: allAvailableIDsFunc,
+				getUsedIDs:    getOwnerUsedUIDsFunc,
+			},
+			owner:  IDOwnerMock{usedUIDs: []uint32{uidT32MinusOne}},
+			wantID: uidT32MinusOne - 2,
+		},
+		"MaxUint32_is_always_skipped": {
+			genID: generateID{
+				idType: "UID",
+				minID:  math.MaxUint32 - 2, maxID: math.MaxUint32,
+				isAvailableID: allAvailableIDsFunc,
+				getUsedIDs:    getOwnerUsedUIDsFunc,
+			},
+			owner:  IDOwnerMock{usedUIDs: []uint32{math.MaxUint32 - 1}},
+			wantID: math.MaxUint32 - 2,
+		},
+
+		// Error cases
+		"Error_if_minID_is_equal_to_maxID": {
+			genID: generateID{
+				idType: "UID",
+				minID:  10001, maxID: 10000,
+			},
+			wantErr: true,
+		},
+		"Error_if_ID_not_available_due_to_isAvailableID": {
+			genID: generateID{
+				idType: "UID",
+				minID:  10000, maxID: 10010,
+				isAvailableID: noAvailableIDFunc,
+				getUsedIDs:    noUsedIDFunc,
+			},
+			wantErr: true,
+		},
+		"Error_if_ID_not_available_due_to_isAvailableID_error": {
+			genID: generateID{
+				idType: "UID",
+				minID:  10000, maxID: 10010,
+				isAvailableID: func(_ *localentries.UserDBLocked, u uint32) (bool, error) {
+					return false, errors.New("test error")
+				},
+				getUsedIDs: noUsedIDFunc,
+			},
+			wantErr: true,
+		},
+		"Error_if_all_IDs_are_used": {
+			genID: generateID{
+				idType: "UID",
+				minID:  10000, maxID: 10002,
+				isAvailableID: allAvailableIDsFunc,
+				getUsedIDs: func(_ *localentries.UserDBLocked, o IDOwner) ([]uint32, error) {
+					return []uint32{10000, 10001, 10002}, nil
+				},
+			},
+			wantErr: true,
+		},
+		"Error_if_all_the_IDs_in_range_are_unavailable": {
+			genID: generateID{
+				idType: "ID",
+				minID:  0, maxID: 100,
+				isAvailableID: noAvailableIDFunc,
+				getUsedIDs:    noUsedIDFunc,
+			},
+			wantErr: true,
+		},
+		"Error_if_all_the_IDs_in_range_are_unavailable_after_max_checks": {
+			genID: generateID{
+				idType: "ID",
+				minID:  10000, maxID: math.MaxUint32,
+				isAvailableID: func(_ *localentries.UserDBLocked, u uint32) (bool, error) {
+					return u < 10000, nil
+				},
+				getUsedIDs: noUsedIDFunc,
+			},
+			wantErr: true,
+		},
+		"Error_if_getUsedIDs_returns_error": {
+			genID: generateID{
+				idType: "UID",
+				minID:  10000, maxID: 10010,
+				isAvailableID: allAvailableIDsFunc,
+				getUsedIDs: func(_ *localentries.UserDBLocked, o IDOwner) ([]uint32, error) {
+					return nil, errors.New("usedIDs error")
+				},
+			},
+			wantErr: true,
+		},
+		"Owner_with_all_UIDs_used": {
+			genID: generateID{
+				idType: "UID",
+				minID:  10, maxID: 12,
+				isAvailableID: allAvailableIDsFunc,
+				getUsedIDs:    getOwnerUsedUIDsFunc,
+			},
+			owner:   IDOwnerMock{usedUIDs: []uint32{10, 11, 12}},
+			wantErr: true,
+		},
+	}
+
+	for name, tc := range tests {
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			if tc.genID.idType == "" {
+				tc.genID.idType = t.Name()
+			} else {
+				tc.genID.idType = fmt.Sprintf("%s_%s", t.Name(),
+					tc.genID.idType)
+			}
+
+			lockedMock := &localentries.UserDBLocked{}
+			id, cleanup, err := tc.generator.generateID(lockedMock,
+				tc.owner, tc.genID)
+			if tc.wantErr {
+				require.Error(t, err, "Expected error but got none")
+				require.Zero(t, id, "Expected id to be zero")
+				return
+			}
+			require.NoError(t, err, "GenerateID should not fail")
+
+			t.Cleanup(func() {
+				cleanup()
+
+				if tc.noCleanupCheck {
+					return
+				}
+				require.Empty(t, tc.generator.pendingIDs, "Expected generator to be empty after cleanup")
+			})
+
+			require.GreaterOrEqual(t, int(id), int(tc.genID.minID), "Id %d is less than minID %d",
+				id, tc.genID.minID)
+			require.LessOrEqual(t, int(id), int(tc.genID.maxID), "Id %d is greater than maxID %d",
+				id, tc.genID.maxID)
+			require.Equal(t, int(tc.wantID), int(id), "Generated unexpected ID")
+			require.Contains(t, tc.generator.pendingIDs, id, "Id %d not found in pendingIDs", id)
+		})
+	}
+}
diff --git a/internal/users/idlimits.go b/internal/users/idlimits.go
new file mode 100644
index 0000000000..386539fb01
--- /dev/null
+++ b/internal/users/idlimits.go
@@ -0,0 +1,8 @@
+// Code generated by "idlimitsgenerator"; DO NOT EDIT.
+package users
+
+const (
+	// dynamic service users (nss-systemd).
+	systemdDynamicUIDMin uint32 = 61184
+	systemdDynamicUIDMax uint32 = 65519
+)
diff --git a/internal/users/idlimitsgenerator/idlimitsgenerator.go b/internal/users/idlimitsgenerator/idlimitsgenerator.go
new file mode 100644
index 0000000000..64cd23d9d3
--- /dev/null
+++ b/internal/users/idlimitsgenerator/idlimitsgenerator.go
@@ -0,0 +1,84 @@
+//go:build generate
+
+// TiCS: disabled // This is a helper file to generate the IDs from pkg-config.
+
+// Package main is the package for the ID limits generator.
+package main
+
+import (
+	"bytes"
+	"fmt"
+	"log"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strconv"
+	"strings"
+	"text/template"
+)
+
+const (
+	outputFile = "idlimits.go"
+)
+
+const tmpl = `// Code generated by "{{ .GeneratorName }}"; DO NOT EDIT.
+package users
+
+const (
+	// dynamic service users (nss-systemd).
+	systemdDynamicUIDMin uint32 = {{ .DynamicUidMin }}
+	systemdDynamicUIDMax uint32 = {{ .DynamicUidMax }}
+)
+`
+
+type variables struct {
+	GeneratorName string
+	DynamicUidMin uint32
+	DynamicUidMax uint32
+}
+
+func getPkgConfigVariable(library, variable string) (string, error) {
+	cmd := exec.Command("pkg-config", library, fmt.Sprintf("--variable=%s", variable))
+	out, err := cmd.CombinedOutput()
+	return strings.TrimSpace(string(out)), err
+}
+
+func systemdLimitValue(variable string) uint32 {
+	val, err := getPkgConfigVariable("systemd", variable)
+	if err != nil {
+		log.Fatalf("Error getting pkg-config variable %q: %v", variable, err)
+	}
+
+	uintVal, err := strconv.ParseUint(val, 10, 32)
+	if err != nil {
+		log.Fatalf("Error parsing %q value %q to uint32: %v", variable, val, err)
+	}
+	return uint32(uintVal)
+}
+
+func main() {
+	generatorName, err := os.Executable()
+	if err != nil {
+		log.Fatal(err)
+	}
+
+	vars := variables{
+		GeneratorName: filepath.Base(generatorName),
+		DynamicUidMin: systemdLimitValue("dynamic_uid_min"),
+		DynamicUidMax: systemdLimitValue("dynamic_uid_max"),
+	}
+
+	tmpl, err := template.New("idlimits").Parse(tmpl)
+	if err != nil {
+		log.Fatalf("Failed to parse template: %v", err)
+	}
+
+	var buf bytes.Buffer
+	if err := tmpl.Execute(&buf, vars); err != nil {
+		log.Fatalf("Failed to execute template: %v", err)
+	}
+
+	if err := os.WriteFile(outputFile, buf.Bytes(), 0600); err != nil {
+		log.Fatalf("Failed to write output file: %v", err)
+	}
+}
diff --git a/internal/users/localentries/export_test.go b/internal/users/localentries/export_test.go
index 45fdd38129..31d2e9f921 100644
--- a/internal/users/localentries/export_test.go
+++ b/internal/users/localentries/export_test.go
@@ -1,22 +1,63 @@
 package localentries
 
+import (
+	userslocking "github.com/canonical/authd/internal/users/locking"
+	"github.com/canonical/authd/internal/users/types"
+)
+
 // WithGroupPath overrides the default /etc/group path for tests.
 func WithGroupPath(p string) Option {
 	return func(o *options) {
-		o.groupPath = p
+		o.inputGroupPath = p
+		o.outputGroupPath = p
+	}
+}
+
+// WithPasswdInputPath overrides the default /etc/passwd path for input in tests.
+func WithPasswdInputPath(p string) Option {
+	return func(o *options) {
+		o.inputPasswdPath = p
+	}
+}
+
+// WithGroupInputPath overrides the default /etc/group path for input in tests.
+func WithGroupInputPath(p string) Option {
+	return func(o *options) {
+		o.inputGroupPath = p
 	}
 }
 
-// WithGpasswdCmd overrides gpasswd call with specific commands for tests.
-func WithGpasswdCmd(cmds []string) Option {
+// WithGroupOutputPath overrides the default /etc/group path for output in tests.
+func WithGroupOutputPath(p string) Option {
 	return func(o *options) {
-		o.gpasswdCmd = cmds
+		o.outputGroupPath = p
 	}
 }
 
-// WithGetUsersFunc overrides the getusers func with a custom one for tests.
-func WithGetUsersFunc(getUsersFunc func() ([]string, error)) Option {
+// WithMockUserDBLocking uses a mock implementation to lock the users database.
+func WithMockUserDBLocking() Option {
 	return func(o *options) {
-		o.getUsersFunc = getUsersFunc
+		mock := userslocking.SimpleMock{}
+		o.writeLockFunc = mock.WriteLock
+		o.writeUnlockFunc = mock.WriteUnlock
 	}
 }
+
+// WithUserDBLockedInstance allows to use a test-provided locked instance that
+// can be used to verify the refcounting behavior instead of relying on the
+// default instance that is used normally.
+func WithUserDBLockedInstance(userDBLocked *UserDBLocked) Option {
+	return func(o *options) {
+		o.userDBLocked = userDBLocked
+	}
+}
+
+// GroupFileBackupPath exposes the path to the group file backup for testing.
+func GroupFileBackupPath(groupFilePath string) string {
+	return groupFileBackupPath(groupFilePath)
+}
+
+// ValidateChangedGroups validates the new groups given the current, changed and new groups.
+func ValidateChangedGroups(currentGroups, newGroups []types.GroupEntry) error {
+	return validateChangedGroups(currentGroups, newGroups)
+}
diff --git a/internal/users/localentries/getgrent_c.go b/internal/users/localentries/getgrent_c.go
index acdee706f7..04b4d058f3 100644
--- a/internal/users/localentries/getgrent_c.go
+++ b/internal/users/localentries/getgrent_c.go
@@ -1,6 +1,4 @@
 // Package localentries provides functions to access the local user and group database.
-//
-//nolint:dupl // This it not a duplicate of getpwent_c.go
 package localentries
 
 /*
@@ -9,6 +7,14 @@ package localentries
 #include <stdlib.h>
 #include <pwd.h>
 #include <grp.h>
+
+// Return the length of a NULL-terminated array of strings.
+size_t strv_len(const char * const * strv) {
+    size_t n = 0;
+    while (strv[n]) n++;
+    return n;
+}
+
 */
 import "C"
 
@@ -19,20 +25,15 @@ import (
 	"syscall"
 	"unsafe"
 
-	"github.com/ubuntu/decorate"
+	"github.com/canonical/authd/internal/decorate"
+	"github.com/canonical/authd/internal/users/types"
 )
 
-// Group represents a group entry.
-type Group struct {
-	Name   string
-	GID    uint32
-	Passwd string
-}
-
+// types.GroupEntry represents a group entry.
 var getgrentMu sync.Mutex
 
-// GetGroupEntries returns all group entries.
-func GetGroupEntries() (entries []Group, err error) {
+// getGroupEntries returns all group entries.
+func getGroupEntries() (entries []types.GroupEntry, err error) {
 	decorate.OnError(&err, "getgrent_r")
 
 	// This function repeatedly calls getgrent_r, which iterates over the records in the group database.
@@ -71,58 +72,29 @@ func GetGroupEntries() (entries []Group, err error) {
 			return nil, errno
 		}
 
-		entries = append(entries, Group{
+		entries = append(entries, types.GroupEntry{
 			Name:   C.GoString(groupPtr.gr_name),
 			Passwd: C.GoString(groupPtr.gr_passwd),
 			GID:    uint32(groupPtr.gr_gid),
+			Users:  strvToSlice(groupPtr.gr_mem),
 		})
 	}
 }
 
-// ErrGroupNotFound is returned when a group is not found.
-var ErrGroupNotFound = errors.New("group not found")
-
-// GetGroupByName returns the group with the given name.
-func GetGroupByName(name string) (g Group, err error) {
-	decorate.OnError(&err, "getgrnam_r")
-
-	var group C.struct_group
-	var groupPtr *C.struct_group
-	buf := make([]C.char, 256)
-
-	pinner := runtime.Pinner{}
-	defer pinner.Unpin()
-
-	pinner.Pin(&group)
-	pinner.Pin(&buf[0])
-
-	cName := C.CString(name)
-	defer C.free(unsafe.Pointer(cName))
-
-	for {
-		ret := C.getgrnam_r(cName, &group, &buf[0], C.size_t(len(buf)), &groupPtr)
-		errno := syscall.Errno(ret)
+func strvToSlice(strv **C.char) []string {
+	if strv == nil {
+		return nil
+	}
+	n := C.strv_len(strv)
+	if n == 0 {
+		return nil
+	}
 
-		if errors.Is(errno, syscall.ERANGE) {
-			buf = make([]C.char, len(buf)*2)
-			pinner.Pin(&buf[0])
-			continue
-		}
-		if (errors.Is(errno, syscall.Errno(0)) && groupPtr == nil) ||
-			errors.Is(errno, syscall.ENOENT) ||
-			errors.Is(errno, syscall.ESRCH) ||
-			errors.Is(errno, syscall.EBADF) ||
-			errors.Is(errno, syscall.EPERM) {
-			return Group{}, ErrGroupNotFound
-		}
-		if !errors.Is(errno, syscall.Errno(0)) {
-			return Group{}, errno
-		}
+	cStrings := unsafe.Slice(strv, int(n))
 
-		return Group{
-			Name:   C.GoString(groupPtr.gr_name),
-			GID:    uint32(groupPtr.gr_gid),
-			Passwd: C.GoString(groupPtr.gr_passwd),
-		}, nil
+	out := make([]string, int(n))
+	for i := 0; i < int(n); i++ {
+		out[i] = C.GoString(cStrings[i])
 	}
+	return out
 }
diff --git a/internal/users/localentries/getgrent_test.go b/internal/users/localentries/getgrent_test.go
index c8a6e9558c..d40a63c3ae 100644
--- a/internal/users/localentries/getgrent_test.go
+++ b/internal/users/localentries/getgrent_test.go
@@ -5,6 +5,7 @@ import (
 	"slices"
 	"testing"
 
+	"github.com/canonical/authd/internal/users/types"
 	"github.com/stretchr/testify/require"
 )
 
@@ -16,42 +17,16 @@ func TestGetGroupEntries(t *testing.T) {
 		t.Run(fmt.Sprintf("iteration_%d", idx), func(t *testing.T) {
 			t.Parallel()
 
-			got, err := GetGroupEntries()
+			got, err := getGroupEntries()
 			require.NoError(t, err, "GetGroupEntries should never return an error")
 			require.NotEmpty(t, got, "GetGroupEntries should never return an empty list")
-			require.True(t, slices.ContainsFunc(got, func(g Group) bool {
+			require.True(t, slices.ContainsFunc(got, func(g types.GroupEntry) bool {
 				return g.Name == "root" && g.GID == 0
 			}), "GetGroupEntries should return root")
-		})
-	}
-}
-
-func TestGetGroupByName(t *testing.T) {
-	t.Parallel()
-
-	for idx := range 10 {
-		t.Run(fmt.Sprintf("iteration_%d", idx), func(t *testing.T) {
-			t.Parallel()
-
-			got, err := GetGroupByName("root")
-			require.NoError(t, err, "GetGroupByName should not return an error")
-			require.Equal(t, got.Name, "root")
-			require.Equal(t, got.GID, uint32(0))
-			require.Equal(t, got.Passwd, "x")
-		})
-	}
-}
-
-func TestGetGroupByName_NotFound(t *testing.T) {
-	t.Parallel()
-
-	for idx := range 10 {
-		t.Run(fmt.Sprintf("iteration_%d", idx), func(t *testing.T) {
-			t.Parallel()
 
-			got, err := GetGroupByName(fmt.Sprintf("nonexistent-really-%d", idx))
-			require.ErrorIs(t, err, ErrGroupNotFound)
-			require.Equal(t, got.Name, "")
+			require.True(t, slices.ContainsFunc(got, func(g types.GroupEntry) bool {
+				return len(g.Users) > 0
+			}), "GetGroupEntries should returns at least one group that have users")
 		})
 	}
 }
diff --git a/internal/users/localentries/getpwent_c.go b/internal/users/localentries/getpwent_c.go
index cf4d96768a..584a79f53d 100644
--- a/internal/users/localentries/getpwent_c.go
+++ b/internal/users/localentries/getpwent_c.go
@@ -1,6 +1,4 @@
 // Package localentries provides functions to access local passwd entries.
-//
-//nolint:dupl // This it not a duplicate of getgrent_c.go
 package localentries
 
 /*
@@ -15,22 +13,15 @@ import (
 	"runtime"
 	"sync"
 	"syscall"
-	"unsafe"
 
-	"github.com/ubuntu/decorate"
+	"github.com/canonical/authd/internal/decorate"
+	"github.com/canonical/authd/internal/users/types"
 )
 
-// Passwd represents a passwd entry.
-type Passwd struct {
-	Name  string
-	UID   uint32
-	Gecos string
-}
-
 var getpwentMu sync.Mutex
 
-// GetPasswdEntries returns all passwd entries.
-func GetPasswdEntries() (entries []Passwd, err error) {
+// getUserEntries returns all passwd entries.
+func getUserEntries() (entries []types.UserEntry, err error) {
 	decorate.OnError(&err, "getpwent_r")
 
 	// This function repeatedly calls getpwent_r, which iterates over the records in the passwd database.
@@ -69,58 +60,13 @@ func GetPasswdEntries() (entries []Passwd, err error) {
 			return nil, errno
 		}
 
-		entries = append(entries, Passwd{
+		entries = append(entries, types.UserEntry{
 			Name:  C.GoString(passwdPtr.pw_name),
 			UID:   uint32(passwdPtr.pw_uid),
+			GID:   uint32(passwdPtr.pw_gid),
 			Gecos: C.GoString(passwdPtr.pw_gecos),
+			Dir:   C.GoString(passwdPtr.pw_dir),
+			Shell: C.GoString(passwdPtr.pw_shell),
 		})
 	}
 }
-
-// ErrUserNotFound is returned when a user is not found.
-var ErrUserNotFound = errors.New("user not found")
-
-// GetPasswdByName returns the user with the given name.
-func GetPasswdByName(name string) (p Passwd, err error) {
-	decorate.OnError(&err, "getgrnam_r")
-
-	var passwd C.struct_passwd
-	var passwdPtr *C.struct_passwd
-	buf := make([]C.char, 256)
-
-	pinner := runtime.Pinner{}
-	defer pinner.Unpin()
-
-	pinner.Pin(&passwd)
-	pinner.Pin(&buf[0])
-
-	cName := C.CString(name)
-	defer C.free(unsafe.Pointer(cName))
-
-	for {
-		ret := C.getpwnam_r(cName, &passwd, &buf[0], C.size_t(len(buf)), &passwdPtr)
-		errno := syscall.Errno(ret)
-
-		if errors.Is(errno, syscall.ERANGE) {
-			buf = make([]C.char, len(buf)*2)
-			pinner.Pin(&buf[0])
-			continue
-		}
-		if (errors.Is(errno, syscall.Errno(0)) && passwdPtr == nil) ||
-			errors.Is(errno, syscall.ENOENT) ||
-			errors.Is(errno, syscall.ESRCH) ||
-			errors.Is(errno, syscall.EBADF) ||
-			errors.Is(errno, syscall.EPERM) {
-			return Passwd{}, ErrUserNotFound
-		}
-		if !errors.Is(errno, syscall.Errno(0)) {
-			return Passwd{}, errno
-		}
-
-		return Passwd{
-			Name:  C.GoString(passwdPtr.pw_name),
-			UID:   uint32(passwdPtr.pw_uid),
-			Gecos: C.GoString(passwdPtr.pw_gecos),
-		}, nil
-	}
-}
diff --git a/internal/users/localentries/getpwent_test.go b/internal/users/localentries/getpwent_test.go
index 163c22d452..dc144d5e9c 100644
--- a/internal/users/localentries/getpwent_test.go
+++ b/internal/users/localentries/getpwent_test.go
@@ -5,6 +5,7 @@ import (
 	"slices"
 	"testing"
 
+	"github.com/canonical/authd/internal/users/types"
 	"github.com/stretchr/testify/require"
 )
 
@@ -15,45 +16,15 @@ func TestGetPasswdEntries(t *testing.T) {
 		t.Run(fmt.Sprintf("iteration_%d", idx), func(t *testing.T) {
 			t.Parallel()
 
-			got, err := GetPasswdEntries()
+			got, err := getUserEntries()
 			require.NoError(t, err, "GetPasswdEntries should never return an error")
 			require.NotEmpty(t, got, "GetPasswdEntries should never return an empty list")
 
 			// Check if the root user is present in the list
-			rootFound := slices.ContainsFunc(got, func(entry Passwd) bool {
-				return entry.Name == "root" && entry.UID == 0
+			rootFound := slices.ContainsFunc(got, func(entry types.UserEntry) bool {
+				return entry.Name == "root" && entry.UID == 0 && entry.GID == 0
 			})
 			require.True(t, rootFound, "GetPasswdEntries should always return root")
 		})
 	}
 }
-
-func TestGetPasswdByName(t *testing.T) {
-	t.Parallel()
-
-	for idx := range 10 {
-		t.Run(fmt.Sprintf("iteration_%d", idx), func(t *testing.T) {
-			t.Parallel()
-
-			got, err := GetPasswdByName("root")
-			require.NoError(t, err, "GetPasswdByName should not return an error")
-			require.Equal(t, "root", got.Name, "Name does not match")
-			require.Equal(t, uint32(0), got.UID, "UID does not match")
-			require.Equal(t, "root", got.Gecos, "Gecos does not match")
-		})
-	}
-}
-
-func TestGetPasswdByName_NotFound(t *testing.T) {
-	t.Parallel()
-
-	for idx := range 10 {
-		t.Run(fmt.Sprintf("iteration_%d", idx), func(t *testing.T) {
-			t.Parallel()
-
-			got, err := GetPasswdByName(fmt.Sprintf("nonexistent-really-%d", idx))
-			require.ErrorIs(t, err, ErrUserNotFound)
-			require.Empty(t, got, "Entry should be empty, but is not")
-		})
-	}
-}
diff --git a/internal/users/localentries/localgroups.go b/internal/users/localentries/localgroups.go
index e604b93564..cbe3cdc364 100644
--- a/internal/users/localentries/localgroups.go
+++ b/internal/users/localentries/localgroups.go
@@ -6,250 +6,297 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"math"
 	"os"
-	"os/exec"
 	"slices"
+	"strconv"
 	"strings"
-	"sync"
 
-	"github.com/ubuntu/authd/internal/sliceutils"
-	"github.com/ubuntu/authd/log"
-	"github.com/ubuntu/decorate"
+	"github.com/canonical/authd/internal/decorate"
+	"github.com/canonical/authd/internal/fileutils"
+	"github.com/canonical/authd/internal/sliceutils"
+	"github.com/canonical/authd/internal/users/types"
+	"github.com/canonical/authd/log"
 )
 
-// GroupFile is the default local group file.
-const GroupFile = "/etc/group"
+// GetGroupEntries returns a copy of the current group entries.
+func GetGroupEntries(dbLocked *UserDBLocked) (entries []types.GroupEntry, err error) {
+	defer decorate.OnError(&err, "could not get groups")
 
-var defaultOptions = options{
-	groupPath:    GroupFile,
-	gpasswdCmd:   []string{"gpasswd"},
-	getUsersFunc: getPasswdUsernames,
+	dbLocked.MustBeLocked()
+
+	unlock := dbLocked.lockGroupFile()
+	defer unlock()
+
+	return getGroupEntriesWithContext(dbLocked)
 }
 
-type options struct {
-	groupPath    string
-	gpasswdCmd   []string
-	getUsersFunc func() ([]string, error)
+func getGroupEntriesWithContext(dbLocked *UserDBLocked) (entries []types.GroupEntry, err error) {
+	entries, err = dbLocked.GetLocalGroupEntries()
+	if err != nil {
+		return nil, err
+	}
+
+	return types.DeepCopyGroupEntries(entries), nil
 }
 
-// Option represents an optional function to override UpdateLocalGroups default values.
-type Option func(*options)
+// SaveGroupEntries saves the provided group entries to the local group file.
+func SaveGroupEntries(dbLocked *UserDBLocked, entries []types.GroupEntry) (err error) {
+	defer decorate.OnError(&err, "could not save groups")
+
+	dbLocked.MustBeLocked()
 
-var localGroupsMu = &sync.RWMutex{}
+	unlock := dbLocked.lockGroupFile()
+	defer unlock()
 
-// Update synchronizes for the given user the local group list with the current group list from UserInfo.
-func Update(username string, newGroups []string, oldGroups []string, args ...Option) (err error) {
-	log.Debugf(context.TODO(), "Updating local groups for user %q, new groups: %v, old groups: %v", username, newGroups, oldGroups)
+	return saveLocalGroups(dbLocked, entries)
+}
+
+// UpdateGroups updates the local groups for a user, adding them to the groups in
+// newGroups which they are not already part of, and removing them from the
+// groups in oldGroups which are not in newGroups.
+func UpdateGroups(dbLocked *UserDBLocked, username string, newGroups []string, oldGroups []string) (err error) {
+	log.Debugf(context.Background(), "Updating local groups for user %q, new groups: %v, old groups: %v", username, newGroups, oldGroups)
 	defer decorate.OnError(&err, "could not update local groups for user %q", username)
 
-	opts := defaultOptions
-	for _, arg := range args {
-		arg(&opts)
+	dbLocked.MustBeLocked()
+
+	unlock := dbLocked.lockGroupFile()
+	defer unlock()
+
+	if len(newGroups) == 0 && len(oldGroups) == 0 {
+		return nil
 	}
 
-	currentGroups, err := existingLocalGroups(username, opts.groupPath)
+	allGroups, err := getGroupEntriesWithContext(dbLocked)
 	if err != nil {
 		return err
 	}
 
-	localGroupsMu.Lock()
-	defer localGroupsMu.Unlock()
-	groupsToAdd := sliceutils.Difference(newGroups, currentGroups)
-	log.Debugf(context.TODO(), "Adding to local groups: %v", groupsToAdd)
+	userGroups := userLocalGroups(allGroups, username)
+	currentGroupsNames := sliceutils.Map(userGroups, func(g types.GroupEntry) string {
+		return g.Name
+	})
+
+	groupsToAdd := sliceutils.Difference(newGroups, currentGroupsNames)
+	log.Debugf(context.Background(), "Adding %q to local groups: %v", username, groupsToAdd)
 	groupsToRemove := sliceutils.Difference(oldGroups, newGroups)
 	// Only remove user from groups which they are part of
-	groupsToRemove = sliceutils.Intersection(groupsToRemove, currentGroups)
-	log.Debugf(context.TODO(), "Removing from local groups: %v", groupsToRemove)
+	groupsToRemove = sliceutils.Intersection(groupsToRemove, currentGroupsNames)
+	log.Debugf(context.Background(), "Removing %q from local groups: %v", username, groupsToRemove)
 
-	// Do all this in a goroutine as we don't want to hang.
-	for _, g := range groupsToRemove {
-		args := opts.gpasswdCmd[1:]
-		args = append(args, "--delete", username, g)
-		if err := runGPasswd(opts.gpasswdCmd[0], args...); err != nil {
-			return err
-		}
+	if len(groupsToRemove) == 0 && len(groupsToAdd) == 0 {
+		return nil
 	}
-	for _, g := range groupsToAdd {
-		args := opts.gpasswdCmd[1:]
-		args = append(args, "--add", username, g)
-		if err := runGPasswd(opts.gpasswdCmd[0], args...); err != nil {
-			return err
+
+	getGroupByName := func(name string) *types.GroupEntry {
+		idx := slices.IndexFunc(allGroups, func(g types.GroupEntry) bool { return g.Name == name })
+		if idx == -1 {
+			return nil
 		}
+		return &allGroups[idx]
 	}
 
-	return nil
-}
-
-// getPasswdUsernames gets the passwd entries and returns their usernames.
-func getPasswdUsernames() ([]string, error) {
-	var usernames []string
-	entries, err := GetPasswdEntries()
-	if err != nil {
-		return nil, err
+	for _, g := range groupsToRemove {
+		group := getGroupByName(g)
+		if group == nil {
+			continue
+		}
+		group.Users = slices.DeleteFunc(group.Users, func(u string) bool {
+			return u == username
+		})
 	}
-	for _, e := range entries {
-		usernames = append(usernames, e.Name)
+	for _, g := range groupsToAdd {
+		group := getGroupByName(g)
+		if group == nil {
+			continue
+		}
+		group.Users = append(group.Users, username)
 	}
 
-	return usernames, nil
+	return saveLocalGroups(dbLocked, allGroups)
 }
 
-// existingLocalGroups returns which groups from groupPath the user is part of.
-func existingLocalGroups(user, groupPath string) (groups []string, err error) {
+func parseLocalGroups(groupPath string) (groups []types.GroupEntry, invalidEntries []invalidEntry, err error) {
 	defer decorate.OnError(&err, "could not fetch existing local group")
 
-	localGroupsMu.RLock()
-	defer localGroupsMu.RUnlock()
+	log.Debugf(context.Background(), "Reading groups from %q", groupPath)
+
 	f, err := os.Open(groupPath)
 	if err != nil {
-		return nil, err
+		return nil, nil, err
 	}
 	defer f.Close()
 
 	// Format of a line composing the group file is:
 	// group_name:password:group_id:user1,…,usern
 	scanner := bufio.NewScanner(f)
-	for scanner.Scan() {
-		t := strings.TrimSpace(scanner.Text())
-		if t == "" {
+	for lineNum := 0; scanner.Scan(); lineNum++ {
+		line := strings.TrimSpace(scanner.Text())
+		if line == "" || line[0] == '#' {
+			invalidEntries = append(invalidEntries,
+				invalidEntry{lineNum: lineNum, line: line})
 			continue
 		}
-		elems := strings.Split(t, ":")
-		if len(elems) != 4 {
-			return nil, fmt.Errorf("malformed entry in group file (should have 4 separators): %q", t)
+
+		elems := strings.SplitN(line, ":", 4)
+		if len(elems) < 4 {
+			log.Warningf(context.Background(),
+				"Malformed entry in group file (should have 4 separators, got %d): %q",
+				len(elems), line)
+			invalidEntries = append(invalidEntries,
+				invalidEntry{lineNum: lineNum, line: line})
+			continue
 		}
 
-		n := elems[0]
-		users := strings.Split(elems[3], ",")
-		if !slices.Contains(users, user) {
+		name, passwd, gidValue, usersValue := elems[0], elems[1], elems[2], elems[3]
+
+		gid, err := strconv.ParseUint(gidValue, 10, 0)
+		if err != nil || gid > math.MaxUint32 {
+			log.Warningf(context.Background(),
+				"Failed parsing entry %q, unexpected GID value: %v", line, err)
+			invalidEntries = append(invalidEntries,
+				invalidEntry{lineNum: lineNum, line: line})
 			continue
 		}
 
-		groups = append(groups, n)
+		var users []string
+		if usersValue != "" {
+			users = strings.Split(usersValue, ",")
+		}
+
+		groups = append(groups, types.GroupEntry{
+			Name:   name,
+			Passwd: passwd,
+			GID:    uint32(gid),
+			Users:  users,
+		})
 	}
 
 	if err := scanner.Err(); err != nil {
-		return nil, err
+		return nil, nil, err
+	}
+
+	if err := types.ValidateGroupEntries(groups); err != nil {
+		log.Warningf(context.Background(),
+			"The group file %q contains at least one invalid entry: %v",
+			groupPath, err)
 	}
 
-	return groups, nil
+	return groups, invalidEntries, nil
 }
 
-// CleanUser removes the user from all local groups.
-func CleanUser(user string, args ...Option) (err error) {
-	defer decorate.OnError(&err, "could not clean user %q from local groups", user)
+func groupFileTemporaryPath(groupPath string) string {
+	return fmt.Sprintf("%s+", groupPath)
+}
 
-	opts := defaultOptions
-	for _, arg := range args {
-		arg(&opts)
-	}
+func groupFileBackupPath(groupPath string) string {
+	return fmt.Sprintf("%s-", groupPath)
+}
 
-	// Get the list of local groups the user belong to
-	groups, err := existingLocalGroups(user, opts.groupPath)
-	if err != nil {
-		return err
-	}
+func formatGroupEntries(dbLocked *UserDBLocked, groups []types.GroupEntry) string {
+	groupLines := sliceutils.Map(groups, func(group types.GroupEntry) string {
+		return group.String()
+	})
 
-	localGroupsMu.Lock()
-	defer localGroupsMu.Unlock()
-	for _, group := range groups {
-		args := opts.gpasswdCmd[1:]
-		args = append(args, "--delete", user, group)
-		if err := runGPasswd(opts.gpasswdCmd[0], args...); err != nil {
-			return err
-		}
+	for _, entry := range dbLocked.localGroupInvalidEntries {
+		groupLines = slices.Insert(groupLines,
+			min(entry.lineNum, len(groupLines)-1), entry.line)
 	}
 
-	return nil
+	// Add final new line to the group file.
+	groupLines = append(groupLines, "")
+
+	return strings.Join(groupLines, "\n")
 }
 
-// Clean removes all unexistent users from the local groups.
-func Clean(args ...Option) (err error) {
-	defer decorate.OnError(&err, "could not clean local groups completely")
+func saveLocalGroups(dbLocked *UserDBLocked, groups []types.GroupEntry) (err error) {
+	lockedEntries := dbLocked
+	inputPath := lockedEntries.options.inputGroupPath
+	groupPath := lockedEntries.options.outputGroupPath
 
-	opts := defaultOptions
-	for _, arg := range args {
-		arg(&opts)
-	}
+	defer decorate.OnError(&err, "could not write local groups to %q", groupPath)
 
-	localGroupsMu.Lock()
-	defer localGroupsMu.Unlock()
-
-	// Add the existingUsers to a map to speed up search
-	existingUsers := make(map[string]struct{})
-	usernames, err := opts.getUsersFunc()
+	currentGroups, err := getGroupEntriesWithContext(dbLocked)
 	if err != nil {
 		return err
 	}
-	for _, username := range usernames {
-		existingUsers[username] = struct{}{}
-	}
-	// If no username was returned, something probably went wrong during the getpwent call and we should stop,
-	// otherwise we would remove all users from the local groups.
-	if len(existingUsers) == 0 {
-		return errors.New("no existing users found, local groups won't be cleaned")
+
+	if slices.EqualFunc(currentGroups, groups, types.GroupEntry.Equals) {
+		log.Debugf(context.Background(), "Nothing to do, groups are equal")
+		return nil
 	}
 
-	// Get the list of local groups
-	f, err := os.Open(opts.groupPath)
-	if err != nil {
+	if err := validateChangedGroups(currentGroups, groups); err != nil {
+		log.Debugf(context.Background(), "New groups are not valid: %v", err)
 		return err
 	}
-	defer f.Close()
 
-	// Format of a line composing the group file is:
-	// group_name:password:group_id:user1,…,usern
-	var delOps [][]string
-	scanner := bufio.NewScanner(f)
-	for scanner.Scan() {
-		t := strings.TrimSpace(scanner.Text())
-		if t == "" {
-			continue
-		}
-		elems := strings.Split(t, ":")
-		if len(elems) != 4 {
-			return fmt.Errorf("malformed entry in group file (should have 4 separators): %q", t)
-		}
+	backupPath := groupFileBackupPath(groupPath)
+	groupsEntries := formatGroupEntries(dbLocked, groups)
 
-		groupName := elems[0]
-		users := strings.Split(elems[3], ",")
-		for _, user := range users {
-			if _, ok := existingUsers[user]; ok {
-				continue
-			}
+	log.Debugf(context.Background(), "Saving group entries %#v to %q", groups, groupPath)
+	if len(groupsEntries) > 0 {
+		log.Debugf(context.Background(), "Group file content:\n%s", groupsEntries)
+	}
 
-			// User doesn't exist anymore, remove it from the group
-			args := opts.gpasswdCmd[1:]
-			delOps = append(delOps, append(args, "--delete", user, groupName))
-		}
+	if err := os.Remove(backupPath); err != nil && !errors.Is(err, os.ErrNotExist) {
+		log.Warningf(context.Background(), "Failed to remove group file backup: %v", err)
 	}
-	if scanner.Err() != nil {
-		return scanner.Err()
+
+	log.Debugf(context.Background(), "Backing up %q to %q", inputPath, backupPath)
+	if err := fileutils.CopyFile(inputPath, backupPath); err != nil {
+		log.Warningf(context.Background(), "Failed make a backup for the group file: %v", err)
 	}
-	f.Close()
 
-	// Execute the deletion operations
-	for _, op := range delOps {
-		if cmdErr := runGPasswd(opts.gpasswdCmd[0], op...); cmdErr != nil {
-			err = errors.Join(err, cmdErr)
-		}
+	tempPath := groupFileTemporaryPath(groupPath)
+	//nolint:gosec // G306 /etc/group should indeed have 0644 permissions
+	if err := os.WriteFile(tempPath, []byte(groupsEntries), 0644); err != nil {
+		return fmt.Errorf("error writing %s: %w", tempPath, err)
+	}
+
+	if err := fileutils.Lrename(tempPath, groupPath); err != nil {
+		return fmt.Errorf("error renaming %s to %s: %w", tempPath, groupPath, err)
 	}
 
-	return err
+	lockedEntries.updateLocalGroupEntriesCache(groups)
+	return nil
 }
 
-// runGPasswd is a wrapper to cmdName ignoring exit code 3, meaning that the group doesn't exist.
-// Note: it’s the same return code for user not existing, but it’s something we are in control of as we
-// are responsible for the user itself and parsing the output is not desired.
-func runGPasswd(cmdName string, args ...string) error {
-	cmd := exec.Command(cmdName, args...)
-	out, err := cmd.CombinedOutput()
-	if err != nil {
-		if cmd.ProcessState.ExitCode() == 3 {
-			log.Noticef(context.TODO(), "gpasswd exited with code 3 (group or user does not exist); ignoring: %s", out)
-			return nil
-		}
-		return fmt.Errorf("%q returned: %v\nOutput: %s", strings.Join(cmd.Args, " "), err, out)
+func validateChangedGroups(currentGroups, newGroups []types.GroupEntry) error {
+	changedGroups := sliceutils.DifferenceFunc(newGroups, currentGroups,
+		types.GroupEntry.Equals)
+	if len(changedGroups) == 0 {
+		log.Debugf(context.Background(), "No new groups added to validate")
+		return nil
 	}
-	return nil
+
+	log.Debugf(context.Background(), "Groups added or modified: %#v", changedGroups)
+
+	if err := types.ValidateGroupEntries(changedGroups); err != nil {
+		// One of the group that has been changed is not valid.
+		return fmt.Errorf("changed groups are not valid: %w", err)
+	}
+
+	if err := types.ValidateGroupEntries(newGroups); err == nil {
+		// The groups we got are all good, no need to proceed further!
+		return nil
+	}
+
+	validCurrentGroups := types.GetValidGroupEntries(currentGroups)
+
+	// So, now we know that:
+	//  1) the changed groups alone are good
+	//  2) the whole set of the new groups are not good
+	// So let's try to check if the changed groups are compatible with the
+	// current valid groups that we have.
+	validGroupsWithChanged := append(validCurrentGroups, changedGroups...)
+	return types.ValidateGroupEntries(validGroupsWithChanged)
+}
+
+// userLocalGroups returns all groups the user is part of.
+func userLocalGroups(entries []types.GroupEntry, user string) (userGroups []types.GroupEntry) {
+	return slices.DeleteFunc(slices.Clone(entries), func(g types.GroupEntry) bool {
+		return !slices.Contains(g.Users, user)
+	})
 }
diff --git a/internal/users/localentries/localgroups_test.go b/internal/users/localentries/localgroups_test.go
index 02212455ef..e659ee8f87 100644
--- a/internal/users/localentries/localgroups_test.go
+++ b/internal/users/localentries/localgroups_test.go
@@ -1,14 +1,22 @@
 package localentries_test
 
 import (
+	"fmt"
 	"os"
 	"path/filepath"
+	"slices"
+	"sync"
 	"testing"
 
+	"github.com/canonical/authd/internal/fileutils"
+	"github.com/canonical/authd/internal/testutils"
+	"github.com/canonical/authd/internal/testutils/golden"
+	"github.com/canonical/authd/internal/users/localentries"
+	localentriestestutils "github.com/canonical/authd/internal/users/localentries/testutils"
+	userslocking "github.com/canonical/authd/internal/users/locking"
+	"github.com/canonical/authd/internal/users/types"
+	"github.com/canonical/authd/log"
 	"github.com/stretchr/testify/require"
-	"github.com/ubuntu/authd/internal/testutils/golden"
-	"github.com/ubuntu/authd/internal/users/localentries"
-	localentriestestutils "github.com/ubuntu/authd/internal/users/localentries/testutils"
 )
 
 func TestUpdatelocalentries(t *testing.T) {
@@ -50,11 +58,32 @@ func TestUpdatelocalentries(t *testing.T) {
 		"User_is_removed_from_old_groups_but_not_from_other_groups": {newGroups: []string{}, oldGroups: []string{"localgroup3"}, groupFilePath: "user_in_both_groups.group"},
 		"User_is_not_removed_from_groups_they_are_not_part_of":      {newGroups: []string{}, oldGroups: []string{"localgroup2"}, groupFilePath: "user_in_one_group.group"},
 
+		"Warn_when_groups_file_has_no_group_name": {
+			groupFilePath: "malformed_file_no_group_name.group",
+			newGroups:     []string{"localgroup6"},
+		},
+		"Warn_when_groups_file_has_missing_fields": {
+			groupFilePath: "malformed_file_missing_field.group",
+			newGroups:     []string{"localgroup6"},
+		},
+		"Warn_when_groups_file_has_invalid_gid": {
+			groupFilePath: "malformed_file_invalid_gid.group",
+		},
+
 		// Error cases
-		"Error_on_missing_groups_file":                {groupFilePath: "does_not_exists.group", wantErr: true},
-		"Error_when_groups_file_is_malformed":         {groupFilePath: "malformed_file.group", wantErr: true},
-		"Error_on_any_unignored_add_gpasswd_error":    {username: "gpasswdfail", groupFilePath: "no_users.group", wantErr: true},
-		"Error_on_any_unignored_delete_gpasswd_error": {username: "gpasswdfail", groupFilePath: "gpasswdfail_in_deleted_group.group", wantErr: true},
+		"Error_on_missing_groups_file": {
+			groupFilePath: "does_not_exists.group",
+			wantErr:       true,
+		},
+		"Error_on_invalid_user_name": {
+			groupFilePath: "no_users_in_our_groups.group",
+			username:      "no,commas,please",
+			wantErr:       true,
+		},
+		"Error_when_groups_file_has_a_duplicated_group": {
+			groupFilePath: "malformed_file_duplicated.group",
+			wantErr:       true,
+		},
 	}
 	for name, tc := range tests {
 		t.Run(name, func(t *testing.T) {
@@ -71,135 +100,545 @@ func TestUpdatelocalentries(t *testing.T) {
 				tc.username = ""
 			}
 
-			destCmdsFile := filepath.Join(t.TempDir(), "gpasswd.output")
+			inputGroupFilePath := filepath.Join("testdata", tc.groupFilePath)
+			outputGroupFilePath := filepath.Join(t.TempDir(), "group")
 
-			groupFilePath := filepath.Join("testdata", tc.groupFilePath)
-			cmdArgs := []string{"env", "GO_WANT_HELPER_PROCESS=1",
-				os.Args[0], "-test.run=TestMockgpasswd", "--",
-				groupFilePath, destCmdsFile,
+			if exists, _ := fileutils.FileExists(inputGroupFilePath); exists {
+				tempGroupFile := filepath.Join(t.TempDir(), "group")
+				err := fileutils.CopyFile(inputGroupFilePath, tempGroupFile)
+				require.NoError(t, err, "failed to copy group file for testing")
+				inputGroupFilePath = tempGroupFile
 			}
 
-			err := localentries.Update(tc.username, tc.newGroups, tc.oldGroups, localentries.WithGroupPath(groupFilePath), localentries.WithGpasswdCmd(cmdArgs))
+			defer localentriestestutils.RequireGroupFile(t, outputGroupFilePath, golden.Path(t))
+
+			entries, entriesUnlock, err := localentries.WithUserDBLock(
+				localentries.WithGroupInputPath(inputGroupFilePath),
+				localentries.WithGroupOutputPath(outputGroupFilePath),
+				localentries.WithMockUserDBLocking(),
+			)
+			require.NoError(t, err, "Failed to lock the local entries")
+			t.Cleanup(func() {
+				err := entriesUnlock()
+				require.NoError(t, err, "entriesUnlock should not fail to unlock the local entries")
+			})
+
+			err = localentries.UpdateGroups(entries, tc.username, tc.newGroups, tc.oldGroups)
 			if tc.wantErr {
 				require.Error(t, err, "Updatelocalentries should have failed")
 			} else {
 				require.NoError(t, err, "Updatelocalentries should not have failed")
 			}
-
-			localentriestestutils.RequireGPasswdOutput(t, destCmdsFile, golden.Path(t))
 		})
 	}
 }
 
-func TestCleanlocalentries(t *testing.T) {
+func TestGetAndSaveLocalGroups(t *testing.T) {
 	t.Parallel()
 
 	tests := map[string]struct {
 		groupFilePath string
+		addGroups     []types.GroupEntry
+		removeGroups  []string
+		addUsers      map[string][]string
 
-		getUsersReturn []string
-
-		wantErr bool
+		wantGetErr bool
+		wantSetErr bool
+		wantNoOp   bool
 	}{
-		"No-op_when_there_are_no_inactive_users":        {groupFilePath: "user_in_many_groups.group"},
-		"Cleans_up_user_from_group":                     {groupFilePath: "inactive_user_in_one_group.group"},
-		"Cleans_up_user_from_multiple_groups":           {groupFilePath: "inactive_user_in_many_groups.group"},
-		"Cleans_up_multiple_users_from_group":           {groupFilePath: "inactive_users_in_one_group.group"},
-		"Cleans_up_multiple_users_from_multiple_groups": {groupFilePath: "inactive_users_in_many_groups.group"},
-
-		"Error_if_there_is_no_active_user":            {groupFilePath: "user_in_many_groups.group", getUsersReturn: []string{}, wantErr: true},
-		"Error_on_missing_groups_file":                {groupFilePath: "does_not_exists.group", wantErr: true},
-		"Error_when_groups_file_is_malformed":         {groupFilePath: "malformed_file.group", wantErr: true},
-		"Error_on_any_unignored_delete_gpasswd_error": {groupFilePath: "gpasswdfail_in_deleted_group.group", wantErr: true},
+		"Empty_group_is_kept_empty_on_no_op": {
+			groupFilePath: "empty.group",
+		},
+		"Empty_group_adding_one_group": {
+			groupFilePath: "empty.group",
+			addGroups: []types.GroupEntry{
+				{Name: "group1", Passwd: "x", GID: 1},
+			},
+		},
+		"Empty_group_adding_one_group_with_one_user": {
+			groupFilePath: "empty.group",
+			addGroups: []types.GroupEntry{
+				{Name: "group1", Passwd: "x", GID: 1},
+			},
+			addUsers: map[string][]string{"group1": {"user1"}},
+		},
+		"Empty_group_adding_two_groups_with_two_users": {
+			groupFilePath: "empty.group",
+			addGroups: []types.GroupEntry{
+				{Name: "group1", Passwd: "x", GID: 1},
+				{Name: "group2", Passwd: "x", GID: 2},
+			},
+			addUsers: map[string][]string{
+				"group1": {"user1.1", "user1.2"},
+				"group2": {"user2.2", "user2.2"},
+			},
+		},
+		"Empty_group_adding_one_group_and_removing_it_afterwards": {
+			groupFilePath: "empty.group",
+			addGroups:     []types.GroupEntry{{Name: "group1", GID: 1}},
+			removeGroups:  []string{"group1"},
+			wantNoOp:      true,
+		},
+		"Insert_new_user_in_existing_files_with_no_users_in_our_group": {
+			groupFilePath: "no_users_in_our_groups.group",
+			addUsers: map[string][]string{
+				"localgroup1": {"user1.1", "user1.2"},
+				"localgroup2": {"user2.2", "user2.2"},
+			},
+		},
+		"Insert_new_user_when_no_users_in_any_group": {
+			groupFilePath: "no_users.group",
+			addUsers: map[string][]string{
+				"localgroup1": {"user1.1", "user1.2"},
+				"localgroup2": {"user2.2", "user2.2"},
+			},
+		},
+		"Insert_new_user_in_existing_files_with_other_users_in_our_group": {
+			groupFilePath: "users_in_our_groups.group",
+			addUsers: map[string][]string{
+				"localgroup1": {"user1.1", "user1.2"},
+				"localgroup2": {"user2.2", "user2.2"},
+			},
+		},
+		"Insert_new_user_in_existing_files_with_multiple_other_users_in_our_group": {
+			groupFilePath: "multiple_users_in_our_groups.group",
+			addUsers: map[string][]string{
+				"localgroup1": {"user1.1", "user1.2"},
+				"localgroup2": {"user2.2", "user2.2"},
+			},
+		},
+		"Ignores_adding_duplicated_equal_groups": {
+			groupFilePath: "empty.group",
+			addGroups: []types.GroupEntry{
+				{Name: "group1", Passwd: "x", GID: 12345, Users: []string{"user1", "user2"}},
+				{Name: "group1", Passwd: "x", GID: 12345, Users: []string{"user1", "user2"}},
+			},
+		},
+		"Ignores_adding_duplicated_equal_group_to_existing_file": {
+			groupFilePath: "no_users_in_our_groups.group",
+			addGroups: []types.GroupEntry{
+				{Name: "localgroup3", Passwd: "x", GID: 43},
+			},
+		},
+		"Removes_group_correctly": {
+			groupFilePath: "multiple_users_in_our_groups.group",
+			removeGroups:  []string{"localgroup1", "localgroup4"},
+		},
+		"Warn_when_groups_file_has_a_duplicated_group": {
+			groupFilePath: "malformed_file_duplicated.group",
+			addGroups: []types.GroupEntry{
+				{Name: "localgroup5", Passwd: "x", GID: 45},
+			},
+		},
+		"Warn_when_groups_file_has_an_extra_field": {
+			groupFilePath: "malformed_file_extra_field.group",
+			addGroups: []types.GroupEntry{
+				{Name: "localgroup5", Passwd: "x", GID: 45},
+			},
+		},
+		"Warn_when_groups_file_has_entries_with_missing_fields": {
+			groupFilePath: "malformed_file_invalid_entries_length.group",
+			addGroups: []types.GroupEntry{
+				{Name: "localgroup9", Passwd: "x", GID: 49},
+			},
+		},
+		"Warn_when_groups_file_has_no_group_name": {
+			groupFilePath: "malformed_file_no_group_name.group",
+		},
+		"Warn_when_groups_file_has_missing_fields": {
+			groupFilePath: "malformed_file_missing_field.group",
+		},
+		"Warn_when_groups_file_has_invalid_gid": {
+			groupFilePath: "malformed_file_invalid_gid.group",
+		},
+
+		// Error cases.
+		"Error_when_missing_groups_file": {
+			groupFilePath: "does_not_exists.group",
+			wantGetErr:    true,
+		},
+		"Error_adding_duplicated_groups": {
+			groupFilePath: "empty.group",
+			addGroups: []types.GroupEntry{
+				{Name: "group1", GID: 12345},
+				{Name: "group1", GID: 12345, Users: []string{"user1"}},
+			},
+			wantSetErr: true,
+		},
+		"Error_adding_duplicated_group_to_existing_file": {
+			groupFilePath: "no_users_in_our_groups.group",
+			addGroups:     []types.GroupEntry{{Name: "localgroup3", GID: 12345}},
+			wantSetErr:    true,
+		},
+		"Error_adding_duplicated_groups_GIDs": {
+			groupFilePath: "empty.group",
+			addGroups: []types.GroupEntry{
+				{Name: "group1", GID: 43},
+				{Name: "group2", GID: 43, Users: []string{"user1"}},
+			},
+			wantSetErr: true,
+		},
+		"Error_adding_duplicated_group_GID_to_existing_file": {
+			groupFilePath: "no_users_in_our_groups.group",
+			addGroups:     []types.GroupEntry{{Name: "test-group3", GID: 43}},
+			wantSetErr:    true,
+		},
 	}
 	for name, tc := range tests {
 		t.Run(name, func(t *testing.T) {
 			t.Parallel()
 
-			destCmdsFile := filepath.Join(t.TempDir(), "gpasswd.output")
-			groupFilePath := filepath.Join("testdata", tc.groupFilePath)
-			gpasswdCmd := []string{"env", "GO_WANT_HELPER_PROCESS=1",
-				os.Args[0], "-test.run=TestMockgpasswd", "--",
-				groupFilePath, destCmdsFile,
+			inputGroupFilePath := filepath.Join(testutils.CurrentDir(),
+				"testdata", tc.groupFilePath)
+			outputGroupFilePath := filepath.Join(t.TempDir(), "group")
+
+			if !tc.wantNoOp && tc.addGroups == nil && tc.removeGroups == nil && tc.addUsers == nil {
+				tc.wantNoOp = true
 			}
 
-			if tc.getUsersReturn == nil {
-				tc.getUsersReturn = []string{"myuser", "otheruser", "otheruser2", "otheruser3", "otheruser4"}
+			if exists, _ := fileutils.FileExists(inputGroupFilePath); exists {
+				tempGroupFile := filepath.Join(t.TempDir(), "group")
+				err := os.Symlink(inputGroupFilePath, tempGroupFile)
+				require.NoError(t, err, "failed to symlink group file for testing")
+				inputGroupFilePath = tempGroupFile
 			}
 
-			cleanupOptions := []localentries.Option{
-				localentries.WithGpasswdCmd(gpasswdCmd),
-				localentries.WithGroupPath(groupFilePath),
-				localentries.WithGetUsersFunc(func() ([]string, error) { return tc.getUsersReturn, nil }),
+			defer localentriestestutils.RequireGroupFile(t, outputGroupFilePath, golden.Path(t))
+
+			entries, entriesUnlock, err := localentries.WithUserDBLock(
+				localentries.WithGroupInputPath(inputGroupFilePath),
+				localentries.WithGroupOutputPath(outputGroupFilePath),
+				localentries.WithMockUserDBLocking(),
+			)
+			require.NoError(t, err, "Failed to lock the local entries")
+			defer func() {
+				err := entriesUnlock()
+				require.NoError(t, err, "entriesUnlock should not fail to unlock the local entries")
+			}()
+
+			groups, err := localentries.GetGroupEntries(entries)
+			if tc.wantGetErr {
+				require.Error(t, err, "GetEntries should return an error, but did not")
+				return
 			}
-			err := localentries.Clean(cleanupOptions...)
-			if tc.wantErr {
-				require.Error(t, err, "Cleanuplocalentries should have failed")
-			} else {
-				require.NoError(t, err, "Cleanuplocalentries should not have failed")
+			require.NoError(t, err, "GetEntries should not return an error, but did")
+			initialGroups := slices.Clone(groups)
+
+			groups = append(groups, tc.addGroups...)
+			groups = slices.DeleteFunc(groups, func(g types.GroupEntry) bool {
+				return slices.Contains(tc.removeGroups, g.Name)
+			})
+
+			for groupName, userNames := range tc.addUsers {
+				idx := slices.IndexFunc(groups, func(g types.GroupEntry) bool { return g.Name == groupName })
+				require.GreaterOrEqual(t, idx, 0, "Setup: %q is not in groups %v", groupName, groups)
+				groups[idx].Users = append(groups[idx].Users, userNames...)
+			}
+
+			err = localentries.SaveGroupEntries(entries, groups)
+			if tc.wantSetErr {
+				require.Error(t, err, "SaveEntries should have failed")
+				updatedGroups, err := localentries.GetGroupEntries(entries)
+				require.NoError(t, err, "GetEntries should not return an error, but did")
+				require.Equal(t, initialGroups, updatedGroups, "Cached groups have been changed")
+				return
+			}
+
+			if len(groups) == 0 {
+				groups = nil
+			}
+
+			require.NoError(t, err, "SaveEntries should not have failed")
+			// Ensure we also saved the cached version of the groups...
+			updatedGroups, err := localentries.GetGroupEntries(entries)
+			require.NoError(t, err, "GetEntries should not return an error, but did")
+			require.Equal(t, groups, updatedGroups, "Cached groups are not saved")
+
+			if tc.wantNoOp {
+				// The output group file should not have been created
+				require.NoFileExists(t, outputGroupFilePath, "Output group file should not have been created")
+				return
 			}
 
-			localentriestestutils.RequireGPasswdOutput(t, destCmdsFile, golden.Path(t))
+			require.FileExists(t, outputGroupFilePath, "Output file should have been created")
 		})
 	}
 }
 
-func TestCleanUserFromlocalentries(t *testing.T) {
-	t.Parallel()
+//nolint:tparallel // This can't be parallel, but subtests can.
+func TestRacingGroupsLockingActions(t *testing.T) {
+	const nIterations = 50
 
-	tests := map[string]struct {
-		username string
-
-		groupFilePath   string
-		wantMockFailure bool
+	testFilePath := filepath.Join("testdata", "no_users_in_our_groups.group")
+	testUserDBLocked := &localentries.UserDBLocked{}
 
-		wantErr bool
-	}{
-		"Cleans_up_user_from_group":                   {},
-		"Cleans_up_user_from_multiple_groups":         {groupFilePath: "user_in_many_groups.group"},
-		"No_op_if_user_does_not_belong_to_any_groups": {username: "groupless"},
+	wg := sync.WaitGroup{}
+	wg.Add(nIterations)
 
-		"Error_on_missing_groups_file":                {groupFilePath: "does_not_exists.group", wantErr: true},
-		"Error_when_groups_file_is_malformed":         {groupFilePath: "malformed_file.group", wantErr: true},
-		"Error_on_any_unignored_delete_gpasswd_error": {wantMockFailure: true, wantErr: true},
-	}
-	for name, tc := range tests {
-		t.Run(name, func(t *testing.T) {
+	// Lock and get the values in parallel.
+	for idx := range nIterations {
+		t.Run(fmt.Sprintf("iteration_%d", idx), func(t *testing.T) {
 			t.Parallel()
 
-			if tc.username == "" {
-				tc.username = "myuser"
-			}
-			if tc.groupFilePath == "" {
-				tc.groupFilePath = "user_in_one_group.group"
-			}
+			t.Cleanup(wg.Done)
 
-			destCmdsFile := filepath.Join(t.TempDir(), "gpasswd.output")
-			groupFilePath := filepath.Join("testdata", tc.groupFilePath)
-			gpasswdCmd := []string{"env", "GO_WANT_HELPER_PROCESS=1",
-				os.Args[0], "-test.run=TestMockgpasswd", "--",
-				groupFilePath, destCmdsFile,
-			}
-			if tc.wantMockFailure {
-				gpasswdCmd = append(gpasswdCmd, "gpasswdfail")
-			}
+			var opts []localentries.Option
+			wantGroup := types.GroupEntry{Name: "root", GID: 0, Passwd: "x"}
+			useTestGroupFile := idx%3 == 0
 
-			cleanupOptions := []localentries.Option{
-				localentries.WithGpasswdCmd(gpasswdCmd),
-				localentries.WithGroupPath(groupFilePath),
+			if useTestGroupFile {
+				// Mix the requests with test-only code paths...
+				opts = append(opts,
+					localentries.WithGroupPath(testFilePath),
+					localentries.WithUserDBLockedInstance(testUserDBLocked),
+					localentries.WithMockUserDBLocking(),
+				)
+				wantGroup = types.GroupEntry{Name: "localgroup1", GID: 41, Passwd: "x"}
 			}
-			err := localentries.CleanUser(tc.username, cleanupOptions...)
+
+			entries, entriesUnlock, err := localentries.WithUserDBLock(opts...)
+			require.NoError(t, err, "Failed to lock the local entries")
+			t.Cleanup(func() {
+				err := entriesUnlock()
+				require.NoError(t, err, "entriesUnlock should not fail to unlock the local entries")
+			})
+
+			groups, err := localentries.GetGroupEntries(entries)
+			require.NoError(t, err, "GetEntries should not return an error, but did")
+			require.NotEmpty(t, groups, "Got empty groups (test groups: %v)", useTestGroupFile)
+			require.Contains(t, groups, wantGroup, "Expected group was not found  (test groups: %v)", useTestGroupFile)
+		})
+	}
+
+	t.Run("final_check", func(t *testing.T) {
+		t.Parallel()
+		wg.Wait()
+
+		// Get a last unlock function, to see if we're all good...
+		entries, entriesUnlock, err := localentries.WithUserDBLock()
+		require.NoError(t, err, "Failed to lock the local entries")
+
+		require.NoError(t, err, "Unlock should not fail to lock the users group")
+
+		err = entriesUnlock()
+		require.NoError(t, err, "entriesUnlock should not fail to unlock the local entries")
+
+		// Ensure that we had cleaned up all the locks correctly!
+		require.Panics(t, func() { _, _ = localentries.GetGroupEntries(entries) })
+	})
+}
+
+func TestLockedInvalidActions(t *testing.T) {
+	// This cannot be parallel
+
+	require.Panics(t, func() { _ = localentries.UpdateGroups(nil, "", nil, nil) },
+		"Update should panic but did not")
+	require.Panics(t, func() { _, _ = localentries.GetGroupEntries(nil) },
+		"GetEntries should panic but did not")
+	require.Panics(t, func() { _ = localentries.SaveGroupEntries(nil, nil) },
+		"SaveEntries should panic but did not")
+
+	entries, entriesUnlock, err := localentries.WithUserDBLock()
+	require.NoError(t, err, "Failed to lock the local entries")
+
+	err = entriesUnlock()
+	require.NoError(t, err, "Unlock should not fail to lock the users group")
+
+	err = entriesUnlock()
+	require.Error(t, err, "Unlocking twice should fail")
+
+	require.Panics(t, func() { _ = localentries.UpdateGroups(entries, "", nil, nil) },
+		"Update should panic but did not")
+	require.Panics(t, func() { _, _ = localentries.GetGroupEntries(entries) },
+		"GetEntries should panic but did not")
+	require.Panics(t, func() { _ = localentries.SaveGroupEntries(entries, nil) },
+		"SaveEntries should panic but did not")
+
+	// This is to ensure that we're in a good state, despite the actions above
+	for range 10 {
+		_, entriesUnlock, err := localentries.WithUserDBLock()
+		require.NoError(t, err, "Failed to lock the local entries")
+		defer func() {
+			err := entriesUnlock()
+			require.NoError(t, err, "entriesUnlock should not fail to unlock the local entries")
+		}()
+	}
+}
+
+func TestValidateChangedGroups(t *testing.T) {
+	t.Parallel()
+
+	tests := map[string]struct {
+		currentGroups []types.GroupEntry
+		changedGroups []types.GroupEntry
+		newGroups     []types.GroupEntry
+		wantErr       bool
+	}{
+		"Empty_groups_no_error": {},
+		"Add_valid_group": {
+			currentGroups: []types.GroupEntry{
+				{Name: "group1", Passwd: "x", GID: 1, Users: []string{"user1"}},
+				{Name: "group1", Passwd: "x", GID: 1, Users: []string{"user1"}},
+			},
+			newGroups: []types.GroupEntry{
+				{Name: "group1", Passwd: "x", GID: 1, Users: []string{"user1"}},
+				{Name: "group2", Passwd: "x", GID: 2, Users: []string{"user2"}},
+			},
+		},
+		"No_changes_in_old_groups": {
+			currentGroups: []types.GroupEntry{
+				{Name: "group1", Passwd: "x", GID: 1, Users: []string{"user1"}},
+				{Name: "group2", Passwd: "x", GID: 2, Users: []string{"user2"}},
+			},
+			newGroups: []types.GroupEntry{
+				{Name: "group1", Passwd: "x", GID: 1, Users: []string{"user1"}},
+				{Name: "group2", Passwd: "x", GID: 2, Users: []string{"user2"}},
+			},
+		},
+		"Replace_old_groups_with_same_name_valid": {
+			currentGroups: []types.GroupEntry{
+				{Name: "group1", Passwd: "x", GID: 1, Users: []string{"user1"}},
+				{Name: "group2", Passwd: "x", GID: 2, Users: []string{"user2"}},
+			},
+			newGroups: []types.GroupEntry{
+				{Name: "group1", Passwd: "x", GID: 1, Users: []string{"user1"}},
+				{Name: "group2", Passwd: "x", GID: 2, Users: []string{"user3"}},
+			},
+		},
+		"Add_multiple_valid_groups": {
+			currentGroups: []types.GroupEntry{
+				{Name: "group1", Passwd: "x", GID: 1, Users: []string{"user1"}},
+			},
+			newGroups: []types.GroupEntry{
+				{Name: "group1", Passwd: "x", GID: 1, Users: []string{"user1"}},
+				{Name: "group2", Passwd: "x", GID: 2, Users: []string{"user2"}},
+				{Name: "group3", Passwd: "x", GID: 3, Users: []string{"user3"}},
+			},
+		},
+		"Removed_group": {
+			currentGroups: []types.GroupEntry{
+				{Name: "group1", Passwd: "x", GID: 1, Users: []string{"user1"}},
+				{Name: "group2", Passwd: "x", GID: 2, Users: []string{"user2"}},
+			},
+			newGroups: []types.GroupEntry{
+				{Name: "group1", Passwd: "x", GID: 1, Users: []string{"user1"}},
+				// group2 removed
+			},
+		},
+		"Removed_multiple_groups": {
+			currentGroups: []types.GroupEntry{
+				{Name: "group1", Passwd: "x", GID: 1, Users: []string{"user1"}},
+				{Name: "group2", Passwd: "x", GID: 2, Users: []string{"user2"}},
+				{Name: "group3", Passwd: "x", GID: 3, Users: []string{"user3"}},
+			},
+			newGroups: []types.GroupEntry{
+				{Name: "group3", Passwd: "x", GID: 3, Users: []string{"user3"}},
+				// group1 and group2 removed
+			},
+		},
+		"All_groups_removed": {
+			currentGroups: []types.GroupEntry{
+				{Name: "group1", Passwd: "x", GID: 1, Users: []string{"user1"}},
+			},
+			newGroups: []types.GroupEntry{
+				// All groups removed
+			},
+		},
+		"Add_valid_group_to_current_groups_with_invalid": {
+			currentGroups: []types.GroupEntry{
+				{Name: "invalid1", Passwd: "x", GID: 1, Users: []string{"user,1"}},
+				{Name: "group1", Passwd: "x", GID: 1, Users: []string{"user1"}},
+			},
+			newGroups: []types.GroupEntry{
+				{Name: "group1", Passwd: "x", GID: 1, Users: []string{"user1"}},
+				{Name: "invalid1", Passwd: "x", GID: 1, Users: []string{"user,1"}},
+				{Name: "group2", Passwd: "x", GID: 2, Users: []string{"user2"}},
+			},
+		},
+		"Add_user_to_group": {
+			currentGroups: []types.GroupEntry{
+				{Name: "group1", Passwd: "x", GID: 1, Users: []string{"user1"}},
+			},
+			newGroups: []types.GroupEntry{
+				{Name: "group1", Passwd: "x", GID: 1, Users: []string{"user1", "user2"}},
+			},
+		},
+
+		// Error cases.
+		"Error_changed_groups_invalid": {
+			currentGroups: []types.GroupEntry{
+				{Name: "group1", Passwd: "x", GID: 1, Users: []string{"user1"}},
+			},
+			newGroups: []types.GroupEntry{
+				{Name: "group1", Passwd: "x", GID: 1, Users: []string{"user1"}},
+				{Name: "invalid,group", Passwd: "x", GID: 2, Users: []string{"user2"}},
+			},
+			wantErr: true,
+		},
+		"Error_combined_groups_invalid": {
+			currentGroups: []types.GroupEntry{
+				{Name: "group1", Passwd: "x", GID: 1, Users: []string{"user1"}},
+			},
+			newGroups: []types.GroupEntry{
+				{Name: "group1", Passwd: "x", GID: 1, Users: []string{"user1"}},
+				{Name: "group2", Passwd: "x", GID: 1, Users: []string{"user2"}},
+			},
+			wantErr: true,
+		},
+		"Error_adding_multiple_groups_one_invalid": {
+			currentGroups: []types.GroupEntry{
+				{Name: "group1", Passwd: "x", GID: 1, Users: []string{"user1"}},
+			},
+			newGroups: []types.GroupEntry{
+				{Name: "group1", Passwd: "x", GID: 1, Users: []string{"user1"}},
+				{Name: "group2", Passwd: "x", GID: 2, Users: []string{"user2"}},
+				{Name: "invalid,group", Passwd: "x", GID: 4, Users: []string{"user4"}},
+			},
+			wantErr: true,
+		},
+		"Error_adding_multiple_groups_with_duplicate_GID": {
+			currentGroups: []types.GroupEntry{
+				{Name: "group1", Passwd: "x", GID: 1, Users: []string{"user1"}},
+			},
+			newGroups: []types.GroupEntry{
+				{Name: "group1", Passwd: "x", GID: 1, Users: []string{"user1"}},
+				{Name: "group2", Passwd: "x", GID: 2, Users: []string{"user2"}},
+				{Name: "group3", Passwd: "x", GID: 2, Users: []string{"user3"}},
+			},
+			wantErr: true,
+		},
+		"Error_adding_multiple_groups_with_duplicate_name": {
+			currentGroups: []types.GroupEntry{
+				{Name: "group1", Passwd: "x", GID: 1, Users: []string{"user1"}},
+			},
+			newGroups: []types.GroupEntry{
+				{Name: "group1", Passwd: "x", GID: 1, Users: []string{"user1"}},
+				{Name: "group2", Passwd: "x", GID: 2, Users: []string{"user2"}},
+				{Name: "group2", Passwd: "x", GID: 22, Users: []string{"user2.2"}},
+			},
+			wantErr: true,
+		},
+	}
+
+	for name, tc := range tests {
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+			err := localentries.ValidateChangedGroups(tc.currentGroups, tc.newGroups)
 			if tc.wantErr {
-				require.Error(t, err, "CleanUserFromlocalentries should have failed")
-			} else {
-				require.NoError(t, err, "CleanUserFromlocalentries should not have failed")
+				require.Error(t, err, "expected error but got nil")
+				t.Logf("Validation failed with error: %v", err)
+				return
 			}
-
-			localentriestestutils.RequireGPasswdOutput(t, destCmdsFile, golden.Path(t))
+			require.NoError(t, err, "expected no error but got: %v", err)
 		})
 	}
 }
 
-func TestMockgpasswd(t *testing.T) {
-	localentriestestutils.Mockgpasswd(t)
+func TestMain(m *testing.M) {
+	log.SetLevel(log.DebugLevel)
+
+	userslocking.Z_ForTests_OverrideLocking()
+	defer userslocking.Z_ForTests_RestoreLocking()
+
+	m.Run()
 }
diff --git a/internal/users/localentries/localusers.go b/internal/users/localentries/localusers.go
new file mode 100644
index 0000000000..1416bb6749
--- /dev/null
+++ b/internal/users/localentries/localusers.go
@@ -0,0 +1,73 @@
+package localentries
+
+import (
+	"bufio"
+	"context"
+	"os"
+	"strconv"
+	"strings"
+
+	"github.com/canonical/authd/internal/decorate"
+	"github.com/canonical/authd/internal/users/types"
+	"github.com/canonical/authd/log"
+)
+
+func parseLocalPasswdFile(passwdFile string) (entries []types.UserEntry, err error) {
+	defer decorate.OnError(&err, "could not parse local passwd file %s", passwdFile)
+
+	log.Debugf(context.Background(), "Parsing local passwd file: %s", passwdFile)
+
+	f, err := os.Open(passwdFile)
+	if err != nil {
+		return nil, err
+	}
+	defer f.Close()
+
+	// The format of the local passwd file is:
+	// username:password:uid:gid:gecos:home:shell
+	scanner := bufio.NewScanner(f)
+	for scanner.Scan() {
+		line := strings.TrimSpace(scanner.Text())
+		if line == "" || line[0] == '#' {
+			continue // Skip empty lines and comments
+		}
+
+		fields := strings.SplitN(line, ":", 7)
+		if len(fields) < 7 {
+			log.Warningf(context.Background(), "Skipping invalid entry in %s (invalid format): %s", passwdFile, line)
+			continue
+		}
+
+		username, uidValue, gidValue, gecos, home, shell :=
+			fields[0], fields[2], fields[3], fields[4], fields[5], fields[6]
+
+		uid, err := strconv.ParseUint(uidValue, 10, 32)
+		if err != nil {
+			log.Warningf(context.Background(), "Skipping invalid entry in %s (invalid UID): %s", passwdFile, line)
+			continue
+		}
+
+		gid, err := strconv.ParseUint(gidValue, 10, 32)
+		if err != nil {
+			log.Warningf(context.Background(), "Skipping invalid entry in %s (invalid GID): %s", passwdFile, line)
+			continue
+		}
+
+		entry := types.UserEntry{
+			Name:  username,
+			UID:   uint32(uid),
+			GID:   uint32(gid),
+			Gecos: gecos,
+			Dir:   home,
+			Shell: shell,
+		}
+
+		entries = append(entries, entry)
+	}
+
+	if err := scanner.Err(); err != nil {
+		return nil, err
+	}
+
+	return entries, nil
+}
diff --git a/internal/users/localentries/localusers_test.go b/internal/users/localentries/localusers_test.go
new file mode 100644
index 0000000000..18620bb923
--- /dev/null
+++ b/internal/users/localentries/localusers_test.go
@@ -0,0 +1,168 @@
+package localentries_test
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/canonical/authd/internal/users/localentries"
+	"github.com/canonical/authd/internal/users/types"
+	"github.com/stretchr/testify/require"
+)
+
+func TestParseLocalPasswdFile(t *testing.T) {
+	t.Parallel()
+
+	tests := map[string]struct {
+		passwdLines []string
+
+		wantEntries []types.UserEntry
+		wantErr     bool
+	}{
+		"Valid_empty_file": {passwdLines: []string{}},
+		"Valid_single_entry": {
+			passwdLines: []string{
+				"testuser:x:1000:1000:Test User:/home/testuser:/bin/bash",
+			},
+			wantEntries: []types.UserEntry{
+				{
+					Name:  "testuser",
+					UID:   1000,
+					GID:   1000,
+					Gecos: "Test User",
+					Dir:   "/home/testuser",
+					Shell: "/bin/bash",
+				},
+			},
+		},
+		"Multiple_valid_entries": {
+			passwdLines: []string{
+				"user1:x:1001:1001:User One:/home/user1:/bin/sh",
+				"user2:x:1002:1002:User Two:/home/user2:/bin/bash",
+			},
+			wantEntries: []types.UserEntry{
+				{
+					Name:  "user1",
+					UID:   1001,
+					GID:   1001,
+					Gecos: "User One",
+					Dir:   "/home/user1",
+					Shell: "/bin/sh",
+				},
+				{
+					Name:  "user2",
+					UID:   1002,
+					GID:   1002,
+					Gecos: "User Two",
+					Dir:   "/home/user2",
+					Shell: "/bin/bash",
+				},
+			},
+		},
+		"Skip_comment_and_empty_lines": {
+			passwdLines: []string{
+				"",
+				"# This is a comment",
+				"user3:x:1003:1003:User Three:/home/user3:/bin/bash",
+			},
+			wantEntries: []types.UserEntry{
+				{
+					Name:  "user3",
+					UID:   1003,
+					GID:   1003,
+					Gecos: "User Three",
+					Dir:   "/home/user3",
+					Shell: "/bin/bash",
+				},
+			},
+		},
+
+		"Warn_if_invalid_entry_format_too_few_fields": {
+			passwdLines: []string{
+				"badentry:x:1004:1004:User Four:/home/user4", // only 6 fields
+				"user4:x:1004:1004:User Four:/home/user4:/bin/bash",
+			},
+			wantEntries: []types.UserEntry{
+				{
+					Name:  "user4",
+					UID:   1004,
+					GID:   1004,
+					Gecos: "User Four",
+					Dir:   "/home/user4",
+					Shell: "/bin/bash",
+				},
+			},
+		},
+		"Warn_if_invalid_uid": {
+			passwdLines: []string{
+				"user5:x:notanuid:1005:User Five:/home/user5:/bin/bash",
+				"user6:x:1006:1006:User Six:/home/user6:/bin/bash",
+			},
+			wantEntries: []types.UserEntry{
+				{
+					Name:  "user6",
+					UID:   1006,
+					GID:   1006,
+					Gecos: "User Six",
+					Dir:   "/home/user6",
+					Shell: "/bin/bash",
+				},
+			},
+		},
+		"Warn_if_invalid_gid": {
+			passwdLines: []string{
+				"user7:x:1007:notagid:User Seven:/home/user7:/bin/bash",
+				"user8:x:1008:1008:User Eight:/home/user8:/bin/bash",
+			},
+			wantEntries: []types.UserEntry{
+				{
+					Name:  "user8",
+					UID:   1008,
+					GID:   1008,
+					Gecos: "User Eight",
+					Dir:   "/home/user8",
+					Shell: "/bin/bash",
+				},
+			},
+		},
+
+		// Error cases.
+		"Error_if_file_is_missing": {
+			wantErr: true,
+		},
+	}
+
+	for name, tc := range tests {
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			inputPasswdFilePath := filepath.Join(t.TempDir(), "passwd")
+
+			if tc.passwdLines != nil {
+				tc.passwdLines = append(tc.passwdLines, "")
+				err := os.WriteFile(inputPasswdFilePath, []byte(strings.Join(tc.passwdLines, "\n")), 0600)
+				require.NoError(t, err, "Setup: Failed to write passwd file to %s", inputPasswdFilePath)
+			}
+
+			le, entriesUnlock, err := localentries.WithUserDBLock(
+				localentries.WithPasswdInputPath(inputPasswdFilePath),
+				localentries.WithMockUserDBLocking(),
+			)
+			require.NoError(t, err, "Failed to lock the local entries")
+			t.Cleanup(func() {
+				err := entriesUnlock()
+				require.NoError(t, err, "entriesUnlock should not fail to unlock the local entries")
+			})
+
+			got, err := le.GetLocalUserEntries()
+			if tc.wantErr {
+				require.Error(t, err, "parseLocalPasswdFile() returned no error")
+			} else {
+				require.NoError(t, err, "parseLocalPasswdFile() returned error")
+			}
+
+			require.Equal(t, tc.wantEntries, got, "entries")
+		})
+	}
+}
diff --git a/internal/users/localentries/lockedentries.go b/internal/users/localentries/lockedentries.go
new file mode 100644
index 0000000000..a6fee4b39f
--- /dev/null
+++ b/internal/users/localentries/lockedentries.go
@@ -0,0 +1,397 @@
+package localentries
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"os/user"
+	"slices"
+	"strconv"
+	"sync"
+
+	"github.com/canonical/authd/internal/decorate"
+	"github.com/canonical/authd/internal/testsdetection"
+	userslocking "github.com/canonical/authd/internal/users/locking"
+	"github.com/canonical/authd/internal/users/types"
+	"github.com/canonical/authd/log"
+)
+
+const (
+	// GroupFile is the default local passwd file.
+	passwdFile = "/etc/passwd"
+
+	// GroupFile is the default local group file.
+	GroupFile = "/etc/group"
+)
+
+type options struct {
+	// inputPasswdPath is the path used to read the passwd file. Defaults to
+	// [passwdFile], but can be overwritten in tests.
+	inputPasswdPath string
+
+	// inputGroupPath is the path used to read the group file. Defaults to
+	// [GroupFile], but can be overwritten in tests.
+	inputGroupPath string
+	// outputGroupPath is the path used to write the group file. Defaults to
+	// [GroupFile], but can be overwritten in tests.
+	outputGroupPath string
+
+	// These are the lock and unlock functions to be used that can be overridden
+	// for testing purposes.
+	writeLockFunc   func() error
+	writeUnlockFunc func() error
+
+	// userDBLocked is the userDBLocked instance to use and that can be
+	// replaced for testing purposes.
+	userDBLocked *UserDBLocked
+}
+
+var defaultOptions = options{
+	// userDBLocked is used as the instance for locked groups when
+	// no test options are provided.
+	userDBLocked: &UserDBLocked{},
+
+	inputPasswdPath: passwdFile,
+	inputGroupPath:  GroupFile,
+	outputGroupPath: GroupFile,
+
+	writeLockFunc:   userslocking.WriteLock,
+	writeUnlockFunc: userslocking.WriteUnlock,
+}
+
+// Option represents an optional function to override [UserDBLocked] default values.
+type Option func(*options)
+
+type invalidEntry struct {
+	// lineNum is the line number in the group file where the invalid line was found.
+	lineNum int
+	// line is the content of the invalid line.
+	line string
+}
+
+// UserDBLocked is a struct that holds the current users and groups while
+// ensuring that the system's user database is locked to prevent concurrent
+// modifications.
+type UserDBLocked struct {
+	// mu is a mutex that protects the refCount and entries fields.
+	mu sync.Mutex
+	// refCount is used to track how many times the GroupsWithLock instance has
+	// been returned by [NewUserDBLocked].
+	refCount uint64
+
+	// localGroupsMu is the mutex that protects us globally from concurrent
+	// reads and writes on the group file.
+	// We need this to ensure that we don't write to the file while we're
+	// parsing it to prevent that we may do concurrent writes on it.
+	// The mutex is tied to the lock instance since it's where different file
+	// paths can be defined (through options), and avoids us to have a shared
+	// global mutex when the locked instances are different from the default.
+	localGroupsMu sync.Mutex
+
+	// userEntries holds the current group entries.
+	userEntries []types.UserEntry
+	// localUserEntries holds the current local entries.
+	localUserEntries []types.UserEntry
+
+	// groupEntries holds the current group entries.
+	groupEntries []types.GroupEntry
+	// localGroupEntries holds the current group entries.
+	localGroupEntries []types.GroupEntry
+	// localGroupInvalidEntries holds the current group invalid entries.
+	localGroupInvalidEntries []invalidEntry
+
+	// options to set the local entries context.
+	options options
+}
+
+// WithUserDBLock gets an [UserDBLocked] instance with a lock on the system's
+// user database.
+// It returns an unlock function that should be called to unlock it.
+//
+// It can called safely multiple times and will return always a the same
+// [UserDBLocked] with increased reference counting (that must be released
+// through returned the unlock function).
+func WithUserDBLock(args ...Option) (userDB *UserDBLocked, unlock func() error, err error) {
+	defer decorate.OnError(&err, "could not lock local groups")
+
+	unlock = func() error {
+		userDB.mu.Lock()
+		defer userDB.mu.Unlock()
+
+		if userDB.refCount == 0 {
+			return fmt.Errorf("groups were already unlocked")
+		}
+
+		userDB.refCount--
+		if userDB.refCount != 0 {
+			return nil
+		}
+
+		log.Debug(context.Background(), "Unlocking local entries")
+		userDB.userEntries = nil
+		userDB.localGroupEntries = nil
+		userDB.groupEntries = nil
+
+		return userDB.options.writeUnlockFunc()
+	}
+
+	opts := defaultOptions
+	testingMode := args != nil
+
+	if testingMode {
+		testsdetection.MustBeTesting()
+		opts.userDBLocked = &UserDBLocked{}
+
+		for _, arg := range args {
+			arg(&opts)
+		}
+	}
+
+	userDB = opts.userDBLocked
+
+	userDB.mu.Lock()
+	defer userDB.mu.Unlock()
+
+	if userDB.refCount != 0 {
+		userDB.refCount++
+		return userDB, unlock, nil
+	}
+
+	log.Debug(context.Background(), "Locking local entries")
+
+	if err := opts.writeLockFunc(); err != nil {
+		return nil, nil, err
+	}
+
+	userDB.options = opts
+	userDB.refCount++
+
+	return userDB, unlock, nil
+}
+
+// MustBeLocked ensures wether the entries are locked.
+func (l *UserDBLocked) MustBeLocked() {
+	l.mu.Lock()
+	defer l.mu.Unlock()
+
+	l.mustBeLocked()
+}
+
+func (l *UserDBLocked) mustBeLocked() {
+	if l.refCount == 0 {
+		panic("locked entries are not locked!")
+	}
+}
+
+// GetUserEntries gets the user entries.
+func (l *UserDBLocked) GetUserEntries() (entries []types.UserEntry, err error) {
+	l.mu.Lock()
+	defer l.mu.Unlock()
+
+	l.mustBeLocked()
+
+	if l.userEntries != nil {
+		return l.userEntries, nil
+	}
+
+	l.userEntries, err = getUserEntries()
+	return l.userEntries, err
+}
+
+// GetGroupEntries gets the group entries.
+func (l *UserDBLocked) GetGroupEntries() (entries []types.GroupEntry, err error) {
+	l.mu.Lock()
+	defer l.mu.Unlock()
+
+	l.mustBeLocked()
+
+	if l.groupEntries != nil {
+		return l.groupEntries, nil
+	}
+
+	l.groupEntries, err = getGroupEntries()
+	return l.groupEntries, err
+}
+
+// GetLocalUserEntries gets the local group entries.
+func (l *UserDBLocked) GetLocalUserEntries() (entries []types.UserEntry, err error) {
+	l.mu.Lock()
+	defer l.mu.Unlock()
+
+	l.mustBeLocked()
+
+	if l.localUserEntries != nil {
+		return l.localUserEntries, nil
+	}
+
+	l.localUserEntries, err = parseLocalPasswdFile(l.options.inputPasswdPath)
+	return l.localUserEntries, err
+}
+
+// GetLocalGroupEntries gets the local group entries.
+func (l *UserDBLocked) GetLocalGroupEntries() (entries []types.GroupEntry, err error) {
+	l.mu.Lock()
+	defer l.mu.Unlock()
+
+	l.mustBeLocked()
+
+	if l.localGroupEntries != nil {
+		return l.localGroupEntries, nil
+	}
+
+	l.localGroupEntries, l.localGroupInvalidEntries, err = parseLocalGroups(
+		l.options.inputGroupPath)
+	return l.localGroupEntries, err
+}
+
+// updateLocalGroupEntriesCache updates the local group entries.
+func (l *UserDBLocked) updateLocalGroupEntriesCache(entries []types.GroupEntry) {
+	l.mu.Lock()
+	defer l.mu.Unlock()
+
+	l.mustBeLocked()
+
+	l.localGroupEntries = types.DeepCopyGroupEntries(entries)
+}
+
+// lockGroupFile locks the read/write operation on the group file and returns
+// an unlock function.
+func (l *UserDBLocked) lockGroupFile() (unlock func()) {
+	l.MustBeLocked()
+
+	l.localGroupsMu.Lock()
+	return l.localGroupsMu.Unlock
+}
+
+// IsUniqueUserName returns if a user exists for the given name.
+func (l *UserDBLocked) IsUniqueUserName(name string) (unique bool, err error) {
+	l.MustBeLocked()
+
+	users, err := l.GetUserEntries()
+	if err != nil {
+		return false, err
+	}
+
+	// Let's try to check first the (potentially) cached entries.
+	if slices.ContainsFunc(users, func(u types.UserEntry) bool {
+		return u.Name == name
+	}) {
+		return false, nil
+	}
+
+	// In case we found no user, we need to still double check NSS by name.
+	_, err = user.Lookup(name)
+	if err == nil {
+		return false, nil
+	}
+
+	var userErr user.UnknownUserError
+	if !errors.As(err, &userErr) {
+		return false, err
+	}
+
+	return true, nil
+}
+
+// IsUniqueGroupName returns if a user exists for the given UID.
+func (l *UserDBLocked) IsUniqueGroupName(group string) (unique bool, err error) {
+	l.MustBeLocked()
+
+	// Let's try to check first the (potentially) cached entries.
+	groups, err := l.GetGroupEntries()
+	if err != nil {
+		return false, err
+	}
+
+	if slices.ContainsFunc(groups, func(g types.GroupEntry) bool {
+		return g.Name == group
+	}) {
+		return false, nil
+	}
+
+	// In case we found no user, we need to still double check NSS by name.
+	_, err = user.LookupGroup(group)
+	if err == nil {
+		return false, nil
+	}
+
+	var groupErr user.UnknownGroupError
+	if !errors.As(err, &groupErr) {
+		return false, err
+	}
+
+	return true, nil
+}
+
+// IsUniqueUID returns if a user exists for the given UID.
+func (l *UserDBLocked) IsUniqueUID(uid uint32) (unique bool, err error) {
+	l.MustBeLocked()
+
+	users, err := l.GetUserEntries()
+	if err != nil {
+		return false, err
+	}
+
+	// Let's try to check first the (potentially) cached entries.
+	if slices.ContainsFunc(users, func(u types.UserEntry) bool {
+		return u.UID == uid
+	}) {
+		return false, nil
+	}
+
+	// In case we found no user, we need to still double check NSS by ID.
+	_, err = user.LookupId(strconv.FormatUint(uint64(uid), 10))
+	if err == nil {
+		return false, nil
+	}
+
+	var userErr user.UnknownUserIdError
+	if !errors.As(err, &userErr) {
+		return false, err
+	}
+
+	// Also check if there is a group with the same ID, because the UID is
+	// also used as the GID of the user private group.
+	return l.IsUniqueGID(uid)
+}
+
+// IsUniqueGID returns if a user exists for the given UID.
+func (l *UserDBLocked) IsUniqueGID(gid uint32) (unique bool, err error) {
+	l.MustBeLocked()
+
+	// Let's try to check first the (potentially) cached entries.
+	groups, err := l.GetGroupEntries()
+	if err != nil {
+		return false, err
+	}
+
+	if slices.ContainsFunc(groups, func(g types.GroupEntry) bool {
+		return g.GID == gid
+	}) {
+		return false, nil
+	}
+
+	// Then the (potentially) cached user entries, for user local groups.
+	users, err := l.GetUserEntries()
+	if err != nil {
+		return false, err
+	}
+	if slices.ContainsFunc(users, func(u types.UserEntry) bool {
+		return u.GID == gid
+	}) {
+		return false, nil
+	}
+
+	// In case we found no user, we need to still double check NSS by ID.
+	_, err = user.LookupGroupId(strconv.FormatUint(uint64(gid), 10))
+	if err == nil {
+		return false, nil
+	}
+
+	var groupErr user.UnknownGroupIdError
+	if !errors.As(err, &groupErr) {
+		return false, err
+	}
+
+	return true, nil
+}
diff --git a/internal/users/localentries/lockedentries_test.go b/internal/users/localentries/lockedentries_test.go
new file mode 100644
index 0000000000..050dc27723
--- /dev/null
+++ b/internal/users/localentries/lockedentries_test.go
@@ -0,0 +1,256 @@
+package localentries_test
+
+import (
+	"crypto/rand"
+	"fmt"
+	"path/filepath"
+	"slices"
+	"sync"
+	"testing"
+
+	"github.com/canonical/authd/internal/users/localentries"
+	"github.com/canonical/authd/internal/users/types"
+	"github.com/stretchr/testify/require"
+)
+
+func TestEntriesWithLockInvalidActions(t *testing.T) {
+	// This cannot be parallel
+
+	require.Panics(t, func() { (&localentries.UserDBLocked{}).MustBeLocked() },
+		"MustBeLocked should panic but did not")
+	require.Panics(t, func() { _, _ = (&localentries.UserDBLocked{}).GetUserEntries() },
+		"GetUserEntries should panic but did not")
+	require.Panics(t, func() { _, _ = (&localentries.UserDBLocked{}).GetGroupEntries() },
+		"GetGroupEntries should panic but did not")
+	require.Panics(t, func() { _, _ = (&localentries.UserDBLocked{}).GetLocalGroupEntries() },
+		"GetLocalGroupEntries should panic but did not")
+
+	le, unlock, err := localentries.WithUserDBLock()
+	require.NotNil(t, le, "GetWithLock should not return nil but it did")
+
+	require.NoError(t, err, "Setup: failed to lock the users group")
+	err = unlock()
+	require.NoError(t, err, "Unlock should not fail to lock the users group")
+
+	err = unlock()
+	require.Error(t, err, "Unlocking twice should fail")
+
+	require.Panics(t, func() { _, _ = le.GetUserEntries() },
+		"GetUserEntries should panic but did not")
+	require.Panics(t, func() { _, _ = le.GetGroupEntries() },
+		"GetGroupEntries should panic but did not")
+	require.Panics(t, func() { _, _ = le.GetLocalGroupEntries() },
+		"GetLocalGroupEntries should panic but did not")
+
+	// This is to ensure that we're in a good state, despite the actions above
+	for range 10 {
+		_, unlock, err = localentries.WithUserDBLock()
+		require.NoError(t, err, "Failed to lock the users group")
+		defer func() {
+			err := unlock()
+			require.NoError(t, err, "Unlock should not fail to lock the users group")
+		}()
+	}
+}
+
+//nolint:tparallel // This can't be parallel, but subtests can.
+func TestRacingEntriesLockingActions(t *testing.T) {
+	const nIterations = 50
+
+	testFilePath := filepath.Join("testdata", "no_users_in_our_groups.group")
+	testUserDBLocked := &localentries.UserDBLocked{}
+
+	wg := sync.WaitGroup{}
+	wg.Add(nIterations)
+
+	// Lock and get the values in parallel.
+	for idx := range nIterations {
+		t.Run(fmt.Sprintf("iteration_%d", idx), func(t *testing.T) {
+			t.Parallel()
+
+			t.Cleanup(wg.Done)
+
+			var opts []localentries.Option
+			wantGroup := types.GroupEntry{Name: "root", GID: 0, Passwd: "x"}
+			useTestGroupFile := idx%3 == 0
+
+			if useTestGroupFile {
+				// Mix the requests with test-only code paths...
+				opts = append(opts,
+					localentries.WithGroupPath(testFilePath),
+					localentries.WithMockUserDBLocking(),
+					localentries.WithUserDBLockedInstance(testUserDBLocked),
+				)
+				wantGroup = types.GroupEntry{Name: "localgroup1", GID: 41, Passwd: "x"}
+			}
+
+			ctx, entriesUnlock, err := localentries.WithUserDBLock(opts...)
+			require.NoError(t, err, "Failed to lock the local entries")
+
+			groups, err := localentries.GetGroupEntries(ctx)
+			require.NoError(t, err, "GetEntries should not return an error, but did")
+			require.NotEmpty(t, groups, "Got empty groups (test groups: %v)", useTestGroupFile)
+			require.Contains(t, groups, wantGroup, "Expected group was not found  (test groups: %v)", useTestGroupFile)
+			err = entriesUnlock()
+			require.NoError(t, err, "EntriesUnlock() should not fail to lock the users group (test groups: %v)", useTestGroupFile)
+		})
+	}
+}
+
+//nolint:dupl  // This is not a duplicated test.
+func TestIsUniqueUserName(t *testing.T) {
+	t.Parallel()
+
+	le, unlock, err := localentries.WithUserDBLock()
+	require.NoError(t, err, "Setup: NewUserDBLocked should not fail to lock the users group")
+
+	t.Cleanup(func() {
+		err := unlock()
+		require.NoError(t, err, "TearDown: Unlock should not fail, but it did")
+	})
+
+	users, err := le.GetUserEntries()
+	require.NoError(t, err, "Setup: GetUserEntries should not fail, but it did")
+
+	for _, u := range users {
+		t.Run(fmt.Sprintf("user_%s", u.Name), func(t *testing.T) {
+			t.Parallel()
+
+			unique, err := le.IsUniqueUserName(u.Name)
+			require.NoError(t, err, "IsUniqueUserName should not fail, but it did")
+			require.False(t, unique, "IsUniqueUserName should not return true for user %q", u.Name)
+
+			bytes := make([]byte, 16)
+			_, err = rand.Read(bytes)
+			require.NoError(t, err, "Setup: Rand should not fail, but it did")
+
+			otherName := fmt.Sprintf("%s-%x", u.Name, bytes)
+			unique, err = le.IsUniqueUserName(otherName)
+			require.NoError(t, err, "IsUniqueUserName should not fail, but it did")
+			require.True(t, unique, "IsUniqueUserName should not return false for user %q", otherName)
+		})
+	}
+}
+
+//nolint:dupl  // This is not a duplicated test.
+func TestIsUniqueGroupName(t *testing.T) {
+	t.Parallel()
+
+	le, unlock, err := localentries.WithUserDBLock()
+	require.NoError(t, err, "Setup: NewUserDBLocked should not fail to lock the users group")
+
+	t.Cleanup(func() {
+		err := unlock()
+		require.NoError(t, err, "TearDown: Unlock should not fail, but it did")
+	})
+
+	groups, err := le.GetGroupEntries()
+	require.NoError(t, err, "Setup: GetGroupEntries should not fail, but it did")
+
+	for _, g := range groups {
+		t.Run(fmt.Sprintf("group_%s", g.Name), func(t *testing.T) {
+			t.Parallel()
+
+			unique, err := le.IsUniqueGroupName(g.Name)
+			require.NoError(t, err, "IsUniqueGroupName should not fail, but it did")
+			require.False(t, unique, "IsUniqueGroupName should not return true for user %q", g.Name)
+
+			bytes := make([]byte, 16)
+			_, err = rand.Read(bytes)
+			require.NoError(t, err, "Setup: Rand should not fail, but it did")
+
+			otherName := fmt.Sprintf("%s-%x", g.Name, bytes)
+			unique, err = le.IsUniqueGroupName(otherName)
+			require.NoError(t, err, "IsUniqueGroupName should not fail, but it did")
+			require.True(t, unique, "IsUniqueGroupName should not return false for user %q", otherName)
+		})
+	}
+}
+
+//nolint:dupl  // This is not a duplicated test.
+func TestIsUniqueUID(t *testing.T) {
+	t.Parallel()
+
+	le, unlock, err := localentries.WithUserDBLock()
+	require.NoError(t, err, "Setup: NewUserDBLocked should not fail to lock the users group")
+
+	t.Cleanup(func() {
+		err := unlock()
+		require.NoError(t, err, "TearDown: Unlock should not fail, but it did")
+	})
+
+	users, err := le.GetUserEntries()
+	require.NoError(t, err, "Setup: GetUserEntries should not fail, but it did")
+
+	for _, u := range users {
+		t.Run(fmt.Sprintf("user_%s", u.Name), func(t *testing.T) {
+			t.Parallel()
+
+			unique, err := le.IsUniqueUID(u.UID)
+			require.NoError(t, err, "IsUniqueUID should not fail, but it did")
+			require.False(t, unique, "IsUniqueUID should not return true for user %q", u.Name)
+		})
+	}
+
+	t.Run("at_least_an_unique_id", func(t *testing.T) {
+		t.Parallel()
+
+		maxUIDUser := slices.MaxFunc(users, func(a types.UserEntry, b types.UserEntry) int {
+			return int(max(a.UID, b.UID))
+		})
+
+		// This has to return one day...
+		for uid := maxUIDUser.UID; ; uid++ {
+			unique, err := le.IsUniqueUID(uid)
+			require.NoError(t, err, "IsUniqueUID should not fail, but it did")
+			if unique {
+				t.Logf("Found unique ID %d", uid)
+				break
+			}
+		}
+	})
+}
+
+//nolint:dupl  // This is not a duplicated test.
+func TestIsUniqueGID(t *testing.T) {
+	t.Parallel()
+
+	le, unlock, err := localentries.WithUserDBLock()
+	require.NoError(t, err, "Setup: NewUserDBLocked should not fail to lock the users group")
+
+	t.Cleanup(func() {
+		err := unlock()
+		require.NoError(t, err, "TearDown: Unlock should not fail, but it did")
+	})
+
+	groups, err := le.GetGroupEntries()
+	require.NoError(t, err, "Setup: GetUserEntries should not fail, but it did")
+
+	for _, g := range groups {
+		t.Run(fmt.Sprintf("group_%s", g.Name), func(t *testing.T) {
+			t.Parallel()
+
+			unique, err := le.IsUniqueGID(g.GID)
+			require.NoError(t, err, "IsUniqueGID should not fail, but it did")
+			require.False(t, unique, "IsUniqueGID should not return true for user %q", g.Name)
+		})
+	}
+
+	t.Run("at_least_an_unique_id", func(t *testing.T) {
+		t.Parallel()
+
+		maxGIDGroup := slices.MaxFunc(groups, func(a types.GroupEntry, b types.GroupEntry) int {
+			return int(max(a.GID, b.GID))
+		})
+
+		// This has to return one day...
+		for gid := maxGIDGroup.GID; ; gid++ {
+			unique, err := le.IsUniqueGID(gid)
+			require.NoError(t, err, "IsUniqueGID should not fail, but it did")
+			if unique {
+				t.Logf("Found unique ID %d", gid)
+				break
+			}
+		}
+	})
+}
diff --git a/internal/users/localentries/testdata/empty.group b/internal/users/localentries/testdata/empty.group
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/internal/users/localentries/testdata/golden/TestCleanUserFromlocalentries/Cleans_up_user_from_group b/internal/users/localentries/testdata/golden/TestCleanUserFromlocalentries/Cleans_up_user_from_group
deleted file mode 100644
index cf402a20b0..0000000000
--- a/internal/users/localentries/testdata/golden/TestCleanUserFromlocalentries/Cleans_up_user_from_group
+++ /dev/null
@@ -1 +0,0 @@
---delete myuser localgroup1
\ No newline at end of file
diff --git a/internal/users/localentries/testdata/golden/TestCleanUserFromlocalentries/Cleans_up_user_from_multiple_groups b/internal/users/localentries/testdata/golden/TestCleanUserFromlocalentries/Cleans_up_user_from_multiple_groups
deleted file mode 100644
index cf2886bdff..0000000000
--- a/internal/users/localentries/testdata/golden/TestCleanUserFromlocalentries/Cleans_up_user_from_multiple_groups
+++ /dev/null
@@ -1,2 +0,0 @@
---delete myuser localgroup1
---delete myuser localgroup2
\ No newline at end of file
diff --git a/internal/users/localentries/testdata/golden/TestCleanlocalentries/Cleans_up_multiple_users_from_group b/internal/users/localentries/testdata/golden/TestCleanlocalentries/Cleans_up_multiple_users_from_group
deleted file mode 100644
index 541c95018c..0000000000
--- a/internal/users/localentries/testdata/golden/TestCleanlocalentries/Cleans_up_multiple_users_from_group
+++ /dev/null
@@ -1,3 +0,0 @@
---delete inactiveuser localgroup1
---delete inactiveuser2 localgroup1
---delete inactiveuser3 localgroup1
\ No newline at end of file
diff --git a/internal/users/localentries/testdata/golden/TestCleanlocalentries/Cleans_up_multiple_users_from_multiple_groups b/internal/users/localentries/testdata/golden/TestCleanlocalentries/Cleans_up_multiple_users_from_multiple_groups
deleted file mode 100644
index 3be8a9f0f4..0000000000
--- a/internal/users/localentries/testdata/golden/TestCleanlocalentries/Cleans_up_multiple_users_from_multiple_groups
+++ /dev/null
@@ -1,6 +0,0 @@
---delete inactiveuser localgroup2
---delete inactiveuser localgroup3
---delete inactiveuser2 localgroup1
---delete inactiveuser2 localgroup3
---delete inactiveuser3 localgroup1
---delete inactiveuser3 localgroup2
\ No newline at end of file
diff --git a/internal/users/localentries/testdata/golden/TestCleanlocalentries/Cleans_up_user_from_group b/internal/users/localentries/testdata/golden/TestCleanlocalentries/Cleans_up_user_from_group
deleted file mode 100644
index 1cb5f6df8f..0000000000
--- a/internal/users/localentries/testdata/golden/TestCleanlocalentries/Cleans_up_user_from_group
+++ /dev/null
@@ -1 +0,0 @@
---delete inactiveuser localgroup1
\ No newline at end of file
diff --git a/internal/users/localentries/testdata/golden/TestCleanlocalentries/Cleans_up_user_from_multiple_groups b/internal/users/localentries/testdata/golden/TestCleanlocalentries/Cleans_up_user_from_multiple_groups
deleted file mode 100644
index f792ff0282..0000000000
--- a/internal/users/localentries/testdata/golden/TestCleanlocalentries/Cleans_up_user_from_multiple_groups
+++ /dev/null
@@ -1,3 +0,0 @@
---delete inactiveuser localgroup1
---delete inactiveuser localgroup3
---delete inactiveuser localgroup4
\ No newline at end of file
diff --git a/internal/users/localentries/testdata/golden/TestCleanlocalentries/Error_on_any_unignored_delete_gpasswd_error b/internal/users/localentries/testdata/golden/TestCleanlocalentries/Error_on_any_unignored_delete_gpasswd_error
deleted file mode 100644
index dac35797d5..0000000000
--- a/internal/users/localentries/testdata/golden/TestCleanlocalentries/Error_on_any_unignored_delete_gpasswd_error
+++ /dev/null
@@ -1,5 +0,0 @@
---delete  cloudgroup1
---delete  cloudgroup2
---delete  localgroup1
---delete  localgroup3
---delete  localgroup4
\ No newline at end of file
diff --git a/internal/users/localentries/testdata/golden/TestGetAndSaveLocalGroups/Empty_group_adding_one_group.group b/internal/users/localentries/testdata/golden/TestGetAndSaveLocalGroups/Empty_group_adding_one_group.group
new file mode 100644
index 0000000000..88e03b5ac7
--- /dev/null
+++ b/internal/users/localentries/testdata/golden/TestGetAndSaveLocalGroups/Empty_group_adding_one_group.group
@@ -0,0 +1 @@
+group1:x:1:
diff --git a/internal/users/localentries/testdata/golden/TestGetAndSaveLocalGroups/Empty_group_adding_one_group.group.backup b/internal/users/localentries/testdata/golden/TestGetAndSaveLocalGroups/Empty_group_adding_one_group.group.backup
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/internal/users/localentries/testdata/golden/TestGetAndSaveLocalGroups/Empty_group_adding_one_group_with_one_user.group b/internal/users/localentries/testdata/golden/TestGetAndSaveLocalGroups/Empty_group_adding_one_group_with_one_user.group
new file mode 100644
index 0000000000..92a82f3c60
--- /dev/null
+++ b/internal/users/localentries/testdata/golden/TestGetAndSaveLocalGroups/Empty_group_adding_one_group_with_one_user.group
@@ -0,0 +1 @@
+group1:x:1:user1
diff --git a/internal/users/localentries/testdata/golden/TestGetAndSaveLocalGroups/Empty_group_adding_one_group_with_one_user.group.backup b/internal/users/localentries/testdata/golden/TestGetAndSaveLocalGroups/Empty_group_adding_one_group_with_one_user.group.backup
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/internal/users/localentries/testdata/golden/TestGetAndSaveLocalGroups/Empty_group_adding_two_groups_with_two_users.group b/internal/users/localentries/testdata/golden/TestGetAndSaveLocalGroups/Empty_group_adding_two_groups_with_two_users.group
new file mode 100644
index 0000000000..4be9c763c6
--- /dev/null
+++ b/internal/users/localentries/testdata/golden/TestGetAndSaveLocalGroups/Empty_group_adding_two_groups_with_two_users.group
@@ -0,0 +1,2 @@
+group1:x:1:user1.1,user1.2
+group2:x:2:user2.2,user2.2
diff --git a/internal/users/localentries/testdata/golden/TestGetAndSaveLocalGroups/Empty_group_adding_two_groups_with_two_users.group.backup b/internal/users/localentries/testdata/golden/TestGetAndSaveLocalGroups/Empty_group_adding_two_groups_with_two_users.group.backup
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/internal/users/localentries/testdata/golden/TestGetAndSaveLocalGroups/Ignores_adding_duplicated_equal_group_to_existing_file.group b/internal/users/localentries/testdata/golden/TestGetAndSaveLocalGroups/Ignores_adding_duplicated_equal_group_to_existing_file.group
new file mode 100644
index 0000000000..e4d1ad40b8
--- /dev/null
+++ b/internal/users/localentries/testdata/golden/TestGetAndSaveLocalGroups/Ignores_adding_duplicated_equal_group_to_existing_file.group
@@ -0,0 +1,7 @@
+localgroup1:x:41:
+localgroup2:x:42:otheruser
+localgroup3:x:43:
+localgroup4:x:44:otheruser2
+cloudgroup1:x:9998:otheruser3
+cloudgroup2:x:9999:otheruser4
+localgroup3:x:43:
diff --git a/internal/users/localentries/testdata/golden/TestGetAndSaveLocalGroups/Ignores_adding_duplicated_equal_group_to_existing_file.group.backup b/internal/users/localentries/testdata/golden/TestGetAndSaveLocalGroups/Ignores_adding_duplicated_equal_group_to_existing_file.group.backup
new file mode 100644
index 0000000000..f298aac70d
--- /dev/null
+++ b/internal/users/localentries/testdata/golden/TestGetAndSaveLocalGroups/Ignores_adding_duplicated_equal_group_to_existing_file.group.backup
@@ -0,0 +1,6 @@
+localgroup1:x:41:
+localgroup2:x:42:otheruser
+localgroup3:x:43:
+localgroup4:x:44:otheruser2
+cloudgroup1:x:9998:otheruser3
+cloudgroup2:x:9999:otheruser4
diff --git a/internal/users/localentries/testdata/golden/TestGetAndSaveLocalGroups/Ignores_adding_duplicated_equal_groups.group b/internal/users/localentries/testdata/golden/TestGetAndSaveLocalGroups/Ignores_adding_duplicated_equal_groups.group
new file mode 100644
index 0000000000..cf642aec25
--- /dev/null
+++ b/internal/users/localentries/testdata/golden/TestGetAndSaveLocalGroups/Ignores_adding_duplicated_equal_groups.group
@@ -0,0 +1,2 @@
+group1:x:12345:user1,user2
+group1:x:12345:user1,user2
diff --git a/internal/users/localentries/testdata/golden/TestGetAndSaveLocalGroups/Ignores_adding_duplicated_equal_groups.group.backup b/internal/users/localentries/testdata/golden/TestGetAndSaveLocalGroups/Ignores_adding_duplicated_equal_groups.group.backup
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/internal/users/localentries/testdata/golden/TestGetAndSaveLocalGroups/Insert_new_user_in_existing_files_with_multiple_other_users_in_our_group.group b/internal/users/localentries/testdata/golden/TestGetAndSaveLocalGroups/Insert_new_user_in_existing_files_with_multiple_other_users_in_our_group.group
new file mode 100644
index 0000000000..1547ad060e
--- /dev/null
+++ b/internal/users/localentries/testdata/golden/TestGetAndSaveLocalGroups/Insert_new_user_in_existing_files_with_multiple_other_users_in_our_group.group
@@ -0,0 +1,6 @@
+localgroup1:x:41:otheruser,otheruser2,user1.1,user1.2
+localgroup2:x:42:otheruser2,user2.2,user2.2
+localgroup3:x:43:otheruser
+localgroup4:x:44:otheruser2
+cloudgroup1:x:9998:otheruser3
+cloudgroup2:x:9999:otheruser4
diff --git a/internal/users/localentries/testdata/golden/TestGetAndSaveLocalGroups/Insert_new_user_in_existing_files_with_multiple_other_users_in_our_group.group.backup b/internal/users/localentries/testdata/golden/TestGetAndSaveLocalGroups/Insert_new_user_in_existing_files_with_multiple_other_users_in_our_group.group.backup
new file mode 100644
index 0000000000..57701809de
--- /dev/null
+++ b/internal/users/localentries/testdata/golden/TestGetAndSaveLocalGroups/Insert_new_user_in_existing_files_with_multiple_other_users_in_our_group.group.backup
@@ -0,0 +1,6 @@
+localgroup1:x:41:otheruser,otheruser2
+localgroup2:x:42:otheruser2
+localgroup3:x:43:otheruser
+localgroup4:x:44:otheruser2
+cloudgroup1:x:9998:otheruser3
+cloudgroup2:x:9999:otheruser4
diff --git a/internal/users/localentries/testdata/golden/TestGetAndSaveLocalGroups/Insert_new_user_in_existing_files_with_no_users_in_our_group.group b/internal/users/localentries/testdata/golden/TestGetAndSaveLocalGroups/Insert_new_user_in_existing_files_with_no_users_in_our_group.group
new file mode 100644
index 0000000000..e8d60b1114
--- /dev/null
+++ b/internal/users/localentries/testdata/golden/TestGetAndSaveLocalGroups/Insert_new_user_in_existing_files_with_no_users_in_our_group.group
@@ -0,0 +1,6 @@
+localgroup1:x:41:user1.1,user1.2
+localgroup2:x:42:otheruser,user2.2,user2.2
+localgroup3:x:43:
+localgroup4:x:44:otheruser2
+cloudgroup1:x:9998:otheruser3
+cloudgroup2:x:9999:otheruser4
diff --git a/internal/users/localentries/testdata/golden/TestGetAndSaveLocalGroups/Insert_new_user_in_existing_files_with_no_users_in_our_group.group.backup b/internal/users/localentries/testdata/golden/TestGetAndSaveLocalGroups/Insert_new_user_in_existing_files_with_no_users_in_our_group.group.backup
new file mode 100644
index 0000000000..f298aac70d
--- /dev/null
+++ b/internal/users/localentries/testdata/golden/TestGetAndSaveLocalGroups/Insert_new_user_in_existing_files_with_no_users_in_our_group.group.backup
@@ -0,0 +1,6 @@
+localgroup1:x:41:
+localgroup2:x:42:otheruser
+localgroup3:x:43:
+localgroup4:x:44:otheruser2
+cloudgroup1:x:9998:otheruser3
+cloudgroup2:x:9999:otheruser4
diff --git a/internal/users/localentries/testdata/golden/TestGetAndSaveLocalGroups/Insert_new_user_in_existing_files_with_other_users_in_our_group.group b/internal/users/localentries/testdata/golden/TestGetAndSaveLocalGroups/Insert_new_user_in_existing_files_with_other_users_in_our_group.group
new file mode 100644
index 0000000000..aee6a2be46
--- /dev/null
+++ b/internal/users/localentries/testdata/golden/TestGetAndSaveLocalGroups/Insert_new_user_in_existing_files_with_other_users_in_our_group.group
@@ -0,0 +1,6 @@
+localgroup1:x:41:otheruser,user1.1,user1.2
+localgroup2:x:42:otheruser2,user2.2,user2.2
+localgroup3:x:43:otheruser
+localgroup4:x:44:otheruser2
+cloudgroup1:x:9998:otheruser3
+cloudgroup2:x:9999:otheruser4
diff --git a/internal/users/localentries/testdata/golden/TestGetAndSaveLocalGroups/Insert_new_user_in_existing_files_with_other_users_in_our_group.group.backup b/internal/users/localentries/testdata/golden/TestGetAndSaveLocalGroups/Insert_new_user_in_existing_files_with_other_users_in_our_group.group.backup
new file mode 100644
index 0000000000..821230a903
--- /dev/null
+++ b/internal/users/localentries/testdata/golden/TestGetAndSaveLocalGroups/Insert_new_user_in_existing_files_with_other_users_in_our_group.group.backup
@@ -0,0 +1,6 @@
+localgroup1:x:41:otheruser
+localgroup2:x:42:otheruser2
+localgroup3:x:43:otheruser
+localgroup4:x:44:otheruser2
+cloudgroup1:x:9998:otheruser3
+cloudgroup2:x:9999:otheruser4
diff --git a/internal/users/localentries/testdata/golden/TestGetAndSaveLocalGroups/Insert_new_user_when_no_users_in_any_group.group b/internal/users/localentries/testdata/golden/TestGetAndSaveLocalGroups/Insert_new_user_when_no_users_in_any_group.group
new file mode 100644
index 0000000000..fedc59334a
--- /dev/null
+++ b/internal/users/localentries/testdata/golden/TestGetAndSaveLocalGroups/Insert_new_user_when_no_users_in_any_group.group
@@ -0,0 +1,6 @@
+localgroup1:x:41:user1.1,user1.2
+localgroup2:x:42:user2.2,user2.2
+localgroup3:x:43:
+localgroup4:x:44:
+cloudgroup1:x:9998:
+cloudgroup2:x:9999:
diff --git a/internal/users/localentries/testdata/gpasswdfail_in_deleted_group.group b/internal/users/localentries/testdata/golden/TestGetAndSaveLocalGroups/Insert_new_user_when_no_users_in_any_group.group.backup
similarity index 76%
rename from internal/users/localentries/testdata/gpasswdfail_in_deleted_group.group
rename to internal/users/localentries/testdata/golden/TestGetAndSaveLocalGroups/Insert_new_user_when_no_users_in_any_group.group.backup
index e0daafe3db..d6667e9e66 100644
--- a/internal/users/localentries/testdata/gpasswdfail_in_deleted_group.group
+++ b/internal/users/localentries/testdata/golden/TestGetAndSaveLocalGroups/Insert_new_user_when_no_users_in_any_group.group.backup
@@ -1,5 +1,5 @@
 localgroup1:x:41:
-localgroup2:x:42:gpasswdfail
+localgroup2:x:42:
 localgroup3:x:43:
 localgroup4:x:44:
 cloudgroup1:x:9998:
diff --git a/internal/users/localentries/testdata/golden/TestGetAndSaveLocalGroups/Removes_group_correctly.group b/internal/users/localentries/testdata/golden/TestGetAndSaveLocalGroups/Removes_group_correctly.group
new file mode 100644
index 0000000000..88de603498
--- /dev/null
+++ b/internal/users/localentries/testdata/golden/TestGetAndSaveLocalGroups/Removes_group_correctly.group
@@ -0,0 +1,4 @@
+localgroup2:x:42:otheruser2
+localgroup3:x:43:otheruser
+cloudgroup1:x:9998:otheruser3
+cloudgroup2:x:9999:otheruser4
diff --git a/internal/users/localentries/testdata/golden/TestGetAndSaveLocalGroups/Removes_group_correctly.group.backup b/internal/users/localentries/testdata/golden/TestGetAndSaveLocalGroups/Removes_group_correctly.group.backup
new file mode 100644
index 0000000000..57701809de
--- /dev/null
+++ b/internal/users/localentries/testdata/golden/TestGetAndSaveLocalGroups/Removes_group_correctly.group.backup
@@ -0,0 +1,6 @@
+localgroup1:x:41:otheruser,otheruser2
+localgroup2:x:42:otheruser2
+localgroup3:x:43:otheruser
+localgroup4:x:44:otheruser2
+cloudgroup1:x:9998:otheruser3
+cloudgroup2:x:9999:otheruser4
diff --git a/internal/users/localentries/testdata/golden/TestGetAndSaveLocalGroups/Warn_when_groups_file_has_a_duplicated_group.group b/internal/users/localentries/testdata/golden/TestGetAndSaveLocalGroups/Warn_when_groups_file_has_a_duplicated_group.group
new file mode 100644
index 0000000000..42223c8ad5
--- /dev/null
+++ b/internal/users/localentries/testdata/golden/TestGetAndSaveLocalGroups/Warn_when_groups_file_has_a_duplicated_group.group
@@ -0,0 +1,8 @@
+localgroup1:x:41:otheruser
+localgroup2:x:42:otheruser2
+localgroup3:x:43:invalidGID
+localgroup4:x:44:otheruser2
+cloudgroup1:x:9998:otheruser3
+cloudgroup2:x:9999:otheruser4
+localgroup4:x:123:again
+localgroup5:x:45:
diff --git a/internal/users/localentries/testdata/golden/TestGetAndSaveLocalGroups/Warn_when_groups_file_has_a_duplicated_group.group.backup b/internal/users/localentries/testdata/golden/TestGetAndSaveLocalGroups/Warn_when_groups_file_has_a_duplicated_group.group.backup
new file mode 100644
index 0000000000..df29880934
--- /dev/null
+++ b/internal/users/localentries/testdata/golden/TestGetAndSaveLocalGroups/Warn_when_groups_file_has_a_duplicated_group.group.backup
@@ -0,0 +1,7 @@
+localgroup1:x:41:otheruser
+localgroup2:x:42:otheruser2
+localgroup3:x:43:invalidGID
+localgroup4:x:44:otheruser2
+cloudgroup1:x:9998:otheruser3
+cloudgroup2:x:9999:otheruser4
+localgroup4:x:123:again
diff --git a/internal/users/localentries/testdata/golden/TestGetAndSaveLocalGroups/Warn_when_groups_file_has_an_extra_field.group b/internal/users/localentries/testdata/golden/TestGetAndSaveLocalGroups/Warn_when_groups_file_has_an_extra_field.group
new file mode 100644
index 0000000000..65fbd260f3
--- /dev/null
+++ b/internal/users/localentries/testdata/golden/TestGetAndSaveLocalGroups/Warn_when_groups_file_has_an_extra_field.group
@@ -0,0 +1,7 @@
+localgroup1:x:41:otheruser
+localgroup2:x:42:otheruser2
+localgroup3:x:43:otheruser3
+localgroup4:x:44:otheruser2:extrafield
+cloudgroup1:x:9998:otheruser3
+cloudgroup2:x:9999:otheruser4
+localgroup5:x:45:
diff --git a/internal/users/localentries/testdata/golden/TestGetAndSaveLocalGroups/Warn_when_groups_file_has_an_extra_field.group.backup b/internal/users/localentries/testdata/golden/TestGetAndSaveLocalGroups/Warn_when_groups_file_has_an_extra_field.group.backup
new file mode 100644
index 0000000000..3de5534245
--- /dev/null
+++ b/internal/users/localentries/testdata/golden/TestGetAndSaveLocalGroups/Warn_when_groups_file_has_an_extra_field.group.backup
@@ -0,0 +1,6 @@
+localgroup1:x:41:otheruser
+localgroup2:x:42:otheruser2
+localgroup3:x:43:otheruser3
+localgroup4:x:44:otheruser2:extrafield
+cloudgroup1:x:9998:otheruser3
+cloudgroup2:x:9999:otheruser4
diff --git a/internal/users/localentries/testdata/golden/TestGetAndSaveLocalGroups/Warn_when_groups_file_has_entries_with_missing_fields.group b/internal/users/localentries/testdata/golden/TestGetAndSaveLocalGroups/Warn_when_groups_file_has_entries_with_missing_fields.group
new file mode 100644
index 0000000000..d8d0ce3c4f
--- /dev/null
+++ b/internal/users/localentries/testdata/golden/TestGetAndSaveLocalGroups/Warn_when_groups_file_has_entries_with_missing_fields.group
@@ -0,0 +1,10 @@
+localgroup1
+localgroup2:
+localgroup3:x
+localgroup4:x:44
+localgroup5:x:45:
+localgroup6:x:46:
+localgroup7:x:47:
+localgroup8:x:48:
+#localgroup8:x:48:with-comment
+localgroup9:x:49:
diff --git a/internal/users/localentries/testdata/golden/TestGetAndSaveLocalGroups/Warn_when_groups_file_has_entries_with_missing_fields.group.backup b/internal/users/localentries/testdata/golden/TestGetAndSaveLocalGroups/Warn_when_groups_file_has_entries_with_missing_fields.group.backup
new file mode 100644
index 0000000000..f60158b440
--- /dev/null
+++ b/internal/users/localentries/testdata/golden/TestGetAndSaveLocalGroups/Warn_when_groups_file_has_entries_with_missing_fields.group.backup
@@ -0,0 +1,9 @@
+localgroup1
+localgroup2:
+localgroup3:x
+localgroup4:x:44
+localgroup5:x:45:
+localgroup6:x:46:
+localgroup7:x:47:
+localgroup8:x:48:
+#localgroup8:x:48:with-comment
diff --git a/internal/users/localentries/testdata/golden/TestUpdatelocalentries/Add_and_remove_user_from_multiple_groups_with_one_remaining b/internal/users/localentries/testdata/golden/TestUpdatelocalentries/Add_and_remove_user_from_multiple_groups_with_one_remaining
deleted file mode 100644
index 80dd17cde2..0000000000
--- a/internal/users/localentries/testdata/golden/TestUpdatelocalentries/Add_and_remove_user_from_multiple_groups_with_one_remaining
+++ /dev/null
@@ -1 +0,0 @@
---add myuser localgroup3
\ No newline at end of file
diff --git a/internal/users/localentries/testdata/golden/TestUpdatelocalentries/Add_and_remove_user_from_multiple_groups_with_one_remaining.group b/internal/users/localentries/testdata/golden/TestUpdatelocalentries/Add_and_remove_user_from_multiple_groups_with_one_remaining.group
new file mode 100644
index 0000000000..38db364051
--- /dev/null
+++ b/internal/users/localentries/testdata/golden/TestUpdatelocalentries/Add_and_remove_user_from_multiple_groups_with_one_remaining.group
@@ -0,0 +1,6 @@
+localgroup1:x:41:otheruser,myuser,otheruser2
+localgroup2:x:42:myuser
+localgroup3:x:43:otheruser2,myuser
+localgroup4:x:44:otheruser2
+cloudgroup1:x:9998:otheruser3
+cloudgroup2:x:9999:otheruser4
diff --git a/internal/users/localentries/testdata/golden/TestUpdatelocalentries/Add_and_remove_user_from_multiple_groups_with_one_remaining.group.backup b/internal/users/localentries/testdata/golden/TestUpdatelocalentries/Add_and_remove_user_from_multiple_groups_with_one_remaining.group.backup
new file mode 100644
index 0000000000..a0ad6fba24
--- /dev/null
+++ b/internal/users/localentries/testdata/golden/TestUpdatelocalentries/Add_and_remove_user_from_multiple_groups_with_one_remaining.group.backup
@@ -0,0 +1,6 @@
+localgroup1:x:41:otheruser,myuser,otheruser2
+localgroup2:x:42:myuser
+localgroup3:x:43:otheruser2
+localgroup4:x:44:otheruser2
+cloudgroup1:x:9998:otheruser3
+cloudgroup2:x:9999:otheruser4
diff --git a/internal/users/localentries/testdata/golden/TestUpdatelocalentries/Group_file_with_empty_line_is_ignored b/internal/users/localentries/testdata/golden/TestUpdatelocalentries/Group_file_with_empty_line_is_ignored
deleted file mode 100644
index 48073e4afb..0000000000
--- a/internal/users/localentries/testdata/golden/TestUpdatelocalentries/Group_file_with_empty_line_is_ignored
+++ /dev/null
@@ -1,2 +0,0 @@
---add myuser localgroup1
---add myuser localgroup3
\ No newline at end of file
diff --git a/internal/users/localentries/testdata/golden/TestUpdatelocalentries/Group_file_with_empty_line_is_ignored.group b/internal/users/localentries/testdata/golden/TestUpdatelocalentries/Group_file_with_empty_line_is_ignored.group
new file mode 100644
index 0000000000..3f414e74b2
--- /dev/null
+++ b/internal/users/localentries/testdata/golden/TestUpdatelocalentries/Group_file_with_empty_line_is_ignored.group
@@ -0,0 +1,7 @@
+localgroup1:x:41:myuser
+localgroup2:x:42:
+
+localgroup3:x:43:myuser
+localgroup4:x:44:
+cloudgroup1:x:9998:
+cloudgroup2:x:9999:
diff --git a/internal/users/localentries/testdata/golden/TestUpdatelocalentries/Group_file_with_empty_line_is_ignored.group.backup b/internal/users/localentries/testdata/golden/TestUpdatelocalentries/Group_file_with_empty_line_is_ignored.group.backup
new file mode 100644
index 0000000000..672fe3e741
--- /dev/null
+++ b/internal/users/localentries/testdata/golden/TestUpdatelocalentries/Group_file_with_empty_line_is_ignored.group.backup
@@ -0,0 +1,7 @@
+localgroup1:x:41:
+localgroup2:x:42:
+
+localgroup3:x:43:
+localgroup4:x:44:
+cloudgroup1:x:9998:
+cloudgroup2:x:9999:
diff --git a/internal/users/localentries/testdata/golden/TestUpdatelocalentries/Insert_new_user_in_existing_files_with_multiple_other_users_in_our_group b/internal/users/localentries/testdata/golden/TestUpdatelocalentries/Insert_new_user_in_existing_files_with_multiple_other_users_in_our_group
deleted file mode 100644
index 48073e4afb..0000000000
--- a/internal/users/localentries/testdata/golden/TestUpdatelocalentries/Insert_new_user_in_existing_files_with_multiple_other_users_in_our_group
+++ /dev/null
@@ -1,2 +0,0 @@
---add myuser localgroup1
---add myuser localgroup3
\ No newline at end of file
diff --git a/internal/users/localentries/testdata/golden/TestUpdatelocalentries/Insert_new_user_in_existing_files_with_multiple_other_users_in_our_group.group b/internal/users/localentries/testdata/golden/TestUpdatelocalentries/Insert_new_user_in_existing_files_with_multiple_other_users_in_our_group.group
new file mode 100644
index 0000000000..8ac662bee9
--- /dev/null
+++ b/internal/users/localentries/testdata/golden/TestUpdatelocalentries/Insert_new_user_in_existing_files_with_multiple_other_users_in_our_group.group
@@ -0,0 +1,6 @@
+localgroup1:x:41:otheruser,otheruser2,myuser
+localgroup2:x:42:otheruser2
+localgroup3:x:43:otheruser,myuser
+localgroup4:x:44:otheruser2
+cloudgroup1:x:9998:otheruser3
+cloudgroup2:x:9999:otheruser4
diff --git a/internal/users/localentries/testdata/golden/TestUpdatelocalentries/Insert_new_user_in_existing_files_with_multiple_other_users_in_our_group.group.backup b/internal/users/localentries/testdata/golden/TestUpdatelocalentries/Insert_new_user_in_existing_files_with_multiple_other_users_in_our_group.group.backup
new file mode 100644
index 0000000000..57701809de
--- /dev/null
+++ b/internal/users/localentries/testdata/golden/TestUpdatelocalentries/Insert_new_user_in_existing_files_with_multiple_other_users_in_our_group.group.backup
@@ -0,0 +1,6 @@
+localgroup1:x:41:otheruser,otheruser2
+localgroup2:x:42:otheruser2
+localgroup3:x:43:otheruser
+localgroup4:x:44:otheruser2
+cloudgroup1:x:9998:otheruser3
+cloudgroup2:x:9999:otheruser4
diff --git a/internal/users/localentries/testdata/golden/TestUpdatelocalentries/Insert_new_user_in_existing_files_with_no_users_in_our_group b/internal/users/localentries/testdata/golden/TestUpdatelocalentries/Insert_new_user_in_existing_files_with_no_users_in_our_group
deleted file mode 100644
index 48073e4afb..0000000000
--- a/internal/users/localentries/testdata/golden/TestUpdatelocalentries/Insert_new_user_in_existing_files_with_no_users_in_our_group
+++ /dev/null
@@ -1,2 +0,0 @@
---add myuser localgroup1
---add myuser localgroup3
\ No newline at end of file
diff --git a/internal/users/localentries/testdata/golden/TestUpdatelocalentries/Insert_new_user_in_existing_files_with_no_users_in_our_group.group b/internal/users/localentries/testdata/golden/TestUpdatelocalentries/Insert_new_user_in_existing_files_with_no_users_in_our_group.group
new file mode 100644
index 0000000000..3e52a350bf
--- /dev/null
+++ b/internal/users/localentries/testdata/golden/TestUpdatelocalentries/Insert_new_user_in_existing_files_with_no_users_in_our_group.group
@@ -0,0 +1,6 @@
+localgroup1:x:41:myuser
+localgroup2:x:42:otheruser
+localgroup3:x:43:myuser
+localgroup4:x:44:otheruser2
+cloudgroup1:x:9998:otheruser3
+cloudgroup2:x:9999:otheruser4
diff --git a/internal/users/localentries/testdata/golden/TestUpdatelocalentries/Insert_new_user_in_existing_files_with_no_users_in_our_group.group.backup b/internal/users/localentries/testdata/golden/TestUpdatelocalentries/Insert_new_user_in_existing_files_with_no_users_in_our_group.group.backup
new file mode 100644
index 0000000000..f298aac70d
--- /dev/null
+++ b/internal/users/localentries/testdata/golden/TestUpdatelocalentries/Insert_new_user_in_existing_files_with_no_users_in_our_group.group.backup
@@ -0,0 +1,6 @@
+localgroup1:x:41:
+localgroup2:x:42:otheruser
+localgroup3:x:43:
+localgroup4:x:44:otheruser2
+cloudgroup1:x:9998:otheruser3
+cloudgroup2:x:9999:otheruser4
diff --git a/internal/users/localentries/testdata/golden/TestUpdatelocalentries/Insert_new_user_in_existing_files_with_other_users_in_our_group b/internal/users/localentries/testdata/golden/TestUpdatelocalentries/Insert_new_user_in_existing_files_with_other_users_in_our_group
deleted file mode 100644
index 48073e4afb..0000000000
--- a/internal/users/localentries/testdata/golden/TestUpdatelocalentries/Insert_new_user_in_existing_files_with_other_users_in_our_group
+++ /dev/null
@@ -1,2 +0,0 @@
---add myuser localgroup1
---add myuser localgroup3
\ No newline at end of file
diff --git a/internal/users/localentries/testdata/golden/TestUpdatelocalentries/Insert_new_user_in_existing_files_with_other_users_in_our_group.group b/internal/users/localentries/testdata/golden/TestUpdatelocalentries/Insert_new_user_in_existing_files_with_other_users_in_our_group.group
new file mode 100644
index 0000000000..41ec5168d2
--- /dev/null
+++ b/internal/users/localentries/testdata/golden/TestUpdatelocalentries/Insert_new_user_in_existing_files_with_other_users_in_our_group.group
@@ -0,0 +1,6 @@
+localgroup1:x:41:otheruser,myuser
+localgroup2:x:42:otheruser2
+localgroup3:x:43:otheruser,myuser
+localgroup4:x:44:otheruser2
+cloudgroup1:x:9998:otheruser3
+cloudgroup2:x:9999:otheruser4
diff --git a/internal/users/localentries/testdata/golden/TestUpdatelocalentries/Insert_new_user_in_existing_files_with_other_users_in_our_group.group.backup b/internal/users/localentries/testdata/golden/TestUpdatelocalentries/Insert_new_user_in_existing_files_with_other_users_in_our_group.group.backup
new file mode 100644
index 0000000000..821230a903
--- /dev/null
+++ b/internal/users/localentries/testdata/golden/TestUpdatelocalentries/Insert_new_user_in_existing_files_with_other_users_in_our_group.group.backup
@@ -0,0 +1,6 @@
+localgroup1:x:41:otheruser
+localgroup2:x:42:otheruser2
+localgroup3:x:43:otheruser
+localgroup4:x:44:otheruser2
+cloudgroup1:x:9998:otheruser3
+cloudgroup2:x:9999:otheruser4
diff --git a/internal/users/localentries/testdata/golden/TestUpdatelocalentries/Insert_new_user_when_no_users_in_any_group b/internal/users/localentries/testdata/golden/TestUpdatelocalentries/Insert_new_user_when_no_users_in_any_group
deleted file mode 100644
index 48073e4afb..0000000000
--- a/internal/users/localentries/testdata/golden/TestUpdatelocalentries/Insert_new_user_when_no_users_in_any_group
+++ /dev/null
@@ -1,2 +0,0 @@
---add myuser localgroup1
---add myuser localgroup3
\ No newline at end of file
diff --git a/internal/users/localentries/testdata/golden/TestUpdatelocalentries/Insert_new_user_when_no_users_in_any_group.group b/internal/users/localentries/testdata/golden/TestUpdatelocalentries/Insert_new_user_when_no_users_in_any_group.group
new file mode 100644
index 0000000000..fc7dc2c253
--- /dev/null
+++ b/internal/users/localentries/testdata/golden/TestUpdatelocalentries/Insert_new_user_when_no_users_in_any_group.group
@@ -0,0 +1,6 @@
+localgroup1:x:41:myuser
+localgroup2:x:42:
+localgroup3:x:43:myuser
+localgroup4:x:44:
+cloudgroup1:x:9998:
+cloudgroup2:x:9999:
diff --git a/internal/users/localentries/testdata/golden/TestUpdatelocalentries/Insert_new_user_when_no_users_in_any_group.group.backup b/internal/users/localentries/testdata/golden/TestUpdatelocalentries/Insert_new_user_when_no_users_in_any_group.group.backup
new file mode 100644
index 0000000000..d6667e9e66
--- /dev/null
+++ b/internal/users/localentries/testdata/golden/TestUpdatelocalentries/Insert_new_user_when_no_users_in_any_group.group.backup
@@ -0,0 +1,6 @@
+localgroup1:x:41:
+localgroup2:x:42:
+localgroup3:x:43:
+localgroup4:x:44:
+cloudgroup1:x:9998:
+cloudgroup2:x:9999:
diff --git a/internal/users/localentries/testdata/golden/TestUpdatelocalentries/Insert_user_in_the_only_local_group_when_not_present b/internal/users/localentries/testdata/golden/TestUpdatelocalentries/Insert_user_in_the_only_local_group_when_not_present
deleted file mode 100644
index 80dd17cde2..0000000000
--- a/internal/users/localentries/testdata/golden/TestUpdatelocalentries/Insert_user_in_the_only_local_group_when_not_present
+++ /dev/null
@@ -1 +0,0 @@
---add myuser localgroup3
\ No newline at end of file
diff --git a/internal/users/localentries/testdata/golden/TestUpdatelocalentries/Insert_user_in_the_only_local_group_when_not_present.group b/internal/users/localentries/testdata/golden/TestUpdatelocalentries/Insert_user_in_the_only_local_group_when_not_present.group
new file mode 100644
index 0000000000..3e52a350bf
--- /dev/null
+++ b/internal/users/localentries/testdata/golden/TestUpdatelocalentries/Insert_user_in_the_only_local_group_when_not_present.group
@@ -0,0 +1,6 @@
+localgroup1:x:41:myuser
+localgroup2:x:42:otheruser
+localgroup3:x:43:myuser
+localgroup4:x:44:otheruser2
+cloudgroup1:x:9998:otheruser3
+cloudgroup2:x:9999:otheruser4
diff --git a/internal/users/localentries/testdata/golden/TestUpdatelocalentries/Insert_user_in_the_only_local_group_when_not_present.group.backup b/internal/users/localentries/testdata/golden/TestUpdatelocalentries/Insert_user_in_the_only_local_group_when_not_present.group.backup
new file mode 100644
index 0000000000..b0f6ea9cf0
--- /dev/null
+++ b/internal/users/localentries/testdata/golden/TestUpdatelocalentries/Insert_user_in_the_only_local_group_when_not_present.group.backup
@@ -0,0 +1,6 @@
+localgroup1:x:41:myuser
+localgroup2:x:42:otheruser
+localgroup3:x:43:
+localgroup4:x:44:otheruser2
+cloudgroup1:x:9998:otheruser3
+cloudgroup2:x:9999:otheruser4
diff --git a/internal/users/localentries/testdata/golden/TestUpdatelocalentries/Insert_user_in_the_only_local_group_when_not_present_even_with_multiple b/internal/users/localentries/testdata/golden/TestUpdatelocalentries/Insert_user_in_the_only_local_group_when_not_present_even_with_multiple
deleted file mode 100644
index 80dd17cde2..0000000000
--- a/internal/users/localentries/testdata/golden/TestUpdatelocalentries/Insert_user_in_the_only_local_group_when_not_present_even_with_multiple
+++ /dev/null
@@ -1 +0,0 @@
---add myuser localgroup3
\ No newline at end of file
diff --git a/internal/users/localentries/testdata/golden/TestUpdatelocalentries/Insert_user_in_the_only_local_group_when_not_present_even_with_multiple.group b/internal/users/localentries/testdata/golden/TestUpdatelocalentries/Insert_user_in_the_only_local_group_when_not_present_even_with_multiple.group
new file mode 100644
index 0000000000..b69e305ea3
--- /dev/null
+++ b/internal/users/localentries/testdata/golden/TestUpdatelocalentries/Insert_user_in_the_only_local_group_when_not_present_even_with_multiple.group
@@ -0,0 +1,6 @@
+localgroup1:x:41:otheruser,myuser,otheruser2
+localgroup2:x:42:otheruser2
+localgroup3:x:43:otheruser,myuser
+localgroup4:x:44:otheruser2
+cloudgroup1:x:9998:otheruser3
+cloudgroup2:x:9999:otheruser4
diff --git a/internal/users/localentries/testdata/golden/TestUpdatelocalentries/Insert_user_in_the_only_local_group_when_not_present_even_with_multiple.group.backup b/internal/users/localentries/testdata/golden/TestUpdatelocalentries/Insert_user_in_the_only_local_group_when_not_present_even_with_multiple.group.backup
new file mode 100644
index 0000000000..800c919baa
--- /dev/null
+++ b/internal/users/localentries/testdata/golden/TestUpdatelocalentries/Insert_user_in_the_only_local_group_when_not_present_even_with_multiple.group.backup
@@ -0,0 +1,6 @@
+localgroup1:x:41:otheruser,myuser,otheruser2
+localgroup2:x:42:otheruser2
+localgroup3:x:43:otheruser
+localgroup4:x:44:otheruser2
+cloudgroup1:x:9998:otheruser3
+cloudgroup2:x:9999:otheruser4
diff --git a/internal/users/localentries/testdata/golden/TestUpdatelocalentries/Missing_group_is_ignored b/internal/users/localentries/testdata/golden/TestUpdatelocalentries/Missing_group_is_ignored
deleted file mode 100644
index 0dd812dc84..0000000000
--- a/internal/users/localentries/testdata/golden/TestUpdatelocalentries/Missing_group_is_ignored
+++ /dev/null
@@ -1 +0,0 @@
---add myuser localgroup1
\ No newline at end of file
diff --git a/internal/users/localentries/testdata/golden/TestUpdatelocalentries/Missing_group_is_ignored.group b/internal/users/localentries/testdata/golden/TestUpdatelocalentries/Missing_group_is_ignored.group
new file mode 100644
index 0000000000..02e66bd3bd
--- /dev/null
+++ b/internal/users/localentries/testdata/golden/TestUpdatelocalentries/Missing_group_is_ignored.group
@@ -0,0 +1,5 @@
+localgroup1:x:41:myuser
+localgroup2:x:42:
+localgroup4:x:44:
+cloudgroup1:x:9998:
+cloudgroup2:x:9999:
diff --git a/internal/users/localentries/testdata/golden/TestUpdatelocalentries/Missing_group_is_ignored.group.backup b/internal/users/localentries/testdata/golden/TestUpdatelocalentries/Missing_group_is_ignored.group.backup
new file mode 100644
index 0000000000..4c1e2343c5
--- /dev/null
+++ b/internal/users/localentries/testdata/golden/TestUpdatelocalentries/Missing_group_is_ignored.group.backup
@@ -0,0 +1,5 @@
+localgroup1:x:41:
+localgroup2:x:42:
+localgroup4:x:44:
+cloudgroup1:x:9998:
+cloudgroup2:x:9999:
diff --git a/internal/users/localentries/testdata/golden/TestUpdatelocalentries/User_is_added_to_group_they_were_added_to_before b/internal/users/localentries/testdata/golden/TestUpdatelocalentries/User_is_added_to_group_they_were_added_to_before
deleted file mode 100644
index 0dd812dc84..0000000000
--- a/internal/users/localentries/testdata/golden/TestUpdatelocalentries/User_is_added_to_group_they_were_added_to_before
+++ /dev/null
@@ -1 +0,0 @@
---add myuser localgroup1
\ No newline at end of file
diff --git a/internal/users/localentries/testdata/golden/TestUpdatelocalentries/User_is_added_to_group_they_were_added_to_before.group b/internal/users/localentries/testdata/golden/TestUpdatelocalentries/User_is_added_to_group_they_were_added_to_before.group
new file mode 100644
index 0000000000..fd572da90f
--- /dev/null
+++ b/internal/users/localentries/testdata/golden/TestUpdatelocalentries/User_is_added_to_group_they_were_added_to_before.group
@@ -0,0 +1,6 @@
+localgroup1:x:41:myuser
+localgroup2:x:42:
+localgroup3:x:43:
+localgroup4:x:44:
+cloudgroup1:x:9998:
+cloudgroup2:x:9999:
diff --git a/internal/users/localentries/testdata/golden/TestUpdatelocalentries/User_is_added_to_group_they_were_added_to_before.group.backup b/internal/users/localentries/testdata/golden/TestUpdatelocalentries/User_is_added_to_group_they_were_added_to_before.group.backup
new file mode 100644
index 0000000000..d6667e9e66
--- /dev/null
+++ b/internal/users/localentries/testdata/golden/TestUpdatelocalentries/User_is_added_to_group_they_were_added_to_before.group.backup
@@ -0,0 +1,6 @@
+localgroup1:x:41:
+localgroup2:x:42:
+localgroup3:x:43:
+localgroup4:x:44:
+cloudgroup1:x:9998:
+cloudgroup2:x:9999:
diff --git a/internal/users/localentries/testdata/golden/TestUpdatelocalentries/User_is_removed_from_old_groups_but_not_from_other_groups b/internal/users/localentries/testdata/golden/TestUpdatelocalentries/User_is_removed_from_old_groups_but_not_from_other_groups
deleted file mode 100644
index e49d0784fd..0000000000
--- a/internal/users/localentries/testdata/golden/TestUpdatelocalentries/User_is_removed_from_old_groups_but_not_from_other_groups
+++ /dev/null
@@ -1 +0,0 @@
---delete myuser localgroup3
\ No newline at end of file
diff --git a/internal/users/localentries/testdata/golden/TestUpdatelocalentries/User_is_removed_from_old_groups_but_not_from_other_groups.group b/internal/users/localentries/testdata/golden/TestUpdatelocalentries/User_is_removed_from_old_groups_but_not_from_other_groups.group
new file mode 100644
index 0000000000..b0f6ea9cf0
--- /dev/null
+++ b/internal/users/localentries/testdata/golden/TestUpdatelocalentries/User_is_removed_from_old_groups_but_not_from_other_groups.group
@@ -0,0 +1,6 @@
+localgroup1:x:41:myuser
+localgroup2:x:42:otheruser
+localgroup3:x:43:
+localgroup4:x:44:otheruser2
+cloudgroup1:x:9998:otheruser3
+cloudgroup2:x:9999:otheruser4
diff --git a/internal/users/localentries/testdata/golden/TestUpdatelocalentries/User_is_removed_from_old_groups_but_not_from_other_groups.group.backup b/internal/users/localentries/testdata/golden/TestUpdatelocalentries/User_is_removed_from_old_groups_but_not_from_other_groups.group.backup
new file mode 100644
index 0000000000..3e52a350bf
--- /dev/null
+++ b/internal/users/localentries/testdata/golden/TestUpdatelocalentries/User_is_removed_from_old_groups_but_not_from_other_groups.group.backup
@@ -0,0 +1,6 @@
+localgroup1:x:41:myuser
+localgroup2:x:42:otheruser
+localgroup3:x:43:myuser
+localgroup4:x:44:otheruser2
+cloudgroup1:x:9998:otheruser3
+cloudgroup2:x:9999:otheruser4
diff --git a/internal/users/localentries/testdata/golden/TestUpdatelocalentries/Warn_when_groups_file_has_invalid_gid.group b/internal/users/localentries/testdata/golden/TestUpdatelocalentries/Warn_when_groups_file_has_invalid_gid.group
new file mode 100644
index 0000000000..d8ec794f3d
--- /dev/null
+++ b/internal/users/localentries/testdata/golden/TestUpdatelocalentries/Warn_when_groups_file_has_invalid_gid.group
@@ -0,0 +1,6 @@
+localgroup1:x:41:otheruser,myuser
+localgroup2:x:42:otheruser2
+localgroup3:x:gid:invalidGID
+localgroup4:x:44:otheruser2
+cloudgroup1:x:9998:otheruser3
+cloudgroup2:x:9999:otheruser4
diff --git a/internal/users/localentries/testdata/golden/TestUpdatelocalentries/Warn_when_groups_file_has_invalid_gid.group.backup b/internal/users/localentries/testdata/golden/TestUpdatelocalentries/Warn_when_groups_file_has_invalid_gid.group.backup
new file mode 100644
index 0000000000..5a55ebf584
--- /dev/null
+++ b/internal/users/localentries/testdata/golden/TestUpdatelocalentries/Warn_when_groups_file_has_invalid_gid.group.backup
@@ -0,0 +1,6 @@
+localgroup1:x:41:otheruser
+localgroup2:x:42:otheruser2
+localgroup3:x:gid:invalidGID
+localgroup4:x:44:otheruser2
+cloudgroup1:x:9998:otheruser3
+cloudgroup2:x:9999:otheruser4
diff --git a/internal/users/localentries/testdata/malformed_file_duplicated.group b/internal/users/localentries/testdata/malformed_file_duplicated.group
new file mode 100644
index 0000000000..df29880934
--- /dev/null
+++ b/internal/users/localentries/testdata/malformed_file_duplicated.group
@@ -0,0 +1,7 @@
+localgroup1:x:41:otheruser
+localgroup2:x:42:otheruser2
+localgroup3:x:43:invalidGID
+localgroup4:x:44:otheruser2
+cloudgroup1:x:9998:otheruser3
+cloudgroup2:x:9999:otheruser4
+localgroup4:x:123:again
diff --git a/internal/users/localentries/testdata/malformed_file_extra_field.group b/internal/users/localentries/testdata/malformed_file_extra_field.group
new file mode 100644
index 0000000000..3de5534245
--- /dev/null
+++ b/internal/users/localentries/testdata/malformed_file_extra_field.group
@@ -0,0 +1,6 @@
+localgroup1:x:41:otheruser
+localgroup2:x:42:otheruser2
+localgroup3:x:43:otheruser3
+localgroup4:x:44:otheruser2:extrafield
+cloudgroup1:x:9998:otheruser3
+cloudgroup2:x:9999:otheruser4
diff --git a/internal/users/localentries/testdata/malformed_file_invalid_entries_length.group b/internal/users/localentries/testdata/malformed_file_invalid_entries_length.group
new file mode 100644
index 0000000000..f60158b440
--- /dev/null
+++ b/internal/users/localentries/testdata/malformed_file_invalid_entries_length.group
@@ -0,0 +1,9 @@
+localgroup1
+localgroup2:
+localgroup3:x
+localgroup4:x:44
+localgroup5:x:45:
+localgroup6:x:46:
+localgroup7:x:47:
+localgroup8:x:48:
+#localgroup8:x:48:with-comment
diff --git a/internal/users/localentries/testdata/malformed_file_invalid_gid.group b/internal/users/localentries/testdata/malformed_file_invalid_gid.group
new file mode 100644
index 0000000000..5a55ebf584
--- /dev/null
+++ b/internal/users/localentries/testdata/malformed_file_invalid_gid.group
@@ -0,0 +1,6 @@
+localgroup1:x:41:otheruser
+localgroup2:x:42:otheruser2
+localgroup3:x:gid:invalidGID
+localgroup4:x:44:otheruser2
+cloudgroup1:x:9998:otheruser3
+cloudgroup2:x:9999:otheruser4
diff --git a/internal/users/localentries/testdata/malformed_file.group b/internal/users/localentries/testdata/malformed_file_missing_field.group
similarity index 100%
rename from internal/users/localentries/testdata/malformed_file.group
rename to internal/users/localentries/testdata/malformed_file_missing_field.group
diff --git a/internal/users/localentries/testdata/malformed_file_no_group_name.group b/internal/users/localentries/testdata/malformed_file_no_group_name.group
new file mode 100644
index 0000000000..1576cf04aa
--- /dev/null
+++ b/internal/users/localentries/testdata/malformed_file_no_group_name.group
@@ -0,0 +1,6 @@
+localgroup1:x:41:otheruser
+localgroup2:x:42:otheruser2
+:passwd-for-group-with-no-name:45:
+localgroup4:x:44:otheruser2
+cloudgroup1:x:9998:otheruser3
+cloudgroup2:x:9999:otheruser4
diff --git a/internal/users/localentries/testutils.go b/internal/users/localentries/testutils.go
index 0ef7edee09..56edcaa157 100644
--- a/internal/users/localentries/testutils.go
+++ b/internal/users/localentries/testutils.go
@@ -1,9 +1,23 @@
 package localentries
 
-import "github.com/ubuntu/authd/internal/testsdetection"
+import (
+	"github.com/canonical/authd/internal/testsdetection"
+)
 
 var originalDefaultOptions = defaultOptions
 
+const (
+	// Z_ForTests_GroupFilePathEnv is the env variable to set the group file path during
+	// integration tests.
+	// nolint:revive,nolintlint // We want to use underscores in the function name here.
+	Z_ForTests_GroupFilePathEnv = "AUTHD_INTEGRATIONTESTS_GROUP_FILE_PATH"
+
+	// Z_ForTests_GroupFileOutputPathEnv is the env variable to set the group file output
+	// path during integration tests.
+	// nolint:revive,nolintlint // We want to use underscores in the function name here.
+	Z_ForTests_GroupFileOutputPathEnv = "AUTHD_INTEGRATIONTESTS_GROUP_OUTPUT_FILE_PATH"
+)
+
 // Z_ForTests_RestoreDefaultOptions restores the defaultOptions to their original values.
 //
 // nolint:revive,nolintlint // We want to use underscores in the function name here.
@@ -18,19 +32,9 @@ func Z_ForTests_RestoreDefaultOptions() {
 // Call Z_ForTests_RestoreDefaultOptions to restore the original value.
 //
 // nolint:revive,nolintlint // We want to use underscores in the function name here.
-func Z_ForTests_SetGroupPath(groupPath string) {
-	testsdetection.MustBeTesting()
-
-	defaultOptions.groupPath = groupPath
-}
-
-// Z_ForTests_SetGpasswdCmd sets the gpasswdCmd for the defaultOptions.
-// Tests using this can't be run in parallel.
-// Call Z_ForTests_RestoreDefaultOptions to restore the original value.
-//
-// nolint:revive,nolintlint // We want to use underscores in the function name here.
-func Z_ForTests_SetGpasswdCmd(gpasswdCmd []string) {
+func Z_ForTests_SetGroupPath(inputGroupPath, outputGroupPath string) {
 	testsdetection.MustBeTesting()
 
-	defaultOptions.gpasswdCmd = gpasswdCmd
+	defaultOptions.inputGroupPath = inputGroupPath
+	defaultOptions.outputGroupPath = outputGroupPath
 }
diff --git a/internal/users/localentries/testutils/gpasswd.go b/internal/users/localentries/testutils/gpasswd.go
deleted file mode 100644
index 292ebba35d..0000000000
--- a/internal/users/localentries/testutils/gpasswd.go
+++ /dev/null
@@ -1,147 +0,0 @@
-// Package localgrouptestutils export users test functionalities used by other packages to change cmdline and group file.
-package localgrouptestutils
-
-import (
-	"fmt"
-	"os"
-	"path/filepath"
-	"slices"
-	"strings"
-	"testing"
-
-	"github.com/stretchr/testify/require"
-	"github.com/ubuntu/authd/internal/testutils/golden"
-	"github.com/ubuntu/authd/internal/users/localentries"
-)
-
-// Mockgpasswd is the gpasswd mock.
-func Mockgpasswd(_ *testing.T) {
-	if os.Getenv("GO_WANT_HELPER_PROCESS") == "" {
-		return
-	}
-
-	args := os.Args
-	for len(args) > 0 {
-		if args[0] != "--" {
-			args = args[1:]
-			continue
-		}
-		args = args[1:]
-		break
-	}
-	groupsFilePath, outputFilePath := args[0], args[1]
-
-	// args are now the real args passed by authd.
-	args = args[2:]
-
-	d, err := os.ReadFile(groupsFilePath)
-	if err != nil {
-		fmt.Fprintf(os.Stderr, "Mock: error reading group file: %v", err)
-		os.Exit(1)
-	}
-
-	// Error if the group is not in the groupfile (we don’t handle substrings in the mock)
-	group := args[len(args)-1]
-	if !strings.Contains(string(d), group+":") {
-		fmt.Fprintf(os.Stderr, "Error: %s in not in the group file", group)
-		os.Exit(3)
-	}
-
-	// Other error
-	if slices.Contains(args, "gpasswdfail") {
-		fmt.Fprint(os.Stderr, "Error requested in mock")
-		os.Exit(1)
-	}
-
-	f, err := os.OpenFile(outputFilePath, os.O_WRONLY|os.O_APPEND|os.O_CREATE, 0600)
-	if err != nil {
-		fmt.Fprintf(os.Stderr, "Mock: error opening file in append mode: %v", err)
-		os.Exit(1)
-	}
-	defer f.Close()
-
-	if _, err := f.Write([]byte(strings.Join(args, " ") + "\n")); err != nil {
-		fmt.Fprintf(os.Stderr, "Mock: error while writing in file: %v", err)
-		f.Close()
-		os.Exit(1)
-	}
-}
-
-// SetupGPasswdMock setup the gpasswd mock and return the path to the file where the commands will be written.
-//
-// Tests that require this can not be run in parallel.
-func SetupGPasswdMock(t *testing.T, groupsFilePath string) string {
-	t.Helper()
-
-	t.Cleanup(localentries.Z_ForTests_RestoreDefaultOptions)
-
-	localentries.Z_ForTests_SetGroupPath(groupsFilePath)
-
-	destCmdsFile := filepath.Join(t.TempDir(), "gpasswd.output")
-	localentries.Z_ForTests_SetGpasswdCmd([]string{"env", "GO_WANT_HELPER_PROCESS=1",
-		os.Args[0], "-test.run=TestMockgpasswd", "--",
-		groupsFilePath, destCmdsFile,
-	})
-
-	return destCmdsFile
-}
-
-// AuthdIntegrationTestsEnvWithGpasswdMock returns the environment to pass to the authd daemon to use the gpasswd
-// mock. In order to enable it, the authd binary must be built with the tag integrationtests.
-// You need to install a TestMockgpasswd (generally calling Mockgpasswd) in your integration tests files.
-func AuthdIntegrationTestsEnvWithGpasswdMock(t *testing.T, outputFilePath, groupsFilePath string) []string {
-	t.Helper()
-
-	gpasswdArgs := append([]string{
-		"env", "GO_WANT_HELPER_PROCESS=1"},
-		os.Args...)
-	gpasswdArgs = append(gpasswdArgs,
-		"-test.run=TestMockgpasswd", "--",
-		groupsFilePath, outputFilePath,
-	)
-
-	return []string{
-		"AUTHD_INTEGRATIONTESTS_GPASSWD_ARGS=" + strings.Join(gpasswdArgs, " "),
-		"AUTHD_INTEGRATIONTESTS_GPASSWD_GRP_FILE_PATH=" + groupsFilePath,
-	}
-}
-
-// RequireGPasswdOutput compare the output of gpasswd with the golden file.
-func RequireGPasswdOutput(t *testing.T, destCmdsFile, goldenGpasswdPath string) {
-	t.Helper()
-
-	// TODO: this should be extracted in testutils, but still allow post-treatement of file like sorting.
-	referenceFilePath := goldenGpasswdPath
-	if golden.UpdateEnabled() {
-		// The file may already not exists.
-		_ = os.Remove(goldenGpasswdPath)
-		referenceFilePath = destCmdsFile
-	}
-
-	var shouldExists bool
-	if _, err := os.Stat(referenceFilePath); err == nil {
-		shouldExists = true
-	}
-	if !shouldExists {
-		require.NoFileExists(t, destCmdsFile, "UpdateLocalGroups should not call gpasswd by did")
-		return
-	}
-
-	gotGPasswd := idempotentGPasswdOutput(t, destCmdsFile)
-	golden.CheckOrUpdate(t, gotGPasswd, golden.WithPath(goldenGpasswdPath))
-}
-
-// idempotentGPasswdOutput sort and trim spaces around mock gpasswd output.
-func idempotentGPasswdOutput(t *testing.T, cmdsFilePath string) string {
-	t.Helper()
-
-	d, err := os.ReadFile(cmdsFilePath)
-	require.NoError(t, err, "Teardown: could not read dest trace file")
-
-	// need to sort out all operations
-	ops := strings.Split(string(d), "\n")
-	slices.Sort(ops)
-	content := strings.TrimSpace(strings.Join(ops, "\n"))
-
-	return content
-}
diff --git a/internal/users/localentries/testutils/localgroups.go b/internal/users/localentries/testutils/localgroups.go
index b63cd27e2d..063fa2fa86 100644
--- a/internal/users/localentries/testutils/localgroups.go
+++ b/internal/users/localentries/testutils/localgroups.go
@@ -1,14 +1,16 @@
 // Package localgrouptestutils export users test functionalities used by other packages to change cmdline and group file.
 package localgrouptestutils
 
-//nolint:gci // We import unsafe as it is needed for go:linkname, but the nolint comment confuses gofmt and it adds
-// a blank space between the imports, which creates problems with gci so we need to ignore it.
 import (
+	"os"
+	"path/filepath"
+	"testing"
 
-	//nolint:revive,nolintlint // needed for go:linkname, but only used in tests. nolintlint as false positive then.
-	_ "unsafe"
-
-	"github.com/ubuntu/authd/internal/testsdetection"
+	"github.com/canonical/authd/internal/fileutils"
+	"github.com/canonical/authd/internal/testsdetection"
+	"github.com/canonical/authd/internal/testutils/golden"
+	"github.com/canonical/authd/internal/users/localentries"
+	"github.com/stretchr/testify/require"
 )
 
 func init() {
@@ -17,11 +19,8 @@ func init() {
 }
 
 var (
-	//go:linkname defaultOptions github.com/ubuntu/authd/internal/users/localentries.defaultOptions
 	defaultOptions struct {
-		groupPath    string
-		gpasswdCmd   []string
-		getUsersFunc func() []string
+		groupPath string
 	}
 )
 
@@ -31,8 +30,66 @@ func SetGroupPath(groupPath string) {
 	defaultOptions.groupPath = groupPath
 }
 
-// SetGpasswdCmd sets the gpasswdCmd for the defaultOptions.
-// Tests using this can't be run in parallel.
-func SetGpasswdCmd(gpasswdCmd []string) {
-	defaultOptions.gpasswdCmd = gpasswdCmd
+// RequireGroupFile compare the output of the generated group file with the
+// golden file.
+func RequireGroupFile(t *testing.T, destGroupFile, goldenGroupPath string) {
+	t.Helper()
+
+	destGroupBackupFile := destGroupFile + "-"
+	groupSuffix := ".group"
+	backupSuffix := groupSuffix + ".backup"
+
+	// TODO: this should be extracted in testutils, but still allow post-treatement of file like sorting.
+	referenceFilePath := goldenGroupPath + groupSuffix
+	if golden.UpdateEnabled() {
+		// The file may already not exists.
+		_ = os.Remove(goldenGroupPath + groupSuffix)
+		_ = os.Remove(goldenGroupPath + backupSuffix)
+		referenceFilePath = destGroupFile
+	}
+
+	var shouldExists bool
+	if _, err := os.Stat(referenceFilePath); err == nil {
+		shouldExists = true
+	}
+	if !shouldExists {
+		require.NoFileExists(t, destGroupFile, "UpdateLocalGroups should not update the group files, but it did")
+		require.NoFileExists(t, destGroupBackupFile, "UpdateLocalGroups should not update the group file, but it did")
+		return
+	}
+
+	gotGroups, err := os.ReadFile(destGroupFile)
+	require.NoError(t, err, "Teardown: could not read dest group file")
+
+	golden.CheckOrUpdate(t, string(gotGroups), golden.WithPath(goldenGroupPath),
+		golden.WithSuffix(groupSuffix))
+
+	gotGroupsBackup, err := os.ReadFile(destGroupBackupFile)
+	require.NoError(t, err, "Teardown: could not read dest group backup file")
+	golden.CheckOrUpdate(t, string(gotGroupsBackup), golden.WithPath(goldenGroupPath),
+		golden.WithSuffix(backupSuffix))
+}
+
+// SetupGroupMock setup the group mock and return the path to the file where the
+// output will be written.
+//
+// Tests that require this can not be run in parallel.
+func SetupGroupMock(t *testing.T, groupsFilePath string) string {
+	t.Helper()
+
+	testsdetection.MustBeTesting()
+
+	t.Cleanup(localentries.Z_ForTests_RestoreDefaultOptions)
+
+	var tempGroupFile string
+	if exists, _ := fileutils.FileExists(groupsFilePath); exists {
+		tempGroupFile = filepath.Join(t.TempDir(), filepath.Base(groupsFilePath))
+		err := fileutils.CopyFile(groupsFilePath, tempGroupFile)
+		require.NoError(t, err, "failed to copy group file for testing")
+	}
+
+	destGroupFile := filepath.Join(t.TempDir(), "group")
+	localentries.Z_ForTests_SetGroupPath(tempGroupFile, destGroupFile)
+
+	return destGroupFile
 }
diff --git a/internal/users/locking/locking.go b/internal/users/locking/locking.go
index 70873ace45..408c2704ce 100644
--- a/internal/users/locking/locking.go
+++ b/internal/users/locking/locking.go
@@ -16,14 +16,18 @@ import (
 var (
 	writeLockImpl   = writeLock
 	writeUnlockImpl = writeUnlock
+
+	// maxWait is the maximum wait time for a lock to happen.
+	// We mimic the libc behavior, in case we don't get SIGALRM'ed.
+	maxWait = 16 * time.Second
 )
 
 var (
 	// ErrLock is the error when locking the database fails.
-	ErrLock = errors.New("failed to lock the shadow password database")
+	ErrLock = errors.New("failed to lock the system's user database")
 
 	// ErrUnlock is the error when unlocking the database fails.
-	ErrUnlock = errors.New("failed to unlock the shadow password database")
+	ErrUnlock = errors.New("failed to unlock the system's user database")
 
 	// ErrLockTimeout is the error when unlocking the database fails because of timeout.
 	ErrLockTimeout = fmt.Errorf("%w: timeout", ErrLock)
@@ -38,6 +42,8 @@ var (
 // lock is already hold by this process.
 func WriteLock() error {
 	done := make(chan error)
+	writeLockImpl := writeLockImpl
+
 	go func() {
 		done <- writeLockImpl()
 	}()
@@ -47,7 +53,7 @@ func WriteLock() error {
 	// because alarms are handled by go runtime, so do it manually here by
 	// failing if "lock not obtained within 15 seconds" as per lckpwdf.3.
 	// Keep this in sync with what lckpwdf does, adding an extra second.
-	case <-time.After(16 * time.Second):
+	case <-time.After(maxWait):
 		return ErrLockTimeout
 	case err := <-done:
 		return err
diff --git a/internal/users/locking/locking_bwrap_test.go b/internal/users/locking/locking_bwrap_test.go
index 1687a6fa3c..ff90f17f74 100644
--- a/internal/users/locking/locking_bwrap_test.go
+++ b/internal/users/locking/locking_bwrap_test.go
@@ -1,24 +1,37 @@
-//go:build bubblewrap_test
-
 package userslocking_test
 
 import (
 	"context"
-	"math"
 	"os"
 	"os/exec"
 	"path/filepath"
 	"strings"
+	"sync"
 	"syscall"
 	"testing"
 	"time"
 
+	"github.com/canonical/authd/internal/testutils"
+	userslocking "github.com/canonical/authd/internal/users/locking"
 	"github.com/stretchr/testify/require"
-	"github.com/ubuntu/authd/internal/testutils"
-	userslocking "github.com/ubuntu/authd/internal/users/locking"
 )
 
+var tempDir string
+var compileLockerBinaryOnce sync.Once
+var lockerBinaryPath string
+
 func TestLockAndWriteUnlock(t *testing.T) {
+	t.Parallel()
+
+	if testing.Short() {
+		t.Skip("skipping test in short mode.")
+	}
+
+	if !testutils.RunningInBubblewrap() {
+		testutils.RunTestInBubbleWrap(t)
+		return
+	}
+
 	require.Zero(t, os.Geteuid(), "Not root")
 
 	groupFile := filepath.Join("/etc", "group")
@@ -66,6 +79,13 @@ func TestLockAndWriteUnlock(t *testing.T) {
 }
 
 func TestReadWhileLocked(t *testing.T) {
+	t.Parallel()
+
+	if !testutils.RunningInBubblewrap() {
+		testutils.RunTestInBubbleWrap(t)
+		return
+	}
+
 	require.Zero(t, os.Geteuid(), "Not root")
 
 	groupFile := filepath.Join("/etc", "group")
@@ -78,14 +98,28 @@ testgroup:x:1001:testuser`
 
 	err = userslocking.WriteLock()
 	require.NoError(t, err, "Locking once it is allowed")
-	t.Cleanup(func() { userslocking.WriteUnlock() })
+	t.Cleanup(func() {
+		err := userslocking.WriteUnlock()
+		require.NoError(t, err, "Unlocking should be allowed")
+	})
 
-	output, err := runCmd(t, "getent", "group")
+	output, err := runCmd(t, "getent", "group", "root", "testgroup")
 	require.NoError(t, err, "Reading should be allowed")
 	require.Equal(t, groupContents, output)
 }
 
 func TestLockAndLockAgainGroupFileOverridden(t *testing.T) {
+	t.Parallel()
+
+	if testing.Short() {
+		t.Skip("skipping test in short mode.")
+	}
+
+	if !testutils.RunningInBubblewrap() {
+		testutils.RunTestInBubbleWrap(t)
+		return
+	}
+
 	userslocking.Z_ForTests_OverrideLocking()
 	restoreFunc := userslocking.Z_ForTests_RestoreLocking
 	t.Cleanup(func() { restoreFunc() })
@@ -93,9 +127,6 @@ func TestLockAndLockAgainGroupFileOverridden(t *testing.T) {
 	err := userslocking.WriteLock()
 	require.NoError(t, err, "Locking once it is allowed")
 
-	err = userslocking.WriteLock()
-	require.ErrorIs(t, err, userslocking.ErrLock, "Locking again should not be allowed")
-
 	err = userslocking.WriteUnlock()
 	require.NoError(t, err, "Unlocking should be allowed")
 
@@ -112,7 +143,11 @@ func TestLockAndLockAgainGroupFileOverridden(t *testing.T) {
 
 	err = userslocking.WriteLock()
 	require.NoError(t, err, "Locking once it is allowed")
-	t.Cleanup(func() { userslocking.WriteUnlock() })
+	t.Cleanup(func() {
+		// Ignore the error here, as it's expected to return an error if the
+		// userslocking.WriteUnlock further below is called first.
+		_ = userslocking.WriteUnlock()
+	})
 
 	gPasswdExited := make(chan error)
 	go func() {
@@ -121,7 +156,7 @@ func TestLockAndLockAgainGroupFileOverridden(t *testing.T) {
 	}()
 
 	select {
-	case <-time.After(sleepDuration(3 * time.Second)):
+	case <-time.After(3 * time.Second):
 		// If we're time-outing: it's fine, it means we were locked!
 	case err := <-gPasswdExited:
 		require.ErrorIs(t, err, userslocking.ErrLock, "GPasswd should fail")
@@ -132,14 +167,41 @@ func TestLockAndLockAgainGroupFileOverridden(t *testing.T) {
 }
 
 func TestUnlockUnlockedOverridden(t *testing.T) {
-	userslocking.Z_ForTests_OverrideLocking()
-	t.Cleanup(userslocking.Z_ForTests_RestoreLocking)
+	t.Parallel()
+
+	if !testutils.RunningInBubblewrap() {
+		testutils.RunTestInBubbleWrap(t)
+		return
+	}
+
+	userslocking.Z_ForTests_OverrideLockingWithCleanup(t)
+
+	err := userslocking.WriteUnlock()
+	require.ErrorIs(t, err, userslocking.ErrUnlock, "Unlocking unlocked should not be allowed")
+}
+
+func TestUnlockUnlocked(t *testing.T) {
+	t.Parallel()
+
+	if !testutils.RunningInBubblewrap() {
+		testutils.RunTestInBubbleWrap(t)
+		return
+	}
+
+	require.Zero(t, os.Geteuid(), "Not root")
 
 	err := userslocking.WriteUnlock()
 	require.ErrorIs(t, err, userslocking.ErrUnlock, "Unlocking unlocked should not be allowed")
 }
 
 func TestLockAndLockAgainGroupFile(t *testing.T) {
+	t.Parallel()
+
+	if !testutils.RunningInBubblewrap() {
+		testutils.RunTestInBubbleWrap(t)
+		return
+	}
+
 	require.Zero(t, os.Geteuid(), "Not root")
 
 	err := userslocking.WriteLock()
@@ -152,14 +214,18 @@ func TestLockAndLockAgainGroupFile(t *testing.T) {
 	require.NoError(t, err, "Unlocking should be allowed")
 }
 
-func TestUnlockUnlocked(t *testing.T) {
-	require.Zero(t, os.Geteuid(), "Not root")
+func TestLockingLockedDatabase(t *testing.T) {
+	t.Parallel()
 
-	err := userslocking.WriteUnlock()
-	require.ErrorIs(t, err, userslocking.ErrUnlock, "Unlocking unlocked should not be allowed")
-}
+	if testing.Short() {
+		t.Skip("skipping test in short mode.")
+	}
+
+	if !testutils.RunningInBubblewrap() {
+		testInBubbleWrapWithLockerBinary(t)
+		return
+	}
 
-func TestLockingLockedDatabase(t *testing.T) {
 	require.Zero(t, os.Geteuid(), "Not root")
 
 	testLockerUtility := os.Getenv("AUTHD_TESTS_PASSWD_LOCKER_UTILITY")
@@ -173,26 +239,31 @@ func TestLockingLockedDatabase(t *testing.T) {
 	require.NoError(t, err, "Writing group file")
 
 	ctx, cancel := context.WithCancel(context.Background())
+	//nolint:gosec // G204 It's fine to pass variables to exec.Command here'
 	cmd := exec.CommandContext(ctx, testLockerUtility)
 	t.Logf("Running command: %s", cmd.Args)
 
+	err = cmd.Start()
+	require.NoError(t, err, "Setup: Locker utility should start")
+	lockerProcess := cmd.Process
+
 	lockerExited := make(chan error)
 	writeLockExited := make(chan error)
 	t.Cleanup(func() {
 		cancel()
-		syscall.Kill(cmd.Process.Pid, syscall.SIGKILL)
+		_ = syscall.Kill(lockerProcess.Pid, syscall.SIGKILL)
 		require.Error(t, <-lockerExited, "Stopping locking process")
 		require.NoError(t, <-writeLockExited, "Final locking")
 		require.NoError(t, userslocking.WriteUnlock(), "Final unlocking")
 	})
 
 	go func() {
-		lockerExited <- cmd.Run()
+		lockerExited <- cmd.Wait()
 	}()
 
 	select {
-	case <-time.After(sleepDuration(1 * time.Second)):
-		t.Cleanup(func() { cmd.Process.Kill() })
+	case <-time.After(1 * time.Second):
+		t.Cleanup(func() { _ = lockerProcess.Kill() })
 		// If we're time-outing: it's fine, it means the test-locker process is running
 	case err := <-lockerExited:
 		require.NoError(t, err, "test locker should not have failed")
@@ -205,7 +276,7 @@ func TestLockingLockedDatabase(t *testing.T) {
 	}()
 
 	select {
-	case <-time.After(sleepDuration(3 * time.Second)):
+	case <-time.After(3 * time.Second):
 		// If we're time-outing: it's fine, it means we were locked!
 	case err := <-gPasswdExited:
 		require.ErrorIs(t, err, userslocking.ErrLock, "GPasswd should fail")
@@ -216,7 +287,7 @@ func TestLockingLockedDatabase(t *testing.T) {
 	}()
 
 	select {
-	case <-time.After(sleepDuration(3 * time.Second)):
+	case <-time.After(1 * time.Second):
 		// If we're time-outing: it's fine, it means the test-locker process is
 		// still running and holding the lock.
 	case err := <-writeLockExited:
@@ -225,30 +296,47 @@ func TestLockingLockedDatabase(t *testing.T) {
 }
 
 func TestLockingLockedDatabaseFailsAfterTimeout(t *testing.T) {
+	t.Parallel()
+
+	if testing.Short() {
+		t.Skip("skipping test in short mode.")
+	}
+
+	if !testutils.RunningInBubblewrap() {
+		testInBubbleWrapWithLockerBinary(t)
+		return
+	}
+
 	require.Zero(t, os.Geteuid(), "Not root")
 
+	userslocking.Z_ForTests_SetMaxWaitTime(t, 2*time.Second)
+
 	testLockerUtility := os.Getenv("AUTHD_TESTS_PASSWD_LOCKER_UTILITY")
 	require.NotEmpty(t, testLockerUtility, "Setup: Locker utility unset")
 
 	ctx, cancel := context.WithCancel(context.Background())
+	//nolint:gosec // G204 It's fine to pass variables to exec.Command here'
 	cmd := exec.CommandContext(ctx, testLockerUtility)
 	t.Logf("Running command: %s", cmd.Args)
 
+	err := cmd.Start()
+	require.NoError(t, err, "Setup: Locker utility should start")
+	lockerProcess := cmd.Process
+
 	lockerExited := make(chan error)
 	t.Cleanup(func() {
 		cancel()
-		syscall.Kill(cmd.Process.Pid, syscall.SIGKILL)
+		_ = syscall.Kill(lockerProcess.Pid, syscall.SIGKILL)
 		require.Error(t, <-lockerExited, "Stopping locking process")
-		require.NoError(t, userslocking.WriteUnlock(), "Final unlocking")
 	})
 
 	go func() {
-		lockerExited <- cmd.Run()
+		lockerExited <- cmd.Wait()
 	}()
 
 	select {
-	case <-time.After(sleepDuration(1 * time.Second)):
-		t.Cleanup(func() { cmd.Process.Kill() })
+	case <-time.After(1 * time.Second):
+		t.Cleanup(func() { _ = lockerProcess.Kill() })
 		// If we're time-outing: it's fine, it means the test-locker process is running
 	case err := <-lockerExited:
 		require.NoError(t, err, "test locker should not have failed")
@@ -260,33 +348,51 @@ func TestLockingLockedDatabaseFailsAfterTimeout(t *testing.T) {
 		writeLockExited <- userslocking.WriteLock()
 	}()
 
-	err := <-writeLockExited
+	err = <-writeLockExited
 	t.Log("Done waiting for lock!")
 	require.ErrorIs(t, err, userslocking.ErrLock)
 	require.ErrorIs(t, err, userslocking.ErrLockTimeout)
 }
 
 func TestLockingLockedDatabaseWorksAfterUnlock(t *testing.T) {
+	t.Parallel()
+
+	if testing.Short() {
+		t.Skip("skipping test in short mode.")
+	}
+
+	if !testutils.RunningInBubblewrap() {
+		testInBubbleWrapWithLockerBinary(t)
+		return
+	}
+
 	require.Zero(t, os.Geteuid(), "Not root")
 
 	testLockerUtility := os.Getenv("AUTHD_TESTS_PASSWD_LOCKER_UTILITY")
 	require.NotEmpty(t, testLockerUtility, "Setup: Locker utility unset")
 
+	userslocking.Z_ForTests_SetMaxWaitTime(t, 3*time.Second)
+
 	ctx, cancel := context.WithCancel(context.Background())
 	t.Cleanup(cancel)
+	//nolint:gosec // G204 It's fine to pass variables to exec.Command here'
 	lockerCmd := exec.CommandContext(ctx, testLockerUtility)
 	t.Logf("Running command: %s", lockerCmd.Args)
 
+	err := lockerCmd.Start()
+	require.NoError(t, err, "Setup: Locker utility should start")
+	lockerProcess := lockerCmd.Process
+
 	lockerExited := make(chan error)
 	go func() {
-		lockerExited <- lockerCmd.Run()
+		lockerExited <- lockerCmd.Wait()
 	}()
 
 	select {
-	case <-time.After(sleepDuration(1 * time.Second)):
+	case <-time.After(500 * time.Millisecond):
 		// If we're time-outing: it's fine, it means the test-locker process is
 		// still running and holding the lock.
-		t.Cleanup(func() { lockerCmd.Process.Kill() })
+		t.Cleanup(func() { _ = lockerProcess.Kill() })
 	case err := <-lockerExited:
 		require.NoError(t, err, "test locker should not have failed")
 	}
@@ -297,7 +403,7 @@ func TestLockingLockedDatabaseWorksAfterUnlock(t *testing.T) {
 	}()
 
 	select {
-	case <-time.After(sleepDuration(3 * time.Second)):
+	case <-time.After(1 * time.Second):
 		// If we're time-outing: it's fine, it means the test-locker process is
 		// still running and holding the lock.
 	case err := <-writeLockExited:
@@ -310,7 +416,7 @@ func TestLockingLockedDatabaseWorksAfterUnlock(t *testing.T) {
 	}()
 
 	select {
-	case <-time.After(sleepDuration(1 * time.Second)):
+	case <-time.After(500 * time.Millisecond):
 		// If we're time-outing: it's fine, it means the test-locker process is
 		// still running and holding the lock.
 	case err := <-writeUnLockExited:
@@ -319,12 +425,12 @@ func TestLockingLockedDatabaseWorksAfterUnlock(t *testing.T) {
 
 	t.Log("Killing locking process")
 	cancel()
-	syscall.Kill(lockerCmd.Process.Pid, syscall.SIGKILL)
+	_ = syscall.Kill(lockerProcess.Pid, syscall.SIGKILL)
 	// Do not wait for the locker being exited yet, so that we can ensure that
 	// our function call wait is over.
 
 	t.Log("We should get the lock now!")
-	err := <-writeLockExited
+	err = <-writeLockExited
 	require.NoError(t, err, "We should have the lock now")
 
 	t.Log("Ensure locking process has been stopped!")
@@ -332,14 +438,13 @@ func TestLockingLockedDatabaseWorksAfterUnlock(t *testing.T) {
 	require.Error(t, err, "Locker should exit with failure")
 
 	err = <-writeUnLockExited
-	// err = userslocking.WriteUnlock()
 	require.NoError(t, err, "We should be able to unlock now")
 }
 
 func runCmd(t *testing.T, command string, args ...string) (string, error) {
 	t.Helper()
 
-	//nolint:gosec // G204 It's fine to pass variables to exec.Command here
+	//nolint:gosec // G204 - test-only code; command and args are controlled by test setup.
 	cmd := exec.Command(command, args...)
 	cmd.Env = append(os.Environ(), "LANG=C", "LC_ALL=C")
 
@@ -354,6 +459,49 @@ func runGPasswd(t *testing.T, args ...string) (string, error) {
 	return runCmd(t, "gpasswd", args...)
 }
 
-func sleepDuration(in time.Duration) time.Duration {
-	return time.Duration(math.Round(float64(in) * testutils.SleepMultiplier()))
+func compileLockerBinary(t *testing.T, tempDir string) {
+	t.Helper()
+
+	lockerBinaryPath = filepath.Join(tempDir, "test-locker")
+	cmd := exec.Command("go", "build", "-C", "testlocker")
+	cmd.Args = append(cmd.Args, []string{
+		"-tags", "test_locker", "-o", lockerBinaryPath,
+	}...)
+
+	t.Logf("Compiling locker binary: %s", strings.Join(cmd.Args, " "))
+	compileOut, err := cmd.CombinedOutput()
+	require.NoError(t, err, "Setup: Cannot compile locker file: %s", compileOut)
+}
+
+func testInBubbleWrapWithLockerBinary(t *testing.T) {
+	t.Helper()
+
+	testutils.RequireBubblewrap(t)
+
+	compileLockerBinaryOnce.Do(func() {
+		compileLockerBinary(t, tempDir)
+	})
+
+	testutils.RunTestInBubbleWrap(t,
+		"--ro-bind", lockerBinaryPath, lockerBinaryPath,
+		"--setenv", "AUTHD_TESTS_PASSWD_LOCKER_UTILITY", lockerBinaryPath,
+	)
+}
+
+func TestMain(m *testing.M) {
+	if testutils.RunningInBubblewrap() {
+		m.Run()
+		return
+	}
+
+	var err error
+	tempDir, err = os.MkdirTemp("", "authd-test-*")
+	if err != nil {
+		panic(err)
+	}
+	if v := os.Getenv("SKIP_CLEANUP"); v == "" {
+		defer func() { _ = os.RemoveAll(tempDir) }()
+	}
+
+	m.Run()
 }
diff --git a/internal/users/locking/locking_c.go b/internal/users/locking/locking_c.go
index d7011a495d..a0db68b9b3 100644
--- a/internal/users/locking/locking_c.go
+++ b/internal/users/locking/locking_c.go
@@ -6,9 +6,12 @@ package userslocking
 import "C"
 
 import (
+	"context"
+	"errors"
 	"fmt"
 
-	"github.com/ubuntu/authd/internal/errno"
+	"github.com/canonical/authd/internal/errno"
+	"github.com/canonical/authd/log"
 )
 
 // writeLock is the default locking implementation.
@@ -17,10 +20,16 @@ func writeLock() error {
 	defer errno.Unlock()
 
 	if C.lckpwdf() == 0 {
+		log.Debug(context.Background(), "glibc lckpwdf: Local entries locked!")
 		return nil
 	}
 
-	if err := errno.Get(); err != nil {
+	err := errno.Get()
+	if errors.Is(err, errno.ErrIntr) {
+		// lckpwdf sets errno to EINTR when a SIGALRM is received, which is expected when the lock times out.
+		return ErrLockTimeout
+	}
+	if err != nil {
 		return fmt.Errorf("%w: %w", ErrLock, err)
 	}
 
@@ -33,6 +42,7 @@ func writeUnlock() error {
 	defer errno.Unlock()
 
 	if C.ulckpwdf() == 0 {
+		log.Debug(context.Background(), "glibc lckpwdf: Local entries unlocked!")
 		return nil
 	}
 
diff --git a/internal/users/locking/locking_test.go b/internal/users/locking/locking_test.go
index b87e953fa0..ad817fd3ea 100644
--- a/internal/users/locking/locking_test.go
+++ b/internal/users/locking/locking_test.go
@@ -1,140 +1,85 @@
-//go:build !bubblewrap_test
-
 package userslocking_test
 
 import (
-	"fmt"
-	"os"
-	"os/exec"
-	"path/filepath"
-	"regexp"
-	"strings"
+	"context"
 	"testing"
+	"time"
 
+	userslocking "github.com/canonical/authd/internal/users/locking"
 	"github.com/stretchr/testify/require"
-	"github.com/ubuntu/authd/internal/fileutils"
-	"github.com/ubuntu/authd/internal/testutils"
-	userslocking "github.com/ubuntu/authd/internal/users/locking"
 )
 
-func TestUsersLockingInBubbleWrap(t *testing.T) {
-	t.Parallel()
-
-	if os.Getenv("AUTHD_SKIP_FLAKY_TESTS") != "" {
-		t.Skip("skipping flaky test")
-	}
-
-	testutils.SkipIfCannotRunBubbleWrap(t)
-
-	// Create a binary for the bubbletea tests.
-	mainTestBinary := compileTestBinary(t)
-
-	//nolint:gosec // G204 we define the parameters here.
-	testsList, err := exec.Command(mainTestBinary, "-test.list", ".*").CombinedOutput()
-	require.NoError(t, err, "Setup: Checking for test: %s", testsList)
-	testsListStr := strings.TrimSpace(string(testsList))
-	require.NotEmpty(t, testsListStr, "Setup: test not found", testsListStr)
-
-	lockerBinary := compileLockerBinary(t)
-
-	for _, name := range strings.Split(testsListStr, "\n") {
-		t.Run(name, func(t *testing.T) {
-			t.Parallel()
-
-			var testEnv []string
-
-			// Create a temporary folder for tests.
-			testDataPath := t.TempDir()
-			testBinary := filepath.Join(testDataPath, filepath.Base(mainTestBinary))
-			err := fileutils.CopyFile(mainTestBinary, testBinary)
-			require.NoError(t, err, "Setup: Copying test binary to local test path")
-
-			testLockerBinary := filepath.Join(testDataPath, filepath.Base(lockerBinary))
-			err = fileutils.CopyFile(lockerBinary, testLockerBinary)
-			require.NoError(t, err, "Setup: Copying locker binary to local test path")
-			testEnv = append(testEnv, "AUTHD_TESTS_PASSWD_LOCKER_UTILITY="+testLockerBinary)
-
-			nameRegex := fmt.Sprintf("^%s$", regexp.QuoteMeta(name))
-			//nolint:gosec // G204 we define the parameters here.
-			testsList, err := exec.Command(testBinary, "-test.list", nameRegex).CombinedOutput()
-			require.NoError(t, err, "Setup: Checking for test: %s", testsList)
-			testsListStr := strings.TrimSpace(string(testsList))
-			require.NotEmpty(t, testsListStr, "Setup: %q test not found", name)
-			require.Len(t, strings.Split(testsListStr, "\n"), 1,
-				"Setup: Too many tests defined for %s", testsListStr)
-
-			testCommand := []string{testBinary, "-test.run", nameRegex}
-			if testutils.IsVerbose() {
-				testCommand = append(testCommand, "-test.v")
-			}
-			if c := testutils.CoverDirForTests(); c != "" {
-				testCommand = append(testCommand, fmt.Sprintf("-test.gocoverdir=%s", c))
-			}
-			out, err := testutils.RunInBubbleWrapWithEnv(t, testDataPath, testEnv,
-				testCommand...)
-			require.NoError(t, err, "Running test: %s\n%s", name, out)
-		})
-	}
-}
+func TestUsersLockingOverride(t *testing.T) {
+	// This cannot be parallel.
 
-func compileTestBinary(t *testing.T) string {
-	t.Helper()
+	userslocking.Z_ForTests_OverrideLockingWithCleanup(t)
 
-	cmd := exec.Command("go", "test")
-	// These are positional arguments.
-	if testutils.CoverDirForTests() != "" {
-		cmd.Args = append(cmd.Args, "-cover")
-	}
-	if testutils.IsAsan() {
-		cmd.Args = append(cmd.Args, "-asan")
-	}
-	if testutils.IsRace() {
-		cmd.Args = append(cmd.Args, "-race")
-	}
+	err := userslocking.WriteLock()
+	require.NoError(t, err, "Locking should be allowed")
 
-	testBinary := filepath.Join(t.TempDir(), "test-binary")
-	cmd.Args = append(cmd.Args, []string{
-		"-tags", "bubblewrap_test", "-c", "-o", testBinary,
-	}...)
+	err = userslocking.WriteLock()
+	require.ErrorIs(t, err, userslocking.ErrLock, "Locking again should not be allowed")
 
-	t.Logf("Compiling test binary: %s", strings.Join(cmd.Args, " "))
-	compileOut, err := cmd.CombinedOutput()
-	require.NoError(t, err, "Setup: Cannot compile test file: %s", compileOut)
+	err = userslocking.WriteUnlock()
+	require.NoError(t, err, "Unlocking should be allowed")
 
-	return testBinary
+	err = userslocking.WriteUnlock()
+	require.ErrorIs(t, err, userslocking.ErrUnlock, "Unlocking unlocked should not be allowed")
 }
 
-func compileLockerBinary(t *testing.T) string {
-	t.Helper()
+func TestUsersLockingOverrideAsLockedExternally(t *testing.T) {
+	// This cannot be parallel.
+	userslocking.Z_ForTests_OverrideLockingAsLockedExternally(t, context.Background())
+
+	lockingExited := make(chan error)
+	go func() {
+		lockingExited <- userslocking.WriteLock()
+	}()
+
+	select {
+	case <-time.After(1 * time.Second):
+		// If we're time-outing: it's fine, it means we were locked!
+	case err := <-lockingExited:
+		t.Errorf("We should have not been exited, but we did with error %v", err)
+		t.FailNow()
+	}
 
-	testLocker := filepath.Join(t.TempDir(), "test-locker")
-	cmd := exec.Command("go", "build", "-C", "testlocker")
-	cmd.Args = append(cmd.Args, []string{
-		"-tags", "test_locker", "-o", testLocker,
-	}...)
+	err := userslocking.WriteUnlock()
+	require.NoError(t, err, "Unlocking should be allowed")
 
-	t.Logf("Compiling locker binary: %s", strings.Join(cmd.Args, " "))
-	compileOut, err := cmd.CombinedOutput()
-	require.NoError(t, err, "Setup: Cannot compile locker file: %s", compileOut)
+	err = <-lockingExited
+	require.NoError(t, err, "Previous concurrent locking should have been allowed now")
 
-	return testLocker
+	err = userslocking.WriteUnlock()
+	require.NoError(t, err, "Unlocking should be allowed")
+
+	err = userslocking.WriteUnlock()
+	require.ErrorIs(t, err, userslocking.ErrUnlock, "Unlocking unlocked should not be allowed")
 }
 
-func TestUsersLockingOverride(t *testing.T) {
+func TestUsersLockingOverrideAsLockedExternallyWithContext(t *testing.T) {
 	// This cannot be parallel.
-
-	if os.Getenv("AUTHD_SKIP_FLAKY_TESTS") != "" {
-		t.Skip("skipping flaky test")
+	lockCtx, lockCancel := context.WithCancel(context.Background())
+	userslocking.Z_ForTests_OverrideLockingAsLockedExternally(t, lockCtx)
+
+	lockingExited := make(chan error)
+	go func() {
+		lockingExited <- userslocking.WriteLock()
+	}()
+
+	select {
+	case <-time.After(1 * time.Second):
+		// If we're time-outing: it's fine, it means we were locked!
+	case err := <-lockingExited:
+		t.Errorf("We should have not been exited, but we did with error %v", err)
+		t.FailNow()
 	}
 
-	userslocking.Z_ForTests_OverrideLocking()
-	t.Cleanup(userslocking.Z_ForTests_RestoreLocking)
-
-	err := userslocking.WriteLock()
-	require.NoError(t, err, "Locking should be allowed")
+	// Remove the "external" lock now.
+	lockCancel()
 
-	err = userslocking.WriteLock()
-	require.ErrorIs(t, err, userslocking.ErrLock, "Locking again should not be allowed")
+	err := <-lockingExited
+	require.NoError(t, err, "Previous concurrent locking should have been allowed now")
 
 	err = userslocking.WriteUnlock()
 	require.NoError(t, err, "Unlocking should be allowed")
diff --git a/internal/users/locking/testlocker/testlocker.go b/internal/users/locking/testlocker/testlocker.go
index df36e50585..9e0cd4e980 100644
--- a/internal/users/locking/testlocker/testlocker.go
+++ b/internal/users/locking/testlocker/testlocker.go
@@ -7,7 +7,7 @@ import (
 	"log"
 	"time"
 
-	userslocking "github.com/ubuntu/authd/internal/users/locking"
+	userslocking "github.com/canonical/authd/internal/users/locking"
 )
 
 func main() {
diff --git a/internal/users/locking/testutils.go b/internal/users/locking/testutils.go
index 2a3d0c7eba..1da65f8f6c 100644
--- a/internal/users/locking/testutils.go
+++ b/internal/users/locking/testutils.go
@@ -1,12 +1,60 @@
 package userslocking
 
 import (
+	"context"
+	"fmt"
+	"sync"
 	"sync/atomic"
+	"testing"
+	"time"
 
-	"github.com/ubuntu/authd/internal/testsdetection"
+	"github.com/canonical/authd/internal/testsdetection"
+	"github.com/canonical/authd/log"
+	"github.com/stretchr/testify/require"
 )
 
-var overrideLocked atomic.Bool
+var (
+	defaultMock     SimpleMock
+	overrideMaxWait atomic.Int64
+
+	overriddenMu              sync.Mutex
+	overriddenWriteLockImpl   []func() error
+	overriddenWriteUnlockImpl []func() error
+)
+
+func init() {
+	overrideMaxWait.Store(int64(maxWait))
+}
+
+// SimpleMock is a structure that can be used to simulate the users database
+// lock without relying on the actual file locking.
+type SimpleMock struct {
+	overrideLocked atomic.Bool
+}
+
+// WriteLock locks the mock.
+func (t *SimpleMock) WriteLock() error {
+	testsdetection.MustBeTesting()
+
+	if !t.overrideLocked.CompareAndSwap(false, true) {
+		return fmt.Errorf("%w: already locked", ErrLock)
+	}
+
+	log.Debug(context.Background(), "TestOverride: Local entries locked!")
+	return nil
+}
+
+// WriteUnlock unlocks the mock.
+func (t *SimpleMock) WriteUnlock() error {
+	testsdetection.MustBeTesting()
+
+	if !t.overrideLocked.CompareAndSwap(true, false) {
+		return fmt.Errorf("%w: already unlocked", ErrUnlock)
+	}
+
+	log.Debug(context.Background(), "TestOverride: Local entries unlocked!")
+	return nil
+}
 
 // Z_ForTests_OverrideLocking is a function to override the locking functions
 // for testing purposes.
@@ -17,28 +65,155 @@ var overrideLocked atomic.Bool
 func Z_ForTests_OverrideLocking() {
 	testsdetection.MustBeTesting()
 
+	overriddenMu.Lock()
+	defer overriddenMu.Unlock()
+
+	overriddenWriteLockImpl = append(overriddenWriteLockImpl, writeLockImpl)
+	writeLockImpl = defaultMock.WriteLock
+
+	overriddenWriteUnlockImpl = append(overriddenWriteUnlockImpl, writeUnlockImpl)
+	writeUnlockImpl = defaultMock.WriteUnlock
+}
+
+// Z_ForTests_OverrideLockingWithCleanup is a function to override the locking
+// functions for testing purposes.
+// It simulates the real behavior but without actual file locking.
+// This implicitly calls [Z_ForTests_RestoreLocking] once the test is completed.
+//
+// nolint:revive,nolintlint // We want to use underscores in the function name here.
+func Z_ForTests_OverrideLockingWithCleanup(t *testing.T) {
+	t.Helper()
+
+	testsdetection.MustBeTesting()
+
+	Z_ForTests_OverrideLocking()
+	t.Cleanup(Z_ForTests_RestoreLocking)
+}
+
+// Z_ForTests_OverrideLockingAsLockedExternally simulates a scenario where the
+// user database is locked by an external process.
+//
+// When called, it marks the user database as locked, causing any subsequent
+// locking attempts by authd (via [WriteLock]) to block until the provided
+// context is cancelled.
+//
+// This does not use real file locking. The lock can be released either
+// by cancelling the context or by calling [WriteUnlock]. After the test,
+// [Z_ForTests_RestoreLocking] is called automatically to restore normal behavior.
+//
+// nolint:revive,nolintlint // We want to use underscores in the function name here.
+func Z_ForTests_OverrideLockingAsLockedExternally(t *testing.T, ctx context.Context) {
+	t.Helper()
+
+	testsdetection.MustBeTesting()
+
+	overriddenMu.Lock()
+	defer overriddenMu.Unlock()
+
+	t.Cleanup(Z_ForTests_RestoreLocking)
+
+	// This channel is used to synchronize the lock and unlock operations.
+	// It uses a buffer of size 1 so that it can be locked exactly once
+	// and then blocks until the unlock operation is called.
+	lockCh := make(chan struct{}, 1)
+
+	overriddenWriteLockImpl = append(overriddenWriteLockImpl, writeLockImpl)
 	writeLockImpl = func() error {
-		if !overrideLocked.CompareAndSwap(false, true) {
-			return ErrLock
+		for {
+			maxWait := time.Duration(overrideMaxWait.Load())
+
+			select {
+			case lockCh <- struct{}{}:
+				log.Debug(ctx, "TestOverrideExternallyLocked: Local entries external lock released!")
+			case <-time.After(maxWait):
+				return fmt.Errorf("failed waiting for %v: %w", maxWait, ErrLockTimeout)
+			}
+
+			if defaultMock.overrideLocked.CompareAndSwap(false, true) {
+				log.Debug(ctx, "TestOverrideExternallyLocked: Local entries locked!")
+				break
+			}
 		}
 		return nil
 	}
 
+	overriddenWriteUnlockImpl = append(overriddenWriteUnlockImpl, writeUnlockImpl)
 	writeUnlockImpl = func() error {
-		if !overrideLocked.CompareAndSwap(true, false) {
+		if !defaultMock.overrideLocked.CompareAndSwap(true, false) {
 			return ErrUnlock
 		}
+
+		<-lockCh
+		log.Debug(ctx, "TestOverrideExternallyLocked: Local entries unlocked!")
 		return nil
 	}
+
+	done := atomic.Bool{}
+	writeUnlockImpl := writeUnlockImpl
+	cleanup := func() {
+		if !done.CompareAndSwap(false, true) {
+			return
+		}
+		if !defaultMock.overrideLocked.Load() {
+			return
+		}
+		err := writeUnlockImpl()
+		require.NoError(t, err, "Unlocking should be allowed")
+	}
+
+	t.Cleanup(cleanup)
+
+	err := writeLockImpl()
+	require.NoError(t, err, "Locking should be allowed")
+
+	go func() {
+		<-ctx.Done()
+		cleanup()
+	}()
 }
 
 // Z_ForTests_RestoreLocking restores the locking overridden done by
-// [Z_ForTests_OverrideLocking].
+// [Z_ForTests_OverrideLocking] or [Z_ForTests_OverrideLockingAsLockedExternally].
 //
 // nolint:revive,nolintlint // We want to use underscores in the function name here.
 func Z_ForTests_RestoreLocking() {
 	testsdetection.MustBeTesting()
 
-	writeLockImpl = writeLock
-	writeUnlockImpl = writeUnlock
+	if defaultMock.overrideLocked.Load() {
+		panic("Lock has not been released before restoring!")
+	}
+
+	overriddenMu.Lock()
+	defer overriddenMu.Unlock()
+
+	popLast := func(l []func() error) ([]func() error, func() error) {
+		n := len(l) - 1
+		v, l := l[n], l[:n]
+		return l, v
+	}
+
+	overriddenWriteLockImpl, writeLockImpl = popLast(overriddenWriteLockImpl)
+	overriddenWriteUnlockImpl, writeUnlockImpl = popLast(overriddenWriteUnlockImpl)
+}
+
+// Z_ForTests_SetMaxWaitTime sets the max time that we should wait before
+// returning a failure in [WriteLock].
+//
+// nolint:revive,nolintlint // We want to use underscores in the function name here.
+func Z_ForTests_SetMaxWaitTime(t *testing.T, maxWaitTime time.Duration) {
+	t.Helper()
+
+	testsdetection.MustBeTesting()
+
+	require.True(t, overrideMaxWait.CompareAndSwap(int64(maxWait), int64(maxWaitTime)),
+		"Waiting time has an unexpected value: %v", overrideMaxWait.Load())
+
+	defaultMaxWait := maxWait
+	maxWait = maxWaitTime
+
+	t.Cleanup(func() {
+		require.True(t, overrideMaxWait.CompareAndSwap(int64(maxWaitTime), int64(defaultMaxWait)),
+			"Waiting time has been changed: %v", overrideMaxWait.Load())
+		maxWait = defaultMaxWait
+	})
 }
diff --git a/internal/users/manager.go b/internal/users/manager.go
index d16935795b..3b978de19b 100644
--- a/internal/users/manager.go
+++ b/internal/users/manager.go
@@ -5,19 +5,23 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"math"
 	"os"
 	"os/user"
-	"strings"
+	"slices"
+	"strconv"
 	"sync"
 	"syscall"
 
-	"github.com/ubuntu/authd/internal/users/db"
-	"github.com/ubuntu/authd/internal/users/idgenerator"
-	"github.com/ubuntu/authd/internal/users/localentries"
-	"github.com/ubuntu/authd/internal/users/tempentries"
-	"github.com/ubuntu/authd/internal/users/types"
-	"github.com/ubuntu/authd/log"
-	"github.com/ubuntu/decorate"
+	"github.com/canonical/authd/internal/decorate"
+	"github.com/canonical/authd/internal/fileutils"
+	"github.com/canonical/authd/internal/users/db"
+	"github.com/canonical/authd/internal/users/localentries"
+	userslocking "github.com/canonical/authd/internal/users/locking"
+	"github.com/canonical/authd/internal/users/proc"
+	"github.com/canonical/authd/internal/users/tempentries"
+	"github.com/canonical/authd/internal/users/types"
+	"github.com/canonical/authd/log"
 )
 
 // Config is the configuration for the user manager.
@@ -30,22 +34,27 @@ type Config struct {
 
 // DefaultConfig is the default configuration for the user manager.
 var DefaultConfig = Config{
-	UIDMin: 1000000000,
-	UIDMax: 1999999999,
-	GIDMin: 1000000000,
-	GIDMax: 1999999999,
+	UIDMin: 10000,
+	UIDMax: 60000,
+	GIDMin: 10000,
+	GIDMax: 60000,
 }
 
 // Manager is the manager for any user related operation.
 type Manager struct {
-	db               *db.Manager
-	config           Config
-	temporaryRecords *tempentries.TemporaryRecords
-	updateUserMu     sync.Mutex
+	// userManagementMu must be used to protect all the operations in which we
+	// do users registration to the DB, to ensure that concurrent goroutines may
+	// not falsify the checks we are performing (such as the users existence).
+	userManagementMu sync.Mutex
+
+	db             *db.Manager
+	config         Config
+	preAuthRecords *tempentries.PreAuthUserRecords
+	idGenerator    IDGeneratorIface
 }
 
 type options struct {
-	idGenerator tempentries.IDGenerator
+	idGenerator IDGeneratorIface
 }
 
 // Option is a function that allows changing some of the default behaviors of the manager.
@@ -53,7 +62,7 @@ type Option func(*options)
 
 // WithIDGenerator makes the manager use a specific ID generator.
 // This option is only useful in tests.
-func WithIDGenerator(g tempentries.IDGenerator) Option {
+func WithIDGenerator(g IDGeneratorIface) Option {
 	return func(o *options) {
 		o.idGenerator = g
 	}
@@ -71,19 +80,40 @@ func NewManager(config Config, dbDir string, args ...Option) (m *Manager, err er
 	if opts.idGenerator == nil {
 		// Check that the ID ranges are valid.
 		if config.UIDMin >= config.UIDMax {
-			return nil, errors.New("UID_MIN must be less than UID_MAX")
+			return nil, fmt.Errorf("UID_MIN (%d) must be less than UID_MAX (%d)", config.UIDMin, config.UIDMax)
 		}
 		if config.GIDMin >= config.GIDMax {
-			return nil, errors.New("GID_MIN must be less than GID_MAX")
+			return nil, fmt.Errorf("GID_MIN (%d) must be less than GID_MAX (%d)", config.GIDMin, config.GIDMax)
 		}
+		// UIDs/GIDs larger than a signed int32 are known to cause issues in various programs,
+		// so they should be avoided (see https://systemd.io/UIDS-GIDS/)
+		if config.UIDMax > math.MaxInt32 {
+			return nil, fmt.Errorf("UID_MAX (%d) must be less than or equal to %d", config.UIDMax, math.MaxInt32)
+		}
+		if config.GIDMax > math.MaxInt32 {
+			return nil, fmt.Errorf("GID_MAX (%d) must be less than or equal to %d", config.GIDMax, math.MaxInt32)
+		}
+
+		// Check that the ID ranges are not overlapping with systemd dynamic service users.
+		rangesOverlap := func(min1, max1, min2, max2 uint32) bool {
+			return (min1 <= max2 && max1 >= min2) || (min2 <= max1 && max2 >= min1)
+		}
+
+		if rangesOverlap(config.UIDMin, config.UIDMax, systemdDynamicUIDMin, systemdDynamicUIDMax) {
+			return nil, fmt.Errorf("UID range (%d-%d) overlaps with systemd dynamic service users range (%d-%d)", config.UIDMin, config.UIDMax, systemdDynamicUIDMin, systemdDynamicUIDMax)
+		}
+		if rangesOverlap(config.GIDMin, config.GIDMax, systemdDynamicUIDMin, systemdDynamicUIDMax) {
+			return nil, fmt.Errorf("GID range (%d-%d) overlaps with systemd dynamic service users range (%d-%d)", config.GIDMin, config.GIDMax, systemdDynamicUIDMin, systemdDynamicUIDMax)
+		}
+
 		// Check that the number of possible UIDs is at least twice the number of possible pre-auth users.
-		numUIDs := config.UIDMax - config.UIDMin
+		numUIDs := config.UIDMax - config.UIDMin + 1
 		minNumUIDs := uint32(tempentries.MaxPreAuthUsers * 2)
 		if numUIDs < minNumUIDs {
 			return nil, fmt.Errorf("UID range configured via UID_MIN and UID_MAX is too small (%d), must be at least %d", numUIDs, minNumUIDs)
 		}
 
-		opts.idGenerator = &idgenerator.IDGenerator{
+		opts.idGenerator = &IDGenerator{
 			UIDMin: config.UIDMin,
 			UIDMax: config.UIDMax,
 			GIDMin: config.GIDMin,
@@ -92,8 +122,9 @@ func NewManager(config Config, dbDir string, args ...Option) (m *Manager, err er
 	}
 
 	m = &Manager{
-		config:           config,
-		temporaryRecords: tempentries.NewTemporaryRecords(opts.idGenerator),
+		config:         config,
+		preAuthRecords: tempentries.NewPreAuthUserRecords(),
+		idGenerator:    opts.idGenerator,
 	}
 
 	m.db, err = db.New(dbDir)
@@ -115,55 +146,97 @@ func (m *Manager) UpdateUser(u types.UserInfo) (err error) {
 
 	log.Debugf(context.TODO(), "Updating user %q", u.Name)
 
-	// authd uses lowercase usernames
-	u.Name = strings.ToLower(u.Name)
-
 	if u.Name == "" {
 		return errors.New("empty username")
 	}
 
-	var uid uint32
+	// Prepend the user private group
+	u.Groups = append([]types.GroupInfo{{Name: u.Name, UGID: u.Name}}, u.Groups...)
+	userPrivateGroup := &u.Groups[0]
 
-	// Prevent a TOCTOU race condition between the check for existence in our database and the registration of the
-	// temporary user/group records. This does not prevent a race condition where a user is created by some other NSS
-	// source, but that is handled in the temporaryRecords.RegisterUser and temporaryRecords.RegisterGroup functions.
-	m.updateUserMu.Lock()
-	defer m.updateUserMu.Unlock()
+	var oldUserInfo *types.UserInfo
+	checkEqualUserExists := func() (exists bool, err error) {
+		// Check if the user already exists in the database.
+		oldUserInfo, err = m.getOldUserInfoFromDB(u.Name)
+		if err != nil {
+			return false, err
+		}
+		if oldUserInfo == nil {
+			return false, nil
+		}
+		if !compareNewUserInfoWithUserInfoFromDB(u, *oldUserInfo) {
+			log.Debugf(context.TODO(), "User %q is already in our database", u.Name)
+			return false, nil
+		}
 
-	// Check if the user already exists in the database
-	oldUser, err := m.db.UserByName(u.Name)
-	if err != nil && !errors.Is(err, db.NoDataFoundError{}) {
-		return fmt.Errorf("could not get user %q: %w", u.Name, err)
+		log.Debugf(context.TODO(), "User %q in database already matches current", u.Name)
+		return true, nil
 	}
-	if errors.Is(err, db.NoDataFoundError{}) {
-		// Check if the user exists on the system
-		existingUser, err := user.Lookup(u.Name)
-		var unknownUserErr user.UnknownUserError
-		if !errors.As(err, &unknownUserErr) {
-			log.Errorf(context.Background(), "User already exists on the system: %+v", existingUser)
-			return fmt.Errorf("user %q already exists on the system (but not in this authd instance)", u.Name)
+
+	// Do a first check before locking, so that if the user is already there and
+	// matches the DB entry, we can avoid any kind of locking (and so being
+	// blocked by other pre-auth users that may try to login meanwhile).
+	exists, err := checkEqualUserExists()
+	if exists || err != nil {
+		// The user already exists, so no update needed, or an error occurred.
+		return err
+	}
+
+	m.userManagementMu.Lock()
+	defer m.userManagementMu.Unlock()
+
+	// Now that we're locked, check again if meanwhile some other request
+	// created the same user, if not we can do all the kinds of locking since
+	// we're sure that the user needs to be added or updated in the database.
+	if exists, err := checkEqualUserExists(); exists || err != nil {
+		return err
+	}
+
+	log.Debugf(context.TODO(), "User %q needs update", u.Name)
+
+	lockedEntries, unlockEntries, err := localentries.WithUserDBLock()
+	if err != nil {
+		return err
+	}
+	defer func() { err = errors.Join(err, unlockEntries()) }()
+
+	if oldUserInfo != nil {
+		// The user already exists in the database, use the existing UID to avoid permission issues.
+		u.UID = oldUserInfo.UID
+	} else {
+		preauthUID, cleanup, err := m.preAuthRecords.MaybeCompletePreauthUser(u.Name)
+		if err != nil && !errors.Is(err, tempentries.NoDataFoundError{}) {
+			return err
 		}
+		if preauthUID != 0 {
+			u.UID = preauthUID
+			defer cleanup()
+		} else {
+			unique, err := lockedEntries.IsUniqueUserName(u.Name)
+			if err != nil {
+				return err
+			}
+			if !unique {
+				log.Warningf(context.Background(), "User %q already exists", u.Name)
+				return fmt.Errorf("another system user exists with %q name", u.Name)
+			}
 
-		// The user does not exist, so we generate a unique UID for it. To avoid that a user with the same UID is
-		// created by some other NSS source, this also registers a temporary user in our NSS handler. We remove that
-		// temporary user before returning from this function, at which point the user is added to the database (so we
-		// don't need the temporary user anymore to keep the UID unique).
-		var cleanup func()
-		uid, cleanup, err = m.temporaryRecords.RegisterUser(u.Name)
-		if err != nil {
-			return fmt.Errorf("could not register user %q: %w", u.Name, err)
+			var cleanupUID func()
+			u.UID, cleanupUID, err = m.idGenerator.GenerateUID(lockedEntries, m)
+			if err != nil {
+				return err
+			}
+			defer cleanupUID()
+			log.Debugf(context.Background(), "Using new UID %d for user %q", u.UID, u.Name)
 		}
-		defer cleanup()
-	} else {
-		// The user already exists in the database, use the existing UID to avoid permission issues.
-		uid = oldUser.UID
 	}
 
-	// Prepend the user private group
-	u.Groups = append([]types.GroupInfo{{Name: u.Name, GID: &uid, UGID: u.Name}}, u.Groups...)
+	// User private Group GID is the same of the user UID.
+	userPrivateGroup.GID = &u.UID
 
 	var groupRows []db.GroupRow
 	var localGroups []string
+	var newGroups []types.GroupInfo
 	for _, g := range u.Groups {
 		if g.Name == "" {
 			return fmt.Errorf("empty group name for user %q", u.Name)
@@ -176,9 +249,6 @@ func (m *Manager) UpdateUser(u types.UserInfo) (err error) {
 			continue
 		}
 
-		// authd groups are lowercase
-		g.Name = strings.ToLower(g.Name)
-
 		// It's not a local group, so before storing it in the database, check if a group with the same name already
 		// exists.
 		if err := m.checkGroupNameConflict(g.Name, g.UGID); err != nil {
@@ -197,46 +267,318 @@ func (m *Manager) UpdateUser(u types.UserInfo) (err error) {
 		}
 
 		if g.GID == nil {
-			// The group does not exist in the database, so we generate a unique GID for it. Similar to the RegisterUser
-			// call above, this also registers a temporary group in our NSS handler. We remove that temporary group
-			// before returning from this function, at which point the group is added to the database (so we don't need
-			// the temporary group anymore to keep the GID unique).
-			gid, cleanup, err := m.temporaryRecords.RegisterGroup(g.Name)
+			// The group does not exist in the database, so we generate a unique GID for it.
+			newGroups = append(newGroups, g)
+			continue
+		}
+
+		groupRows = append(groupRows, db.NewGroupRow(g.Name, *g.GID, g.UGID))
+	}
+
+	if len(newGroups) > 0 {
+		for _, g := range newGroups {
+			unique, err := lockedEntries.IsUniqueGroupName(g.Name)
 			if err != nil {
-				return fmt.Errorf("could not generate GID for group %q: %v", g.Name, err)
+				return err
+			}
+			// If a system group with that name already exists, we log a warning and skip the creation of this group.
+			if !unique {
+				log.Warningf(context.Background(), "Group '%[1]s' already exists on the system, skipping creation. To have the user added to this local group, add them to the IdP group 'linux-%[1]s'.", g.Name)
+				continue
 			}
 
-			defer cleanup()
+			gid, cleanupGID, err := m.idGenerator.GenerateGID(lockedEntries, m)
+			if err != nil {
+				return err
+			}
+			defer cleanupGID()
+
 			g.GID = &gid
+			groupRows = append(groupRows, db.NewGroupRow(g.Name, *g.GID, g.UGID))
+			log.Debugf(context.Background(), "Using new GID %d for group %q", gid, u.Name)
 		}
-
-		groupRows = append(groupRows, db.NewGroupRow(g.Name, *g.GID, g.UGID))
 	}
 
-	oldLocalGroups, err := m.db.UserLocalGroups(uid)
-	if err != nil && !errors.Is(err, db.NoDataFoundError{}) {
-		return err
+	var oldLocalGroups []string
+	if oldUserInfo != nil {
+		for _, g := range oldUserInfo.Groups {
+			if g.UGID != "" {
+				// A non-empty UGID means that it's an authd group
+				continue
+			}
+			oldLocalGroups = append(oldLocalGroups, g.Name)
+		}
 	}
 
-	// Update user information in the db.
-	userPrivateGroup := groupRows[0]
-	userRow := db.NewUserRow(u.Name, uid, userPrivateGroup.GID, u.Gecos, u.Dir, u.Shell)
-	if err := m.db.UpdateUserEntry(userRow, groupRows, localGroups); err != nil {
+	userRow := db.NewUserRow(u.Name, u.UID, *userPrivateGroup.GID, u.Gecos, u.Dir, u.Shell)
+	if err = m.db.UpdateUserEntry(userRow, groupRows, localGroups); err != nil {
 		return err
 	}
 
 	// Update local groups.
-	if err := localentries.Update(u.Name, localGroups, oldLocalGroups); err != nil {
+	if err := localentries.UpdateGroups(lockedEntries, u.Name, localGroups, oldLocalGroups); err != nil {
 		return err
 	}
 
-	if err = checkHomeDirOwnership(userRow.Dir, userRow.UID, userRow.GID); err != nil {
-		return fmt.Errorf("failed to check home directory owner and group: %w", err)
+	if err = checkHomeDirOwner(userRow.Dir, userRow.UID, userRow.GID); err != nil {
+		log.Warningf(context.Background(), "Failed to check home directory ownership: %v", err)
 	}
 
 	return nil
 }
 
+func (m *Manager) getOldUserInfoFromDB(name string) (oldUserInfo *types.UserInfo, err error) {
+	oldUser, oldGroups, oldLocalGroups, err := m.db.UserWithGroups(name)
+	if err != nil && !errors.Is(err, db.NoDataFoundError{}) {
+		// Unexpected error
+		return nil, err
+	}
+	if errors.Is(err, db.NoDataFoundError{}) {
+		return nil, nil
+	}
+
+	return userInfoFromUserAndGroupRows(oldUser, oldGroups, oldLocalGroups), nil
+}
+
+func compareNewUserInfoWithUserInfoFromDB(newUserInfo, dbUserInfo types.UserInfo) bool {
+	if len(dbUserInfo.Groups) != len(newUserInfo.Groups) {
+		return false
+	}
+
+	// The new user UID may be set or un set, but despite that we're going to use
+	// the one we saved, so compare against it.
+	newUserInfo.UID = dbUserInfo.UID
+
+	// We then need to normalize the new user groups in order to be able to
+	// compare the two users, in fact we may receive from the broker user entries
+	// with unset or different GIDs, so let's
+	for idx, g := range newUserInfo.Groups {
+		oldGroupIdx := slices.IndexFunc(dbUserInfo.Groups, func(dg types.GroupInfo) bool {
+			if dg.UGID == "" {
+				// Do not compare through UGID if the one of the existing group is
+				// empty, because we didn't store the UGID in 0.3.7 and earlier.
+				return dg.Name == g.Name
+			}
+			return dg.UGID == g.UGID
+		})
+		if oldGroupIdx < 0 {
+			continue
+		}
+		newUserInfo.Groups[idx].GID = dbUserInfo.Groups[oldGroupIdx].GID
+	}
+
+	return dbUserInfo.Equals(newUserInfo)
+}
+
+// SetUserIDResp is the response type of SetUserID.
+type SetUserIDResp struct {
+	IDChanged           bool
+	HomeDirOwnerChanged bool
+	Warnings            []string
+}
+
+// SetUserID updates the UID of the user with the given name to the specified UID.
+func (m *Manager) SetUserID(name string, uid uint32) (resp *SetUserIDResp, err error) {
+	log.Debugf(context.TODO(), "Updating UID for user %q to %d", name, uid)
+	resp = &SetUserIDResp{}
+
+	if name == "" {
+		return nil, errors.New("empty username")
+	}
+
+	if uid > math.MaxInt32 {
+		return nil, fmt.Errorf("UID %d is too large to convert to int32", uid)
+	}
+
+	m.userManagementMu.Lock()
+	defer m.userManagementMu.Unlock()
+
+	// Call lckpwdf to avoid race conditions with other processes which add UIDs
+	err = userslocking.WriteLock()
+	if err != nil {
+		return nil, err
+	}
+	defer func() { err = errors.Join(err, userslocking.WriteUnlock()) }()
+
+	// Check if the user exists
+	oldUser, err := m.db.UserByName(name)
+	if err != nil {
+		return nil, err
+	}
+	// Check if the user already has the given UID
+	if oldUser.UID == uid {
+		warning := fmt.Sprintf("User '%s' already has UID %d.", name, uid)
+		log.Info(context.Background(), warning)
+		resp.Warnings = append(resp.Warnings, warning)
+		return resp, nil
+	}
+
+	// Check if another user already has the given UID
+	_, err = user.LookupId(strconv.FormatUint(uint64(uid), 10))
+	var userErr user.UnknownUserIdError
+	if err != nil && !errors.As(err, &userErr) {
+		// Unexpected error
+		return nil, err
+	}
+	if err == nil {
+		return nil, fmt.Errorf("UID %d already exists", uid)
+	}
+
+	// Check if the user has active processes
+	err = proc.CheckUserBusy(name, oldUser.UID)
+	if err != nil {
+		return nil, err
+	}
+
+	err = m.db.SetUserID(name, uid)
+	if err != nil {
+		return nil, err
+	}
+	resp.IDChanged = true
+
+	// Check if the home directory is currently owned by the user.
+	homeUID, _, err := getHomeDirOwner(oldUser.Dir)
+	if err != nil && !errors.Is(err, os.ErrNotExist) {
+		warning := fmt.Sprintf("Could not get owner of home directory '%s'.", oldUser.Dir)
+		log.Warningf(context.Background(), "%s: %v", warning, err)
+		resp.Warnings = append(resp.Warnings, warning)
+		return resp, nil
+	}
+	if errors.Is(err, os.ErrNotExist) {
+		// The home directory does not exist, so we don't need to change the owner.
+		log.Debugf(context.Background(), "Home directory %q for user %q does not exist, skipping ownership change", oldUser.Dir, name)
+		return resp, nil
+	}
+
+	if homeUID != oldUser.UID {
+		warning := fmt.Sprintf("Not updating ownership of home directory '%s' because it is not owned by UID %d (current owner: %d).", oldUser.Dir, oldUser.UID, homeUID)
+		log.Warning(context.Background(), warning)
+		resp.Warnings = append(resp.Warnings, warning)
+		return resp, nil
+	}
+
+	// Change the ownership of all files in the home directory from the old UID to the new UID.
+	log.Debugf(context.Background(), "Changing ownership of home directory %q from UID %d to UID %d", oldUser.Dir, oldUser.UID, uid)
+	err = fileutils.ChownRecursiveFrom(
+		oldUser.Dir,
+		&fileutils.ChownUIDArgs{FromUID: oldUser.UID, ToUID: uid},
+		nil,
+	)
+	if err != nil {
+		return resp, err
+	}
+	resp.HomeDirOwnerChanged = true
+
+	return resp, nil
+}
+
+// SetGroupIDResp is the response type of SetGroupID.
+type SetGroupIDResp struct {
+	IDChanged           bool
+	HomeDirOwnerChanged bool
+	Warnings            []string
+}
+
+// SetGroupID updates the GID of the group with the given name to the specified GID.
+func (m *Manager) SetGroupID(name string, gid uint32) (resp *SetGroupIDResp, err error) {
+	log.Debugf(context.TODO(), "Updating GID for group %q to %d", name, gid)
+	resp = &SetGroupIDResp{}
+
+	if name == "" {
+		return nil, errors.New("empty group name")
+	}
+
+	if gid > math.MaxInt32 {
+		return nil, fmt.Errorf("GID %d is too large to convert to int32", gid)
+	}
+
+	m.userManagementMu.Lock()
+	defer m.userManagementMu.Unlock()
+
+	// Call lckpwdf to avoid race conditions with other processes which add GIDs
+	err = userslocking.WriteLock()
+	if err != nil {
+		return nil, err
+	}
+	defer func() { err = errors.Join(err, userslocking.WriteUnlock()) }()
+
+	// Check if the group already has the given GID
+	oldGroup, err := m.db.GroupByName(name)
+	if err != nil {
+		return nil, err
+	}
+	if oldGroup.GID == gid {
+		warning := fmt.Sprintf("Group '%s' already has GID %d.", name, gid)
+		log.Info(context.Background(), warning)
+		resp.Warnings = append(resp.Warnings, warning)
+		return resp, nil
+	}
+
+	// Check if another group already has the given GID
+	_, err = user.LookupGroupId(strconv.FormatUint(uint64(gid), 10))
+	var userErr user.UnknownGroupIdError
+	if err != nil && !errors.As(err, &userErr) {
+		// Unexpected error
+		return nil, err
+	}
+	if err == nil {
+		return nil, fmt.Errorf("GID %d already exists", gid)
+	}
+
+	userRows, err := m.db.SetGroupID(name, gid)
+	if err != nil {
+		return nil, err
+	}
+	resp.IDChanged = true
+
+	for _, userRow := range userRows {
+		changed, warning, updateErr := m.updateUserHomeDirOwnership(userRow, oldGroup.GID, gid)
+		if updateErr != nil {
+			err = errors.Join(err, updateErr)
+		}
+		if warning != "" {
+			resp.Warnings = append(resp.Warnings, warning)
+		}
+		resp.HomeDirOwnerChanged = changed
+	}
+
+	return resp, err
+}
+
+func (m *Manager) updateUserHomeDirOwnership(userRow db.UserRow, oldGID uint32, newGID uint32) (changed bool, warning string, err error) {
+	// Check if the home directory is currently owned by the group
+	_, homeGID, err := getHomeDirOwner(userRow.Dir)
+	if err != nil && !errors.Is(err, os.ErrNotExist) {
+		warning := fmt.Sprintf("Could not get owner of home directory '%s' for user '%s'.", userRow.Dir, userRow.Name)
+		log.Warningf(context.Background(), "%s: %v", warning, err)
+		return false, warning, nil
+	}
+	if errors.Is(err, os.ErrNotExist) {
+		// The home directory does not exist, so we don't need to change the owner.
+		log.Debugf(context.Background(), "Home directory %q for user %q does not exist, skipping ownership change", userRow.Dir, userRow.Name)
+		return false, "", nil
+	}
+
+	if homeGID != oldGID {
+		warning := fmt.Sprintf("Not updating ownership of home directory '%s' because it is not owned by GID %d (current owner: %d).", userRow.Dir, oldGID, homeGID)
+		log.Warning(context.Background(), warning)
+		return false, warning, nil
+	}
+
+	// Change the ownership of all files in the home directory from the old GID to the new GID.
+	log.Debugf(context.Background(), "Changing ownership of home directory %q from GID %d to GID %d", userRow.Dir, oldGID, newGID)
+	err = fileutils.ChownRecursiveFrom(
+		userRow.Dir,
+		nil,
+		&fileutils.ChownGIDArgs{FromGID: oldGID, ToGID: newGID},
+	)
+	if err != nil {
+		return false, "", err
+	}
+
+	return true, "", nil
+}
+
 // checkGroupNameConflict checks if a group with the given name already exists.
 // If it does, it checks if it has the same UGID.
 func (m *Manager) checkGroupNameConflict(name string, ugid string) error {
@@ -248,14 +590,8 @@ func (m *Manager) checkGroupNameConflict(name string, ugid string) error {
 	}
 
 	if errors.Is(err, db.NoDataFoundError{}) {
-		// The group does not exist in the database, check if it exists on the system.
-		existingGroup, err := user.LookupGroup(name)
-		var unknownGroupErr user.UnknownGroupError
-		if !errors.As(err, &unknownGroupErr) {
-			log.Errorf(context.Background(), "Group already exists on the system: %+v", existingGroup)
-			return fmt.Errorf("group %q already exists on the system (but not in this authd instance)", name)
-		}
-		// The group does not exist on the system, so we can proceed.
+		// The group does not exist in the database, the check in the system
+		// can be delayed to the registration point.
 		return nil
 	}
 
@@ -288,10 +624,24 @@ func (m *Manager) findGroup(group types.GroupInfo) (oldGroup db.GroupRow, err er
 	return m.db.GroupByName(group.Name)
 }
 
-// checkHomeDirOwnership checks if the home directory of the user is owned by the user and the user's group.
-// If not, it logs a warning.
-func checkHomeDirOwnership(home string, uid, gid uint32) error {
+func getHomeDirOwner(home string) (uid uint32, gid uint32, err error) {
 	fileInfo, err := os.Stat(home)
+	if err != nil {
+		return 0, 0, err
+	}
+
+	sys, ok := fileInfo.Sys().(*syscall.Stat_t)
+	if !ok {
+		return 0, 0, errors.New("failed to get file info")
+	}
+
+	return sys.Uid, sys.Gid, nil
+}
+
+// checkHomeDirOwner checks if the home directory of the user is owned by the user and the user's group.
+// If not, it logs a warning.
+func checkHomeDirOwner(home string, uid, gid uint32) error {
+	oldUID, oldGID, err := getHomeDirOwner(home)
 	if err != nil && !errors.Is(err, os.ErrNotExist) {
 		return err
 	}
@@ -300,12 +650,6 @@ func checkHomeDirOwnership(home string, uid, gid uint32) error {
 		return nil
 	}
 
-	sys, ok := fileInfo.Sys().(*syscall.Stat_t)
-	if !ok {
-		return errors.New("failed to get file info")
-	}
-	oldUID, oldGID := sys.Uid, sys.Gid
-
 	// Check if the home directory is owned by the user.
 	if oldUID != uid && oldGID != gid {
 		log.Warningf(context.Background(), "Home directory %q is not owned by UID %d and GID %d. To fix this, run `sudo chown -R %d:%d %q`.", home, uid, gid, uid, gid, home)
@@ -324,10 +668,6 @@ func checkHomeDirOwnership(home string, uid, gid uint32) error {
 // BrokerForUser returns the broker ID for the given user.
 func (m *Manager) BrokerForUser(username string) (string, error) {
 	u, err := m.db.UserByName(username)
-	if err != nil && errors.Is(err, db.NoDataFoundError{}) {
-		// User not in db.
-		return "", NoDataFoundError{}
-	}
 	if err != nil {
 		return "", err
 	}
@@ -344,13 +684,37 @@ func (m *Manager) UpdateBrokerForUser(username, brokerID string) error {
 	return nil
 }
 
+// LockUser sets the "locked" field to true for the given user.
+func (m *Manager) LockUser(username string) error {
+	if err := m.db.UpdateLockedFieldForUser(username, true); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+// UnlockUser sets the "locked" field to false for the given user.
+func (m *Manager) UnlockUser(username string) error {
+	if err := m.db.UpdateLockedFieldForUser(username, false); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+// IsUserLocked returns true if the user with the given user name is locked, false otherwise.
+func (m *Manager) IsUserLocked(username string) (bool, error) {
+	u, err := m.db.UserByName(username)
+	if err != nil {
+		return false, err
+	}
+
+	return u.Locked, nil
+}
+
 // UserByName returns the user information for the given user name.
 func (m *Manager) UserByName(username string) (types.UserEntry, error) {
 	usr, err := m.db.UserByName(username)
-	if errors.Is(err, db.NoDataFoundError{}) {
-		// Check if the user is a temporary user.
-		return m.temporaryRecords.UserByName(username)
-	}
 	if err != nil {
 		return types.UserEntry{}, err
 	}
@@ -362,7 +726,7 @@ func (m *Manager) UserByID(uid uint32) (types.UserEntry, error) {
 	usr, err := m.db.UserByID(uid)
 	if errors.Is(err, db.NoDataFoundError{}) {
 		// Check if the user is a temporary user.
-		return m.temporaryRecords.UserByID(uid)
+		return m.preAuthRecords.UserByID(uid)
 	}
 	if err != nil {
 		return types.UserEntry{}, err
@@ -386,13 +750,33 @@ func (m *Manager) AllUsers() ([]types.UserEntry, error) {
 	return usrEntries, err
 }
 
+// UsedUIDs returns all user IDs, including the UIDs of temporary pre-auth users.
+func (m *Manager) UsedUIDs() ([]uint32, error) {
+	var uids []uint32
+
+	usrEntries, err := m.AllUsers()
+	if err != nil {
+		return nil, err
+	}
+	for _, usr := range usrEntries {
+		uids = append(uids, usr.UID)
+	}
+
+	// Add temporary users from the pre-auth records.
+	tempUsers, err := m.preAuthRecords.AllUsers()
+	if err != nil {
+		return nil, fmt.Errorf("failed to get temporary users: %w", err)
+	}
+	for _, tempUser := range tempUsers {
+		uids = append(uids, tempUser.UID)
+	}
+
+	return uids, nil
+}
+
 // GroupByName returns the group information for the given group name.
 func (m *Manager) GroupByName(groupname string) (types.GroupEntry, error) {
 	grp, err := m.db.GroupWithMembersByName(groupname)
-	if errors.Is(err, db.NoDataFoundError{}) {
-		// Check if the group is a temporary group.
-		return m.temporaryRecords.GroupByName(groupname)
-	}
 	if err != nil {
 		return types.GroupEntry{}, err
 	}
@@ -403,8 +787,8 @@ func (m *Manager) GroupByName(groupname string) (types.GroupEntry, error) {
 func (m *Manager) GroupByID(gid uint32) (types.GroupEntry, error) {
 	grp, err := m.db.GroupWithMembersByID(gid)
 	if errors.Is(err, db.NoDataFoundError{}) {
-		// Check if the group is a temporary group.
-		return m.temporaryRecords.GroupByID(gid)
+		// Check if the ID will be the private-group of a temporary user.
+		return m.preAuthRecords.GroupByID(gid)
 	}
 	if err != nil {
 		return types.GroupEntry{}, err
@@ -427,6 +811,38 @@ func (m *Manager) AllGroups() ([]types.GroupEntry, error) {
 	return grpEntries, nil
 }
 
+// UsedGIDs returns all group IDs, including the GIDs of temporary pre-auth users.
+func (m *Manager) UsedGIDs() ([]uint32, error) {
+	var gids []uint32
+
+	grpEntries, err := m.AllGroups()
+	if err != nil {
+		return nil, err
+	}
+	for _, g := range grpEntries {
+		gids = append(gids, g.GID)
+	}
+
+	allUsers, err := m.AllUsers()
+	if err != nil {
+		return nil, err
+	}
+	for _, u := range allUsers {
+		gids = append(gids, u.GID)
+	}
+
+	// Add temporary groups from the pre-auth records.
+	tempUsers, err := m.preAuthRecords.AllUsers()
+	if err != nil {
+		return nil, fmt.Errorf("failed to get temporary groups: %w", err)
+	}
+	for _, tu := range tempUsers {
+		gids = append(gids, tu.GID)
+	}
+
+	return gids, nil
+}
+
 // ShadowByName returns the shadow information for the given user name.
 func (m *Manager) ShadowByName(username string) (types.ShadowEntry, error) {
 	usr, err := m.db.UserByName(username)
@@ -453,6 +869,59 @@ func (m *Manager) AllShadows() ([]types.ShadowEntry, error) {
 // RegisterUserPreAuth registers a temporary user with a unique UID in our NSS handler (in memory, not in the database).
 //
 // The temporary user record is removed when UpdateUser is called with the same username.
-func (m *Manager) RegisterUserPreAuth(name string) (uint32, error) {
-	return m.temporaryRecords.RegisterPreAuthUser(name)
+func (m *Manager) RegisterUserPreAuth(name string) (uid uint32, err error) {
+	defer decorate.OnError(&err, "failed to register pre-auth user %q", name)
+
+	// Do a first check without the lock, so that if the user is already there
+	// we don't have to go through actual locking.
+	if userRow, err := m.db.UserByName(name); err == nil {
+		log.Debugf(context.Background(), "user %q already exists on the system", name)
+		return userRow.UID, nil
+	}
+
+	m.userManagementMu.Lock()
+	defer m.userManagementMu.Unlock()
+
+	// Repeat the check once locked, so that we are really sure that the user
+	// has not been registered meanwhile.
+	if userRow, err := m.db.UserByName(name); err == nil {
+		log.Debugf(context.Background(), "user %q already exists on the system", name)
+		return userRow.UID, nil
+	}
+
+	user, err := m.preAuthRecords.UserByLogin(name)
+	if err == nil {
+		log.Debugf(context.Background(), "user %q already pre-authenticated", name)
+		return user.UID, nil
+	}
+	if err != nil && !errors.Is(err, tempentries.NoDataFoundError{}) {
+		return 0, err
+	}
+
+	lockedEntries, unlockEntries, err := localentries.WithUserDBLock()
+	if err != nil {
+		return 0, err
+	}
+	defer func() { err = errors.Join(err, unlockEntries()) }()
+
+	unique, err := lockedEntries.IsUniqueUserName(name)
+	if err != nil {
+		return 0, err
+	}
+	if !unique {
+		return 0, fmt.Errorf("another system user exists with %q name", name)
+	}
+
+	uid, cleanupUID, err := m.idGenerator.GenerateUID(lockedEntries, m)
+	if err != nil {
+		return 0, err
+	}
+	defer cleanupUID()
+
+	if err := m.preAuthRecords.RegisterPreAuthUser(name, uid); err != nil {
+		return 0, err
+	}
+
+	log.Debugf(context.Background(), "Using new UID %d for temporary user %q", uid, name)
+	return uid, nil
 }
diff --git a/internal/users/manager_bwrap_test.go b/internal/users/manager_bwrap_test.go
new file mode 100644
index 0000000000..db43b3520d
--- /dev/null
+++ b/internal/users/manager_bwrap_test.go
@@ -0,0 +1,461 @@
+package users_test
+
+import (
+	"context"
+	"fmt"
+	"math"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"regexp"
+	"strconv"
+	"testing"
+
+	"github.com/canonical/authd/internal/fileutils"
+	"github.com/canonical/authd/internal/testutils"
+	"github.com/canonical/authd/internal/testutils/golden"
+	"github.com/canonical/authd/internal/users"
+	"github.com/canonical/authd/internal/users/db"
+	"github.com/canonical/authd/log"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestSetUserID(t *testing.T) {
+	t.Parallel()
+
+	tests := map[string]struct {
+		nonExistentUser                  bool
+		emptyUsername                    bool
+		uidAlreadySet                    bool
+		uidAlreadyInUseByAuthdUser       bool
+		uidAlreadyInUseAsGIDofAuthdUser  bool
+		uidAlreadyInUseBySystemUser      bool
+		uidAlreadyInUseAsGIDofSystemUser bool
+		uidTooLarge                      bool
+		homeDirDoesNotExist              bool
+		homeDirOwnedByOtherUser          bool
+		homeDirCannotBeAccessed          bool
+		homeDirOwnerCannotBeChanged      bool
+
+		wantErr                 bool
+		wantErrType             error
+		wantIDChanged           bool
+		wantHomeDirOwnerChanged bool
+		wantWarnings            int
+	}{
+		"Successfully_set_UID": {
+			wantIDChanged: true, wantHomeDirOwnerChanged: true,
+		},
+		"Successfully_set_UID_if_ID_is_already_in_use_as_GID_of_system_user": {
+			uidAlreadyInUseAsGIDofSystemUser: true, wantIDChanged: true, wantHomeDirOwnerChanged: true,
+		},
+		"Successfully_set_UID_if_ID_is_already_in_use_as_GID_of_authd_user": {
+			uidAlreadyInUseAsGIDofAuthdUser: true, wantIDChanged: true, wantHomeDirOwnerChanged: true,
+		},
+		"Successfully_set_UID_when_home_directory_does_not_exist": {
+			homeDirDoesNotExist: true, wantIDChanged: true,
+		},
+
+		"Warning_if_user_already_has_given_UID": {
+			uidAlreadySet: true, wantWarnings: 1,
+		},
+		"Warning_if_home_directory_is_owned_by_other_user": {
+			homeDirOwnedByOtherUser: true, wantWarnings: 1, wantIDChanged: true,
+		},
+		"Warning_if_home_directory_cannot_be_accessed": {
+			homeDirCannotBeAccessed: true, wantWarnings: 1, wantIDChanged: true,
+		},
+
+		"Error_if_username_is_empty":               {emptyUsername: true, wantErr: true},
+		"Error_if_user_does_not_exist":             {nonExistentUser: true, wantErrType: db.NoDataFoundError{}},
+		"Error_if_UID_is_already_in_use_by_authd":  {uidAlreadyInUseByAuthdUser: true, wantErr: true},
+		"Error_if_UID_is_already_in_use_by_system": {uidAlreadyInUseBySystemUser: true, wantErr: true},
+		"Error_if_UID_is_too_large":                {uidTooLarge: true, wantErr: true},
+		"Error_if_home_directory_owner_cannot_be_changed": {
+			homeDirOwnerCannotBeChanged: true, wantErr: true, wantIDChanged: true,
+		},
+	}
+	for name, tc := range tests {
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			if !testutils.RunningInBubblewrap() {
+				testutils.RunTestInBubbleWrap(t)
+				return
+			}
+
+			dbDir := t.TempDir()
+			err := db.Z_ForTests_CreateDBFromYAML(filepath.Join("testdata", "db", "multiple_users_and_groups.db.yaml"), dbDir)
+			require.NoError(t, err, "Setup: could not create database from testdata")
+
+			m := newManagerForTests(t, dbDir)
+
+			username := "user1@example.com"
+			if tc.nonExistentUser {
+				username = "nonexistent"
+			} else if tc.emptyUsername {
+				username = ""
+			} else if !tc.homeDirDoesNotExist {
+				uid := 1111
+				gid := 11111
+				if tc.homeDirOwnedByOtherUser {
+					uid = 2222
+				}
+				home := createTemporaryHome(t, uid, gid, tc.homeDirCannotBeAccessed, tc.homeDirOwnerCannotBeChanged)
+				setHome(t, m, username, home)
+			}
+
+			newUID := 54321
+			if tc.uidTooLarge {
+				newUID = math.MaxInt32 + 1
+			}
+
+			if tc.uidAlreadySet {
+				setUID(t, m, username, newUID)
+			}
+			if tc.uidAlreadyInUseByAuthdUser {
+				setUID(t, m, "user2@example.com", newUID)
+			}
+			if tc.uidAlreadyInUseAsGIDofAuthdUser {
+				newUID = 22222
+			}
+			if tc.uidAlreadyInUseBySystemUser {
+				addUserToSystem(t, newUID)
+			}
+			if tc.uidAlreadyInUseAsGIDofSystemUser {
+				addGroupToSystem(t, newUID)
+			}
+
+			resp, err := m.SetUserID(username, uint32(newUID))
+			log.Infof(context.Background(), "SetUserID error: %v", err)
+			log.Infof(context.Background(), "SetUserID resp: %v", resp)
+
+			if resp != nil {
+				assert.Equal(t, tc.wantIDChanged, resp.IDChanged, "Unexpected IDChanged")
+				assert.Equal(t, tc.wantHomeDirOwnerChanged, resp.HomeDirOwnerChanged, "Unexpected HomeDirOwnerChanged")
+			}
+
+			if tc.wantErrType != nil {
+				require.ErrorIs(t, err, tc.wantErrType, "SetUserID should return expected error")
+				return
+			}
+			if tc.wantErr {
+				require.Error(t, err, "SetUserID should return an error but didn't")
+				return
+			}
+			require.NoError(t, err, "SetUserID should not return an error")
+			require.NotNil(t, resp, "SetUserID should return a response")
+			require.Len(t, resp.Warnings, tc.wantWarnings, "Unexpected number of warnings")
+
+			yamlData, err := db.Z_ForTests_DumpNormalizedYAML(m.DB())
+			require.NoError(t, err)
+			golden.CheckOrUpdate(t, yamlData, golden.WithPath("db"))
+
+			// To make the tests deterministic, we replace the temporary home directory path with a placeholder
+			for i, w := range resp.Warnings {
+				if regexp.MustCompile(`Could not get owner of home directory '([^"]+)'`).MatchString(w) {
+					resp.Warnings[i] = `Could not get owner of home directory '{{HOME}}'`
+				}
+				if regexp.MustCompile(`Not updating ownership of home directory '([^"]+)' because it is not owned by UID \d+ \(current owner: \d+\)`).MatchString(w) {
+					resp.Warnings[i] = `Not updating ownership of home directory '{{HOME}}' because it is not owned by UID {{UID}} (current owner: {{CURR_UID}})`
+				}
+			}
+
+			golden.CheckOrUpdateYAML(t, resp, golden.WithPath("response"))
+		})
+	}
+}
+
+func TestSetGroupID(t *testing.T) {
+	t.Parallel()
+
+	tests := map[string]struct {
+		nonExistentGroup                 bool
+		emptyGroupname                   bool
+		gidAlreadySet                    bool
+		gidAlreadyInUseByAuthdGroup      bool
+		gidAlreadyInUseAsUIDofAuthdUser  bool
+		gidAlreadyInUseBySystemGroup     bool
+		gidAlreadyInUseAsUIDofSystemUser bool
+		gidIsPrimaryGroupOfMultipleUsers bool
+		gidIsNotPrimaryGroupOfAnyUser    bool
+		gidTooLarge                      bool
+		homeDirDoesNotExist              bool
+		homeDirOwnedByOtherGroup         bool
+		homeDirCannotBeAccessed          bool
+		homeDirOwnerCannotBeChanged      bool
+
+		wantErr                 bool
+		wantErrType             error
+		wantIDChanged           bool
+		wantHomeDirOwnerChanged bool
+		wantWarnings            int
+	}{
+		"Successfully_set_GID": {
+			wantIDChanged: true, wantHomeDirOwnerChanged: true,
+		},
+		"Successfully_set_GID_if_ID_is_already_in_use_as_UID_of_system_user": {
+			gidAlreadyInUseAsUIDofSystemUser: true, wantIDChanged: true, wantHomeDirOwnerChanged: true,
+		},
+		"Successfully_set_GID_if_ID_is_already_in_use_as_UID_of_authd_user": {
+			gidAlreadyInUseAsUIDofAuthdUser: true, wantIDChanged: true, wantHomeDirOwnerChanged: true,
+		},
+		"Successfully_set_GID_when_home_directory_does_not_exist": {
+			homeDirDoesNotExist: true, wantIDChanged: true,
+		},
+		"Successfully_set_GID_when_group_is_not_primary_group_of_any_user": {
+			gidIsNotPrimaryGroupOfAnyUser: true, wantIDChanged: true,
+		},
+		"Primary_groups_of_multiple_users_are_updated": {
+			gidIsPrimaryGroupOfMultipleUsers: true, wantIDChanged: true, wantHomeDirOwnerChanged: true,
+		},
+
+		"Warning_if_group_already_has_given_GID": {gidAlreadySet: true, wantWarnings: 1},
+		"Warning_if_home_directory_is_owned_by_other_group": {
+			homeDirOwnedByOtherGroup: true, wantWarnings: 1, wantIDChanged: true,
+		},
+		"Warning_if_home_directory_cannot_be_accessed": {
+			homeDirCannotBeAccessed: true, wantWarnings: 1, wantIDChanged: true,
+		},
+
+		"Error_if_groupname_is_empty":              {emptyGroupname: true, wantErr: true},
+		"Error_if_group_does_not_exist":            {nonExistentGroup: true, wantErrType: db.NoDataFoundError{}},
+		"Error_if_GID_is_already_in_use_by_authd":  {gidAlreadyInUseByAuthdGroup: true, wantErr: true},
+		"Error_if_GID_is_already_in_use_by_system": {gidAlreadyInUseBySystemGroup: true, wantErr: true},
+		"Error_if_GID_is_too_large":                {gidTooLarge: true, wantErr: true},
+		"Error_if_home_directory_owner_cannot_be_changed": {
+			homeDirOwnerCannotBeChanged: true, wantErr: true, wantIDChanged: true,
+		},
+	}
+	for name, tc := range tests {
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			if !testutils.RunningInBubblewrap() {
+				testutils.RunTestInBubbleWrap(t)
+				return
+			}
+
+			dbDir := t.TempDir()
+			err := db.Z_ForTests_CreateDBFromYAML(filepath.Join("testdata", "db", "multiple_users_and_groups.db.yaml"), dbDir)
+			require.NoError(t, err, "Setup: could not create database from testdata")
+
+			m := newManagerForTests(t, dbDir)
+
+			groupname := "group1"
+			if tc.nonExistentGroup {
+				groupname = "nonexistent"
+			} else if tc.emptyGroupname {
+				groupname = ""
+			} else if !tc.homeDirDoesNotExist {
+				uid := 1111
+				gid := 11111
+				if tc.homeDirOwnedByOtherGroup {
+					gid = 2222
+				}
+				home := createTemporaryHome(t, uid, gid, tc.homeDirCannotBeAccessed, tc.homeDirOwnerCannotBeChanged)
+				setHome(t, m, "user1@example.com", home)
+			}
+
+			newGID := 54321
+			if tc.gidTooLarge {
+				newGID = math.MaxInt32 + 1
+			}
+
+			if tc.gidAlreadySet {
+				setGID(t, m, groupname, newGID)
+			}
+			if tc.gidAlreadyInUseByAuthdGroup {
+				setGID(t, m, "group3", newGID)
+			}
+			if tc.gidAlreadyInUseAsUIDofAuthdUser {
+				setUID(t, m, "user2@example.com", newGID)
+			}
+			if tc.gidAlreadyInUseBySystemGroup {
+				addGroupToSystem(t, newGID)
+			}
+			if tc.gidAlreadyInUseAsUIDofSystemUser {
+				addUserToSystem(t, newGID)
+			}
+			if tc.gidIsNotPrimaryGroupOfAnyUser {
+				// Change the primary group of "user1@example.com" to another group
+				setPrimaryGroup(t, m, "user1@example.com", 22222)
+			}
+			if tc.gidIsPrimaryGroupOfMultipleUsers {
+				// Change the primary group of "user2@example.com" to the group we want to change
+				setPrimaryGroup(t, m, "user2@example.com", 11111)
+			}
+
+			resp, err := m.SetGroupID(groupname, uint32(newGID))
+			log.Infof(context.Background(), "SetGroupID error: %v", err)
+			log.Infof(context.Background(), "SetGroupID resp: %v", resp)
+
+			if resp != nil {
+				assert.Equal(t, tc.wantIDChanged, resp.IDChanged, "Unexpected IDChanged")
+				assert.Equal(t, tc.wantHomeDirOwnerChanged, resp.HomeDirOwnerChanged, "Unexpected HomeDirOwnerChanged")
+			}
+
+			if tc.wantErrType != nil {
+				require.ErrorIs(t, err, tc.wantErrType, "SetGroupID should return expected error")
+				return
+			}
+			if tc.wantErr {
+				require.Error(t, err, "SetGroupID should return an error but didn't")
+				return
+			}
+			require.NoError(t, err, "SetGroupID should not return an error")
+			require.NotNil(t, resp, "SetGroupID should return a response")
+			require.Len(t, resp.Warnings, tc.wantWarnings, "Unexpected number of warnings")
+
+			yamlData, err := db.Z_ForTests_DumpNormalizedYAML(m.DB())
+			require.NoError(t, err)
+			golden.CheckOrUpdate(t, yamlData, golden.WithPath("db"))
+
+			// To make the tests deterministic, we replace the temporary home directory path with a placeholder
+			for i, w := range resp.Warnings {
+				if regexp.MustCompile(`Could not get owner of home directory '([^"]+)'.`).MatchString(w) {
+					resp.Warnings[i] = `Could not get owner of home directory '{{HOME}}'.`
+				}
+				if regexp.MustCompile(`Not updating ownership of home directory '([^"]+)' because it is not owned by GID \d+ \(current owner: \d+\).`).MatchString(w) {
+					resp.Warnings[i] = `Not updating ownership of home directory '{{HOME}}' because it is not owned by GID {{GID}} (current owner: {{CURR_GID}}).`
+				}
+			}
+
+			golden.CheckOrUpdateYAML(t, resp, golden.WithPath("response"))
+		})
+	}
+}
+
+// createTemporaryHome creates a temporary home directory for the given user.
+func createTemporaryHome(t *testing.T, uid, gid int, inaccessible, cannotBeChanged bool) string {
+	t.Helper()
+
+	// We use a deterministic path (/tmp/home) here because the home directory
+	// is stored in the database which we dump to a golden file, so we would
+	// have to replace the path in the golden file to make it deterministic.
+	// It's simpler to just use a deterministic path here.
+	parentDir := filepath.Join(os.TempDir(), "home")
+	home := filepath.Join(parentDir, fmt.Sprintf("user-%d", uid))
+
+	if inaccessible {
+		// Create the parent directory as a file, so that the home directory cannot be accessed.
+		err := fileutils.Touch(parentDir)
+		require.NoError(t, err, "Setup: could not create temporary file")
+		return home
+	}
+
+	err := os.MkdirAll(parentDir, 0700)
+	require.NoError(t, err, "Setup: could not create parent directory for home")
+
+	if cannotBeChanged {
+		//nolint:gosec // G204 we want to use exec.Command with variables here
+		cmd := exec.Command("mount", "-t", "tmpfs", "tmpfs", parentDir)
+		cmd.Stdout = t.Output()
+		cmd.Stderr = t.Output()
+		err := cmd.Run()
+		require.NoError(t, err, "Setup: could not mount tmpfs")
+	}
+
+	// Create the home directory and chown it to the user
+	err = os.MkdirAll(home, 0700)
+	require.NoError(t, err, "Setup: could not create home directory")
+
+	err = os.Chown(home, uid, gid)
+	require.NoError(t, err, "Setup: could not chown home directory")
+
+	if cannotBeChanged {
+		//nolint:gosec // G204 we want to use exec.Command with variables here
+		cmd := exec.Command("mount", "-o", "remount,ro", parentDir, parentDir)
+		cmd.Stdout = t.Output()
+		cmd.Stderr = t.Output()
+		err = cmd.Run()
+		require.NoError(t, err, "Setup: could not remount tmpfs read-only")
+	}
+
+	return home
+}
+
+// setHome updates the home directory of the given user.
+func setHome(t *testing.T, m *users.Manager, username string, home string) {
+	t.Helper()
+
+	u, err := m.DB().UserByName(username)
+	require.NoError(t, err, "Setup: could not get user by ID")
+
+	// UpdateUserEntry doesn't update the home directory if the user already exists
+	// and has a non-empty home directory set. We need to delete the user first.
+	err = m.DB().DeleteUser(u.UID)
+	require.NoError(t, err, "Setup: could not delete user")
+
+	// Set the new home directory
+	u.Dir = home
+
+	// Re-add the user with the new home directory
+	err = m.DB().UpdateUserEntry(u, nil, nil)
+	require.NoError(t, err, "Setup: could not update user")
+}
+
+func setUID(t *testing.T, m *users.Manager, username string, uid int) {
+	t.Helper()
+
+	if uid < 0 || uid > math.MaxUint32 {
+		require.Fail(t, "Setup: invalid UID %d", uid)
+	}
+	//nolint:gosec // G115 - bounds-checked above: uid is in [0, MaxUint32].
+	err := m.DB().SetUserID(username, uint32(uid))
+	require.NoError(t, err, "Setup: could not set user ID")
+}
+
+func setGID(t *testing.T, m *users.Manager, groupname string, gid int) {
+	t.Helper()
+
+	if gid < 0 || gid > math.MaxUint32 {
+		require.Fail(t, "Setup: invalid GID %d", gid)
+	}
+
+	//nolint:gosec // G115 - bounds-checked above: gid is in [0, MaxUint32].
+	_, err := m.DB().SetGroupID(groupname, uint32(gid))
+	require.NoError(t, err, "Setup: could not set group ID")
+}
+
+// setPrimaryGroup updates the primary group of the given user.
+func setPrimaryGroup(t *testing.T, m *users.Manager, username string, gid uint32) {
+	t.Helper()
+
+	u, err := m.DB().UserByName(username)
+	require.NoError(t, err, "Setup: could not get user by ID")
+
+	u.GID = gid
+
+	err = m.DB().UpdateUserEntry(u, nil, nil)
+	require.NoError(t, err, "Setup: could not update user")
+}
+
+func addUserToSystem(t *testing.T, uid int) {
+	t.Helper()
+
+	//nolint:gosec // G204 we want to use exec.Command with variables here
+	cmd := exec.Command(
+		"useradd",
+		"--uid", strconv.Itoa(uid),
+		"--gid", "0",
+		"--no-create-home",
+		fmt.Sprintf("test-%d", uid),
+	)
+	output, err := cmd.CombinedOutput()
+	require.NoError(t, err, "Setup: useradd failed: %s", output)
+}
+
+func addGroupToSystem(t *testing.T, gid int) {
+	t.Helper()
+
+	//nolint:gosec // G204 we want to use exec.Command with variables here
+	cmd := exec.Command(
+		"groupadd",
+		"--gid", strconv.Itoa(gid),
+		fmt.Sprintf("test-%d", gid),
+	)
+	output, err := cmd.CombinedOutput()
+	require.NoError(t, err, "Setup: groupadd failed: %s", output)
+}
diff --git a/internal/users/manager_test.go b/internal/users/manager_test.go
index 1fdafce3b9..217e79c6a5 100644
--- a/internal/users/manager_test.go
+++ b/internal/users/manager_test.go
@@ -2,20 +2,31 @@ package users_test
 
 import (
 	"context"
+	"fmt"
+	"math"
 	"os"
 	"path/filepath"
+	"slices"
+	"strings"
+	"sync"
+	"sync/atomic"
 	"testing"
-
+	"time"
+
+	"github.com/canonical/authd/internal/consts"
+	"github.com/canonical/authd/internal/testutils"
+	"github.com/canonical/authd/internal/testutils/golden"
+	"github.com/canonical/authd/internal/users"
+	"github.com/canonical/authd/internal/users/db"
+	"github.com/canonical/authd/internal/users/localentries"
+	localgroupstestutils "github.com/canonical/authd/internal/users/localentries/testutils"
+	userslocking "github.com/canonical/authd/internal/users/locking"
+	"github.com/canonical/authd/internal/users/tempentries"
+	userstestutils "github.com/canonical/authd/internal/users/testutils"
+	"github.com/canonical/authd/internal/users/types"
+	"github.com/canonical/authd/log"
 	"github.com/stretchr/testify/require"
-	"github.com/ubuntu/authd/internal/consts"
-	"github.com/ubuntu/authd/internal/testutils/golden"
-	"github.com/ubuntu/authd/internal/users"
-	"github.com/ubuntu/authd/internal/users/db"
-	"github.com/ubuntu/authd/internal/users/idgenerator"
-	localgroupstestutils "github.com/ubuntu/authd/internal/users/localentries/testutils"
-	userstestutils "github.com/ubuntu/authd/internal/users/testutils"
-	"github.com/ubuntu/authd/internal/users/types"
-	"github.com/ubuntu/authd/log"
+	"gopkg.in/yaml.v3"
 )
 
 func TestNewManager(t *testing.T) {
@@ -29,19 +40,31 @@ func TestNewManager(t *testing.T) {
 
 		wantErr bool
 	}{
-		"Successfully_create_manager_with_default_config": {},
-		"Successfully_create_manager_with_custom_config":  {uidMin: 10000, uidMax: 20000, gidMin: 10000, gidMax: 20000},
+		"Successfully_create_manager_with_default_config":                           {},
+		"Successfully_create_manager_with_custom_config":                            {uidMin: 10000, uidMax: 20000, gidMin: 10000, gidMax: 20000},
+		"Successfully_create_manager_with_UID_range_next_to_systemd_dynamic_users":  {uidMin: users.SystemdDynamicUIDMax + 1, uidMax: users.SystemdDynamicUIDMax + 10000},
+		"Successfully_create_manager_with_GID_range_next_to_systemd_dynamic_groups": {gidMin: users.SystemdDynamicUIDMin - 1000, gidMax: users.SystemdDynamicUIDMin - 1},
+
+		"Warns_creating_manager_with_partially_invalid_UID_ranges": {uidMin: 1, uidMax: 20000},
+		"Warns_creating_manager_with_partially_invalid_GID_ranges": {gidMin: 1, gidMax: 20000},
 
 		// Corrupted databases
-		"Error_when_database_is_corrupted":     {corruptedDbFile: true, wantErr: true},
-		"Error_if_dbDir_does_not_exist":        {dbFile: "-", wantErr: true},
-		"Error_if_UID_MIN_is_equal_to_UID_MAX": {uidMin: 1000, uidMax: 1000, wantErr: true},
-		"Error_if_GID_MIN_is_equal_to_GID_MAX": {gidMin: 1000, gidMax: 1000, wantErr: true},
-		"Error_if_UID_range_is_too_small":      {uidMin: 1000, uidMax: 2000, wantErr: true},
+		"Error_when_database_is_corrupted": {corruptedDbFile: true, wantErr: true},
+		"Error_if_dbDir_does_not_exist":    {dbFile: "-", wantErr: true},
+
+		// Invalid UIDs/GIDs ranges
+		"Error_if_UID_MIN_is_equal_to_UID_MAX":                    {uidMin: 1000, uidMax: 1000, wantErr: true},
+		"Error_if_GID_MIN_is_equal_to_GID_MAX":                    {gidMin: 1000, gidMax: 1000, wantErr: true},
+		"Error_if_UID_range_is_too_small":                         {uidMin: 1000, uidMax: 2000, wantErr: true},
+		"Error_if_UID_range_overlaps_with_systemd_dynamic_users":  {uidMin: users.SystemdDynamicUIDMin, uidMax: users.SystemdDynamicUIDMax, wantErr: true},
+		"Error_if_GID_range_overlaps_with_systemd_dynamic_groups": {gidMin: users.SystemdDynamicUIDMin, gidMax: users.SystemdDynamicUIDMax, wantErr: true},
+		"Error_if_UID_range_is_larger_than_max_signed_int32":      {uidMin: 0, uidMax: math.MaxInt32 + 1, wantErr: true},
+		"Error_if_GID_range_is_larger_than_max_signed_int32":      {gidMin: 0, gidMax: math.MaxInt32 + 1, wantErr: true},
 	}
 	for name, tc := range tests {
 		t.Run(name, func(t *testing.T) {
-			destCmdsFile := localgroupstestutils.SetupGPasswdMock(t, filepath.Join("testdata", "groups", "users_in_groups.group"))
+			destGroupFile := localgroupstestutils.SetupGroupMock(t,
+				filepath.Join("testdata", "groups", "users_in_groups.group"))
 
 			dbDir := t.TempDir()
 			if tc.dbFile == "" {
@@ -75,17 +98,29 @@ func TestNewManager(t *testing.T) {
 
 			m, err := users.NewManager(config, dbDir)
 			if tc.wantErr {
+				t.Logf("Manager creation exited with %v", err)
 				require.Error(t, err, "NewManager should return an error, but did not")
 				return
 			}
 			require.NoError(t, err, "NewManager should not return an error, but did")
 
-			got, err := db.Z_ForTests_DumpNormalizedYAML(userstestutils.GetManagerDB(m))
+			got, err := db.Z_ForTests_DumpNormalizedYAML(userstestutils.DBManager(m))
 			require.NoError(t, err, "Created database should be valid yaml content")
 
 			golden.CheckOrUpdate(t, got)
 
-			localgroupstestutils.RequireGPasswdOutput(t, destCmdsFile, golden.Path(t)+".gpasswd.output")
+			idGenerator := m.RealIDGenerator()
+
+			require.Equal(t, int(config.UIDMin), int(idGenerator.UIDMin),
+				"ID generator UIDMin has not the expected value")
+			require.Equal(t, int(config.UIDMax), int(idGenerator.UIDMax),
+				"ID generator UIDMax has not the expected value")
+			require.Equal(t, int(config.GIDMin), int(idGenerator.GIDMin),
+				"ID generator GIDMin has not the expected value")
+			require.Equal(t, int(config.GIDMax), int(idGenerator.GIDMax),
+				"ID generator GIDMax has not the expected value")
+
+			localgroupstestutils.RequireGroupFile(t, destGroupFile, golden.Path(t))
 		})
 	}
 }
@@ -96,7 +131,7 @@ func TestStop(t *testing.T) {
 	require.NoError(t, m.Stop(), "Stop should not return an error, but did")
 
 	// Should fail, because the db is closed
-	_, err := userstestutils.GetManagerDB(m).AllUsers()
+	_, err := userstestutils.DBManager(m).AllUsers()
 
 	require.Error(t, err, "AllUsers should return an error, but did not")
 }
@@ -118,12 +153,12 @@ func TestUpdateUser(t *testing.T) {
 	}
 
 	userCases := map[string]userCase{
-		"user1":                             {UserInfo: types.UserInfo{Name: "user1"}, UID: 1111},
+		"user1":                             {UserInfo: types.UserInfo{Name: "user1@example.com"}, UID: 1111},
 		"nameless":                          {UID: 1111},
-		"user2":                             {UserInfo: types.UserInfo{Name: "user2"}, UID: 2222},
-		"same-name-different-uid":           {UserInfo: types.UserInfo{Name: "user1"}, UID: 3333},
-		"different-name-same-uid":           {UserInfo: types.UserInfo{Name: "newuser1"}, UID: 1111},
-		"different-capitalization-same-uid": {UserInfo: types.UserInfo{Name: "User1"}, UID: 1111},
+		"user2":                             {UserInfo: types.UserInfo{Name: "user2@example.com"}, UID: 2222},
+		"same-name-different-uid":           {UserInfo: types.UserInfo{Name: "user1@example.com"}, UID: 3333},
+		"different-name-same-uid":           {UserInfo: types.UserInfo{Name: "newuser1@example.com"}, UID: 1111},
+		"different-capitalization-same-uid": {UserInfo: types.UserInfo{Name: "User1@example.com"}, UID: 1111},
 		"user-exists-on-system":             {UserInfo: types.UserInfo{Name: "root"}, UID: 1111},
 	}
 
@@ -139,10 +174,6 @@ func TestUpdateUser(t *testing.T) {
 			{GroupInfo: types.GroupInfo{Name: "localgroup1", UGID: ""}},
 			{GroupInfo: types.GroupInfo{Name: "group1", UGID: "1"}, GID: 11111},
 		},
-		"mixed-groups-gpasswd-fail": {
-			{GroupInfo: types.GroupInfo{Name: "group1", UGID: "1"}, GID: 11111},
-			{GroupInfo: types.GroupInfo{Name: "gpasswdfail", UGID: ""}},
-		},
 		"nameless-group":          {{GroupInfo: types.GroupInfo{Name: "", UGID: "1"}, GID: 11111}},
 		"different-name-same-gid": {{GroupInfo: types.GroupInfo{Name: "newgroup1", UGID: "1"}, GID: 11111}},
 		"group-exists-on-system":  {{GroupInfo: types.GroupInfo{Name: "root", UGID: "1"}, GID: 11111}},
@@ -164,19 +195,18 @@ func TestUpdateUser(t *testing.T) {
 	}{
 		"Successfully_update_user":                                          {groupsCase: "authd-group"},
 		"Successfully_update_user_updating_local_groups":                    {groupsCase: "mixed-groups-authd-first", localGroupsFile: "users_in_groups.group"},
+		"Successfully_update_user_updating_local_groups_with_changes":       {groupsCase: "mixed-groups-authd-first", localGroupsFile: "user_mismatching_groups.group"},
 		"UID_does_not_change_if_user_already_exists":                        {userCase: "same-name-different-uid", dbFile: "one_user_and_group", wantSameUID: true},
-		"Successfully update user with different capitalization":            {userCase: "different-capitalization-same-uid", dbFile: "one_user_and_group"},
 		"GID_does_not_change_if_group_with_same_UGID_exists":                {groupsCase: "different-name-same-ugid", dbFile: "one_user_and_group"},
 		"GID_does_not_change_if_group_with_same_name_and_empty_UGID_exists": {groupsCase: "authd-group", dbFile: "group-with-empty-UGID"},
 		"Removing_last_user_from_a_group_keeps_the_group_record":            {groupsCase: "no-groups", dbFile: "one_user_and_group"},
-		"Names of authd groups are stored in lowercase":                     {groupsCase: "authd-group-with-uppercase"},
+		"Allow_login_with_existing_group_on_system":                         {groupsCase: "group-exists-on-system"},
 
 		"Error_if_user_has_no_username":                           {userCase: "nameless", wantErr: true, noOutput: true},
 		"Error_if_group_has_no_name":                              {groupsCase: "nameless-group", wantErr: true, noOutput: true},
 		"Error_if_group_has_conflicting_gid":                      {groupsCase: "different-name-same-gid", dbFile: "one_user_and_group", wantErr: true, noOutput: true},
 		"Error_if_group_with_same_name_but_different_UGID_exists": {groupsCase: "authd-group", dbFile: "one_user_and_group", wantErr: true, noOutput: true},
 		"Error_if_user_exists_on_system":                          {userCase: "user-exists-on-system", wantErr: true, noOutput: true},
-		"Error_if_group_exists_on_system":                         {groupsCase: "group-exists-on-system", wantErr: true, noOutput: true},
 	}
 	for name, tc := range tests {
 		t.Run(name, func(t *testing.T) {
@@ -184,9 +214,10 @@ func TestUpdateUser(t *testing.T) {
 				t.Parallel()
 			}
 
-			var destCmdsFile string
+			var destGroupFile string
 			if tc.localGroupsFile != "" {
-				destCmdsFile = localgroupstestutils.SetupGPasswdMock(t, filepath.Join("testdata", "groups", tc.localGroupsFile))
+				destGroupFile = localgroupstestutils.SetupGroupMock(t,
+					filepath.Join("testdata", "groups", tc.localGroupsFile))
 			}
 
 			if tc.userCase == "" {
@@ -215,7 +246,7 @@ func TestUpdateUser(t *testing.T) {
 			}
 
 			managerOpts := []users.Option{
-				users.WithIDGenerator(&idgenerator.IDGeneratorMock{
+				users.WithIDGenerator(&users.IDGeneratorMock{
 					UIDsToGenerate: []uint32{user.UID},
 					GIDsToGenerate: gids,
 				}),
@@ -243,17 +274,447 @@ func TestUpdateUser(t *testing.T) {
 				require.Equal(t, oldUID, newUser.UID, "UID should not have changed")
 			}
 
-			got, err := db.Z_ForTests_DumpNormalizedYAML(userstestutils.GetManagerDB(m))
+			got, err := db.Z_ForTests_DumpNormalizedYAML(userstestutils.DBManager(m))
 			require.NoError(t, err, "Created database should be valid yaml content")
 
 			golden.CheckOrUpdate(t, got)
 
-			localgroupstestutils.RequireGPasswdOutput(t, destCmdsFile, golden.Path(t)+".gpasswd.output")
+			localgroupstestutils.RequireGroupFile(t, destGroupFile, golden.Path(t))
+		})
+	}
+}
+
+func TestRegisterUserPreauth(t *testing.T) {
+	t.Parallel()
+
+	// This test is flaky, see https://github.com/canonical/authd/issues/1120
+	if os.Getenv("AUTHD_SKIP_FLAKY_TESTS") != "" {
+		t.Skip("skipping flaky test")
+	}
+
+	userCases := map[string]userCase{
+		"user1":                   {UserInfo: types.UserInfo{Name: "user1@example.com"}, UID: 1111},
+		"nameless":                {UID: 1111},
+		"same-name-different-uid": {UserInfo: types.UserInfo{Name: "user1@example.com"}, UID: 3333},
+		"user-exists-on-system":   {UserInfo: types.UserInfo{Name: "root"}, UID: 1111},
+	}
+
+	tests := map[string]struct {
+		userCase string
+
+		dbFile string
+
+		wantUserInDB bool
+		wantErr      bool
+	}{
+		"Successfully_update_user": {},
+		"Successfully_if_user_already_exists_on_db": {
+			userCase: "same-name-different-uid", dbFile: "one_user_and_group", wantUserInDB: true,
+		},
+
+		"Error_if_user_has_no_username":  {userCase: "nameless", wantErr: true},
+		"Error_if_user_exists_on_system": {userCase: "user-exists-on-system", wantErr: true},
+	}
+	for name, tc := range tests {
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			if tc.userCase == "" {
+				tc.userCase = "user1"
+			}
+
+			user := userCases[tc.userCase]
+
+			dbDir := t.TempDir()
+			if tc.dbFile != "" {
+				err := db.Z_ForTests_CreateDBFromYAML(filepath.Join("testdata", "db", tc.dbFile+".db.yaml"), dbDir)
+				require.NoError(t, err, "Setup: could not create database from testdata")
+			}
+
+			managerOpts := []users.Option{
+				users.WithIDGenerator(&users.IDGeneratorMock{
+					UIDsToGenerate: []uint32{user.UID},
+				}),
+			}
+			m := newManagerForTests(t, dbDir, managerOpts...)
+
+			uid, err := m.RegisterUserPreAuth(user.Name)
+
+			requireErrorAssertions(t, err, nil, tc.wantErr)
+			if tc.wantErr {
+				return
+			}
+
+			_, err = m.UserByName(user.Name)
+			if tc.wantUserInDB {
+				require.NoError(t, err, "UserByName should not return an error, but did")
+			} else {
+				require.Error(t, err, "UserByName should return an error, but did not")
+			}
+
+			newUser, err := m.UserByID(uid)
+			require.NoError(t, err, "UserByID should not return an error, but did")
+
+			require.Equal(t, uid, newUser.UID, "UID should not have changed")
+
+			if tc.wantUserInDB {
+				require.Equal(t, user.Name, newUser.Name, "User name does not match")
+			} else {
+				require.True(t, strings.HasPrefix(newUser.Name, tempentries.UserPrefix),
+					"Pre-auth users should have %q as prefix: %q", tempentries.UserPrefix,
+					newUser.Name)
+				newUser.Name = tempentries.UserPrefix + "-{{random-suffix}}"
+			}
+
+			golden.CheckOrUpdateYAML(t, newUser)
+		})
+	}
+}
+
+func TestConcurrentUserUpdate(t *testing.T) {
+	t.Parallel()
+
+	// This test is flaky, see https://github.com/canonical/authd/issues/1120
+	if os.Getenv("AUTHD_SKIP_FLAKY_TESTS") != "" {
+		t.Skip("skipping flaky test")
+	}
+
+	const nIterations = 100
+	const preAuthIterations = 3
+	const perUserGroups = 3
+	const userUpdateRetries = 3
+
+	dbDir := t.TempDir()
+	const dbFile = "one_user_and_group_with_matching_gid"
+	err := db.Z_ForTests_CreateDBFromYAML(filepath.Join("testdata", "db", dbFile+".db.yaml"), dbDir)
+	require.NoError(t, err, "Setup: could not create database from testdata")
+
+	const registeredUserPrefix = "authd-test-maybe-pre-check-user"
+
+	lockedEntries, entriesUnlock, err := localentries.WithUserDBLock()
+	require.NoError(t, err, "Failed to lock the local entries")
+	systemPasswd, err := lockedEntries.GetUserEntries()
+	require.NoError(t, err, "GetPasswdEntries should not fail but it did")
+	systemGroups, err := lockedEntries.GetGroupEntries()
+	require.NoError(t, err, "GetGroupEntries should not fail but it did")
+
+	err = entriesUnlock()
+	require.NoError(t, err, "entriesUnlock should not fail to unlock the local entries")
+
+	idGenerator := &users.IDGenerator{
+		UIDMin: 0,
+		//nolint: gosec // we're in tests, overflow is very unlikely to happen.
+		UIDMax: uint32(len(systemPasswd)) + nIterations*preAuthIterations + uint32(len(systemGroups)),
+		GIDMin: 0,
+		//nolint: gosec // we're in tests, overflow is very unlikely to happen.
+		GIDMax: uint32(len(systemGroups)) + nIterations*perUserGroups + uint32(len(systemGroups)),
+	}
+	m := newManagerForTests(t, dbDir, users.WithIDGenerator(idGenerator))
+
+	originalDBUsers, err := m.AllUsers()
+	require.NoError(t, err, "AllUsers should not fail but it did")
+	originalDBGroups, err := m.AllGroups()
+	require.NoError(t, err, "AllGroups should not fail but it did")
+
+	wg := sync.WaitGroup{}
+	wg.Add(nIterations)
+
+	// These tests are meant to stress-test in parallel our users manager,
+	// this is happening by updating new users or pre-auth some of them
+	// using a very limited UID and GID set, to retry more their generation.
+	// concurrently so that users gets registered first and then updated.
+	// Finally ensure that the generated UIDs and GIDs are not clashing.
+	for idx := range nIterations {
+		t.Run(fmt.Sprintf("Iteration_%d", idx), func(t *testing.T) {
+			t.Parallel()
+
+			t.Logf("Running iteration %d", idx)
+
+			idx := idx
+			doPreAuth := idx%3 == 0
+			userName := fmt.Sprintf("authd-test-user%d", idx)
+			t.Cleanup(wg.Done)
+
+			var preauthUID atomic.Uint32
+			// var err error
+			if doPreAuth {
+				// In the pre-auth case we do even more parallelization, so that
+				// the pre-auth happens without a defined order of the actual
+				// registration.
+				userName = fmt.Sprintf("%s%d", registeredUserPrefix, idx)
+
+				//nolint:thelper // This is actually a test function!
+				preAuth := func(t *testing.T) {
+					t.Parallel()
+
+					t.Logf("Registering pre-auth user %q", userName)
+					uid, err := m.RegisterUserPreAuth(userName)
+					require.NoError(t, err, "RegisterPreAuthUser should not fail but it did")
+					preauthUID.Store(uid)
+					t.Logf("Registered pre-auth user %q with UID %d", userName, uid)
+				}
+
+				for i := range preAuthIterations {
+					t.Run(fmt.Sprintf("Pre_auth%d", i), preAuth)
+				}
+			}
+
+			//nolint:thelper // This is actually a test function!
+			userUpdate := func(t *testing.T) {
+				t.Parallel()
+
+				uid := preauthUID.Load()
+				t.Logf("Updating user %q (using UID %d)", userName, uid)
+				u := types.UserInfo{
+					Name:   userName,
+					UID:    uid,
+					Dir:    "/home-prefixes/" + userName,
+					Shell:  "/usr/sbin/nologin",
+					Groups: []types.GroupInfo{{Name: fmt.Sprintf("authd-test-local-group%d", idx)}},
+				}
+
+				// One user group matching the user is automatically added by authd.
+				for gdx := range perUserGroups - 1 {
+					u.Groups = append(u.Groups, types.GroupInfo{
+						Name: fmt.Sprintf("authd-test-group%d.%d", idx, gdx),
+						UGID: fmt.Sprintf("authd-test-ugid%d.%d", idx, gdx),
+					})
+				}
+
+				err := m.UpdateUser(u)
+				require.NoError(t, err, "UpdateUser should not fail but it did")
+				t.Logf("Updated user %q using UID %d", userName, uid)
+			}
+
+			testName := "Update_user"
+			if doPreAuth {
+				testName = "Maybe_finish_registration"
+			}
+
+			for i := range userUpdateRetries {
+				t.Run(fmt.Sprintf("%s%d", testName, i), userUpdate)
+			}
+		})
+	}
+
+	// Test that adding users with the same name as system users fails
+	for _, u := range systemPasswd {
+		t.Run(fmt.Sprintf("Error_updating_user_with_name_conflict_%s", u.Name), func(t *testing.T) {
+			t.Parallel()
+
+			err := m.UpdateUser(types.UserInfo{
+				Name:  u.Name,
+				Dir:   "/home-prefixes/" + u.Name,
+				Shell: "/usr/sbin/nologin",
+			})
+			require.Error(t, err, "Updating user %q must fail but it does not", u.Name)
+		})
+	}
+
+	// Test that adding users with groups with the same name as local groups does not fail (we print a warning instead).
+	for idx, g := range systemGroups {
+		t.Run(fmt.Sprintf("Allow_updating_user_with_group_name_conflict_%s", g.Name), func(t *testing.T) {
+			t.Parallel()
+
+			userName := fmt.Sprintf("%s-with-group-name-conflict%d", registeredUserPrefix, idx)
+			err := m.UpdateUser(types.UserInfo{
+				Name:  userName,
+				Dir:   "/home-prefixes/" + g.Name,
+				Shell: "/usr/sbin/nologin",
+				Groups: []types.GroupInfo{{
+					Name: g.Name,
+					UGID: fmt.Sprintf("authd-test-ugid-for-%s", g.Name),
+				}, {
+					Name: fmt.Sprintf("authd-test-local-group%d", idx),
+				}},
+			})
+			// UpdateUser call should pass although the user would not be added to the system group
+			require.NoError(t, err, "Updating user %q with group name conflict %q should not fail but it did", userName, g.Name)
+		})
+	}
+
+	t.Run("Database_checks", func(t *testing.T) {
+		t.Parallel()
+
+		// Wait for the other tests to be completed, not using t.Cleanup here
+		// since this is actually a test.
+		wg.Wait()
+
+		// This includes the extra user that was already in the DB and the
+		// users registered via non-local groups loop.
+		users, err := m.AllUsers()
+		require.NoError(t, err, "AllUsers should not fail but it did")
+		require.Len(t, users, nIterations+1+len(systemGroups), "Number of registered users mismatch")
+
+		// This includes the extra group that was already in the DB and the
+		// private groups for users registered via the non-local groups loop.
+		groups, err := m.AllGroups()
+		require.NoError(t, err, "AllGroups should not fail but it did")
+		require.Len(t, groups, nIterations*3+1+len(systemGroups), "Number of registered groups mismatch")
+
+		lockedEntries, entriesUnlock, err := localentries.WithUserDBLock()
+		require.NoError(t, err, "Failed to lock the local entries")
+		defer func() {
+			err := entriesUnlock()
+			require.NoError(t, err, "entriesUnlock should not fail to unlock the local entries")
+		}()
+
+		localPasswd, err := lockedEntries.GetUserEntries()
+		require.NoError(t, err, "GetPasswdEntries should not fail but it did")
+		localGroups, err := lockedEntries.GetGroupEntries()
+		require.NoError(t, err, "GetGroupEntries should not fail but it did")
+
+		uniqueUIDs := make(map[uint32]types.UserEntry)
+		uniqueGIDs := make(map[uint32]string)
+
+		for _, u := range users {
+			require.NotZero(t, u.UID, "No user should have the UID equal to zero, but %q has", u.Name)
+			require.Equal(t, u.UID, u.GID, "GID does not match UID for user %q", u.Name)
+
+			old, ok := uniqueUIDs[u.UID]
+			require.False(t, ok,
+				"UID %d must be unique across entries, but it's used both %q and %q",
+				u.UID, u.Name, old)
+			uniqueUIDs[u.UID] = u
+			require.Equal(t, int(u.UID), int(u.GID), "User %q UID should match its GID", u.Name)
+
+			if slices.ContainsFunc(originalDBUsers, func(dbU types.UserEntry) bool {
+				return dbU.UID == u.UID && dbU.Name == u.Name
+			}) {
+				// Ignore the local user checks for users already in the DB.
+				continue
+			}
+
+			require.GreaterOrEqual(t, u.UID, idGenerator.UIDMin,
+				"Generated UID should be an ID greater or equal to the minimum")
+			require.LessOrEqual(t, u.UID, idGenerator.UIDMax,
+				"Generate UID should be an ID less or equal to the maximum")
+
+			localgroups, err := m.DB().UserLocalGroups(u.UID)
+			require.NoError(t, err, "UserLocalGroups for %q should not fail but it did", u.Name)
+			require.Len(t, localgroups, 1,
+				"Number of registered local groups for %q mismatch", u.Name)
+
+			isLocal := slices.ContainsFunc(localPasswd, func(lu types.UserEntry) bool {
+				return lu.UID == u.UID
+			})
+			require.False(t, isLocal, "UID %d for user %q should not be a local user ID but it is",
+				u.UID, u.Name)
+		}
+
+		for _, g := range groups {
+			require.NotZero(t, g.GID, "No group should have the GID equal to zero, but %q has", g.Name)
+
+			old, ok := uniqueGIDs[g.GID]
+			require.False(t, ok, "GID %d must be unique across entries, but it's used both %q and %q",
+				g.GID, g.Name, old)
+			uniqueGIDs[g.GID] = g.Name
+
+			u, ok := uniqueUIDs[g.GID]
+			if ok {
+				require.Equal(t, int(g.GID), int(u.GID),
+					"Group %q can only match its user, not to %q", g.Name, u.Name)
+			}
+
+			isLocal := slices.ContainsFunc(localGroups, func(lg types.GroupEntry) bool {
+				return lg.GID == g.GID
+			})
+			require.False(t, isLocal, "GID %d for group %q should not be a local user GID but it is",
+				g.GID, g.Name)
+
+			if slices.ContainsFunc(originalDBGroups, func(dbU types.GroupEntry) bool {
+				return dbU.GID == g.GID && dbU.Name == g.Name
+			}) {
+				// Ignore the local user checks for users already in the DB.
+				continue
+			}
+
+			require.GreaterOrEqual(t, g.GID, idGenerator.GIDMin,
+				"Generated GID should be an ID greater or equal to the minimum")
+			// The GID of user private groups is set to the same value as the UID, even if GIDMax is smaller,
+			// so we need to check that the generated GID is less or equal to the maximum between GIDMax and UIDMax.
+			gidMax := max(idGenerator.GIDMax, idGenerator.UIDMax)
+			require.LessOrEqual(t, g.GID, gidMax,
+				"Generate GID should be an ID less or equal to the maximum")
+		}
+	})
+}
+
+func TestUpdateWhenNoMoreIDsAreAvailable(t *testing.T) {
+	t.Parallel()
+
+	const maxIDs = uint32(10)
+
+	tests := map[string]struct {
+		idGenerator users.IDGeneratorIface
+	}{
+		"Errors_after_registering_the_max_amount_of_users_for_lower_IDs": {
+			idGenerator: &users.IDGenerator{
+				UIDMin: 0,
+				UIDMax: 0 + maxIDs - 1,
+				GIDMin: 0,
+				GIDMax: 0 + maxIDs - 1,
+			},
+		},
+		"Errors_after_registering_the_max_amount_of_users_for_highest_IDs": {
+			idGenerator: &users.IDGenerator{
+				UIDMin: math.MaxUint32 - maxIDs + 1,
+				UIDMax: math.MaxUint32,
+				GIDMin: math.MaxUint32 - maxIDs + 1,
+				GIDMax: math.MaxUint32,
+			},
+		},
+	}
+	for name, tc := range tests {
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			dbDir := t.TempDir()
+			const dbFile = "one_user_and_group_with_matching_gid"
+			err := db.Z_ForTests_CreateDBFromYAML(filepath.Join("testdata", "db", dbFile+".db.yaml"), dbDir)
+			require.NoError(t, err, "Setup: could not create database from testdata")
+
+			m := newManagerForTests(t, dbDir, users.WithIDGenerator(tc.idGenerator))
+
+			// Let'ts fill the manager first...
+			for idx := range maxIDs {
+				userName := fmt.Sprintf("authd-test-lucky-user-%d", idx)
+				t.Logf("Updating user %q", userName)
+
+				err := m.UpdateUser(types.UserInfo{
+					Name:  userName,
+					Dir:   "/home-prefixes/" + userName,
+					Shell: "/usr/sbin/nologin",
+				})
+
+				// We do not care about the return value now...
+				t.Logf("UpdateUser for %q exited with %v", userName, err)
+			}
+
+			// Now try to add more users, we must fail for all of them.
+			for idx := range maxIDs {
+				t.Run(fmt.Sprintf("Adding_more_users%d", idx), func(t *testing.T) {
+					t.Parallel()
+
+					userName := fmt.Sprintf("authd-test-unlucky-user-%d", idx)
+					t.Logf("Updating user %q", userName)
+
+					err := m.UpdateUser(types.UserInfo{
+						Name:  userName,
+						Dir:   "/home-prefixes/" + userName,
+						Shell: "/usr/sbin/nologin",
+					})
+
+					require.Error(t, err, "UpdateUser should have failed for %q", userName)
+				})
+			}
 		})
 	}
 }
 
 func TestBrokerForUser(t *testing.T) {
+	t.Parallel()
+
 	tests := map[string]struct {
 		username string
 		dbFile   string
@@ -262,15 +723,14 @@ func TestBrokerForUser(t *testing.T) {
 		wantErr      bool
 		wantErrType  error
 	}{
-		"Successfully_get_broker_for_user":                     {username: "user1", dbFile: "multiple_users_and_groups", wantBrokerID: "broker-id"},
-		"Return_no_broker_but_in_db_if_user_has_no_broker_yet": {username: "userwithoutbroker", dbFile: "multiple_users_and_groups", wantBrokerID: ""},
+		"Successfully_get_broker_for_user":                     {username: "user1@example.com", dbFile: "multiple_users_and_groups", wantBrokerID: "broker-id"},
+		"Return_no_broker_but_in_db_if_user_has_no_broker_yet": {username: "userwithoutbroker@example.com", dbFile: "multiple_users_and_groups", wantBrokerID: ""},
 
-		"Error_if_user_does_not_exist": {username: "doesnotexist", dbFile: "multiple_users_and_groups", wantErrType: db.NoDataFoundError{}},
+		"Error_if_user_does_not_exist": {username: "doesnotexist@example.com", dbFile: "multiple_users_and_groups", wantErrType: db.NoDataFoundError{}},
 	}
 	for name, tc := range tests {
 		t.Run(name, func(t *testing.T) {
-			// We don't care about the output of gpasswd in this test, but we still need to mock it.
-			_ = localgroupstestutils.SetupGPasswdMock(t, "empty.group")
+			t.Parallel()
 
 			dbDir := t.TempDir()
 			err := db.Z_ForTests_CreateDBFromYAML(filepath.Join("testdata", "db", tc.dbFile+".db.yaml"), dbDir)
@@ -290,6 +750,8 @@ func TestBrokerForUser(t *testing.T) {
 }
 
 func TestUpdateBrokerForUser(t *testing.T) {
+	t.Parallel()
+
 	tests := map[string]struct {
 		username string
 
@@ -304,11 +766,10 @@ func TestUpdateBrokerForUser(t *testing.T) {
 	}
 	for name, tc := range tests {
 		t.Run(name, func(t *testing.T) {
-			// We don't care about the output of gpasswd in this test, but we still need to mock it.
-			_ = localgroupstestutils.SetupGPasswdMock(t, "empty.group")
+			t.Parallel()
 
 			if tc.username == "" {
-				tc.username = "user1"
+				tc.username = "user1@example.com"
 			}
 			if tc.dbFile == "" {
 				tc.dbFile = "multiple_users_and_groups"
@@ -326,7 +787,99 @@ func TestUpdateBrokerForUser(t *testing.T) {
 				return
 			}
 
-			got, err := db.Z_ForTests_DumpNormalizedYAML(userstestutils.GetManagerDB(m))
+			got, err := db.Z_ForTests_DumpNormalizedYAML(userstestutils.DBManager(m))
+			require.NoError(t, err, "Created database should be valid yaml content")
+
+			golden.CheckOrUpdate(t, got)
+		})
+	}
+}
+
+//nolint:dupl // This is not a duplicate test
+func TestLockUser(t *testing.T) {
+	tests := map[string]struct {
+		username string
+
+		dbFile string
+
+		wantErr     bool
+		wantErrType error
+	}{
+		"Successfully_lock_user": {},
+
+		"Error_if_user_does_not_exist": {username: "doesnotexist", wantErrType: db.NoDataFoundError{}},
+	}
+	for name, tc := range tests {
+		t.Run(name, func(t *testing.T) {
+			// We don't care about the output of gpasswd in this test, but we still need to mock it.
+			_ = localgroupstestutils.SetupGroupMock(t, filepath.Join("testdata", "groups", "empty.group"))
+
+			if tc.username == "" {
+				tc.username = "user1@example.com"
+			}
+			if tc.dbFile == "" {
+				tc.dbFile = "multiple_users_and_groups"
+			}
+
+			dbDir := t.TempDir()
+			err := db.Z_ForTests_CreateDBFromYAML(filepath.Join("testdata", "db", tc.dbFile+".db.yaml"), dbDir)
+			require.NoError(t, err, "Setup: could not create database from testdata")
+			m := newManagerForTests(t, dbDir)
+
+			err = m.LockUser(tc.username)
+
+			requireErrorAssertions(t, err, tc.wantErrType, tc.wantErr)
+			if tc.wantErrType != nil || tc.wantErr {
+				return
+			}
+
+			got, err := db.Z_ForTests_DumpNormalizedYAML(userstestutils.DBManager(m))
+			require.NoError(t, err, "Created database should be valid yaml content")
+
+			golden.CheckOrUpdate(t, got)
+		})
+	}
+}
+
+//nolint:dupl // This is not a duplicate test
+func TestUnlockUser(t *testing.T) {
+	tests := map[string]struct {
+		username string
+
+		dbFile string
+
+		wantErr     bool
+		wantErrType error
+	}{
+		"Successfully_enable_user": {},
+
+		"Error_if_user_does_not_exist": {username: "doesnotexist", wantErrType: db.NoDataFoundError{}},
+	}
+	for name, tc := range tests {
+		t.Run(name, func(t *testing.T) {
+			// We don't care about the output of gpasswd in this test, but we still need to mock it.
+			_ = localgroupstestutils.SetupGroupMock(t, filepath.Join("testdata", "groups", "empty.group"))
+
+			if tc.username == "" {
+				tc.username = "user1@example.com"
+			}
+			if tc.dbFile == "" {
+				tc.dbFile = "locked_user"
+			}
+
+			dbDir := t.TempDir()
+			err := db.Z_ForTests_CreateDBFromYAML(filepath.Join("testdata", "db", tc.dbFile+".db.yaml"), dbDir)
+			require.NoError(t, err, "Setup: could not create database from testdata")
+			m := newManagerForTests(t, dbDir)
+
+			err = m.UnlockUser(tc.username)
+
+			requireErrorAssertions(t, err, tc.wantErrType, tc.wantErr)
+			if tc.wantErrType != nil || tc.wantErr {
+				return
+			}
+
+			got, err := db.Z_ForTests_DumpNormalizedYAML(userstestutils.DBManager(m))
 			require.NoError(t, err, "Created database should be valid yaml content")
 
 			golden.CheckOrUpdate(t, got)
@@ -335,6 +888,8 @@ func TestUpdateBrokerForUser(t *testing.T) {
 }
 
 func TestUserByIDAndName(t *testing.T) {
+	t.Parallel()
+
 	// This test is flaky, see https://github.com/canonical/authd/issues/1120
 	if os.Getenv("AUTHD_SKIP_FLAKY_TESTS") != "" {
 		t.Skip("skipping flaky test")
@@ -349,18 +904,16 @@ func TestUserByIDAndName(t *testing.T) {
 		wantErr     bool
 		wantErrType error
 	}{
-		"Successfully_get_user_by_ID":             {uid: 1111, dbFile: "multiple_users_and_groups"},
-		"Successfully_get_user_by_name":           {username: "user1", dbFile: "multiple_users_and_groups"},
-		"Successfully_get_temporary_user_by_ID":   {dbFile: "multiple_users_and_groups", isTempUser: true},
-		"Successfully_get_temporary_user_by_name": {username: "tempuser1", dbFile: "multiple_users_and_groups", isTempUser: true},
+		"Successfully_get_user_by_ID":           {uid: 1111, dbFile: "multiple_users_and_groups"},
+		"Successfully_get_user_by_name":         {username: "user1@example.com", dbFile: "multiple_users_and_groups"},
+		"Successfully_get_temporary_user_by_ID": {dbFile: "multiple_users_and_groups", isTempUser: true},
 
 		"Error_if_user_does_not_exist_-_by_ID":   {uid: 0, dbFile: "multiple_users_and_groups", wantErrType: db.NoDataFoundError{}},
 		"Error_if_user_does_not_exist_-_by_name": {username: "doesnotexist", dbFile: "multiple_users_and_groups", wantErrType: db.NoDataFoundError{}},
 	}
 	for name, tc := range tests {
 		t.Run(name, func(t *testing.T) {
-			// We don't care about the output of gpasswd in this test, but we still need to mock it.
-			_ = localgroupstestutils.SetupGPasswdMock(t, "empty.group")
+			t.Parallel()
 
 			dbDir := t.TempDir()
 			err := db.Z_ForTests_CreateDBFromYAML(filepath.Join("testdata", "db", tc.dbFile+".db.yaml"), dbDir)
@@ -369,7 +922,7 @@ func TestUserByIDAndName(t *testing.T) {
 			m := newManagerForTests(t, dbDir)
 
 			if tc.isTempUser {
-				tc.uid, _, err = m.TemporaryRecords().RegisterUser("tempuser1")
+				tc.uid, err = m.RegisterUserPreAuth("tempuser1@example.com")
 				require.NoError(t, err, "RegisterUser should not return an error, but did")
 			}
 
@@ -388,6 +941,8 @@ func TestUserByIDAndName(t *testing.T) {
 			// Registering a temporary user creates it with a random UID, GID, and gecos, so we have to make it
 			// deterministic before comparing it with the golden file
 			if tc.isTempUser {
+				require.True(t, strings.HasPrefix(user.Name, tempentries.UserPrefix))
+				user.Name = tempentries.UserPrefix + "{{random-suffix}}"
 				require.Equal(t, tc.uid, user.UID)
 				user.UID = 0
 				require.Equal(t, tc.uid, user.GID)
@@ -402,6 +957,8 @@ func TestUserByIDAndName(t *testing.T) {
 }
 
 func TestAllUsers(t *testing.T) {
+	t.Parallel()
+
 	tests := map[string]struct {
 		dbFile string
 
@@ -412,8 +969,7 @@ func TestAllUsers(t *testing.T) {
 	}
 	for name, tc := range tests {
 		t.Run(name, func(t *testing.T) {
-			// We don't care about the output of gpasswd in this test, but we still need to mock it.
-			_ = localgroupstestutils.SetupGPasswdMock(t, "empty.group")
+			t.Parallel()
 
 			dbDir := t.TempDir()
 			err := db.Z_ForTests_CreateDBFromYAML(filepath.Join("testdata", "db", tc.dbFile+".db.yaml"), dbDir)
@@ -433,6 +989,8 @@ func TestAllUsers(t *testing.T) {
 }
 
 func TestGroupByIDAndName(t *testing.T) {
+	t.Parallel()
+
 	// This test is flaky, see https://github.com/canonical/authd/issues/1120
 	if os.Getenv("AUTHD_SKIP_FLAKY_TESTS") != "" {
 		t.Skip("skipping flaky test")
@@ -442,32 +1000,34 @@ func TestGroupByIDAndName(t *testing.T) {
 		gid         uint32
 		groupname   string
 		dbFile      string
-		isTempGroup bool
+		preAuthUser string
 
 		wantErr     bool
 		wantErrType error
 	}{
-		"Successfully_get_group_by_ID":             {gid: 11111, dbFile: "multiple_users_and_groups"},
-		"Successfully_get_group_by_name":           {groupname: "group1", dbFile: "multiple_users_and_groups"},
-		"Successfully_get_temporary_group_by_ID":   {dbFile: "multiple_users_and_groups", isTempGroup: true},
-		"Successfully_get_temporary_group_by_name": {groupname: "tempgroup1", dbFile: "multiple_users_and_groups", isTempGroup: true},
+		"Successfully_get_group_by_ID":                  {gid: 11111, dbFile: "multiple_users_and_groups"},
+		"Successfully_get_group_by_ID_for_preauth_user": {preAuthUser: "hello-authd", dbFile: "multiple_users_and_groups"},
+		"Successfully_get_group_by_name":                {groupname: "group1", dbFile: "multiple_users_and_groups"},
 
 		"Error_if_group_does_not_exist_-_by_ID":   {gid: 0, dbFile: "multiple_users_and_groups", wantErrType: db.NoDataFoundError{}},
 		"Error_if_group_does_not_exist_-_by_name": {groupname: "doesnotexist", dbFile: "multiple_users_and_groups", wantErrType: db.NoDataFoundError{}},
 	}
 	for name, tc := range tests {
 		t.Run(name, func(t *testing.T) {
-			// We don't care about the output of gpasswd in this test, but we still need to mock it.
-			_ = localgroupstestutils.SetupGPasswdMock(t, "empty.group")
+			t.Parallel()
 
 			dbDir := t.TempDir()
 			err := db.Z_ForTests_CreateDBFromYAML(filepath.Join("testdata", "db", tc.dbFile+".db.yaml"), dbDir)
 			require.NoError(t, err, "Setup: could not create database from testdata")
-			m := newManagerForTests(t, dbDir)
-
-			if tc.isTempGroup {
-				tc.gid, _, err = m.TemporaryRecords().RegisterGroup("tempgroup1")
-				require.NoError(t, err, "RegisterGroup should not return an error, but did")
+			m := newManagerForTests(t, dbDir, users.WithIDGenerator(&users.IDGeneratorMock{
+				UIDsToGenerate: []uint32{12345},
+				GIDsToGenerate: []uint32{12345},
+			}))
+
+			if tc.preAuthUser != "" {
+				tc.gid, err = m.RegisterUserPreAuth(tc.preAuthUser)
+				require.NoError(t, err, "RegisterUserPreAuth should not fail for %q, but it did",
+					tc.preAuthUser)
 			}
 
 			var group types.GroupEntry
@@ -482,13 +1042,17 @@ func TestGroupByIDAndName(t *testing.T) {
 				return
 			}
 
-			// Registering a temporary group creates it with a random GID and random passwd, so we have to make it
-			// deterministic before comparing it with the golden file
-			if tc.isTempGroup {
-				require.Equal(t, tc.gid, group.GID)
-				group.GID = 0
-				require.NotEmpty(t, group.Passwd)
-				group.Passwd = ""
+			if tc.preAuthUser != "" {
+				require.True(t, strings.HasPrefix(group.Name, tempentries.UserPrefix),
+					"Pre-auth user group should have %q as prefix: %q", tempentries.UserPrefix,
+					group.Name)
+				group.Name = tempentries.UserPrefix + "-{{RANDOM_ID}}"
+
+				require.Len(t, group.Users, 1, "Users length mismatch")
+				require.True(t, strings.HasPrefix(group.Users[0], tempentries.UserPrefix),
+					"Pre-auth user should have %q as prefix: %q", tempentries.UserPrefix,
+					group.Users[0])
+				group.Users[0] = tempentries.UserPrefix + "-{{RANDOM_ID}}"
 			}
 
 			golden.CheckOrUpdateYAML(t, group)
@@ -497,6 +1061,8 @@ func TestGroupByIDAndName(t *testing.T) {
 }
 
 func TestAllGroups(t *testing.T) {
+	t.Parallel()
+
 	tests := map[string]struct {
 		dbFile string
 
@@ -507,8 +1073,7 @@ func TestAllGroups(t *testing.T) {
 	}
 	for name, tc := range tests {
 		t.Run(name, func(t *testing.T) {
-			// We don't care about the output of gpasswd in this test, but we still need to mock it.
-			_ = localgroupstestutils.SetupGPasswdMock(t, "empty.group")
+			t.Parallel()
 
 			dbDir := t.TempDir()
 			err := db.Z_ForTests_CreateDBFromYAML(filepath.Join("testdata", "db", tc.dbFile+".db.yaml"), dbDir)
@@ -529,6 +1094,8 @@ func TestAllGroups(t *testing.T) {
 }
 
 func TestShadowByName(t *testing.T) {
+	t.Parallel()
+
 	tests := map[string]struct {
 		username string
 		dbFile   string
@@ -536,14 +1103,13 @@ func TestShadowByName(t *testing.T) {
 		wantErr     bool
 		wantErrType error
 	}{
-		"Successfully_get_shadow_by_name": {username: "user1", dbFile: "multiple_users_and_groups"},
+		"Successfully_get_shadow_by_name": {username: "user1@example.com", dbFile: "multiple_users_and_groups"},
 
 		"Error_if_shadow_does_not_exist": {username: "doesnotexist", dbFile: "multiple_users_and_groups", wantErrType: db.NoDataFoundError{}},
 	}
 	for name, tc := range tests {
 		t.Run(name, func(t *testing.T) {
-			// We don't care about the output of gpasswd in this test, but we still need to mock it.
-			_ = localgroupstestutils.SetupGPasswdMock(t, "empty.group")
+			t.Parallel()
 
 			dbDir := t.TempDir()
 			err := db.Z_ForTests_CreateDBFromYAML(filepath.Join("testdata", "db", tc.dbFile+".db.yaml"), dbDir)
@@ -564,6 +1130,8 @@ func TestShadowByName(t *testing.T) {
 }
 
 func TestAllShadows(t *testing.T) {
+	t.Parallel()
+
 	tests := map[string]struct {
 		dbFile string
 
@@ -573,8 +1141,7 @@ func TestAllShadows(t *testing.T) {
 	}
 	for name, tc := range tests {
 		t.Run(name, func(t *testing.T) {
-			// We don't care about the output of gpasswd in this test, but we still need to mock it.
-			_ = localgroupstestutils.SetupGPasswdMock(t, "empty.group")
+			t.Parallel()
 
 			dbDir := t.TempDir()
 			err := db.Z_ForTests_CreateDBFromYAML(filepath.Join("testdata", "db", tc.dbFile+".db.yaml"), dbDir)
@@ -594,8 +1161,180 @@ func TestAllShadows(t *testing.T) {
 	}
 }
 
-func TestMockgpasswd(t *testing.T) {
-	localgroupstestutils.Mockgpasswd(t)
+func TestCompareNewUserInfoWithDB(t *testing.T) {
+	t.Parallel()
+
+	tests := map[string]struct {
+		dbFile string
+
+		wantUserExactMatch map[string]bool
+		wantUserNoMatch    map[string]bool
+	}{
+		"Compare_all_valid_users": {
+			dbFile:             "multiple_users_and_groups",
+			wantUserExactMatch: map[string]bool{"user1@example.com": true},
+		},
+		"Compare_all_not_matching_users": {
+			dbFile: "multiple_users_and_groups",
+			wantUserNoMatch: map[string]bool{
+				"user1@example.com": true, "user2@example.com": true, "user3@example.com": true, "userwithoutbroker@example.com": true,
+			},
+		},
+	}
+	for name, tc := range tests {
+		dbDir := t.TempDir()
+		err := db.Z_ForTests_CreateDBFromYAML(filepath.Join("testdata", "db", tc.dbFile+".db.yaml"), dbDir)
+		require.NoError(t, err, "Setup: could not create database from testdata")
+
+		m := newManagerForTests(t, dbDir)
+
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			userEntries, err := m.AllUsers()
+			require.NoError(t, err, "AllUsers should not fail but it did")
+
+			for _, u := range userEntries {
+				testName, _, _ := strings.Cut(u.Name, "@")
+				t.Run(testName, func(t *testing.T) {
+					t.Parallel()
+
+					u, err := m.GetOldUserInfoFromDB(u.Name)
+					require.NoError(t, err, "GetOldUserInfoFromDB should not fail but it did")
+					require.NotNil(t, u, "GetOldUserInfoFromDB user should not be nil but it is")
+
+					dbUserInfo := *u
+					golden.CheckOrUpdateYAML(t, dbUserInfo,
+						golden.WithSuffix("-from-getOldUserInfoFromDB"))
+
+					userInfoFile := filepath.Join("testdata", t.Name())
+					content, err := os.ReadFile(userInfoFile)
+					require.NoError(t, err, "ReadFile should not fail opening %q", userInfoFile)
+
+					var wantUserInfo types.UserInfo
+					err = yaml.Unmarshal(content, &wantUserInfo)
+					require.NoError(t, err, "Cannot deserialize user info")
+
+					if tc.wantUserExactMatch[u.Name] {
+						require.Equal(t, wantUserInfo, dbUserInfo,
+							"User infos be strictly equal, but they are not")
+						require.True(t, wantUserInfo.Equals(dbUserInfo),
+							"User infos be strictly equal, but they are not")
+					} else {
+						require.NotEqual(t, wantUserInfo, dbUserInfo,
+							"User infos should not be strictly equal, but they are")
+						require.False(t, wantUserInfo.Equals(dbUserInfo),
+							"User infos should not be strictly equal, but they are")
+					}
+
+					got := users.CompareNewUserInfoWithUserInfoFromDB(wantUserInfo, dbUserInfo)
+					require.Equal(t, !tc.wantUserNoMatch[u.Name], got,
+						"User infos does not respect wanted equality check:"+
+							"\nNew: %#v\n Old: %#v", wantUserInfo, dbUserInfo)
+				})
+			}
+		})
+
+		t.Run("not_existing_user", func(t *testing.T) {
+			t.Parallel()
+
+			user, err := m.GetOldUserInfoFromDB("ImustNot-exist")
+			require.NoError(t, err, "GetOldUserInfoFromDB should not fail but it did")
+			require.Nil(t, user, "returned user should be nil, but it was not")
+		})
+	}
+}
+
+func TestRegisterUserPreAuthWhenLocked(t *testing.T) {
+	// This cannot be parallel
+
+	userslocking.Z_ForTests_OverrideLockingAsLockedExternally(t, context.Background())
+	userslocking.Z_ForTests_SetMaxWaitTime(t, testutils.MultipliedSleepDuration(750*time.Millisecond))
+
+	dbFile := "one_user_and_group"
+	dbDir := t.TempDir()
+	err := db.Z_ForTests_CreateDBFromYAML(filepath.Join("testdata", "db", dbFile+".db.yaml"), dbDir)
+	require.NoError(t, err, "Setup: could not create database from testdata")
+
+	m := newManagerForTests(t, dbDir)
+
+	uid, err := m.RegisterUserPreAuth("locked-user@example.com")
+	require.ErrorIs(t, err, userslocking.ErrLock)
+	require.Zero(t, uid, "Uid should be unset")
+}
+
+func TestRegisterUserPreAuthAfterUnlock(t *testing.T) {
+	// This cannot be parallel
+
+	waitTime := testutils.MultipliedSleepDuration(750 * time.Millisecond)
+	lockCtx, lockCancel := context.WithTimeout(context.Background(), waitTime/2)
+	t.Cleanup(lockCancel)
+
+	userslocking.Z_ForTests_OverrideLockingAsLockedExternally(t, lockCtx)
+	userslocking.Z_ForTests_SetMaxWaitTime(t, waitTime)
+
+	t.Cleanup(func() { _ = userslocking.WriteUnlock() })
+
+	dbFile := "one_user_and_group"
+	dbDir := t.TempDir()
+	err := db.Z_ForTests_CreateDBFromYAML(filepath.Join("testdata", "db", dbFile+".db.yaml"), dbDir)
+	require.NoError(t, err, "Setup: could not create database from testdata")
+
+	m := newManagerForTests(t, dbDir)
+
+	uid, err := m.RegisterUserPreAuth("locked-user@example.com")
+	require.NoError(t, err, "Registration should not fail")
+	require.NotZero(t, uid, "UID should be set")
+}
+
+func TestUpdateUserWhenLocked(t *testing.T) {
+	// This cannot be parallel
+
+	// This test is flaky, see https://github.com/canonical/authd/issues/1120
+	if os.Getenv("AUTHD_SKIP_FLAKY_TESTS") != "" {
+		t.Skip("skipping flaky test")
+	}
+
+	userslocking.Z_ForTests_OverrideLockingAsLockedExternally(t, context.Background())
+	userslocking.Z_ForTests_SetMaxWaitTime(t, testutils.MultipliedSleepDuration(750*time.Millisecond))
+
+	dbFile := "one_user_and_group"
+	dbDir := t.TempDir()
+	err := db.Z_ForTests_CreateDBFromYAML(filepath.Join("testdata", "db", dbFile+".db.yaml"), dbDir)
+	require.NoError(t, err, "Setup: could not create database from testdata")
+
+	m := newManagerForTests(t, dbDir)
+
+	err = m.UpdateUser(types.UserInfo{UID: 1234, Name: "test-user@example.com"})
+	require.ErrorIs(t, err, userslocking.ErrLock)
+}
+
+func TestUpdateUserAfterUnlock(t *testing.T) {
+	// This cannot be parallel
+
+	// This test is flaky, see https://github.com/canonical/authd/issues/1120
+	if os.Getenv("AUTHD_SKIP_FLAKY_TESTS") != "" {
+		t.Skip("skipping flaky test")
+	}
+
+	waitTime := testutils.MultipliedSleepDuration(750 * time.Millisecond)
+	lockCtx, lockCancel := context.WithTimeout(context.Background(), waitTime/2)
+	t.Cleanup(lockCancel)
+
+	userslocking.Z_ForTests_OverrideLockingAsLockedExternally(t, lockCtx)
+	userslocking.Z_ForTests_SetMaxWaitTime(t, waitTime)
+
+	t.Cleanup(func() { _ = userslocking.WriteUnlock() })
+
+	dbFile := "one_user_and_group"
+	dbDir := t.TempDir()
+	err := db.Z_ForTests_CreateDBFromYAML(filepath.Join("testdata", "db", dbFile+".db.yaml"), dbDir)
+	require.NoError(t, err, "Setup: could not create database from testdata")
+
+	m := newManagerForTests(t, dbDir)
+
+	err = m.UpdateUser(types.UserInfo{UID: 1234, Name: "some-user-test"})
+	require.NoError(t, err, "UpdateUser should not fail")
 }
 
 func requireErrorAssertions(t *testing.T, gotErr, wantErrType error, wantErr bool) {
@@ -623,5 +1362,14 @@ func newManagerForTests(t *testing.T, dbDir string, opts ...users.Option) *users
 
 func TestMain(m *testing.M) {
 	log.SetLevel(log.DebugLevel)
+
+	if testutils.RunningInBubblewrap() {
+		m.Run()
+		return
+	}
+
+	userslocking.Z_ForTests_OverrideLocking()
+	defer userslocking.Z_ForTests_RestoreLocking()
+
 	m.Run()
 }
diff --git a/internal/users/proc/proc.go b/internal/users/proc/proc.go
new file mode 100644
index 0000000000..94f96c4ab4
--- /dev/null
+++ b/internal/users/proc/proc.go
@@ -0,0 +1,209 @@
+// Package proc contains utilities for checking processes via /proc.
+package proc
+
+import (
+	"bufio"
+	"context"
+	"errors"
+	"fmt"
+	"os"
+	"path/filepath"
+	"strconv"
+	"strings"
+	"syscall"
+
+	"github.com/canonical/authd/log"
+)
+
+// ErrUserBusy is returned by CheckUserBusy if the user is currently used by a process.
+var ErrUserBusy = errors.New("user is currently used by process")
+
+// CheckUserBusy checks if a user is currently running any processes.
+//
+// It is a re-implementation of this user_busy_processes() function:
+// https://github.com/shadow-maint/shadow/blob/e78742e553c12222b40b13224d3b0fafaceae791/lib/user_busy.c#L164-L272
+//
+// It returns ErrUserBusy if the user has active processes, nil otherwise.
+func CheckUserBusy(name string, uid uint32) error {
+	log.Debugf(context.Background(), "Checking if user %s (uid %d) is busy", name, uid)
+	var rootStat syscall.Stat_t
+	if err := syscall.Stat("/", &rootStat); err != nil {
+		return fmt.Errorf("stat (\"/\"): %w", err)
+	}
+
+	procDir, err := os.Open("/proc")
+	if err != nil {
+		return fmt.Errorf("opendir /proc: %w", err)
+	}
+	defer func() {
+		_ = procDir.Close()
+	}()
+
+	entries, err := procDir.Readdir(-1)
+	if err != nil {
+		return err
+	}
+
+	for _, entry := range entries {
+		entryName := entry.Name()
+
+		/*
+		 * Ingo Molnar's patch introducing NPTL for 2.4 hides
+		 * threads in the /proc directory by prepending a period.
+		 * This patch is applied by default in some RedHat
+		 * kernels.
+		 */
+		if entryName == "." || entryName == ".." {
+			continue
+		}
+		entryName = strings.TrimPrefix(entryName, ".")
+
+		/* Check if this is a valid PID */
+		pid, err := strconv.Atoi(entryName)
+		if err != nil {
+			continue
+		}
+
+		/* Check if the process is in our chroot */
+		rootPath := fmt.Sprintf("/proc/%d/root", pid)
+		var procRootStat syscall.Stat_t
+		if err := syscall.Stat(rootPath, &procRootStat); err != nil {
+			continue
+		}
+		if rootStat.Dev != procRootStat.Dev || rootStat.Ino != procRootStat.Ino {
+			continue
+		}
+
+		if checkStatus(name, entryName, uid) {
+			return fmt.Errorf("%w %d", ErrUserBusy, pid)
+		}
+
+		taskPath := fmt.Sprintf("/proc/%d/task", pid)
+		taskDir, err := os.Open(taskPath)
+		if err != nil {
+			log.Debugf(context.Background(), "Skipping invalid task path %q: %v", taskPath, err)
+			continue
+		}
+
+		taskEntries, err := taskDir.Readdir(-1)
+		_ = taskDir.Close()
+		if err != nil {
+			log.Debugf(context.Background(), "Skipping invalid task directory %q: %v", taskPath, err)
+			continue
+		}
+
+		for _, taskEntry := range taskEntries {
+			tid, err := strconv.Atoi(taskEntry.Name())
+			if err != nil || tid == pid {
+				continue
+			}
+
+			taskStatusPath := filepath.Join(strconv.Itoa(pid), "task", taskEntry.Name())
+			if checkStatus(name, taskStatusPath, uid) {
+				return fmt.Errorf("%w %d", ErrUserBusy, pid)
+			}
+		}
+	}
+
+	return nil
+}
+
+func differentNamespace(sname string) bool {
+	path := filepath.Join("/proc", sname, "ns", "user")
+
+	dest1, err := os.Readlink(path)
+	if err != nil {
+		return false
+	}
+
+	dest2, err := os.Readlink("/proc/self/ns/user")
+	if err != nil {
+		return false
+	}
+
+	return dest1 != dest2
+}
+
+func checkStatus(username, sname string, uid uint32) bool {
+	statusPath := filepath.Join("/proc", sname, "status")
+	f, err := os.Open(statusPath)
+	if err != nil {
+		return false
+	}
+	defer func() { _ = f.Close() }()
+
+	scanner := bufio.NewScanner(f)
+	for scanner.Scan() {
+		line := scanner.Text()
+		if rest, ok := strings.CutPrefix(line, "Uid:\t"); ok {
+			fields := strings.Fields(rest)
+			if len(fields) < 3 {
+				return false
+			}
+			var uids [3]uint32
+			for i := 0; i < 3; i++ {
+				uid64, err := strconv.ParseUint(fields[i], 10, 32)
+				if err != nil {
+					return false
+				}
+				uids[i] = uint32(uid64)
+			}
+			realUID, effectiveUID, savedUID := uids[0], uids[1], uids[2]
+
+			if realUID == uid || effectiveUID == uid || savedUID == uid {
+				return true
+			}
+
+			// Check sub-UIDs only if in different namespace
+			if differentNamespace(sname) &&
+				(checkSubUID(username, realUID) ||
+					checkSubUID(username, effectiveUID) ||
+					checkSubUID(username, savedUID)) {
+				return true
+			}
+
+			return false
+		}
+	}
+	if err := scanner.Err(); err != nil {
+		return false
+	}
+
+	return false
+}
+
+func checkSubUID(username string, nsUID uint32) bool {
+	f, err := os.Open("/etc/subuid")
+	if err != nil {
+		return false
+	}
+	defer func() { _ = f.Close() }()
+
+	scanner := bufio.NewScanner(f)
+	for scanner.Scan() {
+		line := scanner.Text()
+		fields := strings.Split(line, ":")
+		if len(fields) != 3 {
+			continue
+		}
+		if fields[0] != username {
+			continue
+		}
+
+		start, err1 := strconv.ParseUint(fields[1], 10, 32)
+		count, err2 := strconv.ParseUint(fields[2], 10, 32)
+		if err1 != nil || err2 != nil {
+			log.Debugf(context.Background(), "Invalid subuid entry %q: %v", line, err)
+			continue
+		}
+
+		if nsUID >= uint32(start) && nsUID < uint32(start)+uint32(count) {
+			return true
+		}
+	}
+	if err := scanner.Err(); err != nil {
+		return false
+	}
+
+	return false
+}
diff --git a/internal/users/proc/proc_test.go b/internal/users/proc/proc_test.go
new file mode 100644
index 0000000000..35a11da5a3
--- /dev/null
+++ b/internal/users/proc/proc_test.go
@@ -0,0 +1,49 @@
+package proc_test
+
+import (
+	"os"
+	"os/user"
+	"testing"
+
+	"github.com/canonical/authd/internal/users/proc"
+	"github.com/stretchr/testify/require"
+)
+
+func TestCheckUserBusy(t *testing.T) {
+	t.Parallel()
+
+	currentUser, err := user.Current()
+	require.NoError(t, err, "failed to get current user")
+
+	tests := map[string]struct {
+		user      string
+		uid       uint32
+		wantError bool
+	}{
+		"The_nobody_user_has_no_processes": {
+			user:      "nobody",
+			uid:       65534,
+			wantError: false,
+		},
+		"The_current_user_has_processes": {
+			user: currentUser.Name,
+			//nolint:gosec // G115 UIDs are never negative
+			uid:       uint32(os.Getuid()),
+			wantError: true,
+		},
+	}
+
+	for name, tc := range tests {
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			err := proc.CheckUserBusy(tc.user, tc.uid)
+			t.Logf("CheckUserBusy returned: %v", err)
+			if tc.wantError {
+				require.Error(t, err, "CheckUserBusy should return an error")
+				return
+			}
+			require.NoError(t, err, "CheckUserBusy should not return an error")
+		})
+	}
+}
diff --git a/internal/users/tempentries/export_test.go b/internal/users/tempentries/export_test.go
new file mode 100644
index 0000000000..61c11e3319
--- /dev/null
+++ b/internal/users/tempentries/export_test.go
@@ -0,0 +1,26 @@
+package tempentries
+
+type PreAuthUser = preAuthUser
+
+func NewPreAuthUser(uid uint32, loginName string) PreAuthUser {
+	return PreAuthUser{uid: uid, loginName: loginName}
+}
+
+func (r *PreAuthUserRecords) GetUsers() map[uint32]PreAuthUser {
+	r.rwMu.RLock()
+	defer r.rwMu.RUnlock()
+
+	return r.users
+}
+
+func (r *PreAuthUserRecords) SetTestUsers(users map[uint32]PreAuthUser, uidByLogin map[string]uint32) {
+	r.users = users
+	r.uidByLogin = uidByLogin
+}
+
+func (r *PreAuthUserRecords) DeletePreAuthUser(uid uint32) {
+	r.rwMu.Lock()
+	defer r.rwMu.Unlock()
+
+	r.deletePreAuthUser(uid)
+}
diff --git a/internal/users/tempentries/groups.go b/internal/users/tempentries/groups.go
deleted file mode 100644
index 920fe491f1..0000000000
--- a/internal/users/tempentries/groups.go
+++ /dev/null
@@ -1,175 +0,0 @@
-package tempentries
-
-import (
-	"context"
-	"crypto/rand"
-	"errors"
-	"fmt"
-	"sync"
-
-	"github.com/ubuntu/authd/internal/users/localentries"
-	"github.com/ubuntu/authd/internal/users/types"
-	"github.com/ubuntu/authd/log"
-)
-
-type groupRecord struct {
-	name   string
-	gid    uint32
-	passwd string
-}
-
-type temporaryGroupRecords struct {
-	idGenerator IDGenerator
-	registerMu  sync.Mutex
-	rwMu        sync.RWMutex
-	groups      map[uint32]groupRecord
-	gidByName   map[string]uint32
-}
-
-func newTemporaryGroupRecords(idGenerator IDGenerator) *temporaryGroupRecords {
-	return &temporaryGroupRecords{
-		idGenerator: idGenerator,
-		registerMu:  sync.Mutex{},
-		rwMu:        sync.RWMutex{},
-		groups:      make(map[uint32]groupRecord),
-		gidByName:   make(map[string]uint32),
-	}
-}
-
-// GroupByID returns the group information for the given group ID.
-func (r *temporaryGroupRecords) GroupByID(gid uint32) (types.GroupEntry, error) {
-	r.rwMu.RLock()
-	defer r.rwMu.RUnlock()
-
-	group, ok := r.groups[gid]
-	if !ok {
-		return types.GroupEntry{}, NoDataFoundError{}
-	}
-
-	return groupEntry(group), nil
-}
-
-// GroupByName returns the group information for the given group name.
-func (r *temporaryGroupRecords) GroupByName(name string) (types.GroupEntry, error) {
-	r.rwMu.RLock()
-	defer r.rwMu.RUnlock()
-
-	gid, ok := r.gidByName[name]
-	if !ok {
-		return types.GroupEntry{}, NoDataFoundError{}
-	}
-
-	return r.GroupByID(gid)
-}
-
-func groupEntry(group groupRecord) types.GroupEntry {
-	return types.GroupEntry{Name: group.name, GID: group.gid, Passwd: group.passwd}
-}
-
-// RegisterGroup registers a temporary group with a unique GID in our NSS handler (in memory, not in the database).
-//
-// Returns the generated GID and a cleanup function that should be called to remove the temporary group once the group
-// was added to the database.
-func (r *temporaryGroupRecords) RegisterGroup(name string) (gid uint32, cleanup func(), err error) {
-	r.registerMu.Lock()
-	defer r.registerMu.Unlock()
-
-	// Check if there is already a temporary group with this name
-	_, err = r.GroupByName(name)
-	if err != nil && !errors.Is(err, NoDataFoundError{}) {
-		return 0, nil, fmt.Errorf("could not check if temporary group %q already exists: %w", name, err)
-	}
-	if err == nil {
-		return 0, nil, fmt.Errorf("group %q already exists", name)
-	}
-
-	// Generate a GID until we find a unique one
-	for {
-		gid, err = r.idGenerator.GenerateGID()
-		if err != nil {
-			return 0, nil, err
-		}
-
-		// To avoid races where a group with this GID is created by some NSS source after we checked, we register this
-		// GID in our NSS handler and then check if another group with the same GID exists in the system. This way we
-		// can guarantee that the GID is unique, under the assumption that other NSS sources don't add groups with a GID
-		// that we already registered (if they do, there's nothing we can do about it).
-		var tmpID string
-		tmpID, cleanup, err = r.addTemporaryGroup(gid, name)
-		if err != nil {
-			return 0, nil, fmt.Errorf("could not register temporary group: %w", err)
-		}
-
-		unique, err := r.uniqueNameAndGID(name, gid, tmpID)
-		if err != nil {
-			cleanup()
-			return 0, nil, fmt.Errorf("could not check if GID %d is unique: %w", gid, err)
-		}
-		if unique {
-			break
-		}
-
-		// If the GID is not unique, remove the temporary group and generate a new one in the next iteration.
-		cleanup()
-	}
-
-	log.Debugf(context.Background(), "Registered group %q with GID %d", name, gid)
-	return gid, cleanup, nil
-}
-
-func (r *temporaryGroupRecords) uniqueNameAndGID(name string, gid uint32, tmpID string) (bool, error) {
-	entries, err := localentries.GetGroupEntries()
-	if err != nil {
-		return false, err
-	}
-	for _, entry := range entries {
-		if entry.Name == name && entry.Passwd != tmpID {
-			// A group with the same name already exists, we can't register this temporary group.
-			log.Debugf(context.Background(), "Name %q already in use by GID %d", name, entry.GID)
-			return false, fmt.Errorf("group %q already exists", name)
-		}
-
-		if entry.GID == gid && entry.Passwd != tmpID {
-			log.Debugf(context.Background(), "GID %d already in use by group %q, generating a new one", gid, entry.Name)
-			return false, nil
-		}
-	}
-
-	return true, nil
-}
-
-func (r *temporaryGroupRecords) addTemporaryGroup(gid uint32, name string) (tmpID string, cleanup func(), err error) {
-	r.rwMu.Lock()
-	defer r.rwMu.Unlock()
-
-	// Generate a 64 character (32 bytes in hex) random ID which we store in the passwd field of the temporary group
-	// record to be able to identify it in isUniqueGID.
-	bytes := make([]byte, 32)
-	if _, err := rand.Read(bytes); err != nil {
-		return "", nil, fmt.Errorf("failed to generate random name: %w", err)
-	}
-	tmpID = fmt.Sprintf("authd-temp-group-%x", bytes)
-
-	r.groups[gid] = groupRecord{name: name, gid: gid, passwd: tmpID}
-	r.gidByName[name] = gid
-
-	cleanup = func() { r.deleteTemporaryGroup(gid) }
-
-	return tmpID, cleanup, nil
-}
-
-func (r *temporaryGroupRecords) deleteTemporaryGroup(gid uint32) {
-	r.rwMu.Lock()
-	defer r.rwMu.Unlock()
-
-	group, ok := r.groups[gid]
-	if !ok {
-		log.Warningf(context.Background(), "Can't delete temporary group with GID %d, it does not exist", gid)
-		return
-	}
-
-	delete(r.groups, gid)
-	delete(r.gidByName, group.name)
-
-	log.Debugf(context.Background(), "Removed temporary record for group %q with GID %d", group.name, gid)
-}
diff --git a/internal/users/tempentries/groups_test.go b/internal/users/tempentries/groups_test.go
deleted file mode 100644
index 78e3a5b0de..0000000000
--- a/internal/users/tempentries/groups_test.go
+++ /dev/null
@@ -1,143 +0,0 @@
-package tempentries
-
-import (
-	"testing"
-
-	"github.com/stretchr/testify/require"
-	"github.com/ubuntu/authd/internal/testutils/golden"
-	"github.com/ubuntu/authd/internal/users/idgenerator"
-	"github.com/ubuntu/authd/internal/users/types"
-)
-
-func TestRegisterGroup(t *testing.T) {
-	t.Parallel()
-
-	gidToGenerate := uint32(12345)
-
-	tests := map[string]struct {
-		groupName      string
-		gidsToGenerate []uint32
-
-		wantErr bool
-	}{
-		"Successfully_register_a_new_group": {},
-		"Successfully_register_a_group_if_the_first_generated_GID_is_already_in_use": {
-			gidsToGenerate: []uint32{0, gidToGenerate}, // GID 0 (root) always exists
-		},
-
-		"Error_when_name_is_already_in_use": {groupName: "root", wantErr: true},
-	}
-	for name, tc := range tests {
-		t.Run(name, func(t *testing.T) {
-			t.Parallel()
-
-			if tc.groupName == "" {
-				tc.groupName = "authd-temp-groups-test"
-			}
-
-			if tc.gidsToGenerate == nil {
-				tc.gidsToGenerate = []uint32{gidToGenerate}
-			}
-
-			idGeneratorMock := &idgenerator.IDGeneratorMock{GIDsToGenerate: tc.gidsToGenerate}
-			records := newTemporaryGroupRecords(idGeneratorMock)
-
-			gid, cleanup, err := records.RegisterGroup(tc.groupName)
-			if tc.wantErr {
-				require.Error(t, err, "RegisterGroup should return an error, but did not")
-				return
-			}
-			require.NoError(t, err, "RegisterGroup should not return an error, but did")
-			require.Equal(t, gidToGenerate, gid, "GID should be the one generated by the IDGenerator")
-			// Check that the temporary group was created
-			group, err := records.GroupByID(gid)
-			require.NoError(t, err, "GroupByID should not return an error, but did")
-			checkGroup(t, group)
-
-			// Delete the temporary group
-			cleanup()
-
-			// Check that the temporary group was deleted
-			_, err = records.GroupByID(gid)
-			require.Error(t, err, "GroupByID should return an error, but did not")
-		})
-	}
-}
-
-func TestGroupByIDAndName(t *testing.T) {
-	t.Parallel()
-
-	groupName := "authd-temp-groups-test"
-	gidToGenerate := uint32(12345)
-
-	tests := map[string]struct {
-		registerGroup       bool
-		groupAlreadyRemoved bool
-		byName              bool
-
-		wantErr bool
-	}{
-		"Successfully_get_a_group_by_ID":   {registerGroup: true},
-		"Successfully_get_a_group_by_name": {registerGroup: true, byName: true},
-
-		"Error_when_group_is_not_registered_-_GroupByID":   {wantErr: true},
-		"Error_when_group_is_not_registered_-_GroupByName": {byName: true, wantErr: true},
-		"Error_when_group_is_already_removed_-_GroupByID": {
-			registerGroup:       true,
-			groupAlreadyRemoved: true,
-			wantErr:             true,
-		},
-		"Error_when_group_is_already_removed_-_GroupByName": {
-			registerGroup:       true,
-			groupAlreadyRemoved: true,
-			byName:              true,
-			wantErr:             true,
-		},
-	}
-
-	for name, tc := range tests {
-		t.Run(name, func(t *testing.T) {
-			t.Parallel()
-
-			idGeneratorMock := &idgenerator.IDGeneratorMock{GIDsToGenerate: []uint32{gidToGenerate}}
-			records := newTemporaryGroupRecords(idGeneratorMock)
-
-			if tc.registerGroup {
-				gid, cleanup, err := records.RegisterGroup(groupName)
-				require.NoError(t, err, "RegisterGroup should not return an error, but did")
-				require.Equal(t, gidToGenerate, gid, "GID should be the one generated by the IDGenerator")
-
-				if tc.groupAlreadyRemoved {
-					cleanup()
-				} else {
-					defer cleanup()
-				}
-			}
-
-			var group types.GroupEntry
-			var err error
-			if tc.byName {
-				group, err = records.GroupByID(gidToGenerate)
-			} else {
-				group, err = records.GroupByName(groupName)
-			}
-
-			if tc.wantErr {
-				require.Error(t, err, "GroupByID should return an error, but did not")
-				return
-			}
-			require.NoError(t, err, "GroupByID should not return an error, but did")
-			checkGroup(t, group)
-		})
-	}
-}
-
-func checkGroup(t *testing.T, group types.GroupEntry) {
-	t.Helper()
-
-	// The passwd field is randomly generated, so unset it before comparing the group with the golden file.
-	require.NotEmpty(t, group.Passwd, "Passwd should not be empty")
-	group.Passwd = ""
-
-	golden.CheckOrUpdateYAML(t, group)
-}
diff --git a/internal/users/tempentries/preauth.go b/internal/users/tempentries/preauth.go
index 8ce3e7f388..ca228260f4 100644
--- a/internal/users/tempentries/preauth.go
+++ b/internal/users/tempentries/preauth.go
@@ -1,3 +1,4 @@
+// Package tempentries provides a temporary pre-authentication records.
 package tempentries
 
 import (
@@ -7,9 +8,9 @@ import (
 	"fmt"
 	"sync"
 
-	"github.com/ubuntu/authd/internal/users/localentries"
-	"github.com/ubuntu/authd/internal/users/types"
-	"github.com/ubuntu/authd/log"
+	"github.com/canonical/authd/internal/users/db"
+	"github.com/canonical/authd/internal/users/types"
+	"github.com/canonical/authd/log"
 )
 
 const (
@@ -20,8 +21,17 @@ const (
 	// defined by UID_MIN and UID_MAX in the config file), otherwise finding a unique UID by trial and error can take
 	// too long.
 	MaxPreAuthUsers = 4096
+
+	// MaxPreAuthUserNameLength is the maximum length of the pre-auth user name.
+	MaxPreAuthUserNameLength = 256
+
+	// UserPrefix is the prefix used as login name by the pre-auth temporary users.
+	UserPrefix = "authd-pre-auth-user"
 )
 
+// NoDataFoundError is the error returned when no entry is found in the database.
+type NoDataFoundError = db.NoDataFoundError
+
 type preAuthUser struct {
 	// name is the generated random name of the pre-auth user (which is returned by UserByID).
 	name string
@@ -30,63 +40,164 @@ type preAuthUser struct {
 	uid       uint32
 }
 
-type preAuthUserRecords struct {
-	idGenerator IDGenerator
-	registerMu  sync.Mutex
-	rwMu        sync.RWMutex
-	users       map[uint32]preAuthUser
-	uidByName   map[string]uint32
-	uidByLogin  map[string]uint32
-	numUsers    int
+// PreAuthUserRecords is a structure holding in memory all the temporary users
+// that have done a pre-auth request.
+type PreAuthUserRecords struct {
+	rwMu       sync.RWMutex
+	users      map[uint32]preAuthUser
+	uidByName  map[string]uint32
+	uidByLogin map[string]uint32
 }
 
-func newPreAuthUserRecords(idGenerator IDGenerator) *preAuthUserRecords {
-	return &preAuthUserRecords{
-		idGenerator: idGenerator,
-		registerMu:  sync.Mutex{},
-		rwMu:        sync.RWMutex{},
-		users:       make(map[uint32]preAuthUser),
-		uidByName:   make(map[string]uint32),
-		uidByLogin:  make(map[string]uint32),
+// NewPreAuthUserRecords creates a new instance of [preAuthUserRecords] that
+// can be used to track the temporary preauth user entries.
+func NewPreAuthUserRecords() *PreAuthUserRecords {
+	return &PreAuthUserRecords{
+		users:      make(map[uint32]preAuthUser),
+		uidByName:  make(map[string]uint32),
+		uidByLogin: make(map[string]uint32),
 	}
 }
 
+// MaybeCompletePreauthUser tries to complete a pre-auth user registration.
+//
+// Returns the generated UID if the user was found in the pre-auth list or an, and a cleanup function that should be called to
+// remove the temporary user once the user is added to the database.
+func (r *PreAuthUserRecords) MaybeCompletePreauthUser(name string) (uid uint32, cleanup func(), err error) {
+	r.rwMu.Lock()
+	defer r.rwMu.Unlock()
+
+	// Check if there is already a pre-auth user for that name
+	uid, ok := r.uidByLogin[name]
+	if !ok {
+		return 0, nil, NoDataFoundError{}
+	}
+
+	return uid, func() {
+		r.rwMu.Lock()
+		defer r.rwMu.Unlock()
+
+		r.deletePreAuthUser(uid)
+	}, nil
+}
+
 // UserByID returns the user information for the given user ID.
-func (r *preAuthUserRecords) userByID(uid uint32) (types.UserEntry, error) {
+func (r *PreAuthUserRecords) UserByID(uid uint32) (types.UserEntry, error) {
+	return r.userByID(uid)
+}
+
+// UserByLogin returns the user information for the given user name.
+func (r *PreAuthUserRecords) UserByLogin(name string) (types.UserEntry, error) {
+	return r.userByLogin(name)
+}
+
+// GroupByID returns the private-group information for the given user ID.
+func (r *PreAuthUserRecords) GroupByID(gid uint32) (types.GroupEntry, error) {
+	user, err := r.userByID(gid)
+	if err != nil {
+		return types.GroupEntry{}, err
+	}
+
+	return types.GroupEntry{
+		Name:   user.Name,
+		GID:    user.GID,
+		Users:  []string{user.Name},
+		Passwd: "x",
+	}, nil
+}
+
+// AllUsers returns all pre-auth users as a slice of UserEntry.
+func (r *PreAuthUserRecords) AllUsers() ([]types.UserEntry, error) {
 	r.rwMu.RLock()
 	defer r.rwMu.RUnlock()
 
-	user, ok := r.users[uid]
-	if !ok {
-		return types.UserEntry{}, NoDataFoundError{}
+	if len(r.users) == 0 {
+		return nil, nil
 	}
 
-	return preAuthUserEntry(user), nil
+	users := make([]types.UserEntry, 0, len(r.users))
+	for _, user := range r.users {
+		users = append(users, preAuthUserEntry(user))
+	}
+
+	return users, nil
+}
+
+// RegisterPreAuthUser registers a temporary user with a unique UID in our NSS
+// handler (in memory, not in the database).
+//
+// The temporary user record is removed when [MaybeCompletePreauthUser] is called with the
+// same username.
+//
+// This method is called when a user logs in for the first time via SSH, in
+// which case sshd checks if the user exists on the system (before
+// authentication), and denies the login if the user does not exist.
+// We pretend that the user exists by creating this temporary user record,
+// which is converted into a permanent user record when [RegisterUser] is called
+// after the user authenticated successfully.
+func (r *PreAuthUserRecords) RegisterPreAuthUser(loginName string, uid uint32) (err error) {
+	if loginName == "" {
+		return fmt.Errorf("empty username")
+	}
+
+	// To mitigate DoS attacks, we limit the length of the name to
+	// MaxPreAuthUserNameLength] characters.
+	if len(loginName) > MaxPreAuthUserNameLength {
+		return fmt.Errorf("username is too long (maximum %d characters): %q",
+			MaxPreAuthUserNameLength, loginName)
+	}
+
+	r.rwMu.Lock()
+	defer r.rwMu.Unlock()
+
+	// To mitigate DoS attacks, we limit the pre-auth users to [MaxPreAuthUsers].
+	if len(r.users) >= MaxPreAuthUsers {
+		return errors.New("maximum number of pre-auth users reached, login for new users via SSH is disabled until authd is restarted")
+	}
+
+	if _, ok := r.uidByLogin[loginName]; ok {
+		panic(fmt.Sprintf("We should never be here, User %q is already tracked", loginName))
+	}
+
+	if user, ok := r.users[uid]; ok {
+		panic(fmt.Sprintf("We should never be here, ID %d is already tracked for %q",
+			uid, user.loginName))
+	}
+
+	if err := r.addPreAuthUser(uid, loginName); err != nil {
+		return fmt.Errorf("could not add pre-auth user record: %w", err)
+	}
+
+	return nil
 }
 
-// UserByName returns the user information for the given user name.
-func (r *preAuthUserRecords) userByName(name string) (types.UserEntry, error) {
+// UserByID returns the user information for the given user ID.
+func (r *PreAuthUserRecords) userByID(uid uint32) (types.UserEntry, error) {
 	r.rwMu.RLock()
 	defer r.rwMu.RUnlock()
 
-	uid, ok := r.uidByName[name]
+	return r.userByIDWithoutLock(uid)
+}
+
+func (r *PreAuthUserRecords) userByIDWithoutLock(uid uint32) (types.UserEntry, error) {
+	user, ok := r.users[uid]
 	if !ok {
-		return types.UserEntry{}, NoDataFoundError{}
+		return types.UserEntry{}, db.NewUIDNotFoundError(uid)
 	}
 
-	return r.userByID(uid)
+	return preAuthUserEntry(user), nil
 }
 
-func (r *preAuthUserRecords) userByLogin(loginName string) (types.UserEntry, error) {
+func (r *PreAuthUserRecords) userByLogin(loginName string) (types.UserEntry, error) {
 	r.rwMu.RLock()
 	defer r.rwMu.RUnlock()
 
 	uid, ok := r.uidByLogin[loginName]
 	if !ok {
-		return types.UserEntry{}, NoDataFoundError{}
+		return types.UserEntry{}, db.NewUserNotFoundError(loginName)
 	}
 
-	return r.userByID(uid)
+	return r.userByIDWithoutLock(uid)
 }
 
 func preAuthUserEntry(user preAuthUser) types.UserEntry {
@@ -101,130 +212,46 @@ func preAuthUserEntry(user preAuthUser) types.UserEntry {
 	}
 }
 
-// RegisterPreAuthUser registers a temporary user with a unique UID in our NSS handler (in memory, not in the database).
-//
-// The temporary user record is removed when UpdateUser is called with the same username.
-//
-// This method is called when a user logs in for the first time via SSH, in which case sshd checks if the user exists on
-// the system (before authentication), and denies the login if the user does not exist. We pretend that the user exists
-// by creating this temporary user record, which is converted into a permanent user record when UpdateUser is called
-// after the user authenticated successfully.
-//
-// Returns the generated UID.
-func (r *preAuthUserRecords) RegisterPreAuthUser(loginName string) (uint32, error) {
-	// To mitigate DoS attacks, we limit the length of the name to 256 characters.
-	if len(loginName) > 256 {
-		return 0, errors.New("username is too long (max 256 characters)")
-	}
-
-	r.registerMu.Lock()
-	defer r.registerMu.Unlock()
-
-	if r.numUsers >= MaxPreAuthUsers {
-		return 0, errors.New("maximum number of pre-auth users reached, login for new users via SSH is disabled until authd is restarted")
-	}
-
-	// Check if there is already a pre-auth user for that name
-	user, err := r.userByLogin(loginName)
-	if err != nil && !errors.Is(err, NoDataFoundError{}) {
-		return 0, fmt.Errorf("could not check if pre-auth user %q already exists: %w", loginName, err)
-	}
-	if err == nil {
-		// A pre-auth user is already registered for this name, so we return the already generated UID.
-		return user.UID, nil
+// addPreAuthUser adds a temporary user with a random name and the given UID. We use a random name here to avoid
+// creating user records with attacker-controlled names.
+func (r *PreAuthUserRecords) addPreAuthUser(uid uint32, loginName string) (err error) {
+	if len(r.users) >= MaxPreAuthUsers {
+		return errors.New("maximum number of pre-auth users reached, login for new users via SSH is disabled until authd is restarted")
 	}
 
-	// Generate a UID until we find a unique one
+	var name string
 	for {
-		uid, err := r.idGenerator.GenerateUID()
-		if err != nil {
-			return 0, err
-		}
-
-		// To avoid races where a user with this UID is created by some NSS source after we checked, we register this
-		// UID in our NSS handler and then check if another user with the same UID exists in the system. This way we
-		// can guarantee that the UID is unique, under the assumption that other NSS sources don't add users with a UID
-		// that we already registered (if they do, there's nothing we can do about it).
-		tmpName, cleanup, err := r.addPreAuthUser(uid, loginName)
-		if err != nil {
-			return 0, fmt.Errorf("could not add pre-auth user record: %w", err)
-		}
-
-		unique, err := r.isUniqueUID(uid, tmpName)
-		if err != nil {
-			cleanup()
-			return 0, fmt.Errorf("could not check if UID %d is unique: %w", uid, err)
+		// Generate a 64 character (32 bytes in hex) random ID which we store in the
+		// name field of the temporary user record to be able to identify it.
+		bytes := make([]byte, 32)
+		if _, err := rand.Read(bytes); err != nil {
+			return fmt.Errorf("failed to generate random name: %w", err)
 		}
-		if unique {
-			log.Debugf(context.Background(), "Added temporary record for user %q with UID %d", loginName, uid)
-			return uid, nil
-		}
-
-		// If the UID is not unique, remove the temporary user and generate a new one in the next iteration.
-		cleanup()
-	}
-}
+		name = fmt.Sprintf("%s-%x", UserPrefix, bytes)
 
-// isUniqueUID returns true if the given UID is unique in the system. It returns false if the UID is already assigned to
-// a user by any NSS source (except the given temporary user).
-func (r *preAuthUserRecords) isUniqueUID(uid uint32, tmpName string) (bool, error) {
-	entries, err := localentries.GetPasswdEntries()
-	if err != nil {
-		return false, err
-	}
-	for _, entry := range entries {
-		if entry.UID == uid && entry.Name != tmpName {
-			return false, nil
+		if _, ok := r.uidByName[name]; ok {
+			log.Debugf(context.Background(), "Generated user %q was not unique", name)
+			continue
 		}
-	}
 
-	groupEntries, err := localentries.GetGroupEntries()
-	if err != nil {
-		return false, fmt.Errorf("failed to get group entries: %w", err)
-	}
-	for _, group := range groupEntries {
-		if group.GID == uid {
-			// A group with the same ID already exists, so we can't use that ID as the GID of the temporary user
-			log.Debugf(context.Background(), "ID %d already in use by group %q", uid, group.Name)
-			return false, fmt.Errorf("group with GID %d already exists", uid)
-		}
+		break
 	}
 
-	return true, nil
-}
-
-// addPreAuthUser adds a temporary user with a random name and the given UID. We use a random name here to avoid
-// creating user records with attacker-controlled names.
-//
-// It returns the generated name and a cleanup function to remove the temporary user record.
-func (r *preAuthUserRecords) addPreAuthUser(uid uint32, loginName string) (name string, cleanup func(), err error) {
-	r.rwMu.Lock()
-	defer r.rwMu.Unlock()
-
-	// Generate a 64 character (32 bytes in hex) random ID which we store in the name field of the temporary user
-	// record to be able to identify it in isUniqueUID.
-	bytes := make([]byte, 32)
-	if _, err := rand.Read(bytes); err != nil {
-		return "", nil, fmt.Errorf("failed to generate random name: %w", err)
-	}
-	name = fmt.Sprintf("authd-pre-auth-user-%x", bytes)
+	log.Debugf(context.Background(),
+		"Added temporary record for user %q with UID %d as %q", loginName, uid, name)
 
 	user := preAuthUser{name: name, uid: uid, loginName: loginName}
 	r.users[uid] = user
 	r.uidByName[name] = uid
 	r.uidByLogin[loginName] = uid
-	r.numUsers++
-
-	cleanup = func() { r.deletePreAuthUser(uid) }
 
-	return name, cleanup, nil
+	return nil
 }
 
 // deletePreAuthUser deletes the temporary user with the given UID.
-func (r *preAuthUserRecords) deletePreAuthUser(uid uint32) {
-	r.rwMu.Lock()
-	defer r.rwMu.Unlock()
-
+//
+// This must be called with the mutex locked.
+func (r *PreAuthUserRecords) deletePreAuthUser(uid uint32) {
 	user, ok := r.users[uid]
 	if !ok {
 		// We ignore the case that the pre-auth user does not exist, because it can happen that the same user is
@@ -235,6 +262,5 @@ func (r *preAuthUserRecords) deletePreAuthUser(uid uint32) {
 	delete(r.users, uid)
 	delete(r.uidByName, user.name)
 	delete(r.uidByLogin, user.loginName)
-	r.numUsers--
 	log.Debugf(context.Background(), "Removed temporary record for user %q with UID %d", user.name, uid)
 }
diff --git a/internal/users/tempentries/preauth_test.go b/internal/users/tempentries/preauth_test.go
index 67dc89e149..c0900baf30 100644
--- a/internal/users/tempentries/preauth_test.go
+++ b/internal/users/tempentries/preauth_test.go
@@ -1,79 +1,184 @@
-package tempentries
+package tempentries_test
 
 import (
+	"fmt"
+	"slices"
+	"strings"
 	"testing"
 
+	"github.com/canonical/authd/internal/testutils/golden"
+	"github.com/canonical/authd/internal/users"
+	"github.com/canonical/authd/internal/users/localentries"
+	userslocking "github.com/canonical/authd/internal/users/locking"
+	"github.com/canonical/authd/internal/users/tempentries"
+	"github.com/canonical/authd/internal/users/types"
+	"github.com/canonical/authd/log"
 	"github.com/stretchr/testify/require"
-	"github.com/ubuntu/authd/internal/testutils/golden"
-	"github.com/ubuntu/authd/internal/users/idgenerator"
-	"github.com/ubuntu/authd/internal/users/types"
 )
 
 func TestPreAuthUser(t *testing.T) {
 	t.Parallel()
 
-	loginName := "test"
+	defaultLoginName := t.Name()
 	uidToGenerate := uint32(12345)
 
 	tests := map[string]struct {
+		users          []string
 		maxUsers       bool
 		uidsToGenerate []uint32
-		registerTwice  bool
 
-		wantErr bool
+		wantErr   bool
+		wantPanic []bool
+		wantUIDs  []uint32
 	}{
 		"Successfully_register_a_pre-auth_user": {},
-		"Successfully_register_a_pre-auth_user_if_the_first_generated_UID_is_already_in_use": {
-			uidsToGenerate: []uint32{0, uidToGenerate}, // UID 0 (root) always exists
+		"Panics_registering_a_pre-auth_user_again": {
+			users:          []string{defaultLoginName, defaultLoginName},
+			uidsToGenerate: []uint32{uidToGenerate, uidToGenerate},
+			wantUIDs:       []uint32{uidToGenerate},
+			wantPanic:      []bool{false, true},
+		},
+		"Panics_registering_a_pre-auth_user_again_with_different_uid": {
+			users:          []string{defaultLoginName, defaultLoginName},
+			uidsToGenerate: []uint32{uidToGenerate, uidToGenerate + 1},
+			wantUIDs:       []uint32{uidToGenerate},
+			wantPanic:      []bool{false, true},
+		},
+		"Panics_registering_a_pre-auth_user_if_the_first_generated_UID_is_already_registered": {
+			users:          []string{defaultLoginName, "other-test"},
+			uidsToGenerate: []uint32{uidToGenerate, uidToGenerate, uidToGenerate + 1},
+			wantUIDs:       []uint32{uidToGenerate, uidToGenerate + 1},
+			wantPanic:      []bool{false, true},
 		},
-		"No_error_when_registering_a_pre-auth_user_with_the_same_name": {registerTwice: true},
 
 		"Error_when_maximum_number_of_pre-auth_users_is_reached": {maxUsers: true, wantErr: true},
+		"Error_when_login_name_is_empty": {
+			users:   []string{""},
+			wantErr: true,
+		},
+		"Error_when_login_name_exceeds_maximum_length": {
+			users:   []string{strings.Repeat("a", tempentries.MaxPreAuthUserNameLength+1)},
+			wantErr: true,
+		},
 	}
 
 	for name, tc := range tests {
 		t.Run(name, func(t *testing.T) {
 			t.Parallel()
 
+			if len(tc.users) == 0 {
+				tc.users = append(tc.users, defaultLoginName)
+			}
+
 			if tc.uidsToGenerate == nil {
-				tc.uidsToGenerate = []uint32{uidToGenerate}
+				uid := uidToGenerate
+				for range tc.users {
+					tc.uidsToGenerate = append(tc.uidsToGenerate, uid)
+					uid++
+				}
+			}
+			if tc.wantUIDs == nil {
+				tc.wantUIDs = tc.uidsToGenerate
 			}
 
-			idGeneratorMock := &idgenerator.IDGeneratorMock{UIDsToGenerate: tc.uidsToGenerate}
-			records := newPreAuthUserRecords(idGeneratorMock)
+			t.Log("UIDs to generate", tc.uidsToGenerate)
+			idGeneratorMock := &users.IDGeneratorMock{UIDsToGenerate: tc.uidsToGenerate}
+			records := tempentries.NewPreAuthUserRecords()
 
 			if tc.maxUsers {
-				records.numUsers = MaxPreAuthUsers
-			}
+				users := make(map[uint32]tempentries.PreAuthUser, tempentries.MaxPreAuthUsers)
+				uidByLogin := make(map[string]uint32)
 
-			uid, err := records.RegisterPreAuthUser(loginName)
-			if tc.wantErr {
-				require.Error(t, err, "RegisterPreAuthUser should return an error, but did not")
-				return
+				for i := range uint32(tempentries.MaxPreAuthUsers) {
+					uid := uidToGenerate + i + 1
+					loginName := fmt.Sprintf("pre-auth-%d", uid)
+					users[uid] = tempentries.NewPreAuthUser(uid, loginName)
+					uidByLogin[loginName] = uid
+				}
+
+				records.SetTestUsers(users, uidByLogin)
+			}
+			if tc.wantPanic == nil {
+				tc.wantPanic = make([]bool, len(tc.users))
 			}
-			require.NoError(t, err, "RegisterPreAuthUser should not return an error, but did")
-			require.Equal(t, uidToGenerate, uid, "UID should be the one generated by the IDGenerator")
-			require.Equal(t, records.numUsers, 1, "Number of pre-auth users should be 1")
 
-			if tc.registerTwice {
-				uid, err = records.RegisterPreAuthUser(loginName)
+			wantRegistered := 0
+			var registeredUIDs []uint32
+
+			for idx, loginName := range tc.users {
+				t.Logf("Registering user %q", loginName)
+				uid, _, err := idGeneratorMock.GenerateUID(&localentries.UserDBLocked{}, nil)
+				require.NoError(t, err, "GenerateUID should not return an error, but it did")
+
+				if tc.wantPanic[idx] {
+					require.Panics(t, func() { _ = records.RegisterPreAuthUser(loginName, uid) },
+						"RegisterPreAuthUser should have panic'ed but it did not")
+					continue
+				}
+				err = records.RegisterPreAuthUser(loginName, uid)
+				if tc.wantErr {
+					require.Error(t, err, "RegisterPreAuthUser should return an error, but did not")
+					continue
+				}
+
+				isDuplicated := slices.Contains(tc.users[0:idx], loginName)
+				if !isDuplicated {
+					wantRegistered++
+				}
+
+				wantUID := tc.wantUIDs[wantRegistered-1]
+
 				require.NoError(t, err, "RegisterPreAuthUser should not return an error, but did")
-				require.Equal(t, uidToGenerate, uid, "UID should be the one generated by the IDGenerator")
-				require.Equal(t, records.numUsers, 1, "Number of pre-auth users should be 1")
+				require.Equal(t, wantUID, uid, "UID should be the one generated by the IDGenerator")
+				require.Len(t, records.GetUsers(), wantRegistered,
+					"Number of pre-auth registered, users should be %d", wantRegistered)
+
+				if isDuplicated {
+					require.Contains(t, registeredUIDs, uid, "UID %d has been already registered!", uid)
+				} else {
+					require.NotContains(t, registeredUIDs, uid, "UID %d has not been already registered!", uid)
+				}
+
+				registeredUIDs = append(registeredUIDs, uid)
+
+				// Check that the user was registered
+				user, err := records.UserByLogin(loginName)
+				require.NoError(t, err, "UserByID should not return an error, but did")
+
+				var goldenOptions []golden.Option
+				if idx > 0 {
+					userSuffix := fmt.Sprintf("_%s_%d", loginName, idx)
+					goldenOptions = append(goldenOptions, golden.WithSuffix(userSuffix))
+				}
+				checkPreAuthUser(t, user, goldenOptions...)
 			}
 
-			// Check that the user was registered
-			user, err := records.userByLogin(loginName)
-			require.NoError(t, err, "UserByID should not return an error, but did")
-			checkPreAuthUser(t, user)
+			if wantRegistered == 0 {
+				return
+			}
+
+			for idx, loginName := range tc.users {
+				if tc.wantPanic[idx] {
+					continue
+				}
+				isDuplicated := slices.Contains(tc.users[0:idx], loginName)
+				if !isDuplicated {
+					wantRegistered--
+				}
 
-			// Remove the user
-			records.deletePreAuthUser(uidToGenerate)
-			require.Equal(t, records.numUsers, 0, "Number of pre-auth users should be 0")
+				removeUID := registeredUIDs[len(registeredUIDs)-wantRegistered-1]
+				t.Logf("Removing user %q for UID %v", loginName, removeUID)
+				preauthUID, cleanup, err := records.MaybeCompletePreauthUser(loginName)
+				require.NoError(t, err, "MaybeCompletePreauthUser should not fail but it did")
+				require.Equal(t, removeUID, preauthUID, "MaybeCompletePreauthUser UID is not matching")
+				cleanup()
+				require.Len(t, records.GetUsers(), wantRegistered,
+					"Number of pre-auth users should be %d", wantRegistered)
 
-			// Check that the user was removed
-			_, err = records.userByLogin(loginName)
-			require.Error(t, err, "UserByID should return an error, but did not")
+				// Check that the user was removed
+				_, err = records.UserByLogin(loginName)
+				require.Error(t, err, "UserByID should return an error, but did not")
+			}
 		})
 	}
 }
@@ -81,7 +186,7 @@ func TestPreAuthUser(t *testing.T) {
 func TestPreAuthUserByIDAndName(t *testing.T) {
 	t.Parallel()
 
-	loginName := "test"
+	loginName := t.Name()
 	uidToGenerate := uint32(12345)
 
 	tests := map[string]struct {
@@ -100,22 +205,24 @@ func TestPreAuthUserByIDAndName(t *testing.T) {
 		t.Run(name, func(t *testing.T) {
 			t.Parallel()
 
-			idGeneratorMock := &idgenerator.IDGeneratorMock{UIDsToGenerate: []uint32{uidToGenerate}}
-			records := newPreAuthUserRecords(idGeneratorMock)
+			idGeneratorMock := &users.IDGeneratorMock{UIDsToGenerate: []uint32{uidToGenerate}}
+			records := tempentries.NewPreAuthUserRecords()
 
 			if tc.registerUser {
-				uid, err := records.RegisterPreAuthUser(loginName)
-				require.NoError(t, err, "RegisterPreAuthUser should not return an error, but did")
-				require.Equal(t, uidToGenerate, uid, "UID should be the one generated by the IDGenerator")
+				uid, _, err := idGeneratorMock.GenerateUID(&localentries.UserDBLocked{}, nil)
+				require.NoError(t, err, "GenerateUID should not return an error, but it did")
+
+				err = records.RegisterPreAuthUser(loginName, uid)
+				require.NoError(t, err, "generatePreAuthUserID should not return an error, but did")
 			}
 
 			if tc.userAlreadyRemoved {
-				records.deletePreAuthUser(uidToGenerate)
+				records.DeletePreAuthUser(uidToGenerate)
 			} else {
-				defer records.deletePreAuthUser(uidToGenerate)
+				defer records.DeletePreAuthUser(uidToGenerate)
 			}
 
-			user, err := records.userByID(uidToGenerate)
+			user, err := records.UserByID(uidToGenerate)
 
 			if tc.wantErr {
 				require.Error(t, err, "UserByID should return an error, but did not")
@@ -123,24 +230,27 @@ func TestPreAuthUserByIDAndName(t *testing.T) {
 			}
 			require.NoError(t, err, "UserByID should not return an error, but did")
 			checkPreAuthUser(t, user)
-
-			user, err = records.userByName(user.Name)
-			if tc.wantErr {
-				require.Error(t, err, "UserByName should return an error, but did not")
-				return
-			}
-			require.NoError(t, err, "UserByName should not return an error, but did")
-			checkPreAuthUser(t, user)
 		})
 	}
 }
 
-func checkPreAuthUser(t *testing.T, user types.UserEntry) {
+func checkPreAuthUser(t *testing.T, user types.UserEntry, options ...golden.Option) {
 	t.Helper()
 
-	// The name field is randomly generated, so unset it before comparing the user with the golden file.
-	require.NotEmpty(t, user.Name, "Name should not be empty")
-	user.Name = ""
+	// The name field contains a randomly generated part, so we replace that part
+	// before comparing the user with the golden file.
+	require.True(t, strings.HasPrefix(user.Name, tempentries.UserPrefix),
+		"Name should have %q prefix", tempentries.UserPrefix)
+	user.Name = tempentries.UserPrefix + "-{RANDOM-ID}"
+
+	golden.CheckOrUpdateYAML(t, user, options...)
+}
+
+func TestMain(m *testing.M) {
+	log.SetLevel(log.DebugLevel)
+
+	userslocking.Z_ForTests_OverrideLocking()
+	defer userslocking.Z_ForTests_RestoreLocking()
 
-	golden.CheckOrUpdateYAML(t, user)
+	m.Run()
 }
diff --git a/internal/users/tempentries/tempentries.go b/internal/users/tempentries/tempentries.go
deleted file mode 100644
index e0e9f3e6b0..0000000000
--- a/internal/users/tempentries/tempentries.go
+++ /dev/null
@@ -1,148 +0,0 @@
-// Package tempentries provides a temporary user and group records.
-package tempentries
-
-import (
-	"context"
-	"errors"
-	"fmt"
-
-	"github.com/ubuntu/authd/internal/users/db"
-	"github.com/ubuntu/authd/internal/users/types"
-	"github.com/ubuntu/authd/log"
-)
-
-// NoDataFoundError is the error returned when no entry is found in the database.
-type NoDataFoundError = db.NoDataFoundError
-
-// IDGenerator is the interface that must be implemented by the ID generator.
-type IDGenerator interface {
-	GenerateUID() (uint32, error)
-	GenerateGID() (uint32, error)
-}
-
-// TemporaryRecords is the in-memory temporary user and group records.
-type TemporaryRecords struct {
-	*temporaryUserRecords
-	*preAuthUserRecords
-	*temporaryGroupRecords
-
-	idGenerator IDGenerator
-}
-
-// NewTemporaryRecords creates a new TemporaryRecords.
-func NewTemporaryRecords(idGenerator IDGenerator) *TemporaryRecords {
-	return &TemporaryRecords{
-		idGenerator:           idGenerator,
-		temporaryUserRecords:  newTemporaryUserRecords(idGenerator),
-		preAuthUserRecords:    newPreAuthUserRecords(idGenerator),
-		temporaryGroupRecords: newTemporaryGroupRecords(idGenerator),
-	}
-}
-
-// UserByID returns the user information for the given user ID.
-func (r *TemporaryRecords) UserByID(uid uint32) (types.UserEntry, error) {
-	user, err := r.temporaryUserRecords.userByID(uid)
-	if errors.Is(err, NoDataFoundError{}) {
-		user, err = r.preAuthUserRecords.userByID(uid)
-	}
-	return user, err
-}
-
-// UserByName returns the user information for the given user name.
-func (r *TemporaryRecords) UserByName(name string) (types.UserEntry, error) {
-	user, err := r.temporaryUserRecords.userByName(name)
-	if errors.Is(err, NoDataFoundError{}) {
-		user, err = r.preAuthUserRecords.userByName(name)
-	}
-	return user, err
-}
-
-// RegisterUser registers a temporary user with a unique UID in our NSS handler (in memory, not in the database).
-//
-// Returns the generated UID and a cleanup function that should be called to remove the temporary user once the user was
-// added to the database.
-func (r *TemporaryRecords) RegisterUser(name string) (uid uint32, cleanup func(), err error) {
-	r.temporaryUserRecords.registerMu.Lock()
-	defer r.temporaryUserRecords.registerMu.Unlock()
-
-	// Check if there is a temporary  user with the same login name.
-	_, err = r.temporaryUserRecords.userByName(name)
-	if err != nil && !errors.Is(err, NoDataFoundError{}) {
-		return 0, nil, fmt.Errorf("could not check if temporary user %q already exists: %w", name, err)
-	}
-	if err == nil {
-		return 0, nil, fmt.Errorf("user %q already exists", name)
-	}
-
-	// Check if there is a pre-auth user with the same login name.
-	user, err := r.preAuthUserRecords.userByLogin(name)
-	if err != nil && !errors.Is(err, NoDataFoundError{}) {
-		return 0, nil, fmt.Errorf("could not check if pre-auth user %q already exists: %w", name, err)
-	}
-	if err == nil {
-		// There is a pre-auth user with the same login name. Now that the user authenticated successfully, we can
-		// replace the pre-auth user with a temporary user.
-		return r.replacePreAuthUser(user, name)
-	}
-
-	// Generate a UID until we find a unique one
-	for {
-		uid, err = r.idGenerator.GenerateUID()
-		if err != nil {
-			return 0, nil, err
-		}
-
-		// To avoid races where a user with this UID is created by some NSS source after we checked, we register this
-		// UID in our NSS handler and then check if another user with the same UID exists in the system. This way we
-		// can guarantee that the UID is unique, under the assumption that other NSS sources don't add users with a UID
-		// that we already registered (if they do, there's nothing we can do about it).
-		var tmpID string
-		tmpID, cleanup, err = r.temporaryUserRecords.addTemporaryUser(uid, name)
-		if err != nil {
-			return 0, nil, fmt.Errorf("could not add temporary user record: %w", err)
-		}
-
-		unique, err := r.temporaryUserRecords.uniqueNameAndUID(name, uid, tmpID)
-		if err != nil {
-			err = fmt.Errorf("checking UID and name uniqueness: %w", err)
-			cleanup()
-			return 0, nil, err
-		}
-		if unique {
-			break
-		}
-
-		// If the UID is not unique, remove the temporary user and generate a new one in the next iteration.
-		cleanup()
-	}
-
-	log.Debugf(context.Background(), "Added temporary record for user %q with UID %d", name, uid)
-	return uid, cleanup, nil
-}
-
-// replacePreAuthUser replaces a pre-auth user with a temporary user with the same name and UID.
-func (r *TemporaryRecords) replacePreAuthUser(user types.UserEntry, name string) (uid uint32, cleanup func(), err error) {
-	var tmpID string
-	tmpID, cleanup, err = r.addTemporaryUser(user.UID, name)
-	if err != nil {
-		return 0, nil, fmt.Errorf("could not add temporary user record: %w", err)
-	}
-
-	// Remove the pre-auth user from the pre-auth user records.
-	r.deletePreAuthUser(user.UID)
-
-	// Check if the UID and name are unique.
-	unique, err := r.temporaryUserRecords.uniqueNameAndUID(name, user.UID, tmpID)
-	if err != nil {
-		err = fmt.Errorf("checking UID and name uniqueness: %w", err)
-		cleanup()
-		return 0, nil, err
-	}
-	if !unique {
-		err = fmt.Errorf("UID (%d) or name (%q) from pre-auth user are not unique", user.UID, name)
-		cleanup()
-		return 0, nil, err
-	}
-
-	return user.UID, cleanup, nil
-}
diff --git a/internal/users/tempentries/tempentries_test.go b/internal/users/tempentries/tempentries_test.go
deleted file mode 100644
index f90a842bf2..0000000000
--- a/internal/users/tempentries/tempentries_test.go
+++ /dev/null
@@ -1,174 +0,0 @@
-package tempentries
-
-import (
-	"testing"
-
-	"github.com/stretchr/testify/require"
-	"github.com/ubuntu/authd/internal/testutils/golden"
-	"github.com/ubuntu/authd/internal/users/idgenerator"
-	"github.com/ubuntu/authd/internal/users/types"
-)
-
-func TestRegisterUser(t *testing.T) {
-	t.Parallel()
-
-	uidToGenerate := uint32(12345)
-	userName := "authd-temp-users-test"
-
-	tests := map[string]struct {
-		userName                string
-		uidsToGenerate          []uint32
-		userAlreadyRemoved      bool
-		replacesPreAuthUser     bool
-		preAuthUIDAlreadyExists bool
-
-		wantErr bool
-	}{
-		"Successfully_register_a_new_user": {},
-		"Successfully_register_a_user_if_the_first_generated_UID_is_already_in_use": {
-			uidsToGenerate: []uint32{0, uidToGenerate}, // UID 0 (root) always exists
-		},
-		"Successfully_register_a_user_if_the_pre-auth_user_already_exists": {
-			replacesPreAuthUser: true,
-			uidsToGenerate:      []uint32{}, // No UID generation needed
-		},
-
-		"Error_when_name_is_already_in_use": {userName: "root", wantErr: true},
-		"Error_when_pre-auth_user_already_exists_and_name_is_not_unique": {
-			replacesPreAuthUser: true,
-			userName:            "root",
-			wantErr:             true,
-		},
-		"Error_when_pre-auth_UID_is_not_unique": {
-			replacesPreAuthUser:     true,
-			preAuthUIDAlreadyExists: true,
-			wantErr:                 true,
-		},
-	}
-
-	for name, tc := range tests {
-		t.Run(name, func(t *testing.T) {
-			t.Parallel()
-
-			if tc.userName == "" {
-				tc.userName = userName
-			}
-
-			if tc.uidsToGenerate == nil {
-				tc.uidsToGenerate = []uint32{uidToGenerate}
-			}
-
-			idGeneratorMock := &idgenerator.IDGeneratorMock{UIDsToGenerate: tc.uidsToGenerate}
-			records := NewTemporaryRecords(idGeneratorMock)
-
-			var preAuthUID uint32
-			if tc.replacesPreAuthUser {
-				preAuthUID = uidToGenerate
-				if tc.preAuthUIDAlreadyExists {
-					preAuthUID = 0 // UID 0 (root) always exists
-				}
-				_, _, err := records.preAuthUserRecords.addPreAuthUser(preAuthUID, tc.userName)
-				require.NoError(t, err, "addPreAuthUser should not return an error, but did")
-			}
-
-			uid, cleanup, err := records.RegisterUser(tc.userName)
-			if tc.wantErr {
-				require.Error(t, err, "RegisterUser should return an error, but did not")
-				return
-			}
-			require.NoError(t, err, "RegisterUser should not return an error, but did")
-			require.Equal(t, uidToGenerate, uid, "UID should be the one generated by the IDGenerator")
-
-			if tc.replacesPreAuthUser {
-				// Check that the pre-auth user was removed
-				_, err = records.preAuthUserRecords.userByID(preAuthUID)
-				require.Error(t, err, "userByID should return an error, but did not")
-			}
-
-			user, err := records.UserByID(uid)
-			require.NoError(t, err, "UserByID should not return an error, but did")
-			checkUser(t, user)
-
-			cleanup()
-		})
-	}
-}
-
-func TestUserByIDAndName(t *testing.T) {
-	t.Parallel()
-
-	userName := "authd-temp-users-test"
-	uidToGenerate := uint32(12345)
-
-	tests := map[string]struct {
-		registerUser       bool
-		userAlreadyRemoved bool
-		byName             bool
-
-		wantErr bool
-	}{
-		"Successfully_get_a_user_by_ID":   {registerUser: true},
-		"Successfully_get_a_user_by_name": {registerUser: true, byName: true},
-
-		"Error_when_user_is_not_registered_-_UserByID":   {wantErr: true},
-		"Error_when_user_is_not_registered_-_UserByName": {byName: true, wantErr: true},
-		"Error_when_user_is_already_removed_-_UserByID": {
-			registerUser:       true,
-			userAlreadyRemoved: true,
-			wantErr:            true,
-		},
-		"Error_when_user_is_already_removed_-_UserByName": {
-			registerUser:       true,
-			userAlreadyRemoved: true,
-			byName:             true,
-			wantErr:            true,
-		},
-	}
-
-	for name, tc := range tests {
-		t.Run(name, func(t *testing.T) {
-			t.Parallel()
-
-			idGeneratorMock := &idgenerator.IDGeneratorMock{UIDsToGenerate: []uint32{uidToGenerate}}
-			records := NewTemporaryRecords(idGeneratorMock)
-			userRecords := records.temporaryUserRecords
-
-			if tc.registerUser {
-				uid, cleanup, err := records.RegisterUser(userName)
-				require.NoError(t, err, "RegisterUser should not return an error, but did")
-				require.Equal(t, uidToGenerate, uid, "UID should be the one generated by the IDGenerator")
-
-				if tc.userAlreadyRemoved {
-					cleanup()
-				} else {
-					defer cleanup()
-				}
-			}
-
-			var user types.UserEntry
-			var err error
-			if tc.byName {
-				user, err = userRecords.userByName(userName)
-			} else {
-				user, err = userRecords.userByID(uidToGenerate)
-			}
-
-			if tc.wantErr {
-				require.Error(t, err, "UserByID should return an error, but did not")
-				return
-			}
-			require.NoError(t, err, "UserByID should not return an error, but did")
-			checkUser(t, user)
-		})
-	}
-}
-
-func checkUser(t *testing.T, user types.UserEntry) {
-	t.Helper()
-
-	// The gecos field is randomly generated, so unset it before comparing the user with the golden file.
-	require.NotEmpty(t, user.Gecos, "Gecos should not be empty")
-	user.Gecos = ""
-
-	golden.CheckOrUpdateYAML(t, user)
-}
diff --git a/internal/users/tempentries/testdata/golden/TestGroupByIDAndName/Successfully_get_a_group_by_ID b/internal/users/tempentries/testdata/golden/TestGroupByIDAndName/Successfully_get_a_group_by_ID
deleted file mode 100644
index e992cfed83..0000000000
--- a/internal/users/tempentries/testdata/golden/TestGroupByIDAndName/Successfully_get_a_group_by_ID
+++ /dev/null
@@ -1,4 +0,0 @@
-name: authd-temp-groups-test
-gid: 12345
-users: []
-passwd: ""
diff --git a/internal/users/tempentries/testdata/golden/TestGroupByIDAndName/Successfully_get_a_group_by_name b/internal/users/tempentries/testdata/golden/TestGroupByIDAndName/Successfully_get_a_group_by_name
deleted file mode 100644
index e992cfed83..0000000000
--- a/internal/users/tempentries/testdata/golden/TestGroupByIDAndName/Successfully_get_a_group_by_name
+++ /dev/null
@@ -1,4 +0,0 @@
-name: authd-temp-groups-test
-gid: 12345
-users: []
-passwd: ""
diff --git a/internal/users/tempentries/testdata/golden/TestPreAuthUser/No_error_when_registering_a_pre-auth_user_with_the_same_name b/internal/users/tempentries/testdata/golden/TestPreAuthUser/Panics_registering_a_pre-auth_user_again
similarity index 51%
rename from internal/users/tempentries/testdata/golden/TestPreAuthUser/No_error_when_registering_a_pre-auth_user_with_the_same_name
rename to internal/users/tempentries/testdata/golden/TestPreAuthUser/Panics_registering_a_pre-auth_user_again
index fa0bd512de..a03c6001b8 100644
--- a/internal/users/tempentries/testdata/golden/TestPreAuthUser/No_error_when_registering_a_pre-auth_user_with_the_same_name
+++ b/internal/users/tempentries/testdata/golden/TestPreAuthUser/Panics_registering_a_pre-auth_user_again
@@ -1,6 +1,6 @@
-name: ""
+name: authd-pre-auth-user-{RANDOM-ID}
 uid: 12345
 gid: 12345
-gecos: test
+gecos: TestPreAuthUser
 dir: /nonexistent
 shell: /usr/sbin/nologin
diff --git a/internal/users/tempentries/testdata/golden/TestPreAuthUser/Successfully_register_a_pre-auth_user_if_the_first_generated_UID_is_already_in_use b/internal/users/tempentries/testdata/golden/TestPreAuthUser/Panics_registering_a_pre-auth_user_again_with_different_uid
similarity index 51%
rename from internal/users/tempentries/testdata/golden/TestPreAuthUser/Successfully_register_a_pre-auth_user_if_the_first_generated_UID_is_already_in_use
rename to internal/users/tempentries/testdata/golden/TestPreAuthUser/Panics_registering_a_pre-auth_user_again_with_different_uid
index fa0bd512de..a03c6001b8 100644
--- a/internal/users/tempentries/testdata/golden/TestPreAuthUser/Successfully_register_a_pre-auth_user_if_the_first_generated_UID_is_already_in_use
+++ b/internal/users/tempentries/testdata/golden/TestPreAuthUser/Panics_registering_a_pre-auth_user_again_with_different_uid
@@ -1,6 +1,6 @@
-name: ""
+name: authd-pre-auth-user-{RANDOM-ID}
 uid: 12345
 gid: 12345
-gecos: test
+gecos: TestPreAuthUser
 dir: /nonexistent
 shell: /usr/sbin/nologin
diff --git a/internal/users/tempentries/testdata/golden/TestRegisterUser/Successfully_register_a_new_user b/internal/users/tempentries/testdata/golden/TestPreAuthUser/Panics_registering_a_pre-auth_user_if_the_first_generated_UID_is_already_registered
similarity index 51%
rename from internal/users/tempentries/testdata/golden/TestRegisterUser/Successfully_register_a_new_user
rename to internal/users/tempentries/testdata/golden/TestPreAuthUser/Panics_registering_a_pre-auth_user_if_the_first_generated_UID_is_already_registered
index c6f5874e44..a03c6001b8 100644
--- a/internal/users/tempentries/testdata/golden/TestRegisterUser/Successfully_register_a_new_user
+++ b/internal/users/tempentries/testdata/golden/TestPreAuthUser/Panics_registering_a_pre-auth_user_if_the_first_generated_UID_is_already_registered
@@ -1,6 +1,6 @@
-name: authd-temp-users-test
+name: authd-pre-auth-user-{RANDOM-ID}
 uid: 12345
 gid: 12345
-gecos: ""
+gecos: TestPreAuthUser
 dir: /nonexistent
 shell: /usr/sbin/nologin
diff --git a/internal/users/tempentries/testdata/golden/TestPreAuthUser/Successfully_register_a_pre-auth_user b/internal/users/tempentries/testdata/golden/TestPreAuthUser/Successfully_register_a_pre-auth_user
index fa0bd512de..a03c6001b8 100644
--- a/internal/users/tempentries/testdata/golden/TestPreAuthUser/Successfully_register_a_pre-auth_user
+++ b/internal/users/tempentries/testdata/golden/TestPreAuthUser/Successfully_register_a_pre-auth_user
@@ -1,6 +1,6 @@
-name: ""
+name: authd-pre-auth-user-{RANDOM-ID}
 uid: 12345
 gid: 12345
-gecos: test
+gecos: TestPreAuthUser
 dir: /nonexistent
 shell: /usr/sbin/nologin
diff --git a/internal/users/tempentries/testdata/golden/TestPreAuthUserByIDAndName/Successfully_get_a_user_by_ID_and_name b/internal/users/tempentries/testdata/golden/TestPreAuthUserByIDAndName/Successfully_get_a_user_by_ID_and_name
index fa0bd512de..6742c3e888 100644
--- a/internal/users/tempentries/testdata/golden/TestPreAuthUserByIDAndName/Successfully_get_a_user_by_ID_and_name
+++ b/internal/users/tempentries/testdata/golden/TestPreAuthUserByIDAndName/Successfully_get_a_user_by_ID_and_name
@@ -1,6 +1,6 @@
-name: ""
+name: authd-pre-auth-user-{RANDOM-ID}
 uid: 12345
 gid: 12345
-gecos: test
+gecos: TestPreAuthUserByIDAndName
 dir: /nonexistent
 shell: /usr/sbin/nologin
diff --git a/internal/users/tempentries/testdata/golden/TestRegisterGroup/Successfully_register_a_group_if_the_first_generated_GID_is_already_in_use b/internal/users/tempentries/testdata/golden/TestRegisterGroup/Successfully_register_a_group_if_the_first_generated_GID_is_already_in_use
deleted file mode 100644
index e992cfed83..0000000000
--- a/internal/users/tempentries/testdata/golden/TestRegisterGroup/Successfully_register_a_group_if_the_first_generated_GID_is_already_in_use
+++ /dev/null
@@ -1,4 +0,0 @@
-name: authd-temp-groups-test
-gid: 12345
-users: []
-passwd: ""
diff --git a/internal/users/tempentries/testdata/golden/TestRegisterGroup/Successfully_register_a_new_group b/internal/users/tempentries/testdata/golden/TestRegisterGroup/Successfully_register_a_new_group
deleted file mode 100644
index e992cfed83..0000000000
--- a/internal/users/tempentries/testdata/golden/TestRegisterGroup/Successfully_register_a_new_group
+++ /dev/null
@@ -1,4 +0,0 @@
-name: authd-temp-groups-test
-gid: 12345
-users: []
-passwd: ""
diff --git a/internal/users/tempentries/testdata/golden/TestRegisterUser/Successfully_register_a_user_if_the_first_generated_UID_is_already_in_use b/internal/users/tempentries/testdata/golden/TestRegisterUser/Successfully_register_a_user_if_the_first_generated_UID_is_already_in_use
deleted file mode 100644
index c6f5874e44..0000000000
--- a/internal/users/tempentries/testdata/golden/TestRegisterUser/Successfully_register_a_user_if_the_first_generated_UID_is_already_in_use
+++ /dev/null
@@ -1,6 +0,0 @@
-name: authd-temp-users-test
-uid: 12345
-gid: 12345
-gecos: ""
-dir: /nonexistent
-shell: /usr/sbin/nologin
diff --git a/internal/users/tempentries/testdata/golden/TestRegisterUser/Successfully_register_a_user_if_the_pre-auth_user_already_exists b/internal/users/tempentries/testdata/golden/TestRegisterUser/Successfully_register_a_user_if_the_pre-auth_user_already_exists
deleted file mode 100644
index c6f5874e44..0000000000
--- a/internal/users/tempentries/testdata/golden/TestRegisterUser/Successfully_register_a_user_if_the_pre-auth_user_already_exists
+++ /dev/null
@@ -1,6 +0,0 @@
-name: authd-temp-users-test
-uid: 12345
-gid: 12345
-gecos: ""
-dir: /nonexistent
-shell: /usr/sbin/nologin
diff --git a/internal/users/tempentries/testdata/golden/TestUserByIDAndName/Successfully_get_a_user_by_ID b/internal/users/tempentries/testdata/golden/TestUserByIDAndName/Successfully_get_a_user_by_ID
deleted file mode 100644
index c6f5874e44..0000000000
--- a/internal/users/tempentries/testdata/golden/TestUserByIDAndName/Successfully_get_a_user_by_ID
+++ /dev/null
@@ -1,6 +0,0 @@
-name: authd-temp-users-test
-uid: 12345
-gid: 12345
-gecos: ""
-dir: /nonexistent
-shell: /usr/sbin/nologin
diff --git a/internal/users/tempentries/testdata/golden/TestUserByIDAndName/Successfully_get_a_user_by_name b/internal/users/tempentries/testdata/golden/TestUserByIDAndName/Successfully_get_a_user_by_name
deleted file mode 100644
index c6f5874e44..0000000000
--- a/internal/users/tempentries/testdata/golden/TestUserByIDAndName/Successfully_get_a_user_by_name
+++ /dev/null
@@ -1,6 +0,0 @@
-name: authd-temp-users-test
-uid: 12345
-gid: 12345
-gecos: ""
-dir: /nonexistent
-shell: /usr/sbin/nologin
diff --git a/internal/users/tempentries/users.go b/internal/users/tempentries/users.go
deleted file mode 100644
index 4cb81959ce..0000000000
--- a/internal/users/tempentries/users.go
+++ /dev/null
@@ -1,147 +0,0 @@
-package tempentries
-
-import (
-	"context"
-	"crypto/rand"
-	"fmt"
-	"sync"
-
-	"github.com/ubuntu/authd/internal/users/localentries"
-	"github.com/ubuntu/authd/internal/users/types"
-	"github.com/ubuntu/authd/log"
-)
-
-type userRecord struct {
-	name  string
-	uid   uint32
-	gecos string
-}
-
-type temporaryUserRecords struct {
-	idGenerator IDGenerator
-	registerMu  sync.Mutex
-	rwMu        sync.RWMutex
-	users       map[uint32]userRecord
-	uidByName   map[string]uint32
-}
-
-func newTemporaryUserRecords(idGenerator IDGenerator) *temporaryUserRecords {
-	return &temporaryUserRecords{
-		idGenerator: idGenerator,
-		registerMu:  sync.Mutex{},
-		rwMu:        sync.RWMutex{},
-		users:       make(map[uint32]userRecord),
-		uidByName:   make(map[string]uint32),
-	}
-}
-
-// UserByID returns the user information for the given user ID.
-func (r *temporaryUserRecords) userByID(uid uint32) (types.UserEntry, error) {
-	r.rwMu.RLock()
-	defer r.rwMu.RUnlock()
-
-	user, ok := r.users[uid]
-	if !ok {
-		return types.UserEntry{}, NoDataFoundError{}
-	}
-
-	return userEntry(user), nil
-}
-
-// UserByName returns the user information for the given user name.
-func (r *temporaryUserRecords) userByName(name string) (types.UserEntry, error) {
-	r.rwMu.RLock()
-	defer r.rwMu.RUnlock()
-
-	uid, ok := r.uidByName[name]
-	if !ok {
-		return types.UserEntry{}, NoDataFoundError{}
-	}
-
-	return r.userByID(uid)
-}
-
-func userEntry(user userRecord) types.UserEntry {
-	return types.UserEntry{
-		Name: user.name,
-		UID:  user.uid,
-		// The UID is also the GID of the user private group (see https://wiki.debian.org/UserPrivateGroups#UPGs)
-		GID:   user.uid,
-		Gecos: user.gecos,
-		Dir:   "/nonexistent",
-		Shell: "/usr/sbin/nologin",
-	}
-}
-
-// uniqueNameAndUID returns true if the given UID is unique in the system. It returns false if the UID is already assigned to
-// a user by any NSS source (except the given temporary user).
-func (r *temporaryUserRecords) uniqueNameAndUID(name string, uid uint32, tmpID string) (bool, error) {
-	entries, err := localentries.GetPasswdEntries()
-	if err != nil {
-		return false, err
-	}
-	for _, entry := range entries {
-		if entry.Name == name && entry.UID != uid {
-			// A user with the same name already exists, we can't register this temporary user.
-			log.Debugf(context.Background(), "Name %q already in use by UID %d", name, entry.UID)
-			return false, fmt.Errorf("user %q already exists", name)
-		}
-
-		if entry.UID == uid && entry.Gecos != tmpID {
-			log.Debugf(context.Background(), "UID %d already in use by user %q, generating a new one", uid, entry.Name)
-			return false, nil
-		}
-	}
-
-	groupEntries, err := localentries.GetGroupEntries()
-	if err != nil {
-		return false, fmt.Errorf("failed to get group entries: %w", err)
-	}
-	for _, group := range groupEntries {
-		if group.GID == uid {
-			// A group with the same ID already exists, so we can't use that ID as the GID of the temporary user.
-			log.Debugf(context.Background(), "ID %d already in use by group %q", uid, group.Name)
-			return false, fmt.Errorf("group with GID %d already exists", uid)
-		}
-	}
-
-	return true, nil
-}
-
-// addTemporaryUser adds a temporary user with a random name and the given UID. It returns the generated name.
-// If the UID is already registered, it returns a errUserAlreadyExists.
-func (r *temporaryUserRecords) addTemporaryUser(uid uint32, name string) (tmpID string, cleanup func(), err error) {
-	r.rwMu.Lock()
-	defer r.rwMu.Unlock()
-
-	// Generate a 64 character (32 bytes in hex) random ID which we store in the gecos field of the temporary user
-	// record to be able to identify it in isUniqueUID.
-	bytes := make([]byte, 32)
-	if _, err := rand.Read(bytes); err != nil {
-		return "", nil, fmt.Errorf("failed to generate random name: %w", err)
-	}
-	tmpID = fmt.Sprintf("authd-temp-user-%x", bytes)
-
-	r.users[uid] = userRecord{name: name, uid: uid, gecos: tmpID}
-	r.uidByName[name] = uid
-
-	cleanup = func() { r.deleteTemporaryUser(uid) }
-
-	return tmpID, cleanup, nil
-}
-
-// deleteTemporaryUser deletes the temporary user with the given UID.
-func (r *temporaryUserRecords) deleteTemporaryUser(uid uint32) {
-	r.rwMu.Lock()
-	defer r.rwMu.Unlock()
-
-	user, ok := r.users[uid]
-	if !ok {
-		log.Warningf(context.Background(), "Can't delete temporary user with UID %d, it does not exist", uid)
-		return
-	}
-	delete(r.users, uid)
-	delete(r.uidByName, user.name)
-
-	log.Debugf(context.Background(), "Removed temporary record for user %q with UID %d", user.name, uid)
-}
diff --git a/internal/users/testdata/TestCompareNewUserInfoWithDB/Compare_all_not_matching_users/user1 b/internal/users/testdata/TestCompareNewUserInfoWithDB/Compare_all_not_matching_users/user1
new file mode 100644
index 0000000000..d05746c638
--- /dev/null
+++ b/internal/users/testdata/TestCompareNewUserInfoWithDB/Compare_all_not_matching_users/user1
@@ -0,0 +1,15 @@
+name: user1@example.com
+uid: 1111
+gecos: |-
+    User1 gecos
+    On multiple lines
+    But they are too many!
+dir: /home/user1@example.com
+shell: /bin/bash
+groups:
+    - name: group1
+      gid: 11111
+      ugid: "12345678"
+    - name: commongroup
+      gid: 99999
+      ugid: "87654321"
diff --git a/internal/users/testdata/TestCompareNewUserInfoWithDB/Compare_all_not_matching_users/user2 b/internal/users/testdata/TestCompareNewUserInfoWithDB/Compare_all_not_matching_users/user2
new file mode 100644
index 0000000000..bc3c3a270a
--- /dev/null
+++ b/internal/users/testdata/TestCompareNewUserInfoWithDB/Compare_all_not_matching_users/user2
@@ -0,0 +1,12 @@
+name: user2@example.com
+uid: 2222
+gecos: User2
+dir: /home/user2@example.com/new/home_is_here
+shell: /bin/dash
+groups:
+    - name: group2withoutugid
+      gid: 22222
+      ugid: ""
+    - name: commongroup
+      gid: 99999
+      ugid: "87654321"
diff --git a/internal/users/testdata/TestCompareNewUserInfoWithDB/Compare_all_not_matching_users/user3 b/internal/users/testdata/TestCompareNewUserInfoWithDB/Compare_all_not_matching_users/user3
new file mode 100644
index 0000000000..340b2dff2d
--- /dev/null
+++ b/internal/users/testdata/TestCompareNewUserInfoWithDB/Compare_all_not_matching_users/user3
@@ -0,0 +1,12 @@
+name: user3@example.com
+uid: 3333
+gecos: User3
+dir: /home/user3@example.com
+shell: /bin/zsh
+groups:
+    - name: group3
+      gid: 33333
+      ugid: "my-new-ugid-is-better!"
+    - name: commongroup
+      gid: 99999
+      ugid: "87654321"
diff --git a/internal/users/testdata/TestCompareNewUserInfoWithDB/Compare_all_not_matching_users/userwithoutbroker b/internal/users/testdata/TestCompareNewUserInfoWithDB/Compare_all_not_matching_users/userwithoutbroker
new file mode 100644
index 0000000000..73b0175d93
--- /dev/null
+++ b/internal/users/testdata/TestCompareNewUserInfoWithDB/Compare_all_not_matching_users/userwithoutbroker
@@ -0,0 +1,14 @@
+name: userwithoutbroker@example.com
+uid: 4444
+gecos: userwithoutbroker
+dir: /home/userwithoutbroker@example.com
+shell: /bin/sh
+groups:
+    - name: group4
+      gid: 44444
+      ugid: "45678123"
+    - name: commongroup
+      gid: 99999
+      ugid: "87654321"
+    - name: but-with-a-new-group
+      gid: 12456
diff --git a/internal/users/testdata/TestCompareNewUserInfoWithDB/Compare_all_valid_users/user1 b/internal/users/testdata/TestCompareNewUserInfoWithDB/Compare_all_valid_users/user1
new file mode 100644
index 0000000000..346fba0582
--- /dev/null
+++ b/internal/users/testdata/TestCompareNewUserInfoWithDB/Compare_all_valid_users/user1
@@ -0,0 +1,14 @@
+name: user1@example.com
+uid: 1111
+gecos: |-
+    User1 gecos
+    On multiple lines
+dir: /home/user1@example.com
+shell: /bin/bash
+groups:
+    - name: group1
+      gid: 11111
+      ugid: "12345678"
+    - name: commongroup
+      gid: 99999
+      ugid: "87654321"
diff --git a/internal/users/testdata/TestCompareNewUserInfoWithDB/Compare_all_valid_users/user2 b/internal/users/testdata/TestCompareNewUserInfoWithDB/Compare_all_valid_users/user2
new file mode 100644
index 0000000000..c1a5fdbb0c
--- /dev/null
+++ b/internal/users/testdata/TestCompareNewUserInfoWithDB/Compare_all_valid_users/user2
@@ -0,0 +1,10 @@
+name: user2@example.com
+gecos: User2
+dir: /home/user2@example.com
+shell: /bin/dash
+groups:
+    - name: group2withoutugid
+      ugid: ""
+    - name: commongroup
+      gid: 99999
+      ugid: "87654321"
diff --git a/internal/users/testdata/TestCompareNewUserInfoWithDB/Compare_all_valid_users/user3 b/internal/users/testdata/TestCompareNewUserInfoWithDB/Compare_all_valid_users/user3
new file mode 100644
index 0000000000..3653b8b5f1
--- /dev/null
+++ b/internal/users/testdata/TestCompareNewUserInfoWithDB/Compare_all_valid_users/user3
@@ -0,0 +1,11 @@
+name: user3@example.com
+uid: 333333333
+gecos: User3
+dir: /home/user3@example.com
+shell: /bin/zsh
+groups:
+    - name: group3
+      gid: 333333333
+      ugid: "34567812"
+    - name: commongroup
+      ugid: "87654321"
diff --git a/internal/users/testdata/TestCompareNewUserInfoWithDB/Compare_all_valid_users/userwithoutbroker b/internal/users/testdata/TestCompareNewUserInfoWithDB/Compare_all_valid_users/userwithoutbroker
new file mode 100644
index 0000000000..5d48011998
--- /dev/null
+++ b/internal/users/testdata/TestCompareNewUserInfoWithDB/Compare_all_valid_users/userwithoutbroker
@@ -0,0 +1,11 @@
+name: userwithoutbroker@example.com
+uid: 0
+gecos: userwithoutbroker
+dir: /home/userwithoutbroker@example.com
+shell: /bin/sh
+groups:
+    - name: group4
+      gid: 44444
+      ugid: "45678123"
+    - name: commongroup
+      ugid: "87654321"
diff --git a/internal/users/testdata/db/group-with-empty-UGID.db.yaml b/internal/users/testdata/db/group-with-empty-UGID.db.yaml
index 6f7d116bb9..ed136d2aa7 100644
--- a/internal/users/testdata/db/group-with-empty-UGID.db.yaml
+++ b/internal/users/testdata/db/group-with-empty-UGID.db.yaml
@@ -1,11 +1,11 @@
 users:
-    - name: user1
+    - name: user1@example.com
       uid: 1111
       gid: 11111
       gecos: |-
         User1 gecos
         On multiple lines
-      dir: /home/user1
+      dir: /home/user1@example.com
       shell: /bin/bash
       broker_id: broker-id
 groups:
diff --git a/internal/users/testdata/db/locked_user.db.yaml b/internal/users/testdata/db/locked_user.db.yaml
new file mode 100644
index 0000000000..2899b82bb5
--- /dev/null
+++ b/internal/users/testdata/db/locked_user.db.yaml
@@ -0,0 +1,18 @@
+users:
+    - name: user1@example.com
+      uid: 1111
+      gid: 11111
+      gecos: |-
+        User1 gecos
+        On multiple lines
+      dir: /home/user1@example.com
+      shell: /bin/bash
+      broker_id: broker-id
+      locked: true
+groups:
+    - name: group1
+      gid: 11111
+      ugid: "12345678"
+users_to_groups:
+    - uid: 1111
+      gid: 11111
diff --git a/internal/users/testdata/db/multiple_users_and_groups.db.yaml b/internal/users/testdata/db/multiple_users_and_groups.db.yaml
index eea979e6e0..68301851f6 100644
--- a/internal/users/testdata/db/multiple_users_and_groups.db.yaml
+++ b/internal/users/testdata/db/multiple_users_and_groups.db.yaml
@@ -1,40 +1,40 @@
 users:
-    - name: user1
+    - name: user1@example.com
       uid: 1111
       gid: 11111
       gecos: |-
         User1 gecos
         On multiple lines
-      dir: /home/user1
+      dir: /home/user1@example.com
       shell: /bin/bash
       broker_id: broker-id
-    - name: user2
+    - name: user2@example.com
       uid: 2222
       gid: 22222
       gecos: User2
-      dir: /home/user2
+      dir: /home/user2@example.com
       shell: /bin/dash
       broker_id: broker-id
-    - name: user3
+    - name: user3@example.com
       uid: 3333
       gid: 33333
       gecos: User3
-      dir: /home/user3
+      dir: /home/user3@example.com
       shell: /bin/zsh
       broker_id: broker-id
-    - name: userwithoutbroker
+    - name: userwithoutbroker@example.com
       uid: 4444
       gid: 44444
       gecos: userwithoutbroker
-      dir: /home/userwithoutbroker
+      dir: /home/userwithoutbroker@example.com
       shell: /bin/sh
 groups:
     - name: group1
       gid: 11111
       ugid: "12345678"
-    - name: group2
+    - name: group2withoutugid
       gid: 22222
-      ugid: "56781234"
+      ugid: ""
     - name: group3
       gid: 33333
       ugid: "34567812"
diff --git a/internal/users/testdata/db/one_user_and_group.db.yaml b/internal/users/testdata/db/one_user_and_group.db.yaml
index 77567897ae..8b634ae020 100644
--- a/internal/users/testdata/db/one_user_and_group.db.yaml
+++ b/internal/users/testdata/db/one_user_and_group.db.yaml
@@ -1,15 +1,15 @@
 users:
-    - name: user1
+    - name: user1@example.com
       uid: 1111
       gid: 11111
       gecos: |-
         User1 gecos
         On multiple lines
-      dir: /home/user1
+      dir: /home/user1@example.com
       shell: /bin/bash
       broker_id: broker-id
 groups:
-    - name: group1
+    - name: group1@example.com
       gid: 11111
       ugid: "12345678"
 users_to_groups:
diff --git a/internal/users/testdata/db/one_user_and_group_with_matching_gid.db.yaml b/internal/users/testdata/db/one_user_and_group_with_matching_gid.db.yaml
new file mode 100644
index 0000000000..2d673752a2
--- /dev/null
+++ b/internal/users/testdata/db/one_user_and_group_with_matching_gid.db.yaml
@@ -0,0 +1,17 @@
+users:
+    - name: user1@example.com
+      uid: 11111
+      gid: 11111
+      gecos: |-
+        User1 gecos
+        On multiple lines
+      dir: /home/user1@example.com
+      shell: /bin/bash
+      broker_id: broker-id
+groups:
+    - name: user1@example.com
+      gid: 11111
+      ugid: "12345678"
+users_to_groups:
+    - uid: 11111
+      gid: 11111
diff --git a/internal/users/testdata/golden/TestAllGroups/Successfully_get_all_groups b/internal/users/testdata/golden/TestAllGroups/Successfully_get_all_groups
index f911029941..b876d70f04 100644
--- a/internal/users/testdata/golden/TestAllGroups/Successfully_get_all_groups
+++ b/internal/users/testdata/golden/TestAllGroups/Successfully_get_all_groups
@@ -1,28 +1,28 @@
 - name: group1
   gid: 11111
   users:
-    - user1
+    - user1@example.com
   passwd: ""
-- name: group2
+- name: group2withoutugid
   gid: 22222
   users:
-    - user2
+    - user2@example.com
   passwd: ""
 - name: group3
   gid: 33333
   users:
-    - user3
+    - user3@example.com
   passwd: ""
 - name: group4
   gid: 44444
   users:
-    - userwithoutbroker
+    - userwithoutbroker@example.com
   passwd: ""
 - name: commongroup
   gid: 99999
   users:
-    - user1
-    - user2
-    - user3
-    - userwithoutbroker
+    - user1@example.com
+    - user2@example.com
+    - user3@example.com
+    - userwithoutbroker@example.com
   passwd: ""
diff --git a/internal/users/testdata/golden/TestAllShadows/Successfully_get_all_users b/internal/users/testdata/golden/TestAllShadows/Successfully_get_all_users
index 5078be1c6c..2c1c79ab21 100644
--- a/internal/users/testdata/golden/TestAllShadows/Successfully_get_all_users
+++ b/internal/users/testdata/golden/TestAllShadows/Successfully_get_all_users
@@ -1,25 +1,25 @@
-- name: user1
+- name: user1@example.com
   lastpwdchange: -1
   maxpwdage: -1
   pwdwarnperiod: -1
   pwdinactivity: -1
   minpwdage: -1
   expirationdate: -1
-- name: user2
+- name: user2@example.com
   lastpwdchange: -1
   maxpwdage: -1
   pwdwarnperiod: -1
   pwdinactivity: -1
   minpwdage: -1
   expirationdate: -1
-- name: user3
+- name: user3@example.com
   lastpwdchange: -1
   maxpwdage: -1
   pwdwarnperiod: -1
   pwdinactivity: -1
   minpwdage: -1
   expirationdate: -1
-- name: userwithoutbroker
+- name: userwithoutbroker@example.com
   lastpwdchange: -1
   maxpwdage: -1
   pwdwarnperiod: -1
diff --git a/internal/users/testdata/golden/TestAllUsers/Successfully_get_all_users b/internal/users/testdata/golden/TestAllUsers/Successfully_get_all_users
index 2b81889385..8fa82b8fae 100644
--- a/internal/users/testdata/golden/TestAllUsers/Successfully_get_all_users
+++ b/internal/users/testdata/golden/TestAllUsers/Successfully_get_all_users
@@ -1,26 +1,26 @@
-- name: user1
+- name: user1@example.com
   uid: 1111
   gid: 11111
   gecos: |-
     User1 gecos
     On multiple lines
-  dir: /home/user1
+  dir: /home/user1@example.com
   shell: /bin/bash
-- name: user2
+- name: user2@example.com
   uid: 2222
   gid: 22222
   gecos: User2
-  dir: /home/user2
+  dir: /home/user2@example.com
   shell: /bin/dash
-- name: user3
+- name: user3@example.com
   uid: 3333
   gid: 33333
   gecos: User3
-  dir: /home/user3
+  dir: /home/user3@example.com
   shell: /bin/zsh
-- name: userwithoutbroker
+- name: userwithoutbroker@example.com
   uid: 4444
   gid: 44444
   gecos: userwithoutbroker
-  dir: /home/userwithoutbroker
+  dir: /home/userwithoutbroker@example.com
   shell: /bin/sh
diff --git a/internal/users/testdata/golden/TestCompareNewUserInfoWithDB/Compare_all_not_matching_users/user1-from-getOldUserInfoFromDB b/internal/users/testdata/golden/TestCompareNewUserInfoWithDB/Compare_all_not_matching_users/user1-from-getOldUserInfoFromDB
new file mode 100644
index 0000000000..346fba0582
--- /dev/null
+++ b/internal/users/testdata/golden/TestCompareNewUserInfoWithDB/Compare_all_not_matching_users/user1-from-getOldUserInfoFromDB
@@ -0,0 +1,14 @@
+name: user1@example.com
+uid: 1111
+gecos: |-
+    User1 gecos
+    On multiple lines
+dir: /home/user1@example.com
+shell: /bin/bash
+groups:
+    - name: group1
+      gid: 11111
+      ugid: "12345678"
+    - name: commongroup
+      gid: 99999
+      ugid: "87654321"
diff --git a/internal/users/testdata/golden/TestCompareNewUserInfoWithDB/Compare_all_not_matching_users/user2-from-getOldUserInfoFromDB b/internal/users/testdata/golden/TestCompareNewUserInfoWithDB/Compare_all_not_matching_users/user2-from-getOldUserInfoFromDB
new file mode 100644
index 0000000000..6fa473d720
--- /dev/null
+++ b/internal/users/testdata/golden/TestCompareNewUserInfoWithDB/Compare_all_not_matching_users/user2-from-getOldUserInfoFromDB
@@ -0,0 +1,12 @@
+name: user2@example.com
+uid: 2222
+gecos: User2
+dir: /home/user2@example.com
+shell: /bin/dash
+groups:
+    - name: group2withoutugid
+      gid: 22222
+      ugid: ""
+    - name: commongroup
+      gid: 99999
+      ugid: "87654321"
diff --git a/internal/users/testdata/golden/TestCompareNewUserInfoWithDB/Compare_all_not_matching_users/user3-from-getOldUserInfoFromDB b/internal/users/testdata/golden/TestCompareNewUserInfoWithDB/Compare_all_not_matching_users/user3-from-getOldUserInfoFromDB
new file mode 100644
index 0000000000..441836401f
--- /dev/null
+++ b/internal/users/testdata/golden/TestCompareNewUserInfoWithDB/Compare_all_not_matching_users/user3-from-getOldUserInfoFromDB
@@ -0,0 +1,12 @@
+name: user3@example.com
+uid: 3333
+gecos: User3
+dir: /home/user3@example.com
+shell: /bin/zsh
+groups:
+    - name: group3
+      gid: 33333
+      ugid: "34567812"
+    - name: commongroup
+      gid: 99999
+      ugid: "87654321"
diff --git a/internal/users/testdata/golden/TestCompareNewUserInfoWithDB/Compare_all_not_matching_users/userwithoutbroker-from-getOldUserInfoFromDB b/internal/users/testdata/golden/TestCompareNewUserInfoWithDB/Compare_all_not_matching_users/userwithoutbroker-from-getOldUserInfoFromDB
new file mode 100644
index 0000000000..a858c88ee2
--- /dev/null
+++ b/internal/users/testdata/golden/TestCompareNewUserInfoWithDB/Compare_all_not_matching_users/userwithoutbroker-from-getOldUserInfoFromDB
@@ -0,0 +1,12 @@
+name: userwithoutbroker@example.com
+uid: 4444
+gecos: userwithoutbroker
+dir: /home/userwithoutbroker@example.com
+shell: /bin/sh
+groups:
+    - name: group4
+      gid: 44444
+      ugid: "45678123"
+    - name: commongroup
+      gid: 99999
+      ugid: "87654321"
diff --git a/internal/users/testdata/golden/TestCompareNewUserInfoWithDB/Compare_all_valid_users/user1-from-getOldUserInfoFromDB b/internal/users/testdata/golden/TestCompareNewUserInfoWithDB/Compare_all_valid_users/user1-from-getOldUserInfoFromDB
new file mode 100644
index 0000000000..346fba0582
--- /dev/null
+++ b/internal/users/testdata/golden/TestCompareNewUserInfoWithDB/Compare_all_valid_users/user1-from-getOldUserInfoFromDB
@@ -0,0 +1,14 @@
+name: user1@example.com
+uid: 1111
+gecos: |-
+    User1 gecos
+    On multiple lines
+dir: /home/user1@example.com
+shell: /bin/bash
+groups:
+    - name: group1
+      gid: 11111
+      ugid: "12345678"
+    - name: commongroup
+      gid: 99999
+      ugid: "87654321"
diff --git a/internal/users/testdata/golden/TestCompareNewUserInfoWithDB/Compare_all_valid_users/user2-from-getOldUserInfoFromDB b/internal/users/testdata/golden/TestCompareNewUserInfoWithDB/Compare_all_valid_users/user2-from-getOldUserInfoFromDB
new file mode 100644
index 0000000000..6fa473d720
--- /dev/null
+++ b/internal/users/testdata/golden/TestCompareNewUserInfoWithDB/Compare_all_valid_users/user2-from-getOldUserInfoFromDB
@@ -0,0 +1,12 @@
+name: user2@example.com
+uid: 2222
+gecos: User2
+dir: /home/user2@example.com
+shell: /bin/dash
+groups:
+    - name: group2withoutugid
+      gid: 22222
+      ugid: ""
+    - name: commongroup
+      gid: 99999
+      ugid: "87654321"
diff --git a/internal/users/testdata/golden/TestCompareNewUserInfoWithDB/Compare_all_valid_users/user3-from-getOldUserInfoFromDB b/internal/users/testdata/golden/TestCompareNewUserInfoWithDB/Compare_all_valid_users/user3-from-getOldUserInfoFromDB
new file mode 100644
index 0000000000..441836401f
--- /dev/null
+++ b/internal/users/testdata/golden/TestCompareNewUserInfoWithDB/Compare_all_valid_users/user3-from-getOldUserInfoFromDB
@@ -0,0 +1,12 @@
+name: user3@example.com
+uid: 3333
+gecos: User3
+dir: /home/user3@example.com
+shell: /bin/zsh
+groups:
+    - name: group3
+      gid: 33333
+      ugid: "34567812"
+    - name: commongroup
+      gid: 99999
+      ugid: "87654321"
diff --git a/internal/users/testdata/golden/TestCompareNewUserInfoWithDB/Compare_all_valid_users/userwithoutbroker-from-getOldUserInfoFromDB b/internal/users/testdata/golden/TestCompareNewUserInfoWithDB/Compare_all_valid_users/userwithoutbroker-from-getOldUserInfoFromDB
new file mode 100644
index 0000000000..a858c88ee2
--- /dev/null
+++ b/internal/users/testdata/golden/TestCompareNewUserInfoWithDB/Compare_all_valid_users/userwithoutbroker-from-getOldUserInfoFromDB
@@ -0,0 +1,12 @@
+name: userwithoutbroker@example.com
+uid: 4444
+gecos: userwithoutbroker
+dir: /home/userwithoutbroker@example.com
+shell: /bin/sh
+groups:
+    - name: group4
+      gid: 44444
+      ugid: "45678123"
+    - name: commongroup
+      gid: 99999
+      ugid: "87654321"
diff --git a/internal/users/testdata/golden/TestGroupByIDAndName/Successfully_get_group_by_ID b/internal/users/testdata/golden/TestGroupByIDAndName/Successfully_get_group_by_ID
index deaa6af10f..1e0929b2bb 100644
--- a/internal/users/testdata/golden/TestGroupByIDAndName/Successfully_get_group_by_ID
+++ b/internal/users/testdata/golden/TestGroupByIDAndName/Successfully_get_group_by_ID
@@ -1,5 +1,5 @@
 name: group1
 gid: 11111
 users:
-    - user1
+    - user1@example.com
 passwd: ""
diff --git a/internal/users/testdata/golden/TestGroupByIDAndName/Successfully_get_group_by_ID_for_preauth_user b/internal/users/testdata/golden/TestGroupByIDAndName/Successfully_get_group_by_ID_for_preauth_user
new file mode 100644
index 0000000000..de8789371b
--- /dev/null
+++ b/internal/users/testdata/golden/TestGroupByIDAndName/Successfully_get_group_by_ID_for_preauth_user
@@ -0,0 +1,5 @@
+name: authd-pre-auth-user-{{RANDOM_ID}}
+gid: 12345
+users:
+    - authd-pre-auth-user-{{RANDOM_ID}}
+passwd: x
diff --git a/internal/users/testdata/golden/TestGroupByIDAndName/Successfully_get_group_by_name b/internal/users/testdata/golden/TestGroupByIDAndName/Successfully_get_group_by_name
index deaa6af10f..1e0929b2bb 100644
--- a/internal/users/testdata/golden/TestGroupByIDAndName/Successfully_get_group_by_name
+++ b/internal/users/testdata/golden/TestGroupByIDAndName/Successfully_get_group_by_name
@@ -1,5 +1,5 @@
 name: group1
 gid: 11111
 users:
-    - user1
+    - user1@example.com
 passwd: ""
diff --git a/internal/users/testdata/golden/TestGroupByIDAndName/Successfully_get_temporary_group_by_ID b/internal/users/testdata/golden/TestGroupByIDAndName/Successfully_get_temporary_group_by_ID
deleted file mode 100644
index 6a90d9b2a5..0000000000
--- a/internal/users/testdata/golden/TestGroupByIDAndName/Successfully_get_temporary_group_by_ID
+++ /dev/null
@@ -1,4 +0,0 @@
-name: tempgroup1
-gid: 0
-users: []
-passwd: ""
diff --git a/internal/users/testdata/golden/TestGroupByIDAndName/Successfully_get_temporary_group_by_name b/internal/users/testdata/golden/TestGroupByIDAndName/Successfully_get_temporary_group_by_name
deleted file mode 100644
index 6a90d9b2a5..0000000000
--- a/internal/users/testdata/golden/TestGroupByIDAndName/Successfully_get_temporary_group_by_name
+++ /dev/null
@@ -1,4 +0,0 @@
-name: tempgroup1
-gid: 0
-users: []
-passwd: ""
diff --git a/internal/users/testdata/golden/TestLockUser/Successfully_lock_user b/internal/users/testdata/golden/TestLockUser/Successfully_lock_user
new file mode 100644
index 0000000000..bdb582ab74
--- /dev/null
+++ b/internal/users/testdata/golden/TestLockUser/Successfully_lock_user
@@ -0,0 +1,65 @@
+users:
+    - name: user1@example.com
+      uid: 1111
+      gid: 11111
+      gecos: |-
+        User1 gecos
+        On multiple lines
+      dir: /home/user1@example.com
+      shell: /bin/bash
+      broker_id: broker-id
+      locked: true
+    - name: user2@example.com
+      uid: 2222
+      gid: 22222
+      gecos: User2
+      dir: /home/user2@example.com
+      shell: /bin/dash
+      broker_id: broker-id
+    - name: user3@example.com
+      uid: 3333
+      gid: 33333
+      gecos: User3
+      dir: /home/user3@example.com
+      shell: /bin/zsh
+      broker_id: broker-id
+    - name: userwithoutbroker@example.com
+      uid: 4444
+      gid: 44444
+      gecos: userwithoutbroker
+      dir: /home/userwithoutbroker@example.com
+      shell: /bin/sh
+groups:
+    - name: group1
+      gid: 11111
+      ugid: "12345678"
+    - name: group2withoutugid
+      gid: 22222
+      ugid: ""
+    - name: group3
+      gid: 33333
+      ugid: "34567812"
+    - name: group4
+      gid: 44444
+      ugid: "45678123"
+    - name: commongroup
+      gid: 99999
+      ugid: "87654321"
+users_to_groups:
+    - uid: 1111
+      gid: 11111
+    - uid: 1111
+      gid: 99999
+    - uid: 2222
+      gid: 22222
+    - uid: 2222
+      gid: 99999
+    - uid: 3333
+      gid: 33333
+    - uid: 3333
+      gid: 99999
+    - uid: 4444
+      gid: 44444
+    - uid: 4444
+      gid: 99999
+schema_version: 2
diff --git a/internal/users/testdata/golden/TestNewManager/Successfully_create_manager_with_GID_range_next_to_systemd_dynamic_groups b/internal/users/testdata/golden/TestNewManager/Successfully_create_manager_with_GID_range_next_to_systemd_dynamic_groups
new file mode 100644
index 0000000000..9009ddf20c
--- /dev/null
+++ b/internal/users/testdata/golden/TestNewManager/Successfully_create_manager_with_GID_range_next_to_systemd_dynamic_groups
@@ -0,0 +1,64 @@
+users:
+    - name: user1@example.com
+      uid: 1111
+      gid: 11111
+      gecos: |-
+        User1 gecos
+        On multiple lines
+      dir: /home/user1@example.com
+      shell: /bin/bash
+      broker_id: broker-id
+    - name: user2@example.com
+      uid: 2222
+      gid: 22222
+      gecos: User2
+      dir: /home/user2@example.com
+      shell: /bin/dash
+      broker_id: broker-id
+    - name: user3@example.com
+      uid: 3333
+      gid: 33333
+      gecos: User3
+      dir: /home/user3@example.com
+      shell: /bin/zsh
+      broker_id: broker-id
+    - name: userwithoutbroker@example.com
+      uid: 4444
+      gid: 44444
+      gecos: userwithoutbroker
+      dir: /home/userwithoutbroker@example.com
+      shell: /bin/sh
+groups:
+    - name: group1
+      gid: 11111
+      ugid: "12345678"
+    - name: group2withoutugid
+      gid: 22222
+      ugid: ""
+    - name: group3
+      gid: 33333
+      ugid: "34567812"
+    - name: group4
+      gid: 44444
+      ugid: "45678123"
+    - name: commongroup
+      gid: 99999
+      ugid: "87654321"
+users_to_groups:
+    - uid: 1111
+      gid: 11111
+    - uid: 1111
+      gid: 99999
+    - uid: 2222
+      gid: 22222
+    - uid: 2222
+      gid: 99999
+    - uid: 3333
+      gid: 33333
+    - uid: 3333
+      gid: 99999
+    - uid: 4444
+      gid: 44444
+    - uid: 4444
+      gid: 99999
+schema_version: 2
diff --git a/internal/users/testdata/golden/TestNewManager/Successfully_create_manager_with_UID_range_next_to_systemd_dynamic_users b/internal/users/testdata/golden/TestNewManager/Successfully_create_manager_with_UID_range_next_to_systemd_dynamic_users
new file mode 100644
index 0000000000..9009ddf20c
--- /dev/null
+++ b/internal/users/testdata/golden/TestNewManager/Successfully_create_manager_with_UID_range_next_to_systemd_dynamic_users
@@ -0,0 +1,64 @@
+users:
+    - name: user1@example.com
+      uid: 1111
+      gid: 11111
+      gecos: |-
+        User1 gecos
+        On multiple lines
+      dir: /home/user1@example.com
+      shell: /bin/bash
+      broker_id: broker-id
+    - name: user2@example.com
+      uid: 2222
+      gid: 22222
+      gecos: User2
+      dir: /home/user2@example.com
+      shell: /bin/dash
+      broker_id: broker-id
+    - name: user3@example.com
+      uid: 3333
+      gid: 33333
+      gecos: User3
+      dir: /home/user3@example.com
+      shell: /bin/zsh
+      broker_id: broker-id
+    - name: userwithoutbroker@example.com
+      uid: 4444
+      gid: 44444
+      gecos: userwithoutbroker
+      dir: /home/userwithoutbroker@example.com
+      shell: /bin/sh
+groups:
+    - name: group1
+      gid: 11111
+      ugid: "12345678"
+    - name: group2withoutugid
+      gid: 22222
+      ugid: ""
+    - name: group3
+      gid: 33333
+      ugid: "34567812"
+    - name: group4
+      gid: 44444
+      ugid: "45678123"
+    - name: commongroup
+      gid: 99999
+      ugid: "87654321"
+users_to_groups:
+    - uid: 1111
+      gid: 11111
+    - uid: 1111
+      gid: 99999
+    - uid: 2222
+      gid: 22222
+    - uid: 2222
+      gid: 99999
+    - uid: 3333
+      gid: 33333
+    - uid: 3333
+      gid: 99999
+    - uid: 4444
+      gid: 44444
+    - uid: 4444
+      gid: 99999
+schema_version: 2
diff --git a/internal/users/testdata/golden/TestNewManager/Successfully_create_manager_with_custom_config b/internal/users/testdata/golden/TestNewManager/Successfully_create_manager_with_custom_config
index 9a59a4ead0..9009ddf20c 100644
--- a/internal/users/testdata/golden/TestNewManager/Successfully_create_manager_with_custom_config
+++ b/internal/users/testdata/golden/TestNewManager/Successfully_create_manager_with_custom_config
@@ -1,40 +1,40 @@
 users:
-    - name: user1
+    - name: user1@example.com
       uid: 1111
       gid: 11111
       gecos: |-
         User1 gecos
         On multiple lines
-      dir: /home/user1
+      dir: /home/user1@example.com
       shell: /bin/bash
       broker_id: broker-id
-    - name: user2
+    - name: user2@example.com
       uid: 2222
       gid: 22222
       gecos: User2
-      dir: /home/user2
+      dir: /home/user2@example.com
       shell: /bin/dash
       broker_id: broker-id
-    - name: user3
+    - name: user3@example.com
       uid: 3333
       gid: 33333
       gecos: User3
-      dir: /home/user3
+      dir: /home/user3@example.com
       shell: /bin/zsh
       broker_id: broker-id
-    - name: userwithoutbroker
+    - name: userwithoutbroker@example.com
       uid: 4444
       gid: 44444
       gecos: userwithoutbroker
-      dir: /home/userwithoutbroker
+      dir: /home/userwithoutbroker@example.com
       shell: /bin/sh
 groups:
     - name: group1
       gid: 11111
       ugid: "12345678"
-    - name: group2
+    - name: group2withoutugid
       gid: 22222
-      ugid: "56781234"
+      ugid: ""
     - name: group3
       gid: 33333
       ugid: "34567812"
@@ -61,4 +61,4 @@ users_to_groups:
       gid: 44444
     - uid: 4444
       gid: 99999
-schema_version: 1
+schema_version: 2
diff --git a/internal/users/testdata/golden/TestNewManager/Successfully_create_manager_with_default_config b/internal/users/testdata/golden/TestNewManager/Successfully_create_manager_with_default_config
index 9a59a4ead0..9009ddf20c 100644
--- a/internal/users/testdata/golden/TestNewManager/Successfully_create_manager_with_default_config
+++ b/internal/users/testdata/golden/TestNewManager/Successfully_create_manager_with_default_config
@@ -1,40 +1,40 @@
 users:
-    - name: user1
+    - name: user1@example.com
       uid: 1111
       gid: 11111
       gecos: |-
         User1 gecos
         On multiple lines
-      dir: /home/user1
+      dir: /home/user1@example.com
       shell: /bin/bash
       broker_id: broker-id
-    - name: user2
+    - name: user2@example.com
       uid: 2222
       gid: 22222
       gecos: User2
-      dir: /home/user2
+      dir: /home/user2@example.com
       shell: /bin/dash
       broker_id: broker-id
-    - name: user3
+    - name: user3@example.com
       uid: 3333
       gid: 33333
       gecos: User3
-      dir: /home/user3
+      dir: /home/user3@example.com
       shell: /bin/zsh
       broker_id: broker-id
-    - name: userwithoutbroker
+    - name: userwithoutbroker@example.com
       uid: 4444
       gid: 44444
       gecos: userwithoutbroker
-      dir: /home/userwithoutbroker
+      dir: /home/userwithoutbroker@example.com
       shell: /bin/sh
 groups:
     - name: group1
       gid: 11111
       ugid: "12345678"
-    - name: group2
+    - name: group2withoutugid
       gid: 22222
-      ugid: "56781234"
+      ugid: ""
     - name: group3
       gid: 33333
       ugid: "34567812"
@@ -61,4 +61,4 @@ users_to_groups:
       gid: 44444
     - uid: 4444
       gid: 99999
-schema_version: 1
+schema_version: 2
diff --git a/internal/users/testdata/golden/TestNewManager/Warns_creating_manager_with_partially_invalid_GID_ranges b/internal/users/testdata/golden/TestNewManager/Warns_creating_manager_with_partially_invalid_GID_ranges
new file mode 100644
index 0000000000..9009ddf20c
--- /dev/null
+++ b/internal/users/testdata/golden/TestNewManager/Warns_creating_manager_with_partially_invalid_GID_ranges
@@ -0,0 +1,64 @@
+users:
+    - name: user1@example.com
+      uid: 1111
+      gid: 11111
+      gecos: |-
+        User1 gecos
+        On multiple lines
+      dir: /home/user1@example.com
+      shell: /bin/bash
+      broker_id: broker-id
+    - name: user2@example.com
+      uid: 2222
+      gid: 22222
+      gecos: User2
+      dir: /home/user2@example.com
+      shell: /bin/dash
+      broker_id: broker-id
+    - name: user3@example.com
+      uid: 3333
+      gid: 33333
+      gecos: User3
+      dir: /home/user3@example.com
+      shell: /bin/zsh
+      broker_id: broker-id
+    - name: userwithoutbroker@example.com
+      uid: 4444
+      gid: 44444
+      gecos: userwithoutbroker
+      dir: /home/userwithoutbroker@example.com
+      shell: /bin/sh
+groups:
+    - name: group1
+      gid: 11111
+      ugid: "12345678"
+    - name: group2withoutugid
+      gid: 22222
+      ugid: ""
+    - name: group3
+      gid: 33333
+      ugid: "34567812"
+    - name: group4
+      gid: 44444
+      ugid: "45678123"
+    - name: commongroup
+      gid: 99999
+      ugid: "87654321"
+users_to_groups:
+    - uid: 1111
+      gid: 11111
+    - uid: 1111
+      gid: 99999
+    - uid: 2222
+      gid: 22222
+    - uid: 2222
+      gid: 99999
+    - uid: 3333
+      gid: 33333
+    - uid: 3333
+      gid: 99999
+    - uid: 4444
+      gid: 44444
+    - uid: 4444
+      gid: 99999
+schema_version: 2
diff --git a/internal/users/testdata/golden/TestNewManager/Warns_creating_manager_with_partially_invalid_UID_ranges b/internal/users/testdata/golden/TestNewManager/Warns_creating_manager_with_partially_invalid_UID_ranges
new file mode 100644
index 0000000000..9009ddf20c
--- /dev/null
+++ b/internal/users/testdata/golden/TestNewManager/Warns_creating_manager_with_partially_invalid_UID_ranges
@@ -0,0 +1,64 @@
+users:
+    - name: user1@example.com
+      uid: 1111
+      gid: 11111
+      gecos: |-
+        User1 gecos
+        On multiple lines
+      dir: /home/user1@example.com
+      shell: /bin/bash
+      broker_id: broker-id
+    - name: user2@example.com
+      uid: 2222
+      gid: 22222
+      gecos: User2
+      dir: /home/user2@example.com
+      shell: /bin/dash
+      broker_id: broker-id
+    - name: user3@example.com
+      uid: 3333
+      gid: 33333
+      gecos: User3
+      dir: /home/user3@example.com
+      shell: /bin/zsh
+      broker_id: broker-id
+    - name: userwithoutbroker@example.com
+      uid: 4444
+      gid: 44444
+      gecos: userwithoutbroker
+      dir: /home/userwithoutbroker@example.com
+      shell: /bin/sh
+groups:
+    - name: group1
+      gid: 11111
+      ugid: "12345678"
+    - name: group2withoutugid
+      gid: 22222
+      ugid: ""
+    - name: group3
+      gid: 33333
+      ugid: "34567812"
+    - name: group4
+      gid: 44444
+      ugid: "45678123"
+    - name: commongroup
+      gid: 99999
+      ugid: "87654321"
+users_to_groups:
+    - uid: 1111
+      gid: 11111
+    - uid: 1111
+      gid: 99999
+    - uid: 2222
+      gid: 22222
+    - uid: 2222
+      gid: 99999
+    - uid: 3333
+      gid: 33333
+    - uid: 3333
+      gid: 99999
+    - uid: 4444
+      gid: 44444
+    - uid: 4444
+      gid: 99999
+schema_version: 2
diff --git a/internal/services/user/testdata/golden/TestGetUserByName/Return_existing_user_with_different_capitalization b/internal/users/testdata/golden/TestRegisterUserPreauth/Successfully_if_user_already_exists_on_db
similarity index 61%
rename from internal/services/user/testdata/golden/TestGetUserByName/Return_existing_user_with_different_capitalization
rename to internal/users/testdata/golden/TestRegisterUserPreauth/Successfully_if_user_already_exists_on_db
index 6df55f12d9..2d762b0d31 100644
--- a/internal/services/user/testdata/golden/TestGetUserByName/Return_existing_user_with_different_capitalization
+++ b/internal/users/testdata/golden/TestRegisterUserPreauth/Successfully_if_user_already_exists_on_db
@@ -1,8 +1,8 @@
-name: user1
+name: user1@example.com
 uid: 1111
 gid: 11111
 gecos: |-
     User1 gecos
     On multiple lines
-homedir: /home/user1
+dir: /home/user1@example.com
 shell: /bin/bash
diff --git a/internal/users/testdata/golden/TestRegisterUserPreauth/Successfully_update_user b/internal/users/testdata/golden/TestRegisterUserPreauth/Successfully_update_user
new file mode 100644
index 0000000000..47bb4a2183
--- /dev/null
+++ b/internal/users/testdata/golden/TestRegisterUserPreauth/Successfully_update_user
@@ -0,0 +1,6 @@
+name: authd-pre-auth-user-{{random-suffix}}
+uid: 1111
+gid: 1111
+gecos: user1@example.com
+dir: /nonexistent
+shell: /usr/sbin/nologin
diff --git a/internal/users/testdata/golden/TestSetGroupID/Primary_groups_of_multiple_users_are_updated/db b/internal/users/testdata/golden/TestSetGroupID/Primary_groups_of_multiple_users_are_updated/db
new file mode 100644
index 0000000000..84ed029026
--- /dev/null
+++ b/internal/users/testdata/golden/TestSetGroupID/Primary_groups_of_multiple_users_are_updated/db
@@ -0,0 +1,56 @@
+users:
+    - name: user1@example.com
+      uid: 1111
+      gid: 54321
+      gecos: |-
+        User1 gecos
+        On multiple lines
+      dir: /tmp/home/user-1111
+      shell: /bin/bash
+      broker_id: broker-id
+    - name: user2@example.com
+      uid: 2222
+      gid: 54321
+      gecos: User2
+      dir: /home/user2@example.com
+      shell: /bin/dash
+      broker_id: broker-id
+    - name: user3@example.com
+      uid: 3333
+      gid: 33333
+      gecos: User3
+      dir: /home/user3@example.com
+      shell: /bin/zsh
+      broker_id: broker-id
+    - name: userwithoutbroker@example.com
+      uid: 4444
+      gid: 44444
+      gecos: userwithoutbroker
+      dir: /home/userwithoutbroker@example.com
+      shell: /bin/sh
+groups:
+    - name: group2withoutugid
+      gid: 22222
+      ugid: ""
+    - name: group3
+      gid: 33333
+      ugid: "34567812"
+    - name: group4
+      gid: 44444
+      ugid: "45678123"
+    - name: group1
+      gid: 54321
+      ugid: "12345678"
+    - name: commongroup
+      gid: 99999
+      ugid: "87654321"
+users_to_groups:
+    - uid: 3333
+      gid: 33333
+    - uid: 3333
+      gid: 99999
+    - uid: 4444
+      gid: 44444
+    - uid: 4444
+      gid: 99999
+schema_version: 2
diff --git a/internal/users/testdata/golden/TestSetGroupID/Primary_groups_of_multiple_users_are_updated/response b/internal/users/testdata/golden/TestSetGroupID/Primary_groups_of_multiple_users_are_updated/response
new file mode 100644
index 0000000000..5ea0b29be3
--- /dev/null
+++ b/internal/users/testdata/golden/TestSetGroupID/Primary_groups_of_multiple_users_are_updated/response
@@ -0,0 +1,3 @@
+idchanged: true
+homedirownerchanged: true
+warnings: []
diff --git a/internal/users/testdata/golden/TestSetGroupID/Successfully_set_GID/db b/internal/users/testdata/golden/TestSetGroupID/Successfully_set_GID/db
new file mode 100644
index 0000000000..bd7e75cd8f
--- /dev/null
+++ b/internal/users/testdata/golden/TestSetGroupID/Successfully_set_GID/db
@@ -0,0 +1,60 @@
+users:
+    - name: user1@example.com
+      uid: 1111
+      gid: 54321
+      gecos: |-
+        User1 gecos
+        On multiple lines
+      dir: /tmp/home/user-1111
+      shell: /bin/bash
+      broker_id: broker-id
+    - name: user2@example.com
+      uid: 2222
+      gid: 22222
+      gecos: User2
+      dir: /home/user2@example.com
+      shell: /bin/dash
+      broker_id: broker-id
+    - name: user3@example.com
+      uid: 3333
+      gid: 33333
+      gecos: User3
+      dir: /home/user3@example.com
+      shell: /bin/zsh
+      broker_id: broker-id
+    - name: userwithoutbroker@example.com
+      uid: 4444
+      gid: 44444
+      gecos: userwithoutbroker
+      dir: /home/userwithoutbroker@example.com
+      shell: /bin/sh
+groups:
+    - name: group2withoutugid
+      gid: 22222
+      ugid: ""
+    - name: group3
+      gid: 33333
+      ugid: "34567812"
+    - name: group4
+      gid: 44444
+      ugid: "45678123"
+    - name: group1
+      gid: 54321
+      ugid: "12345678"
+    - name: commongroup
+      gid: 99999
+      ugid: "87654321"
+users_to_groups:
+    - uid: 2222
+      gid: 22222
+    - uid: 2222
+      gid: 99999
+    - uid: 3333
+      gid: 33333
+    - uid: 3333
+      gid: 99999
+    - uid: 4444
+      gid: 44444
+    - uid: 4444
+      gid: 99999
+schema_version: 2
diff --git a/internal/users/testdata/golden/TestSetGroupID/Successfully_set_GID/response b/internal/users/testdata/golden/TestSetGroupID/Successfully_set_GID/response
new file mode 100644
index 0000000000..5ea0b29be3
--- /dev/null
+++ b/internal/users/testdata/golden/TestSetGroupID/Successfully_set_GID/response
@@ -0,0 +1,3 @@
+idchanged: true
+homedirownerchanged: true
+warnings: []
diff --git a/internal/users/testdata/golden/TestSetGroupID/Successfully_set_GID_if_ID_is_already_in_use_as_UID_of_authd_user/db b/internal/users/testdata/golden/TestSetGroupID/Successfully_set_GID_if_ID_is_already_in_use_as_UID_of_authd_user/db
new file mode 100644
index 0000000000..1dbcd13a05
--- /dev/null
+++ b/internal/users/testdata/golden/TestSetGroupID/Successfully_set_GID_if_ID_is_already_in_use_as_UID_of_authd_user/db
@@ -0,0 +1,60 @@
+users:
+    - name: user1@example.com
+      uid: 1111
+      gid: 54321
+      gecos: |-
+        User1 gecos
+        On multiple lines
+      dir: /tmp/home/user-1111
+      shell: /bin/bash
+      broker_id: broker-id
+    - name: user3@example.com
+      uid: 3333
+      gid: 33333
+      gecos: User3
+      dir: /home/user3@example.com
+      shell: /bin/zsh
+      broker_id: broker-id
+    - name: userwithoutbroker@example.com
+      uid: 4444
+      gid: 44444
+      gecos: userwithoutbroker
+      dir: /home/userwithoutbroker@example.com
+      shell: /bin/sh
+    - name: user2@example.com
+      uid: 54321
+      gid: 22222
+      gecos: User2
+      dir: /home/user2@example.com
+      shell: /bin/dash
+      broker_id: broker-id
+groups:
+    - name: group2withoutugid
+      gid: 22222
+      ugid: ""
+    - name: group3
+      gid: 33333
+      ugid: "34567812"
+    - name: group4
+      gid: 44444
+      ugid: "45678123"
+    - name: group1
+      gid: 54321
+      ugid: "12345678"
+    - name: commongroup
+      gid: 99999
+      ugid: "87654321"
+users_to_groups:
+    - uid: 3333
+      gid: 33333
+    - uid: 3333
+      gid: 99999
+    - uid: 4444
+      gid: 44444
+    - uid: 4444
+      gid: 99999
+    - uid: 54321
+      gid: 22222
+    - uid: 54321
+      gid: 99999
+schema_version: 2
diff --git a/internal/users/testdata/golden/TestSetGroupID/Successfully_set_GID_if_ID_is_already_in_use_as_UID_of_authd_user/response b/internal/users/testdata/golden/TestSetGroupID/Successfully_set_GID_if_ID_is_already_in_use_as_UID_of_authd_user/response
new file mode 100644
index 0000000000..5ea0b29be3
--- /dev/null
+++ b/internal/users/testdata/golden/TestSetGroupID/Successfully_set_GID_if_ID_is_already_in_use_as_UID_of_authd_user/response
@@ -0,0 +1,3 @@
+idchanged: true
+homedirownerchanged: true
+warnings: []
diff --git a/internal/users/testdata/golden/TestSetGroupID/Successfully_set_GID_if_ID_is_already_in_use_as_UID_of_system_user/db b/internal/users/testdata/golden/TestSetGroupID/Successfully_set_GID_if_ID_is_already_in_use_as_UID_of_system_user/db
new file mode 100644
index 0000000000..bd7e75cd8f
--- /dev/null
+++ b/internal/users/testdata/golden/TestSetGroupID/Successfully_set_GID_if_ID_is_already_in_use_as_UID_of_system_user/db
@@ -0,0 +1,60 @@
+users:
+    - name: user1@example.com
+      uid: 1111
+      gid: 54321
+      gecos: |-
+        User1 gecos
+        On multiple lines
+      dir: /tmp/home/user-1111
+      shell: /bin/bash
+      broker_id: broker-id
+    - name: user2@example.com
+      uid: 2222
+      gid: 22222
+      gecos: User2
+      dir: /home/user2@example.com
+      shell: /bin/dash
+      broker_id: broker-id
+    - name: user3@example.com
+      uid: 3333
+      gid: 33333
+      gecos: User3
+      dir: /home/user3@example.com
+      shell: /bin/zsh
+      broker_id: broker-id
+    - name: userwithoutbroker@example.com
+      uid: 4444
+      gid: 44444
+      gecos: userwithoutbroker
+      dir: /home/userwithoutbroker@example.com
+      shell: /bin/sh
+groups:
+    - name: group2withoutugid
+      gid: 22222
+      ugid: ""
+    - name: group3
+      gid: 33333
+      ugid: "34567812"
+    - name: group4
+      gid: 44444
+      ugid: "45678123"
+    - name: group1
+      gid: 54321
+      ugid: "12345678"
+    - name: commongroup
+      gid: 99999
+      ugid: "87654321"
+users_to_groups:
+    - uid: 2222
+      gid: 22222
+    - uid: 2222
+      gid: 99999
+    - uid: 3333
+      gid: 33333
+    - uid: 3333
+      gid: 99999
+    - uid: 4444
+      gid: 44444
+    - uid: 4444
+      gid: 99999
+schema_version: 2
diff --git a/internal/users/testdata/golden/TestSetGroupID/Successfully_set_GID_if_ID_is_already_in_use_as_UID_of_system_user/response b/internal/users/testdata/golden/TestSetGroupID/Successfully_set_GID_if_ID_is_already_in_use_as_UID_of_system_user/response
new file mode 100644
index 0000000000..5ea0b29be3
--- /dev/null
+++ b/internal/users/testdata/golden/TestSetGroupID/Successfully_set_GID_if_ID_is_already_in_use_as_UID_of_system_user/response
@@ -0,0 +1,3 @@
+idchanged: true
+homedirownerchanged: true
+warnings: []
diff --git a/internal/users/testdata/golden/TestSetGroupID/Successfully_set_GID_when_group_is_not_primary_group_of_any_user/db b/internal/users/testdata/golden/TestSetGroupID/Successfully_set_GID_when_group_is_not_primary_group_of_any_user/db
new file mode 100644
index 0000000000..c4ee544154
--- /dev/null
+++ b/internal/users/testdata/golden/TestSetGroupID/Successfully_set_GID_when_group_is_not_primary_group_of_any_user/db
@@ -0,0 +1,60 @@
+users:
+    - name: user1@example.com
+      uid: 1111
+      gid: 22222
+      gecos: |-
+        User1 gecos
+        On multiple lines
+      dir: /tmp/home/user-1111
+      shell: /bin/bash
+      broker_id: broker-id
+    - name: user2@example.com
+      uid: 2222
+      gid: 22222
+      gecos: User2
+      dir: /home/user2@example.com
+      shell: /bin/dash
+      broker_id: broker-id
+    - name: user3@example.com
+      uid: 3333
+      gid: 33333
+      gecos: User3
+      dir: /home/user3@example.com
+      shell: /bin/zsh
+      broker_id: broker-id
+    - name: userwithoutbroker@example.com
+      uid: 4444
+      gid: 44444
+      gecos: userwithoutbroker
+      dir: /home/userwithoutbroker@example.com
+      shell: /bin/sh
+groups:
+    - name: group2withoutugid
+      gid: 22222
+      ugid: ""
+    - name: group3
+      gid: 33333
+      ugid: "34567812"
+    - name: group4
+      gid: 44444
+      ugid: "45678123"
+    - name: group1
+      gid: 54321
+      ugid: "12345678"
+    - name: commongroup
+      gid: 99999
+      ugid: "87654321"
+users_to_groups:
+    - uid: 2222
+      gid: 22222
+    - uid: 2222
+      gid: 99999
+    - uid: 3333
+      gid: 33333
+    - uid: 3333
+      gid: 99999
+    - uid: 4444
+      gid: 44444
+    - uid: 4444
+      gid: 99999
+schema_version: 2
diff --git a/internal/users/testdata/golden/TestSetGroupID/Successfully_set_GID_when_group_is_not_primary_group_of_any_user/response b/internal/users/testdata/golden/TestSetGroupID/Successfully_set_GID_when_group_is_not_primary_group_of_any_user/response
new file mode 100644
index 0000000000..5b5a696198
--- /dev/null
+++ b/internal/users/testdata/golden/TestSetGroupID/Successfully_set_GID_when_group_is_not_primary_group_of_any_user/response
@@ -0,0 +1,3 @@
+idchanged: true
+homedirownerchanged: false
+warnings: []
diff --git a/internal/users/testdata/golden/TestSetGroupID/Successfully_set_GID_when_home_directory_does_not_exist/db b/internal/users/testdata/golden/TestSetGroupID/Successfully_set_GID_when_home_directory_does_not_exist/db
new file mode 100644
index 0000000000..60344d4f49
--- /dev/null
+++ b/internal/users/testdata/golden/TestSetGroupID/Successfully_set_GID_when_home_directory_does_not_exist/db
@@ -0,0 +1,64 @@
+users:
+    - name: user1@example.com
+      uid: 1111
+      gid: 54321
+      gecos: |-
+        User1 gecos
+        On multiple lines
+      dir: /home/user1@example.com
+      shell: /bin/bash
+      broker_id: broker-id
+    - name: user2@example.com
+      uid: 2222
+      gid: 22222
+      gecos: User2
+      dir: /home/user2@example.com
+      shell: /bin/dash
+      broker_id: broker-id
+    - name: user3@example.com
+      uid: 3333
+      gid: 33333
+      gecos: User3
+      dir: /home/user3@example.com
+      shell: /bin/zsh
+      broker_id: broker-id
+    - name: userwithoutbroker@example.com
+      uid: 4444
+      gid: 44444
+      gecos: userwithoutbroker
+      dir: /home/userwithoutbroker@example.com
+      shell: /bin/sh
+groups:
+    - name: group2withoutugid
+      gid: 22222
+      ugid: ""
+    - name: group3
+      gid: 33333
+      ugid: "34567812"
+    - name: group4
+      gid: 44444
+      ugid: "45678123"
+    - name: group1
+      gid: 54321
+      ugid: "12345678"
+    - name: commongroup
+      gid: 99999
+      ugid: "87654321"
+users_to_groups:
+    - uid: 1111
+      gid: 54321
+    - uid: 1111
+      gid: 99999
+    - uid: 2222
+      gid: 22222
+    - uid: 2222
+      gid: 99999
+    - uid: 3333
+      gid: 33333
+    - uid: 3333
+      gid: 99999
+    - uid: 4444
+      gid: 44444
+    - uid: 4444
+      gid: 99999
+schema_version: 2
diff --git a/internal/users/testdata/golden/TestSetGroupID/Successfully_set_GID_when_home_directory_does_not_exist/response b/internal/users/testdata/golden/TestSetGroupID/Successfully_set_GID_when_home_directory_does_not_exist/response
new file mode 100644
index 0000000000..5b5a696198
--- /dev/null
+++ b/internal/users/testdata/golden/TestSetGroupID/Successfully_set_GID_when_home_directory_does_not_exist/response
@@ -0,0 +1,3 @@
+idchanged: true
+homedirownerchanged: false
+warnings: []
diff --git a/internal/users/testdata/golden/TestSetGroupID/Warning_if_group_already_has_given_GID/db b/internal/users/testdata/golden/TestSetGroupID/Warning_if_group_already_has_given_GID/db
new file mode 100644
index 0000000000..bd7e75cd8f
--- /dev/null
+++ b/internal/users/testdata/golden/TestSetGroupID/Warning_if_group_already_has_given_GID/db
@@ -0,0 +1,60 @@
+users:
+    - name: user1@example.com
+      uid: 1111
+      gid: 54321
+      gecos: |-
+        User1 gecos
+        On multiple lines
+      dir: /tmp/home/user-1111
+      shell: /bin/bash
+      broker_id: broker-id
+    - name: user2@example.com
+      uid: 2222
+      gid: 22222
+      gecos: User2
+      dir: /home/user2@example.com
+      shell: /bin/dash
+      broker_id: broker-id
+    - name: user3@example.com
+      uid: 3333
+      gid: 33333
+      gecos: User3
+      dir: /home/user3@example.com
+      shell: /bin/zsh
+      broker_id: broker-id
+    - name: userwithoutbroker@example.com
+      uid: 4444
+      gid: 44444
+      gecos: userwithoutbroker
+      dir: /home/userwithoutbroker@example.com
+      shell: /bin/sh
+groups:
+    - name: group2withoutugid
+      gid: 22222
+      ugid: ""
+    - name: group3
+      gid: 33333
+      ugid: "34567812"
+    - name: group4
+      gid: 44444
+      ugid: "45678123"
+    - name: group1
+      gid: 54321
+      ugid: "12345678"
+    - name: commongroup
+      gid: 99999
+      ugid: "87654321"
+users_to_groups:
+    - uid: 2222
+      gid: 22222
+    - uid: 2222
+      gid: 99999
+    - uid: 3333
+      gid: 33333
+    - uid: 3333
+      gid: 99999
+    - uid: 4444
+      gid: 44444
+    - uid: 4444
+      gid: 99999
+schema_version: 2
diff --git a/internal/users/testdata/golden/TestSetGroupID/Warning_if_group_already_has_given_GID/response b/internal/users/testdata/golden/TestSetGroupID/Warning_if_group_already_has_given_GID/response
new file mode 100644
index 0000000000..dd21d7391f
--- /dev/null
+++ b/internal/users/testdata/golden/TestSetGroupID/Warning_if_group_already_has_given_GID/response
@@ -0,0 +1,4 @@
+idchanged: false
+homedirownerchanged: false
+warnings:
+    - Group 'group1' already has GID 54321.
diff --git a/internal/users/testdata/golden/TestSetGroupID/Warning_if_home_directory_cannot_be_accessed/db b/internal/users/testdata/golden/TestSetGroupID/Warning_if_home_directory_cannot_be_accessed/db
new file mode 100644
index 0000000000..bd7e75cd8f
--- /dev/null
+++ b/internal/users/testdata/golden/TestSetGroupID/Warning_if_home_directory_cannot_be_accessed/db
@@ -0,0 +1,60 @@
+users:
+    - name: user1@example.com
+      uid: 1111
+      gid: 54321
+      gecos: |-
+        User1 gecos
+        On multiple lines
+      dir: /tmp/home/user-1111
+      shell: /bin/bash
+      broker_id: broker-id
+    - name: user2@example.com
+      uid: 2222
+      gid: 22222
+      gecos: User2
+      dir: /home/user2@example.com
+      shell: /bin/dash
+      broker_id: broker-id
+    - name: user3@example.com
+      uid: 3333
+      gid: 33333
+      gecos: User3
+      dir: /home/user3@example.com
+      shell: /bin/zsh
+      broker_id: broker-id
+    - name: userwithoutbroker@example.com
+      uid: 4444
+      gid: 44444
+      gecos: userwithoutbroker
+      dir: /home/userwithoutbroker@example.com
+      shell: /bin/sh
+groups:
+    - name: group2withoutugid
+      gid: 22222
+      ugid: ""
+    - name: group3
+      gid: 33333
+      ugid: "34567812"
+    - name: group4
+      gid: 44444
+      ugid: "45678123"
+    - name: group1
+      gid: 54321
+      ugid: "12345678"
+    - name: commongroup
+      gid: 99999
+      ugid: "87654321"
+users_to_groups:
+    - uid: 2222
+      gid: 22222
+    - uid: 2222
+      gid: 99999
+    - uid: 3333
+      gid: 33333
+    - uid: 3333
+      gid: 99999
+    - uid: 4444
+      gid: 44444
+    - uid: 4444
+      gid: 99999
+schema_version: 2
diff --git a/internal/users/testdata/golden/TestSetGroupID/Warning_if_home_directory_cannot_be_accessed/response b/internal/users/testdata/golden/TestSetGroupID/Warning_if_home_directory_cannot_be_accessed/response
new file mode 100644
index 0000000000..95015bea9a
--- /dev/null
+++ b/internal/users/testdata/golden/TestSetGroupID/Warning_if_home_directory_cannot_be_accessed/response
@@ -0,0 +1,4 @@
+idchanged: true
+homedirownerchanged: false
+warnings:
+    - Could not get owner of home directory '{{HOME}}'.
diff --git a/internal/users/testdata/golden/TestSetGroupID/Warning_if_home_directory_is_owned_by_other_group/db b/internal/users/testdata/golden/TestSetGroupID/Warning_if_home_directory_is_owned_by_other_group/db
new file mode 100644
index 0000000000..bd7e75cd8f
--- /dev/null
+++ b/internal/users/testdata/golden/TestSetGroupID/Warning_if_home_directory_is_owned_by_other_group/db
@@ -0,0 +1,60 @@
+users:
+    - name: user1@example.com
+      uid: 1111
+      gid: 54321
+      gecos: |-
+        User1 gecos
+        On multiple lines
+      dir: /tmp/home/user-1111
+      shell: /bin/bash
+      broker_id: broker-id
+    - name: user2@example.com
+      uid: 2222
+      gid: 22222
+      gecos: User2
+      dir: /home/user2@example.com
+      shell: /bin/dash
+      broker_id: broker-id
+    - name: user3@example.com
+      uid: 3333
+      gid: 33333
+      gecos: User3
+      dir: /home/user3@example.com
+      shell: /bin/zsh
+      broker_id: broker-id
+    - name: userwithoutbroker@example.com
+      uid: 4444
+      gid: 44444
+      gecos: userwithoutbroker
+      dir: /home/userwithoutbroker@example.com
+      shell: /bin/sh
+groups:
+    - name: group2withoutugid
+      gid: 22222
+      ugid: ""
+    - name: group3
+      gid: 33333
+      ugid: "34567812"
+    - name: group4
+      gid: 44444
+      ugid: "45678123"
+    - name: group1
+      gid: 54321
+      ugid: "12345678"
+    - name: commongroup
+      gid: 99999
+      ugid: "87654321"
+users_to_groups:
+    - uid: 2222
+      gid: 22222
+    - uid: 2222
+      gid: 99999
+    - uid: 3333
+      gid: 33333
+    - uid: 3333
+      gid: 99999
+    - uid: 4444
+      gid: 44444
+    - uid: 4444
+      gid: 99999
+schema_version: 2
diff --git a/internal/users/testdata/golden/TestSetGroupID/Warning_if_home_directory_is_owned_by_other_group/response b/internal/users/testdata/golden/TestSetGroupID/Warning_if_home_directory_is_owned_by_other_group/response
new file mode 100644
index 0000000000..befd7ff6d6
--- /dev/null
+++ b/internal/users/testdata/golden/TestSetGroupID/Warning_if_home_directory_is_owned_by_other_group/response
@@ -0,0 +1,4 @@
+idchanged: true
+homedirownerchanged: false
+warnings:
+    - 'Not updating ownership of home directory ''{{HOME}}'' because it is not owned by GID {{GID}} (current owner: {{CURR_GID}}).'
diff --git a/internal/users/testdata/golden/TestSetUserID/Successfully_set_UID/db b/internal/users/testdata/golden/TestSetUserID/Successfully_set_UID/db
new file mode 100644
index 0000000000..7db435ea61
--- /dev/null
+++ b/internal/users/testdata/golden/TestSetUserID/Successfully_set_UID/db
@@ -0,0 +1,60 @@
+users:
+    - name: user2@example.com
+      uid: 2222
+      gid: 22222
+      gecos: User2
+      dir: /home/user2@example.com
+      shell: /bin/dash
+      broker_id: broker-id
+    - name: user3@example.com
+      uid: 3333
+      gid: 33333
+      gecos: User3
+      dir: /home/user3@example.com
+      shell: /bin/zsh
+      broker_id: broker-id
+    - name: userwithoutbroker@example.com
+      uid: 4444
+      gid: 44444
+      gecos: userwithoutbroker
+      dir: /home/userwithoutbroker@example.com
+      shell: /bin/sh
+    - name: user1@example.com
+      uid: 54321
+      gid: 11111
+      gecos: |-
+        User1 gecos
+        On multiple lines
+      dir: /tmp/home/user-1111
+      shell: /bin/bash
+      broker_id: broker-id
+groups:
+    - name: group1
+      gid: 11111
+      ugid: "12345678"
+    - name: group2withoutugid
+      gid: 22222
+      ugid: ""
+    - name: group3
+      gid: 33333
+      ugid: "34567812"
+    - name: group4
+      gid: 44444
+      ugid: "45678123"
+    - name: commongroup
+      gid: 99999
+      ugid: "87654321"
+users_to_groups:
+    - uid: 2222
+      gid: 22222
+    - uid: 2222
+      gid: 99999
+    - uid: 3333
+      gid: 33333
+    - uid: 3333
+      gid: 99999
+    - uid: 4444
+      gid: 44444
+    - uid: 4444
+      gid: 99999
+schema_version: 2
diff --git a/internal/users/testdata/golden/TestSetUserID/Successfully_set_UID/response b/internal/users/testdata/golden/TestSetUserID/Successfully_set_UID/response
new file mode 100644
index 0000000000..5ea0b29be3
--- /dev/null
+++ b/internal/users/testdata/golden/TestSetUserID/Successfully_set_UID/response
@@ -0,0 +1,3 @@
+idchanged: true
+homedirownerchanged: true
+warnings: []
diff --git a/internal/users/testdata/golden/TestSetUserID/Successfully_set_UID_if_ID_is_already_in_use_as_GID_of_authd_user/db b/internal/users/testdata/golden/TestSetUserID/Successfully_set_UID_if_ID_is_already_in_use_as_GID_of_authd_user/db
new file mode 100644
index 0000000000..11cb87f34f
--- /dev/null
+++ b/internal/users/testdata/golden/TestSetUserID/Successfully_set_UID_if_ID_is_already_in_use_as_GID_of_authd_user/db
@@ -0,0 +1,60 @@
+users:
+    - name: user2@example.com
+      uid: 2222
+      gid: 22222
+      gecos: User2
+      dir: /home/user2@example.com
+      shell: /bin/dash
+      broker_id: broker-id
+    - name: user3@example.com
+      uid: 3333
+      gid: 33333
+      gecos: User3
+      dir: /home/user3@example.com
+      shell: /bin/zsh
+      broker_id: broker-id
+    - name: userwithoutbroker@example.com
+      uid: 4444
+      gid: 44444
+      gecos: userwithoutbroker
+      dir: /home/userwithoutbroker@example.com
+      shell: /bin/sh
+    - name: user1@example.com
+      uid: 22222
+      gid: 11111
+      gecos: |-
+        User1 gecos
+        On multiple lines
+      dir: /tmp/home/user-1111
+      shell: /bin/bash
+      broker_id: broker-id
+groups:
+    - name: group1
+      gid: 11111
+      ugid: "12345678"
+    - name: group2withoutugid
+      gid: 22222
+      ugid: ""
+    - name: group3
+      gid: 33333
+      ugid: "34567812"
+    - name: group4
+      gid: 44444
+      ugid: "45678123"
+    - name: commongroup
+      gid: 99999
+      ugid: "87654321"
+users_to_groups:
+    - uid: 2222
+      gid: 22222
+    - uid: 2222
+      gid: 99999
+    - uid: 3333
+      gid: 33333
+    - uid: 3333
+      gid: 99999
+    - uid: 4444
+      gid: 44444
+    - uid: 4444
+      gid: 99999
+schema_version: 2
diff --git a/internal/users/testdata/golden/TestSetUserID/Successfully_set_UID_if_ID_is_already_in_use_as_GID_of_authd_user/response b/internal/users/testdata/golden/TestSetUserID/Successfully_set_UID_if_ID_is_already_in_use_as_GID_of_authd_user/response
new file mode 100644
index 0000000000..5ea0b29be3
--- /dev/null
+++ b/internal/users/testdata/golden/TestSetUserID/Successfully_set_UID_if_ID_is_already_in_use_as_GID_of_authd_user/response
@@ -0,0 +1,3 @@
+idchanged: true
+homedirownerchanged: true
+warnings: []
diff --git a/internal/users/testdata/golden/TestSetUserID/Successfully_set_UID_if_ID_is_already_in_use_as_GID_of_system_user/db b/internal/users/testdata/golden/TestSetUserID/Successfully_set_UID_if_ID_is_already_in_use_as_GID_of_system_user/db
new file mode 100644
index 0000000000..7db435ea61
--- /dev/null
+++ b/internal/users/testdata/golden/TestSetUserID/Successfully_set_UID_if_ID_is_already_in_use_as_GID_of_system_user/db
@@ -0,0 +1,60 @@
+users:
+    - name: user2@example.com
+      uid: 2222
+      gid: 22222
+      gecos: User2
+      dir: /home/user2@example.com
+      shell: /bin/dash
+      broker_id: broker-id
+    - name: user3@example.com
+      uid: 3333
+      gid: 33333
+      gecos: User3
+      dir: /home/user3@example.com
+      shell: /bin/zsh
+      broker_id: broker-id
+    - name: userwithoutbroker@example.com
+      uid: 4444
+      gid: 44444
+      gecos: userwithoutbroker
+      dir: /home/userwithoutbroker@example.com
+      shell: /bin/sh
+    - name: user1@example.com
+      uid: 54321
+      gid: 11111
+      gecos: |-
+        User1 gecos
+        On multiple lines
+      dir: /tmp/home/user-1111
+      shell: /bin/bash
+      broker_id: broker-id
+groups:
+    - name: group1
+      gid: 11111
+      ugid: "12345678"
+    - name: group2withoutugid
+      gid: 22222
+      ugid: ""
+    - name: group3
+      gid: 33333
+      ugid: "34567812"
+    - name: group4
+      gid: 44444
+      ugid: "45678123"
+    - name: commongroup
+      gid: 99999
+      ugid: "87654321"
+users_to_groups:
+    - uid: 2222
+      gid: 22222
+    - uid: 2222
+      gid: 99999
+    - uid: 3333
+      gid: 33333
+    - uid: 3333
+      gid: 99999
+    - uid: 4444
+      gid: 44444
+    - uid: 4444
+      gid: 99999
+schema_version: 2
diff --git a/internal/users/testdata/golden/TestSetUserID/Successfully_set_UID_if_ID_is_already_in_use_as_GID_of_system_user/response b/internal/users/testdata/golden/TestSetUserID/Successfully_set_UID_if_ID_is_already_in_use_as_GID_of_system_user/response
new file mode 100644
index 0000000000..5ea0b29be3
--- /dev/null
+++ b/internal/users/testdata/golden/TestSetUserID/Successfully_set_UID_if_ID_is_already_in_use_as_GID_of_system_user/response
@@ -0,0 +1,3 @@
+idchanged: true
+homedirownerchanged: true
+warnings: []
diff --git a/internal/users/testdata/golden/TestSetUserID/Successfully_set_UID_when_home_directory_does_not_exist/db b/internal/users/testdata/golden/TestSetUserID/Successfully_set_UID_when_home_directory_does_not_exist/db
new file mode 100644
index 0000000000..90a8fa641e
--- /dev/null
+++ b/internal/users/testdata/golden/TestSetUserID/Successfully_set_UID_when_home_directory_does_not_exist/db
@@ -0,0 +1,64 @@
+users:
+    - name: user2@example.com
+      uid: 2222
+      gid: 22222
+      gecos: User2
+      dir: /home/user2@example.com
+      shell: /bin/dash
+      broker_id: broker-id
+    - name: user3@example.com
+      uid: 3333
+      gid: 33333
+      gecos: User3
+      dir: /home/user3@example.com
+      shell: /bin/zsh
+      broker_id: broker-id
+    - name: userwithoutbroker@example.com
+      uid: 4444
+      gid: 44444
+      gecos: userwithoutbroker
+      dir: /home/userwithoutbroker@example.com
+      shell: /bin/sh
+    - name: user1@example.com
+      uid: 54321
+      gid: 11111
+      gecos: |-
+        User1 gecos
+        On multiple lines
+      dir: /home/user1@example.com
+      shell: /bin/bash
+      broker_id: broker-id
+groups:
+    - name: group1
+      gid: 11111
+      ugid: "12345678"
+    - name: group2withoutugid
+      gid: 22222
+      ugid: ""
+    - name: group3
+      gid: 33333
+      ugid: "34567812"
+    - name: group4
+      gid: 44444
+      ugid: "45678123"
+    - name: commongroup
+      gid: 99999
+      ugid: "87654321"
+users_to_groups:
+    - uid: 2222
+      gid: 22222
+    - uid: 2222
+      gid: 99999
+    - uid: 3333
+      gid: 33333
+    - uid: 3333
+      gid: 99999
+    - uid: 4444
+      gid: 44444
+    - uid: 4444
+      gid: 99999
+    - uid: 54321
+      gid: 11111
+    - uid: 54321
+      gid: 99999
+schema_version: 2
diff --git a/internal/users/testdata/golden/TestSetUserID/Successfully_set_UID_when_home_directory_does_not_exist/response b/internal/users/testdata/golden/TestSetUserID/Successfully_set_UID_when_home_directory_does_not_exist/response
new file mode 100644
index 0000000000..5b5a696198
--- /dev/null
+++ b/internal/users/testdata/golden/TestSetUserID/Successfully_set_UID_when_home_directory_does_not_exist/response
@@ -0,0 +1,3 @@
+idchanged: true
+homedirownerchanged: false
+warnings: []
diff --git a/internal/users/testdata/golden/TestSetUserID/Warning_if_home_directory_cannot_be_accessed/db b/internal/users/testdata/golden/TestSetUserID/Warning_if_home_directory_cannot_be_accessed/db
new file mode 100644
index 0000000000..7db435ea61
--- /dev/null
+++ b/internal/users/testdata/golden/TestSetUserID/Warning_if_home_directory_cannot_be_accessed/db
@@ -0,0 +1,60 @@
+users:
+    - name: user2@example.com
+      uid: 2222
+      gid: 22222
+      gecos: User2
+      dir: /home/user2@example.com
+      shell: /bin/dash
+      broker_id: broker-id
+    - name: user3@example.com
+      uid: 3333
+      gid: 33333
+      gecos: User3
+      dir: /home/user3@example.com
+      shell: /bin/zsh
+      broker_id: broker-id
+    - name: userwithoutbroker@example.com
+      uid: 4444
+      gid: 44444
+      gecos: userwithoutbroker
+      dir: /home/userwithoutbroker@example.com
+      shell: /bin/sh
+    - name: user1@example.com
+      uid: 54321
+      gid: 11111
+      gecos: |-
+        User1 gecos
+        On multiple lines
+      dir: /tmp/home/user-1111
+      shell: /bin/bash
+      broker_id: broker-id
+groups:
+    - name: group1
+      gid: 11111
+      ugid: "12345678"
+    - name: group2withoutugid
+      gid: 22222
+      ugid: ""
+    - name: group3
+      gid: 33333
+      ugid: "34567812"
+    - name: group4
+      gid: 44444
+      ugid: "45678123"
+    - name: commongroup
+      gid: 99999
+      ugid: "87654321"
+users_to_groups:
+    - uid: 2222
+      gid: 22222
+    - uid: 2222
+      gid: 99999
+    - uid: 3333
+      gid: 33333
+    - uid: 3333
+      gid: 99999
+    - uid: 4444
+      gid: 44444
+    - uid: 4444
+      gid: 99999
+schema_version: 2
diff --git a/internal/users/testdata/golden/TestSetUserID/Warning_if_home_directory_cannot_be_accessed/response b/internal/users/testdata/golden/TestSetUserID/Warning_if_home_directory_cannot_be_accessed/response
new file mode 100644
index 0000000000..5967e5be65
--- /dev/null
+++ b/internal/users/testdata/golden/TestSetUserID/Warning_if_home_directory_cannot_be_accessed/response
@@ -0,0 +1,4 @@
+idchanged: true
+homedirownerchanged: false
+warnings:
+    - Could not get owner of home directory '{{HOME}}'
diff --git a/internal/users/testdata/golden/TestSetUserID/Warning_if_home_directory_is_owned_by_other_user/db b/internal/users/testdata/golden/TestSetUserID/Warning_if_home_directory_is_owned_by_other_user/db
new file mode 100644
index 0000000000..0c45fb89a9
--- /dev/null
+++ b/internal/users/testdata/golden/TestSetUserID/Warning_if_home_directory_is_owned_by_other_user/db
@@ -0,0 +1,60 @@
+users:
+    - name: user2@example.com
+      uid: 2222
+      gid: 22222
+      gecos: User2
+      dir: /home/user2@example.com
+      shell: /bin/dash
+      broker_id: broker-id
+    - name: user3@example.com
+      uid: 3333
+      gid: 33333
+      gecos: User3
+      dir: /home/user3@example.com
+      shell: /bin/zsh
+      broker_id: broker-id
+    - name: userwithoutbroker@example.com
+      uid: 4444
+      gid: 44444
+      gecos: userwithoutbroker
+      dir: /home/userwithoutbroker@example.com
+      shell: /bin/sh
+    - name: user1@example.com
+      uid: 54321
+      gid: 11111
+      gecos: |-
+        User1 gecos
+        On multiple lines
+      dir: /tmp/home/user-2222
+      shell: /bin/bash
+      broker_id: broker-id
+groups:
+    - name: group1
+      gid: 11111
+      ugid: "12345678"
+    - name: group2withoutugid
+      gid: 22222
+      ugid: ""
+    - name: group3
+      gid: 33333
+      ugid: "34567812"
+    - name: group4
+      gid: 44444
+      ugid: "45678123"
+    - name: commongroup
+      gid: 99999
+      ugid: "87654321"
+users_to_groups:
+    - uid: 2222
+      gid: 22222
+    - uid: 2222
+      gid: 99999
+    - uid: 3333
+      gid: 33333
+    - uid: 3333
+      gid: 99999
+    - uid: 4444
+      gid: 44444
+    - uid: 4444
+      gid: 99999
+schema_version: 2
diff --git a/internal/users/testdata/golden/TestSetUserID/Warning_if_home_directory_is_owned_by_other_user/response b/internal/users/testdata/golden/TestSetUserID/Warning_if_home_directory_is_owned_by_other_user/response
new file mode 100644
index 0000000000..1927dd6513
--- /dev/null
+++ b/internal/users/testdata/golden/TestSetUserID/Warning_if_home_directory_is_owned_by_other_user/response
@@ -0,0 +1,4 @@
+idchanged: true
+homedirownerchanged: false
+warnings:
+    - 'Not updating ownership of home directory ''{{HOME}}'' because it is not owned by UID {{UID}} (current owner: {{CURR_UID}})'
diff --git a/internal/users/testdata/golden/TestSetUserID/Warning_if_user_already_has_given_UID/db b/internal/users/testdata/golden/TestSetUserID/Warning_if_user_already_has_given_UID/db
new file mode 100644
index 0000000000..7db435ea61
--- /dev/null
+++ b/internal/users/testdata/golden/TestSetUserID/Warning_if_user_already_has_given_UID/db
@@ -0,0 +1,60 @@
+users:
+    - name: user2@example.com
+      uid: 2222
+      gid: 22222
+      gecos: User2
+      dir: /home/user2@example.com
+      shell: /bin/dash
+      broker_id: broker-id
+    - name: user3@example.com
+      uid: 3333
+      gid: 33333
+      gecos: User3
+      dir: /home/user3@example.com
+      shell: /bin/zsh
+      broker_id: broker-id
+    - name: userwithoutbroker@example.com
+      uid: 4444
+      gid: 44444
+      gecos: userwithoutbroker
+      dir: /home/userwithoutbroker@example.com
+      shell: /bin/sh
+    - name: user1@example.com
+      uid: 54321
+      gid: 11111
+      gecos: |-
+        User1 gecos
+        On multiple lines
+      dir: /tmp/home/user-1111
+      shell: /bin/bash
+      broker_id: broker-id
+groups:
+    - name: group1
+      gid: 11111
+      ugid: "12345678"
+    - name: group2withoutugid
+      gid: 22222
+      ugid: ""
+    - name: group3
+      gid: 33333
+      ugid: "34567812"
+    - name: group4
+      gid: 44444
+      ugid: "45678123"
+    - name: commongroup
+      gid: 99999
+      ugid: "87654321"
+users_to_groups:
+    - uid: 2222
+      gid: 22222
+    - uid: 2222
+      gid: 99999
+    - uid: 3333
+      gid: 33333
+    - uid: 3333
+      gid: 99999
+    - uid: 4444
+      gid: 44444
+    - uid: 4444
+      gid: 99999
+schema_version: 2
diff --git a/internal/users/testdata/golden/TestSetUserID/Warning_if_user_already_has_given_UID/response b/internal/users/testdata/golden/TestSetUserID/Warning_if_user_already_has_given_UID/response
new file mode 100644
index 0000000000..f42e5571f8
--- /dev/null
+++ b/internal/users/testdata/golden/TestSetUserID/Warning_if_user_already_has_given_UID/response
@@ -0,0 +1,4 @@
+idchanged: false
+homedirownerchanged: false
+warnings:
+    - User 'user1@example.com' already has UID 54321.
diff --git a/internal/users/testdata/golden/TestShadowByName/Successfully_get_shadow_by_name b/internal/users/testdata/golden/TestShadowByName/Successfully_get_shadow_by_name
index d084e72e84..a0043307fd 100644
--- a/internal/users/testdata/golden/TestShadowByName/Successfully_get_shadow_by_name
+++ b/internal/users/testdata/golden/TestShadowByName/Successfully_get_shadow_by_name
@@ -1,4 +1,4 @@
-name: user1
+name: user1@example.com
 lastpwdchange: -1
 maxpwdage: -1
 pwdwarnperiod: -1
diff --git a/internal/users/db/testdata/golden/TestUpdateUserEntry/Updating_user_with_different_capitalization b/internal/users/testdata/golden/TestUnlockUser/Successfully_enable_user
similarity index 68%
rename from internal/users/db/testdata/golden/TestUpdateUserEntry/Updating_user_with_different_capitalization
rename to internal/users/testdata/golden/TestUnlockUser/Successfully_enable_user
index 362a15f68b..68a096617e 100644
--- a/internal/users/db/testdata/golden/TestUpdateUserEntry/Updating_user_with_different_capitalization
+++ b/internal/users/testdata/golden/TestUnlockUser/Successfully_enable_user
@@ -1,12 +1,13 @@
 users:
-    - name: user1
+    - name: user1@example.com
       uid: 1111
       gid: 11111
       gecos: |-
         User1 gecos
         On multiple lines
-      dir: /home/user1
+      dir: /home/user1@example.com
       shell: /bin/bash
+      broker_id: broker-id
 groups:
     - name: group1
       gid: 11111
@@ -14,4 +15,4 @@ groups:
 users_to_groups:
     - uid: 1111
       gid: 11111
-schema_version: 1
+schema_version: 2
diff --git a/internal/users/testdata/golden/TestUpdateBrokerForUser/Successfully_update_broker_for_user b/internal/users/testdata/golden/TestUpdateBrokerForUser/Successfully_update_broker_for_user
index 5077945380..10af34deb8 100644
--- a/internal/users/testdata/golden/TestUpdateBrokerForUser/Successfully_update_broker_for_user
+++ b/internal/users/testdata/golden/TestUpdateBrokerForUser/Successfully_update_broker_for_user
@@ -1,40 +1,40 @@
 users:
-    - name: user1
+    - name: user1@example.com
       uid: 1111
       gid: 11111
       gecos: |-
         User1 gecos
         On multiple lines
-      dir: /home/user1
+      dir: /home/user1@example.com
       shell: /bin/bash
       broker_id: ExampleBrokerID
-    - name: user2
+    - name: user2@example.com
       uid: 2222
       gid: 22222
       gecos: User2
-      dir: /home/user2
+      dir: /home/user2@example.com
       shell: /bin/dash
       broker_id: broker-id
-    - name: user3
+    - name: user3@example.com
       uid: 3333
       gid: 33333
       gecos: User3
-      dir: /home/user3
+      dir: /home/user3@example.com
       shell: /bin/zsh
       broker_id: broker-id
-    - name: userwithoutbroker
+    - name: userwithoutbroker@example.com
       uid: 4444
       gid: 44444
       gecos: userwithoutbroker
-      dir: /home/userwithoutbroker
+      dir: /home/userwithoutbroker@example.com
       shell: /bin/sh
 groups:
     - name: group1
       gid: 11111
       ugid: "12345678"
-    - name: group2
+    - name: group2withoutugid
       gid: 22222
-      ugid: "56781234"
+      ugid: ""
     - name: group3
       gid: 33333
       ugid: "34567812"
@@ -61,4 +61,4 @@ users_to_groups:
       gid: 44444
     - uid: 4444
       gid: 99999
-schema_version: 1
+schema_version: 2
diff --git a/internal/users/testdata/golden/TestUpdateUser/Allow_login_with_existing_group_on_system b/internal/users/testdata/golden/TestUpdateUser/Allow_login_with_existing_group_on_system
new file mode 100644
index 0000000000..94bfe7c869
--- /dev/null
+++ b/internal/users/testdata/golden/TestUpdateUser/Allow_login_with_existing_group_on_system
@@ -0,0 +1,15 @@
+users:
+    - name: user1@example.com
+      uid: 1111
+      gid: 1111
+      gecos: gecos for user1@example.com
+      dir: /home/user1@example.com
+      shell: /bin/bash
+groups:
+    - name: user1@example.com
+      gid: 1111
+      ugid: user1@example.com
+users_to_groups:
+    - uid: 1111
+      gid: 1111
+schema_version: 2
diff --git a/internal/users/testdata/golden/TestUpdateUser/GID_does_not_change_if_group_with_same_UGID_exists b/internal/users/testdata/golden/TestUpdateUser/GID_does_not_change_if_group_with_same_UGID_exists
index 4ea8612145..bdfaf38740 100644
--- a/internal/users/testdata/golden/TestUpdateUser/GID_does_not_change_if_group_with_same_UGID_exists
+++ b/internal/users/testdata/golden/TestUpdateUser/GID_does_not_change_if_group_with_same_UGID_exists
@@ -1,14 +1,14 @@
 users:
-    - name: user1
+    - name: user1@example.com
       uid: 1111
       gid: 1111
-      gecos: gecos for user1
-      dir: /home/user1
+      gecos: gecos for user1@example.com
+      dir: /home/user1@example.com
       shell: /bin/bash
 groups:
-    - name: user1
+    - name: user1@example.com
       gid: 1111
-      ugid: user1
+      ugid: user1@example.com
     - name: renamed-group
       gid: 11111
       ugid: "12345678"
@@ -17,4 +17,4 @@ users_to_groups:
       gid: 1111
     - uid: 1111
       gid: 11111
-schema_version: 1
+schema_version: 2
diff --git a/internal/users/testdata/golden/TestUpdateUser/GID_does_not_change_if_group_with_same_name_and_empty_UGID_exists b/internal/users/testdata/golden/TestUpdateUser/GID_does_not_change_if_group_with_same_name_and_empty_UGID_exists
index 11a33baa3a..a681b31da6 100644
--- a/internal/users/testdata/golden/TestUpdateUser/GID_does_not_change_if_group_with_same_name_and_empty_UGID_exists
+++ b/internal/users/testdata/golden/TestUpdateUser/GID_does_not_change_if_group_with_same_name_and_empty_UGID_exists
@@ -1,14 +1,14 @@
 users:
-    - name: user1
+    - name: user1@example.com
       uid: 1111
       gid: 1111
-      gecos: gecos for user1
-      dir: /home/user1
+      gecos: gecos for user1@example.com
+      dir: /home/user1@example.com
       shell: /bin/bash
 groups:
-    - name: user1
+    - name: user1@example.com
       gid: 1111
-      ugid: user1
+      ugid: user1@example.com
     - name: group1
       gid: 11111
       ugid: "1"
@@ -17,4 +17,4 @@ users_to_groups:
       gid: 1111
     - uid: 1111
       gid: 11111
-schema_version: 1
+schema_version: 2
diff --git a/internal/users/testdata/golden/TestUpdateUser/Removing_last_user_from_a_group_keeps_the_group_record b/internal/users/testdata/golden/TestUpdateUser/Removing_last_user_from_a_group_keeps_the_group_record
index f744472f5e..152ac7fe49 100644
--- a/internal/users/testdata/golden/TestUpdateUser/Removing_last_user_from_a_group_keeps_the_group_record
+++ b/internal/users/testdata/golden/TestUpdateUser/Removing_last_user_from_a_group_keeps_the_group_record
@@ -1,18 +1,18 @@
 users:
-    - name: user1
+    - name: user1@example.com
       uid: 1111
       gid: 1111
-      gecos: gecos for user1
-      dir: /home/user1
+      gecos: gecos for user1@example.com
+      dir: /home/user1@example.com
       shell: /bin/bash
 groups:
-    - name: user1
+    - name: user1@example.com
       gid: 1111
-      ugid: user1
-    - name: group1
+      ugid: user1@example.com
+    - name: group1@example.com
       gid: 11111
       ugid: "12345678"
 users_to_groups:
     - uid: 1111
       gid: 1111
-schema_version: 1
+schema_version: 2
diff --git a/internal/users/testdata/golden/TestUpdateUser/Successfully_update_user b/internal/users/testdata/golden/TestUpdateUser/Successfully_update_user
index 11a33baa3a..a681b31da6 100644
--- a/internal/users/testdata/golden/TestUpdateUser/Successfully_update_user
+++ b/internal/users/testdata/golden/TestUpdateUser/Successfully_update_user
@@ -1,14 +1,14 @@
 users:
-    - name: user1
+    - name: user1@example.com
       uid: 1111
       gid: 1111
-      gecos: gecos for user1
-      dir: /home/user1
+      gecos: gecos for user1@example.com
+      dir: /home/user1@example.com
       shell: /bin/bash
 groups:
-    - name: user1
+    - name: user1@example.com
       gid: 1111
-      ugid: user1
+      ugid: user1@example.com
     - name: group1
       gid: 11111
       ugid: "1"
@@ -17,4 +17,4 @@ users_to_groups:
       gid: 1111
     - uid: 1111
       gid: 11111
-schema_version: 1
+schema_version: 2
diff --git a/internal/users/testdata/golden/TestUpdateUser/Successfully_update_user_updating_local_groups b/internal/users/testdata/golden/TestUpdateUser/Successfully_update_user_updating_local_groups
index 11a33baa3a..a681b31da6 100644
--- a/internal/users/testdata/golden/TestUpdateUser/Successfully_update_user_updating_local_groups
+++ b/internal/users/testdata/golden/TestUpdateUser/Successfully_update_user_updating_local_groups
@@ -1,14 +1,14 @@
 users:
-    - name: user1
+    - name: user1@example.com
       uid: 1111
       gid: 1111
-      gecos: gecos for user1
-      dir: /home/user1
+      gecos: gecos for user1@example.com
+      dir: /home/user1@example.com
       shell: /bin/bash
 groups:
-    - name: user1
+    - name: user1@example.com
       gid: 1111
-      ugid: user1
+      ugid: user1@example.com
     - name: group1
       gid: 11111
       ugid: "1"
@@ -17,4 +17,4 @@ users_to_groups:
       gid: 1111
     - uid: 1111
       gid: 11111
-schema_version: 1
+schema_version: 2
diff --git a/internal/users/testdata/golden/TestUpdateUser/Names_of_authd_groups_are_stored_in_lowercase b/internal/users/testdata/golden/TestUpdateUser/Successfully_update_user_updating_local_groups_with_changes
similarity index 54%
rename from internal/users/testdata/golden/TestUpdateUser/Names_of_authd_groups_are_stored_in_lowercase
rename to internal/users/testdata/golden/TestUpdateUser/Successfully_update_user_updating_local_groups_with_changes
index 11a33baa3a..a681b31da6 100644
--- a/internal/users/testdata/golden/TestUpdateUser/Names_of_authd_groups_are_stored_in_lowercase
+++ b/internal/users/testdata/golden/TestUpdateUser/Successfully_update_user_updating_local_groups_with_changes
@@ -1,14 +1,14 @@
 users:
-    - name: user1
+    - name: user1@example.com
       uid: 1111
       gid: 1111
-      gecos: gecos for user1
-      dir: /home/user1
+      gecos: gecos for user1@example.com
+      dir: /home/user1@example.com
       shell: /bin/bash
 groups:
-    - name: user1
+    - name: user1@example.com
       gid: 1111
-      ugid: user1
+      ugid: user1@example.com
     - name: group1
       gid: 11111
       ugid: "1"
@@ -17,4 +17,4 @@ users_to_groups:
       gid: 1111
     - uid: 1111
       gid: 11111
-schema_version: 1
+schema_version: 2
diff --git a/internal/users/testdata/golden/TestUpdateUser/Successfully_update_user_updating_local_groups_with_changes.group b/internal/users/testdata/golden/TestUpdateUser/Successfully_update_user_updating_local_groups_with_changes.group
new file mode 100644
index 0000000000..c3230bf9e8
--- /dev/null
+++ b/internal/users/testdata/golden/TestUpdateUser/Successfully_update_user_updating_local_groups_with_changes.group
@@ -0,0 +1,3 @@
+localgroup1:x:41:user1@example.com
+localgroup2:x:44:user2@example.com
+localgroup3:x:45:user3@example.com
diff --git a/internal/users/testdata/golden/TestUpdateUser/Successfully_update_user_updating_local_groups_with_changes.group.backup b/internal/users/testdata/golden/TestUpdateUser/Successfully_update_user_updating_local_groups_with_changes.group.backup
new file mode 100644
index 0000000000..d475bb46a4
--- /dev/null
+++ b/internal/users/testdata/golden/TestUpdateUser/Successfully_update_user_updating_local_groups_with_changes.group.backup
@@ -0,0 +1,3 @@
+localgroup1:x:41:
+localgroup2:x:44:user2@example.com
+localgroup3:x:45:user3@example.com
diff --git a/internal/users/testdata/golden/TestUpdateUser/Successfully_update_user_with_different_capitalization b/internal/users/testdata/golden/TestUpdateUser/Successfully_update_user_with_different_capitalization
deleted file mode 100644
index 575dc64034..0000000000
--- a/internal/users/testdata/golden/TestUpdateUser/Successfully_update_user_with_different_capitalization
+++ /dev/null
@@ -1,18 +0,0 @@
-users:
-    - name: user1
-      uid: 1111
-      gid: 1111
-      gecos: gecos for User1
-      dir: /home/user1
-      shell: /bin/bash
-groups:
-    - name: user1
-      gid: 1111
-      ugid: user1
-    - name: group1
-      gid: 11111
-      ugid: "12345678"
-users_to_groups:
-    - uid: 1111
-      gid: 1111
-schema_version: 1
diff --git a/internal/users/testdata/golden/TestUpdateUser/UID_does_not_change_if_user_already_exists b/internal/users/testdata/golden/TestUpdateUser/UID_does_not_change_if_user_already_exists
index f744472f5e..152ac7fe49 100644
--- a/internal/users/testdata/golden/TestUpdateUser/UID_does_not_change_if_user_already_exists
+++ b/internal/users/testdata/golden/TestUpdateUser/UID_does_not_change_if_user_already_exists
@@ -1,18 +1,18 @@
 users:
-    - name: user1
+    - name: user1@example.com
       uid: 1111
       gid: 1111
-      gecos: gecos for user1
-      dir: /home/user1
+      gecos: gecos for user1@example.com
+      dir: /home/user1@example.com
       shell: /bin/bash
 groups:
-    - name: user1
+    - name: user1@example.com
       gid: 1111
-      ugid: user1
-    - name: group1
+      ugid: user1@example.com
+    - name: group1@example.com
       gid: 11111
       ugid: "12345678"
 users_to_groups:
     - uid: 1111
       gid: 1111
-schema_version: 1
+schema_version: 2
diff --git a/internal/users/testdata/golden/TestUserByIDAndName/Successfully_get_temporary_user_by_ID b/internal/users/testdata/golden/TestUserByIDAndName/Successfully_get_temporary_user_by_ID
index 8c4eed4c48..c8c1f6e51b 100644
--- a/internal/users/testdata/golden/TestUserByIDAndName/Successfully_get_temporary_user_by_ID
+++ b/internal/users/testdata/golden/TestUserByIDAndName/Successfully_get_temporary_user_by_ID
@@ -1,4 +1,4 @@
-name: tempuser1
+name: authd-pre-auth-user{{random-suffix}}
 uid: 0
 gid: 0
 gecos: ""
diff --git a/internal/users/testdata/golden/TestUserByIDAndName/Successfully_get_temporary_user_by_name b/internal/users/testdata/golden/TestUserByIDAndName/Successfully_get_temporary_user_by_name
deleted file mode 100644
index 8c4eed4c48..0000000000
--- a/internal/users/testdata/golden/TestUserByIDAndName/Successfully_get_temporary_user_by_name
+++ /dev/null
@@ -1,6 +0,0 @@
-name: tempuser1
-uid: 0
-gid: 0
-gecos: ""
-dir: /nonexistent
-shell: /usr/sbin/nologin
diff --git a/internal/users/testdata/golden/TestUserByIDAndName/Successfully_get_user_by_ID b/internal/users/testdata/golden/TestUserByIDAndName/Successfully_get_user_by_ID
index 8dc6feb43a..2d762b0d31 100644
--- a/internal/users/testdata/golden/TestUserByIDAndName/Successfully_get_user_by_ID
+++ b/internal/users/testdata/golden/TestUserByIDAndName/Successfully_get_user_by_ID
@@ -1,8 +1,8 @@
-name: user1
+name: user1@example.com
 uid: 1111
 gid: 11111
 gecos: |-
     User1 gecos
     On multiple lines
-dir: /home/user1
+dir: /home/user1@example.com
 shell: /bin/bash
diff --git a/internal/users/testdata/golden/TestUserByIDAndName/Successfully_get_user_by_name b/internal/users/testdata/golden/TestUserByIDAndName/Successfully_get_user_by_name
index 8dc6feb43a..2d762b0d31 100644
--- a/internal/users/testdata/golden/TestUserByIDAndName/Successfully_get_user_by_name
+++ b/internal/users/testdata/golden/TestUserByIDAndName/Successfully_get_user_by_name
@@ -1,8 +1,8 @@
-name: user1
+name: user1@example.com
 uid: 1111
 gid: 11111
 gecos: |-
     User1 gecos
     On multiple lines
-dir: /home/user1
+dir: /home/user1@example.com
 shell: /bin/bash
diff --git a/internal/users/testdata/groups/gpasswdfail_in_deleted_group.group b/internal/users/testdata/groups/gpasswdfail_in_deleted_group.group
deleted file mode 100644
index 3ba19de956..0000000000
--- a/internal/users/testdata/groups/gpasswdfail_in_deleted_group.group
+++ /dev/null
@@ -1,2 +0,0 @@
-gpasswdfail:x:42:anotheruser
-localgroup1:x:43:otheruser
\ No newline at end of file
diff --git a/internal/users/testdata/groups/user_mismatching_groups.group b/internal/users/testdata/groups/user_mismatching_groups.group
new file mode 100644
index 0000000000..d475bb46a4
--- /dev/null
+++ b/internal/users/testdata/groups/user_mismatching_groups.group
@@ -0,0 +1,3 @@
+localgroup1:x:41:
+localgroup2:x:44:user2@example.com
+localgroup3:x:45:user3@example.com
diff --git a/internal/users/testdata/groups/users_in_groups.group b/internal/users/testdata/groups/users_in_groups.group
index 225ade2795..1b2548cf04 100644
--- a/internal/users/testdata/groups/users_in_groups.group
+++ b/internal/users/testdata/groups/users_in_groups.group
@@ -1,3 +1,3 @@
-localgroup1:x:41:user1
-localgroup2:x:44:user1,user2
-localgroup3:x:45:user3
\ No newline at end of file
+localgroup1:x:41:user1@example.com
+localgroup2:x:44:user1@example.com,user2@example.com
+localgroup3:x:45:user3@example.com
\ No newline at end of file
diff --git a/internal/users/testutils.go b/internal/users/testutils.go
new file mode 100644
index 0000000000..4692eefdcb
--- /dev/null
+++ b/internal/users/testutils.go
@@ -0,0 +1,38 @@
+package users
+
+import (
+	"fmt"
+
+	"github.com/canonical/authd/internal/testsdetection"
+	"github.com/canonical/authd/internal/users/localentries"
+)
+
+// IDGeneratorMock is a mock implementation of the IDGenerator interface.
+type IDGeneratorMock struct {
+	UIDsToGenerate []uint32
+	GIDsToGenerate []uint32
+}
+
+// GenerateUID generates a UID.
+func (g *IDGeneratorMock) GenerateUID(_ *localentries.UserDBLocked, _ IDOwner) (uint32, func(), error) {
+	testsdetection.MustBeTesting()
+
+	if len(g.UIDsToGenerate) == 0 {
+		return 0, nil, fmt.Errorf("no more UIDs to generate")
+	}
+	uid := g.UIDsToGenerate[0]
+	g.UIDsToGenerate = g.UIDsToGenerate[1:]
+	return uid, func() {}, nil
+}
+
+// GenerateGID generates a GID.
+func (g *IDGeneratorMock) GenerateGID(_ *localentries.UserDBLocked, _ IDOwner) (uint32, func(), error) {
+	testsdetection.MustBeTesting()
+
+	if len(g.GIDsToGenerate) == 0 {
+		return 0, nil, fmt.Errorf("no more GIDs to generate")
+	}
+	gid := g.GIDsToGenerate[0]
+	g.GIDsToGenerate = g.GIDsToGenerate[1:]
+	return gid, func() {}, nil
+}
diff --git a/internal/users/testutils/manager.go b/internal/users/testutils/manager.go
index d99370fd71..bc0311bf73 100644
--- a/internal/users/testutils/manager.go
+++ b/internal/users/testutils/manager.go
@@ -2,11 +2,12 @@
 package userstestutils
 
 import (
+	"sync"
 	"unsafe"
 
-	"github.com/ubuntu/authd/internal/testsdetection"
-	"github.com/ubuntu/authd/internal/users"
-	"github.com/ubuntu/authd/internal/users/db"
+	"github.com/canonical/authd/internal/testsdetection"
+	"github.com/canonical/authd/internal/users"
+	"github.com/canonical/authd/internal/users/db"
 )
 
 func init() {
@@ -15,11 +16,13 @@ func init() {
 }
 
 type manager struct {
+	userRegisterMu sync.Mutex
+
 	db *db.Manager
 }
 
-// GetManagerDB returns the database of the manager.
-func GetManagerDB(m *users.Manager) *db.Manager {
+// DBManager returns the database of the manager.
+func DBManager(m *users.Manager) *db.Manager {
 	//#nosec:G103 // This is only used in tests.
 	mTest := *(*manager)(unsafe.Pointer(m))
 
diff --git a/internal/users/types/groupentry.go b/internal/users/types/groupentry.go
new file mode 100644
index 0000000000..962151b31d
--- /dev/null
+++ b/internal/users/types/groupentry.go
@@ -0,0 +1,160 @@
+package types
+
+import (
+	"context"
+	"fmt"
+	"slices"
+	"strconv"
+	"strings"
+
+	"github.com/canonical/authd/internal/sliceutils"
+	"github.com/canonical/authd/log"
+)
+
+// Validate validates the group entry values.
+func (g GroupEntry) Validate() error {
+	if g.Name == "" {
+		return fmt.Errorf("group %q cannot have empty name", g)
+	}
+
+	if g.GID == 0 && g.Name != "root" {
+		return fmt.Errorf("only root group can have GID 0, not %q", g.Name)
+	}
+
+	if strings.ContainsRune(g.Name, ',') {
+		return fmt.Errorf("group %q cannot contain ',' character", g.Name)
+	}
+
+	if strings.ContainsRune(g.Name, ':') {
+		return fmt.Errorf("group %q cannot contain ':' character", g.Name)
+	}
+
+	if strings.ContainsRune(g.Passwd, ',') {
+		return fmt.Errorf("group %q passwd %q cannot contain ',' character", g.Name, g.Passwd)
+	}
+
+	if strings.ContainsRune(g.Passwd, ':') {
+		return fmt.Errorf("group %q passwd %q cannot contain ':' character", g.Name, g.Passwd)
+	}
+
+	for _, u := range g.Users {
+		if strings.ContainsRune(u, ',') {
+			return fmt.Errorf("group %q cannot contain users with ',' character (%v)", g, g.Users)
+		}
+		if strings.ContainsRune(u, ':') {
+			return fmt.Errorf("group %q cannot contain users with ':' character (%v)", g, g.Users)
+		}
+	}
+
+	return nil
+}
+
+// Equals checks that two groups are equal.
+func (g GroupEntry) Equals(other GroupEntry) bool {
+	return g.Name == other.Name &&
+		g.GID == other.GID &&
+		g.Passwd == other.Passwd &&
+		sliceutils.EqualContent(g.Users, other.Users)
+}
+
+// DeepCopy makes a deep copy of the group entry.
+func (g GroupEntry) DeepCopy() GroupEntry {
+	g.Users = slices.Clone(g.Users)
+	return g
+}
+
+func (g GroupEntry) String() string {
+	return strings.Join([]string{
+		g.Name,
+		g.Passwd,
+		strconv.FormatUint(uint64(g.GID), 10),
+		strings.Join(g.Users, ","),
+	}, ":")
+}
+
+// DeepCopyGroupEntries makes a deep copy of group entries.
+func DeepCopyGroupEntries(groups []GroupEntry) []GroupEntry {
+	return sliceutils.Map(groups, func(g GroupEntry) GroupEntry {
+		return g.DeepCopy()
+	})
+}
+
+// ValidateGroupEntries validates a list of group entries, ensuring they respect
+// the [GroupEntry.Validate] constraints and that the names and the GID are unique.
+func ValidateGroupEntries(groups []GroupEntry) error {
+	groupNames := make(map[string]*GroupEntry, len(groups))
+	groupIDs := make(map[uint32]*GroupEntry, len(groups))
+
+	for _, g := range groups {
+		if err := g.Validate(); err != nil {
+			return fmt.Errorf("group %q is not valid: %w", g, err)
+		}
+
+		if otherGroup, ok := groupNames[g.Name]; ok {
+			if g.Equals(*otherGroup) {
+				log.Debugf(context.Background(),
+					"Skipping group %q, it's a duplicate!", g)
+				continue
+			}
+
+			return fmt.Errorf("group %q is duplicate", g.Name)
+		}
+		if otherGroup, ok := groupIDs[g.GID]; ok {
+			return fmt.Errorf("GID %d for group %q is duplicated by %q",
+				g.GID, g.Name, otherGroup.Name)
+		}
+
+		groupNames[g.Name] = &g
+		groupIDs[g.GID] = &g
+	}
+
+	return nil
+}
+
+// GetValidGroupEntries returns the first valid group entries according to validates a list of group entries, ensuring they respect
+// the [GroupEntry.Validate] constraints and that the names and the GID are unique.
+func GetValidGroupEntries(groups []GroupEntry) (validEntries []GroupEntry) {
+	groupNames := make(map[string]*GroupEntry, len(groups))
+	groupIDs := make(map[uint32]*GroupEntry, len(groups))
+
+	if groups == nil {
+		return nil
+	}
+
+	validEntries = make([]GroupEntry, 0, len(groups))
+
+	for _, g := range groups {
+		if err := g.Validate(); err != nil {
+			log.Warningf(context.Background(), "Group %q is not valid: %v", g.Name, err)
+			continue
+		}
+
+		if otherGroup, ok := groupNames[g.Name]; ok {
+			if !g.Equals(*otherGroup) {
+				log.Warningf(context.Background(),
+					"Skipping group %q, it's a duplicate!", g)
+				continue
+			}
+
+			log.Infof(context.Background(),
+				"Group %q name (%q) is not unique (duplicates %q)", g.Name, g, *otherGroup)
+
+			// We still consider it valid, not to miss track of it, while ideally
+			// it should be just dropped, but maybe it's not our duty.
+			validEntries = append(validEntries, g)
+			continue
+		}
+		if otherGroup, ok := groupIDs[g.GID]; ok {
+			log.Warningf(context.Background(),
+				"Group %q ID (%d) is not unique (duplicates %q)", g.Name, g.GID, *otherGroup)
+			continue
+		}
+
+		groupNames[g.Name] = &g
+		groupIDs[g.GID] = &g
+
+		validEntries = append(validEntries, g)
+	}
+
+	return validEntries
+}
diff --git a/internal/users/types/groupentry_test.go b/internal/users/types/groupentry_test.go
new file mode 100644
index 0000000000..2942ae467a
--- /dev/null
+++ b/internal/users/types/groupentry_test.go
@@ -0,0 +1,532 @@
+package types
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestValidateGroupEntry(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name    string
+		group   GroupEntry
+		wantErr bool
+	}{
+		{
+			name:  "Valid_group",
+			group: GroupEntry{Name: "group1", GID: 1000, Passwd: "x", Users: []string{"user1", "user2"}},
+		},
+		{
+			name:  "Valid_root_group",
+			group: GroupEntry{Name: "root", Passwd: "x"},
+		},
+		{
+			name:  "Valid_group_with_empty_users_list",
+			group: GroupEntry{Name: "group1", GID: 1006, Passwd: "x", Users: []string{}},
+		},
+
+		// Error cases.
+		{
+			name:    "Error_on_empty_group",
+			wantErr: true,
+		},
+		{
+			name:    "Error_on_non_root_group_with_zero_GID",
+			group:   GroupEntry{Name: "i-wish-i-was-root"},
+			wantErr: true,
+		},
+		{
+			name:    "Error_on_empty_name",
+			group:   GroupEntry{Name: "", GID: 1001, Passwd: "x", Users: []string{"user1"}},
+			wantErr: true,
+		},
+		{
+			name:    "Error_on_name_contains_comma",
+			group:   GroupEntry{Name: "ad,mins", GID: 1002, Passwd: "x", Users: []string{"user1"}},
+			wantErr: true,
+		},
+		{
+			name:    "Error_on_passwd_contains_comma",
+			group:   GroupEntry{Name: "group1", GID: 1003, Passwd: "x,", Users: []string{"user1"}},
+			wantErr: true,
+		},
+		{
+			name:    "Error_on_user_contains_comma",
+			group:   GroupEntry{Name: "group1", GID: 1004, Passwd: "x", Users: []string{"al,ice"}},
+			wantErr: true,
+		},
+		{
+			name:    "Error_on_multiple_users_one_with_comma",
+			group:   GroupEntry{Name: "group1", GID: 1005, Passwd: "x", Users: []string{"user1", "b,ob"}},
+			wantErr: true,
+		},
+		{
+			name:    "Error_on_name_contains_colon",
+			group:   GroupEntry{Name: "ad:mins", GID: 1002, Passwd: "x", Users: []string{"user1"}},
+			wantErr: true,
+		},
+		{
+			name:    "Error_on_passwd_contains_colon",
+			group:   GroupEntry{Name: "group1", GID: 1003, Passwd: "x:", Users: []string{"user1"}},
+			wantErr: true,
+		},
+		{
+			name:    "Error_on_user_contains_colon",
+			group:   GroupEntry{Name: "group1", GID: 1004, Passwd: "x", Users: []string{"user:1"}},
+			wantErr: true,
+		},
+		{
+			name:    "Error_on_multiple_users_one_with_colon",
+			group:   GroupEntry{Name: "group1", GID: 1005, Passwd: "x", Users: []string{"user1", "user:2"}},
+			wantErr: true,
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			err := tc.group.Validate()
+			if tc.wantErr {
+				require.Error(t, err, "Validate should return error but it did not")
+				return
+			}
+
+			require.NoError(t, err, "Validate should not return error but it did")
+		})
+	}
+}
+
+func TestGroupEntryEquals(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name string
+		a    GroupEntry
+		b    GroupEntry
+		want bool
+	}{
+		{
+			name: "Equal_groups_all_fields",
+			a:    GroupEntry{Name: "group1", GID: 1000, Passwd: "x", Users: []string{"user1", "user2"}},
+			b:    GroupEntry{Name: "group1", GID: 1000, Passwd: "x", Users: []string{"user1", "user2"}},
+			want: true,
+		},
+		{
+			name: "Different_Users_order",
+			a:    GroupEntry{Name: "group1", GID: 1000, Passwd: "x", Users: []string{"user1", "user2"}},
+			b:    GroupEntry{Name: "group1", GID: 1000, Passwd: "x", Users: []string{"user2", "user1"}},
+			want: true,
+		},
+		{
+			name: "Both_empty_users",
+			a:    GroupEntry{Name: "group1", GID: 1000, Passwd: "x", Users: []string{}},
+			b:    GroupEntry{Name: "group1", GID: 1000, Passwd: "x", Users: []string{}},
+			want: true,
+		},
+		{
+			name: "Both_empty",
+			a:    GroupEntry{},
+			b:    GroupEntry{},
+			want: true,
+		},
+		{
+			name: "Different_name",
+			a:    GroupEntry{Name: "group1", GID: 1000, Passwd: "x", Users: []string{"user1"}},
+			b:    GroupEntry{Name: "group2", GID: 1000, Passwd: "x", Users: []string{"user1"}},
+			want: false,
+		},
+		{
+			name: "Different_GID",
+			a:    GroupEntry{Name: "group1", GID: 1000, Passwd: "x", Users: []string{"user1"}},
+			b:    GroupEntry{Name: "group1", GID: 1001, Passwd: "x", Users: []string{"user1"}},
+			want: false,
+		},
+		{
+			name: "Different_passwd",
+			a:    GroupEntry{Name: "group1", GID: 1000, Passwd: "x", Users: []string{"user1"}},
+			b:    GroupEntry{Name: "group1", GID: 1000, Passwd: "y", Users: []string{"user1"}},
+			want: false,
+		},
+		{
+			name: "Different_users",
+			a:    GroupEntry{Name: "group1", GID: 1000, Passwd: "x", Users: []string{"user1"}},
+			b:    GroupEntry{Name: "group1", GID: 1000, Passwd: "x", Users: []string{"user2"}},
+			want: false,
+		},
+		{
+			name: "Different_multiple_users",
+			a:    GroupEntry{Name: "group1", GID: 1000, Passwd: "x", Users: []string{"user1", "user2"}},
+			b:    GroupEntry{Name: "group1", GID: 1000, Passwd: "x", Users: []string{"user2", "user3"}},
+			want: false,
+		},
+		{
+			name: "One_empty_one_filled",
+			a:    GroupEntry{},
+			b:    GroupEntry{Name: "group1", GID: 1000, Passwd: "x", Users: []string{"user1"}},
+			want: false,
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+			got := tc.a.Equals(tc.b)
+			require.Equal(t, tc.want, got, "Equals not matching expected; want %v", tc.want)
+		})
+	}
+}
+
+func TestGroupEntryString(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name     string
+		group    GroupEntry
+		expected string
+	}{
+		{
+			name:     "All_fields_set_with_users",
+			group:    GroupEntry{Name: "group1", GID: 1000, Passwd: "x", Users: []string{"user1", "user2"}},
+			expected: "group1:x:1000:user1,user2",
+		},
+		{
+			name:     "No_users",
+			group:    GroupEntry{Name: "group2", GID: 1001, Passwd: "y", Users: nil},
+			expected: "group2:y:1001:",
+		},
+		{
+			name:     "Empty_users_slice",
+			group:    GroupEntry{Name: "group3", GID: 1002, Passwd: "z", Users: []string{}},
+			expected: "group3:z:1002:",
+		},
+		{
+			name:     "Empty_passwd",
+			group:    GroupEntry{Name: "group4", GID: 1003, Passwd: "", Users: []string{"user3"}},
+			expected: "group4::1003:user3",
+		},
+		{
+			name:     "Empty_group",
+			group:    GroupEntry{},
+			expected: "::0:",
+		},
+		{
+			name:     "Multiple_users",
+			group:    GroupEntry{Name: "admins", GID: 42, Passwd: "pw", Users: []string{"alice", "bob", "carol"}},
+			expected: "admins:pw:42:alice,bob,carol",
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+			got := tc.group.String()
+			require.Equal(t, tc.expected, got, "String output mismatch")
+		})
+	}
+}
+
+func TestValidateGroupEntries(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name    string
+		groups  []GroupEntry
+		wantErr bool
+	}{
+		{
+			name: "Valid_multiple_groups",
+			groups: []GroupEntry{
+				{Name: "group1", GID: 1000, Passwd: "x", Users: []string{"user1", "user2"}},
+				{Name: "group2", GID: 1001, Passwd: "x", Users: []string{"user3"}},
+			},
+		},
+		{
+			name: "Valid_duplicate_group_structs_with_default_passwd",
+			groups: []GroupEntry{
+				{Name: "group1", GID: 1000, Passwd: "x", Users: []string{"user1"}},
+				{Name: "group1", GID: 1000, Passwd: "x", Users: []string{"user1"}},
+			},
+		},
+		{
+			name: "Valid_duplicate_group_structs_with_unset_passwd",
+			groups: []GroupEntry{
+				{Name: "group1", GID: 1000, Users: []string{"user1"}},
+				{Name: "group1", GID: 1000, Users: []string{"user1"}},
+			},
+		},
+		{
+			name:   "Valid_empty_list",
+			groups: []GroupEntry{},
+		},
+		{
+			name: "Valid_root_group_GID_0",
+			groups: []GroupEntry{
+				{Name: "root", GID: 0, Passwd: "x"},
+			},
+		},
+		{
+			name: "Valid_group_with_empty_passwd",
+			groups: []GroupEntry{
+				{Name: "group1", GID: 1002, Passwd: "", Users: []string{"user1"}},
+			},
+		},
+
+		// Error cases
+		{
+			name: "Error_duplicate_group_name_different_content",
+			groups: []GroupEntry{
+				{Name: "group1", GID: 1000, Passwd: "x", Users: []string{"user1"}},
+				{Name: "group1", GID: 1001, Passwd: "x", Users: []string{"user2"}},
+			},
+			wantErr: true,
+		},
+		{
+			name: "Error_duplicate_GID",
+			groups: []GroupEntry{
+				{Name: "group1", GID: 1000, Passwd: "x", Users: []string{"user1"}},
+				{Name: "group2", GID: 1000, Passwd: "x", Users: []string{"user2"}},
+			},
+			wantErr: true,
+		},
+		{
+			name: "Error_duplicate_group_structs_with_partial_default_passwd",
+			groups: []GroupEntry{
+				{Name: "group1", GID: 1000, Passwd: "x", Users: []string{"user1"}},
+				{Name: "group1", GID: 1000, Users: []string{"user1"}},
+			},
+			wantErr: true,
+		},
+		{
+			name: "Error_invalid_group_entry",
+			groups: []GroupEntry{
+				{Name: "", GID: 1000, Passwd: "x", Users: []string{"user1"}},
+			},
+			wantErr: true,
+		},
+		{
+			name: "Error_non_root_group_GID_0",
+			groups: []GroupEntry{
+				{Name: "group1", GID: 0, Passwd: "x"},
+			},
+			wantErr: true,
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			err := ValidateGroupEntries(tc.groups)
+			if tc.wantErr {
+				require.Error(t, err, "ValidateGroupEntries should return error but did not")
+				return
+			}
+
+			require.NoError(t, err, "ValidateGroupEntries should not return error but did")
+		})
+	}
+}
+
+func TestGroupEntryDeepCopy(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name     string
+		original GroupEntry
+	}{
+		{
+			name:     "Empty_group",
+			original: GroupEntry{},
+		},
+		{
+			name:     "Group_with_users",
+			original: GroupEntry{Name: "group1", GID: 1000, Passwd: "x", Users: []string{"user1", "user2"}},
+		},
+		{
+			name:     "Group_with_empty_users",
+			original: GroupEntry{Name: "group2", GID: 1001, Passwd: "x", Users: []string{}},
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+			copied := tc.original.DeepCopy()
+			require.Equal(t, tc.original, copied, "DeepCopy should produce an equal struct")
+
+			// Mutate the copy's Users slice and ensure original is not affected
+			if copied.Users != nil {
+				copied.Users = append(copied.Users, "newuser")
+				require.NotEqual(t, tc.original.Users, copied.Users, "Users slice should be independent after DeepCopy")
+			}
+		})
+	}
+}
+
+func TestDeepCopyGroupEntries(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name     string
+		original []GroupEntry
+	}{
+		{
+			name:     "Empty_slice",
+			original: []GroupEntry{},
+		},
+		{
+			name: "Multiple_groups",
+			original: []GroupEntry{
+				{Name: "group1", GID: 1000, Passwd: "x", Users: []string{"user1"}},
+				{Name: "group2", GID: 1001, Passwd: "y", Users: []string{"user2", "user3"}},
+			},
+		},
+		{
+			name: "Groups_with_empty_users",
+			original: []GroupEntry{
+				{Name: "group3", GID: 1002, Passwd: "z", Users: []string{}},
+			},
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+			copied := DeepCopyGroupEntries(tc.original)
+			require.Equal(t, tc.original, copied, "DeepCopyGroupEntries should produce an equal slice")
+
+			// Mutate the copy and ensure original is not affected
+			if len(copied) > 0 && len(copied[0].Users) > 0 {
+				copied[0].Users[0] = "mutated"
+				require.NotEqual(t, tc.original[0].Users[0], copied[0].Users[0], "Users slice should be independent after DeepCopyGroupEntries")
+			}
+			if len(copied) > 0 {
+				copied[0].Name = "mutated"
+				require.NotEqual(t, tc.original[0].Name, copied[0].Name, "Struct fields should be independent after DeepCopyGroupEntries")
+			}
+		})
+	}
+}
+
+func TestGetValidGroupEntries(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name   string
+		groups []GroupEntry
+		want   []GroupEntry
+	}{
+		{
+			name: "Nil_input",
+		},
+		{
+			name:   "Empty_input",
+			groups: []GroupEntry{},
+			want:   []GroupEntry{},
+		},
+		{
+			name: "All_valid_groups",
+			groups: []GroupEntry{
+				{Name: "group1", GID: 1000, Passwd: "x", Users: []string{"user1"}},
+				{Name: "group2", GID: 1001, Passwd: "y", Users: []string{"user2"}},
+			},
+			want: []GroupEntry{
+				{Name: "group1", GID: 1000, Passwd: "x", Users: []string{"user1"}},
+				{Name: "group2", GID: 1001, Passwd: "y", Users: []string{"user2"}},
+			},
+		},
+		{
+			name: "Invalid_group_skipped",
+			groups: []GroupEntry{
+				{Name: "invalid,group", GID: 1000, Passwd: "x", Users: []string{"user1"}},
+				{Name: "group2", GID: 1001, Passwd: "y", Users: []string{"user2"}},
+			},
+			want: []GroupEntry{
+				{Name: "group2", GID: 1001, Passwd: "y", Users: []string{"user2"}},
+			},
+		},
+		{
+			name: "Duplicate_name_with_equal_content",
+			groups: []GroupEntry{
+				{Name: "group1", GID: 1000, Passwd: "x", Users: []string{"user1"}},
+				{Name: "group1", GID: 1000, Passwd: "x", Users: []string{"user1"}},
+			},
+			want: []GroupEntry{
+				{Name: "group1", GID: 1000, Passwd: "x", Users: []string{"user1"}},
+				{Name: "group1", GID: 1000, Passwd: "x", Users: []string{"user1"}},
+			},
+		},
+		{
+			name: "Duplicate_name_with_different_content",
+			groups: []GroupEntry{
+				{Name: "group1", GID: 1000, Passwd: "x", Users: []string{"user1"}},
+				{Name: "group1", GID: 1001, Passwd: "y", Users: []string{"user2"}},
+				{Name: "group2", GID: 1002, Passwd: "z", Users: []string{"user3"}},
+			},
+			want: []GroupEntry{
+				{Name: "group1", GID: 1000, Passwd: "x", Users: []string{"user1"}},
+				{Name: "group2", GID: 1002, Passwd: "z", Users: []string{"user3"}},
+			},
+		},
+		{
+			name: "Duplicate_GID",
+			groups: []GroupEntry{
+				{Name: "group1", GID: 1000, Passwd: "x", Users: []string{"user1"}},
+				{Name: "group2", GID: 1000, Passwd: "y", Users: []string{"user2"}},
+				{Name: "group3", GID: 1001, Passwd: "z", Users: []string{"user3"}},
+			},
+			want: []GroupEntry{
+				{Name: "group1", GID: 1000, Passwd: "x", Users: []string{"user1"}},
+				{Name: "group3", GID: 1001, Passwd: "z", Users: []string{"user3"}},
+			},
+		},
+		{
+			name: "Multiple_invalid_and_duplicates",
+			groups: []GroupEntry{
+				{Name: "invalid,group", GID: 1000, Passwd: "x", Users: []string{"user1"}},
+				{Name: "group1", GID: 1001, Passwd: "y", Users: []string{"user2"}},
+				{Name: "group1", GID: 1001, Passwd: "y", Users: []string{"user2"}},
+				{Name: "group2", GID: 1001, Passwd: "z", Users: []string{"user3"}},
+				{Name: "group3", GID: 1002, Passwd: "w", Users: []string{"user4"}},
+			},
+			want: []GroupEntry{
+				{Name: "group1", GID: 1001, Passwd: "y", Users: []string{"user2"}},
+				{Name: "group1", GID: 1001, Passwd: "y", Users: []string{"user2"}},
+				{Name: "group3", GID: 1002, Passwd: "w", Users: []string{"user4"}},
+			},
+		},
+		{
+			name: "Root_group_GID_0_valid",
+			groups: []GroupEntry{
+				{Name: "root", GID: 0, Passwd: "x"},
+				{Name: "group1", GID: 1000, Passwd: "y"},
+			},
+			want: []GroupEntry{
+				{Name: "root", GID: 0, Passwd: "x"},
+				{Name: "group1", GID: 1000, Passwd: "y"},
+			},
+		},
+		{
+			name: "Non_root_group_GID_0_invalid",
+			groups: []GroupEntry{
+				{Name: "group1", GID: 0, Passwd: "x"},
+				{Name: "group2", GID: 1001, Passwd: "y"},
+			},
+			want: []GroupEntry{
+				{Name: "group2", GID: 1001, Passwd: "y"},
+			},
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			got := GetValidGroupEntries(tc.groups)
+			require.Equal(t, tc.want, got, "GetValidGroupEntries output mismatch")
+		})
+	}
+}
diff --git a/internal/users/types/groupinfo.go b/internal/users/types/groupinfo.go
new file mode 100644
index 0000000000..0bf2bff8bc
--- /dev/null
+++ b/internal/users/types/groupinfo.go
@@ -0,0 +1,15 @@
+package types
+
+// Equals checks that two groups are equal.
+func (u GroupInfo) Equals(other GroupInfo) bool {
+	if u.Name != other.Name ||
+		u.UGID != other.UGID {
+		return false
+	}
+
+	if u.GID == nil || other.GID == nil {
+		return u.GID == other.GID
+	}
+
+	return *u.GID == *other.GID
+}
diff --git a/internal/users/types/groupinfo_test.go b/internal/users/types/groupinfo_test.go
new file mode 100644
index 0000000000..16f801fc39
--- /dev/null
+++ b/internal/users/types/groupinfo_test.go
@@ -0,0 +1,91 @@
+package types
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestGroupInfoEquals(t *testing.T) {
+	t.Parallel()
+
+	gid0 := uint32(0)
+	gid1 := uint32(1)
+	gid1Again := uint32(1)
+	gid2 := uint32(2)
+
+	tests := map[string]struct {
+		a    GroupInfo
+		b    GroupInfo
+		want bool
+	}{
+		"Empty groups": {
+			want: true,
+		},
+		"All_fields_equal_GID_non-nil_and_equal": {
+			a:    GroupInfo{Name: "group", UGID: "u1", GID: &gid1},
+			b:    GroupInfo{Name: "group", UGID: "u1", GID: &gid1},
+			want: true,
+		},
+		"Both_GID_nil": {
+			a:    GroupInfo{Name: "group", UGID: "u1", GID: nil},
+			b:    GroupInfo{Name: "group", UGID: "u1", GID: nil},
+			want: true,
+		},
+		"GID_pointers_different_but_values_equal": {
+			a:    GroupInfo{Name: "group", UGID: "u1", GID: &gid1},
+			b:    GroupInfo{Name: "group", UGID: "u1", GID: &gid1Again},
+			want: true,
+		},
+		"GID_is_zero_value": {
+			a:    GroupInfo{Name: "group", UGID: "u1", GID: &gid0},
+			b:    GroupInfo{Name: "group", UGID: "u1", GID: &gid0},
+			want: true,
+		},
+
+		// Failing cases.
+		"Fails_if_Empty_not_equals_other": {
+			a:    GroupInfo{Name: "group", UGID: "u1", GID: &gid1},
+			want: false,
+		},
+		"Fails_if_Name_differs": {
+			a:    GroupInfo{Name: "group1", UGID: "u1", GID: &gid1},
+			b:    GroupInfo{Name: "group2", UGID: "u1", GID: &gid1},
+			want: false,
+		},
+		"Fails_if_UGID_differs": {
+			a:    GroupInfo{Name: "group", UGID: "u1", GID: &gid1},
+			b:    GroupInfo{Name: "group", UGID: "u2", GID: &gid1},
+			want: false,
+		},
+		"Fails_if_GID_one_nil_one_non-nil_a_nil": {
+			a:    GroupInfo{Name: "group", UGID: "u1", GID: nil},
+			b:    GroupInfo{Name: "group", UGID: "u1", GID: &gid1},
+			want: false,
+		},
+		"Fails_if_GID_one_nil_one_non-nil_b_nil": {
+			a:    GroupInfo{Name: "group", UGID: "u1", GID: &gid1},
+			b:    GroupInfo{Name: "group", UGID: "u1", GID: nil},
+			want: false,
+		},
+		"Fails_if_GID_non-nil_values_differ": {
+			a:    GroupInfo{Name: "group", UGID: "u1", GID: &gid1},
+			b:    GroupInfo{Name: "group", UGID: "u1", GID: &gid2},
+			want: false,
+		},
+		"Fails_if_All_fields_differ": {
+			a:    GroupInfo{Name: "groupA", UGID: "uA", GID: &gid1},
+			b:    GroupInfo{Name: "groupB", UGID: "uB", GID: &gid2},
+			want: false,
+		},
+	}
+
+	for name, tc := range tests {
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			got := tc.a.Equals(tc.b)
+			require.Equal(t, tc.want, got)
+		})
+	}
+}
diff --git a/internal/users/types/userinfo.go b/internal/users/types/userinfo.go
new file mode 100644
index 0000000000..54e44136ef
--- /dev/null
+++ b/internal/users/types/userinfo.go
@@ -0,0 +1,13 @@
+package types
+
+import "github.com/canonical/authd/internal/sliceutils"
+
+// Equals checks that two users are equal.
+func (u UserInfo) Equals(other UserInfo) bool {
+	return u.Name == other.Name &&
+		u.UID == other.UID &&
+		u.Gecos == other.Gecos &&
+		u.Dir == other.Dir &&
+		u.Shell == other.Shell &&
+		sliceutils.EqualContentFunc(u.Groups, other.Groups, GroupInfo.Equals)
+}
diff --git a/internal/users/types/userinfo_test.go b/internal/users/types/userinfo_test.go
new file mode 100644
index 0000000000..2e1e2703b1
--- /dev/null
+++ b/internal/users/types/userinfo_test.go
@@ -0,0 +1,138 @@
+package types_test
+
+import (
+	"testing"
+
+	"github.com/canonical/authd/internal/users/types"
+	"github.com/stretchr/testify/require"
+)
+
+func ptrValue[T any](value T) *T {
+	return &value
+}
+
+func TestUserInfoEquals(t *testing.T) {
+	t.Parallel()
+
+	tests := map[string]struct {
+		u1, u2 types.UserInfo
+		want   bool
+	}{
+		"Equal_when_all_fields_and_groups_are_equal": {
+			u1: types.UserInfo{
+				Name:  "user1",
+				UID:   1000,
+				Gecos: "User1",
+				Dir:   "/home/user1",
+				Shell: "/bin/bash",
+				Groups: []types.GroupInfo{
+					{Name: "sudo", GID: ptrValue[uint32](27)},
+					{Name: "users", GID: ptrValue[uint32](100)},
+				},
+			},
+			u2: types.UserInfo{
+				Name:  "user1",
+				UID:   1000,
+				Gecos: "User1",
+				Dir:   "/home/user1",
+				Shell: "/bin/bash",
+				Groups: []types.GroupInfo{
+					{Name: "sudo", GID: ptrValue[uint32](27)},
+					{Name: "users", GID: ptrValue[uint32](100)},
+				},
+			},
+			want: true,
+		},
+		"Equal_when_both_have_no_groups": {
+			u1:   types.UserInfo{Name: "user1"},
+			u2:   types.UserInfo{Name: "user1"},
+			want: true,
+		},
+		"Equal_when_groups_are_equal_but_in_different_pointer_instances": {
+			u1: types.UserInfo{
+				Name:   "user1",
+				Groups: []types.GroupInfo{{Name: "sudo", GID: ptrValue[uint32](27)}},
+			},
+			u2: types.UserInfo{
+				Name:   "user1",
+				Groups: []types.GroupInfo{{Name: "sudo", GID: ptrValue[uint32](27)}},
+			},
+			want: true,
+		},
+		"Equal_when_groups_are_equal_but_in_different_order": {
+			u1: types.UserInfo{
+				Name: "user1",
+				Groups: []types.GroupInfo{
+					{Name: "group1", GID: ptrValue[uint32](1)},
+					{Name: "group2", GID: ptrValue[uint32](2)},
+				},
+			},
+			u2: types.UserInfo{
+				Name: "user1",
+				Groups: []types.GroupInfo{
+					{Name: "group2", GID: ptrValue[uint32](2)},
+					{Name: "group1", GID: ptrValue[uint32](1)},
+				},
+			},
+			want: true,
+		},
+
+		// Failing cases.
+		"Fails_if_names_differ": {
+			u1:   types.UserInfo{Name: "user1"},
+			u2:   types.UserInfo{Name: "user2"},
+			want: false,
+		},
+		"Fails_if_UIDs_differ": {
+			u1:   types.UserInfo{Name: "user1", UID: 1000},
+			u2:   types.UserInfo{Name: "user1", UID: 1001},
+			want: false,
+		},
+		"Fails_if_Gecos_differ": {
+			u1:   types.UserInfo{Name: "user1", Gecos: "User1"},
+			u2:   types.UserInfo{Name: "user1", Gecos: "User3"},
+			want: false,
+		},
+		"Fails_if_Dir_differ": {
+			u1:   types.UserInfo{Name: "user1", Dir: "/home/user1"},
+			u2:   types.UserInfo{Name: "user1", Dir: "/home/user2"},
+			want: false,
+		},
+		"Fails_if_Shell_differ": {
+			u1:   types.UserInfo{Name: "user1", Shell: "/bin/bash"},
+			u2:   types.UserInfo{Name: "user1", Shell: "/bin/zsh"},
+			want: false,
+		},
+		"Fails_if_Groups_differ_in_length": {
+			u1: types.UserInfo{
+				Name:   "user1",
+				Groups: []types.GroupInfo{{Name: "sudo", GID: ptrValue[uint32](27)}},
+			},
+			u2: types.UserInfo{
+				Name:   "user1",
+				Groups: []types.GroupInfo{},
+			},
+			want: false,
+		},
+		"Fails_if_Groups_differ_in_content": {
+			u1: types.UserInfo{
+				Name:   "user1",
+				Groups: []types.GroupInfo{{Name: "sudo", GID: ptrValue[uint32](27)}},
+			},
+			u2: types.UserInfo{
+				Name:   "user1",
+				Groups: []types.GroupInfo{{Name: "users", GID: ptrValue[uint32](100)}},
+			},
+			want: false,
+		},
+	}
+
+	for name, tc := range tests {
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			got := tc.u1.Equals(tc.u2)
+			require.Equal(t, tc.want, got, "Equals() returned unexpected result")
+		})
+	}
+}
diff --git a/log/handler.go b/log/handler.go
new file mode 100644
index 0000000000..aa91524cd9
--- /dev/null
+++ b/log/handler.go
@@ -0,0 +1,63 @@
+package log
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"log/slog"
+)
+
+// SimpleHandler writes logs in the format: <timestamp> <level> <message>.
+type SimpleHandler struct {
+	slog.TextHandler
+	w io.Writer
+}
+
+// NewSimpleHandler creates a new SimpleHandler that writes to the provided io.Writer.
+func NewSimpleHandler(w io.Writer, level slog.Level) slog.Handler {
+	opts := &slog.HandlerOptions{
+		Level: level,
+	}
+	return &SimpleHandler{
+		TextHandler: *slog.NewTextHandler(w, opts),
+		w:           w,
+	}
+}
+
+// Handle implements the slog.Handler interface.
+func (h *SimpleHandler) Handle(ctx context.Context, r slog.Record) error {
+	t := r.Time.Format("15:04:05")
+	_, err := fmt.Fprintf(h.w, "%s %s %s\n", t, r.Level.String(), r.Message)
+	return err
+}
+
+// Enabled checks if the handler is enabled for the given log level.
+func (h *SimpleHandler) Enabled(ctx context.Context, level slog.Level) bool {
+	return h.TextHandler.Enabled(ctx, level)
+}
+
+// WithAttrs returns a new SimpleHandler with the specified attributes.
+func (h *SimpleHandler) WithAttrs(attrs []slog.Attr) slog.Handler {
+	textHandler, ok := h.TextHandler.WithAttrs(attrs).(*slog.TextHandler)
+	if !ok {
+		panic("WithAttrs did not return a *slog.TextHandler")
+	}
+
+	return &SimpleHandler{
+		TextHandler: *textHandler,
+		w:           h.w,
+	}
+}
+
+// WithGroup returns a new SimpleHandler with the specified group name.
+func (h *SimpleHandler) WithGroup(name string) slog.Handler {
+	textHandler, ok := h.TextHandler.WithGroup(name).(*slog.TextHandler)
+	if !ok {
+		panic("WithGroup did not return a *slog.TextHandler")
+	}
+
+	return &SimpleHandler{
+		TextHandler: *textHandler,
+		w:           h.w,
+	}
+}
diff --git a/log/journal.go b/log/journal.go
index 2bf3913208..fd15c4769c 100644
--- a/log/journal.go
+++ b/log/journal.go
@@ -20,7 +20,7 @@ func InitJournalHandler(force bool) {
 	}
 
 	SetHandler(func(_ context.Context, level Level, format string, args ...interface{}) {
-		journal.Print(mapPriority(level), format, args...)
+		_ = journal.Print(mapPriority(level), format, args...)
 	})
 }
 
diff --git a/log/log.go b/log/log.go
index 15f720a3c1..5dac22be43 100644
--- a/log/log.go
+++ b/log/log.go
@@ -7,6 +7,7 @@ import (
 	"io"
 	"log/slog"
 	"maps"
+	"os"
 	"sync"
 	"sync/atomic"
 )
@@ -20,7 +21,7 @@ type (
 )
 
 var logLevelMu = sync.RWMutex{}
-var logLevel slog.Level
+var logLevel = NoticeLevel
 
 var hasCustomOutput atomic.Pointer[io.Writer]
 
@@ -64,6 +65,10 @@ var defaultHandlers = map[Level]Handler{
 var handlers = maps.Clone(defaultHandlers)
 var handlersMu = sync.RWMutex{}
 
+func init() {
+	SetOutput(os.Stderr)
+}
+
 // GetLevel gets the standard logger level.
 func GetLevel() Level {
 	logLevelMu.RLock()
@@ -96,9 +101,7 @@ func SetLevel(level Level) (oldLevel Level) {
 // SetOutput sets the log output.
 func SetOutput(out io.Writer) {
 	hasCustomOutput.Store(&out)
-	slog.SetDefault(slog.New(slog.NewTextHandler(out, &slog.HandlerOptions{
-		Level: GetLevel(),
-	})))
+	slog.SetDefault(slog.New(NewSimpleHandler(out, GetLevel())))
 }
 
 // SetLevelHandler allows to define the default handler function for a given level.
diff --git a/log/log_test.go b/log/log_test.go
index 5d19813106..fde8c6af52 100644
--- a/log/log_test.go
+++ b/log/log_test.go
@@ -5,8 +5,8 @@ import (
 	"fmt"
 	"testing"
 
+	"github.com/canonical/authd/log"
 	"github.com/stretchr/testify/require"
-	"github.com/ubuntu/authd/log"
 )
 
 var supportedLevels = []log.Level{
diff --git a/man/authctl.1 b/man/authctl.1
new file mode 100644
index 0000000000..718c5ff479
--- /dev/null
+++ b/man/authctl.1
@@ -0,0 +1,51 @@
+.\" Generated from authctl man page generator
+.\" Do not edit manually
+.nh
+.TH "AUTHCTL" "1" "2026-03-03" "authd"
+.SH NAME
+authctl \- Manage authd users and groups
+.SH SYNOPSIS
+\fBauthctl\fP [\fIoptions\fP] \fI<command>\fP [\fIargs\fP]
+.SH DESCRIPTION
+\fBauthctl\fP is a command-line tool for managing users and groups handled by authd.
+.SH COMMANDS
+.PP
+\fBuser\fP \fBlock\fP \fI<user>\fP
+.RS 4
+Lock a user so that they cannot log in.
+.RE
+.PP
+\fBuser\fP \fBunlock\fP \fI<user>\fP
+.RS 4
+Unlock a locked user so that they can log in again.
+.RE
+.PP
+\fBuser\fP \fBset-uid\fP \fI<user>\fP \fI<uid>\fP
+.RS 4
+Set the UID of a user managed by authd to the specified value.
+.sp
+The new UID must be unique and non-negative. The command must be run as root.
+.sp
+The ownership of the user's home directory, and any files within the directory that the user owns, will automatically be updated to the new UID.
+.sp
+Files outside the user's home directory are not updated and must be changed manually. Note that changing a UID can be unsafe if files on the system are still owned by the original UID: those files may become accessible to a different account that is later assigned that UID.
+.RE
+.PP
+\fBgroup\fP \fBset-gid\fP \fI<group>\fP \fI<gid>\fP
+.RS 4
+Set the GID of a group managed by authd to the specified value.
+.sp
+The new GID must be unique and non-negative. The command must be run as root.
+.sp
+When a group's GID is changed, any users whose primary group is set to this group will have the GID of their primary group updated. The home directories of these users, and any files within these directories that are owned by the group, will be updated to the new GID.
+.sp
+Files outside users' home directories are not updated and must be changed manually. Note that changing a GID can be unsafe if files on the system are still owned by the original GID: those files may become accessible to a different group that is later assigned that GID.
+.RE
+.SH SEE ALSO
+For more information, please refer to the \m[blue]\fBauthd documentation\fP\m[][1]\&.
+.SH NOTES
+.IP " 1." 4
+authd documentation
+.RS 4
+\%https://documentation.ubuntu.com/authd
+.RE
diff --git a/man/generate.go b/man/generate.go
new file mode 100644
index 0000000000..b84baf256f
--- /dev/null
+++ b/man/generate.go
@@ -0,0 +1,7 @@
+//go:build generate
+
+// TiCS: disabled // This is a helper file to generate the CLI documentation
+
+//go:generate sh -c "go run ../cmd/authctl/internal/docgen -format man -out authctl.1"
+
+package docs
diff --git a/nss/Cargo.toml b/nss/Cargo.toml
index 262c58c027..d86dd2903c 100644
--- a/nss/Cargo.toml
+++ b/nss/Cargo.toml
@@ -18,20 +18,22 @@ should_pre_check_env = []
 
 [dependencies]
 libnss = "0.9.0"
-libc = "0.2.171"
-tonic = "0.13.1"
-prost = "0.13.5"
-rustix = { version = "1.0.7", features = ["use-libc"] }
-tokio = { version = "1.45.0", features = ["macros", "rt-multi-thread"] }
+libc = "0.2.174"
+tonic-prost = "0.14.*"
+tonic = "0.14.*"
+prost = "0.14.*"
+rustix = { version = "1.0.8", features = ["use-libc"] }
+tokio = { version = "1.47.0", features = ["macros", "rt-multi-thread"] }
 tower = {  version = "0.4.13", features = ["util"] }
 log = "0.4.27"
 simple_logger = {version = "5.0.0", features = ["stderr"]}
 syslog = "7.0.0"
-ctor = "0.4.1"
+ctor = "0.5.0"
 procfs = "0.17.0"
-hyper-util = "0.1.11"
+hyper-util = "0.1.16"
+time = "0.3.41"
+once_cell = "1.21.3"
 
 [build-dependencies]
-# We need to pin tonic-build to 0.11.* for now until https://github.com/hyperium/tonic/issues/1909 is fixed.
-tonic-build = "0.13.*"
-cc = "1.2.21"
+tonic-prost-build = "0.14.*"
+cc = "1.2.34"
diff --git a/nss/build.rs b/nss/build.rs
index 927ae589ba..36fccf0350 100644
--- a/nss/build.rs
+++ b/nss/build.rs
@@ -1,8 +1,11 @@
 fn main() -> Result<(), Box<dyn std::error::Error>> {
-    tonic_build::configure()
+    tonic_prost_build::configure()
         .build_server(false)
         .protoc_arg("--experimental_allow_proto3_optional")
-        .compile_protos(&["../internal/proto/authd/authd.proto"], &["../"])?;
+        .compile_protos(
+            &["../internal/proto/authd/authd.proto"],
+            &["../internal/proto"],
+        )?;
 
     #[cfg(feature = "integration_tests")]
     cc::Build::new()
diff --git a/nss/integration-tests/helper_test.go b/nss/integration-tests/helper_test.go
index 010908d741..015ac8f90b 100644
--- a/nss/integration-tests/helper_test.go
+++ b/nss/integration-tests/helper_test.go
@@ -15,8 +15,8 @@ import (
 func getentOutputForLib(t *testing.T, libPath, socketPath string, rustCovEnv []string, shouldPreCheck bool, cmds ...string) (got string, exitCode int) {
 	t.Helper()
 
-	// #nosec:G204 - we control the command arguments in tests
 	cmds = append(cmds, "--service", "authd")
+	//nolint:gosec // G204 - test-only code; cmds are controlled test arguments.
 	cmd := exec.Command("getent", cmds...)
 	cmd.Env = append(cmd.Env,
 		"AUTHD_NSS_INFO=stderr",
@@ -35,8 +35,8 @@ func getentOutputForLib(t *testing.T, libPath, socketPath string, rustCovEnv []s
 	}
 
 	var out bytes.Buffer
-	cmd.Stdout = io.MultiWriter(os.Stdout, &out)
-	cmd.Stderr = os.Stderr
+	cmd.Stdout = io.MultiWriter(t.Output(), &out)
+	cmd.Stderr = t.Output()
 
 	// We are only interested in the output and the exit code of the command, so we can ignore the error.
 	_ = cmd.Run()
diff --git a/nss/integration-tests/integration_test.go b/nss/integration-tests/integration_test.go
index 79caf306bc..f8aad8904d 100644
--- a/nss/integration-tests/integration_test.go
+++ b/nss/integration-tests/integration_test.go
@@ -1,18 +1,15 @@
 package nss_test
 
 import (
-	"context"
 	"log"
 	"os"
 	"path/filepath"
 	"strings"
 	"testing"
 
+	"github.com/canonical/authd/internal/testutils"
+	"github.com/canonical/authd/internal/testutils/golden"
 	"github.com/stretchr/testify/require"
-	"github.com/ubuntu/authd/examplebroker"
-	"github.com/ubuntu/authd/internal/testutils"
-	"github.com/ubuntu/authd/internal/testutils/golden"
-	localgroupstestutils "github.com/ubuntu/authd/internal/users/localentries/testutils"
 )
 
 var daemonPath string
@@ -28,22 +25,15 @@ func TestIntegration(t *testing.T) {
 	// Create a default daemon to use for most test cases.
 	defaultSocket := filepath.Join(os.TempDir(), "nss-integration-tests.sock")
 	defaultDbState := "multiple_users_and_groups"
-	defaultOutputPath := filepath.Join(filepath.Dir(daemonPath), "gpasswd.output")
-	defaultGroupsFilePath := filepath.Join(testutils.TestFamilyPath(t), "gpasswd.group")
+	defaultGroupsFilePath := filepath.Join(filepath.Join("testdata", "empty.group"))
 
-	env := append(localgroupstestutils.AuthdIntegrationTestsEnvWithGpasswdMock(t, defaultOutputPath, defaultGroupsFilePath), "AUTHD_INTEGRATIONTESTS_CURRENT_USER_AS_ROOT=1")
-	ctx, cancel := context.WithCancel(context.Background())
-	_, stopped := testutils.RunDaemon(ctx, t, daemonPath,
+	testutils.StartAuthd(t, daemonPath,
 		testutils.WithSocketPath(defaultSocket),
 		testutils.WithPreviousDBState(defaultDbState),
-		testutils.WithEnvironment(env...),
+		testutils.WithGroupFile(defaultGroupsFilePath),
+		testutils.WithCurrentUserAsRoot,
 	)
 
-	t.Cleanup(func() {
-		cancel()
-		<-stopped
-	})
-
 	tests := map[string]struct {
 		getentDB string
 		key      string
@@ -59,16 +49,16 @@ func TestIntegration(t *testing.T) {
 		"Get_all_entries_from_group":  {getentDB: "group"},
 		"Get_all_entries_from_shadow": {getentDB: "shadow"},
 
-		"Get_entry_from_passwd_by_name":               {getentDB: "passwd", key: "user1"},
-		"Get_entry_from_passwd_by_name_in_upper_case": {getentDB: "passwd", key: "USER1"},
+		"Get_entry_from_passwd_by_name":               {getentDB: "passwd", key: "user1@example.com"},
+		"Get_entry_from_passwd_by_name_in_upper_case": {getentDB: "passwd", key: "USER1@EXAMPLE.COM"},
 		"Get_entry_from_group_by_name":                {getentDB: "group", key: "group1"},
-		"Get_entry_from_shadow_by_name":               {getentDB: "shadow", key: "user1"},
+		"Get_entry_from_shadow_by_name":               {getentDB: "shadow", key: "user1@example.com"},
 
 		"Get_entry_from_passwd_by_id": {getentDB: "passwd", key: "1111"},
 		"Get_entry_from_group_by_id":  {getentDB: "group", key: "11111"},
 
-		"Check_user_with_broker_if_not_found_in_db":               {getentDB: "passwd", key: examplebroker.UserIntegrationPreCheckPrefix + "simple", shouldPreCheck: true},
-		"Check_user_with_broker_if_not_found_in_db_in_upper_case": {getentDB: "passwd", key: strings.ToUpper(examplebroker.UserIntegrationPreCheckPrefix + "simple"), shouldPreCheck: true},
+		"Check_user_with_broker_if_not_found_in_db":               {getentDB: "passwd", key: "user-pre-check@example.com", shouldPreCheck: true},
+		"Check_user_with_broker_if_not_found_in_db_in_upper_case": {getentDB: "passwd", key: strings.ToUpper("user-pre-check@example.com"), shouldPreCheck: true},
 
 		// Even though those are "error" cases, the getent command won't fail when trying to list content of a service.
 		"Returns_empty_when_getting_all_entries_from_passwd_and_daemon_is_not_available": {getentDB: "passwd", noDaemon: true},
@@ -77,16 +67,16 @@ func TestIntegration(t *testing.T) {
 
 		/* Error cases */
 		"Error_when_getting_passwd_by_name_and_entry_does_not_exist":                        {getentDB: "passwd", key: "doesnotexit", wantStatus: codeNotFound},
-		"Error_when_getting_passwd_by_name_entry_exists_in_broker_but_precheck_is_disabled": {getentDB: "passwd", key: examplebroker.UserIntegrationPreCheckPrefix + "simple", wantStatus: codeNotFound},
+		"Error_when_getting_passwd_by_name_entry_exists_in_broker_but_precheck_is_disabled": {getentDB: "passwd", key: "user-pre-check@example.com", wantStatus: codeNotFound},
 		"Error_when_getting_group_by_name_and_entry_does_not_exist":                         {getentDB: "group", key: "doesnotexit", wantStatus: codeNotFound},
 		"Error_when_getting_shadow_by_name_and_entry_does_not_exist":                        {getentDB: "shadow", key: "doesnotexit", wantStatus: codeNotFound},
 
 		"Error_when_getting_passwd_by_id_and_entry_does_not_exist": {getentDB: "passwd", key: "404", wantStatus: codeNotFound},
 		"Error_when_getting_group_by_id_and_entry_does_not_exist":  {getentDB: "group", key: "404", wantStatus: codeNotFound},
 
-		"Error_when_getting_passwd_by_name_and_daemon_is_not_available": {getentDB: "passwd", key: "user1", noDaemon: true, wantStatus: codeNotFound},
+		"Error_when_getting_passwd_by_name_and_daemon_is_not_available": {getentDB: "passwd", key: "user1@example.com", noDaemon: true, wantStatus: codeNotFound},
 		"Error_when_getting_group_by_name_and_daemon_is_not_available":  {getentDB: "group", key: "group1", noDaemon: true, wantStatus: codeNotFound},
-		"Error_when_getting_shadow_by_name_and_daemon_is_not_available": {getentDB: "shadow", key: "user1", noDaemon: true, wantStatus: codeNotFound},
+		"Error_when_getting_shadow_by_name_and_daemon_is_not_available": {getentDB: "shadow", key: "user1@example.com", noDaemon: true, wantStatus: codeNotFound},
 
 		"Error_when_getting_passwd_by_id_and_daemon_is_not_available": {getentDB: "passwd", key: "1111", noDaemon: true, wantStatus: codeNotFound},
 		"Error_when_getting_group_by_id_and_daemon_is_not_available":  {getentDB: "group", key: "11111", noDaemon: true, wantStatus: codeNotFound},
@@ -109,26 +99,16 @@ func TestIntegration(t *testing.T) {
 
 			// We don't check compatibility of arguments, have noDaemon taking precedences to the others.
 			if tc.noDaemon {
-				socketPath = ""
+				socketPath = "/non-existent"
 				useAlternativeDaemon = false
 			}
 
 			if useAlternativeDaemon {
 				// Run a specific new daemon for special test cases.
-				outPath := filepath.Join(t.TempDir(), "gpasswd.output")
-				groupsFilePath := filepath.Join("testdata", "empty.group")
-
-				var daemonStopped chan struct{}
-				ctx, cancel := context.WithCancel(context.Background())
-				env := localgroupstestutils.AuthdIntegrationTestsEnvWithGpasswdMock(t, outPath, groupsFilePath)
-				socketPath, daemonStopped = testutils.RunDaemon(ctx, t, daemonPath,
+				socketPath = testutils.StartAuthd(t, daemonPath,
 					testutils.WithPreviousDBState(tc.dbState),
-					testutils.WithEnvironment(env...),
+					testutils.WithGroupFile(defaultGroupsFilePath),
 				)
-				t.Cleanup(func() {
-					cancel()
-					<-daemonStopped
-				})
 			}
 
 			cmds := []string{tc.getentDB}
@@ -172,23 +152,15 @@ func TestIntegration(t *testing.T) {
 	}
 }
 
-func TestMockgpasswd(t *testing.T) {
-	localgroupstestutils.Mockgpasswd(t)
-}
-
 func TestMain(m *testing.M) {
-	// Needed to skip the test setup when running the gpasswd mock.
-	if os.Getenv("GO_WANT_HELPER_PROCESS") != "" {
-		os.Exit(m.Run())
-	}
-
-	execPath, cleanup, err := testutils.BuildDaemon("-tags=withexamplebroker,integrationtests")
+	var cleanup func()
+	var err error
+	daemonPath, cleanup, err = testutils.BuildAuthdWithExampleBroker()
 	if err != nil {
 		log.Printf("Setup: failed to build daemon: %v", err)
 		os.Exit(1)
 	}
 	defer cleanup()
-	daemonPath = execPath
 
 	m.Run()
 }
diff --git a/nss/integration-tests/testdata/db/multiple_users_and_groups.db.yaml b/nss/integration-tests/testdata/db/multiple_users_and_groups.db.yaml
index 9c87ad47e4..0725fe8114 100644
--- a/nss/integration-tests/testdata/db/multiple_users_and_groups.db.yaml
+++ b/nss/integration-tests/testdata/db/multiple_users_and_groups.db.yaml
@@ -1,25 +1,25 @@
 users:
-    - name: user1
+    - name: user1@example.com
       uid: 1111
       gid: 11111
       gecos: |-
         User1 gecos
         On multiple lines
-      dir: /home/user1
+      dir: /home/user1@example.com
       shell: /bin/bash
       broker_id: broker-id
-    - name: user2
+    - name: user2@example.com
       uid: 2222
       gid: 22222
       gecos: User2
-      dir: /home/user2
+      dir: /home/user2@example.com
       shell: /bin/dash
       broker_id: broker-id
-    - name: user3
+    - name: user3@example.com
       uid: 3333
       gid: 33333
       gecos: User3
-      dir: /home/user3
+      dir: /home/user3@example.com
       shell: /bin/zsh
       broker_id: broker-id
 groups:
diff --git a/nss/integration-tests/testdata/golden/TestIntegration/Check_user_with_broker_if_not_found_in_db b/nss/integration-tests/testdata/golden/TestIntegration/Check_user_with_broker_if_not_found_in_db
index 135c61a113..180c76c76c 100644
--- a/nss/integration-tests/testdata/golden/TestIntegration/Check_user_with_broker_if_not_found_in_db
+++ b/nss/integration-tests/testdata/golden/TestIntegration/Check_user_with_broker_if_not_found_in_db
@@ -1 +1 @@
-user-integration-pre-check-simple:x:{{UID}}:{{GID}}:gecos for user-integration-pre-check-simple:/home/user-integration-pre-check-simple:/bin/sh
+user-pre-check@example.com:x:{{UID}}:{{GID}}:gecos for user-pre-check@example.com:/home/user-pre-check@example.com:/bin/sh
diff --git a/nss/integration-tests/testdata/golden/TestIntegration/Check_user_with_broker_if_not_found_in_db_in_upper_case b/nss/integration-tests/testdata/golden/TestIntegration/Check_user_with_broker_if_not_found_in_db_in_upper_case
index 135c61a113..180c76c76c 100644
--- a/nss/integration-tests/testdata/golden/TestIntegration/Check_user_with_broker_if_not_found_in_db_in_upper_case
+++ b/nss/integration-tests/testdata/golden/TestIntegration/Check_user_with_broker_if_not_found_in_db_in_upper_case
@@ -1 +1 @@
-user-integration-pre-check-simple:x:{{UID}}:{{GID}}:gecos for user-integration-pre-check-simple:/home/user-integration-pre-check-simple:/bin/sh
+user-pre-check@example.com:x:{{UID}}:{{GID}}:gecos for user-pre-check@example.com:/home/user-pre-check@example.com:/bin/sh
diff --git a/nss/integration-tests/testdata/golden/TestIntegration/Get_all_entries_from_group b/nss/integration-tests/testdata/golden/TestIntegration/Get_all_entries_from_group
index 467b699d90..982481f9f1 100644
--- a/nss/integration-tests/testdata/golden/TestIntegration/Get_all_entries_from_group
+++ b/nss/integration-tests/testdata/golden/TestIntegration/Get_all_entries_from_group
@@ -1,4 +1,4 @@
-group1::11111:user1
-group2::22222:user2
-group3::33333:user3
-commongroup::99999:user1,user2,user3
+group1::11111:user1@example.com
+group2::22222:user2@example.com
+group3::33333:user3@example.com
+commongroup::99999:user1@example.com,user2@example.com,user3@example.com
diff --git a/nss/integration-tests/testdata/golden/TestIntegration/Get_all_entries_from_passwd b/nss/integration-tests/testdata/golden/TestIntegration/Get_all_entries_from_passwd
index a7998a555b..fc4b93140c 100644
--- a/nss/integration-tests/testdata/golden/TestIntegration/Get_all_entries_from_passwd
+++ b/nss/integration-tests/testdata/golden/TestIntegration/Get_all_entries_from_passwd
@@ -1,3 +1,3 @@
-user1:x:1111:11111:User1 gecos On multiple lines:/home/user1:/bin/bash
-user2:x:2222:22222:User2:/home/user2:/bin/dash
-user3:x:3333:33333:User3:/home/user3:/bin/zsh
+user1@example.com:x:1111:11111:User1 gecos On multiple lines:/home/user1@example.com:/bin/bash
+user2@example.com:x:2222:22222:User2:/home/user2@example.com:/bin/dash
+user3@example.com:x:3333:33333:User3:/home/user3@example.com:/bin/zsh
diff --git a/nss/integration-tests/testdata/golden/TestIntegration/Get_all_entries_from_shadow b/nss/integration-tests/testdata/golden/TestIntegration/Get_all_entries_from_shadow
index ad70636a73..26ad55a31a 100644
--- a/nss/integration-tests/testdata/golden/TestIntegration/Get_all_entries_from_shadow
+++ b/nss/integration-tests/testdata/golden/TestIntegration/Get_all_entries_from_shadow
@@ -1,3 +1,3 @@
-user1:x:::::::
-user2:x:::::::
-user3:x:::::::
+user1@example.com:x:::::::
+user2@example.com:x:::::::
+user3@example.com:x:::::::
diff --git a/nss/integration-tests/testdata/golden/TestIntegration/Get_entry_from_group_by_id b/nss/integration-tests/testdata/golden/TestIntegration/Get_entry_from_group_by_id
index f7ab6edf89..22c559cd0a 100644
--- a/nss/integration-tests/testdata/golden/TestIntegration/Get_entry_from_group_by_id
+++ b/nss/integration-tests/testdata/golden/TestIntegration/Get_entry_from_group_by_id
@@ -1 +1 @@
-group1::11111:user1
+group1::11111:user1@example.com
diff --git a/nss/integration-tests/testdata/golden/TestIntegration/Get_entry_from_group_by_name b/nss/integration-tests/testdata/golden/TestIntegration/Get_entry_from_group_by_name
index f7ab6edf89..22c559cd0a 100644
--- a/nss/integration-tests/testdata/golden/TestIntegration/Get_entry_from_group_by_name
+++ b/nss/integration-tests/testdata/golden/TestIntegration/Get_entry_from_group_by_name
@@ -1 +1 @@
-group1::11111:user1
+group1::11111:user1@example.com
diff --git a/nss/integration-tests/testdata/golden/TestIntegration/Get_entry_from_passwd_by_id b/nss/integration-tests/testdata/golden/TestIntegration/Get_entry_from_passwd_by_id
index 1cbc07c2b9..81c734310c 100644
--- a/nss/integration-tests/testdata/golden/TestIntegration/Get_entry_from_passwd_by_id
+++ b/nss/integration-tests/testdata/golden/TestIntegration/Get_entry_from_passwd_by_id
@@ -1 +1 @@
-user1:x:1111:11111:User1 gecos On multiple lines:/home/user1:/bin/bash
+user1@example.com:x:1111:11111:User1 gecos On multiple lines:/home/user1@example.com:/bin/bash
diff --git a/nss/integration-tests/testdata/golden/TestIntegration/Get_entry_from_passwd_by_name b/nss/integration-tests/testdata/golden/TestIntegration/Get_entry_from_passwd_by_name
index 1cbc07c2b9..81c734310c 100644
--- a/nss/integration-tests/testdata/golden/TestIntegration/Get_entry_from_passwd_by_name
+++ b/nss/integration-tests/testdata/golden/TestIntegration/Get_entry_from_passwd_by_name
@@ -1 +1 @@
-user1:x:1111:11111:User1 gecos On multiple lines:/home/user1:/bin/bash
+user1@example.com:x:1111:11111:User1 gecos On multiple lines:/home/user1@example.com:/bin/bash
diff --git a/nss/integration-tests/testdata/golden/TestIntegration/Get_entry_from_passwd_by_name_in_upper_case b/nss/integration-tests/testdata/golden/TestIntegration/Get_entry_from_passwd_by_name_in_upper_case
index 1cbc07c2b9..81c734310c 100644
--- a/nss/integration-tests/testdata/golden/TestIntegration/Get_entry_from_passwd_by_name_in_upper_case
+++ b/nss/integration-tests/testdata/golden/TestIntegration/Get_entry_from_passwd_by_name_in_upper_case
@@ -1 +1 @@
-user1:x:1111:11111:User1 gecos On multiple lines:/home/user1:/bin/bash
+user1@example.com:x:1111:11111:User1 gecos On multiple lines:/home/user1@example.com:/bin/bash
diff --git a/nss/integration-tests/testdata/golden/TestIntegration/Get_entry_from_shadow_by_name b/nss/integration-tests/testdata/golden/TestIntegration/Get_entry_from_shadow_by_name
index 3b6dabfe01..bc2020afa8 100644
--- a/nss/integration-tests/testdata/golden/TestIntegration/Get_entry_from_shadow_by_name
+++ b/nss/integration-tests/testdata/golden/TestIntegration/Get_entry_from_shadow_by_name
@@ -1 +1 @@
-user1:x:::::::
+user1@example.com:x:::::::
diff --git a/nss/src/lib.rs b/nss/src/lib.rs
index ff9f89bdce..7de2a2ee4e 100644
--- a/nss/src/lib.rs
+++ b/nss/src/lib.rs
@@ -30,6 +30,8 @@ const CONNECTION_TIMEOUT: Duration = Duration::from_secs(5);
 #[cfg(feature = "integration_tests")]
 const REQUEST_TIMEOUT: Duration = Duration::from_secs(10);
 
+const DEFAULT_SOCKET_PATH: &str = "/run/authd.sock";
+
 /// socket_path returns the socket path to connect to the gRPC server.
 ///
 /// It uses the AUTHD_NSS_SOCKET env value if set and the custom_socket feature is enabled,
@@ -40,12 +42,11 @@ fn socket_path() -> String {
         Ok(s) => return s,
         Err(err) => {
             info!(
-                "AUTHD_NSS_SOCKET not set or badly configured, using default value: {}",
-                err
+                "AUTHD_NSS_SOCKET env variable not set, falling back to default socket path {DEFAULT_SOCKET_PATH}: {err}"
             );
         }
     }
-    "/run/authd.sock".to_string()
+    DEFAULT_SOCKET_PATH.to_string()
 }
 
 /// grpc_status_to_nss_response converts a gRPC status to a NSS response.
diff --git a/nss/src/logs/mod.rs b/nss/src/logs/mod.rs
index 4f66b8f1cc..2a228b6b8f 100644
--- a/nss/src/logs/mod.rs
+++ b/nss/src/logs/mod.rs
@@ -1,13 +1,15 @@
 use log::{LevelFilter, Metadata};
+use once_cell::sync::OnceCell;
 use simple_logger::SimpleLogger;
 use std::env;
 use syslog::{BasicLogger, Facility, Formatter3164};
 
+pub static LOG_PREFIX: OnceCell<&'static str> = OnceCell::new();
+
 #[macro_export]
 macro_rules! info {
     ($($arg:tt)*) => {
-        let log_prefix = "authd:";
-        log::info!("{} {}", log_prefix, format_args!($($arg)*));
+        log::info!("{}{}", $crate::logs::LOG_PREFIX.get().copied().unwrap_or(""), format_args!($($arg)*));
     }
 }
 
@@ -36,33 +38,48 @@ pub fn init_logger() {
 
 /// init_sys_logger initializes a global log that prints messages to the system logs.
 fn init_sys_logger(log_level: LevelFilter) {
+    // Derive the process name from current_exe(), fall back to a sensible default.
+    let process_name = std::env::current_exe()
+        .ok()
+        .and_then(|p| p.file_name().map(|s| s.to_string_lossy().into_owned()))
+        .filter(|s| !s.is_empty())
+        .unwrap_or_else(|| "nss-authd".to_string());
+
     let formatter = Formatter3164 {
         facility: Facility::LOG_USER,
         hostname: None,
-        process: "authd".into(),
-        pid: 0,
+        process: process_name,
+        pid: std::process::id(),
     };
 
-    let logger = match syslog::unix(formatter) {
-        Err(err) => {
-            println!("cannot connect to syslog: {err:?}");
-            return;
-        }
-        Ok(l) => l,
+    let logger = if let Ok(l) = syslog::unix(formatter) {
+        l
+    } else {
+        eprintln!("failed to create syslog logger");
+        return;
     };
 
-    if let Err(err) = log::set_boxed_logger(Box::new(BasicLogger::new(logger)))
-        .map(|()| log::set_max_level(log_level))
-    {
-        eprintln!("cannot set log level: {err:?}");
+    if let Err(err) = log::set_boxed_logger(Box::new(BasicLogger::new(logger))) {
+        eprintln!("failed to install global syslog logger: {err:?}");
         return;
-    };
+    }
+    log::set_max_level(log_level);
+
+    LOG_PREFIX.set("[nss-authd] ").unwrap();
 
     info!("Log output set to syslog");
 }
 
 /// init_stderr_logger initializes a global log that prints the messages to stderr.
 fn init_stderr_logger(log_level: LevelFilter) {
-    SimpleLogger::new().with_level(log_level).init().unwrap();
+    SimpleLogger::new()
+        .with_level(log_level)
+        .with_local_timestamps()
+        .with_timestamp_format(time::macros::format_description!(
+            "[hour]:[minute]:[second]"
+        ))
+        .init()
+        .unwrap();
+
     info!("Log output set to stderr");
 }
diff --git a/pam/Hacking.md b/pam/Hacking.md
index 3092bc5ce1..2ecd7fcc2c 100644
--- a/pam/Hacking.md
+++ b/pam/Hacking.md
@@ -12,7 +12,7 @@ it.
  2. When used in normal PAM transactions by any other PAM application we
     instead compile the module as an executable application that is launched
     by our [`go-exec`](./go-exec/module.c) PAM module implemented in C
-    and that does some DBus communication over a private bus with the actual
+    and that does some D-Bus communication over a private bus with the actual
     PAM application.
 
 
@@ -40,9 +40,9 @@ hanging when loaded by some applications (such as `sshd`).
 As mentioned in order to make our Go PAM implementation of the PAM module to be
 reliable, we relied on a simpler C module that only acts as a wrapper between
 the actual PAM APIs and a go program that is called and that communicates with
-the actual module using a DBus private connection (where the security of that
+the actual module using a D-Bus private connection (where the security of that
 is both grantee by the fact that it's almost impossible to predict its address,
-but also by native DBus credentials checks and on child PID verification).
+but also by native D-Bus credentials checks and on child PID verification).
 
 In order to build the module and its relative companion PAM program you can do:
 
diff --git a/pam/generate.sh b/pam/generate.sh
index 26674c30fe..0652ff7cac 100755
--- a/pam/generate.sh
+++ b/pam/generate.sh
@@ -18,7 +18,7 @@ else
     go generate -x -tags pam_module_generation
 fi
 
-# shellcheck disable=SC2086
+# shellcheck disable=SC2086,SC2046
 # we do want to do word splitting on flags
 ${CC:-cc} -o go-exec/"$exec_libname" \
     go-exec/module.c ${CFLAGS:--Wall} \
diff --git a/pam/go-exec/module.c b/pam/go-exec/module.c
index 9034c56b45..621d781671 100644
--- a/pam/go-exec/module.c
+++ b/pam/go-exec/module.c
@@ -1,26 +1,6 @@
 // TiCS: disabled // This file is compiled indirectly through go generate.
 
-/* A simple PAM wrapper for GO based pam modules
- *
- * Copyright (C) 2024 Canonical Ltd.
- *
- * SPDX-License-Identifier: LGPL-3.0
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public
- * License as published by the Free Software Foundation; either
- * version 3 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General
- * Public License along with this library; if not, see <http://www.gnu.org/licenses/>.
- *
- * Author: Marco Trevisan <marco.trevisan@canonical.com>
- */
+/* A simple PAM wrapper for Go based pam modules */
 
 #define G_LOG_DOMAIN "authd-pam-exec"
 
@@ -1157,7 +1137,13 @@ do_pam_action_thread (pam_handle_t *pamh,
     }
 
   for (int i = 0; env_variables && env_variables[i]; ++i)
-    g_ptr_array_add (envp, g_strdup (env_variables[i]));
+    {
+      if (strchr (env_variables[i], '='))
+        g_ptr_array_add (envp, g_strdup (env_variables[i]));
+      else
+        maybe_replicate_env (envp, env_variables[i]);
+    }
+
   g_ptr_array_add (envp, g_strdup_printf ("AUTHD_PAM_SERVER_ADDRESS=%s",
                                           g_dbus_server_get_client_address (server)));
   /* FIXME: use g_ptr_array_new_null_terminated when we can use newer GLib. */
@@ -1173,8 +1159,10 @@ do_pam_action_thread (pam_handle_t *pamh,
 
   if (is_debug_logging_enabled ())
     {
+      g_autofree char *exec_env = g_strjoinv ("\n  ", (char **) envp->pdata);
       g_autofree char *exec_str_args = g_strjoinv (" ", (char **) args->pdata);
 
+      g_debug ("Environment:%s%s", exec_env && *exec_env ? "\n  " : "", exec_env);
       g_debug ("Launching '%s'", exec_str_args);
     }
 
diff --git a/pam/integration-tests/cli_test.go b/pam/integration-tests/cli_test.go
index e925c83cf2..44689aaefc 100644
--- a/pam/integration-tests/cli_test.go
+++ b/pam/integration-tests/cli_test.go
@@ -9,14 +9,14 @@ import (
 	"testing"
 	"time"
 
+	"github.com/canonical/authd/examplebroker"
+	"github.com/canonical/authd/internal/proto/authd"
+	"github.com/canonical/authd/internal/testutils"
+	"github.com/canonical/authd/internal/testutils/golden"
+	localgroupstestutils "github.com/canonical/authd/internal/users/localentries/testutils"
+	"github.com/canonical/authd/pam/internal/pam_test"
 	"github.com/msteinert/pam/v2"
 	"github.com/stretchr/testify/require"
-	"github.com/ubuntu/authd/examplebroker"
-	"github.com/ubuntu/authd/internal/proto/authd"
-	"github.com/ubuntu/authd/internal/testutils"
-	"github.com/ubuntu/authd/internal/testutils/golden"
-	localgroupstestutils "github.com/ubuntu/authd/internal/users/localentries/testutils"
-	"github.com/ubuntu/authd/pam/internal/pam_test"
 )
 
 const cliTapeBaseCommand = "./pam_authd %s socket=${%s}"
@@ -24,6 +24,16 @@ const cliTapeBaseCommand = "./pam_authd %s socket=${%s}"
 func TestCLIAuthenticate(t *testing.T) {
 	t.Parallel()
 
+	if testing.Short() {
+		t.Skip("skipping test in short mode.")
+	}
+
+	// Due to external dependencies such as `vhs`, we can't run the tests in some environments (like LP builders), as we
+	// can't install the dependencies there. So we need to be able to skip these tests on-demand.
+	if os.Getenv("AUTHD_SKIP_EXTERNAL_DEPENDENT_TESTS") != "" {
+		t.Skip("Skipping tests with external dependencies as requested")
+	}
+
 	// This test is flaky, see https://github.com/canonical/authd/issues/1329
 	if os.Getenv("AUTHD_SKIP_FLAKY_TESTS") != "" {
 		t.Skip("skipping flaky test")
@@ -80,7 +90,7 @@ func TestCLIAuthenticate(t *testing.T) {
 		"Authenticate_user_successfully_with_password_only_supported_method": {
 			tape: "simple_auth",
 			tapeVariables: map[string]string{
-				vhsTapeUserVariable: examplebroker.UserIntegrationAuthModesPrefix + "password-integration-cli",
+				vhsTapeUserVariable: examplebroker.UserIntegrationAuthModesPrefix + "password-integration-cli@example.com",
 			},
 		},
 		"Authenticate_user_successfully_after_trying_empty_user": {
@@ -90,21 +100,21 @@ func TestCLIAuthenticate(t *testing.T) {
 			tape:  "simple_auth_with_auto_selected_broker",
 			oldDB: "authd_0.4.1_bbolt_with_mixed_case_users",
 			clientOptions: clientOptions{
-				PamUser: "user-integration-cached",
+				PamUser: "user-integration-cached@example.com",
 			},
 		},
 		"Authenticate_user_with_upper_case_using_lower_case_after_db_migration": {
 			tape:  "simple_auth_with_auto_selected_broker",
 			oldDB: "authd_0.4.1_bbolt_with_mixed_case_users",
 			clientOptions: clientOptions{
-				PamUser: "user-integration-upper-case",
+				PamUser: "user-integration-upper-case@example.com",
 			},
 		},
 		"Authenticate_user_with_mixed_case_after_db_migration": {
 			tape:  "simple_auth_with_auto_selected_broker",
 			oldDB: "authd_0.4.1_bbolt_with_mixed_case_users",
 			clientOptions: clientOptions{
-				PamUser: "user-integration-WITH-Mixed-CaSe",
+				PamUser: "user-integration-WITH-Mixed-CaSe@example.com",
 			},
 		},
 		"Authenticate_user_with_mfa": {
@@ -116,14 +126,14 @@ func TestCLIAuthenticate(t *testing.T) {
 		"Authenticate_user_with_qr_code": {
 			tape: "qr_code",
 			clientOptions: clientOptions{
-				PamUser: examplebroker.UserIntegrationPrefix + "qr-code",
+				PamUser: examplebroker.UserIntegrationPrefix + "qr-code@example.com",
 			},
 		},
 		"Authenticate_user_with_qr_code_in_a_TTY": {
 			tape:         "qr_code",
 			tapeSettings: []tapeSetting{{vhsHeight, 800}},
 			clientOptions: clientOptions{
-				PamUser: examplebroker.UserIntegrationPrefix + "qr-code-tty",
+				PamUser: examplebroker.UserIntegrationPrefix + "qr-code-tty@example.com",
 				Term:    "linux",
 			},
 		},
@@ -131,7 +141,7 @@ func TestCLIAuthenticate(t *testing.T) {
 			tape:         "qr_code",
 			tapeSettings: []tapeSetting{{vhsHeight, 800}},
 			clientOptions: clientOptions{
-				PamUser: examplebroker.UserIntegrationPrefix + "qr-code-tty-session",
+				PamUser: examplebroker.UserIntegrationPrefix + "qr-code-tty-session@example.com",
 				Term:    "xterm-256color", SessionType: "tty",
 			},
 		},
@@ -139,7 +149,7 @@ func TestCLIAuthenticate(t *testing.T) {
 			tape:         "qr_code",
 			tapeSettings: []tapeSetting{{vhsHeight, 800}},
 			clientOptions: clientOptions{
-				PamUser: examplebroker.UserIntegrationPrefix + "qr-code-screen",
+				PamUser: examplebroker.UserIntegrationPrefix + "qr-code-screen@example.com",
 				Term:    "screen",
 			},
 		},
@@ -203,7 +213,7 @@ func TestCLIAuthenticate(t *testing.T) {
 		"Prevent_user_from_switching_username": {
 			tape: "switch_preset_username",
 			clientOptions: clientOptions{
-				PamUser: examplebroker.UserIntegrationPrefix + "pam-preset",
+				PamUser: examplebroker.UserIntegrationPrefix + "pam-preset@example.com",
 			},
 		},
 
@@ -248,43 +258,52 @@ func TestCLIAuthenticate(t *testing.T) {
 				filepath.Join(outDir, "pam_authd"))
 			require.NoError(t, err, "Setup: symlinking the pam client")
 
-			var socketPath, gpasswdOutput, groupsFile, pidFile string
+			var socketPath, groupFileOutput, pidFile string
 			if tc.wantLocalGroups || tc.currentUserNotRoot || tc.stopDaemonAfter > 0 || tc.oldDB != "" {
 				// For the local groups tests we need to run authd again so that it has
-				// special environment that generates a fake gpasswd output for us to test.
+				// special environment that saves the updated group file to a writable
+				// location for us to test.
 				// Similarly for the not-root tests authd has to run in a more restricted way.
 				// In the other cases this is not needed, so we can just use a shared authd.
-				gpasswdOutput, groupsFile = prepareGPasswdFiles(t)
+				var groupFile string
+				groupFileOutput, groupFile = prepareGroupFiles(t)
+
+				if tc.wantLocalGroups || tc.oldDB != "" {
+					// We don't want to use separate input ant output files here.
+					groupFileOutput = groupFile
+				}
 
 				pidFile = filepath.Join(outDir, "authd.pid")
 
-				socketPath = runAuthd(t, gpasswdOutput, groupsFile, !tc.currentUserNotRoot,
+				args := []testutils.DaemonOption{
+					testutils.WithGroupFile(groupFile),
+					testutils.WithGroupFileOutput(groupFileOutput),
 					testutils.WithPidFile(pidFile),
-					testutils.WithEnvironment(useOldDatabaseEnv(t, tc.oldDB)...))
+					testutils.WithEnvironment(useOldDatabaseEnv(t, tc.oldDB)...),
+				}
+				if !tc.currentUserNotRoot {
+					args = append(args, testutils.WithCurrentUserAsRoot)
+				}
+
+				socketPath = runAuthd(t, args...)
 			} else {
-				socketPath, gpasswdOutput = sharedAuthd(t)
+				socketPath, groupFileOutput = sharedAuthd(t)
 			}
 			if tc.socketPath != "" {
 				socketPath = tc.socketPath
 			}
 
-			td := newTapeData(tc.tape, tc.tapeSettings...)
+			td := newTapeData(tc.tape, outDir, tc.tapeSettings...)
 			td.Command = tapeCommand
 			td.Variables = tc.tapeVariables
 			td.Env[vhsTapeSocketVariable] = socketPath
 			td.Env["AUTHD_TEST_PID_FILE"] = pidFile
 			td.AddClientOptions(t, tc.clientOptions)
-			td.RunVhs(t, vhsTestTypeCLI, outDir, cliEnv)
-			got := td.ExpectedOutput(t, outDir)
+			td.RunVHS(t, vhsTestTypeCLI, cliEnv)
+			got := td.SanitizedOutput(t)
 			golden.CheckOrUpdate(t, got)
 
-			if tc.wantLocalGroups || tc.oldDB != "" {
-				actualGroups, err := os.ReadFile(groupsFile)
-				require.NoError(t, err, "Failed to read the groups file")
-				golden.CheckOrUpdate(t, string(actualGroups), golden.WithSuffix(".groups"))
-			}
-
-			localgroupstestutils.RequireGPasswdOutput(t, gpasswdOutput, golden.Path(t)+".gpasswd_out")
+			localgroupstestutils.RequireGroupFile(t, groupFileOutput, golden.Path(t))
 
 			requireRunnerResultForUser(t, authd.SessionMode_LOGIN, tc.clientOptions.PamUser, got)
 		})
@@ -294,6 +313,16 @@ func TestCLIAuthenticate(t *testing.T) {
 func TestCLIChangeAuthTok(t *testing.T) {
 	t.Parallel()
 
+	if testing.Short() {
+		t.Skip("skipping test in short mode.")
+	}
+
+	// Due to external dependencies such as `vhs`, we can't run the tests in some environments (like LP builders), as we
+	// can't install the dependencies there. So we need to be able to skip these tests on-demand.
+	if os.Getenv("AUTHD_SKIP_EXTERNAL_DEPENDENT_TESTS") != "" {
+		t.Skip("Skipping tests with external dependencies as requested")
+	}
+
 	clientPath := t.TempDir()
 	cliEnv := preparePamRunnerTest(t, clientPath)
 
@@ -328,7 +357,7 @@ func TestCLIChangeAuthTok(t *testing.T) {
 		"Change_passwd_after_MFA_auth": {
 			tape: "passwd_mfa",
 			tapeVariables: map[string]string{
-				vhsTapeUserVariable: examplebroker.UserIntegrationMfaPrefix + "cli-passwd",
+				vhsTapeUserVariable: examplebroker.UserIntegrationMfaPrefix + "cli-passwd@example.com",
 			},
 		},
 
@@ -381,7 +410,7 @@ func TestCLIChangeAuthTok(t *testing.T) {
 			if tc.currentUserNotRoot {
 				// For the not-root tests authd has to run in a more restricted way.
 				// In the other cases this is not needed, so we can just use a shared authd.
-				socketPath = runAuthd(t, os.DevNull, os.DevNull, false)
+				socketPath = runAuthd(t, testutils.WithGroupFile(filepath.Join(t.TempDir(), "group")))
 			} else {
 				socketPath, _ = sharedAuthd(t)
 			}
@@ -393,13 +422,13 @@ func TestCLIChangeAuthTok(t *testing.T) {
 				tc.tapeVariables[vhsTapeUserVariable] = vhsTestUserName(t, "cli-passwd")
 			}
 
-			td := newTapeData(tc.tape, tc.tapeSettings...)
+			td := newTapeData(tc.tape, outDir, tc.tapeSettings...)
 			td.Command = tapeCommand
 			td.Variables = tc.tapeVariables
 			td.Env[vhsTapeSocketVariable] = socketPath
 			td.AddClientOptions(t, clientOptions{})
-			td.RunVhs(t, vhsTestTypeCLI, outDir, cliEnv)
-			got := td.ExpectedOutput(t, outDir)
+			td.RunVHS(t, vhsTestTypeCLI, cliEnv)
+			got := td.SanitizedOutput(t)
 			golden.CheckOrUpdate(t, got)
 
 			requireRunnerResult(t, authd.SessionMode_CHANGE_PASSWORD, got)
@@ -410,6 +439,10 @@ func TestCLIChangeAuthTok(t *testing.T) {
 func TestPamCLIRunStandalone(t *testing.T) {
 	t.Parallel()
 
+	if testing.Short() {
+		t.Skip("skipping test in short mode.")
+	}
+
 	clientPath := t.TempDir()
 	pamCleanup, err := buildPAMRunner(clientPath)
 	require.NoError(t, err, "Setup: Failed to build PAM executable")
@@ -440,10 +473,10 @@ func TestPamCLIRunStandalone(t *testing.T) {
 	outStr := string(out)
 	t.Log(outStr)
 
-	require.Contains(t, outStr, pam.ErrAuthinfoUnavail.Error())
-	require.Contains(t, outStr, pam.ErrIgnore.Error())
-}
-
-func TestMockgpasswd(t *testing.T) {
-	localgroupstestutils.Mockgpasswd(t)
+	if !strings.Contains(outStr, pam.ErrAuthinfoUnavail.Error()) {
+		t.Errorf("Expected output to contain %s", pam.ErrAuthinfoUnavail.Error())
+	}
+	if !strings.Contains(outStr, pam.ErrIgnore.Error()) {
+		t.Errorf("Expected output to contain %s", pam.ErrIgnore.Error())
+	}
 }
diff --git a/pam/integration-tests/cmd/exec-client/client.go b/pam/integration-tests/cmd/exec-client/client.go
index 062262deda..9a64fedf9f 100644
--- a/pam/integration-tests/cmd/exec-client/client.go
+++ b/pam/integration-tests/cmd/exec-client/client.go
@@ -15,11 +15,11 @@ import (
 	"regexp"
 	"strings"
 
+	"github.com/canonical/authd/log"
+	"github.com/canonical/authd/pam/internal/dbusmodule"
+	"github.com/canonical/authd/pam/internal/pam_test"
 	"github.com/godbus/dbus/v5"
 	"github.com/msteinert/pam/v2"
-	"github.com/ubuntu/authd/log"
-	"github.com/ubuntu/authd/pam/internal/dbusmodule"
-	"github.com/ubuntu/authd/pam/internal/pam_test"
 )
 
 var (
diff --git a/pam/integration-tests/cmd/exec-client/modulewrapper.go b/pam/integration-tests/cmd/exec-client/modulewrapper.go
index cfe54374a4..6ac77c426f 100644
--- a/pam/integration-tests/cmd/exec-client/modulewrapper.go
+++ b/pam/integration-tests/cmd/exec-client/modulewrapper.go
@@ -11,10 +11,10 @@ import (
 	"syscall"
 	"time"
 
+	"github.com/canonical/authd/log"
+	"github.com/canonical/authd/pam/internal/dbusmodule"
 	"github.com/godbus/dbus/v5"
 	"github.com/msteinert/pam/v2"
-	"github.com/ubuntu/authd/log"
-	"github.com/ubuntu/authd/pam/internal/dbusmodule"
 )
 
 type moduleWrapper struct {
diff --git a/pam/integration-tests/exec_test.go b/pam/integration-tests/exec_test.go
index d23d19fdc3..f6a334d278 100644
--- a/pam/integration-tests/exec_test.go
+++ b/pam/integration-tests/exec_test.go
@@ -7,15 +7,16 @@ import (
 	"os/exec"
 	"path/filepath"
 	"reflect"
+	"runtime"
 	"strings"
 	"syscall"
 	"testing"
 
+	"github.com/canonical/authd/internal/testutils"
+	"github.com/canonical/authd/pam/internal/pam_test"
 	"github.com/godbus/dbus/v5"
 	"github.com/msteinert/pam/v2"
 	"github.com/stretchr/testify/require"
-	"github.com/ubuntu/authd/internal/testutils"
-	"github.com/ubuntu/authd/pam/internal/pam_test"
 )
 
 var execModuleSources = []string{"./pam/go-exec/module.c"}
@@ -337,7 +338,7 @@ func TestExecModule(t *testing.T) {
 	}{
 		"Set_user": {
 			item:  pam.User,
-			value: ptrValue("an user"),
+			value: ptrValue("a user"),
 		},
 		"Returns_empty_when_getting_an_unset_user": {
 			item:      pam.User,
@@ -866,9 +867,16 @@ func getModuleArgs(t *testing.T, clientPath string, args []string) []string {
 	if env := testutils.CoverDirEnv(); env != "" {
 		moduleArgs = append(moduleArgs, "--exec-env", env)
 	}
+	if testutils.IsRace() {
+		moduleArgs = append(moduleArgs, "--exec-env", "GORACE")
+	}
+	if testutils.IsAsan() {
+		moduleArgs = append(moduleArgs, "--exec-env", "ASAN_OPTIONS")
+		moduleArgs = append(moduleArgs, "--exec-env", "LSAN_OPTIONS")
+	}
 
 	logFile := os.Stderr.Name()
-	if !testutils.IsVerbose() {
+	if !testing.Verbose() {
 		logFile = prepareFileLogging(t, "exec-module.log")
 	}
 	moduleArgs = append(moduleArgs, "--exec-log", logFile)
@@ -884,7 +892,7 @@ func getModuleArgs(t *testing.T, clientPath string, args []string) []string {
 			clientArgsPath := filepath.Join(t.TempDir(), "client-args-file")
 			require.NoError(t, os.WriteFile(clientArgsPath, []byte(strings.Join(args, "\t")), 0600),
 				"Setup: Creation of client args file failed")
-			saveArtifactsForDebugOnCleanup(t, []string{clientArgsPath})
+			testutils.MaybeSaveFilesAsArtifactsOnCleanup(t, clientArgsPath)
 			return append(moduleArgs, "-client-args-file", clientArgsPath)
 		}
 	}
@@ -922,13 +930,16 @@ func preparePamTransactionForServiceFile(t *testing.T, serviceFile string, user
 	var tx *pam.Transaction
 	var err error
 
+	runtime.LockOSThread()
+	t.Cleanup(runtime.UnlockOSThread)
+
 	// FIXME: pam.Transaction doesn't handle well pam.ConversationHandler(nil)
 	if conv != nil && !reflect.ValueOf(conv).IsNil() {
 		tx, err = pam.StartConfDir(filepath.Base(serviceFile), user, conv, filepath.Dir(serviceFile))
 	} else {
 		tx, err = pam.StartConfDir(filepath.Base(serviceFile), user, nil, filepath.Dir(serviceFile))
 	}
-	saveArtifactsForDebugOnCleanup(t, []string{serviceFile})
+	testutils.MaybeSaveFilesAsArtifactsOnCleanup(t, serviceFile)
 	require.NoError(t, err, "PAM: Error to initialize module")
 	require.NotNil(t, tx, "PAM: Transaction is not set")
 	t.Cleanup(func() { require.NoError(t, tx.End(), "PAM: can't end transaction") })
@@ -960,27 +971,17 @@ func buildExecModuleWithCFlags(t *testing.T, cFlags []string, forPreload bool) s
 
 	pkgConfigDeps := []string{"gio-2.0", "gio-unix-2.0"}
 	// t.Name() can be a subtest, so replace the directory slash to get a valid filename.
-	return buildCPAMModule(t, execModuleSources, pkgConfigDeps, cFlags,
-		"pam_authd_exec"+strings.ToLower(strings.ReplaceAll(t.Name(), "/", "_")),
+	return buildSharedModule(t, "Building PAM module", execModuleSources, pkgConfigDeps, cFlags,
+		[]string{"-lpam"}, "pam_authd_exec"+strings.ToLower(strings.ReplaceAll(t.Name(), "/", "_")),
 		forPreload)
 }
 
 func buildExecClient(t *testing.T) string {
 	t.Helper()
 
-	cmd := exec.Command("go", "build", "-C", "cmd/exec-client")
-	cmd.Dir = filepath.Join(testutils.CurrentDir())
-	if testutils.CoverDirForTests() != "" {
-		// -cover is a "positional flag", so it needs to come right after the "build" command.
-		cmd.Args = append(cmd.Args, "-cover")
-	}
-	if testutils.IsAsan() {
-		// -asan is a "positional flag", so it needs to come right after the "build" command.
-		cmd.Args = append(cmd.Args, "-asan")
-	}
-	if testutils.IsRace() {
-		cmd.Args = append(cmd.Args, "-race")
-	}
+	cmd := exec.Command("go", "build")
+	cmd.Dir = filepath.Join(testutils.CurrentDir(), "cmd/exec-client")
+	cmd.Args = append(cmd.Args, testutils.GoBuildFlags()...)
 	cmd.Args = append(cmd.Args, "-gcflags=all=-N -l")
 	cmd.Args = append(cmd.Args, "-tags=pam_tests_exec_client")
 	cmd.Env = append(os.Environ(), `CGO_CFLAGS=-O0 -g3`)
diff --git a/pam/integration-tests/gdm-module-handler_test.go b/pam/integration-tests/gdm-module-handler_test.go
index 31cd71f87b..eeabbb5d6f 100644
--- a/pam/integration-tests/gdm-module-handler_test.go
+++ b/pam/integration-tests/gdm-module-handler_test.go
@@ -8,13 +8,13 @@ import (
 	"slices"
 	"testing"
 
+	"github.com/canonical/authd/internal/proto/authd"
+	"github.com/canonical/authd/log"
+	"github.com/canonical/authd/pam/internal/gdm"
+	"github.com/canonical/authd/pam/internal/gdm_test"
+	"github.com/canonical/authd/pam/internal/proto"
 	"github.com/msteinert/pam/v2"
 	"github.com/stretchr/testify/require"
-	"github.com/ubuntu/authd/internal/proto/authd"
-	"github.com/ubuntu/authd/log"
-	"github.com/ubuntu/authd/pam/internal/gdm"
-	"github.com/ubuntu/authd/pam/internal/gdm_test"
-	"github.com/ubuntu/authd/pam/internal/proto"
 )
 
 type gdmTestModuleHandler struct {
diff --git a/pam/integration-tests/gdm_test.go b/pam/integration-tests/gdm_test.go
index 48bc7e0ed5..c70999c116 100644
--- a/pam/integration-tests/gdm_test.go
+++ b/pam/integration-tests/gdm_test.go
@@ -9,19 +9,19 @@ import (
 	"testing"
 	"time"
 
+	"github.com/canonical/authd/examplebroker"
+	"github.com/canonical/authd/internal/brokers"
+	"github.com/canonical/authd/internal/brokers/auth"
+	"github.com/canonical/authd/internal/brokers/layouts"
+	"github.com/canonical/authd/internal/brokers/layouts/entries"
+	"github.com/canonical/authd/internal/proto/authd"
+	"github.com/canonical/authd/internal/testutils"
+	"github.com/canonical/authd/pam/internal/gdm"
+	"github.com/canonical/authd/pam/internal/gdm_test"
+	"github.com/canonical/authd/pam/internal/pam_test"
+	"github.com/canonical/authd/pam/internal/proto"
 	"github.com/msteinert/pam/v2"
 	"github.com/stretchr/testify/require"
-	"github.com/ubuntu/authd/examplebroker"
-	"github.com/ubuntu/authd/internal/brokers"
-	"github.com/ubuntu/authd/internal/brokers/auth"
-	"github.com/ubuntu/authd/internal/brokers/layouts"
-	"github.com/ubuntu/authd/internal/brokers/layouts/entries"
-	"github.com/ubuntu/authd/internal/proto/authd"
-	"github.com/ubuntu/authd/internal/testutils"
-	"github.com/ubuntu/authd/pam/internal/gdm"
-	"github.com/ubuntu/authd/pam/internal/gdm_test"
-	"github.com/ubuntu/authd/pam/internal/pam_test"
-	"github.com/ubuntu/authd/pam/internal/proto"
 )
 
 func enableGdmExtension() {
@@ -129,6 +129,10 @@ var testPhoneAckUILayout = authd.UILayout{
 func TestGdmModule(t *testing.T) {
 	t.Parallel()
 
+	if testing.Short() {
+		t.Skip("skipping test in short mode.")
+	}
+
 	// This test is flaky, see https://github.com/canonical/authd/issues/966
 	if os.Getenv("AUTHD_SKIP_FLAKY_TESTS") != "" {
 		t.Skip("skipping flaky test")
@@ -202,7 +206,7 @@ func TestGdmModule(t *testing.T) {
 			},
 		},
 		"Authenticate_user_successfully_with_password_only_supported_method": {
-			pamUser: ptrValue(examplebroker.UserIntegrationAuthModesPrefix + "password-integration-gdm"),
+			pamUser: ptrValue(examplebroker.UserIntegrationAuthModesPrefix + "password-integration-gdm@example.com"),
 			eventPollResponses: map[gdm.EventType][]*gdm.EventData{
 				gdm.EventType_startAuthentication: {
 					gdm_test.IsAuthenticatedEvent(&authd.IARequest_AuthenticationData_Secret{
@@ -425,7 +429,6 @@ func TestGdmModule(t *testing.T) {
 				newPasswordAuthID,
 				newPasswordAuthID,
 				newPasswordAuthID,
-				newPasswordAuthID,
 			},
 			supportedLayouts: []*authd.UILayout{
 				pam_test.FormUILayout(pam_test.WithWait(true)),
@@ -449,10 +452,6 @@ func TestGdmModule(t *testing.T) {
 					gdm_test.IsAuthenticatedEvent(&authd.IARequest_AuthenticationData_Secret{
 						Secret: "noble2404",
 					}),
-					// Use previous one
-					gdm_test.IsAuthenticatedEvent(&authd.IARequest_AuthenticationData_Secret{
-						Secret: "goodpass",
-					}),
 					// Finally change the password
 					gdm_test.IsAuthenticatedEvent(&authd.IARequest_AuthenticationData_Secret{
 						Secret: "authd2404",
@@ -465,7 +464,6 @@ func TestGdmModule(t *testing.T) {
 				&testNewPasswordUILayout,
 				&testNewPasswordUILayout,
 				&testNewPasswordUILayout,
-				&testNewPasswordUILayout,
 			},
 			wantAuthResponses: []*authd.IAResponse{
 				{Access: auth.Next, Msg: "Password reset, 2 step(s) missing"},
@@ -478,10 +476,6 @@ func TestGdmModule(t *testing.T) {
 					Access: auth.Retry,
 					Msg:    "new password does not match criteria: must be 'authd2404'",
 				},
-				{
-					Access: auth.Retry,
-					Msg:    "The password is the same as the old one",
-				},
 				{Access: auth.Granted},
 			},
 		},
@@ -493,7 +487,6 @@ func TestGdmModule(t *testing.T) {
 				newPasswordAuthID,
 				newPasswordAuthID,
 				newPasswordAuthID,
-				newPasswordAuthID,
 			},
 			supportedLayouts: []*authd.UILayout{
 				pam_test.FormUILayout(pam_test.WithWait(true)),
@@ -507,9 +500,6 @@ func TestGdmModule(t *testing.T) {
 					gdm_test.IsAuthenticatedEvent(&authd.IARequest_AuthenticationData_Secret{
 						Secret: "authd",
 					}),
-					gdm_test.IsAuthenticatedEvent(&authd.IARequest_AuthenticationData_Secret{
-						Secret: "goodpass",
-					}),
 					gdm_test.IsAuthenticatedEvent(&authd.IARequest_AuthenticationData_Secret{
 						Secret: "password",
 					}),
@@ -531,10 +521,6 @@ func TestGdmModule(t *testing.T) {
 					Access: auth.Retry,
 					Msg:    "The password is shorter than 8 characters",
 				},
-				{
-					Access: auth.Retry,
-					Msg:    "The password is the same as the old one",
-				},
 				{
 					Access: auth.Retry,
 					Msg:    "The password fails the dictionary check - it is based on a dictionary word",
@@ -811,7 +797,7 @@ func TestGdmModule(t *testing.T) {
 				},
 			},
 			wantPamErrorMessages: []string{
-				"can't select broker: error InvalidArgument from server: can't start authentication transaction: rpc error: code = InvalidArgument desc = no user name provided",
+				"error InvalidArgument from server: no user name provided",
 			},
 			wantError:       pam.ErrSystem,
 			wantAcctMgmtErr: pam_test.ErrIgnore,
@@ -962,7 +948,7 @@ func TestGdmModule(t *testing.T) {
 			moduleArgs = append(moduleArgs, tc.moduleArgs...)
 
 			serviceFile := createServiceFile(t, "gdm-authd", libPath, moduleArgs)
-			saveArtifactsForDebugOnCleanup(t, []string{serviceFile})
+			testutils.MaybeSaveFilesAsArtifactsOnCleanup(t, serviceFile)
 
 			pamUser := vhsTestUserName(t, "gdm")
 			if tc.pamUserPrefix != "" {
@@ -1019,7 +1005,7 @@ func TestGdmModule(t *testing.T) {
 			}
 
 			var pamFlags pam.Flags
-			if !testutils.IsVerbose() {
+			if !testing.Verbose() {
 				pamFlags = pam.Silent
 			}
 
@@ -1071,6 +1057,10 @@ func TestGdmModule(t *testing.T) {
 }
 
 func TestGdmModuleAuthenticateWithoutGdmExtension(t *testing.T) {
+	if testing.Short() {
+		t.Skip("skipping test in short mode.")
+	}
+
 	// This cannot be parallel!
 	t.Cleanup(pam_test.MaybeDoLeakCheck)
 
@@ -1084,7 +1074,7 @@ func TestGdmModuleAuthenticateWithoutGdmExtension(t *testing.T) {
 	moduleArgs = append(moduleArgs, "debug=true", "logfile="+gdmLog)
 
 	serviceFile := createServiceFile(t, "gdm-authd", libPath, moduleArgs)
-	saveArtifactsForDebugOnCleanup(t, []string{serviceFile})
+	testutils.MaybeSaveFilesAsArtifactsOnCleanup(t, serviceFile)
 	pamUser := vhsTestUserName(t, "gdm")
 	gh := newGdmTestModuleHandler(t, serviceFile, pamUser)
 	t.Cleanup(func() { require.NoError(t, gh.tx.End(), "PAM: can't end transaction") })
@@ -1095,7 +1085,7 @@ func TestGdmModuleAuthenticateWithoutGdmExtension(t *testing.T) {
 	t.Cleanup(enableGdmExtension)
 
 	var pamFlags pam.Flags
-	if !testutils.IsVerbose() {
+	if !testing.Verbose() {
 		pamFlags = pam.Silent
 	}
 
@@ -1105,6 +1095,10 @@ func TestGdmModuleAuthenticateWithoutGdmExtension(t *testing.T) {
 }
 
 func TestGdmModuleAcctMgmtWithoutGdmExtension(t *testing.T) {
+	if testing.Short() {
+		t.Skip("skipping test in short mode.")
+	}
+
 	// This cannot be parallel!
 	t.Cleanup(pam_test.MaybeDoLeakCheck)
 
@@ -1118,7 +1112,7 @@ func TestGdmModuleAcctMgmtWithoutGdmExtension(t *testing.T) {
 	moduleArgs = append(moduleArgs, "debug=true", "logfile="+gdmLog)
 
 	serviceFile := createServiceFile(t, "gdm-authd", libPath, moduleArgs)
-	saveArtifactsForDebugOnCleanup(t, []string{serviceFile})
+	testutils.MaybeSaveFilesAsArtifactsOnCleanup(t, serviceFile)
 	pamUser := vhsTestUserName(t, "gdm")
 	gh := newGdmTestModuleHandler(t, serviceFile, pamUser)
 	t.Cleanup(func() { require.NoError(t, gh.tx.End(), "PAM: can't end transaction") })
@@ -1136,7 +1130,7 @@ func TestGdmModuleAcctMgmtWithoutGdmExtension(t *testing.T) {
 	}
 
 	var pamFlags pam.Flags
-	if !testutils.IsVerbose() {
+	if !testing.Verbose() {
 		pamFlags = pam.Silent
 	}
 
diff --git a/pam/integration-tests/helpers_test.go b/pam/integration-tests/helpers_test.go
index eedc58da69..3b32c5adc1 100644
--- a/pam/integration-tests/helpers_test.go
+++ b/pam/integration-tests/helpers_test.go
@@ -2,10 +2,10 @@ package main_test
 
 import (
 	"context"
+	"encoding/json"
 	"errors"
 	"fmt"
 	"io/fs"
-	"math"
 	"os"
 	"os/exec"
 	"path/filepath"
@@ -16,89 +16,73 @@ import (
 	"testing"
 	"time"
 
+	"github.com/canonical/authd/internal/consts"
+	"github.com/canonical/authd/internal/fileutils"
+	"github.com/canonical/authd/internal/grpcutils"
+	"github.com/canonical/authd/internal/proto/authd"
+	"github.com/canonical/authd/internal/services/errmessages"
+	"github.com/canonical/authd/internal/testlog"
+	"github.com/canonical/authd/internal/testutils"
+	"github.com/canonical/authd/internal/users/db/bbolt"
+	"github.com/canonical/authd/pam/internal/pam_test"
 	"github.com/stretchr/testify/require"
-	"github.com/ubuntu/authd/internal/consts"
-	"github.com/ubuntu/authd/internal/fileutils"
-	"github.com/ubuntu/authd/internal/grpcutils"
-	"github.com/ubuntu/authd/internal/proto/authd"
-	"github.com/ubuntu/authd/internal/services/errmessages"
-	"github.com/ubuntu/authd/internal/testutils"
-	"github.com/ubuntu/authd/internal/testutils/golden"
-	"github.com/ubuntu/authd/internal/users/db/bbolt"
-	localgroupstestutils "github.com/ubuntu/authd/internal/users/localentries/testutils"
-	"github.com/ubuntu/authd/pam/internal/pam_test"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/credentials/insecure"
 	"gorbe.io/go/osrelease"
 )
 
-var (
-	authdTestSessionTime     = time.Now()
-	authdArtifactsDir        string
-	authdArtifactsAlwaysSave bool
-	authdArtifactsDirSync    sync.Once
-)
-
 type authdInstance struct {
-	mu                sync.Mutex
-	refCount          uint64
-	socketPath        string
-	gPasswdOutputPath string
-	groupsFile        string
-	cleanup           func()
+	mu               sync.Mutex
+	refCount         uint64
+	socketPath       string
+	groupsOutputPath string
+	groupsFile       string
+	cleanup          func()
 }
 
 var (
 	sharedAuthdInstance = authdInstance{}
 )
 
-func runAuthdForTesting(t *testing.T, gpasswdOutput, groupsFile string, currentUserAsRoot bool, isSharedDaemon bool, args ...testutils.DaemonOption) (
-	socketPath string, waitFunc func()) {
+func runAuthdForTesting(t *testing.T, isSharedDaemon bool, args ...testutils.DaemonOption) (socketPath string) {
 	t.Helper()
 
-	ctx, cancel := context.WithCancel(context.Background())
+	socketPath, cancelFunc := runAuthdForTestingWithCancel(t, isSharedDaemon, args...)
+	t.Cleanup(cancelFunc)
+	return socketPath
+}
 
-	env := localgroupstestutils.AuthdIntegrationTestsEnvWithGpasswdMock(t, gpasswdOutput, groupsFile)
-	if currentUserAsRoot {
-		env = append(env, authdCurrentUserRootEnvVariableContent)
-	}
-	args = append(args, testutils.WithEnvironment(env...))
+func runAuthdForTestingWithCancel(t *testing.T, isSharedDaemon bool, args ...testutils.DaemonOption) (socketPath string, cancelFunc func()) {
+	t.Helper()
 
-	outputFile := filepath.Join(t.TempDir(), "authd.log")
-	args = append(args, testutils.WithOutputFile(outputFile))
+	defaultArgs := []testutils.DaemonOption{testutils.WithOutputAsTestArtifact()}
 
 	homeBaseDir := filepath.Join(t.TempDir(), "homes")
 	err := os.MkdirAll(homeBaseDir, 0700)
 	require.NoError(t, err, "Setup: Creating home base dir %q", homeBaseDir)
-	args = append(args, testutils.WithHomeBaseDir(homeBaseDir))
+	defaultArgs = append(defaultArgs, testutils.WithHomeBaseDir(homeBaseDir))
 
 	if !isSharedDaemon {
 		database := filepath.Join(t.TempDir(), "db", consts.DefaultDatabaseFileName)
-		args = append(args, testutils.WithDBPath(filepath.Dir(database)))
-		saveArtifactsForDebugOnCleanup(t, []string{database})
+		defaultArgs = append(defaultArgs, testutils.WithDBPath(filepath.Dir(database)))
+		testutils.MaybeSaveFilesAsArtifactsOnCleanup(t, database)
 	}
-	if isSharedDaemon && authdArtifactsAlwaysSave {
-		database := filepath.Join(authdArtifactsDir, "db", consts.DefaultDatabaseFileName)
-		args = append(args, testutils.WithDBPath(filepath.Dir(database)))
+	if isSharedDaemon && os.Getenv("AUTHD_TESTS_ARTIFACTS_ALWAYS_SAVE") != "" {
+		database := filepath.Join(testutils.ArtifactsDir(t), "db", consts.DefaultDatabaseFileName)
+		defaultArgs = append(defaultArgs, testutils.WithDBPath(filepath.Dir(database)))
 	}
 
-	socketPath, stopped := testutils.RunDaemon(ctx, t, daemonPath, args...)
-	saveArtifactsForDebugOnCleanup(t, []string{outputFile})
-	return socketPath, func() {
-		cancel()
-		<-stopped
-	}
+	socketPath, cancelFunc = testutils.StartAuthdWithCancel(t, daemonPath, append(defaultArgs, args...)...)
+	return socketPath, cancelFunc
 }
 
-func runAuthd(t *testing.T, gpasswdOutput, groupsFile string, currentUserAsRoot bool, args ...testutils.DaemonOption) string {
+func runAuthd(t *testing.T, args ...testutils.DaemonOption) string {
 	t.Helper()
 
-	socketPath, waitFunc := runAuthdForTesting(t, gpasswdOutput, groupsFile, currentUserAsRoot, false, args...)
-	t.Cleanup(waitFunc)
-	return socketPath
+	return runAuthdForTesting(t, false, args...)
 }
 
-func sharedAuthd(t *testing.T, args ...testutils.DaemonOption) (socketPath string, gpasswdFile string) {
+func sharedAuthd(t *testing.T, args ...testutils.DaemonOption) (socketPath string, groupFile string) {
 	t.Helper()
 
 	useSharedInstance := testutils.IsRace()
@@ -107,11 +91,15 @@ func sharedAuthd(t *testing.T, args ...testutils.DaemonOption) (socketPath strin
 	}
 
 	if !useSharedInstance {
-		gPasswd := filepath.Join(t.TempDir(), "gpasswd.output")
-		groups := filepath.Join(testutils.TestFamilyPath(t), "gpasswd.group")
-		socket, cleanup := runAuthdForTesting(t, gPasswd, groups, true, useSharedInstance, args...)
-		t.Cleanup(cleanup)
-		return socket, gPasswd
+		groupOutput := filepath.Join(t.TempDir(), "groups")
+		groups := filepath.Join(testutils.TestFamilyPath(t), "groups")
+		args = append(args,
+			testutils.WithGroupFile(groups),
+			testutils.WithGroupFileOutput(groupOutput),
+			testutils.WithCurrentUserAsRoot,
+		)
+		socket := runAuthdForTesting(t, useSharedInstance, args...)
+		return socket, groupOutput
 	}
 
 	sa := &sharedAuthdInstance
@@ -120,8 +108,8 @@ func sharedAuthd(t *testing.T, args ...testutils.DaemonOption) (socketPath strin
 		defer sharedAuthdInstance.mu.Unlock()
 
 		sa.refCount--
-		if testutils.IsVerbose() {
-			t.Logf("Authd shared instances decreased: %v", sa.refCount)
+		if testing.Verbose() {
+			t.Logf("Teardown: authd shared instances decreased: %v", sa.refCount)
 		}
 		if sa.refCount != 0 {
 			return
@@ -129,7 +117,7 @@ func sharedAuthd(t *testing.T, args ...testutils.DaemonOption) (socketPath strin
 		require.NotNil(t, sa.cleanup)
 		cleanup := sa.cleanup
 		sa.socketPath = ""
-		sa.gPasswdOutputPath = ""
+		sa.groupsOutputPath = ""
 		sa.groupsFile = ""
 		sa.cleanup = nil
 		cleanup()
@@ -139,30 +127,28 @@ func sharedAuthd(t *testing.T, args ...testutils.DaemonOption) (socketPath strin
 	defer sharedAuthdInstance.mu.Unlock()
 
 	sa.refCount++
-	if testutils.IsVerbose() {
-		t.Logf("Authd shared instances increased: %v", sa.refCount)
+	if testing.Verbose() {
+		t.Logf("authd shared instances increased: %v", sa.refCount)
 	}
 	if sa.refCount != 1 {
-		return sa.socketPath, sa.gPasswdOutputPath
+		return sa.socketPath, sa.groupsOutputPath
 	}
 
-	args = append(slices.Clone(args), testutils.WithSharedDaemon(true))
-	sa.gPasswdOutputPath = filepath.Join(t.TempDir(), "gpasswd.output")
-	sa.groupsFile = filepath.Join(testutils.TestFamilyPath(t), "gpasswd.group")
-	sa.socketPath, sa.cleanup = runAuthdForTesting(t, sa.gPasswdOutputPath,
-		sa.groupsFile, true, useSharedInstance, args...)
-	return sa.socketPath, sa.gPasswdOutputPath
+	sa.groupsFile = filepath.Join(testutils.TestFamilyPath(t), "groups")
+	sa.groupsOutputPath = filepath.Join(t.TempDir(), "groups")
+	args = append(slices.Clone(args),
+		testutils.WithSharedDaemon(true),
+		testutils.WithCurrentUserAsRoot,
+		testutils.WithGroupFile(sa.groupsFile),
+		testutils.WithGroupFileOutput(sa.groupsOutputPath),
+	)
+	sa.socketPath, sa.cleanup = runAuthdForTestingWithCancel(t, useSharedInstance, args...)
+	return sa.socketPath, sa.groupsOutputPath
 }
 
 func preparePamRunnerTest(t *testing.T, clientPath string) []string {
 	t.Helper()
 
-	// Due to external dependencies such as `vhs`, we can't run the tests in some environments (like LP builders), as we
-	// can't install the dependencies there. So we need to be able to skip these tests on-demand.
-	if os.Getenv("AUTHD_SKIP_EXTERNAL_DEPENDENT_TESTS") != "" {
-		t.Skip("Skipping tests with external dependencies as requested")
-	}
-
 	pamCleanup, err := buildPAMRunner(clientPath)
 	require.NoError(t, err, "Setup: Failed to build PAM executable")
 	t.Cleanup(pamCleanup)
@@ -177,17 +163,7 @@ func preparePamRunnerTest(t *testing.T, clientPath string) []string {
 func buildPAMRunner(execPath string) (cleanup func(), err error) {
 	cmd := exec.Command("go", "build")
 	cmd.Dir = testutils.ProjectRoot()
-	if testutils.CoverDirForTests() != "" {
-		// -cover is a "positional flag", so it needs to come right after the "build" command.
-		cmd.Args = append(cmd.Args, "-cover")
-	}
-	if testutils.IsAsan() {
-		// -asan is a "positional flag", so it needs to come right after the "build" command.
-		cmd.Args = append(cmd.Args, "-asan")
-	}
-	if testutils.IsRace() {
-		cmd.Args = append(cmd.Args, "-race")
-	}
+	cmd.Args = append(cmd.Args, testutils.GoBuildFlags()...)
 	cmd.Args = append(cmd.Args, "-gcflags=all=-N -l")
 	cmd.Args = append(cmd.Args, "-tags=withpamrunner", "-o", filepath.Join(execPath, "pam_authd"),
 		"./pam/tools/pam-runner")
@@ -201,30 +177,18 @@ func buildPAMRunner(execPath string) (cleanup func(), err error) {
 func buildPAMExecChild(t *testing.T) string {
 	t.Helper()
 
-	cmd := exec.Command("go", "build", "-C", "pam")
-	cmd.Dir = testutils.ProjectRoot()
-	if testutils.CoverDirForTests() != "" {
-		// -cover is a "positional flag", so it needs to come right after the "build" command.
-		cmd.Args = append(cmd.Args, "-cover")
-	}
-	if testutils.IsAsan() {
-		// -asan is a "positional flag", so it needs to come right after the "build" command.
-		cmd.Args = append(cmd.Args, "-asan")
-	}
-	if testutils.IsRace() {
-		cmd.Args = append(cmd.Args, "-race")
-	}
+	cmd := exec.Command("go", "build")
+	cmd.Dir = filepath.Join(testutils.ProjectRoot(), "pam")
+	cmd.Args = append(cmd.Args, testutils.GoBuildFlags()...)
 	cmd.Args = append(cmd.Args, "-gcflags=all=-N -l")
 	cmd.Args = append(cmd.Args, "-tags=pam_debug")
-	cmd.Env = append(os.Environ(), `CGO_CFLAGS=-O0 -g3`)
+	cmd.Env = append(goEnv(t), testutils.MinimalPathEnv, "CGO_CFLAGS=-O0 -g3")
 
 	authdPam := filepath.Join(t.TempDir(), "authd-pam")
-	t.Logf("Compiling Exec child at %s", authdPam)
-	t.Log(strings.Join(cmd.Args, " "))
 
 	cmd.Args = append(cmd.Args, "-o", authdPam)
-	out, err := cmd.CombinedOutput()
-	require.NoError(t, err, "Setup: could not compile PAM exec child: %s", out)
+	err := testlog.RunWithTiming(t, "Building PAM exec child", cmd)
+	require.NoError(t, err, "Setup: Failed to build PAM exec child")
 
 	return authdPam
 }
@@ -233,7 +197,7 @@ func prepareFileLogging(t *testing.T, fileName string) string {
 	t.Helper()
 
 	cliLog := filepath.Join(t.TempDir(), fileName)
-	saveArtifactsForDebugOnCleanup(t, []string{cliLog})
+	testutils.MaybeSaveFilesAsArtifactsOnCleanup(t, cliLog)
 	t.Cleanup(func() {
 		out, err := os.ReadFile(cliLog)
 		if errors.Is(err, fs.ErrNotExist) {
@@ -269,104 +233,71 @@ func requirePreviousBrokerForUser(t *testing.T, socketPath string, brokerName st
 	require.Equal(t, prevBroker.PreviousBroker, prevBrokerID)
 }
 
-func artifactsPath(t *testing.T) string {
-	t.Helper()
-
-	authdArtifactsDirSync.Do(func() {
-		defer func() { t.Logf("Saving test artifacts at %s", authdArtifactsDir) }()
-
-		authdArtifactsAlwaysSave = os.Getenv("AUTHD_TESTS_ARTIFACTS_ALWAYS_SAVE") != ""
-
-		// We need to copy the artifacts to another directory, since the test directory will be cleaned up.
-		authdArtifactsDir = os.Getenv("AUTHD_TESTS_ARTIFACTS_PATH")
-		if authdArtifactsDir != "" {
-			if err := os.MkdirAll(authdArtifactsDir, 0750); err != nil && !os.IsExist(err) {
-				require.NoError(t, err, "TearDown: could not create artifacts directory %q", authdArtifactsDir)
-			}
-			return
-		}
-
-		st := authdTestSessionTime
-		folderName := fmt.Sprintf("authd-test-artifacts-%d-%02d-%02dT%02d:%02d:%02d.%d-",
-			st.Year(), st.Month(), st.Day(), st.Hour(), st.Minute(), st.Second(),
-			st.UnixMilli())
-
-		var err error
-		authdArtifactsDir, err = os.MkdirTemp(os.TempDir(), folderName)
-		require.NoError(t, err, "TearDown: could not create artifacts directory %q", authdArtifactsDir)
-	})
-
-	return authdArtifactsDir
+func sleepDuration(in time.Duration) time.Duration {
+	return testutils.MultipliedSleepDuration(in)
 }
 
-// saveArtifactsForDebug saves the specified artifacts to a temporary directory if the test failed.
-func saveArtifactsForDebug(t *testing.T, artifacts []string) {
+// pathEnvWithGoBin returns the value of the GOPATH defined in go env prepended to PATH.
+func pathEnvWithGoBin(t *testing.T) string {
 	t.Helper()
-	if !t.Failed() && !authdArtifactsAlwaysSave {
-		return
-	}
 
-	tmpDir := filepath.Join(artifactsPath(t), golden.Path(t))
-	err := os.MkdirAll(tmpDir, 0750)
-	require.NoError(t, err, "TearDown: could not create temporary directory %q for artifacts", tmpDir)
+	pathEnv := testutils.MinimalPathEnv
 
-	// Copy the artifacts to the temporary directory.
-	for _, artifact := range artifacts {
-		content, err := os.ReadFile(artifact)
-		if err != nil {
-			t.Logf("Could not read artifact %q: %v", artifact, err)
-			continue
-		}
-		if err := os.WriteFile(filepath.Join(tmpDir, filepath.Base(artifact)), content, 0600); err != nil {
-			t.Logf("Could not write artifact %q: %v", artifact, err)
-		}
-	}
-}
+	cmd := exec.Command("go", "env", "GOPATH")
+	out, err := cmd.CombinedOutput()
+	require.NoError(t, err, "Could not get GOPATH: %v: %s", err, out)
 
-func saveArtifactsForDebugOnCleanup(t *testing.T, artifacts []string) {
-	t.Helper()
-	t.Cleanup(func() { saveArtifactsForDebug(t, artifacts) })
-}
+	goPath := strings.TrimSpace(string(out))
 
-func sleepDuration(in time.Duration) time.Duration {
-	return time.Duration(math.Round(float64(in) * testutils.SleepMultiplier()))
+	if goPath == "" {
+		return pathEnv
+	}
+
+	goBinPath := filepath.Join(goPath, "bin")
+	return fmt.Sprintf("PATH=%s:%s", goBinPath, strings.TrimPrefix(pathEnv, "PATH="))
 }
 
-// prependBinToPath returns the value of the GOPATH defined in go env prepended to PATH.
-func prependBinToPath(t *testing.T) string {
+func goEnv(t *testing.T) []string {
 	t.Helper()
 
-	cmd := exec.Command("go", "env", "GOPATH")
+	cmd := exec.Command("go", "env", "-json")
 	out, err := cmd.CombinedOutput()
-	require.NoError(t, err, "Could not get GOPATH: %v: %s", err, out)
+	require.NoError(t, err, "Could not get go env: %v: %s", err, out)
+
+	var env map[string]string
+	err = json.Unmarshal(out, &env)
+	require.NoError(t, err, "Could not unmarshal go env: %v: %s", err, out)
 
-	env := os.Getenv("PATH")
-	return "PATH=" + strings.Join([]string{filepath.Join(strings.TrimSpace(string(out)), "bin"), env}, ":")
+	var envSlice []string
+	for k, v := range env {
+		envSlice = append(envSlice, fmt.Sprintf("%s=%s", k, v))
+	}
+	return envSlice
 }
 
-func prepareGPasswdFiles(t *testing.T) (string, string) {
+func prepareGroupFiles(t *testing.T) (string, string) {
 	t.Helper()
 
 	cwd, err := os.Getwd()
 	require.NoError(t, err, "Cannot get current working directory")
 
-	const groupFileName = "gpasswd.group"
-	gpasswdOutput := filepath.Join(t.TempDir(), "gpasswd.output")
+	const groupFileName = "groups"
+	groupOutputFile := filepath.Join(t.TempDir(), "groups")
 	groupsFile := filepath.Join(cwd, "testdata", t.Name(), groupFileName)
 
 	if ok, _ := fileutils.FileExists(groupsFile); !ok {
 		groupsFile = filepath.Join(cwd, testutils.TestFamilyPath(t), groupFileName)
 	}
 
-	// Do a copy of the original group file, since it may be migrated by authd.
+	// Do a copy of the original group file, since it may be changed by authd.
 	tmpCopy := filepath.Join(t.TempDir(), filepath.Base(groupsFile))
 	err = fileutils.CopyFile(groupsFile, tmpCopy)
 	require.NoError(t, err, "Cannot copy the group file %q", groupsFile)
 	groupsFile = tmpCopy
 
-	saveArtifactsForDebugOnCleanup(t, []string{gpasswdOutput, groupsFile})
+	testutils.MaybeSaveFilesAsArtifactsOnCleanup(t, groupOutputFile, groupsFile)
 
-	return gpasswdOutput, groupsFile
+	return groupOutputFile, groupsFile
 }
 
 func getUbuntuVersion(t *testing.T) int {
@@ -452,7 +383,7 @@ func requireNoAuthdUser(t *testing.T, client authd.UserServiceClient, user strin
 
 	_, err := client.GetUserByName(context.Background(),
 		&authd.GetUserByNameRequest{Name: user, ShouldPreCheck: false})
-	require.Error(t, err, "User %q is not expected to exist")
+	require.Error(t, err, "User %q is not expected to exist", user)
 }
 
 func requireAuthdGroup(t *testing.T, client authd.UserServiceClient, gid uint32) *authd.Group {
@@ -484,7 +415,7 @@ func getEntOutput(t *testing.T, nssLibrary, authdSocket, db, key string) string
 	cmd.Env = nssTestEnv(t, nssLibrary, authdSocket)
 
 	out, err := cmd.Output()
-	require.NoError(t, err, "getent %s should not fail for key %q\n%s", db, key)
+	require.NoError(t, err, "getent %s should not fail for key %q\n%s", db, key, out)
 
 	o := strings.TrimSpace(string(out))
 	t.Log(strings.Join(cmd.Args, " "), "returned:", o)
diff --git a/pam/integration-tests/integration_test.go b/pam/integration-tests/integration_test.go
index c4c85078b3..3237ba5493 100644
--- a/pam/integration-tests/integration_test.go
+++ b/pam/integration-tests/integration_test.go
@@ -5,26 +5,20 @@ import (
 	"os"
 	"testing"
 
-	"github.com/ubuntu/authd/internal/testutils"
+	"github.com/canonical/authd/internal/testutils"
 )
 
-const authdCurrentUserRootEnvVariableContent = "AUTHD_INTEGRATIONTESTS_CURRENT_USER_AS_ROOT=1"
-
 var daemonPath string
 
 func TestMain(m *testing.M) {
-	// Needed to skip the test setup when running the gpasswd mock.
-	if os.Getenv("GO_WANT_HELPER_PROCESS") != "" {
-		os.Exit(m.Run())
-	}
-
-	execPath, daemonCleanup, err := testutils.BuildDaemon("-tags=withexamplebroker,integrationtests")
+	var cleanup func()
+	var err error
+	daemonPath, cleanup, err = testutils.BuildAuthdWithExampleBroker()
 	if err != nil {
-		log.Printf("Setup: Failed to build authd daemon: %v", err)
+		log.Printf("Setup: failed to build daemon: %v", err)
 		os.Exit(1)
 	}
-	defer daemonCleanup()
-	daemonPath = execPath
+	defer cleanup()
 
 	m.Run()
 }
diff --git a/pam/integration-tests/modulehelpers_test.go b/pam/integration-tests/modulehelpers_test.go
index 57b8d691df..e28cd0d6f7 100644
--- a/pam/integration-tests/modulehelpers_test.go
+++ b/pam/integration-tests/modulehelpers_test.go
@@ -7,20 +7,22 @@ import (
 	"strings"
 	"testing"
 
+	"github.com/canonical/authd/internal/testlog"
+	"github.com/canonical/authd/internal/testutils"
+	"github.com/canonical/authd/pam/internal/pam_test"
 	"github.com/stretchr/testify/require"
-	"github.com/ubuntu/authd/internal/testutils"
-	"github.com/ubuntu/authd/pam/internal/pam_test"
 )
 
 func getPkgConfigFlags(t *testing.T, args []string) []string {
 	t.Helper()
 
+	//nolint:gosec // G204 - test-only code; args are controlled test arguments for pkg-config.
 	out, err := exec.Command("pkg-config", args...).CombinedOutput()
 	require.NoError(t, err, "Can't run pkg-config: %s", out)
 	return strings.Split(strings.TrimSpace(string(out)), " ")
 }
 
-func buildCModule(t *testing.T, sources []string, pkgConfigDeps []string, cFlags []string, ldFlags []string, soname string, forPreload bool) string {
+func buildSharedModule(t *testing.T, logMsg string, sources []string, pkgConfigDeps []string, cFlags []string, ldFlags []string, soname string, forPreload bool) string {
 	t.Helper()
 
 	compiler := os.Getenv("CC")
@@ -35,7 +37,6 @@ func buildCModule(t *testing.T, sources []string, pkgConfigDeps []string, cFlags
 
 	require.NoError(t, os.MkdirAll(filepath.Dir(libPath), 0700),
 		"Setup: Can't create loader build path")
-	t.Logf("Compiling C Module library at %s", libPath)
 	cmd.Args = append(cmd.Args, "-o", libPath)
 	cmd.Args = append(cmd.Args, sources...)
 	cmd.Args = append(cmd.Args,
@@ -58,7 +59,7 @@ func buildCModule(t *testing.T, sources []string, pkgConfigDeps []string, cFlags
 	// if testutils.IsRace() {
 	// 	cmd.Args = append(cmd.Args, "-fsanitize=thread")
 	// }
-	if cflags := os.Getenv("CFLAGS"); cflags != "" && os.Getenv("DEB_BUILD_ARCH") == "" {
+	if cflags := os.Getenv("CFLAGS"); cflags != "" && !testutils.IsDebianPackageBuild() {
 		cmd.Args = append(cmd.Args, strings.Split(cflags, " ")...)
 	}
 
@@ -76,7 +77,7 @@ func buildCModule(t *testing.T, sources []string, pkgConfigDeps []string, cFlags
 	}
 	cmd.Args = append(cmd.Args, ldFlags...)
 
-	if ldflags := os.Getenv("LDFLAGS"); ldflags != "" && os.Getenv("DEB_BUILD_ARCH") == "" {
+	if ldflags := os.Getenv("LDFLAGS"); ldflags != "" && !testutils.IsDebianPackageBuild() {
 		cmd.Args = append(cmd.Args, strings.Split(ldflags, " ")...)
 	}
 
@@ -93,18 +94,15 @@ func buildCModule(t *testing.T, sources []string, pkgConfigDeps []string, cFlags
 		require.NoError(t, err, "TearDown: Impossible to create path %q", gcovDir)
 
 		t.Cleanup(func() {
-			t.Log("Running gcov...")
 			gcov := exec.Command("gcov")
 			gcov.Args = append(gcov.Args,
 				"-pb", "-o", libDir,
 				notesFilename)
 			gcov.Dir = gcovDir
-			out, err := gcov.CombinedOutput()
+			err := testlog.RunWithTiming(t, "Running gcov", gcov,
+				testlog.OnlyPrintStdoutAndStderrOnError())
 			require.NoError(t, err,
-				"Teardown: Can't get coverage report on C library: %s", out)
-			if string(out) != "" {
-				t.Log(string(out))
-			}
+				"Teardown: Can't get coverage report on C library")
 
 			// Also keep track of notes and data files as they're useful to generate
 			// an html output locally using geninfo + genhtml.
@@ -119,21 +117,12 @@ func buildCModule(t *testing.T, sources []string, pkgConfigDeps []string, cFlags
 		})
 	}
 
-	t.Logf("Running compiler command: %s %s", cmd.Path, strings.Join(cmd.Args[1:], " "))
-	out, err := cmd.CombinedOutput()
-	require.NoError(t, err, "Setup: could not compile C module %s: %s", soname, out)
-	if string(out) != "" {
-		t.Log(string(out))
-	}
+	err := testlog.RunWithTiming(t, logMsg, cmd)
+	require.NoError(t, err, "Setup: Failed to build PAM module")
 
 	return libPath
 }
 
-func buildCPAMModule(t *testing.T, sources []string, pkgConfigDeps []string, cFlags []string, soname string, forPreload bool) string {
-	t.Helper()
-	return buildCModule(t, sources, pkgConfigDeps, cFlags, []string{"-lpam"}, soname, forPreload)
-}
-
 type actionArgsMap = map[pam_test.Action][]string
 
 func createServiceFile(t *testing.T, name string, libPath string, args []string) string {
diff --git a/pam/integration-tests/native_test.go b/pam/integration-tests/native_test.go
index 3bdd4837f0..7b7ce12085 100644
--- a/pam/integration-tests/native_test.go
+++ b/pam/integration-tests/native_test.go
@@ -7,13 +7,13 @@ import (
 	"strings"
 	"testing"
 
+	"github.com/canonical/authd/examplebroker"
+	"github.com/canonical/authd/internal/proto/authd"
+	"github.com/canonical/authd/internal/testutils"
+	"github.com/canonical/authd/internal/testutils/golden"
+	localgroupstestutils "github.com/canonical/authd/internal/users/localentries/testutils"
+	"github.com/canonical/authd/pam/internal/pam_test"
 	"github.com/stretchr/testify/require"
-	"github.com/ubuntu/authd/examplebroker"
-	"github.com/ubuntu/authd/internal/proto/authd"
-	"github.com/ubuntu/authd/internal/testutils"
-	"github.com/ubuntu/authd/internal/testutils/golden"
-	localgroupstestutils "github.com/ubuntu/authd/internal/users/localentries/testutils"
-	"github.com/ubuntu/authd/pam/internal/pam_test"
 )
 
 const nativeTapeBaseCommand = "./pam_authd %s socket=${%s} force_native_client=true"
@@ -21,9 +21,14 @@ const nativeTapeBaseCommand = "./pam_authd %s socket=${%s} force_native_client=t
 func TestNativeAuthenticate(t *testing.T) {
 	t.Parallel()
 
-	// This test is flaky, see https://github.com/canonical/authd/issues/966
-	if os.Getenv("AUTHD_SKIP_FLAKY_TESTS") != "" {
-		t.Skip("skipping flaky test")
+	if testing.Short() {
+		t.Skip("skipping test in short mode.")
+	}
+
+	// Due to external dependencies such as `vhs`, we can't run the tests in some environments (like LP builders), as we
+	// can't install the dependencies there. So we need to be able to skip these tests on-demand.
+	if os.Getenv("AUTHD_SKIP_EXTERNAL_DEPENDENT_TESTS") != "" {
+		t.Skip("Skipping tests with external dependencies as requested")
 	}
 
 	clientPath := t.TempDir()
@@ -40,7 +45,6 @@ func TestNativeAuthenticate(t *testing.T) {
 		clientOptions      clientOptions
 		currentUserNotRoot bool
 		userSelection      bool
-		userSuffixSkip     bool
 		oldDB              string
 		wantLocalGroups    bool
 		wantSeparateDaemon bool
@@ -53,34 +57,34 @@ func TestNativeAuthenticate(t *testing.T) {
 		"Authenticate_user_successfully_with_upper_case": {
 			tape: "simple_auth",
 			clientOptions: clientOptions{
-				PamUser: strings.ToUpper(vhsTestUserName(t, "upper-case")),
+				PamUser: strings.ToUpper(vhsTestUserName(t, "upper-case-native")),
 			},
 		},
 		"Authenticate_user_successfully_with_user_selection": {
 			tape:          "simple_auth_with_user_selection",
 			userSelection: true,
 			tapeVariables: map[string]string{
-				vhsTapeUserVariable: examplebroker.UserIntegrationPrefix + "native-user-selection",
+				vhsTapeUserVariable: examplebroker.UserIntegrationPrefix + "native-user-selection@example.com",
 			},
 		},
 		"Authenticate_user_successfully_using_upper_case_with_user_selection": {
 			tape:          "simple_auth_with_user_selection",
 			userSelection: true,
 			tapeVariables: map[string]string{
-				vhsTapeUserVariable: strings.ToUpper(vhsTestUserName(t, "selection-upper-case")),
+				vhsTapeUserVariable: strings.ToUpper(vhsTestUserName(t, "selection-upper-case-native")),
 			},
 		},
 		"Authenticate_user_successfully_with_invalid_connection_timeout": {
 			tape: "simple_auth",
 			clientOptions: clientOptions{
-				PamUser:    "user-integration-simple-auth-invalid-timeout",
+				PamUser:    "user-integration-simple-auth-invalid-timeout-native@example.com",
 				PamTimeout: "invalid",
 			},
 		},
 		"Authenticate_user_successfully_with_password_only_supported_method": {
 			tape: "simple_auth",
 			clientOptions: clientOptions{
-				PamUser: examplebroker.UserIntegrationAuthModesPrefix + "password-integration-native",
+				PamUser: examplebroker.UserIntegrationAuthModesPrefix + "password-integration-native@example.com",
 			},
 		},
 		"Authenticate_user_successfully_with_password_only_supported_method_in_polkit": {
@@ -88,38 +92,35 @@ func TestNativeAuthenticate(t *testing.T) {
 			clientOptions: clientOptions{
 				PamServiceName: "polkit-1",
 				PamUser: vhsTestUserNameFull(t,
-					examplebroker.UserIntegrationAuthModesPrefix, "password-integration-polkit"),
+					examplebroker.UserIntegrationAuthModesPrefix, "password-integration-polkit-native@example.com"),
 			},
 		},
 		"Authenticate_user_successfully_after_db_migration": {
-			tape:           "simple_auth_with_auto_selected_broker",
-			oldDB:          "authd_0.4.1_bbolt_with_mixed_case_users",
-			userSuffixSkip: true,
+			tape:  "simple_auth_with_auto_selected_broker",
+			oldDB: "authd_0.4.1_bbolt_with_mixed_case_users",
 			clientOptions: clientOptions{
-				PamUser: "user-integration-cached",
+				PamUser: "user-integration-cached@example.com",
 			},
 		},
 		"Authenticate_user_with_upper_case_using_lower_case_after_db_migration": {
-			tape:           "simple_auth_with_auto_selected_broker",
-			oldDB:          "authd_0.4.1_bbolt_with_mixed_case_users",
-			userSuffixSkip: true,
+			tape:  "simple_auth_with_auto_selected_broker",
+			oldDB: "authd_0.4.1_bbolt_with_mixed_case_users",
 			clientOptions: clientOptions{
-				PamUser: "user-integration-upper-case",
+				PamUser: "user-integration-upper-case@example.com",
 			},
 		},
 		"Authenticate_user_with_mixed_case_after_db_migration": {
-			tape:           "simple_auth_with_auto_selected_broker",
-			oldDB:          "authd_0.4.1_bbolt_with_mixed_case_users",
-			userSuffixSkip: true,
+			tape:  "simple_auth_with_auto_selected_broker",
+			oldDB: "authd_0.4.1_bbolt_with_mixed_case_users",
 			clientOptions: clientOptions{
-				PamUser: "user-integration-WITH-Mixed-CaSe",
+				PamUser: "user-integration-WITH-Mixed-CaSe@example.com",
 			},
 		},
 		"Authenticate_user_with_mfa": {
 			tape:         "mfa_auth",
 			tapeSettings: []tapeSetting{{vhsHeight, 1200}},
 			clientOptions: clientOptions{
-				PamUser: examplebroker.UserIntegrationMfaPrefix + "auth",
+				PamUser: examplebroker.UserIntegrationMfaPrefix + "auth-native@example.com",
 			},
 		},
 		"Authenticate_user_with_form_mode_with_button": {
@@ -132,7 +133,7 @@ func TestNativeAuthenticate(t *testing.T) {
 		"Authenticate_user_with_form_mode_with_button_two_supported_methods": {
 			tape: "form_with_button",
 			clientOptions: clientOptions{
-				PamUser: examplebroker.UserIntegrationAuthModesPrefix + "totp_with_button,password-integration-native",
+				PamUser: examplebroker.UserIntegrationAuthModesPrefix + "totp_with_button,password-integration-native@example.com",
 			},
 			tapeSettings: []tapeSetting{{vhsHeight, 700}},
 			tapeVariables: map[string]string{
@@ -196,7 +197,7 @@ func TestNativeAuthenticate(t *testing.T) {
 				"AUTHD_QRCODE_TAPE_ITEM_NAME": "Login code",
 			},
 			clientOptions: clientOptions{
-				PamUser:        examplebroker.UserIntegrationPreCheckPrefix + "ssh-service-qr-code",
+				PamUser:        examplebroker.UserIntegrationPreCheckPrefix + "ssh-service-qr-code-native@example.com",
 				PamServiceName: "sshd",
 			},
 		},
@@ -204,7 +205,7 @@ func TestNativeAuthenticate(t *testing.T) {
 			tape:         "mandatory_password_reset",
 			tapeSettings: []tapeSetting{{vhsHeight, 550}},
 			clientOptions: clientOptions{
-				PamUser: examplebroker.UserIntegrationNeedsResetPrefix + "mandatory",
+				PamUser: examplebroker.UserIntegrationNeedsResetPrefix + "mandatory-native@example.com",
 			},
 		},
 		"Authenticate_user_and_reset_password_with_case_insensitive_user_selection": {
@@ -213,37 +214,44 @@ func TestNativeAuthenticate(t *testing.T) {
 			userSelection: true,
 			tapeVariables: map[string]string{
 				vhsTapeUserVariable: vhsTestUserNameFull(t,
-					examplebroker.UserIntegrationNeedsResetPrefix, "case-insensitive"),
+					examplebroker.UserIntegrationNeedsResetPrefix, "case-insensitive-native"),
 				"AUTHD_TEST_TAPE_UPPER_CASE_USERNAME": strings.ToUpper(
 					vhsTestUserNameFull(t,
-						examplebroker.UserIntegrationNeedsResetPrefix, "Case-INSENSITIVE")),
+						examplebroker.UserIntegrationNeedsResetPrefix, "CASE-INSENSITIVE-NATIVE")),
 				"AUTHD_TEST_TAPE_MIXED_CASE_USERNAME": vhsTestUserNameFull(t,
-					examplebroker.UserIntegrationNeedsResetPrefix, "Case-INSENSITIVE"),
+					examplebroker.UserIntegrationNeedsResetPrefix, "Case-INSENSITIVE-native"),
 			},
 		},
 		"Authenticate_user_with_mfa_and_reset_password_while_enforcing_policy": {
 			tape:         "mfa_reset_pwquality_auth",
 			tapeSettings: []tapeSetting{{vhsHeight, 3000}},
 			clientOptions: clientOptions{
-				PamUser: examplebroker.UserIntegrationMfaWithResetPrefix + "pwquality",
+				PamUser: examplebroker.UserIntegrationMfaWithResetPrefix + "pwquality-native@example.com",
+			},
+		},
+		"Authenticate_user_with_mfa_and_reset_same_password": {
+			tape:         "mfa_reset_same_password",
+			tapeSettings: []tapeSetting{{vhsHeight, 3000}},
+			clientOptions: clientOptions{
+				PamUser: examplebroker.UserIntegrationMfaWithResetPrefix + "same-password-native@example.com",
 			},
 		},
 		"Authenticate_user_and_offer_password_reset": {
 			tape: "optional_password_reset_skip",
 			clientOptions: clientOptions{
-				PamUser: examplebroker.UserIntegrationCanResetPrefix + "skip",
+				PamUser: examplebroker.UserIntegrationCanResetPrefix + "skip-native@example.com",
 			},
 		},
 		"Authenticate_user_and_accept_password_reset": {
 			tape: "optional_password_reset_accept",
 			clientOptions: clientOptions{
-				PamUser: examplebroker.UserIntegrationCanResetPrefix + "accept",
+				PamUser: examplebroker.UserIntegrationCanResetPrefix + "accept-native@example.com",
 			},
 		},
 		"Authenticate_user_switching_auth_mode": {
 			tape:          "switch_auth_mode",
 			tapeSettings:  []tapeSetting{{vhsHeight, 3000}},
-			clientOptions: clientOptions{PamUser: "user-integration-switch-mode"},
+			clientOptions: clientOptions{PamUser: "user-integration-switch-mode-native@example.com"},
 			tapeVariables: map[string]string{
 				"AUTHD_SWITCH_AUTH_MODE_TAPE_SEND_URL_TO_EMAIL_ITEM":   "2",
 				"AUTHD_SWITCH_AUTH_MODE_TAPE_FIDO_DEVICE_FOO_ITEM":     "3",
@@ -260,8 +268,8 @@ func TestNativeAuthenticate(t *testing.T) {
 			tape:          "switch_username",
 			userSelection: true,
 			tapeVariables: map[string]string{
-				vhsTapeUserVariable:               examplebroker.UserIntegrationPrefix + "native-username",
-				vhsTapeUserVariable + "_SWITCHED": examplebroker.UserIntegrationPrefix + "native-username-switched",
+				vhsTapeUserVariable:               examplebroker.UserIntegrationPrefix + "native-username@example.com",
+				vhsTapeUserVariable + "_SWITCHED": examplebroker.UserIntegrationPrefix + "native-username-switched@example.com",
 			},
 		},
 		"Authenticate_user_switching_to_local_broker": {
@@ -273,27 +281,27 @@ func TestNativeAuthenticate(t *testing.T) {
 			tapeSettings:    []tapeSetting{{vhsHeight, 700}},
 			wantLocalGroups: true,
 			clientOptions: clientOptions{
-				PamUser: examplebroker.UserIntegrationLocalGroupsPrefix + "auth",
+				PamUser: examplebroker.UserIntegrationLocalGroupsPrefix + "auth-native@example.com",
 			},
 		},
 		"Authenticate_user_on_ssh_service": {
 			tape: "simple_ssh_auth",
 			clientOptions: clientOptions{
-				PamUser:        examplebroker.UserIntegrationPreCheckPrefix + "ssh-service",
+				PamUser:        examplebroker.UserIntegrationPreCheckPrefix + "ssh-service-native@example.com",
 				PamServiceName: "sshd",
 			},
 		},
 		"Authenticate_user_on_ssh_service_with_custom_name_and_connection_env": {
 			tape: "simple_ssh_auth",
 			clientOptions: clientOptions{
-				PamUser: examplebroker.UserIntegrationPreCheckPrefix + "ssh-connection",
+				PamUser: examplebroker.UserIntegrationPreCheckPrefix + "ssh-connection-native@example.com",
 				PamEnv:  []string{"SSH_CONNECTION=foo-connection"},
 			},
 		},
 		"Authenticate_user_on_ssh_service_with_custom_name_and_auth_info_env": {
 			tape: "simple_ssh_auth",
 			clientOptions: clientOptions{
-				PamUser: examplebroker.UserIntegrationPreCheckPrefix + "ssh-auth-info",
+				PamUser: examplebroker.UserIntegrationPreCheckPrefix + "ssh-auth-info-native@example.com",
 				PamEnv:  []string{"SSH_AUTH_INFO_0=foo-authinfo"},
 			},
 		},
@@ -352,7 +360,7 @@ func TestNativeAuthenticate(t *testing.T) {
 			tape:         "bad_password",
 			tapeSettings: []tapeSetting{{vhsHeight, 800}},
 			clientOptions: clientOptions{
-				PamUser: examplebroker.UserIntegrationNeedsResetPrefix + "bad-password",
+				PamUser: examplebroker.UserIntegrationNeedsResetPrefix + "bad-password-native@example.com",
 			},
 		},
 
@@ -406,22 +414,37 @@ func TestNativeAuthenticate(t *testing.T) {
 				filepath.Join(outDir, "pam_authd"))
 			require.NoError(t, err, "Setup: symlinking the pam client")
 
-			var socketPath, gpasswdOutput, groupsFile, pidFile string
+			var socketPath, groupFileOutput, pidFile string
 			if tc.wantLocalGroups || tc.currentUserNotRoot || tc.wantSeparateDaemon ||
 				tc.oldDB != "" {
 				// For the local groups tests we need to run authd again so that it has
-				// special environment that generates a fake gpasswd output for us to test.
+				// special environment that saves the updated group file to a writable
+				// location for us to test.
 				// Similarly for the not-root tests authd has to run in a more restricted way.
 				// In the other cases this is not needed, so we can just use a shared authd.
-				gpasswdOutput, groupsFile = prepareGPasswdFiles(t)
+				var groupFile string
+				groupFileOutput, groupFile = prepareGroupFiles(t)
+
+				if tc.wantLocalGroups || tc.oldDB != "" {
+					// We don't want to use separate input ant output files here.
+					groupFileOutput = groupFile
+				}
 
 				pidFile = filepath.Join(outDir, "authd.pid")
 
-				socketPath = runAuthd(t, gpasswdOutput, groupsFile, !tc.currentUserNotRoot,
+				args := []testutils.DaemonOption{
+					testutils.WithGroupFile(groupFile),
+					testutils.WithGroupFileOutput(groupFileOutput),
 					testutils.WithPidFile(pidFile),
-					testutils.WithEnvironment(useOldDatabaseEnv(t, tc.oldDB)...))
+					testutils.WithEnvironment(useOldDatabaseEnv(t, tc.oldDB)...),
+				}
+				if !tc.currentUserNotRoot {
+					args = append(args, testutils.WithCurrentUserAsRoot)
+				}
+
+				socketPath = runAuthd(t, args...)
 			} else {
-				socketPath, gpasswdOutput = sharedAuthd(t)
+				socketPath, groupFileOutput = sharedAuthd(t)
 			}
 			if tc.socketPath != "" {
 				socketPath = tc.socketPath
@@ -431,32 +454,22 @@ func TestNativeAuthenticate(t *testing.T) {
 				tc.tapeCommand = tapeCommand
 			}
 
-			if u := tc.clientOptions.PamUser; !tc.userSuffixSkip &&
-				strings.Contains(u, "integration") && !strings.Contains(u, "native") {
-				tc.clientOptions.PamUser += "-native"
-			}
 			if tc.clientOptions.PamUser == "" && !tc.userSelection {
 				tc.clientOptions.PamUser = vhsTestUserName(t, "native")
 			}
 
-			td := newTapeData(tc.tape, tc.tapeSettings...)
+			td := newTapeData(tc.tape, outDir, tc.tapeSettings...)
 			td.Command = tc.tapeCommand
 			td.Env[vhsTapeSocketVariable] = socketPath
 			td.Env[pam_test.RunnerEnvSupportsConversation] = "1"
 			td.Env["AUTHD_TEST_PID_FILE"] = pidFile
 			td.Variables = tc.tapeVariables
 			td.AddClientOptions(t, tc.clientOptions)
-			td.RunVhs(t, vhsTestTypeNative, outDir, cliEnv)
-			got := td.ExpectedOutput(t, outDir)
+			td.RunVHS(t, vhsTestTypeNative, cliEnv)
+			got := td.SanitizedOutput(t)
 			golden.CheckOrUpdate(t, got)
 
-			if tc.wantLocalGroups || tc.oldDB != "" {
-				actualGroups, err := os.ReadFile(groupsFile)
-				require.NoError(t, err, "Failed to read the groups file")
-				golden.CheckOrUpdate(t, string(actualGroups), golden.WithSuffix(".groups"))
-			}
-
-			localgroupstestutils.RequireGPasswdOutput(t, gpasswdOutput, golden.Path(t)+".gpasswd_out")
+			localgroupstestutils.RequireGroupFile(t, groupFileOutput, golden.Path(t))
 
 			if !tc.skipRunnerCheck {
 				requireRunnerResultForUser(t, authd.SessionMode_LOGIN, tc.clientOptions.PamUser, got)
@@ -468,6 +481,21 @@ func TestNativeAuthenticate(t *testing.T) {
 func TestNativeChangeAuthTok(t *testing.T) {
 	t.Parallel()
 
+	if testing.Short() {
+		t.Skip("skipping test in short mode.")
+	}
+
+	// Due to external dependencies such as `vhs`, we can't run the tests in some environments (like LP builders), as we
+	// can't install the dependencies there. So we need to be able to skip these tests on-demand.
+	if os.Getenv("AUTHD_SKIP_EXTERNAL_DEPENDENT_TESTS") != "" {
+		t.Skip("Skipping tests with external dependencies as requested")
+	}
+
+	// This test is flaky, see https://github.com/canonical/authd/issues/1330
+	if os.Getenv("AUTHD_SKIP_FLAKY_TESTS") != "" {
+		t.Skip("skipping flaky test")
+	}
+
 	clientPath := t.TempDir()
 	cliEnv := preparePamRunnerTest(t, clientPath)
 
@@ -516,7 +544,7 @@ func TestNativeChangeAuthTok(t *testing.T) {
 			tape:         "passwd_mfa",
 			tapeSettings: []tapeSetting{{vhsHeight, 1300}},
 			tapeVariables: map[string]string{
-				vhsTapeUserVariable: examplebroker.UserIntegrationMfaPrefix + "native-passwd",
+				vhsTapeUserVariable: examplebroker.UserIntegrationMfaPrefix + "native-passwd@example.com",
 			},
 		},
 
@@ -571,7 +599,7 @@ func TestNativeChangeAuthTok(t *testing.T) {
 			if tc.currentUserNotRoot {
 				// For the not-root tests authd has to run in a more restricted way.
 				// In the other cases this is not needed, so we can just use a shared authd.
-				socketPath = runAuthd(t, os.DevNull, os.DevNull, false)
+				socketPath = runAuthd(t, testutils.WithGroupFile(filepath.Join(t.TempDir(), "group")))
 			} else {
 				socketPath, _ = sharedAuthd(t)
 			}
@@ -584,14 +612,14 @@ func TestNativeChangeAuthTok(t *testing.T) {
 				tc.tapeVariables[vhsTapeUserVariable] = vhsTestUserName(t, "native-passwd")
 			}
 
-			td := newTapeData(tc.tape, tc.tapeSettings...)
+			td := newTapeData(tc.tape, outDir, tc.tapeSettings...)
 			td.Command = tapeCommand
 			td.Variables = tc.tapeVariables
 			td.Env[vhsTapeSocketVariable] = socketPath
 			td.Env[pam_test.RunnerEnvSupportsConversation] = "1"
 			td.AddClientOptions(t, tc.clientOptions)
-			td.RunVhs(t, vhsTestTypeNative, outDir, cliEnv)
-			got := td.ExpectedOutput(t, outDir)
+			td.RunVHS(t, vhsTestTypeNative, cliEnv)
+			got := td.SanitizedOutput(t)
 			golden.CheckOrUpdate(t, got)
 
 			if !tc.skipRunnerCheck {
diff --git a/pam/integration-tests/ssh_test.go b/pam/integration-tests/ssh_test.go
index 4066eb7174..25f496da76 100644
--- a/pam/integration-tests/ssh_test.go
+++ b/pam/integration-tests/ssh_test.go
@@ -1,10 +1,10 @@
 package main_test
 
 import (
-	"bytes"
 	"context"
 	"errors"
 	"fmt"
+	"io"
 	"net"
 	"net/http"
 	"net/http/httptest"
@@ -16,19 +16,22 @@ import (
 	"slices"
 	"strconv"
 	"strings"
+	"sync"
+	"sync/atomic"
 	"syscall"
 	"testing"
 	"time"
 
+	"github.com/canonical/authd/examplebroker"
+	"github.com/canonical/authd/internal/grpcutils"
+	"github.com/canonical/authd/internal/proto/authd"
+	"github.com/canonical/authd/internal/services/errmessages"
+	"github.com/canonical/authd/internal/testlog"
+	"github.com/canonical/authd/internal/testutils"
+	"github.com/canonical/authd/internal/testutils/golden"
+	localgroupstestutils "github.com/canonical/authd/internal/users/localentries/testutils"
+	"github.com/canonical/authd/pam/internal/pam_test"
 	"github.com/stretchr/testify/require"
-	"github.com/ubuntu/authd/examplebroker"
-	"github.com/ubuntu/authd/internal/grpcutils"
-	"github.com/ubuntu/authd/internal/proto/authd"
-	"github.com/ubuntu/authd/internal/services/errmessages"
-	"github.com/ubuntu/authd/internal/testutils"
-	"github.com/ubuntu/authd/internal/testutils/golden"
-	localgroupstestutils "github.com/ubuntu/authd/internal/users/localentries/testutils"
-	"github.com/ubuntu/authd/pam/internal/pam_test"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/credentials/insecure"
 )
@@ -38,11 +41,32 @@ var (
 	sshHostPortRegex     *regexp.Regexp
 
 	sshDefaultFinalWaitTimeout = sleepDuration(3 * defaultSleepValues[authdWaitDefault])
+
+	prepareSSHTestsOnce sync.Once
+	sshTestsPrepared    atomic.Bool
+
+	prepareSharedSSHDTestsOnce sync.Once
+	sharedSSHDTestsPrepared    atomic.Bool
+
+	execModule, execChild, pamMkHomeDirModule string
+	nssEnv                                    []string
+	nssLibrary                                string
+	sshdPreloadLibraries                      []string
+	sshdPreloaderCFlags                       []string
+	sshdEnv                                   []string
+	sshdHostKeyPath                           string
+	sshdHostPubKey                            []byte
+
+	sshTestsHomeBase = filepath.Join(os.TempDir(), "authd-tests", "home")
 )
 
 func TestSSHAuthenticate(t *testing.T) {
 	t.Parallel()
 
+	if testing.Short() {
+		t.Skip("skipping test in short mode.")
+	}
+
 	runSharedDaemonTests := testutils.IsRace() || os.Getenv("AUTHD_TESTS_SSHD_SHARED") != ""
 
 	// We only test the single-sshd instance when in race mode.
@@ -55,7 +79,7 @@ func TestSSHAuthenticate(t *testing.T) {
 }
 
 //nolint:thelper // This is actually a test function!
-func testSSHAuthenticate(t *testing.T, sharedSSHd bool) {
+func testSSHAuthenticate(t *testing.T, sharedSSHD bool) {
 	// Due to external dependencies such as `vhs`, we can't run the tests in some environments (like LP builders), as we
 	// can't install the dependencies there. So we need to be able to skip these tests on-demand.
 	if os.Getenv("AUTHD_SKIP_EXTERNAL_DEPENDENT_TESTS") != "" {
@@ -76,69 +100,87 @@ func testSSHAuthenticate(t *testing.T, sharedSSHd bool) {
 	currentDir, err := os.Getwd()
 	require.NoError(t, err, "Setup: Could not get current directory for the tests")
 
-	execModule := buildExecModuleWithCFlags(t, []string{"-std=c11"}, true)
-	execChild := buildPAMExecChild(t)
-
-	mkHomeDirHelper, err := exec.LookPath("mkhomedir_helper")
-	require.NoError(t, err, "Setup: mkhomedir_helper not found")
-	pamMkHomeDirModule := buildCPAMModule(t,
-		[]string{"./pam/integration-tests/pam_mkhomedir/pam_mkhomedir.c"},
-		nil,
-		[]string{
-			"-DAUTHD_TESTS_SSH_USE_AUTHD_NSS",
-			fmt.Sprintf("-DMKHOMEDIR_HELPER=%q", mkHomeDirHelper),
-		},
-		"pam_mkhomedir_test.so", true)
-
-	var nssEnv []string
-	var nssLibrary string
-	var sshdPreloadLibraries []string
-	var sshdPreloaderCFlags []string
-	err = testutils.CanRunRustTests(false)
-	if os.Getenv("AUTHD_TESTS_SSH_USE_DUMMY_NSS") == "" && err == nil {
-		nssLibrary, nssEnv = testutils.BuildRustNSSLib(t, true)
-		sshdPreloadLibraries = append(sshdPreloadLibraries, nssLibrary)
-		sshdPreloaderCFlags = append(sshdPreloaderCFlags,
-			"-DAUTHD_TESTS_SSH_USE_AUTHD_NSS")
-		nssEnv = append(nssEnv, nssTestEnvBase(t, nssLibrary)...)
-	} else if err != nil {
-		t.Logf("Using the dummy library to implement NSS: %v", err)
+	prepareSSHTests := func(subtest *testing.T) {
+		t.Logf("Preparing SSH tests, triggered by %q", subtest.Name())
+
+		execModule = buildExecModuleWithCFlags(t, []string{"-std=c11"}, true)
+		execChild = buildPAMExecChild(t)
+
+		mkHomeDirHelper, err := exec.LookPath("mkhomedir_helper")
+		require.NoError(t, err, "Setup: mkhomedir_helper not found")
+		pamMkHomeDirModule = buildSharedModule(t,
+			"Building pam_mkhomedir module",
+			[]string{"./pam/integration-tests/pam_mkhomedir/pam_mkhomedir.c"},
+			nil,
+			[]string{
+				"-DAUTHD_TESTS_SSH_USE_AUTHD_NSS",
+				fmt.Sprintf("-DMKHOMEDIR_HELPER=%q", mkHomeDirHelper),
+			},
+			[]string{"-lpam"},
+			"pam_mkhomedir_test.so", true)
+
+		err = testutils.CanRunRustTests(false)
+		if os.Getenv("AUTHD_TESTS_SSH_USE_DUMMY_NSS") == "" && err == nil {
+			nssLibrary, nssEnv = testutils.BuildRustNSSLib(t, true)
+			sshdPreloadLibraries = append(sshdPreloadLibraries, nssLibrary)
+			sshdPreloaderCFlags = append(sshdPreloaderCFlags,
+				"-DAUTHD_TESTS_SSH_USE_AUTHD_NSS")
+			nssEnv = append(nssEnv, nssTestEnvBase(t, nssLibrary)...)
+		} else if err != nil {
+			t.Logf("Using the dummy library to implement NSS: %v", err)
+		}
+
+		sources := []string{filepath.Join(currentDir, "/sshd_preloader/sshd_preloader.c")}
+		sshdPreloadLibrary := buildSharedModule(t, "Building sshd_preloader library", sources,
+			nil, sshdPreloaderCFlags, nil, "sshd_preloader", true)
+		sshdPreloadLibraries = append(sshdPreloadLibraries, sshdPreloadLibrary)
+
+		sshdHostKeyPath = filepath.Join(t.TempDir(), "ssh_host_ed25519_key")
+		//#nosec:G204 - we control the command arguments in tests
+		out, err := exec.Command("ssh-keygen", "-q", "-f", sshdHostKeyPath, "-N", "", "-t", "ed25519").CombinedOutput()
+		require.NoError(t, err, "Setup: Failed generating SSH host key: %s", out)
+		testutils.MaybeSaveFilesAsArtifactsOnCleanup(t, sshdHostKeyPath)
+
+		sshdHostPubKey, err = os.ReadFile(sshdHostKeyPath + ".pub")
+		require.NoError(t, err, "Setup: Can't read sshd host public key")
+
+		testutils.MaybeSaveFilesAsArtifactsOnCleanup(t, sshdHostKeyPath+".pub")
+
+		if !t.Failed() {
+			t.Log("Prepared SSH tests")
+			sshTestsPrepared.Store(true)
+		}
 	}
 
-	sshdPreloadLibrary := buildCModule(t, []string{
-		filepath.Join(currentDir, "/sshd_preloader/sshd_preloader.c"),
-	}, nil, sshdPreloaderCFlags, nil, "sshd_preloader", true)
-	sshdPreloadLibraries = append(sshdPreloadLibraries, sshdPreloadLibrary)
+	var sharedSSHDPort, sharedSSHDUserHome, sharedAuthdSocket, sharedAuthdGroupOutput string
+	prepareSharedSSHDTests := func(subtest *testing.T) {
+		t.Logf("Preparing SSH tests with shared sshd, triggered by %q", subtest.Name())
+		sharedAuthdSocket, sharedAuthdGroupOutput = sharedAuthd(t)
+		serviceFile := createSSHDServiceFile(t, execModule, execChild, pamMkHomeDirModule, sharedAuthdSocket)
+		sshdEnv = append(sshdEnv, nssEnv...)
+		sshdEnv = append(sshdEnv, fmt.Sprintf("AUTHD_NSS_SOCKET=%s", sharedAuthdSocket))
 
-	sshdHostKey := filepath.Join(t.TempDir(), "ssh_host_ed25519_key")
-	//#nosec:G204 - we control the command arguments in tests
-	out, err := exec.Command("ssh-keygen", "-q", "-f", sshdHostKey, "-N", "", "-t", "ed25519").CombinedOutput()
-	require.NoError(t, err, "Setup: Failed generating SSH host key: %s", out)
-	saveArtifactsForDebugOnCleanup(t, []string{sshdHostKey})
+		sharedSSHDPort, sharedSSHDUserHome = startSSHDForTest(t, serviceFile, sshdHostKeyPath,
+			"authd-test-user-sshd-accept-all@example.com", sshdPreloadLibraries, sshdEnv, false)
 
-	pubKey, err := os.ReadFile(sshdHostKey + ".pub")
-	require.NoError(t, err, "Setup: Can't read sshd host public key")
-	saveArtifactsForDebugOnCleanup(t, []string{sshdHostKey + ".pub"})
+		if !t.Failed() {
+			t.Log("Prepared SSH tests with shared sshd")
+			sharedSSHDTestsPrepared.Store(true)
+		}
+	}
 
 	const pamSSHUserEnv = "AUTHD_PAM_SSH_USER"
 	const baseTapeCommand = "ssh ${%s}@localhost ${AUTHD_PAM_SSH_ARGS}"
 	tapeCommand := fmt.Sprintf(baseTapeCommand, pamSSHUserEnv)
-	defaultTapeSettings := []tapeSetting{{vhsHeight, 1000}, {vhsWidth, 1500}}
-
-	var sshdEnv []string
-	var defaultSSHDPort, defaultUserHome, defaultSocketPath, defaultGPasswdOutput string
-	if sharedSSHd {
-		defaultSocketPath, defaultGPasswdOutput = sharedAuthd(t)
-		serviceFile := createSshdServiceFile(t, execModule, execChild, pamMkHomeDirModule, defaultSocketPath)
-		sshdEnv = append(sshdEnv, nssEnv...)
-		sshdEnv = append(sshdEnv, fmt.Sprintf("AUTHD_NSS_SOCKET=%s", defaultSocketPath))
-		defaultSSHDPort, defaultUserHome = startSSHdForTest(t, serviceFile, sshdHostKey,
-			"authd-test-user-sshd-accept-all", sshdPreloadLibraries, sshdEnv, true, false)
-	}
+	defaultTapeSettings := []tapeSetting{{vhsHeight, 1000}, {vhsWidth, 2000}}
 
 	sshEnvVariablesRegex = regexp.MustCompile(`(?m)  (PATH|HOME|PWD|SSH_[A-Z]+)=.*(\n*)($[^ ]{2}.*)?$`)
 	sshHostPortRegex = regexp.MustCompile(`([\d\.:]+) port ([\d:]+)`)
 
+	authctlPath, authctlCleanup, err := testutils.BuildAuthctl()
+	require.NoError(t, err)
+	t.Cleanup(authctlCleanup)
+
 	tests := map[string]struct {
 		tape          string
 		tapeSettings  []tapeSetting
@@ -149,7 +191,6 @@ func testSSHAuthenticate(t *testing.T, sharedSSHd bool) {
 		userPrefix       string
 		pamServiceName   string
 		socketPath       string
-		daemonizeSSHd    bool
 		interactiveShell bool
 		oldDB            string
 
@@ -161,7 +202,7 @@ func testSSHAuthenticate(t *testing.T, sharedSSHd bool) {
 			tape: "simple_auth",
 		},
 		"Authenticate_user_successfully_if_already_registered": {
-			user: "user-ssh",
+			user: "user-ssh@example.com",
 			tape: "simple_auth",
 		},
 		"Authenticate_user_successfully_and_enters_shell": {
@@ -174,26 +215,26 @@ func testSSHAuthenticate(t *testing.T, sharedSSHd bool) {
 				examplebroker.UserIntegrationPreCheckPrefix, "upper-case")),
 		},
 		"Authenticate_user_successfully_if_already_registered_with_upper_case": {
-			user: "USER-SSH2",
+			user: "USER-SSH2@example.com",
 			tape: "simple_auth",
 		},
 		"Authenticate_user_successfully_after_db_migration": {
 			tape:                 "simple_auth_with_auto_selected_broker",
 			oldDB:                "authd_0.4.1_bbolt_with_mixed_case_users",
 			wantUserAlreadyExist: true,
-			user:                 "user-integration-cached",
+			user:                 "user-integration-cached@example.com",
 		},
 		"Authenticate_user_with_upper_case_using_lower_case_after_db_migration": {
 			tape:                 "simple_auth_with_auto_selected_broker",
 			oldDB:                "authd_0.4.1_bbolt_with_mixed_case_users",
 			wantUserAlreadyExist: true,
-			user:                 "user-integration-upper-case",
+			user:                 "user-integration-upper-case@example.com",
 		},
 		"Authenticate_user_with_mixed_case_after_db_migration": {
 			tape:                 "simple_auth_with_auto_selected_broker",
 			oldDB:                "authd_0.4.1_bbolt_with_mixed_case_users",
 			wantUserAlreadyExist: true,
-			user:                 "user-integration-WITH-Mixed-CaSe",
+			user:                 "user-integration-WITH-Mixed-CaSe@example.com",
 		},
 		"Authenticate_user_with_mfa": {
 			tape:         "mfa_auth",
@@ -224,7 +265,6 @@ func testSSHAuthenticate(t *testing.T, sharedSSHd bool) {
 			user: strings.ToUpper(vhsTestUserNameFull(t,
 				examplebroker.UserIntegrationNeedsResetPrefix+
 					examplebroker.UserIntegrationPreCheckValue, "case-insensitive")),
-			daemonizeSSHd: true,
 			tapeVariables: map[string]string{
 				"AUTHD_TEST_TAPE_SSH_USER_VAR": pamSSHUserEnv,
 				"AUTHD_TEST_TAPE_LOWER_CASE_USERNAME": vhsTestUserNameFull(t,
@@ -240,6 +280,11 @@ func testSSHAuthenticate(t *testing.T, sharedSSHd bool) {
 			tapeSettings: []tapeSetting{{vhsHeight, 1500}, {vhsWidth, 1800}},
 			userPrefix:   examplebroker.UserIntegrationMfaWithResetPrefix,
 		},
+		"Authenticate_user_with_mfa_and_reset_same_password": {
+			tape:         "mfa_reset_same_password",
+			tapeSettings: []tapeSetting{{vhsHeight, 3000}},
+			userPrefix:   examplebroker.UserIntegrationMfaWithResetPrefix,
+		},
 		"Authenticate_user_and_offer_password_reset": {
 			tape:       "optional_password_reset_skip",
 			userPrefix: examplebroker.UserIntegrationCanResetPrefix,
@@ -278,8 +323,7 @@ func testSSHAuthenticate(t *testing.T, sharedSSHd bool) {
 		},
 
 		"Remember_last_successful_broker_and_mode": {
-			tape:          "remember_broker_and_mode",
-			daemonizeSSHd: true,
+			tape: "remember_broker_and_mode",
 		},
 		"Autoselect_local_broker_for_local_user": {
 			tape:                "local_user_preset",
@@ -293,6 +337,9 @@ func testSSHAuthenticate(t *testing.T, sharedSSHd bool) {
 				vhsCommandFinalAuthWaitVariable: `Wait /Password:/`,
 			},
 		},
+		"Authenticate_user_locks_and_unlocks_it": {
+			tape: "simple_auth_locks_unlocks",
+		},
 
 		"Deny_authentication_if_max_attempts_reached": {
 			tape:                "max_attempts",
@@ -332,7 +379,7 @@ Wait@%dms`, sshDefaultFinalWaitTimeout),
 		},
 		"Exit_if_user_is_not_pre-checked_on_ssh_service": {
 			tape:                "local_ssh",
-			user:                examplebroker.UserIntegrationPrefix + "ssh-service-not-allowed",
+			user:                examplebroker.UserIntegrationPrefix + "ssh-service-not-allowed@example.com",
 			pamServiceName:      "sshd",
 			wantNotLoggedInUser: true,
 			tapeVariables: map[string]string{
@@ -354,14 +401,34 @@ Wait@%dms`, sshDefaultFinalWaitTimeout),
 		},
 	}
 	for name, tc := range tests {
-		if sharedSSHd {
-			name = fmt.Sprintf("%s on shared SSHd", name)
+		if sharedSSHD {
+			name = fmt.Sprintf("%s_with_shared_sshd", name)
 		}
 		t.Run(name, func(t *testing.T) {
 			t.Parallel()
 
-			socketPath := defaultSocketPath
-			gpasswdOutput := defaultGPasswdOutput
+			if !sshTestsPrepared.Load() {
+				t.Log("Waiting for SSH tests to be prepared")
+				start := time.Now()
+				prepareSSHTestsOnce.Do(func() {
+					prepareSSHTests(t)
+				})
+				require.True(t, sshTestsPrepared.Load(), "Setup: preparing SSH tests failed")
+				t.Logf("SSH tests prepared after %.3fs", time.Since(start).Seconds())
+			}
+
+			if sharedSSHD && !sharedSSHDTestsPrepared.Load() {
+				t.Log("Waiting for shared SSHD tests to be prepared")
+				start := time.Now()
+				prepareSharedSSHDTestsOnce.Do(func() {
+					prepareSharedSSHDTests(t)
+				})
+				require.True(t, sharedSSHDTestsPrepared.Load(), "Setup: creating shared sshd service file failed")
+				t.Logf("Shared SSHD tests prepared after %.3fs", time.Since(start).Seconds())
+			}
+
+			socketPath := sharedAuthdSocket
+			groupOutput := sharedAuthdGroupOutput
 
 			var authdEnv []string
 			var authdSocketLink string
@@ -380,19 +447,32 @@ Wait@%dms`, sshDefaultFinalWaitTimeout),
 				authdEnv = append(authdEnv, nssTestEnv(t, nssLibrary, authdSocketLink)...)
 			}
 
-			var groupsFile string
 			if tc.wantLocalGroups || tc.oldDB != "" {
 				// For the local groups tests we need to run authd again so that it has
-				// special environment that generates a fake gpasswd output for us to test.
-				// In the other cases this is not needed, so we can just use a shared authd.
-				gpasswdOutput, groupsFile = prepareGPasswdFiles(t)
+				// special environment that saves the updated group file to a writable
+				// location for us to test.
+				_, groupOutput = prepareGroupFiles(t)
 
 				authdEnv = append(authdEnv, useOldDatabaseEnv(t, tc.oldDB)...)
 
-				socketPath = runAuthd(t, gpasswdOutput, groupsFile, true,
-					testutils.WithEnvironment(authdEnv...))
-			} else if !sharedSSHd {
-				socketPath, gpasswdOutput = sharedAuthd(t,
+				// Since we are migrating users, we need to make sure that we can replicate
+				// the homedir they have in the database.
+				err := os.MkdirAll(sshTestsHomeBase, 0700)
+				require.NoError(t, err, "Setup: failed to create home directory")
+
+				t.Cleanup(func() {
+					_ = os.RemoveAll(sshTestsHomeBase)
+				})
+
+				socketPath = runAuthd(t,
+					testutils.WithCurrentUserAsRoot,
+					testutils.WithGroupFile(groupOutput),
+					testutils.WithEnvironment(authdEnv...),
+					testutils.WithHomeBaseDir(sshTestsHomeBase),
+				)
+			} else if !sharedSSHD {
+				socketPath, groupOutput = sharedAuthd(t,
+					testutils.WithGroupFileOutput(sharedAuthdGroupOutput),
 					testutils.WithEnvironment(authdEnv...))
 			}
 			if tc.socketPath != "" {
@@ -430,9 +510,9 @@ Wait@%dms`, sshDefaultFinalWaitTimeout),
 				}
 			}
 
-			sshdPort := defaultSSHDPort
-			userHome := defaultUserHome
-			if !sharedSSHd || tc.wantLocalGroups || tc.oldDB != "" ||
+			sshdPort := sharedSSHDPort
+			userHome := sharedSSHDUserHome
+			if !sharedSSHD || tc.wantLocalGroups || tc.oldDB != "" ||
 				tc.interactiveShell || tc.socketPath != "" {
 				sshdEnv := sshdEnv
 				if nssLibrary != "" {
@@ -444,29 +524,30 @@ Wait@%dms`, sshDefaultFinalWaitTimeout),
 					err := os.Symlink(socketPath, authdSocketLink)
 					require.NoError(t, err, "Setup: symlinking the authd socket")
 				}
-				serviceFile := createSshdServiceFile(t, execModule, execChild,
+				serviceFile := createSSHDServiceFile(t, execModule, execChild,
 					pamMkHomeDirModule, socketPath)
-				sshdPort, userHome = startSSHdForTest(t, serviceFile, sshdHostKey, user,
-					sshdPreloadLibraries, sshdEnv, tc.daemonizeSSHd, tc.interactiveShell)
+				sshdPort, userHome = startSSHDForTest(t, serviceFile, sshdHostKeyPath, user,
+					sshdPreloadLibraries, sshdEnv, tc.interactiveShell)
 			}
 
-			if !sharedSSHd {
+			if !sharedSSHD {
 				_, err := os.Stat(userHome)
 				require.ErrorIs(t, err, os.ErrNotExist, "Unexpected error checking for %q", userHome)
 			}
 
 			knownHost := filepath.Join(t.TempDir(), "known_hosts")
 			err := os.WriteFile(knownHost, []byte(
-				fmt.Sprintf("[localhost]:%s %s", sshdPort, pubKey),
+				fmt.Sprintf("[localhost]:%s %s", sshdPort, sshdHostPubKey),
 			), 0600)
 			require.NoError(t, err, "Setup: can't create known hosts file")
 
 			outDir := t.TempDir()
-			td := newTapeData(tc.tape, append(defaultTapeSettings, tc.tapeSettings...)...)
+			td := newTapeData(tc.tape, outDir, append(defaultTapeSettings, tc.tapeSettings...)...)
 			td.Command = tapeCommand
 			td.Env[pam_test.RunnerEnvSupportsConversation] = "1"
-			td.Env["HOME"] = t.TempDir()
 			td.Env[pamSSHUserEnv] = user
+			td.Env["AUTHD_SOCKET"] = "unix://" + socketPath
+			td.Env["AUTHCTL_PATH"] = authctlPath
 			td.Env["AUTHD_PAM_SSH_ARGS"] = strings.Join([]string{
 				"-p", sshdPort,
 				"-F", os.DevNull,
@@ -477,13 +558,16 @@ Wait@%dms`, sshDefaultFinalWaitTimeout),
 				"-o", "UserKnownHostsFile=" + knownHost,
 			}, " ")
 			td.Variables = tc.tapeVariables
-			td.RunVhs(t, vhsTestTypeSSH, outDir, nil)
-			got := sanitizeGoldenFile(t, td, outDir)
-			golden.CheckOrUpdate(t, got)
+			td.RunVHS(t, vhsTestTypeSSH, nil)
+			output := sanitizedOutput(t, td)
+			golden.CheckOrUpdate(t, output)
 
 			userEnv := fmt.Sprintf("USER=%s", strings.ToLower(user))
 			if tc.wantNotLoggedInUser {
-				require.NotContains(t, got, userEnv, "Should not have a logged in user")
+				if strings.Contains(output, userEnv) {
+					require.Fail(t, "Tape output should not contain the logged in user name",
+						"##### Tape output #####\n%s\n##### End of tape output #####\n", output)
+				}
 
 				if userClient != nil {
 					requireNoAuthdUser(t, userClient, user)
@@ -492,7 +576,10 @@ Wait@%dms`, sshDefaultFinalWaitTimeout),
 					requireGetEntExists(t, nssLibrary, socketPath, user, tc.isLocalUser)
 				}
 			} else {
-				require.Contains(t, got, userEnv, "Logged in user does not matches")
+				if !strings.Contains(output, userEnv) {
+					require.Fail(t, "Tape output should contain the logged in user name",
+						"##### Tape output:\n%s\n##### End of tape output #####\n", output)
+				}
 
 				if userClient != nil {
 					authdUser := requireAuthdUser(t, userClient, user)
@@ -511,34 +598,28 @@ Wait@%dms`, sshDefaultFinalWaitTimeout),
 				if !tc.wantUserAlreadyExist {
 					// Check if user home has been created, but only if the user is a new one.
 					stat, err := os.Stat(userHome)
-					require.NoError(t, err, "Error checking for %q", userHome)
+					require.NoError(t, err, "Home directory does not exist: %q", userHome)
 					require.True(t, stat.IsDir(), "%q is not a directory", userHome)
 				}
 			}
 
-			if tc.wantLocalGroups || tc.oldDB != "" {
-				actualGroups, err := os.ReadFile(groupsFile)
-				require.NoError(t, err, "Failed to read the groups file")
-				golden.CheckOrUpdate(t, string(actualGroups), golden.WithSuffix(".groups"))
-			}
-
-			localgroupstestutils.RequireGPasswdOutput(t, gpasswdOutput, golden.Path(t)+".gpasswd_out")
+			localgroupstestutils.RequireGroupFile(t, groupOutput, golden.Path(t))
 		})
 	}
 }
 
-func sanitizeGoldenFile(t *testing.T, td tapeData, outDir string) string {
+func sanitizedOutput(t *testing.T, td *tapeData) string {
 	t.Helper()
 
-	golden := td.ExpectedOutput(t, outDir)
+	output := td.SanitizedOutput(t)
 
 	// When sshd is in debug mode, it shows the environment variables, so let's sanitize them
-	golden = sshEnvVariablesRegex.ReplaceAllString(golden, "  $1=$${AUTHD_TEST_$1}")
+	output = sshEnvVariablesRegex.ReplaceAllString(output, "  $1=$${AUTHD_TEST_$1}")
 
-	return sshHostPortRegex.ReplaceAllLiteralString(golden, "${SSH_HOST} port ${SSH_PORT}")
+	return sshHostPortRegex.ReplaceAllLiteralString(output, "${SSH_HOST} port ${SSH_PORT}")
 }
 
-func createSshdServiceFile(t *testing.T, module, execChild, mkHomeModule, socketPath string) string {
+func createSSHDServiceFile(t *testing.T, module, execChild, mkHomeModule, socketPath string) string {
 	t.Helper()
 
 	moduleArgs := []string{
@@ -553,15 +634,12 @@ func createSshdServiceFile(t *testing.T, module, execChild, mkHomeModule, socket
 	if env := testutils.CoverDirEnv(); env != "" {
 		moduleArgs = append(moduleArgs, "--exec-env", env)
 	}
+	if testutils.IsRace() {
+		moduleArgs = append(moduleArgs, "--exec-env", "GORACE")
+	}
 	if testutils.IsAsan() {
-		if o := os.Getenv("ASAN_OPTIONS"); o != "" {
-			moduleArgs = append(moduleArgs, "--exec-env",
-				fmt.Sprintf("ASAN_OPTIONS=%s", o))
-		}
-		if o := os.Getenv("LSAN_OPTIONS"); o != "" {
-			moduleArgs = append(moduleArgs, "--exec-env",
-				fmt.Sprintf("LSAN_OPTIONS=%s", o))
-		}
+		moduleArgs = append(moduleArgs, "--exec-env", "ASAN_OPTIONS")
+		moduleArgs = append(moduleArgs, "--exec-env", "LSAN_OPTIONS")
 	}
 
 	outDir := t.TempDir()
@@ -593,63 +671,47 @@ func createSshdServiceFile(t *testing.T, module, execChild, mkHomeModule, socket
 		{Action: pam_test.Session, Control: pam_test.Requisite, Module: pam_test.Permit.String()},
 	})
 	require.NoError(t, err, "Setup: Creation of service file %s", pamServiceName)
-	saveArtifactsForDebugOnCleanup(t, []string{serviceFile})
+	testutils.MaybeSaveFilesAsArtifactsOnCleanup(t, serviceFile)
 
 	return serviceFile
 }
 
-func startSSHdForTest(t *testing.T, serviceFile, hostKey, user string, preloadLibraries []string, env []string, daemonize bool, interactiveShell bool) (string, string) {
+func startSSHDForTest(t *testing.T, serviceFile, hostKey, user string, preloadLibraries []string, env []string, interactiveShell bool) (string, string) {
 	t.Helper()
 
 	sshdConnectCommand := fmt.Sprintf(
-		"/usr/bin/echo ' SSHD: Connected to ssh via authd module! [%s]'",
+		"/usr/bin/echo ' SSHD: Connected to ssh via authd module! [%s]' && env | sort | sed 's/^/  /'",
 		t.Name())
-	if daemonize {
-		// When in daemon mode SSH doesn't show debug infos, so let's
-		// handle this manually.
-		sshdConnectCommand += "&& env | sort | sed 's/^/  /'"
-	}
 	if interactiveShell {
-		sshdConnectCommand = "/bin/sh"
+		sshdConnectCommand += "&& /bin/sh"
 	}
 
-	homeBase := t.TempDir()
-	userHome := filepath.Join(homeBase, user)
-	sshdPort := startSSHd(t, hostKey, sshdConnectCommand, append([]string{
-		fmt.Sprintf("HOME=%s", homeBase),
+	userHome := filepath.Join(sshTestsHomeBase, user)
+	sshdPort := startSSHD(t, hostKey, sshdConnectCommand, append([]string{
+		fmt.Sprintf("HOME=%s", sshTestsHomeBase),
 		fmt.Sprintf("LD_PRELOAD=%s", strings.Join(preloadLibraries, ":")),
 		fmt.Sprintf("AUTHD_TEST_SSH_USER=%s", user),
 		fmt.Sprintf("AUTHD_TEST_SSH_HOME=%s", userHome),
 		fmt.Sprintf("AUTHD_TEST_SSH_PAM_SERVICE=%s", serviceFile),
-	}, env...), daemonize)
+	}, env...))
 
 	return sshdPort, userHome
 }
 
-func sshdCommand(t *testing.T, port, hostKey, forcedCommand string, env []string, daemonize bool) (*exec.Cmd, string, string) {
+func sshdCommand(t *testing.T, port, hostKey, forcedCommand string, env []string) (*exec.Cmd, string) {
 	t.Helper()
 
-	logFile := ""
-	pidFile := ""
-	runModeArgs := []string{"-ddd"}
-
-	if daemonize {
-		pidFile = filepath.Join(t.TempDir(), "sshd.pid")
-		logFile = filepath.Join(t.TempDir(), "sshd-daemon.log")
-		saveArtifactsForDebugOnCleanup(t, []string{logFile})
-
-		runModeArgs = []string{
-			"-E", logFile,
-			"-o", "PidFile=" + pidFile,
-			"-o", "LogLevel=DEBUG3",
-		}
-	}
+	pidFile := filepath.Join(t.TempDir(), "sshd.pid")
 
 	// #nosec:G204 - we control the command arguments in tests
 	sshd := exec.Command("/usr/sbin/sshd",
 		"-f", os.DevNull,
 		"-p", port,
 		"-h", hostKey,
+		"-D",
+		"-e",
+		"-o", "LogLevel=DEBUG3",
+		"-o", "PidFile="+pidFile,
 		"-o", "UsePAM=yes",
 		"-o", "KbdInteractiveAuthentication=yes",
 		"-o", "AuthenticationMethods=keyboard-interactive",
@@ -662,14 +724,13 @@ func sshdCommand(t *testing.T, port, hostKey, forcedCommand string, env []string
 		"-o", "ForceCommand="+forcedCommand,
 		"-o", "MaxAuthTries=1",
 	)
-	sshd.Args = append(sshd.Args, runModeArgs...)
 	sshd.Env = append(sshd.Env, env...)
 	sshd.Env = testutils.AppendCovEnv(sshd.Env)
 
-	return sshd, pidFile, logFile
+	return sshd, pidFile
 }
 
-func startSSHd(t *testing.T, hostKey, forcedCommand string, env []string, daemonize bool) string {
+func startSSHD(t *testing.T, hostKey, forcedCommand string, env []string) string {
 	t.Helper()
 
 	// We use this to easily find a free port we can use, without going random
@@ -679,28 +740,21 @@ func startSSHd(t *testing.T, hostKey, forcedCommand string, env []string, daemon
 	sshdPort := url.Port()
 	server.Close()
 
-	sshd, sshdPidFile, sshdLogFile := sshdCommand(t, sshdPort, hostKey, forcedCommand, env, daemonize)
-	sshdStderr := bytes.Buffer{}
-	sshd.Stderr = &sshdStderr
-	if testing.Verbose() {
-		sshd.Stdout = os.Stdout
-		sshd.Stderr = os.Stderr
-	}
+	sshd, sshdPidFile := sshdCommand(t, sshdPort, hostKey, forcedCommand, env)
+
+	sshdOutput := &testutils.SyncBuffer{}
+
+	// Write stdout/stderr both to our stdout/stderr and to the buffer
+	sshd.Stdout = io.MultiWriter(t.Output(), sshdOutput)
+	sshd.Stderr = io.MultiWriter(newFilteredStderrWriter(t.Output()), sshdOutput)
 
-	t.Log("Launching sshd with", sshd.Env, sshd.Args)
+	testlog.LogCommand(t, "Starting sshd", sshd)
+	start := time.Now()
 	err = sshd.Start()
 	require.NoError(t, err, "Setup: Impossible to start sshd")
 	sshdPid := sshd.Process.Pid
 
-	t.Cleanup(func() {
-		if testing.Verbose() || !t.Failed() {
-			return
-		}
-		sshdLog := filepath.Join(t.TempDir(), "sshd.log")
-		require.NoError(t, os.WriteFile(sshdLog, sshdStderr.Bytes(), 0600),
-			"TearDown: Saving sshd log")
-		saveArtifactsForDebug(t, []string{sshdLog})
-	})
+	testutils.MaybeSaveBufferAsArtifactOnCleanup(t, sshdOutput, "sshd.log")
 
 	t.Cleanup(func() {
 		if sshd.Process == nil {
@@ -710,67 +764,40 @@ func startSSHd(t *testing.T, hostKey, forcedCommand string, env []string, daemon
 		sshdExited := make(chan *os.ProcessState)
 		go func() {
 			processState, err := sshd.Process.Wait()
-			require.NoError(t, err, "TearDown: Waiting SSHd failed")
+			require.NoError(t, err, "TearDown: Waiting sshd failed")
 			sshdExited <- processState
 		}()
 
-		t.Log("Waiting for sshd to be terminated")
+		t.Log("Teardown: Waiting for sshd to be terminated")
 		select {
 		case <-time.After(sleepDuration(5 * time.Second)):
-			require.NoError(t, sshd.Process.Kill(), "TearDown: Killing SSHd failed")
-			if !testing.Verbose() {
-				t.Logf("SSHd stopped (killed)\n ##### STDERR #####\n %s \n ##### END #####",
-					sshdStderr.String())
-			}
-			t.Fatal("SSHd didn't finish in time!")
+			require.NoError(t, sshd.Process.Kill(), "TearDown: Killing sshd failed")
+			t.Fatal("sshd didn't exit in time!")
 		case state := <-sshdExited:
-			t.Logf("SSHd %v stopped (%s)!", sshdPid, state)
-			if !testing.Verbose() {
-				t.Logf("##### STDERR #####\n %s \n ##### END #####", sshdStderr.String())
-			}
-			expectedExitCode := 255
-			if daemonize {
-				expectedExitCode = 0
-			}
-			require.Equal(t, expectedExitCode, state.ExitCode(), "TearDown: SSHd exited with %s", state)
-		}
-	})
-
-	if !daemonize {
-		// Sadly we can't wait for SSHd to be ready using net.Dial, since that will make sshd
-		// (when in debug mode) not to accept further connections from the actual test, but we
-		// can assume we're good.
-		t.Logf("SSHd started with pid %d and listening on port %s", sshdPid, sshdPort)
-		return sshdPort
-	}
-
-	t.Cleanup(func() {
-		if !t.Failed() && !testutils.IsVerbose() {
-			return
+			t.Logf("sshd[%v] exited (%s)", sshdPid, state)
+			expectedExitCode := -1
+			require.Equal(t, expectedExitCode, state.ExitCode(), "TearDown: sshd exited with %s", state)
 		}
-		contents, err := os.ReadFile(sshdLogFile)
-		require.NoError(t, err, "TearDown: Reading SSHd log failed")
-		t.Logf(" ##### LOG FILE #####\n %s \n ##### END #####", contents)
 	})
 
 	t.Cleanup(func() {
 		pidFileContent, err := os.ReadFile(sshdPidFile)
-		require.NoError(t, err, "TearDown: Reading SSHd pid file failed")
+		require.NoError(t, err, "TearDown: Reading sshd pid file failed")
 		p := strings.TrimSpace(string(pidFileContent))
 		pid, err := strconv.Atoi(p)
-		require.NoError(t, err, "TearDown: Parsing SSHd pid file content: %q", p)
+		require.NoError(t, err, "TearDown: Parsing sshd pid file content: %q", p)
 		process, err := os.FindProcess(pid)
-		require.NoError(t, err, "TearDown: Finding SSHd process")
+		require.NoError(t, err, "TearDown: Finding sshd process")
 		err = process.Kill()
-		require.NoError(t, err, "TearDown: Killing SSHd process")
-		t.Logf("SSHd pid %d killed", pid)
+		require.NoError(t, err, "TearDown: Killing sshd process")
+		t.Logf("Teardown: Sent SIGKILL to sshd[%d]", pid)
 	})
 
 	sshdStarted := make(chan error)
 	go func() {
 		for {
 			conn, err := net.DialTimeout("tcp", ":"+sshdPort, sleepDuration(1*time.Second))
-			if errors.Is(err, syscall.ECONNREFUSED) {
+			if errors.Is(err, syscall.ECONNREFUSED) || errors.Is(err, syscall.ECONNRESET) {
 				continue
 			}
 			if err != nil {
@@ -794,22 +821,72 @@ func startSSHd(t *testing.T, hostKey, forcedCommand string, env []string, daemon
 	select {
 	case <-time.After(sleepDuration(5 * time.Second)):
 		_ = sshd.Process.Kill()
-		if !testing.Verbose() {
-			t.Logf("SSHd stopped (killed)\n ##### STDERR #####\n %s \n ##### END #####",
-				sshdStderr.String())
-		}
-		t.Fatal("SSHd didn't start in time!")
+		t.Fatal("sshd didn't start in time!")
 	case err := <-sshdStarted:
-		require.NoError(t, err, "Setup: SSHd startup checking failed %s",
-			sshdStderr.String())
+		require.NoError(t, err, "Setup: sshd startup checking failed")
 	}
-	require.NoError(t, err, "Setup: Waiting SSHd failed")
+	require.NoError(t, err, "Setup: Waiting sshd failed")
 
 	pidFileContent, err := os.ReadFile(sshdPidFile)
-	require.NoError(t, err, "Setup: Reading SSHd pid file failed")
+	require.NoError(t, err, "Setup: Reading sshd pid file failed")
 
-	t.Logf("SSHd started with pid %d (%s) and listening on port %s",
-		sshdPid, strings.TrimSpace(string(pidFileContent)), sshdPort)
+	duration := time.Since(start)
+	testlog.LogEndSeparatorf(t, "sshd started in %.3fs - pid: %d (%s), listen port: %s",
+		duration.Seconds(), sshdPid, strings.TrimSpace(string(pidFileContent)), sshdPort)
 
 	return sshdPort
 }
+
+type filteredStderrWriter struct {
+	w io.Writer
+}
+
+func newFilteredStderrWriter(w io.Writer) *filteredStderrWriter {
+	return &filteredStderrWriter{w: w}
+}
+
+func (fw *filteredStderrWriter) Write(p []byte) (n int, err error) {
+	debugLevel := os.Getenv("AUTHD_SSHD_STDERR_DEBUG_LEVEL")
+	if debugLevel == "" {
+		debugLevel = "1"
+	}
+
+	logAllPAMMessages := os.Getenv("AUTHD_SSHD_STDERR_LOG_ALL_PAM_MESSAGES") != ""
+
+	lines := strings.Split(string(p), "\n")
+	var outLines []string
+	for _, line := range lines {
+		// Print all PAM messages if requested
+		if logAllPAMMessages && len(line) >= 12 && strings.HasPrefix(line[8:], "PAM:") {
+			outLines = append(outLines, line)
+			continue
+		}
+
+		// Only print lines with a debug level less than or equal to the configured level
+		if strings.HasPrefix(line, "debug") {
+			switch debugLevel {
+			case "1":
+				if strings.HasPrefix(line, "debug2") || strings.HasPrefix(line, "debug3") {
+					continue
+				}
+			case "2":
+				if strings.HasPrefix(line, "debug3") {
+					continue
+				}
+			case "3":
+				// Print all debug lines
+			default:
+				// Unknown debug level, don't print any debug lines
+				continue
+			}
+		}
+		outLines = append(outLines, line)
+	}
+	out := strings.Join(outLines, "\n")
+	if out == "" {
+		return len(p), nil
+	}
+
+	_, err = fw.w.Write([]byte(out))
+	return len(p), err
+}
diff --git a/pam/integration-tests/sshd_preloader/sshd_preloader.c b/pam/integration-tests/sshd_preloader/sshd_preloader.c
index 8f8668bbd4..f6a1a0fbb5 100644
--- a/pam/integration-tests/sshd_preloader/sshd_preloader.c
+++ b/pam/integration-tests/sshd_preloader/sshd_preloader.c
@@ -18,7 +18,7 @@
 #define AUTHD_TEST_SHELL "/bin/sh"
 #define AUTHD_TEST_GECOS ""
 #define AUTHD_DEFAULT_SSH_PAM_SERVICE_NAME "sshd"
-#define AUTHD_SPECIAL_USER_ACCEPT_ALL "authd-test-user-sshd-accept-all"
+#define AUTHD_SPECIAL_USER_ACCEPT_ALL "authd-test-user-sshd-accept-all@example.com"
 
 #define SIZE_OF_ARRAY(a) (sizeof ((a)) / sizeof (*(a)))
 
@@ -33,7 +33,7 @@ static MockPasswd passwd_entities[512];
 __attribute__((constructor))
 void constructor (void)
 {
-  fprintf (stderr, "sshd_preloader [%d]: Library loaded\n", getpid ());
+  fprintf (stderr, "sshd_preloader[%d]: Library loaded\n", getpid ());
 }
 
 __attribute__((destructor))
@@ -42,7 +42,7 @@ void destructor (void)
   for (size_t i = 0; i < SIZE_OF_ARRAY (passwd_entities); ++i)
     free (passwd_entities[i].authd_name);
 
-  fprintf (stderr, "sshd_preloader [%d]: Library unloaded\n", getpid ());
+  fprintf (stderr, "sshd_preloader[%d]: Library unloaded\n", getpid ());
 }
 
 static const char *
@@ -153,7 +153,12 @@ getpwnam (const char *name)
       /* Ensure the GID we got matches the UID.
        * See: https://wiki.debian.org/UserPrivateGroups#UPGs
        */
-      assert (passwd_entity->pw_gid == passwd_entity->pw_uid);
+      if (passwd_entity->pw_uid != passwd_entity->pw_gid)
+        {
+          fprintf (stderr, "sshd_preloader[%d]: User %s has different UID and GID (%d:%d)\n",
+                   getpid (), name, passwd_entity->pw_uid, passwd_entity->pw_gid);
+          abort();
+        }
     }
   else if (!is_supported_test_fake_user (name))
     {
@@ -205,7 +210,7 @@ getpwnam (const char *name)
           mock_passwd->authd_name = n;
           passwd_entity->pw_name = mock_passwd->authd_name;
 
-          fprintf (stderr, "sshd_preloader [%d]: User %s converted to %s\n",
+          fprintf (stderr, "sshd_preloader[%d]: User %s converted to %s\n",
                   getpid (), name, passwd_entity->pw_name);
         }
     }
@@ -220,7 +225,7 @@ getpwnam (const char *name)
   passwd_entity->pw_uid = getuid ();
   passwd_entity->pw_gid = getgid ();
 
-  fprintf (stderr, "sshd_preloader [%d]: Simulating to be fake user %s (%d:%d)\n",
+  fprintf (stderr, "sshd_preloader[%d]: Simulating to be fake user %s (%d:%d)\n",
            getpid (), passwd_entity->pw_name, passwd_entity->pw_uid,
            passwd_entity->pw_gid);
 
@@ -244,7 +249,7 @@ fopen (const char *pathname, const char *mode)
   if (strcmp (pathname, "/etc/pam.d/" AUTHD_DEFAULT_SSH_PAM_SERVICE_NAME) == 0 ||
       strcmp (pathname, "/usr/lib/pam.d/" AUTHD_DEFAULT_SSH_PAM_SERVICE_NAME) == 0)
     {
-      fprintf (stderr, "sshd_preloader [%d]: Trying to open '%s', "
+      fprintf (stderr, "sshd_preloader[%d]: Trying to open '%s', "
                "but redirecting instead to '%s'\n",
                getpid (), pathname, service_path);
       pathname = service_path;
diff --git a/pam/integration-tests/testdata/TestCLIAuthenticate/Authenticate_user_successfully_after_db_migration/gpasswd.group b/pam/integration-tests/testdata/TestCLIAuthenticate/Authenticate_user_successfully_after_db_migration/gpasswd.group
deleted file mode 100644
index 58742bc372..0000000000
--- a/pam/integration-tests/testdata/TestCLIAuthenticate/Authenticate_user_successfully_after_db_migration/gpasswd.group
+++ /dev/null
@@ -1,6 +0,0 @@
-localgroup:x:41:user-integration-WITH-Mixed-CaSe,user-integration-cached,user-integration-pre-check-WITH-UPPER-CASE,user-integration-UPPER-CASE,user-pre-check
-some-group-for-user-integration-WITH-Mixed-CaSe:x:101:user-integration-WITH-Mixed-CaSe
-some-group-for-user-integration-cached:x:102:user-integration-cached
-some-group-for-user-integration-pre-check-WITH-UPPER-CASE:x:103:user-integration-pre-check-WITH-UPPER-CASE
-some-group-for-user-integration-UPPER-CASE:x:104:user-integration-UPPER-CASE
-some-group-for-user-pre-check:x:105:user-pre-check
diff --git a/pam/integration-tests/testdata/TestCLIAuthenticate/Authenticate_user_successfully_after_db_migration/groups b/pam/integration-tests/testdata/TestCLIAuthenticate/Authenticate_user_successfully_after_db_migration/groups
new file mode 100644
index 0000000000..7fe8ba8346
--- /dev/null
+++ b/pam/integration-tests/testdata/TestCLIAuthenticate/Authenticate_user_successfully_after_db_migration/groups
@@ -0,0 +1,6 @@
+localgroup:x:41:user-integration-WITH-Mixed-CaSe@example.com,user-integration-cached@example.com,user-integration-pre-check-WITH-UPPER-CASE@example.com,user-integration-UPPER-CASE@example.com,user-pre-check@example.com
+some-group-for-user-integration-WITH-Mixed-CaSe@example.com:x:101:user-integration-WITH-Mixed-CaSe@example.com
+some-group-for-user-integration-cached@example.com:x:102:user-integration-cached@example.com
+some-group-for-user-integration-pre-check-WITH-UPPER-CASE@example.com:x:103:user-integration-pre-check-WITH-UPPER-CASE@example.com
+some-group-for-user-integration-UPPER-CASE@example.com:x:104:user-integration-UPPER-CASE@example.com
+some-group-for-user-pre-check@example.com:x:105:user-pre-check@example.com
diff --git a/pam/integration-tests/testdata/TestCLIAuthenticate/Authenticate_user_with_mixed_case_after_db_migration/gpasswd.group b/pam/integration-tests/testdata/TestCLIAuthenticate/Authenticate_user_with_mixed_case_after_db_migration/gpasswd.group
deleted file mode 100644
index 58742bc372..0000000000
--- a/pam/integration-tests/testdata/TestCLIAuthenticate/Authenticate_user_with_mixed_case_after_db_migration/gpasswd.group
+++ /dev/null
@@ -1,6 +0,0 @@
-localgroup:x:41:user-integration-WITH-Mixed-CaSe,user-integration-cached,user-integration-pre-check-WITH-UPPER-CASE,user-integration-UPPER-CASE,user-pre-check
-some-group-for-user-integration-WITH-Mixed-CaSe:x:101:user-integration-WITH-Mixed-CaSe
-some-group-for-user-integration-cached:x:102:user-integration-cached
-some-group-for-user-integration-pre-check-WITH-UPPER-CASE:x:103:user-integration-pre-check-WITH-UPPER-CASE
-some-group-for-user-integration-UPPER-CASE:x:104:user-integration-UPPER-CASE
-some-group-for-user-pre-check:x:105:user-pre-check
diff --git a/pam/integration-tests/testdata/TestCLIAuthenticate/Authenticate_user_with_mixed_case_after_db_migration/groups b/pam/integration-tests/testdata/TestCLIAuthenticate/Authenticate_user_with_mixed_case_after_db_migration/groups
new file mode 100644
index 0000000000..7fe8ba8346
--- /dev/null
+++ b/pam/integration-tests/testdata/TestCLIAuthenticate/Authenticate_user_with_mixed_case_after_db_migration/groups
@@ -0,0 +1,6 @@
+localgroup:x:41:user-integration-WITH-Mixed-CaSe@example.com,user-integration-cached@example.com,user-integration-pre-check-WITH-UPPER-CASE@example.com,user-integration-UPPER-CASE@example.com,user-pre-check@example.com
+some-group-for-user-integration-WITH-Mixed-CaSe@example.com:x:101:user-integration-WITH-Mixed-CaSe@example.com
+some-group-for-user-integration-cached@example.com:x:102:user-integration-cached@example.com
+some-group-for-user-integration-pre-check-WITH-UPPER-CASE@example.com:x:103:user-integration-pre-check-WITH-UPPER-CASE@example.com
+some-group-for-user-integration-UPPER-CASE@example.com:x:104:user-integration-UPPER-CASE@example.com
+some-group-for-user-pre-check@example.com:x:105:user-pre-check@example.com
diff --git a/pam/integration-tests/testdata/TestCLIAuthenticate/Authenticate_user_with_upper_case_using_lower_case_after_db_migration/gpasswd.group b/pam/integration-tests/testdata/TestCLIAuthenticate/Authenticate_user_with_upper_case_using_lower_case_after_db_migration/gpasswd.group
deleted file mode 100644
index 58742bc372..0000000000
--- a/pam/integration-tests/testdata/TestCLIAuthenticate/Authenticate_user_with_upper_case_using_lower_case_after_db_migration/gpasswd.group
+++ /dev/null
@@ -1,6 +0,0 @@
-localgroup:x:41:user-integration-WITH-Mixed-CaSe,user-integration-cached,user-integration-pre-check-WITH-UPPER-CASE,user-integration-UPPER-CASE,user-pre-check
-some-group-for-user-integration-WITH-Mixed-CaSe:x:101:user-integration-WITH-Mixed-CaSe
-some-group-for-user-integration-cached:x:102:user-integration-cached
-some-group-for-user-integration-pre-check-WITH-UPPER-CASE:x:103:user-integration-pre-check-WITH-UPPER-CASE
-some-group-for-user-integration-UPPER-CASE:x:104:user-integration-UPPER-CASE
-some-group-for-user-pre-check:x:105:user-pre-check
diff --git a/pam/integration-tests/testdata/TestCLIAuthenticate/Authenticate_user_with_upper_case_using_lower_case_after_db_migration/groups b/pam/integration-tests/testdata/TestCLIAuthenticate/Authenticate_user_with_upper_case_using_lower_case_after_db_migration/groups
new file mode 100644
index 0000000000..7fe8ba8346
--- /dev/null
+++ b/pam/integration-tests/testdata/TestCLIAuthenticate/Authenticate_user_with_upper_case_using_lower_case_after_db_migration/groups
@@ -0,0 +1,6 @@
+localgroup:x:41:user-integration-WITH-Mixed-CaSe@example.com,user-integration-cached@example.com,user-integration-pre-check-WITH-UPPER-CASE@example.com,user-integration-UPPER-CASE@example.com,user-pre-check@example.com
+some-group-for-user-integration-WITH-Mixed-CaSe@example.com:x:101:user-integration-WITH-Mixed-CaSe@example.com
+some-group-for-user-integration-cached@example.com:x:102:user-integration-cached@example.com
+some-group-for-user-integration-pre-check-WITH-UPPER-CASE@example.com:x:103:user-integration-pre-check-WITH-UPPER-CASE@example.com
+some-group-for-user-integration-UPPER-CASE@example.com:x:104:user-integration-UPPER-CASE@example.com
+some-group-for-user-pre-check@example.com:x:105:user-pre-check@example.com
diff --git a/pam/integration-tests/testdata/TestCLIAuthenticate/gpasswd.group b/pam/integration-tests/testdata/TestCLIAuthenticate/groups
similarity index 100%
rename from pam/integration-tests/testdata/TestCLIAuthenticate/gpasswd.group
rename to pam/integration-tests/testdata/TestCLIAuthenticate/groups
diff --git a/pam/integration-tests/testdata/TestCLIChangeAuthTok/gpasswd.group b/pam/integration-tests/testdata/TestCLIChangeAuthTok/groups
similarity index 100%
rename from pam/integration-tests/testdata/TestCLIChangeAuthTok/gpasswd.group
rename to pam/integration-tests/testdata/TestCLIChangeAuthTok/groups
diff --git a/pam/integration-tests/testdata/TestGdmModule/gpasswd.group b/pam/integration-tests/testdata/TestGdmModule/groups
similarity index 100%
rename from pam/integration-tests/testdata/TestGdmModule/gpasswd.group
rename to pam/integration-tests/testdata/TestGdmModule/groups
diff --git a/pam/integration-tests/testdata/TestNativeAuthenticate/Authenticate_user_successfully_after_db_migration/gpasswd.group b/pam/integration-tests/testdata/TestNativeAuthenticate/Authenticate_user_successfully_after_db_migration/gpasswd.group
deleted file mode 100644
index 58742bc372..0000000000
--- a/pam/integration-tests/testdata/TestNativeAuthenticate/Authenticate_user_successfully_after_db_migration/gpasswd.group
+++ /dev/null
@@ -1,6 +0,0 @@
-localgroup:x:41:user-integration-WITH-Mixed-CaSe,user-integration-cached,user-integration-pre-check-WITH-UPPER-CASE,user-integration-UPPER-CASE,user-pre-check
-some-group-for-user-integration-WITH-Mixed-CaSe:x:101:user-integration-WITH-Mixed-CaSe
-some-group-for-user-integration-cached:x:102:user-integration-cached
-some-group-for-user-integration-pre-check-WITH-UPPER-CASE:x:103:user-integration-pre-check-WITH-UPPER-CASE
-some-group-for-user-integration-UPPER-CASE:x:104:user-integration-UPPER-CASE
-some-group-for-user-pre-check:x:105:user-pre-check
diff --git a/pam/integration-tests/testdata/TestNativeAuthenticate/Authenticate_user_successfully_after_db_migration/groups b/pam/integration-tests/testdata/TestNativeAuthenticate/Authenticate_user_successfully_after_db_migration/groups
new file mode 100644
index 0000000000..7fe8ba8346
--- /dev/null
+++ b/pam/integration-tests/testdata/TestNativeAuthenticate/Authenticate_user_successfully_after_db_migration/groups
@@ -0,0 +1,6 @@
+localgroup:x:41:user-integration-WITH-Mixed-CaSe@example.com,user-integration-cached@example.com,user-integration-pre-check-WITH-UPPER-CASE@example.com,user-integration-UPPER-CASE@example.com,user-pre-check@example.com
+some-group-for-user-integration-WITH-Mixed-CaSe@example.com:x:101:user-integration-WITH-Mixed-CaSe@example.com
+some-group-for-user-integration-cached@example.com:x:102:user-integration-cached@example.com
+some-group-for-user-integration-pre-check-WITH-UPPER-CASE@example.com:x:103:user-integration-pre-check-WITH-UPPER-CASE@example.com
+some-group-for-user-integration-UPPER-CASE@example.com:x:104:user-integration-UPPER-CASE@example.com
+some-group-for-user-pre-check@example.com:x:105:user-pre-check@example.com
diff --git a/pam/integration-tests/testdata/TestNativeAuthenticate/Authenticate_user_with_mixed_case_after_db_migration/gpasswd.group b/pam/integration-tests/testdata/TestNativeAuthenticate/Authenticate_user_with_mixed_case_after_db_migration/gpasswd.group
deleted file mode 100644
index 58742bc372..0000000000
--- a/pam/integration-tests/testdata/TestNativeAuthenticate/Authenticate_user_with_mixed_case_after_db_migration/gpasswd.group
+++ /dev/null
@@ -1,6 +0,0 @@
-localgroup:x:41:user-integration-WITH-Mixed-CaSe,user-integration-cached,user-integration-pre-check-WITH-UPPER-CASE,user-integration-UPPER-CASE,user-pre-check
-some-group-for-user-integration-WITH-Mixed-CaSe:x:101:user-integration-WITH-Mixed-CaSe
-some-group-for-user-integration-cached:x:102:user-integration-cached
-some-group-for-user-integration-pre-check-WITH-UPPER-CASE:x:103:user-integration-pre-check-WITH-UPPER-CASE
-some-group-for-user-integration-UPPER-CASE:x:104:user-integration-UPPER-CASE
-some-group-for-user-pre-check:x:105:user-pre-check
diff --git a/pam/integration-tests/testdata/TestNativeAuthenticate/Authenticate_user_with_mixed_case_after_db_migration/groups b/pam/integration-tests/testdata/TestNativeAuthenticate/Authenticate_user_with_mixed_case_after_db_migration/groups
new file mode 100644
index 0000000000..7fe8ba8346
--- /dev/null
+++ b/pam/integration-tests/testdata/TestNativeAuthenticate/Authenticate_user_with_mixed_case_after_db_migration/groups
@@ -0,0 +1,6 @@
+localgroup:x:41:user-integration-WITH-Mixed-CaSe@example.com,user-integration-cached@example.com,user-integration-pre-check-WITH-UPPER-CASE@example.com,user-integration-UPPER-CASE@example.com,user-pre-check@example.com
+some-group-for-user-integration-WITH-Mixed-CaSe@example.com:x:101:user-integration-WITH-Mixed-CaSe@example.com
+some-group-for-user-integration-cached@example.com:x:102:user-integration-cached@example.com
+some-group-for-user-integration-pre-check-WITH-UPPER-CASE@example.com:x:103:user-integration-pre-check-WITH-UPPER-CASE@example.com
+some-group-for-user-integration-UPPER-CASE@example.com:x:104:user-integration-UPPER-CASE@example.com
+some-group-for-user-pre-check@example.com:x:105:user-pre-check@example.com
diff --git a/pam/integration-tests/testdata/TestNativeAuthenticate/Authenticate_user_with_upper_case_using_lower_case_after_db_migration/gpasswd.group b/pam/integration-tests/testdata/TestNativeAuthenticate/Authenticate_user_with_upper_case_using_lower_case_after_db_migration/gpasswd.group
deleted file mode 100644
index 58742bc372..0000000000
--- a/pam/integration-tests/testdata/TestNativeAuthenticate/Authenticate_user_with_upper_case_using_lower_case_after_db_migration/gpasswd.group
+++ /dev/null
@@ -1,6 +0,0 @@
-localgroup:x:41:user-integration-WITH-Mixed-CaSe,user-integration-cached,user-integration-pre-check-WITH-UPPER-CASE,user-integration-UPPER-CASE,user-pre-check
-some-group-for-user-integration-WITH-Mixed-CaSe:x:101:user-integration-WITH-Mixed-CaSe
-some-group-for-user-integration-cached:x:102:user-integration-cached
-some-group-for-user-integration-pre-check-WITH-UPPER-CASE:x:103:user-integration-pre-check-WITH-UPPER-CASE
-some-group-for-user-integration-UPPER-CASE:x:104:user-integration-UPPER-CASE
-some-group-for-user-pre-check:x:105:user-pre-check
diff --git a/pam/integration-tests/testdata/TestNativeAuthenticate/Authenticate_user_with_upper_case_using_lower_case_after_db_migration/groups b/pam/integration-tests/testdata/TestNativeAuthenticate/Authenticate_user_with_upper_case_using_lower_case_after_db_migration/groups
new file mode 100644
index 0000000000..7fe8ba8346
--- /dev/null
+++ b/pam/integration-tests/testdata/TestNativeAuthenticate/Authenticate_user_with_upper_case_using_lower_case_after_db_migration/groups
@@ -0,0 +1,6 @@
+localgroup:x:41:user-integration-WITH-Mixed-CaSe@example.com,user-integration-cached@example.com,user-integration-pre-check-WITH-UPPER-CASE@example.com,user-integration-UPPER-CASE@example.com,user-pre-check@example.com
+some-group-for-user-integration-WITH-Mixed-CaSe@example.com:x:101:user-integration-WITH-Mixed-CaSe@example.com
+some-group-for-user-integration-cached@example.com:x:102:user-integration-cached@example.com
+some-group-for-user-integration-pre-check-WITH-UPPER-CASE@example.com:x:103:user-integration-pre-check-WITH-UPPER-CASE@example.com
+some-group-for-user-integration-UPPER-CASE@example.com:x:104:user-integration-UPPER-CASE@example.com
+some-group-for-user-pre-check@example.com:x:105:user-pre-check@example.com
diff --git a/pam/integration-tests/testdata/TestNativeAuthenticate/gpasswd.group b/pam/integration-tests/testdata/TestNativeAuthenticate/groups
similarity index 100%
rename from pam/integration-tests/testdata/TestNativeAuthenticate/gpasswd.group
rename to pam/integration-tests/testdata/TestNativeAuthenticate/groups
diff --git a/pam/integration-tests/testdata/TestNativeChangeAuthTok/gpasswd.group b/pam/integration-tests/testdata/TestNativeChangeAuthTok/groups
similarity index 100%
rename from pam/integration-tests/testdata/TestNativeChangeAuthTok/gpasswd.group
rename to pam/integration-tests/testdata/TestNativeChangeAuthTok/groups
diff --git a/pam/integration-tests/testdata/TestSSHAuthenticate/Authenticate_user_successfully_after_db_migration/gpasswd.group b/pam/integration-tests/testdata/TestSSHAuthenticate/Authenticate_user_successfully_after_db_migration/gpasswd.group
deleted file mode 100644
index 58742bc372..0000000000
--- a/pam/integration-tests/testdata/TestSSHAuthenticate/Authenticate_user_successfully_after_db_migration/gpasswd.group
+++ /dev/null
@@ -1,6 +0,0 @@
-localgroup:x:41:user-integration-WITH-Mixed-CaSe,user-integration-cached,user-integration-pre-check-WITH-UPPER-CASE,user-integration-UPPER-CASE,user-pre-check
-some-group-for-user-integration-WITH-Mixed-CaSe:x:101:user-integration-WITH-Mixed-CaSe
-some-group-for-user-integration-cached:x:102:user-integration-cached
-some-group-for-user-integration-pre-check-WITH-UPPER-CASE:x:103:user-integration-pre-check-WITH-UPPER-CASE
-some-group-for-user-integration-UPPER-CASE:x:104:user-integration-UPPER-CASE
-some-group-for-user-pre-check:x:105:user-pre-check
diff --git a/pam/integration-tests/testdata/TestSSHAuthenticate/Authenticate_user_successfully_after_db_migration/groups b/pam/integration-tests/testdata/TestSSHAuthenticate/Authenticate_user_successfully_after_db_migration/groups
new file mode 100644
index 0000000000..7fe8ba8346
--- /dev/null
+++ b/pam/integration-tests/testdata/TestSSHAuthenticate/Authenticate_user_successfully_after_db_migration/groups
@@ -0,0 +1,6 @@
+localgroup:x:41:user-integration-WITH-Mixed-CaSe@example.com,user-integration-cached@example.com,user-integration-pre-check-WITH-UPPER-CASE@example.com,user-integration-UPPER-CASE@example.com,user-pre-check@example.com
+some-group-for-user-integration-WITH-Mixed-CaSe@example.com:x:101:user-integration-WITH-Mixed-CaSe@example.com
+some-group-for-user-integration-cached@example.com:x:102:user-integration-cached@example.com
+some-group-for-user-integration-pre-check-WITH-UPPER-CASE@example.com:x:103:user-integration-pre-check-WITH-UPPER-CASE@example.com
+some-group-for-user-integration-UPPER-CASE@example.com:x:104:user-integration-UPPER-CASE@example.com
+some-group-for-user-pre-check@example.com:x:105:user-pre-check@example.com
diff --git a/pam/integration-tests/testdata/TestSSHAuthenticate/Authenticate_user_successfully_after_db_migration_on_shared_SSHd b/pam/integration-tests/testdata/TestSSHAuthenticate/Authenticate_user_successfully_after_db_migration_with_shared_sshd
similarity index 100%
rename from pam/integration-tests/testdata/TestSSHAuthenticate/Authenticate_user_successfully_after_db_migration_on_shared_SSHd
rename to pam/integration-tests/testdata/TestSSHAuthenticate/Authenticate_user_successfully_after_db_migration_with_shared_sshd
diff --git a/pam/integration-tests/testdata/TestSSHAuthenticate/Authenticate_user_with_mixed_case_after_db_migration/gpasswd.group b/pam/integration-tests/testdata/TestSSHAuthenticate/Authenticate_user_with_mixed_case_after_db_migration/gpasswd.group
deleted file mode 100644
index 58742bc372..0000000000
--- a/pam/integration-tests/testdata/TestSSHAuthenticate/Authenticate_user_with_mixed_case_after_db_migration/gpasswd.group
+++ /dev/null
@@ -1,6 +0,0 @@
-localgroup:x:41:user-integration-WITH-Mixed-CaSe,user-integration-cached,user-integration-pre-check-WITH-UPPER-CASE,user-integration-UPPER-CASE,user-pre-check
-some-group-for-user-integration-WITH-Mixed-CaSe:x:101:user-integration-WITH-Mixed-CaSe
-some-group-for-user-integration-cached:x:102:user-integration-cached
-some-group-for-user-integration-pre-check-WITH-UPPER-CASE:x:103:user-integration-pre-check-WITH-UPPER-CASE
-some-group-for-user-integration-UPPER-CASE:x:104:user-integration-UPPER-CASE
-some-group-for-user-pre-check:x:105:user-pre-check
diff --git a/pam/integration-tests/testdata/TestSSHAuthenticate/Authenticate_user_with_mixed_case_after_db_migration/groups b/pam/integration-tests/testdata/TestSSHAuthenticate/Authenticate_user_with_mixed_case_after_db_migration/groups
new file mode 100644
index 0000000000..7fe8ba8346
--- /dev/null
+++ b/pam/integration-tests/testdata/TestSSHAuthenticate/Authenticate_user_with_mixed_case_after_db_migration/groups
@@ -0,0 +1,6 @@
+localgroup:x:41:user-integration-WITH-Mixed-CaSe@example.com,user-integration-cached@example.com,user-integration-pre-check-WITH-UPPER-CASE@example.com,user-integration-UPPER-CASE@example.com,user-pre-check@example.com
+some-group-for-user-integration-WITH-Mixed-CaSe@example.com:x:101:user-integration-WITH-Mixed-CaSe@example.com
+some-group-for-user-integration-cached@example.com:x:102:user-integration-cached@example.com
+some-group-for-user-integration-pre-check-WITH-UPPER-CASE@example.com:x:103:user-integration-pre-check-WITH-UPPER-CASE@example.com
+some-group-for-user-integration-UPPER-CASE@example.com:x:104:user-integration-UPPER-CASE@example.com
+some-group-for-user-pre-check@example.com:x:105:user-pre-check@example.com
diff --git a/pam/integration-tests/testdata/TestSSHAuthenticate/Authenticate_user_with_mixed_case_after_db_migration_on_shared_SSHd b/pam/integration-tests/testdata/TestSSHAuthenticate/Authenticate_user_with_mixed_case_after_db_migration_with_shared_sshd
similarity index 100%
rename from pam/integration-tests/testdata/TestSSHAuthenticate/Authenticate_user_with_mixed_case_after_db_migration_on_shared_SSHd
rename to pam/integration-tests/testdata/TestSSHAuthenticate/Authenticate_user_with_mixed_case_after_db_migration_with_shared_sshd
diff --git a/pam/integration-tests/testdata/TestSSHAuthenticate/Authenticate_user_with_upper_case_using_lower_case_after_db_migration/gpasswd.group b/pam/integration-tests/testdata/TestSSHAuthenticate/Authenticate_user_with_upper_case_using_lower_case_after_db_migration/gpasswd.group
deleted file mode 100644
index 58742bc372..0000000000
--- a/pam/integration-tests/testdata/TestSSHAuthenticate/Authenticate_user_with_upper_case_using_lower_case_after_db_migration/gpasswd.group
+++ /dev/null
@@ -1,6 +0,0 @@
-localgroup:x:41:user-integration-WITH-Mixed-CaSe,user-integration-cached,user-integration-pre-check-WITH-UPPER-CASE,user-integration-UPPER-CASE,user-pre-check
-some-group-for-user-integration-WITH-Mixed-CaSe:x:101:user-integration-WITH-Mixed-CaSe
-some-group-for-user-integration-cached:x:102:user-integration-cached
-some-group-for-user-integration-pre-check-WITH-UPPER-CASE:x:103:user-integration-pre-check-WITH-UPPER-CASE
-some-group-for-user-integration-UPPER-CASE:x:104:user-integration-UPPER-CASE
-some-group-for-user-pre-check:x:105:user-pre-check
diff --git a/pam/integration-tests/testdata/TestSSHAuthenticate/Authenticate_user_with_upper_case_using_lower_case_after_db_migration/groups b/pam/integration-tests/testdata/TestSSHAuthenticate/Authenticate_user_with_upper_case_using_lower_case_after_db_migration/groups
new file mode 100644
index 0000000000..7fe8ba8346
--- /dev/null
+++ b/pam/integration-tests/testdata/TestSSHAuthenticate/Authenticate_user_with_upper_case_using_lower_case_after_db_migration/groups
@@ -0,0 +1,6 @@
+localgroup:x:41:user-integration-WITH-Mixed-CaSe@example.com,user-integration-cached@example.com,user-integration-pre-check-WITH-UPPER-CASE@example.com,user-integration-UPPER-CASE@example.com,user-pre-check@example.com
+some-group-for-user-integration-WITH-Mixed-CaSe@example.com:x:101:user-integration-WITH-Mixed-CaSe@example.com
+some-group-for-user-integration-cached@example.com:x:102:user-integration-cached@example.com
+some-group-for-user-integration-pre-check-WITH-UPPER-CASE@example.com:x:103:user-integration-pre-check-WITH-UPPER-CASE@example.com
+some-group-for-user-integration-UPPER-CASE@example.com:x:104:user-integration-UPPER-CASE@example.com
+some-group-for-user-pre-check@example.com:x:105:user-pre-check@example.com
diff --git a/pam/integration-tests/testdata/TestSSHAuthenticate/Authenticate_user_with_upper_case_using_lower_case_after_db_migration_on_shared_SSHd b/pam/integration-tests/testdata/TestSSHAuthenticate/Authenticate_user_with_upper_case_using_lower_case_after_db_migration_with_shared_sshd
similarity index 100%
rename from pam/integration-tests/testdata/TestSSHAuthenticate/Authenticate_user_with_upper_case_using_lower_case_after_db_migration_on_shared_SSHd
rename to pam/integration-tests/testdata/TestSSHAuthenticate/Authenticate_user_with_upper_case_using_lower_case_after_db_migration_with_shared_sshd
diff --git a/pam/integration-tests/testdata/TestSSHAuthenticate/gpasswd.group b/pam/integration-tests/testdata/TestSSHAuthenticate/groups
similarity index 100%
rename from pam/integration-tests/testdata/TestSSHAuthenticate/gpasswd.group
rename to pam/integration-tests/testdata/TestSSHAuthenticate/groups
diff --git a/pam/integration-tests/testdata/db/authd_0.4.1_bbolt_with_mixed_case_users.db.yaml b/pam/integration-tests/testdata/db/authd_0.4.1_bbolt_with_mixed_case_users.db.yaml
index 5417dcf389..105f1560cb 100644
--- a/pam/integration-tests/testdata/db/authd_0.4.1_bbolt_with_mixed_case_users.db.yaml
+++ b/pam/integration-tests/testdata/db/authd_0.4.1_bbolt_with_mixed_case_users.db.yaml
@@ -1,90 +1,90 @@
 GroupByID:
-    "1060856841": '{"Name":"user-local-groups-UPPER-CASE","GID":1060856841,"UGID":"user-local-groups-UPPER-CASE"}'
-    "1100583035": '{"Name":"user-integration-WITH-Mixed-CaSe","GID":1100583035,"UGID":"user-integration-WITH-Mixed-CaSe"}'
-    "1118334210": '{"Name":"group-user-pre-check","GID":1118334210,"UGID":"ugid-user-pre-check"}'
-    "1127261046": '{"Name":"group-user-local-groups-lower-case","GID":1127261046,"UGID":"ugid-user-local-groups-lower-case"}'
-    "1147556396": '{"Name":"group-user-integration-cached","GID":1147556396,"UGID":"ugid-user-integration-cached"}'
-    "1204499006": '{"Name":"user-integration-pre-check-WITH-UPPER-CASE","GID":1204499006,"UGID":"user-integration-pre-check-WITH-UPPER-CASE"}'
-    "1305862567": '{"Name":"user-integration-cached","GID":1305862567,"UGID":"user-integration-cached"}'
-    "1308355719": '{"Name":"group-user-integration-WITH-Mixed-CaSe","GID":1308355719,"UGID":"ugid-user-integration-with-mixed-case"}'
-    "1308629880": '{"Name":"user-pre-check","GID":1308629880,"UGID":"user-pre-check"}'
-    "1485242865": '{"Name":"group-user-integration-pre-check-WITH-UPPER-CASE","GID":1485242865,"UGID":"ugid-user-integration-pre-check-WITH-UPPER-CASE"}'
-    "1637945796": '{"Name":"group-user-local-groups-UPPER-CASE","GID":1637945796,"UGID":"ugid-user-local-groups-UPPER-CASE"}'
-    "1722096224": '{"Name":"user-local-groups-lower-case","GID":1722096224,"UGID":"user-local-groups-lower-case"}'
-    "1726859569": '{"Name":"group-user-integration-UPPER-CASE","GID":1726859569,"UGID":"ugid-user-integration-upper-case"}'
-    "1888170398": '{"Name":"group-user-local-groups-Mixed-Case","GID":1888170398,"UGID":"ugid-user-local-groups-Mixed-Case"}'
-    "1926585439": '{"Name":"user-integration-UPPER-CASE","GID":1926585439,"UGID":"user-integration-UPPER-CASE"}'
-    "1974061242": '{"Name":"user-local-groups-Mixed-Case","GID":1974061242,"UGID":"user-local-groups-Mixed-Case"}'
+    "1674497680": '{"Name":"user-local-groups-UPPER-CASE@example.com","GID":1674497680,"UGID":"user-local-groups-UPPER-CASE@example.com"}'
+    "1031497592": '{"Name":"user-integration-WITH-Mixed-CaSe@example.com","GID":1031497592,"UGID":"user-integration-WITH-Mixed-CaSe@example.com"}'
+    "1118334210": '{"Name":"group-user-pre-check@example.com","GID":1118334210,"UGID":"ugid-user-pre-check@example.com"}'
+    "1127261046": '{"Name":"group-user-local-groups-lower-case@example.com","GID":1127261046,"UGID":"ugid-user-local-groups-lower-case@example.com"}'
+    "1147556396": '{"Name":"group-user-integration-cached@example.com","GID":1147556396,"UGID":"ugid-user-integration-cached@example.com"}'
+    "1668487632": '{"Name":"user-integration-pre-check-WITH-UPPER-CASE@example.com","GID":1668487632,"UGID":"user-integration-pre-check-WITH-UPPER-CASE@example.com"}'
+    "1448654198": '{"Name":"user-integration-cached@example.com","GID":1448654198,"UGID":"user-integration-cached@example.com"}'
+    "1308355719": '{"Name":"group-user-integration-WITH-Mixed-CaSe@example.com","GID":1308355719,"UGID":"ugid-user-integration-with-mixed-case@example.com"}'
+    "1974679960": '{"Name":"user-pre-check@example.com","GID":1974679960,"UGID":"user-pre-check@example.com"}'
+    "1485242865": '{"Name":"group-user-integration-pre-check-WITH-UPPER-CASE@example.com","GID":1485242865,"UGID":"ugid-user-integration-pre-check-WITH-UPPER-CASE@example.com"}'
+    "1637945796": '{"Name":"group-user-local-groups-UPPER-CASE@example.com","GID":1637945796,"UGID":"ugid-user-local-groups-UPPER-CASE@example.com"}'
+    "1690031958": '{"Name":"user-local-groups-lower-case@example.com","GID":1690031958,"UGID":"user-local-groups-lower-case@example.com"}'
+    "1726859569": '{"Name":"group-user-integration-UPPER-CASE@example.com","GID":1726859569,"UGID":"ugid-user-integration-upper-case@example.com"}'
+    "1888170398": '{"Name":"group-user-local-groups-Mixed-Case@example.com","GID":1888170398,"UGID":"ugid-user-local-groups-Mixed-Case@example.com"}'
+    "1911746559": '{"Name":"user-integration-UPPER-CASE@example.com","GID":1911746559,"UGID":"user-integration-UPPER-CASE@example.com"}'
+    "1047623009": '{"Name":"user-local-groups-Mixed-Case@example.com","GID":1047623009,"UGID":"user-local-groups-Mixed-Case@example.com"}'
 GroupByName:
-    group-user-integration-UPPER-CASE: '{"Name":"group-user-integration-UPPER-CASE","GID":1726859569,"UGID":"ugid-user-integration-upper-case"}'
-    group-user-integration-WITH-Mixed-CaSe: '{"Name":"group-user-integration-WITH-Mixed-CaSe","GID":1308355719,"UGID":"ugid-user-integration-with-mixed-case"}'
-    group-user-integration-cached: '{"Name":"group-user-integration-cached","GID":1147556396,"UGID":"ugid-user-integration-cached"}'
-    group-user-integration-pre-check-WITH-UPPER-CASE: '{"Name":"group-user-integration-pre-check-WITH-UPPER-CASE","GID":1485242865,"UGID":"ugid-user-integration-pre-check-WITH-UPPER-CASE"}'
-    group-user-local-groups-Mixed-Case: '{"Name":"group-user-local-groups-Mixed-Case","GID":1888170398,"UGID":"ugid-user-local-groups-Mixed-Case"}'
-    group-user-local-groups-UPPER-CASE: '{"Name":"group-user-local-groups-UPPER-CASE","GID":1637945796,"UGID":"ugid-user-local-groups-UPPER-CASE"}'
-    group-user-local-groups-lower-case: '{"Name":"group-user-local-groups-lower-case","GID":1127261046,"UGID":"ugid-user-local-groups-lower-case"}'
-    group-user-pre-check: '{"Name":"group-user-pre-check","GID":1118334210,"UGID":"ugid-user-pre-check"}'
-    user-integration-UPPER-CASE: '{"Name":"user-integration-UPPER-CASE","GID":1926585439,"UGID":"user-integration-UPPER-CASE"}'
-    user-integration-WITH-Mixed-CaSe: '{"Name":"user-integration-WITH-Mixed-CaSe","GID":1100583035,"UGID":"user-integration-WITH-Mixed-CaSe"}'
-    user-integration-cached: '{"Name":"user-integration-cached","GID":1305862567,"UGID":"user-integration-cached"}'
-    user-integration-pre-check-WITH-UPPER-CASE: '{"Name":"user-integration-pre-check-WITH-UPPER-CASE","GID":1204499006,"UGID":"user-integration-pre-check-WITH-UPPER-CASE"}'
-    user-local-groups-Mixed-Case: '{"Name":"user-local-groups-Mixed-Case","GID":1974061242,"UGID":"user-local-groups-Mixed-Case"}'
-    user-local-groups-UPPER-CASE: '{"Name":"user-local-groups-UPPER-CASE","GID":1060856841,"UGID":"user-local-groups-UPPER-CASE"}'
-    user-local-groups-lower-case: '{"Name":"user-local-groups-lower-case","GID":1722096224,"UGID":"user-local-groups-lower-case"}'
-    user-pre-check: '{"Name":"user-pre-check","GID":1308629880,"UGID":"user-pre-check"}'
+    group-user-integration-UPPER-CASE@example.com: '{"Name":"group-user-integration-UPPER-CASE@example.com","GID":1726859569,"UGID":"ugid-user-integration-upper-case@example.com"}'
+    group-user-integration-WITH-Mixed-CaSe@example.com: '{"Name":"group-user-integration-WITH-Mixed-CaSe@example.com","GID":1308355719,"UGID":"ugid-user-integration-with-mixed-case@example.com"}'
+    group-user-integration-cached@example.com: '{"Name":"group-user-integration-cached@example.com","GID":1147556396,"UGID":"ugid-user-integration-cached@example.com"}'
+    group-user-integration-pre-check-WITH-UPPER-CASE@example.com: '{"Name":"group-user-integration-pre-check-WITH-UPPER-CASE@example.com","GID":1485242865,"UGID":"ugid-user-integration-pre-check-WITH-UPPER-CASE@example.com"}'
+    group-user-local-groups-Mixed-Case@example.com: '{"Name":"group-user-local-groups-Mixed-Case@example.com","GID":1888170398,"UGID":"ugid-user-local-groups-Mixed-Case@example.com"}'
+    group-user-local-groups-UPPER-CASE@example.com: '{"Name":"group-user-local-groups-UPPER-CASE@example.com","GID":1637945796,"UGID":"ugid-user-local-groups-UPPER-CASE@example.com"}'
+    group-user-local-groups-lower-case@example.com: '{"Name":"group-user-local-groups-lower-case@example.com","GID":1127261046,"UGID":"ugid-user-local-groups-lower-case@example.com"}'
+    group-user-pre-check@example.com: '{"Name":"group-user-pre-check@example.com","GID":1118334210,"UGID":"ugid-user-pre-check@example.com"}'
+    user-integration-UPPER-CASE@example.com: '{"Name":"user-integration-UPPER-CASE@example.com","GID":1911746559,"UGID":"user-integration-UPPER-CASE@example.com"}'
+    user-integration-WITH-Mixed-CaSe@example.com: '{"Name":"user-integration-WITH-Mixed-CaSe@example.com","GID":1031497592,"UGID":"user-integration-WITH-Mixed-CaSe@example.com"}'
+    user-integration-cached@example.com: '{"Name":"user-integration-cached@example.com","GID":1448654198,"UGID":"user-integration-cached@example.com"}'
+    user-integration-pre-check-WITH-UPPER-CASE@example.com: '{"Name":"user-integration-pre-check-WITH-UPPER-CASE@example.com","GID":1668487632,"UGID":"user-integration-pre-check-WITH-UPPER-CASE@example.com"}'
+    user-local-groups-Mixed-Case@example.com: '{"Name":"user-local-groups-Mixed-Case@example.com","GID":1047623009,"UGID":"user-local-groups-Mixed-Case@example.com"}'
+    user-local-groups-UPPER-CASE@example.com: '{"Name":"user-local-groups-UPPER-CASE@example.com","GID":1674497680,"UGID":"user-local-groups-UPPER-CASE@example.com"}'
+    user-local-groups-lower-case@example.com: '{"Name":"user-local-groups-lower-case@example.com","GID":1690031958,"UGID":"user-local-groups-lower-case@example.com"}'
+    user-pre-check@example.com: '{"Name":"user-pre-check@example.com","GID":1974679960,"UGID":"user-pre-check@example.com"}'
 
 GroupByUGID:
-    ugid-user-integration-upper-case: '{"Name":"group-user-integration-UPPER-CASE","GID":1726859569,"UGID":"ugid-user-integration-upper-case"}'
-    ugid-user-integration-with-mixed-case: '{"Name":"group-user-integration-WITH-Mixed-CaSe","GID":1308355719,"UGID":"ugid-user-integration-with-mixed-case"}'
-    ugid-user-integration-cached: '{"Name":"group-user-integration-cached","GID":1147556396,"UGID":"ugid-user-integration-cached"}'
-    ugid-user-integration-pre-check-WITH-UPPER-CASE: '{"Name":"group-user-integration-pre-check-WITH-UPPER-CASE","GID":1485242865,"UGID":"ugid-user-integration-pre-check-WITH-UPPER-CASE"}'
-    ugid-user-local-groups-Mixed-Case: '{"Name":"group-user-local-groups-Mixed-Case","GID":1888170398,"UGID":"ugid-user-local-groups-Mixed-Case"}'
-    ugid-user-local-groups-UPPER-CASE: '{"Name":"group-user-local-groups-UPPER-CASE","GID":1637945796,"UGID":"ugid-user-local-groups-UPPER-CASE"}'
-    ugid-user-local-groups-lower-case: '{"Name":"group-user-local-groups-lower-case","GID":1127261046,"UGID":"ugid-user-local-groups-lower-case"}'
-    ugid-user-pre-check: '{"Name":"group-user-pre-check","GID":1118334210,"UGID":"ugid-user-pre-check"}'
-    user-integration-UPPER-CASE: '{"Name":"user-integration-UPPER-CASE","GID":1926585439,"UGID":"user-integration-UPPER-CASE"}'
-    user-integration-WITH-Mixed-CaSe: '{"Name":"user-integration-WITH-Mixed-CaSe","GID":1100583035,"UGID":"user-integration-WITH-Mixed-CaSe"}'
-    user-integration-cached: '{"Name":"user-integration-cached","GID":1305862567,"UGID":"user-integration-cached"}'
-    user-integration-pre-check-WITH-UPPER-CASE: '{"Name":"user-integration-pre-check-WITH-UPPER-CASE","GID":1204499006,"UGID":"user-integration-pre-check-WITH-UPPER-CASE"}'
-    user-local-groups-Mixed-Case: '{"Name":"user-local-groups-Mixed-Case","GID":1974061242,"UGID":"user-local-groups-Mixed-Case"}'
-    user-local-groups-UPPER-CASE: '{"Name":"user-local-groups-UPPER-CASE","GID":1060856841,"UGID":"user-local-groups-UPPER-CASE"}'
-    user-local-groups-lower-case: '{"Name":"user-local-groups-lower-case","GID":1722096224,"UGID":"user-local-groups-lower-case"}'
-    user-pre-check: '{"Name":"user-pre-check","GID":1308629880,"UGID":"user-pre-check"}'
+    ugid-user-integration-upper-case@example.com: '{"Name":"group-user-integration-UPPER-CASE@example.com","GID":1726859569,"UGID":"ugid-user-integration-upper-case@example.com"}'
+    ugid-user-integration-with-mixed-case@example.com: '{"Name":"group-user-integration-WITH-Mixed-CaSe@example.com","GID":1308355719,"UGID":"ugid-user-integration-with-mixed-case@example.com"}'
+    ugid-user-integration-cached@example.com: '{"Name":"group-user-integration-cached@example.com","GID":1147556396,"UGID":"ugid-user-integration-cached@example.com"}'
+    ugid-user-integration-pre-check-WITH-UPPER-CASE@example.com: '{"Name":"group-user-integration-pre-check-WITH-UPPER-CASE@example.com","GID":1485242865,"UGID":"ugid-user-integration-pre-check-WITH-UPPER-CASE@example.com"}'
+    ugid-user-local-groups-Mixed-Case@example.com: '{"Name":"group-user-local-groups-Mixed-Case@example.com","GID":1888170398,"UGID":"ugid-user-local-groups-Mixed-Case@example.com"}'
+    ugid-user-local-groups-UPPER-CASE@example.com: '{"Name":"group-user-local-groups-UPPER-CASE@example.com","GID":1637945796,"UGID":"ugid-user-local-groups-UPPER-CASE@example.com"}'
+    ugid-user-local-groups-lower-case@example.com: '{"Name":"group-user-local-groups-lower-case@example.com","GID":1127261046,"UGID":"ugid-user-local-groups-lower-case@example.com"}'
+    ugid-user-pre-check@example.com: '{"Name":"group-user-pre-check@example.com","GID":1118334210,"UGID":"ugid-user-pre-check@example.com"}'
+    user-integration-UPPER-CASE@example.com: '{"Name":"user-integration-UPPER-CASE@example.com","GID":1911746559,"UGID":"user-integration-UPPER-CASE@example.com"}'
+    user-integration-WITH-Mixed-CaSe@example.com: '{"Name":"user-integration-WITH-Mixed-CaSe@example.com","GID":1031497592,"UGID":"user-integration-WITH-Mixed-CaSe@example.com"}'
+    user-integration-cached@example.com: '{"Name":"user-integration-cached@example.com","GID":1448654198,"UGID":"user-integration-cached@example.com"}'
+    user-integration-pre-check-WITH-UPPER-CASE@example.com: '{"Name":"user-integration-pre-check-WITH-UPPER-CASE@example.com","GID":1668487632,"UGID":"user-integration-pre-check-WITH-UPPER-CASE@example.com"}'
+    user-local-groups-Mixed-Case@example.com: '{"Name":"user-local-groups-Mixed-Case@example.com","GID":1047623009,"UGID":"user-local-groups-Mixed-Case@example.com"}'
+    user-local-groups-UPPER-CASE@example.com: '{"Name":"user-local-groups-UPPER-CASE@example.com","GID":1674497680,"UGID":"user-local-groups-UPPER-CASE@example.com"}'
+    user-local-groups-lower-case@example.com: '{"Name":"user-local-groups-lower-case@example.com","GID":1690031958,"UGID":"user-local-groups-lower-case@example.com"}'
+    user-pre-check@example.com: '{"Name":"user-pre-check@example.com","GID":1974679960,"UGID":"user-pre-check@example.com"}'
 GroupToUsers:
-    "1060856841": '{"GID":1060856841,"UIDs":[1674497680]}'
-    "1100583035": '{"GID":1100583035,"UIDs":[1031497592]}'
+    "1674497680": '{"GID":1674497680,"UIDs":[1674497680]}'
+    "1031497592": '{"GID":1031497592,"UIDs":[1031497592]}'
     "1118334210": '{"GID":1118334210,"UIDs":[1974679960]}'
     "1127261046": '{"GID":1127261046,"UIDs":[1690031958]}'
     "1147556396": '{"GID":1147556396,"UIDs":[1448654198]}'
-    "1204499006": '{"GID":1204499006,"UIDs":[1668487632]}'
-    "1305862567": '{"GID":1305862567,"UIDs":[1448654198]}'
+    "1668487632": '{"GID":1668487632,"UIDs":[1668487632]}'
+    "1448654198": '{"GID":1448654198,"UIDs":[1448654198]}'
     "1308355719": '{"GID":1308355719,"UIDs":[1031497592]}'
-    "1308629880": '{"GID":1308629880,"UIDs":[1974679960]}'
+    "1974679960": '{"GID":1974679960,"UIDs":[1974679960]}'
     "1485242865": '{"GID":1485242865,"UIDs":[1668487632]}'
     "1637945796": '{"GID":1637945796,"UIDs":[1674497680]}'
-    "1722096224": '{"GID":1722096224,"UIDs":[1690031958]}'
+    "1690031958": '{"GID":1690031958,"UIDs":[1690031958]}'
     "1726859569": '{"GID":1726859569,"UIDs":[1911746559]}'
     "1888170398": '{"GID":1888170398,"UIDs":[1047623009]}'
-    "1926585439": '{"GID":1926585439,"UIDs":[1911746559]}'
-    "1974061242": '{"GID":1974061242,"UIDs":[1047623009]}'
+    "1911746559": '{"GID":1911746559,"UIDs":[1911746559]}'
+    "1047623009": '{"GID":1047623009,"UIDs":[1047623009]}'
 UserByID:
-    "1031497592": '{"Name":"user-integration-WITH-Mixed-CaSe","UID":1031497592,"GID":1100583035,"Gecos":"gecos for user-integration-WITH-Mixed-CaSe","Dir":"/home/user-integration-WITH-Mixed-CaSe","Shell":"/bin/sh","LastPwdChange":-1,"MaxPwdAge":-1,"PwdWarnPeriod":-1,"PwdInactivity":-1,"MinPwdAge":-1,"ExpirationDate":-1,"LastLogin":"2025-05-30T18:17:18.01191855+02:00"}'
-    "1047623009": '{"Name":"user-local-groups-Mixed-Case","UID":1047623009,"GID":1974061242,"Gecos":"gecos for user-local-groups-Mixed-Case","Dir":"/home/user-local-groups-Mixed-Case","Shell":"/usr/bin/bash","LastPwdChange":-1,"MaxPwdAge":-1,"PwdWarnPeriod":-1,"PwdInactivity":-1,"MinPwdAge":-1,"ExpirationDate":-1,"LastLogin":"2025-06-02T01:05:19.742290239+02:00"}'
-    "1448654198": '{"Name":"user-integration-cached","UID":1448654198,"GID":1305862567,"Gecos":"gecos for user-integration-cached","Dir":"/home/user-integration-cached","Shell":"/bin/sh","LastPwdChange":-1,"MaxPwdAge":-1,"PwdWarnPeriod":-1,"PwdInactivity":-1,"MinPwdAge":-1,"ExpirationDate":-1,"LastLogin":"2025-05-30T18:16:55.049670042+02:00"}'
-    "1668487632": '{"Name":"user-integration-pre-check-WITH-UPPER-CASE","UID":1668487632,"GID":1204499006,"Gecos":"gecos for user-integration-pre-check-WITH-UPPER-CASE","Dir":"/home/user-integration-pre-check-WITH-UPPER-CASE","Shell":"/bin/sh","LastPwdChange":-1,"MaxPwdAge":-1,"PwdWarnPeriod":-1,"PwdInactivity":-1,"MinPwdAge":-1,"ExpirationDate":-1,"LastLogin":"2025-05-30T18:26:39.600082108+02:00"}'
-    "1674497680": '{"Name":"user-local-groups-UPPER-CASE","UID":1674497680,"GID":1060856841,"Gecos":"gecos for user-local-groups-UPPER-CASE","Dir":"/home/user-local-groups-UPPER-CASE","Shell":"/usr/bin/bash","LastPwdChange":-1,"MaxPwdAge":-1,"PwdWarnPeriod":-1,"PwdInactivity":-1,"MinPwdAge":-1,"ExpirationDate":-1,"LastLogin":"2025-06-02T01:08:33.759143141+02:00"}'
-    "1690031958": '{"Name":"user-local-groups-lower-case","UID":1690031958,"GID":1722096224,"Gecos":"gecos for user-local-groups-lower-case","Dir":"/home/user-local-groups-lower-case","Shell":"/usr/bin/bash","LastPwdChange":-1,"MaxPwdAge":-1,"PwdWarnPeriod":-1,"PwdInactivity":-1,"MinPwdAge":-1,"ExpirationDate":-1,"LastLogin":"2025-06-02T01:08:07.712846646+02:00"}'
-    "1911746559": '{"Name":"user-integration-UPPER-CASE","UID":1911746559,"GID":1926585439,"Gecos":"gecos for user-integration-UPPER-CASE","Dir":"/home/user-integration-UPPER-CASE","Shell":"/bin/sh","LastPwdChange":-1,"MaxPwdAge":-1,"PwdWarnPeriod":-1,"PwdInactivity":-1,"MinPwdAge":-1,"ExpirationDate":-1,"LastLogin":"2025-05-30T18:20:04.201035581+02:00"}'
-    "1974679960": '{"Name":"user-pre-check","UID":1974679960,"GID":1308629880,"Gecos":"gecos for user-pre-check","Dir":"/home/user-pre-check","Shell":"/bin/sh","LastPwdChange":-1,"MaxPwdAge":-1,"PwdWarnPeriod":-1,"PwdInactivity":-1,"MinPwdAge":-1,"ExpirationDate":-1,"LastLogin":"2025-05-30T18:24:42.349318925+02:00"}'
+    "1031497592": '{"Name":"user-integration-WITH-Mixed-CaSe@example.com","UID":1031497592,"GID":1031497592,"Gecos":"gecos for user-integration-WITH-Mixed-CaSe@example.com","Dir":"/tmp/authd-tests/home/user-integration-WITH-Mixed-CaSe@example.com","Shell":"/bin/sh","LastPwdChange":-1,"MaxPwdAge":-1,"PwdWarnPeriod":-1,"PwdInactivity":-1,"MinPwdAge":-1,"ExpirationDate":-1,"LastLogin":"2025-05-30T18:17:18.01191855+02:00"}'
+    "1047623009": '{"Name":"user-local-groups-Mixed-Case@example.com","UID":1047623009,"GID":1047623009,"Gecos":"gecos for user-local-groups-Mixed-Case@example.com","Dir":"/tmp/authd-tests/home/user-local-groups-Mixed-Case@example.com","Shell":"/usr/bin/bash","LastPwdChange":-1,"MaxPwdAge":-1,"PwdWarnPeriod":-1,"PwdInactivity":-1,"MinPwdAge":-1,"ExpirationDate":-1,"LastLogin":"2025-06-02T01:05:19.742290239+02:00"}'
+    "1448654198": '{"Name":"user-integration-cached@example.com","UID":1448654198,"GID":1448654198,"Gecos":"gecos for user-integration-cached@example.com","Dir":"/tmp/authd-tests/home/user-integration-cached@example.com","Shell":"/bin/sh","LastPwdChange":-1,"MaxPwdAge":-1,"PwdWarnPeriod":-1,"PwdInactivity":-1,"MinPwdAge":-1,"ExpirationDate":-1,"LastLogin":"2025-05-30T18:16:55.049670042+02:00"}'
+    "1668487632": '{"Name":"user-integration-pre-check-WITH-UPPER-CASE@example.com","UID":1668487632,"GID":1668487632,"Gecos":"gecos for user-integration-pre-check-WITH-UPPER-CASE@example.com","Dir":"/tmp/authd-tests/home/user-integration-pre-check-WITH-UPPER-CASE@example.com","Shell":"/bin/sh","LastPwdChange":-1,"MaxPwdAge":-1,"PwdWarnPeriod":-1,"PwdInactivity":-1,"MinPwdAge":-1,"ExpirationDate":-1,"LastLogin":"2025-05-30T18:26:39.600082108+02:00"}'
+    "1674497680": '{"Name":"user-local-groups-UPPER-CASE@example.com","UID":1674497680,"GID":1674497680,"Gecos":"gecos for user-local-groups-UPPER-CASE@example.com","Dir":"/tmp/authd-tests/home/user-local-groups-UPPER-CASE@example.com","Shell":"/usr/bin/bash","LastPwdChange":-1,"MaxPwdAge":-1,"PwdWarnPeriod":-1,"PwdInactivity":-1,"MinPwdAge":-1,"ExpirationDate":-1,"LastLogin":"2025-06-02T01:08:33.759143141+02:00"}'
+    "1690031958": '{"Name":"user-local-groups-lower-case@example.com","UID":1690031958,"GID":1690031958,"Gecos":"gecos for user-local-groups-lower-case@example.com","Dir":"/tmp/authd-tests/home/user-local-groups-lower-case@example.com","Shell":"/usr/bin/bash","LastPwdChange":-1,"MaxPwdAge":-1,"PwdWarnPeriod":-1,"PwdInactivity":-1,"MinPwdAge":-1,"ExpirationDate":-1,"LastLogin":"2025-06-02T01:08:07.712846646+02:00"}'
+    "1911746559": '{"Name":"user-integration-UPPER-CASE@example.com","UID":1911746559,"GID":1911746559,"Gecos":"gecos for user-integration-UPPER-CASE@example.com","Dir":"/tmp/authd-tests/home/user-integration-UPPER-CASE@example.com","Shell":"/bin/sh","LastPwdChange":-1,"MaxPwdAge":-1,"PwdWarnPeriod":-1,"PwdInactivity":-1,"MinPwdAge":-1,"ExpirationDate":-1,"LastLogin":"2025-05-30T18:20:04.201035581+02:00"}'
+    "1974679960": '{"Name":"user-pre-check@example.com","UID":1974679960,"GID":1974679960,"Gecos":"gecos for user-pre-check@example.com","Dir":"/tmp/authd-tests/home/user-pre-check@example.com","Shell":"/bin/sh","LastPwdChange":-1,"MaxPwdAge":-1,"PwdWarnPeriod":-1,"PwdInactivity":-1,"MinPwdAge":-1,"ExpirationDate":-1,"LastLogin":"2025-05-30T18:24:42.349318925+02:00"}'
 UserByName:
-    user-integration-UPPER-CASE: '{"Name":"user-integration-UPPER-CASE","UID":1911746559,"GID":1926585439,"Gecos":"gecos for user-integration-UPPER-CASE","Dir":"/home/user-integration-UPPER-CASE","Shell":"/bin/sh","LastPwdChange":-1,"MaxPwdAge":-1,"PwdWarnPeriod":-1,"PwdInactivity":-1,"MinPwdAge":-1,"ExpirationDate":-1,"LastLogin":"2025-05-30T18:20:04.201035581+02:00"}'
-    user-integration-WITH-Mixed-CaSe: '{"Name":"user-integration-WITH-Mixed-CaSe","UID":1031497592,"GID":1100583035,"Gecos":"gecos for user-integration-WITH-Mixed-CaSe","Dir":"/home/user-integration-WITH-Mixed-CaSe","Shell":"/bin/sh","LastPwdChange":-1,"MaxPwdAge":-1,"PwdWarnPeriod":-1,"PwdInactivity":-1,"MinPwdAge":-1,"ExpirationDate":-1,"LastLogin":"2025-05-30T18:17:18.01191855+02:00"}'
-    user-integration-cached: '{"Name":"user-integration-cached","UID":1448654198,"GID":1305862567,"Gecos":"gecos for user-integration-cached","Dir":"/home/user-integration-cached","Shell":"/bin/sh","LastPwdChange":-1,"MaxPwdAge":-1,"PwdWarnPeriod":-1,"PwdInactivity":-1,"MinPwdAge":-1,"ExpirationDate":-1,"LastLogin":"2025-05-30T18:16:55.049670042+02:00"}'
-    user-integration-pre-check-WITH-UPPER-CASE: '{"Name":"user-integration-pre-check-WITH-UPPER-CASE","UID":1668487632,"GID":1204499006,"Gecos":"gecos for user-integration-pre-check-WITH-UPPER-CASE","Dir":"/home/user-integration-pre-check-WITH-UPPER-CASE","Shell":"/bin/sh","LastPwdChange":-1,"MaxPwdAge":-1,"PwdWarnPeriod":-1,"PwdInactivity":-1,"MinPwdAge":-1,"ExpirationDate":-1,"LastLogin":"2025-05-30T18:26:39.600082108+02:00"}'
-    user-local-groups-Mixed-Case: '{"Name":"user-local-groups-Mixed-Case","UID":1047623009,"GID":1974061242,"Gecos":"gecos for user-local-groups-Mixed-Case","Dir":"/home/user-local-groups-Mixed-Case","Shell":"/usr/bin/bash","LastPwdChange":-1,"MaxPwdAge":-1,"PwdWarnPeriod":-1,"PwdInactivity":-1,"MinPwdAge":-1,"ExpirationDate":-1,"LastLogin":"2025-06-02T01:05:19.742290239+02:00"}'
-    user-local-groups-UPPER-CASE: '{"Name":"user-local-groups-UPPER-CASE","UID":1674497680,"GID":1060856841,"Gecos":"gecos for user-local-groups-UPPER-CASE","Dir":"/home/user-local-groups-UPPER-CASE","Shell":"/usr/bin/bash","LastPwdChange":-1,"MaxPwdAge":-1,"PwdWarnPeriod":-1,"PwdInactivity":-1,"MinPwdAge":-1,"ExpirationDate":-1,"LastLogin":"2025-06-02T01:08:33.759143141+02:00"}'
-    user-local-groups-lower-case: '{"Name":"user-local-groups-lower-case","UID":1690031958,"GID":1722096224,"Gecos":"gecos for user-local-groups-lower-case","Dir":"/home/user-local-groups-lower-case","Shell":"/usr/bin/bash","LastPwdChange":-1,"MaxPwdAge":-1,"PwdWarnPeriod":-1,"PwdInactivity":-1,"MinPwdAge":-1,"ExpirationDate":-1,"LastLogin":"2025-06-02T01:08:07.712846646+02:00"}'
-    user-pre-check: '{"Name":"user-pre-check","UID":1974679960,"GID":1308629880,"Gecos":"gecos for user-pre-check","Dir":"/home/user-pre-check","Shell":"/bin/sh","LastPwdChange":-1,"MaxPwdAge":-1,"PwdWarnPeriod":-1,"PwdInactivity":-1,"MinPwdAge":-1,"ExpirationDate":-1,"LastLogin":"2025-05-30T18:24:42.349318925+02:00"}'
+    user-integration-UPPER-CASE@example.com: '{"Name":"user-integration-UPPER-CASE@example.com","UID":1911746559,"GID":1911746559,"Gecos":"gecos for user-integration-UPPER-CASE@example.com","Dir":"/tmp/authd-tests/home/user-integration-UPPER-CASE@example.com","Shell":"/bin/sh","LastPwdChange":-1,"MaxPwdAge":-1,"PwdWarnPeriod":-1,"PwdInactivity":-1,"MinPwdAge":-1,"ExpirationDate":-1,"LastLogin":"2025-05-30T18:20:04.201035581+02:00"}'
+    user-integration-WITH-Mixed-CaSe@example.com: '{"Name":"user-integration-WITH-Mixed-CaSe@example.com","UID":1031497592,"GID":1031497592,"Gecos":"gecos for user-integration-WITH-Mixed-CaSe@example.com","Dir":"/tmp/authd-tests/home/user-integration-WITH-Mixed-CaSe@example.com","Shell":"/bin/sh","LastPwdChange":-1,"MaxPwdAge":-1,"PwdWarnPeriod":-1,"PwdInactivity":-1,"MinPwdAge":-1,"ExpirationDate":-1,"LastLogin":"2025-05-30T18:17:18.01191855+02:00"}'
+    user-integration-cached@example.com: '{"Name":"user-integration-cached@example.com","UID":1448654198,"GID":1448654198,"Gecos":"gecos for user-integration-cached@example.com","Dir":"/tmp/authd-tests/home/user-integration-cached@example.com","Shell":"/bin/sh","LastPwdChange":-1,"MaxPwdAge":-1,"PwdWarnPeriod":-1,"PwdInactivity":-1,"MinPwdAge":-1,"ExpirationDate":-1,"LastLogin":"2025-05-30T18:16:55.049670042+02:00"}'
+    user-integration-pre-check-WITH-UPPER-CASE@example.com: '{"Name":"user-integration-pre-check-WITH-UPPER-CASE@example.com","UID":1668487632,"GID":1668487632,"Gecos":"gecos for user-integration-pre-check-WITH-UPPER-CASE@example.com","Dir":"/tmp/authd-tests/home/user-integration-pre-check-WITH-UPPER-CASE@example.com","Shell":"/bin/sh","LastPwdChange":-1,"MaxPwdAge":-1,"PwdWarnPeriod":-1,"PwdInactivity":-1,"MinPwdAge":-1,"ExpirationDate":-1,"LastLogin":"2025-05-30T18:26:39.600082108+02:00"}'
+    user-local-groups-Mixed-Case@example.com: '{"Name":"user-local-groups-Mixed-Case@example.com","UID":1047623009,"GID":1047623009,"Gecos":"gecos for user-local-groups-Mixed-Case@example.com","Dir":"/tmp/authd-tests/home/user-local-groups-Mixed-Case@example.com","Shell":"/usr/bin/bash","LastPwdChange":-1,"MaxPwdAge":-1,"PwdWarnPeriod":-1,"PwdInactivity":-1,"MinPwdAge":-1,"ExpirationDate":-1,"LastLogin":"2025-06-02T01:05:19.742290239+02:00"}'
+    user-local-groups-UPPER-CASE@example.com: '{"Name":"user-local-groups-UPPER-CASE@example.com","UID":1674497680,"GID":1674497680,"Gecos":"gecos for user-local-groups-UPPER-CASE@example.com","Dir":"/tmp/authd-tests/home/user-local-groups-UPPER-CASE@example.com","Shell":"/usr/bin/bash","LastPwdChange":-1,"MaxPwdAge":-1,"PwdWarnPeriod":-1,"PwdInactivity":-1,"MinPwdAge":-1,"ExpirationDate":-1,"LastLogin":"2025-06-02T01:08:33.759143141+02:00"}'
+    user-local-groups-lower-case@example.com: '{"Name":"user-local-groups-lower-case@example.com","UID":1690031958,"GID":1690031958,"Gecos":"gecos for user-local-groups-lower-case@example.com","Dir":"/tmp/authd-tests/home/user-local-groups-lower-case@example.com","Shell":"/usr/bin/bash","LastPwdChange":-1,"MaxPwdAge":-1,"PwdWarnPeriod":-1,"PwdInactivity":-1,"MinPwdAge":-1,"ExpirationDate":-1,"LastLogin":"2025-06-02T01:08:07.712846646+02:00"}'
+    user-pre-check@example.com: '{"Name":"user-pre-check@example.com","UID":1974679960,"GID":1974679960,"Gecos":"gecos for user-pre-check@example.com","Dir":"/tmp/authd-tests/home/user-pre-check@example.com","Shell":"/bin/sh","LastPwdChange":-1,"MaxPwdAge":-1,"PwdWarnPeriod":-1,"PwdInactivity":-1,"MinPwdAge":-1,"ExpirationDate":-1,"LastLogin":"2025-05-30T18:24:42.349318925+02:00"}'
 UserToBroker:
     "1031497592": '"2221040704"'
     "1047623009": '"2221040704"'
@@ -95,14 +95,14 @@ UserToBroker:
     "1911746559": '"2221040704"'
     "1974679960": '"2221040704"'
 UserToGroups:
-    "1031497592": '{"UID":1031497592,"GIDs":[1100583035,1308355719]}'
-    "1047623009": '{"UID":1047623009,"GIDs":[1974061242,1888170398]}'
-    "1448654198": '{"UID":1448654198,"GIDs":[1305862567,1147556396]}'
-    "1668487632": '{"UID":1668487632,"GIDs":[1204499006,1485242865]}'
-    "1674497680": '{"UID":1674497680,"GIDs":[1060856841,1637945796]}'
-    "1690031958": '{"UID":1690031958,"GIDs":[1722096224,1127261046]}'
-    "1911746559": '{"UID":1911746559,"GIDs":[1926585439,1726859569]}'
-    "1974679960": '{"UID":1974679960,"GIDs":[1308629880,1118334210]}'
+    "1031497592": '{"UID":1031497592,"GIDs":[1031497592,1308355719]}'
+    "1047623009": '{"UID":1047623009,"GIDs":[1047623009,1888170398]}'
+    "1448654198": '{"UID":1448654198,"GIDs":[1448654198,1147556396]}'
+    "1668487632": '{"UID":1668487632,"GIDs":[1668487632,1485242865]}'
+    "1674497680": '{"UID":1674497680,"GIDs":[1674497680,1637945796]}'
+    "1690031958": '{"UID":1690031958,"GIDs":[1690031958,1127261046]}'
+    "1911746559": '{"UID":1911746559,"GIDs":[1911746559,1726859569]}'
+    "1974679960": '{"UID":1974679960,"GIDs":[1974679960,1118334210]}'
 UserToLocalGroups:
     "1031497592": "null"
     "1047623009": '["localGROUP"]'
diff --git a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_and_add_it_to_local_group b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_and_add_it_to_local_group
index 6a23d5b739..094de10a5e 100644
--- a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_and_add_it_to_local_group
+++ b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_and_add_it_to_local_group
@@ -2,7 +2,7 @@
 Username: user name
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET}
-Username: user-local-groups-integration-auth-native
+Username: user-local-groups-integration-auth-cli@example.com
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET}
   Select your provider
@@ -26,10 +26,10 @@ Gimme your password:
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET}
 PAM Authenticate()
-  User: "user-local-groups-integration-auth-native"
+  User: "user-local-groups-integration-auth-cli@example.com"
   Result: success
 PAM AcctMgmt()
-  User: "user-local-groups-integration-auth-native"
+  User: "user-local-groups-integration-auth-cli@example.com"
   Result: success
 >
 ────────────────────────────────────────────────────────────────────────────────
diff --git a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_and_add_it_to_local_group.gpasswd_out b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_and_add_it_to_local_group.gpasswd_out
deleted file mode 100644
index 4f5e85619d..0000000000
--- a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_and_add_it_to_local_group.gpasswd_out
+++ /dev/null
@@ -1 +0,0 @@
---add user-local-groups-integration-auth-native localgroup
\ No newline at end of file
diff --git a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_and_add_it_to_local_group.group b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_and_add_it_to_local_group.group
new file mode 100644
index 0000000000..8ab2c10650
--- /dev/null
+++ b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_and_add_it_to_local_group.group
@@ -0,0 +1 @@
+localgroup:x:41:user-local-groups-integration-auth-cli@example.com
diff --git a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_and_add_it_to_local_group.groups b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_and_add_it_to_local_group.group.backup
similarity index 100%
rename from pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_and_add_it_to_local_group.groups
rename to pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_and_add_it_to_local_group.group.backup
diff --git a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_and_offer_password_reset b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_and_offer_password_reset
index d9a68e4079..8f8fed614e 100644
--- a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_and_offer_password_reset
+++ b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_and_offer_password_reset
@@ -2,7 +2,7 @@
 Username: user name
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET}
-Username: user-can-reset
+Username: user-can-reset@example.com
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET}
   Select your provider
@@ -43,10 +43,10 @@ New password:
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET}
 PAM Authenticate()
-  User: "user-can-reset"
+  User: "user-can-reset@example.com"
   Result: success
 PAM AcctMgmt()
-  User: "user-can-reset"
+  User: "user-can-reset@example.com"
   Result: success
 >
 ────────────────────────────────────────────────────────────────────────────────
diff --git a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_and_reset_password_while_enforcing_policy b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_and_reset_password_while_enforcing_policy
index 8eda45a0b6..4e1d8e9130 100644
--- a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_and_reset_password_while_enforcing_policy
+++ b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_and_reset_password_while_enforcing_policy
@@ -2,7 +2,7 @@
 Username: user name
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET}
-Username: user-needs-reset-integration-mandatory
+Username: user-needs-reset-integration-mandatory@example.com
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET}
   Select your provider
@@ -59,10 +59,10 @@ Confirm password:
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET}
 PAM Authenticate()
-  User: "user-needs-reset-integration-mandatory"
+  User: "user-needs-reset-integration-mandatory@example.com"
   Result: success
 PAM AcctMgmt()
-  User: "user-needs-reset-integration-mandatory"
+  User: "user-needs-reset-integration-mandatory@example.com"
   Result: success
 >
 ────────────────────────────────────────────────────────────────────────────────
diff --git a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_and_reset_password_with_case_insensitive_user_selection b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_and_reset_password_with_case_insensitive_user_selection
index 651fbabe58..c3d0c708e3 100644
--- a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_and_reset_password_with_case_insensitive_user_selection
+++ b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_and_reset_password_with_case_insensitive_user_selection
@@ -2,7 +2,7 @@
 Username: user name
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET}
-Username: user-needs-reset-integration-case-insensitive-testcliauthenticate
+Username: user-needs-reset-integration-case-insensitive-testcliauthenticate@example.com
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET}
   Select your provider
@@ -52,10 +52,10 @@ Confirm password:
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET}
 PAM Authenticate()
-  User: "user-needs-reset-integration-case-insensitive-testcliauthenticate"
+  User: "user-needs-reset-integration-case-insensitive-testcliauthenticate@example.com"
   Result: success
 PAM AcctMgmt()
-  User: "user-needs-reset-integration-case-insensitive-testcliauthenticate"
+  User: "user-needs-reset-integration-case-insensitive-testcliauthenticate@example.com"
   Result: success
 >
 ────────────────────────────────────────────────────────────────────────────────
@@ -65,7 +65,7 @@ PAM AcctMgmt()
 Username: user name
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET}
-Username: USER-NEEDS-RESET-INTEGRATION-CASE-INSENSITIVE-TESTCLIAUTHENTICATE
+Username: USER-NEEDS-RESET-INTEGRATION-CASE-INSENSITIVE-TESTCLIAUTHENTICATE@EXAMPLE.COM
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET}
 Gimme your password:
@@ -81,10 +81,10 @@ Gimme your password:
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET}
 PAM Authenticate()
-  User: "user-needs-reset-integration-case-insensitive-testcliauthenticate"
+  User: "user-needs-reset-integration-case-insensitive-testcliauthenticate@example.com"
   Result: success
 PAM AcctMgmt()
-  User: "user-needs-reset-integration-case-insensitive-testcliauthenticate"
+  User: "user-needs-reset-integration-case-insensitive-testcliauthenticate@example.com"
   Result: success
 >
 ────────────────────────────────────────────────────────────────────────────────
@@ -94,7 +94,7 @@ PAM AcctMgmt()
 Username: user name
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET}
-Username: user-needs-reset-integration-Case-INSENSITIVE-testcliauthenticate
+Username: user-needs-reset-integration-Case-INSENSITIVE-testcliauthenticate@example.com
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET}
 Gimme your password:
@@ -110,10 +110,10 @@ Gimme your password:
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET}
 PAM Authenticate()
-  User: "user-needs-reset-integration-case-insensitive-testcliauthenticate"
+  User: "user-needs-reset-integration-case-insensitive-testcliauthenticate@example.com"
   Result: success
 PAM AcctMgmt()
-  User: "user-needs-reset-integration-case-insensitive-testcliauthenticate"
+  User: "user-needs-reset-integration-case-insensitive-testcliauthenticate@example.com"
   Result: success
 >
 ────────────────────────────────────────────────────────────────────────────────
diff --git a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_successfully b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_successfully
index 1a50d3f513..afe66527ea 100644
--- a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_successfully
+++ b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_successfully
@@ -2,7 +2,7 @@
 Username: user name
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET}
-Username: user-integration-simple-testcliauthenticate
+Username: user-integration-simple-testcliauthenticate@example.com
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET}
   Select your provider
@@ -26,10 +26,10 @@ Gimme your password:
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET}
 PAM Authenticate()
-  User: "user-integration-simple-testcliauthenticate"
+  User: "user-integration-simple-testcliauthenticate@example.com"
   Result: success
 PAM AcctMgmt()
-  User: "user-integration-simple-testcliauthenticate"
+  User: "user-integration-simple-testcliauthenticate@example.com"
   Result: success
 >
 ────────────────────────────────────────────────────────────────────────────────
diff --git a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_successfully_after_db_migration b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_successfully_after_db_migration
index 978541f926..364fee5646 100644
--- a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_successfully_after_db_migration
+++ b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_successfully_after_db_migration
@@ -12,10 +12,10 @@ Gimme your password:
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET}
 PAM Authenticate()
-  User: "user-integration-cached"
+  User: "user-integration-cached@example.com"
   Result: success
 PAM AcctMgmt()
-  User: "user-integration-cached"
+  User: "user-integration-cached@example.com"
   Result: success
 >
 ────────────────────────────────────────────────────────────────────────────────
diff --git a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_successfully_after_db_migration.group b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_successfully_after_db_migration.group
new file mode 100644
index 0000000000..2c7783d30a
--- /dev/null
+++ b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_successfully_after_db_migration.group
@@ -0,0 +1,6 @@
+localgroup:x:41:user-integration-with-mixed-case@example.com,user-integration-cached@example.com,user-integration-pre-check-with-upper-case@example.com,user-integration-upper-case@example.com,user-pre-check@example.com
+some-group-for-user-integration-WITH-Mixed-CaSe@example.com:x:101:user-integration-with-mixed-case@example.com
+some-group-for-user-integration-cached@example.com:x:102:user-integration-cached@example.com
+some-group-for-user-integration-pre-check-WITH-UPPER-CASE@example.com:x:103:user-integration-pre-check-with-upper-case@example.com
+some-group-for-user-integration-UPPER-CASE@example.com:x:104:user-integration-upper-case@example.com
+some-group-for-user-pre-check@example.com:x:105:user-pre-check@example.com
diff --git a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_successfully_after_db_migration.group.backup b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_successfully_after_db_migration.group.backup
new file mode 100644
index 0000000000..7fe8ba8346
--- /dev/null
+++ b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_successfully_after_db_migration.group.backup
@@ -0,0 +1,6 @@
+localgroup:x:41:user-integration-WITH-Mixed-CaSe@example.com,user-integration-cached@example.com,user-integration-pre-check-WITH-UPPER-CASE@example.com,user-integration-UPPER-CASE@example.com,user-pre-check@example.com
+some-group-for-user-integration-WITH-Mixed-CaSe@example.com:x:101:user-integration-WITH-Mixed-CaSe@example.com
+some-group-for-user-integration-cached@example.com:x:102:user-integration-cached@example.com
+some-group-for-user-integration-pre-check-WITH-UPPER-CASE@example.com:x:103:user-integration-pre-check-WITH-UPPER-CASE@example.com
+some-group-for-user-integration-UPPER-CASE@example.com:x:104:user-integration-UPPER-CASE@example.com
+some-group-for-user-pre-check@example.com:x:105:user-pre-check@example.com
diff --git a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_successfully_after_db_migration.groups b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_successfully_after_db_migration.groups
deleted file mode 100644
index f31a69be33..0000000000
--- a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_successfully_after_db_migration.groups
+++ /dev/null
@@ -1,6 +0,0 @@
-localgroup:x:41:user-integration-with-mixed-case,user-integration-cached,user-integration-pre-check-with-upper-case,user-integration-upper-case,user-pre-check
-some-group-for-user-integration-WITH-Mixed-CaSe:x:101:user-integration-with-mixed-case
-some-group-for-user-integration-cached:x:102:user-integration-cached
-some-group-for-user-integration-pre-check-WITH-UPPER-CASE:x:103:user-integration-pre-check-with-upper-case
-some-group-for-user-integration-UPPER-CASE:x:104:user-integration-upper-case
-some-group-for-user-pre-check:x:105:user-pre-check
diff --git a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_successfully_after_trying_empty_user b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_successfully_after_trying_empty_user
index 196a8173d7..c3bd7f44dd 100644
--- a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_successfully_after_trying_empty_user
+++ b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_successfully_after_trying_empty_user
@@ -2,13 +2,13 @@
 Username: user name
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET}
-Username: user-integration-not-empty
+Username: user-integration-not-empty@example.com
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET}
 Username: user name
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET}
-Username: user-integration-was-empty
+Username: user-integration-was-empty@example.com
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET}
   Select your provider
@@ -26,10 +26,10 @@ Gimme your password:
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET}
 PAM Authenticate()
-  User: "user-integration-was-empty"
+  User: "user-integration-was-empty@example.com"
   Result: success
 PAM AcctMgmt()
-  User: "user-integration-was-empty"
+  User: "user-integration-was-empty@example.com"
   Result: success
 >
 ────────────────────────────────────────────────────────────────────────────────
diff --git a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_successfully_with_invalid_connection_timeout b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_successfully_with_invalid_connection_timeout
index df19543758..d812c41511 100644
--- a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_successfully_with_invalid_connection_timeout
+++ b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_successfully_with_invalid_connection_timeout
@@ -2,7 +2,7 @@
 Username: user name
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET}
-Username: user-integration-invalid-timeout-testcliauthenticate
+Username: user-integration-invalid-timeout-testcliauthenticate@example.com
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET}
   Select your provider
@@ -26,10 +26,10 @@ Gimme your password:
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET}
 PAM Authenticate()
-  User: "user-integration-invalid-timeout-testcliauthenticate"
+  User: "user-integration-invalid-timeout-testcliauthenticate@example.com"
   Result: success
 PAM AcctMgmt()
-  User: "user-integration-invalid-timeout-testcliauthenticate"
+  User: "user-integration-invalid-timeout-testcliauthenticate@example.com"
   Result: success
 >
 ────────────────────────────────────────────────────────────────────────────────
diff --git a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_successfully_with_password_only_supported_method b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_successfully_with_password_only_supported_method
index f29b09b054..a587bb5802 100644
--- a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_successfully_with_password_only_supported_method
+++ b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_successfully_with_password_only_supported_method
@@ -2,7 +2,7 @@
 Username: user name
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET}
-Username: user-auth-modes-password-integration-cli
+Username: user-auth-modes-password-integration-cli@example.com
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET}
   Select your provider
@@ -26,10 +26,10 @@ Gimme your password:
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET}
 PAM Authenticate()
-  User: "user-auth-modes-password-integration-cli"
+  User: "user-auth-modes-password-integration-cli@example.com"
   Result: success
 PAM AcctMgmt()
-  User: "user-auth-modes-password-integration-cli"
+  User: "user-auth-modes-password-integration-cli@example.com"
   Result: success
 >
 ────────────────────────────────────────────────────────────────────────────────
diff --git a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_successfully_with_preset_user b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_successfully_with_preset_user
index b1fa7f0366..11493f1a45 100644
--- a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_successfully_with_preset_user
+++ b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_successfully_with_preset_user
@@ -18,10 +18,10 @@ Gimme your password:
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET}
 PAM Authenticate()
-  User: "user-integration-preset-testcliauthenticate"
+  User: "user-integration-preset-testcliauthenticate@example.com"
   Result: success
 PAM AcctMgmt()
-  User: "user-integration-preset-testcliauthenticate"
+  User: "user-integration-preset-testcliauthenticate@example.com"
   Result: success
 >
 ────────────────────────────────────────────────────────────────────────────────
diff --git a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_successfully_with_upper_case b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_successfully_with_upper_case
index fd5a296478..8a30774d91 100644
--- a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_successfully_with_upper_case
+++ b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_successfully_with_upper_case
@@ -2,7 +2,7 @@
 Username: user name
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET}
-Username: user-integration-upper-case-testcliauthenticate
+Username: user-integration-upper-case-testcliauthenticate@example.com
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET}
   Select your provider
@@ -26,10 +26,10 @@ Gimme your password:
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET}
 PAM Authenticate()
-  User: "user-integration-upper-case-testcliauthenticate"
+  User: "user-integration-upper-case-testcliauthenticate@example.com"
   Result: success
 PAM AcctMgmt()
-  User: "user-integration-upper-case-testcliauthenticate"
+  User: "user-integration-upper-case-testcliauthenticate@example.com"
   Result: success
 >
 ────────────────────────────────────────────────────────────────────────────────
diff --git a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_successfully_with_upper_case_preset_user b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_successfully_with_upper_case_preset_user
index 1421d97923..363f36765d 100644
--- a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_successfully_with_upper_case_preset_user
+++ b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_successfully_with_upper_case_preset_user
@@ -18,10 +18,10 @@ Gimme your password:
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET}
 PAM Authenticate()
-  User: "user-integration-preset-upper-case-testcliauthenticate"
+  User: "user-integration-preset-upper-case-testcliauthenticate@example.com"
   Result: success
 PAM AcctMgmt()
-  User: "user-integration-preset-upper-case-testcliauthenticate"
+  User: "user-integration-preset-upper-case-testcliauthenticate@example.com"
   Result: success
 >
 ────────────────────────────────────────────────────────────────────────────────
diff --git a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_switching_auth_mode b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_switching_auth_mode
index facdbd9c16..4a9f345697 100644
--- a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_switching_auth_mode
+++ b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_switching_auth_mode
@@ -2,7 +2,7 @@
 Username: user name
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET}
-Username: user-integration-switch-mode
+Username: user-integration-switch-mode@example.com
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET}
   Select your provider
@@ -22,7 +22,7 @@ Gimme your password:
   Select your authentication method
 
 > 1. Password authentication
-  2. Send URL to user-integration-switch-mode@gmail.com
+  2. Send URL to user-integration-switch-mode@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -32,7 +32,7 @@ Gimme your password:
   Press escape key to go back to choose the provider
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET}
-Click on the link received at user-integration-switch-mode@gmail.com or enter the code:
+Click on the link received at user-integration-switch-mode@example.com or enter the code:
 >
 
   Press escape key to go back to select the authentication method
@@ -41,7 +41,7 @@ Click on the link received at user-integration-switch-mode@gmail.com or enter th
   Select your authentication method
 
   1. Password authentication
-> 2. Send URL to user-integration-switch-mode@gmail.com
+> 2. Send URL to user-integration-switch-mode@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -59,7 +59,7 @@ Plug your fido device and press with your thumb
   Select your authentication method
 
   1. Password authentication
-  2. Send URL to user-integration-switch-mode@gmail.com
+  2. Send URL to user-integration-switch-mode@example.com
 > 3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -82,10 +82,10 @@ Gimme your password:
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET}
 PAM Authenticate()
-  User: "user-integration-switch-mode"
+  User: "user-integration-switch-mode@example.com"
   Result: success
 PAM AcctMgmt()
-  User: "user-integration-switch-mode"
+  User: "user-integration-switch-mode@example.com"
   Result: success
 >
 ────────────────────────────────────────────────────────────────────────────────
diff --git a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_switching_to_local_broker b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_switching_to_local_broker
index 8f52ca5395..6ae86ef0b2 100644
--- a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_switching_to_local_broker
+++ b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_switching_to_local_broker
@@ -2,7 +2,7 @@
 Username: user name
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET}
-Username: user-integration-switch-broker
+Username: user-integration-switch-broker@example.com
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET}
   Select your provider
@@ -22,7 +22,7 @@ Gimme your password:
   Select your authentication method
 
 > 1. Password authentication
-  2. Send URL to user-integration-switch-broker@gmail.com
+  2. Send URL to user-integration-switch-broker@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -47,11 +47,11 @@ Gimme your password:
 
 PAM Info Message: auth=incomplete
 PAM Authenticate()
-  User: "user-integration-switch-broker"
+  User: "user-integration-switch-broker@example.com"
   Result: error: PAM exit code: 25
     The return value should be ignored by PAM dispatch
 PAM AcctMgmt()
-  User: "user-integration-switch-broker"
+  User: "user-integration-switch-broker@example.com"
   Result: error: PAM exit code: 26
     Critical error - immediate abort
 >
diff --git a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_switching_username b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_switching_username
index 7166d12b2a..22ee0a858a 100644
--- a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_switching_username
+++ b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_switching_username
@@ -2,7 +2,7 @@
 Username: user name
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET}
-Username: user-integration-switch-username
+Username: user-integration-switch-username@example.com
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET}
   Select your provider
@@ -13,7 +13,7 @@ Username: user-integration-switch-username
   Press escape key to go back to user selection
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET}
-Username: user-integration-username-switched
+Username: user-integration-username-switched@example.com
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET}
   Select your provider
@@ -37,10 +37,10 @@ Gimme your password:
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET}
 PAM Authenticate()
-  User: "user-integration-username-switched"
+  User: "user-integration-username-switched@example.com"
   Result: success
 PAM AcctMgmt()
-  User: "user-integration-username-switched"
+  User: "user-integration-username-switched@example.com"
   Result: success
 >
 ────────────────────────────────────────────────────────────────────────────────
diff --git a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_with_form_mode_with_button b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_with_form_mode_with_button
index bc4c671d84..d0d9710041 100644
--- a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_with_form_mode_with_button
+++ b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_with_form_mode_with_button
@@ -2,7 +2,7 @@
 Username: user name
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET}
-Username: user-integration-form-w-button
+Username: user-integration-form-w-button@example.com
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET}
   Select your provider
@@ -22,7 +22,7 @@ Gimme your password:
   Select your authentication method
 
 > 1. Password authentication
-  2. Send URL to user-integration-form-w-button@gmail.com
+  2. Send URL to user-integration-form-w-button@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -49,10 +49,10 @@ Enter your one time credential:
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET}
 PAM Authenticate()
-  User: "user-integration-form-w-button"
+  User: "user-integration-form-w-button@example.com"
   Result: success
 PAM AcctMgmt()
-  User: "user-integration-form-w-button"
+  User: "user-integration-form-w-button@example.com"
   Result: success
 >
 ────────────────────────────────────────────────────────────────────────────────
diff --git a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_with_mfa b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_with_mfa
index b5a1150e40..cf9d04cd88 100644
--- a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_with_mfa
+++ b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_with_mfa
@@ -2,7 +2,7 @@
 Username: user name
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET}
-Username: user-mfa
+Username: user-mfa@example.com
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET}
   Select your provider
@@ -22,7 +22,7 @@ Gimme your password:
   Select your authentication method
 
 > 1. Password authentication
-  2. Send URL to user-mfa@gmail.com
+  2. Send URL to user-mfa@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -82,10 +82,10 @@ Unlock your phone +33... or accept request on web interface
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET}
 PAM Authenticate()
-  User: "user-mfa"
+  User: "user-mfa@example.com"
   Result: success
 PAM AcctMgmt()
-  User: "user-mfa"
+  User: "user-mfa@example.com"
   Result: success
 >
 ────────────────────────────────────────────────────────────────────────────────
diff --git a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_with_mfa_and_reset_password_while_enforcing_policy b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_with_mfa_and_reset_password_while_enforcing_policy
index dc759c56dd..909d1c0647 100644
--- a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_with_mfa_and_reset_password_while_enforcing_policy
+++ b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_with_mfa_and_reset_password_while_enforcing_policy
@@ -2,7 +2,7 @@
 Username: user name
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET}
-Username: user-mfa-with-reset
+Username: user-mfa-with-reset@example.com
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET}
   Select your provider
@@ -68,39 +68,6 @@ Enter your new password (3 days until mandatory)
 New password:
 >
 
-  [ Skip ]
-The password is the same as the old one
-
-  Press escape key to go back to choose the provider
-────────────────────────────────────────────────────────────────────────────────
-> ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET}
-Enter your new password (3 days until mandatory)
-
-New password:
-> ********
-
-  [ Skip ]
-The password is the same as the old one
-
-  Press escape key to go back to choose the provider
-────────────────────────────────────────────────────────────────────────────────
-> ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET}
-Enter your new password (3 days until mandatory)
-
-New password:
->
-
-  [ Skip ]
-The password fails the dictionary check - it is based on a dictionary word
-
-  Press escape key to go back to choose the provider
-────────────────────────────────────────────────────────────────────────────────
-> ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET}
-Enter your new password (3 days until mandatory)
-
-New password:
-> ********
-
   [ Skip ]
 The password fails the dictionary check - it is based on a dictionary word
 
@@ -109,22 +76,11 @@ The password fails the dictionary check - it is based on a dictionary word
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET}
 Enter your new password (3 days until mandatory)
 
-New password:
->
-
-  [ Skip ]
-The password is the same as the old one
-
-  Press escape key to go back to choose the provider
-────────────────────────────────────────────────────────────────────────────────
-> ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET}
-Enter your new password (3 days until mandatory)
-
 New password:
 > ****
 
   [ Skip ]
-The password is the same as the old one
+The password fails the dictionary check - it is based on a dictionary word
 
   Press escape key to go back to choose the provider
 ────────────────────────────────────────────────────────────────────────────────
@@ -176,10 +132,10 @@ Confirm password:
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET}
 PAM Authenticate()
-  User: "user-mfa-with-reset"
+  User: "user-mfa-with-reset@example.com"
   Result: success
 PAM AcctMgmt()
-  User: "user-mfa-with-reset"
+  User: "user-mfa-with-reset@example.com"
   Result: success
 >
 ────────────────────────────────────────────────────────────────────────────────
diff --git a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_with_mixed_case_after_db_migration b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_with_mixed_case_after_db_migration
index eef4c827e0..fc54f1a107 100644
--- a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_with_mixed_case_after_db_migration
+++ b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_with_mixed_case_after_db_migration
@@ -12,10 +12,10 @@ Gimme your password:
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET}
 PAM Authenticate()
-  User: "user-integration-with-mixed-case"
+  User: "user-integration-with-mixed-case@example.com"
   Result: success
 PAM AcctMgmt()
-  User: "user-integration-with-mixed-case"
+  User: "user-integration-with-mixed-case@example.com"
   Result: success
 >
 ────────────────────────────────────────────────────────────────────────────────
diff --git a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_with_mixed_case_after_db_migration.group b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_with_mixed_case_after_db_migration.group
new file mode 100644
index 0000000000..2c7783d30a
--- /dev/null
+++ b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_with_mixed_case_after_db_migration.group
@@ -0,0 +1,6 @@
+localgroup:x:41:user-integration-with-mixed-case@example.com,user-integration-cached@example.com,user-integration-pre-check-with-upper-case@example.com,user-integration-upper-case@example.com,user-pre-check@example.com
+some-group-for-user-integration-WITH-Mixed-CaSe@example.com:x:101:user-integration-with-mixed-case@example.com
+some-group-for-user-integration-cached@example.com:x:102:user-integration-cached@example.com
+some-group-for-user-integration-pre-check-WITH-UPPER-CASE@example.com:x:103:user-integration-pre-check-with-upper-case@example.com
+some-group-for-user-integration-UPPER-CASE@example.com:x:104:user-integration-upper-case@example.com
+some-group-for-user-pre-check@example.com:x:105:user-pre-check@example.com
diff --git a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_with_mixed_case_after_db_migration.group.backup b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_with_mixed_case_after_db_migration.group.backup
new file mode 100644
index 0000000000..7fe8ba8346
--- /dev/null
+++ b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_with_mixed_case_after_db_migration.group.backup
@@ -0,0 +1,6 @@
+localgroup:x:41:user-integration-WITH-Mixed-CaSe@example.com,user-integration-cached@example.com,user-integration-pre-check-WITH-UPPER-CASE@example.com,user-integration-UPPER-CASE@example.com,user-pre-check@example.com
+some-group-for-user-integration-WITH-Mixed-CaSe@example.com:x:101:user-integration-WITH-Mixed-CaSe@example.com
+some-group-for-user-integration-cached@example.com:x:102:user-integration-cached@example.com
+some-group-for-user-integration-pre-check-WITH-UPPER-CASE@example.com:x:103:user-integration-pre-check-WITH-UPPER-CASE@example.com
+some-group-for-user-integration-UPPER-CASE@example.com:x:104:user-integration-UPPER-CASE@example.com
+some-group-for-user-pre-check@example.com:x:105:user-pre-check@example.com
diff --git a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_with_mixed_case_after_db_migration.groups b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_with_mixed_case_after_db_migration.groups
deleted file mode 100644
index f31a69be33..0000000000
--- a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_with_mixed_case_after_db_migration.groups
+++ /dev/null
@@ -1,6 +0,0 @@
-localgroup:x:41:user-integration-with-mixed-case,user-integration-cached,user-integration-pre-check-with-upper-case,user-integration-upper-case,user-pre-check
-some-group-for-user-integration-WITH-Mixed-CaSe:x:101:user-integration-with-mixed-case
-some-group-for-user-integration-cached:x:102:user-integration-cached
-some-group-for-user-integration-pre-check-WITH-UPPER-CASE:x:103:user-integration-pre-check-with-upper-case
-some-group-for-user-integration-UPPER-CASE:x:104:user-integration-upper-case
-some-group-for-user-pre-check:x:105:user-pre-check
diff --git a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_with_qr_code b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_with_qr_code
index dc07dc928d..61327bfb2b 100644
--- a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_with_qr_code
+++ b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_with_qr_code
@@ -14,7 +14,7 @@ Gimme your password:
   Select your authentication method
 
 > 1. Password authentication
-  2. Send URL to user-integration-qr-code@gmail.com
+  2. Send URL to user-integration-qr-code@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -162,10 +162,10 @@ Scan the qrcode or enter the code in the login page
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET}
 PAM Authenticate()
-  User: "user-integration-qr-code"
+  User: "user-integration-qr-code@example.com"
   Result: success
 PAM AcctMgmt()
-  User: "user-integration-qr-code"
+  User: "user-integration-qr-code@example.com"
   Result: success
 >
 ────────────────────────────────────────────────────────────────────────────────
diff --git a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_with_qr_code_after_many_regenerations b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_with_qr_code_after_many_regenerations
index 55b871b910..76ecc40ff4 100644
--- a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_with_qr_code_after_many_regenerations
+++ b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_with_qr_code_after_many_regenerations
@@ -2,7 +2,7 @@
 Username: user name
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET}
-Username: user-integration-qrcode-static-regenerate
+Username: user-integration-qrcode-static-regenerate@example.com
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET}
   Select your provider
@@ -22,7 +22,7 @@ Gimme your password:
   Select your authentication method
 
 > 1. Password authentication
-  2. Send URL to user-integration-qrcode-static-regenerate@gmail.com
+  2. Send URL to user-integration-qrcode-static-regenerate@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -60,10 +60,10 @@ Scan the qrcode or enter the code in the login page
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET}
 PAM Authenticate()
-  User: "user-integration-qrcode-static-regenerate"
+  User: "user-integration-qrcode-static-regenerate@example.com"
   Result: success
 PAM AcctMgmt()
-  User: "user-integration-qrcode-static-regenerate"
+  User: "user-integration-qrcode-static-regenerate@example.com"
   Result: success
 >
 ────────────────────────────────────────────────────────────────────────────────
diff --git a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_with_qr_code_in_a_TTY b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_with_qr_code_in_a_TTY
index b71b29bdfb..4147ad346a 100644
--- a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_with_qr_code_in_a_TTY
+++ b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_with_qr_code_in_a_TTY
@@ -14,7 +14,7 @@ Gimme your password:
   Select your authentication method
 
 > 1. Password authentication
-  2. Send URL to user-integration-qr-code-tty@gmail.com
+  2. Send URL to user-integration-qr-code-tty@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -244,10 +244,10 @@ Scan the qrcode or enter the code in the login page
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET}
 PAM Authenticate()
-  User: "user-integration-qr-code-tty"
+  User: "user-integration-qr-code-tty@example.com"
   Result: success
 PAM AcctMgmt()
-  User: "user-integration-qr-code-tty"
+  User: "user-integration-qr-code-tty@example.com"
   Result: success
 >
 ────────────────────────────────────────────────────────────────────────────────
diff --git a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_with_qr_code_in_a_TTY_session b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_with_qr_code_in_a_TTY_session
index 467d5656d7..99f85e232c 100644
--- a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_with_qr_code_in_a_TTY_session
+++ b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_with_qr_code_in_a_TTY_session
@@ -14,7 +14,7 @@ Gimme your password:
   Select your authentication method
 
 > 1. Password authentication
-  2. Send URL to user-integration-qr-code-tty-session@gmail.com
+  2. Send URL to user-integration-qr-code-tty-session@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -244,10 +244,10 @@ Scan the qrcode or enter the code in the login page
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET}
 PAM Authenticate()
-  User: "user-integration-qr-code-tty-session"
+  User: "user-integration-qr-code-tty-session@example.com"
   Result: success
 PAM AcctMgmt()
-  User: "user-integration-qr-code-tty-session"
+  User: "user-integration-qr-code-tty-session@example.com"
   Result: success
 >
 ────────────────────────────────────────────────────────────────────────────────
diff --git a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_with_qr_code_in_screen b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_with_qr_code_in_screen
index 21ebde7da7..3519e7e8a4 100644
--- a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_with_qr_code_in_screen
+++ b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_with_qr_code_in_screen
@@ -14,7 +14,7 @@ Gimme your password:
   Select your authentication method
 
 > 1. Password authentication
-  2. Send URL to user-integration-qr-code-screen@gmail.com
+  2. Send URL to user-integration-qr-code-screen@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -244,10 +244,10 @@ Scan the qrcode or enter the code in the login page
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET}
 PAM Authenticate()
-  User: "user-integration-qr-code-screen"
+  User: "user-integration-qr-code-screen@example.com"
   Result: success
 PAM AcctMgmt()
-  User: "user-integration-qr-code-screen"
+  User: "user-integration-qr-code-screen@example.com"
   Result: success
 >
 ────────────────────────────────────────────────────────────────────────────────
diff --git a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_with_upper_case_using_lower_case_after_db_migration b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_with_upper_case_using_lower_case_after_db_migration
index 1e20a6b2b7..00fb158687 100644
--- a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_with_upper_case_using_lower_case_after_db_migration
+++ b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_with_upper_case_using_lower_case_after_db_migration
@@ -12,10 +12,10 @@ Gimme your password:
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET}
 PAM Authenticate()
-  User: "user-integration-upper-case"
+  User: "user-integration-upper-case@example.com"
   Result: success
 PAM AcctMgmt()
-  User: "user-integration-upper-case"
+  User: "user-integration-upper-case@example.com"
   Result: success
 >
 ────────────────────────────────────────────────────────────────────────────────
diff --git a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_with_upper_case_using_lower_case_after_db_migration.group b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_with_upper_case_using_lower_case_after_db_migration.group
new file mode 100644
index 0000000000..2c7783d30a
--- /dev/null
+++ b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_with_upper_case_using_lower_case_after_db_migration.group
@@ -0,0 +1,6 @@
+localgroup:x:41:user-integration-with-mixed-case@example.com,user-integration-cached@example.com,user-integration-pre-check-with-upper-case@example.com,user-integration-upper-case@example.com,user-pre-check@example.com
+some-group-for-user-integration-WITH-Mixed-CaSe@example.com:x:101:user-integration-with-mixed-case@example.com
+some-group-for-user-integration-cached@example.com:x:102:user-integration-cached@example.com
+some-group-for-user-integration-pre-check-WITH-UPPER-CASE@example.com:x:103:user-integration-pre-check-with-upper-case@example.com
+some-group-for-user-integration-UPPER-CASE@example.com:x:104:user-integration-upper-case@example.com
+some-group-for-user-pre-check@example.com:x:105:user-pre-check@example.com
diff --git a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_with_upper_case_using_lower_case_after_db_migration.group.backup b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_with_upper_case_using_lower_case_after_db_migration.group.backup
new file mode 100644
index 0000000000..7fe8ba8346
--- /dev/null
+++ b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_with_upper_case_using_lower_case_after_db_migration.group.backup
@@ -0,0 +1,6 @@
+localgroup:x:41:user-integration-WITH-Mixed-CaSe@example.com,user-integration-cached@example.com,user-integration-pre-check-WITH-UPPER-CASE@example.com,user-integration-UPPER-CASE@example.com,user-pre-check@example.com
+some-group-for-user-integration-WITH-Mixed-CaSe@example.com:x:101:user-integration-WITH-Mixed-CaSe@example.com
+some-group-for-user-integration-cached@example.com:x:102:user-integration-cached@example.com
+some-group-for-user-integration-pre-check-WITH-UPPER-CASE@example.com:x:103:user-integration-pre-check-WITH-UPPER-CASE@example.com
+some-group-for-user-integration-UPPER-CASE@example.com:x:104:user-integration-UPPER-CASE@example.com
+some-group-for-user-pre-check@example.com:x:105:user-pre-check@example.com
diff --git a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_with_upper_case_using_lower_case_after_db_migration.groups b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_with_upper_case_using_lower_case_after_db_migration.groups
deleted file mode 100644
index f31a69be33..0000000000
--- a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_with_upper_case_using_lower_case_after_db_migration.groups
+++ /dev/null
@@ -1,6 +0,0 @@
-localgroup:x:41:user-integration-with-mixed-case,user-integration-cached,user-integration-pre-check-with-upper-case,user-integration-upper-case,user-pre-check
-some-group-for-user-integration-WITH-Mixed-CaSe:x:101:user-integration-with-mixed-case
-some-group-for-user-integration-cached:x:102:user-integration-cached
-some-group-for-user-integration-pre-check-WITH-UPPER-CASE:x:103:user-integration-pre-check-with-upper-case
-some-group-for-user-integration-UPPER-CASE:x:104:user-integration-upper-case
-some-group-for-user-pre-check:x:105:user-pre-check
diff --git a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_with_warnings_on_unsupported_arguments b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_with_warnings_on_unsupported_arguments
index 49f7f66f98..7cf6e8aebb 100644
--- a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_with_warnings_on_unsupported_arguments
+++ b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_with_warnings_on_unsupported_arguments
@@ -2,7 +2,7 @@
 Username: user name
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET} invalid_flag=foo bar
-Username: user2
+Username: user2@example.com
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET} invalid_flag=foo bar
   Select your provider
@@ -26,10 +26,10 @@ Gimme your password:
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET} invalid_flag=foo bar
 PAM Authenticate()
-  User: "user2"
+  User: "user2@example.com"
   Result: success
 PAM AcctMgmt()
-  User: "user2"
+  User: "user2@example.com"
   Result: success
 >
 ────────────────────────────────────────────────────────────────────────────────
diff --git a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Deny_authentication_if_current_user_is_not_considered_as_root b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Deny_authentication_if_current_user_is_not_considered_as_root
index 4158028750..fee047acea 100644
--- a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Deny_authentication_if_current_user_is_not_considered_as_root
+++ b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Deny_authentication_if_current_user_is_not_considered_as_root
@@ -1,6 +1,5 @@
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET}
-PAM Error Message: could not get current available brokers: permission denied: this action is on
-ly allowed for root users. Current user is XXXX
+PAM Error Message: could not get current available brokers: permission denied: only root can perform this operation
 PAM Authenticate()
   User: "<unset>"
   Result: error: PAM exit code: 4
@@ -13,8 +12,7 @@ PAM AcctMgmt()
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET}
-PAM Error Message: could not get current available brokers: permission denied: this action is on
-ly allowed for root users. Current user is XXXX
+PAM Error Message: could not get current available brokers: permission denied: only root can perform this operation
 PAM Authenticate()
   User: "<unset>"
   Result: error: PAM exit code: 4
diff --git a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Deny_authentication_if_max_attempts_reached b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Deny_authentication_if_max_attempts_reached
index 4fe6707c2e..1344df552a 100644
--- a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Deny_authentication_if_max_attempts_reached
+++ b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Deny_authentication_if_max_attempts_reached
@@ -2,7 +2,7 @@
 Username: user name
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET}
-Username: user-integration-max-attempts
+Username: user-integration-max-attempts@example.com
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET}
   Select your provider
@@ -83,12 +83,12 @@ invalid password 'wrongpass', should be 'goodpass'
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET}
 PAM Error Message: invalid password 'wrongpass', should be 'goodpass'
 PAM Authenticate()
-  User: "user-integration-max-attempts"
+  User: "user-integration-max-attempts@example.com"
   Result: error: PAM exit code: 7
     Authentication failure
 PAM Info Message: acct=incomplete
 PAM AcctMgmt()
-  User: "user-integration-max-attempts"
+  User: "user-integration-max-attempts@example.com"
   Result: error: PAM exit code: 25
     The return value should be ignored by PAM dispatch
 >
diff --git a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Deny_authentication_if_newpassword_does_not_match_required_criteria b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Deny_authentication_if_newpassword_does_not_match_required_criteria
index 9256b40792..7cbcccf9cd 100644
--- a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Deny_authentication_if_newpassword_does_not_match_required_criteria
+++ b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Deny_authentication_if_newpassword_does_not_match_required_criteria
@@ -2,7 +2,7 @@
 Username: user name
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET}
-Username: user-needs-reset
+Username: user-needs-reset@example.com
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET}
   Select your provider
@@ -153,10 +153,10 @@ Confirm password:
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET}
 PAM Authenticate()
-  User: "user-needs-reset"
+  User: "user-needs-reset@example.com"
   Result: success
 PAM AcctMgmt()
-  User: "user-needs-reset"
+  User: "user-needs-reset@example.com"
   Result: success
 >
 ────────────────────────────────────────────────────────────────────────────────
diff --git a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Deny_authentication_if_user_does_not_exist b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Deny_authentication_if_user_does_not_exist
index 58714a3771..b44dd5b1a0 100644
--- a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Deny_authentication_if_user_does_not_exist
+++ b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Deny_authentication_if_user_does_not_exist
@@ -2,7 +2,7 @@
 Username: user name
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET}
-Username: user-unexistent
+Username: user-unexistent@example.com
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET}
   Select your provider
@@ -18,14 +18,14 @@ Username: user-unexistent
   1. local
 > 2. ExampleBroker
 
-PAM Error Message: can't select broker: user "user-unexistent" does not exist
+PAM Error Message: user "user-unexistent@example.com" does not exist
 PAM Authenticate()
-  User: "user-unexistent"
+  User: "user-unexistent@example.com"
   Result: error: PAM exit code: 4
     System error
 PAM Info Message: acct=incomplete
 PAM AcctMgmt()
-  User: "user-unexistent"
+  User: "user-unexistent@example.com"
   Result: error: PAM exit code: 25
     The return value should be ignored by PAM dispatch
 >
diff --git a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Error_if_cannot_connect_to_authd b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Error_if_cannot_connect_to_authd
index 4bed1260df..9d1092d65e 100644
--- a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Error_if_cannot_connect_to_authd
+++ b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Error_if_cannot_connect_to_authd
@@ -1,8 +1,7 @@
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET}
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET}
-PAM Error Message: could not connect to unix:///some-path/not-existent-socket: service took too
-long to respond. Disconnecting client
+PAM Error Message: could not connect to unix:///some-path/not-existent-socket: service took too long to respond. Disconnecting client
 PAM Authenticate()
   User: "<unset>"
   Result: error: PAM exit code: 9
diff --git a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Exit_authd_if_user_sigints b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Exit_authd_if_user_sigints
index 3dd4da80a5..026ba11321 100644
--- a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Exit_authd_if_user_sigints
+++ b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Exit_authd_if_user_sigints
@@ -2,7 +2,7 @@
 Username: user name
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET}
-Username: user-integration-sigint
+Username: user-integration-sigint@example.com
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET}
   Select your provider
@@ -24,12 +24,12 @@ Gimme your password:
 
 PAM Error Message: cancel requested
 PAM Authenticate()
-  User: "user-integration-sigint"
+  User: "user-integration-sigint@example.com"
   Result: error: PAM exit code: 26
     Critical error - immediate abort
 PAM Info Message: acct=incomplete
 PAM AcctMgmt()
-  User: "user-integration-sigint"
+  User: "user-integration-sigint@example.com"
   Result: error: PAM exit code: 25
     The return value should be ignored by PAM dispatch
 >
diff --git a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Prevent_user_from_switching_username b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Prevent_user_from_switching_username
index a3506a764b..95042f0805 100644
--- a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Prevent_user_from_switching_username
+++ b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Prevent_user_from_switching_username
@@ -20,7 +20,7 @@ Gimme your password:
   Select your authentication method
 
 > 1. Password authentication
-  2. Send URL to user-integration-pam-preset@gmail.com
+  2. Send URL to user-integration-pam-preset@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -49,10 +49,10 @@ Gimme your password:
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET}
 PAM Authenticate()
-  User: "user-integration-pam-preset"
+  User: "user-integration-pam-preset@example.com"
   Result: success
 PAM AcctMgmt()
-  User: "user-integration-pam-preset"
+  User: "user-integration-pam-preset@example.com"
   Result: success
 >
 ────────────────────────────────────────────────────────────────────────────────
diff --git a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Remember_last_successful_broker_and_mode b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Remember_last_successful_broker_and_mode
index 52b30418b7..74002e7dc8 100644
--- a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Remember_last_successful_broker_and_mode
+++ b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Remember_last_successful_broker_and_mode
@@ -2,7 +2,7 @@
 Username: user name
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET}
-Username: user-integration-remember-mode
+Username: user-integration-remember-mode@example.com
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET}
   Select your provider
@@ -16,7 +16,7 @@ Username: user-integration-remember-mode
   Select your authentication method
 
 > 1. Password authentication
-  2. Send URL to user-integration-remember-mode@gmail.com
+  2. Send URL to user-integration-remember-mode@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -35,10 +35,10 @@ Enter your one time credential:
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET}
 PAM Authenticate()
-  User: "user-integration-remember-mode"
+  User: "user-integration-remember-mode@example.com"
   Result: success
 PAM AcctMgmt()
-  User: "user-integration-remember-mode"
+  User: "user-integration-remember-mode@example.com"
   Result: success
 >
 ────────────────────────────────────────────────────────────────────────────────
@@ -48,7 +48,7 @@ PAM AcctMgmt()
 Username: user name
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET}
-Username: user-integration-remember-mode
+Username: user-integration-remember-mode@example.com
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET}
 Enter your one time credential:
@@ -60,10 +60,10 @@ Enter your one time credential:
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET}
 PAM Authenticate()
-  User: "user-integration-remember-mode"
+  User: "user-integration-remember-mode@example.com"
   Result: success
 PAM AcctMgmt()
-  User: "user-integration-remember-mode"
+  User: "user-integration-remember-mode@example.com"
   Result: success
 >
 ────────────────────────────────────────────────────────────────────────────────
diff --git a/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Change_passwd_after_MFA_auth b/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Change_passwd_after_MFA_auth
index 226bfd497c..5aba2607f9 100644
--- a/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Change_passwd_after_MFA_auth
+++ b/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Change_passwd_after_MFA_auth
@@ -2,7 +2,7 @@
 Username: user name
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd passwd socket=${AUTHD_TEST_TAPE_SOCKET}
-Username: user-mfa-integration-cli-passwd
+Username: user-mfa-integration-cli-passwd@example.com
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd passwd socket=${AUTHD_TEST_TAPE_SOCKET}
   Select your provider
@@ -22,7 +22,7 @@ Gimme your password:
   Select your authentication method
 
 > 1. Password authentication
-  2. Send URL to user-mfa-integration-cli-passwd@gmail.com
+  2. Send URL to user-mfa-integration-cli-passwd@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -108,10 +108,10 @@ Confirm password:
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd passwd socket=${AUTHD_TEST_TAPE_SOCKET}
 PAM ChangeAuthTok()
-  User: "user-mfa-integration-cli-passwd"
+  User: "user-mfa-integration-cli-passwd@example.com"
   Result: success
 PAM AcctMgmt()
-  User: "user-mfa-integration-cli-passwd"
+  User: "user-mfa-integration-cli-passwd@example.com"
   Result: success
 >
 ────────────────────────────────────────────────────────────────────────────────
diff --git a/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Change_password_successfully_and_authenticate_with_new_one b/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Change_password_successfully_and_authenticate_with_new_one
index 3956f5e894..9e8562943d 100644
--- a/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Change_password_successfully_and_authenticate_with_new_one
+++ b/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Change_password_successfully_and_authenticate_with_new_one
@@ -2,7 +2,7 @@
 Username: user name
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd passwd socket=${AUTHD_TEST_TAPE_SOCKET}
-Username: user-integration-simple-testclichangeauthtok
+Username: user-integration-simple-testclichangeauthtok@example.com
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd passwd socket=${AUTHD_TEST_TAPE_SOCKET}
   Select your provider
@@ -52,10 +52,10 @@ Confirm password:
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd passwd socket=${AUTHD_TEST_TAPE_SOCKET}
 PAM ChangeAuthTok()
-  User: "user-integration-simple-testclichangeauthtok"
+  User: "user-integration-simple-testclichangeauthtok@example.com"
   Result: success
 PAM AcctMgmt()
-  User: "user-integration-simple-testclichangeauthtok"
+  User: "user-integration-simple-testclichangeauthtok@example.com"
   Result: success
 >
 ────────────────────────────────────────────────────────────────────────────────
@@ -65,7 +65,7 @@ PAM AcctMgmt()
 Username: user name
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET}
-Username: user-integration-simple-testclichangeauthtok
+Username: user-integration-simple-testclichangeauthtok@example.com
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET}
 Gimme your password:
@@ -75,10 +75,10 @@ Gimme your password:
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET}
 PAM Authenticate()
-  User: "user-integration-simple-testclichangeauthtok"
+  User: "user-integration-simple-testclichangeauthtok@example.com"
   Result: success
 PAM AcctMgmt()
-  User: "user-integration-simple-testclichangeauthtok"
+  User: "user-integration-simple-testclichangeauthtok@example.com"
   Result: success
 >
 ────────────────────────────────────────────────────────────────────────────────
diff --git a/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Change_password_successfully_and_authenticate_with_new_one_with_different_case b/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Change_password_successfully_and_authenticate_with_new_one_with_different_case
index 9499bf2008..2b8d56c183 100644
--- a/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Change_password_successfully_and_authenticate_with_new_one_with_different_case
+++ b/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Change_password_successfully_and_authenticate_with_new_one_with_different_case
@@ -2,7 +2,7 @@
 Username: user name
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd passwd socket=${AUTHD_TEST_TAPE_SOCKET}
-Username: USER-INTEGRATION-CASE-INSENSITIVE-TESTCLICHANGEAUTHTOK
+Username: USER-INTEGRATION-CASE-INSENSITIVE-TESTCLICHANGEAUTHTOK@EXAMPLE.COM
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd passwd socket=${AUTHD_TEST_TAPE_SOCKET}
   Select your provider
@@ -52,10 +52,10 @@ Confirm password:
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd passwd socket=${AUTHD_TEST_TAPE_SOCKET}
 PAM ChangeAuthTok()
-  User: "user-integration-case-insensitive-testclichangeauthtok"
+  User: "user-integration-case-insensitive-testclichangeauthtok@example.com"
   Result: success
 PAM AcctMgmt()
-  User: "user-integration-case-insensitive-testclichangeauthtok"
+  User: "user-integration-case-insensitive-testclichangeauthtok@example.com"
   Result: success
 >
 ────────────────────────────────────────────────────────────────────────────────
@@ -65,7 +65,7 @@ PAM AcctMgmt()
 Username: user name
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET}
-Username: user-integration-case-insensitive-testclichangeauthtok
+Username: user-integration-case-insensitive-testclichangeauthtok@example.com
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET}
 Gimme your password:
@@ -75,10 +75,10 @@ Gimme your password:
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET}
 PAM Authenticate()
-  User: "user-integration-case-insensitive-testclichangeauthtok"
+  User: "user-integration-case-insensitive-testclichangeauthtok@example.com"
   Result: success
 PAM AcctMgmt()
-  User: "user-integration-case-insensitive-testclichangeauthtok"
+  User: "user-integration-case-insensitive-testclichangeauthtok@example.com"
   Result: success
 >
 ────────────────────────────────────────────────────────────────────────────────
diff --git a/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Exit_authd_if_local_broker_is_selected b/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Exit_authd_if_local_broker_is_selected
index 7da792d498..04fb2063dc 100644
--- a/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Exit_authd_if_local_broker_is_selected
+++ b/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Exit_authd_if_local_broker_is_selected
@@ -2,7 +2,7 @@
 Username: user name
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd passwd socket=${AUTHD_TEST_TAPE_SOCKET}
-Username: user-integration-cli-passwd-exit-authd-if-local-broker-is-selected
+Username: user-integration-cli-passwd-exit-authd-if-local-broker-is-selected@example.com
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd passwd socket=${AUTHD_TEST_TAPE_SOCKET}
   Select your provider
@@ -20,11 +20,11 @@ Username: user-integration-cli-passwd-exit-authd-if-local-broker-is-selected
 
 PAM Info Message: chauthtok=incomplete
 PAM ChangeAuthTok()
-  User: "user-integration-cli-passwd-exit-authd-if-local-broker-is-selected"
+  User: "user-integration-cli-passwd-exit-authd-if-local-broker-is-selected@example.com"
   Result: error: PAM exit code: 25
     The return value should be ignored by PAM dispatch
 PAM AcctMgmt()
-  User: "user-integration-cli-passwd-exit-authd-if-local-broker-is-selected"
+  User: "user-integration-cli-passwd-exit-authd-if-local-broker-is-selected@example.com"
   Result: error: PAM exit code: 26
     Critical error - immediate abort
 >
diff --git a/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Exit_authd_if_user_sigints b/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Exit_authd_if_user_sigints
index cc12a32813..178c1fcefd 100644
--- a/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Exit_authd_if_user_sigints
+++ b/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Exit_authd_if_user_sigints
@@ -2,7 +2,7 @@
 Username: user name
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd passwd socket=${AUTHD_TEST_TAPE_SOCKET}
-Username: user-integration-cli-passwd-exit-authd-if-user-sigints
+Username: user-integration-cli-passwd-exit-authd-if-user-sigints@example.com
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd passwd socket=${AUTHD_TEST_TAPE_SOCKET}
   Select your provider
@@ -24,12 +24,12 @@ Gimme your password:
 
 PAM Error Message: cancel requested
 PAM ChangeAuthTok()
-  User: "user-integration-cli-passwd-exit-authd-if-user-sigints"
+  User: "user-integration-cli-passwd-exit-authd-if-user-sigints@example.com"
   Result: error: PAM exit code: 26
     Critical error - immediate abort
 PAM Info Message: acct=incomplete
 PAM AcctMgmt()
-  User: "user-integration-cli-passwd-exit-authd-if-user-sigints"
+  User: "user-integration-cli-passwd-exit-authd-if-user-sigints@example.com"
   Result: error: PAM exit code: 25
     The return value should be ignored by PAM dispatch
 >
diff --git a/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Prevent_change_password_if_auth_fails b/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Prevent_change_password_if_auth_fails
index e8988892a5..3fdf61eb71 100644
--- a/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Prevent_change_password_if_auth_fails
+++ b/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Prevent_change_password_if_auth_fails
@@ -2,7 +2,7 @@
 Username: user name
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd passwd socket=${AUTHD_TEST_TAPE_SOCKET}
-Username: user-integration-cli-passwd-prevent-change-password-if-auth-fails
+Username: user-integration-cli-passwd-prevent-change-password-if-auth-fails@example.com
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd passwd socket=${AUTHD_TEST_TAPE_SOCKET}
   Select your provider
@@ -83,12 +83,12 @@ invalid password 'wrongpass', should be 'goodpass'
 > ./pam_authd passwd socket=${AUTHD_TEST_TAPE_SOCKET}
 PAM Error Message: invalid password 'wrongpass', should be 'goodpass'
 PAM ChangeAuthTok()
-  User: "user-integration-cli-passwd-prevent-change-password-if-auth-fails"
+  User: "user-integration-cli-passwd-prevent-change-password-if-auth-fails@example.com"
   Result: error: PAM exit code: 7
     Authentication failure
 PAM Info Message: acct=incomplete
 PAM AcctMgmt()
-  User: "user-integration-cli-passwd-prevent-change-password-if-auth-fails"
+  User: "user-integration-cli-passwd-prevent-change-password-if-auth-fails@example.com"
   Result: error: PAM exit code: 25
     The return value should be ignored by PAM dispatch
 >
diff --git a/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Prevent_change_password_if_current_user_is_not_root_as_can_not_authenticate b/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Prevent_change_password_if_current_user_is_not_root_as_can_not_authenticate
index d512faa995..f04c9022d7 100644
--- a/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Prevent_change_password_if_current_user_is_not_root_as_can_not_authenticate
+++ b/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Prevent_change_password_if_current_user_is_not_root_as_can_not_authenticate
@@ -1,6 +1,5 @@
 > ./pam_authd passwd socket=${AUTHD_TEST_TAPE_SOCKET}
-PAM Error Message: could not get current available brokers: permission denied: this action is on
-ly allowed for root users. Current user is XXXX
+PAM Error Message: could not get current available brokers: permission denied: only root can perform this operation
 PAM ChangeAuthTok()
   User: "<unset>"
   Result: error: PAM exit code: 4
@@ -13,8 +12,7 @@ PAM AcctMgmt()
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd passwd socket=${AUTHD_TEST_TAPE_SOCKET}
-PAM Error Message: could not get current available brokers: permission denied: this action is on
-ly allowed for root users. Current user is XXXX
+PAM Error Message: could not get current available brokers: permission denied: only root can perform this operation
 PAM ChangeAuthTok()
   User: "<unset>"
   Result: error: PAM exit code: 4
diff --git a/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Prevent_change_password_if_user_does_not_exist b/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Prevent_change_password_if_user_does_not_exist
index 725d73f473..a3dbf7a768 100644
--- a/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Prevent_change_password_if_user_does_not_exist
+++ b/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Prevent_change_password_if_user_does_not_exist
@@ -2,7 +2,7 @@
 Username: user name
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd passwd socket=${AUTHD_TEST_TAPE_SOCKET}
-Username: user-unexistent
+Username: user-unexistent@example.com
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd passwd socket=${AUTHD_TEST_TAPE_SOCKET}
   Select your provider
@@ -18,14 +18,14 @@ Username: user-unexistent
   1. local
 > 2. ExampleBroker
 
-PAM Error Message: can't select broker: user "user-unexistent" does not exist
+PAM Error Message: user "user-unexistent@example.com" does not exist
 PAM ChangeAuthTok()
-  User: "user-unexistent"
+  User: "user-unexistent@example.com"
   Result: error: PAM exit code: 4
     System error
 PAM Info Message: acct=incomplete
 PAM AcctMgmt()
-  User: "user-unexistent"
+  User: "user-unexistent@example.com"
   Result: error: PAM exit code: 25
     The return value should be ignored by PAM dispatch
 >
diff --git a/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Retry_if_new_password_does_not_match_quality_criteria b/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Retry_if_new_password_does_not_match_quality_criteria
index cd742172ba..b2796ce9dd 100644
--- a/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Retry_if_new_password_does_not_match_quality_criteria
+++ b/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Retry_if_new_password_does_not_match_quality_criteria
@@ -2,7 +2,7 @@
 Username: user name
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd passwd socket=${AUTHD_TEST_TAPE_SOCKET}
-Username: user-integration-cli-passwd-retry-if-new-password-does-not-match-quality-criteria
+Username: user-integration-cli-passwd-retry-if-new-password-does-not-match-quality-criteria@example.com
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd passwd socket=${AUTHD_TEST_TAPE_SOCKET}
   Select your provider
@@ -110,10 +110,10 @@ Confirm password:
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd passwd socket=${AUTHD_TEST_TAPE_SOCKET}
 PAM ChangeAuthTok()
-  User: "user-integration-cli-passwd-retry-if-new-password-does-not-match-quality-criteria"
+  User: "user-integration-cli-passwd-retry-if-new-password-does-not-match-quality-criteria@example.com"
   Result: success
 PAM AcctMgmt()
-  User: "user-integration-cli-passwd-retry-if-new-password-does-not-match-quality-criteria"
+  User: "user-integration-cli-passwd-retry-if-new-password-does-not-match-quality-criteria@example.com"
   Result: success
 >
 ────────────────────────────────────────────────────────────────────────────────
diff --git a/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Retry_if_new_password_is_rejected_by_broker b/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Retry_if_new_password_is_rejected_by_broker
index 3057e788a2..86eb74ffa9 100644
--- a/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Retry_if_new_password_is_rejected_by_broker
+++ b/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Retry_if_new_password_is_rejected_by_broker
@@ -2,7 +2,7 @@
 Username: user name
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd passwd socket=${AUTHD_TEST_TAPE_SOCKET}
-Username: user-integration-cli-passwd-retry-if-new-password-is-rejected-by-broker
+Username: user-integration-cli-passwd-retry-if-new-password-is-rejected-by-broker@example.com
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd passwd socket=${AUTHD_TEST_TAPE_SOCKET}
   Select your provider
@@ -80,10 +80,10 @@ Confirm password:
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd passwd socket=${AUTHD_TEST_TAPE_SOCKET}
 PAM ChangeAuthTok()
-  User: "user-integration-cli-passwd-retry-if-new-password-is-rejected-by-broker"
+  User: "user-integration-cli-passwd-retry-if-new-password-is-rejected-by-broker@example.com"
   Result: success
 PAM AcctMgmt()
-  User: "user-integration-cli-passwd-retry-if-new-password-is-rejected-by-broker"
+  User: "user-integration-cli-passwd-retry-if-new-password-is-rejected-by-broker@example.com"
   Result: success
 >
 ────────────────────────────────────────────────────────────────────────────────
@@ -93,7 +93,7 @@ PAM AcctMgmt()
 Username: user name
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd passwd socket=${AUTHD_TEST_TAPE_SOCKET}
-Username: user-integration-cli-passwd-retry-if-new-password-is-rejected-by-broker
+Username: user-integration-cli-passwd-retry-if-new-password-is-rejected-by-broker@example.com
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd passwd socket=${AUTHD_TEST_TAPE_SOCKET}
 Gimme your password:
@@ -157,10 +157,10 @@ Confirm password:
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd passwd socket=${AUTHD_TEST_TAPE_SOCKET}
 PAM ChangeAuthTok()
-  User: "user-integration-cli-passwd-retry-if-new-password-is-rejected-by-broker"
+  User: "user-integration-cli-passwd-retry-if-new-password-is-rejected-by-broker@example.com"
   Result: success
 PAM AcctMgmt()
-  User: "user-integration-cli-passwd-retry-if-new-password-is-rejected-by-broker"
+  User: "user-integration-cli-passwd-retry-if-new-password-is-rejected-by-broker@example.com"
   Result: success
 >
 ────────────────────────────────────────────────────────────────────────────────
diff --git a/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Retry_if_new_password_is_same_of_previous b/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Retry_if_new_password_is_same_of_previous
index cacd0ac142..e92bd15d68 100644
--- a/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Retry_if_new_password_is_same_of_previous
+++ b/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Retry_if_new_password_is_same_of_previous
@@ -2,7 +2,7 @@
 Username: user name
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd passwd socket=${AUTHD_TEST_TAPE_SOCKET}
-Username: user-integration-cli-passwd-retry-if-new-password-is-same-of-previous
+Username: user-integration-cli-passwd-retry-if-new-password-is-same-of-previous@example.com
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd passwd socket=${AUTHD_TEST_TAPE_SOCKET}
   Select your provider
@@ -70,10 +70,10 @@ Confirm password:
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd passwd socket=${AUTHD_TEST_TAPE_SOCKET}
 PAM ChangeAuthTok()
-  User: "user-integration-cli-passwd-retry-if-new-password-is-same-of-previous"
+  User: "user-integration-cli-passwd-retry-if-new-password-is-same-of-previous@example.com"
   Result: success
 PAM AcctMgmt()
-  User: "user-integration-cli-passwd-retry-if-new-password-is-same-of-previous"
+  User: "user-integration-cli-passwd-retry-if-new-password-is-same-of-previous@example.com"
   Result: success
 >
 ────────────────────────────────────────────────────────────────────────────────
diff --git a/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Retry_if_password_confirmation_is_not_the_same b/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Retry_if_password_confirmation_is_not_the_same
index 7c961b09dc..980e3c60ee 100644
--- a/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Retry_if_password_confirmation_is_not_the_same
+++ b/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Retry_if_password_confirmation_is_not_the_same
@@ -2,7 +2,7 @@
 Username: user name
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd passwd socket=${AUTHD_TEST_TAPE_SOCKET}
-Username: user-integration-cli-passwd-retry-if-password-confirmation-is-not-the-same
+Username: user-integration-cli-passwd-retry-if-password-confirmation-is-not-the-same@example.com
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd passwd socket=${AUTHD_TEST_TAPE_SOCKET}
   Select your provider
@@ -80,10 +80,10 @@ Confirm password:
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd passwd socket=${AUTHD_TEST_TAPE_SOCKET}
 PAM ChangeAuthTok()
-  User: "user-integration-cli-passwd-retry-if-password-confirmation-is-not-the-same"
+  User: "user-integration-cli-passwd-retry-if-password-confirmation-is-not-the-same@example.com"
   Result: success
 PAM AcctMgmt()
-  User: "user-integration-cli-passwd-retry-if-password-confirmation-is-not-the-same"
+  User: "user-integration-cli-passwd-retry-if-password-confirmation-is-not-the-same@example.com"
   Result: success
 >
 ────────────────────────────────────────────────────────────────────────────────
diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_and_accept_password_reset b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_and_accept_password_reset
index ec2dd3c961..7eb25bb85a 100644
--- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_and_accept_password_reset
+++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_and_accept_password_reset
@@ -129,10 +129,10 @@ Enter your new password (3 days until mandatory):
 Confirm Password:
 >
 PAM Authenticate()
-  User: "user-can-reset-integration-accept-native"
+  User: "user-can-reset-integration-accept-native@example.com"
   Result: success
 PAM AcctMgmt()
-  User: "user-can-reset-integration-accept-native"
+  User: "user-can-reset-integration-accept-native@example.com"
   Result: success
 >
 ────────────────────────────────────────────────────────────────────────────────
diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_and_add_it_to_local_group b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_and_add_it_to_local_group
index dbab76e189..2b0b7cf758 100644
--- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_and_add_it_to_local_group
+++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_and_add_it_to_local_group
@@ -34,10 +34,10 @@ Enter 'r' to cancel the request and go back to select the authentication method
 Gimme your password:
 >
 PAM Authenticate()
-  User: "user-local-groups-integration-auth-native"
+  User: "user-local-groups-integration-auth-native@example.com"
   Result: success
 PAM AcctMgmt()
-  User: "user-local-groups-integration-auth-native"
+  User: "user-local-groups-integration-auth-native@example.com"
   Result: success
 >
 ────────────────────────────────────────────────────────────────────────────────
diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_and_add_it_to_local_group.gpasswd_out b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_and_add_it_to_local_group.gpasswd_out
deleted file mode 100644
index 4f5e85619d..0000000000
--- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_and_add_it_to_local_group.gpasswd_out
+++ /dev/null
@@ -1 +0,0 @@
---add user-local-groups-integration-auth-native localgroup
\ No newline at end of file
diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_and_add_it_to_local_group.group b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_and_add_it_to_local_group.group
new file mode 100644
index 0000000000..fd77630698
--- /dev/null
+++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_and_add_it_to_local_group.group
@@ -0,0 +1 @@
+localgroup:x:41:user-local-groups-integration-auth-native@example.com
diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_and_add_it_to_local_group.groups b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_and_add_it_to_local_group.group.backup
similarity index 100%
rename from pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_and_add_it_to_local_group.groups
rename to pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_and_add_it_to_local_group.group.backup
diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_and_offer_password_reset b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_and_offer_password_reset
index 4626c4d593..c6e1e521ba 100644
--- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_and_offer_password_reset
+++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_and_offer_password_reset
@@ -77,10 +77,10 @@ Or enter 'r' to go back to choose the provider
 Choose action:
 > 2
 PAM Authenticate()
-  User: "user-can-reset-integration-skip-native"
+  User: "user-can-reset-integration-skip-native@example.com"
   Result: success
 PAM AcctMgmt()
-  User: "user-can-reset-integration-skip-native"
+  User: "user-can-reset-integration-skip-native@example.com"
   Result: success
 >
 ────────────────────────────────────────────────────────────────────────────────
diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_and_reset_password_while_enforcing_policy b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_and_reset_password_while_enforcing_policy
index 0170d9ea3a..547b90086a 100644
--- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_and_reset_password_while_enforcing_policy
+++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_and_reset_password_while_enforcing_policy
@@ -75,10 +75,10 @@ Enter your new password:
 Confirm Password:
 >
 PAM Authenticate()
-  User: "user-needs-reset-integration-mandatory-native"
+  User: "user-needs-reset-integration-mandatory-native@example.com"
   Result: success
 PAM AcctMgmt()
-  User: "user-needs-reset-integration-mandatory-native"
+  User: "user-needs-reset-integration-mandatory-native@example.com"
   Result: success
 >
 ────────────────────────────────────────────────────────────────────────────────
diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_and_reset_password_with_case_insensitive_user_selection b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_and_reset_password_with_case_insensitive_user_selection
index 4454a73c6b..49d7cefb62 100644
--- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_and_reset_password_with_case_insensitive_user_selection
+++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_and_reset_password_with_case_insensitive_user_selection
@@ -2,10 +2,10 @@
 Username:
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
-Username: user-needs-reset-integration-case-insensitive-testnativeauthenticate
+Username: user-needs-reset-integration-case-insensitive-native-testnativeauthenticate@example.com
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
-Username: user-needs-reset-integration-case-insensitive-testnativeauthenticate
+Username: user-needs-reset-integration-case-insensitive-native-testnativeauthenticate@example.com
 == Provider selection ==
   1. local
   2. ExampleBroker
@@ -14,7 +14,7 @@ Choose your provider:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
-Username: user-needs-reset-integration-case-insensitive-testnativeauthenticate
+Username: user-needs-reset-integration-case-insensitive-native-testnativeauthenticate@example.com
 == Provider selection ==
   1. local
   2. ExampleBroker
@@ -23,7 +23,7 @@ Choose your provider:
 > 2
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
-Username: user-needs-reset-integration-case-insensitive-testnativeauthenticate
+Username: user-needs-reset-integration-case-insensitive-native-testnativeauthenticate@example.com
 == Provider selection ==
   1. local
   2. ExampleBroker
@@ -36,7 +36,7 @@ Gimme your password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
-Username: user-needs-reset-integration-case-insensitive-testnativeauthenticate
+Username: user-needs-reset-integration-case-insensitive-native-testnativeauthenticate@example.com
 == Provider selection ==
   1. local
   2. ExampleBroker
@@ -54,7 +54,7 @@ Enter your new password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
-Username: user-needs-reset-integration-case-insensitive-testnativeauthenticate
+Username: user-needs-reset-integration-case-insensitive-native-testnativeauthenticate@example.com
 == Provider selection ==
   1. local
   2. ExampleBroker
@@ -74,7 +74,7 @@ Confirm Password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
-Username: user-needs-reset-integration-case-insensitive-testnativeauthenticate
+Username: user-needs-reset-integration-case-insensitive-native-testnativeauthenticate@example.com
 == Provider selection ==
   1. local
   2. ExampleBroker
@@ -93,10 +93,10 @@ Enter your new password:
 Confirm Password:
 >
 PAM Authenticate()
-  User: "user-needs-reset-integration-case-insensitive-testnativeauthenticate"
+  User: "user-needs-reset-integration-case-insensitive-native-testnativeauthenticate@example.com"
   Result: success
 PAM AcctMgmt()
-  User: "user-needs-reset-integration-case-insensitive-testnativeauthenticate"
+  User: "user-needs-reset-integration-case-insensitive-native-testnativeauthenticate@example.com"
   Result: success
 >
 ────────────────────────────────────────────────────────────────────────────────
@@ -106,26 +106,26 @@ PAM AcctMgmt()
 Username:
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
-Username: USER-NEEDS-RESET-INTEGRATION-CASE-INSENSITIVE-TESTNATIVEAUTHENTICATE
+Username: USER-NEEDS-RESET-INTEGRATION-CASE-INSENSITIVE-NATIVE-TESTNATIVEAUTHENTICATE@EXAMPLE.COM
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
-Username: USER-NEEDS-RESET-INTEGRATION-CASE-INSENSITIVE-TESTNATIVEAUTHENTICATE
+Username: USER-NEEDS-RESET-INTEGRATION-CASE-INSENSITIVE-NATIVE-TESTNATIVEAUTHENTICATE@EXAMPLE.COM
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
 Gimme your password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
-Username: USER-NEEDS-RESET-INTEGRATION-CASE-INSENSITIVE-TESTNATIVEAUTHENTICATE
+Username: USER-NEEDS-RESET-INTEGRATION-CASE-INSENSITIVE-NATIVE-TESTNATIVEAUTHENTICATE@EXAMPLE.COM
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
 Gimme your password:
 >
 PAM Authenticate()
-  User: "user-needs-reset-integration-case-insensitive-testnativeauthenticate"
+  User: "user-needs-reset-integration-case-insensitive-native-testnativeauthenticate@example.com"
   Result: success
 PAM AcctMgmt()
-  User: "user-needs-reset-integration-case-insensitive-testnativeauthenticate"
+  User: "user-needs-reset-integration-case-insensitive-native-testnativeauthenticate@example.com"
   Result: success
 >
 ────────────────────────────────────────────────────────────────────────────────
@@ -135,26 +135,26 @@ PAM AcctMgmt()
 Username:
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
-Username: user-needs-reset-integration-Case-INSENSITIVE-testnativeauthenticate
+Username: user-needs-reset-integration-Case-INSENSITIVE-native-testnativeauthenticate@example.com
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
-Username: user-needs-reset-integration-Case-INSENSITIVE-testnativeauthenticate
+Username: user-needs-reset-integration-Case-INSENSITIVE-native-testnativeauthenticate@example.com
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
 Gimme your password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
-Username: user-needs-reset-integration-Case-INSENSITIVE-testnativeauthenticate
+Username: user-needs-reset-integration-Case-INSENSITIVE-native-testnativeauthenticate@example.com
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
 Gimme your password:
 >
 PAM Authenticate()
-  User: "user-needs-reset-integration-case-insensitive-testnativeauthenticate"
+  User: "user-needs-reset-integration-case-insensitive-native-testnativeauthenticate@example.com"
   Result: success
 PAM AcctMgmt()
-  User: "user-needs-reset-integration-case-insensitive-testnativeauthenticate"
+  User: "user-needs-reset-integration-case-insensitive-native-testnativeauthenticate@example.com"
   Result: success
 >
 ────────────────────────────────────────────────────────────────────────────────
diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_on_ssh_service b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_on_ssh_service
index aa0ab0ee9f..2b494f40e2 100644
--- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_on_ssh_service
+++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_on_ssh_service
@@ -34,10 +34,10 @@ Enter 'r' to cancel the request and go back to select the authentication method
 Gimme your password:
 >
 PAM Authenticate()
-  User: "user-integration-pre-check-ssh-service-native"
+  User: "user-integration-pre-check-ssh-service-native@example.com"
   Result: success
 PAM AcctMgmt()
-  User: "user-integration-pre-check-ssh-service-native"
+  User: "user-integration-pre-check-ssh-service-native@example.com"
   Result: success
 >
 ────────────────────────────────────────────────────────────────────────────────
diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_on_ssh_service_with_custom_name_and_auth_info_env b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_on_ssh_service_with_custom_name_and_auth_info_env
index c53267eabb..3e507abe98 100644
--- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_on_ssh_service_with_custom_name_and_auth_info_env
+++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_on_ssh_service_with_custom_name_and_auth_info_env
@@ -34,10 +34,10 @@ Enter 'r' to cancel the request and go back to select the authentication method
 Gimme your password:
 >
 PAM Authenticate()
-  User: "user-integration-pre-check-ssh-auth-info-native"
+  User: "user-integration-pre-check-ssh-auth-info-native@example.com"
   Result: success
 PAM AcctMgmt()
-  User: "user-integration-pre-check-ssh-auth-info-native"
+  User: "user-integration-pre-check-ssh-auth-info-native@example.com"
   Result: success
 >
 ────────────────────────────────────────────────────────────────────────────────
diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_on_ssh_service_with_custom_name_and_connection_env b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_on_ssh_service_with_custom_name_and_connection_env
index dd82982b5c..c2ead98956 100644
--- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_on_ssh_service_with_custom_name_and_connection_env
+++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_on_ssh_service_with_custom_name_and_connection_env
@@ -34,10 +34,10 @@ Enter 'r' to cancel the request and go back to select the authentication method
 Gimme your password:
 >
 PAM Authenticate()
-  User: "user-integration-pre-check-ssh-connection-native"
+  User: "user-integration-pre-check-ssh-connection-native@example.com"
   Result: success
 PAM AcctMgmt()
-  User: "user-integration-pre-check-ssh-connection-native"
+  User: "user-integration-pre-check-ssh-connection-native@example.com"
   Result: success
 >
 ────────────────────────────────────────────────────────────────────────────────
diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_successfully b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_successfully
index 54700ae47a..c2f29b7434 100644
--- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_successfully
+++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_successfully
@@ -34,10 +34,10 @@ Enter 'r' to cancel the request and go back to select the authentication method
 Gimme your password:
 >
 PAM Authenticate()
-  User: "user-integration-native-authenticate-user-successfully"
+  User: "user-integration-native-authenticate-user-successfully@example.com"
   Result: success
 PAM AcctMgmt()
-  User: "user-integration-native-authenticate-user-successfully"
+  User: "user-integration-native-authenticate-user-successfully@example.com"
   Result: success
 >
 ────────────────────────────────────────────────────────────────────────────────
diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_successfully_after_db_migration b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_successfully_after_db_migration
index ad2cc557cc..e4c2d24f8f 100644
--- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_successfully_after_db_migration
+++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_successfully_after_db_migration
@@ -10,10 +10,10 @@ Enter 'r' to cancel the request and go back to select the authentication method
 Gimme your password:
 >
 PAM Authenticate()
-  User: "user-integration-cached"
+  User: "user-integration-cached@example.com"
   Result: success
 PAM AcctMgmt()
-  User: "user-integration-cached"
+  User: "user-integration-cached@example.com"
   Result: success
 >
 ────────────────────────────────────────────────────────────────────────────────
diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_successfully_after_db_migration.group b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_successfully_after_db_migration.group
new file mode 100644
index 0000000000..2c7783d30a
--- /dev/null
+++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_successfully_after_db_migration.group
@@ -0,0 +1,6 @@
+localgroup:x:41:user-integration-with-mixed-case@example.com,user-integration-cached@example.com,user-integration-pre-check-with-upper-case@example.com,user-integration-upper-case@example.com,user-pre-check@example.com
+some-group-for-user-integration-WITH-Mixed-CaSe@example.com:x:101:user-integration-with-mixed-case@example.com
+some-group-for-user-integration-cached@example.com:x:102:user-integration-cached@example.com
+some-group-for-user-integration-pre-check-WITH-UPPER-CASE@example.com:x:103:user-integration-pre-check-with-upper-case@example.com
+some-group-for-user-integration-UPPER-CASE@example.com:x:104:user-integration-upper-case@example.com
+some-group-for-user-pre-check@example.com:x:105:user-pre-check@example.com
diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_successfully_after_db_migration.group.backup b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_successfully_after_db_migration.group.backup
new file mode 100644
index 0000000000..7fe8ba8346
--- /dev/null
+++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_successfully_after_db_migration.group.backup
@@ -0,0 +1,6 @@
+localgroup:x:41:user-integration-WITH-Mixed-CaSe@example.com,user-integration-cached@example.com,user-integration-pre-check-WITH-UPPER-CASE@example.com,user-integration-UPPER-CASE@example.com,user-pre-check@example.com
+some-group-for-user-integration-WITH-Mixed-CaSe@example.com:x:101:user-integration-WITH-Mixed-CaSe@example.com
+some-group-for-user-integration-cached@example.com:x:102:user-integration-cached@example.com
+some-group-for-user-integration-pre-check-WITH-UPPER-CASE@example.com:x:103:user-integration-pre-check-WITH-UPPER-CASE@example.com
+some-group-for-user-integration-UPPER-CASE@example.com:x:104:user-integration-UPPER-CASE@example.com
+some-group-for-user-pre-check@example.com:x:105:user-pre-check@example.com
diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_successfully_after_db_migration.groups b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_successfully_after_db_migration.groups
deleted file mode 100644
index f31a69be33..0000000000
--- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_successfully_after_db_migration.groups
+++ /dev/null
@@ -1,6 +0,0 @@
-localgroup:x:41:user-integration-with-mixed-case,user-integration-cached,user-integration-pre-check-with-upper-case,user-integration-upper-case,user-pre-check
-some-group-for-user-integration-WITH-Mixed-CaSe:x:101:user-integration-with-mixed-case
-some-group-for-user-integration-cached:x:102:user-integration-cached
-some-group-for-user-integration-pre-check-WITH-UPPER-CASE:x:103:user-integration-pre-check-with-upper-case
-some-group-for-user-integration-UPPER-CASE:x:104:user-integration-upper-case
-some-group-for-user-pre-check:x:105:user-pre-check
diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_successfully_using_upper_case_with_user_selection b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_successfully_using_upper_case_with_user_selection
index d64bdd7f1c..baa9396637 100644
--- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_successfully_using_upper_case_with_user_selection
+++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_successfully_using_upper_case_with_user_selection
@@ -7,11 +7,11 @@ Username:
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
 Username:
-Username: USER-INTEGRATION-SELECTION-UPPER-CASE-TESTNATIVEAUTHENTICATE
+Username: USER-INTEGRATION-SELECTION-UPPER-CASE-NATIVE-TESTNATIVEAUTHENTICATE@EXAMPLE.COM
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
 Username:
-Username: USER-INTEGRATION-SELECTION-UPPER-CASE-TESTNATIVEAUTHENTICATE
+Username: USER-INTEGRATION-SELECTION-UPPER-CASE-NATIVE-TESTNATIVEAUTHENTICATE@EXAMPLE.COM
 == Provider selection ==
   1. local
   2. ExampleBroker
@@ -21,7 +21,7 @@ Choose your provider:
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
 Username:
-Username: USER-INTEGRATION-SELECTION-UPPER-CASE-TESTNATIVEAUTHENTICATE
+Username: USER-INTEGRATION-SELECTION-UPPER-CASE-NATIVE-TESTNATIVEAUTHENTICATE@EXAMPLE.COM
 == Provider selection ==
   1. local
   2. ExampleBroker
@@ -31,7 +31,7 @@ Choose your provider:
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
 Username:
-Username: USER-INTEGRATION-SELECTION-UPPER-CASE-TESTNATIVEAUTHENTICATE
+Username: USER-INTEGRATION-SELECTION-UPPER-CASE-NATIVE-TESTNATIVEAUTHENTICATE@EXAMPLE.COM
 == Provider selection ==
   1. local
   2. ExampleBroker
@@ -45,7 +45,7 @@ Gimme your password:
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
 Username:
-Username: USER-INTEGRATION-SELECTION-UPPER-CASE-TESTNATIVEAUTHENTICATE
+Username: USER-INTEGRATION-SELECTION-UPPER-CASE-NATIVE-TESTNATIVEAUTHENTICATE@EXAMPLE.COM
 == Provider selection ==
   1. local
   2. ExampleBroker
@@ -57,10 +57,10 @@ Enter 'r' to cancel the request and go back to select the authentication method
 Gimme your password:
 >
 PAM Authenticate()
-  User: "user-integration-selection-upper-case-testnativeauthenticate"
+  User: "user-integration-selection-upper-case-native-testnativeauthenticate@example.com"
   Result: success
 PAM AcctMgmt()
-  User: "user-integration-selection-upper-case-testnativeauthenticate"
+  User: "user-integration-selection-upper-case-native-testnativeauthenticate@example.com"
   Result: success
 >
 ────────────────────────────────────────────────────────────────────────────────
diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_successfully_with_invalid_connection_timeout b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_successfully_with_invalid_connection_timeout
index 5245a6d1a3..65fcd1838e 100644
--- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_successfully_with_invalid_connection_timeout
+++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_successfully_with_invalid_connection_timeout
@@ -34,10 +34,10 @@ Enter 'r' to cancel the request and go back to select the authentication method
 Gimme your password:
 >
 PAM Authenticate()
-  User: "user-integration-simple-auth-invalid-timeout-native"
+  User: "user-integration-simple-auth-invalid-timeout-native@example.com"
   Result: success
 PAM AcctMgmt()
-  User: "user-integration-simple-auth-invalid-timeout-native"
+  User: "user-integration-simple-auth-invalid-timeout-native@example.com"
   Result: success
 >
 ────────────────────────────────────────────────────────────────────────────────
diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_successfully_with_password_only_supported_method b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_successfully_with_password_only_supported_method
index c065694c8a..74ce523ac0 100644
--- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_successfully_with_password_only_supported_method
+++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_successfully_with_password_only_supported_method
@@ -34,10 +34,10 @@ Enter 'r' to cancel the request and go back to choose the provider
 Gimme your password:
 >
 PAM Authenticate()
-  User: "user-auth-modes-password-integration-native"
+  User: "user-auth-modes-password-integration-native@example.com"
   Result: success
 PAM AcctMgmt()
-  User: "user-auth-modes-password-integration-native"
+  User: "user-auth-modes-password-integration-native@example.com"
   Result: success
 >
 ────────────────────────────────────────────────────────────────────────────────
diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_successfully_with_password_only_supported_method_in_polkit b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_successfully_with_password_only_supported_method_in_polkit
index 7ef63eaa88..83219c3ca3 100644
--- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_successfully_with_password_only_supported_method_in_polkit
+++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_successfully_with_password_only_supported_method_in_polkit
@@ -8,10 +8,10 @@ Gimme your password:
 Gimme your password:
 >
 PAM Authenticate()
-  User: "user-auth-modes-password-integration-polkit-testnativeauthenticate"
+  User: "user-auth-modes-password-integration-polkit-native@example.com-testnativeauthenticate@example.com"
   Result: success
 PAM AcctMgmt()
-  User: "user-auth-modes-password-integration-polkit-testnativeauthenticate"
+  User: "user-auth-modes-password-integration-polkit-native@example.com-testnativeauthenticate@example.com"
   Result: success
 >
 ────────────────────────────────────────────────────────────────────────────────
diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_successfully_with_socket_stdout b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_successfully_with_socket_stdout
deleted file mode 100644
index 5e8d6585d7..0000000000
--- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_successfully_with_socket_stdout
+++ /dev/null
@@ -1,47 +0,0 @@
-> python3 /DEV/authd/pam/integration-tests/sshuttle-sudo.py ./pam_authd login socket=${AUTHD_TES
-T_TAPE_SOCKET}
-== Provider selection ==
-  1. local
-  2. ExampleBroker
-Choose your provider:
->
-────────────────────────────────────────────────────────────────────────────────
-> python3 /DEV/authd/pam/integration-tests/sshuttle-sudo.py ./pam_authd login socket=${AUTHD_TES
-T_TAPE_SOCKET}
-== Provider selection ==
-  1. local
-  2. ExampleBroker
-Choose your provider:
-> 2
-────────────────────────────────────────────────────────────────────────────────
-> python3 /DEV/authd/pam/integration-tests/sshuttle-sudo.py ./pam_authd login socket=${AUTHD_TES
-T_TAPE_SOCKET}
-== Provider selection ==
-  1. local
-  2. ExampleBroker
-Choose your provider:
-> 2
-== Password authentication ==
-Enter 'r' to cancel the request and go back to select the authentication method
-Gimme your password:
->
-────────────────────────────────────────────────────────────────────────────────
-> python3 /DEV/authd/pam/integration-tests/sshuttle-sudo.py ./pam_authd login socket=${AUTHD_TES
-T_TAPE_SOCKET}
-== Provider selection ==
-  1. local
-  2. ExampleBroker
-Choose your provider:
-> 2
-== Password authentication ==
-Enter 'r' to cancel the request and go back to select the authentication method
-Gimme your password:
->
-PAM Authenticate()
-  User: "user-integration-native-authenticate-user-successfully-with-socket-stdout"
-  Result: success
-PAM AcctMgmt()
-  User: "user-integration-native-authenticate-user-successfully-with-socket-stdout"
-  Result: success
->
-────────────────────────────────────────────────────────────────────────────────
diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_successfully_with_upper_case b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_successfully_with_upper_case
index 9c9f7f5ae1..6270c76e74 100644
--- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_successfully_with_upper_case
+++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_successfully_with_upper_case
@@ -34,10 +34,10 @@ Enter 'r' to cancel the request and go back to select the authentication method
 Gimme your password:
 >
 PAM Authenticate()
-  User: "user-integration-upper-case-testnativeauthenticate"
+  User: "user-integration-upper-case-native-testnativeauthenticate@example.com"
   Result: success
 PAM AcctMgmt()
-  User: "user-integration-upper-case-testnativeauthenticate"
+  User: "user-integration-upper-case-native-testnativeauthenticate@example.com"
   Result: success
 >
 ────────────────────────────────────────────────────────────────────────────────
diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_successfully_with_user_selection b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_successfully_with_user_selection
index 625c8ce93b..04cbb32c88 100644
--- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_successfully_with_user_selection
+++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_successfully_with_user_selection
@@ -7,11 +7,11 @@ Username:
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
 Username:
-Username: user-integration-native-user-selection
+Username: user-integration-native-user-selection@example.com
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
 Username:
-Username: user-integration-native-user-selection
+Username: user-integration-native-user-selection@example.com
 == Provider selection ==
   1. local
   2. ExampleBroker
@@ -21,7 +21,7 @@ Choose your provider:
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
 Username:
-Username: user-integration-native-user-selection
+Username: user-integration-native-user-selection@example.com
 == Provider selection ==
   1. local
   2. ExampleBroker
@@ -31,7 +31,7 @@ Choose your provider:
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
 Username:
-Username: user-integration-native-user-selection
+Username: user-integration-native-user-selection@example.com
 == Provider selection ==
   1. local
   2. ExampleBroker
@@ -45,7 +45,7 @@ Gimme your password:
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
 Username:
-Username: user-integration-native-user-selection
+Username: user-integration-native-user-selection@example.com
 == Provider selection ==
   1. local
   2. ExampleBroker
@@ -57,10 +57,10 @@ Enter 'r' to cancel the request and go back to select the authentication method
 Gimme your password:
 >
 PAM Authenticate()
-  User: "user-integration-native-user-selection"
+  User: "user-integration-native-user-selection@example.com"
   Result: success
 PAM AcctMgmt()
-  User: "user-integration-native-user-selection"
+  User: "user-integration-native-user-selection@example.com"
   Result: success
 >
 ────────────────────────────────────────────────────────────────────────────────
diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_switching_auth_mode b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_switching_auth_mode
index 3397b6e8bf..3de449cc01 100644
--- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_switching_auth_mode
+++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_switching_auth_mode
@@ -35,7 +35,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -58,7 +58,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -81,7 +81,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -91,10 +91,9 @@ Gimme your password:
 Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 2
-== Send URL to user-integration-switch-mode-native@gmail.com ==
-Leave the input field empty to wait for the alternative authentication method or enter 'r' to go
- back to select the authentication method
-Click on the link received at user-integration-switch-mode-native@gmail.com or enter the code:
+== Send URL to user-integration-switch-mode-native@example.com ==
+Leave the input field empty to wait for the alternative authentication method or enter 'r' to go back to select the authentication method
+Click on the link received at user-integration-switch-mode-native@example.com or enter the code:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
@@ -109,7 +108,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -119,10 +118,9 @@ Gimme your password:
 Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 2
-== Send URL to user-integration-switch-mode-native@gmail.com ==
-Leave the input field empty to wait for the alternative authentication method or enter 'r' to go
- back to select the authentication method
-Click on the link received at user-integration-switch-mode-native@gmail.com or enter the code:
+== Send URL to user-integration-switch-mode-native@example.com ==
+Leave the input field empty to wait for the alternative authentication method or enter 'r' to go back to select the authentication method
+Click on the link received at user-integration-switch-mode-native@example.com or enter the code:
 > r
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
@@ -137,7 +135,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -147,14 +145,13 @@ Gimme your password:
 Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 2
-== Send URL to user-integration-switch-mode-native@gmail.com ==
-Leave the input field empty to wait for the alternative authentication method or enter 'r' to go
- back to select the authentication method
-Click on the link received at user-integration-switch-mode-native@gmail.com or enter the code:
+== Send URL to user-integration-switch-mode-native@example.com ==
+Leave the input field empty to wait for the alternative authentication method or enter 'r' to go back to select the authentication method
+Click on the link received at user-integration-switch-mode-native@example.com or enter the code:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -177,7 +174,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -187,14 +184,13 @@ Gimme your password:
 Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 2
-== Send URL to user-integration-switch-mode-native@gmail.com ==
-Leave the input field empty to wait for the alternative authentication method or enter 'r' to go
- back to select the authentication method
-Click on the link received at user-integration-switch-mode-native@gmail.com or enter the code:
+== Send URL to user-integration-switch-mode-native@example.com ==
+Leave the input field empty to wait for the alternative authentication method or enter 'r' to go back to select the authentication method
+Click on the link received at user-integration-switch-mode-native@example.com or enter the code:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -217,7 +213,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -227,14 +223,13 @@ Gimme your password:
 Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 2
-== Send URL to user-integration-switch-mode-native@gmail.com ==
-Leave the input field empty to wait for the alternative authentication method or enter 'r' to go
- back to select the authentication method
-Click on the link received at user-integration-switch-mode-native@gmail.com or enter the code:
+== Send URL to user-integration-switch-mode-native@example.com ==
+Leave the input field empty to wait for the alternative authentication method or enter 'r' to go back to select the authentication method
+Click on the link received at user-integration-switch-mode-native@example.com or enter the code:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -245,8 +240,7 @@ Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 3
 == Use your fido device foo ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Plug your fido device and press with your thumb:
 >
 ────────────────────────────────────────────────────────────────────────────────
@@ -262,7 +256,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -272,14 +266,13 @@ Gimme your password:
 Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 2
-== Send URL to user-integration-switch-mode-native@gmail.com ==
-Leave the input field empty to wait for the alternative authentication method or enter 'r' to go
- back to select the authentication method
-Click on the link received at user-integration-switch-mode-native@gmail.com or enter the code:
+== Send URL to user-integration-switch-mode-native@example.com ==
+Leave the input field empty to wait for the alternative authentication method or enter 'r' to go back to select the authentication method
+Click on the link received at user-integration-switch-mode-native@example.com or enter the code:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -290,8 +283,7 @@ Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 3
 == Use your fido device foo ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Plug your fido device and press with your thumb:
 > r
 ────────────────────────────────────────────────────────────────────────────────
@@ -307,7 +299,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -317,14 +309,13 @@ Gimme your password:
 Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 2
-== Send URL to user-integration-switch-mode-native@gmail.com ==
-Leave the input field empty to wait for the alternative authentication method or enter 'r' to go
- back to select the authentication method
-Click on the link received at user-integration-switch-mode-native@gmail.com or enter the code:
+== Send URL to user-integration-switch-mode-native@example.com ==
+Leave the input field empty to wait for the alternative authentication method or enter 'r' to go back to select the authentication method
+Click on the link received at user-integration-switch-mode-native@example.com or enter the code:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -335,13 +326,12 @@ Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 3
 == Use your fido device foo ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Plug your fido device and press with your thumb:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -364,7 +354,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -374,14 +364,13 @@ Gimme your password:
 Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 2
-== Send URL to user-integration-switch-mode-native@gmail.com ==
-Leave the input field empty to wait for the alternative authentication method or enter 'r' to go
- back to select the authentication method
-Click on the link received at user-integration-switch-mode-native@gmail.com or enter the code:
+== Send URL to user-integration-switch-mode-native@example.com ==
+Leave the input field empty to wait for the alternative authentication method or enter 'r' to go back to select the authentication method
+Click on the link received at user-integration-switch-mode-native@example.com or enter the code:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -392,13 +381,12 @@ Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 3
 == Use your fido device foo ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Plug your fido device and press with your thumb:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -421,7 +409,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -431,14 +419,13 @@ Gimme your password:
 Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 2
-== Send URL to user-integration-switch-mode-native@gmail.com ==
-Leave the input field empty to wait for the alternative authentication method or enter 'r' to go
- back to select the authentication method
-Click on the link received at user-integration-switch-mode-native@gmail.com or enter the code:
+== Send URL to user-integration-switch-mode-native@example.com ==
+Leave the input field empty to wait for the alternative authentication method or enter 'r' to go back to select the authentication method
+Click on the link received at user-integration-switch-mode-native@example.com or enter the code:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -449,13 +436,12 @@ Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 3
 == Use your fido device foo ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Plug your fido device and press with your thumb:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -466,8 +452,7 @@ Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 4
 == Use your phone +33... ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Unlock your phone +33... or accept request on web interface:
 >
 ────────────────────────────────────────────────────────────────────────────────
@@ -483,7 +468,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -493,14 +478,13 @@ Gimme your password:
 Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 2
-== Send URL to user-integration-switch-mode-native@gmail.com ==
-Leave the input field empty to wait for the alternative authentication method or enter 'r' to go
- back to select the authentication method
-Click on the link received at user-integration-switch-mode-native@gmail.com or enter the code:
+== Send URL to user-integration-switch-mode-native@example.com ==
+Leave the input field empty to wait for the alternative authentication method or enter 'r' to go back to select the authentication method
+Click on the link received at user-integration-switch-mode-native@example.com or enter the code:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -511,13 +495,12 @@ Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 3
 == Use your fido device foo ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Plug your fido device and press with your thumb:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -528,8 +511,7 @@ Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 4
 == Use your phone +33... ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Unlock your phone +33... or accept request on web interface:
 > r
 ────────────────────────────────────────────────────────────────────────────────
@@ -545,7 +527,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -555,14 +537,13 @@ Gimme your password:
 Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 2
-== Send URL to user-integration-switch-mode-native@gmail.com ==
-Leave the input field empty to wait for the alternative authentication method or enter 'r' to go
- back to select the authentication method
-Click on the link received at user-integration-switch-mode-native@gmail.com or enter the code:
+== Send URL to user-integration-switch-mode-native@example.com ==
+Leave the input field empty to wait for the alternative authentication method or enter 'r' to go back to select the authentication method
+Click on the link received at user-integration-switch-mode-native@example.com or enter the code:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -573,13 +554,12 @@ Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 3
 == Use your fido device foo ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Plug your fido device and press with your thumb:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -590,13 +570,12 @@ Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 4
 == Use your phone +33... ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Unlock your phone +33... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -619,7 +598,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -629,14 +608,13 @@ Gimme your password:
 Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 2
-== Send URL to user-integration-switch-mode-native@gmail.com ==
-Leave the input field empty to wait for the alternative authentication method or enter 'r' to go
- back to select the authentication method
-Click on the link received at user-integration-switch-mode-native@gmail.com or enter the code:
+== Send URL to user-integration-switch-mode-native@example.com ==
+Leave the input field empty to wait for the alternative authentication method or enter 'r' to go back to select the authentication method
+Click on the link received at user-integration-switch-mode-native@example.com or enter the code:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -647,13 +625,12 @@ Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 3
 == Use your fido device foo ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Plug your fido device and press with your thumb:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -664,13 +641,12 @@ Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 4
 == Use your phone +33... ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Unlock your phone +33... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -693,7 +669,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -703,14 +679,13 @@ Gimme your password:
 Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 2
-== Send URL to user-integration-switch-mode-native@gmail.com ==
-Leave the input field empty to wait for the alternative authentication method or enter 'r' to go
- back to select the authentication method
-Click on the link received at user-integration-switch-mode-native@gmail.com or enter the code:
+== Send URL to user-integration-switch-mode-native@example.com ==
+Leave the input field empty to wait for the alternative authentication method or enter 'r' to go back to select the authentication method
+Click on the link received at user-integration-switch-mode-native@example.com or enter the code:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -721,13 +696,12 @@ Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 3
 == Use your fido device foo ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Plug your fido device and press with your thumb:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -738,13 +712,12 @@ Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 4
 == Use your phone +33... ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Unlock your phone +33... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -755,8 +728,7 @@ Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 5
 == Use your phone +1... ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Unlock your phone +1... or accept request on web interface:
 >
 ────────────────────────────────────────────────────────────────────────────────
@@ -772,7 +744,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -782,14 +754,13 @@ Gimme your password:
 Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 2
-== Send URL to user-integration-switch-mode-native@gmail.com ==
-Leave the input field empty to wait for the alternative authentication method or enter 'r' to go
- back to select the authentication method
-Click on the link received at user-integration-switch-mode-native@gmail.com or enter the code:
+== Send URL to user-integration-switch-mode-native@example.com ==
+Leave the input field empty to wait for the alternative authentication method or enter 'r' to go back to select the authentication method
+Click on the link received at user-integration-switch-mode-native@example.com or enter the code:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -800,13 +771,12 @@ Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 3
 == Use your fido device foo ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Plug your fido device and press with your thumb:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -817,13 +787,12 @@ Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 4
 == Use your phone +33... ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Unlock your phone +33... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -834,8 +803,7 @@ Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 5
 == Use your phone +1... ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Unlock your phone +1... or accept request on web interface:
 > r
 ────────────────────────────────────────────────────────────────────────────────
@@ -851,7 +819,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -861,14 +829,13 @@ Gimme your password:
 Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 2
-== Send URL to user-integration-switch-mode-native@gmail.com ==
-Leave the input field empty to wait for the alternative authentication method or enter 'r' to go
- back to select the authentication method
-Click on the link received at user-integration-switch-mode-native@gmail.com or enter the code:
+== Send URL to user-integration-switch-mode-native@example.com ==
+Leave the input field empty to wait for the alternative authentication method or enter 'r' to go back to select the authentication method
+Click on the link received at user-integration-switch-mode-native@example.com or enter the code:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -879,13 +846,12 @@ Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 3
 == Use your fido device foo ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Plug your fido device and press with your thumb:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -896,13 +862,12 @@ Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 4
 == Use your phone +33... ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Unlock your phone +33... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -913,13 +878,12 @@ Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 5
 == Use your phone +1... ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Unlock your phone +1... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -942,7 +906,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -952,14 +916,13 @@ Gimme your password:
 Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 2
-== Send URL to user-integration-switch-mode-native@gmail.com ==
-Leave the input field empty to wait for the alternative authentication method or enter 'r' to go
- back to select the authentication method
-Click on the link received at user-integration-switch-mode-native@gmail.com or enter the code:
+== Send URL to user-integration-switch-mode-native@example.com ==
+Leave the input field empty to wait for the alternative authentication method or enter 'r' to go back to select the authentication method
+Click on the link received at user-integration-switch-mode-native@example.com or enter the code:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -970,13 +933,12 @@ Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 3
 == Use your fido device foo ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Plug your fido device and press with your thumb:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -987,13 +949,12 @@ Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 4
 == Use your phone +33... ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Unlock your phone +33... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -1004,13 +965,12 @@ Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 5
 == Use your phone +1... ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Unlock your phone +1... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -1033,7 +993,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -1043,14 +1003,13 @@ Gimme your password:
 Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 2
-== Send URL to user-integration-switch-mode-native@gmail.com ==
-Leave the input field empty to wait for the alternative authentication method or enter 'r' to go
- back to select the authentication method
-Click on the link received at user-integration-switch-mode-native@gmail.com or enter the code:
+== Send URL to user-integration-switch-mode-native@example.com ==
+Leave the input field empty to wait for the alternative authentication method or enter 'r' to go back to select the authentication method
+Click on the link received at user-integration-switch-mode-native@example.com or enter the code:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -1061,13 +1020,12 @@ Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 3
 == Use your fido device foo ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Plug your fido device and press with your thumb:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -1078,13 +1036,12 @@ Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 4
 == Use your phone +33... ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Unlock your phone +33... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -1095,13 +1052,12 @@ Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 5
 == Use your phone +1... ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Unlock your phone +1... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -1128,7 +1084,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -1138,14 +1094,13 @@ Gimme your password:
 Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 2
-== Send URL to user-integration-switch-mode-native@gmail.com ==
-Leave the input field empty to wait for the alternative authentication method or enter 'r' to go
- back to select the authentication method
-Click on the link received at user-integration-switch-mode-native@gmail.com or enter the code:
+== Send URL to user-integration-switch-mode-native@example.com ==
+Leave the input field empty to wait for the alternative authentication method or enter 'r' to go back to select the authentication method
+Click on the link received at user-integration-switch-mode-native@example.com or enter the code:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -1156,13 +1111,12 @@ Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 3
 == Use your fido device foo ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Plug your fido device and press with your thumb:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -1173,13 +1127,12 @@ Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 4
 == Use your phone +33... ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Unlock your phone +33... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -1190,13 +1143,12 @@ Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 5
 == Use your phone +1... ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Unlock your phone +1... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -1223,7 +1175,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -1233,14 +1185,13 @@ Gimme your password:
 Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 2
-== Send URL to user-integration-switch-mode-native@gmail.com ==
-Leave the input field empty to wait for the alternative authentication method or enter 'r' to go
- back to select the authentication method
-Click on the link received at user-integration-switch-mode-native@gmail.com or enter the code:
+== Send URL to user-integration-switch-mode-native@example.com ==
+Leave the input field empty to wait for the alternative authentication method or enter 'r' to go back to select the authentication method
+Click on the link received at user-integration-switch-mode-native@example.com or enter the code:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -1251,13 +1202,12 @@ Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 3
 == Use your fido device foo ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Plug your fido device and press with your thumb:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -1268,13 +1218,12 @@ Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 4
 == Use your phone +33... ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Unlock your phone +33... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -1285,13 +1234,12 @@ Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 5
 == Use your phone +1... ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Unlock your phone +1... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -1307,7 +1255,7 @@ Enter your pin code:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -1330,7 +1278,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -1340,14 +1288,13 @@ Gimme your password:
 Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 2
-== Send URL to user-integration-switch-mode-native@gmail.com ==
-Leave the input field empty to wait for the alternative authentication method or enter 'r' to go
- back to select the authentication method
-Click on the link received at user-integration-switch-mode-native@gmail.com or enter the code:
+== Send URL to user-integration-switch-mode-native@example.com ==
+Leave the input field empty to wait for the alternative authentication method or enter 'r' to go back to select the authentication method
+Click on the link received at user-integration-switch-mode-native@example.com or enter the code:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -1358,13 +1305,12 @@ Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 3
 == Use your fido device foo ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Plug your fido device and press with your thumb:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -1375,13 +1321,12 @@ Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 4
 == Use your phone +33... ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Unlock your phone +33... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -1392,13 +1337,12 @@ Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 5
 == Use your phone +1... ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Unlock your phone +1... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -1414,7 +1358,7 @@ Enter your pin code:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -1437,7 +1381,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -1447,14 +1391,13 @@ Gimme your password:
 Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 2
-== Send URL to user-integration-switch-mode-native@gmail.com ==
-Leave the input field empty to wait for the alternative authentication method or enter 'r' to go
- back to select the authentication method
-Click on the link received at user-integration-switch-mode-native@gmail.com or enter the code:
+== Send URL to user-integration-switch-mode-native@example.com ==
+Leave the input field empty to wait for the alternative authentication method or enter 'r' to go back to select the authentication method
+Click on the link received at user-integration-switch-mode-native@example.com or enter the code:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -1465,13 +1408,12 @@ Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 3
 == Use your fido device foo ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Plug your fido device and press with your thumb:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -1482,13 +1424,12 @@ Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 4
 == Use your phone +33... ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Unlock your phone +33... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -1499,13 +1440,12 @@ Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 5
 == Use your phone +1... ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Unlock your phone +1... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -1521,7 +1461,7 @@ Enter your pin code:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -1571,7 +1511,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -1581,14 +1521,13 @@ Gimme your password:
 Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 2
-== Send URL to user-integration-switch-mode-native@gmail.com ==
-Leave the input field empty to wait for the alternative authentication method or enter 'r' to go
- back to select the authentication method
-Click on the link received at user-integration-switch-mode-native@gmail.com or enter the code:
+== Send URL to user-integration-switch-mode-native@example.com ==
+Leave the input field empty to wait for the alternative authentication method or enter 'r' to go back to select the authentication method
+Click on the link received at user-integration-switch-mode-native@example.com or enter the code:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -1599,13 +1538,12 @@ Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 3
 == Use your fido device foo ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Plug your fido device and press with your thumb:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -1616,13 +1554,12 @@ Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 4
 == Use your phone +33... ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Unlock your phone +33... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -1633,13 +1570,12 @@ Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 5
 == Use your phone +1... ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Unlock your phone +1... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -1655,7 +1591,7 @@ Enter your pin code:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -1705,7 +1641,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -1715,14 +1651,13 @@ Gimme your password:
 Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 2
-== Send URL to user-integration-switch-mode-native@gmail.com ==
-Leave the input field empty to wait for the alternative authentication method or enter 'r' to go
- back to select the authentication method
-Click on the link received at user-integration-switch-mode-native@gmail.com or enter the code:
+== Send URL to user-integration-switch-mode-native@example.com ==
+Leave the input field empty to wait for the alternative authentication method or enter 'r' to go back to select the authentication method
+Click on the link received at user-integration-switch-mode-native@example.com or enter the code:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -1733,13 +1668,12 @@ Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 3
 == Use your fido device foo ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Plug your fido device and press with your thumb:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -1750,13 +1684,12 @@ Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 4
 == Use your phone +33... ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Unlock your phone +33... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -1767,13 +1700,12 @@ Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 5
 == Use your phone +1... ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Unlock your phone +1... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -1789,7 +1721,7 @@ Enter your pin code:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -1828,7 +1760,7 @@ Choose action:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -1851,7 +1783,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -1861,14 +1793,13 @@ Gimme your password:
 Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 2
-== Send URL to user-integration-switch-mode-native@gmail.com ==
-Leave the input field empty to wait for the alternative authentication method or enter 'r' to go
- back to select the authentication method
-Click on the link received at user-integration-switch-mode-native@gmail.com or enter the code:
+== Send URL to user-integration-switch-mode-native@example.com ==
+Leave the input field empty to wait for the alternative authentication method or enter 'r' to go back to select the authentication method
+Click on the link received at user-integration-switch-mode-native@example.com or enter the code:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -1879,13 +1810,12 @@ Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 3
 == Use your fido device foo ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Plug your fido device and press with your thumb:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -1896,13 +1826,12 @@ Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 4
 == Use your phone +33... ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Unlock your phone +33... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -1913,13 +1842,12 @@ Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 5
 == Use your phone +1... ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Unlock your phone +1... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -1935,7 +1863,7 @@ Enter your pin code:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -1974,7 +1902,7 @@ Choose action:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -1997,7 +1925,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -2007,14 +1935,13 @@ Gimme your password:
 Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 2
-== Send URL to user-integration-switch-mode-native@gmail.com ==
-Leave the input field empty to wait for the alternative authentication method or enter 'r' to go
- back to select the authentication method
-Click on the link received at user-integration-switch-mode-native@gmail.com or enter the code:
+== Send URL to user-integration-switch-mode-native@example.com ==
+Leave the input field empty to wait for the alternative authentication method or enter 'r' to go back to select the authentication method
+Click on the link received at user-integration-switch-mode-native@example.com or enter the code:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -2025,13 +1952,12 @@ Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 3
 == Use your fido device foo ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Plug your fido device and press with your thumb:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -2042,13 +1968,12 @@ Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 4
 == Use your phone +33... ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Unlock your phone +33... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -2059,13 +1984,12 @@ Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 5
 == Use your phone +1... ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Unlock your phone +1... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -2081,7 +2005,7 @@ Enter your pin code:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -2120,7 +2044,7 @@ Choose action:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -2149,7 +2073,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -2159,14 +2083,13 @@ Gimme your password:
 Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 2
-== Send URL to user-integration-switch-mode-native@gmail.com ==
-Leave the input field empty to wait for the alternative authentication method or enter 'r' to go
- back to select the authentication method
-Click on the link received at user-integration-switch-mode-native@gmail.com or enter the code:
+== Send URL to user-integration-switch-mode-native@example.com ==
+Leave the input field empty to wait for the alternative authentication method or enter 'r' to go back to select the authentication method
+Click on the link received at user-integration-switch-mode-native@example.com or enter the code:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -2177,13 +2100,12 @@ Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 3
 == Use your fido device foo ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Plug your fido device and press with your thumb:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -2194,13 +2116,12 @@ Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 4
 == Use your phone +33... ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Unlock your phone +33... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -2211,13 +2132,12 @@ Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 5
 == Use your phone +1... ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Unlock your phone +1... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -2233,7 +2153,7 @@ Enter your pin code:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -2272,7 +2192,7 @@ Choose action:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -2301,7 +2221,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -2311,14 +2231,13 @@ Gimme your password:
 Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 2
-== Send URL to user-integration-switch-mode-native@gmail.com ==
-Leave the input field empty to wait for the alternative authentication method or enter 'r' to go
- back to select the authentication method
-Click on the link received at user-integration-switch-mode-native@gmail.com or enter the code:
+== Send URL to user-integration-switch-mode-native@example.com ==
+Leave the input field empty to wait for the alternative authentication method or enter 'r' to go back to select the authentication method
+Click on the link received at user-integration-switch-mode-native@example.com or enter the code:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -2329,13 +2248,12 @@ Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 3
 == Use your fido device foo ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Plug your fido device and press with your thumb:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -2346,13 +2264,12 @@ Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 4
 == Use your phone +33... ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Unlock your phone +33... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -2363,13 +2280,12 @@ Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 5
 == Use your phone +1... ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Unlock your phone +1... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -2385,7 +2301,7 @@ Enter your pin code:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -2424,7 +2340,7 @@ Choose action:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -2442,7 +2358,7 @@ Choose action:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -2465,7 +2381,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -2475,14 +2391,13 @@ Gimme your password:
 Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 2
-== Send URL to user-integration-switch-mode-native@gmail.com ==
-Leave the input field empty to wait for the alternative authentication method or enter 'r' to go
- back to select the authentication method
-Click on the link received at user-integration-switch-mode-native@gmail.com or enter the code:
+== Send URL to user-integration-switch-mode-native@example.com ==
+Leave the input field empty to wait for the alternative authentication method or enter 'r' to go back to select the authentication method
+Click on the link received at user-integration-switch-mode-native@example.com or enter the code:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -2493,13 +2408,12 @@ Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 3
 == Use your fido device foo ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Plug your fido device and press with your thumb:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -2510,13 +2424,12 @@ Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 4
 == Use your phone +33... ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Unlock your phone +33... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -2527,13 +2440,12 @@ Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 5
 == Use your phone +1... ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Unlock your phone +1... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -2549,7 +2461,7 @@ Enter your pin code:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -2588,7 +2500,7 @@ Choose action:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -2606,7 +2518,7 @@ Choose action:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -2629,7 +2541,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -2639,14 +2551,13 @@ Gimme your password:
 Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 2
-== Send URL to user-integration-switch-mode-native@gmail.com ==
-Leave the input field empty to wait for the alternative authentication method or enter 'r' to go
- back to select the authentication method
-Click on the link received at user-integration-switch-mode-native@gmail.com or enter the code:
+== Send URL to user-integration-switch-mode-native@example.com ==
+Leave the input field empty to wait for the alternative authentication method or enter 'r' to go back to select the authentication method
+Click on the link received at user-integration-switch-mode-native@example.com or enter the code:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -2657,13 +2568,12 @@ Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 3
 == Use your fido device foo ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Plug your fido device and press with your thumb:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -2674,13 +2584,12 @@ Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 4
 == Use your phone +33... ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Unlock your phone +33... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -2691,13 +2600,12 @@ Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 5
 == Use your phone +1... ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Unlock your phone +1... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -2713,7 +2621,7 @@ Enter your pin code:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -2752,7 +2660,7 @@ Choose action:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -2770,7 +2678,7 @@ Choose action:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -2796,7 +2704,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -2806,14 +2714,13 @@ Gimme your password:
 Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 2
-== Send URL to user-integration-switch-mode-native@gmail.com ==
-Leave the input field empty to wait for the alternative authentication method or enter 'r' to go
- back to select the authentication method
-Click on the link received at user-integration-switch-mode-native@gmail.com or enter the code:
+== Send URL to user-integration-switch-mode-native@example.com ==
+Leave the input field empty to wait for the alternative authentication method or enter 'r' to go back to select the authentication method
+Click on the link received at user-integration-switch-mode-native@example.com or enter the code:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -2824,13 +2731,12 @@ Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 3
 == Use your fido device foo ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Plug your fido device and press with your thumb:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -2841,13 +2747,12 @@ Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 4
 == Use your phone +33... ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Unlock your phone +33... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -2858,13 +2763,12 @@ Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 5
 == Use your phone +1... ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Unlock your phone +1... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -2880,7 +2784,7 @@ Enter your pin code:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -2919,7 +2823,7 @@ Choose action:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -2937,7 +2841,7 @@ Choose action:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -2963,7 +2867,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -2973,14 +2877,13 @@ Gimme your password:
 Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 2
-== Send URL to user-integration-switch-mode-native@gmail.com ==
-Leave the input field empty to wait for the alternative authentication method or enter 'r' to go
- back to select the authentication method
-Click on the link received at user-integration-switch-mode-native@gmail.com or enter the code:
+== Send URL to user-integration-switch-mode-native@example.com ==
+Leave the input field empty to wait for the alternative authentication method or enter 'r' to go back to select the authentication method
+Click on the link received at user-integration-switch-mode-native@example.com or enter the code:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -2991,13 +2894,12 @@ Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 3
 == Use your fido device foo ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Plug your fido device and press with your thumb:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -3008,13 +2910,12 @@ Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 4
 == Use your phone +33... ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Unlock your phone +33... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -3025,13 +2926,12 @@ Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 5
 == Use your phone +1... ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Unlock your phone +1... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -3047,7 +2947,7 @@ Enter your pin code:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -3086,7 +2986,7 @@ Choose action:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -3104,7 +3004,7 @@ Choose action:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -3120,7 +3020,7 @@ Choose your authentication method:
 PAM Error Message: Invalid selection
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -3143,7 +3043,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -3153,14 +3053,13 @@ Gimme your password:
 Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 2
-== Send URL to user-integration-switch-mode-native@gmail.com ==
-Leave the input field empty to wait for the alternative authentication method or enter 'r' to go
- back to select the authentication method
-Click on the link received at user-integration-switch-mode-native@gmail.com or enter the code:
+== Send URL to user-integration-switch-mode-native@example.com ==
+Leave the input field empty to wait for the alternative authentication method or enter 'r' to go back to select the authentication method
+Click on the link received at user-integration-switch-mode-native@example.com or enter the code:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -3171,13 +3070,12 @@ Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 3
 == Use your fido device foo ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Plug your fido device and press with your thumb:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -3188,13 +3086,12 @@ Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 4
 == Use your phone +33... ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Unlock your phone +33... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -3205,13 +3102,12 @@ Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 5
 == Use your phone +1... ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Unlock your phone +1... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -3227,7 +3123,7 @@ Enter your pin code:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -3266,7 +3162,7 @@ Choose action:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -3284,7 +3180,7 @@ Choose action:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -3300,7 +3196,7 @@ Choose your authentication method:
 PAM Error Message: Invalid selection
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -3323,7 +3219,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -3333,14 +3229,13 @@ Gimme your password:
 Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 2
-== Send URL to user-integration-switch-mode-native@gmail.com ==
-Leave the input field empty to wait for the alternative authentication method or enter 'r' to go
- back to select the authentication method
-Click on the link received at user-integration-switch-mode-native@gmail.com or enter the code:
+== Send URL to user-integration-switch-mode-native@example.com ==
+Leave the input field empty to wait for the alternative authentication method or enter 'r' to go back to select the authentication method
+Click on the link received at user-integration-switch-mode-native@example.com or enter the code:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -3351,13 +3246,12 @@ Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 3
 == Use your fido device foo ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Plug your fido device and press with your thumb:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -3368,13 +3262,12 @@ Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 4
 == Use your phone +33... ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Unlock your phone +33... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -3385,13 +3278,12 @@ Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 5
 == Use your phone +1... ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Unlock your phone +1... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -3407,7 +3299,7 @@ Enter your pin code:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -3446,7 +3338,7 @@ Choose action:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -3464,7 +3356,7 @@ Choose action:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -3480,7 +3372,7 @@ Choose your authentication method:
 PAM Error Message: Invalid selection
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -3507,7 +3399,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -3517,14 +3409,13 @@ Gimme your password:
 Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 2
-== Send URL to user-integration-switch-mode-native@gmail.com ==
-Leave the input field empty to wait for the alternative authentication method or enter 'r' to go
- back to select the authentication method
-Click on the link received at user-integration-switch-mode-native@gmail.com or enter the code:
+== Send URL to user-integration-switch-mode-native@example.com ==
+Leave the input field empty to wait for the alternative authentication method or enter 'r' to go back to select the authentication method
+Click on the link received at user-integration-switch-mode-native@example.com or enter the code:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -3535,13 +3426,12 @@ Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 3
 == Use your fido device foo ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Plug your fido device and press with your thumb:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -3552,13 +3442,12 @@ Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 4
 == Use your phone +33... ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Unlock your phone +33... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -3569,13 +3458,12 @@ Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 5
 == Use your phone +1... ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Unlock your phone +1... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -3591,7 +3479,7 @@ Enter your pin code:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -3630,7 +3518,7 @@ Choose action:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -3648,7 +3536,7 @@ Choose action:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -3664,7 +3552,7 @@ Choose your authentication method:
 PAM Error Message: Invalid selection
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -3691,7 +3579,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -3701,14 +3589,13 @@ Gimme your password:
 Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 2
-== Send URL to user-integration-switch-mode-native@gmail.com ==
-Leave the input field empty to wait for the alternative authentication method or enter 'r' to go
- back to select the authentication method
-Click on the link received at user-integration-switch-mode-native@gmail.com or enter the code:
+== Send URL to user-integration-switch-mode-native@example.com ==
+Leave the input field empty to wait for the alternative authentication method or enter 'r' to go back to select the authentication method
+Click on the link received at user-integration-switch-mode-native@example.com or enter the code:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -3719,13 +3606,12 @@ Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 3
 == Use your fido device foo ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Plug your fido device and press with your thumb:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -3736,13 +3622,12 @@ Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 4
 == Use your phone +33... ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Unlock your phone +33... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -3753,13 +3638,12 @@ Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 5
 == Use your phone +1... ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Unlock your phone +1... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -3775,7 +3659,7 @@ Enter your pin code:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -3814,7 +3698,7 @@ Choose action:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -3832,7 +3716,7 @@ Choose action:
 > r
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -3848,7 +3732,7 @@ Choose your authentication method:
 PAM Error Message: Invalid selection
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-switch-mode-native@gmail.com
+  2. Send URL to user-integration-switch-mode-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -3863,10 +3747,10 @@ Enter 'r' to cancel the request and go back to select the authentication method
 Enter your pin code:
 > 4242
 PAM Authenticate()
-  User: "user-integration-switch-mode-native"
+  User: "user-integration-switch-mode-native@example.com"
   Result: success
 PAM AcctMgmt()
-  User: "user-integration-switch-mode-native"
+  User: "user-integration-switch-mode-native@example.com"
   Result: success
 >
 ────────────────────────────────────────────────────────────────────────────────
diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_switching_to_local_broker b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_switching_to_local_broker
index fc76f9db95..dd65bafdfe 100644
--- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_switching_to_local_broker
+++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_switching_to_local_broker
@@ -35,7 +35,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-native-authenticate-user-switching-to-local-broker@gmail.com
+  2. Send URL to user-integration-native-authenticate-user-switching-to-local-broker@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -58,7 +58,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-native-authenticate-user-switching-to-local-broker@gmail.com
+  2. Send URL to user-integration-native-authenticate-user-switching-to-local-broker@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -81,7 +81,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-native-authenticate-user-switching-to-local-broker@gmail.com
+  2. Send URL to user-integration-native-authenticate-user-switching-to-local-broker@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -109,7 +109,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-native-authenticate-user-switching-to-local-broker@gmail.com
+  2. Send URL to user-integration-native-authenticate-user-switching-to-local-broker@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -137,7 +137,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-native-authenticate-user-switching-to-local-broker@gmail.com
+  2. Send URL to user-integration-native-authenticate-user-switching-to-local-broker@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -168,7 +168,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-native-authenticate-user-switching-to-local-broker@gmail.com
+  2. Send URL to user-integration-native-authenticate-user-switching-to-local-broker@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -199,7 +199,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-native-authenticate-user-switching-to-local-broker@gmail.com
+  2. Send URL to user-integration-native-authenticate-user-switching-to-local-broker@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -236,7 +236,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-native-authenticate-user-switching-to-local-broker@gmail.com
+  2. Send URL to user-integration-native-authenticate-user-switching-to-local-broker@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -273,7 +273,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-native-authenticate-user-switching-to-local-broker@gmail.com
+  2. Send URL to user-integration-native-authenticate-user-switching-to-local-broker@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -299,11 +299,11 @@ Choose your provider:
 > 1
 auth=incomplete
 PAM Authenticate()
-  User: "user-integration-native-authenticate-user-switching-to-local-broker"
+  User: "user-integration-native-authenticate-user-switching-to-local-broker@example.com"
   Result: error: PAM exit code: 25
     The return value should be ignored by PAM dispatch
 PAM AcctMgmt()
-  User: "user-integration-native-authenticate-user-switching-to-local-broker"
+  User: "user-integration-native-authenticate-user-switching-to-local-broker@example.com"
   Result: error: PAM exit code: 26
     Critical error - immediate abort
 >
diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_switching_username b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_switching_username
index cad36e6ec2..01697f617e 100644
--- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_switching_username
+++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_switching_username
@@ -2,10 +2,10 @@
 Username:
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
-Username: user-integration-native-username
+Username: user-integration-native-username@example.com
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
-Username: user-integration-native-username
+Username: user-integration-native-username@example.com
 == Provider selection ==
   1. local
   2. ExampleBroker
@@ -14,7 +14,7 @@ Choose your provider:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
-Username: user-integration-native-username
+Username: user-integration-native-username@example.com
 == Provider selection ==
   1. local
   2. ExampleBroker
@@ -23,7 +23,7 @@ Choose your provider:
 > r
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
-Username: user-integration-native-username
+Username: user-integration-native-username@example.com
 == Provider selection ==
   1. local
   2. ExampleBroker
@@ -33,24 +33,24 @@ Choose your provider:
 Username:
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
-Username: user-integration-native-username
+Username: user-integration-native-username@example.com
 == Provider selection ==
   1. local
   2. ExampleBroker
 Or enter 'r' to go back to user selection
 Choose your provider:
 > r
-Username: user-integration-native-username-switched
+Username: user-integration-native-username-switched@example.com
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
-Username: user-integration-native-username
+Username: user-integration-native-username@example.com
 == Provider selection ==
   1. local
   2. ExampleBroker
 Or enter 'r' to go back to user selection
 Choose your provider:
 > r
-Username: user-integration-native-username-switched
+Username: user-integration-native-username-switched@example.com
 == Provider selection ==
   1. local
   2. ExampleBroker
@@ -59,14 +59,14 @@ Choose your provider:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
-Username: user-integration-native-username
+Username: user-integration-native-username@example.com
 == Provider selection ==
   1. local
   2. ExampleBroker
 Or enter 'r' to go back to user selection
 Choose your provider:
 > r
-Username: user-integration-native-username-switched
+Username: user-integration-native-username-switched@example.com
 == Provider selection ==
   1. local
   2. ExampleBroker
@@ -75,14 +75,14 @@ Choose your provider:
 > 2
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
-Username: user-integration-native-username
+Username: user-integration-native-username@example.com
 == Provider selection ==
   1. local
   2. ExampleBroker
 Or enter 'r' to go back to user selection
 Choose your provider:
 > r
-Username: user-integration-native-username-switched
+Username: user-integration-native-username-switched@example.com
 == Provider selection ==
   1. local
   2. ExampleBroker
@@ -95,14 +95,14 @@ Gimme your password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
-Username: user-integration-native-username
+Username: user-integration-native-username@example.com
 == Provider selection ==
   1. local
   2. ExampleBroker
 Or enter 'r' to go back to user selection
 Choose your provider:
 > r
-Username: user-integration-native-username-switched
+Username: user-integration-native-username-switched@example.com
 == Provider selection ==
   1. local
   2. ExampleBroker
@@ -114,10 +114,10 @@ Enter 'r' to cancel the request and go back to select the authentication method
 Gimme your password:
 >
 PAM Authenticate()
-  User: "user-integration-native-username-switched"
+  User: "user-integration-native-username-switched@example.com"
   Result: success
 PAM AcctMgmt()
-  User: "user-integration-native-username-switched"
+  User: "user-integration-native-username-switched@example.com"
   Result: success
 >
 ────────────────────────────────────────────────────────────────────────────────
diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_form_mode_with_button b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_form_mode_with_button
index 8996607661..5112bb1c6f 100644
--- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_form_mode_with_button
+++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_form_mode_with_button
@@ -35,7 +35,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-native-authenticate-user-with-form-mode-with-button@gmail.com
+  2. Send URL to user-integration-native-authenticate-user-with-form-mode-with-button@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -58,7 +58,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-native-authenticate-user-with-form-mode-with-button@gmail.com
+  2. Send URL to user-integration-native-authenticate-user-with-form-mode-with-button@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -81,7 +81,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-native-authenticate-user-with-form-mode-with-button@gmail.com
+  2. Send URL to user-integration-native-authenticate-user-with-form-mode-with-button@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -110,7 +110,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-native-authenticate-user-with-form-mode-with-button@gmail.com
+  2. Send URL to user-integration-native-authenticate-user-with-form-mode-with-button@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -139,7 +139,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-native-authenticate-user-with-form-mode-with-button@gmail.com
+  2. Send URL to user-integration-native-authenticate-user-with-form-mode-with-button@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -174,7 +174,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-native-authenticate-user-with-form-mode-with-button@gmail.com
+  2. Send URL to user-integration-native-authenticate-user-with-form-mode-with-button@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -209,7 +209,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-native-authenticate-user-with-form-mode-with-button@gmail.com
+  2. Send URL to user-integration-native-authenticate-user-with-form-mode-with-button@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -248,7 +248,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-native-authenticate-user-with-form-mode-with-button@gmail.com
+  2. Send URL to user-integration-native-authenticate-user-with-form-mode-with-button@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -287,7 +287,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-native-authenticate-user-with-form-mode-with-button@gmail.com
+  2. Send URL to user-integration-native-authenticate-user-with-form-mode-with-button@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -314,10 +314,10 @@ Enter 'r' to cancel the request and go back to select the authentication method
 Enter your one time credential:
 > temporary pass00
 PAM Authenticate()
-  User: "user-integration-native-authenticate-user-with-form-mode-with-button"
+  User: "user-integration-native-authenticate-user-with-form-mode-with-button@example.com"
   Result: success
 PAM AcctMgmt()
-  User: "user-integration-native-authenticate-user-with-form-mode-with-button"
+  User: "user-integration-native-authenticate-user-with-form-mode-with-button@example.com"
   Result: success
 >
 ────────────────────────────────────────────────────────────────────────────────
diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_form_mode_with_button_in_polkit b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_form_mode_with_button_in_polkit
index f647e6516b..d0ccd9fc36 100644
--- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_form_mode_with_button_in_polkit
+++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_form_mode_with_button_in_polkit
@@ -17,8 +17,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-native-authenticate-user-with-form-mode-with-button-in-polkit@
-gmail.com
+  2. Send URL to user-integration-native-authenticate-user-with-form-mode-with-button-in-polkit@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -34,8 +33,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-native-authenticate-user-with-form-mode-with-button-in-polkit@
-gmail.com
+  2. Send URL to user-integration-native-authenticate-user-with-form-mode-with-button-in-polkit@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -51,8 +49,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-native-authenticate-user-with-form-mode-with-button-in-polkit@
-gmail.com
+  2. Send URL to user-integration-native-authenticate-user-with-form-mode-with-button-in-polkit@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -74,8 +71,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-native-authenticate-user-with-form-mode-with-button-in-polkit@
-gmail.com
+  2. Send URL to user-integration-native-authenticate-user-with-form-mode-with-button-in-polkit@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -97,8 +93,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-native-authenticate-user-with-form-mode-with-button-in-polkit@
-gmail.com
+  2. Send URL to user-integration-native-authenticate-user-with-form-mode-with-button-in-polkit@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -126,8 +121,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-native-authenticate-user-with-form-mode-with-button-in-polkit@
-gmail.com
+  2. Send URL to user-integration-native-authenticate-user-with-form-mode-with-button-in-polkit@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -155,8 +149,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-native-authenticate-user-with-form-mode-with-button-in-polkit@
-gmail.com
+  2. Send URL to user-integration-native-authenticate-user-with-form-mode-with-button-in-polkit@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -188,8 +181,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-native-authenticate-user-with-form-mode-with-button-in-polkit@
-gmail.com
+  2. Send URL to user-integration-native-authenticate-user-with-form-mode-with-button-in-polkit@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -221,8 +213,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-native-authenticate-user-with-form-mode-with-button-in-polkit@
-gmail.com
+  2. Send URL to user-integration-native-authenticate-user-with-form-mode-with-button-in-polkit@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -247,10 +238,10 @@ Enter 'r' to cancel the request and go back to select the authentication method
 Enter your one time credential:
 > temporary pass00
 PAM Authenticate()
-  User: "user-integration-native-authenticate-user-with-form-mode-with-button-in-polkit"
+  User: "user-integration-native-authenticate-user-with-form-mode-with-button-in-polkit@example.com"
   Result: success
 PAM AcctMgmt()
-  User: "user-integration-native-authenticate-user-with-form-mode-with-button-in-polkit"
+  User: "user-integration-native-authenticate-user-with-form-mode-with-button-in-polkit@example.com"
   Result: success
 >
 ────────────────────────────────────────────────────────────────────────────────
diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_form_mode_with_button_two_supported_methods b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_form_mode_with_button_two_supported_methods
index f7824922ef..ac4f336cad 100644
--- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_form_mode_with_button_two_supported_methods
+++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_form_mode_with_button_two_supported_methods
@@ -260,10 +260,10 @@ Enter 'r' to cancel the request and go back to select the authentication method
 Enter your one time credential:
 > temporary pass00
 PAM Authenticate()
-  User: "user-auth-modes-totp_with_button,password-integration-native"
+  User: "user-auth-modes-totp_with_button,password-integration-native@example.com"
   Result: success
 PAM AcctMgmt()
-  User: "user-auth-modes-totp_with_button,password-integration-native"
+  User: "user-auth-modes-totp_with_button,password-integration-native@example.com"
   Result: success
 >
 ────────────────────────────────────────────────────────────────────────────────
diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_mfa b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_mfa
index ea15ea60d1..ef7abcc61f 100644
--- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_mfa
+++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_mfa
@@ -35,7 +35,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-mfa-integration-auth-native@gmail.com
+  2. Send URL to user-mfa-integration-auth-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -58,7 +58,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-mfa-integration-auth-native@gmail.com
+  2. Send URL to user-mfa-integration-auth-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -85,7 +85,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-mfa-integration-auth-native@gmail.com
+  2. Send URL to user-mfa-integration-auth-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -100,8 +100,7 @@ Enter 'r' to cancel the request and go back to select the authentication method
 Gimme your password:
 >
 == Use your fido device foo ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Plug your fido device and press with your thumb:
 >
 ────────────────────────────────────────────────────────────────────────────────
@@ -117,7 +116,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-mfa-integration-auth-native@gmail.com
+  2. Send URL to user-mfa-integration-auth-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -132,8 +131,7 @@ Enter 'r' to cancel the request and go back to select the authentication method
 Gimme your password:
 >
 == Use your fido device foo ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Plug your fido device and press with your thumb:
 > r
 ────────────────────────────────────────────────────────────────────────────────
@@ -149,7 +147,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-mfa-integration-auth-native@gmail.com
+  2. Send URL to user-mfa-integration-auth-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -164,8 +162,7 @@ Enter 'r' to cancel the request and go back to select the authentication method
 Gimme your password:
 >
 == Use your fido device foo ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Plug your fido device and press with your thumb:
 > r
 == Authentication method selection ==
@@ -188,7 +185,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-mfa-integration-auth-native@gmail.com
+  2. Send URL to user-mfa-integration-auth-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -203,8 +200,7 @@ Enter 'r' to cancel the request and go back to select the authentication method
 Gimme your password:
 >
 == Use your fido device foo ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Plug your fido device and press with your thumb:
 > r
 == Authentication method selection ==
@@ -215,8 +211,7 @@ Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 1
 == Use your fido device foo ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Plug your fido device and press with your thumb:
 >
 ────────────────────────────────────────────────────────────────────────────────
@@ -232,7 +227,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-mfa-integration-auth-native@gmail.com
+  2. Send URL to user-mfa-integration-auth-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -247,8 +242,7 @@ Enter 'r' to cancel the request and go back to select the authentication method
 Gimme your password:
 >
 == Use your fido device foo ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Plug your fido device and press with your thumb:
 > r
 == Authentication method selection ==
@@ -259,8 +253,7 @@ Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 1
 == Use your fido device foo ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Plug your fido device and press with your thumb:
 > r
 ────────────────────────────────────────────────────────────────────────────────
@@ -276,7 +269,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-mfa-integration-auth-native@gmail.com
+  2. Send URL to user-mfa-integration-auth-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -291,8 +284,7 @@ Enter 'r' to cancel the request and go back to select the authentication method
 Gimme your password:
 >
 == Use your fido device foo ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Plug your fido device and press with your thumb:
 > r
 == Authentication method selection ==
@@ -303,8 +295,7 @@ Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 1
 == Use your fido device foo ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Plug your fido device and press with your thumb:
 > r
 == Authentication method selection ==
@@ -327,7 +318,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-mfa-integration-auth-native@gmail.com
+  2. Send URL to user-mfa-integration-auth-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -342,8 +333,7 @@ Enter 'r' to cancel the request and go back to select the authentication method
 Gimme your password:
 >
 == Use your fido device foo ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Plug your fido device and press with your thumb:
 > r
 == Authentication method selection ==
@@ -354,8 +344,7 @@ Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 1
 == Use your fido device foo ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Plug your fido device and press with your thumb:
 > r
 == Authentication method selection ==
@@ -366,8 +355,7 @@ Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 2
 == Use your phone +33... ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Unlock your phone +33... or accept request on web interface:
 >
 ────────────────────────────────────────────────────────────────────────────────
@@ -383,7 +371,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-mfa-integration-auth-native@gmail.com
+  2. Send URL to user-mfa-integration-auth-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -398,8 +386,7 @@ Enter 'r' to cancel the request and go back to select the authentication method
 Gimme your password:
 >
 == Use your fido device foo ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Plug your fido device and press with your thumb:
 > r
 == Authentication method selection ==
@@ -410,8 +397,7 @@ Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 1
 == Use your fido device foo ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Plug your fido device and press with your thumb:
 > r
 == Authentication method selection ==
@@ -422,13 +408,11 @@ Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 2
 == Use your phone +33... ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Unlock your phone +33... or accept request on web interface:
 >
 == Use your fido device foo ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Plug your fido device and press with your thumb:
 >
 ────────────────────────────────────────────────────────────────────────────────
@@ -444,7 +428,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-mfa-integration-auth-native@gmail.com
+  2. Send URL to user-mfa-integration-auth-native@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -459,8 +443,7 @@ Enter 'r' to cancel the request and go back to select the authentication method
 Gimme your password:
 >
 == Use your fido device foo ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Plug your fido device and press with your thumb:
 > r
 == Authentication method selection ==
@@ -471,8 +454,7 @@ Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 1
 == Use your fido device foo ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Plug your fido device and press with your thumb:
 > r
 == Authentication method selection ==
@@ -483,20 +465,18 @@ Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 2
 == Use your phone +33... ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Unlock your phone +33... or accept request on web interface:
 >
 == Use your fido device foo ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Plug your fido device and press with your thumb:
 >
 PAM Authenticate()
-  User: "user-mfa-integration-auth-native"
+  User: "user-mfa-integration-auth-native@example.com"
   Result: success
 PAM AcctMgmt()
-  User: "user-mfa-integration-auth-native"
+  User: "user-mfa-integration-auth-native@example.com"
   Result: success
 >
 ────────────────────────────────────────────────────────────────────────────────
diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_mfa_and_reset_password_while_enforcing_policy b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_mfa_and_reset_password_while_enforcing_policy
index dfabc2f066..f9629d6b35 100644
--- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_mfa_and_reset_password_while_enforcing_policy
+++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_mfa_and_reset_password_while_enforcing_policy
@@ -35,8 +35,7 @@ Gimme your password:
 >
 Password reset, 2 step(s) missing
 == Use your fido device foo ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Plug your fido device and press with your thumb:
 >
 ────────────────────────────────────────────────────────────────────────────────
@@ -52,8 +51,7 @@ Gimme your password:
 >
 Password reset, 2 step(s) missing
 == Use your fido device foo ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Plug your fido device and press with your thumb:
 >
 Password reset, 1 step(s) missing
@@ -76,8 +74,7 @@ Gimme your password:
 >
 Password reset, 2 step(s) missing
 == Use your fido device foo ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Plug your fido device and press with your thumb:
 >
 Password reset, 1 step(s) missing
@@ -100,8 +97,7 @@ Gimme your password:
 >
 Password reset, 2 step(s) missing
 == Use your fido device foo ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Plug your fido device and press with your thumb:
 >
 Password reset, 1 step(s) missing
@@ -128,8 +124,7 @@ Gimme your password:
 >
 Password reset, 2 step(s) missing
 == Use your fido device foo ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Plug your fido device and press with your thumb:
 >
 Password reset, 1 step(s) missing
@@ -143,44 +138,6 @@ Choose action:
 Enter 'r' to cancel the request and go back to choose the provider
 Enter your new password (3 days until mandatory):
 >
-PAM Error Message: The password is the same as the old one
-== Password reset ==
-Enter 'r' to cancel the request and go back to choose the provider
-Enter your new password (3 days until mandatory):
->
-────────────────────────────────────────────────────────────────────────────────
-> ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
-== Provider selection ==
-  1. local
-  2. ExampleBroker
-Choose your provider:
-> 2
-== Password authentication ==
-Enter 'r' to cancel the request and go back to select the authentication method
-Gimme your password:
->
-Password reset, 2 step(s) missing
-== Use your fido device foo ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
-Plug your fido device and press with your thumb:
->
-Password reset, 1 step(s) missing
-== Password reset ==
-  1. Proceed with password update
-  2. Skip
-Or enter 'r' to go back to choose the provider
-Choose action:
-> 1
-== Password reset ==
-Enter 'r' to cancel the request and go back to choose the provider
-Enter your new password (3 days until mandatory):
->
-PAM Error Message: The password is the same as the old one
-== Password reset ==
-Enter 'r' to cancel the request and go back to choose the provider
-Enter your new password (3 days until mandatory):
->
 PAM Error Message: The password fails the dictionary check - it is based on a dictionary word
 == Password reset ==
 Enter 'r' to cancel the request and go back to choose the provider
@@ -199,8 +156,7 @@ Gimme your password:
 >
 Password reset, 2 step(s) missing
 == Use your fido device foo ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Plug your fido device and press with your thumb:
 >
 Password reset, 1 step(s) missing
@@ -214,64 +170,11 @@ Choose action:
 Enter 'r' to cancel the request and go back to choose the provider
 Enter your new password (3 days until mandatory):
 >
-PAM Error Message: The password is the same as the old one
-== Password reset ==
-Enter 'r' to cancel the request and go back to choose the provider
-Enter your new password (3 days until mandatory):
->
 PAM Error Message: The password fails the dictionary check - it is based on a dictionary word
 == Password reset ==
 Enter 'r' to cancel the request and go back to choose the provider
 Enter your new password (3 days until mandatory):
 >
-PAM Error Message: The password is the same as the old one
-== Password reset ==
-Enter 'r' to cancel the request and go back to choose the provider
-Enter your new password (3 days until mandatory):
->
-────────────────────────────────────────────────────────────────────────────────
-> ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
-== Provider selection ==
-  1. local
-  2. ExampleBroker
-Choose your provider:
-> 2
-== Password authentication ==
-Enter 'r' to cancel the request and go back to select the authentication method
-Gimme your password:
->
-Password reset, 2 step(s) missing
-== Use your fido device foo ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
-Plug your fido device and press with your thumb:
->
-Password reset, 1 step(s) missing
-== Password reset ==
-  1. Proceed with password update
-  2. Skip
-Or enter 'r' to go back to choose the provider
-Choose action:
-> 1
-== Password reset ==
-Enter 'r' to cancel the request and go back to choose the provider
-Enter your new password (3 days until mandatory):
->
-PAM Error Message: The password is the same as the old one
-== Password reset ==
-Enter 'r' to cancel the request and go back to choose the provider
-Enter your new password (3 days until mandatory):
->
-PAM Error Message: The password fails the dictionary check - it is based on a dictionary word
-== Password reset ==
-Enter 'r' to cancel the request and go back to choose the provider
-Enter your new password (3 days until mandatory):
->
-PAM Error Message: The password is the same as the old one
-== Password reset ==
-Enter 'r' to cancel the request and go back to choose the provider
-Enter your new password (3 days until mandatory):
->
 PAM Error Message: The password is shorter than 8 characters
 == Password reset ==
 Enter 'r' to cancel the request and go back to choose the provider
@@ -290,8 +193,7 @@ Gimme your password:
 >
 Password reset, 2 step(s) missing
 == Use your fido device foo ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Plug your fido device and press with your thumb:
 >
 Password reset, 1 step(s) missing
@@ -305,21 +207,11 @@ Choose action:
 Enter 'r' to cancel the request and go back to choose the provider
 Enter your new password (3 days until mandatory):
 >
-PAM Error Message: The password is the same as the old one
-== Password reset ==
-Enter 'r' to cancel the request and go back to choose the provider
-Enter your new password (3 days until mandatory):
->
 PAM Error Message: The password fails the dictionary check - it is based on a dictionary word
 == Password reset ==
 Enter 'r' to cancel the request and go back to choose the provider
 Enter your new password (3 days until mandatory):
 >
-PAM Error Message: The password is the same as the old one
-== Password reset ==
-Enter 'r' to cancel the request and go back to choose the provider
-Enter your new password (3 days until mandatory):
->
 PAM Error Message: The password is shorter than 8 characters
 == Password reset ==
 Enter 'r' to cancel the request and go back to choose the provider
@@ -340,8 +232,7 @@ Gimme your password:
 >
 Password reset, 2 step(s) missing
 == Use your fido device foo ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Plug your fido device and press with your thumb:
 >
 Password reset, 1 step(s) missing
@@ -355,21 +246,11 @@ Choose action:
 Enter 'r' to cancel the request and go back to choose the provider
 Enter your new password (3 days until mandatory):
 >
-PAM Error Message: The password is the same as the old one
-== Password reset ==
-Enter 'r' to cancel the request and go back to choose the provider
-Enter your new password (3 days until mandatory):
->
 PAM Error Message: The password fails the dictionary check - it is based on a dictionary word
 == Password reset ==
 Enter 'r' to cancel the request and go back to choose the provider
 Enter your new password (3 days until mandatory):
 >
-PAM Error Message: The password is the same as the old one
-== Password reset ==
-Enter 'r' to cancel the request and go back to choose the provider
-Enter your new password (3 days until mandatory):
->
 PAM Error Message: The password is shorter than 8 characters
 == Password reset ==
 Enter 'r' to cancel the request and go back to choose the provider
@@ -378,10 +259,10 @@ Enter your new password (3 days until mandatory):
 Confirm Password:
 >
 PAM Authenticate()
-  User: "user-mfa-with-reset-integration-pwquality-native"
+  User: "user-mfa-with-reset-integration-pwquality-native@example.com"
   Result: success
 PAM AcctMgmt()
-  User: "user-mfa-with-reset-integration-pwquality-native"
+  User: "user-mfa-with-reset-integration-pwquality-native@example.com"
   Result: success
 >
 ────────────────────────────────────────────────────────────────────────────────
diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_mfa_and_reset_same_password b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_mfa_and_reset_same_password
new file mode 100644
index 0000000000..03f95bb114
--- /dev/null
+++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_mfa_and_reset_same_password
@@ -0,0 +1,179 @@
+> ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
+== Provider selection ==
+  1. local
+  2. ExampleBroker
+Choose your provider:
+>
+────────────────────────────────────────────────────────────────────────────────
+> ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
+== Provider selection ==
+  1. local
+  2. ExampleBroker
+Choose your provider:
+> 2
+────────────────────────────────────────────────────────────────────────────────
+> ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
+== Provider selection ==
+  1. local
+  2. ExampleBroker
+Choose your provider:
+> 2
+== Password authentication ==
+Enter 'r' to cancel the request and go back to select the authentication method
+Gimme your password:
+>
+────────────────────────────────────────────────────────────────────────────────
+> ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
+== Provider selection ==
+  1. local
+  2. ExampleBroker
+Choose your provider:
+> 2
+== Password authentication ==
+Enter 'r' to cancel the request and go back to select the authentication method
+Gimme your password:
+>
+Password reset, 2 step(s) missing
+== Use your fido device foo ==
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
+Plug your fido device and press with your thumb:
+>
+────────────────────────────────────────────────────────────────────────────────
+> ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
+== Provider selection ==
+  1. local
+  2. ExampleBroker
+Choose your provider:
+> 2
+== Password authentication ==
+Enter 'r' to cancel the request and go back to select the authentication method
+Gimme your password:
+>
+Password reset, 2 step(s) missing
+== Use your fido device foo ==
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
+Plug your fido device and press with your thumb:
+>
+Password reset, 1 step(s) missing
+== Password reset ==
+  1. Proceed with password update
+  2. Skip
+Or enter 'r' to go back to choose the provider
+Choose action:
+>
+────────────────────────────────────────────────────────────────────────────────
+> ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
+== Provider selection ==
+  1. local
+  2. ExampleBroker
+Choose your provider:
+> 2
+== Password authentication ==
+Enter 'r' to cancel the request and go back to select the authentication method
+Gimme your password:
+>
+Password reset, 2 step(s) missing
+== Use your fido device foo ==
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
+Plug your fido device and press with your thumb:
+>
+Password reset, 1 step(s) missing
+== Password reset ==
+  1. Proceed with password update
+  2. Skip
+Or enter 'r' to go back to choose the provider
+Choose action:
+> 1
+────────────────────────────────────────────────────────────────────────────────
+> ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
+== Provider selection ==
+  1. local
+  2. ExampleBroker
+Choose your provider:
+> 2
+== Password authentication ==
+Enter 'r' to cancel the request and go back to select the authentication method
+Gimme your password:
+>
+Password reset, 2 step(s) missing
+== Use your fido device foo ==
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
+Plug your fido device and press with your thumb:
+>
+Password reset, 1 step(s) missing
+== Password reset ==
+  1. Proceed with password update
+  2. Skip
+Or enter 'r' to go back to choose the provider
+Choose action:
+> 1
+== Password reset ==
+Enter 'r' to cancel the request and go back to choose the provider
+Enter your new password (3 days until mandatory):
+>
+────────────────────────────────────────────────────────────────────────────────
+> ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
+== Provider selection ==
+  1. local
+  2. ExampleBroker
+Choose your provider:
+> 2
+== Password authentication ==
+Enter 'r' to cancel the request and go back to select the authentication method
+Gimme your password:
+>
+Password reset, 2 step(s) missing
+== Use your fido device foo ==
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
+Plug your fido device and press with your thumb:
+>
+Password reset, 1 step(s) missing
+== Password reset ==
+  1. Proceed with password update
+  2. Skip
+Or enter 'r' to go back to choose the provider
+Choose action:
+> 1
+== Password reset ==
+Enter 'r' to cancel the request and go back to choose the provider
+Enter your new password (3 days until mandatory):
+>
+Confirm Password:
+>
+────────────────────────────────────────────────────────────────────────────────
+> ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
+== Provider selection ==
+  1. local
+  2. ExampleBroker
+Choose your provider:
+> 2
+== Password authentication ==
+Enter 'r' to cancel the request and go back to select the authentication method
+Gimme your password:
+>
+Password reset, 2 step(s) missing
+== Use your fido device foo ==
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
+Plug your fido device and press with your thumb:
+>
+Password reset, 1 step(s) missing
+== Password reset ==
+  1. Proceed with password update
+  2. Skip
+Or enter 'r' to go back to choose the provider
+Choose action:
+> 1
+== Password reset ==
+Enter 'r' to cancel the request and go back to choose the provider
+Enter your new password (3 days until mandatory):
+>
+Confirm Password:
+>
+PAM Authenticate()
+  User: "user-mfa-with-reset-integration-same-password-native@example.com"
+  Result: success
+PAM AcctMgmt()
+  User: "user-mfa-with-reset-integration-same-password-native@example.com"
+  Result: success
+>
+────────────────────────────────────────────────────────────────────────────────
diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_mixed_case_after_db_migration b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_mixed_case_after_db_migration
index 4214a7c685..83daf21294 100644
--- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_mixed_case_after_db_migration
+++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_mixed_case_after_db_migration
@@ -10,10 +10,10 @@ Enter 'r' to cancel the request and go back to select the authentication method
 Gimme your password:
 >
 PAM Authenticate()
-  User: "user-integration-with-mixed-case"
+  User: "user-integration-with-mixed-case@example.com"
   Result: success
 PAM AcctMgmt()
-  User: "user-integration-with-mixed-case"
+  User: "user-integration-with-mixed-case@example.com"
   Result: success
 >
 ────────────────────────────────────────────────────────────────────────────────
diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_mixed_case_after_db_migration.group b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_mixed_case_after_db_migration.group
new file mode 100644
index 0000000000..2c7783d30a
--- /dev/null
+++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_mixed_case_after_db_migration.group
@@ -0,0 +1,6 @@
+localgroup:x:41:user-integration-with-mixed-case@example.com,user-integration-cached@example.com,user-integration-pre-check-with-upper-case@example.com,user-integration-upper-case@example.com,user-pre-check@example.com
+some-group-for-user-integration-WITH-Mixed-CaSe@example.com:x:101:user-integration-with-mixed-case@example.com
+some-group-for-user-integration-cached@example.com:x:102:user-integration-cached@example.com
+some-group-for-user-integration-pre-check-WITH-UPPER-CASE@example.com:x:103:user-integration-pre-check-with-upper-case@example.com
+some-group-for-user-integration-UPPER-CASE@example.com:x:104:user-integration-upper-case@example.com
+some-group-for-user-pre-check@example.com:x:105:user-pre-check@example.com
diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_mixed_case_after_db_migration.group.backup b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_mixed_case_after_db_migration.group.backup
new file mode 100644
index 0000000000..7fe8ba8346
--- /dev/null
+++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_mixed_case_after_db_migration.group.backup
@@ -0,0 +1,6 @@
+localgroup:x:41:user-integration-WITH-Mixed-CaSe@example.com,user-integration-cached@example.com,user-integration-pre-check-WITH-UPPER-CASE@example.com,user-integration-UPPER-CASE@example.com,user-pre-check@example.com
+some-group-for-user-integration-WITH-Mixed-CaSe@example.com:x:101:user-integration-WITH-Mixed-CaSe@example.com
+some-group-for-user-integration-cached@example.com:x:102:user-integration-cached@example.com
+some-group-for-user-integration-pre-check-WITH-UPPER-CASE@example.com:x:103:user-integration-pre-check-WITH-UPPER-CASE@example.com
+some-group-for-user-integration-UPPER-CASE@example.com:x:104:user-integration-UPPER-CASE@example.com
+some-group-for-user-pre-check@example.com:x:105:user-pre-check@example.com
diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_mixed_case_after_db_migration.groups b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_mixed_case_after_db_migration.groups
deleted file mode 100644
index f31a69be33..0000000000
--- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_mixed_case_after_db_migration.groups
+++ /dev/null
@@ -1,6 +0,0 @@
-localgroup:x:41:user-integration-with-mixed-case,user-integration-cached,user-integration-pre-check-with-upper-case,user-integration-upper-case,user-pre-check
-some-group-for-user-integration-WITH-Mixed-CaSe:x:101:user-integration-with-mixed-case
-some-group-for-user-integration-cached:x:102:user-integration-cached
-some-group-for-user-integration-pre-check-WITH-UPPER-CASE:x:103:user-integration-pre-check-with-upper-case
-some-group-for-user-integration-UPPER-CASE:x:104:user-integration-upper-case
-some-group-for-user-pre-check:x:105:user-pre-check
diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_qr_code b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_qr_code
index f8578f5dab..8d9f6085f0 100644
--- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_qr_code
+++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_qr_code
@@ -35,7 +35,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-native-authenticate-user-with-qr-code@gmail.com
+  2. Send URL to user-integration-native-authenticate-user-with-qr-code@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -58,7 +58,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-native-authenticate-user-with-qr-code@gmail.com
+  2. Send URL to user-integration-native-authenticate-user-with-qr-code@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -81,7 +81,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-native-authenticate-user-with-qr-code@gmail.com
+  2. Send URL to user-integration-native-authenticate-user-with-qr-code@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -131,7 +131,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-native-authenticate-user-with-qr-code@gmail.com
+  2. Send URL to user-integration-native-authenticate-user-with-qr-code@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -181,7 +181,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-native-authenticate-user-with-qr-code@gmail.com
+  2. Send URL to user-integration-native-authenticate-user-with-qr-code@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -258,7 +258,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-native-authenticate-user-with-qr-code@gmail.com
+  2. Send URL to user-integration-native-authenticate-user-with-qr-code@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -335,7 +335,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-native-authenticate-user-with-qr-code@gmail.com
+  2. Send URL to user-integration-native-authenticate-user-with-qr-code@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -441,7 +441,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-native-authenticate-user-with-qr-code@gmail.com
+  2. Send URL to user-integration-native-authenticate-user-with-qr-code@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -547,7 +547,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-native-authenticate-user-with-qr-code@gmail.com
+  2. Send URL to user-integration-native-authenticate-user-with-qr-code@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -680,7 +680,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-native-authenticate-user-with-qr-code@gmail.com
+  2. Send URL to user-integration-native-authenticate-user-with-qr-code@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -813,7 +813,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-native-authenticate-user-with-qr-code@gmail.com
+  2. Send URL to user-integration-native-authenticate-user-with-qr-code@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -973,7 +973,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-native-authenticate-user-with-qr-code@gmail.com
+  2. Send URL to user-integration-native-authenticate-user-with-qr-code@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -1133,7 +1133,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-native-authenticate-user-with-qr-code@gmail.com
+  2. Send URL to user-integration-native-authenticate-user-with-qr-code@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -1281,10 +1281,10 @@ Or enter 'r' to go back to select the authentication method
 Choose action:
 > 1
 PAM Authenticate()
-  User: "user-integration-native-authenticate-user-with-qr-code"
+  User: "user-integration-native-authenticate-user-with-qr-code@example.com"
   Result: success
 PAM AcctMgmt()
-  User: "user-integration-native-authenticate-user-with-qr-code"
+  User: "user-integration-native-authenticate-user-with-qr-code@example.com"
   Result: success
 >
 ────────────────────────────────────────────────────────────────────────────────
diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_qr_code_in_a_TTY b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_qr_code_in_a_TTY
index ee39835c44..f0fd0b9145 100644
--- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_qr_code_in_a_TTY
+++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_qr_code_in_a_TTY
@@ -35,7 +35,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-native-authenticate-user-with-qr-code-in-a-tty@gmail.com
+  2. Send URL to user-integration-native-authenticate-user-with-qr-code-in-a-tty@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -58,7 +58,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-native-authenticate-user-with-qr-code-in-a-tty@gmail.com
+  2. Send URL to user-integration-native-authenticate-user-with-qr-code-in-a-tty@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -81,7 +81,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-native-authenticate-user-with-qr-code-in-a-tty@gmail.com
+  2. Send URL to user-integration-native-authenticate-user-with-qr-code-in-a-tty@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -147,7 +147,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-native-authenticate-user-with-qr-code-in-a-tty@gmail.com
+  2. Send URL to user-integration-native-authenticate-user-with-qr-code-in-a-tty@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -213,7 +213,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-native-authenticate-user-with-qr-code-in-a-tty@gmail.com
+  2. Send URL to user-integration-native-authenticate-user-with-qr-code-in-a-tty@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -322,7 +322,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-native-authenticate-user-with-qr-code-in-a-tty@gmail.com
+  2. Send URL to user-integration-native-authenticate-user-with-qr-code-in-a-tty@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -431,7 +431,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-native-authenticate-user-with-qr-code-in-a-tty@gmail.com
+  2. Send URL to user-integration-native-authenticate-user-with-qr-code-in-a-tty@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -587,7 +587,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-native-authenticate-user-with-qr-code-in-a-tty@gmail.com
+  2. Send URL to user-integration-native-authenticate-user-with-qr-code-in-a-tty@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -743,7 +743,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-native-authenticate-user-with-qr-code-in-a-tty@gmail.com
+  2. Send URL to user-integration-native-authenticate-user-with-qr-code-in-a-tty@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -942,7 +942,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-native-authenticate-user-with-qr-code-in-a-tty@gmail.com
+  2. Send URL to user-integration-native-authenticate-user-with-qr-code-in-a-tty@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -1141,7 +1141,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-native-authenticate-user-with-qr-code-in-a-tty@gmail.com
+  2. Send URL to user-integration-native-authenticate-user-with-qr-code-in-a-tty@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -1383,7 +1383,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-native-authenticate-user-with-qr-code-in-a-tty@gmail.com
+  2. Send URL to user-integration-native-authenticate-user-with-qr-code-in-a-tty@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -1625,7 +1625,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-native-authenticate-user-with-qr-code-in-a-tty@gmail.com
+  2. Send URL to user-integration-native-authenticate-user-with-qr-code-in-a-tty@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -1855,10 +1855,10 @@ Or enter 'r' to go back to select the authentication method
 Choose action:
 > 1
 PAM Authenticate()
-  User: "user-integration-native-authenticate-user-with-qr-code-in-a-tty"
+  User: "user-integration-native-authenticate-user-with-qr-code-in-a-tty@example.com"
   Result: success
 PAM AcctMgmt()
-  User: "user-integration-native-authenticate-user-with-qr-code-in-a-tty"
+  User: "user-integration-native-authenticate-user-with-qr-code-in-a-tty@example.com"
   Result: success
 >
 ────────────────────────────────────────────────────────────────────────────────
diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_qr_code_in_a_TTY_session b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_qr_code_in_a_TTY_session
index 8c70e5f985..9816132f64 100644
--- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_qr_code_in_a_TTY_session
+++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_qr_code_in_a_TTY_session
@@ -35,8 +35,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-native-authenticate-user-with-qr-code-in-a-tty-session@gmail.c
-om
+  2. Send URL to user-integration-native-authenticate-user-with-qr-code-in-a-tty-session@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -59,8 +58,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-native-authenticate-user-with-qr-code-in-a-tty-session@gmail.c
-om
+  2. Send URL to user-integration-native-authenticate-user-with-qr-code-in-a-tty-session@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -83,8 +81,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-native-authenticate-user-with-qr-code-in-a-tty-session@gmail.c
-om
+  2. Send URL to user-integration-native-authenticate-user-with-qr-code-in-a-tty-session@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -150,8 +147,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-native-authenticate-user-with-qr-code-in-a-tty-session@gmail.c
-om
+  2. Send URL to user-integration-native-authenticate-user-with-qr-code-in-a-tty-session@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -217,8 +213,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-native-authenticate-user-with-qr-code-in-a-tty-session@gmail.c
-om
+  2. Send URL to user-integration-native-authenticate-user-with-qr-code-in-a-tty-session@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -327,8 +322,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-native-authenticate-user-with-qr-code-in-a-tty-session@gmail.c
-om
+  2. Send URL to user-integration-native-authenticate-user-with-qr-code-in-a-tty-session@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -437,8 +431,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-native-authenticate-user-with-qr-code-in-a-tty-session@gmail.c
-om
+  2. Send URL to user-integration-native-authenticate-user-with-qr-code-in-a-tty-session@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -594,8 +587,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-native-authenticate-user-with-qr-code-in-a-tty-session@gmail.c
-om
+  2. Send URL to user-integration-native-authenticate-user-with-qr-code-in-a-tty-session@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -751,8 +743,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-native-authenticate-user-with-qr-code-in-a-tty-session@gmail.c
-om
+  2. Send URL to user-integration-native-authenticate-user-with-qr-code-in-a-tty-session@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -951,8 +942,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-native-authenticate-user-with-qr-code-in-a-tty-session@gmail.c
-om
+  2. Send URL to user-integration-native-authenticate-user-with-qr-code-in-a-tty-session@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -1151,8 +1141,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-native-authenticate-user-with-qr-code-in-a-tty-session@gmail.c
-om
+  2. Send URL to user-integration-native-authenticate-user-with-qr-code-in-a-tty-session@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -1394,8 +1383,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-native-authenticate-user-with-qr-code-in-a-tty-session@gmail.c
-om
+  2. Send URL to user-integration-native-authenticate-user-with-qr-code-in-a-tty-session@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -1637,8 +1625,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-native-authenticate-user-with-qr-code-in-a-tty-session@gmail.c
-om
+  2. Send URL to user-integration-native-authenticate-user-with-qr-code-in-a-tty-session@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -1868,10 +1855,10 @@ Or enter 'r' to go back to select the authentication method
 Choose action:
 > 1
 PAM Authenticate()
-  User: "user-integration-native-authenticate-user-with-qr-code-in-a-tty-session"
+  User: "user-integration-native-authenticate-user-with-qr-code-in-a-tty-session@example.com"
   Result: success
 PAM AcctMgmt()
-  User: "user-integration-native-authenticate-user-with-qr-code-in-a-tty-session"
+  User: "user-integration-native-authenticate-user-with-qr-code-in-a-tty-session@example.com"
   Result: success
 >
 ────────────────────────────────────────────────────────────────────────────────
diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_qr_code_in_polkit b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_qr_code_in_polkit
deleted file mode 100644
index 4d83d2e3cb..0000000000
--- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_qr_code_in_polkit
+++ /dev/null
@@ -1,696 +0,0 @@
-> ./pam_authd login socket=${AUTHD_TEST_LOGIN_SOCK} force_native_client=true
-== Provider selection ==
-  1. local
-  2. ExampleBroker
-Choose your provider:
->
-────────────────────────────────────────────────────────────────────────────────
-> if [ -v AUTHD_PAM_CLI_TERM ]; then export TERM=${AUTHD_PAM_CLI_TERM}; fi
-> ./pam_authd login socket=${AUTHD_TEST_LOGIN_SOCK} force_native_client=true
-== Provider selection ==
-  1. local
-  2. ExampleBroker
-Choose your provider:
-> 2
-────────────────────────────────────────────────────────────────────────────────
-> if [ -v AUTHD_PAM_CLI_TERM ]; then export TERM=${AUTHD_PAM_CLI_TERM}; fi
-> ./pam_authd login socket=${AUTHD_TEST_LOGIN_SOCK} force_native_client=true
-== Provider selection ==
-  1. local
-  2. ExampleBroker
-Choose your provider:
-> 2
-== Password authentication ==
-Enter 'r' to cancel the request and go back to select the authentication method
-Gimme your password:
->
-────────────────────────────────────────────────────────────────────────────────
-> if [ -v AUTHD_PAM_CLI_TERM ]; then export TERM=${AUTHD_PAM_CLI_TERM}; fi
-> ./pam_authd login socket=${AUTHD_TEST_LOGIN_SOCK} force_native_client=true
-== Provider selection ==
-  1. local
-  2. ExampleBroker
-Choose your provider:
-> 2
-== Password authentication ==
-Enter 'r' to cancel the request and go back to select the authentication method
-Gimme your password:
->
-== Authentication method selection ==
-  1. Password authentication
-  2. Use a Login code
-  3. Send URL to user-integration-native-authenticate-user-with-qr-code-in-polkit@gmail.com
-  4. Use your fido device foo
-  5. Use your phone +33...
-  6. Use your phone +1...
-  7. Pin code
-  8. Authentication code
-Or enter 'r' to go back to choose the provider
-Choose your authentication method:
->
-────────────────────────────────────────────────────────────────────────────────
-> if [ -v AUTHD_PAM_CLI_TERM ]; then export TERM=${AUTHD_PAM_CLI_TERM}; fi
-> ./pam_authd login socket=${AUTHD_TEST_LOGIN_SOCK} force_native_client=true
-== Provider selection ==
-  1. local
-  2. ExampleBroker
-Choose your provider:
-> 2
-== Password authentication ==
-Enter 'r' to cancel the request and go back to select the authentication method
-Gimme your password:
->
-== Authentication method selection ==
-  1. Password authentication
-  2. Use a Login code
-  3. Send URL to user-integration-native-authenticate-user-with-qr-code-in-polkit@gmail.com
-  4. Use your fido device foo
-  5. Use your phone +33...
-  6. Use your phone +1...
-  7. Pin code
-  8. Authentication code
-Or enter 'r' to go back to choose the provider
-Choose your authentication method:
-> 2
-────────────────────────────────────────────────────────────────────────────────
-> if [ -v AUTHD_PAM_CLI_TERM ]; then export TERM=${AUTHD_PAM_CLI_TERM}; fi
-> ./pam_authd login socket=${AUTHD_TEST_LOGIN_SOCK} force_native_client=true
-== Provider selection ==
-  1. local
-  2. ExampleBroker
-Choose your provider:
-> 2
-== Password authentication ==
-Enter 'r' to cancel the request and go back to select the authentication method
-Gimme your password:
->
-== Authentication method selection ==
-  1. Password authentication
-  2. Use a Login code
-  3. Send URL to user-integration-native-authenticate-user-with-qr-code-in-polkit@gmail.com
-  4. Use your fido device foo
-  5. Use your phone +33...
-  6. Use your phone +1...
-  7. Pin code
-  8. Authentication code
-Or enter 'r' to go back to choose the provider
-Choose your authentication method:
-> 2
-== Use a Login code ==
-Enter the code in the login page
-https://ubuntu.com
-       1337
-
-  1. Wait for authentication result
-  2. Regenerate code
-Or enter 'r' to go back to select the authentication method
-Choose action:
->
-────────────────────────────────────────────────────────────────────────────────
-> if [ -v AUTHD_PAM_CLI_TERM ]; then export TERM=${AUTHD_PAM_CLI_TERM}; fi
-> ./pam_authd login socket=${AUTHD_TEST_LOGIN_SOCK} force_native_client=true
-== Provider selection ==
-  1. local
-  2. ExampleBroker
-Choose your provider:
-> 2
-== Password authentication ==
-Enter 'r' to cancel the request and go back to select the authentication method
-Gimme your password:
->
-== Authentication method selection ==
-  1. Password authentication
-  2. Use a Login code
-  3. Send URL to user-integration-native-authenticate-user-with-qr-code-in-polkit@gmail.com
-  4. Use your fido device foo
-  5. Use your phone +33...
-  6. Use your phone +1...
-  7. Pin code
-  8. Authentication code
-Or enter 'r' to go back to choose the provider
-Choose your authentication method:
-> 2
-== Use a Login code ==
-Enter the code in the login page
-https://ubuntu.com
-       1337
-
-  1. Wait for authentication result
-  2. Regenerate code
-Or enter 'r' to go back to select the authentication method
-Choose action:
-> 2
-────────────────────────────────────────────────────────────────────────────────
-> if [ -v AUTHD_PAM_CLI_TERM ]; then export TERM=${AUTHD_PAM_CLI_TERM}; fi
-> ./pam_authd login socket=${AUTHD_TEST_LOGIN_SOCK} force_native_client=true
-== Provider selection ==
-  1. local
-  2. ExampleBroker
-Choose your provider:
-> 2
-== Password authentication ==
-Enter 'r' to cancel the request and go back to select the authentication method
-Gimme your password:
->
-== Authentication method selection ==
-  1. Password authentication
-  2. Use a Login code
-  3. Send URL to user-integration-native-authenticate-user-with-qr-code-in-polkit@gmail.com
-  4. Use your fido device foo
-  5. Use your phone +33...
-  6. Use your phone +1...
-  7. Pin code
-  8. Authentication code
-Or enter 'r' to go back to choose the provider
-Choose your authentication method:
-> 2
-== Use a Login code ==
-Enter the code in the login page
-https://ubuntu.com
-       1337
-
-  1. Wait for authentication result
-  2. Regenerate code
-Or enter 'r' to go back to select the authentication method
-Choose action:
-> 2
-== Use a Login code ==
-Enter the code in the login page
-https://ubuntu.fr/
-       1338
-
-  1. Wait for authentication result
-  2. Regenerate code
-Or enter 'r' to go back to select the authentication method
-Choose action:
->
-────────────────────────────────────────────────────────────────────────────────
-> if [ -v AUTHD_PAM_CLI_TERM ]; then export TERM=${AUTHD_PAM_CLI_TERM}; fi
-> ./pam_authd login socket=${AUTHD_TEST_LOGIN_SOCK} force_native_client=true
-== Provider selection ==
-  1. local
-  2. ExampleBroker
-Choose your provider:
-> 2
-== Password authentication ==
-Enter 'r' to cancel the request and go back to select the authentication method
-Gimme your password:
->
-== Authentication method selection ==
-  1. Password authentication
-  2. Use a Login code
-  3. Send URL to user-integration-native-authenticate-user-with-qr-code-in-polkit@gmail.com
-  4. Use your fido device foo
-  5. Use your phone +33...
-  6. Use your phone +1...
-  7. Pin code
-  8. Authentication code
-Or enter 'r' to go back to choose the provider
-Choose your authentication method:
-> 2
-== Use a Login code ==
-Enter the code in the login page
-https://ubuntu.com
-       1337
-
-  1. Wait for authentication result
-  2. Regenerate code
-Or enter 'r' to go back to select the authentication method
-Choose action:
-> 2
-== Use a Login code ==
-Enter the code in the login page
-https://ubuntu.fr/
-       1338
-
-  1. Wait for authentication result
-  2. Regenerate code
-Or enter 'r' to go back to select the authentication method
-Choose action:
-> 2
-────────────────────────────────────────────────────────────────────────────────
-> if [ -v AUTHD_PAM_CLI_TERM ]; then export TERM=${AUTHD_PAM_CLI_TERM}; fi
-> ./pam_authd login socket=${AUTHD_TEST_LOGIN_SOCK} force_native_client=true
-== Provider selection ==
-  1. local
-  2. ExampleBroker
-Choose your provider:
-> 2
-== Password authentication ==
-Enter 'r' to cancel the request and go back to select the authentication method
-Gimme your password:
->
-== Authentication method selection ==
-  1. Password authentication
-  2. Use a Login code
-  3. Send URL to user-integration-native-authenticate-user-with-qr-code-in-polkit@gmail.com
-  4. Use your fido device foo
-  5. Use your phone +33...
-  6. Use your phone +1...
-  7. Pin code
-  8. Authentication code
-Or enter 'r' to go back to choose the provider
-Choose your authentication method:
-> 2
-== Use a Login code ==
-Enter the code in the login page
-https://ubuntu.com
-       1337
-
-  1. Wait for authentication result
-  2. Regenerate code
-Or enter 'r' to go back to select the authentication method
-Choose action:
-> 2
-== Use a Login code ==
-Enter the code in the login page
-https://ubuntu.fr/
-       1338
-
-  1. Wait for authentication result
-  2. Regenerate code
-Or enter 'r' to go back to select the authentication method
-Choose action:
-> 2
-== Use a Login code ==
-Enter the code in the login page
-https://ubuntuforum-br.org/
-           1339
-
-  1. Wait for authentication result
-  2. Regenerate code
-Or enter 'r' to go back to select the authentication method
-Choose action:
->
-────────────────────────────────────────────────────────────────────────────────
-> if [ -v AUTHD_PAM_CLI_TERM ]; then export TERM=${AUTHD_PAM_CLI_TERM}; fi
-> ./pam_authd login socket=${AUTHD_TEST_LOGIN_SOCK} force_native_client=true
-== Provider selection ==
-  1. local
-  2. ExampleBroker
-Choose your provider:
-> 2
-== Password authentication ==
-Enter 'r' to cancel the request and go back to select the authentication method
-Gimme your password:
->
-== Authentication method selection ==
-  1. Password authentication
-  2. Use a Login code
-  3. Send URL to user-integration-native-authenticate-user-with-qr-code-in-polkit@gmail.com
-  4. Use your fido device foo
-  5. Use your phone +33...
-  6. Use your phone +1...
-  7. Pin code
-  8. Authentication code
-Or enter 'r' to go back to choose the provider
-Choose your authentication method:
-> 2
-== Use a Login code ==
-Enter the code in the login page
-https://ubuntu.com
-       1337
-
-  1. Wait for authentication result
-  2. Regenerate code
-Or enter 'r' to go back to select the authentication method
-Choose action:
-> 2
-== Use a Login code ==
-Enter the code in the login page
-https://ubuntu.fr/
-       1338
-
-  1. Wait for authentication result
-  2. Regenerate code
-Or enter 'r' to go back to select the authentication method
-Choose action:
-> 2
-== Use a Login code ==
-Enter the code in the login page
-https://ubuntuforum-br.org/
-           1339
-
-  1. Wait for authentication result
-  2. Regenerate code
-Or enter 'r' to go back to select the authentication method
-Choose action:
-> 2
-────────────────────────────────────────────────────────────────────────────────
-> if [ -v AUTHD_PAM_CLI_TERM ]; then export TERM=${AUTHD_PAM_CLI_TERM}; fi
-> ./pam_authd login socket=${AUTHD_TEST_LOGIN_SOCK} force_native_client=true
-== Provider selection ==
-  1. local
-  2. ExampleBroker
-Choose your provider:
-> 2
-== Password authentication ==
-Enter 'r' to cancel the request and go back to select the authentication method
-Gimme your password:
->
-== Authentication method selection ==
-  1. Password authentication
-  2. Use a Login code
-  3. Send URL to user-integration-native-authenticate-user-with-qr-code-in-polkit@gmail.com
-  4. Use your fido device foo
-  5. Use your phone +33...
-  6. Use your phone +1...
-  7. Pin code
-  8. Authentication code
-Or enter 'r' to go back to choose the provider
-Choose your authentication method:
-> 2
-== Use a Login code ==
-Enter the code in the login page
-https://ubuntu.com
-       1337
-
-  1. Wait for authentication result
-  2. Regenerate code
-Or enter 'r' to go back to select the authentication method
-Choose action:
-> 2
-== Use a Login code ==
-Enter the code in the login page
-https://ubuntu.fr/
-       1338
-
-  1. Wait for authentication result
-  2. Regenerate code
-Or enter 'r' to go back to select the authentication method
-Choose action:
-> 2
-== Use a Login code ==
-Enter the code in the login page
-https://ubuntuforum-br.org/
-           1339
-
-  1. Wait for authentication result
-  2. Regenerate code
-Or enter 'r' to go back to select the authentication method
-Choose action:
-> 2
-== Use a Login code ==
-Enter the code in the login page
-https://www.ubuntu-it.org/
-           1340
-
-  1. Wait for authentication result
-  2. Regenerate code
-Or enter 'r' to go back to select the authentication method
-Choose action:
->
-────────────────────────────────────────────────────────────────────────────────
-> if [ -v AUTHD_PAM_CLI_TERM ]; then export TERM=${AUTHD_PAM_CLI_TERM}; fi
-> ./pam_authd login socket=${AUTHD_TEST_LOGIN_SOCK} force_native_client=true
-== Provider selection ==
-  1. local
-  2. ExampleBroker
-Choose your provider:
-> 2
-== Password authentication ==
-Enter 'r' to cancel the request and go back to select the authentication method
-Gimme your password:
->
-== Authentication method selection ==
-  1. Password authentication
-  2. Use a Login code
-  3. Send URL to user-integration-native-authenticate-user-with-qr-code-in-polkit@gmail.com
-  4. Use your fido device foo
-  5. Use your phone +33...
-  6. Use your phone +1...
-  7. Pin code
-  8. Authentication code
-Or enter 'r' to go back to choose the provider
-Choose your authentication method:
-> 2
-== Use a Login code ==
-Enter the code in the login page
-https://ubuntu.com
-       1337
-
-  1. Wait for authentication result
-  2. Regenerate code
-Or enter 'r' to go back to select the authentication method
-Choose action:
-> 2
-== Use a Login code ==
-Enter the code in the login page
-https://ubuntu.fr/
-       1338
-
-  1. Wait for authentication result
-  2. Regenerate code
-Or enter 'r' to go back to select the authentication method
-Choose action:
-> 2
-== Use a Login code ==
-Enter the code in the login page
-https://ubuntuforum-br.org/
-           1339
-
-  1. Wait for authentication result
-  2. Regenerate code
-Or enter 'r' to go back to select the authentication method
-Choose action:
-> 2
-== Use a Login code ==
-Enter the code in the login page
-https://www.ubuntu-it.org/
-           1340
-
-  1. Wait for authentication result
-  2. Regenerate code
-Or enter 'r' to go back to select the authentication method
-Choose action:
-> 2
-────────────────────────────────────────────────────────────────────────────────
-> if [ -v AUTHD_PAM_CLI_TERM ]; then export TERM=${AUTHD_PAM_CLI_TERM}; fi
-> ./pam_authd login socket=${AUTHD_TEST_LOGIN_SOCK} force_native_client=true
-== Provider selection ==
-  1. local
-  2. ExampleBroker
-Choose your provider:
-> 2
-== Password authentication ==
-Enter 'r' to cancel the request and go back to select the authentication method
-Gimme your password:
->
-== Authentication method selection ==
-  1. Password authentication
-  2. Use a Login code
-  3. Send URL to user-integration-native-authenticate-user-with-qr-code-in-polkit@gmail.com
-  4. Use your fido device foo
-  5. Use your phone +33...
-  6. Use your phone +1...
-  7. Pin code
-  8. Authentication code
-Or enter 'r' to go back to choose the provider
-Choose your authentication method:
-> 2
-== Use a Login code ==
-Enter the code in the login page
-https://ubuntu.com
-       1337
-
-  1. Wait for authentication result
-  2. Regenerate code
-Or enter 'r' to go back to select the authentication method
-Choose action:
-> 2
-== Use a Login code ==
-Enter the code in the login page
-https://ubuntu.fr/
-       1338
-
-  1. Wait for authentication result
-  2. Regenerate code
-Or enter 'r' to go back to select the authentication method
-Choose action:
-> 2
-== Use a Login code ==
-Enter the code in the login page
-https://ubuntuforum-br.org/
-           1339
-
-  1. Wait for authentication result
-  2. Regenerate code
-Or enter 'r' to go back to select the authentication method
-Choose action:
-> 2
-== Use a Login code ==
-Enter the code in the login page
-https://www.ubuntu-it.org/
-           1340
-
-  1. Wait for authentication result
-  2. Regenerate code
-Or enter 'r' to go back to select the authentication method
-Choose action:
-> 2
-== Use a Login code ==
-Enter the code in the login page
-https://ubuntu.com
-       1341
-
-  1. Wait for authentication result
-  2. Regenerate code
-Or enter 'r' to go back to select the authentication method
-Choose action:
->
-────────────────────────────────────────────────────────────────────────────────
-> if [ -v AUTHD_PAM_CLI_TERM ]; then export TERM=${AUTHD_PAM_CLI_TERM}; fi
-> ./pam_authd login socket=${AUTHD_TEST_LOGIN_SOCK} force_native_client=true
-== Provider selection ==
-  1. local
-  2. ExampleBroker
-Choose your provider:
-> 2
-== Password authentication ==
-Enter 'r' to cancel the request and go back to select the authentication method
-Gimme your password:
->
-== Authentication method selection ==
-  1. Password authentication
-  2. Use a Login code
-  3. Send URL to user-integration-native-authenticate-user-with-qr-code-in-polkit@gmail.com
-  4. Use your fido device foo
-  5. Use your phone +33...
-  6. Use your phone +1...
-  7. Pin code
-  8. Authentication code
-Or enter 'r' to go back to choose the provider
-Choose your authentication method:
-> 2
-== Use a Login code ==
-Enter the code in the login page
-https://ubuntu.com
-       1337
-
-  1. Wait for authentication result
-  2. Regenerate code
-Or enter 'r' to go back to select the authentication method
-Choose action:
-> 2
-== Use a Login code ==
-Enter the code in the login page
-https://ubuntu.fr/
-       1338
-
-  1. Wait for authentication result
-  2. Regenerate code
-Or enter 'r' to go back to select the authentication method
-Choose action:
-> 2
-== Use a Login code ==
-Enter the code in the login page
-https://ubuntuforum-br.org/
-           1339
-
-  1. Wait for authentication result
-  2. Regenerate code
-Or enter 'r' to go back to select the authentication method
-Choose action:
-> 2
-== Use a Login code ==
-Enter the code in the login page
-https://www.ubuntu-it.org/
-           1340
-
-  1. Wait for authentication result
-  2. Regenerate code
-Or enter 'r' to go back to select the authentication method
-Choose action:
-> 2
-== Use a Login code ==
-Enter the code in the login page
-https://ubuntu.com
-       1341
-
-  1. Wait for authentication result
-  2. Regenerate code
-Or enter 'r' to go back to select the authentication method
-Choose action:
-> 1
-────────────────────────────────────────────────────────────────────────────────
-> if [ -v AUTHD_PAM_CLI_TERM ]; then export TERM=${AUTHD_PAM_CLI_TERM}; fi
-> ./pam_authd login socket=${AUTHD_TEST_LOGIN_SOCK} force_native_client=true
-== Provider selection ==
-  1. local
-  2. ExampleBroker
-Choose your provider:
-> 2
-== Password authentication ==
-Enter 'r' to cancel the request and go back to select the authentication method
-Gimme your password:
->
-== Authentication method selection ==
-  1. Password authentication
-  2. Use a Login code
-  3. Send URL to user-integration-native-authenticate-user-with-qr-code-in-polkit@gmail.com
-  4. Use your fido device foo
-  5. Use your phone +33...
-  6. Use your phone +1...
-  7. Pin code
-  8. Authentication code
-Or enter 'r' to go back to choose the provider
-Choose your authentication method:
-> 2
-== Use a Login code ==
-Enter the code in the login page
-https://ubuntu.com
-       1337
-
-  1. Wait for authentication result
-  2. Regenerate code
-Or enter 'r' to go back to select the authentication method
-Choose action:
-> 2
-== Use a Login code ==
-Enter the code in the login page
-https://ubuntu.fr/
-       1338
-
-  1. Wait for authentication result
-  2. Regenerate code
-Or enter 'r' to go back to select the authentication method
-Choose action:
-> 2
-== Use a Login code ==
-Enter the code in the login page
-https://ubuntuforum-br.org/
-           1339
-
-  1. Wait for authentication result
-  2. Regenerate code
-Or enter 'r' to go back to select the authentication method
-Choose action:
-> 2
-== Use a Login code ==
-Enter the code in the login page
-https://www.ubuntu-it.org/
-           1340
-
-  1. Wait for authentication result
-  2. Regenerate code
-Or enter 'r' to go back to select the authentication method
-Choose action:
-> 2
-== Use a Login code ==
-Enter the code in the login page
-https://ubuntu.com
-       1341
-
-  1. Wait for authentication result
-  2. Regenerate code
-Or enter 'r' to go back to select the authentication method
-Choose action:
-> 1
-PAM Authenticate()
-  User: "user-integration-native-authenticate-user-with-qr-code-in-polkit"
-  Result: success
-PAM AcctMgmt()
-  User: "user-integration-native-authenticate-user-with-qr-code-in-polkit"
-  Result: success
->
-────────────────────────────────────────────────────────────────────────────────
diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_qr_code_in_screen b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_qr_code_in_screen
index 7822028e65..4f2f4afb8b 100644
--- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_qr_code_in_screen
+++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_qr_code_in_screen
@@ -35,7 +35,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-native-authenticate-user-with-qr-code-in-screen@gmail.com
+  2. Send URL to user-integration-native-authenticate-user-with-qr-code-in-screen@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -58,7 +58,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-native-authenticate-user-with-qr-code-in-screen@gmail.com
+  2. Send URL to user-integration-native-authenticate-user-with-qr-code-in-screen@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -81,7 +81,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-native-authenticate-user-with-qr-code-in-screen@gmail.com
+  2. Send URL to user-integration-native-authenticate-user-with-qr-code-in-screen@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -147,7 +147,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-native-authenticate-user-with-qr-code-in-screen@gmail.com
+  2. Send URL to user-integration-native-authenticate-user-with-qr-code-in-screen@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -213,7 +213,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-native-authenticate-user-with-qr-code-in-screen@gmail.com
+  2. Send URL to user-integration-native-authenticate-user-with-qr-code-in-screen@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -322,7 +322,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-native-authenticate-user-with-qr-code-in-screen@gmail.com
+  2. Send URL to user-integration-native-authenticate-user-with-qr-code-in-screen@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -431,7 +431,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-native-authenticate-user-with-qr-code-in-screen@gmail.com
+  2. Send URL to user-integration-native-authenticate-user-with-qr-code-in-screen@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -587,7 +587,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-native-authenticate-user-with-qr-code-in-screen@gmail.com
+  2. Send URL to user-integration-native-authenticate-user-with-qr-code-in-screen@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -743,7 +743,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-native-authenticate-user-with-qr-code-in-screen@gmail.com
+  2. Send URL to user-integration-native-authenticate-user-with-qr-code-in-screen@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -942,7 +942,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-native-authenticate-user-with-qr-code-in-screen@gmail.com
+  2. Send URL to user-integration-native-authenticate-user-with-qr-code-in-screen@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -1141,7 +1141,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-native-authenticate-user-with-qr-code-in-screen@gmail.com
+  2. Send URL to user-integration-native-authenticate-user-with-qr-code-in-screen@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -1383,7 +1383,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-native-authenticate-user-with-qr-code-in-screen@gmail.com
+  2. Send URL to user-integration-native-authenticate-user-with-qr-code-in-screen@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -1625,7 +1625,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-native-authenticate-user-with-qr-code-in-screen@gmail.com
+  2. Send URL to user-integration-native-authenticate-user-with-qr-code-in-screen@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -1855,10 +1855,10 @@ Or enter 'r' to go back to select the authentication method
 Choose action:
 > 1
 PAM Authenticate()
-  User: "user-integration-native-authenticate-user-with-qr-code-in-screen"
+  User: "user-integration-native-authenticate-user-with-qr-code-in-screen@example.com"
   Result: success
 PAM AcctMgmt()
-  User: "user-integration-native-authenticate-user-with-qr-code-in-screen"
+  User: "user-integration-native-authenticate-user-with-qr-code-in-screen@example.com"
   Result: success
 >
 ────────────────────────────────────────────────────────────────────────────────
diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_qr_code_in_ssh b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_qr_code_in_ssh
index 1e5497aa60..2dcbbe80bf 100644
--- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_qr_code_in_ssh
+++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_qr_code_in_ssh
@@ -36,7 +36,7 @@ Gimme your password:
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-service-qr-code-native@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-service-qr-code-native@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
@@ -59,7 +59,7 @@ Gimme your password:
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-service-qr-code-native@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-service-qr-code-native@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
@@ -82,7 +82,7 @@ Gimme your password:
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-service-qr-code-native@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-service-qr-code-native@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
@@ -115,7 +115,7 @@ Gimme your password:
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-service-qr-code-native@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-service-qr-code-native@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
@@ -148,7 +148,7 @@ Gimme your password:
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-service-qr-code-native@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-service-qr-code-native@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
@@ -191,7 +191,7 @@ Gimme your password:
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-service-qr-code-native@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-service-qr-code-native@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
@@ -234,7 +234,7 @@ Gimme your password:
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-service-qr-code-native@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-service-qr-code-native@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
@@ -287,7 +287,7 @@ Gimme your password:
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-service-qr-code-native@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-service-qr-code-native@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
@@ -340,7 +340,7 @@ Gimme your password:
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-service-qr-code-native@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-service-qr-code-native@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
@@ -403,7 +403,7 @@ Gimme your password:
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-service-qr-code-native@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-service-qr-code-native@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
@@ -466,7 +466,7 @@ Gimme your password:
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-service-qr-code-native@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-service-qr-code-native@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
@@ -539,7 +539,7 @@ Gimme your password:
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-service-qr-code-native@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-service-qr-code-native@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
@@ -612,7 +612,7 @@ Gimme your password:
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-service-qr-code-native@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-service-qr-code-native@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
@@ -672,10 +672,10 @@ Or enter 'r' to go back to select the authentication method
 Choose action:
 > 1
 PAM Authenticate()
-  User: "user-integration-pre-check-ssh-service-qr-code-native"
+  User: "user-integration-pre-check-ssh-service-qr-code-native@example.com"
   Result: success
 PAM AcctMgmt()
-  User: "user-integration-pre-check-ssh-service-qr-code-native"
+  User: "user-integration-pre-check-ssh-service-qr-code-native@example.com"
   Result: success
 >
 ────────────────────────────────────────────────────────────────────────────────
diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_upper_case_using_lower_case_after_db_migration b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_upper_case_using_lower_case_after_db_migration
index 41f591da0a..3707ebac2c 100644
--- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_upper_case_using_lower_case_after_db_migration
+++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_upper_case_using_lower_case_after_db_migration
@@ -10,10 +10,10 @@ Enter 'r' to cancel the request and go back to select the authentication method
 Gimme your password:
 >
 PAM Authenticate()
-  User: "user-integration-upper-case"
+  User: "user-integration-upper-case@example.com"
   Result: success
 PAM AcctMgmt()
-  User: "user-integration-upper-case"
+  User: "user-integration-upper-case@example.com"
   Result: success
 >
 ────────────────────────────────────────────────────────────────────────────────
diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_upper_case_using_lower_case_after_db_migration.group b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_upper_case_using_lower_case_after_db_migration.group
new file mode 100644
index 0000000000..2c7783d30a
--- /dev/null
+++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_upper_case_using_lower_case_after_db_migration.group
@@ -0,0 +1,6 @@
+localgroup:x:41:user-integration-with-mixed-case@example.com,user-integration-cached@example.com,user-integration-pre-check-with-upper-case@example.com,user-integration-upper-case@example.com,user-pre-check@example.com
+some-group-for-user-integration-WITH-Mixed-CaSe@example.com:x:101:user-integration-with-mixed-case@example.com
+some-group-for-user-integration-cached@example.com:x:102:user-integration-cached@example.com
+some-group-for-user-integration-pre-check-WITH-UPPER-CASE@example.com:x:103:user-integration-pre-check-with-upper-case@example.com
+some-group-for-user-integration-UPPER-CASE@example.com:x:104:user-integration-upper-case@example.com
+some-group-for-user-pre-check@example.com:x:105:user-pre-check@example.com
diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_upper_case_using_lower_case_after_db_migration.group.backup b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_upper_case_using_lower_case_after_db_migration.group.backup
new file mode 100644
index 0000000000..7fe8ba8346
--- /dev/null
+++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_upper_case_using_lower_case_after_db_migration.group.backup
@@ -0,0 +1,6 @@
+localgroup:x:41:user-integration-WITH-Mixed-CaSe@example.com,user-integration-cached@example.com,user-integration-pre-check-WITH-UPPER-CASE@example.com,user-integration-UPPER-CASE@example.com,user-pre-check@example.com
+some-group-for-user-integration-WITH-Mixed-CaSe@example.com:x:101:user-integration-WITH-Mixed-CaSe@example.com
+some-group-for-user-integration-cached@example.com:x:102:user-integration-cached@example.com
+some-group-for-user-integration-pre-check-WITH-UPPER-CASE@example.com:x:103:user-integration-pre-check-WITH-UPPER-CASE@example.com
+some-group-for-user-integration-UPPER-CASE@example.com:x:104:user-integration-UPPER-CASE@example.com
+some-group-for-user-pre-check@example.com:x:105:user-pre-check@example.com
diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_upper_case_using_lower_case_after_db_migration.groups b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_upper_case_using_lower_case_after_db_migration.groups
deleted file mode 100644
index f31a69be33..0000000000
--- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_upper_case_using_lower_case_after_db_migration.groups
+++ /dev/null
@@ -1,6 +0,0 @@
-localgroup:x:41:user-integration-with-mixed-case,user-integration-cached,user-integration-pre-check-with-upper-case,user-integration-upper-case,user-pre-check
-some-group-for-user-integration-WITH-Mixed-CaSe:x:101:user-integration-with-mixed-case
-some-group-for-user-integration-cached:x:102:user-integration-cached
-some-group-for-user-integration-pre-check-WITH-UPPER-CASE:x:103:user-integration-pre-check-with-upper-case
-some-group-for-user-integration-UPPER-CASE:x:104:user-integration-upper-case
-some-group-for-user-pre-check:x:105:user-pre-check
diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_with_warnings_on_unsupported_arguments b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_with_warnings_on_unsupported_arguments
index ebf40c0278..20e112a2e0 100644
--- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_with_warnings_on_unsupported_arguments
+++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_with_warnings_on_unsupported_arguments
@@ -1,21 +1,18 @@
-> ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET} invalid_flag=foo force_native_client=true b
-ar
+> ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET} invalid_flag=foo force_native_client=true bar
 == Provider selection ==
   1. local
   2. ExampleBroker
 Choose your provider:
 >
 ────────────────────────────────────────────────────────────────────────────────
-> ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET} invalid_flag=foo force_native_client=true b
-ar
+> ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET} invalid_flag=foo force_native_client=true bar
 == Provider selection ==
   1. local
   2. ExampleBroker
 Choose your provider:
 > 2
 ────────────────────────────────────────────────────────────────────────────────
-> ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET} invalid_flag=foo force_native_client=true b
-ar
+> ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET} invalid_flag=foo force_native_client=true bar
 == Provider selection ==
   1. local
   2. ExampleBroker
@@ -26,8 +23,7 @@ Enter 'r' to cancel the request and go back to select the authentication method
 Gimme your password:
 >
 ────────────────────────────────────────────────────────────────────────────────
-> ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET} invalid_flag=foo force_native_client=true b
-ar
+> ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET} invalid_flag=foo force_native_client=true bar
 == Provider selection ==
   1. local
   2. ExampleBroker
@@ -38,10 +34,10 @@ Enter 'r' to cancel the request and go back to select the authentication method
 Gimme your password:
 >
 PAM Authenticate()
-  User: "user-integration-native-authenticate-with-warnings-on-unsupported-arguments"
+  User: "user-integration-native-authenticate-with-warnings-on-unsupported-arguments@example.com"
   Result: success
 PAM AcctMgmt()
-  User: "user-integration-native-authenticate-with-warnings-on-unsupported-arguments"
+  User: "user-integration-native-authenticate-with-warnings-on-unsupported-arguments@example.com"
   Result: success
 >
 ────────────────────────────────────────────────────────────────────────────────
diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Deny_authentication_if_current_user_is_not_considered_as_root b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Deny_authentication_if_current_user_is_not_considered_as_root
index 6592255ba3..a0a28795c0 100644
--- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Deny_authentication_if_current_user_is_not_considered_as_root
+++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Deny_authentication_if_current_user_is_not_considered_as_root
@@ -1,27 +1,25 @@
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
-PAM Error Message: could not get current available brokers: permission denied: this action is on
-ly allowed for root users. Current user is XXXX
+PAM Error Message: could not get current available brokers: permission denied: only root can perform this operation
 PAM Authenticate()
-  User: "user-integration-native-deny-authentication-if-current-user-is-not-considered-as-root"
+  User: "user-integration-native-deny-authentication-if-current-user-is-not-considered-as-root@example.com"
   Result: error: PAM exit code: 4
     System error
 acct=incomplete
 PAM AcctMgmt()
-  User: "user-integration-native-deny-authentication-if-current-user-is-not-considered-as-root"
+  User: "user-integration-native-deny-authentication-if-current-user-is-not-considered-as-root@example.com"
   Result: error: PAM exit code: 25
     The return value should be ignored by PAM dispatch
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
-PAM Error Message: could not get current available brokers: permission denied: this action is on
-ly allowed for root users. Current user is XXXX
+PAM Error Message: could not get current available brokers: permission denied: only root can perform this operation
 PAM Authenticate()
-  User: "user-integration-native-deny-authentication-if-current-user-is-not-considered-as-root"
+  User: "user-integration-native-deny-authentication-if-current-user-is-not-considered-as-root@example.com"
   Result: error: PAM exit code: 4
     System error
 acct=incomplete
 PAM AcctMgmt()
-  User: "user-integration-native-deny-authentication-if-current-user-is-not-considered-as-root"
+  User: "user-integration-native-deny-authentication-if-current-user-is-not-considered-as-root@example.com"
   Result: error: PAM exit code: 25
     The return value should be ignored by PAM dispatch
 >
diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Deny_authentication_if_max_attempts_reached b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Deny_authentication_if_max_attempts_reached
index ae9f0c8858..97b8ca307c 100644
--- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Deny_authentication_if_max_attempts_reached
+++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Deny_authentication_if_max_attempts_reached
@@ -149,12 +149,12 @@ Gimme your password:
 >
 PAM Error Message: invalid password 'wrongpass', should be 'goodpass'
 PAM Authenticate()
-  User: "user-integration-native-deny-authentication-if-max-attempts-reached"
+  User: "user-integration-native-deny-authentication-if-max-attempts-reached@example.com"
   Result: error: PAM exit code: 7
     Authentication failure
 acct=incomplete
 PAM AcctMgmt()
-  User: "user-integration-native-deny-authentication-if-max-attempts-reached"
+  User: "user-integration-native-deny-authentication-if-max-attempts-reached@example.com"
   Result: error: PAM exit code: 25
     The return value should be ignored by PAM dispatch
 >
diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Deny_authentication_if_newpassword_does_not_match_required_criteria b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Deny_authentication_if_newpassword_does_not_match_required_criteria
index bfc15bc77f..d9e70367e6 100644
--- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Deny_authentication_if_newpassword_does_not_match_required_criteria
+++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Deny_authentication_if_newpassword_does_not_match_required_criteria
@@ -321,10 +321,10 @@ Enter your new password:
 Confirm Password:
 >
 PAM Authenticate()
-  User: "user-needs-reset-integration-bad-password-native"
+  User: "user-needs-reset-integration-bad-password-native@example.com"
   Result: success
 PAM AcctMgmt()
-  User: "user-needs-reset-integration-bad-password-native"
+  User: "user-needs-reset-integration-bad-password-native@example.com"
   Result: success
 >
 ────────────────────────────────────────────────────────────────────────────────
diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Deny_authentication_if_user_does_not_exist b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Deny_authentication_if_user_does_not_exist
index b7ce250a7f..5da295b93a 100644
--- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Deny_authentication_if_user_does_not_exist
+++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Deny_authentication_if_user_does_not_exist
@@ -18,14 +18,14 @@ Choose your provider:
   2. ExampleBroker
 Choose your provider:
 > 2
-PAM Error Message: can't select broker: user "user-unexistent" does not exist
+PAM Error Message: user "user-unexistent@example.com" does not exist
 PAM Authenticate()
-  User: "user-unexistent"
+  User: "user-unexistent@example.com"
   Result: error: PAM exit code: 4
     System error
 acct=incomplete
 PAM AcctMgmt()
-  User: "user-unexistent"
+  User: "user-unexistent@example.com"
   Result: error: PAM exit code: 25
     The return value should be ignored by PAM dispatch
 >
diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Error_if_cannot_connect_to_authd b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Error_if_cannot_connect_to_authd
index 14dffbab7f..04c4fdbf19 100644
--- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Error_if_cannot_connect_to_authd
+++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Error_if_cannot_connect_to_authd
@@ -1,15 +1,14 @@
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
-PAM Error Message: could not connect to unix:///some-path/not-existent-socket: service took too
-long to respond. Disconnecting client
+PAM Error Message: could not connect to unix:///some-path/not-existent-socket: service took too long to respond. Disconnecting client
 PAM Authenticate()
-  User: "user-integration-native-error-if-cannot-connect-to-authd"
+  User: "user-integration-native-error-if-cannot-connect-to-authd@example.com"
   Result: error: PAM exit code: 9
     Authentication service cannot retrieve authentication info
 acct=incomplete
 PAM AcctMgmt()
-  User: "user-integration-native-error-if-cannot-connect-to-authd"
+  User: "user-integration-native-error-if-cannot-connect-to-authd@example.com"
   Result: error: PAM exit code: 25
     The return value should be ignored by PAM dispatch
 >
diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Exit_authd_if_local_broker_is_selected b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Exit_authd_if_local_broker_is_selected
index 86d026813a..1b63ec473a 100644
--- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Exit_authd_if_local_broker_is_selected
+++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Exit_authd_if_local_broker_is_selected
@@ -20,11 +20,11 @@ Choose your provider:
 > 1
 auth=incomplete
 PAM Authenticate()
-  User: "user-integration-native-exit-authd-if-local-broker-is-selected"
+  User: "user-integration-native-exit-authd-if-local-broker-is-selected@example.com"
   Result: error: PAM exit code: 25
     The return value should be ignored by PAM dispatch
 PAM AcctMgmt()
-  User: "user-integration-native-exit-authd-if-local-broker-is-selected"
+  User: "user-integration-native-exit-authd-if-local-broker-is-selected@example.com"
   Result: error: PAM exit code: 26
     Critical error - immediate abort
 >
diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Exit_if_authd_is_stopped b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Exit_if_authd_is_stopped
index 61ab743640..d5c2a38334 100644
--- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Exit_if_authd_is_stopped
+++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Exit_if_authd_is_stopped
@@ -13,12 +13,12 @@ Choose your provider:
 >
 PAM Error Message: unix:///authd/test_socket.sock stopped serving
 PAM Authenticate()
-  User: "user-integration-native-exit-if-authd-is-stopped"
+  User: "user-integration-native-exit-if-authd-is-stopped@example.com"
   Result: error: PAM exit code: 4
     System error
 acct=incomplete
 PAM AcctMgmt()
-  User: "user-integration-native-exit-if-authd-is-stopped"
+  User: "user-integration-native-exit-if-authd-is-stopped@example.com"
   Result: error: PAM exit code: 25
     The return value should be ignored by PAM dispatch
 >
diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Exit_if_user_is_not_pre-checked_on_custom_ssh_service_with_auth_info_env b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Exit_if_user_is_not_pre-checked_on_custom_ssh_service_with_auth_info_env
index 772ef509a7..e295abca26 100644
--- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Exit_if_user_is_not_pre-checked_on_custom_ssh_service_with_auth_info_env
+++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Exit_if_user_is_not_pre-checked_on_custom_ssh_service_with_auth_info_env
@@ -1,11 +1,11 @@
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
 auth=incomplete
 PAM Authenticate()
-  User: "user-integration-native-exit-if-user-is-not-pre-checked-on-custom-ssh-service-with-auth-info-env"
+  User: "user-integration-native-exit-if-user-is-not-pre-checked-on-custom-ssh-service-with-auth-info-env@example.com"
   Result: error: PAM exit code: 25
     The return value should be ignored by PAM dispatch
 PAM AcctMgmt()
-  User: "user-integration-native-exit-if-user-is-not-pre-checked-on-custom-ssh-service-with-auth-info-env"
+  User: "user-integration-native-exit-if-user-is-not-pre-checked-on-custom-ssh-service-with-auth-info-env@example.com"
   Result: error: PAM exit code: 26
     Critical error - immediate abort
 >
@@ -13,11 +13,11 @@ PAM AcctMgmt()
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
 auth=incomplete
 PAM Authenticate()
-  User: "user-integration-native-exit-if-user-is-not-pre-checked-on-custom-ssh-service-with-auth-info-env"
+  User: "user-integration-native-exit-if-user-is-not-pre-checked-on-custom-ssh-service-with-auth-info-env@example.com"
   Result: error: PAM exit code: 25
     The return value should be ignored by PAM dispatch
 PAM AcctMgmt()
-  User: "user-integration-native-exit-if-user-is-not-pre-checked-on-custom-ssh-service-with-auth-info-env"
+  User: "user-integration-native-exit-if-user-is-not-pre-checked-on-custom-ssh-service-with-auth-info-env@example.com"
   Result: error: PAM exit code: 26
     Critical error - immediate abort
 >
diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Exit_if_user_is_not_pre-checked_on_custom_ssh_service_with_connection_env b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Exit_if_user_is_not_pre-checked_on_custom_ssh_service_with_connection_env
index c8ff4922a4..ec44dc7351 100644
--- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Exit_if_user_is_not_pre-checked_on_custom_ssh_service_with_connection_env
+++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Exit_if_user_is_not_pre-checked_on_custom_ssh_service_with_connection_env
@@ -1,11 +1,11 @@
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
 auth=incomplete
 PAM Authenticate()
-  User: "user-integration-native-exit-if-user-is-not-pre-checked-on-custom-ssh-service-with-connection-env"
+  User: "user-integration-native-exit-if-user-is-not-pre-checked-on-custom-ssh-service-with-connection-env@example.com"
   Result: error: PAM exit code: 25
     The return value should be ignored by PAM dispatch
 PAM AcctMgmt()
-  User: "user-integration-native-exit-if-user-is-not-pre-checked-on-custom-ssh-service-with-connection-env"
+  User: "user-integration-native-exit-if-user-is-not-pre-checked-on-custom-ssh-service-with-connection-env@example.com"
   Result: error: PAM exit code: 26
     Critical error - immediate abort
 >
@@ -13,11 +13,11 @@ PAM AcctMgmt()
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
 auth=incomplete
 PAM Authenticate()
-  User: "user-integration-native-exit-if-user-is-not-pre-checked-on-custom-ssh-service-with-connection-env"
+  User: "user-integration-native-exit-if-user-is-not-pre-checked-on-custom-ssh-service-with-connection-env@example.com"
   Result: error: PAM exit code: 25
     The return value should be ignored by PAM dispatch
 PAM AcctMgmt()
-  User: "user-integration-native-exit-if-user-is-not-pre-checked-on-custom-ssh-service-with-connection-env"
+  User: "user-integration-native-exit-if-user-is-not-pre-checked-on-custom-ssh-service-with-connection-env@example.com"
   Result: error: PAM exit code: 26
     Critical error - immediate abort
 >
diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Exit_if_user_is_not_pre-checked_on_ssh_service b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Exit_if_user_is_not_pre-checked_on_ssh_service
index 2983f1d3f2..3e5428694f 100644
--- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Exit_if_user_is_not_pre-checked_on_ssh_service
+++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Exit_if_user_is_not_pre-checked_on_ssh_service
@@ -1,11 +1,11 @@
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
 auth=incomplete
 PAM Authenticate()
-  User: "user-integration-native-exit-if-user-is-not-pre-checked-on-ssh-service"
+  User: "user-integration-native-exit-if-user-is-not-pre-checked-on-ssh-service@example.com"
   Result: error: PAM exit code: 25
     The return value should be ignored by PAM dispatch
 PAM AcctMgmt()
-  User: "user-integration-native-exit-if-user-is-not-pre-checked-on-ssh-service"
+  User: "user-integration-native-exit-if-user-is-not-pre-checked-on-ssh-service@example.com"
   Result: error: PAM exit code: 26
     Critical error - immediate abort
 >
@@ -13,11 +13,11 @@ PAM AcctMgmt()
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
 auth=incomplete
 PAM Authenticate()
-  User: "user-integration-native-exit-if-user-is-not-pre-checked-on-ssh-service"
+  User: "user-integration-native-exit-if-user-is-not-pre-checked-on-ssh-service@example.com"
   Result: error: PAM exit code: 25
     The return value should be ignored by PAM dispatch
 PAM AcctMgmt()
-  User: "user-integration-native-exit-if-user-is-not-pre-checked-on-ssh-service"
+  User: "user-integration-native-exit-if-user-is-not-pre-checked-on-ssh-service@example.com"
   Result: error: PAM exit code: 26
     Critical error - immediate abort
 >
diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Prevent_preset_user_from_switching_username b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Prevent_preset_user_from_switching_username
index ad80b999f1..581da72be2 100644
--- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Prevent_preset_user_from_switching_username
+++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Prevent_preset_user_from_switching_username
@@ -61,7 +61,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-native-prevent-preset-user-from-switching-username@gmail.com
+  2. Send URL to user-integration-native-prevent-preset-user-from-switching-username@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -87,7 +87,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-native-prevent-preset-user-from-switching-username@gmail.com
+  2. Send URL to user-integration-native-prevent-preset-user-from-switching-username@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -113,7 +113,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-native-prevent-preset-user-from-switching-username@gmail.com
+  2. Send URL to user-integration-native-prevent-preset-user-from-switching-username@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -144,7 +144,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-native-prevent-preset-user-from-switching-username@gmail.com
+  2. Send URL to user-integration-native-prevent-preset-user-from-switching-username@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -175,7 +175,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-native-prevent-preset-user-from-switching-username@gmail.com
+  2. Send URL to user-integration-native-prevent-preset-user-from-switching-username@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -209,7 +209,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-native-prevent-preset-user-from-switching-username@gmail.com
+  2. Send URL to user-integration-native-prevent-preset-user-from-switching-username@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -243,7 +243,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-native-prevent-preset-user-from-switching-username@gmail.com
+  2. Send URL to user-integration-native-prevent-preset-user-from-switching-username@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -280,7 +280,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-native-prevent-preset-user-from-switching-username@gmail.com
+  2. Send URL to user-integration-native-prevent-preset-user-from-switching-username@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -317,7 +317,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-native-prevent-preset-user-from-switching-username@gmail.com
+  2. Send URL to user-integration-native-prevent-preset-user-from-switching-username@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -358,7 +358,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-native-prevent-preset-user-from-switching-username@gmail.com
+  2. Send URL to user-integration-native-prevent-preset-user-from-switching-username@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -384,10 +384,10 @@ Enter 'r' to cancel the request and go back to select the authentication method
 Gimme your password:
 >
 PAM Authenticate()
-  User: "user-integration-native-prevent-preset-user-from-switching-username"
+  User: "user-integration-native-prevent-preset-user-from-switching-username@example.com"
   Result: success
 PAM AcctMgmt()
-  User: "user-integration-native-prevent-preset-user-from-switching-username"
+  User: "user-integration-native-prevent-preset-user-from-switching-username@example.com"
   Result: success
 >
 ────────────────────────────────────────────────────────────────────────────────
diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Remember_last_successful_broker_and_mode b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Remember_last_successful_broker_and_mode
index 2c2d46ad28..490e3ec953 100644
--- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Remember_last_successful_broker_and_mode
+++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Remember_last_successful_broker_and_mode
@@ -35,7 +35,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-native-remember-last-successful-broker-and-mode@gmail.com
+  2. Send URL to user-integration-native-remember-last-successful-broker-and-mode@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -58,7 +58,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-native-remember-last-successful-broker-and-mode@gmail.com
+  2. Send URL to user-integration-native-remember-last-successful-broker-and-mode@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -81,7 +81,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-native-remember-last-successful-broker-and-mode@gmail.com
+  2. Send URL to user-integration-native-remember-last-successful-broker-and-mode@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -110,7 +110,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-native-remember-last-successful-broker-and-mode@gmail.com
+  2. Send URL to user-integration-native-remember-last-successful-broker-and-mode@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -143,7 +143,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-native-remember-last-successful-broker-and-mode@gmail.com
+  2. Send URL to user-integration-native-remember-last-successful-broker-and-mode@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -176,7 +176,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-integration-native-remember-last-successful-broker-and-mode@gmail.com
+  2. Send URL to user-integration-native-remember-last-successful-broker-and-mode@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -197,10 +197,10 @@ Enter 'r' to cancel the request and go back to select the authentication method
 Enter your one time credential:
 > temporary pass0
 PAM Authenticate()
-  User: "user-integration-native-remember-last-successful-broker-and-mode"
+  User: "user-integration-native-remember-last-successful-broker-and-mode@example.com"
   Result: success
 PAM AcctMgmt()
-  User: "user-integration-native-remember-last-successful-broker-and-mode"
+  User: "user-integration-native-remember-last-successful-broker-and-mode@example.com"
   Result: success
 >
 ────────────────────────────────────────────────────────────────────────────────
@@ -252,10 +252,10 @@ Enter 'r' to cancel the request and go back to select the authentication method
 Enter your one time credential:
 > temporary pass0
 PAM Authenticate()
-  User: "user-integration-native-remember-last-successful-broker-and-mode"
+  User: "user-integration-native-remember-last-successful-broker-and-mode@example.com"
   Result: success
 PAM AcctMgmt()
-  User: "user-integration-native-remember-last-successful-broker-and-mode"
+  User: "user-integration-native-remember-last-successful-broker-and-mode@example.com"
   Result: success
 >
 ────────────────────────────────────────────────────────────────────────────────
diff --git a/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Change_passwd_after_MFA_auth b/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Change_passwd_after_MFA_auth
index e0f42779b7..9f7d0cdc63 100644
--- a/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Change_passwd_after_MFA_auth
+++ b/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Change_passwd_after_MFA_auth
@@ -2,7 +2,7 @@
 Username:
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd passwd socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
-Username: user-mfa-integration-native-passwd
+Username: user-mfa-integration-native-passwd@example.com
 == Provider selection ==
   1. local
   2. ExampleBroker
@@ -11,7 +11,7 @@ Choose your provider:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd passwd socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
-Username: user-mfa-integration-native-passwd
+Username: user-mfa-integration-native-passwd@example.com
 == Provider selection ==
   1. local
   2. ExampleBroker
@@ -20,7 +20,7 @@ Choose your provider:
 > 2
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd passwd socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
-Username: user-mfa-integration-native-passwd
+Username: user-mfa-integration-native-passwd@example.com
 == Provider selection ==
   1. local
   2. ExampleBroker
@@ -33,7 +33,7 @@ Gimme your password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd passwd socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
-Username: user-mfa-integration-native-passwd
+Username: user-mfa-integration-native-passwd@example.com
 == Provider selection ==
   1. local
   2. ExampleBroker
@@ -46,7 +46,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-mfa-integration-native-passwd@gmail.com
+  2. Send URL to user-mfa-integration-native-passwd@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -58,7 +58,7 @@ Choose your authentication method:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd passwd socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
-Username: user-mfa-integration-native-passwd
+Username: user-mfa-integration-native-passwd@example.com
 == Provider selection ==
   1. local
   2. ExampleBroker
@@ -71,7 +71,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-mfa-integration-native-passwd@gmail.com
+  2. Send URL to user-mfa-integration-native-passwd@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -87,7 +87,7 @@ Gimme your password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd passwd socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
-Username: user-mfa-integration-native-passwd
+Username: user-mfa-integration-native-passwd@example.com
 == Provider selection ==
   1. local
   2. ExampleBroker
@@ -100,7 +100,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-mfa-integration-native-passwd@gmail.com
+  2. Send URL to user-mfa-integration-native-passwd@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -115,13 +115,12 @@ Enter 'r' to cancel the request and go back to select the authentication method
 Gimme your password:
 >
 == Use your fido device foo ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Plug your fido device and press with your thumb:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd passwd socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
-Username: user-mfa-integration-native-passwd
+Username: user-mfa-integration-native-passwd@example.com
 == Provider selection ==
   1. local
   2. ExampleBroker
@@ -134,7 +133,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-mfa-integration-native-passwd@gmail.com
+  2. Send URL to user-mfa-integration-native-passwd@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -149,13 +148,12 @@ Enter 'r' to cancel the request and go back to select the authentication method
 Gimme your password:
 >
 == Use your fido device foo ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Plug your fido device and press with your thumb:
 > r
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd passwd socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
-Username: user-mfa-integration-native-passwd
+Username: user-mfa-integration-native-passwd@example.com
 == Provider selection ==
   1. local
   2. ExampleBroker
@@ -168,7 +166,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-mfa-integration-native-passwd@gmail.com
+  2. Send URL to user-mfa-integration-native-passwd@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -183,8 +181,7 @@ Enter 'r' to cancel the request and go back to select the authentication method
 Gimme your password:
 >
 == Use your fido device foo ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Plug your fido device and press with your thumb:
 > r
 == Authentication method selection ==
@@ -196,7 +193,7 @@ Choose your authentication method:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd passwd socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
-Username: user-mfa-integration-native-passwd
+Username: user-mfa-integration-native-passwd@example.com
 == Provider selection ==
   1. local
   2. ExampleBroker
@@ -209,7 +206,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-mfa-integration-native-passwd@gmail.com
+  2. Send URL to user-mfa-integration-native-passwd@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -224,8 +221,7 @@ Enter 'r' to cancel the request and go back to select the authentication method
 Gimme your password:
 >
 == Use your fido device foo ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Plug your fido device and press with your thumb:
 > r
 == Authentication method selection ==
@@ -236,13 +232,12 @@ Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 1
 == Use your fido device foo ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Plug your fido device and press with your thumb:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd passwd socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
-Username: user-mfa-integration-native-passwd
+Username: user-mfa-integration-native-passwd@example.com
 == Provider selection ==
   1. local
   2. ExampleBroker
@@ -255,7 +250,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-mfa-integration-native-passwd@gmail.com
+  2. Send URL to user-mfa-integration-native-passwd@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -270,8 +265,7 @@ Enter 'r' to cancel the request and go back to select the authentication method
 Gimme your password:
 >
 == Use your fido device foo ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Plug your fido device and press with your thumb:
 > r
 == Authentication method selection ==
@@ -282,18 +276,16 @@ Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 1
 == Use your fido device foo ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Plug your fido device and press with your thumb:
 >
 == Use your phone +33... ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Unlock your phone +33... or accept request on web interface:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd passwd socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
-Username: user-mfa-integration-native-passwd
+Username: user-mfa-integration-native-passwd@example.com
 == Provider selection ==
   1. local
   2. ExampleBroker
@@ -306,7 +298,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-mfa-integration-native-passwd@gmail.com
+  2. Send URL to user-mfa-integration-native-passwd@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -321,8 +313,7 @@ Enter 'r' to cancel the request and go back to select the authentication method
 Gimme your password:
 >
 == Use your fido device foo ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Plug your fido device and press with your thumb:
 > r
 == Authentication method selection ==
@@ -333,18 +324,16 @@ Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 1
 == Use your fido device foo ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Plug your fido device and press with your thumb:
 >
 == Use your phone +33... ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Unlock your phone +33... or accept request on web interface:
 > r
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd passwd socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
-Username: user-mfa-integration-native-passwd
+Username: user-mfa-integration-native-passwd@example.com
 == Provider selection ==
   1. local
   2. ExampleBroker
@@ -357,7 +346,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-mfa-integration-native-passwd@gmail.com
+  2. Send URL to user-mfa-integration-native-passwd@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -372,8 +361,7 @@ Enter 'r' to cancel the request and go back to select the authentication method
 Gimme your password:
 >
 == Use your fido device foo ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Plug your fido device and press with your thumb:
 > r
 == Authentication method selection ==
@@ -384,13 +372,11 @@ Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 1
 == Use your fido device foo ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Plug your fido device and press with your thumb:
 >
 == Use your phone +33... ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Unlock your phone +33... or accept request on web interface:
 > r
 == Authentication method selection ==
@@ -401,7 +387,7 @@ Choose your authentication method:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd passwd socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
-Username: user-mfa-integration-native-passwd
+Username: user-mfa-integration-native-passwd@example.com
 == Provider selection ==
   1. local
   2. ExampleBroker
@@ -414,7 +400,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-mfa-integration-native-passwd@gmail.com
+  2. Send URL to user-mfa-integration-native-passwd@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -429,8 +415,7 @@ Enter 'r' to cancel the request and go back to select the authentication method
 Gimme your password:
 >
 == Use your fido device foo ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Plug your fido device and press with your thumb:
 > r
 == Authentication method selection ==
@@ -441,13 +426,11 @@ Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 1
 == Use your fido device foo ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Plug your fido device and press with your thumb:
 >
 == Use your phone +33... ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Unlock your phone +33... or accept request on web interface:
 > r
 == Authentication method selection ==
@@ -457,13 +440,12 @@ Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 1
 == Use your phone +33... ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Unlock your phone +33... or accept request on web interface:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd passwd socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
-Username: user-mfa-integration-native-passwd
+Username: user-mfa-integration-native-passwd@example.com
 == Provider selection ==
   1. local
   2. ExampleBroker
@@ -476,7 +458,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-mfa-integration-native-passwd@gmail.com
+  2. Send URL to user-mfa-integration-native-passwd@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -491,8 +473,7 @@ Enter 'r' to cancel the request and go back to select the authentication method
 Gimme your password:
 >
 == Use your fido device foo ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Plug your fido device and press with your thumb:
 > r
 == Authentication method selection ==
@@ -503,13 +484,11 @@ Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 1
 == Use your fido device foo ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Plug your fido device and press with your thumb:
 >
 == Use your phone +33... ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Unlock your phone +33... or accept request on web interface:
 > r
 == Authentication method selection ==
@@ -519,8 +498,7 @@ Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 1
 == Use your phone +33... ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Unlock your phone +33... or accept request on web interface:
 >
 == Password reset ==
@@ -529,7 +507,7 @@ Enter your new password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd passwd socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
-Username: user-mfa-integration-native-passwd
+Username: user-mfa-integration-native-passwd@example.com
 == Provider selection ==
   1. local
   2. ExampleBroker
@@ -542,7 +520,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-mfa-integration-native-passwd@gmail.com
+  2. Send URL to user-mfa-integration-native-passwd@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -557,8 +535,7 @@ Enter 'r' to cancel the request and go back to select the authentication method
 Gimme your password:
 >
 == Use your fido device foo ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Plug your fido device and press with your thumb:
 > r
 == Authentication method selection ==
@@ -569,13 +546,11 @@ Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 1
 == Use your fido device foo ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Plug your fido device and press with your thumb:
 >
 == Use your phone +33... ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Unlock your phone +33... or accept request on web interface:
 > r
 == Authentication method selection ==
@@ -585,8 +560,7 @@ Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 1
 == Use your phone +33... ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Unlock your phone +33... or accept request on web interface:
 >
 == Password reset ==
@@ -597,7 +571,7 @@ Confirm Password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd passwd socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
-Username: user-mfa-integration-native-passwd
+Username: user-mfa-integration-native-passwd@example.com
 == Provider selection ==
   1. local
   2. ExampleBroker
@@ -610,7 +584,7 @@ Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
-  2. Send URL to user-mfa-integration-native-passwd@gmail.com
+  2. Send URL to user-mfa-integration-native-passwd@example.com
   3. Use your fido device foo
   4. Use your phone +33...
   5. Use your phone +1...
@@ -625,8 +599,7 @@ Enter 'r' to cancel the request and go back to select the authentication method
 Gimme your password:
 >
 == Use your fido device foo ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Plug your fido device and press with your thumb:
 > r
 == Authentication method selection ==
@@ -637,13 +610,11 @@ Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 1
 == Use your fido device foo ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Plug your fido device and press with your thumb:
 >
 == Use your phone +33... ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Unlock your phone +33... or accept request on web interface:
 > r
 == Authentication method selection ==
@@ -653,8 +624,7 @@ Or enter 'r' to go back to choose the provider
 Choose your authentication method:
 > 1
 == Use your phone +33... ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication meth
-od
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
 Unlock your phone +33... or accept request on web interface:
 >
 == Password reset ==
@@ -664,10 +634,10 @@ Enter your new password:
 Confirm Password:
 >
 PAM ChangeAuthTok()
-  User: "user-mfa-integration-native-passwd"
+  User: "user-mfa-integration-native-passwd@example.com"
   Result: success
 PAM AcctMgmt()
-  User: "user-mfa-integration-native-passwd"
+  User: "user-mfa-integration-native-passwd@example.com"
   Result: success
 >
 ────────────────────────────────────────────────────────────────────────────────
diff --git a/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Change_password_successfully_and_authenticate_with_new_one b/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Change_password_successfully_and_authenticate_with_new_one
index 5be6455262..e8e85885f3 100644
--- a/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Change_password_successfully_and_authenticate_with_new_one
+++ b/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Change_password_successfully_and_authenticate_with_new_one
@@ -2,7 +2,7 @@
 Username:
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd passwd socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
-Username: user-integration-simple-testnativechangeauthtok
+Username: user-integration-simple-testnativechangeauthtok@example.com
 == Provider selection ==
   1. local
   2. ExampleBroker
@@ -11,7 +11,7 @@ Choose your provider:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd passwd socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
-Username: user-integration-simple-testnativechangeauthtok
+Username: user-integration-simple-testnativechangeauthtok@example.com
 == Provider selection ==
   1. local
   2. ExampleBroker
@@ -20,7 +20,7 @@ Choose your provider:
 > 2
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd passwd socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
-Username: user-integration-simple-testnativechangeauthtok
+Username: user-integration-simple-testnativechangeauthtok@example.com
 == Provider selection ==
   1. local
   2. ExampleBroker
@@ -33,7 +33,7 @@ Gimme your password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd passwd socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
-Username: user-integration-simple-testnativechangeauthtok
+Username: user-integration-simple-testnativechangeauthtok@example.com
 == Provider selection ==
   1. local
   2. ExampleBroker
@@ -50,7 +50,7 @@ Enter your new password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd passwd socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
-Username: user-integration-simple-testnativechangeauthtok
+Username: user-integration-simple-testnativechangeauthtok@example.com
 == Provider selection ==
   1. local
   2. ExampleBroker
@@ -69,7 +69,7 @@ Confirm Password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd passwd socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
-Username: user-integration-simple-testnativechangeauthtok
+Username: user-integration-simple-testnativechangeauthtok@example.com
 == Provider selection ==
   1. local
   2. ExampleBroker
@@ -87,10 +87,10 @@ Enter your new password:
 Confirm Password:
 >
 PAM ChangeAuthTok()
-  User: "user-integration-simple-testnativechangeauthtok"
+  User: "user-integration-simple-testnativechangeauthtok@example.com"
   Result: success
 PAM AcctMgmt()
-  User: "user-integration-simple-testnativechangeauthtok"
+  User: "user-integration-simple-testnativechangeauthtok@example.com"
   Result: success
 >
 ────────────────────────────────────────────────────────────────────────────────
@@ -100,23 +100,23 @@ PAM AcctMgmt()
 Username:
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
-Username: user-integration-simple-testnativechangeauthtok
+Username: user-integration-simple-testnativechangeauthtok@example.com
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
 Gimme your password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
-Username: user-integration-simple-testnativechangeauthtok
+Username: user-integration-simple-testnativechangeauthtok@example.com
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
 Gimme your password:
 >
 PAM Authenticate()
-  User: "user-integration-simple-testnativechangeauthtok"
+  User: "user-integration-simple-testnativechangeauthtok@example.com"
   Result: success
 PAM AcctMgmt()
-  User: "user-integration-simple-testnativechangeauthtok"
+  User: "user-integration-simple-testnativechangeauthtok@example.com"
   Result: success
 >
 ────────────────────────────────────────────────────────────────────────────────
diff --git a/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Change_password_successfully_and_authenticate_with_new_one_with_different_case b/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Change_password_successfully_and_authenticate_with_new_one_with_different_case
index a4d8c7496b..0c0f4fef7e 100644
--- a/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Change_password_successfully_and_authenticate_with_new_one_with_different_case
+++ b/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Change_password_successfully_and_authenticate_with_new_one_with_different_case
@@ -2,7 +2,7 @@
 Username:
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd passwd socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
-Username: user-integration-case-insensitive-testnativechangeauthtok
+Username: user-integration-case-insensitive-testnativechangeauthtok@example.com
 == Provider selection ==
   1. local
   2. ExampleBroker
@@ -11,7 +11,7 @@ Choose your provider:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd passwd socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
-Username: user-integration-case-insensitive-testnativechangeauthtok
+Username: user-integration-case-insensitive-testnativechangeauthtok@example.com
 == Provider selection ==
   1. local
   2. ExampleBroker
@@ -20,7 +20,7 @@ Choose your provider:
 > 2
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd passwd socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
-Username: user-integration-case-insensitive-testnativechangeauthtok
+Username: user-integration-case-insensitive-testnativechangeauthtok@example.com
 == Provider selection ==
   1. local
   2. ExampleBroker
@@ -33,7 +33,7 @@ Gimme your password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd passwd socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
-Username: user-integration-case-insensitive-testnativechangeauthtok
+Username: user-integration-case-insensitive-testnativechangeauthtok@example.com
 == Provider selection ==
   1. local
   2. ExampleBroker
@@ -50,7 +50,7 @@ Enter your new password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd passwd socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
-Username: user-integration-case-insensitive-testnativechangeauthtok
+Username: user-integration-case-insensitive-testnativechangeauthtok@example.com
 == Provider selection ==
   1. local
   2. ExampleBroker
@@ -69,7 +69,7 @@ Confirm Password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd passwd socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
-Username: user-integration-case-insensitive-testnativechangeauthtok
+Username: user-integration-case-insensitive-testnativechangeauthtok@example.com
 == Provider selection ==
   1. local
   2. ExampleBroker
@@ -87,10 +87,10 @@ Enter your new password:
 Confirm Password:
 >
 PAM ChangeAuthTok()
-  User: "user-integration-case-insensitive-testnativechangeauthtok"
+  User: "user-integration-case-insensitive-testnativechangeauthtok@example.com"
   Result: success
 PAM AcctMgmt()
-  User: "user-integration-case-insensitive-testnativechangeauthtok"
+  User: "user-integration-case-insensitive-testnativechangeauthtok@example.com"
   Result: success
 >
 ────────────────────────────────────────────────────────────────────────────────
@@ -100,23 +100,23 @@ PAM AcctMgmt()
 Username:
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
-Username: user-integration-case-insensitive-testnativechangeauthtok
+Username: user-integration-case-insensitive-testnativechangeauthtok@example.com
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
 Gimme your password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
-Username: user-integration-case-insensitive-testnativechangeauthtok
+Username: user-integration-case-insensitive-testnativechangeauthtok@example.com
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
 Gimme your password:
 >
 PAM Authenticate()
-  User: "user-integration-case-insensitive-testnativechangeauthtok"
+  User: "user-integration-case-insensitive-testnativechangeauthtok@example.com"
   Result: success
 PAM AcctMgmt()
-  User: "user-integration-case-insensitive-testnativechangeauthtok"
+  User: "user-integration-case-insensitive-testnativechangeauthtok@example.com"
   Result: success
 >
 ────────────────────────────────────────────────────────────────────────────────
diff --git a/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Change_password_successfully_and_authenticate_with_new_one_with_single_broker_and_password_only_supported_method b/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Change_password_successfully_and_authenticate_with_new_one_with_single_broker_and_password_only_supported_method
index cf9d3350a4..bd7af9d614 100644
--- a/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Change_password_successfully_and_authenticate_with_new_one_with_single_broker_and_password_only_supported_method
+++ b/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Change_password_successfully_and_authenticate_with_new_one_with_single_broker_and_password_only_supported_method
@@ -31,10 +31,10 @@ Enter your new password:
 Confirm Password:
 >
 PAM ChangeAuthTok()
-  User: "user-auth-modes-password,mandatoryreset-integration-polkit-testnativechangeauthtok"
+  User: "user-auth-modes-password,mandatoryreset-integration-polkit-testnativechangeauthtok@example.com"
   Result: success
 PAM AcctMgmt()
-  User: "user-auth-modes-password,mandatoryreset-integration-polkit-testnativechangeauthtok"
+  User: "user-auth-modes-password,mandatoryreset-integration-polkit-testnativechangeauthtok@example.com"
   Result: success
 >
 ────────────────────────────────────────────────────────────────────────────────
@@ -52,10 +52,10 @@ Enter 'r' to cancel the request and go back to select the authentication method
 Gimme your password:
 >
 PAM Authenticate()
-  User: "user-auth-modes-password,mandatoryreset-integration-polkit-testnativechangeauthtok"
+  User: "user-auth-modes-password,mandatoryreset-integration-polkit-testnativechangeauthtok@example.com"
   Result: success
 PAM AcctMgmt()
-  User: "user-auth-modes-password,mandatoryreset-integration-polkit-testnativechangeauthtok"
+  User: "user-auth-modes-password,mandatoryreset-integration-polkit-testnativechangeauthtok@example.com"
   Result: success
 >
 ────────────────────────────────────────────────────────────────────────────────
diff --git a/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Exit_authd_if_local_broker_is_selected b/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Exit_authd_if_local_broker_is_selected
index 8162bac09b..bb4601ae61 100644
--- a/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Exit_authd_if_local_broker_is_selected
+++ b/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Exit_authd_if_local_broker_is_selected
@@ -2,7 +2,7 @@
 Username:
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd passwd socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
-Username: user-integration-native-passwd-exit-authd-if-local-broker-is-selected
+Username: user-integration-native-passwd-exit-authd-if-local-broker-is-selected@example.com
 == Provider selection ==
   1. local
   2. ExampleBroker
@@ -11,7 +11,7 @@ Choose your provider:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd passwd socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
-Username: user-integration-native-passwd-exit-authd-if-local-broker-is-selected
+Username: user-integration-native-passwd-exit-authd-if-local-broker-is-selected@example.com
 == Provider selection ==
   1. local
   2. ExampleBroker
@@ -20,7 +20,7 @@ Choose your provider:
 > 1
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd passwd socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
-Username: user-integration-native-passwd-exit-authd-if-local-broker-is-selected
+Username: user-integration-native-passwd-exit-authd-if-local-broker-is-selected@example.com
 == Provider selection ==
   1. local
   2. ExampleBroker
@@ -29,11 +29,11 @@ Choose your provider:
 > 1
 chauthtok=incomplete
 PAM ChangeAuthTok()
-  User: "user-integration-native-passwd-exit-authd-if-local-broker-is-selected"
+  User: "user-integration-native-passwd-exit-authd-if-local-broker-is-selected@example.com"
   Result: error: PAM exit code: 25
     The return value should be ignored by PAM dispatch
 PAM AcctMgmt()
-  User: "user-integration-native-passwd-exit-authd-if-local-broker-is-selected"
+  User: "user-integration-native-passwd-exit-authd-if-local-broker-is-selected@example.com"
   Result: error: PAM exit code: 26
     Critical error - immediate abort
 >
diff --git a/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Exit_authd_if_user_sigints b/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Exit_authd_if_user_sigints
index 4ec0ac4923..3c3e737808 100644
--- a/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Exit_authd_if_user_sigints
+++ b/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Exit_authd_if_user_sigints
@@ -2,7 +2,7 @@
 Username:
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd passwd socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
-Username: user-integration-native-passwd-exit-authd-if-user-sigints
+Username: user-integration-native-passwd-exit-authd-if-user-sigints@example.com
 == Provider selection ==
   1. local
   2. ExampleBroker
@@ -11,7 +11,7 @@ Choose your provider:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd passwd socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
-Username: user-integration-native-passwd-exit-authd-if-user-sigints
+Username: user-integration-native-passwd-exit-authd-if-user-sigints@example.com
 == Provider selection ==
   1. local
   2. ExampleBroker
@@ -20,7 +20,7 @@ Choose your provider:
 > 2
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd passwd socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
-Username: user-integration-native-passwd-exit-authd-if-user-sigints
+Username: user-integration-native-passwd-exit-authd-if-user-sigints@example.com
 == Provider selection ==
   1. local
   2. ExampleBroker
@@ -33,7 +33,7 @@ Gimme your password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd passwd socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
-Username: user-integration-native-passwd-exit-authd-if-user-sigints
+Username: user-integration-native-passwd-exit-authd-if-user-sigints@example.com
 == Provider selection ==
   1. local
   2. ExampleBroker
diff --git a/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Prevent_change_password_if_auth_fails b/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Prevent_change_password_if_auth_fails
index f07ca27735..c036f2e296 100644
--- a/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Prevent_change_password_if_auth_fails
+++ b/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Prevent_change_password_if_auth_fails
@@ -2,7 +2,7 @@
 Username:
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd passwd socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
-Username: user-integration-native-passwd-prevent-change-password-if-auth-fails
+Username: user-integration-native-passwd-prevent-change-password-if-auth-fails@example.com
 == Provider selection ==
   1. local
   2. ExampleBroker
@@ -11,7 +11,7 @@ Choose your provider:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd passwd socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
-Username: user-integration-native-passwd-prevent-change-password-if-auth-fails
+Username: user-integration-native-passwd-prevent-change-password-if-auth-fails@example.com
 == Provider selection ==
   1. local
   2. ExampleBroker
@@ -20,7 +20,7 @@ Choose your provider:
 > 2
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd passwd socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
-Username: user-integration-native-passwd-prevent-change-password-if-auth-fails
+Username: user-integration-native-passwd-prevent-change-password-if-auth-fails@example.com
 == Provider selection ==
   1. local
   2. ExampleBroker
@@ -33,7 +33,7 @@ Gimme your password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd passwd socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
-Username: user-integration-native-passwd-prevent-change-password-if-auth-fails
+Username: user-integration-native-passwd-prevent-change-password-if-auth-fails@example.com
 == Provider selection ==
   1. local
   2. ExampleBroker
@@ -51,7 +51,7 @@ Gimme your password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd passwd socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
-Username: user-integration-native-passwd-prevent-change-password-if-auth-fails
+Username: user-integration-native-passwd-prevent-change-password-if-auth-fails@example.com
 == Provider selection ==
   1. local
   2. ExampleBroker
@@ -74,7 +74,7 @@ Gimme your password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd passwd socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
-Username: user-integration-native-passwd-prevent-change-password-if-auth-fails
+Username: user-integration-native-passwd-prevent-change-password-if-auth-fails@example.com
 == Provider selection ==
   1. local
   2. ExampleBroker
@@ -102,7 +102,7 @@ Gimme your password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd passwd socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
-Username: user-integration-native-passwd-prevent-change-password-if-auth-fails
+Username: user-integration-native-passwd-prevent-change-password-if-auth-fails@example.com
 == Provider selection ==
   1. local
   2. ExampleBroker
@@ -135,7 +135,7 @@ Gimme your password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd passwd socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
-Username: user-integration-native-passwd-prevent-change-password-if-auth-fails
+Username: user-integration-native-passwd-prevent-change-password-if-auth-fails@example.com
 == Provider selection ==
   1. local
   2. ExampleBroker
@@ -168,12 +168,12 @@ Gimme your password:
 >
 PAM Error Message: invalid password 'wrongpass', should be 'goodpass'
 PAM ChangeAuthTok()
-  User: "user-integration-native-passwd-prevent-change-password-if-auth-fails"
+  User: "user-integration-native-passwd-prevent-change-password-if-auth-fails@example.com"
   Result: error: PAM exit code: 7
     Authentication failure
 acct=incomplete
 PAM AcctMgmt()
-  User: "user-integration-native-passwd-prevent-change-password-if-auth-fails"
+  User: "user-integration-native-passwd-prevent-change-password-if-auth-fails@example.com"
   Result: error: PAM exit code: 25
     The return value should be ignored by PAM dispatch
 >
diff --git a/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Prevent_change_password_if_current_user_is_not_root_as_can_not_authenticate b/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Prevent_change_password_if_current_user_is_not_root_as_can_not_authenticate
index b28545ad34..fbf17d8fd5 100644
--- a/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Prevent_change_password_if_current_user_is_not_root_as_can_not_authenticate
+++ b/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Prevent_change_password_if_current_user_is_not_root_as_can_not_authenticate
@@ -1,6 +1,5 @@
 > ./pam_authd passwd socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
-PAM Error Message: could not get current available brokers: permission denied: this action is on
-ly allowed for root users. Current user is XXXX
+PAM Error Message: could not get current available brokers: permission denied: only root can perform this operation
 PAM ChangeAuthTok()
   User: "<unset>"
   Result: error: PAM exit code: 4
@@ -13,8 +12,7 @@ PAM AcctMgmt()
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd passwd socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
-PAM Error Message: could not get current available brokers: permission denied: this action is on
-ly allowed for root users. Current user is XXXX
+PAM Error Message: could not get current available brokers: permission denied: only root can perform this operation
 PAM ChangeAuthTok()
   User: "<unset>"
   Result: error: PAM exit code: 4
diff --git a/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Prevent_change_password_if_user_does_not_exist b/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Prevent_change_password_if_user_does_not_exist
index b7c9d98836..e5bdde7577 100644
--- a/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Prevent_change_password_if_user_does_not_exist
+++ b/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Prevent_change_password_if_user_does_not_exist
@@ -2,7 +2,7 @@
 Username:
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd passwd socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
-Username: user-unexistent
+Username: user-unexistent@example.com
 == Provider selection ==
   1. local
   2. ExampleBroker
@@ -11,7 +11,7 @@ Choose your provider:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd passwd socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
-Username: user-unexistent
+Username: user-unexistent@example.com
 == Provider selection ==
   1. local
   2. ExampleBroker
@@ -20,21 +20,21 @@ Choose your provider:
 > 2
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd passwd socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
-Username: user-unexistent
+Username: user-unexistent@example.com
 == Provider selection ==
   1. local
   2. ExampleBroker
 Or enter 'r' to go back to user selection
 Choose your provider:
 > 2
-PAM Error Message: can't select broker: user "user-unexistent" does not exist
+PAM Error Message: user "user-unexistent@example.com" does not exist
 PAM ChangeAuthTok()
-  User: "user-unexistent"
+  User: "user-unexistent@example.com"
   Result: error: PAM exit code: 4
     System error
 acct=incomplete
 PAM AcctMgmt()
-  User: "user-unexistent"
+  User: "user-unexistent@example.com"
   Result: error: PAM exit code: 25
     The return value should be ignored by PAM dispatch
 >
diff --git a/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Retry_if_new_password_does_not_match_quality_criteria b/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Retry_if_new_password_does_not_match_quality_criteria
index 8958cd87ed..2e9561b0e1 100644
--- a/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Retry_if_new_password_does_not_match_quality_criteria
+++ b/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Retry_if_new_password_does_not_match_quality_criteria
@@ -2,7 +2,7 @@
 Username:
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd passwd socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
-Username: user-integration-native-passwd-retry-if-new-password-does-not-match-quality-criteria
+Username: user-integration-native-passwd-retry-if-new-password-does-not-match-quality-criteria@example.com
 == Provider selection ==
   1. local
   2. ExampleBroker
@@ -11,7 +11,7 @@ Choose your provider:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd passwd socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
-Username: user-integration-native-passwd-retry-if-new-password-does-not-match-quality-criteria
+Username: user-integration-native-passwd-retry-if-new-password-does-not-match-quality-criteria@example.com
 == Provider selection ==
   1. local
   2. ExampleBroker
@@ -20,7 +20,7 @@ Choose your provider:
 > 2
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd passwd socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
-Username: user-integration-native-passwd-retry-if-new-password-does-not-match-quality-criteria
+Username: user-integration-native-passwd-retry-if-new-password-does-not-match-quality-criteria@example.com
 == Provider selection ==
   1. local
   2. ExampleBroker
@@ -33,7 +33,7 @@ Gimme your password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd passwd socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
-Username: user-integration-native-passwd-retry-if-new-password-does-not-match-quality-criteria
+Username: user-integration-native-passwd-retry-if-new-password-does-not-match-quality-criteria@example.com
 == Provider selection ==
   1. local
   2. ExampleBroker
@@ -50,7 +50,7 @@ Enter your new password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd passwd socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
-Username: user-integration-native-passwd-retry-if-new-password-does-not-match-quality-criteria
+Username: user-integration-native-passwd-retry-if-new-password-does-not-match-quality-criteria@example.com
 == Provider selection ==
   1. local
   2. ExampleBroker
@@ -72,7 +72,7 @@ Enter your new password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd passwd socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
-Username: user-integration-native-passwd-retry-if-new-password-does-not-match-quality-criteria
+Username: user-integration-native-passwd-retry-if-new-password-does-not-match-quality-criteria@example.com
 == Provider selection ==
   1. local
   2. ExampleBroker
@@ -99,7 +99,7 @@ Enter your new password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd passwd socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
-Username: user-integration-native-passwd-retry-if-new-password-does-not-match-quality-criteria
+Username: user-integration-native-passwd-retry-if-new-password-does-not-match-quality-criteria@example.com
 == Provider selection ==
   1. local
   2. ExampleBroker
@@ -131,7 +131,7 @@ Enter your new password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd passwd socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
-Username: user-integration-native-passwd-retry-if-new-password-does-not-match-quality-criteria
+Username: user-integration-native-passwd-retry-if-new-password-does-not-match-quality-criteria@example.com
 == Provider selection ==
   1. local
   2. ExampleBroker
@@ -165,7 +165,7 @@ Confirm Password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd passwd socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
-Username: user-integration-native-passwd-retry-if-new-password-does-not-match-quality-criteria
+Username: user-integration-native-passwd-retry-if-new-password-does-not-match-quality-criteria@example.com
 == Provider selection ==
   1. local
   2. ExampleBroker
@@ -204,7 +204,7 @@ Enter your new password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd passwd socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
-Username: user-integration-native-passwd-retry-if-new-password-does-not-match-quality-criteria
+Username: user-integration-native-passwd-retry-if-new-password-does-not-match-quality-criteria@example.com
 == Provider selection ==
   1. local
   2. ExampleBroker
@@ -248,7 +248,7 @@ Enter your new password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd passwd socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
-Username: user-integration-native-passwd-retry-if-new-password-does-not-match-quality-criteria
+Username: user-integration-native-passwd-retry-if-new-password-does-not-match-quality-criteria@example.com
 == Provider selection ==
   1. local
   2. ExampleBroker
@@ -294,7 +294,7 @@ Confirm Password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd passwd socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
-Username: user-integration-native-passwd-retry-if-new-password-does-not-match-quality-criteria
+Username: user-integration-native-passwd-retry-if-new-password-does-not-match-quality-criteria@example.com
 == Provider selection ==
   1. local
   2. ExampleBroker
@@ -339,10 +339,10 @@ Enter your new password:
 Confirm Password:
 >
 PAM ChangeAuthTok()
-  User: "user-integration-native-passwd-retry-if-new-password-does-not-match-quality-criteria"
+  User: "user-integration-native-passwd-retry-if-new-password-does-not-match-quality-criteria@example.com"
   Result: success
 PAM AcctMgmt()
-  User: "user-integration-native-passwd-retry-if-new-password-does-not-match-quality-criteria"
+  User: "user-integration-native-passwd-retry-if-new-password-does-not-match-quality-criteria@example.com"
   Result: success
 >
 ────────────────────────────────────────────────────────────────────────────────
diff --git a/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Retry_if_new_password_is_rejected_by_broker b/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Retry_if_new_password_is_rejected_by_broker
index 5669857a30..133d4b1f86 100644
--- a/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Retry_if_new_password_is_rejected_by_broker
+++ b/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Retry_if_new_password_is_rejected_by_broker
@@ -2,7 +2,7 @@
 Username:
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd passwd socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
-Username: user-integration-native-passwd-retry-if-new-password-is-rejected-by-broker
+Username: user-integration-native-passwd-retry-if-new-password-is-rejected-by-broker@example.com
 == Provider selection ==
   1. local
   2. ExampleBroker
@@ -11,7 +11,7 @@ Choose your provider:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd passwd socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
-Username: user-integration-native-passwd-retry-if-new-password-is-rejected-by-broker
+Username: user-integration-native-passwd-retry-if-new-password-is-rejected-by-broker@example.com
 == Provider selection ==
   1. local
   2. ExampleBroker
@@ -20,7 +20,7 @@ Choose your provider:
 > 2
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd passwd socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
-Username: user-integration-native-passwd-retry-if-new-password-is-rejected-by-broker
+Username: user-integration-native-passwd-retry-if-new-password-is-rejected-by-broker@example.com
 == Provider selection ==
   1. local
   2. ExampleBroker
@@ -33,7 +33,7 @@ Gimme your password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd passwd socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
-Username: user-integration-native-passwd-retry-if-new-password-is-rejected-by-broker
+Username: user-integration-native-passwd-retry-if-new-password-is-rejected-by-broker@example.com
 == Provider selection ==
   1. local
   2. ExampleBroker
@@ -50,7 +50,7 @@ Enter your new password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd passwd socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
-Username: user-integration-native-passwd-retry-if-new-password-is-rejected-by-broker
+Username: user-integration-native-passwd-retry-if-new-password-is-rejected-by-broker@example.com
 == Provider selection ==
   1. local
   2. ExampleBroker
@@ -69,7 +69,7 @@ Confirm Password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd passwd socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
-Username: user-integration-native-passwd-retry-if-new-password-is-rejected-by-broker
+Username: user-integration-native-passwd-retry-if-new-password-is-rejected-by-broker@example.com
 == Provider selection ==
   1. local
   2. ExampleBroker
@@ -93,7 +93,7 @@ Enter your new password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd passwd socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
-Username: user-integration-native-passwd-retry-if-new-password-is-rejected-by-broker
+Username: user-integration-native-passwd-retry-if-new-password-is-rejected-by-broker@example.com
 == Provider selection ==
   1. local
   2. ExampleBroker
@@ -119,7 +119,7 @@ Confirm Password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd passwd socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
-Username: user-integration-native-passwd-retry-if-new-password-is-rejected-by-broker
+Username: user-integration-native-passwd-retry-if-new-password-is-rejected-by-broker@example.com
 == Provider selection ==
   1. local
   2. ExampleBroker
@@ -144,10 +144,10 @@ Enter your new password:
 Confirm Password:
 >
 PAM ChangeAuthTok()
-  User: "user-integration-native-passwd-retry-if-new-password-is-rejected-by-broker"
+  User: "user-integration-native-passwd-retry-if-new-password-is-rejected-by-broker@example.com"
   Result: success
 PAM AcctMgmt()
-  User: "user-integration-native-passwd-retry-if-new-password-is-rejected-by-broker"
+  User: "user-integration-native-passwd-retry-if-new-password-is-rejected-by-broker@example.com"
   Result: success
 >
 ────────────────────────────────────────────────────────────────────────────────
@@ -157,14 +157,14 @@ PAM AcctMgmt()
 Username:
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd passwd socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
-Username: user-integration-native-passwd-retry-if-new-password-is-rejected-by-broker
+Username: user-integration-native-passwd-retry-if-new-password-is-rejected-by-broker@example.com
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
 Gimme your password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd passwd socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
-Username: user-integration-native-passwd-retry-if-new-password-is-rejected-by-broker
+Username: user-integration-native-passwd-retry-if-new-password-is-rejected-by-broker@example.com
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
 Gimme your password:
@@ -175,7 +175,7 @@ Enter your new password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd passwd socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
-Username: user-integration-native-passwd-retry-if-new-password-is-rejected-by-broker
+Username: user-integration-native-passwd-retry-if-new-password-is-rejected-by-broker@example.com
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
 Gimme your password:
@@ -188,7 +188,7 @@ Confirm Password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd passwd socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
-Username: user-integration-native-passwd-retry-if-new-password-is-rejected-by-broker
+Username: user-integration-native-passwd-retry-if-new-password-is-rejected-by-broker@example.com
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
 Gimme your password:
@@ -206,7 +206,7 @@ Enter your new password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd passwd socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
-Username: user-integration-native-passwd-retry-if-new-password-is-rejected-by-broker
+Username: user-integration-native-passwd-retry-if-new-password-is-rejected-by-broker@example.com
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
 Gimme your password:
@@ -226,7 +226,7 @@ Confirm Password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd passwd socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
-Username: user-integration-native-passwd-retry-if-new-password-is-rejected-by-broker
+Username: user-integration-native-passwd-retry-if-new-password-is-rejected-by-broker@example.com
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
 Gimme your password:
@@ -251,7 +251,7 @@ Enter your new password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd passwd socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
-Username: user-integration-native-passwd-retry-if-new-password-is-rejected-by-broker
+Username: user-integration-native-passwd-retry-if-new-password-is-rejected-by-broker@example.com
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
 Gimme your password:
@@ -278,7 +278,7 @@ Confirm Password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd passwd socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
-Username: user-integration-native-passwd-retry-if-new-password-is-rejected-by-broker
+Username: user-integration-native-passwd-retry-if-new-password-is-rejected-by-broker@example.com
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
 Gimme your password:
@@ -304,10 +304,10 @@ Enter your new password:
 Confirm Password:
 >
 PAM ChangeAuthTok()
-  User: "user-integration-native-passwd-retry-if-new-password-is-rejected-by-broker"
+  User: "user-integration-native-passwd-retry-if-new-password-is-rejected-by-broker@example.com"
   Result: success
 PAM AcctMgmt()
-  User: "user-integration-native-passwd-retry-if-new-password-is-rejected-by-broker"
+  User: "user-integration-native-passwd-retry-if-new-password-is-rejected-by-broker@example.com"
   Result: success
 >
 ────────────────────────────────────────────────────────────────────────────────
diff --git a/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Retry_if_new_password_is_same_of_previous b/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Retry_if_new_password_is_same_of_previous
index ee2609724c..a5eea2dfab 100644
--- a/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Retry_if_new_password_is_same_of_previous
+++ b/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Retry_if_new_password_is_same_of_previous
@@ -2,7 +2,7 @@
 Username:
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd passwd socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
-Username: user-integration-native-passwd-retry-if-new-password-is-same-of-previous
+Username: user-integration-native-passwd-retry-if-new-password-is-same-of-previous@example.com
 == Provider selection ==
   1. local
   2. ExampleBroker
@@ -11,7 +11,7 @@ Choose your provider:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd passwd socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
-Username: user-integration-native-passwd-retry-if-new-password-is-same-of-previous
+Username: user-integration-native-passwd-retry-if-new-password-is-same-of-previous@example.com
 == Provider selection ==
   1. local
   2. ExampleBroker
@@ -20,7 +20,7 @@ Choose your provider:
 > 2
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd passwd socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
-Username: user-integration-native-passwd-retry-if-new-password-is-same-of-previous
+Username: user-integration-native-passwd-retry-if-new-password-is-same-of-previous@example.com
 == Provider selection ==
   1. local
   2. ExampleBroker
@@ -33,7 +33,7 @@ Gimme your password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd passwd socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
-Username: user-integration-native-passwd-retry-if-new-password-is-same-of-previous
+Username: user-integration-native-passwd-retry-if-new-password-is-same-of-previous@example.com
 == Provider selection ==
   1. local
   2. ExampleBroker
@@ -50,7 +50,7 @@ Enter your new password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd passwd socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
-Username: user-integration-native-passwd-retry-if-new-password-is-same-of-previous
+Username: user-integration-native-passwd-retry-if-new-password-is-same-of-previous@example.com
 == Provider selection ==
   1. local
   2. ExampleBroker
@@ -72,7 +72,7 @@ Enter your new password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd passwd socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
-Username: user-integration-native-passwd-retry-if-new-password-is-same-of-previous
+Username: user-integration-native-passwd-retry-if-new-password-is-same-of-previous@example.com
 == Provider selection ==
   1. local
   2. ExampleBroker
@@ -96,7 +96,7 @@ Confirm Password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd passwd socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
-Username: user-integration-native-passwd-retry-if-new-password-is-same-of-previous
+Username: user-integration-native-passwd-retry-if-new-password-is-same-of-previous@example.com
 == Provider selection ==
   1. local
   2. ExampleBroker
@@ -119,10 +119,10 @@ Enter your new password:
 Confirm Password:
 >
 PAM ChangeAuthTok()
-  User: "user-integration-native-passwd-retry-if-new-password-is-same-of-previous"
+  User: "user-integration-native-passwd-retry-if-new-password-is-same-of-previous@example.com"
   Result: success
 PAM AcctMgmt()
-  User: "user-integration-native-passwd-retry-if-new-password-is-same-of-previous"
+  User: "user-integration-native-passwd-retry-if-new-password-is-same-of-previous@example.com"
   Result: success
 >
 ────────────────────────────────────────────────────────────────────────────────
diff --git a/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Retry_if_password_confirmation_is_not_the_same b/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Retry_if_password_confirmation_is_not_the_same
index 3c820d78d4..7ef843d7eb 100644
--- a/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Retry_if_password_confirmation_is_not_the_same
+++ b/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Retry_if_password_confirmation_is_not_the_same
@@ -2,7 +2,7 @@
 Username:
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd passwd socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
-Username: user-integration-native-passwd-retry-if-password-confirmation-is-not-the-same
+Username: user-integration-native-passwd-retry-if-password-confirmation-is-not-the-same@example.com
 == Provider selection ==
   1. local
   2. ExampleBroker
@@ -11,7 +11,7 @@ Choose your provider:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd passwd socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
-Username: user-integration-native-passwd-retry-if-password-confirmation-is-not-the-same
+Username: user-integration-native-passwd-retry-if-password-confirmation-is-not-the-same@example.com
 == Provider selection ==
   1. local
   2. ExampleBroker
@@ -20,7 +20,7 @@ Choose your provider:
 > 2
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd passwd socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
-Username: user-integration-native-passwd-retry-if-password-confirmation-is-not-the-same
+Username: user-integration-native-passwd-retry-if-password-confirmation-is-not-the-same@example.com
 == Provider selection ==
   1. local
   2. ExampleBroker
@@ -33,7 +33,7 @@ Gimme your password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd passwd socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
-Username: user-integration-native-passwd-retry-if-password-confirmation-is-not-the-same
+Username: user-integration-native-passwd-retry-if-password-confirmation-is-not-the-same@example.com
 == Provider selection ==
   1. local
   2. ExampleBroker
@@ -50,7 +50,7 @@ Enter your new password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd passwd socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
-Username: user-integration-native-passwd-retry-if-password-confirmation-is-not-the-same
+Username: user-integration-native-passwd-retry-if-password-confirmation-is-not-the-same@example.com
 == Provider selection ==
   1. local
   2. ExampleBroker
@@ -69,7 +69,7 @@ Confirm Password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd passwd socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
-Username: user-integration-native-passwd-retry-if-password-confirmation-is-not-the-same
+Username: user-integration-native-passwd-retry-if-password-confirmation-is-not-the-same@example.com
 == Provider selection ==
   1. local
   2. ExampleBroker
@@ -93,7 +93,7 @@ Enter your new password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd passwd socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
-Username: user-integration-native-passwd-retry-if-password-confirmation-is-not-the-same
+Username: user-integration-native-passwd-retry-if-password-confirmation-is-not-the-same@example.com
 == Provider selection ==
   1. local
   2. ExampleBroker
@@ -119,7 +119,7 @@ Confirm Password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ./pam_authd passwd socket=${AUTHD_TEST_TAPE_SOCKET} force_native_client=true
-Username: user-integration-native-passwd-retry-if-password-confirmation-is-not-the-same
+Username: user-integration-native-passwd-retry-if-password-confirmation-is-not-the-same@example.com
 == Provider selection ==
   1. local
   2. ExampleBroker
@@ -144,10 +144,10 @@ Enter your new password:
 Confirm Password:
 >
 PAM ChangeAuthTok()
-  User: "user-integration-native-passwd-retry-if-password-confirmation-is-not-the-same"
+  User: "user-integration-native-passwd-retry-if-password-confirmation-is-not-the-same@example.com"
   Result: success
 PAM AcctMgmt()
-  User: "user-integration-native-passwd-retry-if-password-confirmation-is-not-the-same"
+  User: "user-integration-native-passwd-retry-if-password-confirmation-is-not-the-same@example.com"
   Result: success
 >
 ────────────────────────────────────────────────────────────────────────────────
diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_accept_password_reset b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_accept_password_reset
index 29a81bd914..c73dbac031 100644
--- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_accept_password_reset
+++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_accept_password_reset
@@ -2,145 +2,145 @@
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-can-reset-integration-pre-check-ssh-authenticate-user-and-accept-password-reset@localhost) Choose your provider:
+(user-can-reset-integration-pre-check-ssh-authenticate-user-and-accept-password-reset@example.com@localhost) Choose your provider:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-can-reset-integration-pre-check-ssh-authenticate-user-and-accept-password-reset@localhost) Choose your provider:
+(user-can-reset-integration-pre-check-ssh-authenticate-user-and-accept-password-reset@example.com@localhost) Choose your provider:
 > 2
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-can-reset-integration-pre-check-ssh-authenticate-user-and-accept-password-reset@localhost) Choose your provider:
+(user-can-reset-integration-pre-check-ssh-authenticate-user-and-accept-password-reset@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-can-reset-integration-pre-check-ssh-authenticate-user-and-accept-password-reset@localhost) Gimme your password:
+(user-can-reset-integration-pre-check-ssh-authenticate-user-and-accept-password-reset@example.com@localhost) Gimme your password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-can-reset-integration-pre-check-ssh-authenticate-user-and-accept-password-reset@localhost) Choose your provider:
+(user-can-reset-integration-pre-check-ssh-authenticate-user-and-accept-password-reset@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-can-reset-integration-pre-check-ssh-authenticate-user-and-accept-password-reset@localhost) Gimme your password:
+(user-can-reset-integration-pre-check-ssh-authenticate-user-and-accept-password-reset@example.com@localhost) Gimme your password:
 >
 Password reset, 1 step(s) missing
 == Password reset ==
   1. Proceed with password update
   2. Skip
 Or enter 'r' to go back to choose the provider
-(user-can-reset-integration-pre-check-ssh-authenticate-user-and-accept-password-reset@localhost) Choose action:
+(user-can-reset-integration-pre-check-ssh-authenticate-user-and-accept-password-reset@example.com@localhost) Choose action:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-can-reset-integration-pre-check-ssh-authenticate-user-and-accept-password-reset@localhost) Choose your provider:
+(user-can-reset-integration-pre-check-ssh-authenticate-user-and-accept-password-reset@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-can-reset-integration-pre-check-ssh-authenticate-user-and-accept-password-reset@localhost) Gimme your password:
+(user-can-reset-integration-pre-check-ssh-authenticate-user-and-accept-password-reset@example.com@localhost) Gimme your password:
 >
 Password reset, 1 step(s) missing
 == Password reset ==
   1. Proceed with password update
   2. Skip
 Or enter 'r' to go back to choose the provider
-(user-can-reset-integration-pre-check-ssh-authenticate-user-and-accept-password-reset@localhost) Choose action:
+(user-can-reset-integration-pre-check-ssh-authenticate-user-and-accept-password-reset@example.com@localhost) Choose action:
 > 1
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-can-reset-integration-pre-check-ssh-authenticate-user-and-accept-password-reset@localhost) Choose your provider:
+(user-can-reset-integration-pre-check-ssh-authenticate-user-and-accept-password-reset@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-can-reset-integration-pre-check-ssh-authenticate-user-and-accept-password-reset@localhost) Gimme your password:
+(user-can-reset-integration-pre-check-ssh-authenticate-user-and-accept-password-reset@example.com@localhost) Gimme your password:
 >
 Password reset, 1 step(s) missing
 == Password reset ==
   1. Proceed with password update
   2. Skip
 Or enter 'r' to go back to choose the provider
-(user-can-reset-integration-pre-check-ssh-authenticate-user-and-accept-password-reset@localhost) Choose action:
+(user-can-reset-integration-pre-check-ssh-authenticate-user-and-accept-password-reset@example.com@localhost) Choose action:
 > 1
 == Password reset ==
 Enter 'r' to cancel the request and go back to choose the provider
-(user-can-reset-integration-pre-check-ssh-authenticate-user-and-accept-password-reset@localhost) Enter your new password (3 days until mandatory):
+(user-can-reset-integration-pre-check-ssh-authenticate-user-and-accept-password-reset@example.com@localhost) Enter your new password (3 days until mandatory):
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-can-reset-integration-pre-check-ssh-authenticate-user-and-accept-password-reset@localhost) Choose your provider:
+(user-can-reset-integration-pre-check-ssh-authenticate-user-and-accept-password-reset@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-can-reset-integration-pre-check-ssh-authenticate-user-and-accept-password-reset@localhost) Gimme your password:
+(user-can-reset-integration-pre-check-ssh-authenticate-user-and-accept-password-reset@example.com@localhost) Gimme your password:
 >
 Password reset, 1 step(s) missing
 == Password reset ==
   1. Proceed with password update
   2. Skip
 Or enter 'r' to go back to choose the provider
-(user-can-reset-integration-pre-check-ssh-authenticate-user-and-accept-password-reset@localhost) Choose action:
+(user-can-reset-integration-pre-check-ssh-authenticate-user-and-accept-password-reset@example.com@localhost) Choose action:
 > 1
 == Password reset ==
 Enter 'r' to cancel the request and go back to choose the provider
-(user-can-reset-integration-pre-check-ssh-authenticate-user-and-accept-password-reset@localhost) Enter your new password (3 days until mandatory):
+(user-can-reset-integration-pre-check-ssh-authenticate-user-and-accept-password-reset@example.com@localhost) Enter your new password (3 days until mandatory):
 >
-(user-can-reset-integration-pre-check-ssh-authenticate-user-and-accept-password-reset@localhost) Confirm Password:
+(user-can-reset-integration-pre-check-ssh-authenticate-user-and-accept-password-reset@example.com@localhost) Confirm Password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-can-reset-integration-pre-check-ssh-authenticate-user-and-accept-password-reset@localhost) Choose your provider:
+(user-can-reset-integration-pre-check-ssh-authenticate-user-and-accept-password-reset@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-can-reset-integration-pre-check-ssh-authenticate-user-and-accept-password-reset@localhost) Gimme your password:
+(user-can-reset-integration-pre-check-ssh-authenticate-user-and-accept-password-reset@example.com@localhost) Gimme your password:
 >
 Password reset, 1 step(s) missing
 == Password reset ==
   1. Proceed with password update
   2. Skip
 Or enter 'r' to go back to choose the provider
-(user-can-reset-integration-pre-check-ssh-authenticate-user-and-accept-password-reset@localhost) Choose action:
+(user-can-reset-integration-pre-check-ssh-authenticate-user-and-accept-password-reset@example.com@localhost) Choose action:
 > 1
 == Password reset ==
 Enter 'r' to cancel the request and go back to choose the provider
-(user-can-reset-integration-pre-check-ssh-authenticate-user-and-accept-password-reset@localhost) Enter your new password (3 days until mandatory):
+(user-can-reset-integration-pre-check-ssh-authenticate-user-and-accept-password-reset@example.com@localhost) Enter your new password (3 days until mandatory):
 >
-(user-can-reset-integration-pre-check-ssh-authenticate-user-and-accept-password-reset@localhost) Confirm Password:
+(user-can-reset-integration-pre-check-ssh-authenticate-user-and-accept-password-reset@example.com@localhost) Confirm Password:
 >
-PAM Authenticate() finished for user 'user-can-reset-integration-pre-check-ssh-authenticate-user-and-accept-password-reset'
-PAM AcctMgmt() finished for user 'user-can-reset-integration-pre-check-ssh-authenticate-user-and-accept-password-reset'
-Environment:
-  USER=user-can-reset-integration-pre-check-ssh-authenticate-user-and-accept-password-reset
-  LOGNAME=user-can-reset-integration-pre-check-ssh-authenticate-user-and-accept-password-reset
+PAM Authenticate() finished for user 'user-can-reset-integration-pre-check-ssh-authenticate-user-and-accept-password-reset@example.com'
+PAM AcctMgmt() finished for user 'user-can-reset-integration-pre-check-ssh-authenticate-user-and-accept-password-reset@example.com'
+ SSHD: Connected to ssh via authd module! [TestSSHAuthenticate/Authenticate_user_and_accept_password_reset]
   HOME=${AUTHD_TEST_HOME}
+  LOGNAME=user-can-reset-integration-pre-check-ssh-authenticate-user-and-accept-password-reset@example.com
   PATH=${AUTHD_TEST_PATH}
+  PWD=${AUTHD_TEST_PWD}
   SHELL=/bin/sh
-  TERM=xterm-256color
   SSH_CLIENT=${AUTHD_TEST_SSH_CLIENT}
   SSH_CONNECTION=${AUTHD_TEST_SSH_CONNECTION}
   SSH_TTY=${AUTHD_TEST_SSH_TTY}
- SSHD: Connected to ssh via authd module! [TestSSHAuthenticate/Authenticate_user_and_accept_password_reset]
+  TERM=xterm-256color
+  USER=user-can-reset-integration-pre-check-ssh-authenticate-user-and-accept-password-reset@example.com
 Connection to localhost closed.
 >
 ────────────────────────────────────────────────────────────────────────────────
diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_accept_password_reset_on_shared_SSHd b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_accept_password_reset_with_shared_sshd
similarity index 74%
rename from pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_accept_password_reset_on_shared_SSHd
rename to pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_accept_password_reset_with_shared_sshd
index 608dd088d5..57c3c1f5b0 100644
--- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_accept_password_reset_on_shared_SSHd
+++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_accept_password_reset_with_shared_sshd
@@ -2,137 +2,137 @@
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-can-reset-integration-pre-check-ssh-authenticate-user-and-accept-password-reset-on-shared-sshd@localhost) Choose your provider:
+(user-can-reset-integration-pre-check-ssh-authenticate-user-and-accept-password-reset-with-shared-sshd@example.com@localhost) Choose your provider:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-can-reset-integration-pre-check-ssh-authenticate-user-and-accept-password-reset-on-shared-sshd@localhost) Choose your provider:
+(user-can-reset-integration-pre-check-ssh-authenticate-user-and-accept-password-reset-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-can-reset-integration-pre-check-ssh-authenticate-user-and-accept-password-reset-on-shared-sshd@localhost) Choose your provider:
+(user-can-reset-integration-pre-check-ssh-authenticate-user-and-accept-password-reset-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-can-reset-integration-pre-check-ssh-authenticate-user-and-accept-password-reset-on-shared-sshd@localhost) Gimme your password:
+(user-can-reset-integration-pre-check-ssh-authenticate-user-and-accept-password-reset-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-can-reset-integration-pre-check-ssh-authenticate-user-and-accept-password-reset-on-shared-sshd@localhost) Choose your provider:
+(user-can-reset-integration-pre-check-ssh-authenticate-user-and-accept-password-reset-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-can-reset-integration-pre-check-ssh-authenticate-user-and-accept-password-reset-on-shared-sshd@localhost) Gimme your password:
+(user-can-reset-integration-pre-check-ssh-authenticate-user-and-accept-password-reset-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 Password reset, 1 step(s) missing
 == Password reset ==
   1. Proceed with password update
   2. Skip
 Or enter 'r' to go back to choose the provider
-(user-can-reset-integration-pre-check-ssh-authenticate-user-and-accept-password-reset-on-shared-sshd@localhost) Choose action:
+(user-can-reset-integration-pre-check-ssh-authenticate-user-and-accept-password-reset-with-shared-sshd@example.com@localhost) Choose action:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-can-reset-integration-pre-check-ssh-authenticate-user-and-accept-password-reset-on-shared-sshd@localhost) Choose your provider:
+(user-can-reset-integration-pre-check-ssh-authenticate-user-and-accept-password-reset-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-can-reset-integration-pre-check-ssh-authenticate-user-and-accept-password-reset-on-shared-sshd@localhost) Gimme your password:
+(user-can-reset-integration-pre-check-ssh-authenticate-user-and-accept-password-reset-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 Password reset, 1 step(s) missing
 == Password reset ==
   1. Proceed with password update
   2. Skip
 Or enter 'r' to go back to choose the provider
-(user-can-reset-integration-pre-check-ssh-authenticate-user-and-accept-password-reset-on-shared-sshd@localhost) Choose action:
+(user-can-reset-integration-pre-check-ssh-authenticate-user-and-accept-password-reset-with-shared-sshd@example.com@localhost) Choose action:
 > 1
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-can-reset-integration-pre-check-ssh-authenticate-user-and-accept-password-reset-on-shared-sshd@localhost) Choose your provider:
+(user-can-reset-integration-pre-check-ssh-authenticate-user-and-accept-password-reset-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-can-reset-integration-pre-check-ssh-authenticate-user-and-accept-password-reset-on-shared-sshd@localhost) Gimme your password:
+(user-can-reset-integration-pre-check-ssh-authenticate-user-and-accept-password-reset-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 Password reset, 1 step(s) missing
 == Password reset ==
   1. Proceed with password update
   2. Skip
 Or enter 'r' to go back to choose the provider
-(user-can-reset-integration-pre-check-ssh-authenticate-user-and-accept-password-reset-on-shared-sshd@localhost) Choose action:
+(user-can-reset-integration-pre-check-ssh-authenticate-user-and-accept-password-reset-with-shared-sshd@example.com@localhost) Choose action:
 > 1
 == Password reset ==
 Enter 'r' to cancel the request and go back to choose the provider
-(user-can-reset-integration-pre-check-ssh-authenticate-user-and-accept-password-reset-on-shared-sshd@localhost) Enter your new password (3 days until mandatory):
+(user-can-reset-integration-pre-check-ssh-authenticate-user-and-accept-password-reset-with-shared-sshd@example.com@localhost) Enter your new password (3 days until mandatory):
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-can-reset-integration-pre-check-ssh-authenticate-user-and-accept-password-reset-on-shared-sshd@localhost) Choose your provider:
+(user-can-reset-integration-pre-check-ssh-authenticate-user-and-accept-password-reset-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-can-reset-integration-pre-check-ssh-authenticate-user-and-accept-password-reset-on-shared-sshd@localhost) Gimme your password:
+(user-can-reset-integration-pre-check-ssh-authenticate-user-and-accept-password-reset-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 Password reset, 1 step(s) missing
 == Password reset ==
   1. Proceed with password update
   2. Skip
 Or enter 'r' to go back to choose the provider
-(user-can-reset-integration-pre-check-ssh-authenticate-user-and-accept-password-reset-on-shared-sshd@localhost) Choose action:
+(user-can-reset-integration-pre-check-ssh-authenticate-user-and-accept-password-reset-with-shared-sshd@example.com@localhost) Choose action:
 > 1
 == Password reset ==
 Enter 'r' to cancel the request and go back to choose the provider
-(user-can-reset-integration-pre-check-ssh-authenticate-user-and-accept-password-reset-on-shared-sshd@localhost) Enter your new password (3 days until mandatory):
+(user-can-reset-integration-pre-check-ssh-authenticate-user-and-accept-password-reset-with-shared-sshd@example.com@localhost) Enter your new password (3 days until mandatory):
 >
-(user-can-reset-integration-pre-check-ssh-authenticate-user-and-accept-password-reset-on-shared-sshd@localhost) Confirm Password:
+(user-can-reset-integration-pre-check-ssh-authenticate-user-and-accept-password-reset-with-shared-sshd@example.com@localhost) Confirm Password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-can-reset-integration-pre-check-ssh-authenticate-user-and-accept-password-reset-on-shared-sshd@localhost) Choose your provider:
+(user-can-reset-integration-pre-check-ssh-authenticate-user-and-accept-password-reset-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-can-reset-integration-pre-check-ssh-authenticate-user-and-accept-password-reset-on-shared-sshd@localhost) Gimme your password:
+(user-can-reset-integration-pre-check-ssh-authenticate-user-and-accept-password-reset-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 Password reset, 1 step(s) missing
 == Password reset ==
   1. Proceed with password update
   2. Skip
 Or enter 'r' to go back to choose the provider
-(user-can-reset-integration-pre-check-ssh-authenticate-user-and-accept-password-reset-on-shared-sshd@localhost) Choose action:
+(user-can-reset-integration-pre-check-ssh-authenticate-user-and-accept-password-reset-with-shared-sshd@example.com@localhost) Choose action:
 > 1
 == Password reset ==
 Enter 'r' to cancel the request and go back to choose the provider
-(user-can-reset-integration-pre-check-ssh-authenticate-user-and-accept-password-reset-on-shared-sshd@localhost) Enter your new password (3 days until mandatory):
+(user-can-reset-integration-pre-check-ssh-authenticate-user-and-accept-password-reset-with-shared-sshd@example.com@localhost) Enter your new password (3 days until mandatory):
 >
-(user-can-reset-integration-pre-check-ssh-authenticate-user-and-accept-password-reset-on-shared-sshd@localhost) Confirm Password:
+(user-can-reset-integration-pre-check-ssh-authenticate-user-and-accept-password-reset-with-shared-sshd@example.com@localhost) Confirm Password:
 >
-PAM Authenticate() finished for user 'user-can-reset-integration-pre-check-ssh-authenticate-user-and-accept-password-reset-on-shared-sshd'
-PAM AcctMgmt() finished for user 'user-can-reset-integration-pre-check-ssh-authenticate-user-and-accept-password-reset-on-shared-sshd'
+PAM Authenticate() finished for user 'user-can-reset-integration-pre-check-ssh-authenticate-user-and-accept-password-reset-with-shared-sshd@example.com'
+PAM AcctMgmt() finished for user 'user-can-reset-integration-pre-check-ssh-authenticate-user-and-accept-password-reset-with-shared-sshd@example.com'
  SSHD: Connected to ssh via authd module! [TestSSHAuthenticate]
   HOME=${AUTHD_TEST_HOME}
-  LOGNAME=user-can-reset-integration-pre-check-ssh-authenticate-user-and-accept-password-reset-on-shared-sshd
+  LOGNAME=user-can-reset-integration-pre-check-ssh-authenticate-user-and-accept-password-reset-with-shared-sshd@example.com
   PATH=${AUTHD_TEST_PATH}
   PWD=${AUTHD_TEST_PWD}
   SHELL=/bin/sh
@@ -140,7 +140,7 @@ PAM AcctMgmt() finished for user 'user-can-reset-integration-pre-check-ssh-authe
   SSH_CONNECTION=${AUTHD_TEST_SSH_CONNECTION}
   SSH_TTY=${AUTHD_TEST_SSH_TTY}
   TERM=xterm-256color
-  USER=user-can-reset-integration-pre-check-ssh-authenticate-user-and-accept-password-reset-on-shared-sshd
+  USER=user-can-reset-integration-pre-check-ssh-authenticate-user-and-accept-password-reset-with-shared-sshd@example.com
 Connection to localhost closed.
 >
 ────────────────────────────────────────────────────────────────────────────────
diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_add_it_to_local_group b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_add_it_to_local_group
index d451fb3409..df2373dbbc 100644
--- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_add_it_to_local_group
+++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_add_it_to_local_group
@@ -2,50 +2,50 @@
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-local-groups-integration-pre-check-ssh-authenticate-user-and-add-it-to-local-group@localhost) Choose your provider:
+(user-local-groups-integration-pre-check-ssh-authenticate-user-and-add-it-to-local-group@example.com@localhost) Choose your provider:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-local-groups-integration-pre-check-ssh-authenticate-user-and-add-it-to-local-group@localhost) Choose your provider:
+(user-local-groups-integration-pre-check-ssh-authenticate-user-and-add-it-to-local-group@example.com@localhost) Choose your provider:
 > 2
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-local-groups-integration-pre-check-ssh-authenticate-user-and-add-it-to-local-group@localhost) Choose your provider:
+(user-local-groups-integration-pre-check-ssh-authenticate-user-and-add-it-to-local-group@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-local-groups-integration-pre-check-ssh-authenticate-user-and-add-it-to-local-group@localhost) Gimme your password:
+(user-local-groups-integration-pre-check-ssh-authenticate-user-and-add-it-to-local-group@example.com@localhost) Gimme your password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-local-groups-integration-pre-check-ssh-authenticate-user-and-add-it-to-local-group@localhost) Choose your provider:
+(user-local-groups-integration-pre-check-ssh-authenticate-user-and-add-it-to-local-group@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-local-groups-integration-pre-check-ssh-authenticate-user-and-add-it-to-local-group@localhost) Gimme your password:
+(user-local-groups-integration-pre-check-ssh-authenticate-user-and-add-it-to-local-group@example.com@localhost) Gimme your password:
 >
-PAM Authenticate() finished for user 'user-local-groups-integration-pre-check-ssh-authenticate-user-and-add-it-to-local-group'
-PAM AcctMgmt() finished for user 'user-local-groups-integration-pre-check-ssh-authenticate-user-and-add-it-to-local-group'
-Environment:
-  USER=user-local-groups-integration-pre-check-ssh-authenticate-user-and-add-it-to-local-group
-  LOGNAME=user-local-groups-integration-pre-check-ssh-authenticate-user-and-add-it-to-local-group
+PAM Authenticate() finished for user 'user-local-groups-integration-pre-check-ssh-authenticate-user-and-add-it-to-local-group@example.com'
+PAM AcctMgmt() finished for user 'user-local-groups-integration-pre-check-ssh-authenticate-user-and-add-it-to-local-group@example.com'
+ SSHD: Connected to ssh via authd module! [TestSSHAuthenticate/Authenticate_user_and_add_it_to_local_group]
   HOME=${AUTHD_TEST_HOME}
+  LOGNAME=user-local-groups-integration-pre-check-ssh-authenticate-user-and-add-it-to-local-group@example.com
   PATH=${AUTHD_TEST_PATH}
+  PWD=${AUTHD_TEST_PWD}
   SHELL=/bin/sh
-  TERM=xterm-256color
   SSH_CLIENT=${AUTHD_TEST_SSH_CLIENT}
   SSH_CONNECTION=${AUTHD_TEST_SSH_CONNECTION}
   SSH_TTY=${AUTHD_TEST_SSH_TTY}
- SSHD: Connected to ssh via authd module! [TestSSHAuthenticate/Authenticate_user_and_add_it_to_local_group]
+  TERM=xterm-256color
+  USER=user-local-groups-integration-pre-check-ssh-authenticate-user-and-add-it-to-local-group@example.com
 Connection to localhost closed.
 >
 ────────────────────────────────────────────────────────────────────────────────
diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_add_it_to_local_group.gpasswd_out b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_add_it_to_local_group.gpasswd_out
deleted file mode 100644
index a8528cc444..0000000000
--- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_add_it_to_local_group.gpasswd_out
+++ /dev/null
@@ -1 +0,0 @@
---add user-local-groups-integration-pre-check-ssh-authenticate-user-and-add-it-to-local-group localgroup
\ No newline at end of file
diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_add_it_to_local_group.group b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_add_it_to_local_group.group
new file mode 100644
index 0000000000..9bf8bd21cd
--- /dev/null
+++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_add_it_to_local_group.group
@@ -0,0 +1 @@
+localgroup:x:41:user-local-groups-integration-pre-check-ssh-authenticate-user-and-add-it-to-local-group@example.com
diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_add_it_to_local_group.groups b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_add_it_to_local_group.group.backup
similarity index 100%
rename from pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_add_it_to_local_group.groups
rename to pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_add_it_to_local_group.group.backup
diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_add_it_to_local_group_on_shared_SSHd.gpasswd_out b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_add_it_to_local_group_on_shared_SSHd.gpasswd_out
deleted file mode 100644
index ffd6a5fda6..0000000000
--- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_add_it_to_local_group_on_shared_SSHd.gpasswd_out
+++ /dev/null
@@ -1 +0,0 @@
---add user-local-groups-integration-pre-check-ssh-authenticate-user-and-add-it-to-local-group-on-shared-sshd localgroup
\ No newline at end of file
diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_add_it_to_local_group_on_shared_SSHd b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_add_it_to_local_group_with_shared_sshd
similarity index 74%
rename from pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_add_it_to_local_group_on_shared_SSHd
rename to pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_add_it_to_local_group_with_shared_sshd
index ea22601790..908d2c9ed3 100644
--- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_add_it_to_local_group_on_shared_SSHd
+++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_add_it_to_local_group_with_shared_sshd
@@ -2,50 +2,50 @@
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-local-groups-integration-pre-check-ssh-authenticate-user-and-add-it-to-local-group-on-shared-sshd@localhost) Choose your provider:
+(user-local-groups-integration-pre-check-ssh-authenticate-user-and-add-it-to-local-group-with-shared-sshd@example.com@localhost) Choose your provider:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-local-groups-integration-pre-check-ssh-authenticate-user-and-add-it-to-local-group-on-shared-sshd@localhost) Choose your provider:
+(user-local-groups-integration-pre-check-ssh-authenticate-user-and-add-it-to-local-group-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-local-groups-integration-pre-check-ssh-authenticate-user-and-add-it-to-local-group-on-shared-sshd@localhost) Choose your provider:
+(user-local-groups-integration-pre-check-ssh-authenticate-user-and-add-it-to-local-group-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-local-groups-integration-pre-check-ssh-authenticate-user-and-add-it-to-local-group-on-shared-sshd@localhost) Gimme your password:
+(user-local-groups-integration-pre-check-ssh-authenticate-user-and-add-it-to-local-group-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-local-groups-integration-pre-check-ssh-authenticate-user-and-add-it-to-local-group-on-shared-sshd@localhost) Choose your provider:
+(user-local-groups-integration-pre-check-ssh-authenticate-user-and-add-it-to-local-group-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-local-groups-integration-pre-check-ssh-authenticate-user-and-add-it-to-local-group-on-shared-sshd@localhost) Gimme your password:
+(user-local-groups-integration-pre-check-ssh-authenticate-user-and-add-it-to-local-group-with-shared-sshd@example.com@localhost) Gimme your password:
 >
-PAM Authenticate() finished for user 'user-local-groups-integration-pre-check-ssh-authenticate-user-and-add-it-to-local-group-on-shared-sshd'
-PAM AcctMgmt() finished for user 'user-local-groups-integration-pre-check-ssh-authenticate-user-and-add-it-to-local-group-on-shared-sshd'
-Environment:
-  USER=user-local-groups-integration-pre-check-ssh-authenticate-user-and-add-it-to-local-group-on-shared-sshd
-  LOGNAME=user-local-groups-integration-pre-check-ssh-authenticate-user-and-add-it-to-local-group-on-shared-sshd
+PAM Authenticate() finished for user 'user-local-groups-integration-pre-check-ssh-authenticate-user-and-add-it-to-local-group-with-shared-sshd@example.com'
+PAM AcctMgmt() finished for user 'user-local-groups-integration-pre-check-ssh-authenticate-user-and-add-it-to-local-group-with-shared-sshd@example.com'
+ SSHD: Connected to ssh via authd module! [TestSSHAuthenticate/Authenticate_user_and_add_it_to_local_group_with_shared_sshd]
   HOME=${AUTHD_TEST_HOME}
+  LOGNAME=user-local-groups-integration-pre-check-ssh-authenticate-user-and-add-it-to-local-group-with-shared-sshd@example.com
   PATH=${AUTHD_TEST_PATH}
+  PWD=${AUTHD_TEST_PWD}
   SHELL=/bin/sh
-  TERM=xterm-256color
   SSH_CLIENT=${AUTHD_TEST_SSH_CLIENT}
   SSH_CONNECTION=${AUTHD_TEST_SSH_CONNECTION}
   SSH_TTY=${AUTHD_TEST_SSH_TTY}
- SSHD: Connected to ssh via authd module! [TestSSHAuthenticate/Authenticate_user_and_add_it_to_local_group_on_shared_SSHd]
+  TERM=xterm-256color
+  USER=user-local-groups-integration-pre-check-ssh-authenticate-user-and-add-it-to-local-group-with-shared-sshd@example.com
 Connection to localhost closed.
 >
 ────────────────────────────────────────────────────────────────────────────────
diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_add_it_to_local_group_with_shared_sshd.group b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_add_it_to_local_group_with_shared_sshd.group
new file mode 100644
index 0000000000..fdda884619
--- /dev/null
+++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_add_it_to_local_group_with_shared_sshd.group
@@ -0,0 +1 @@
+localgroup:x:41:user-local-groups-integration-pre-check-ssh-authenticate-user-and-add-it-to-local-group-with-shared-sshd@example.com
diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_add_it_to_local_group_on_shared_SSHd.groups b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_add_it_to_local_group_with_shared_sshd.group.backup
similarity index 100%
rename from pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_add_it_to_local_group_on_shared_SSHd.groups
rename to pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_add_it_to_local_group_with_shared_sshd.group.backup
diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_offer_password_reset b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_offer_password_reset
index ddb963d00b..848cb38439 100644
--- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_offer_password_reset
+++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_offer_password_reset
@@ -2,93 +2,93 @@
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-can-reset-integration-pre-check-ssh-authenticate-user-and-offer-password-reset@localhost) Choose your provider:
+(user-can-reset-integration-pre-check-ssh-authenticate-user-and-offer-password-reset@example.com@localhost) Choose your provider:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-can-reset-integration-pre-check-ssh-authenticate-user-and-offer-password-reset@localhost) Choose your provider:
+(user-can-reset-integration-pre-check-ssh-authenticate-user-and-offer-password-reset@example.com@localhost) Choose your provider:
 > 2
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-can-reset-integration-pre-check-ssh-authenticate-user-and-offer-password-reset@localhost) Choose your provider:
+(user-can-reset-integration-pre-check-ssh-authenticate-user-and-offer-password-reset@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-can-reset-integration-pre-check-ssh-authenticate-user-and-offer-password-reset@localhost) Gimme your password:
+(user-can-reset-integration-pre-check-ssh-authenticate-user-and-offer-password-reset@example.com@localhost) Gimme your password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-can-reset-integration-pre-check-ssh-authenticate-user-and-offer-password-reset@localhost) Choose your provider:
+(user-can-reset-integration-pre-check-ssh-authenticate-user-and-offer-password-reset@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-can-reset-integration-pre-check-ssh-authenticate-user-and-offer-password-reset@localhost) Gimme your password:
+(user-can-reset-integration-pre-check-ssh-authenticate-user-and-offer-password-reset@example.com@localhost) Gimme your password:
 >
 Password reset, 1 step(s) missing
 == Password reset ==
   1. Proceed with password update
   2. Skip
 Or enter 'r' to go back to choose the provider
-(user-can-reset-integration-pre-check-ssh-authenticate-user-and-offer-password-reset@localhost) Choose action:
+(user-can-reset-integration-pre-check-ssh-authenticate-user-and-offer-password-reset@example.com@localhost) Choose action:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-can-reset-integration-pre-check-ssh-authenticate-user-and-offer-password-reset@localhost) Choose your provider:
+(user-can-reset-integration-pre-check-ssh-authenticate-user-and-offer-password-reset@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-can-reset-integration-pre-check-ssh-authenticate-user-and-offer-password-reset@localhost) Gimme your password:
+(user-can-reset-integration-pre-check-ssh-authenticate-user-and-offer-password-reset@example.com@localhost) Gimme your password:
 >
 Password reset, 1 step(s) missing
 == Password reset ==
   1. Proceed with password update
   2. Skip
 Or enter 'r' to go back to choose the provider
-(user-can-reset-integration-pre-check-ssh-authenticate-user-and-offer-password-reset@localhost) Choose action:
+(user-can-reset-integration-pre-check-ssh-authenticate-user-and-offer-password-reset@example.com@localhost) Choose action:
 > 2
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-can-reset-integration-pre-check-ssh-authenticate-user-and-offer-password-reset@localhost) Choose your provider:
+(user-can-reset-integration-pre-check-ssh-authenticate-user-and-offer-password-reset@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-can-reset-integration-pre-check-ssh-authenticate-user-and-offer-password-reset@localhost) Gimme your password:
+(user-can-reset-integration-pre-check-ssh-authenticate-user-and-offer-password-reset@example.com@localhost) Gimme your password:
 >
 Password reset, 1 step(s) missing
 == Password reset ==
   1. Proceed with password update
   2. Skip
 Or enter 'r' to go back to choose the provider
-(user-can-reset-integration-pre-check-ssh-authenticate-user-and-offer-password-reset@localhost) Choose action:
+(user-can-reset-integration-pre-check-ssh-authenticate-user-and-offer-password-reset@example.com@localhost) Choose action:
 > 2
-PAM Authenticate() finished for user 'user-can-reset-integration-pre-check-ssh-authenticate-user-and-offer-password-reset'
-PAM AcctMgmt() finished for user 'user-can-reset-integration-pre-check-ssh-authenticate-user-and-offer-password-reset'
-Environment:
-  USER=user-can-reset-integration-pre-check-ssh-authenticate-user-and-offer-password-reset
-  LOGNAME=user-can-reset-integration-pre-check-ssh-authenticate-user-and-offer-password-reset
+PAM Authenticate() finished for user 'user-can-reset-integration-pre-check-ssh-authenticate-user-and-offer-password-reset@example.com'
+PAM AcctMgmt() finished for user 'user-can-reset-integration-pre-check-ssh-authenticate-user-and-offer-password-reset@example.com'
+ SSHD: Connected to ssh via authd module! [TestSSHAuthenticate/Authenticate_user_and_offer_password_reset]
   HOME=${AUTHD_TEST_HOME}
+  LOGNAME=user-can-reset-integration-pre-check-ssh-authenticate-user-and-offer-password-reset@example.com
   PATH=${AUTHD_TEST_PATH}
+  PWD=${AUTHD_TEST_PWD}
   SHELL=/bin/sh
-  TERM=xterm-256color
   SSH_CLIENT=${AUTHD_TEST_SSH_CLIENT}
   SSH_CONNECTION=${AUTHD_TEST_SSH_CONNECTION}
   SSH_TTY=${AUTHD_TEST_SSH_TTY}
- SSHD: Connected to ssh via authd module! [TestSSHAuthenticate/Authenticate_user_and_offer_password_reset]
+  TERM=xterm-256color
+  USER=user-can-reset-integration-pre-check-ssh-authenticate-user-and-offer-password-reset@example.com
 Connection to localhost closed.
 >
 ────────────────────────────────────────────────────────────────────────────────
diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_offer_password_reset_on_shared_SSHd b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_offer_password_reset_with_shared_sshd
similarity index 76%
rename from pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_offer_password_reset_on_shared_SSHd
rename to pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_offer_password_reset_with_shared_sshd
index 1db1c13d69..cf594755fa 100644
--- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_offer_password_reset_on_shared_SSHd
+++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_offer_password_reset_with_shared_sshd
@@ -2,85 +2,85 @@
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-can-reset-integration-pre-check-ssh-authenticate-user-and-offer-password-reset-on-shared-sshd@localhost) Choose your provider:
+(user-can-reset-integration-pre-check-ssh-authenticate-user-and-offer-password-reset-with-shared-sshd@example.com@localhost) Choose your provider:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-can-reset-integration-pre-check-ssh-authenticate-user-and-offer-password-reset-on-shared-sshd@localhost) Choose your provider:
+(user-can-reset-integration-pre-check-ssh-authenticate-user-and-offer-password-reset-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-can-reset-integration-pre-check-ssh-authenticate-user-and-offer-password-reset-on-shared-sshd@localhost) Choose your provider:
+(user-can-reset-integration-pre-check-ssh-authenticate-user-and-offer-password-reset-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-can-reset-integration-pre-check-ssh-authenticate-user-and-offer-password-reset-on-shared-sshd@localhost) Gimme your password:
+(user-can-reset-integration-pre-check-ssh-authenticate-user-and-offer-password-reset-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-can-reset-integration-pre-check-ssh-authenticate-user-and-offer-password-reset-on-shared-sshd@localhost) Choose your provider:
+(user-can-reset-integration-pre-check-ssh-authenticate-user-and-offer-password-reset-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-can-reset-integration-pre-check-ssh-authenticate-user-and-offer-password-reset-on-shared-sshd@localhost) Gimme your password:
+(user-can-reset-integration-pre-check-ssh-authenticate-user-and-offer-password-reset-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 Password reset, 1 step(s) missing
 == Password reset ==
   1. Proceed with password update
   2. Skip
 Or enter 'r' to go back to choose the provider
-(user-can-reset-integration-pre-check-ssh-authenticate-user-and-offer-password-reset-on-shared-sshd@localhost) Choose action:
+(user-can-reset-integration-pre-check-ssh-authenticate-user-and-offer-password-reset-with-shared-sshd@example.com@localhost) Choose action:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-can-reset-integration-pre-check-ssh-authenticate-user-and-offer-password-reset-on-shared-sshd@localhost) Choose your provider:
+(user-can-reset-integration-pre-check-ssh-authenticate-user-and-offer-password-reset-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-can-reset-integration-pre-check-ssh-authenticate-user-and-offer-password-reset-on-shared-sshd@localhost) Gimme your password:
+(user-can-reset-integration-pre-check-ssh-authenticate-user-and-offer-password-reset-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 Password reset, 1 step(s) missing
 == Password reset ==
   1. Proceed with password update
   2. Skip
 Or enter 'r' to go back to choose the provider
-(user-can-reset-integration-pre-check-ssh-authenticate-user-and-offer-password-reset-on-shared-sshd@localhost) Choose action:
+(user-can-reset-integration-pre-check-ssh-authenticate-user-and-offer-password-reset-with-shared-sshd@example.com@localhost) Choose action:
 > 2
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-can-reset-integration-pre-check-ssh-authenticate-user-and-offer-password-reset-on-shared-sshd@localhost) Choose your provider:
+(user-can-reset-integration-pre-check-ssh-authenticate-user-and-offer-password-reset-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-can-reset-integration-pre-check-ssh-authenticate-user-and-offer-password-reset-on-shared-sshd@localhost) Gimme your password:
+(user-can-reset-integration-pre-check-ssh-authenticate-user-and-offer-password-reset-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 Password reset, 1 step(s) missing
 == Password reset ==
   1. Proceed with password update
   2. Skip
 Or enter 'r' to go back to choose the provider
-(user-can-reset-integration-pre-check-ssh-authenticate-user-and-offer-password-reset-on-shared-sshd@localhost) Choose action:
+(user-can-reset-integration-pre-check-ssh-authenticate-user-and-offer-password-reset-with-shared-sshd@example.com@localhost) Choose action:
 > 2
-PAM Authenticate() finished for user 'user-can-reset-integration-pre-check-ssh-authenticate-user-and-offer-password-reset-on-shared-sshd'
-PAM AcctMgmt() finished for user 'user-can-reset-integration-pre-check-ssh-authenticate-user-and-offer-password-reset-on-shared-sshd'
+PAM Authenticate() finished for user 'user-can-reset-integration-pre-check-ssh-authenticate-user-and-offer-password-reset-with-shared-sshd@example.com'
+PAM AcctMgmt() finished for user 'user-can-reset-integration-pre-check-ssh-authenticate-user-and-offer-password-reset-with-shared-sshd@example.com'
  SSHD: Connected to ssh via authd module! [TestSSHAuthenticate]
   HOME=${AUTHD_TEST_HOME}
-  LOGNAME=user-can-reset-integration-pre-check-ssh-authenticate-user-and-offer-password-reset-on-shared-sshd
+  LOGNAME=user-can-reset-integration-pre-check-ssh-authenticate-user-and-offer-password-reset-with-shared-sshd@example.com
   PATH=${AUTHD_TEST_PATH}
   PWD=${AUTHD_TEST_PWD}
   SHELL=/bin/sh
@@ -88,7 +88,7 @@ PAM AcctMgmt() finished for user 'user-can-reset-integration-pre-check-ssh-authe
   SSH_CONNECTION=${AUTHD_TEST_SSH_CONNECTION}
   SSH_TTY=${AUTHD_TEST_SSH_TTY}
   TERM=xterm-256color
-  USER=user-can-reset-integration-pre-check-ssh-authenticate-user-and-offer-password-reset-on-shared-sshd
+  USER=user-can-reset-integration-pre-check-ssh-authenticate-user-and-offer-password-reset-with-shared-sshd@example.com
 Connection to localhost closed.
 >
 ────────────────────────────────────────────────────────────────────────────────
diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_reset_password_while_enforcing_policy b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_reset_password_while_enforcing_policy
index 0f4f4ade36..4443a4a1d2 100644
--- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_reset_password_while_enforcing_policy
+++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_reset_password_while_enforcing_policy
@@ -2,91 +2,91 @@
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-needs-reset-integration-pre-check-ssh-authenticate-user-and-reset-password-while-enforcing-policy@localhost) Choose your provider:
+(user-needs-reset-integration-pre-check-ssh-authenticate-user-and-reset-password-while-enforcing-policy@example.com@localhost) Choose your provider:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-needs-reset-integration-pre-check-ssh-authenticate-user-and-reset-password-while-enforcing-policy@localhost) Choose your provider:
+(user-needs-reset-integration-pre-check-ssh-authenticate-user-and-reset-password-while-enforcing-policy@example.com@localhost) Choose your provider:
 > 2
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-needs-reset-integration-pre-check-ssh-authenticate-user-and-reset-password-while-enforcing-policy@localhost) Choose your provider:
+(user-needs-reset-integration-pre-check-ssh-authenticate-user-and-reset-password-while-enforcing-policy@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-needs-reset-integration-pre-check-ssh-authenticate-user-and-reset-password-while-enforcing-policy@localhost) Gimme your password:
+(user-needs-reset-integration-pre-check-ssh-authenticate-user-and-reset-password-while-enforcing-policy@example.com@localhost) Gimme your password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-needs-reset-integration-pre-check-ssh-authenticate-user-and-reset-password-while-enforcing-policy@localhost) Choose your provider:
+(user-needs-reset-integration-pre-check-ssh-authenticate-user-and-reset-password-while-enforcing-policy@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-needs-reset-integration-pre-check-ssh-authenticate-user-and-reset-password-while-enforcing-policy@localhost) Gimme your password:
+(user-needs-reset-integration-pre-check-ssh-authenticate-user-and-reset-password-while-enforcing-policy@example.com@localhost) Gimme your password:
 >
 Password reset, 1 step(s) missing
 == Password reset ==
 Enter 'r' to cancel the request and go back to choose the provider
-(user-needs-reset-integration-pre-check-ssh-authenticate-user-and-reset-password-while-enforcing-policy@localhost) Enter your new password:
+(user-needs-reset-integration-pre-check-ssh-authenticate-user-and-reset-password-while-enforcing-policy@example.com@localhost) Enter your new password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-needs-reset-integration-pre-check-ssh-authenticate-user-and-reset-password-while-enforcing-policy@localhost) Choose your provider:
+(user-needs-reset-integration-pre-check-ssh-authenticate-user-and-reset-password-while-enforcing-policy@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-needs-reset-integration-pre-check-ssh-authenticate-user-and-reset-password-while-enforcing-policy@localhost) Gimme your password:
+(user-needs-reset-integration-pre-check-ssh-authenticate-user-and-reset-password-while-enforcing-policy@example.com@localhost) Gimme your password:
 >
 Password reset, 1 step(s) missing
 == Password reset ==
 Enter 'r' to cancel the request and go back to choose the provider
-(user-needs-reset-integration-pre-check-ssh-authenticate-user-and-reset-password-while-enforcing-policy@localhost) Enter your new password:
+(user-needs-reset-integration-pre-check-ssh-authenticate-user-and-reset-password-while-enforcing-policy@example.com@localhost) Enter your new password:
 >
-(user-needs-reset-integration-pre-check-ssh-authenticate-user-and-reset-password-while-enforcing-policy@localhost) Confirm Password:
+(user-needs-reset-integration-pre-check-ssh-authenticate-user-and-reset-password-while-enforcing-policy@example.com@localhost) Confirm Password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-needs-reset-integration-pre-check-ssh-authenticate-user-and-reset-password-while-enforcing-policy@localhost) Choose your provider:
+(user-needs-reset-integration-pre-check-ssh-authenticate-user-and-reset-password-while-enforcing-policy@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-needs-reset-integration-pre-check-ssh-authenticate-user-and-reset-password-while-enforcing-policy@localhost) Gimme your password:
+(user-needs-reset-integration-pre-check-ssh-authenticate-user-and-reset-password-while-enforcing-policy@example.com@localhost) Gimme your password:
 >
 Password reset, 1 step(s) missing
 == Password reset ==
 Enter 'r' to cancel the request and go back to choose the provider
-(user-needs-reset-integration-pre-check-ssh-authenticate-user-and-reset-password-while-enforcing-policy@localhost) Enter your new password:
+(user-needs-reset-integration-pre-check-ssh-authenticate-user-and-reset-password-while-enforcing-policy@example.com@localhost) Enter your new password:
 >
-(user-needs-reset-integration-pre-check-ssh-authenticate-user-and-reset-password-while-enforcing-policy@localhost) Confirm Password:
+(user-needs-reset-integration-pre-check-ssh-authenticate-user-and-reset-password-while-enforcing-policy@example.com@localhost) Confirm Password:
 >
-PAM Authenticate() finished for user 'user-needs-reset-integration-pre-check-ssh-authenticate-user-and-reset-password-while-enforcing-policy'
-PAM AcctMgmt() finished for user 'user-needs-reset-integration-pre-check-ssh-authenticate-user-and-reset-password-while-enforcing-policy'
-Environment:
-  USER=user-needs-reset-integration-pre-check-ssh-authenticate-user-and-reset-password-while-enforcing-policy
-  LOGNAME=user-needs-reset-integration-pre-check-ssh-authenticate-user-and-reset-password-while-enforcing-policy
+PAM Authenticate() finished for user 'user-needs-reset-integration-pre-check-ssh-authenticate-user-and-reset-password-while-enforcing-policy@example.com'
+PAM AcctMgmt() finished for user 'user-needs-reset-integration-pre-check-ssh-authenticate-user-and-reset-password-while-enforcing-policy@example.com'
+ SSHD: Connected to ssh via authd module! [TestSSHAuthenticate/Authenticate_user_and_reset_password_while_enforcing_policy]
   HOME=${AUTHD_TEST_HOME}
+  LOGNAME=user-needs-reset-integration-pre-check-ssh-authenticate-user-and-reset-password-while-enforcing-policy@example.com
   PATH=${AUTHD_TEST_PATH}
+  PWD=${AUTHD_TEST_PWD}
   SHELL=/bin/sh
-  TERM=xterm-256color
   SSH_CLIENT=${AUTHD_TEST_SSH_CLIENT}
   SSH_CONNECTION=${AUTHD_TEST_SSH_CONNECTION}
   SSH_TTY=${AUTHD_TEST_SSH_TTY}
- SSHD: Connected to ssh via authd module! [TestSSHAuthenticate/Authenticate_user_and_reset_password_while_enforcing_policy]
+  TERM=xterm-256color
+  USER=user-needs-reset-integration-pre-check-ssh-authenticate-user-and-reset-password-while-enforcing-policy@example.com
 Connection to localhost closed.
 >
 ────────────────────────────────────────────────────────────────────────────────
diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_reset_password_while_enforcing_policy_on_shared_SSHd b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_reset_password_while_enforcing_policy_with_shared_sshd
similarity index 72%
rename from pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_reset_password_while_enforcing_policy_on_shared_SSHd
rename to pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_reset_password_while_enforcing_policy_with_shared_sshd
index f96cb92ee5..99510bb3f2 100644
--- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_reset_password_while_enforcing_policy_on_shared_SSHd
+++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_reset_password_while_enforcing_policy_with_shared_sshd
@@ -2,83 +2,83 @@
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-needs-reset-integration-pre-check-ssh-authenticate-user-and-reset-password-while-enforcing-policy-on-shared-sshd@localhost) Choose your provider:
+(user-needs-reset-integration-pre-check-ssh-authenticate-user-and-reset-password-while-enforcing-policy-with-shared-sshd@example.com@localhost) Choose your provider:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-needs-reset-integration-pre-check-ssh-authenticate-user-and-reset-password-while-enforcing-policy-on-shared-sshd@localhost) Choose your provider:
+(user-needs-reset-integration-pre-check-ssh-authenticate-user-and-reset-password-while-enforcing-policy-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-needs-reset-integration-pre-check-ssh-authenticate-user-and-reset-password-while-enforcing-policy-on-shared-sshd@localhost) Choose your provider:
+(user-needs-reset-integration-pre-check-ssh-authenticate-user-and-reset-password-while-enforcing-policy-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-needs-reset-integration-pre-check-ssh-authenticate-user-and-reset-password-while-enforcing-policy-on-shared-sshd@localhost) Gimme your password:
+(user-needs-reset-integration-pre-check-ssh-authenticate-user-and-reset-password-while-enforcing-policy-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-needs-reset-integration-pre-check-ssh-authenticate-user-and-reset-password-while-enforcing-policy-on-shared-sshd@localhost) Choose your provider:
+(user-needs-reset-integration-pre-check-ssh-authenticate-user-and-reset-password-while-enforcing-policy-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-needs-reset-integration-pre-check-ssh-authenticate-user-and-reset-password-while-enforcing-policy-on-shared-sshd@localhost) Gimme your password:
+(user-needs-reset-integration-pre-check-ssh-authenticate-user-and-reset-password-while-enforcing-policy-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 Password reset, 1 step(s) missing
 == Password reset ==
 Enter 'r' to cancel the request and go back to choose the provider
-(user-needs-reset-integration-pre-check-ssh-authenticate-user-and-reset-password-while-enforcing-policy-on-shared-sshd@localhost) Enter your new password:
+(user-needs-reset-integration-pre-check-ssh-authenticate-user-and-reset-password-while-enforcing-policy-with-shared-sshd@example.com@localhost) Enter your new password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-needs-reset-integration-pre-check-ssh-authenticate-user-and-reset-password-while-enforcing-policy-on-shared-sshd@localhost) Choose your provider:
+(user-needs-reset-integration-pre-check-ssh-authenticate-user-and-reset-password-while-enforcing-policy-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-needs-reset-integration-pre-check-ssh-authenticate-user-and-reset-password-while-enforcing-policy-on-shared-sshd@localhost) Gimme your password:
+(user-needs-reset-integration-pre-check-ssh-authenticate-user-and-reset-password-while-enforcing-policy-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 Password reset, 1 step(s) missing
 == Password reset ==
 Enter 'r' to cancel the request and go back to choose the provider
-(user-needs-reset-integration-pre-check-ssh-authenticate-user-and-reset-password-while-enforcing-policy-on-shared-sshd@localhost) Enter your new password:
+(user-needs-reset-integration-pre-check-ssh-authenticate-user-and-reset-password-while-enforcing-policy-with-shared-sshd@example.com@localhost) Enter your new password:
 >
-(user-needs-reset-integration-pre-check-ssh-authenticate-user-and-reset-password-while-enforcing-policy-on-shared-sshd@localhost) Confirm Password:
+(user-needs-reset-integration-pre-check-ssh-authenticate-user-and-reset-password-while-enforcing-policy-with-shared-sshd@example.com@localhost) Confirm Password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-needs-reset-integration-pre-check-ssh-authenticate-user-and-reset-password-while-enforcing-policy-on-shared-sshd@localhost) Choose your provider:
+(user-needs-reset-integration-pre-check-ssh-authenticate-user-and-reset-password-while-enforcing-policy-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-needs-reset-integration-pre-check-ssh-authenticate-user-and-reset-password-while-enforcing-policy-on-shared-sshd@localhost) Gimme your password:
+(user-needs-reset-integration-pre-check-ssh-authenticate-user-and-reset-password-while-enforcing-policy-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 Password reset, 1 step(s) missing
 == Password reset ==
 Enter 'r' to cancel the request and go back to choose the provider
-(user-needs-reset-integration-pre-check-ssh-authenticate-user-and-reset-password-while-enforcing-policy-on-shared-sshd@localhost) Enter your new password:
+(user-needs-reset-integration-pre-check-ssh-authenticate-user-and-reset-password-while-enforcing-policy-with-shared-sshd@example.com@localhost) Enter your new password:
 >
-(user-needs-reset-integration-pre-check-ssh-authenticate-user-and-reset-password-while-enforcing-policy-on-shared-sshd@localhost) Confirm Password:
+(user-needs-reset-integration-pre-check-ssh-authenticate-user-and-reset-password-while-enforcing-policy-with-shared-sshd@example.com@localhost) Confirm Password:
 >
-PAM Authenticate() finished for user 'user-needs-reset-integration-pre-check-ssh-authenticate-user-and-reset-password-while-enforcing-policy-on-shared-sshd'
-PAM AcctMgmt() finished for user 'user-needs-reset-integration-pre-check-ssh-authenticate-user-and-reset-password-while-enforcing-policy-on-shared-sshd'
+PAM Authenticate() finished for user 'user-needs-reset-integration-pre-check-ssh-authenticate-user-and-reset-password-while-enforcing-policy-with-shared-sshd@example.com'
+PAM AcctMgmt() finished for user 'user-needs-reset-integration-pre-check-ssh-authenticate-user-and-reset-password-while-enforcing-policy-with-shared-sshd@example.com'
  SSHD: Connected to ssh via authd module! [TestSSHAuthenticate]
   HOME=${AUTHD_TEST_HOME}
-  LOGNAME=user-needs-reset-integration-pre-check-ssh-authenticate-user-and-reset-password-while-enforcing-policy-on-shared-sshd
+  LOGNAME=user-needs-reset-integration-pre-check-ssh-authenticate-user-and-reset-password-while-enforcing-policy-with-shared-sshd@example.com
   PATH=${AUTHD_TEST_PATH}
   PWD=${AUTHD_TEST_PWD}
   SHELL=/bin/sh
@@ -86,7 +86,7 @@ PAM AcctMgmt() finished for user 'user-needs-reset-integration-pre-check-ssh-aut
   SSH_CONNECTION=${AUTHD_TEST_SSH_CONNECTION}
   SSH_TTY=${AUTHD_TEST_SSH_TTY}
   TERM=xterm-256color
-  USER=user-needs-reset-integration-pre-check-ssh-authenticate-user-and-reset-password-while-enforcing-policy-on-shared-sshd
+  USER=user-needs-reset-integration-pre-check-ssh-authenticate-user-and-reset-password-while-enforcing-policy-with-shared-sshd@example.com
 Connection to localhost closed.
 >
 ────────────────────────────────────────────────────────────────────────────────
diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_reset_password_with_case_insensitive_user_selection b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_reset_password_with_case_insensitive_user_selection
index 7b44131cb0..ab1616fec2 100644
--- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_reset_password_with_case_insensitive_user_selection
+++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_reset_password_with_case_insensitive_user_selection
@@ -2,83 +2,83 @@
 == Provider selection ==
   1. local
   2. ExampleBroker
-(USER-NEEDS-RESET-INTEGRATION-PRE-CHECK-CASE-INSENSITIVE-TESTSSHAUTHENTICATE@localhost) Choose your provider:
+(USER-NEEDS-RESET-INTEGRATION-PRE-CHECK-CASE-INSENSITIVE-TESTSSHAUTHENTICATE@EXAMPLE.COM@localhost) Choose your provider:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(USER-NEEDS-RESET-INTEGRATION-PRE-CHECK-CASE-INSENSITIVE-TESTSSHAUTHENTICATE@localhost) Choose your provider:
+(USER-NEEDS-RESET-INTEGRATION-PRE-CHECK-CASE-INSENSITIVE-TESTSSHAUTHENTICATE@EXAMPLE.COM@localhost) Choose your provider:
 > 2
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(USER-NEEDS-RESET-INTEGRATION-PRE-CHECK-CASE-INSENSITIVE-TESTSSHAUTHENTICATE@localhost) Choose your provider:
+(USER-NEEDS-RESET-INTEGRATION-PRE-CHECK-CASE-INSENSITIVE-TESTSSHAUTHENTICATE@EXAMPLE.COM@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(USER-NEEDS-RESET-INTEGRATION-PRE-CHECK-CASE-INSENSITIVE-TESTSSHAUTHENTICATE@localhost) Gimme your password:
+(USER-NEEDS-RESET-INTEGRATION-PRE-CHECK-CASE-INSENSITIVE-TESTSSHAUTHENTICATE@EXAMPLE.COM@localhost) Gimme your password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(USER-NEEDS-RESET-INTEGRATION-PRE-CHECK-CASE-INSENSITIVE-TESTSSHAUTHENTICATE@localhost) Choose your provider:
+(USER-NEEDS-RESET-INTEGRATION-PRE-CHECK-CASE-INSENSITIVE-TESTSSHAUTHENTICATE@EXAMPLE.COM@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(USER-NEEDS-RESET-INTEGRATION-PRE-CHECK-CASE-INSENSITIVE-TESTSSHAUTHENTICATE@localhost) Gimme your password:
+(USER-NEEDS-RESET-INTEGRATION-PRE-CHECK-CASE-INSENSITIVE-TESTSSHAUTHENTICATE@EXAMPLE.COM@localhost) Gimme your password:
 >
 Password reset, 1 step(s) missing
 == Password reset ==
 Enter 'r' to cancel the request and go back to choose the provider
-(USER-NEEDS-RESET-INTEGRATION-PRE-CHECK-CASE-INSENSITIVE-TESTSSHAUTHENTICATE@localhost) Enter your new password:
+(USER-NEEDS-RESET-INTEGRATION-PRE-CHECK-CASE-INSENSITIVE-TESTSSHAUTHENTICATE@EXAMPLE.COM@localhost) Enter your new password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(USER-NEEDS-RESET-INTEGRATION-PRE-CHECK-CASE-INSENSITIVE-TESTSSHAUTHENTICATE@localhost) Choose your provider:
+(USER-NEEDS-RESET-INTEGRATION-PRE-CHECK-CASE-INSENSITIVE-TESTSSHAUTHENTICATE@EXAMPLE.COM@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(USER-NEEDS-RESET-INTEGRATION-PRE-CHECK-CASE-INSENSITIVE-TESTSSHAUTHENTICATE@localhost) Gimme your password:
+(USER-NEEDS-RESET-INTEGRATION-PRE-CHECK-CASE-INSENSITIVE-TESTSSHAUTHENTICATE@EXAMPLE.COM@localhost) Gimme your password:
 >
 Password reset, 1 step(s) missing
 == Password reset ==
 Enter 'r' to cancel the request and go back to choose the provider
-(USER-NEEDS-RESET-INTEGRATION-PRE-CHECK-CASE-INSENSITIVE-TESTSSHAUTHENTICATE@localhost) Enter your new password:
+(USER-NEEDS-RESET-INTEGRATION-PRE-CHECK-CASE-INSENSITIVE-TESTSSHAUTHENTICATE@EXAMPLE.COM@localhost) Enter your new password:
 >
-(USER-NEEDS-RESET-INTEGRATION-PRE-CHECK-CASE-INSENSITIVE-TESTSSHAUTHENTICATE@localhost) Confirm Password:
+(USER-NEEDS-RESET-INTEGRATION-PRE-CHECK-CASE-INSENSITIVE-TESTSSHAUTHENTICATE@EXAMPLE.COM@localhost) Confirm Password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(USER-NEEDS-RESET-INTEGRATION-PRE-CHECK-CASE-INSENSITIVE-TESTSSHAUTHENTICATE@localhost) Choose your provider:
+(USER-NEEDS-RESET-INTEGRATION-PRE-CHECK-CASE-INSENSITIVE-TESTSSHAUTHENTICATE@EXAMPLE.COM@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(USER-NEEDS-RESET-INTEGRATION-PRE-CHECK-CASE-INSENSITIVE-TESTSSHAUTHENTICATE@localhost) Gimme your password:
+(USER-NEEDS-RESET-INTEGRATION-PRE-CHECK-CASE-INSENSITIVE-TESTSSHAUTHENTICATE@EXAMPLE.COM@localhost) Gimme your password:
 >
 Password reset, 1 step(s) missing
 == Password reset ==
 Enter 'r' to cancel the request and go back to choose the provider
-(USER-NEEDS-RESET-INTEGRATION-PRE-CHECK-CASE-INSENSITIVE-TESTSSHAUTHENTICATE@localhost) Enter your new password:
+(USER-NEEDS-RESET-INTEGRATION-PRE-CHECK-CASE-INSENSITIVE-TESTSSHAUTHENTICATE@EXAMPLE.COM@localhost) Enter your new password:
 >
-(USER-NEEDS-RESET-INTEGRATION-PRE-CHECK-CASE-INSENSITIVE-TESTSSHAUTHENTICATE@localhost) Confirm Password:
+(USER-NEEDS-RESET-INTEGRATION-PRE-CHECK-CASE-INSENSITIVE-TESTSSHAUTHENTICATE@EXAMPLE.COM@localhost) Confirm Password:
 >
-PAM Authenticate() finished for user 'user-needs-reset-integration-pre-check-case-insensitive-testsshauthenticate'
-PAM AcctMgmt() finished for user 'user-needs-reset-integration-pre-check-case-insensitive-testsshauthenticate'
+PAM Authenticate() finished for user 'user-needs-reset-integration-pre-check-case-insensitive-testsshauthenticate@example.com'
+PAM AcctMgmt() finished for user 'user-needs-reset-integration-pre-check-case-insensitive-testsshauthenticate@example.com'
  SSHD: Connected to ssh via authd module! [TestSSHAuthenticate/Authenticate_user_and_reset_password_with_case_insensitive_user_selection]
   HOME=${AUTHD_TEST_HOME}
-  LOGNAME=user-needs-reset-integration-pre-check-case-insensitive-testsshauthenticate
+  LOGNAME=user-needs-reset-integration-pre-check-case-insensitive-testsshauthenticate@example.com
   PATH=${AUTHD_TEST_PATH}
   PWD=${AUTHD_TEST_PWD}
   SHELL=/bin/sh
@@ -86,7 +86,7 @@ PAM AcctMgmt() finished for user 'user-needs-reset-integration-pre-check-case-in
   SSH_CONNECTION=${AUTHD_TEST_SSH_CONNECTION}
   SSH_TTY=${AUTHD_TEST_SSH_TTY}
   TERM=xterm-256color
-  USER=user-needs-reset-integration-pre-check-case-insensitive-testsshauthenticate
+  USER=user-needs-reset-integration-pre-check-case-insensitive-testsshauthenticate@example.com
 Connection to localhost closed.
 >
 ────────────────────────────────────────────────────────────────────────────────
@@ -95,19 +95,19 @@ Connection to localhost closed.
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-needs-reset-integration-pre-check-case-insensitive-testsshauthenticate@localhost) Gimme your password:
+(user-needs-reset-integration-pre-check-case-insensitive-testsshauthenticate@example.com@localhost) Gimme your password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-needs-reset-integration-pre-check-case-insensitive-testsshauthenticate@localhost) Gimme your password:
+(user-needs-reset-integration-pre-check-case-insensitive-testsshauthenticate@example.com@localhost) Gimme your password:
 >
-PAM Authenticate() finished for user 'user-needs-reset-integration-pre-check-case-insensitive-testsshauthenticate'
-PAM AcctMgmt() finished for user 'user-needs-reset-integration-pre-check-case-insensitive-testsshauthenticate'
+PAM Authenticate() finished for user 'user-needs-reset-integration-pre-check-case-insensitive-testsshauthenticate@example.com'
+PAM AcctMgmt() finished for user 'user-needs-reset-integration-pre-check-case-insensitive-testsshauthenticate@example.com'
  SSHD: Connected to ssh via authd module! [TestSSHAuthenticate/Authenticate_user_and_reset_password_with_case_insensitive_user_selection]
   HOME=${AUTHD_TEST_HOME}
-  LOGNAME=user-needs-reset-integration-pre-check-case-insensitive-testsshauthenticate
+  LOGNAME=user-needs-reset-integration-pre-check-case-insensitive-testsshauthenticate@example.com
   PATH=${AUTHD_TEST_PATH}
   PWD=${AUTHD_TEST_PWD}
   SHELL=/bin/sh
@@ -115,7 +115,7 @@ PAM AcctMgmt() finished for user 'user-needs-reset-integration-pre-check-case-in
   SSH_CONNECTION=${AUTHD_TEST_SSH_CONNECTION}
   SSH_TTY=${AUTHD_TEST_SSH_TTY}
   TERM=xterm-256color
-  USER=user-needs-reset-integration-pre-check-case-insensitive-testsshauthenticate
+  USER=user-needs-reset-integration-pre-check-case-insensitive-testsshauthenticate@example.com
 Connection to localhost closed.
 >
 ────────────────────────────────────────────────────────────────────────────────
@@ -124,19 +124,19 @@ Connection to localhost closed.
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-needs-reset-integration-pre-check-Case-INSENSITIVE-testsshauthenticate@localhost) Gimme your password:
+(user-needs-reset-integration-pre-check-Case-INSENSITIVE-testsshauthenticate@example.com@localhost) Gimme your password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-needs-reset-integration-pre-check-Case-INSENSITIVE-testsshauthenticate@localhost) Gimme your password:
+(user-needs-reset-integration-pre-check-Case-INSENSITIVE-testsshauthenticate@example.com@localhost) Gimme your password:
 >
-PAM Authenticate() finished for user 'user-needs-reset-integration-pre-check-case-insensitive-testsshauthenticate'
-PAM AcctMgmt() finished for user 'user-needs-reset-integration-pre-check-case-insensitive-testsshauthenticate'
+PAM Authenticate() finished for user 'user-needs-reset-integration-pre-check-case-insensitive-testsshauthenticate@example.com'
+PAM AcctMgmt() finished for user 'user-needs-reset-integration-pre-check-case-insensitive-testsshauthenticate@example.com'
  SSHD: Connected to ssh via authd module! [TestSSHAuthenticate/Authenticate_user_and_reset_password_with_case_insensitive_user_selection]
   HOME=${AUTHD_TEST_HOME}
-  LOGNAME=user-needs-reset-integration-pre-check-case-insensitive-testsshauthenticate
+  LOGNAME=user-needs-reset-integration-pre-check-case-insensitive-testsshauthenticate@example.com
   PATH=${AUTHD_TEST_PATH}
   PWD=${AUTHD_TEST_PWD}
   SHELL=/bin/sh
@@ -144,7 +144,7 @@ PAM AcctMgmt() finished for user 'user-needs-reset-integration-pre-check-case-in
   SSH_CONNECTION=${AUTHD_TEST_SSH_CONNECTION}
   SSH_TTY=${AUTHD_TEST_SSH_TTY}
   TERM=xterm-256color
-  USER=user-needs-reset-integration-pre-check-case-insensitive-testsshauthenticate
+  USER=user-needs-reset-integration-pre-check-case-insensitive-testsshauthenticate@example.com
 Connection to localhost closed.
 >
 ────────────────────────────────────────────────────────────────────────────────
diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_reset_password_with_case_insensitive_user_selection_on_shared_SSHd b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_reset_password_with_case_insensitive_user_selection_with_shared_sshd
similarity index 83%
rename from pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_reset_password_with_case_insensitive_user_selection_on_shared_SSHd
rename to pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_reset_password_with_case_insensitive_user_selection_with_shared_sshd
index d5bbdfc527..cd91078682 100644
--- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_reset_password_with_case_insensitive_user_selection_on_shared_SSHd
+++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_reset_password_with_case_insensitive_user_selection_with_shared_sshd
@@ -2,83 +2,83 @@
 == Provider selection ==
   1. local
   2. ExampleBroker
-(USER-NEEDS-RESET-INTEGRATION-PRE-CHECK-CASE-INSENSITIVE-TESTSSHAUTHENTICATE@localhost) Choose your provider:
+(USER-NEEDS-RESET-INTEGRATION-PRE-CHECK-CASE-INSENSITIVE-TESTSSHAUTHENTICATE@EXAMPLE.COM@localhost) Choose your provider:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(USER-NEEDS-RESET-INTEGRATION-PRE-CHECK-CASE-INSENSITIVE-TESTSSHAUTHENTICATE@localhost) Choose your provider:
+(USER-NEEDS-RESET-INTEGRATION-PRE-CHECK-CASE-INSENSITIVE-TESTSSHAUTHENTICATE@EXAMPLE.COM@localhost) Choose your provider:
 > 2
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(USER-NEEDS-RESET-INTEGRATION-PRE-CHECK-CASE-INSENSITIVE-TESTSSHAUTHENTICATE@localhost) Choose your provider:
+(USER-NEEDS-RESET-INTEGRATION-PRE-CHECK-CASE-INSENSITIVE-TESTSSHAUTHENTICATE@EXAMPLE.COM@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(USER-NEEDS-RESET-INTEGRATION-PRE-CHECK-CASE-INSENSITIVE-TESTSSHAUTHENTICATE@localhost) Gimme your password:
+(USER-NEEDS-RESET-INTEGRATION-PRE-CHECK-CASE-INSENSITIVE-TESTSSHAUTHENTICATE@EXAMPLE.COM@localhost) Gimme your password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(USER-NEEDS-RESET-INTEGRATION-PRE-CHECK-CASE-INSENSITIVE-TESTSSHAUTHENTICATE@localhost) Choose your provider:
+(USER-NEEDS-RESET-INTEGRATION-PRE-CHECK-CASE-INSENSITIVE-TESTSSHAUTHENTICATE@EXAMPLE.COM@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(USER-NEEDS-RESET-INTEGRATION-PRE-CHECK-CASE-INSENSITIVE-TESTSSHAUTHENTICATE@localhost) Gimme your password:
+(USER-NEEDS-RESET-INTEGRATION-PRE-CHECK-CASE-INSENSITIVE-TESTSSHAUTHENTICATE@EXAMPLE.COM@localhost) Gimme your password:
 >
 Password reset, 1 step(s) missing
 == Password reset ==
 Enter 'r' to cancel the request and go back to choose the provider
-(USER-NEEDS-RESET-INTEGRATION-PRE-CHECK-CASE-INSENSITIVE-TESTSSHAUTHENTICATE@localhost) Enter your new password:
+(USER-NEEDS-RESET-INTEGRATION-PRE-CHECK-CASE-INSENSITIVE-TESTSSHAUTHENTICATE@EXAMPLE.COM@localhost) Enter your new password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(USER-NEEDS-RESET-INTEGRATION-PRE-CHECK-CASE-INSENSITIVE-TESTSSHAUTHENTICATE@localhost) Choose your provider:
+(USER-NEEDS-RESET-INTEGRATION-PRE-CHECK-CASE-INSENSITIVE-TESTSSHAUTHENTICATE@EXAMPLE.COM@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(USER-NEEDS-RESET-INTEGRATION-PRE-CHECK-CASE-INSENSITIVE-TESTSSHAUTHENTICATE@localhost) Gimme your password:
+(USER-NEEDS-RESET-INTEGRATION-PRE-CHECK-CASE-INSENSITIVE-TESTSSHAUTHENTICATE@EXAMPLE.COM@localhost) Gimme your password:
 >
 Password reset, 1 step(s) missing
 == Password reset ==
 Enter 'r' to cancel the request and go back to choose the provider
-(USER-NEEDS-RESET-INTEGRATION-PRE-CHECK-CASE-INSENSITIVE-TESTSSHAUTHENTICATE@localhost) Enter your new password:
+(USER-NEEDS-RESET-INTEGRATION-PRE-CHECK-CASE-INSENSITIVE-TESTSSHAUTHENTICATE@EXAMPLE.COM@localhost) Enter your new password:
 >
-(USER-NEEDS-RESET-INTEGRATION-PRE-CHECK-CASE-INSENSITIVE-TESTSSHAUTHENTICATE@localhost) Confirm Password:
+(USER-NEEDS-RESET-INTEGRATION-PRE-CHECK-CASE-INSENSITIVE-TESTSSHAUTHENTICATE@EXAMPLE.COM@localhost) Confirm Password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(USER-NEEDS-RESET-INTEGRATION-PRE-CHECK-CASE-INSENSITIVE-TESTSSHAUTHENTICATE@localhost) Choose your provider:
+(USER-NEEDS-RESET-INTEGRATION-PRE-CHECK-CASE-INSENSITIVE-TESTSSHAUTHENTICATE@EXAMPLE.COM@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(USER-NEEDS-RESET-INTEGRATION-PRE-CHECK-CASE-INSENSITIVE-TESTSSHAUTHENTICATE@localhost) Gimme your password:
+(USER-NEEDS-RESET-INTEGRATION-PRE-CHECK-CASE-INSENSITIVE-TESTSSHAUTHENTICATE@EXAMPLE.COM@localhost) Gimme your password:
 >
 Password reset, 1 step(s) missing
 == Password reset ==
 Enter 'r' to cancel the request and go back to choose the provider
-(USER-NEEDS-RESET-INTEGRATION-PRE-CHECK-CASE-INSENSITIVE-TESTSSHAUTHENTICATE@localhost) Enter your new password:
+(USER-NEEDS-RESET-INTEGRATION-PRE-CHECK-CASE-INSENSITIVE-TESTSSHAUTHENTICATE@EXAMPLE.COM@localhost) Enter your new password:
 >
-(USER-NEEDS-RESET-INTEGRATION-PRE-CHECK-CASE-INSENSITIVE-TESTSSHAUTHENTICATE@localhost) Confirm Password:
+(USER-NEEDS-RESET-INTEGRATION-PRE-CHECK-CASE-INSENSITIVE-TESTSSHAUTHENTICATE@EXAMPLE.COM@localhost) Confirm Password:
 >
-PAM Authenticate() finished for user 'user-needs-reset-integration-pre-check-case-insensitive-testsshauthenticate'
-PAM AcctMgmt() finished for user 'user-needs-reset-integration-pre-check-case-insensitive-testsshauthenticate'
+PAM Authenticate() finished for user 'user-needs-reset-integration-pre-check-case-insensitive-testsshauthenticate@example.com'
+PAM AcctMgmt() finished for user 'user-needs-reset-integration-pre-check-case-insensitive-testsshauthenticate@example.com'
  SSHD: Connected to ssh via authd module! [TestSSHAuthenticate]
   HOME=${AUTHD_TEST_HOME}
-  LOGNAME=user-needs-reset-integration-pre-check-case-insensitive-testsshauthenticate
+  LOGNAME=user-needs-reset-integration-pre-check-case-insensitive-testsshauthenticate@example.com
   PATH=${AUTHD_TEST_PATH}
   PWD=${AUTHD_TEST_PWD}
   SHELL=/bin/sh
@@ -86,7 +86,7 @@ PAM AcctMgmt() finished for user 'user-needs-reset-integration-pre-check-case-in
   SSH_CONNECTION=${AUTHD_TEST_SSH_CONNECTION}
   SSH_TTY=${AUTHD_TEST_SSH_TTY}
   TERM=xterm-256color
-  USER=user-needs-reset-integration-pre-check-case-insensitive-testsshauthenticate
+  USER=user-needs-reset-integration-pre-check-case-insensitive-testsshauthenticate@example.com
 Connection to localhost closed.
 >
 ────────────────────────────────────────────────────────────────────────────────
@@ -95,19 +95,19 @@ Connection to localhost closed.
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-needs-reset-integration-pre-check-case-insensitive-testsshauthenticate@localhost) Gimme your password:
+(user-needs-reset-integration-pre-check-case-insensitive-testsshauthenticate@example.com@localhost) Gimme your password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-needs-reset-integration-pre-check-case-insensitive-testsshauthenticate@localhost) Gimme your password:
+(user-needs-reset-integration-pre-check-case-insensitive-testsshauthenticate@example.com@localhost) Gimme your password:
 >
-PAM Authenticate() finished for user 'user-needs-reset-integration-pre-check-case-insensitive-testsshauthenticate'
-PAM AcctMgmt() finished for user 'user-needs-reset-integration-pre-check-case-insensitive-testsshauthenticate'
+PAM Authenticate() finished for user 'user-needs-reset-integration-pre-check-case-insensitive-testsshauthenticate@example.com'
+PAM AcctMgmt() finished for user 'user-needs-reset-integration-pre-check-case-insensitive-testsshauthenticate@example.com'
  SSHD: Connected to ssh via authd module! [TestSSHAuthenticate]
   HOME=${AUTHD_TEST_HOME}
-  LOGNAME=user-needs-reset-integration-pre-check-case-insensitive-testsshauthenticate
+  LOGNAME=user-needs-reset-integration-pre-check-case-insensitive-testsshauthenticate@example.com
   PATH=${AUTHD_TEST_PATH}
   PWD=${AUTHD_TEST_PWD}
   SHELL=/bin/sh
@@ -115,7 +115,7 @@ PAM AcctMgmt() finished for user 'user-needs-reset-integration-pre-check-case-in
   SSH_CONNECTION=${AUTHD_TEST_SSH_CONNECTION}
   SSH_TTY=${AUTHD_TEST_SSH_TTY}
   TERM=xterm-256color
-  USER=user-needs-reset-integration-pre-check-case-insensitive-testsshauthenticate
+  USER=user-needs-reset-integration-pre-check-case-insensitive-testsshauthenticate@example.com
 Connection to localhost closed.
 >
 ────────────────────────────────────────────────────────────────────────────────
@@ -124,19 +124,19 @@ Connection to localhost closed.
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-needs-reset-integration-pre-check-Case-INSENSITIVE-testsshauthenticate@localhost) Gimme your password:
+(user-needs-reset-integration-pre-check-Case-INSENSITIVE-testsshauthenticate@example.com@localhost) Gimme your password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-needs-reset-integration-pre-check-Case-INSENSITIVE-testsshauthenticate@localhost) Gimme your password:
+(user-needs-reset-integration-pre-check-Case-INSENSITIVE-testsshauthenticate@example.com@localhost) Gimme your password:
 >
-PAM Authenticate() finished for user 'user-needs-reset-integration-pre-check-case-insensitive-testsshauthenticate'
-PAM AcctMgmt() finished for user 'user-needs-reset-integration-pre-check-case-insensitive-testsshauthenticate'
+PAM Authenticate() finished for user 'user-needs-reset-integration-pre-check-case-insensitive-testsshauthenticate@example.com'
+PAM AcctMgmt() finished for user 'user-needs-reset-integration-pre-check-case-insensitive-testsshauthenticate@example.com'
  SSHD: Connected to ssh via authd module! [TestSSHAuthenticate]
   HOME=${AUTHD_TEST_HOME}
-  LOGNAME=user-needs-reset-integration-pre-check-case-insensitive-testsshauthenticate
+  LOGNAME=user-needs-reset-integration-pre-check-case-insensitive-testsshauthenticate@example.com
   PATH=${AUTHD_TEST_PATH}
   PWD=${AUTHD_TEST_PWD}
   SHELL=/bin/sh
@@ -144,7 +144,7 @@ PAM AcctMgmt() finished for user 'user-needs-reset-integration-pre-check-case-in
   SSH_CONNECTION=${AUTHD_TEST_SSH_CONNECTION}
   SSH_TTY=${AUTHD_TEST_SSH_TTY}
   TERM=xterm-256color
-  USER=user-needs-reset-integration-pre-check-case-insensitive-testsshauthenticate
+  USER=user-needs-reset-integration-pre-check-case-insensitive-testsshauthenticate@example.com
 Connection to localhost closed.
 >
 ────────────────────────────────────────────────────────────────────────────────
diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_locks_and_unlocks_it b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_locks_and_unlocks_it
new file mode 100644
index 0000000000..496cd8bbe5
--- /dev/null
+++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_locks_and_unlocks_it
@@ -0,0 +1,113 @@
+> ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
+== Provider selection ==
+  1. local
+  2. ExampleBroker
+(user-integration-pre-check-ssh-authenticate-user-locks-and-unlocks-it@example.com@localhost) Choose your provider:
+>
+────────────────────────────────────────────────────────────────────────────────
+> ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
+== Provider selection ==
+  1. local
+  2. ExampleBroker
+(user-integration-pre-check-ssh-authenticate-user-locks-and-unlocks-it@example.com@localhost) Choose your provider:
+> 2
+────────────────────────────────────────────────────────────────────────────────
+> ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
+== Provider selection ==
+  1. local
+  2. ExampleBroker
+(user-integration-pre-check-ssh-authenticate-user-locks-and-unlocks-it@example.com@localhost) Choose your provider:
+> 2
+== Password authentication ==
+Enter 'r' to cancel the request and go back to select the authentication method
+(user-integration-pre-check-ssh-authenticate-user-locks-and-unlocks-it@example.com@localhost) Gimme your password:
+>
+────────────────────────────────────────────────────────────────────────────────
+> ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
+== Provider selection ==
+  1. local
+  2. ExampleBroker
+(user-integration-pre-check-ssh-authenticate-user-locks-and-unlocks-it@example.com@localhost) Choose your provider:
+> 2
+== Password authentication ==
+Enter 'r' to cancel the request and go back to select the authentication method
+(user-integration-pre-check-ssh-authenticate-user-locks-and-unlocks-it@example.com@localhost) Gimme your password:
+>
+PAM Authenticate() finished for user 'user-integration-pre-check-ssh-authenticate-user-locks-and-unlocks-it@example.com'
+PAM AcctMgmt() finished for user 'user-integration-pre-check-ssh-authenticate-user-locks-and-unlocks-it@example.com'
+ SSHD: Connected to ssh via authd module! [TestSSHAuthenticate/Authenticate_user_locks_and_unlocks_it]
+  HOME=${AUTHD_TEST_HOME}
+  LOGNAME=user-integration-pre-check-ssh-authenticate-user-locks-and-unlocks-it@example.com
+  PATH=${AUTHD_TEST_PATH}
+  PWD=${AUTHD_TEST_PWD}
+  SHELL=/bin/sh
+  SSH_CLIENT=${AUTHD_TEST_SSH_CLIENT}
+  SSH_CONNECTION=${AUTHD_TEST_SSH_CONNECTION}
+  SSH_TTY=${AUTHD_TEST_SSH_TTY}
+  TERM=xterm-256color
+  USER=user-integration-pre-check-ssh-authenticate-user-locks-and-unlocks-it@example.com
+Connection to localhost closed.
+>
+────────────────────────────────────────────────────────────────────────────────
+>
+────────────────────────────────────────────────────────────────────────────────
+> ${AUTHCTL_PATH} user lock ${AUTHD_PAM_SSH_USER}
+>
+────────────────────────────────────────────────────────────────────────────────
+>
+────────────────────────────────────────────────────────────────────────────────
+> ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
+== Password authentication ==
+Enter 'r' to cancel the request and go back to select the authentication method
+(user-integration-pre-check-ssh-authenticate-user-locks-and-unlocks-it@example.com@localhost) Gimme your password:
+>
+────────────────────────────────────────────────────────────────────────────────
+> ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
+== Password authentication ==
+Enter 'r' to cancel the request and go back to select the authentication method
+(user-integration-pre-check-ssh-authenticate-user-locks-and-unlocks-it@example.com@localhost) Gimme your password:
+>
+permission denied: user user-integration-pre-check-ssh-authenticate-user-locks-and-unlocks-it@example.com is locked
+Received disconnect from ${SSH_HOST} port ${SSH_PORT} Too many authentication failures
+Disconnected from ${SSH_HOST} port ${SSH_PORT}
+>
+────────────────────────────────────────────────────────────────────────────────
+>
+────────────────────────────────────────────────────────────────────────────────
+> ${AUTHCTL_PATH} user lock ${AUTHD_PAM_SSH_USER}
+>
+────────────────────────────────────────────────────────────────────────────────
+>
+────────────────────────────────────────────────────────────────────────────────
+> ${AUTHCTL_PATH} user unlock ${AUTHD_PAM_SSH_USER}
+>
+────────────────────────────────────────────────────────────────────────────────
+> ${AUTHCTL_PATH} user unlock ${AUTHD_PAM_SSH_USER}
+> ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
+== Password authentication ==
+Enter 'r' to cancel the request and go back to select the authentication method
+(user-integration-pre-check-ssh-authenticate-user-locks-and-unlocks-it@example.com@localhost) Gimme your password:
+>
+────────────────────────────────────────────────────────────────────────────────
+> ${AUTHCTL_PATH} user unlock ${AUTHD_PAM_SSH_USER}
+> ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
+== Password authentication ==
+Enter 'r' to cancel the request and go back to select the authentication method
+(user-integration-pre-check-ssh-authenticate-user-locks-and-unlocks-it@example.com@localhost) Gimme your password:
+>
+PAM Authenticate() finished for user 'user-integration-pre-check-ssh-authenticate-user-locks-and-unlocks-it@example.com'
+PAM AcctMgmt() finished for user 'user-integration-pre-check-ssh-authenticate-user-locks-and-unlocks-it@example.com'
+ SSHD: Connected to ssh via authd module! [TestSSHAuthenticate/Authenticate_user_locks_and_unlocks_it]
+  HOME=${AUTHD_TEST_HOME}
+  LOGNAME=user-integration-pre-check-ssh-authenticate-user-locks-and-unlocks-it@example.com
+  PATH=${AUTHD_TEST_PATH}
+  PWD=${AUTHD_TEST_PWD}
+  SHELL=/bin/sh
+  SSH_CLIENT=${AUTHD_TEST_SSH_CLIENT}
+  SSH_CONNECTION=${AUTHD_TEST_SSH_CONNECTION}
+  SSH_TTY=${AUTHD_TEST_SSH_TTY}
+  TERM=xterm-256color
+  USER=user-integration-pre-check-ssh-authenticate-user-locks-and-unlocks-it@example.com
+Connection to localhost closed.
+>
+────────────────────────────────────────────────────────────────────────────────
diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_locks_and_unlocks_it_with_shared_sshd b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_locks_and_unlocks_it_with_shared_sshd
new file mode 100644
index 0000000000..9366ec5f43
--- /dev/null
+++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_locks_and_unlocks_it_with_shared_sshd
@@ -0,0 +1,113 @@
+> ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
+== Provider selection ==
+  1. local
+  2. ExampleBroker
+(user-integration-pre-check-ssh-authenticate-user-locks-and-unlocks-it-with-shared-sshd@example.com@localhost) Choose your provider:
+>
+────────────────────────────────────────────────────────────────────────────────
+> ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
+== Provider selection ==
+  1. local
+  2. ExampleBroker
+(user-integration-pre-check-ssh-authenticate-user-locks-and-unlocks-it-with-shared-sshd@example.com@localhost) Choose your provider:
+> 2
+────────────────────────────────────────────────────────────────────────────────
+> ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
+== Provider selection ==
+  1. local
+  2. ExampleBroker
+(user-integration-pre-check-ssh-authenticate-user-locks-and-unlocks-it-with-shared-sshd@example.com@localhost) Choose your provider:
+> 2
+== Password authentication ==
+Enter 'r' to cancel the request and go back to select the authentication method
+(user-integration-pre-check-ssh-authenticate-user-locks-and-unlocks-it-with-shared-sshd@example.com@localhost) Gimme your password:
+>
+────────────────────────────────────────────────────────────────────────────────
+> ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
+== Provider selection ==
+  1. local
+  2. ExampleBroker
+(user-integration-pre-check-ssh-authenticate-user-locks-and-unlocks-it-with-shared-sshd@example.com@localhost) Choose your provider:
+> 2
+== Password authentication ==
+Enter 'r' to cancel the request and go back to select the authentication method
+(user-integration-pre-check-ssh-authenticate-user-locks-and-unlocks-it-with-shared-sshd@example.com@localhost) Gimme your password:
+>
+PAM Authenticate() finished for user 'user-integration-pre-check-ssh-authenticate-user-locks-and-unlocks-it-with-shared-sshd@example.com'
+PAM AcctMgmt() finished for user 'user-integration-pre-check-ssh-authenticate-user-locks-and-unlocks-it-with-shared-sshd@example.com'
+ SSHD: Connected to ssh via authd module! [TestSSHAuthenticate]
+  HOME=${AUTHD_TEST_HOME}
+  LOGNAME=user-integration-pre-check-ssh-authenticate-user-locks-and-unlocks-it-with-shared-sshd@example.com
+  PATH=${AUTHD_TEST_PATH}
+  PWD=${AUTHD_TEST_PWD}
+  SHELL=/bin/sh
+  SSH_CLIENT=${AUTHD_TEST_SSH_CLIENT}
+  SSH_CONNECTION=${AUTHD_TEST_SSH_CONNECTION}
+  SSH_TTY=${AUTHD_TEST_SSH_TTY}
+  TERM=xterm-256color
+  USER=user-integration-pre-check-ssh-authenticate-user-locks-and-unlocks-it-with-shared-sshd@example.com
+Connection to localhost closed.
+>
+────────────────────────────────────────────────────────────────────────────────
+>
+────────────────────────────────────────────────────────────────────────────────
+> ${AUTHCTL_PATH} user lock ${AUTHD_PAM_SSH_USER}
+>
+────────────────────────────────────────────────────────────────────────────────
+>
+────────────────────────────────────────────────────────────────────────────────
+> ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
+== Password authentication ==
+Enter 'r' to cancel the request and go back to select the authentication method
+(user-integration-pre-check-ssh-authenticate-user-locks-and-unlocks-it-with-shared-sshd@example.com@localhost) Gimme your password:
+>
+────────────────────────────────────────────────────────────────────────────────
+> ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
+== Password authentication ==
+Enter 'r' to cancel the request and go back to select the authentication method
+(user-integration-pre-check-ssh-authenticate-user-locks-and-unlocks-it-with-shared-sshd@example.com@localhost) Gimme your password:
+>
+permission denied: user user-integration-pre-check-ssh-authenticate-user-locks-and-unlocks-it-with-shared-sshd@example.com is locked
+Received disconnect from ${SSH_HOST} port ${SSH_PORT} Too many authentication failures
+Disconnected from ${SSH_HOST} port ${SSH_PORT}
+>
+────────────────────────────────────────────────────────────────────────────────
+>
+────────────────────────────────────────────────────────────────────────────────
+> ${AUTHCTL_PATH} user lock ${AUTHD_PAM_SSH_USER}
+>
+────────────────────────────────────────────────────────────────────────────────
+>
+────────────────────────────────────────────────────────────────────────────────
+> ${AUTHCTL_PATH} user unlock ${AUTHD_PAM_SSH_USER}
+>
+────────────────────────────────────────────────────────────────────────────────
+> ${AUTHCTL_PATH} user unlock ${AUTHD_PAM_SSH_USER}
+> ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
+== Password authentication ==
+Enter 'r' to cancel the request and go back to select the authentication method
+(user-integration-pre-check-ssh-authenticate-user-locks-and-unlocks-it-with-shared-sshd@example.com@localhost) Gimme your password:
+>
+────────────────────────────────────────────────────────────────────────────────
+> ${AUTHCTL_PATH} user unlock ${AUTHD_PAM_SSH_USER}
+> ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
+== Password authentication ==
+Enter 'r' to cancel the request and go back to select the authentication method
+(user-integration-pre-check-ssh-authenticate-user-locks-and-unlocks-it-with-shared-sshd@example.com@localhost) Gimme your password:
+>
+PAM Authenticate() finished for user 'user-integration-pre-check-ssh-authenticate-user-locks-and-unlocks-it-with-shared-sshd@example.com'
+PAM AcctMgmt() finished for user 'user-integration-pre-check-ssh-authenticate-user-locks-and-unlocks-it-with-shared-sshd@example.com'
+ SSHD: Connected to ssh via authd module! [TestSSHAuthenticate]
+  HOME=${AUTHD_TEST_HOME}
+  LOGNAME=user-integration-pre-check-ssh-authenticate-user-locks-and-unlocks-it-with-shared-sshd@example.com
+  PATH=${AUTHD_TEST_PATH}
+  PWD=${AUTHD_TEST_PWD}
+  SHELL=/bin/sh
+  SSH_CLIENT=${AUTHD_TEST_SSH_CLIENT}
+  SSH_CONNECTION=${AUTHD_TEST_SSH_CONNECTION}
+  SSH_TTY=${AUTHD_TEST_SSH_TTY}
+  TERM=xterm-256color
+  USER=user-integration-pre-check-ssh-authenticate-user-locks-and-unlocks-it-with-shared-sshd@example.com
+Connection to localhost closed.
+>
+────────────────────────────────────────────────────────────────────────────────
diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully
index b9a4e17fe3..43cc892512 100644
--- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully
+++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully
@@ -2,50 +2,50 @@
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-successfully@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-successfully@example.com@localhost) Choose your provider:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-successfully@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-successfully@example.com@localhost) Choose your provider:
 > 2
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-successfully@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-successfully@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-successfully@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-successfully@example.com@localhost) Gimme your password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-successfully@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-successfully@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-successfully@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-successfully@example.com@localhost) Gimme your password:
 >
-PAM Authenticate() finished for user 'user-integration-pre-check-ssh-authenticate-user-successfully'
-PAM AcctMgmt() finished for user 'user-integration-pre-check-ssh-authenticate-user-successfully'
-Environment:
-  USER=user-integration-pre-check-ssh-authenticate-user-successfully
-  LOGNAME=user-integration-pre-check-ssh-authenticate-user-successfully
+PAM Authenticate() finished for user 'user-integration-pre-check-ssh-authenticate-user-successfully@example.com'
+PAM AcctMgmt() finished for user 'user-integration-pre-check-ssh-authenticate-user-successfully@example.com'
+ SSHD: Connected to ssh via authd module! [TestSSHAuthenticate/Authenticate_user_successfully]
   HOME=${AUTHD_TEST_HOME}
+  LOGNAME=user-integration-pre-check-ssh-authenticate-user-successfully@example.com
   PATH=${AUTHD_TEST_PATH}
+  PWD=${AUTHD_TEST_PWD}
   SHELL=/bin/sh
-  TERM=xterm-256color
   SSH_CLIENT=${AUTHD_TEST_SSH_CLIENT}
   SSH_CONNECTION=${AUTHD_TEST_SSH_CONNECTION}
   SSH_TTY=${AUTHD_TEST_SSH_TTY}
- SSHD: Connected to ssh via authd module! [TestSSHAuthenticate/Authenticate_user_successfully]
+  TERM=xterm-256color
+  USER=user-integration-pre-check-ssh-authenticate-user-successfully@example.com
 Connection to localhost closed.
 >
 ────────────────────────────────────────────────────────────────────────────────
diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_after_db_migration b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_after_db_migration
index e566e9fd0e..43cdb597c0 100644
--- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_after_db_migration
+++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_after_db_migration
@@ -1,27 +1,27 @@
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-cached@localhost) Gimme your password:
+(user-integration-cached@example.com@localhost) Gimme your password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-cached@localhost) Gimme your password:
+(user-integration-cached@example.com@localhost) Gimme your password:
 >
-PAM Authenticate() finished for user 'user-integration-cached'
-PAM AcctMgmt() finished for user 'user-integration-cached'
-Environment:
-  USER=user-integration-cached
-  LOGNAME=user-integration-cached
+PAM Authenticate() finished for user 'user-integration-cached@example.com'
+PAM AcctMgmt() finished for user 'user-integration-cached@example.com'
+ SSHD: Connected to ssh via authd module! [TestSSHAuthenticate/Authenticate_user_successfully_after_db_migration]
   HOME=${AUTHD_TEST_HOME}
+  LOGNAME=user-integration-cached@example.com
   PATH=${AUTHD_TEST_PATH}
+  PWD=${AUTHD_TEST_PWD}
   SHELL=/bin/sh
-  TERM=xterm-256color
   SSH_CLIENT=${AUTHD_TEST_SSH_CLIENT}
   SSH_CONNECTION=${AUTHD_TEST_SSH_CONNECTION}
   SSH_TTY=${AUTHD_TEST_SSH_TTY}
- SSHD: Connected to ssh via authd module! [TestSSHAuthenticate/Authenticate_user_successfully_after_db_migration]
+  TERM=xterm-256color
+  USER=user-integration-cached@example.com
 Connection to localhost closed.
 >
 ────────────────────────────────────────────────────────────────────────────────
diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_after_db_migration.group b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_after_db_migration.group
new file mode 100644
index 0000000000..2c7783d30a
--- /dev/null
+++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_after_db_migration.group
@@ -0,0 +1,6 @@
+localgroup:x:41:user-integration-with-mixed-case@example.com,user-integration-cached@example.com,user-integration-pre-check-with-upper-case@example.com,user-integration-upper-case@example.com,user-pre-check@example.com
+some-group-for-user-integration-WITH-Mixed-CaSe@example.com:x:101:user-integration-with-mixed-case@example.com
+some-group-for-user-integration-cached@example.com:x:102:user-integration-cached@example.com
+some-group-for-user-integration-pre-check-WITH-UPPER-CASE@example.com:x:103:user-integration-pre-check-with-upper-case@example.com
+some-group-for-user-integration-UPPER-CASE@example.com:x:104:user-integration-upper-case@example.com
+some-group-for-user-pre-check@example.com:x:105:user-pre-check@example.com
diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_after_db_migration.group.backup b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_after_db_migration.group.backup
new file mode 100644
index 0000000000..7fe8ba8346
--- /dev/null
+++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_after_db_migration.group.backup
@@ -0,0 +1,6 @@
+localgroup:x:41:user-integration-WITH-Mixed-CaSe@example.com,user-integration-cached@example.com,user-integration-pre-check-WITH-UPPER-CASE@example.com,user-integration-UPPER-CASE@example.com,user-pre-check@example.com
+some-group-for-user-integration-WITH-Mixed-CaSe@example.com:x:101:user-integration-WITH-Mixed-CaSe@example.com
+some-group-for-user-integration-cached@example.com:x:102:user-integration-cached@example.com
+some-group-for-user-integration-pre-check-WITH-UPPER-CASE@example.com:x:103:user-integration-pre-check-WITH-UPPER-CASE@example.com
+some-group-for-user-integration-UPPER-CASE@example.com:x:104:user-integration-UPPER-CASE@example.com
+some-group-for-user-pre-check@example.com:x:105:user-pre-check@example.com
diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_after_db_migration.groups b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_after_db_migration.groups
deleted file mode 100644
index f31a69be33..0000000000
--- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_after_db_migration.groups
+++ /dev/null
@@ -1,6 +0,0 @@
-localgroup:x:41:user-integration-with-mixed-case,user-integration-cached,user-integration-pre-check-with-upper-case,user-integration-upper-case,user-pre-check
-some-group-for-user-integration-WITH-Mixed-CaSe:x:101:user-integration-with-mixed-case
-some-group-for-user-integration-cached:x:102:user-integration-cached
-some-group-for-user-integration-pre-check-WITH-UPPER-CASE:x:103:user-integration-pre-check-with-upper-case
-some-group-for-user-integration-UPPER-CASE:x:104:user-integration-upper-case
-some-group-for-user-pre-check:x:105:user-pre-check
diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_after_db_migration_on_shared_SSHd.groups b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_after_db_migration_on_shared_SSHd.groups
deleted file mode 100644
index f31a69be33..0000000000
--- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_after_db_migration_on_shared_SSHd.groups
+++ /dev/null
@@ -1,6 +0,0 @@
-localgroup:x:41:user-integration-with-mixed-case,user-integration-cached,user-integration-pre-check-with-upper-case,user-integration-upper-case,user-pre-check
-some-group-for-user-integration-WITH-Mixed-CaSe:x:101:user-integration-with-mixed-case
-some-group-for-user-integration-cached:x:102:user-integration-cached
-some-group-for-user-integration-pre-check-WITH-UPPER-CASE:x:103:user-integration-pre-check-with-upper-case
-some-group-for-user-integration-UPPER-CASE:x:104:user-integration-upper-case
-some-group-for-user-pre-check:x:105:user-pre-check
diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_after_db_migration_on_shared_SSHd b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_after_db_migration_with_shared_sshd
similarity index 70%
rename from pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_after_db_migration_on_shared_SSHd
rename to pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_after_db_migration_with_shared_sshd
index 29303a5bc3..c39a3a3c56 100644
--- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_after_db_migration_on_shared_SSHd
+++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_after_db_migration_with_shared_sshd
@@ -1,27 +1,27 @@
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-cached@localhost) Gimme your password:
+(user-integration-cached@example.com@localhost) Gimme your password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-cached@localhost) Gimme your password:
+(user-integration-cached@example.com@localhost) Gimme your password:
 >
-PAM Authenticate() finished for user 'user-integration-cached'
-PAM AcctMgmt() finished for user 'user-integration-cached'
-Environment:
-  USER=user-integration-cached
-  LOGNAME=user-integration-cached
+PAM Authenticate() finished for user 'user-integration-cached@example.com'
+PAM AcctMgmt() finished for user 'user-integration-cached@example.com'
+ SSHD: Connected to ssh via authd module! [TestSSHAuthenticate/Authenticate_user_successfully_after_db_migration_with_shared_sshd]
   HOME=${AUTHD_TEST_HOME}
+  LOGNAME=user-integration-cached@example.com
   PATH=${AUTHD_TEST_PATH}
+  PWD=${AUTHD_TEST_PWD}
   SHELL=/bin/sh
-  TERM=xterm-256color
   SSH_CLIENT=${AUTHD_TEST_SSH_CLIENT}
   SSH_CONNECTION=${AUTHD_TEST_SSH_CONNECTION}
   SSH_TTY=${AUTHD_TEST_SSH_TTY}
- SSHD: Connected to ssh via authd module! [TestSSHAuthenticate/Authenticate_user_successfully_after_db_migration_on_shared_SSHd]
+  TERM=xterm-256color
+  USER=user-integration-cached@example.com
 Connection to localhost closed.
 >
 ────────────────────────────────────────────────────────────────────────────────
diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_after_db_migration_with_shared_sshd.group b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_after_db_migration_with_shared_sshd.group
new file mode 100644
index 0000000000..2c7783d30a
--- /dev/null
+++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_after_db_migration_with_shared_sshd.group
@@ -0,0 +1,6 @@
+localgroup:x:41:user-integration-with-mixed-case@example.com,user-integration-cached@example.com,user-integration-pre-check-with-upper-case@example.com,user-integration-upper-case@example.com,user-pre-check@example.com
+some-group-for-user-integration-WITH-Mixed-CaSe@example.com:x:101:user-integration-with-mixed-case@example.com
+some-group-for-user-integration-cached@example.com:x:102:user-integration-cached@example.com
+some-group-for-user-integration-pre-check-WITH-UPPER-CASE@example.com:x:103:user-integration-pre-check-with-upper-case@example.com
+some-group-for-user-integration-UPPER-CASE@example.com:x:104:user-integration-upper-case@example.com
+some-group-for-user-pre-check@example.com:x:105:user-pre-check@example.com
diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_after_db_migration_with_shared_sshd.group.backup b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_after_db_migration_with_shared_sshd.group.backup
new file mode 100644
index 0000000000..7fe8ba8346
--- /dev/null
+++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_after_db_migration_with_shared_sshd.group.backup
@@ -0,0 +1,6 @@
+localgroup:x:41:user-integration-WITH-Mixed-CaSe@example.com,user-integration-cached@example.com,user-integration-pre-check-WITH-UPPER-CASE@example.com,user-integration-UPPER-CASE@example.com,user-pre-check@example.com
+some-group-for-user-integration-WITH-Mixed-CaSe@example.com:x:101:user-integration-WITH-Mixed-CaSe@example.com
+some-group-for-user-integration-cached@example.com:x:102:user-integration-cached@example.com
+some-group-for-user-integration-pre-check-WITH-UPPER-CASE@example.com:x:103:user-integration-pre-check-WITH-UPPER-CASE@example.com
+some-group-for-user-integration-UPPER-CASE@example.com:x:104:user-integration-UPPER-CASE@example.com
+some-group-for-user-pre-check@example.com:x:105:user-pre-check@example.com
diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_and_enters_shell b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_and_enters_shell
index 84cac98481..343419e87b 100644
--- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_and_enters_shell
+++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_and_enters_shell
@@ -2,91 +2,97 @@
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell@example.com@localhost) Choose your provider:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell@example.com@localhost) Gimme your password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell@example.com@localhost) Gimme your password:
 >
-PAM Authenticate() finished for user 'user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell'
-PAM AcctMgmt() finished for user 'user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell'
-Environment:
-  USER=user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell
-  LOGNAME=user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell
+PAM Authenticate() finished for user 'user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell@example.com'
+PAM AcctMgmt() finished for user 'user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell@example.com'
+ SSHD: Connected to ssh via authd module! [TestSSHAuthenticate/Authenticate_user_successfully_and_enters_shell]
   HOME=${AUTHD_TEST_HOME}
+  LOGNAME=user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell@example.com
   PATH=${AUTHD_TEST_PATH}
+  PWD=${AUTHD_TEST_PWD}
   SHELL=/bin/sh
-  TERM=xterm-256color
   SSH_CLIENT=${AUTHD_TEST_SSH_CLIENT}
   SSH_CONNECTION=${AUTHD_TEST_SSH_CONNECTION}
   SSH_TTY=${AUTHD_TEST_SSH_TTY}
+  TERM=xterm-256color
+  USER=user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell@example.com
+$
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell@example.com@localhost) Gimme your password:
 >
-PAM Authenticate() finished for user 'user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell'
-PAM AcctMgmt() finished for user 'user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell'
-Environment:
-  USER=user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell
-  LOGNAME=user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell
+PAM Authenticate() finished for user 'user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell@example.com'
+PAM AcctMgmt() finished for user 'user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell@example.com'
+ SSHD: Connected to ssh via authd module! [TestSSHAuthenticate/Authenticate_user_successfully_and_enters_shell]
   HOME=${AUTHD_TEST_HOME}
+  LOGNAME=user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell@example.com
   PATH=${AUTHD_TEST_PATH}
+  PWD=${AUTHD_TEST_PWD}
   SHELL=/bin/sh
-  TERM=xterm-256color
   SSH_CLIENT=${AUTHD_TEST_SSH_CLIENT}
   SSH_CONNECTION=${AUTHD_TEST_SSH_CONNECTION}
   SSH_TTY=${AUTHD_TEST_SSH_TTY}
-user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell
+  TERM=xterm-256color
+  USER=user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell@example.com
+$ echo $USER
+user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell@example.com
 $
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell@example.com@localhost) Gimme your password:
 >
-PAM Authenticate() finished for user 'user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell'
-PAM AcctMgmt() finished for user 'user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell'
-Environment:
-  USER=user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell
-  LOGNAME=user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell
+PAM Authenticate() finished for user 'user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell@example.com'
+PAM AcctMgmt() finished for user 'user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell@example.com'
+ SSHD: Connected to ssh via authd module! [TestSSHAuthenticate/Authenticate_user_successfully_and_enters_shell]
   HOME=${AUTHD_TEST_HOME}
+  LOGNAME=user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell@example.com
   PATH=${AUTHD_TEST_PATH}
+  PWD=${AUTHD_TEST_PWD}
   SHELL=/bin/sh
-  TERM=xterm-256color
   SSH_CLIENT=${AUTHD_TEST_SSH_CLIENT}
   SSH_CONNECTION=${AUTHD_TEST_SSH_CONNECTION}
   SSH_TTY=${AUTHD_TEST_SSH_TTY}
-user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell
+  TERM=xterm-256color
+  USER=user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell@example.com
+$ echo $USER
+user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell@example.com
 $ [ -n "${SSH_CONNECTION}" ] && echo "Inside SSH"
 Inside SSH
 $
@@ -95,25 +101,27 @@ $
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell@example.com@localhost) Gimme your password:
 >
-PAM Authenticate() finished for user 'user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell'
-PAM AcctMgmt() finished for user 'user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell'
-Environment:
-  USER=user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell
-  LOGNAME=user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell
+PAM Authenticate() finished for user 'user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell@example.com'
+PAM AcctMgmt() finished for user 'user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell@example.com'
+ SSHD: Connected to ssh via authd module! [TestSSHAuthenticate/Authenticate_user_successfully_and_enters_shell]
   HOME=${AUTHD_TEST_HOME}
+  LOGNAME=user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell@example.com
   PATH=${AUTHD_TEST_PATH}
+  PWD=${AUTHD_TEST_PWD}
   SHELL=/bin/sh
-  TERM=xterm-256color
   SSH_CLIENT=${AUTHD_TEST_SSH_CLIENT}
   SSH_CONNECTION=${AUTHD_TEST_SSH_CONNECTION}
   SSH_TTY=${AUTHD_TEST_SSH_TTY}
-user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell
+  TERM=xterm-256color
+  USER=user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell@example.com
+$ echo $USER
+user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell@example.com
 $ [ -n "${SSH_CONNECTION}" ] && echo "Inside SSH"
 Inside SSH
 $
@@ -124,25 +132,27 @@ Connection to localhost closed.
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell@example.com@localhost) Gimme your password:
 >
-PAM Authenticate() finished for user 'user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell'
-PAM AcctMgmt() finished for user 'user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell'
-Environment:
-  USER=user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell
-  LOGNAME=user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell
+PAM Authenticate() finished for user 'user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell@example.com'
+PAM AcctMgmt() finished for user 'user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell@example.com'
+ SSHD: Connected to ssh via authd module! [TestSSHAuthenticate/Authenticate_user_successfully_and_enters_shell]
   HOME=${AUTHD_TEST_HOME}
+  LOGNAME=user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell@example.com
   PATH=${AUTHD_TEST_PATH}
+  PWD=${AUTHD_TEST_PWD}
   SHELL=/bin/sh
-  TERM=xterm-256color
   SSH_CLIENT=${AUTHD_TEST_SSH_CLIENT}
   SSH_CONNECTION=${AUTHD_TEST_SSH_CONNECTION}
   SSH_TTY=${AUTHD_TEST_SSH_TTY}
-user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell
+  TERM=xterm-256color
+  USER=user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell@example.com
+$ echo $USER
+user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell@example.com
 $ [ -n "${SSH_CONNECTION}" ] && echo "Inside SSH"
 Inside SSH
 $
diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_and_enters_shell_on_shared_SSHd b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_and_enters_shell_with_shared_sshd
similarity index 67%
rename from pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_and_enters_shell_on_shared_SSHd
rename to pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_and_enters_shell_with_shared_sshd
index 652c087d5e..78cb0cd2fd 100644
--- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_and_enters_shell_on_shared_SSHd
+++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_and_enters_shell_with_shared_sshd
@@ -2,91 +2,97 @@
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell-with-shared-sshd@example.com@localhost) Choose your provider:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell-on-shared-sshd@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell-on-shared-sshd@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell-with-shared-sshd@example.com@localhost) Gimme your password:
 >
-PAM Authenticate() finished for user 'user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell-on-shared-sshd'
-PAM AcctMgmt() finished for user 'user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell-on-shared-sshd'
-Environment:
-  USER=user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell-on-shared-sshd
-  LOGNAME=user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell-on-shared-sshd
+PAM Authenticate() finished for user 'user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell-with-shared-sshd@example.com'
+PAM AcctMgmt() finished for user 'user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell-with-shared-sshd@example.com'
+ SSHD: Connected to ssh via authd module! [TestSSHAuthenticate/Authenticate_user_successfully_and_enters_shell_with_shared_sshd]
   HOME=${AUTHD_TEST_HOME}
+  LOGNAME=user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell-with-shared-sshd@example.com
   PATH=${AUTHD_TEST_PATH}
+  PWD=${AUTHD_TEST_PWD}
   SHELL=/bin/sh
-  TERM=xterm-256color
   SSH_CLIENT=${AUTHD_TEST_SSH_CLIENT}
   SSH_CONNECTION=${AUTHD_TEST_SSH_CONNECTION}
   SSH_TTY=${AUTHD_TEST_SSH_TTY}
+  TERM=xterm-256color
+  USER=user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell-with-shared-sshd@example.com
+$
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell-on-shared-sshd@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell-with-shared-sshd@example.com@localhost) Gimme your password:
 >
-PAM Authenticate() finished for user 'user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell-on-shared-sshd'
-PAM AcctMgmt() finished for user 'user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell-on-shared-sshd'
-Environment:
-  USER=user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell-on-shared-sshd
-  LOGNAME=user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell-on-shared-sshd
+PAM Authenticate() finished for user 'user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell-with-shared-sshd@example.com'
+PAM AcctMgmt() finished for user 'user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell-with-shared-sshd@example.com'
+ SSHD: Connected to ssh via authd module! [TestSSHAuthenticate/Authenticate_user_successfully_and_enters_shell_with_shared_sshd]
   HOME=${AUTHD_TEST_HOME}
+  LOGNAME=user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell-with-shared-sshd@example.com
   PATH=${AUTHD_TEST_PATH}
+  PWD=${AUTHD_TEST_PWD}
   SHELL=/bin/sh
-  TERM=xterm-256color
   SSH_CLIENT=${AUTHD_TEST_SSH_CLIENT}
   SSH_CONNECTION=${AUTHD_TEST_SSH_CONNECTION}
   SSH_TTY=${AUTHD_TEST_SSH_TTY}
-user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell-on-shared-sshd
+  TERM=xterm-256color
+  USER=user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell-with-shared-sshd@example.com
+$ echo $USER
+user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell-with-shared-sshd@example.com
 $
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell-on-shared-sshd@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell-with-shared-sshd@example.com@localhost) Gimme your password:
 >
-PAM Authenticate() finished for user 'user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell-on-shared-sshd'
-PAM AcctMgmt() finished for user 'user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell-on-shared-sshd'
-Environment:
-  USER=user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell-on-shared-sshd
-  LOGNAME=user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell-on-shared-sshd
+PAM Authenticate() finished for user 'user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell-with-shared-sshd@example.com'
+PAM AcctMgmt() finished for user 'user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell-with-shared-sshd@example.com'
+ SSHD: Connected to ssh via authd module! [TestSSHAuthenticate/Authenticate_user_successfully_and_enters_shell_with_shared_sshd]
   HOME=${AUTHD_TEST_HOME}
+  LOGNAME=user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell-with-shared-sshd@example.com
   PATH=${AUTHD_TEST_PATH}
+  PWD=${AUTHD_TEST_PWD}
   SHELL=/bin/sh
-  TERM=xterm-256color
   SSH_CLIENT=${AUTHD_TEST_SSH_CLIENT}
   SSH_CONNECTION=${AUTHD_TEST_SSH_CONNECTION}
   SSH_TTY=${AUTHD_TEST_SSH_TTY}
-user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell-on-shared-sshd
+  TERM=xterm-256color
+  USER=user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell-with-shared-sshd@example.com
+$ echo $USER
+user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell-with-shared-sshd@example.com
 $ [ -n "${SSH_CONNECTION}" ] && echo "Inside SSH"
 Inside SSH
 $
@@ -95,25 +101,27 @@ $
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell-on-shared-sshd@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell-with-shared-sshd@example.com@localhost) Gimme your password:
 >
-PAM Authenticate() finished for user 'user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell-on-shared-sshd'
-PAM AcctMgmt() finished for user 'user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell-on-shared-sshd'
-Environment:
-  USER=user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell-on-shared-sshd
-  LOGNAME=user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell-on-shared-sshd
+PAM Authenticate() finished for user 'user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell-with-shared-sshd@example.com'
+PAM AcctMgmt() finished for user 'user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell-with-shared-sshd@example.com'
+ SSHD: Connected to ssh via authd module! [TestSSHAuthenticate/Authenticate_user_successfully_and_enters_shell_with_shared_sshd]
   HOME=${AUTHD_TEST_HOME}
+  LOGNAME=user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell-with-shared-sshd@example.com
   PATH=${AUTHD_TEST_PATH}
+  PWD=${AUTHD_TEST_PWD}
   SHELL=/bin/sh
-  TERM=xterm-256color
   SSH_CLIENT=${AUTHD_TEST_SSH_CLIENT}
   SSH_CONNECTION=${AUTHD_TEST_SSH_CONNECTION}
   SSH_TTY=${AUTHD_TEST_SSH_TTY}
-user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell-on-shared-sshd
+  TERM=xterm-256color
+  USER=user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell-with-shared-sshd@example.com
+$ echo $USER
+user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell-with-shared-sshd@example.com
 $ [ -n "${SSH_CONNECTION}" ] && echo "Inside SSH"
 Inside SSH
 $
@@ -124,25 +132,27 @@ Connection to localhost closed.
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell-on-shared-sshd@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell-with-shared-sshd@example.com@localhost) Gimme your password:
 >
-PAM Authenticate() finished for user 'user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell-on-shared-sshd'
-PAM AcctMgmt() finished for user 'user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell-on-shared-sshd'
-Environment:
-  USER=user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell-on-shared-sshd
-  LOGNAME=user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell-on-shared-sshd
+PAM Authenticate() finished for user 'user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell-with-shared-sshd@example.com'
+PAM AcctMgmt() finished for user 'user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell-with-shared-sshd@example.com'
+ SSHD: Connected to ssh via authd module! [TestSSHAuthenticate/Authenticate_user_successfully_and_enters_shell_with_shared_sshd]
   HOME=${AUTHD_TEST_HOME}
+  LOGNAME=user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell-with-shared-sshd@example.com
   PATH=${AUTHD_TEST_PATH}
+  PWD=${AUTHD_TEST_PWD}
   SHELL=/bin/sh
-  TERM=xterm-256color
   SSH_CLIENT=${AUTHD_TEST_SSH_CLIENT}
   SSH_CONNECTION=${AUTHD_TEST_SSH_CONNECTION}
   SSH_TTY=${AUTHD_TEST_SSH_TTY}
-user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell-on-shared-sshd
+  TERM=xterm-256color
+  USER=user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell-with-shared-sshd@example.com
+$ echo $USER
+user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell-with-shared-sshd@example.com
 $ [ -n "${SSH_CONNECTION}" ] && echo "Inside SSH"
 Inside SSH
 $
diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_if_already_registered b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_if_already_registered
index 483744b389..403864b115 100644
--- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_if_already_registered
+++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_if_already_registered
@@ -2,50 +2,50 @@
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-ssh@localhost) Choose your provider:
+(user-ssh@example.com@localhost) Choose your provider:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-ssh@localhost) Choose your provider:
+(user-ssh@example.com@localhost) Choose your provider:
 > 2
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-ssh@localhost) Choose your provider:
+(user-ssh@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-ssh@localhost) Gimme your password:
+(user-ssh@example.com@localhost) Gimme your password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-ssh@localhost) Choose your provider:
+(user-ssh@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-ssh@localhost) Gimme your password:
+(user-ssh@example.com@localhost) Gimme your password:
 >
-PAM Authenticate() finished for user 'user-ssh'
-PAM AcctMgmt() finished for user 'user-ssh'
-Environment:
-  USER=user-ssh
-  LOGNAME=user-ssh
+PAM Authenticate() finished for user 'user-ssh@example.com'
+PAM AcctMgmt() finished for user 'user-ssh@example.com'
+ SSHD: Connected to ssh via authd module! [TestSSHAuthenticate/Authenticate_user_successfully_if_already_registered]
   HOME=${AUTHD_TEST_HOME}
+  LOGNAME=user-ssh@example.com
   PATH=${AUTHD_TEST_PATH}
+  PWD=${AUTHD_TEST_PWD}
   SHELL=/bin/sh
-  TERM=xterm-256color
   SSH_CLIENT=${AUTHD_TEST_SSH_CLIENT}
   SSH_CONNECTION=${AUTHD_TEST_SSH_CONNECTION}
   SSH_TTY=${AUTHD_TEST_SSH_TTY}
- SSHD: Connected to ssh via authd module! [TestSSHAuthenticate/Authenticate_user_successfully_if_already_registered]
+  TERM=xterm-256color
+  USER=user-ssh@example.com
 Connection to localhost closed.
 >
 ────────────────────────────────────────────────────────────────────────────────
diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_if_already_registered_with_upper_case_on_shared_SSHd b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_if_already_registered_with_shared_sshd
similarity index 79%
rename from pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_if_already_registered_with_upper_case_on_shared_SSHd
rename to pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_if_already_registered_with_shared_sshd
index 02a0467038..eefb6a4ded 100644
--- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_if_already_registered_with_upper_case_on_shared_SSHd
+++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_if_already_registered_with_shared_sshd
@@ -2,42 +2,42 @@
 == Provider selection ==
   1. local
   2. ExampleBroker
-(USER-SSH2@localhost) Choose your provider:
+(user-ssh@example.com@localhost) Choose your provider:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(USER-SSH2@localhost) Choose your provider:
+(user-ssh@example.com@localhost) Choose your provider:
 > 2
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(USER-SSH2@localhost) Choose your provider:
+(user-ssh@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(USER-SSH2@localhost) Gimme your password:
+(user-ssh@example.com@localhost) Gimme your password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(USER-SSH2@localhost) Choose your provider:
+(user-ssh@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(USER-SSH2@localhost) Gimme your password:
+(user-ssh@example.com@localhost) Gimme your password:
 >
-PAM Authenticate() finished for user 'user-ssh2'
-PAM AcctMgmt() finished for user 'user-ssh2'
+PAM Authenticate() finished for user 'user-ssh@example.com'
+PAM AcctMgmt() finished for user 'user-ssh@example.com'
  SSHD: Connected to ssh via authd module! [TestSSHAuthenticate]
   HOME=${AUTHD_TEST_HOME}
-  LOGNAME=user-ssh2
+  LOGNAME=user-ssh@example.com
   PATH=${AUTHD_TEST_PATH}
   PWD=${AUTHD_TEST_PWD}
   SHELL=/bin/sh
@@ -45,7 +45,7 @@ PAM AcctMgmt() finished for user 'user-ssh2'
   SSH_CONNECTION=${AUTHD_TEST_SSH_CONNECTION}
   SSH_TTY=${AUTHD_TEST_SSH_TTY}
   TERM=xterm-256color
-  USER=user-ssh2
+  USER=user-ssh@example.com
 Connection to localhost closed.
 >
 ────────────────────────────────────────────────────────────────────────────────
diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_if_already_registered_with_upper_case b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_if_already_registered_with_upper_case
index c6b36539ae..0f1beb7b6d 100644
--- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_if_already_registered_with_upper_case
+++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_if_already_registered_with_upper_case
@@ -2,50 +2,50 @@
 == Provider selection ==
   1. local
   2. ExampleBroker
-(USER-SSH2@localhost) Choose your provider:
+(USER-SSH2@example.com@localhost) Choose your provider:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(USER-SSH2@localhost) Choose your provider:
+(USER-SSH2@example.com@localhost) Choose your provider:
 > 2
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(USER-SSH2@localhost) Choose your provider:
+(USER-SSH2@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(USER-SSH2@localhost) Gimme your password:
+(USER-SSH2@example.com@localhost) Gimme your password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(USER-SSH2@localhost) Choose your provider:
+(USER-SSH2@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(USER-SSH2@localhost) Gimme your password:
+(USER-SSH2@example.com@localhost) Gimme your password:
 >
-PAM Authenticate() finished for user 'user-ssh2'
-PAM AcctMgmt() finished for user 'user-ssh2'
-Environment:
-  USER=user-ssh2
-  LOGNAME=user-ssh2
+PAM Authenticate() finished for user 'user-ssh2@example.com'
+PAM AcctMgmt() finished for user 'user-ssh2@example.com'
+ SSHD: Connected to ssh via authd module! [TestSSHAuthenticate/Authenticate_user_successfully_if_already_registered_with_upper_case]
   HOME=${AUTHD_TEST_HOME}
+  LOGNAME=user-ssh2@example.com
   PATH=${AUTHD_TEST_PATH}
+  PWD=${AUTHD_TEST_PWD}
   SHELL=/bin/sh
-  TERM=xterm-256color
   SSH_CLIENT=${AUTHD_TEST_SSH_CLIENT}
   SSH_CONNECTION=${AUTHD_TEST_SSH_CONNECTION}
   SSH_TTY=${AUTHD_TEST_SSH_TTY}
- SSHD: Connected to ssh via authd module! [TestSSHAuthenticate/Authenticate_user_successfully_if_already_registered_with_upper_case]
+  TERM=xterm-256color
+  USER=user-ssh2@example.com
 Connection to localhost closed.
 >
 ────────────────────────────────────────────────────────────────────────────────
diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_if_already_registered_on_shared_SSHd b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_if_already_registered_with_upper_case_with_shared_sshd
similarity index 79%
rename from pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_if_already_registered_on_shared_SSHd
rename to pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_if_already_registered_with_upper_case_with_shared_sshd
index de37950d40..4663803610 100644
--- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_if_already_registered_on_shared_SSHd
+++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_if_already_registered_with_upper_case_with_shared_sshd
@@ -2,42 +2,42 @@
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-ssh@localhost) Choose your provider:
+(USER-SSH2@example.com@localhost) Choose your provider:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-ssh@localhost) Choose your provider:
+(USER-SSH2@example.com@localhost) Choose your provider:
 > 2
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-ssh@localhost) Choose your provider:
+(USER-SSH2@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-ssh@localhost) Gimme your password:
+(USER-SSH2@example.com@localhost) Gimme your password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-ssh@localhost) Choose your provider:
+(USER-SSH2@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-ssh@localhost) Gimme your password:
+(USER-SSH2@example.com@localhost) Gimme your password:
 >
-PAM Authenticate() finished for user 'user-ssh'
-PAM AcctMgmt() finished for user 'user-ssh'
+PAM Authenticate() finished for user 'user-ssh2@example.com'
+PAM AcctMgmt() finished for user 'user-ssh2@example.com'
  SSHD: Connected to ssh via authd module! [TestSSHAuthenticate]
   HOME=${AUTHD_TEST_HOME}
-  LOGNAME=user-ssh
+  LOGNAME=user-ssh2@example.com
   PATH=${AUTHD_TEST_PATH}
   PWD=${AUTHD_TEST_PWD}
   SHELL=/bin/sh
@@ -45,7 +45,7 @@ PAM AcctMgmt() finished for user 'user-ssh'
   SSH_CONNECTION=${AUTHD_TEST_SSH_CONNECTION}
   SSH_TTY=${AUTHD_TEST_SSH_TTY}
   TERM=xterm-256color
-  USER=user-ssh
+  USER=user-ssh2@example.com
 Connection to localhost closed.
 >
 ────────────────────────────────────────────────────────────────────────────────
diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_on_shared_SSHd b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_with_shared_sshd
similarity index 70%
rename from pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_on_shared_SSHd
rename to pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_with_shared_sshd
index 8c5225093d..eaf09a57a2 100644
--- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_on_shared_SSHd
+++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_with_shared_sshd
@@ -2,42 +2,42 @@
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-successfully-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-successfully-with-shared-sshd@example.com@localhost) Choose your provider:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-successfully-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-successfully-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-successfully-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-successfully-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-successfully-on-shared-sshd@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-successfully-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-successfully-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-successfully-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-successfully-on-shared-sshd@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-successfully-with-shared-sshd@example.com@localhost) Gimme your password:
 >
-PAM Authenticate() finished for user 'user-integration-pre-check-ssh-authenticate-user-successfully-on-shared-sshd'
-PAM AcctMgmt() finished for user 'user-integration-pre-check-ssh-authenticate-user-successfully-on-shared-sshd'
+PAM Authenticate() finished for user 'user-integration-pre-check-ssh-authenticate-user-successfully-with-shared-sshd@example.com'
+PAM AcctMgmt() finished for user 'user-integration-pre-check-ssh-authenticate-user-successfully-with-shared-sshd@example.com'
  SSHD: Connected to ssh via authd module! [TestSSHAuthenticate]
   HOME=${AUTHD_TEST_HOME}
-  LOGNAME=user-integration-pre-check-ssh-authenticate-user-successfully-on-shared-sshd
+  LOGNAME=user-integration-pre-check-ssh-authenticate-user-successfully-with-shared-sshd@example.com
   PATH=${AUTHD_TEST_PATH}
   PWD=${AUTHD_TEST_PWD}
   SHELL=/bin/sh
@@ -45,7 +45,7 @@ PAM AcctMgmt() finished for user 'user-integration-pre-check-ssh-authenticate-us
   SSH_CONNECTION=${AUTHD_TEST_SSH_CONNECTION}
   SSH_TTY=${AUTHD_TEST_SSH_TTY}
   TERM=xterm-256color
-  USER=user-integration-pre-check-ssh-authenticate-user-successfully-on-shared-sshd
+  USER=user-integration-pre-check-ssh-authenticate-user-successfully-with-shared-sshd@example.com
 Connection to localhost closed.
 >
 ────────────────────────────────────────────────────────────────────────────────
diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_with_upper_case b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_with_upper_case
index 6a14d8c794..cc362dfed5 100644
--- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_with_upper_case
+++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_with_upper_case
@@ -2,50 +2,50 @@
 == Provider selection ==
   1. local
   2. ExampleBroker
-(USER-INTEGRATION-PRE-CHECK-UPPER-CASE-TESTSSHAUTHENTICATE@localhost) Choose your provider:
+(USER-INTEGRATION-PRE-CHECK-UPPER-CASE-TESTSSHAUTHENTICATE@EXAMPLE.COM@localhost) Choose your provider:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(USER-INTEGRATION-PRE-CHECK-UPPER-CASE-TESTSSHAUTHENTICATE@localhost) Choose your provider:
+(USER-INTEGRATION-PRE-CHECK-UPPER-CASE-TESTSSHAUTHENTICATE@EXAMPLE.COM@localhost) Choose your provider:
 > 2
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(USER-INTEGRATION-PRE-CHECK-UPPER-CASE-TESTSSHAUTHENTICATE@localhost) Choose your provider:
+(USER-INTEGRATION-PRE-CHECK-UPPER-CASE-TESTSSHAUTHENTICATE@EXAMPLE.COM@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(USER-INTEGRATION-PRE-CHECK-UPPER-CASE-TESTSSHAUTHENTICATE@localhost) Gimme your password:
+(USER-INTEGRATION-PRE-CHECK-UPPER-CASE-TESTSSHAUTHENTICATE@EXAMPLE.COM@localhost) Gimme your password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(USER-INTEGRATION-PRE-CHECK-UPPER-CASE-TESTSSHAUTHENTICATE@localhost) Choose your provider:
+(USER-INTEGRATION-PRE-CHECK-UPPER-CASE-TESTSSHAUTHENTICATE@EXAMPLE.COM@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(USER-INTEGRATION-PRE-CHECK-UPPER-CASE-TESTSSHAUTHENTICATE@localhost) Gimme your password:
+(USER-INTEGRATION-PRE-CHECK-UPPER-CASE-TESTSSHAUTHENTICATE@EXAMPLE.COM@localhost) Gimme your password:
 >
-PAM Authenticate() finished for user 'user-integration-pre-check-upper-case-testsshauthenticate'
-PAM AcctMgmt() finished for user 'user-integration-pre-check-upper-case-testsshauthenticate'
-Environment:
-  USER=user-integration-pre-check-upper-case-testsshauthenticate
-  LOGNAME=user-integration-pre-check-upper-case-testsshauthenticate
+PAM Authenticate() finished for user 'user-integration-pre-check-upper-case-testsshauthenticate@example.com'
+PAM AcctMgmt() finished for user 'user-integration-pre-check-upper-case-testsshauthenticate@example.com'
+ SSHD: Connected to ssh via authd module! [TestSSHAuthenticate/Authenticate_user_successfully_with_upper_case]
   HOME=${AUTHD_TEST_HOME}
+  LOGNAME=user-integration-pre-check-upper-case-testsshauthenticate@example.com
   PATH=${AUTHD_TEST_PATH}
+  PWD=${AUTHD_TEST_PWD}
   SHELL=/bin/sh
-  TERM=xterm-256color
   SSH_CLIENT=${AUTHD_TEST_SSH_CLIENT}
   SSH_CONNECTION=${AUTHD_TEST_SSH_CONNECTION}
   SSH_TTY=${AUTHD_TEST_SSH_TTY}
- SSHD: Connected to ssh via authd module! [TestSSHAuthenticate/Authenticate_user_successfully_with_upper_case]
+  TERM=xterm-256color
+  USER=user-integration-pre-check-upper-case-testsshauthenticate@example.com
 Connection to localhost closed.
 >
 ────────────────────────────────────────────────────────────────────────────────
diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_with_upper_case_on_shared_SSHd b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_with_upper_case_with_shared_sshd
similarity index 75%
rename from pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_with_upper_case_on_shared_SSHd
rename to pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_with_upper_case_with_shared_sshd
index 1a802220b9..5d20cbf811 100644
--- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_with_upper_case_on_shared_SSHd
+++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_with_upper_case_with_shared_sshd
@@ -2,42 +2,42 @@
 == Provider selection ==
   1. local
   2. ExampleBroker
-(USER-INTEGRATION-PRE-CHECK-UPPER-CASE-TESTSSHAUTHENTICATE@localhost) Choose your provider:
+(USER-INTEGRATION-PRE-CHECK-UPPER-CASE-TESTSSHAUTHENTICATE@EXAMPLE.COM@localhost) Choose your provider:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(USER-INTEGRATION-PRE-CHECK-UPPER-CASE-TESTSSHAUTHENTICATE@localhost) Choose your provider:
+(USER-INTEGRATION-PRE-CHECK-UPPER-CASE-TESTSSHAUTHENTICATE@EXAMPLE.COM@localhost) Choose your provider:
 > 2
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(USER-INTEGRATION-PRE-CHECK-UPPER-CASE-TESTSSHAUTHENTICATE@localhost) Choose your provider:
+(USER-INTEGRATION-PRE-CHECK-UPPER-CASE-TESTSSHAUTHENTICATE@EXAMPLE.COM@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(USER-INTEGRATION-PRE-CHECK-UPPER-CASE-TESTSSHAUTHENTICATE@localhost) Gimme your password:
+(USER-INTEGRATION-PRE-CHECK-UPPER-CASE-TESTSSHAUTHENTICATE@EXAMPLE.COM@localhost) Gimme your password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(USER-INTEGRATION-PRE-CHECK-UPPER-CASE-TESTSSHAUTHENTICATE@localhost) Choose your provider:
+(USER-INTEGRATION-PRE-CHECK-UPPER-CASE-TESTSSHAUTHENTICATE@EXAMPLE.COM@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(USER-INTEGRATION-PRE-CHECK-UPPER-CASE-TESTSSHAUTHENTICATE@localhost) Gimme your password:
+(USER-INTEGRATION-PRE-CHECK-UPPER-CASE-TESTSSHAUTHENTICATE@EXAMPLE.COM@localhost) Gimme your password:
 >
-PAM Authenticate() finished for user 'user-integration-pre-check-upper-case-testsshauthenticate'
-PAM AcctMgmt() finished for user 'user-integration-pre-check-upper-case-testsshauthenticate'
+PAM Authenticate() finished for user 'user-integration-pre-check-upper-case-testsshauthenticate@example.com'
+PAM AcctMgmt() finished for user 'user-integration-pre-check-upper-case-testsshauthenticate@example.com'
  SSHD: Connected to ssh via authd module! [TestSSHAuthenticate]
   HOME=${AUTHD_TEST_HOME}
-  LOGNAME=user-integration-pre-check-upper-case-testsshauthenticate
+  LOGNAME=user-integration-pre-check-upper-case-testsshauthenticate@example.com
   PATH=${AUTHD_TEST_PATH}
   PWD=${AUTHD_TEST_PWD}
   SHELL=/bin/sh
@@ -45,7 +45,7 @@ PAM AcctMgmt() finished for user 'user-integration-pre-check-upper-case-testssha
   SSH_CONNECTION=${AUTHD_TEST_SSH_CONNECTION}
   SSH_TTY=${AUTHD_TEST_SSH_TTY}
   TERM=xterm-256color
-  USER=user-integration-pre-check-upper-case-testsshauthenticate
+  USER=user-integration-pre-check-upper-case-testsshauthenticate@example.com
 Connection to localhost closed.
 >
 ────────────────────────────────────────────────────────────────────────────────
diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_switching_auth_mode b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_switching_auth_mode
index cd4013a9a8..62a5ae368f 100644
--- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_switching_auth_mode
+++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_switching_auth_mode
@@ -2,1495 +2,1474 @@
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your provider:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your provider:
 > 2
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Gimme your password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 3
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 3
-== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com ==
+== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com ==
 Leave the input field empty to wait for the alternative authentication method or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmai
-l.com or enter the code:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com or enter the code:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 3
-== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com ==
+== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com ==
 Leave the input field empty to wait for the alternative authentication method or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmai
-l.com or enter the code:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com or enter the code:
 > r
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 3
-== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com ==
+== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com ==
 Leave the input field empty to wait for the alternative authentication method or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmai
-l.com or enter the code:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com or enter the code:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 3
-== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com ==
+== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com ==
 Leave the input field empty to wait for the alternative authentication method or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmai
-l.com or enter the code:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com or enter the code:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 4
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 3
-== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com ==
+== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com ==
 Leave the input field empty to wait for the alternative authentication method or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmai
-l.com or enter the code:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com or enter the code:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 4
 == Use your fido device foo ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Plug your fido device and press with your thumb:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Plug your fido device and press with your thumb:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 3
-== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com ==
+== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com ==
 Leave the input field empty to wait for the alternative authentication method or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmai
-l.com or enter the code:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com or enter the code:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 4
 == Use your fido device foo ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Plug your fido device and press with your thumb:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Plug your fido device and press with your thumb:
 > r
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 3
-== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com ==
+== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com ==
 Leave the input field empty to wait for the alternative authentication method or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmai
-l.com or enter the code:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com or enter the code:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 4
 == Use your fido device foo ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Plug your fido device and press with your thumb:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Plug your fido device and press with your thumb:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 3
-== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com ==
+== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com ==
 Leave the input field empty to wait for the alternative authentication method or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmai
-l.com or enter the code:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com or enter the code:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 4
 == Use your fido device foo ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Plug your fido device and press with your thumb:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Plug your fido device and press with your thumb:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 5
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 3
-== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com ==
+== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com ==
 Leave the input field empty to wait for the alternative authentication method or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmai
-l.com or enter the code:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com or enter the code:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 4
 == Use your fido device foo ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Plug your fido device and press with your thumb:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Plug your fido device and press with your thumb:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 5
 == Use your phone +33... ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Unlock your phone +33... or accept request on web interface:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Unlock your phone +33... or accept request on web interface:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 3
-== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com ==
+== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com ==
 Leave the input field empty to wait for the alternative authentication method or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmai
-l.com or enter the code:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com or enter the code:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 4
 == Use your fido device foo ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Plug your fido device and press with your thumb:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Plug your fido device and press with your thumb:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 5
 == Use your phone +33... ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Unlock your phone +33... or accept request on web interface:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Unlock your phone +33... or accept request on web interface:
 > r
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 3
-== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com ==
+== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com ==
 Leave the input field empty to wait for the alternative authentication method or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmai
-l.com or enter the code:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com or enter the code:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 4
 == Use your fido device foo ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Plug your fido device and press with your thumb:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Plug your fido device and press with your thumb:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 5
 == Use your phone +33... ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Unlock your phone +33... or accept request on web interface:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Unlock your phone +33... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 3
-== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com ==
+== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com ==
 Leave the input field empty to wait for the alternative authentication method or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmai
-l.com or enter the code:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com or enter the code:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 4
 == Use your fido device foo ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Plug your fido device and press with your thumb:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Plug your fido device and press with your thumb:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 5
 == Use your phone +33... ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Unlock your phone +33... or accept request on web interface:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Unlock your phone +33... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 6
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 3
-== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com ==
+== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com ==
 Leave the input field empty to wait for the alternative authentication method or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmai
-l.com or enter the code:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com or enter the code:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 4
 == Use your fido device foo ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Plug your fido device and press with your thumb:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Plug your fido device and press with your thumb:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 5
 == Use your phone +33... ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Unlock your phone +33... or accept request on web interface:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Unlock your phone +33... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 6
 == Use your phone +1... ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Unlock your phone +1... or accept request on web interface:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Unlock your phone +1... or accept request on web interface:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 3
-== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com ==
+== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com ==
 Leave the input field empty to wait for the alternative authentication method or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmai
-l.com or enter the code:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com or enter the code:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 4
 == Use your fido device foo ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Plug your fido device and press with your thumb:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Plug your fido device and press with your thumb:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 5
 == Use your phone +33... ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Unlock your phone +33... or accept request on web interface:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Unlock your phone +33... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 6
 == Use your phone +1... ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Unlock your phone +1... or accept request on web interface:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Unlock your phone +1... or accept request on web interface:
 > r
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 3
-== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com ==
+== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com ==
 Leave the input field empty to wait for the alternative authentication method or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmai
-l.com or enter the code:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com or enter the code:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 4
 == Use your fido device foo ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Plug your fido device and press with your thumb:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Plug your fido device and press with your thumb:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 5
 == Use your phone +33... ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Unlock your phone +33... or accept request on web interface:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Unlock your phone +33... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 6
 == Use your phone +1... ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Unlock your phone +1... or accept request on web interface:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Unlock your phone +1... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 3
-== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com ==
+== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com ==
 Leave the input field empty to wait for the alternative authentication method or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmai
-l.com or enter the code:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com or enter the code:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 4
 == Use your fido device foo ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Plug your fido device and press with your thumb:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Plug your fido device and press with your thumb:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 5
 == Use your phone +33... ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Unlock your phone +33... or accept request on web interface:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Unlock your phone +33... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 6
 == Use your phone +1... ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Unlock your phone +1... or accept request on web interface:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Unlock your phone +1... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 7
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 3
-== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com ==
+== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com ==
 Leave the input field empty to wait for the alternative authentication method or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmai
-l.com or enter the code:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com or enter the code:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 4
 == Use your fido device foo ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Plug your fido device and press with your thumb:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Plug your fido device and press with your thumb:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 5
 == Use your phone +33... ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Unlock your phone +33... or accept request on web interface:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Unlock your phone +33... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 6
 == Use your phone +1... ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Unlock your phone +1... or accept request on web interface:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Unlock your phone +1... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 7
 == Pin code ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Enter your pin code:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Enter your pin code:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 3
-== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com ==
+== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com ==
 Leave the input field empty to wait for the alternative authentication method or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmai
-l.com or enter the code:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com or enter the code:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 4
 == Use your fido device foo ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Plug your fido device and press with your thumb:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Plug your fido device and press with your thumb:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 5
 == Use your phone +33... ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Unlock your phone +33... or accept request on web interface:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Unlock your phone +33... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 6
 == Use your phone +1... ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Unlock your phone +1... or accept request on web interface:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Unlock your phone +1... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 7
 == Pin code ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Enter your pin code:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Enter your pin code:
 > r
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 3
-== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com ==
+== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com ==
 Leave the input field empty to wait for the alternative authentication method or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmai
-l.com or enter the code:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com or enter the code:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 4
 == Use your fido device foo ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Plug your fido device and press with your thumb:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Plug your fido device and press with your thumb:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 5
 == Use your phone +33... ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Unlock your phone +33... or accept request on web interface:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Unlock your phone +33... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 6
 == Use your phone +1... ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Unlock your phone +1... or accept request on web interface:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Unlock your phone +1... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 7
 == Pin code ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Enter your pin code:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Enter your pin code:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 3
-== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com ==
+== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com ==
 Leave the input field empty to wait for the alternative authentication method or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmai
-l.com or enter the code:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com or enter the code:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 4
 == Use your fido device foo ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Plug your fido device and press with your thumb:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Plug your fido device and press with your thumb:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 5
 == Use your phone +33... ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Unlock your phone +33... or accept request on web interface:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Unlock your phone +33... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 6
 == Use your phone +1... ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Unlock your phone +1... or accept request on web interface:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Unlock your phone +1... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 7
 == Pin code ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Enter your pin code:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Enter your pin code:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 2
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 3
-== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com ==
+== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com ==
 Leave the input field empty to wait for the alternative authentication method or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmai
-l.com or enter the code:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com or enter the code:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 4
 == Use your fido device foo ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Plug your fido device and press with your thumb:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Plug your fido device and press with your thumb:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 5
 == Use your phone +33... ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Unlock your phone +33... or accept request on web interface:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Unlock your phone +33... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 6
 == Use your phone +1... ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Unlock your phone +1... or accept request on web interface:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Unlock your phone +1... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 7
 == Pin code ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Enter your pin code:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Enter your pin code:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 2
 == Use a Login code ==
 Enter the code in the login page
@@ -1500,111 +1479,110 @@ https://ubuntu.com
   1. Wait for authentication result
   2. Regenerate code
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose action:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 3
-== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com ==
+== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com ==
 Leave the input field empty to wait for the alternative authentication method or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmai
-l.com or enter the code:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com or enter the code:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 4
 == Use your fido device foo ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Plug your fido device and press with your thumb:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Plug your fido device and press with your thumb:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 5
 == Use your phone +33... ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Unlock your phone +33... or accept request on web interface:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Unlock your phone +33... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 6
 == Use your phone +1... ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Unlock your phone +1... or accept request on web interface:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Unlock your phone +1... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 7
 == Pin code ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Enter your pin code:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Enter your pin code:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 2
 == Use a Login code ==
 Enter the code in the login page
@@ -1614,111 +1592,110 @@ https://ubuntu.com
   1. Wait for authentication result
   2. Regenerate code
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose action:
 > r
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 3
-== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com ==
+== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com ==
 Leave the input field empty to wait for the alternative authentication method or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmai
-l.com or enter the code:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com or enter the code:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 4
 == Use your fido device foo ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Plug your fido device and press with your thumb:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Plug your fido device and press with your thumb:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 5
 == Use your phone +33... ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Unlock your phone +33... or accept request on web interface:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Unlock your phone +33... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 6
 == Use your phone +1... ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Unlock your phone +1... or accept request on web interface:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Unlock your phone +1... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 7
 == Pin code ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Enter your pin code:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Enter your pin code:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 2
 == Use a Login code ==
 Enter the code in the login page
@@ -1728,123 +1705,122 @@ https://ubuntu.com
   1. Wait for authentication result
   2. Regenerate code
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose action:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 3
-== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com ==
+== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com ==
 Leave the input field empty to wait for the alternative authentication method or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmai
-l.com or enter the code:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com or enter the code:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 4
 == Use your fido device foo ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Plug your fido device and press with your thumb:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Plug your fido device and press with your thumb:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 5
 == Use your phone +33... ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Unlock your phone +33... or accept request on web interface:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Unlock your phone +33... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 6
 == Use your phone +1... ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Unlock your phone +1... or accept request on web interface:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Unlock your phone +1... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 7
 == Pin code ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Enter your pin code:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Enter your pin code:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 2
 == Use a Login code ==
 Enter the code in the login page
@@ -1854,123 +1830,122 @@ https://ubuntu.com
   1. Wait for authentication result
   2. Regenerate code
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose action:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 8
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 3
-== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com ==
+== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com ==
 Leave the input field empty to wait for the alternative authentication method or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmai
-l.com or enter the code:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com or enter the code:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 4
 == Use your fido device foo ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Plug your fido device and press with your thumb:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Plug your fido device and press with your thumb:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 5
 == Use your phone +33... ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Unlock your phone +33... or accept request on web interface:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Unlock your phone +33... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 6
 == Use your phone +1... ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Unlock your phone +1... or accept request on web interface:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Unlock your phone +1... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 7
 == Pin code ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Enter your pin code:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Enter your pin code:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 2
 == Use a Login code ==
 Enter the code in the login page
@@ -1980,129 +1955,128 @@ https://ubuntu.com
   1. Wait for authentication result
   2. Regenerate code
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose action:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 8
 == Authentication code ==
   1. Proceed with Authentication code
   2. Resend SMS (1 sent)
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose action:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 3
-== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com ==
+== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com ==
 Leave the input field empty to wait for the alternative authentication method or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmai
-l.com or enter the code:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com or enter the code:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 4
 == Use your fido device foo ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Plug your fido device and press with your thumb:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Plug your fido device and press with your thumb:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 5
 == Use your phone +33... ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Unlock your phone +33... or accept request on web interface:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Unlock your phone +33... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 6
 == Use your phone +1... ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Unlock your phone +1... or accept request on web interface:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Unlock your phone +1... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 7
 == Pin code ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Enter your pin code:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Enter your pin code:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 2
 == Use a Login code ==
 Enter the code in the login page
@@ -2112,129 +2086,128 @@ https://ubuntu.com
   1. Wait for authentication result
   2. Regenerate code
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose action:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 8
 == Authentication code ==
   1. Proceed with Authentication code
   2. Resend SMS (1 sent)
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose action:
 > r
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 3
-== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com ==
+== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com ==
 Leave the input field empty to wait for the alternative authentication method or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmai
-l.com or enter the code:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com or enter the code:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 4
 == Use your fido device foo ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Plug your fido device and press with your thumb:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Plug your fido device and press with your thumb:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 5
 == Use your phone +33... ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Unlock your phone +33... or accept request on web interface:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Unlock your phone +33... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 6
 == Use your phone +1... ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Unlock your phone +1... or accept request on web interface:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Unlock your phone +1... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 7
 == Pin code ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Enter your pin code:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Enter your pin code:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 2
 == Use a Login code ==
 Enter the code in the login page
@@ -2244,141 +2217,140 @@ https://ubuntu.com
   1. Wait for authentication result
   2. Regenerate code
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose action:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 8
 == Authentication code ==
   1. Proceed with Authentication code
   2. Resend SMS (1 sent)
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose action:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 3
-== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com ==
+== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com ==
 Leave the input field empty to wait for the alternative authentication method or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmai
-l.com or enter the code:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com or enter the code:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 4
 == Use your fido device foo ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Plug your fido device and press with your thumb:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Plug your fido device and press with your thumb:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 5
 == Use your phone +33... ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Unlock your phone +33... or accept request on web interface:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Unlock your phone +33... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 6
 == Use your phone +1... ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Unlock your phone +1... or accept request on web interface:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Unlock your phone +1... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 7
 == Pin code ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Enter your pin code:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Enter your pin code:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 2
 == Use a Login code ==
 Enter the code in the login page
@@ -2388,141 +2360,140 @@ https://ubuntu.com
   1. Wait for authentication result
   2. Regenerate code
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose action:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 8
 == Authentication code ==
   1. Proceed with Authentication code
   2. Resend SMS (1 sent)
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose action:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > invalid-selection
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 3
-== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com ==
+== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com ==
 Leave the input field empty to wait for the alternative authentication method or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmai
-l.com or enter the code:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com or enter the code:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 4
 == Use your fido device foo ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Plug your fido device and press with your thumb:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Plug your fido device and press with your thumb:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 5
 == Use your phone +33... ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Unlock your phone +33... or accept request on web interface:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Unlock your phone +33... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 6
 == Use your phone +1... ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Unlock your phone +1... or accept request on web interface:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Unlock your phone +1... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 7
 == Pin code ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Enter your pin code:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Enter your pin code:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 2
 == Use a Login code ==
 Enter the code in the login page
@@ -2532,144 +2503,143 @@ https://ubuntu.com
   1. Wait for authentication result
   2. Regenerate code
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose action:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 8
 == Authentication code ==
   1. Proceed with Authentication code
   2. Resend SMS (1 sent)
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose action:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > invalid-selection
 Unsupported input
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 3
-== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com ==
+== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com ==
 Leave the input field empty to wait for the alternative authentication method or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmai
-l.com or enter the code:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com or enter the code:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 4
 == Use your fido device foo ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Plug your fido device and press with your thumb:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Plug your fido device and press with your thumb:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 5
 == Use your phone +33... ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Unlock your phone +33... or accept request on web interface:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Unlock your phone +33... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 6
 == Use your phone +1... ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Unlock your phone +1... or accept request on web interface:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Unlock your phone +1... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 7
 == Pin code ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Enter your pin code:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Enter your pin code:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 2
 == Use a Login code ==
 Enter the code in the login page
@@ -2679,144 +2649,143 @@ https://ubuntu.com
   1. Wait for authentication result
   2. Regenerate code
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose action:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 8
 == Authentication code ==
   1. Proceed with Authentication code
   2. Resend SMS (1 sent)
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose action:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > invalid-selection
 Unsupported input
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > -1
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 3
-== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com ==
+== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com ==
 Leave the input field empty to wait for the alternative authentication method or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmai
-l.com or enter the code:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com or enter the code:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 4
 == Use your fido device foo ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Plug your fido device and press with your thumb:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Plug your fido device and press with your thumb:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 5
 == Use your phone +33... ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Unlock your phone +33... or accept request on web interface:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Unlock your phone +33... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 6
 == Use your phone +1... ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Unlock your phone +1... or accept request on web interface:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Unlock your phone +1... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 7
 == Pin code ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Enter your pin code:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Enter your pin code:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 2
 == Use a Login code ==
 Enter the code in the login page
@@ -2826,157 +2795,156 @@ https://ubuntu.com
   1. Wait for authentication result
   2. Regenerate code
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose action:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 8
 == Authentication code ==
   1. Proceed with Authentication code
   2. Resend SMS (1 sent)
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose action:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > invalid-selection
 Unsupported input
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > -1
 Invalid selection
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 3
-== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com ==
+== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com ==
 Leave the input field empty to wait for the alternative authentication method or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmai
-l.com or enter the code:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com or enter the code:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 4
 == Use your fido device foo ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Plug your fido device and press with your thumb:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Plug your fido device and press with your thumb:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 5
 == Use your phone +33... ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Unlock your phone +33... or accept request on web interface:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Unlock your phone +33... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 6
 == Use your phone +1... ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Unlock your phone +1... or accept request on web interface:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Unlock your phone +1... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 7
 == Pin code ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Enter your pin code:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Enter your pin code:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 2
 == Use a Login code ==
 Enter the code in the login page
@@ -2986,157 +2954,156 @@ https://ubuntu.com
   1. Wait for authentication result
   2. Regenerate code
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose action:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 8
 == Authentication code ==
   1. Proceed with Authentication code
   2. Resend SMS (1 sent)
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose action:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > invalid-selection
 Unsupported input
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > -1
 Invalid selection
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 7
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 3
-== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com ==
+== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com ==
 Leave the input field empty to wait for the alternative authentication method or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmai
-l.com or enter the code:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com or enter the code:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 4
 == Use your fido device foo ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Plug your fido device and press with your thumb:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Plug your fido device and press with your thumb:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 5
 == Use your phone +33... ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Unlock your phone +33... or accept request on web interface:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Unlock your phone +33... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 6
 == Use your phone +1... ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Unlock your phone +1... or accept request on web interface:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Unlock your phone +1... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 7
 == Pin code ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Enter your pin code:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Enter your pin code:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 2
 == Use a Login code ==
 Enter the code in the login page
@@ -3146,161 +3113,160 @@ https://ubuntu.com
   1. Wait for authentication result
   2. Regenerate code
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose action:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 8
 == Authentication code ==
   1. Proceed with Authentication code
   2. Resend SMS (1 sent)
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose action:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > invalid-selection
 Unsupported input
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > -1
 Invalid selection
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 7
 == Pin code ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Enter your pin code:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Enter your pin code:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 3
-== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com ==
+== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com ==
 Leave the input field empty to wait for the alternative authentication method or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmai
-l.com or enter the code:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com or enter the code:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 4
 == Use your fido device foo ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Plug your fido device and press with your thumb:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Plug your fido device and press with your thumb:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 5
 == Use your phone +33... ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Unlock your phone +33... or accept request on web interface:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Unlock your phone +33... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 6
 == Use your phone +1... ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Unlock your phone +1... or accept request on web interface:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Unlock your phone +1... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 7
 == Pin code ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Enter your pin code:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Enter your pin code:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 2
 == Use a Login code ==
 Enter the code in the login page
@@ -3310,161 +3276,160 @@ https://ubuntu.com
   1. Wait for authentication result
   2. Regenerate code
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose action:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 8
 == Authentication code ==
   1. Proceed with Authentication code
   2. Resend SMS (1 sent)
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose action:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > invalid-selection
 Unsupported input
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > -1
 Invalid selection
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 7
 == Pin code ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Enter your pin code:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Enter your pin code:
 > 4242
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 3
-== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com ==
+== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com ==
 Leave the input field empty to wait for the alternative authentication method or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmai
-l.com or enter the code:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com or enter the code:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 4
 == Use your fido device foo ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Plug your fido device and press with your thumb:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Plug your fido device and press with your thumb:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 5
 == Use your phone +33... ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Unlock your phone +33... or accept request on web interface:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Unlock your phone +33... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 6
 == Use your phone +1... ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Unlock your phone +1... or accept request on web interface:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Unlock your phone +1... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 7
 == Pin code ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Enter your pin code:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Enter your pin code:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 2
 == Use a Login code ==
 Enter the code in the login page
@@ -3474,71 +3439,71 @@ https://ubuntu.com
   1. Wait for authentication result
   2. Regenerate code
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose action:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 8
 == Authentication code ==
   1. Proceed with Authentication code
   2. Resend SMS (1 sent)
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose action:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > invalid-selection
 Unsupported input
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > -1
 Invalid selection
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Choose your authentication method:
 > 7
 == Pin code ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@localhost) Enter your pin code:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Enter your pin code:
 > 4242
-PAM Authenticate() finished for user 'user-integration-pre-check-ssh-authenticate-user-switching-auth-mode'
-PAM AcctMgmt() finished for user 'user-integration-pre-check-ssh-authenticate-user-switching-auth-mode'
-Environment:
-  USER=user-integration-pre-check-ssh-authenticate-user-switching-auth-mode
-  LOGNAME=user-integration-pre-check-ssh-authenticate-user-switching-auth-mode
+PAM Authenticate() finished for user 'user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com'
+PAM AcctMgmt() finished for user 'user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com'
+ SSHD: Connected to ssh via authd module! [TestSSHAuthenticate/Authenticate_user_switching_auth_mode]
   HOME=${AUTHD_TEST_HOME}
+  LOGNAME=user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
   PATH=${AUTHD_TEST_PATH}
+  PWD=${AUTHD_TEST_PWD}
   SHELL=/bin/sh
-  TERM=xterm-256color
   SSH_CLIENT=${AUTHD_TEST_SSH_CLIENT}
   SSH_CONNECTION=${AUTHD_TEST_SSH_CONNECTION}
   SSH_TTY=${AUTHD_TEST_SSH_TTY}
- SSHD: Connected to ssh via authd module! [TestSSHAuthenticate/Authenticate_user_switching_auth_mode]
+  TERM=xterm-256color
+  USER=user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com
 Connection to localhost closed.
 >
 ────────────────────────────────────────────────────────────────────────────────
diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_switching_auth_mode_on_shared_SSHd b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_switching_auth_mode_with_shared_sshd
similarity index 72%
rename from pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_switching_auth_mode_on_shared_SSHd
rename to pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_switching_auth_mode_with_shared_sshd
index 788bb9a904..3cd6cd262f 100644
--- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_switching_auth_mode_on_shared_SSHd
+++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_switching_auth_mode_with_shared_sshd
@@ -2,1495 +2,1495 @@
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your provider:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 3
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 3
-== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com ==
+== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com ==
 Leave the input field empty to wait for the alternative authentication method or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-user-switching
--auth-mode-on-shared-sshd@gmail.com or enter the code:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-
+user-switching-auth-mode-with-shared-sshd@example.com or enter the code:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 3
-== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com ==
+== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com ==
 Leave the input field empty to wait for the alternative authentication method or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-user-switching
--auth-mode-on-shared-sshd@gmail.com or enter the code:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-
+user-switching-auth-mode-with-shared-sshd@example.com or enter the code:
 > r
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 3
-== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com ==
+== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com ==
 Leave the input field empty to wait for the alternative authentication method or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-user-switching
--auth-mode-on-shared-sshd@gmail.com or enter the code:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-
+user-switching-auth-mode-with-shared-sshd@example.com or enter the code:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 3
-== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com ==
+== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com ==
 Leave the input field empty to wait for the alternative authentication method or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-user-switching
--auth-mode-on-shared-sshd@gmail.com or enter the code:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-
+user-switching-auth-mode-with-shared-sshd@example.com or enter the code:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 4
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 3
-== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com ==
+== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com ==
 Leave the input field empty to wait for the alternative authentication method or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-user-switching
--auth-mode-on-shared-sshd@gmail.com or enter the code:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-
+user-switching-auth-mode-with-shared-sshd@example.com or enter the code:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 4
 == Use your fido device foo ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Plug your fido device and press with your thumb:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Plug your fido device and press with your thumb:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 3
-== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com ==
+== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com ==
 Leave the input field empty to wait for the alternative authentication method or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-user-switching
--auth-mode-on-shared-sshd@gmail.com or enter the code:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-
+user-switching-auth-mode-with-shared-sshd@example.com or enter the code:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 4
 == Use your fido device foo ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Plug your fido device and press with your thumb:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Plug your fido device and press with your thumb:
 > r
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 3
-== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com ==
+== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com ==
 Leave the input field empty to wait for the alternative authentication method or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-user-switching
--auth-mode-on-shared-sshd@gmail.com or enter the code:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-
+user-switching-auth-mode-with-shared-sshd@example.com or enter the code:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 4
 == Use your fido device foo ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Plug your fido device and press with your thumb:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Plug your fido device and press with your thumb:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 3
-== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com ==
+== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com ==
 Leave the input field empty to wait for the alternative authentication method or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-user-switching
--auth-mode-on-shared-sshd@gmail.com or enter the code:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-
+user-switching-auth-mode-with-shared-sshd@example.com or enter the code:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 4
 == Use your fido device foo ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Plug your fido device and press with your thumb:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Plug your fido device and press with your thumb:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 5
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 3
-== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com ==
+== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com ==
 Leave the input field empty to wait for the alternative authentication method or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-user-switching
--auth-mode-on-shared-sshd@gmail.com or enter the code:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-
+user-switching-auth-mode-with-shared-sshd@example.com or enter the code:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 4
 == Use your fido device foo ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Plug your fido device and press with your thumb:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Plug your fido device and press with your thumb:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 5
 == Use your phone +33... ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Unlock your phone +33... or accept request on web interface:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Unlock your phone +33... or accept request on web interface:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 3
-== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com ==
+== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com ==
 Leave the input field empty to wait for the alternative authentication method or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-user-switching
--auth-mode-on-shared-sshd@gmail.com or enter the code:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-
+user-switching-auth-mode-with-shared-sshd@example.com or enter the code:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 4
 == Use your fido device foo ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Plug your fido device and press with your thumb:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Plug your fido device and press with your thumb:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 5
 == Use your phone +33... ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Unlock your phone +33... or accept request on web interface:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Unlock your phone +33... or accept request on web interface:
 > r
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 3
-== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com ==
+== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com ==
 Leave the input field empty to wait for the alternative authentication method or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-user-switching
--auth-mode-on-shared-sshd@gmail.com or enter the code:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-
+user-switching-auth-mode-with-shared-sshd@example.com or enter the code:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 4
 == Use your fido device foo ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Plug your fido device and press with your thumb:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Plug your fido device and press with your thumb:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 5
 == Use your phone +33... ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Unlock your phone +33... or accept request on web interface:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Unlock your phone +33... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 3
-== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com ==
+== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com ==
 Leave the input field empty to wait for the alternative authentication method or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-user-switching
--auth-mode-on-shared-sshd@gmail.com or enter the code:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-
+user-switching-auth-mode-with-shared-sshd@example.com or enter the code:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 4
 == Use your fido device foo ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Plug your fido device and press with your thumb:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Plug your fido device and press with your thumb:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 5
 == Use your phone +33... ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Unlock your phone +33... or accept request on web interface:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Unlock your phone +33... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 6
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 3
-== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com ==
+== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com ==
 Leave the input field empty to wait for the alternative authentication method or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-user-switching
--auth-mode-on-shared-sshd@gmail.com or enter the code:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-
+user-switching-auth-mode-with-shared-sshd@example.com or enter the code:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 4
 == Use your fido device foo ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Plug your fido device and press with your thumb:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Plug your fido device and press with your thumb:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 5
 == Use your phone +33... ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Unlock your phone +33... or accept request on web interface:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Unlock your phone +33... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 6
 == Use your phone +1... ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Unlock your phone +1... or accept request on web interface:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Unlock your phone +1... or accept request on web interface:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 3
-== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com ==
+== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com ==
 Leave the input field empty to wait for the alternative authentication method or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-user-switching
--auth-mode-on-shared-sshd@gmail.com or enter the code:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-
+user-switching-auth-mode-with-shared-sshd@example.com or enter the code:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 4
 == Use your fido device foo ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Plug your fido device and press with your thumb:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Plug your fido device and press with your thumb:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 5
 == Use your phone +33... ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Unlock your phone +33... or accept request on web interface:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Unlock your phone +33... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 6
 == Use your phone +1... ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Unlock your phone +1... or accept request on web interface:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Unlock your phone +1... or accept request on web interface:
 > r
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 3
-== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com ==
+== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com ==
 Leave the input field empty to wait for the alternative authentication method or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-user-switching
--auth-mode-on-shared-sshd@gmail.com or enter the code:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-
+user-switching-auth-mode-with-shared-sshd@example.com or enter the code:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 4
 == Use your fido device foo ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Plug your fido device and press with your thumb:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Plug your fido device and press with your thumb:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 5
 == Use your phone +33... ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Unlock your phone +33... or accept request on web interface:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Unlock your phone +33... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 6
 == Use your phone +1... ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Unlock your phone +1... or accept request on web interface:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Unlock your phone +1... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 3
-== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com ==
+== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com ==
 Leave the input field empty to wait for the alternative authentication method or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-user-switching
--auth-mode-on-shared-sshd@gmail.com or enter the code:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-
+user-switching-auth-mode-with-shared-sshd@example.com or enter the code:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 4
 == Use your fido device foo ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Plug your fido device and press with your thumb:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Plug your fido device and press with your thumb:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 5
 == Use your phone +33... ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Unlock your phone +33... or accept request on web interface:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Unlock your phone +33... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 6
 == Use your phone +1... ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Unlock your phone +1... or accept request on web interface:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Unlock your phone +1... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 7
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 3
-== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com ==
+== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com ==
 Leave the input field empty to wait for the alternative authentication method or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-user-switching
--auth-mode-on-shared-sshd@gmail.com or enter the code:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-
+user-switching-auth-mode-with-shared-sshd@example.com or enter the code:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 4
 == Use your fido device foo ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Plug your fido device and press with your thumb:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Plug your fido device and press with your thumb:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 5
 == Use your phone +33... ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Unlock your phone +33... or accept request on web interface:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Unlock your phone +33... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 6
 == Use your phone +1... ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Unlock your phone +1... or accept request on web interface:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Unlock your phone +1... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 7
 == Pin code ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Enter your pin code:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Enter your pin code:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 3
-== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com ==
+== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com ==
 Leave the input field empty to wait for the alternative authentication method or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-user-switching
--auth-mode-on-shared-sshd@gmail.com or enter the code:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-
+user-switching-auth-mode-with-shared-sshd@example.com or enter the code:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 4
 == Use your fido device foo ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Plug your fido device and press with your thumb:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Plug your fido device and press with your thumb:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 5
 == Use your phone +33... ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Unlock your phone +33... or accept request on web interface:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Unlock your phone +33... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 6
 == Use your phone +1... ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Unlock your phone +1... or accept request on web interface:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Unlock your phone +1... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 7
 == Pin code ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Enter your pin code:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Enter your pin code:
 > r
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 3
-== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com ==
+== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com ==
 Leave the input field empty to wait for the alternative authentication method or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-user-switching
--auth-mode-on-shared-sshd@gmail.com or enter the code:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-
+user-switching-auth-mode-with-shared-sshd@example.com or enter the code:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 4
 == Use your fido device foo ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Plug your fido device and press with your thumb:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Plug your fido device and press with your thumb:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 5
 == Use your phone +33... ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Unlock your phone +33... or accept request on web interface:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Unlock your phone +33... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 6
 == Use your phone +1... ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Unlock your phone +1... or accept request on web interface:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Unlock your phone +1... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 7
 == Pin code ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Enter your pin code:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Enter your pin code:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 3
-== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com ==
+== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com ==
 Leave the input field empty to wait for the alternative authentication method or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-user-switching
--auth-mode-on-shared-sshd@gmail.com or enter the code:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-
+user-switching-auth-mode-with-shared-sshd@example.com or enter the code:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 4
 == Use your fido device foo ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Plug your fido device and press with your thumb:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Plug your fido device and press with your thumb:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 5
 == Use your phone +33... ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Unlock your phone +33... or accept request on web interface:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Unlock your phone +33... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 6
 == Use your phone +1... ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Unlock your phone +1... or accept request on web interface:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Unlock your phone +1... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 7
 == Pin code ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Enter your pin code:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Enter your pin code:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 2
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 3
-== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com ==
+== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com ==
 Leave the input field empty to wait for the alternative authentication method or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-user-switching
--auth-mode-on-shared-sshd@gmail.com or enter the code:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-
+user-switching-auth-mode-with-shared-sshd@example.com or enter the code:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 4
 == Use your fido device foo ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Plug your fido device and press with your thumb:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Plug your fido device and press with your thumb:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 5
 == Use your phone +33... ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Unlock your phone +33... or accept request on web interface:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Unlock your phone +33... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 6
 == Use your phone +1... ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Unlock your phone +1... or accept request on web interface:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Unlock your phone +1... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 7
 == Pin code ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Enter your pin code:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Enter your pin code:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 2
 == Use a Login code ==
 Enter the code in the login page
@@ -1500,111 +1500,111 @@ https://ubuntu.com
   1. Wait for authentication result
   2. Regenerate code
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose action:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 3
-== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com ==
+== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com ==
 Leave the input field empty to wait for the alternative authentication method or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-user-switching
--auth-mode-on-shared-sshd@gmail.com or enter the code:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-
+user-switching-auth-mode-with-shared-sshd@example.com or enter the code:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 4
 == Use your fido device foo ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Plug your fido device and press with your thumb:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Plug your fido device and press with your thumb:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 5
 == Use your phone +33... ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Unlock your phone +33... or accept request on web interface:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Unlock your phone +33... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 6
 == Use your phone +1... ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Unlock your phone +1... or accept request on web interface:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Unlock your phone +1... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 7
 == Pin code ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Enter your pin code:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Enter your pin code:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 2
 == Use a Login code ==
 Enter the code in the login page
@@ -1614,111 +1614,111 @@ https://ubuntu.com
   1. Wait for authentication result
   2. Regenerate code
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose action:
 > r
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 3
-== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com ==
+== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com ==
 Leave the input field empty to wait for the alternative authentication method or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-user-switching
--auth-mode-on-shared-sshd@gmail.com or enter the code:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-
+user-switching-auth-mode-with-shared-sshd@example.com or enter the code:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 4
 == Use your fido device foo ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Plug your fido device and press with your thumb:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Plug your fido device and press with your thumb:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 5
 == Use your phone +33... ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Unlock your phone +33... or accept request on web interface:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Unlock your phone +33... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 6
 == Use your phone +1... ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Unlock your phone +1... or accept request on web interface:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Unlock your phone +1... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 7
 == Pin code ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Enter your pin code:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Enter your pin code:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 2
 == Use a Login code ==
 Enter the code in the login page
@@ -1728,123 +1728,123 @@ https://ubuntu.com
   1. Wait for authentication result
   2. Regenerate code
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose action:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 3
-== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com ==
+== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com ==
 Leave the input field empty to wait for the alternative authentication method or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-user-switching
--auth-mode-on-shared-sshd@gmail.com or enter the code:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-
+user-switching-auth-mode-with-shared-sshd@example.com or enter the code:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 4
 == Use your fido device foo ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Plug your fido device and press with your thumb:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Plug your fido device and press with your thumb:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 5
 == Use your phone +33... ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Unlock your phone +33... or accept request on web interface:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Unlock your phone +33... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 6
 == Use your phone +1... ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Unlock your phone +1... or accept request on web interface:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Unlock your phone +1... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 7
 == Pin code ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Enter your pin code:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Enter your pin code:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 2
 == Use a Login code ==
 Enter the code in the login page
@@ -1854,123 +1854,123 @@ https://ubuntu.com
   1. Wait for authentication result
   2. Regenerate code
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose action:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 8
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 3
-== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com ==
+== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com ==
 Leave the input field empty to wait for the alternative authentication method or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-user-switching
--auth-mode-on-shared-sshd@gmail.com or enter the code:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-
+user-switching-auth-mode-with-shared-sshd@example.com or enter the code:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 4
 == Use your fido device foo ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Plug your fido device and press with your thumb:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Plug your fido device and press with your thumb:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 5
 == Use your phone +33... ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Unlock your phone +33... or accept request on web interface:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Unlock your phone +33... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 6
 == Use your phone +1... ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Unlock your phone +1... or accept request on web interface:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Unlock your phone +1... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 7
 == Pin code ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Enter your pin code:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Enter your pin code:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 2
 == Use a Login code ==
 Enter the code in the login page
@@ -1980,129 +1980,129 @@ https://ubuntu.com
   1. Wait for authentication result
   2. Regenerate code
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose action:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 8
 == Authentication code ==
   1. Proceed with Authentication code
   2. Resend SMS (1 sent)
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose action:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 3
-== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com ==
+== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com ==
 Leave the input field empty to wait for the alternative authentication method or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-user-switching
--auth-mode-on-shared-sshd@gmail.com or enter the code:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-
+user-switching-auth-mode-with-shared-sshd@example.com or enter the code:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 4
 == Use your fido device foo ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Plug your fido device and press with your thumb:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Plug your fido device and press with your thumb:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 5
 == Use your phone +33... ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Unlock your phone +33... or accept request on web interface:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Unlock your phone +33... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 6
 == Use your phone +1... ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Unlock your phone +1... or accept request on web interface:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Unlock your phone +1... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 7
 == Pin code ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Enter your pin code:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Enter your pin code:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 2
 == Use a Login code ==
 Enter the code in the login page
@@ -2112,129 +2112,129 @@ https://ubuntu.com
   1. Wait for authentication result
   2. Regenerate code
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose action:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 8
 == Authentication code ==
   1. Proceed with Authentication code
   2. Resend SMS (1 sent)
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose action:
 > r
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 3
-== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com ==
+== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com ==
 Leave the input field empty to wait for the alternative authentication method or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-user-switching
--auth-mode-on-shared-sshd@gmail.com or enter the code:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-
+user-switching-auth-mode-with-shared-sshd@example.com or enter the code:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 4
 == Use your fido device foo ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Plug your fido device and press with your thumb:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Plug your fido device and press with your thumb:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 5
 == Use your phone +33... ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Unlock your phone +33... or accept request on web interface:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Unlock your phone +33... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 6
 == Use your phone +1... ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Unlock your phone +1... or accept request on web interface:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Unlock your phone +1... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 7
 == Pin code ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Enter your pin code:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Enter your pin code:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 2
 == Use a Login code ==
 Enter the code in the login page
@@ -2244,141 +2244,141 @@ https://ubuntu.com
   1. Wait for authentication result
   2. Regenerate code
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose action:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 8
 == Authentication code ==
   1. Proceed with Authentication code
   2. Resend SMS (1 sent)
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose action:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 3
-== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com ==
+== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com ==
 Leave the input field empty to wait for the alternative authentication method or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-user-switching
--auth-mode-on-shared-sshd@gmail.com or enter the code:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-
+user-switching-auth-mode-with-shared-sshd@example.com or enter the code:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 4
 == Use your fido device foo ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Plug your fido device and press with your thumb:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Plug your fido device and press with your thumb:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 5
 == Use your phone +33... ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Unlock your phone +33... or accept request on web interface:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Unlock your phone +33... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 6
 == Use your phone +1... ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Unlock your phone +1... or accept request on web interface:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Unlock your phone +1... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 7
 == Pin code ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Enter your pin code:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Enter your pin code:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 2
 == Use a Login code ==
 Enter the code in the login page
@@ -2388,141 +2388,141 @@ https://ubuntu.com
   1. Wait for authentication result
   2. Regenerate code
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose action:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 8
 == Authentication code ==
   1. Proceed with Authentication code
   2. Resend SMS (1 sent)
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose action:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > invalid-selection
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 3
-== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com ==
+== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com ==
 Leave the input field empty to wait for the alternative authentication method or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-user-switching
--auth-mode-on-shared-sshd@gmail.com or enter the code:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-
+user-switching-auth-mode-with-shared-sshd@example.com or enter the code:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 4
 == Use your fido device foo ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Plug your fido device and press with your thumb:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Plug your fido device and press with your thumb:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 5
 == Use your phone +33... ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Unlock your phone +33... or accept request on web interface:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Unlock your phone +33... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 6
 == Use your phone +1... ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Unlock your phone +1... or accept request on web interface:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Unlock your phone +1... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 7
 == Pin code ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Enter your pin code:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Enter your pin code:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 2
 == Use a Login code ==
 Enter the code in the login page
@@ -2532,144 +2532,144 @@ https://ubuntu.com
   1. Wait for authentication result
   2. Regenerate code
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose action:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 8
 == Authentication code ==
   1. Proceed with Authentication code
   2. Resend SMS (1 sent)
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose action:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > invalid-selection
 Unsupported input
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 3
-== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com ==
+== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com ==
 Leave the input field empty to wait for the alternative authentication method or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-user-switching
--auth-mode-on-shared-sshd@gmail.com or enter the code:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-
+user-switching-auth-mode-with-shared-sshd@example.com or enter the code:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 4
 == Use your fido device foo ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Plug your fido device and press with your thumb:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Plug your fido device and press with your thumb:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 5
 == Use your phone +33... ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Unlock your phone +33... or accept request on web interface:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Unlock your phone +33... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 6
 == Use your phone +1... ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Unlock your phone +1... or accept request on web interface:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Unlock your phone +1... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 7
 == Pin code ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Enter your pin code:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Enter your pin code:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 2
 == Use a Login code ==
 Enter the code in the login page
@@ -2679,144 +2679,144 @@ https://ubuntu.com
   1. Wait for authentication result
   2. Regenerate code
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose action:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 8
 == Authentication code ==
   1. Proceed with Authentication code
   2. Resend SMS (1 sent)
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose action:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > invalid-selection
 Unsupported input
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > -1
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 3
-== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com ==
+== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com ==
 Leave the input field empty to wait for the alternative authentication method or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-user-switching
--auth-mode-on-shared-sshd@gmail.com or enter the code:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-
+user-switching-auth-mode-with-shared-sshd@example.com or enter the code:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 4
 == Use your fido device foo ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Plug your fido device and press with your thumb:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Plug your fido device and press with your thumb:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 5
 == Use your phone +33... ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Unlock your phone +33... or accept request on web interface:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Unlock your phone +33... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 6
 == Use your phone +1... ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Unlock your phone +1... or accept request on web interface:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Unlock your phone +1... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 7
 == Pin code ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Enter your pin code:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Enter your pin code:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 2
 == Use a Login code ==
 Enter the code in the login page
@@ -2826,157 +2826,157 @@ https://ubuntu.com
   1. Wait for authentication result
   2. Regenerate code
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose action:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 8
 == Authentication code ==
   1. Proceed with Authentication code
   2. Resend SMS (1 sent)
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose action:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > invalid-selection
 Unsupported input
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > -1
 Invalid selection
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 3
-== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com ==
+== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com ==
 Leave the input field empty to wait for the alternative authentication method or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-user-switching
--auth-mode-on-shared-sshd@gmail.com or enter the code:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-
+user-switching-auth-mode-with-shared-sshd@example.com or enter the code:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 4
 == Use your fido device foo ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Plug your fido device and press with your thumb:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Plug your fido device and press with your thumb:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 5
 == Use your phone +33... ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Unlock your phone +33... or accept request on web interface:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Unlock your phone +33... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 6
 == Use your phone +1... ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Unlock your phone +1... or accept request on web interface:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Unlock your phone +1... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 7
 == Pin code ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Enter your pin code:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Enter your pin code:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 2
 == Use a Login code ==
 Enter the code in the login page
@@ -2986,157 +2986,157 @@ https://ubuntu.com
   1. Wait for authentication result
   2. Regenerate code
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose action:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 8
 == Authentication code ==
   1. Proceed with Authentication code
   2. Resend SMS (1 sent)
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose action:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > invalid-selection
 Unsupported input
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > -1
 Invalid selection
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 7
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 3
-== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com ==
+== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com ==
 Leave the input field empty to wait for the alternative authentication method or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-user-switching
--auth-mode-on-shared-sshd@gmail.com or enter the code:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-
+user-switching-auth-mode-with-shared-sshd@example.com or enter the code:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 4
 == Use your fido device foo ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Plug your fido device and press with your thumb:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Plug your fido device and press with your thumb:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 5
 == Use your phone +33... ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Unlock your phone +33... or accept request on web interface:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Unlock your phone +33... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 6
 == Use your phone +1... ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Unlock your phone +1... or accept request on web interface:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Unlock your phone +1... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 7
 == Pin code ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Enter your pin code:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Enter your pin code:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 2
 == Use a Login code ==
 Enter the code in the login page
@@ -3146,161 +3146,161 @@ https://ubuntu.com
   1. Wait for authentication result
   2. Regenerate code
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose action:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 8
 == Authentication code ==
   1. Proceed with Authentication code
   2. Resend SMS (1 sent)
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose action:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > invalid-selection
 Unsupported input
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > -1
 Invalid selection
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 7
 == Pin code ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Enter your pin code:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Enter your pin code:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 3
-== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com ==
+== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com ==
 Leave the input field empty to wait for the alternative authentication method or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-user-switching
--auth-mode-on-shared-sshd@gmail.com or enter the code:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-
+user-switching-auth-mode-with-shared-sshd@example.com or enter the code:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 4
 == Use your fido device foo ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Plug your fido device and press with your thumb:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Plug your fido device and press with your thumb:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 5
 == Use your phone +33... ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Unlock your phone +33... or accept request on web interface:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Unlock your phone +33... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 6
 == Use your phone +1... ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Unlock your phone +1... or accept request on web interface:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Unlock your phone +1... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 7
 == Pin code ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Enter your pin code:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Enter your pin code:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 2
 == Use a Login code ==
 Enter the code in the login page
@@ -3310,161 +3310,161 @@ https://ubuntu.com
   1. Wait for authentication result
   2. Regenerate code
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose action:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 8
 == Authentication code ==
   1. Proceed with Authentication code
   2. Resend SMS (1 sent)
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose action:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > invalid-selection
 Unsupported input
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > -1
 Invalid selection
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 7
 == Pin code ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Enter your pin code:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Enter your pin code:
 > 4242
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 3
-== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com ==
+== Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com ==
 Leave the input field empty to wait for the alternative authentication method or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-user-switching
--auth-mode-on-shared-sshd@gmail.com or enter the code:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Click on the link received at user-integration-pre-check-ssh-authenticate-
+user-switching-auth-mode-with-shared-sshd@example.com or enter the code:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 4
 == Use your fido device foo ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Plug your fido device and press with your thumb:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Plug your fido device and press with your thumb:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 5
 == Use your phone +33... ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Unlock your phone +33... or accept request on web interface:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Unlock your phone +33... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 6
 == Use your phone +1... ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Unlock your phone +1... or accept request on web interface:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Unlock your phone +1... or accept request on web interface:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 7
 == Pin code ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Enter your pin code:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Enter your pin code:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 2
 == Use a Login code ==
 Enter the code in the login page
@@ -3474,63 +3474,63 @@ https://ubuntu.com
   1. Wait for authentication result
   2. Regenerate code
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose action:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 8
 == Authentication code ==
   1. Proceed with Authentication code
   2. Resend SMS (1 sent)
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose action:
 > r
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > invalid-selection
 Unsupported input
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > -1
 Invalid selection
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 7
 == Pin code ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd@localhost) Enter your pin code:
+(user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Enter your pin code:
 > 4242
-PAM Authenticate() finished for user 'user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd'
-PAM AcctMgmt() finished for user 'user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd'
+PAM Authenticate() finished for user 'user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com'
+PAM AcctMgmt() finished for user 'user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com'
  SSHD: Connected to ssh via authd module! [TestSSHAuthenticate]
   HOME=${AUTHD_TEST_HOME}
-  LOGNAME=user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd
+  LOGNAME=user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
   PATH=${AUTHD_TEST_PATH}
   PWD=${AUTHD_TEST_PWD}
   SHELL=/bin/sh
@@ -3538,7 +3538,7 @@ PAM AcctMgmt() finished for user 'user-integration-pre-check-ssh-authenticate-us
   SSH_CONNECTION=${AUTHD_TEST_SSH_CONNECTION}
   SSH_TTY=${AUTHD_TEST_SSH_TTY}
   TERM=xterm-256color
-  USER=user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-on-shared-sshd
+  USER=user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com
 Connection to localhost closed.
 >
 ────────────────────────────────────────────────────────────────────────────────
diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_switching_to_local_broker b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_switching_to_local_broker
index 278f4f6c2e..85083b919a 100644
--- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_switching_to_local_broker
+++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_switching_to_local_broker
@@ -2,302 +2,302 @@
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker@example.com@localhost) Choose your provider:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker@example.com@localhost) Choose your provider:
 > 2
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker@example.com@localhost) Gimme your password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker@example.com@localhost) Choose your authentication method:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker@example.com@localhost) Choose your authentication method:
 > r
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker@example.com@localhost) Choose your authentication method:
 > r
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker@example.com@localhost) Choose your provider:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker@example.com@localhost) Choose your authentication method:
 > r
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker@example.com@localhost) Choose your provider:
 > invalid-ID
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker@example.com@localhost) Choose your authentication method:
 > r
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker@example.com@localhost) Choose your provider:
 > invalid-ID
 Unsupported input
-(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker@example.com@localhost) Choose your provider:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker@example.com@localhost) Choose your authentication method:
 > r
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker@example.com@localhost) Choose your provider:
 > invalid-ID
 Unsupported input
-(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker@example.com@localhost) Choose your provider:
 > 555
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker@example.com@localhost) Choose your authentication method:
 > r
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker@example.com@localhost) Choose your provider:
 > invalid-ID
 Unsupported input
-(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker@example.com@localhost) Choose your provider:
 > 555
 Invalid selection
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker@example.com@localhost) Choose your provider:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker@example.com@localhost) Choose your authentication method:
 > r
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker@example.com@localhost) Choose your provider:
 > invalid-ID
 Unsupported input
-(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker@example.com@localhost) Choose your provider:
 > 555
 Invalid selection
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker@example.com@localhost) Choose your provider:
 > 1
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker@example.com@localhost) Choose your authentication method:
 > r
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker@example.com@localhost) Choose your provider:
 > invalid-ID
 Unsupported input
-(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker@example.com@localhost) Choose your provider:
 > 555
 Invalid selection
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker@example.com@localhost) Choose your provider:
 > 1
-PAM Authenticate() finished for user 'user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker'
-SSH PAM user 'user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker' using local broker
-(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker@localhost) Password:
+PAM Authenticate() finished for user 'user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker@example.com'
+SSH PAM user 'user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker@example.com' using local broker
+(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker@example.com@localhost) Password:
 ────────────────────────────────────────────────────────────────────────────────
diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_switching_to_local_broker_on_shared_SSHd b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_switching_to_local_broker_with_shared_sshd
similarity index 74%
rename from pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_switching_to_local_broker_on_shared_SSHd
rename to pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_switching_to_local_broker_with_shared_sshd
index 860f284d5a..847643d0c4 100644
--- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_switching_to_local_broker_on_shared_SSHd
+++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_switching_to_local_broker_with_shared_sshd
@@ -2,302 +2,302 @@
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker-with-shared-sshd@example.com@localhost) Choose your provider:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker-on-shared-sshd@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker-on-shared-sshd@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker-with-shared-sshd@example.com@localhost) Choose your authentication method:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker-on-shared-sshd@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > r
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker-on-shared-sshd@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > r
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker-with-shared-sshd@example.com@localhost) Choose your provider:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker-on-shared-sshd@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > r
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker-with-shared-sshd@example.com@localhost) Choose your provider:
 > invalid-ID
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker-on-shared-sshd@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > r
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker-with-shared-sshd@example.com@localhost) Choose your provider:
 > invalid-ID
 Unsupported input
-(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker-with-shared-sshd@example.com@localhost) Choose your provider:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker-on-shared-sshd@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > r
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker-with-shared-sshd@example.com@localhost) Choose your provider:
 > invalid-ID
 Unsupported input
-(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker-with-shared-sshd@example.com@localhost) Choose your provider:
 > 555
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker-on-shared-sshd@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > r
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker-with-shared-sshd@example.com@localhost) Choose your provider:
 > invalid-ID
 Unsupported input
-(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker-with-shared-sshd@example.com@localhost) Choose your provider:
 > 555
 Invalid selection
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker-with-shared-sshd@example.com@localhost) Choose your provider:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker-on-shared-sshd@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > r
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker-with-shared-sshd@example.com@localhost) Choose your provider:
 > invalid-ID
 Unsupported input
-(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker-with-shared-sshd@example.com@localhost) Choose your provider:
 > 555
 Invalid selection
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker-with-shared-sshd@example.com@localhost) Choose your provider:
 > 1
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker-on-shared-sshd@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > r
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker-with-shared-sshd@example.com@localhost) Choose your provider:
 > invalid-ID
 Unsupported input
-(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker-with-shared-sshd@example.com@localhost) Choose your provider:
 > 555
 Invalid selection
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker-with-shared-sshd@example.com@localhost) Choose your provider:
 > 1
-PAM Authenticate() finished for user 'user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker-on-shared-sshd'
-SSH PAM user 'user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker-on-shared-sshd' using local broker
-(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker-on-shared-sshd@localhost) Password:
+PAM Authenticate() finished for user 'user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker-with-shared-sshd@example.com'
+SSH PAM user 'user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker-with-shared-sshd@example.com' using local broker
+(user-integration-pre-check-ssh-authenticate-user-switching-to-local-broker-with-shared-sshd@example.com@localhost) Password:
 ────────────────────────────────────────────────────────────────────────────────
diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_form_mode_with_button b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_form_mode_with_button
index 3133464fe6..1fe530ad41 100644
--- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_form_mode_with_button
+++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_form_mode_with_button
@@ -2,330 +2,330 @@
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button@example.com@localhost) Choose your provider:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button@example.com@localhost) Choose your provider:
 > 2
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button@example.com@localhost) Gimme your password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button@example.com@localhost) Choose your authentication method:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button@example.com@localhost) Choose your authentication method:
 > 8
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button@example.com@localhost) Choose your authentication method:
 > 8
 == Authentication code ==
   1. Proceed with Authentication code
   2. Resend SMS (1 sent)
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button@example.com@localhost) Choose action:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button@example.com@localhost) Choose your authentication method:
 > 8
 == Authentication code ==
   1. Proceed with Authentication code
   2. Resend SMS (1 sent)
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button@example.com@localhost) Choose action:
 > 2
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button@example.com@localhost) Choose your authentication method:
 > 8
 == Authentication code ==
   1. Proceed with Authentication code
   2. Resend SMS (1 sent)
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button@example.com@localhost) Choose action:
 > 2
 == Authentication code ==
   1. Proceed with Authentication code
   2. Resend SMS (2 sent)
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button@example.com@localhost) Choose action:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button@example.com@localhost) Choose your authentication method:
 > 8
 == Authentication code ==
   1. Proceed with Authentication code
   2. Resend SMS (1 sent)
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button@example.com@localhost) Choose action:
 > 2
 == Authentication code ==
   1. Proceed with Authentication code
   2. Resend SMS (2 sent)
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button@example.com@localhost) Choose action:
 > 1
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button@example.com@localhost) Choose your authentication method:
 > 8
 == Authentication code ==
   1. Proceed with Authentication code
   2. Resend SMS (1 sent)
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button@example.com@localhost) Choose action:
 > 2
 == Authentication code ==
   1. Proceed with Authentication code
   2. Resend SMS (2 sent)
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button@example.com@localhost) Choose action:
 > 1
 == Authentication code ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button@localhost) Enter your one time credential:
+(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button@example.com@localhost) Enter your one time credential:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button@example.com@localhost) Choose your authentication method:
 > 8
 == Authentication code ==
   1. Proceed with Authentication code
   2. Resend SMS (1 sent)
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button@example.com@localhost) Choose action:
 > 2
 == Authentication code ==
   1. Proceed with Authentication code
   2. Resend SMS (2 sent)
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button@example.com@localhost) Choose action:
 > 1
 == Authentication code ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button@localhost) Enter your one time credential:
+(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button@example.com@localhost) Enter your one time credential:
 > temporary pass00
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button@example.com@localhost) Choose your authentication method:
 > 8
 == Authentication code ==
   1. Proceed with Authentication code
   2. Resend SMS (1 sent)
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button@example.com@localhost) Choose action:
 > 2
 == Authentication code ==
   1. Proceed with Authentication code
   2. Resend SMS (2 sent)
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button@example.com@localhost) Choose action:
 > 1
 == Authentication code ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button@localhost) Enter your one time credential:
+(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button@example.com@localhost) Enter your one time credential:
 > temporary pass00
-PAM Authenticate() finished for user 'user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button'
-PAM AcctMgmt() finished for user 'user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button'
-Environment:
-  USER=user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button
-  LOGNAME=user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button
+PAM Authenticate() finished for user 'user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button@example.com'
+PAM AcctMgmt() finished for user 'user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button@example.com'
+ SSHD: Connected to ssh via authd module! [TestSSHAuthenticate/Authenticate_user_with_form_mode_with_button]
   HOME=${AUTHD_TEST_HOME}
+  LOGNAME=user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button@example.com
   PATH=${AUTHD_TEST_PATH}
+  PWD=${AUTHD_TEST_PWD}
   SHELL=/bin/sh
-  TERM=xterm-256color
   SSH_CLIENT=${AUTHD_TEST_SSH_CLIENT}
   SSH_CONNECTION=${AUTHD_TEST_SSH_CONNECTION}
   SSH_TTY=${AUTHD_TEST_SSH_TTY}
- SSHD: Connected to ssh via authd module! [TestSSHAuthenticate/Authenticate_user_with_form_mode_with_button]
+  TERM=xterm-256color
+  USER=user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button@example.com
 Connection to localhost closed.
 >
 ────────────────────────────────────────────────────────────────────────────────
diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_form_mode_with_button_on_shared_SSHd b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_form_mode_with_button_with_shared_sshd
similarity index 76%
rename from pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_form_mode_with_button_on_shared_SSHd
rename to pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_form_mode_with_button_with_shared_sshd
index d124c366a1..660e9869a4 100644
--- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_form_mode_with_button_on_shared_SSHd
+++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_form_mode_with_button_with_shared_sshd
@@ -2,322 +2,322 @@
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button-with-shared-sshd@example.com@localhost) Choose your provider:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button-on-shared-sshd@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button-on-shared-sshd@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button-with-shared-sshd@example.com@localhost) Choose your authentication method:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button-on-shared-sshd@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 8
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button-on-shared-sshd@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 8
 == Authentication code ==
   1. Proceed with Authentication code
   2. Resend SMS (1 sent)
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button-on-shared-sshd@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button-with-shared-sshd@example.com@localhost) Choose action:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button-on-shared-sshd@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 8
 == Authentication code ==
   1. Proceed with Authentication code
   2. Resend SMS (1 sent)
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button-on-shared-sshd@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button-with-shared-sshd@example.com@localhost) Choose action:
 > 2
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button-on-shared-sshd@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 8
 == Authentication code ==
   1. Proceed with Authentication code
   2. Resend SMS (1 sent)
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button-on-shared-sshd@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button-with-shared-sshd@example.com@localhost) Choose action:
 > 2
 == Authentication code ==
   1. Proceed with Authentication code
   2. Resend SMS (2 sent)
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button-on-shared-sshd@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button-with-shared-sshd@example.com@localhost) Choose action:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button-on-shared-sshd@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 8
 == Authentication code ==
   1. Proceed with Authentication code
   2. Resend SMS (1 sent)
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button-on-shared-sshd@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button-with-shared-sshd@example.com@localhost) Choose action:
 > 2
 == Authentication code ==
   1. Proceed with Authentication code
   2. Resend SMS (2 sent)
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button-on-shared-sshd@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button-with-shared-sshd@example.com@localhost) Choose action:
 > 1
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button-on-shared-sshd@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 8
 == Authentication code ==
   1. Proceed with Authentication code
   2. Resend SMS (1 sent)
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button-on-shared-sshd@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button-with-shared-sshd@example.com@localhost) Choose action:
 > 2
 == Authentication code ==
   1. Proceed with Authentication code
   2. Resend SMS (2 sent)
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button-on-shared-sshd@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button-with-shared-sshd@example.com@localhost) Choose action:
 > 1
 == Authentication code ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button-on-shared-sshd@localhost) Enter your one time credential:
+(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button-with-shared-sshd@example.com@localhost) Enter your one time credential:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button-on-shared-sshd@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 8
 == Authentication code ==
   1. Proceed with Authentication code
   2. Resend SMS (1 sent)
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button-on-shared-sshd@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button-with-shared-sshd@example.com@localhost) Choose action:
 > 2
 == Authentication code ==
   1. Proceed with Authentication code
   2. Resend SMS (2 sent)
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button-on-shared-sshd@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button-with-shared-sshd@example.com@localhost) Choose action:
 > 1
 == Authentication code ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button-on-shared-sshd@localhost) Enter your one time credential:
+(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button-with-shared-sshd@example.com@localhost) Enter your one time credential:
 > temporary pass00
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button-on-shared-sshd@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 8
 == Authentication code ==
   1. Proceed with Authentication code
   2. Resend SMS (1 sent)
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button-on-shared-sshd@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button-with-shared-sshd@example.com@localhost) Choose action:
 > 2
 == Authentication code ==
   1. Proceed with Authentication code
   2. Resend SMS (2 sent)
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button-on-shared-sshd@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button-with-shared-sshd@example.com@localhost) Choose action:
 > 1
 == Authentication code ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button-on-shared-sshd@localhost) Enter your one time credential:
+(user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button-with-shared-sshd@example.com@localhost) Enter your one time credential:
 > temporary pass00
-PAM Authenticate() finished for user 'user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button-on-shared-sshd'
-PAM AcctMgmt() finished for user 'user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button-on-shared-sshd'
+PAM Authenticate() finished for user 'user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button-with-shared-sshd@example.com'
+PAM AcctMgmt() finished for user 'user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button-with-shared-sshd@example.com'
  SSHD: Connected to ssh via authd module! [TestSSHAuthenticate]
   HOME=${AUTHD_TEST_HOME}
-  LOGNAME=user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button-on-shared-sshd
+  LOGNAME=user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button-with-shared-sshd@example.com
   PATH=${AUTHD_TEST_PATH}
   PWD=${AUTHD_TEST_PWD}
   SHELL=/bin/sh
@@ -325,7 +325,7 @@ PAM AcctMgmt() finished for user 'user-integration-pre-check-ssh-authenticate-us
   SSH_CONNECTION=${AUTHD_TEST_SSH_CONNECTION}
   SSH_TTY=${AUTHD_TEST_SSH_TTY}
   TERM=xterm-256color
-  USER=user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button-on-shared-sshd
+  USER=user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button-with-shared-sshd@example.com
 Connection to localhost closed.
 >
 ────────────────────────────────────────────────────────────────────────────────
diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_mfa b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_mfa
index 616e92c3e1..434d0a295f 100644
--- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_mfa
+++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_mfa
@@ -2,489 +2,489 @@
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@localhost) Choose your provider:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@example.com@localhost) Choose your provider:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@localhost) Choose your provider:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@example.com@localhost) Choose your provider:
 > 2
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@localhost) Choose your provider:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@localhost) Gimme your password:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@example.com@localhost) Gimme your password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@localhost) Choose your provider:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@localhost) Gimme your password:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@gmail.com
+  3. Send URL to user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@localhost) Choose your authentication method:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@example.com@localhost) Choose your authentication method:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@localhost) Choose your provider:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@localhost) Gimme your password:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@gmail.com
+  3. Send URL to user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@localhost) Choose your authentication method:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@example.com@localhost) Choose your authentication method:
 > 1
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@localhost) Gimme your password:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@example.com@localhost) Gimme your password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@localhost) Choose your provider:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@localhost) Gimme your password:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@gmail.com
+  3. Send URL to user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@localhost) Choose your authentication method:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@example.com@localhost) Choose your authentication method:
 > 1
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@localhost) Gimme your password:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@example.com@localhost) Gimme your password:
 >
 == Use your fido device foo ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@localhost) Plug your fido device and press with your thumb:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@example.com@localhost) Plug your fido device and press with your thumb:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@localhost) Choose your provider:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@localhost) Gimme your password:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@gmail.com
+  3. Send URL to user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@localhost) Choose your authentication method:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@example.com@localhost) Choose your authentication method:
 > 1
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@localhost) Gimme your password:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@example.com@localhost) Gimme your password:
 >
 == Use your fido device foo ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@localhost) Plug your fido device and press with your thumb:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@example.com@localhost) Plug your fido device and press with your thumb:
 > r
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@localhost) Choose your provider:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@localhost) Gimme your password:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@gmail.com
+  3. Send URL to user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@localhost) Choose your authentication method:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@example.com@localhost) Choose your authentication method:
 > 1
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@localhost) Gimme your password:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@example.com@localhost) Gimme your password:
 >
 == Use your fido device foo ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@localhost) Plug your fido device and press with your thumb:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@example.com@localhost) Plug your fido device and press with your thumb:
 > r
 == Authentication method selection ==
   1. Use your fido device foo
   2. Use your phone +33...
   3. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@localhost) Choose your authentication method:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@example.com@localhost) Choose your authentication method:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@localhost) Choose your provider:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@localhost) Gimme your password:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@gmail.com
+  3. Send URL to user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@localhost) Choose your authentication method:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@example.com@localhost) Choose your authentication method:
 > 1
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@localhost) Gimme your password:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@example.com@localhost) Gimme your password:
 >
 == Use your fido device foo ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@localhost) Plug your fido device and press with your thumb:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@example.com@localhost) Plug your fido device and press with your thumb:
 > r
 == Authentication method selection ==
   1. Use your fido device foo
   2. Use your phone +33...
   3. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@localhost) Choose your authentication method:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@example.com@localhost) Choose your authentication method:
 > 1
 == Use your fido device foo ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@localhost) Plug your fido device and press with your thumb:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@example.com@localhost) Plug your fido device and press with your thumb:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@localhost) Choose your provider:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@localhost) Gimme your password:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@gmail.com
+  3. Send URL to user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@localhost) Choose your authentication method:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@example.com@localhost) Choose your authentication method:
 > 1
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@localhost) Gimme your password:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@example.com@localhost) Gimme your password:
 >
 == Use your fido device foo ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@localhost) Plug your fido device and press with your thumb:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@example.com@localhost) Plug your fido device and press with your thumb:
 > r
 == Authentication method selection ==
   1. Use your fido device foo
   2. Use your phone +33...
   3. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@localhost) Choose your authentication method:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@example.com@localhost) Choose your authentication method:
 > 1
 == Use your fido device foo ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@localhost) Plug your fido device and press with your thumb:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@example.com@localhost) Plug your fido device and press with your thumb:
 > r
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@localhost) Choose your provider:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@localhost) Gimme your password:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@gmail.com
+  3. Send URL to user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@localhost) Choose your authentication method:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@example.com@localhost) Choose your authentication method:
 > 1
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@localhost) Gimme your password:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@example.com@localhost) Gimme your password:
 >
 == Use your fido device foo ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@localhost) Plug your fido device and press with your thumb:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@example.com@localhost) Plug your fido device and press with your thumb:
 > r
 == Authentication method selection ==
   1. Use your fido device foo
   2. Use your phone +33...
   3. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@localhost) Choose your authentication method:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@example.com@localhost) Choose your authentication method:
 > 1
 == Use your fido device foo ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@localhost) Plug your fido device and press with your thumb:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@example.com@localhost) Plug your fido device and press with your thumb:
 > r
 == Authentication method selection ==
   1. Use your fido device foo
   2. Use your phone +33...
   3. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@localhost) Choose your authentication method:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@example.com@localhost) Choose your authentication method:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@localhost) Choose your provider:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@localhost) Gimme your password:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@gmail.com
+  3. Send URL to user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@localhost) Choose your authentication method:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@example.com@localhost) Choose your authentication method:
 > 1
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@localhost) Gimme your password:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@example.com@localhost) Gimme your password:
 >
 == Use your fido device foo ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@localhost) Plug your fido device and press with your thumb:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@example.com@localhost) Plug your fido device and press with your thumb:
 > r
 == Authentication method selection ==
   1. Use your fido device foo
   2. Use your phone +33...
   3. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@localhost) Choose your authentication method:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@example.com@localhost) Choose your authentication method:
 > 1
 == Use your fido device foo ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@localhost) Plug your fido device and press with your thumb:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@example.com@localhost) Plug your fido device and press with your thumb:
 > r
 == Authentication method selection ==
   1. Use your fido device foo
   2. Use your phone +33...
   3. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@localhost) Choose your authentication method:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@example.com@localhost) Choose your authentication method:
 > 2
 == Use your phone +33... ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@localhost) Unlock your phone +33... or accept request on web interface:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@example.com@localhost) Unlock your phone +33... or accept request on web interface:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@localhost) Choose your provider:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@localhost) Gimme your password:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@gmail.com
+  3. Send URL to user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@localhost) Choose your authentication method:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@example.com@localhost) Choose your authentication method:
 > 1
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@localhost) Gimme your password:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@example.com@localhost) Gimme your password:
 >
 == Use your fido device foo ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@localhost) Plug your fido device and press with your thumb:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@example.com@localhost) Plug your fido device and press with your thumb:
 > r
 == Authentication method selection ==
   1. Use your fido device foo
   2. Use your phone +33...
   3. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@localhost) Choose your authentication method:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@example.com@localhost) Choose your authentication method:
 > 1
 == Use your fido device foo ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@localhost) Plug your fido device and press with your thumb:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@example.com@localhost) Plug your fido device and press with your thumb:
 > r
 == Authentication method selection ==
   1. Use your fido device foo
   2. Use your phone +33...
   3. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@localhost) Choose your authentication method:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@example.com@localhost) Choose your authentication method:
 > 2
 == Use your phone +33... ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@localhost) Unlock your phone +33... or accept request on web interface:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@example.com@localhost) Unlock your phone +33... or accept request on web interface:
 >
 == Use your fido device foo ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@localhost) Plug your fido device and press with your thumb:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@example.com@localhost) Plug your fido device and press with your thumb:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@localhost) Choose your provider:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@localhost) Gimme your password:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@gmail.com
+  3. Send URL to user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@localhost) Choose your authentication method:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@example.com@localhost) Choose your authentication method:
 > 1
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@localhost) Gimme your password:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@example.com@localhost) Gimme your password:
 >
 == Use your fido device foo ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@localhost) Plug your fido device and press with your thumb:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@example.com@localhost) Plug your fido device and press with your thumb:
 > r
 == Authentication method selection ==
   1. Use your fido device foo
   2. Use your phone +33...
   3. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@localhost) Choose your authentication method:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@example.com@localhost) Choose your authentication method:
 > 1
 == Use your fido device foo ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@localhost) Plug your fido device and press with your thumb:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@example.com@localhost) Plug your fido device and press with your thumb:
 > r
 == Authentication method selection ==
   1. Use your fido device foo
   2. Use your phone +33...
   3. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@localhost) Choose your authentication method:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@example.com@localhost) Choose your authentication method:
 > 2
 == Use your phone +33... ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@localhost) Unlock your phone +33... or accept request on web interface:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@example.com@localhost) Unlock your phone +33... or accept request on web interface:
 >
 == Use your fido device foo ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@localhost) Plug your fido device and press with your thumb:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@example.com@localhost) Plug your fido device and press with your thumb:
 >
-PAM Authenticate() finished for user 'user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa'
-PAM AcctMgmt() finished for user 'user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa'
-Environment:
-  USER=user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa
-  LOGNAME=user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa
+PAM Authenticate() finished for user 'user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@example.com'
+PAM AcctMgmt() finished for user 'user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@example.com'
+ SSHD: Connected to ssh via authd module! [TestSSHAuthenticate/Authenticate_user_with_mfa]
   HOME=${AUTHD_TEST_HOME}
+  LOGNAME=user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@example.com
   PATH=${AUTHD_TEST_PATH}
+  PWD=${AUTHD_TEST_PWD}
   SHELL=/bin/sh
-  TERM=xterm-256color
   SSH_CLIENT=${AUTHD_TEST_SSH_CLIENT}
   SSH_CONNECTION=${AUTHD_TEST_SSH_CONNECTION}
   SSH_TTY=${AUTHD_TEST_SSH_TTY}
- SSHD: Connected to ssh via authd module! [TestSSHAuthenticate/Authenticate_user_with_mfa]
+  TERM=xterm-256color
+  USER=user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@example.com
 Connection to localhost closed.
 >
 ────────────────────────────────────────────────────────────────────────────────
diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_mfa_and_reset_password_while_enforcing_policy b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_mfa_and_reset_password_while_enforcing_policy
index 4b5d1d7fc1..e208075afc 100644
--- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_mfa_and_reset_password_while_enforcing_policy
+++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_mfa_and_reset_password_while_enforcing_policy
@@ -2,384 +2,275 @@
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy@localhost) Choose your provider:
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy@example.com@localhost) Choose your provider:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy@localhost) Choose your provider:
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy@example.com@localhost) Choose your provider:
 > 2
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy@localhost) Choose your provider:
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy@localhost) Gimme your password:
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy@example.com@localhost) Gimme your password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy@localhost) Choose your provider:
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy@localhost) Gimme your password:
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy@example.com@localhost) Gimme your password:
 >
 Password reset, 2 step(s) missing
 == Use your fido device foo ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy@localhost) Plug your fido device and press with your thumb:
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy@example.com@localhost) Plug your fido device and press with your thumb:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy@localhost) Choose your provider:
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy@localhost) Gimme your password:
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy@example.com@localhost) Gimme your password:
 >
 Password reset, 2 step(s) missing
 == Use your fido device foo ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy@localhost) Plug your fido device and press with your thumb:
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy@example.com@localhost) Plug your fido device and press with your thumb:
 >
 Password reset, 1 step(s) missing
 == Password reset ==
   1. Proceed with password update
   2. Skip
 Or enter 'r' to go back to choose the provider
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy@localhost) Choose action:
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy@example.com@localhost) Choose action:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy@localhost) Choose your provider:
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy@localhost) Gimme your password:
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy@example.com@localhost) Gimme your password:
 >
 Password reset, 2 step(s) missing
 == Use your fido device foo ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy@localhost) Plug your fido device and press with your thumb:
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy@example.com@localhost) Plug your fido device and press with your thumb:
 >
 Password reset, 1 step(s) missing
 == Password reset ==
   1. Proceed with password update
   2. Skip
 Or enter 'r' to go back to choose the provider
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy@localhost) Choose action:
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy@example.com@localhost) Choose action:
 > 1
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy@localhost) Choose your provider:
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy@localhost) Gimme your password:
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy@example.com@localhost) Gimme your password:
 >
 Password reset, 2 step(s) missing
 == Use your fido device foo ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy@localhost) Plug your fido device and press with your thumb:
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy@example.com@localhost) Plug your fido device and press with your thumb:
 >
 Password reset, 1 step(s) missing
 == Password reset ==
   1. Proceed with password update
   2. Skip
 Or enter 'r' to go back to choose the provider
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy@localhost) Choose action:
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy@example.com@localhost) Choose action:
 > 1
 == Password reset ==
 Enter 'r' to cancel the request and go back to choose the provider
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy@localhost) Enter your new password (3 days until mandatory):
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy@example.com@localhost) Enter your new password (3 days until mandatory):
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy@localhost) Choose your provider:
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy@localhost) Gimme your password:
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy@example.com@localhost) Gimme your password:
 >
 Password reset, 2 step(s) missing
 == Use your fido device foo ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy@localhost) Plug your fido device and press with your thumb:
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy@example.com@localhost) Plug your fido device and press with your thumb:
 >
 Password reset, 1 step(s) missing
 == Password reset ==
   1. Proceed with password update
   2. Skip
 Or enter 'r' to go back to choose the provider
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy@localhost) Choose action:
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy@example.com@localhost) Choose action:
 > 1
 == Password reset ==
 Enter 'r' to cancel the request and go back to choose the provider
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy@localhost) Enter your new password (3 days until mandatory):
->
-The password is the same as the old one
-== Password reset ==
-Enter 'r' to cancel the request and go back to choose the provider
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy@localhost) Enter your new password (3 days until mandatory):
->
-────────────────────────────────────────────────────────────────────────────────
-> ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
-== Provider selection ==
-  1. local
-  2. ExampleBroker
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy@localhost) Choose your provider:
-> 2
-== Password authentication ==
-Enter 'r' to cancel the request and go back to select the authentication method
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy@localhost) Gimme your password:
->
-Password reset, 2 step(s) missing
-== Use your fido device foo ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy@localhost) Plug your fido device and press with your thumb:
->
-Password reset, 1 step(s) missing
-== Password reset ==
-  1. Proceed with password update
-  2. Skip
-Or enter 'r' to go back to choose the provider
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy@localhost) Choose action:
-> 1
-== Password reset ==
-Enter 'r' to cancel the request and go back to choose the provider
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy@localhost) Enter your new password (3 days until mandatory):
->
-The password is the same as the old one
-== Password reset ==
-Enter 'r' to cancel the request and go back to choose the provider
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy@localhost) Enter your new password (3 days until mandatory):
->
-The password fails the dictionary check - it is based on a dictionary word
-== Password reset ==
-Enter 'r' to cancel the request and go back to choose the provider
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy@localhost) Enter your new password (3 days until mandatory):
->
-────────────────────────────────────────────────────────────────────────────────
-> ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
-== Provider selection ==
-  1. local
-  2. ExampleBroker
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy@localhost) Choose your provider:
-> 2
-== Password authentication ==
-Enter 'r' to cancel the request and go back to select the authentication method
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy@localhost) Gimme your password:
->
-Password reset, 2 step(s) missing
-== Use your fido device foo ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy@localhost) Plug your fido device and press with your thumb:
->
-Password reset, 1 step(s) missing
-== Password reset ==
-  1. Proceed with password update
-  2. Skip
-Or enter 'r' to go back to choose the provider
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy@localhost) Choose action:
-> 1
-== Password reset ==
-Enter 'r' to cancel the request and go back to choose the provider
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy@localhost) Enter your new password (3 days until mandatory):
->
-The password is the same as the old one
-== Password reset ==
-Enter 'r' to cancel the request and go back to choose the provider
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy@localhost) Enter your new password (3 days until mandatory):
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy@example.com@localhost) Enter your new password (3 days until mandatory):
 >
 The password fails the dictionary check - it is based on a dictionary word
 == Password reset ==
 Enter 'r' to cancel the request and go back to choose the provider
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy@localhost) Enter your new password (3 days until mandatory):
->
-The password is the same as the old one
-== Password reset ==
-Enter 'r' to cancel the request and go back to choose the provider
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy@localhost) Enter your new password (3 days until mandatory):
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy@example.com@localhost) Enter your new password (3 days until mandatory):
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy@localhost) Choose your provider:
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy@localhost) Gimme your password:
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy@example.com@localhost) Gimme your password:
 >
 Password reset, 2 step(s) missing
 == Use your fido device foo ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy@localhost) Plug your fido device and press with your thumb:
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy@example.com@localhost) Plug your fido device and press with your thumb:
 >
 Password reset, 1 step(s) missing
 == Password reset ==
   1. Proceed with password update
   2. Skip
 Or enter 'r' to go back to choose the provider
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy@localhost) Choose action:
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy@example.com@localhost) Choose action:
 > 1
 == Password reset ==
 Enter 'r' to cancel the request and go back to choose the provider
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy@localhost) Enter your new password (3 days until mandatory):
->
-The password is the same as the old one
-== Password reset ==
-Enter 'r' to cancel the request and go back to choose the provider
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy@localhost) Enter your new password (3 days until mandatory):
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy@example.com@localhost) Enter your new password (3 days until mandatory):
 >
 The password fails the dictionary check - it is based on a dictionary word
 == Password reset ==
 Enter 'r' to cancel the request and go back to choose the provider
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy@localhost) Enter your new password (3 days until mandatory):
->
-The password is the same as the old one
-== Password reset ==
-Enter 'r' to cancel the request and go back to choose the provider
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy@localhost) Enter your new password (3 days until mandatory):
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy@example.com@localhost) Enter your new password (3 days until mandatory):
 >
 The password is shorter than 8 characters
 == Password reset ==
 Enter 'r' to cancel the request and go back to choose the provider
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy@localhost) Enter your new password (3 days until mandatory):
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy@example.com@localhost) Enter your new password (3 days until mandatory):
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy@localhost) Choose your provider:
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy@localhost) Gimme your password:
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy@example.com@localhost) Gimme your password:
 >
 Password reset, 2 step(s) missing
 == Use your fido device foo ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy@localhost) Plug your fido device and press with your thumb:
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy@example.com@localhost) Plug your fido device and press with your thumb:
 >
 Password reset, 1 step(s) missing
 == Password reset ==
   1. Proceed with password update
   2. Skip
 Or enter 'r' to go back to choose the provider
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy@localhost) Choose action:
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy@example.com@localhost) Choose action:
 > 1
 == Password reset ==
 Enter 'r' to cancel the request and go back to choose the provider
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy@localhost) Enter your new password (3 days until mandatory):
->
-The password is the same as the old one
-== Password reset ==
-Enter 'r' to cancel the request and go back to choose the provider
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy@localhost) Enter your new password (3 days until mandatory):
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy@example.com@localhost) Enter your new password (3 days until mandatory):
 >
 The password fails the dictionary check - it is based on a dictionary word
 == Password reset ==
 Enter 'r' to cancel the request and go back to choose the provider
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy@localhost) Enter your new password (3 days until mandatory):
->
-The password is the same as the old one
-== Password reset ==
-Enter 'r' to cancel the request and go back to choose the provider
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy@localhost) Enter your new password (3 days until mandatory):
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy@example.com@localhost) Enter your new password (3 days until mandatory):
 >
 The password is shorter than 8 characters
 == Password reset ==
 Enter 'r' to cancel the request and go back to choose the provider
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy@localhost) Enter your new password (3 days until mandatory):
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy@example.com@localhost) Enter your new password (3 days until mandatory):
 >
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy@localhost) Confirm Password:
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy@example.com@localhost) Confirm Password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy@localhost) Choose your provider:
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy@localhost) Gimme your password:
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy@example.com@localhost) Gimme your password:
 >
 Password reset, 2 step(s) missing
 == Use your fido device foo ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy@localhost) Plug your fido device and press with your thumb:
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy@example.com@localhost) Plug your fido device and press with your thumb:
 >
 Password reset, 1 step(s) missing
 == Password reset ==
   1. Proceed with password update
   2. Skip
 Or enter 'r' to go back to choose the provider
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy@localhost) Choose action:
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy@example.com@localhost) Choose action:
 > 1
 == Password reset ==
 Enter 'r' to cancel the request and go back to choose the provider
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy@localhost) Enter your new password (3 days until mandatory):
->
-The password is the same as the old one
-== Password reset ==
-Enter 'r' to cancel the request and go back to choose the provider
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy@localhost) Enter your new password (3 days until mandatory):
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy@example.com@localhost) Enter your new password (3 days until mandatory):
 >
 The password fails the dictionary check - it is based on a dictionary word
 == Password reset ==
 Enter 'r' to cancel the request and go back to choose the provider
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy@localhost) Enter your new password (3 days until mandatory):
->
-The password is the same as the old one
-== Password reset ==
-Enter 'r' to cancel the request and go back to choose the provider
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy@localhost) Enter your new password (3 days until mandatory):
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy@example.com@localhost) Enter your new password (3 days until mandatory):
 >
 The password is shorter than 8 characters
 == Password reset ==
 Enter 'r' to cancel the request and go back to choose the provider
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy@localhost) Enter your new password (3 days until mandatory):
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy@example.com@localhost) Enter your new password (3 days until mandatory):
 >
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy@localhost) Confirm Password:
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy@example.com@localhost) Confirm Password:
 >
-PAM Authenticate() finished for user 'user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy'
-PAM AcctMgmt() finished for user 'user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy'
-Environment:
-  USER=user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy
-  LOGNAME=user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy
+PAM Authenticate() finished for user 'user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy@example.com'
+PAM AcctMgmt() finished for user 'user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy@example.com'
+ SSHD: Connected to ssh via authd module! [TestSSHAuthenticate/Authenticate_user_with_mfa_and_reset_password_while_enforcing_policy]
   HOME=${AUTHD_TEST_HOME}
+  LOGNAME=user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy@example.com
   PATH=${AUTHD_TEST_PATH}
+  PWD=${AUTHD_TEST_PWD}
   SHELL=/bin/sh
-  TERM=xterm-256color
   SSH_CLIENT=${AUTHD_TEST_SSH_CLIENT}
   SSH_CONNECTION=${AUTHD_TEST_SSH_CONNECTION}
   SSH_TTY=${AUTHD_TEST_SSH_TTY}
- SSHD: Connected to ssh via authd module! [TestSSHAuthenticate/Authenticate_user_with_mfa_and_reset_password_while_enforcing_policy]
+  TERM=xterm-256color
+  USER=user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy@example.com
 Connection to localhost closed.
 >
 ────────────────────────────────────────────────────────────────────────────────
diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_mfa_and_reset_password_while_enforcing_policy_on_shared_SSHd b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_mfa_and_reset_password_while_enforcing_policy_with_shared_sshd
similarity index 50%
rename from pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_mfa_and_reset_password_while_enforcing_policy_on_shared_SSHd
rename to pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_mfa_and_reset_password_while_enforcing_policy_with_shared_sshd
index 29a0274157..5804fac7c8 100644
--- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_mfa_and_reset_password_while_enforcing_policy_on_shared_SSHd
+++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_mfa_and_reset_password_while_enforcing_policy_with_shared_sshd
@@ -2,376 +2,267 @@
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-on-shared-sshd@localhost) Choose your provider:
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-with-shared-sshd@example.com@localhost) Choose your provider:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-on-shared-sshd@localhost) Choose your provider:
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-on-shared-sshd@localhost) Choose your provider:
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-on-shared-sshd@localhost) Gimme your password:
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-on-shared-sshd@localhost) Choose your provider:
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-on-shared-sshd@localhost) Gimme your password:
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 Password reset, 2 step(s) missing
 == Use your fido device foo ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-on-shared-sshd@localhost) Plug your fido device and press with your thumb:
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-with-shared-sshd@example.com@localhost) Plug your fido device and press with your thumb:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-on-shared-sshd@localhost) Choose your provider:
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-on-shared-sshd@localhost) Gimme your password:
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 Password reset, 2 step(s) missing
 == Use your fido device foo ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-on-shared-sshd@localhost) Plug your fido device and press with your thumb:
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-with-shared-sshd@example.com@localhost) Plug your fido device and press with your thumb:
 >
 Password reset, 1 step(s) missing
 == Password reset ==
   1. Proceed with password update
   2. Skip
 Or enter 'r' to go back to choose the provider
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-on-shared-sshd@localhost) Choose action:
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-with-shared-sshd@example.com@localhost) Choose action:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-on-shared-sshd@localhost) Choose your provider:
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-on-shared-sshd@localhost) Gimme your password:
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 Password reset, 2 step(s) missing
 == Use your fido device foo ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-on-shared-sshd@localhost) Plug your fido device and press with your thumb:
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-with-shared-sshd@example.com@localhost) Plug your fido device and press with your thumb:
 >
 Password reset, 1 step(s) missing
 == Password reset ==
   1. Proceed with password update
   2. Skip
 Or enter 'r' to go back to choose the provider
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-on-shared-sshd@localhost) Choose action:
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-with-shared-sshd@example.com@localhost) Choose action:
 > 1
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-on-shared-sshd@localhost) Choose your provider:
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-on-shared-sshd@localhost) Gimme your password:
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 Password reset, 2 step(s) missing
 == Use your fido device foo ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-on-shared-sshd@localhost) Plug your fido device and press with your thumb:
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-with-shared-sshd@example.com@localhost) Plug your fido device and press with your thumb:
 >
 Password reset, 1 step(s) missing
 == Password reset ==
   1. Proceed with password update
   2. Skip
 Or enter 'r' to go back to choose the provider
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-on-shared-sshd@localhost) Choose action:
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-with-shared-sshd@example.com@localhost) Choose action:
 > 1
 == Password reset ==
 Enter 'r' to cancel the request and go back to choose the provider
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-on-shared-sshd@localhost) Enter your new password (3 days until mandatory):
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-with-shared-sshd@example.com@localhost) Enter your new password (3 days until mandatory):
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-on-shared-sshd@localhost) Choose your provider:
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-on-shared-sshd@localhost) Gimme your password:
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 Password reset, 2 step(s) missing
 == Use your fido device foo ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-on-shared-sshd@localhost) Plug your fido device and press with your thumb:
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-with-shared-sshd@example.com@localhost) Plug your fido device and press with your thumb:
 >
 Password reset, 1 step(s) missing
 == Password reset ==
   1. Proceed with password update
   2. Skip
 Or enter 'r' to go back to choose the provider
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-on-shared-sshd@localhost) Choose action:
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-with-shared-sshd@example.com@localhost) Choose action:
 > 1
 == Password reset ==
 Enter 'r' to cancel the request and go back to choose the provider
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-on-shared-sshd@localhost) Enter your new password (3 days until mandatory):
->
-The password is the same as the old one
-== Password reset ==
-Enter 'r' to cancel the request and go back to choose the provider
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-on-shared-sshd@localhost) Enter your new password (3 days until mandatory):
->
-────────────────────────────────────────────────────────────────────────────────
-> ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
-== Provider selection ==
-  1. local
-  2. ExampleBroker
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-on-shared-sshd@localhost) Choose your provider:
-> 2
-== Password authentication ==
-Enter 'r' to cancel the request and go back to select the authentication method
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-on-shared-sshd@localhost) Gimme your password:
->
-Password reset, 2 step(s) missing
-== Use your fido device foo ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-on-shared-sshd@localhost) Plug your fido device and press with your thumb:
->
-Password reset, 1 step(s) missing
-== Password reset ==
-  1. Proceed with password update
-  2. Skip
-Or enter 'r' to go back to choose the provider
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-on-shared-sshd@localhost) Choose action:
-> 1
-== Password reset ==
-Enter 'r' to cancel the request and go back to choose the provider
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-on-shared-sshd@localhost) Enter your new password (3 days until mandatory):
->
-The password is the same as the old one
-== Password reset ==
-Enter 'r' to cancel the request and go back to choose the provider
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-on-shared-sshd@localhost) Enter your new password (3 days until mandatory):
->
-The password fails the dictionary check - it is based on a dictionary word
-== Password reset ==
-Enter 'r' to cancel the request and go back to choose the provider
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-on-shared-sshd@localhost) Enter your new password (3 days until mandatory):
->
-────────────────────────────────────────────────────────────────────────────────
-> ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
-== Provider selection ==
-  1. local
-  2. ExampleBroker
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-on-shared-sshd@localhost) Choose your provider:
-> 2
-== Password authentication ==
-Enter 'r' to cancel the request and go back to select the authentication method
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-on-shared-sshd@localhost) Gimme your password:
->
-Password reset, 2 step(s) missing
-== Use your fido device foo ==
-Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-on-shared-sshd@localhost) Plug your fido device and press with your thumb:
->
-Password reset, 1 step(s) missing
-== Password reset ==
-  1. Proceed with password update
-  2. Skip
-Or enter 'r' to go back to choose the provider
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-on-shared-sshd@localhost) Choose action:
-> 1
-== Password reset ==
-Enter 'r' to cancel the request and go back to choose the provider
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-on-shared-sshd@localhost) Enter your new password (3 days until mandatory):
->
-The password is the same as the old one
-== Password reset ==
-Enter 'r' to cancel the request and go back to choose the provider
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-on-shared-sshd@localhost) Enter your new password (3 days until mandatory):
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-with-shared-sshd@example.com@localhost) Enter your new password (3 days until mandatory):
 >
 The password fails the dictionary check - it is based on a dictionary word
 == Password reset ==
 Enter 'r' to cancel the request and go back to choose the provider
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-on-shared-sshd@localhost) Enter your new password (3 days until mandatory):
->
-The password is the same as the old one
-== Password reset ==
-Enter 'r' to cancel the request and go back to choose the provider
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-on-shared-sshd@localhost) Enter your new password (3 days until mandatory):
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-with-shared-sshd@example.com@localhost) Enter your new password (3 days until mandatory):
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-on-shared-sshd@localhost) Choose your provider:
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-on-shared-sshd@localhost) Gimme your password:
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 Password reset, 2 step(s) missing
 == Use your fido device foo ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-on-shared-sshd@localhost) Plug your fido device and press with your thumb:
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-with-shared-sshd@example.com@localhost) Plug your fido device and press with your thumb:
 >
 Password reset, 1 step(s) missing
 == Password reset ==
   1. Proceed with password update
   2. Skip
 Or enter 'r' to go back to choose the provider
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-on-shared-sshd@localhost) Choose action:
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-with-shared-sshd@example.com@localhost) Choose action:
 > 1
 == Password reset ==
 Enter 'r' to cancel the request and go back to choose the provider
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-on-shared-sshd@localhost) Enter your new password (3 days until mandatory):
->
-The password is the same as the old one
-== Password reset ==
-Enter 'r' to cancel the request and go back to choose the provider
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-on-shared-sshd@localhost) Enter your new password (3 days until mandatory):
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-with-shared-sshd@example.com@localhost) Enter your new password (3 days until mandatory):
 >
 The password fails the dictionary check - it is based on a dictionary word
 == Password reset ==
 Enter 'r' to cancel the request and go back to choose the provider
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-on-shared-sshd@localhost) Enter your new password (3 days until mandatory):
->
-The password is the same as the old one
-== Password reset ==
-Enter 'r' to cancel the request and go back to choose the provider
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-on-shared-sshd@localhost) Enter your new password (3 days until mandatory):
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-with-shared-sshd@example.com@localhost) Enter your new password (3 days until mandatory):
 >
 The password is shorter than 8 characters
 == Password reset ==
 Enter 'r' to cancel the request and go back to choose the provider
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-on-shared-sshd@localhost) Enter your new password (3 days until mandatory):
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-with-shared-sshd@example.com@localhost) Enter your new password (3 days until mandatory):
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-on-shared-sshd@localhost) Choose your provider:
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-on-shared-sshd@localhost) Gimme your password:
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 Password reset, 2 step(s) missing
 == Use your fido device foo ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-on-shared-sshd@localhost) Plug your fido device and press with your thumb:
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-with-shared-sshd@example.com@localhost) Plug your fido device and press with your thumb:
 >
 Password reset, 1 step(s) missing
 == Password reset ==
   1. Proceed with password update
   2. Skip
 Or enter 'r' to go back to choose the provider
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-on-shared-sshd@localhost) Choose action:
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-with-shared-sshd@example.com@localhost) Choose action:
 > 1
 == Password reset ==
 Enter 'r' to cancel the request and go back to choose the provider
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-on-shared-sshd@localhost) Enter your new password (3 days until mandatory):
->
-The password is the same as the old one
-== Password reset ==
-Enter 'r' to cancel the request and go back to choose the provider
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-on-shared-sshd@localhost) Enter your new password (3 days until mandatory):
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-with-shared-sshd@example.com@localhost) Enter your new password (3 days until mandatory):
 >
 The password fails the dictionary check - it is based on a dictionary word
 == Password reset ==
 Enter 'r' to cancel the request and go back to choose the provider
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-on-shared-sshd@localhost) Enter your new password (3 days until mandatory):
->
-The password is the same as the old one
-== Password reset ==
-Enter 'r' to cancel the request and go back to choose the provider
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-on-shared-sshd@localhost) Enter your new password (3 days until mandatory):
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-with-shared-sshd@example.com@localhost) Enter your new password (3 days until mandatory):
 >
 The password is shorter than 8 characters
 == Password reset ==
 Enter 'r' to cancel the request and go back to choose the provider
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-on-shared-sshd@localhost) Enter your new password (3 days until mandatory):
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-with-shared-sshd@example.com@localhost) Enter your new password (3 days until mandatory):
 >
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-on-shared-sshd@localhost) Confirm Password:
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-with-shared-sshd@example.com@localhost) Confirm Password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-on-shared-sshd@localhost) Choose your provider:
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-on-shared-sshd@localhost) Gimme your password:
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 Password reset, 2 step(s) missing
 == Use your fido device foo ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-on-shared-sshd@localhost) Plug your fido device and press with your thumb:
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-with-shared-sshd@example.com@localhost) Plug your fido device and press with your thumb:
 >
 Password reset, 1 step(s) missing
 == Password reset ==
   1. Proceed with password update
   2. Skip
 Or enter 'r' to go back to choose the provider
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-on-shared-sshd@localhost) Choose action:
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-with-shared-sshd@example.com@localhost) Choose action:
 > 1
 == Password reset ==
 Enter 'r' to cancel the request and go back to choose the provider
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-on-shared-sshd@localhost) Enter your new password (3 days until mandatory):
->
-The password is the same as the old one
-== Password reset ==
-Enter 'r' to cancel the request and go back to choose the provider
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-on-shared-sshd@localhost) Enter your new password (3 days until mandatory):
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-with-shared-sshd@example.com@localhost) Enter your new password (3 days until mandatory):
 >
 The password fails the dictionary check - it is based on a dictionary word
 == Password reset ==
 Enter 'r' to cancel the request and go back to choose the provider
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-on-shared-sshd@localhost) Enter your new password (3 days until mandatory):
->
-The password is the same as the old one
-== Password reset ==
-Enter 'r' to cancel the request and go back to choose the provider
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-on-shared-sshd@localhost) Enter your new password (3 days until mandatory):
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-with-shared-sshd@example.com@localhost) Enter your new password (3 days until mandatory):
 >
 The password is shorter than 8 characters
 == Password reset ==
 Enter 'r' to cancel the request and go back to choose the provider
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-on-shared-sshd@localhost) Enter your new password (3 days until mandatory):
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-with-shared-sshd@example.com@localhost) Enter your new password (3 days until mandatory):
 >
-(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-on-shared-sshd@localhost) Confirm Password:
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-with-shared-sshd@example.com@localhost) Confirm Password:
 >
-PAM Authenticate() finished for user 'user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-on-shared-sshd'
-PAM AcctMgmt() finished for user 'user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-on-shared-sshd'
+PAM Authenticate() finished for user 'user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-with-shared-sshd@example.com'
+PAM AcctMgmt() finished for user 'user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-with-shared-sshd@example.com'
  SSHD: Connected to ssh via authd module! [TestSSHAuthenticate]
   HOME=${AUTHD_TEST_HOME}
-  LOGNAME=user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-on-shared-sshd
+  LOGNAME=user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-with-shared-sshd@example.com
   PATH=${AUTHD_TEST_PATH}
   PWD=${AUTHD_TEST_PWD}
   SHELL=/bin/sh
@@ -379,7 +270,7 @@ PAM AcctMgmt() finished for user 'user-mfa-with-reset-integration-pre-check-ssh-
   SSH_CONNECTION=${AUTHD_TEST_SSH_CONNECTION}
   SSH_TTY=${AUTHD_TEST_SSH_TTY}
   TERM=xterm-256color
-  USER=user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-on-shared-sshd
+  USER=user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-with-shared-sshd@example.com
 Connection to localhost closed.
 >
 ────────────────────────────────────────────────────────────────────────────────
diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_mfa_and_reset_same_password b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_mfa_and_reset_same_password
new file mode 100644
index 0000000000..b02483d07f
--- /dev/null
+++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_mfa_and_reset_same_password
@@ -0,0 +1,187 @@
+> ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
+== Provider selection ==
+  1. local
+  2. ExampleBroker
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-same-password@example.com@localhost) Choose your provider:
+>
+────────────────────────────────────────────────────────────────────────────────
+> ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
+== Provider selection ==
+  1. local
+  2. ExampleBroker
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-same-password@example.com@localhost) Choose your provider:
+> 2
+────────────────────────────────────────────────────────────────────────────────
+> ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
+== Provider selection ==
+  1. local
+  2. ExampleBroker
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-same-password@example.com@localhost) Choose your provider:
+> 2
+== Password authentication ==
+Enter 'r' to cancel the request and go back to select the authentication method
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-same-password@example.com@localhost) Gimme your password:
+>
+────────────────────────────────────────────────────────────────────────────────
+> ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
+== Provider selection ==
+  1. local
+  2. ExampleBroker
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-same-password@example.com@localhost) Choose your provider:
+> 2
+== Password authentication ==
+Enter 'r' to cancel the request and go back to select the authentication method
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-same-password@example.com@localhost) Gimme your password:
+>
+Password reset, 2 step(s) missing
+== Use your fido device foo ==
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-same-password@example.com@localhost) Plug your fido device and press with your thumb:
+>
+────────────────────────────────────────────────────────────────────────────────
+> ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
+== Provider selection ==
+  1. local
+  2. ExampleBroker
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-same-password@example.com@localhost) Choose your provider:
+> 2
+== Password authentication ==
+Enter 'r' to cancel the request and go back to select the authentication method
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-same-password@example.com@localhost) Gimme your password:
+>
+Password reset, 2 step(s) missing
+== Use your fido device foo ==
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-same-password@example.com@localhost) Plug your fido device and press with your thumb:
+>
+Password reset, 1 step(s) missing
+== Password reset ==
+  1. Proceed with password update
+  2. Skip
+Or enter 'r' to go back to choose the provider
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-same-password@example.com@localhost) Choose action:
+>
+────────────────────────────────────────────────────────────────────────────────
+> ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
+== Provider selection ==
+  1. local
+  2. ExampleBroker
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-same-password@example.com@localhost) Choose your provider:
+> 2
+== Password authentication ==
+Enter 'r' to cancel the request and go back to select the authentication method
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-same-password@example.com@localhost) Gimme your password:
+>
+Password reset, 2 step(s) missing
+== Use your fido device foo ==
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-same-password@example.com@localhost) Plug your fido device and press with your thumb:
+>
+Password reset, 1 step(s) missing
+== Password reset ==
+  1. Proceed with password update
+  2. Skip
+Or enter 'r' to go back to choose the provider
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-same-password@example.com@localhost) Choose action:
+> 1
+────────────────────────────────────────────────────────────────────────────────
+> ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
+== Provider selection ==
+  1. local
+  2. ExampleBroker
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-same-password@example.com@localhost) Choose your provider:
+> 2
+== Password authentication ==
+Enter 'r' to cancel the request and go back to select the authentication method
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-same-password@example.com@localhost) Gimme your password:
+>
+Password reset, 2 step(s) missing
+== Use your fido device foo ==
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-same-password@example.com@localhost) Plug your fido device and press with your thumb:
+>
+Password reset, 1 step(s) missing
+== Password reset ==
+  1. Proceed with password update
+  2. Skip
+Or enter 'r' to go back to choose the provider
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-same-password@example.com@localhost) Choose action:
+> 1
+== Password reset ==
+Enter 'r' to cancel the request and go back to choose the provider
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-same-password@example.com@localhost) Enter your new password (3 days until mandatory):
+>
+────────────────────────────────────────────────────────────────────────────────
+> ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
+== Provider selection ==
+  1. local
+  2. ExampleBroker
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-same-password@example.com@localhost) Choose your provider:
+> 2
+== Password authentication ==
+Enter 'r' to cancel the request and go back to select the authentication method
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-same-password@example.com@localhost) Gimme your password:
+>
+Password reset, 2 step(s) missing
+== Use your fido device foo ==
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-same-password@example.com@localhost) Plug your fido device and press with your thumb:
+>
+Password reset, 1 step(s) missing
+== Password reset ==
+  1. Proceed with password update
+  2. Skip
+Or enter 'r' to go back to choose the provider
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-same-password@example.com@localhost) Choose action:
+> 1
+== Password reset ==
+Enter 'r' to cancel the request and go back to choose the provider
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-same-password@example.com@localhost) Enter your new password (3 days until mandatory):
+>
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-same-password@example.com@localhost) Confirm Password:
+>
+────────────────────────────────────────────────────────────────────────────────
+> ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
+== Provider selection ==
+  1. local
+  2. ExampleBroker
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-same-password@example.com@localhost) Choose your provider:
+> 2
+== Password authentication ==
+Enter 'r' to cancel the request and go back to select the authentication method
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-same-password@example.com@localhost) Gimme your password:
+>
+Password reset, 2 step(s) missing
+== Use your fido device foo ==
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-same-password@example.com@localhost) Plug your fido device and press with your thumb:
+>
+Password reset, 1 step(s) missing
+== Password reset ==
+  1. Proceed with password update
+  2. Skip
+Or enter 'r' to go back to choose the provider
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-same-password@example.com@localhost) Choose action:
+> 1
+== Password reset ==
+Enter 'r' to cancel the request and go back to choose the provider
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-same-password@example.com@localhost) Enter your new password (3 days until mandatory):
+>
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-same-password@example.com@localhost) Confirm Password:
+>
+PAM Authenticate() finished for user 'user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-same-password@example.com'
+PAM AcctMgmt() finished for user 'user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-same-password@example.com'
+ SSHD: Connected to ssh via authd module! [TestSSHAuthenticate/Authenticate_user_with_mfa_and_reset_same_password]
+  HOME=${AUTHD_TEST_HOME}
+  LOGNAME=user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-same-password@example.com
+  PATH=${AUTHD_TEST_PATH}
+  PWD=${AUTHD_TEST_PWD}
+  SHELL=/bin/sh
+  SSH_CLIENT=${AUTHD_TEST_SSH_CLIENT}
+  SSH_CONNECTION=${AUTHD_TEST_SSH_CONNECTION}
+  SSH_TTY=${AUTHD_TEST_SSH_TTY}
+  TERM=xterm-256color
+  USER=user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-same-password@example.com
+Connection to localhost closed.
+>
+────────────────────────────────────────────────────────────────────────────────
diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_mfa_and_reset_same_password_with_shared_sshd b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_mfa_and_reset_same_password_with_shared_sshd
new file mode 100644
index 0000000000..b110ff482c
--- /dev/null
+++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_mfa_and_reset_same_password_with_shared_sshd
@@ -0,0 +1,187 @@
+> ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
+== Provider selection ==
+  1. local
+  2. ExampleBroker
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-same-password-with-shared-sshd@example.com@localhost) Choose your provider:
+>
+────────────────────────────────────────────────────────────────────────────────
+> ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
+== Provider selection ==
+  1. local
+  2. ExampleBroker
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-same-password-with-shared-sshd@example.com@localhost) Choose your provider:
+> 2
+────────────────────────────────────────────────────────────────────────────────
+> ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
+== Provider selection ==
+  1. local
+  2. ExampleBroker
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-same-password-with-shared-sshd@example.com@localhost) Choose your provider:
+> 2
+== Password authentication ==
+Enter 'r' to cancel the request and go back to select the authentication method
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-same-password-with-shared-sshd@example.com@localhost) Gimme your password:
+>
+────────────────────────────────────────────────────────────────────────────────
+> ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
+== Provider selection ==
+  1. local
+  2. ExampleBroker
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-same-password-with-shared-sshd@example.com@localhost) Choose your provider:
+> 2
+== Password authentication ==
+Enter 'r' to cancel the request and go back to select the authentication method
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-same-password-with-shared-sshd@example.com@localhost) Gimme your password:
+>
+Password reset, 2 step(s) missing
+== Use your fido device foo ==
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-same-password-with-shared-sshd@example.com@localhost) Plug your fido device and press with your thumb:
+>
+────────────────────────────────────────────────────────────────────────────────
+> ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
+== Provider selection ==
+  1. local
+  2. ExampleBroker
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-same-password-with-shared-sshd@example.com@localhost) Choose your provider:
+> 2
+== Password authentication ==
+Enter 'r' to cancel the request and go back to select the authentication method
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-same-password-with-shared-sshd@example.com@localhost) Gimme your password:
+>
+Password reset, 2 step(s) missing
+== Use your fido device foo ==
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-same-password-with-shared-sshd@example.com@localhost) Plug your fido device and press with your thumb:
+>
+Password reset, 1 step(s) missing
+== Password reset ==
+  1. Proceed with password update
+  2. Skip
+Or enter 'r' to go back to choose the provider
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-same-password-with-shared-sshd@example.com@localhost) Choose action:
+>
+────────────────────────────────────────────────────────────────────────────────
+> ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
+== Provider selection ==
+  1. local
+  2. ExampleBroker
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-same-password-with-shared-sshd@example.com@localhost) Choose your provider:
+> 2
+== Password authentication ==
+Enter 'r' to cancel the request and go back to select the authentication method
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-same-password-with-shared-sshd@example.com@localhost) Gimme your password:
+>
+Password reset, 2 step(s) missing
+== Use your fido device foo ==
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-same-password-with-shared-sshd@example.com@localhost) Plug your fido device and press with your thumb:
+>
+Password reset, 1 step(s) missing
+== Password reset ==
+  1. Proceed with password update
+  2. Skip
+Or enter 'r' to go back to choose the provider
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-same-password-with-shared-sshd@example.com@localhost) Choose action:
+> 1
+────────────────────────────────────────────────────────────────────────────────
+> ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
+== Provider selection ==
+  1. local
+  2. ExampleBroker
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-same-password-with-shared-sshd@example.com@localhost) Choose your provider:
+> 2
+== Password authentication ==
+Enter 'r' to cancel the request and go back to select the authentication method
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-same-password-with-shared-sshd@example.com@localhost) Gimme your password:
+>
+Password reset, 2 step(s) missing
+== Use your fido device foo ==
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-same-password-with-shared-sshd@example.com@localhost) Plug your fido device and press with your thumb:
+>
+Password reset, 1 step(s) missing
+== Password reset ==
+  1. Proceed with password update
+  2. Skip
+Or enter 'r' to go back to choose the provider
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-same-password-with-shared-sshd@example.com@localhost) Choose action:
+> 1
+== Password reset ==
+Enter 'r' to cancel the request and go back to choose the provider
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-same-password-with-shared-sshd@example.com@localhost) Enter your new password (3 days until mandatory):
+>
+────────────────────────────────────────────────────────────────────────────────
+> ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
+== Provider selection ==
+  1. local
+  2. ExampleBroker
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-same-password-with-shared-sshd@example.com@localhost) Choose your provider:
+> 2
+== Password authentication ==
+Enter 'r' to cancel the request and go back to select the authentication method
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-same-password-with-shared-sshd@example.com@localhost) Gimme your password:
+>
+Password reset, 2 step(s) missing
+== Use your fido device foo ==
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-same-password-with-shared-sshd@example.com@localhost) Plug your fido device and press with your thumb:
+>
+Password reset, 1 step(s) missing
+== Password reset ==
+  1. Proceed with password update
+  2. Skip
+Or enter 'r' to go back to choose the provider
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-same-password-with-shared-sshd@example.com@localhost) Choose action:
+> 1
+== Password reset ==
+Enter 'r' to cancel the request and go back to choose the provider
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-same-password-with-shared-sshd@example.com@localhost) Enter your new password (3 days until mandatory):
+>
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-same-password-with-shared-sshd@example.com@localhost) Confirm Password:
+>
+────────────────────────────────────────────────────────────────────────────────
+> ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
+== Provider selection ==
+  1. local
+  2. ExampleBroker
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-same-password-with-shared-sshd@example.com@localhost) Choose your provider:
+> 2
+== Password authentication ==
+Enter 'r' to cancel the request and go back to select the authentication method
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-same-password-with-shared-sshd@example.com@localhost) Gimme your password:
+>
+Password reset, 2 step(s) missing
+== Use your fido device foo ==
+Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-same-password-with-shared-sshd@example.com@localhost) Plug your fido device and press with your thumb:
+>
+Password reset, 1 step(s) missing
+== Password reset ==
+  1. Proceed with password update
+  2. Skip
+Or enter 'r' to go back to choose the provider
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-same-password-with-shared-sshd@example.com@localhost) Choose action:
+> 1
+== Password reset ==
+Enter 'r' to cancel the request and go back to choose the provider
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-same-password-with-shared-sshd@example.com@localhost) Enter your new password (3 days until mandatory):
+>
+(user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-same-password-with-shared-sshd@example.com@localhost) Confirm Password:
+>
+PAM Authenticate() finished for user 'user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-same-password-with-shared-sshd@example.com'
+PAM AcctMgmt() finished for user 'user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-same-password-with-shared-sshd@example.com'
+ SSHD: Connected to ssh via authd module! [TestSSHAuthenticate]
+  HOME=${AUTHD_TEST_HOME}
+  LOGNAME=user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-same-password-with-shared-sshd@example.com
+  PATH=${AUTHD_TEST_PATH}
+  PWD=${AUTHD_TEST_PWD}
+  SHELL=/bin/sh
+  SSH_CLIENT=${AUTHD_TEST_SSH_CLIENT}
+  SSH_CONNECTION=${AUTHD_TEST_SSH_CONNECTION}
+  SSH_TTY=${AUTHD_TEST_SSH_TTY}
+  TERM=xterm-256color
+  USER=user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-same-password-with-shared-sshd@example.com
+Connection to localhost closed.
+>
+────────────────────────────────────────────────────────────────────────────────
diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_mfa_on_shared_SSHd b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_mfa_with_shared_sshd
similarity index 58%
rename from pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_mfa_on_shared_SSHd
rename to pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_mfa_with_shared_sshd
index 346cae988c..d9eede4139 100644
--- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_mfa_on_shared_SSHd
+++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_mfa_with_shared_sshd
@@ -2,481 +2,481 @@
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-on-shared-sshd@localhost) Choose your provider:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-with-shared-sshd@example.com@localhost) Choose your provider:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-on-shared-sshd@localhost) Choose your provider:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-on-shared-sshd@localhost) Choose your provider:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-on-shared-sshd@localhost) Gimme your password:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-on-shared-sshd@localhost) Choose your provider:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-on-shared-sshd@localhost) Gimme your password:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-on-shared-sshd@gmail.com
+  3. Send URL to user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-on-shared-sshd@localhost) Choose your authentication method:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-with-shared-sshd@example.com@localhost) Choose your authentication method:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-on-shared-sshd@localhost) Choose your provider:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-on-shared-sshd@localhost) Gimme your password:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-on-shared-sshd@gmail.com
+  3. Send URL to user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-on-shared-sshd@localhost) Choose your authentication method:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 1
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-on-shared-sshd@localhost) Gimme your password:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-on-shared-sshd@localhost) Choose your provider:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-on-shared-sshd@localhost) Gimme your password:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-on-shared-sshd@gmail.com
+  3. Send URL to user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-on-shared-sshd@localhost) Choose your authentication method:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 1
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-on-shared-sshd@localhost) Gimme your password:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 == Use your fido device foo ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-on-shared-sshd@localhost) Plug your fido device and press with your thumb:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-with-shared-sshd@example.com@localhost) Plug your fido device and press with your thumb:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-on-shared-sshd@localhost) Choose your provider:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-on-shared-sshd@localhost) Gimme your password:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-on-shared-sshd@gmail.com
+  3. Send URL to user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-on-shared-sshd@localhost) Choose your authentication method:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 1
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-on-shared-sshd@localhost) Gimme your password:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 == Use your fido device foo ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-on-shared-sshd@localhost) Plug your fido device and press with your thumb:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-with-shared-sshd@example.com@localhost) Plug your fido device and press with your thumb:
 > r
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-on-shared-sshd@localhost) Choose your provider:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-on-shared-sshd@localhost) Gimme your password:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-on-shared-sshd@gmail.com
+  3. Send URL to user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-on-shared-sshd@localhost) Choose your authentication method:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 1
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-on-shared-sshd@localhost) Gimme your password:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 == Use your fido device foo ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-on-shared-sshd@localhost) Plug your fido device and press with your thumb:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-with-shared-sshd@example.com@localhost) Plug your fido device and press with your thumb:
 > r
 == Authentication method selection ==
   1. Use your fido device foo
   2. Use your phone +33...
   3. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-on-shared-sshd@localhost) Choose your authentication method:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-with-shared-sshd@example.com@localhost) Choose your authentication method:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-on-shared-sshd@localhost) Choose your provider:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-on-shared-sshd@localhost) Gimme your password:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-on-shared-sshd@gmail.com
+  3. Send URL to user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-on-shared-sshd@localhost) Choose your authentication method:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 1
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-on-shared-sshd@localhost) Gimme your password:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 == Use your fido device foo ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-on-shared-sshd@localhost) Plug your fido device and press with your thumb:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-with-shared-sshd@example.com@localhost) Plug your fido device and press with your thumb:
 > r
 == Authentication method selection ==
   1. Use your fido device foo
   2. Use your phone +33...
   3. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-on-shared-sshd@localhost) Choose your authentication method:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 1
 == Use your fido device foo ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-on-shared-sshd@localhost) Plug your fido device and press with your thumb:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-with-shared-sshd@example.com@localhost) Plug your fido device and press with your thumb:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-on-shared-sshd@localhost) Choose your provider:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-on-shared-sshd@localhost) Gimme your password:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-on-shared-sshd@gmail.com
+  3. Send URL to user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-on-shared-sshd@localhost) Choose your authentication method:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 1
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-on-shared-sshd@localhost) Gimme your password:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 == Use your fido device foo ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-on-shared-sshd@localhost) Plug your fido device and press with your thumb:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-with-shared-sshd@example.com@localhost) Plug your fido device and press with your thumb:
 > r
 == Authentication method selection ==
   1. Use your fido device foo
   2. Use your phone +33...
   3. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-on-shared-sshd@localhost) Choose your authentication method:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 1
 == Use your fido device foo ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-on-shared-sshd@localhost) Plug your fido device and press with your thumb:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-with-shared-sshd@example.com@localhost) Plug your fido device and press with your thumb:
 > r
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-on-shared-sshd@localhost) Choose your provider:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-on-shared-sshd@localhost) Gimme your password:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-on-shared-sshd@gmail.com
+  3. Send URL to user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-on-shared-sshd@localhost) Choose your authentication method:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 1
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-on-shared-sshd@localhost) Gimme your password:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 == Use your fido device foo ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-on-shared-sshd@localhost) Plug your fido device and press with your thumb:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-with-shared-sshd@example.com@localhost) Plug your fido device and press with your thumb:
 > r
 == Authentication method selection ==
   1. Use your fido device foo
   2. Use your phone +33...
   3. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-on-shared-sshd@localhost) Choose your authentication method:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 1
 == Use your fido device foo ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-on-shared-sshd@localhost) Plug your fido device and press with your thumb:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-with-shared-sshd@example.com@localhost) Plug your fido device and press with your thumb:
 > r
 == Authentication method selection ==
   1. Use your fido device foo
   2. Use your phone +33...
   3. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-on-shared-sshd@localhost) Choose your authentication method:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-with-shared-sshd@example.com@localhost) Choose your authentication method:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-on-shared-sshd@localhost) Choose your provider:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-on-shared-sshd@localhost) Gimme your password:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-on-shared-sshd@gmail.com
+  3. Send URL to user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-on-shared-sshd@localhost) Choose your authentication method:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 1
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-on-shared-sshd@localhost) Gimme your password:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 == Use your fido device foo ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-on-shared-sshd@localhost) Plug your fido device and press with your thumb:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-with-shared-sshd@example.com@localhost) Plug your fido device and press with your thumb:
 > r
 == Authentication method selection ==
   1. Use your fido device foo
   2. Use your phone +33...
   3. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-on-shared-sshd@localhost) Choose your authentication method:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 1
 == Use your fido device foo ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-on-shared-sshd@localhost) Plug your fido device and press with your thumb:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-with-shared-sshd@example.com@localhost) Plug your fido device and press with your thumb:
 > r
 == Authentication method selection ==
   1. Use your fido device foo
   2. Use your phone +33...
   3. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-on-shared-sshd@localhost) Choose your authentication method:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 2
 == Use your phone +33... ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-on-shared-sshd@localhost) Unlock your phone +33... or accept request on web interface:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-with-shared-sshd@example.com@localhost) Unlock your phone +33... or accept request on web interface:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-on-shared-sshd@localhost) Choose your provider:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-on-shared-sshd@localhost) Gimme your password:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-on-shared-sshd@gmail.com
+  3. Send URL to user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-on-shared-sshd@localhost) Choose your authentication method:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 1
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-on-shared-sshd@localhost) Gimme your password:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 == Use your fido device foo ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-on-shared-sshd@localhost) Plug your fido device and press with your thumb:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-with-shared-sshd@example.com@localhost) Plug your fido device and press with your thumb:
 > r
 == Authentication method selection ==
   1. Use your fido device foo
   2. Use your phone +33...
   3. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-on-shared-sshd@localhost) Choose your authentication method:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 1
 == Use your fido device foo ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-on-shared-sshd@localhost) Plug your fido device and press with your thumb:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-with-shared-sshd@example.com@localhost) Plug your fido device and press with your thumb:
 > r
 == Authentication method selection ==
   1. Use your fido device foo
   2. Use your phone +33...
   3. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-on-shared-sshd@localhost) Choose your authentication method:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 2
 == Use your phone +33... ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-on-shared-sshd@localhost) Unlock your phone +33... or accept request on web interface:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-with-shared-sshd@example.com@localhost) Unlock your phone +33... or accept request on web interface:
 >
 == Use your fido device foo ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-on-shared-sshd@localhost) Plug your fido device and press with your thumb:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-with-shared-sshd@example.com@localhost) Plug your fido device and press with your thumb:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-on-shared-sshd@localhost) Choose your provider:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-on-shared-sshd@localhost) Gimme your password:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-on-shared-sshd@gmail.com
+  3. Send URL to user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-on-shared-sshd@localhost) Choose your authentication method:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 1
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-on-shared-sshd@localhost) Gimme your password:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 == Use your fido device foo ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-on-shared-sshd@localhost) Plug your fido device and press with your thumb:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-with-shared-sshd@example.com@localhost) Plug your fido device and press with your thumb:
 > r
 == Authentication method selection ==
   1. Use your fido device foo
   2. Use your phone +33...
   3. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-on-shared-sshd@localhost) Choose your authentication method:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 1
 == Use your fido device foo ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-on-shared-sshd@localhost) Plug your fido device and press with your thumb:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-with-shared-sshd@example.com@localhost) Plug your fido device and press with your thumb:
 > r
 == Authentication method selection ==
   1. Use your fido device foo
   2. Use your phone +33...
   3. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-on-shared-sshd@localhost) Choose your authentication method:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 2
 == Use your phone +33... ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-on-shared-sshd@localhost) Unlock your phone +33... or accept request on web interface:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-with-shared-sshd@example.com@localhost) Unlock your phone +33... or accept request on web interface:
 >
 == Use your fido device foo ==
 Press Enter to wait for authentication or enter 'r' to go back to select the authentication method
-(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-on-shared-sshd@localhost) Plug your fido device and press with your thumb:
+(user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-with-shared-sshd@example.com@localhost) Plug your fido device and press with your thumb:
 >
-PAM Authenticate() finished for user 'user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-on-shared-sshd'
-PAM AcctMgmt() finished for user 'user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-on-shared-sshd'
+PAM Authenticate() finished for user 'user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-with-shared-sshd@example.com'
+PAM AcctMgmt() finished for user 'user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-with-shared-sshd@example.com'
  SSHD: Connected to ssh via authd module! [TestSSHAuthenticate]
   HOME=${AUTHD_TEST_HOME}
-  LOGNAME=user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-on-shared-sshd
+  LOGNAME=user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-with-shared-sshd@example.com
   PATH=${AUTHD_TEST_PATH}
   PWD=${AUTHD_TEST_PWD}
   SHELL=/bin/sh
@@ -484,7 +484,7 @@ PAM AcctMgmt() finished for user 'user-mfa-integration-pre-check-ssh-authenticat
   SSH_CONNECTION=${AUTHD_TEST_SSH_CONNECTION}
   SSH_TTY=${AUTHD_TEST_SSH_TTY}
   TERM=xterm-256color
-  USER=user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-on-shared-sshd
+  USER=user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-with-shared-sshd@example.com
 Connection to localhost closed.
 >
 ────────────────────────────────────────────────────────────────────────────────
diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_mixed_case_after_db_migration b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_mixed_case_after_db_migration
index f6940d503d..159c60e68e 100644
--- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_mixed_case_after_db_migration
+++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_mixed_case_after_db_migration
@@ -1,27 +1,27 @@
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-WITH-Mixed-CaSe@localhost) Gimme your password:
+(user-integration-WITH-Mixed-CaSe@example.com@localhost) Gimme your password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-WITH-Mixed-CaSe@localhost) Gimme your password:
+(user-integration-WITH-Mixed-CaSe@example.com@localhost) Gimme your password:
 >
-PAM Authenticate() finished for user 'user-integration-with-mixed-case'
-PAM AcctMgmt() finished for user 'user-integration-with-mixed-case'
-Environment:
-  USER=user-integration-with-mixed-case
-  LOGNAME=user-integration-with-mixed-case
+PAM Authenticate() finished for user 'user-integration-with-mixed-case@example.com'
+PAM AcctMgmt() finished for user 'user-integration-with-mixed-case@example.com'
+ SSHD: Connected to ssh via authd module! [TestSSHAuthenticate/Authenticate_user_with_mixed_case_after_db_migration]
   HOME=${AUTHD_TEST_HOME}
+  LOGNAME=user-integration-with-mixed-case@example.com
   PATH=${AUTHD_TEST_PATH}
+  PWD=${AUTHD_TEST_PWD}
   SHELL=/bin/sh
-  TERM=xterm-256color
   SSH_CLIENT=${AUTHD_TEST_SSH_CLIENT}
   SSH_CONNECTION=${AUTHD_TEST_SSH_CONNECTION}
   SSH_TTY=${AUTHD_TEST_SSH_TTY}
- SSHD: Connected to ssh via authd module! [TestSSHAuthenticate/Authenticate_user_with_mixed_case_after_db_migration]
+  TERM=xterm-256color
+  USER=user-integration-with-mixed-case@example.com
 Connection to localhost closed.
 >
 ────────────────────────────────────────────────────────────────────────────────
diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_mixed_case_after_db_migration.group b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_mixed_case_after_db_migration.group
new file mode 100644
index 0000000000..2c7783d30a
--- /dev/null
+++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_mixed_case_after_db_migration.group
@@ -0,0 +1,6 @@
+localgroup:x:41:user-integration-with-mixed-case@example.com,user-integration-cached@example.com,user-integration-pre-check-with-upper-case@example.com,user-integration-upper-case@example.com,user-pre-check@example.com
+some-group-for-user-integration-WITH-Mixed-CaSe@example.com:x:101:user-integration-with-mixed-case@example.com
+some-group-for-user-integration-cached@example.com:x:102:user-integration-cached@example.com
+some-group-for-user-integration-pre-check-WITH-UPPER-CASE@example.com:x:103:user-integration-pre-check-with-upper-case@example.com
+some-group-for-user-integration-UPPER-CASE@example.com:x:104:user-integration-upper-case@example.com
+some-group-for-user-pre-check@example.com:x:105:user-pre-check@example.com
diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_mixed_case_after_db_migration.group.backup b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_mixed_case_after_db_migration.group.backup
new file mode 100644
index 0000000000..7fe8ba8346
--- /dev/null
+++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_mixed_case_after_db_migration.group.backup
@@ -0,0 +1,6 @@
+localgroup:x:41:user-integration-WITH-Mixed-CaSe@example.com,user-integration-cached@example.com,user-integration-pre-check-WITH-UPPER-CASE@example.com,user-integration-UPPER-CASE@example.com,user-pre-check@example.com
+some-group-for-user-integration-WITH-Mixed-CaSe@example.com:x:101:user-integration-WITH-Mixed-CaSe@example.com
+some-group-for-user-integration-cached@example.com:x:102:user-integration-cached@example.com
+some-group-for-user-integration-pre-check-WITH-UPPER-CASE@example.com:x:103:user-integration-pre-check-WITH-UPPER-CASE@example.com
+some-group-for-user-integration-UPPER-CASE@example.com:x:104:user-integration-UPPER-CASE@example.com
+some-group-for-user-pre-check@example.com:x:105:user-pre-check@example.com
diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_mixed_case_after_db_migration.groups b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_mixed_case_after_db_migration.groups
deleted file mode 100644
index f31a69be33..0000000000
--- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_mixed_case_after_db_migration.groups
+++ /dev/null
@@ -1,6 +0,0 @@
-localgroup:x:41:user-integration-with-mixed-case,user-integration-cached,user-integration-pre-check-with-upper-case,user-integration-upper-case,user-pre-check
-some-group-for-user-integration-WITH-Mixed-CaSe:x:101:user-integration-with-mixed-case
-some-group-for-user-integration-cached:x:102:user-integration-cached
-some-group-for-user-integration-pre-check-WITH-UPPER-CASE:x:103:user-integration-pre-check-with-upper-case
-some-group-for-user-integration-UPPER-CASE:x:104:user-integration-upper-case
-some-group-for-user-pre-check:x:105:user-pre-check
diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_mixed_case_after_db_migration_on_shared_SSHd.groups b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_mixed_case_after_db_migration_on_shared_SSHd.groups
deleted file mode 100644
index f31a69be33..0000000000
--- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_mixed_case_after_db_migration_on_shared_SSHd.groups
+++ /dev/null
@@ -1,6 +0,0 @@
-localgroup:x:41:user-integration-with-mixed-case,user-integration-cached,user-integration-pre-check-with-upper-case,user-integration-upper-case,user-pre-check
-some-group-for-user-integration-WITH-Mixed-CaSe:x:101:user-integration-with-mixed-case
-some-group-for-user-integration-cached:x:102:user-integration-cached
-some-group-for-user-integration-pre-check-WITH-UPPER-CASE:x:103:user-integration-pre-check-with-upper-case
-some-group-for-user-integration-UPPER-CASE:x:104:user-integration-upper-case
-some-group-for-user-pre-check:x:105:user-pre-check
diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_mixed_case_after_db_migration_on_shared_SSHd b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_mixed_case_after_db_migration_with_shared_sshd
similarity index 76%
rename from pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_mixed_case_after_db_migration_on_shared_SSHd
rename to pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_mixed_case_after_db_migration_with_shared_sshd
index 5f7626510a..93a13e91fe 100644
--- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_mixed_case_after_db_migration_on_shared_SSHd
+++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_mixed_case_after_db_migration_with_shared_sshd
@@ -1,27 +1,27 @@
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-WITH-Mixed-CaSe@localhost) Gimme your password:
+(user-integration-WITH-Mixed-CaSe@example.com@localhost) Gimme your password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-WITH-Mixed-CaSe@localhost) Gimme your password:
+(user-integration-WITH-Mixed-CaSe@example.com@localhost) Gimme your password:
 >
-PAM Authenticate() finished for user 'user-integration-with-mixed-case'
-PAM AcctMgmt() finished for user 'user-integration-with-mixed-case'
-Environment:
-  USER=user-integration-with-mixed-case
-  LOGNAME=user-integration-with-mixed-case
+PAM Authenticate() finished for user 'user-integration-with-mixed-case@example.com'
+PAM AcctMgmt() finished for user 'user-integration-with-mixed-case@example.com'
+ SSHD: Connected to ssh via authd module! [TestSSHAuthenticate/Authenticate_user_with_mixed_case_after_db_migration_with_shared_sshd]
   HOME=${AUTHD_TEST_HOME}
+  LOGNAME=user-integration-with-mixed-case@example.com
   PATH=${AUTHD_TEST_PATH}
+  PWD=${AUTHD_TEST_PWD}
   SHELL=/bin/sh
-  TERM=xterm-256color
   SSH_CLIENT=${AUTHD_TEST_SSH_CLIENT}
   SSH_CONNECTION=${AUTHD_TEST_SSH_CONNECTION}
   SSH_TTY=${AUTHD_TEST_SSH_TTY}
- SSHD: Connected to ssh via authd module! [TestSSHAuthenticate/Authenticate_user_with_mixed_case_after_db_migration_on_shared_SSHd]
+  TERM=xterm-256color
+  USER=user-integration-with-mixed-case@example.com
 Connection to localhost closed.
 >
 ────────────────────────────────────────────────────────────────────────────────
diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_mixed_case_after_db_migration_with_shared_sshd.group b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_mixed_case_after_db_migration_with_shared_sshd.group
new file mode 100644
index 0000000000..2c7783d30a
--- /dev/null
+++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_mixed_case_after_db_migration_with_shared_sshd.group
@@ -0,0 +1,6 @@
+localgroup:x:41:user-integration-with-mixed-case@example.com,user-integration-cached@example.com,user-integration-pre-check-with-upper-case@example.com,user-integration-upper-case@example.com,user-pre-check@example.com
+some-group-for-user-integration-WITH-Mixed-CaSe@example.com:x:101:user-integration-with-mixed-case@example.com
+some-group-for-user-integration-cached@example.com:x:102:user-integration-cached@example.com
+some-group-for-user-integration-pre-check-WITH-UPPER-CASE@example.com:x:103:user-integration-pre-check-with-upper-case@example.com
+some-group-for-user-integration-UPPER-CASE@example.com:x:104:user-integration-upper-case@example.com
+some-group-for-user-pre-check@example.com:x:105:user-pre-check@example.com
diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_mixed_case_after_db_migration_with_shared_sshd.group.backup b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_mixed_case_after_db_migration_with_shared_sshd.group.backup
new file mode 100644
index 0000000000..7fe8ba8346
--- /dev/null
+++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_mixed_case_after_db_migration_with_shared_sshd.group.backup
@@ -0,0 +1,6 @@
+localgroup:x:41:user-integration-WITH-Mixed-CaSe@example.com,user-integration-cached@example.com,user-integration-pre-check-WITH-UPPER-CASE@example.com,user-integration-UPPER-CASE@example.com,user-pre-check@example.com
+some-group-for-user-integration-WITH-Mixed-CaSe@example.com:x:101:user-integration-WITH-Mixed-CaSe@example.com
+some-group-for-user-integration-cached@example.com:x:102:user-integration-cached@example.com
+some-group-for-user-integration-pre-check-WITH-UPPER-CASE@example.com:x:103:user-integration-pre-check-WITH-UPPER-CASE@example.com
+some-group-for-user-integration-UPPER-CASE@example.com:x:104:user-integration-UPPER-CASE@example.com
+some-group-for-user-pre-check@example.com:x:105:user-pre-check@example.com
diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_qr_code b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_qr_code
index 076b4809ae..23272ecfc6 100644
--- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_qr_code
+++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_qr_code
@@ -2,94 +2,94 @@
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code@example.com@localhost) Choose your provider:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code@example.com@localhost) Choose your provider:
 > 2
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code@example.com@localhost) Gimme your password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-with-qr-code@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-with-qr-code@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code@example.com@localhost) Choose your authentication method:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-with-qr-code@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-with-qr-code@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code@example.com@localhost) Choose your authentication method:
 > 2
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-with-qr-code@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-with-qr-code@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code@example.com@localhost) Choose your authentication method:
 > 2
 == Use a Login code ==
 Enter the code in the login page
@@ -99,30 +99,30 @@ https://ubuntu.com
   1. Wait for authentication result
   2. Regenerate code
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code@example.com@localhost) Choose action:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-with-qr-code@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-with-qr-code@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code@example.com@localhost) Choose your authentication method:
 > 2
 == Use a Login code ==
 Enter the code in the login page
@@ -132,30 +132,30 @@ https://ubuntu.com
   1. Wait for authentication result
   2. Regenerate code
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code@example.com@localhost) Choose action:
 > 2
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-with-qr-code@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-with-qr-code@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code@example.com@localhost) Choose your authentication method:
 > 2
 == Use a Login code ==
 Enter the code in the login page
@@ -165,7 +165,7 @@ https://ubuntu.com
   1. Wait for authentication result
   2. Regenerate code
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code@example.com@localhost) Choose action:
 > 2
 == Use a Login code ==
 Enter the code in the login page
@@ -175,30 +175,30 @@ https://ubuntu.fr/
   1. Wait for authentication result
   2. Regenerate code
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code@example.com@localhost) Choose action:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-with-qr-code@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-with-qr-code@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code@example.com@localhost) Choose your authentication method:
 > 2
 == Use a Login code ==
 Enter the code in the login page
@@ -208,7 +208,7 @@ https://ubuntu.com
   1. Wait for authentication result
   2. Regenerate code
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code@example.com@localhost) Choose action:
 > 2
 == Use a Login code ==
 Enter the code in the login page
@@ -218,30 +218,30 @@ https://ubuntu.fr/
   1. Wait for authentication result
   2. Regenerate code
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code@example.com@localhost) Choose action:
 > 2
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-with-qr-code@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-with-qr-code@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code@example.com@localhost) Choose your authentication method:
 > 2
 == Use a Login code ==
 Enter the code in the login page
@@ -251,7 +251,7 @@ https://ubuntu.com
   1. Wait for authentication result
   2. Regenerate code
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code@example.com@localhost) Choose action:
 > 2
 == Use a Login code ==
 Enter the code in the login page
@@ -261,7 +261,7 @@ https://ubuntu.fr/
   1. Wait for authentication result
   2. Regenerate code
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code@example.com@localhost) Choose action:
 > 2
 == Use a Login code ==
 Enter the code in the login page
@@ -271,30 +271,30 @@ https://ubuntuforum-br.org/
   1. Wait for authentication result
   2. Regenerate code
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code@example.com@localhost) Choose action:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-with-qr-code@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-with-qr-code@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code@example.com@localhost) Choose your authentication method:
 > 2
 == Use a Login code ==
 Enter the code in the login page
@@ -304,7 +304,7 @@ https://ubuntu.com
   1. Wait for authentication result
   2. Regenerate code
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code@example.com@localhost) Choose action:
 > 2
 == Use a Login code ==
 Enter the code in the login page
@@ -314,7 +314,7 @@ https://ubuntu.fr/
   1. Wait for authentication result
   2. Regenerate code
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code@example.com@localhost) Choose action:
 > 2
 == Use a Login code ==
 Enter the code in the login page
@@ -324,30 +324,30 @@ https://ubuntuforum-br.org/
   1. Wait for authentication result
   2. Regenerate code
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code@example.com@localhost) Choose action:
 > 2
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-with-qr-code@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-with-qr-code@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code@example.com@localhost) Choose your authentication method:
 > 2
 == Use a Login code ==
 Enter the code in the login page
@@ -357,7 +357,7 @@ https://ubuntu.com
   1. Wait for authentication result
   2. Regenerate code
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code@example.com@localhost) Choose action:
 > 2
 == Use a Login code ==
 Enter the code in the login page
@@ -367,7 +367,7 @@ https://ubuntu.fr/
   1. Wait for authentication result
   2. Regenerate code
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code@example.com@localhost) Choose action:
 > 2
 == Use a Login code ==
 Enter the code in the login page
@@ -377,7 +377,7 @@ https://ubuntuforum-br.org/
   1. Wait for authentication result
   2. Regenerate code
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code@example.com@localhost) Choose action:
 > 2
 == Use a Login code ==
 Enter the code in the login page
@@ -387,30 +387,30 @@ https://www.ubuntu-it.org/
   1. Wait for authentication result
   2. Regenerate code
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code@example.com@localhost) Choose action:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-with-qr-code@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-with-qr-code@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code@example.com@localhost) Choose your authentication method:
 > 2
 == Use a Login code ==
 Enter the code in the login page
@@ -420,7 +420,7 @@ https://ubuntu.com
   1. Wait for authentication result
   2. Regenerate code
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code@example.com@localhost) Choose action:
 > 2
 == Use a Login code ==
 Enter the code in the login page
@@ -430,7 +430,7 @@ https://ubuntu.fr/
   1. Wait for authentication result
   2. Regenerate code
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code@example.com@localhost) Choose action:
 > 2
 == Use a Login code ==
 Enter the code in the login page
@@ -440,7 +440,7 @@ https://ubuntuforum-br.org/
   1. Wait for authentication result
   2. Regenerate code
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code@example.com@localhost) Choose action:
 > 2
 == Use a Login code ==
 Enter the code in the login page
@@ -450,30 +450,30 @@ https://www.ubuntu-it.org/
   1. Wait for authentication result
   2. Regenerate code
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code@example.com@localhost) Choose action:
 > 2
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-with-qr-code@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-with-qr-code@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code@example.com@localhost) Choose your authentication method:
 > 2
 == Use a Login code ==
 Enter the code in the login page
@@ -483,7 +483,7 @@ https://ubuntu.com
   1. Wait for authentication result
   2. Regenerate code
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code@example.com@localhost) Choose action:
 > 2
 == Use a Login code ==
 Enter the code in the login page
@@ -493,7 +493,7 @@ https://ubuntu.fr/
   1. Wait for authentication result
   2. Regenerate code
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code@example.com@localhost) Choose action:
 > 2
 == Use a Login code ==
 Enter the code in the login page
@@ -503,7 +503,7 @@ https://ubuntuforum-br.org/
   1. Wait for authentication result
   2. Regenerate code
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code@example.com@localhost) Choose action:
 > 2
 == Use a Login code ==
 Enter the code in the login page
@@ -513,7 +513,7 @@ https://www.ubuntu-it.org/
   1. Wait for authentication result
   2. Regenerate code
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code@example.com@localhost) Choose action:
 > 2
 == Use a Login code ==
 Enter the code in the login page
@@ -523,30 +523,30 @@ https://ubuntu.com
   1. Wait for authentication result
   2. Regenerate code
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code@example.com@localhost) Choose action:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-with-qr-code@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-with-qr-code@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code@example.com@localhost) Choose your authentication method:
 > 2
 == Use a Login code ==
 Enter the code in the login page
@@ -556,7 +556,7 @@ https://ubuntu.com
   1. Wait for authentication result
   2. Regenerate code
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code@example.com@localhost) Choose action:
 > 2
 == Use a Login code ==
 Enter the code in the login page
@@ -566,7 +566,7 @@ https://ubuntu.fr/
   1. Wait for authentication result
   2. Regenerate code
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code@example.com@localhost) Choose action:
 > 2
 == Use a Login code ==
 Enter the code in the login page
@@ -576,7 +576,7 @@ https://ubuntuforum-br.org/
   1. Wait for authentication result
   2. Regenerate code
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code@example.com@localhost) Choose action:
 > 2
 == Use a Login code ==
 Enter the code in the login page
@@ -586,7 +586,7 @@ https://www.ubuntu-it.org/
   1. Wait for authentication result
   2. Regenerate code
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code@example.com@localhost) Choose action:
 > 2
 == Use a Login code ==
 Enter the code in the login page
@@ -596,30 +596,30 @@ https://ubuntu.com
   1. Wait for authentication result
   2. Regenerate code
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code@example.com@localhost) Choose action:
 > 1
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-with-qr-code@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-with-qr-code@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code@example.com@localhost) Choose your authentication method:
 > 2
 == Use a Login code ==
 Enter the code in the login page
@@ -629,7 +629,7 @@ https://ubuntu.com
   1. Wait for authentication result
   2. Regenerate code
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code@example.com@localhost) Choose action:
 > 2
 == Use a Login code ==
 Enter the code in the login page
@@ -639,7 +639,7 @@ https://ubuntu.fr/
   1. Wait for authentication result
   2. Regenerate code
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code@example.com@localhost) Choose action:
 > 2
 == Use a Login code ==
 Enter the code in the login page
@@ -649,7 +649,7 @@ https://ubuntuforum-br.org/
   1. Wait for authentication result
   2. Regenerate code
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code@example.com@localhost) Choose action:
 > 2
 == Use a Login code ==
 Enter the code in the login page
@@ -659,7 +659,7 @@ https://www.ubuntu-it.org/
   1. Wait for authentication result
   2. Regenerate code
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code@example.com@localhost) Choose action:
 > 2
 == Use a Login code ==
 Enter the code in the login page
@@ -669,21 +669,21 @@ https://ubuntu.com
   1. Wait for authentication result
   2. Regenerate code
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code@example.com@localhost) Choose action:
 > 1
-PAM Authenticate() finished for user 'user-integration-pre-check-ssh-authenticate-user-with-qr-code'
-PAM AcctMgmt() finished for user 'user-integration-pre-check-ssh-authenticate-user-with-qr-code'
-Environment:
-  USER=user-integration-pre-check-ssh-authenticate-user-with-qr-code
-  LOGNAME=user-integration-pre-check-ssh-authenticate-user-with-qr-code
+PAM Authenticate() finished for user 'user-integration-pre-check-ssh-authenticate-user-with-qr-code@example.com'
+PAM AcctMgmt() finished for user 'user-integration-pre-check-ssh-authenticate-user-with-qr-code@example.com'
+ SSHD: Connected to ssh via authd module! [TestSSHAuthenticate/Authenticate_user_with_qr_code]
   HOME=${AUTHD_TEST_HOME}
+  LOGNAME=user-integration-pre-check-ssh-authenticate-user-with-qr-code@example.com
   PATH=${AUTHD_TEST_PATH}
+  PWD=${AUTHD_TEST_PWD}
   SHELL=/bin/sh
-  TERM=xterm-256color
   SSH_CLIENT=${AUTHD_TEST_SSH_CLIENT}
   SSH_CONNECTION=${AUTHD_TEST_SSH_CONNECTION}
   SSH_TTY=${AUTHD_TEST_SSH_TTY}
- SSHD: Connected to ssh via authd module! [TestSSHAuthenticate/Authenticate_user_with_qr_code]
+  TERM=xterm-256color
+  USER=user-integration-pre-check-ssh-authenticate-user-with-qr-code@example.com
 Connection to localhost closed.
 >
 ────────────────────────────────────────────────────────────────────────────────
diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_qr_code_on_shared_SSHd b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_qr_code_with_shared_sshd
similarity index 65%
rename from pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_qr_code_on_shared_SSHd
rename to pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_qr_code_with_shared_sshd
index e4d3f4a43e..8564f29147 100644
--- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_qr_code_on_shared_SSHd
+++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_qr_code_with_shared_sshd
@@ -2,94 +2,94 @@
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code-with-shared-sshd@example.com@localhost) Choose your provider:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code-on-shared-sshd@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code-on-shared-sshd@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-with-qr-code-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-with-qr-code-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code-with-shared-sshd@example.com@localhost) Choose your authentication method:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code-on-shared-sshd@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-with-qr-code-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-with-qr-code-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 2
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code-on-shared-sshd@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-with-qr-code-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-with-qr-code-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 2
 == Use a Login code ==
 Enter the code in the login page
@@ -99,30 +99,30 @@ https://ubuntu.com
   1. Wait for authentication result
   2. Regenerate code
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code-on-shared-sshd@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code-with-shared-sshd@example.com@localhost) Choose action:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code-on-shared-sshd@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-with-qr-code-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-with-qr-code-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 2
 == Use a Login code ==
 Enter the code in the login page
@@ -132,30 +132,30 @@ https://ubuntu.com
   1. Wait for authentication result
   2. Regenerate code
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code-on-shared-sshd@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code-with-shared-sshd@example.com@localhost) Choose action:
 > 2
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code-on-shared-sshd@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-with-qr-code-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-with-qr-code-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 2
 == Use a Login code ==
 Enter the code in the login page
@@ -165,7 +165,7 @@ https://ubuntu.com
   1. Wait for authentication result
   2. Regenerate code
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code-on-shared-sshd@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code-with-shared-sshd@example.com@localhost) Choose action:
 > 2
 == Use a Login code ==
 Enter the code in the login page
@@ -175,30 +175,30 @@ https://ubuntu.fr/
   1. Wait for authentication result
   2. Regenerate code
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code-on-shared-sshd@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code-with-shared-sshd@example.com@localhost) Choose action:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code-on-shared-sshd@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-with-qr-code-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-with-qr-code-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 2
 == Use a Login code ==
 Enter the code in the login page
@@ -208,7 +208,7 @@ https://ubuntu.com
   1. Wait for authentication result
   2. Regenerate code
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code-on-shared-sshd@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code-with-shared-sshd@example.com@localhost) Choose action:
 > 2
 == Use a Login code ==
 Enter the code in the login page
@@ -218,30 +218,30 @@ https://ubuntu.fr/
   1. Wait for authentication result
   2. Regenerate code
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code-on-shared-sshd@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code-with-shared-sshd@example.com@localhost) Choose action:
 > 2
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code-on-shared-sshd@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-with-qr-code-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-with-qr-code-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 2
 == Use a Login code ==
 Enter the code in the login page
@@ -251,7 +251,7 @@ https://ubuntu.com
   1. Wait for authentication result
   2. Regenerate code
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code-on-shared-sshd@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code-with-shared-sshd@example.com@localhost) Choose action:
 > 2
 == Use a Login code ==
 Enter the code in the login page
@@ -261,7 +261,7 @@ https://ubuntu.fr/
   1. Wait for authentication result
   2. Regenerate code
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code-on-shared-sshd@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code-with-shared-sshd@example.com@localhost) Choose action:
 > 2
 == Use a Login code ==
 Enter the code in the login page
@@ -271,30 +271,30 @@ https://ubuntuforum-br.org/
   1. Wait for authentication result
   2. Regenerate code
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code-on-shared-sshd@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code-with-shared-sshd@example.com@localhost) Choose action:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code-on-shared-sshd@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-with-qr-code-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-with-qr-code-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 2
 == Use a Login code ==
 Enter the code in the login page
@@ -304,7 +304,7 @@ https://ubuntu.com
   1. Wait for authentication result
   2. Regenerate code
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code-on-shared-sshd@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code-with-shared-sshd@example.com@localhost) Choose action:
 > 2
 == Use a Login code ==
 Enter the code in the login page
@@ -314,7 +314,7 @@ https://ubuntu.fr/
   1. Wait for authentication result
   2. Regenerate code
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code-on-shared-sshd@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code-with-shared-sshd@example.com@localhost) Choose action:
 > 2
 == Use a Login code ==
 Enter the code in the login page
@@ -324,30 +324,30 @@ https://ubuntuforum-br.org/
   1. Wait for authentication result
   2. Regenerate code
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code-on-shared-sshd@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code-with-shared-sshd@example.com@localhost) Choose action:
 > 2
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code-on-shared-sshd@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-with-qr-code-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-with-qr-code-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 2
 == Use a Login code ==
 Enter the code in the login page
@@ -357,7 +357,7 @@ https://ubuntu.com
   1. Wait for authentication result
   2. Regenerate code
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code-on-shared-sshd@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code-with-shared-sshd@example.com@localhost) Choose action:
 > 2
 == Use a Login code ==
 Enter the code in the login page
@@ -367,7 +367,7 @@ https://ubuntu.fr/
   1. Wait for authentication result
   2. Regenerate code
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code-on-shared-sshd@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code-with-shared-sshd@example.com@localhost) Choose action:
 > 2
 == Use a Login code ==
 Enter the code in the login page
@@ -377,7 +377,7 @@ https://ubuntuforum-br.org/
   1. Wait for authentication result
   2. Regenerate code
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code-on-shared-sshd@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code-with-shared-sshd@example.com@localhost) Choose action:
 > 2
 == Use a Login code ==
 Enter the code in the login page
@@ -387,30 +387,30 @@ https://www.ubuntu-it.org/
   1. Wait for authentication result
   2. Regenerate code
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code-on-shared-sshd@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code-with-shared-sshd@example.com@localhost) Choose action:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code-on-shared-sshd@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-with-qr-code-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-with-qr-code-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 2
 == Use a Login code ==
 Enter the code in the login page
@@ -420,7 +420,7 @@ https://ubuntu.com
   1. Wait for authentication result
   2. Regenerate code
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code-on-shared-sshd@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code-with-shared-sshd@example.com@localhost) Choose action:
 > 2
 == Use a Login code ==
 Enter the code in the login page
@@ -430,7 +430,7 @@ https://ubuntu.fr/
   1. Wait for authentication result
   2. Regenerate code
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code-on-shared-sshd@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code-with-shared-sshd@example.com@localhost) Choose action:
 > 2
 == Use a Login code ==
 Enter the code in the login page
@@ -440,7 +440,7 @@ https://ubuntuforum-br.org/
   1. Wait for authentication result
   2. Regenerate code
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code-on-shared-sshd@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code-with-shared-sshd@example.com@localhost) Choose action:
 > 2
 == Use a Login code ==
 Enter the code in the login page
@@ -450,30 +450,30 @@ https://www.ubuntu-it.org/
   1. Wait for authentication result
   2. Regenerate code
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code-on-shared-sshd@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code-with-shared-sshd@example.com@localhost) Choose action:
 > 2
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code-on-shared-sshd@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-with-qr-code-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-with-qr-code-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 2
 == Use a Login code ==
 Enter the code in the login page
@@ -483,7 +483,7 @@ https://ubuntu.com
   1. Wait for authentication result
   2. Regenerate code
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code-on-shared-sshd@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code-with-shared-sshd@example.com@localhost) Choose action:
 > 2
 == Use a Login code ==
 Enter the code in the login page
@@ -493,7 +493,7 @@ https://ubuntu.fr/
   1. Wait for authentication result
   2. Regenerate code
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code-on-shared-sshd@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code-with-shared-sshd@example.com@localhost) Choose action:
 > 2
 == Use a Login code ==
 Enter the code in the login page
@@ -503,7 +503,7 @@ https://ubuntuforum-br.org/
   1. Wait for authentication result
   2. Regenerate code
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code-on-shared-sshd@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code-with-shared-sshd@example.com@localhost) Choose action:
 > 2
 == Use a Login code ==
 Enter the code in the login page
@@ -513,7 +513,7 @@ https://www.ubuntu-it.org/
   1. Wait for authentication result
   2. Regenerate code
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code-on-shared-sshd@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code-with-shared-sshd@example.com@localhost) Choose action:
 > 2
 == Use a Login code ==
 Enter the code in the login page
@@ -523,30 +523,30 @@ https://ubuntu.com
   1. Wait for authentication result
   2. Regenerate code
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code-on-shared-sshd@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code-with-shared-sshd@example.com@localhost) Choose action:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code-on-shared-sshd@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-with-qr-code-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-with-qr-code-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 2
 == Use a Login code ==
 Enter the code in the login page
@@ -556,7 +556,7 @@ https://ubuntu.com
   1. Wait for authentication result
   2. Regenerate code
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code-on-shared-sshd@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code-with-shared-sshd@example.com@localhost) Choose action:
 > 2
 == Use a Login code ==
 Enter the code in the login page
@@ -566,7 +566,7 @@ https://ubuntu.fr/
   1. Wait for authentication result
   2. Regenerate code
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code-on-shared-sshd@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code-with-shared-sshd@example.com@localhost) Choose action:
 > 2
 == Use a Login code ==
 Enter the code in the login page
@@ -576,7 +576,7 @@ https://ubuntuforum-br.org/
   1. Wait for authentication result
   2. Regenerate code
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code-on-shared-sshd@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code-with-shared-sshd@example.com@localhost) Choose action:
 > 2
 == Use a Login code ==
 Enter the code in the login page
@@ -586,7 +586,7 @@ https://www.ubuntu-it.org/
   1. Wait for authentication result
   2. Regenerate code
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code-on-shared-sshd@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code-with-shared-sshd@example.com@localhost) Choose action:
 > 2
 == Use a Login code ==
 Enter the code in the login page
@@ -596,30 +596,30 @@ https://ubuntu.com
   1. Wait for authentication result
   2. Regenerate code
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code-on-shared-sshd@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code-with-shared-sshd@example.com@localhost) Choose action:
 > 1
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code-on-shared-sshd@localhost) Gimme your password:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-authenticate-user-with-qr-code-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-authenticate-user-with-qr-code-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 2
 == Use a Login code ==
 Enter the code in the login page
@@ -629,7 +629,7 @@ https://ubuntu.com
   1. Wait for authentication result
   2. Regenerate code
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code-on-shared-sshd@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code-with-shared-sshd@example.com@localhost) Choose action:
 > 2
 == Use a Login code ==
 Enter the code in the login page
@@ -639,7 +639,7 @@ https://ubuntu.fr/
   1. Wait for authentication result
   2. Regenerate code
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code-on-shared-sshd@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code-with-shared-sshd@example.com@localhost) Choose action:
 > 2
 == Use a Login code ==
 Enter the code in the login page
@@ -649,7 +649,7 @@ https://ubuntuforum-br.org/
   1. Wait for authentication result
   2. Regenerate code
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code-on-shared-sshd@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code-with-shared-sshd@example.com@localhost) Choose action:
 > 2
 == Use a Login code ==
 Enter the code in the login page
@@ -659,7 +659,7 @@ https://www.ubuntu-it.org/
   1. Wait for authentication result
   2. Regenerate code
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code-on-shared-sshd@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code-with-shared-sshd@example.com@localhost) Choose action:
 > 2
 == Use a Login code ==
 Enter the code in the login page
@@ -669,13 +669,13 @@ https://ubuntu.com
   1. Wait for authentication result
   2. Regenerate code
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-authenticate-user-with-qr-code-on-shared-sshd@localhost) Choose action:
+(user-integration-pre-check-ssh-authenticate-user-with-qr-code-with-shared-sshd@example.com@localhost) Choose action:
 > 1
-PAM Authenticate() finished for user 'user-integration-pre-check-ssh-authenticate-user-with-qr-code-on-shared-sshd'
-PAM AcctMgmt() finished for user 'user-integration-pre-check-ssh-authenticate-user-with-qr-code-on-shared-sshd'
+PAM Authenticate() finished for user 'user-integration-pre-check-ssh-authenticate-user-with-qr-code-with-shared-sshd@example.com'
+PAM AcctMgmt() finished for user 'user-integration-pre-check-ssh-authenticate-user-with-qr-code-with-shared-sshd@example.com'
  SSHD: Connected to ssh via authd module! [TestSSHAuthenticate]
   HOME=${AUTHD_TEST_HOME}
-  LOGNAME=user-integration-pre-check-ssh-authenticate-user-with-qr-code-on-shared-sshd
+  LOGNAME=user-integration-pre-check-ssh-authenticate-user-with-qr-code-with-shared-sshd@example.com
   PATH=${AUTHD_TEST_PATH}
   PWD=${AUTHD_TEST_PWD}
   SHELL=/bin/sh
@@ -683,7 +683,7 @@ PAM AcctMgmt() finished for user 'user-integration-pre-check-ssh-authenticate-us
   SSH_CONNECTION=${AUTHD_TEST_SSH_CONNECTION}
   SSH_TTY=${AUTHD_TEST_SSH_TTY}
   TERM=xterm-256color
-  USER=user-integration-pre-check-ssh-authenticate-user-with-qr-code-on-shared-sshd
+  USER=user-integration-pre-check-ssh-authenticate-user-with-qr-code-with-shared-sshd@example.com
 Connection to localhost closed.
 >
 ────────────────────────────────────────────────────────────────────────────────
diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_upper_case_using_lower_case_after_db_migration b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_upper_case_using_lower_case_after_db_migration
index 8373a5b8e4..de891dbc72 100644
--- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_upper_case_using_lower_case_after_db_migration
+++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_upper_case_using_lower_case_after_db_migration
@@ -1,27 +1,27 @@
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-upper-case@localhost) Gimme your password:
+(user-integration-upper-case@example.com@localhost) Gimme your password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-upper-case@localhost) Gimme your password:
+(user-integration-upper-case@example.com@localhost) Gimme your password:
 >
-PAM Authenticate() finished for user 'user-integration-upper-case'
-PAM AcctMgmt() finished for user 'user-integration-upper-case'
-Environment:
-  USER=user-integration-upper-case
-  LOGNAME=user-integration-upper-case
+PAM Authenticate() finished for user 'user-integration-upper-case@example.com'
+PAM AcctMgmt() finished for user 'user-integration-upper-case@example.com'
+ SSHD: Connected to ssh via authd module! [TestSSHAuthenticate/Authenticate_user_with_upper_case_using_lower_case_after_db_migration]
   HOME=${AUTHD_TEST_HOME}
+  LOGNAME=user-integration-upper-case@example.com
   PATH=${AUTHD_TEST_PATH}
+  PWD=${AUTHD_TEST_PWD}
   SHELL=/bin/sh
-  TERM=xterm-256color
   SSH_CLIENT=${AUTHD_TEST_SSH_CLIENT}
   SSH_CONNECTION=${AUTHD_TEST_SSH_CONNECTION}
   SSH_TTY=${AUTHD_TEST_SSH_TTY}
- SSHD: Connected to ssh via authd module! [TestSSHAuthenticate/Authenticate_user_with_upper_case_using_lower_case_after_db_migration]
+  TERM=xterm-256color
+  USER=user-integration-upper-case@example.com
 Connection to localhost closed.
 >
 ────────────────────────────────────────────────────────────────────────────────
diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_upper_case_using_lower_case_after_db_migration.group b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_upper_case_using_lower_case_after_db_migration.group
new file mode 100644
index 0000000000..2c7783d30a
--- /dev/null
+++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_upper_case_using_lower_case_after_db_migration.group
@@ -0,0 +1,6 @@
+localgroup:x:41:user-integration-with-mixed-case@example.com,user-integration-cached@example.com,user-integration-pre-check-with-upper-case@example.com,user-integration-upper-case@example.com,user-pre-check@example.com
+some-group-for-user-integration-WITH-Mixed-CaSe@example.com:x:101:user-integration-with-mixed-case@example.com
+some-group-for-user-integration-cached@example.com:x:102:user-integration-cached@example.com
+some-group-for-user-integration-pre-check-WITH-UPPER-CASE@example.com:x:103:user-integration-pre-check-with-upper-case@example.com
+some-group-for-user-integration-UPPER-CASE@example.com:x:104:user-integration-upper-case@example.com
+some-group-for-user-pre-check@example.com:x:105:user-pre-check@example.com
diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_upper_case_using_lower_case_after_db_migration.group.backup b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_upper_case_using_lower_case_after_db_migration.group.backup
new file mode 100644
index 0000000000..7fe8ba8346
--- /dev/null
+++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_upper_case_using_lower_case_after_db_migration.group.backup
@@ -0,0 +1,6 @@
+localgroup:x:41:user-integration-WITH-Mixed-CaSe@example.com,user-integration-cached@example.com,user-integration-pre-check-WITH-UPPER-CASE@example.com,user-integration-UPPER-CASE@example.com,user-pre-check@example.com
+some-group-for-user-integration-WITH-Mixed-CaSe@example.com:x:101:user-integration-WITH-Mixed-CaSe@example.com
+some-group-for-user-integration-cached@example.com:x:102:user-integration-cached@example.com
+some-group-for-user-integration-pre-check-WITH-UPPER-CASE@example.com:x:103:user-integration-pre-check-WITH-UPPER-CASE@example.com
+some-group-for-user-integration-UPPER-CASE@example.com:x:104:user-integration-UPPER-CASE@example.com
+some-group-for-user-pre-check@example.com:x:105:user-pre-check@example.com
diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_upper_case_using_lower_case_after_db_migration.groups b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_upper_case_using_lower_case_after_db_migration.groups
deleted file mode 100644
index f31a69be33..0000000000
--- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_upper_case_using_lower_case_after_db_migration.groups
+++ /dev/null
@@ -1,6 +0,0 @@
-localgroup:x:41:user-integration-with-mixed-case,user-integration-cached,user-integration-pre-check-with-upper-case,user-integration-upper-case,user-pre-check
-some-group-for-user-integration-WITH-Mixed-CaSe:x:101:user-integration-with-mixed-case
-some-group-for-user-integration-cached:x:102:user-integration-cached
-some-group-for-user-integration-pre-check-WITH-UPPER-CASE:x:103:user-integration-pre-check-with-upper-case
-some-group-for-user-integration-UPPER-CASE:x:104:user-integration-upper-case
-some-group-for-user-pre-check:x:105:user-pre-check
diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_upper_case_using_lower_case_after_db_migration_on_shared_SSHd.groups b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_upper_case_using_lower_case_after_db_migration_on_shared_SSHd.groups
deleted file mode 100644
index f31a69be33..0000000000
--- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_upper_case_using_lower_case_after_db_migration_on_shared_SSHd.groups
+++ /dev/null
@@ -1,6 +0,0 @@
-localgroup:x:41:user-integration-with-mixed-case,user-integration-cached,user-integration-pre-check-with-upper-case,user-integration-upper-case,user-pre-check
-some-group-for-user-integration-WITH-Mixed-CaSe:x:101:user-integration-with-mixed-case
-some-group-for-user-integration-cached:x:102:user-integration-cached
-some-group-for-user-integration-pre-check-WITH-UPPER-CASE:x:103:user-integration-pre-check-with-upper-case
-some-group-for-user-integration-UPPER-CASE:x:104:user-integration-upper-case
-some-group-for-user-pre-check:x:105:user-pre-check
diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_upper_case_using_lower_case_after_db_migration_on_shared_SSHd b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_upper_case_using_lower_case_after_db_migration_with_shared_sshd
similarity index 76%
rename from pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_upper_case_using_lower_case_after_db_migration_on_shared_SSHd
rename to pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_upper_case_using_lower_case_after_db_migration_with_shared_sshd
index c30360165b..1539e7f1ad 100644
--- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_upper_case_using_lower_case_after_db_migration_on_shared_SSHd
+++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_upper_case_using_lower_case_after_db_migration_with_shared_sshd
@@ -1,27 +1,27 @@
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-upper-case@localhost) Gimme your password:
+(user-integration-upper-case@example.com@localhost) Gimme your password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-upper-case@localhost) Gimme your password:
+(user-integration-upper-case@example.com@localhost) Gimme your password:
 >
-PAM Authenticate() finished for user 'user-integration-upper-case'
-PAM AcctMgmt() finished for user 'user-integration-upper-case'
-Environment:
-  USER=user-integration-upper-case
-  LOGNAME=user-integration-upper-case
+PAM Authenticate() finished for user 'user-integration-upper-case@example.com'
+PAM AcctMgmt() finished for user 'user-integration-upper-case@example.com'
+ SSHD: Connected to ssh via authd module! [TestSSHAuthenticate/Authenticate_user_with_upper_case_using_lower_case_after_db_migration_with_shared_sshd]
   HOME=${AUTHD_TEST_HOME}
+  LOGNAME=user-integration-upper-case@example.com
   PATH=${AUTHD_TEST_PATH}
+  PWD=${AUTHD_TEST_PWD}
   SHELL=/bin/sh
-  TERM=xterm-256color
   SSH_CLIENT=${AUTHD_TEST_SSH_CLIENT}
   SSH_CONNECTION=${AUTHD_TEST_SSH_CONNECTION}
   SSH_TTY=${AUTHD_TEST_SSH_TTY}
- SSHD: Connected to ssh via authd module! [TestSSHAuthenticate/Authenticate_user_with_upper_case_using_lower_case_after_db_migration_on_shared_SSHd]
+  TERM=xterm-256color
+  USER=user-integration-upper-case@example.com
 Connection to localhost closed.
 >
 ────────────────────────────────────────────────────────────────────────────────
diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_upper_case_using_lower_case_after_db_migration_with_shared_sshd.group b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_upper_case_using_lower_case_after_db_migration_with_shared_sshd.group
new file mode 100644
index 0000000000..2c7783d30a
--- /dev/null
+++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_upper_case_using_lower_case_after_db_migration_with_shared_sshd.group
@@ -0,0 +1,6 @@
+localgroup:x:41:user-integration-with-mixed-case@example.com,user-integration-cached@example.com,user-integration-pre-check-with-upper-case@example.com,user-integration-upper-case@example.com,user-pre-check@example.com
+some-group-for-user-integration-WITH-Mixed-CaSe@example.com:x:101:user-integration-with-mixed-case@example.com
+some-group-for-user-integration-cached@example.com:x:102:user-integration-cached@example.com
+some-group-for-user-integration-pre-check-WITH-UPPER-CASE@example.com:x:103:user-integration-pre-check-with-upper-case@example.com
+some-group-for-user-integration-UPPER-CASE@example.com:x:104:user-integration-upper-case@example.com
+some-group-for-user-pre-check@example.com:x:105:user-pre-check@example.com
diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_upper_case_using_lower_case_after_db_migration_with_shared_sshd.group.backup b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_upper_case_using_lower_case_after_db_migration_with_shared_sshd.group.backup
new file mode 100644
index 0000000000..7fe8ba8346
--- /dev/null
+++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_upper_case_using_lower_case_after_db_migration_with_shared_sshd.group.backup
@@ -0,0 +1,6 @@
+localgroup:x:41:user-integration-WITH-Mixed-CaSe@example.com,user-integration-cached@example.com,user-integration-pre-check-WITH-UPPER-CASE@example.com,user-integration-UPPER-CASE@example.com,user-pre-check@example.com
+some-group-for-user-integration-WITH-Mixed-CaSe@example.com:x:101:user-integration-WITH-Mixed-CaSe@example.com
+some-group-for-user-integration-cached@example.com:x:102:user-integration-cached@example.com
+some-group-for-user-integration-pre-check-WITH-UPPER-CASE@example.com:x:103:user-integration-pre-check-WITH-UPPER-CASE@example.com
+some-group-for-user-integration-UPPER-CASE@example.com:x:104:user-integration-UPPER-CASE@example.com
+some-group-for-user-pre-check@example.com:x:105:user-pre-check@example.com
diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Autoselect_local_broker_for_local_user_on_shared_SSHd b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Autoselect_local_broker_for_local_user_with_shared_sshd
similarity index 100%
rename from pam/integration-tests/testdata/golden/TestSSHAuthenticate/Autoselect_local_broker_for_local_user_on_shared_SSHd
rename to pam/integration-tests/testdata/golden/TestSSHAuthenticate/Autoselect_local_broker_for_local_user_with_shared_sshd
diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Deny_authentication_if_max_attempts_reached b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Deny_authentication_if_max_attempts_reached
index bcc1ec2fe6..935128747a 100644
--- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Deny_authentication_if_max_attempts_reached
+++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Deny_authentication_if_max_attempts_reached
@@ -2,150 +2,150 @@
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-deny-authentication-if-max-attempts-reached@localhost) Choose your provider:
+(user-integration-pre-check-ssh-deny-authentication-if-max-attempts-reached@example.com@localhost) Choose your provider:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-deny-authentication-if-max-attempts-reached@localhost) Choose your provider:
+(user-integration-pre-check-ssh-deny-authentication-if-max-attempts-reached@example.com@localhost) Choose your provider:
 > 2
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-deny-authentication-if-max-attempts-reached@localhost) Choose your provider:
+(user-integration-pre-check-ssh-deny-authentication-if-max-attempts-reached@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-deny-authentication-if-max-attempts-reached@localhost) Gimme your password:
+(user-integration-pre-check-ssh-deny-authentication-if-max-attempts-reached@example.com@localhost) Gimme your password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-deny-authentication-if-max-attempts-reached@localhost) Choose your provider:
+(user-integration-pre-check-ssh-deny-authentication-if-max-attempts-reached@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-deny-authentication-if-max-attempts-reached@localhost) Gimme your password:
+(user-integration-pre-check-ssh-deny-authentication-if-max-attempts-reached@example.com@localhost) Gimme your password:
 >
 invalid password 'wrongpass', should be 'goodpass'
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-deny-authentication-if-max-attempts-reached@localhost) Gimme your password:
+(user-integration-pre-check-ssh-deny-authentication-if-max-attempts-reached@example.com@localhost) Gimme your password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-deny-authentication-if-max-attempts-reached@localhost) Choose your provider:
+(user-integration-pre-check-ssh-deny-authentication-if-max-attempts-reached@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-deny-authentication-if-max-attempts-reached@localhost) Gimme your password:
+(user-integration-pre-check-ssh-deny-authentication-if-max-attempts-reached@example.com@localhost) Gimme your password:
 >
 invalid password 'wrongpass', should be 'goodpass'
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-deny-authentication-if-max-attempts-reached@localhost) Gimme your password:
+(user-integration-pre-check-ssh-deny-authentication-if-max-attempts-reached@example.com@localhost) Gimme your password:
 >
 invalid password 'wrongpass', should be 'goodpass'
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-deny-authentication-if-max-attempts-reached@localhost) Gimme your password:
+(user-integration-pre-check-ssh-deny-authentication-if-max-attempts-reached@example.com@localhost) Gimme your password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-deny-authentication-if-max-attempts-reached@localhost) Choose your provider:
+(user-integration-pre-check-ssh-deny-authentication-if-max-attempts-reached@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-deny-authentication-if-max-attempts-reached@localhost) Gimme your password:
+(user-integration-pre-check-ssh-deny-authentication-if-max-attempts-reached@example.com@localhost) Gimme your password:
 >
 invalid password 'wrongpass', should be 'goodpass'
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-deny-authentication-if-max-attempts-reached@localhost) Gimme your password:
+(user-integration-pre-check-ssh-deny-authentication-if-max-attempts-reached@example.com@localhost) Gimme your password:
 >
 invalid password 'wrongpass', should be 'goodpass'
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-deny-authentication-if-max-attempts-reached@localhost) Gimme your password:
+(user-integration-pre-check-ssh-deny-authentication-if-max-attempts-reached@example.com@localhost) Gimme your password:
 >
 invalid password 'wrongpass', should be 'goodpass'
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-deny-authentication-if-max-attempts-reached@localhost) Gimme your password:
+(user-integration-pre-check-ssh-deny-authentication-if-max-attempts-reached@example.com@localhost) Gimme your password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-deny-authentication-if-max-attempts-reached@localhost) Choose your provider:
+(user-integration-pre-check-ssh-deny-authentication-if-max-attempts-reached@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-deny-authentication-if-max-attempts-reached@localhost) Gimme your password:
+(user-integration-pre-check-ssh-deny-authentication-if-max-attempts-reached@example.com@localhost) Gimme your password:
 >
 invalid password 'wrongpass', should be 'goodpass'
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-deny-authentication-if-max-attempts-reached@localhost) Gimme your password:
+(user-integration-pre-check-ssh-deny-authentication-if-max-attempts-reached@example.com@localhost) Gimme your password:
 >
 invalid password 'wrongpass', should be 'goodpass'
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-deny-authentication-if-max-attempts-reached@localhost) Gimme your password:
+(user-integration-pre-check-ssh-deny-authentication-if-max-attempts-reached@example.com@localhost) Gimme your password:
 >
 invalid password 'wrongpass', should be 'goodpass'
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-deny-authentication-if-max-attempts-reached@localhost) Gimme your password:
+(user-integration-pre-check-ssh-deny-authentication-if-max-attempts-reached@example.com@localhost) Gimme your password:
 >
 invalid password 'wrongpass', should be 'goodpass'
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-deny-authentication-if-max-attempts-reached@localhost) Gimme your password:
+(user-integration-pre-check-ssh-deny-authentication-if-max-attempts-reached@example.com@localhost) Gimme your password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-deny-authentication-if-max-attempts-reached@localhost) Choose your provider:
+(user-integration-pre-check-ssh-deny-authentication-if-max-attempts-reached@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-deny-authentication-if-max-attempts-reached@localhost) Gimme your password:
+(user-integration-pre-check-ssh-deny-authentication-if-max-attempts-reached@example.com@localhost) Gimme your password:
 >
 invalid password 'wrongpass', should be 'goodpass'
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-deny-authentication-if-max-attempts-reached@localhost) Gimme your password:
+(user-integration-pre-check-ssh-deny-authentication-if-max-attempts-reached@example.com@localhost) Gimme your password:
 >
 invalid password 'wrongpass', should be 'goodpass'
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-deny-authentication-if-max-attempts-reached@localhost) Gimme your password:
+(user-integration-pre-check-ssh-deny-authentication-if-max-attempts-reached@example.com@localhost) Gimme your password:
 >
 invalid password 'wrongpass', should be 'goodpass'
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-deny-authentication-if-max-attempts-reached@localhost) Gimme your password:
+(user-integration-pre-check-ssh-deny-authentication-if-max-attempts-reached@example.com@localhost) Gimme your password:
 >
 invalid password 'wrongpass', should be 'goodpass'
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-deny-authentication-if-max-attempts-reached@localhost) Gimme your password:
+(user-integration-pre-check-ssh-deny-authentication-if-max-attempts-reached@example.com@localhost) Gimme your password:
 >
 invalid password 'wrongpass', should be 'goodpass'
 Received disconnect from ${SSH_HOST} port ${SSH_PORT} Too many authentication failures
diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Deny_authentication_if_max_attempts_reached_on_shared_SSHd b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Deny_authentication_if_max_attempts_reached_with_shared_sshd
similarity index 79%
rename from pam/integration-tests/testdata/golden/TestSSHAuthenticate/Deny_authentication_if_max_attempts_reached_on_shared_SSHd
rename to pam/integration-tests/testdata/golden/TestSSHAuthenticate/Deny_authentication_if_max_attempts_reached_with_shared_sshd
index 8254e6e9e5..cd857bbbb9 100644
--- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Deny_authentication_if_max_attempts_reached_on_shared_SSHd
+++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Deny_authentication_if_max_attempts_reached_with_shared_sshd
@@ -2,150 +2,150 @@
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-deny-authentication-if-max-attempts-reached-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-deny-authentication-if-max-attempts-reached-with-shared-sshd@example.com@localhost) Choose your provider:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-deny-authentication-if-max-attempts-reached-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-deny-authentication-if-max-attempts-reached-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-deny-authentication-if-max-attempts-reached-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-deny-authentication-if-max-attempts-reached-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-deny-authentication-if-max-attempts-reached-on-shared-sshd@localhost) Gimme your password:
+(user-integration-pre-check-ssh-deny-authentication-if-max-attempts-reached-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-deny-authentication-if-max-attempts-reached-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-deny-authentication-if-max-attempts-reached-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-deny-authentication-if-max-attempts-reached-on-shared-sshd@localhost) Gimme your password:
+(user-integration-pre-check-ssh-deny-authentication-if-max-attempts-reached-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 invalid password 'wrongpass', should be 'goodpass'
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-deny-authentication-if-max-attempts-reached-on-shared-sshd@localhost) Gimme your password:
+(user-integration-pre-check-ssh-deny-authentication-if-max-attempts-reached-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-deny-authentication-if-max-attempts-reached-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-deny-authentication-if-max-attempts-reached-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-deny-authentication-if-max-attempts-reached-on-shared-sshd@localhost) Gimme your password:
+(user-integration-pre-check-ssh-deny-authentication-if-max-attempts-reached-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 invalid password 'wrongpass', should be 'goodpass'
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-deny-authentication-if-max-attempts-reached-on-shared-sshd@localhost) Gimme your password:
+(user-integration-pre-check-ssh-deny-authentication-if-max-attempts-reached-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 invalid password 'wrongpass', should be 'goodpass'
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-deny-authentication-if-max-attempts-reached-on-shared-sshd@localhost) Gimme your password:
+(user-integration-pre-check-ssh-deny-authentication-if-max-attempts-reached-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-deny-authentication-if-max-attempts-reached-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-deny-authentication-if-max-attempts-reached-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-deny-authentication-if-max-attempts-reached-on-shared-sshd@localhost) Gimme your password:
+(user-integration-pre-check-ssh-deny-authentication-if-max-attempts-reached-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 invalid password 'wrongpass', should be 'goodpass'
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-deny-authentication-if-max-attempts-reached-on-shared-sshd@localhost) Gimme your password:
+(user-integration-pre-check-ssh-deny-authentication-if-max-attempts-reached-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 invalid password 'wrongpass', should be 'goodpass'
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-deny-authentication-if-max-attempts-reached-on-shared-sshd@localhost) Gimme your password:
+(user-integration-pre-check-ssh-deny-authentication-if-max-attempts-reached-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 invalid password 'wrongpass', should be 'goodpass'
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-deny-authentication-if-max-attempts-reached-on-shared-sshd@localhost) Gimme your password:
+(user-integration-pre-check-ssh-deny-authentication-if-max-attempts-reached-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-deny-authentication-if-max-attempts-reached-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-deny-authentication-if-max-attempts-reached-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-deny-authentication-if-max-attempts-reached-on-shared-sshd@localhost) Gimme your password:
+(user-integration-pre-check-ssh-deny-authentication-if-max-attempts-reached-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 invalid password 'wrongpass', should be 'goodpass'
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-deny-authentication-if-max-attempts-reached-on-shared-sshd@localhost) Gimme your password:
+(user-integration-pre-check-ssh-deny-authentication-if-max-attempts-reached-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 invalid password 'wrongpass', should be 'goodpass'
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-deny-authentication-if-max-attempts-reached-on-shared-sshd@localhost) Gimme your password:
+(user-integration-pre-check-ssh-deny-authentication-if-max-attempts-reached-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 invalid password 'wrongpass', should be 'goodpass'
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-deny-authentication-if-max-attempts-reached-on-shared-sshd@localhost) Gimme your password:
+(user-integration-pre-check-ssh-deny-authentication-if-max-attempts-reached-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 invalid password 'wrongpass', should be 'goodpass'
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-deny-authentication-if-max-attempts-reached-on-shared-sshd@localhost) Gimme your password:
+(user-integration-pre-check-ssh-deny-authentication-if-max-attempts-reached-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-deny-authentication-if-max-attempts-reached-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-deny-authentication-if-max-attempts-reached-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-deny-authentication-if-max-attempts-reached-on-shared-sshd@localhost) Gimme your password:
+(user-integration-pre-check-ssh-deny-authentication-if-max-attempts-reached-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 invalid password 'wrongpass', should be 'goodpass'
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-deny-authentication-if-max-attempts-reached-on-shared-sshd@localhost) Gimme your password:
+(user-integration-pre-check-ssh-deny-authentication-if-max-attempts-reached-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 invalid password 'wrongpass', should be 'goodpass'
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-deny-authentication-if-max-attempts-reached-on-shared-sshd@localhost) Gimme your password:
+(user-integration-pre-check-ssh-deny-authentication-if-max-attempts-reached-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 invalid password 'wrongpass', should be 'goodpass'
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-deny-authentication-if-max-attempts-reached-on-shared-sshd@localhost) Gimme your password:
+(user-integration-pre-check-ssh-deny-authentication-if-max-attempts-reached-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 invalid password 'wrongpass', should be 'goodpass'
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-deny-authentication-if-max-attempts-reached-on-shared-sshd@localhost) Gimme your password:
+(user-integration-pre-check-ssh-deny-authentication-if-max-attempts-reached-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 invalid password 'wrongpass', should be 'goodpass'
 Received disconnect from ${SSH_HOST} port ${SSH_PORT} Too many authentication failures
diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Deny_authentication_if_newpassword_does_not_match_required_criteria b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Deny_authentication_if_newpassword_does_not_match_required_criteria
index 34d48d8cc5..e28fee8667 100644
--- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Deny_authentication_if_newpassword_does_not_match_required_criteria
+++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Deny_authentication_if_newpassword_does_not_match_required_criteria
@@ -2,337 +2,337 @@
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@localhost) Choose your provider:
+(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@example.com@localhost) Choose your provider:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@localhost) Choose your provider:
+(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@example.com@localhost) Choose your provider:
 > 2
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@localhost) Choose your provider:
+(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@localhost) Gimme your password:
+(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@example.com@localhost) Gimme your password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@localhost) Choose your provider:
+(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@localhost) Gimme your password:
+(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@example.com@localhost) Gimme your password:
 >
 Password reset, 1 step(s) missing
 == Password reset ==
 Enter 'r' to cancel the request and go back to choose the provider
-(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@localhost) Enter your new password:
+(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@example.com@localhost) Enter your new password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@localhost) Choose your provider:
+(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@localhost) Gimme your password:
+(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@example.com@localhost) Gimme your password:
 >
 Password reset, 1 step(s) missing
 == Password reset ==
 Enter 'r' to cancel the request and go back to choose the provider
-(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@localhost) Enter your new password:
+(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@example.com@localhost) Enter your new password:
 >
 No password supplied
 == Password reset ==
 Enter 'r' to cancel the request and go back to choose the provider
-(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@localhost) Enter your new password:
+(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@example.com@localhost) Enter your new password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@localhost) Choose your provider:
+(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@localhost) Gimme your password:
+(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@example.com@localhost) Gimme your password:
 >
 Password reset, 1 step(s) missing
 == Password reset ==
 Enter 'r' to cancel the request and go back to choose the provider
-(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@localhost) Enter your new password:
+(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@example.com@localhost) Enter your new password:
 >
 No password supplied
 == Password reset ==
 Enter 'r' to cancel the request and go back to choose the provider
-(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@localhost) Enter your new password:
+(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@example.com@localhost) Enter your new password:
 >
 The password is shorter than 8 characters
 == Password reset ==
 Enter 'r' to cancel the request and go back to choose the provider
-(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@localhost) Enter your new password:
+(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@example.com@localhost) Enter your new password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@localhost) Choose your provider:
+(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@localhost) Gimme your password:
+(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@example.com@localhost) Gimme your password:
 >
 Password reset, 1 step(s) missing
 == Password reset ==
 Enter 'r' to cancel the request and go back to choose the provider
-(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@localhost) Enter your new password:
+(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@example.com@localhost) Enter your new password:
 >
 No password supplied
 == Password reset ==
 Enter 'r' to cancel the request and go back to choose the provider
-(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@localhost) Enter your new password:
+(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@example.com@localhost) Enter your new password:
 >
 The password is shorter than 8 characters
 == Password reset ==
 Enter 'r' to cancel the request and go back to choose the provider
-(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@localhost) Enter your new password:
+(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@example.com@localhost) Enter your new password:
 >
 The password fails the dictionary check - it is too simplistic/systematic
 == Password reset ==
 Enter 'r' to cancel the request and go back to choose the provider
-(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@localhost) Enter your new password:
+(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@example.com@localhost) Enter your new password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@localhost) Choose your provider:
+(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@localhost) Gimme your password:
+(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@example.com@localhost) Gimme your password:
 >
 Password reset, 1 step(s) missing
 == Password reset ==
 Enter 'r' to cancel the request and go back to choose the provider
-(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@localhost) Enter your new password:
+(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@example.com@localhost) Enter your new password:
 >
 No password supplied
 == Password reset ==
 Enter 'r' to cancel the request and go back to choose the provider
-(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@localhost) Enter your new password:
+(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@example.com@localhost) Enter your new password:
 >
 The password is shorter than 8 characters
 == Password reset ==
 Enter 'r' to cancel the request and go back to choose the provider
-(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@localhost) Enter your new password:
+(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@example.com@localhost) Enter your new password:
 >
 The password fails the dictionary check - it is too simplistic/systematic
 == Password reset ==
 Enter 'r' to cancel the request and go back to choose the provider
-(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@localhost) Enter your new password:
+(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@example.com@localhost) Enter your new password:
 >
-(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@localhost) Confirm Password:
+(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@example.com@localhost) Confirm Password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@localhost) Choose your provider:
+(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@localhost) Gimme your password:
+(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@example.com@localhost) Gimme your password:
 >
 Password reset, 1 step(s) missing
 == Password reset ==
 Enter 'r' to cancel the request and go back to choose the provider
-(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@localhost) Enter your new password:
+(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@example.com@localhost) Enter your new password:
 >
 No password supplied
 == Password reset ==
 Enter 'r' to cancel the request and go back to choose the provider
-(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@localhost) Enter your new password:
+(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@example.com@localhost) Enter your new password:
 >
 The password is shorter than 8 characters
 == Password reset ==
 Enter 'r' to cancel the request and go back to choose the provider
-(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@localhost) Enter your new password:
+(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@example.com@localhost) Enter your new password:
 >
 The password fails the dictionary check - it is too simplistic/systematic
 == Password reset ==
 Enter 'r' to cancel the request and go back to choose the provider
-(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@localhost) Enter your new password:
+(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@example.com@localhost) Enter your new password:
 >
-(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@localhost) Confirm Password:
+(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@example.com@localhost) Confirm Password:
 >
 Password entries don't match
 == Password reset ==
 Enter 'r' to cancel the request and go back to choose the provider
-(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@localhost) Enter your new password:
+(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@example.com@localhost) Enter your new password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@localhost) Choose your provider:
+(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@localhost) Gimme your password:
+(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@example.com@localhost) Gimme your password:
 >
 Password reset, 1 step(s) missing
 == Password reset ==
 Enter 'r' to cancel the request and go back to choose the provider
-(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@localhost) Enter your new password:
+(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@example.com@localhost) Enter your new password:
 >
 No password supplied
 == Password reset ==
 Enter 'r' to cancel the request and go back to choose the provider
-(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@localhost) Enter your new password:
+(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@example.com@localhost) Enter your new password:
 >
 The password is shorter than 8 characters
 == Password reset ==
 Enter 'r' to cancel the request and go back to choose the provider
-(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@localhost) Enter your new password:
+(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@example.com@localhost) Enter your new password:
 >
 The password fails the dictionary check - it is too simplistic/systematic
 == Password reset ==
 Enter 'r' to cancel the request and go back to choose the provider
-(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@localhost) Enter your new password:
+(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@example.com@localhost) Enter your new password:
 >
-(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@localhost) Confirm Password:
+(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@example.com@localhost) Confirm Password:
 >
 Password entries don't match
 == Password reset ==
 Enter 'r' to cancel the request and go back to choose the provider
-(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@localhost) Enter your new password:
+(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@example.com@localhost) Enter your new password:
 >
 No password supplied
 == Password reset ==
 Enter 'r' to cancel the request and go back to choose the provider
-(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@localhost) Enter your new password:
+(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@example.com@localhost) Enter your new password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@localhost) Choose your provider:
+(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@localhost) Gimme your password:
+(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@example.com@localhost) Gimme your password:
 >
 Password reset, 1 step(s) missing
 == Password reset ==
 Enter 'r' to cancel the request and go back to choose the provider
-(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@localhost) Enter your new password:
+(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@example.com@localhost) Enter your new password:
 >
 No password supplied
 == Password reset ==
 Enter 'r' to cancel the request and go back to choose the provider
-(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@localhost) Enter your new password:
+(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@example.com@localhost) Enter your new password:
 >
 The password is shorter than 8 characters
 == Password reset ==
 Enter 'r' to cancel the request and go back to choose the provider
-(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@localhost) Enter your new password:
+(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@example.com@localhost) Enter your new password:
 >
 The password fails the dictionary check - it is too simplistic/systematic
 == Password reset ==
 Enter 'r' to cancel the request and go back to choose the provider
-(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@localhost) Enter your new password:
+(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@example.com@localhost) Enter your new password:
 >
-(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@localhost) Confirm Password:
+(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@example.com@localhost) Confirm Password:
 >
 Password entries don't match
 == Password reset ==
 Enter 'r' to cancel the request and go back to choose the provider
-(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@localhost) Enter your new password:
+(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@example.com@localhost) Enter your new password:
 >
 No password supplied
 == Password reset ==
 Enter 'r' to cancel the request and go back to choose the provider
-(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@localhost) Enter your new password:
+(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@example.com@localhost) Enter your new password:
 >
-(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@localhost) Confirm Password:
+(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@example.com@localhost) Confirm Password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@localhost) Choose your provider:
+(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@localhost) Gimme your password:
+(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@example.com@localhost) Gimme your password:
 >
 Password reset, 1 step(s) missing
 == Password reset ==
 Enter 'r' to cancel the request and go back to choose the provider
-(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@localhost) Enter your new password:
+(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@example.com@localhost) Enter your new password:
 >
 No password supplied
 == Password reset ==
 Enter 'r' to cancel the request and go back to choose the provider
-(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@localhost) Enter your new password:
+(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@example.com@localhost) Enter your new password:
 >
 The password is shorter than 8 characters
 == Password reset ==
 Enter 'r' to cancel the request and go back to choose the provider
-(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@localhost) Enter your new password:
+(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@example.com@localhost) Enter your new password:
 >
 The password fails the dictionary check - it is too simplistic/systematic
 == Password reset ==
 Enter 'r' to cancel the request and go back to choose the provider
-(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@localhost) Enter your new password:
+(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@example.com@localhost) Enter your new password:
 >
-(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@localhost) Confirm Password:
+(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@example.com@localhost) Confirm Password:
 >
 Password entries don't match
 == Password reset ==
 Enter 'r' to cancel the request and go back to choose the provider
-(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@localhost) Enter your new password:
+(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@example.com@localhost) Enter your new password:
 >
 No password supplied
 == Password reset ==
 Enter 'r' to cancel the request and go back to choose the provider
-(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@localhost) Enter your new password:
+(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@example.com@localhost) Enter your new password:
 >
-(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@localhost) Confirm Password:
+(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@example.com@localhost) Confirm Password:
 >
-PAM Authenticate() finished for user 'user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria'
-PAM AcctMgmt() finished for user 'user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria'
-Environment:
-  USER=user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria
-  LOGNAME=user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria
+PAM Authenticate() finished for user 'user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@example.com'
+PAM AcctMgmt() finished for user 'user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@example.com'
+ SSHD: Connected to ssh via authd module! [TestSSHAuthenticate/Deny_authentication_if_newpassword_does_not_match_required_criteria]
   HOME=${AUTHD_TEST_HOME}
+  LOGNAME=user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@example.com
   PATH=${AUTHD_TEST_PATH}
+  PWD=${AUTHD_TEST_PWD}
   SHELL=/bin/sh
-  TERM=xterm-256color
   SSH_CLIENT=${AUTHD_TEST_SSH_CLIENT}
   SSH_CONNECTION=${AUTHD_TEST_SSH_CONNECTION}
   SSH_TTY=${AUTHD_TEST_SSH_TTY}
- SSHD: Connected to ssh via authd module! [TestSSHAuthenticate/Deny_authentication_if_newpassword_does_not_match_required_criteria]
+  TERM=xterm-256color
+  USER=user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@example.com
 Connection to localhost closed.
 >
 ────────────────────────────────────────────────────────────────────────────────
diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Deny_authentication_if_newpassword_does_not_match_required_criteria_on_shared_SSHd b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Deny_authentication_if_newpassword_does_not_match_required_criteria_with_shared_sshd
similarity index 66%
rename from pam/integration-tests/testdata/golden/TestSSHAuthenticate/Deny_authentication_if_newpassword_does_not_match_required_criteria_on_shared_SSHd
rename to pam/integration-tests/testdata/golden/TestSSHAuthenticate/Deny_authentication_if_newpassword_does_not_match_required_criteria_with_shared_sshd
index c1f1f2c6f5..c37a1ce43e 100644
--- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Deny_authentication_if_newpassword_does_not_match_required_criteria_on_shared_SSHd
+++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Deny_authentication_if_newpassword_does_not_match_required_criteria_with_shared_sshd
@@ -2,329 +2,329 @@
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-on-shared-sshd@localhost) Choose your provider:
+(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-with-shared-sshd@example.com@localhost) Choose your provider:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-on-shared-sshd@localhost) Choose your provider:
+(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-on-shared-sshd@localhost) Choose your provider:
+(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-on-shared-sshd@localhost) Gimme your password:
+(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-on-shared-sshd@localhost) Choose your provider:
+(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-on-shared-sshd@localhost) Gimme your password:
+(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 Password reset, 1 step(s) missing
 == Password reset ==
 Enter 'r' to cancel the request and go back to choose the provider
-(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-on-shared-sshd@localhost) Enter your new password:
+(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-with-shared-sshd@example.com@localhost) Enter your new password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-on-shared-sshd@localhost) Choose your provider:
+(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-on-shared-sshd@localhost) Gimme your password:
+(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 Password reset, 1 step(s) missing
 == Password reset ==
 Enter 'r' to cancel the request and go back to choose the provider
-(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-on-shared-sshd@localhost) Enter your new password:
+(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-with-shared-sshd@example.com@localhost) Enter your new password:
 >
 No password supplied
 == Password reset ==
 Enter 'r' to cancel the request and go back to choose the provider
-(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-on-shared-sshd@localhost) Enter your new password:
+(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-with-shared-sshd@example.com@localhost) Enter your new password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-on-shared-sshd@localhost) Choose your provider:
+(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-on-shared-sshd@localhost) Gimme your password:
+(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 Password reset, 1 step(s) missing
 == Password reset ==
 Enter 'r' to cancel the request and go back to choose the provider
-(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-on-shared-sshd@localhost) Enter your new password:
+(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-with-shared-sshd@example.com@localhost) Enter your new password:
 >
 No password supplied
 == Password reset ==
 Enter 'r' to cancel the request and go back to choose the provider
-(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-on-shared-sshd@localhost) Enter your new password:
+(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-with-shared-sshd@example.com@localhost) Enter your new password:
 >
 The password is shorter than 8 characters
 == Password reset ==
 Enter 'r' to cancel the request and go back to choose the provider
-(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-on-shared-sshd@localhost) Enter your new password:
+(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-with-shared-sshd@example.com@localhost) Enter your new password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-on-shared-sshd@localhost) Choose your provider:
+(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-on-shared-sshd@localhost) Gimme your password:
+(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 Password reset, 1 step(s) missing
 == Password reset ==
 Enter 'r' to cancel the request and go back to choose the provider
-(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-on-shared-sshd@localhost) Enter your new password:
+(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-with-shared-sshd@example.com@localhost) Enter your new password:
 >
 No password supplied
 == Password reset ==
 Enter 'r' to cancel the request and go back to choose the provider
-(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-on-shared-sshd@localhost) Enter your new password:
+(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-with-shared-sshd@example.com@localhost) Enter your new password:
 >
 The password is shorter than 8 characters
 == Password reset ==
 Enter 'r' to cancel the request and go back to choose the provider
-(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-on-shared-sshd@localhost) Enter your new password:
+(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-with-shared-sshd@example.com@localhost) Enter your new password:
 >
 The password fails the dictionary check - it is too simplistic/systematic
 == Password reset ==
 Enter 'r' to cancel the request and go back to choose the provider
-(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-on-shared-sshd@localhost) Enter your new password:
+(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-with-shared-sshd@example.com@localhost) Enter your new password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-on-shared-sshd@localhost) Choose your provider:
+(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-on-shared-sshd@localhost) Gimme your password:
+(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 Password reset, 1 step(s) missing
 == Password reset ==
 Enter 'r' to cancel the request and go back to choose the provider
-(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-on-shared-sshd@localhost) Enter your new password:
+(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-with-shared-sshd@example.com@localhost) Enter your new password:
 >
 No password supplied
 == Password reset ==
 Enter 'r' to cancel the request and go back to choose the provider
-(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-on-shared-sshd@localhost) Enter your new password:
+(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-with-shared-sshd@example.com@localhost) Enter your new password:
 >
 The password is shorter than 8 characters
 == Password reset ==
 Enter 'r' to cancel the request and go back to choose the provider
-(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-on-shared-sshd@localhost) Enter your new password:
+(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-with-shared-sshd@example.com@localhost) Enter your new password:
 >
 The password fails the dictionary check - it is too simplistic/systematic
 == Password reset ==
 Enter 'r' to cancel the request and go back to choose the provider
-(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-on-shared-sshd@localhost) Enter your new password:
+(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-with-shared-sshd@example.com@localhost) Enter your new password:
 >
-(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-on-shared-sshd@localhost) Confirm Password:
+(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-with-shared-sshd@example.com@localhost) Confirm Password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-on-shared-sshd@localhost) Choose your provider:
+(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-on-shared-sshd@localhost) Gimme your password:
+(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 Password reset, 1 step(s) missing
 == Password reset ==
 Enter 'r' to cancel the request and go back to choose the provider
-(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-on-shared-sshd@localhost) Enter your new password:
+(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-with-shared-sshd@example.com@localhost) Enter your new password:
 >
 No password supplied
 == Password reset ==
 Enter 'r' to cancel the request and go back to choose the provider
-(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-on-shared-sshd@localhost) Enter your new password:
+(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-with-shared-sshd@example.com@localhost) Enter your new password:
 >
 The password is shorter than 8 characters
 == Password reset ==
 Enter 'r' to cancel the request and go back to choose the provider
-(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-on-shared-sshd@localhost) Enter your new password:
+(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-with-shared-sshd@example.com@localhost) Enter your new password:
 >
 The password fails the dictionary check - it is too simplistic/systematic
 == Password reset ==
 Enter 'r' to cancel the request and go back to choose the provider
-(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-on-shared-sshd@localhost) Enter your new password:
+(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-with-shared-sshd@example.com@localhost) Enter your new password:
 >
-(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-on-shared-sshd@localhost) Confirm Password:
+(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-with-shared-sshd@example.com@localhost) Confirm Password:
 >
 Password entries don't match
 == Password reset ==
 Enter 'r' to cancel the request and go back to choose the provider
-(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-on-shared-sshd@localhost) Enter your new password:
+(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-with-shared-sshd@example.com@localhost) Enter your new password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-on-shared-sshd@localhost) Choose your provider:
+(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-on-shared-sshd@localhost) Gimme your password:
+(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 Password reset, 1 step(s) missing
 == Password reset ==
 Enter 'r' to cancel the request and go back to choose the provider
-(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-on-shared-sshd@localhost) Enter your new password:
+(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-with-shared-sshd@example.com@localhost) Enter your new password:
 >
 No password supplied
 == Password reset ==
 Enter 'r' to cancel the request and go back to choose the provider
-(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-on-shared-sshd@localhost) Enter your new password:
+(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-with-shared-sshd@example.com@localhost) Enter your new password:
 >
 The password is shorter than 8 characters
 == Password reset ==
 Enter 'r' to cancel the request and go back to choose the provider
-(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-on-shared-sshd@localhost) Enter your new password:
+(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-with-shared-sshd@example.com@localhost) Enter your new password:
 >
 The password fails the dictionary check - it is too simplistic/systematic
 == Password reset ==
 Enter 'r' to cancel the request and go back to choose the provider
-(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-on-shared-sshd@localhost) Enter your new password:
+(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-with-shared-sshd@example.com@localhost) Enter your new password:
 >
-(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-on-shared-sshd@localhost) Confirm Password:
+(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-with-shared-sshd@example.com@localhost) Confirm Password:
 >
 Password entries don't match
 == Password reset ==
 Enter 'r' to cancel the request and go back to choose the provider
-(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-on-shared-sshd@localhost) Enter your new password:
+(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-with-shared-sshd@example.com@localhost) Enter your new password:
 >
 No password supplied
 == Password reset ==
 Enter 'r' to cancel the request and go back to choose the provider
-(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-on-shared-sshd@localhost) Enter your new password:
+(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-with-shared-sshd@example.com@localhost) Enter your new password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-on-shared-sshd@localhost) Choose your provider:
+(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-on-shared-sshd@localhost) Gimme your password:
+(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 Password reset, 1 step(s) missing
 == Password reset ==
 Enter 'r' to cancel the request and go back to choose the provider
-(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-on-shared-sshd@localhost) Enter your new password:
+(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-with-shared-sshd@example.com@localhost) Enter your new password:
 >
 No password supplied
 == Password reset ==
 Enter 'r' to cancel the request and go back to choose the provider
-(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-on-shared-sshd@localhost) Enter your new password:
+(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-with-shared-sshd@example.com@localhost) Enter your new password:
 >
 The password is shorter than 8 characters
 == Password reset ==
 Enter 'r' to cancel the request and go back to choose the provider
-(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-on-shared-sshd@localhost) Enter your new password:
+(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-with-shared-sshd@example.com@localhost) Enter your new password:
 >
 The password fails the dictionary check - it is too simplistic/systematic
 == Password reset ==
 Enter 'r' to cancel the request and go back to choose the provider
-(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-on-shared-sshd@localhost) Enter your new password:
+(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-with-shared-sshd@example.com@localhost) Enter your new password:
 >
-(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-on-shared-sshd@localhost) Confirm Password:
+(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-with-shared-sshd@example.com@localhost) Confirm Password:
 >
 Password entries don't match
 == Password reset ==
 Enter 'r' to cancel the request and go back to choose the provider
-(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-on-shared-sshd@localhost) Enter your new password:
+(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-with-shared-sshd@example.com@localhost) Enter your new password:
 >
 No password supplied
 == Password reset ==
 Enter 'r' to cancel the request and go back to choose the provider
-(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-on-shared-sshd@localhost) Enter your new password:
+(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-with-shared-sshd@example.com@localhost) Enter your new password:
 >
-(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-on-shared-sshd@localhost) Confirm Password:
+(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-with-shared-sshd@example.com@localhost) Confirm Password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-on-shared-sshd@localhost) Choose your provider:
+(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-on-shared-sshd@localhost) Gimme your password:
+(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 Password reset, 1 step(s) missing
 == Password reset ==
 Enter 'r' to cancel the request and go back to choose the provider
-(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-on-shared-sshd@localhost) Enter your new password:
+(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-with-shared-sshd@example.com@localhost) Enter your new password:
 >
 No password supplied
 == Password reset ==
 Enter 'r' to cancel the request and go back to choose the provider
-(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-on-shared-sshd@localhost) Enter your new password:
+(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-with-shared-sshd@example.com@localhost) Enter your new password:
 >
 The password is shorter than 8 characters
 == Password reset ==
 Enter 'r' to cancel the request and go back to choose the provider
-(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-on-shared-sshd@localhost) Enter your new password:
+(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-with-shared-sshd@example.com@localhost) Enter your new password:
 >
 The password fails the dictionary check - it is too simplistic/systematic
 == Password reset ==
 Enter 'r' to cancel the request and go back to choose the provider
-(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-on-shared-sshd@localhost) Enter your new password:
+(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-with-shared-sshd@example.com@localhost) Enter your new password:
 >
-(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-on-shared-sshd@localhost) Confirm Password:
+(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-with-shared-sshd@example.com@localhost) Confirm Password:
 >
 Password entries don't match
 == Password reset ==
 Enter 'r' to cancel the request and go back to choose the provider
-(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-on-shared-sshd@localhost) Enter your new password:
+(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-with-shared-sshd@example.com@localhost) Enter your new password:
 >
 No password supplied
 == Password reset ==
 Enter 'r' to cancel the request and go back to choose the provider
-(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-on-shared-sshd@localhost) Enter your new password:
+(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-with-shared-sshd@example.com@localhost) Enter your new password:
 >
-(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-on-shared-sshd@localhost) Confirm Password:
+(user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-with-shared-sshd@example.com@localhost) Confirm Password:
 >
-PAM Authenticate() finished for user 'user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-on-shared-sshd'
-PAM AcctMgmt() finished for user 'user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-on-shared-sshd'
+PAM Authenticate() finished for user 'user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-with-shared-sshd@example.com'
+PAM AcctMgmt() finished for user 'user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-with-shared-sshd@example.com'
  SSHD: Connected to ssh via authd module! [TestSSHAuthenticate]
   HOME=${AUTHD_TEST_HOME}
-  LOGNAME=user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-on-shared-sshd
+  LOGNAME=user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-with-shared-sshd@example.com
   PATH=${AUTHD_TEST_PATH}
   PWD=${AUTHD_TEST_PWD}
   SHELL=/bin/sh
@@ -332,7 +332,7 @@ PAM AcctMgmt() finished for user 'user-needs-reset-integration-pre-check-ssh-den
   SSH_CONNECTION=${AUTHD_TEST_SSH_CONNECTION}
   SSH_TTY=${AUTHD_TEST_SSH_TTY}
   TERM=xterm-256color
-  USER=user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-on-shared-sshd
+  USER=user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-with-shared-sshd@example.com
 Connection to localhost closed.
 >
 ────────────────────────────────────────────────────────────────────────────────
diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Deny_authentication_if_user_does_not_exist b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Deny_authentication_if_user_does_not_exist
index 4b72b5f9c1..a2890e0bc3 100644
--- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Deny_authentication_if_user_does_not_exist
+++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Deny_authentication_if_user_does_not_exist
@@ -1,10 +1,10 @@
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
-PAM Authenticate() finished for user 'user-unexistent'
-SSH PAM user 'user-unexistent' using local broker
-(user-unexistent@localhost) Password:
+PAM Authenticate() finished for user 'user-unexistent@example.com'
+SSH PAM user 'user-unexistent@example.com' using local broker
+(user-unexistent@example.com@localhost) Password:
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
-PAM Authenticate() finished for user 'user-unexistent'
-SSH PAM user 'user-unexistent' using local broker
-(user-unexistent@localhost) Password:
+PAM Authenticate() finished for user 'user-unexistent@example.com'
+SSH PAM user 'user-unexistent@example.com' using local broker
+(user-unexistent@example.com@localhost) Password:
 ────────────────────────────────────────────────────────────────────────────────
diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Deny_authentication_if_user_does_not_exist_and_matches_cancel_key_on_shared_SSHd b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Deny_authentication_if_user_does_not_exist_and_matches_cancel_key_with_shared_sshd
similarity index 100%
rename from pam/integration-tests/testdata/golden/TestSSHAuthenticate/Deny_authentication_if_user_does_not_exist_and_matches_cancel_key_on_shared_SSHd
rename to pam/integration-tests/testdata/golden/TestSSHAuthenticate/Deny_authentication_if_user_does_not_exist_and_matches_cancel_key_with_shared_sshd
diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Deny_authentication_if_user_does_not_exist_on_shared_SSHd b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Deny_authentication_if_user_does_not_exist_with_shared_sshd
similarity index 62%
rename from pam/integration-tests/testdata/golden/TestSSHAuthenticate/Deny_authentication_if_user_does_not_exist_on_shared_SSHd
rename to pam/integration-tests/testdata/golden/TestSSHAuthenticate/Deny_authentication_if_user_does_not_exist_with_shared_sshd
index 4b72b5f9c1..a2890e0bc3 100644
--- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Deny_authentication_if_user_does_not_exist_on_shared_SSHd
+++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Deny_authentication_if_user_does_not_exist_with_shared_sshd
@@ -1,10 +1,10 @@
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
-PAM Authenticate() finished for user 'user-unexistent'
-SSH PAM user 'user-unexistent' using local broker
-(user-unexistent@localhost) Password:
+PAM Authenticate() finished for user 'user-unexistent@example.com'
+SSH PAM user 'user-unexistent@example.com' using local broker
+(user-unexistent@example.com@localhost) Password:
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
-PAM Authenticate() finished for user 'user-unexistent'
-SSH PAM user 'user-unexistent' using local broker
-(user-unexistent@localhost) Password:
+PAM Authenticate() finished for user 'user-unexistent@example.com'
+SSH PAM user 'user-unexistent@example.com' using local broker
+(user-unexistent@example.com@localhost) Password:
 ────────────────────────────────────────────────────────────────────────────────
diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Error_if_cannot_connect_to_authd b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Error_if_cannot_connect_to_authd
index 242b2cd216..9769e513f3 100644
--- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Error_if_cannot_connect_to_authd
+++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Error_if_cannot_connect_to_authd
@@ -2,7 +2,7 @@
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 could not connect to unix:///some-path/not-existent-socket: service took too long to respond. Disconnecting client
-PAM Authenticate() finished for user 'user-integration-pre-check-ssh-error-if-cannot-connect-to-authd'
-SSH PAM user 'user-integration-pre-check-ssh-error-if-cannot-connect-to-authd' using local broker
-(user-integration-pre-check-ssh-error-if-cannot-connect-to-authd@localhost) Password:
+PAM Authenticate() finished for user 'user-integration-pre-check-ssh-error-if-cannot-connect-to-authd@example.com'
+SSH PAM user 'user-integration-pre-check-ssh-error-if-cannot-connect-to-authd@example.com' using local broker
+(user-integration-pre-check-ssh-error-if-cannot-connect-to-authd@example.com@localhost) Password:
 ────────────────────────────────────────────────────────────────────────────────
diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Error_if_cannot_connect_to_authd_on_shared_SSHd b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Error_if_cannot_connect_to_authd_with_shared_sshd
similarity index 83%
rename from pam/integration-tests/testdata/golden/TestSSHAuthenticate/Error_if_cannot_connect_to_authd_on_shared_SSHd
rename to pam/integration-tests/testdata/golden/TestSSHAuthenticate/Error_if_cannot_connect_to_authd_with_shared_sshd
index 8d0456d0ec..f56df1f73c 100644
--- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Error_if_cannot_connect_to_authd_on_shared_SSHd
+++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Error_if_cannot_connect_to_authd_with_shared_sshd
@@ -2,7 +2,7 @@
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 could not connect to unix:///some-path/not-existent-socket: service took too long to respond. Disconnecting client
-PAM Authenticate() finished for user 'user-integration-pre-check-ssh-error-if-cannot-connect-to-authd-on-shared-sshd'
-SSH PAM user 'user-integration-pre-check-ssh-error-if-cannot-connect-to-authd-on-shared-sshd' using local broker
-(user-integration-pre-check-ssh-error-if-cannot-connect-to-authd-on-shared-sshd@localhost) Password:
+PAM Authenticate() finished for user 'user-integration-pre-check-ssh-error-if-cannot-connect-to-authd-with-shared-sshd@example.com'
+SSH PAM user 'user-integration-pre-check-ssh-error-if-cannot-connect-to-authd-with-shared-sshd@example.com' using local broker
+(user-integration-pre-check-ssh-error-if-cannot-connect-to-authd-with-shared-sshd@example.com@localhost) Password:
 ────────────────────────────────────────────────────────────────────────────────
diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Exit_authd_if_local_broker_is_selected b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Exit_authd_if_local_broker_is_selected
index 618b752137..37954a5ef9 100644
--- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Exit_authd_if_local_broker_is_selected
+++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Exit_authd_if_local_broker_is_selected
@@ -2,23 +2,23 @@
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-exit-authd-if-local-broker-is-selected@localhost) Choose your provider:
+(user-integration-pre-check-ssh-exit-authd-if-local-broker-is-selected@example.com@localhost) Choose your provider:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-exit-authd-if-local-broker-is-selected@localhost) Choose your provider:
+(user-integration-pre-check-ssh-exit-authd-if-local-broker-is-selected@example.com@localhost) Choose your provider:
 > 1
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-exit-authd-if-local-broker-is-selected@localhost) Choose your provider:
+(user-integration-pre-check-ssh-exit-authd-if-local-broker-is-selected@example.com@localhost) Choose your provider:
 > 1
-PAM Authenticate() finished for user 'user-integration-pre-check-ssh-exit-authd-if-local-broker-is-selected'
-SSH PAM user 'user-integration-pre-check-ssh-exit-authd-if-local-broker-is-selected' using local broker
-(user-integration-pre-check-ssh-exit-authd-if-local-broker-is-selected@localhost) Password:
+PAM Authenticate() finished for user 'user-integration-pre-check-ssh-exit-authd-if-local-broker-is-selected@example.com'
+SSH PAM user 'user-integration-pre-check-ssh-exit-authd-if-local-broker-is-selected@example.com' using local broker
+(user-integration-pre-check-ssh-exit-authd-if-local-broker-is-selected@example.com@localhost) Password:
 ────────────────────────────────────────────────────────────────────────────────
diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Exit_authd_if_local_broker_is_selected_on_shared_SSHd b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Exit_authd_if_local_broker_is_selected_with_shared_sshd
similarity index 78%
rename from pam/integration-tests/testdata/golden/TestSSHAuthenticate/Exit_authd_if_local_broker_is_selected_on_shared_SSHd
rename to pam/integration-tests/testdata/golden/TestSSHAuthenticate/Exit_authd_if_local_broker_is_selected_with_shared_sshd
index 840f377594..38eec4d66e 100644
--- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Exit_authd_if_local_broker_is_selected_on_shared_SSHd
+++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Exit_authd_if_local_broker_is_selected_with_shared_sshd
@@ -2,23 +2,23 @@
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-exit-authd-if-local-broker-is-selected-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-exit-authd-if-local-broker-is-selected-with-shared-sshd@example.com@localhost) Choose your provider:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-exit-authd-if-local-broker-is-selected-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-exit-authd-if-local-broker-is-selected-with-shared-sshd@example.com@localhost) Choose your provider:
 > 1
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-exit-authd-if-local-broker-is-selected-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-exit-authd-if-local-broker-is-selected-with-shared-sshd@example.com@localhost) Choose your provider:
 > 1
-PAM Authenticate() finished for user 'user-integration-pre-check-ssh-exit-authd-if-local-broker-is-selected-on-shared-sshd'
-SSH PAM user 'user-integration-pre-check-ssh-exit-authd-if-local-broker-is-selected-on-shared-sshd' using local broker
-(user-integration-pre-check-ssh-exit-authd-if-local-broker-is-selected-on-shared-sshd@localhost) Password:
+PAM Authenticate() finished for user 'user-integration-pre-check-ssh-exit-authd-if-local-broker-is-selected-with-shared-sshd@example.com'
+SSH PAM user 'user-integration-pre-check-ssh-exit-authd-if-local-broker-is-selected-with-shared-sshd@example.com' using local broker
+(user-integration-pre-check-ssh-exit-authd-if-local-broker-is-selected-with-shared-sshd@example.com@localhost) Password:
 ────────────────────────────────────────────────────────────────────────────────
diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Exit_authd_if_user_sigints b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Exit_authd_if_user_sigints
index 6194e0887d..de7f7e2db1 100644
--- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Exit_authd_if_user_sigints
+++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Exit_authd_if_user_sigints
@@ -2,36 +2,36 @@
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-exit-authd-if-user-sigints@localhost) Choose your provider:
+(user-integration-pre-check-ssh-exit-authd-if-user-sigints@example.com@localhost) Choose your provider:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-exit-authd-if-user-sigints@localhost) Choose your provider:
+(user-integration-pre-check-ssh-exit-authd-if-user-sigints@example.com@localhost) Choose your provider:
 > 2
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-exit-authd-if-user-sigints@localhost) Choose your provider:
+(user-integration-pre-check-ssh-exit-authd-if-user-sigints@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-exit-authd-if-user-sigints@localhost) Gimme your password:
+(user-integration-pre-check-ssh-exit-authd-if-user-sigints@example.com@localhost) Gimme your password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-exit-authd-if-user-sigints@localhost) Choose your provider:
+(user-integration-pre-check-ssh-exit-authd-if-user-sigints@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-exit-authd-if-user-sigints@localhost) Gimme your password:
+(user-integration-pre-check-ssh-exit-authd-if-user-sigints@example.com@localhost) Gimme your password:
 >
 
 >
@@ -40,11 +40,11 @@ Enter 'r' to cancel the request and go back to select the authentication method
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-exit-authd-if-user-sigints@localhost) Choose your provider:
+(user-integration-pre-check-ssh-exit-authd-if-user-sigints@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-exit-authd-if-user-sigints@localhost) Gimme your password:
+(user-integration-pre-check-ssh-exit-authd-if-user-sigints@example.com@localhost) Gimme your password:
 >
 
 > echo $TERM
diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Exit_authd_if_user_sigints_on_shared_SSHd b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Exit_authd_if_user_sigints_with_shared_sshd
similarity index 69%
rename from pam/integration-tests/testdata/golden/TestSSHAuthenticate/Exit_authd_if_user_sigints_on_shared_SSHd
rename to pam/integration-tests/testdata/golden/TestSSHAuthenticate/Exit_authd_if_user_sigints_with_shared_sshd
index 9483f5840c..cd6e45ed52 100644
--- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Exit_authd_if_user_sigints_on_shared_SSHd
+++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Exit_authd_if_user_sigints_with_shared_sshd
@@ -2,36 +2,36 @@
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-exit-authd-if-user-sigints-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-exit-authd-if-user-sigints-with-shared-sshd@example.com@localhost) Choose your provider:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-exit-authd-if-user-sigints-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-exit-authd-if-user-sigints-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-exit-authd-if-user-sigints-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-exit-authd-if-user-sigints-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-exit-authd-if-user-sigints-on-shared-sshd@localhost) Gimme your password:
+(user-integration-pre-check-ssh-exit-authd-if-user-sigints-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-exit-authd-if-user-sigints-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-exit-authd-if-user-sigints-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-exit-authd-if-user-sigints-on-shared-sshd@localhost) Gimme your password:
+(user-integration-pre-check-ssh-exit-authd-if-user-sigints-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 
 >
@@ -40,11 +40,11 @@ Enter 'r' to cancel the request and go back to select the authentication method
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-exit-authd-if-user-sigints-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-exit-authd-if-user-sigints-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-exit-authd-if-user-sigints-on-shared-sshd@localhost) Gimme your password:
+(user-integration-pre-check-ssh-exit-authd-if-user-sigints-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 
 > echo $TERM
diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Exit_if_user_is_not_pre-checked_on_ssh_service b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Exit_if_user_is_not_pre-checked_on_ssh_service
index d8c17a6dee..aa12080e87 100644
--- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Exit_if_user_is_not_pre-checked_on_ssh_service
+++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Exit_if_user_is_not_pre-checked_on_ssh_service
@@ -1,10 +1,10 @@
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
-PAM Authenticate() finished for user 'user-integration-ssh-service-not-allowed'
-SSH PAM user 'user-integration-ssh-service-not-allowed' using local broker
-(user-integration-ssh-service-not-allowed@localhost) Password:
+PAM Authenticate() finished for user 'user-integration-ssh-service-not-allowed@example.com'
+SSH PAM user 'user-integration-ssh-service-not-allowed@example.com' using local broker
+(user-integration-ssh-service-not-allowed@example.com@localhost) Password:
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
-PAM Authenticate() finished for user 'user-integration-ssh-service-not-allowed'
-SSH PAM user 'user-integration-ssh-service-not-allowed' using local broker
-(user-integration-ssh-service-not-allowed@localhost) Password:
+PAM Authenticate() finished for user 'user-integration-ssh-service-not-allowed@example.com'
+SSH PAM user 'user-integration-ssh-service-not-allowed@example.com' using local broker
+(user-integration-ssh-service-not-allowed@example.com@localhost) Password:
 ────────────────────────────────────────────────────────────────────────────────
diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Exit_if_user_is_not_pre-checked_on_ssh_service_on_shared_SSHd b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Exit_if_user_is_not_pre-checked_on_ssh_service_with_shared_sshd
similarity index 65%
rename from pam/integration-tests/testdata/golden/TestSSHAuthenticate/Exit_if_user_is_not_pre-checked_on_ssh_service_on_shared_SSHd
rename to pam/integration-tests/testdata/golden/TestSSHAuthenticate/Exit_if_user_is_not_pre-checked_on_ssh_service_with_shared_sshd
index d8c17a6dee..aa12080e87 100644
--- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Exit_if_user_is_not_pre-checked_on_ssh_service_on_shared_SSHd
+++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Exit_if_user_is_not_pre-checked_on_ssh_service_with_shared_sshd
@@ -1,10 +1,10 @@
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
-PAM Authenticate() finished for user 'user-integration-ssh-service-not-allowed'
-SSH PAM user 'user-integration-ssh-service-not-allowed' using local broker
-(user-integration-ssh-service-not-allowed@localhost) Password:
+PAM Authenticate() finished for user 'user-integration-ssh-service-not-allowed@example.com'
+SSH PAM user 'user-integration-ssh-service-not-allowed@example.com' using local broker
+(user-integration-ssh-service-not-allowed@example.com@localhost) Password:
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
-PAM Authenticate() finished for user 'user-integration-ssh-service-not-allowed'
-SSH PAM user 'user-integration-ssh-service-not-allowed' using local broker
-(user-integration-ssh-service-not-allowed@localhost) Password:
+PAM Authenticate() finished for user 'user-integration-ssh-service-not-allowed@example.com'
+SSH PAM user 'user-integration-ssh-service-not-allowed@example.com' using local broker
+(user-integration-ssh-service-not-allowed@example.com@localhost) Password:
 ────────────────────────────────────────────────────────────────────────────────
diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Prevent_user_from_switching_username b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Prevent_user_from_switching_username
index 99582f31b8..d2a430da71 100644
--- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Prevent_user_from_switching_username
+++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Prevent_user_from_switching_username
@@ -2,400 +2,400 @@
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-prevent-user-from-switching-username@localhost) Choose your provider:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username@example.com@localhost) Choose your provider:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-prevent-user-from-switching-username@localhost) Choose your provider:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username@example.com@localhost) Choose your provider:
 > r
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-prevent-user-from-switching-username@localhost) Choose your provider:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username@example.com@localhost) Choose your provider:
 > r
 Unsupported input
-(user-integration-pre-check-ssh-prevent-user-from-switching-username@localhost) Choose your provider:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username@example.com@localhost) Choose your provider:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-prevent-user-from-switching-username@localhost) Choose your provider:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username@example.com@localhost) Choose your provider:
 > r
 Unsupported input
-(user-integration-pre-check-ssh-prevent-user-from-switching-username@localhost) Choose your provider:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username@example.com@localhost) Choose your provider:
 > 2
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-prevent-user-from-switching-username@localhost) Choose your provider:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username@example.com@localhost) Choose your provider:
 > r
 Unsupported input
-(user-integration-pre-check-ssh-prevent-user-from-switching-username@localhost) Choose your provider:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-prevent-user-from-switching-username@localhost) Gimme your password:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username@example.com@localhost) Gimme your password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-prevent-user-from-switching-username@localhost) Choose your provider:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username@example.com@localhost) Choose your provider:
 > r
 Unsupported input
-(user-integration-pre-check-ssh-prevent-user-from-switching-username@localhost) Choose your provider:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-prevent-user-from-switching-username@localhost) Gimme your password:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-prevent-user-from-switching-username@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-prevent-user-from-switching-username@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-prevent-user-from-switching-username@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username@example.com@localhost) Choose your authentication method:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-prevent-user-from-switching-username@localhost) Choose your provider:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username@example.com@localhost) Choose your provider:
 > r
 Unsupported input
-(user-integration-pre-check-ssh-prevent-user-from-switching-username@localhost) Choose your provider:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-prevent-user-from-switching-username@localhost) Gimme your password:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-prevent-user-from-switching-username@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-prevent-user-from-switching-username@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-prevent-user-from-switching-username@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username@example.com@localhost) Choose your authentication method:
 > r
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-prevent-user-from-switching-username@localhost) Choose your provider:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username@example.com@localhost) Choose your provider:
 > r
 Unsupported input
-(user-integration-pre-check-ssh-prevent-user-from-switching-username@localhost) Choose your provider:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-prevent-user-from-switching-username@localhost) Gimme your password:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-prevent-user-from-switching-username@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-prevent-user-from-switching-username@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-prevent-user-from-switching-username@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username@example.com@localhost) Choose your authentication method:
 > r
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-prevent-user-from-switching-username@localhost) Choose your provider:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username@example.com@localhost) Choose your provider:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-prevent-user-from-switching-username@localhost) Choose your provider:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username@example.com@localhost) Choose your provider:
 > r
 Unsupported input
-(user-integration-pre-check-ssh-prevent-user-from-switching-username@localhost) Choose your provider:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-prevent-user-from-switching-username@localhost) Gimme your password:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-prevent-user-from-switching-username@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-prevent-user-from-switching-username@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-prevent-user-from-switching-username@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username@example.com@localhost) Choose your authentication method:
 > r
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-prevent-user-from-switching-username@localhost) Choose your provider:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username@example.com@localhost) Choose your provider:
 > r
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-prevent-user-from-switching-username@localhost) Choose your provider:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username@example.com@localhost) Choose your provider:
 > r
 Unsupported input
-(user-integration-pre-check-ssh-prevent-user-from-switching-username@localhost) Choose your provider:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-prevent-user-from-switching-username@localhost) Gimme your password:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-prevent-user-from-switching-username@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-prevent-user-from-switching-username@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-prevent-user-from-switching-username@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username@example.com@localhost) Choose your authentication method:
 > r
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-prevent-user-from-switching-username@localhost) Choose your provider:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username@example.com@localhost) Choose your provider:
 > r
 Unsupported input
-(user-integration-pre-check-ssh-prevent-user-from-switching-username@localhost) Choose your provider:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username@example.com@localhost) Choose your provider:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-prevent-user-from-switching-username@localhost) Choose your provider:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username@example.com@localhost) Choose your provider:
 > r
 Unsupported input
-(user-integration-pre-check-ssh-prevent-user-from-switching-username@localhost) Choose your provider:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-prevent-user-from-switching-username@localhost) Gimme your password:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-prevent-user-from-switching-username@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-prevent-user-from-switching-username@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-prevent-user-from-switching-username@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username@example.com@localhost) Choose your authentication method:
 > r
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-prevent-user-from-switching-username@localhost) Choose your provider:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username@example.com@localhost) Choose your provider:
 > r
 Unsupported input
-(user-integration-pre-check-ssh-prevent-user-from-switching-username@localhost) Choose your provider:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username@example.com@localhost) Choose your provider:
 > r
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-prevent-user-from-switching-username@localhost) Choose your provider:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username@example.com@localhost) Choose your provider:
 > r
 Unsupported input
-(user-integration-pre-check-ssh-prevent-user-from-switching-username@localhost) Choose your provider:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-prevent-user-from-switching-username@localhost) Gimme your password:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-prevent-user-from-switching-username@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-prevent-user-from-switching-username@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-prevent-user-from-switching-username@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username@example.com@localhost) Choose your authentication method:
 > r
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-prevent-user-from-switching-username@localhost) Choose your provider:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username@example.com@localhost) Choose your provider:
 > r
 Unsupported input
-(user-integration-pre-check-ssh-prevent-user-from-switching-username@localhost) Choose your provider:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username@example.com@localhost) Choose your provider:
 > r
 Unsupported input
-(user-integration-pre-check-ssh-prevent-user-from-switching-username@localhost) Choose your provider:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username@example.com@localhost) Choose your provider:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-prevent-user-from-switching-username@localhost) Choose your provider:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username@example.com@localhost) Choose your provider:
 > r
 Unsupported input
-(user-integration-pre-check-ssh-prevent-user-from-switching-username@localhost) Choose your provider:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-prevent-user-from-switching-username@localhost) Gimme your password:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-prevent-user-from-switching-username@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-prevent-user-from-switching-username@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-prevent-user-from-switching-username@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username@example.com@localhost) Choose your authentication method:
 > r
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-prevent-user-from-switching-username@localhost) Choose your provider:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username@example.com@localhost) Choose your provider:
 > r
 Unsupported input
-(user-integration-pre-check-ssh-prevent-user-from-switching-username@localhost) Choose your provider:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username@example.com@localhost) Choose your provider:
 > r
 Unsupported input
-(user-integration-pre-check-ssh-prevent-user-from-switching-username@localhost) Choose your provider:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username@example.com@localhost) Choose your provider:
 > 2
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-prevent-user-from-switching-username@localhost) Choose your provider:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username@example.com@localhost) Choose your provider:
 > r
 Unsupported input
-(user-integration-pre-check-ssh-prevent-user-from-switching-username@localhost) Choose your provider:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-prevent-user-from-switching-username@localhost) Gimme your password:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-prevent-user-from-switching-username@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-prevent-user-from-switching-username@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-prevent-user-from-switching-username@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username@example.com@localhost) Choose your authentication method:
 > r
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-prevent-user-from-switching-username@localhost) Choose your provider:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username@example.com@localhost) Choose your provider:
 > r
 Unsupported input
-(user-integration-pre-check-ssh-prevent-user-from-switching-username@localhost) Choose your provider:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username@example.com@localhost) Choose your provider:
 > r
 Unsupported input
-(user-integration-pre-check-ssh-prevent-user-from-switching-username@localhost) Choose your provider:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-prevent-user-from-switching-username@localhost) Gimme your password:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username@example.com@localhost) Gimme your password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-prevent-user-from-switching-username@localhost) Choose your provider:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username@example.com@localhost) Choose your provider:
 > r
 Unsupported input
-(user-integration-pre-check-ssh-prevent-user-from-switching-username@localhost) Choose your provider:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-prevent-user-from-switching-username@localhost) Gimme your password:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-prevent-user-from-switching-username@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-prevent-user-from-switching-username@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-prevent-user-from-switching-username@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username@example.com@localhost) Choose your authentication method:
 > r
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-prevent-user-from-switching-username@localhost) Choose your provider:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username@example.com@localhost) Choose your provider:
 > r
 Unsupported input
-(user-integration-pre-check-ssh-prevent-user-from-switching-username@localhost) Choose your provider:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username@example.com@localhost) Choose your provider:
 > r
 Unsupported input
-(user-integration-pre-check-ssh-prevent-user-from-switching-username@localhost) Choose your provider:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-prevent-user-from-switching-username@localhost) Gimme your password:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username@example.com@localhost) Gimme your password:
 >
-PAM Authenticate() finished for user 'user-integration-pre-check-ssh-prevent-user-from-switching-username'
-PAM AcctMgmt() finished for user 'user-integration-pre-check-ssh-prevent-user-from-switching-username'
-Environment:
-  USER=user-integration-pre-check-ssh-prevent-user-from-switching-username
-  LOGNAME=user-integration-pre-check-ssh-prevent-user-from-switching-username
+PAM Authenticate() finished for user 'user-integration-pre-check-ssh-prevent-user-from-switching-username@example.com'
+PAM AcctMgmt() finished for user 'user-integration-pre-check-ssh-prevent-user-from-switching-username@example.com'
+ SSHD: Connected to ssh via authd module! [TestSSHAuthenticate/Prevent_user_from_switching_username]
   HOME=${AUTHD_TEST_HOME}
+  LOGNAME=user-integration-pre-check-ssh-prevent-user-from-switching-username@example.com
   PATH=${AUTHD_TEST_PATH}
+  PWD=${AUTHD_TEST_PWD}
   SHELL=/bin/sh
-  TERM=xterm-256color
   SSH_CLIENT=${AUTHD_TEST_SSH_CLIENT}
   SSH_CONNECTION=${AUTHD_TEST_SSH_CONNECTION}
   SSH_TTY=${AUTHD_TEST_SSH_TTY}
- SSHD: Connected to ssh via authd module! [TestSSHAuthenticate/Prevent_user_from_switching_username]
+  TERM=xterm-256color
+  USER=user-integration-pre-check-ssh-prevent-user-from-switching-username@example.com
 Connection to localhost closed.
 >
 ────────────────────────────────────────────────────────────────────────────────
diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Prevent_user_from_switching_username_on_shared_SSHd b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Prevent_user_from_switching_username_with_shared_sshd
similarity index 74%
rename from pam/integration-tests/testdata/golden/TestSSHAuthenticate/Prevent_user_from_switching_username_on_shared_SSHd
rename to pam/integration-tests/testdata/golden/TestSSHAuthenticate/Prevent_user_from_switching_username_with_shared_sshd
index dda1c4114e..fdd980b32a 100644
--- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Prevent_user_from_switching_username_on_shared_SSHd
+++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Prevent_user_from_switching_username_with_shared_sshd
@@ -2,392 +2,392 @@
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-prevent-user-from-switching-username-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username-with-shared-sshd@example.com@localhost) Choose your provider:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-prevent-user-from-switching-username-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username-with-shared-sshd@example.com@localhost) Choose your provider:
 > r
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-prevent-user-from-switching-username-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username-with-shared-sshd@example.com@localhost) Choose your provider:
 > r
 Unsupported input
-(user-integration-pre-check-ssh-prevent-user-from-switching-username-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username-with-shared-sshd@example.com@localhost) Choose your provider:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-prevent-user-from-switching-username-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username-with-shared-sshd@example.com@localhost) Choose your provider:
 > r
 Unsupported input
-(user-integration-pre-check-ssh-prevent-user-from-switching-username-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-prevent-user-from-switching-username-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username-with-shared-sshd@example.com@localhost) Choose your provider:
 > r
 Unsupported input
-(user-integration-pre-check-ssh-prevent-user-from-switching-username-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-prevent-user-from-switching-username-on-shared-sshd@localhost) Gimme your password:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-prevent-user-from-switching-username-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username-with-shared-sshd@example.com@localhost) Choose your provider:
 > r
 Unsupported input
-(user-integration-pre-check-ssh-prevent-user-from-switching-username-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-prevent-user-from-switching-username-on-shared-sshd@localhost) Gimme your password:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-prevent-user-from-switching-username-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-prevent-user-from-switching-username-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-prevent-user-from-switching-username-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username-with-shared-sshd@example.com@localhost) Choose your authentication method:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-prevent-user-from-switching-username-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username-with-shared-sshd@example.com@localhost) Choose your provider:
 > r
 Unsupported input
-(user-integration-pre-check-ssh-prevent-user-from-switching-username-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-prevent-user-from-switching-username-on-shared-sshd@localhost) Gimme your password:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-prevent-user-from-switching-username-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-prevent-user-from-switching-username-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-prevent-user-from-switching-username-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > r
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-prevent-user-from-switching-username-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username-with-shared-sshd@example.com@localhost) Choose your provider:
 > r
 Unsupported input
-(user-integration-pre-check-ssh-prevent-user-from-switching-username-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-prevent-user-from-switching-username-on-shared-sshd@localhost) Gimme your password:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-prevent-user-from-switching-username-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-prevent-user-from-switching-username-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-prevent-user-from-switching-username-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > r
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-prevent-user-from-switching-username-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username-with-shared-sshd@example.com@localhost) Choose your provider:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-prevent-user-from-switching-username-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username-with-shared-sshd@example.com@localhost) Choose your provider:
 > r
 Unsupported input
-(user-integration-pre-check-ssh-prevent-user-from-switching-username-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-prevent-user-from-switching-username-on-shared-sshd@localhost) Gimme your password:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-prevent-user-from-switching-username-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-prevent-user-from-switching-username-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-prevent-user-from-switching-username-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > r
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-prevent-user-from-switching-username-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username-with-shared-sshd@example.com@localhost) Choose your provider:
 > r
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-prevent-user-from-switching-username-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username-with-shared-sshd@example.com@localhost) Choose your provider:
 > r
 Unsupported input
-(user-integration-pre-check-ssh-prevent-user-from-switching-username-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-prevent-user-from-switching-username-on-shared-sshd@localhost) Gimme your password:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-prevent-user-from-switching-username-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-prevent-user-from-switching-username-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-prevent-user-from-switching-username-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > r
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-prevent-user-from-switching-username-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username-with-shared-sshd@example.com@localhost) Choose your provider:
 > r
 Unsupported input
-(user-integration-pre-check-ssh-prevent-user-from-switching-username-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username-with-shared-sshd@example.com@localhost) Choose your provider:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-prevent-user-from-switching-username-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username-with-shared-sshd@example.com@localhost) Choose your provider:
 > r
 Unsupported input
-(user-integration-pre-check-ssh-prevent-user-from-switching-username-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-prevent-user-from-switching-username-on-shared-sshd@localhost) Gimme your password:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-prevent-user-from-switching-username-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-prevent-user-from-switching-username-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-prevent-user-from-switching-username-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > r
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-prevent-user-from-switching-username-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username-with-shared-sshd@example.com@localhost) Choose your provider:
 > r
 Unsupported input
-(user-integration-pre-check-ssh-prevent-user-from-switching-username-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username-with-shared-sshd@example.com@localhost) Choose your provider:
 > r
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-prevent-user-from-switching-username-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username-with-shared-sshd@example.com@localhost) Choose your provider:
 > r
 Unsupported input
-(user-integration-pre-check-ssh-prevent-user-from-switching-username-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-prevent-user-from-switching-username-on-shared-sshd@localhost) Gimme your password:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-prevent-user-from-switching-username-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-prevent-user-from-switching-username-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-prevent-user-from-switching-username-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > r
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-prevent-user-from-switching-username-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username-with-shared-sshd@example.com@localhost) Choose your provider:
 > r
 Unsupported input
-(user-integration-pre-check-ssh-prevent-user-from-switching-username-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username-with-shared-sshd@example.com@localhost) Choose your provider:
 > r
 Unsupported input
-(user-integration-pre-check-ssh-prevent-user-from-switching-username-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username-with-shared-sshd@example.com@localhost) Choose your provider:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-prevent-user-from-switching-username-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username-with-shared-sshd@example.com@localhost) Choose your provider:
 > r
 Unsupported input
-(user-integration-pre-check-ssh-prevent-user-from-switching-username-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-prevent-user-from-switching-username-on-shared-sshd@localhost) Gimme your password:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-prevent-user-from-switching-username-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-prevent-user-from-switching-username-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-prevent-user-from-switching-username-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > r
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-prevent-user-from-switching-username-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username-with-shared-sshd@example.com@localhost) Choose your provider:
 > r
 Unsupported input
-(user-integration-pre-check-ssh-prevent-user-from-switching-username-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username-with-shared-sshd@example.com@localhost) Choose your provider:
 > r
 Unsupported input
-(user-integration-pre-check-ssh-prevent-user-from-switching-username-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-prevent-user-from-switching-username-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username-with-shared-sshd@example.com@localhost) Choose your provider:
 > r
 Unsupported input
-(user-integration-pre-check-ssh-prevent-user-from-switching-username-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-prevent-user-from-switching-username-on-shared-sshd@localhost) Gimme your password:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-prevent-user-from-switching-username-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-prevent-user-from-switching-username-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-prevent-user-from-switching-username-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > r
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-prevent-user-from-switching-username-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username-with-shared-sshd@example.com@localhost) Choose your provider:
 > r
 Unsupported input
-(user-integration-pre-check-ssh-prevent-user-from-switching-username-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username-with-shared-sshd@example.com@localhost) Choose your provider:
 > r
 Unsupported input
-(user-integration-pre-check-ssh-prevent-user-from-switching-username-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-prevent-user-from-switching-username-on-shared-sshd@localhost) Gimme your password:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-prevent-user-from-switching-username-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username-with-shared-sshd@example.com@localhost) Choose your provider:
 > r
 Unsupported input
-(user-integration-pre-check-ssh-prevent-user-from-switching-username-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-prevent-user-from-switching-username-on-shared-sshd@localhost) Gimme your password:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-prevent-user-from-switching-username-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-prevent-user-from-switching-username-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-prevent-user-from-switching-username-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > r
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-prevent-user-from-switching-username-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username-with-shared-sshd@example.com@localhost) Choose your provider:
 > r
 Unsupported input
-(user-integration-pre-check-ssh-prevent-user-from-switching-username-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username-with-shared-sshd@example.com@localhost) Choose your provider:
 > r
 Unsupported input
-(user-integration-pre-check-ssh-prevent-user-from-switching-username-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-prevent-user-from-switching-username-on-shared-sshd@localhost) Gimme your password:
+(user-integration-pre-check-ssh-prevent-user-from-switching-username-with-shared-sshd@example.com@localhost) Gimme your password:
 >
-PAM Authenticate() finished for user 'user-integration-pre-check-ssh-prevent-user-from-switching-username-on-shared-sshd'
-PAM AcctMgmt() finished for user 'user-integration-pre-check-ssh-prevent-user-from-switching-username-on-shared-sshd'
+PAM Authenticate() finished for user 'user-integration-pre-check-ssh-prevent-user-from-switching-username-with-shared-sshd@example.com'
+PAM AcctMgmt() finished for user 'user-integration-pre-check-ssh-prevent-user-from-switching-username-with-shared-sshd@example.com'
  SSHD: Connected to ssh via authd module! [TestSSHAuthenticate]
   HOME=${AUTHD_TEST_HOME}
-  LOGNAME=user-integration-pre-check-ssh-prevent-user-from-switching-username-on-shared-sshd
+  LOGNAME=user-integration-pre-check-ssh-prevent-user-from-switching-username-with-shared-sshd@example.com
   PATH=${AUTHD_TEST_PATH}
   PWD=${AUTHD_TEST_PWD}
   SHELL=/bin/sh
@@ -395,7 +395,7 @@ PAM AcctMgmt() finished for user 'user-integration-pre-check-ssh-prevent-user-fr
   SSH_CONNECTION=${AUTHD_TEST_SSH_CONNECTION}
   SSH_TTY=${AUTHD_TEST_SSH_TTY}
   TERM=xterm-256color
-  USER=user-integration-pre-check-ssh-prevent-user-from-switching-username-on-shared-sshd
+  USER=user-integration-pre-check-ssh-prevent-user-from-switching-username-with-shared-sshd@example.com
 Connection to localhost closed.
 >
 ────────────────────────────────────────────────────────────────────────────────
diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Remember_last_successful_broker_and_mode b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Remember_last_successful_broker_and_mode
index b1b56db16e..aef11bd1ad 100644
--- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Remember_last_successful_broker_and_mode
+++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Remember_last_successful_broker_and_mode
@@ -2,205 +2,205 @@
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode@localhost) Choose your provider:
+(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode@example.com@localhost) Choose your provider:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode@localhost) Choose your provider:
+(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode@example.com@localhost) Choose your provider:
 > 2
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode@localhost) Choose your provider:
+(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode@localhost) Gimme your password:
+(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode@example.com@localhost) Gimme your password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode@localhost) Choose your provider:
+(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode@localhost) Gimme your password:
+(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-remember-last-successful-broker-and-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-remember-last-successful-broker-and-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode@example.com@localhost) Choose your authentication method:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode@localhost) Choose your provider:
+(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode@localhost) Gimme your password:
+(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-remember-last-successful-broker-and-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-remember-last-successful-broker-and-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode@example.com@localhost) Choose your authentication method:
 > 8
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode@localhost) Choose your provider:
+(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode@localhost) Gimme your password:
+(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-remember-last-successful-broker-and-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-remember-last-successful-broker-and-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode@example.com@localhost) Choose your authentication method:
 > 8
 == Authentication code ==
   1. Proceed with Authentication code
   2. Resend SMS (1 sent)
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode@localhost) Choose action:
+(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode@example.com@localhost) Choose action:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode@localhost) Choose your provider:
+(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode@localhost) Gimme your password:
+(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-remember-last-successful-broker-and-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-remember-last-successful-broker-and-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode@example.com@localhost) Choose your authentication method:
 > 8
 == Authentication code ==
   1. Proceed with Authentication code
   2. Resend SMS (1 sent)
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode@localhost) Choose action:
+(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode@example.com@localhost) Choose action:
 > 1
 == Authentication code ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode@localhost) Enter your one time credential:
+(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode@example.com@localhost) Enter your one time credential:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode@localhost) Choose your provider:
+(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode@localhost) Gimme your password:
+(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-remember-last-successful-broker-and-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-remember-last-successful-broker-and-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode@example.com@localhost) Choose your authentication method:
 > 8
 == Authentication code ==
   1. Proceed with Authentication code
   2. Resend SMS (1 sent)
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode@localhost) Choose action:
+(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode@example.com@localhost) Choose action:
 > 1
 == Authentication code ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode@localhost) Enter your one time credential:
+(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode@example.com@localhost) Enter your one time credential:
 > temporary pass0
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode@localhost) Choose your provider:
+(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode@localhost) Gimme your password:
+(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-remember-last-successful-broker-and-mode@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-remember-last-successful-broker-and-mode@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode@example.com@localhost) Choose your authentication method:
 > 8
 == Authentication code ==
   1. Proceed with Authentication code
   2. Resend SMS (1 sent)
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode@localhost) Choose action:
+(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode@example.com@localhost) Choose action:
 > 1
 == Authentication code ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode@localhost) Enter your one time credential:
+(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode@example.com@localhost) Enter your one time credential:
 > temporary pass0
-PAM Authenticate() finished for user 'user-integration-pre-check-ssh-remember-last-successful-broker-and-mode'
-PAM AcctMgmt() finished for user 'user-integration-pre-check-ssh-remember-last-successful-broker-and-mode'
+PAM Authenticate() finished for user 'user-integration-pre-check-ssh-remember-last-successful-broker-and-mode@example.com'
+PAM AcctMgmt() finished for user 'user-integration-pre-check-ssh-remember-last-successful-broker-and-mode@example.com'
  SSHD: Connected to ssh via authd module! [TestSSHAuthenticate/Remember_last_successful_broker_and_mode]
   HOME=${AUTHD_TEST_HOME}
-  LOGNAME=user-integration-pre-check-ssh-remember-last-successful-broker-and-mode
+  LOGNAME=user-integration-pre-check-ssh-remember-last-successful-broker-and-mode@example.com
   PATH=${AUTHD_TEST_PATH}
   PWD=${AUTHD_TEST_PWD}
   SHELL=/bin/sh
@@ -208,7 +208,7 @@ PAM AcctMgmt() finished for user 'user-integration-pre-check-ssh-remember-last-s
   SSH_CONNECTION=${AUTHD_TEST_SSH_CONNECTION}
   SSH_TTY=${AUTHD_TEST_SSH_TTY}
   TERM=xterm-256color
-  USER=user-integration-pre-check-ssh-remember-last-successful-broker-and-mode
+  USER=user-integration-pre-check-ssh-remember-last-successful-broker-and-mode@example.com
 Connection to localhost closed.
 >
 ────────────────────────────────────────────────────────────────────────────────
@@ -221,7 +221,7 @@ Connection to localhost closed.
   1. Proceed with Authentication code
   2. Resend SMS (1 sent)
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode@localhost) Choose action:
+(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode@example.com@localhost) Choose action:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
@@ -229,11 +229,11 @@ Or enter 'r' to go back to select the authentication method
   1. Proceed with Authentication code
   2. Resend SMS (1 sent)
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode@localhost) Choose action:
+(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode@example.com@localhost) Choose action:
 > 1
 == Authentication code ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode@localhost) Enter your one time credential:
+(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode@example.com@localhost) Enter your one time credential:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
@@ -241,11 +241,11 @@ Enter 'r' to cancel the request and go back to select the authentication method
   1. Proceed with Authentication code
   2. Resend SMS (1 sent)
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode@localhost) Choose action:
+(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode@example.com@localhost) Choose action:
 > 1
 == Authentication code ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode@localhost) Enter your one time credential:
+(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode@example.com@localhost) Enter your one time credential:
 > temporary pass0
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
@@ -253,17 +253,17 @@ Enter 'r' to cancel the request and go back to select the authentication method
   1. Proceed with Authentication code
   2. Resend SMS (1 sent)
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode@localhost) Choose action:
+(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode@example.com@localhost) Choose action:
 > 1
 == Authentication code ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode@localhost) Enter your one time credential:
+(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode@example.com@localhost) Enter your one time credential:
 > temporary pass0
-PAM Authenticate() finished for user 'user-integration-pre-check-ssh-remember-last-successful-broker-and-mode'
-PAM AcctMgmt() finished for user 'user-integration-pre-check-ssh-remember-last-successful-broker-and-mode'
+PAM Authenticate() finished for user 'user-integration-pre-check-ssh-remember-last-successful-broker-and-mode@example.com'
+PAM AcctMgmt() finished for user 'user-integration-pre-check-ssh-remember-last-successful-broker-and-mode@example.com'
  SSHD: Connected to ssh via authd module! [TestSSHAuthenticate/Remember_last_successful_broker_and_mode]
   HOME=${AUTHD_TEST_HOME}
-  LOGNAME=user-integration-pre-check-ssh-remember-last-successful-broker-and-mode
+  LOGNAME=user-integration-pre-check-ssh-remember-last-successful-broker-and-mode@example.com
   PATH=${AUTHD_TEST_PATH}
   PWD=${AUTHD_TEST_PWD}
   SHELL=/bin/sh
@@ -271,7 +271,7 @@ PAM AcctMgmt() finished for user 'user-integration-pre-check-ssh-remember-last-s
   SSH_CONNECTION=${AUTHD_TEST_SSH_CONNECTION}
   SSH_TTY=${AUTHD_TEST_SSH_TTY}
   TERM=xterm-256color
-  USER=user-integration-pre-check-ssh-remember-last-successful-broker-and-mode
+  USER=user-integration-pre-check-ssh-remember-last-successful-broker-and-mode@example.com
 Connection to localhost closed.
 >
 ────────────────────────────────────────────────────────────────────────────────
diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Remember_last_successful_broker_and_mode_on_shared_SSHd b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Remember_last_successful_broker_and_mode_with_shared_sshd
similarity index 79%
rename from pam/integration-tests/testdata/golden/TestSSHAuthenticate/Remember_last_successful_broker_and_mode_on_shared_SSHd
rename to pam/integration-tests/testdata/golden/TestSSHAuthenticate/Remember_last_successful_broker_and_mode_with_shared_sshd
index 556a950ad2..43732d6bab 100644
--- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Remember_last_successful_broker_and_mode_on_shared_SSHd
+++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Remember_last_successful_broker_and_mode_with_shared_sshd
@@ -2,205 +2,205 @@
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode-with-shared-sshd@example.com@localhost) Choose your provider:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode-on-shared-sshd@localhost) Gimme your password:
+(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode-on-shared-sshd@localhost) Gimme your password:
+(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-remember-last-successful-broker-and-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-remember-last-successful-broker-and-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode-on-shared-sshd@localhost) Gimme your password:
+(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-remember-last-successful-broker-and-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-remember-last-successful-broker-and-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 8
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode-on-shared-sshd@localhost) Gimme your password:
+(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-remember-last-successful-broker-and-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-remember-last-successful-broker-and-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 8
 == Authentication code ==
   1. Proceed with Authentication code
   2. Resend SMS (1 sent)
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode-on-shared-sshd@localhost) Choose action:
+(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode-with-shared-sshd@example.com@localhost) Choose action:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode-on-shared-sshd@localhost) Gimme your password:
+(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-remember-last-successful-broker-and-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-remember-last-successful-broker-and-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 8
 == Authentication code ==
   1. Proceed with Authentication code
   2. Resend SMS (1 sent)
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode-on-shared-sshd@localhost) Choose action:
+(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode-with-shared-sshd@example.com@localhost) Choose action:
 > 1
 == Authentication code ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode-on-shared-sshd@localhost) Enter your one time credential:
+(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode-with-shared-sshd@example.com@localhost) Enter your one time credential:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode-on-shared-sshd@localhost) Gimme your password:
+(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-remember-last-successful-broker-and-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-remember-last-successful-broker-and-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 8
 == Authentication code ==
   1. Proceed with Authentication code
   2. Resend SMS (1 sent)
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode-on-shared-sshd@localhost) Choose action:
+(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode-with-shared-sshd@example.com@localhost) Choose action:
 > 1
 == Authentication code ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode-on-shared-sshd@localhost) Enter your one time credential:
+(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode-with-shared-sshd@example.com@localhost) Enter your one time credential:
 > temporary pass0
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
 == Provider selection ==
   1. local
   2. ExampleBroker
-(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode-on-shared-sshd@localhost) Choose your provider:
+(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode-with-shared-sshd@example.com@localhost) Choose your provider:
 > 2
 == Password authentication ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode-on-shared-sshd@localhost) Gimme your password:
+(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode-with-shared-sshd@example.com@localhost) Gimme your password:
 >
 == Authentication method selection ==
   1. Password authentication
   2. Use a Login code
-  3. Send URL to user-integration-pre-check-ssh-remember-last-successful-broker-and-mode-on-shared-sshd@gmail.com
+  3. Send URL to user-integration-pre-check-ssh-remember-last-successful-broker-and-mode-with-shared-sshd@example.com
   4. Use your fido device foo
   5. Use your phone +33...
   6. Use your phone +1...
   7. Pin code
   8. Authentication code
 Or enter 'r' to go back to choose the provider
-(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode-on-shared-sshd@localhost) Choose your authentication method:
+(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode-with-shared-sshd@example.com@localhost) Choose your authentication method:
 > 8
 == Authentication code ==
   1. Proceed with Authentication code
   2. Resend SMS (1 sent)
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode-on-shared-sshd@localhost) Choose action:
+(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode-with-shared-sshd@example.com@localhost) Choose action:
 > 1
 == Authentication code ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode-on-shared-sshd@localhost) Enter your one time credential:
+(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode-with-shared-sshd@example.com@localhost) Enter your one time credential:
 > temporary pass0
-PAM Authenticate() finished for user 'user-integration-pre-check-ssh-remember-last-successful-broker-and-mode-on-shared-sshd'
-PAM AcctMgmt() finished for user 'user-integration-pre-check-ssh-remember-last-successful-broker-and-mode-on-shared-sshd'
+PAM Authenticate() finished for user 'user-integration-pre-check-ssh-remember-last-successful-broker-and-mode-with-shared-sshd@example.com'
+PAM AcctMgmt() finished for user 'user-integration-pre-check-ssh-remember-last-successful-broker-and-mode-with-shared-sshd@example.com'
  SSHD: Connected to ssh via authd module! [TestSSHAuthenticate]
   HOME=${AUTHD_TEST_HOME}
-  LOGNAME=user-integration-pre-check-ssh-remember-last-successful-broker-and-mode-on-shared-sshd
+  LOGNAME=user-integration-pre-check-ssh-remember-last-successful-broker-and-mode-with-shared-sshd@example.com
   PATH=${AUTHD_TEST_PATH}
   PWD=${AUTHD_TEST_PWD}
   SHELL=/bin/sh
@@ -208,7 +208,7 @@ PAM AcctMgmt() finished for user 'user-integration-pre-check-ssh-remember-last-s
   SSH_CONNECTION=${AUTHD_TEST_SSH_CONNECTION}
   SSH_TTY=${AUTHD_TEST_SSH_TTY}
   TERM=xterm-256color
-  USER=user-integration-pre-check-ssh-remember-last-successful-broker-and-mode-on-shared-sshd
+  USER=user-integration-pre-check-ssh-remember-last-successful-broker-and-mode-with-shared-sshd@example.com
 Connection to localhost closed.
 >
 ────────────────────────────────────────────────────────────────────────────────
@@ -221,7 +221,7 @@ Connection to localhost closed.
   1. Proceed with Authentication code
   2. Resend SMS (1 sent)
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode-on-shared-sshd@localhost) Choose action:
+(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode-with-shared-sshd@example.com@localhost) Choose action:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
@@ -229,11 +229,11 @@ Or enter 'r' to go back to select the authentication method
   1. Proceed with Authentication code
   2. Resend SMS (1 sent)
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode-on-shared-sshd@localhost) Choose action:
+(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode-with-shared-sshd@example.com@localhost) Choose action:
 > 1
 == Authentication code ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode-on-shared-sshd@localhost) Enter your one time credential:
+(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode-with-shared-sshd@example.com@localhost) Enter your one time credential:
 >
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
@@ -241,11 +241,11 @@ Enter 'r' to cancel the request and go back to select the authentication method
   1. Proceed with Authentication code
   2. Resend SMS (1 sent)
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode-on-shared-sshd@localhost) Choose action:
+(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode-with-shared-sshd@example.com@localhost) Choose action:
 > 1
 == Authentication code ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode-on-shared-sshd@localhost) Enter your one time credential:
+(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode-with-shared-sshd@example.com@localhost) Enter your one time credential:
 > temporary pass0
 ────────────────────────────────────────────────────────────────────────────────
 > ssh ${AUTHD_PAM_SSH_USER}@localhost ${AUTHD_PAM_SSH_ARGS}
@@ -253,17 +253,17 @@ Enter 'r' to cancel the request and go back to select the authentication method
   1. Proceed with Authentication code
   2. Resend SMS (1 sent)
 Or enter 'r' to go back to select the authentication method
-(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode-on-shared-sshd@localhost) Choose action:
+(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode-with-shared-sshd@example.com@localhost) Choose action:
 > 1
 == Authentication code ==
 Enter 'r' to cancel the request and go back to select the authentication method
-(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode-on-shared-sshd@localhost) Enter your one time credential:
+(user-integration-pre-check-ssh-remember-last-successful-broker-and-mode-with-shared-sshd@example.com@localhost) Enter your one time credential:
 > temporary pass0
-PAM Authenticate() finished for user 'user-integration-pre-check-ssh-remember-last-successful-broker-and-mode-on-shared-sshd'
-PAM AcctMgmt() finished for user 'user-integration-pre-check-ssh-remember-last-successful-broker-and-mode-on-shared-sshd'
+PAM Authenticate() finished for user 'user-integration-pre-check-ssh-remember-last-successful-broker-and-mode-with-shared-sshd@example.com'
+PAM AcctMgmt() finished for user 'user-integration-pre-check-ssh-remember-last-successful-broker-and-mode-with-shared-sshd@example.com'
  SSHD: Connected to ssh via authd module! [TestSSHAuthenticate]
   HOME=${AUTHD_TEST_HOME}
-  LOGNAME=user-integration-pre-check-ssh-remember-last-successful-broker-and-mode-on-shared-sshd
+  LOGNAME=user-integration-pre-check-ssh-remember-last-successful-broker-and-mode-with-shared-sshd@example.com
   PATH=${AUTHD_TEST_PATH}
   PWD=${AUTHD_TEST_PWD}
   SHELL=/bin/sh
@@ -271,7 +271,7 @@ PAM AcctMgmt() finished for user 'user-integration-pre-check-ssh-remember-last-s
   SSH_CONNECTION=${AUTHD_TEST_SSH_CONNECTION}
   SSH_TTY=${AUTHD_TEST_SSH_TTY}
   TERM=xterm-256color
-  USER=user-integration-pre-check-ssh-remember-last-successful-broker-and-mode-on-shared-sshd
+  USER=user-integration-pre-check-ssh-remember-last-successful-broker-and-mode-with-shared-sshd@example.com
 Connection to localhost closed.
 >
 ────────────────────────────────────────────────────────────────────────────────
diff --git a/pam/integration-tests/testdata/tapes/cli/bad_password.tape b/pam/integration-tests/testdata/tapes/cli/bad_password.tape
index 7d15878292..11a0adfae2 100644
--- a/pam/integration-tests/testdata/tapes/cli/bad_password.tape
+++ b/pam/integration-tests/testdata/tapes/cli/bad_password.tape
@@ -5,7 +5,7 @@ Wait /Username: user name\n/
 Show
 
 Hide
-TypeUsername "user-needs-reset"
+TypeUsername "user-needs-reset@example.com"
 Show
 
 Hide
diff --git a/pam/integration-tests/testdata/tapes/cli/form_with_button.tape b/pam/integration-tests/testdata/tapes/cli/form_with_button.tape
index 23e85e2e0b..1a606c274f 100644
--- a/pam/integration-tests/testdata/tapes/cli/form_with_button.tape
+++ b/pam/integration-tests/testdata/tapes/cli/form_with_button.tape
@@ -5,7 +5,7 @@ Wait /Username: user name\n/
 Show
 
 Hide
-TypeUsername "user-integration-form-w-button"
+TypeUsername "user-integration-form-w-button@example.com"
 Show
 
 Hide
diff --git a/pam/integration-tests/testdata/tapes/cli/local_group.tape b/pam/integration-tests/testdata/tapes/cli/local_group.tape
index 97b25c1027..ce274f09fa 100644
--- a/pam/integration-tests/testdata/tapes/cli/local_group.tape
+++ b/pam/integration-tests/testdata/tapes/cli/local_group.tape
@@ -5,7 +5,7 @@ Wait /Username: user name\n/
 Show
 
 Hide
-TypeUsername "user-local-groups-integration-auth-native"
+TypeUsername "user-local-groups-integration-auth-cli@example.com"
 Show
 
 Hide
diff --git a/pam/integration-tests/testdata/tapes/cli/mandatory_password_reset.tape b/pam/integration-tests/testdata/tapes/cli/mandatory_password_reset.tape
index 9446b20017..190baf9ecc 100644
--- a/pam/integration-tests/testdata/tapes/cli/mandatory_password_reset.tape
+++ b/pam/integration-tests/testdata/tapes/cli/mandatory_password_reset.tape
@@ -5,7 +5,7 @@ Wait /Username: user name\n/
 Show
 
 Hide
-TypeUsername "user-needs-reset-integration-mandatory"
+TypeUsername "user-needs-reset-integration-mandatory@example.com"
 Show
 
 Hide
diff --git a/pam/integration-tests/testdata/tapes/cli/max_attempts.tape b/pam/integration-tests/testdata/tapes/cli/max_attempts.tape
index e6b373aa83..d1e99a322f 100644
--- a/pam/integration-tests/testdata/tapes/cli/max_attempts.tape
+++ b/pam/integration-tests/testdata/tapes/cli/max_attempts.tape
@@ -5,7 +5,7 @@ Wait /Username: user name\n/
 Show
 
 Hide
-TypeUsername "user-integration-max-attempts"
+TypeUsername "user-integration-max-attempts@example.com"
 Show
 
 Hide
diff --git a/pam/integration-tests/testdata/tapes/cli/mfa_auth.tape b/pam/integration-tests/testdata/tapes/cli/mfa_auth.tape
index 049cbd0db2..1b92a08907 100644
--- a/pam/integration-tests/testdata/tapes/cli/mfa_auth.tape
+++ b/pam/integration-tests/testdata/tapes/cli/mfa_auth.tape
@@ -5,7 +5,7 @@ Wait /Username: user name\n/
 Show
 
 Hide
-TypeUsername "user-mfa"
+TypeUsername "user-mfa@example.com"
 Show
 
 Hide
diff --git a/pam/integration-tests/testdata/tapes/cli/mfa_reset_pwquality_auth.tape b/pam/integration-tests/testdata/tapes/cli/mfa_reset_pwquality_auth.tape
index aa50176be1..f24939de48 100644
--- a/pam/integration-tests/testdata/tapes/cli/mfa_reset_pwquality_auth.tape
+++ b/pam/integration-tests/testdata/tapes/cli/mfa_reset_pwquality_auth.tape
@@ -5,7 +5,7 @@ Wait /Username: user name\n/
 Show
 
 Hide
-TypeUsername "user-mfa-with-reset"
+TypeUsername "user-mfa-with-reset@example.com"
 Show
 
 Hide
@@ -45,15 +45,6 @@ Wait+Screen /Enter your new password \(3 days until mandatory\)\n/
 Wait+CLIPrompt@${AUTHD_SLEEP_EXAMPLE_BROKER_MFA_WAIT} * 1.2 /New password/ /\[ Skip \]/ /[ ]*Press escape key to go back to choose the provider/
 Show
 
-Hide
-TypeCLIPassword "goodpass"
-Show
-
-Hide
-Enter
-Wait+CLIPrompt@${AUTHD_WAIT_DEFAULT}*2 /New password/ /\[ Skip \]/ /The password is the same as the old one[\n]+[ ]*Press escape key to go back to choose the provider/
-Show
-
 Hide
 TypeCLIPassword "password"
 Show
@@ -63,15 +54,6 @@ Enter
 Wait+CLIPrompt@${AUTHD_WAIT_DEFAULT}*2 /New password/ /\[ Skip \]\nThe password fails the dictionary check[^\n]+[\n]+[ ]*Press escape key to go back to choose the provider/
 Show
 
-Hide
-TypeCLIPassword "goodpass"
-Show
-
-Hide
-Enter
-Wait+CLIPrompt@${AUTHD_WAIT_DEFAULT}*2 /New password/ /\[ Skip \]\nThe password is the same as the old one[\n]+[ ]*Press escape key to go back to choose the provider/
-Show
-
 Hide
 TypeCLIPassword "1234"
 Show
diff --git a/pam/integration-tests/testdata/tapes/cli/optional_password_reset_skip.tape b/pam/integration-tests/testdata/tapes/cli/optional_password_reset_skip.tape
index 1ca2eb4761..b079419860 100644
--- a/pam/integration-tests/testdata/tapes/cli/optional_password_reset_skip.tape
+++ b/pam/integration-tests/testdata/tapes/cli/optional_password_reset_skip.tape
@@ -5,7 +5,7 @@ Wait /Username: user name\n/
 Show
 
 Hide
-TypeUsername "user-can-reset"
+TypeUsername "user-can-reset@example.com"
 Show
 
 Hide
diff --git a/pam/integration-tests/testdata/tapes/cli/qr_code_quick_regenerate.tape b/pam/integration-tests/testdata/tapes/cli/qr_code_quick_regenerate.tape
index fb1e333fde..aa41faf6aa 100644
--- a/pam/integration-tests/testdata/tapes/cli/qr_code_quick_regenerate.tape
+++ b/pam/integration-tests/testdata/tapes/cli/qr_code_quick_regenerate.tape
@@ -5,7 +5,7 @@ Wait /Username: user name\n/
 Show
 
 Hide
-TypeUsername "user-integration-qrcode-static-regenerate"
+TypeUsername "user-integration-qrcode-static-regenerate@example.com"
 Show
 
 Hide
diff --git a/pam/integration-tests/testdata/tapes/cli/remember_broker_and_mode.tape b/pam/integration-tests/testdata/tapes/cli/remember_broker_and_mode.tape
index 3287bf006d..7fb08ab1f9 100644
--- a/pam/integration-tests/testdata/tapes/cli/remember_broker_and_mode.tape
+++ b/pam/integration-tests/testdata/tapes/cli/remember_broker_and_mode.tape
@@ -5,7 +5,7 @@ Wait /Username: user name\n/
 Show
 
 Hide
-TypeUsername "user-integration-remember-mode"
+TypeUsername "user-integration-remember-mode@example.com"
 Show
 
 Hide
@@ -42,7 +42,7 @@ Wait /Username: user name\n/
 Show
 
 Hide
-TypeUsername "user-integration-remember-mode"
+TypeUsername "user-integration-remember-mode@example.com"
 Show
 
 Hide
diff --git a/pam/integration-tests/testdata/tapes/cli/sigint.tape b/pam/integration-tests/testdata/tapes/cli/sigint.tape
index 09c1e0a199..d60085736a 100644
--- a/pam/integration-tests/testdata/tapes/cli/sigint.tape
+++ b/pam/integration-tests/testdata/tapes/cli/sigint.tape
@@ -5,7 +5,7 @@ Wait /Username: user name\n/
 Show
 
 Hide
-TypeUsername "user-integration-sigint"
+TypeUsername "user-integration-sigint@example.com"
 Show
 
 Hide
diff --git a/pam/integration-tests/testdata/tapes/cli/simple_auth_empty_user.tape b/pam/integration-tests/testdata/tapes/cli/simple_auth_empty_user.tape
index e53effd5a6..7bcbe5b143 100644
--- a/pam/integration-tests/testdata/tapes/cli/simple_auth_empty_user.tape
+++ b/pam/integration-tests/testdata/tapes/cli/simple_auth_empty_user.tape
@@ -5,11 +5,11 @@ Wait /Username: user name\n/
 Show
 
 Hide
-TypeUsername "user-integration-not-empty"
+TypeUsername "user-integration-not-empty@example.com"
 Show
 
 Hide
-Backspace 26
+Backspace 38
 Wait /Username: user name\n/
 Show
 
@@ -21,7 +21,7 @@ Show
 Hide
 Escape
 Backspace
-TypeUsername "user-integration-was-empty"
+TypeUsername "user-integration-was-empty@example.com"
 Show
 
 Hide
diff --git a/pam/integration-tests/testdata/tapes/cli/simple_auth_with_unsupported_args.tape b/pam/integration-tests/testdata/tapes/cli/simple_auth_with_unsupported_args.tape
index 368cf1d419..c062d13e89 100644
--- a/pam/integration-tests/testdata/tapes/cli/simple_auth_with_unsupported_args.tape
+++ b/pam/integration-tests/testdata/tapes/cli/simple_auth_with_unsupported_args.tape
@@ -5,7 +5,7 @@ Wait /Username: user name\n/
 Show
 
 Hide
-TypeUsername "user2"
+TypeUsername "user2@example.com"
 Show
 
 Hide
diff --git a/pam/integration-tests/testdata/tapes/cli/switch_auth_mode.tape b/pam/integration-tests/testdata/tapes/cli/switch_auth_mode.tape
index fba8675203..7ac8f88061 100644
--- a/pam/integration-tests/testdata/tapes/cli/switch_auth_mode.tape
+++ b/pam/integration-tests/testdata/tapes/cli/switch_auth_mode.tape
@@ -5,7 +5,7 @@ Wait /Username: user name\n/
 Show
 
 Hide
-TypeUsername "user-integration-switch-mode"
+TypeUsername "user-integration-switch-mode@example.com"
 Show
 
 Hide
diff --git a/pam/integration-tests/testdata/tapes/cli/switch_local_broker.tape b/pam/integration-tests/testdata/tapes/cli/switch_local_broker.tape
index c637fa1058..c480721a5f 100644
--- a/pam/integration-tests/testdata/tapes/cli/switch_local_broker.tape
+++ b/pam/integration-tests/testdata/tapes/cli/switch_local_broker.tape
@@ -5,7 +5,7 @@ Wait /Username: user name\n/
 Show
 
 Hide
-TypeUsername "user-integration-switch-broker"
+TypeUsername "user-integration-switch-broker@example.com"
 Show
 
 Hide
diff --git a/pam/integration-tests/testdata/tapes/cli/switch_username.tape b/pam/integration-tests/testdata/tapes/cli/switch_username.tape
index 2ccc3213cb..9c05b0437f 100644
--- a/pam/integration-tests/testdata/tapes/cli/switch_username.tape
+++ b/pam/integration-tests/testdata/tapes/cli/switch_username.tape
@@ -6,7 +6,7 @@ Show
 
 Hide
 Escape
-TypeUsername "user-integration-switch-username"
+TypeUsername "user-integration-switch-username@example.com"
 Show
 
 Hide
@@ -16,11 +16,11 @@ Show
 
 Hide
 Escape
-Wait /Username: user-integration-switch-username\n/
-Backspace 15
+Wait /Username: user-integration-switch-username@example.com\n/
+Backspace 27
 Wait /Username: user-integration-\n/
-Type "username-switched"
-Wait /Username: user-integration-username-switched\n/
+Type "username-switched@example.com"
+Wait /Username: user-integration-username-switched@example.com\n/
 Show
 
 Hide
diff --git a/pam/integration-tests/testdata/tapes/cli/unexistent_user.tape b/pam/integration-tests/testdata/tapes/cli/unexistent_user.tape
index e711683c37..9845ffecd5 100644
--- a/pam/integration-tests/testdata/tapes/cli/unexistent_user.tape
+++ b/pam/integration-tests/testdata/tapes/cli/unexistent_user.tape
@@ -5,7 +5,7 @@ Wait /Username: user name\n/
 Show
 
 Hide
-TypeUsername "user-unexistent"
+TypeUsername "user-unexistent@example.com"
 Show
 
 Hide
diff --git a/pam/integration-tests/testdata/tapes/native/mfa_reset_pwquality_auth.tape b/pam/integration-tests/testdata/tapes/native/mfa_reset_pwquality_auth.tape
index f8f99b436f..426eb7e8f3 100644
--- a/pam/integration-tests/testdata/tapes/native/mfa_reset_pwquality_auth.tape
+++ b/pam/integration-tests/testdata/tapes/native/mfa_reset_pwquality_auth.tape
@@ -39,13 +39,6 @@ Enter
 Wait+Prompt@${AUTHD_SLEEP_EXAMPLE_BROKER_MFA_WAIT}*1.2 /Enter your new password \(3 days until mandatory\)/
 Show
 
-Hide
-Type "goodpass"
-Enter
-Wait+Nth(1) /The password is the same as the old one/
-Wait+Prompt /Enter your new password \(3 days until mandatory\)/
-Show
-
 Hide
 Type "password"
 Enter
@@ -53,13 +46,6 @@ Wait+Nth(1) /The password fails the dictionary check/
 Wait+Prompt /Enter your new password \(3 days until mandatory\)/
 Show
 
-Hide
-Type "goodpass"
-Enter
-Wait+Nth(2)  /The password is the same as the old one/
-Wait+Prompt /Enter your new password \(3 days until mandatory\)/
-Show
-
 Hide
 Type "1234"
 Enter
diff --git a/pam/integration-tests/testdata/tapes/native/mfa_reset_same_password.tape b/pam/integration-tests/testdata/tapes/native/mfa_reset_same_password.tape
new file mode 100644
index 0000000000..910ffa48e9
--- /dev/null
+++ b/pam/integration-tests/testdata/tapes/native/mfa_reset_same_password.tape
@@ -0,0 +1,52 @@
+Hide
+TypeInPrompt+Shell "${AUTHD_TEST_TAPE_COMMAND}"
+Enter
+Wait+Prompt /Choose your provider/
+Show
+
+Hide
+TypeInPrompt "2"
+Show
+
+Hide
+Show
+
+Hide
+Enter
+Wait+Prompt /Gimme your password/
+Show
+
+Hide
+Type "goodpass"
+Enter
+Wait+Nth(1)@${AUTHD_SLEEP_EXAMPLE_BROKER_MFA_WAIT}/2 /Password reset, 2 step\(s\) missing/
+Wait+Prompt /Plug your fido device and press with your thumb/
+Show
+
+# Wait for MFA auth to happen
+Hide
+Enter
+Wait+Nth(1) /Password reset, 1 step\(s\) missing/
+Wait+Prompt /Choose action/
+Show
+
+Hide
+TypeInPrompt "1"
+Show
+
+Hide
+Enter
+Wait+Prompt@${AUTHD_SLEEP_EXAMPLE_BROKER_MFA_WAIT}*1.2 /Enter your new password \(3 days until mandatory\)/
+Show
+
+Hide
+Type "authd2404"
+Enter
+Wait+Prompt /Confirm Password/
+Show
+
+Hide
+Type "authd2404"
+Enter
+${AUTHD_TEST_TAPE_COMMAND_AUTH_FINAL_WAIT}
+Show
diff --git a/pam/integration-tests/testdata/tapes/ssh/mfa_reset_same_password.tape b/pam/integration-tests/testdata/tapes/ssh/mfa_reset_same_password.tape
new file mode 120000
index 0000000000..d5bf5037f9
--- /dev/null
+++ b/pam/integration-tests/testdata/tapes/ssh/mfa_reset_same_password.tape
@@ -0,0 +1 @@
+../native/mfa_reset_same_password.tape
\ No newline at end of file
diff --git a/pam/integration-tests/testdata/tapes/ssh/simple_auth_locks_unlocks.tape b/pam/integration-tests/testdata/tapes/ssh/simple_auth_locks_unlocks.tape
new file mode 100644
index 0000000000..fce122641b
--- /dev/null
+++ b/pam/integration-tests/testdata/tapes/ssh/simple_auth_locks_unlocks.tape
@@ -0,0 +1,73 @@
+Hide
+TypeInPrompt+Shell "${AUTHD_TEST_TAPE_COMMAND}"
+Enter
+Wait+Prompt /Choose your provider/
+Show
+
+Hide
+TypeInPrompt "2"
+Show
+
+Hide
+Enter
+Wait+Prompt /Gimme your password/
+Show
+
+Hide
+Type "goodpass"
+Enter
+${AUTHD_TEST_TAPE_COMMAND_AUTH_FINAL_WAIT}
+Show
+
+ClearTerminal
+
+Hide
+TypeInPrompt+Shell "${AUTHCTL_PATH} user lock ${AUTHD_PAM_SSH_USER}"
+Enter
+Wait
+Show
+
+ClearTerminal
+
+Hide
+TypeInPrompt+Shell "${AUTHD_TEST_TAPE_COMMAND}"
+Enter
+Wait+Prompt /Gimme your password/
+Show
+
+Hide
+Type "goodpass"
+Enter
+Wait /permission denied: user .* is locked/
+Wait
+Show
+
+ClearTerminal
+
+# lock again...
+
+Hide
+TypeInPrompt+Shell "${AUTHCTL_PATH} user lock ${AUTHD_PAM_SSH_USER}"
+Enter
+Wait
+Show
+
+ClearTerminal
+
+Hide
+TypeInPrompt+Shell "${AUTHCTL_PATH} user unlock ${AUTHD_PAM_SSH_USER}"
+Enter
+Wait
+Show
+
+Hide
+TypeInPrompt+Shell "${AUTHD_TEST_TAPE_COMMAND}"
+Enter
+Wait+Prompt /Gimme your password/
+Show
+
+Hide
+Type "goodpass"
+Enter
+${AUTHD_TEST_TAPE_COMMAND_AUTH_FINAL_WAIT}
+Show
diff --git a/pam/integration-tests/testdata/tapes/ssh/simple_auth_with_shell.tape b/pam/integration-tests/testdata/tapes/ssh/simple_auth_with_shell.tape
index 357d406dea..a4e8ddce5f 100644
--- a/pam/integration-tests/testdata/tapes/ssh/simple_auth_with_shell.tape
+++ b/pam/integration-tests/testdata/tapes/ssh/simple_auth_with_shell.tape
@@ -19,7 +19,7 @@ Show
 Hide
 TypeInPrompt+SH "echo $USER"
 Enter
-Wait /user-integration[\w-]+\n\$\n/
+Wait /user-integration[\w-]+@[\w-.]+\n\$\n/
 Show
 
 Hide
diff --git a/pam/integration-tests/vhs-helpers_test.go b/pam/integration-tests/vhs-helpers_test.go
index ce3771ce95..c892d0b569 100644
--- a/pam/integration-tests/vhs-helpers_test.go
+++ b/pam/integration-tests/vhs-helpers_test.go
@@ -2,6 +2,7 @@ package main_test
 
 import (
 	"fmt"
+	"io"
 	"maps"
 	"math"
 	"os"
@@ -12,17 +13,19 @@ import (
 	"slices"
 	"strconv"
 	"strings"
+	"sync"
 	"testing"
 	"time"
 	"unicode/utf8"
 
+	"github.com/canonical/authd/examplebroker"
+	"github.com/canonical/authd/internal/proto/authd"
+	"github.com/canonical/authd/internal/services/permissions"
+	"github.com/canonical/authd/internal/testlog"
+	"github.com/canonical/authd/internal/testutils"
+	"github.com/canonical/authd/pam/internal/pam_test"
 	"github.com/msteinert/pam/v2"
 	"github.com/stretchr/testify/require"
-	"github.com/ubuntu/authd/examplebroker"
-	"github.com/ubuntu/authd/internal/proto/authd"
-	"github.com/ubuntu/authd/internal/services/permissions"
-	"github.com/ubuntu/authd/internal/testutils"
-	"github.com/ubuntu/authd/pam/internal/pam_test"
 )
 
 const (
@@ -69,12 +72,16 @@ type tapeSetting struct {
 }
 
 type tapeData struct {
-	Name      string
-	Command   string
-	Outputs   []string
-	Settings  map[string]any
-	Env       map[string]string
-	Variables map[string]string
+	Name           string
+	Command        string
+	OutputDir      string
+	OutputFilename string
+	Settings       map[string]any
+	Env            map[string]string
+	Variables      map[string]string
+
+	sanitizeOutputOnce sync.Once
+	sanitizedOutput    string
 }
 
 type vhsTestType int
@@ -125,7 +132,7 @@ var (
 )
 
 var (
-	// vhsWaitRegex catches Wait(@timeout)? /Pattern/ commands to re-implement default vhs
+	// vhsWaitRegex catches Wait(@timeout)? /Pattern/ commands to re-implement default VHS
 	// Wait /Pattern/ command with full context on errors.
 	vhsWaitRegex = regexp.MustCompile(`\bWait(\+Line)?(@\S+)?[\t ]+(/(.+)/|(.+))`)
 	// vhsWaitLineRegex catches Wait(@timeout) commands to re-implement default Wait command
@@ -165,9 +172,19 @@ var (
 	vhsClearTape = regexp.MustCompile(`\bClearTerminal\b`)
 )
 
-func newTapeData(tapeName string, settings ...tapeSetting) tapeData {
+func init() {
+	if v := os.Getenv("AUTHD_TESTS_VHS_WAIT_TIMEOUT"); v != "" {
+		d, err := time.ParseDuration(v)
+		if err != nil {
+			panic(err)
+		}
+		defaultSleepValues[authdWaitDefault] = d
+	}
+}
+
+func newTapeData(tapeName string, outputDir string, settings ...tapeSetting) *tapeData {
 	m := map[string]any{
-		vhsWidth:  800,
+		vhsWidth:  1200,
 		vhsHeight: 500,
 		// TODO: Ideally, we should use Ubuntu Mono. However, the github runner is still on Jammy, which does not have it.
 		// We should update this to use Ubuntu Mono once the runner is updated.
@@ -182,13 +199,12 @@ func newTapeData(tapeName string, settings ...tapeSetting) tapeData {
 	for _, s := range settings {
 		m[s.Key] = s.Value
 	}
-	return tapeData{
-		Name: tapeName,
-		Outputs: []string{
-			tapeName + ".txt",
-		},
-		Settings: m,
-		Env:      make(map[string]string),
+	return &tapeData{
+		Name:           tapeName,
+		OutputDir:      outputDir,
+		OutputFilename: tapeName + ".txt",
+		Settings:       m,
+		Env:            make(map[string]string),
 	}
 }
 
@@ -238,15 +254,37 @@ func (td *tapeData) AddClientOptions(t *testing.T, opts clientOptions) {
 	}
 }
 
-func (td tapeData) RunVhs(t *testing.T, testType vhsTestType, outDir string, cliEnv []string) {
+func (td *tapeData) RunVHS(t *testing.T, testType vhsTestType, cliEnv []string) {
 	t.Helper()
 
 	cmd := exec.Command("env", "vhs")
+
+	var outBuf testutils.SyncBuffer
+	// Write stdout/stderr both to our stdout/stderr and to the buffer
+	cmd.Stdout = io.MultiWriter(t.Output(), &outBuf)
+	cmd.Stderr = io.MultiWriter(t.Output(), &outBuf)
+
 	cmd.Env = append(testutils.AppendCovEnv(cmd.Env), cliEnv...)
-	cmd.Dir = outDir
+	cmd.Dir = td.OutputDir
+
+	cmd.Env = append(cmd.Env,
+		// If vhs is installed with "go install", we need to add GOPATH to PATH.
+		pathEnvWithGoBin(t),
+		// vhs uses rod, which downloads chromium to $HOME/.cache/rod,
+		// so $HOME needs to be set to avoid that it downloads it every time.
+		// TODO: Set XDG_CACHE_HOME instead once https://github.com/go-rod/rod/pull/1213 was merged
+		"HOME="+os.Getenv("HOME"),
+		// Avoid VHS printing "Host your GIF on vhs.charm.sh: vhs publish <file>.gif"
+		"VHS_PUBLISH=false",
+	)
 
-	// If vhs is installed with "go install", we need to add GOPATH to PATH.
-	cmd.Env = append(cmd.Env, prependBinToPath(t))
+	// Force VHS to use color because it makes it a lot easier to find the error
+	// message in the VHS output. The only case where we don't want color is when
+	// building a Debian package, because when viewing the logs of a launchpad build
+	// in the browser, ANSI colors are not rendered.
+	if !testutils.IsDebianPackageBuild() {
+		cmd.Env = append(cmd.Env, "CLICOLOR_FORCE=1")
+	}
 
 	u, err := user.Current()
 	require.NoError(t, err, "Setup: getting current user")
@@ -254,6 +292,9 @@ func (td tapeData) RunVhs(t *testing.T, testType vhsTestType, outDir string, cli
 		cmd.Env = append(cmd.Env, "VHS_NO_SANDBOX=1")
 	}
 
+	// Set a temporary HOME directory to avoid interference with the user's home directory.
+	td.Env["HOME"] = t.TempDir()
+
 	// Move some of the environment specific-variables from the tape to the launched process
 	if e, ok := td.Env[pam_test.RunnerEnvLogFile]; ok {
 		delete(td.Env, pam_test.RunnerEnvLogFile)
@@ -266,37 +307,49 @@ func (td tapeData) RunVhs(t *testing.T, testType vhsTestType, outDir string, cli
 		cmd.Env = append(cmd.Env, fmt.Sprintf("GORACE=log_path=%s exitcode=0", raceLog))
 	}
 
-	cmd.Args = append(cmd.Args, td.PrepareTape(t, testType, outDir))
-	out, err := cmd.CombinedOutput()
+	if testutils.IsAsan() {
+		if asanOptions := os.Getenv("ASAN_OPTIONS"); asanOptions != "" {
+			cmd.Env = append(cmd.Env, fmt.Sprintf("ASAN_OPTIONS=%s", asanOptions))
+		}
+		if lsanOptions := os.Getenv("LSAN_OPTIONS"); lsanOptions != "" {
+			cmd.Env = append(cmd.Env, fmt.Sprintf("LSAN_OPTIONS=%s", lsanOptions))
+		}
+	}
+
+	tapePath := td.PrepareTape(t, testType)
+	testutils.MaybeSaveFilesAsArtifactsOnCleanup(t, tapePath, filepath.Join(td.OutputDir, td.OutputFilename))
+	cmd.Args = append(cmd.Args, tapePath)
+
+	err = testlog.RunWithTiming(t, fmt.Sprintf("VHS tape %q", td.Name), cmd, testlog.DoNotSetStdoutAndStderr())
 	if raceLog != "" {
 		checkDataRaces(t, raceLog)
 	}
 
-	isSSHError := func(processOut []byte) bool {
+	sanitizedOutputFilename := strings.TrimSuffix(td.OutputFilename, ".txt") + ".sanitized.txt"
+	testutils.MaybeSaveBytesAsArtifactOnCleanup(t, []byte(td.SanitizedOutput(t)), sanitizedOutputFilename)
+
+	isSSHError := func() bool {
+		out := outBuf.String()
 		const sshConnectionResetByPeer = "Connection reset by peer"
 		const sshConnectionClosed = "Connection closed by"
-		output := string(processOut)
-		return strings.Contains(output, sshConnectionResetByPeer) ||
-			strings.Contains(output, sshConnectionClosed)
+		return strings.Contains(out, sshConnectionResetByPeer) ||
+			strings.Contains(out, sshConnectionClosed)
 	}
-	if err != nil && testType == vhsTestTypeSSH && isSSHError(out) {
-		t.Logf("SSH Connection failed on tape %q: %v: %s", td.Name, err, out)
+	if err != nil && testType == vhsTestTypeSSH && isSSHError() {
+		t.Logf("SSH Connection failed on tape %q: %v", td.Name, err)
 		// We've sometimes (but rarely) seen SSH connection errors which were resolved on retry, so we retry once.
 		// If it fails again, something might actually be broken.
 		//nolint:gosec // G204 it's a test and we explicitly set the parameters before.
 		newCmd := exec.Command(cmd.Args[0], cmd.Args[1:]...)
 		newCmd.Dir = cmd.Dir
 		newCmd.Env = slices.Clone(cmd.Env)
-		out, err = newCmd.CombinedOutput()
+		err = testlog.RunWithTiming(t, fmt.Sprintf("VHS tape %q (second try)", td.Name), newCmd, testlog.DoNotSetStdoutAndStderr())
 	}
-	require.NoError(t, err, "Failed to run tape %q: %v: %s", td.Name, err, out)
+	require.NoError(t, err, "Failed to run tape %q, see vhs output above", td.Name)
 }
 
-func (td tapeData) String() string {
-	var str string
-	for _, o := range td.Outputs {
-		str += fmt.Sprintf("Output %q\n", o)
-	}
+func (td *tapeData) String() string {
+	str := fmt.Sprintf("Output %q\n", td.OutputFilename)
 	for s, v := range td.Settings {
 		switch vv := v.(type) {
 		case time.Duration:
@@ -316,16 +369,6 @@ func (td tapeData) String() string {
 	return str
 }
 
-func (td tapeData) Output() string {
-	var txt string
-	for _, o := range td.Outputs {
-		if strings.HasSuffix(o, ".txt") {
-			txt = o
-		}
-	}
-	return txt
-}
-
 func checkDataRaces(t *testing.T, raceLog string) {
 	t.Helper()
 
@@ -348,7 +391,7 @@ func checkDataRaces(t *testing.T, raceLog string) {
 		})
 
 	require.NoError(t, err, "TearDown: Check for races")
-	saveArtifactsForDebugOnCleanup(t, raceLogs)
+	testutils.MaybeSaveFilesAsArtifactsOnCleanup(t, raceLogs...)
 	for _, raceLog := range raceLogs {
 		checkDataRace(t, raceLog)
 	}
@@ -368,18 +411,28 @@ func checkDataRace(t *testing.T, raceLog string) {
 	t.Fatalf("Got a GO Race on vhs child:\n%s", out)
 }
 
-func (td tapeData) ExpectedOutput(t *testing.T, outputDir string) string {
+func (td *tapeData) SanitizedOutput(t *testing.T) string {
 	t.Helper()
 
-	outPath := filepath.Join(outputDir, td.Output())
+	td.sanitizeOutputOnce.Do(func() {
+		td.sanitizedOutput = td.sanitizeOutput(t)
+	})
+
+	return td.sanitizedOutput
+}
+
+func (td *tapeData) sanitizeOutput(t *testing.T) string {
+	t.Helper()
+
+	outPath := filepath.Join(td.OutputDir, td.OutputFilename)
 	out, err := os.ReadFile(outPath)
 	require.NoError(t, err, "Could not read output file of tape %q (%s)", td.Name, outPath)
-	got := string(out)
+	s := string(out)
 
 	// We need to format the output a little bit, since the txt file can have some noise at the beginning.
 	command := "> " + td.Command
 	maxCommandLen := 0
-	splitTmp := strings.Split(got, "\n")
+	splitTmp := strings.Split(s, "\n")
 	for _, str := range splitTmp {
 		maxCommandLen = max(maxCommandLen, utf8.RuneCountInString(str))
 	}
@@ -388,46 +441,34 @@ func (td tapeData) ExpectedOutput(t *testing.T, outputDir string) string {
 	}
 	for i, str := range splitTmp {
 		if strings.Contains(str, command) {
-			got = strings.Join(splitTmp[i:], "\n")
+			s = strings.Join(splitTmp[i:], "\n")
 			break
 		}
 	}
 
-	got = permissions.Z_ForTests_IdempotentPermissionError(got)
+	s = permissions.Z_ForTests_IdempotentPermissionError(s)
 
 	// Remove consecutive equal frames from vhs tapes.
 	framesSeparator := strings.Repeat(string(vhsFrameSeparator), vhsFrameSeparatorLength)
-	frames := slices.Compact(strings.Split(got, framesSeparator))
+	frames := slices.Compact(strings.Split(s, framesSeparator))
 	// Drop all the empty lines before each page separator, to remove the clutter.
 	for i, f := range frames {
 		frames[i] = vhsEmptyTrailingLinesRegex.ReplaceAllString(f, "\n")
 	}
-	got = strings.Join(frames, framesSeparator)
+	s = strings.Join(frames, framesSeparator)
 
 	// Drop all the socket references.
-	got = vhsUnixTargetRegex.ReplaceAllLiteralString(got, "unix:///authd/test_socket.sock")
+	s = vhsUnixTargetRegex.ReplaceAllLiteralString(s, "unix:///authd/test_socket.sock")
 
 	// Username may be split in multiple lines, so fix this not to break further checks.
-	got = vhsUserCheckRegex.ReplaceAllStringFunc(got, func(s string) string {
+	s = vhsUserCheckRegex.ReplaceAllStringFunc(s, func(s string) string {
 		return strings.ReplaceAll(s, "\n", "")
 	})
 
-	// Save the sanitized result on cleanup
-	t.Cleanup(func() {
-		if !t.Failed() {
-			return
-		}
-		baseName, _ := strings.CutSuffix(td.Output(), ".txt")
-		tempOutput := filepath.Join(t.TempDir(), fmt.Sprintf("%s_sanitized.txt", baseName))
-		require.NoError(t, os.WriteFile(tempOutput, []byte(got), 0600),
-			"TearDown: Saving sanitized output file %q", tempOutput)
-		saveArtifactsForDebug(t, []string{tempOutput})
-	})
-
-	return got
+	return s
 }
 
-func (td tapeData) PrepareTape(t *testing.T, testType vhsTestType, outputPath string) string {
+func (td *tapeData) PrepareTape(t *testing.T, testType vhsTestType) string {
 	t.Helper()
 
 	currentDir, err := os.Getwd()
@@ -464,24 +505,14 @@ func (td tapeData) PrepareTape(t *testing.T, testType vhsTestType, outputPath st
 			sleepDuration(defaultSleepValues[authdSleepDefault]).Milliseconds()),
 	}, "\n"))
 
-	tapePath := filepath.Join(outputPath, td.Name)
+	tapePath := filepath.Join(td.OutputDir, td.Name+".tape")
 	err = os.WriteFile(tapePath, tape, 0600)
 	require.NoError(t, err, "Setup: write tape file")
 
-	if testutils.IsVerbose() {
-		t.Logf("Tape %q is now:\n%s", td.Name, tape)
-	}
-
-	artifacts := []string{tapePath}
-	for _, o := range td.Outputs {
-		artifacts = append(artifacts, filepath.Join(outputPath, o))
-	}
-	saveArtifactsForDebugOnCleanup(t, artifacts)
-
 	return tapePath
 }
 
-func evaluateTapeVariables(t *testing.T, tapeString string, td tapeData, testType vhsTestType) string {
+func evaluateTapeVariables(t *testing.T, tapeString string, td *tapeData, testType vhsTestType) string {
 	t.Helper()
 
 	for _, m := range vhsSleepOrWaitRegex.FindAllStringSubmatch(tapeString, -1) {
@@ -693,8 +724,9 @@ func vhsTestUserNameFull(t *testing.T, userPrefix string, namePrefix string) str
 	if namePrefix != "" && namePrefix[len(namePrefix)-1] != '-' {
 		namePrefix += "-"
 	}
-	return userPrefix + namePrefix + strings.ReplaceAll(
-		strings.ToLower(filepath.Base(t.Name())), "_", "-")
+
+	username := userPrefix + namePrefix + strings.ReplaceAll(strings.ToLower(filepath.Base(t.Name())), "_", "-")
+	return username + "@example.com"
 }
 
 func vhsTestUserName(t *testing.T, prefix string) string {
diff --git a/pam/internal/adapter/authentication.go b/pam/internal/adapter/authentication.go
index ef1bf2baa6..389e48be18 100644
--- a/pam/internal/adapter/authentication.go
+++ b/pam/internal/adapter/authentication.go
@@ -12,14 +12,14 @@ import (
 	"sync"
 	"time"
 
+	"github.com/canonical/authd/internal/brokers/auth"
+	"github.com/canonical/authd/internal/brokers/layouts"
+	"github.com/canonical/authd/internal/proto/authd"
+	"github.com/canonical/authd/log"
+	pam_proto "github.com/canonical/authd/pam/internal/proto"
 	tea "github.com/charmbracelet/bubbletea"
 	"github.com/charmbracelet/lipgloss"
 	"github.com/msteinert/pam/v2"
-	"github.com/ubuntu/authd/internal/brokers/auth"
-	"github.com/ubuntu/authd/internal/brokers/layouts"
-	"github.com/ubuntu/authd/internal/proto/authd"
-	"github.com/ubuntu/authd/log"
-	pam_proto "github.com/ubuntu/authd/pam/internal/proto"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
 )
@@ -68,7 +68,7 @@ func sendIsAuthenticated(ctx context.Context, client authd.PAMClient, sessionID
 			}
 			return pamError{
 				status: pam.ErrSystem,
-				msg:    fmt.Sprintf("authentication status failure: %v", err),
+				msg:    err.Error(),
 			}
 		}
 
@@ -122,6 +122,7 @@ type authenticationComponent interface {
 type authenticationModel struct {
 	client     authd.PAMClient
 	clientType PamClientType
+	mode       authd.SessionMode
 
 	inProgress       bool
 	currentModel     authenticationComponent
@@ -168,10 +169,11 @@ type newPasswordCheckResult struct {
 }
 
 // newAuthenticationModel initializes a authenticationModel which needs to be Compose then.
-func newAuthenticationModel(client authd.PAMClient, clientType PamClientType) authenticationModel {
+func newAuthenticationModel(client authd.PAMClient, clientType PamClientType, mode authd.SessionMode) authenticationModel {
 	return authenticationModel{
 		client:      client,
 		clientType:  clientType,
+		mode:        mode,
 		authTracker: &authTracker{cond: sync.NewCond(&sync.Mutex{})},
 	}
 }
@@ -222,10 +224,18 @@ func (m authenticationModel) Update(msg tea.Msg) (authModel authenticationModel,
 
 	case newPasswordCheck:
 		safeMessageDebug(msg)
-		currentSecret := m.currentSecret
+		var oldPassword string
+		if m.mode == authd.SessionMode_CHANGE_PASSWORD {
+			// Only compare the new password with the current one if the session is for changing the password.
+			// If the session is for authentication, we allow the user to set the same password again, to avoid
+			// that the user is forced to change their password if e.g. device authentication is forced when
+			// the refresh token is expired.
+			oldPassword = m.currentSecret
+		}
+
 		return m, func() tea.Msg {
 			res := newPasswordCheckResult{ctx: msg.ctx, password: msg.password}
-			if err := checkPasswordQuality(currentSecret, msg.password); err != nil {
+			if err := checkPasswordQuality(oldPassword, msg.password); err != nil {
 				res.msg = err.Error()
 			}
 			return res
diff --git a/pam/internal/adapter/authmodeselection.go b/pam/internal/adapter/authmodeselection.go
index 1dfffda560..9294bc058a 100644
--- a/pam/internal/adapter/authmodeselection.go
+++ b/pam/internal/adapter/authmodeselection.go
@@ -2,15 +2,14 @@ package adapter
 
 import (
 	"context"
-	"fmt"
 
+	"github.com/canonical/authd/internal/brokers/layouts"
+	"github.com/canonical/authd/internal/brokers/layouts/entries"
+	"github.com/canonical/authd/internal/proto/authd"
+	"github.com/canonical/authd/log"
 	tea_list "github.com/charmbracelet/bubbles/list"
 	tea "github.com/charmbracelet/bubbletea"
 	"github.com/msteinert/pam/v2"
-	"github.com/ubuntu/authd/internal/brokers/layouts"
-	"github.com/ubuntu/authd/internal/brokers/layouts/entries"
-	"github.com/ubuntu/authd/internal/proto/authd"
-	"github.com/ubuntu/authd/log"
 )
 
 // authModeSelectionModel is the model list to select supported authentication modes.
@@ -231,7 +230,7 @@ func getAuthenticationModes(client authd.PAMClient, sessionID string, uiLayouts
 		if err != nil {
 			return pamError{
 				status: pam.ErrSystem,
-				msg:    fmt.Sprintf("could not get authentication modes: %v", err),
+				msg:    err.Error(),
 			}
 		}
 
diff --git a/pam/internal/adapter/brokerselection.go b/pam/internal/adapter/brokerselection.go
index 7efc07e8b0..e0cb40cf11 100644
--- a/pam/internal/adapter/brokerselection.go
+++ b/pam/internal/adapter/brokerselection.go
@@ -4,12 +4,12 @@ import (
 	"context"
 	"fmt"
 
+	"github.com/canonical/authd/internal/proto/authd"
+	"github.com/canonical/authd/log"
+	"github.com/canonical/authd/pam/internal/proto"
 	tea_list "github.com/charmbracelet/bubbles/list"
 	tea "github.com/charmbracelet/bubbletea"
 	"github.com/msteinert/pam/v2"
-	"github.com/ubuntu/authd/internal/proto/authd"
-	"github.com/ubuntu/authd/log"
-	"github.com/ubuntu/authd/pam/internal/proto"
 )
 
 // brokerSelectionModel is the model list selection layout to allow authenticating and return a password.
diff --git a/pam/internal/adapter/button.go b/pam/internal/adapter/button.go
index 0fd3116a1e..61bbe5c36f 100644
--- a/pam/internal/adapter/button.go
+++ b/pam/internal/adapter/button.go
@@ -5,9 +5,9 @@ import (
 	"fmt"
 	"time"
 
+	"github.com/canonical/authd/log"
 	tea "github.com/charmbracelet/bubbletea"
 	"github.com/charmbracelet/lipgloss"
-	"github.com/ubuntu/authd/log"
 )
 
 // reselectionWaitTime is the amount of time that we wait before emitting buttonSelected event.
diff --git a/pam/internal/adapter/commands.go b/pam/internal/adapter/commands.go
index 0c8b798096..5ab935c2e6 100644
--- a/pam/internal/adapter/commands.go
+++ b/pam/internal/adapter/commands.go
@@ -6,11 +6,11 @@ import (
 	"os"
 	"strings"
 
+	"github.com/canonical/authd/internal/brokers"
+	"github.com/canonical/authd/internal/proto/authd"
+	"github.com/canonical/authd/log"
 	tea "github.com/charmbracelet/bubbletea"
 	"github.com/msteinert/pam/v2"
-	"github.com/ubuntu/authd/internal/brokers"
-	"github.com/ubuntu/authd/internal/proto/authd"
-	"github.com/ubuntu/authd/log"
 )
 
 // sendEvent sends an event msg to the main event loop.
@@ -47,7 +47,7 @@ func startBrokerSession(client authd.PAMClient, brokerID, username string, mode
 
 		sbResp, err := client.SelectBroker(context.TODO(), sbReq)
 		if err != nil {
-			return pamError{status: pam.ErrSystem, msg: fmt.Sprintf("can't select broker: %v", err)}
+			return pamError{status: pam.ErrSystem, msg: err.Error()}
 		}
 
 		sessionID := sbResp.GetSessionId()
diff --git a/pam/internal/adapter/focustracker.go b/pam/internal/adapter/focustracker.go
index 92ab143b31..52d27f6a6f 100644
--- a/pam/internal/adapter/focustracker.go
+++ b/pam/internal/adapter/focustracker.go
@@ -3,8 +3,8 @@ package adapter
 import (
 	"context"
 
+	"github.com/canonical/authd/log"
 	tea "github.com/charmbracelet/bubbletea"
-	"github.com/ubuntu/authd/log"
 )
 
 type focusTrackerModel struct {
diff --git a/pam/internal/adapter/formmodel.go b/pam/internal/adapter/formmodel.go
index 3c3487b91a..73f7036c8f 100644
--- a/pam/internal/adapter/formmodel.go
+++ b/pam/internal/adapter/formmodel.go
@@ -5,12 +5,12 @@ import (
 	"slices"
 	"strings"
 
+	"github.com/canonical/authd/internal/brokers/layouts"
+	"github.com/canonical/authd/internal/brokers/layouts/entries"
+	"github.com/canonical/authd/internal/proto/authd"
+	"github.com/canonical/authd/log"
 	tea "github.com/charmbracelet/bubbletea"
 	"github.com/charmbracelet/lipgloss"
-	"github.com/ubuntu/authd/internal/brokers/layouts"
-	"github.com/ubuntu/authd/internal/brokers/layouts/entries"
-	"github.com/ubuntu/authd/internal/proto/authd"
-	"github.com/ubuntu/authd/log"
 )
 
 // formModel is the form layout type to allow authentication and return a password.
diff --git a/pam/internal/adapter/gdmmodel.go b/pam/internal/adapter/gdmmodel.go
index a46de58dce..165bc28013 100644
--- a/pam/internal/adapter/gdmmodel.go
+++ b/pam/internal/adapter/gdmmodel.go
@@ -6,13 +6,13 @@ import (
 	"fmt"
 	"time"
 
+	"github.com/canonical/authd/internal/brokers/auth"
+	"github.com/canonical/authd/internal/proto/authd"
+	"github.com/canonical/authd/log"
+	"github.com/canonical/authd/pam/internal/gdm"
+	"github.com/canonical/authd/pam/internal/proto"
 	tea "github.com/charmbracelet/bubbletea"
 	"github.com/msteinert/pam/v2"
-	"github.com/ubuntu/authd/internal/brokers/auth"
-	"github.com/ubuntu/authd/internal/proto/authd"
-	"github.com/ubuntu/authd/log"
-	"github.com/ubuntu/authd/pam/internal/gdm"
-	"github.com/ubuntu/authd/pam/internal/proto"
 )
 
 const (
diff --git a/pam/internal/adapter/gdmmodel_convhandler_test.go b/pam/internal/adapter/gdmmodel_convhandler_test.go
index f0a5e81309..1d3f49f3e3 100644
--- a/pam/internal/adapter/gdmmodel_convhandler_test.go
+++ b/pam/internal/adapter/gdmmodel_convhandler_test.go
@@ -9,13 +9,12 @@ import (
 	"testing"
 	"time"
 
+	"github.com/canonical/authd/internal/proto/authd"
+	"github.com/canonical/authd/log"
+	"github.com/canonical/authd/pam/internal/gdm"
+	"github.com/canonical/authd/pam/internal/proto"
 	"github.com/msteinert/pam/v2"
 	"github.com/stretchr/testify/require"
-	"github.com/ubuntu/authd/internal/proto/authd"
-	"github.com/ubuntu/authd/log"
-	"github.com/ubuntu/authd/pam/internal/gdm"
-	"github.com/ubuntu/authd/pam/internal/proto"
-	pam_proto "github.com/ubuntu/authd/pam/internal/proto"
 )
 
 type gdmConvHandler struct {
@@ -40,9 +39,9 @@ type gdmConvHandler struct {
 	selectedBrokerID string
 
 	currentStageChanged sync.Cond
-	currentStage        pam_proto.Stage
-	stageChanges        []pam_proto.Stage
-	lastNotifiedStage   *pam_proto.Stage
+	currentStage        proto.Stage
+	stageChanges        []proto.Stage
+	lastNotifiedStage   *proto.Stage
 
 	startAuthRequested chan struct{}
 	authEvents         []*authd.IAResponse
@@ -244,7 +243,7 @@ func (h *gdmConvHandler) handleEvent(event *gdm.EventData) error {
 		}
 
 	case *gdm.EventData_StartAuthentication:
-		require.Equal(h.t, pam_proto.Stage_challenge, h.currentStage,
+		require.Equal(h.t, proto.Stage_challenge, h.currentStage,
 			"Authentication started when we're not in challenge phase but in %s",
 			h.currentStage)
 
diff --git a/pam/internal/adapter/gdmmodel_test.go b/pam/internal/adapter/gdmmodel_test.go
index bd9b37d86c..5b31350aea 100644
--- a/pam/internal/adapter/gdmmodel_test.go
+++ b/pam/internal/adapter/gdmmodel_test.go
@@ -14,18 +14,17 @@ import (
 	"testing"
 	"time"
 
+	"github.com/canonical/authd/internal/brokers/auth"
+	"github.com/canonical/authd/internal/brokers/layouts"
+	"github.com/canonical/authd/internal/proto/authd"
+	"github.com/canonical/authd/internal/testutils"
+	"github.com/canonical/authd/pam/internal/gdm"
+	"github.com/canonical/authd/pam/internal/gdm_test"
+	"github.com/canonical/authd/pam/internal/pam_test"
+	"github.com/canonical/authd/pam/internal/proto"
 	tea "github.com/charmbracelet/bubbletea"
 	"github.com/msteinert/pam/v2"
 	"github.com/stretchr/testify/require"
-	"github.com/ubuntu/authd/internal/brokers/auth"
-	"github.com/ubuntu/authd/internal/brokers/layouts"
-	"github.com/ubuntu/authd/internal/proto/authd"
-	"github.com/ubuntu/authd/internal/testutils"
-	"github.com/ubuntu/authd/pam/internal/gdm"
-	"github.com/ubuntu/authd/pam/internal/gdm_test"
-	"github.com/ubuntu/authd/pam/internal/pam_test"
-	"github.com/ubuntu/authd/pam/internal/proto"
-	pam_proto "github.com/ubuntu/authd/pam/internal/proto"
 )
 
 var gdmTestPrivateKey *rsa.PrivateKey
@@ -35,7 +34,11 @@ const gdmTestIgnoredMessage string = "<ignored>"
 func TestGdmModel(t *testing.T) {
 	t.Parallel()
 
-	// This test is flaky, see https://github.com/canonical/authd/issues/966
+	if testing.Short() {
+		t.Skip("skipping test in short mode.")
+	}
+
+	// // These tests are flaky, see https://github.com/canonical/authd/issues/1092
 	if os.Getenv("AUTHD_SKIP_FLAKY_TESTS") != "" {
 		t.Skip("skipping flaky test")
 	}
@@ -47,7 +50,7 @@ func TestGdmModel(t *testing.T) {
 	// been completed fully.
 	gdmTestEarlyStopExitStatus := errNoExitStatus
 
-	gdmTestIgnoreStage := pam_proto.Stage(-1)
+	gdmTestIgnoreStage := proto.Stage(-1)
 
 	firstBrokerInfo := &authd.ABResponse_BrokerInfo{
 		Id:        "testBroker",
@@ -88,6 +91,7 @@ func TestGdmModel(t *testing.T) {
 	testCases := map[string]struct {
 		client           authd.PAMClient
 		clientOptions    []pam_test.DummyClientOptions
+		sessionMode      authd.SessionMode
 		supportedLayouts []*authd.UILayout
 		messages         []tea.Msg
 		commands         []tea.Cmd
@@ -105,13 +109,13 @@ func TestGdmModel(t *testing.T) {
 		wantNoGdmEvents    []gdm.EventType
 		wantNoBrokers      bool
 		wantSelectedBroker string
-		wantStage          pam_proto.Stage
+		wantStage          proto.Stage
 		wantUsername       string
 		wantMessages       []tea.Msg
 	}{
 		"User_selection_stage": {
 			wantGdmRequests: []gdm.RequestType{gdm.RequestType_uiLayoutCapabilities},
-			wantStage:       pam_proto.Stage_userSelection,
+			wantStage:       proto.Stage_userSelection,
 			wantGdmEvents: []gdm.EventType{
 				gdm.EventType_brokersReceived,
 			},
@@ -144,7 +148,7 @@ func TestGdmModel(t *testing.T) {
 				gdm.EventType_startAuthentication,
 				gdm.EventType_authEvent,
 			},
-			wantStage:      pam_proto.Stage_brokerSelection,
+			wantStage:      proto.Stage_brokerSelection,
 			wantExitStatus: gdmTestEarlyStopExitStatus,
 		},
 		"Broker_selection_stage_caused_by_client_side_user_selection": {
@@ -167,7 +171,7 @@ func TestGdmModel(t *testing.T) {
 				gdm.EventType_startAuthentication,
 				gdm.EventType_authEvent,
 			},
-			wantStage:      pam_proto.Stage_brokerSelection,
+			wantStage:      proto.Stage_brokerSelection,
 			wantExitStatus: gdmTestEarlyStopExitStatus,
 		},
 		"Challenge_stage_caused_by_server_side_broker_and_authMode_selection": {
@@ -175,7 +179,7 @@ func TestGdmModel(t *testing.T) {
 				pam_test.WithGetPreviousBrokerReturn(firstBrokerInfo.Id, nil)),
 			pamUser: "pam-preset-user-and-daemon-selected-broker",
 			messages: []tea.Msg{
-				gdmTestWaitForStage{stage: pam_proto.Stage_challenge},
+				gdmTestWaitForStage{stage: proto.Stage_challenge},
 			},
 			wantSelectedBroker: firstBrokerInfo.Id,
 			wantGdmRequests: []gdm.RequestType{
@@ -195,7 +199,7 @@ func TestGdmModel(t *testing.T) {
 			wantNoGdmEvents: []gdm.EventType{
 				gdm.EventType_authEvent,
 			},
-			wantStage:      pam_proto.Stage_challenge,
+			wantStage:      proto.Stage_challenge,
 			wantExitStatus: gdmTestEarlyStopExitStatus,
 		},
 		"Challenge_stage_caused_by_client_side_broker_and_authMode_selection": {
@@ -204,12 +208,12 @@ func TestGdmModel(t *testing.T) {
 			},
 			messages: []tea.Msg{
 				gdmTestWaitForStage{
-					stage: pam_proto.Stage_brokerSelection,
+					stage: proto.Stage_brokerSelection,
 					events: []*gdm.EventData{
 						gdm_test.SelectBrokerEvent(firstBrokerInfo.Id),
 					},
 				},
-				gdmTestWaitForStage{stage: pam_proto.Stage_challenge},
+				gdmTestWaitForStage{stage: proto.Stage_challenge},
 			},
 			wantUsername:       "gdm-selected-user-and-broker",
 			wantSelectedBroker: firstBrokerInfo.Id,
@@ -231,7 +235,7 @@ func TestGdmModel(t *testing.T) {
 			wantNoGdmEvents: []gdm.EventType{
 				gdm.EventType_authEvent,
 			},
-			wantStage:      pam_proto.Stage_challenge,
+			wantStage:      proto.Stage_challenge,
 			wantExitStatus: gdmTestEarlyStopExitStatus,
 		},
 		"Authenticated_with_preset_PAM_user_and_server_side_broker_and_authMode_selection": {
@@ -241,7 +245,7 @@ func TestGdmModel(t *testing.T) {
 			pamUser: "pam-PRESET-user-and-daemon-selected-broker",
 			messages: []tea.Msg{
 				gdmTestWaitForStage{
-					stage: pam_proto.Stage_challenge,
+					stage: proto.Stage_challenge,
 					commands: []tea.Cmd{
 						sendEvent(gdmTestSendAuthDataWhenReady{&authd.IARequest_AuthenticationData_Secret{
 							Secret: "gdm-good-password",
@@ -266,7 +270,7 @@ func TestGdmModel(t *testing.T) {
 				gdm.EventType_authEvent,
 			},
 			wantGdmAuthRes: []*authd.IAResponse{{Access: auth.Granted}},
-			wantStage:      pam_proto.Stage_challenge,
+			wantStage:      proto.Stage_challenge,
 			wantExitStatus: PamSuccess{BrokerID: firstBrokerInfo.Id},
 		},
 		"Authenticated_with_preset_PAM_user_using_legacy_challenge_and_server_side_broker_and_authMode_selection": {
@@ -276,7 +280,7 @@ func TestGdmModel(t *testing.T) {
 			pamUser: "pam-PRESET-user-and-daemon-selected-broker",
 			messages: []tea.Msg{
 				gdmTestWaitForStage{
-					stage: pam_proto.Stage_challenge,
+					stage: proto.Stage_challenge,
 					commands: []tea.Cmd{
 						sendEvent(gdmTestSendAuthDataWhenReady{&authd.IARequest_AuthenticationData_Challenge{
 							Challenge: "gdm-good-password",
@@ -301,7 +305,7 @@ func TestGdmModel(t *testing.T) {
 				gdm.EventType_authEvent,
 			},
 			wantGdmAuthRes: []*authd.IAResponse{{Access: auth.Granted}},
-			wantStage:      pam_proto.Stage_challenge,
+			wantStage:      proto.Stage_challenge,
 			wantExitStatus: PamSuccess{BrokerID: firstBrokerInfo.Id},
 		},
 		"Authenticated_with_preset_PAM_user_updated_and_server_side_broker_and_authMode_selection": {
@@ -311,19 +315,19 @@ func TestGdmModel(t *testing.T) {
 			pamUser: "GDM@PAM-CASE-INDEPENDENT-PRESET-USER",
 			messages: []tea.Msg{
 				gdmTestWaitForStage{
-					stage: pam_proto.Stage_challenge,
+					stage: proto.Stage_challenge,
 					events: []*gdm.EventData{
-						gdm_test.ChangeStageEvent(pam_proto.Stage_userSelection),
+						gdm_test.ChangeStageEvent(proto.Stage_userSelection),
 					},
 					commands: []tea.Cmd{
 						sendEvent(gdmTestWaitForStage{
-							stage: pam_proto.Stage_userSelection,
+							stage: proto.Stage_userSelection,
 							events: []*gdm.EventData{
 								gdm_test.SelectUserEvent("gdm@pam-case-independent-preset-user"),
 							},
 							commands: []tea.Cmd{
 								sendEvent(gdmTestWaitForStage{
-									stage: pam_proto.Stage_challenge,
+									stage: proto.Stage_challenge,
 									commands: []tea.Cmd{
 										sendEvent(gdmTestSendAuthDataWhenReady{&authd.IARequest_AuthenticationData_Secret{
 											Secret: "gdm-good-password",
@@ -357,7 +361,7 @@ func TestGdmModel(t *testing.T) {
 				gdm.EventType_authEvent,
 			},
 			wantGdmAuthRes: []*authd.IAResponse{{Access: auth.Granted}},
-			wantStage:      pam_proto.Stage_challenge,
+			wantStage:      proto.Stage_challenge,
 			wantExitStatus: PamSuccess{BrokerID: firstBrokerInfo.Id},
 		},
 		"Authenticated_with_message_with_preset_PAM_user_and_server_side_broker_and_authMode_selection": {
@@ -371,7 +375,7 @@ func TestGdmModel(t *testing.T) {
 			pamUser: "pam-preset-user-and-daemon-selected-broker",
 			messages: []tea.Msg{
 				gdmTestWaitForStage{
-					stage: pam_proto.Stage_challenge,
+					stage: proto.Stage_challenge,
 					commands: []tea.Cmd{
 						sendEvent(gdmTestSendAuthDataWhenReady{&authd.IARequest_AuthenticationData_Secret{
 							Secret: "gdm-good-password",
@@ -395,7 +399,7 @@ func TestGdmModel(t *testing.T) {
 				gdm.EventType_authEvent,
 				gdm.EventType_startAuthentication,
 			},
-			wantStage: pam_proto.Stage_challenge,
+			wantStage: proto.Stage_challenge,
 			wantGdmAuthRes: []*authd.IAResponse{{
 				Access: auth.Granted,
 				Msg:    "Hi GDM, it's a pleasure to get you in!",
@@ -415,7 +419,7 @@ func TestGdmModel(t *testing.T) {
 			pamUser: "pam-preset-user-and-daemon-selected-broker",
 			messages: []tea.Msg{
 				gdmTestWaitForStage{
-					stage: pam_proto.Stage_challenge,
+					stage: proto.Stage_challenge,
 					commands: []tea.Cmd{
 						sendEvent(gdmTestSendAuthDataWhenReady{&authd.IARequest_AuthenticationData_Secret{
 							Secret: "gdm-good-password",
@@ -440,7 +444,7 @@ func TestGdmModel(t *testing.T) {
 				gdm.EventType_startAuthentication,
 				gdm.EventType_authEvent,
 			},
-			wantStage: pam_proto.Stage_challenge,
+			wantStage: proto.Stage_challenge,
 			wantGdmAuthRes: []*authd.IAResponse{{
 				Access: auth.Granted,
 			}},
@@ -459,7 +463,7 @@ func TestGdmModel(t *testing.T) {
 			pamUser: "pam-preset-user-and-daemon-selected-broker",
 			messages: []tea.Msg{
 				gdmTestWaitForStage{
-					stage: pam_proto.Stage_challenge,
+					stage: proto.Stage_challenge,
 					commands: []tea.Cmd{
 						sendEvent(gdmTestSendAuthDataWhenReady{&authd.IARequest_AuthenticationData_Secret{
 							Secret: "gdm-good-password",
@@ -484,7 +488,7 @@ func TestGdmModel(t *testing.T) {
 				gdm.EventType_startAuthentication,
 				gdm.EventType_authEvent,
 			},
-			wantStage: pam_proto.Stage_challenge,
+			wantStage: proto.Stage_challenge,
 			wantGdmAuthRes: []*authd.IAResponse{{
 				Access: auth.Granted,
 				Msg:    "Hi GDM, it's a pleasure to change your password!",
@@ -505,7 +509,7 @@ func TestGdmModel(t *testing.T) {
 			pamUser: "pam-preset-user-and-daemon-selected-broker",
 			messages: []tea.Msg{
 				gdmTestWaitForStage{
-					stage: pam_proto.Stage_challenge,
+					stage: proto.Stage_challenge,
 					commands: []tea.Cmd{
 						sendEvent(gdmTestSendAuthDataWhenReady{&authd.IARequest_AuthenticationData_Secret{
 							Secret: "newpass",
@@ -540,7 +544,7 @@ func TestGdmModel(t *testing.T) {
 				gdm.EventType_startAuthentication,
 				gdm.EventType_authEvent, // granted
 			},
-			wantStage: pam_proto.Stage_challenge,
+			wantStage: proto.Stage_challenge,
 			wantGdmAuthRes: []*authd.IAResponse{
 				{
 					Access: auth.Retry,
@@ -560,8 +564,9 @@ func TestGdmModel(t *testing.T) {
 				msg:      "Hi GDM, it's a pleasure to change your password!",
 			},
 		},
-		"New_password_cannot_change_because_matches_previous_with_preset_PAM_user_and_server_side_broker_and_authMode_selection": {
-			timeout: 30 * time.Second,
+		"Changing_password_fails_when_same_as_old_password_with_preset_PAM_user_and_server_side_broker_and_authMode_selection": {
+			timeout:     30 * time.Second,
+			sessionMode: authd.SessionMode_CHANGE_PASSWORD,
 			clientOptions: append(slices.Clone(singleBrokerClientOptions),
 				pam_test.WithGetPreviousBrokerReturn(firstBrokerInfo.Id, nil),
 				pam_test.WithUILayout(newPasswordUILayoutID, "New Password", pam_test.NewPasswordUILayout()),
@@ -573,13 +578,13 @@ func TestGdmModel(t *testing.T) {
 			pamUser: "pam-preset-user-with-daemon-selected-broker-and-auth-mode",
 			messages: []tea.Msg{
 				gdmTestWaitForStage{
-					stage: pam_proto.Stage_authModeSelection,
+					stage: proto.Stage_authModeSelection,
 					events: []*gdm.EventData{
 						gdm_test.AuthModeSelectedEvent(passwordUILayoutID),
 					},
 				},
 				gdmTestWaitForStage{
-					stage: pam_proto.Stage_challenge,
+					stage: proto.Stage_challenge,
 					commands: []tea.Cmd{
 						sendEvent(gdmTestSendAuthDataWhenReadyFull{
 							authData: &authd.IARequest_AuthenticationData_Secret{
@@ -587,22 +592,22 @@ func TestGdmModel(t *testing.T) {
 							},
 							commands: []tea.Cmd{
 								sendEvent(gdmTestWaitForStage{
-									stage: pam_proto.Stage_authModeSelection,
+									stage: proto.Stage_authModeSelection,
 								}),
 								sendEvent(gdmTestWaitForStage{
-									stage: pam_proto.Stage_challenge,
+									stage: proto.Stage_challenge,
 									events: []*gdm.EventData{
-										gdm_test.ChangeStageEvent(pam_proto.Stage_authModeSelection),
+										gdm_test.ChangeStageEvent(proto.Stage_authModeSelection),
 									},
 									commands: []tea.Cmd{
 										sendEvent(gdmTestWaitForStage{
-											stage: pam_proto.Stage_authModeSelection,
+											stage: proto.Stage_authModeSelection,
 											events: []*gdm.EventData{
 												gdm_test.AuthModeSelectedEvent(newPasswordUILayoutID),
 											},
 											commands: []tea.Cmd{
 												sendEvent(gdmTestWaitForStage{
-													stage: pam_proto.Stage_challenge,
+													stage: proto.Stage_challenge,
 													commands: []tea.Cmd{
 														sendEvent(gdmTestSendAuthDataWhenReady{
 															&authd.IARequest_AuthenticationData_Secret{
@@ -654,7 +659,7 @@ func TestGdmModel(t *testing.T) {
 				gdm.EventType_authEvent, // retry
 				gdm.EventType_startAuthentication,
 			},
-			wantStage: pam_proto.Stage_challenge,
+			wantStage: proto.Stage_challenge,
 			wantGdmAuthRes: []*authd.IAResponse{
 				{
 					Access: auth.Next,
@@ -692,7 +697,7 @@ func TestGdmModel(t *testing.T) {
 				gdm.EventType_startAuthentication,
 				gdm.EventType_authEvent,
 			},
-			wantStage:      pam_proto.Stage_userSelection,
+			wantStage:      proto.Stage_userSelection,
 			wantExitStatus: gdmTestEarlyStopExitStatus,
 		},
 		"Cancelled_with_preset_PAM_user_and_server_side_broker_and_authMode_selection": {
@@ -724,7 +729,7 @@ func TestGdmModel(t *testing.T) {
 				gdm.EventType_startAuthentication,
 				gdm.EventType_authEvent,
 			},
-			wantStage:      pam_proto.Stage_challenge,
+			wantStage:      proto.Stage_challenge,
 			wantGdmAuthRes: []*authd.IAResponse{{Access: auth.Cancelled}},
 			wantExitStatus: gdmTestEarlyStopExitStatus,
 		},
@@ -735,7 +740,7 @@ func TestGdmModel(t *testing.T) {
 			pamUser: "pam-preset-user-and-daemon-selected-broker",
 			messages: []tea.Msg{
 				gdmTestWaitForStage{
-					stage: pam_proto.Stage_challenge,
+					stage: proto.Stage_challenge,
 					events: []*gdm.EventData{
 						gdm_test.IsAuthenticatedCancelledEvent(),
 					},
@@ -756,7 +761,7 @@ func TestGdmModel(t *testing.T) {
 				gdm.EventType_uiLayoutReceived,
 				gdm.EventType_startAuthentication,
 			},
-			wantStage:      pam_proto.Stage_challenge,
+			wantStage:      proto.Stage_challenge,
 			wantExitStatus: gdmTestEarlyStopExitStatus,
 		},
 		"Explicitly_cancelled_for_a_waiting_auth_mode_with_preset_PAM_user_and_server_side_broker_and_authMode_selection": {
@@ -767,7 +772,7 @@ func TestGdmModel(t *testing.T) {
 			pamUser: "pam-preset-user-and-daemon-selected-broker",
 			messages: []tea.Msg{
 				gdmTestWaitForStage{
-					stage: pam_proto.Stage_challenge,
+					stage: proto.Stage_challenge,
 					commands: []tea.Cmd{
 						sendEvent(gdmTestSendAuthDataWhenReadyFull{
 							authData: &authd.IARequest_AuthenticationData_Wait{
@@ -797,7 +802,7 @@ func TestGdmModel(t *testing.T) {
 				gdm.EventType_authEvent,
 			},
 			wantGdmAuthRes: []*authd.IAResponse{{Access: auth.Cancelled}},
-			wantStage:      pam_proto.Stage_challenge,
+			wantStage:      proto.Stage_challenge,
 			wantExitStatus: gdmTestEarlyStopExitStatus,
 		},
 		"Implicitly_cancelled_for_a_waiting_auth_mode_with_preset_PAM_user_and_server_side_broker_and_authMode_selection": {
@@ -808,17 +813,17 @@ func TestGdmModel(t *testing.T) {
 			pamUser: "pam-preset-user-and-daemon-selected-broker",
 			messages: []tea.Msg{
 				gdmTestWaitForStage{
-					stage: pam_proto.Stage_challenge,
+					stage: proto.Stage_challenge,
 					commands: []tea.Cmd{
 						sendEvent(gdmTestSendAuthDataWhenReadyFull{
 							authData: &authd.IARequest_AuthenticationData_Wait{
 								Wait: layouts.True,
 							},
 							events: []*gdm.EventData{
-								gdm_test.ChangeStageEvent(pam_proto.Stage_brokerSelection),
+								gdm_test.ChangeStageEvent(proto.Stage_brokerSelection),
 							},
 							commands: []tea.Cmd{
-								sendEvent(gdmTestWaitForStage{stage: pam_proto.Stage_brokerSelection}),
+								sendEvent(gdmTestWaitForStage{stage: proto.Stage_brokerSelection}),
 							},
 						}),
 					},
@@ -842,7 +847,7 @@ func TestGdmModel(t *testing.T) {
 				gdm.EventType_authEvent,
 			},
 			wantGdmAuthRes: []*authd.IAResponse{{Access: auth.Cancelled}},
-			wantStage:      pam_proto.Stage_brokerSelection,
+			wantStage:      proto.Stage_brokerSelection,
 			wantExitStatus: gdmTestEarlyStopExitStatus,
 		},
 		"Authenticated_with_preset_PAM_user_and_server_side_broker_and_authMode_selection_and_after_various_retries": {
@@ -854,7 +859,7 @@ func TestGdmModel(t *testing.T) {
 			pamUser: "pam-preset-user-and-daemon-selected-broker",
 			messages: []tea.Msg{
 				gdmTestWaitForStage{
-					stage: pam_proto.Stage_challenge,
+					stage: proto.Stage_challenge,
 					commands: []tea.Cmd{
 						sendEvent(gdmTestSendAuthDataWhenReadyFull{
 							authData: &authd.IARequest_AuthenticationData_Secret{
@@ -897,7 +902,7 @@ func TestGdmModel(t *testing.T) {
 				{Access: auth.Retry},
 				{Access: auth.Granted},
 			},
-			wantStage:      pam_proto.Stage_challenge,
+			wantStage:      proto.Stage_challenge,
 			wantExitStatus: PamSuccess{BrokerID: firstBrokerInfo.Id},
 		},
 		"Authenticated_after_client_side_user_and_broker_and_authMode_selection": {
@@ -909,7 +914,7 @@ func TestGdmModel(t *testing.T) {
 			},
 			messages: []tea.Msg{
 				gdmTestWaitForStage{
-					stage: pam_proto.Stage_brokerSelection,
+					stage: proto.Stage_brokerSelection,
 					events: []*gdm.EventData{
 						gdm_test.SelectBrokerEvent(secondBrokerInfo.Id),
 					},
@@ -937,7 +942,7 @@ func TestGdmModel(t *testing.T) {
 				gdm.EventType_startAuthentication,
 				gdm.EventType_authEvent,
 			},
-			wantStage:      pam_proto.Stage_challenge,
+			wantStage:      proto.Stage_challenge,
 			wantGdmAuthRes: []*authd.IAResponse{{Access: auth.Granted}},
 			wantExitStatus: PamSuccess{BrokerID: secondBrokerInfo.Id},
 		},
@@ -951,13 +956,13 @@ func TestGdmModel(t *testing.T) {
 			},
 			messages: []tea.Msg{
 				gdmTestWaitForStage{
-					stage: pam_proto.Stage_brokerSelection,
+					stage: proto.Stage_brokerSelection,
 					events: []*gdm.EventData{
 						gdm_test.SelectBrokerEvent(firstBrokerInfo.Id),
 					},
 				},
 				gdmTestWaitForStage{
-					stage: pam_proto.Stage_challenge,
+					stage: proto.Stage_challenge,
 					commands: []tea.Cmd{
 						sendEvent(gdmTestSendAuthDataWhenReadyFull{
 							authData: &authd.IARequest_AuthenticationData_Secret{
@@ -1001,7 +1006,7 @@ func TestGdmModel(t *testing.T) {
 				{Access: auth.Retry},
 				{Access: auth.Granted},
 			},
-			wantStage:      pam_proto.Stage_challenge,
+			wantStage:      proto.Stage_challenge,
 			wantExitStatus: PamSuccess{BrokerID: firstBrokerInfo.Id},
 		},
 		"Cancelled_auth_after_client_side_user_and_broker_and_authMode_selection": {
@@ -1015,7 +1020,7 @@ func TestGdmModel(t *testing.T) {
 			},
 			messages: []tea.Msg{
 				gdmTestWaitForStage{
-					stage: pam_proto.Stage_brokerSelection,
+					stage: proto.Stage_brokerSelection,
 					events: []*gdm.EventData{
 						gdm_test.SelectBrokerEvent(firstBrokerInfo.Id),
 					},
@@ -1045,7 +1050,7 @@ func TestGdmModel(t *testing.T) {
 				startAuthentication{},
 			},
 			wantGdmAuthRes: []*authd.IAResponse{{Access: auth.Cancelled}},
-			wantStage:      pam_proto.Stage_challenge,
+			wantStage:      proto.Stage_challenge,
 			wantExitStatus: gdmTestEarlyStopExitStatus,
 		},
 		"AuthMode_selection_stage_from_client_after_server_side_broker_and_auth_mode_selection_if_there_is_only_one_auth_mode": {
@@ -1055,12 +1060,12 @@ func TestGdmModel(t *testing.T) {
 			pamUser: "pam-preset-user-and-daemon-selected-broker",
 			messages: []tea.Msg{
 				gdmTestWaitForStage{
-					stage: pam_proto.Stage_challenge,
+					stage: proto.Stage_challenge,
 					events: []*gdm.EventData{
-						gdm_test.ChangeStageEvent(pam_proto.Stage_authModeSelection),
+						gdm_test.ChangeStageEvent(proto.Stage_authModeSelection),
 					},
 					commands: []tea.Cmd{
-						sendEvent(gdmTestWaitForStage{stage: pam_proto.Stage_authModeSelection}),
+						sendEvent(gdmTestWaitForStage{stage: proto.Stage_authModeSelection}),
 					},
 				},
 			},
@@ -1084,7 +1089,7 @@ func TestGdmModel(t *testing.T) {
 			wantNoGdmEvents: []gdm.EventType{
 				gdm.EventType_authEvent,
 			},
-			wantStage:      pam_proto.Stage_authModeSelection,
+			wantStage:      proto.Stage_authModeSelection,
 			wantExitStatus: gdmTestEarlyStopExitStatus,
 		},
 		"AuthMode_selection_stage_from_client_after_server_side_broker_and_auth_mode_selection_with_multiple_auth_modes": {
@@ -1095,12 +1100,12 @@ func TestGdmModel(t *testing.T) {
 			pamUser: "pam-preset-user-and-daemon-selected-broker",
 			messages: []tea.Msg{
 				gdmTestWaitForStage{
-					stage: pam_proto.Stage_challenge,
+					stage: proto.Stage_challenge,
 					events: []*gdm.EventData{
-						gdm_test.ChangeStageEvent(pam_proto.Stage_authModeSelection),
+						gdm_test.ChangeStageEvent(proto.Stage_authModeSelection),
 					},
 					commands: []tea.Cmd{
-						sendEvent(gdmTestWaitForStage{stage: pam_proto.Stage_authModeSelection}),
+						sendEvent(gdmTestWaitForStage{stage: proto.Stage_authModeSelection}),
 					},
 				},
 			},
@@ -1124,7 +1129,7 @@ func TestGdmModel(t *testing.T) {
 			wantNoGdmEvents: []gdm.EventType{
 				gdm.EventType_authEvent,
 			},
-			wantStage:      pam_proto.Stage_authModeSelection,
+			wantStage:      proto.Stage_authModeSelection,
 			wantExitStatus: gdmTestEarlyStopExitStatus,
 		},
 		"AuthMode_selection_stage_from_client_after_client_side_broker_and_auth_mode_selection_if_there_is_only_one_auth_mode": {
@@ -1133,18 +1138,18 @@ func TestGdmModel(t *testing.T) {
 			},
 			messages: []tea.Msg{
 				gdmTestWaitForStage{
-					stage: pam_proto.Stage_brokerSelection,
+					stage: proto.Stage_brokerSelection,
 					events: []*gdm.EventData{
 						gdm_test.SelectBrokerEvent(firstBrokerInfo.Id),
 					},
 				},
 				gdmTestWaitForStage{
-					stage: pam_proto.Stage_challenge,
+					stage: proto.Stage_challenge,
 					events: []*gdm.EventData{
-						gdm_test.ChangeStageEvent(pam_proto.Stage_authModeSelection),
+						gdm_test.ChangeStageEvent(proto.Stage_authModeSelection),
 					},
 					commands: []tea.Cmd{
-						sendEvent(gdmTestWaitForStage{stage: pam_proto.Stage_authModeSelection}),
+						sendEvent(gdmTestWaitForStage{stage: proto.Stage_authModeSelection}),
 					},
 				},
 			},
@@ -1170,7 +1175,7 @@ func TestGdmModel(t *testing.T) {
 				gdm.EventType_startAuthentication,
 				gdm.EventType_authEvent,
 			},
-			wantStage:      pam_proto.Stage_authModeSelection,
+			wantStage:      proto.Stage_authModeSelection,
 			wantExitStatus: gdmTestEarlyStopExitStatus,
 		},
 		"Authenticated_after_auth_selection_stage_from_client_after_client_side_broker_and_auth_mode_selection_if_there_is_only_one_auth_mode": {
@@ -1182,19 +1187,19 @@ func TestGdmModel(t *testing.T) {
 			},
 			messages: []tea.Msg{
 				gdmTestWaitForStage{
-					stage: pam_proto.Stage_brokerSelection,
+					stage: proto.Stage_brokerSelection,
 					events: []*gdm.EventData{
 						gdm_test.SelectBrokerEvent(firstBrokerInfo.Id),
 					},
 				},
 				gdmTestWaitForStage{
-					stage: pam_proto.Stage_challenge,
+					stage: proto.Stage_challenge,
 					events: []*gdm.EventData{
-						gdm_test.ChangeStageEvent(pam_proto.Stage_authModeSelection),
+						gdm_test.ChangeStageEvent(proto.Stage_authModeSelection),
 					},
 					commands: []tea.Cmd{
 						sendEvent(gdmTestWaitForStage{
-							stage: pam_proto.Stage_authModeSelection,
+							stage: proto.Stage_authModeSelection,
 							events: []*gdm.EventData{
 								gdm_test.AuthModeSelectedEvent(passwordUILayoutID),
 							},
@@ -1233,7 +1238,7 @@ func TestGdmModel(t *testing.T) {
 				gdm.EventType_startAuthentication,
 				gdm.EventType_authEvent,
 			},
-			wantStage: pam_proto.Stage_challenge,
+			wantStage: proto.Stage_challenge,
 			wantGdmAuthRes: []*authd.IAResponse{
 				{Access: auth.Granted},
 			},
@@ -1249,19 +1254,19 @@ func TestGdmModel(t *testing.T) {
 			},
 			messages: []tea.Msg{
 				gdmTestWaitForStage{
-					stage: pam_proto.Stage_brokerSelection,
+					stage: proto.Stage_brokerSelection,
 					events: []*gdm.EventData{
 						gdm_test.SelectBrokerEvent(firstBrokerInfo.Id),
 					},
 				},
 				gdmTestWaitForStage{
-					stage: pam_proto.Stage_challenge,
+					stage: proto.Stage_challenge,
 					events: []*gdm.EventData{
-						gdm_test.ChangeStageEvent(pam_proto.Stage_authModeSelection),
+						gdm_test.ChangeStageEvent(proto.Stage_authModeSelection),
 					},
 					commands: []tea.Cmd{
 						sendEvent(gdmTestWaitForStage{
-							stage: pam_proto.Stage_authModeSelection,
+							stage: proto.Stage_authModeSelection,
 							events: []*gdm.EventData{
 								gdm_test.AuthModeSelectedEvent("pincode"),
 							},
@@ -1300,14 +1305,13 @@ func TestGdmModel(t *testing.T) {
 				gdm.EventType_startAuthentication,
 				gdm.EventType_authEvent,
 			},
-			wantStage: pam_proto.Stage_challenge,
+			wantStage: proto.Stage_challenge,
 			wantGdmAuthRes: []*authd.IAResponse{
 				{Access: auth.Granted},
 			},
 			wantExitStatus: PamSuccess{BrokerID: firstBrokerInfo.Id},
 		},
 		"Authenticated_with_qrcode_after_auth_selection_stage_from_client_after_client_side_broker_and_auth_mode_selection": {
-			timeout: 20 * time.Second,
 			supportedLayouts: []*authd.UILayout{
 				pam_test.FormUILayout(pam_test.WithWait(true)),
 				pam_test.QrCodeUILayout(),
@@ -1321,19 +1325,19 @@ func TestGdmModel(t *testing.T) {
 			},
 			messages: []tea.Msg{
 				gdmTestWaitForStage{
-					stage: pam_proto.Stage_brokerSelection,
+					stage: proto.Stage_brokerSelection,
 					events: []*gdm.EventData{
 						gdm_test.SelectBrokerEvent(firstBrokerInfo.Id),
 					},
 				},
 				gdmTestWaitForStage{
-					stage: pam_proto.Stage_challenge,
+					stage: proto.Stage_challenge,
 					events: []*gdm.EventData{
-						gdm_test.ChangeStageEvent(pam_proto.Stage_authModeSelection),
+						gdm_test.ChangeStageEvent(proto.Stage_authModeSelection),
 					},
 					commands: []tea.Cmd{
 						sendEvent(gdmTestWaitForStage{
-							stage: pam_proto.Stage_authModeSelection,
+							stage: proto.Stage_authModeSelection,
 							events: []*gdm.EventData{
 								gdm_test.AuthModeSelectedEvent(layouts.QrCode),
 							},
@@ -1372,7 +1376,7 @@ func TestGdmModel(t *testing.T) {
 				gdm.EventType_startAuthentication,
 				gdm.EventType_authEvent, // granted
 			},
-			wantStage: pam_proto.Stage_challenge,
+			wantStage: proto.Stage_challenge,
 			wantGdmAuthRes: []*authd.IAResponse{
 				{Access: auth.Granted},
 			},
@@ -1393,19 +1397,19 @@ func TestGdmModel(t *testing.T) {
 			},
 			messages: []tea.Msg{
 				gdmTestWaitForStage{
-					stage: pam_proto.Stage_brokerSelection,
+					stage: proto.Stage_brokerSelection,
 					events: []*gdm.EventData{
 						gdm_test.SelectBrokerEvent(firstBrokerInfo.Id),
 					},
 				},
 				gdmTestWaitForStage{
-					stage: pam_proto.Stage_challenge,
+					stage: proto.Stage_challenge,
 					events: []*gdm.EventData{
-						gdm_test.ChangeStageEvent(pam_proto.Stage_authModeSelection),
+						gdm_test.ChangeStageEvent(proto.Stage_authModeSelection),
 					},
 					commands: []tea.Cmd{
 						sendEvent(gdmTestWaitForStage{
-							stage: pam_proto.Stage_authModeSelection,
+							stage: proto.Stage_authModeSelection,
 							events: []*gdm.EventData{
 								gdm_test.AuthModeSelectedEvent(layouts.QrCode),
 							},
@@ -1458,7 +1462,7 @@ func TestGdmModel(t *testing.T) {
 				gdm.EventType_startAuthentication,
 				gdm.EventType_authEvent, // granted
 			},
-			wantStage: pam_proto.Stage_challenge,
+			wantStage: proto.Stage_challenge,
 			wantGdmAuthRes: []*authd.IAResponse{
 				{Access: auth.Cancelled},
 				{Access: auth.Granted},
@@ -1466,7 +1470,6 @@ func TestGdmModel(t *testing.T) {
 			wantExitStatus: PamSuccess{BrokerID: firstBrokerInfo.Id},
 		},
 		"Authenticated_with_qrcode_regenerated_after_wait_started_at_auth_selection_stage_from_client_after_client_side_broker_and_auth_mode_selection": {
-			timeout: 20 * time.Second,
 			supportedLayouts: []*authd.UILayout{
 				pam_test.FormUILayout(pam_test.WithWait(true)),
 				pam_test.QrCodeUILayout(),
@@ -1481,19 +1484,19 @@ func TestGdmModel(t *testing.T) {
 			},
 			messages: []tea.Msg{
 				gdmTestWaitForStage{
-					stage: pam_proto.Stage_brokerSelection,
+					stage: proto.Stage_brokerSelection,
 					events: []*gdm.EventData{
 						gdm_test.SelectBrokerEvent(firstBrokerInfo.Id),
 					},
 				},
 				gdmTestWaitForStage{
-					stage: pam_proto.Stage_challenge,
+					stage: proto.Stage_challenge,
 					events: []*gdm.EventData{
-						gdm_test.ChangeStageEvent(pam_proto.Stage_authModeSelection),
+						gdm_test.ChangeStageEvent(proto.Stage_authModeSelection),
 					},
 					commands: []tea.Cmd{
 						sendEvent(gdmTestWaitForStage{
-							stage: pam_proto.Stage_authModeSelection,
+							stage: proto.Stage_authModeSelection,
 							events: []*gdm.EventData{
 								gdm_test.AuthModeSelectedEvent(layouts.QrCode),
 							},
@@ -1548,7 +1551,7 @@ func TestGdmModel(t *testing.T) {
 				gdm.EventType_authModeSelected,
 				gdm.EventType_authEvent, // granted
 			},
-			wantStage: pam_proto.Stage_challenge,
+			wantStage: proto.Stage_challenge,
 			wantGdmAuthRes: []*authd.IAResponse{
 				{Access: auth.Cancelled},
 				{Access: auth.Granted},
@@ -1561,24 +1564,24 @@ func TestGdmModel(t *testing.T) {
 			},
 			messages: []tea.Msg{
 				gdmTestWaitForStage{
-					stage: pam_proto.Stage_brokerSelection,
+					stage: proto.Stage_brokerSelection,
 					events: []*gdm.EventData{
 						gdm_test.SelectBrokerEvent(firstBrokerInfo.Id),
 					},
 				},
 				gdmTestWaitForStage{
-					stage: pam_proto.Stage_challenge,
+					stage: proto.Stage_challenge,
 					events: []*gdm.EventData{
-						gdm_test.ChangeStageEvent(pam_proto.Stage_authModeSelection),
+						gdm_test.ChangeStageEvent(proto.Stage_authModeSelection),
 					},
 					commands: []tea.Cmd{
 						sendEvent(gdmTestWaitForStage{
-							stage: pam_proto.Stage_authModeSelection,
+							stage: proto.Stage_authModeSelection,
 							events: []*gdm.EventData{
-								gdm_test.ChangeStageEvent(pam_proto.Stage_brokerSelection),
+								gdm_test.ChangeStageEvent(proto.Stage_brokerSelection),
 							},
 							commands: []tea.Cmd{
-								sendEvent(gdmTestWaitForStage{stage: pam_proto.Stage_brokerSelection}),
+								sendEvent(gdmTestWaitForStage{stage: proto.Stage_brokerSelection}),
 							},
 						}),
 					},
@@ -1606,7 +1609,7 @@ func TestGdmModel(t *testing.T) {
 			wantNoGdmEvents: []gdm.EventType{
 				gdm.EventType_authEvent,
 			},
-			wantStage:      pam_proto.Stage_brokerSelection,
+			wantStage:      proto.Stage_brokerSelection,
 			wantExitStatus: gdmTestEarlyStopExitStatus,
 		},
 		"User_selection_stage_from_client_after_client_side_broker_and_auth_mode_selection_if_there_is_only_one_auth_mode": {
@@ -1615,30 +1618,30 @@ func TestGdmModel(t *testing.T) {
 			},
 			messages: []tea.Msg{
 				gdmTestWaitForStage{
-					stage: pam_proto.Stage_brokerSelection,
+					stage: proto.Stage_brokerSelection,
 					events: []*gdm.EventData{
 						gdm_test.SelectBrokerEvent(firstBrokerInfo.Id),
 					},
 				},
 				gdmTestWaitForStage{
-					stage: pam_proto.Stage_challenge,
+					stage: proto.Stage_challenge,
 					events: []*gdm.EventData{
-						gdm_test.ChangeStageEvent(pam_proto.Stage_authModeSelection),
+						gdm_test.ChangeStageEvent(proto.Stage_authModeSelection),
 					},
 					commands: []tea.Cmd{
 						sendEvent(gdmTestWaitForStage{
-							stage: pam_proto.Stage_authModeSelection,
+							stage: proto.Stage_authModeSelection,
 							events: []*gdm.EventData{
-								gdm_test.ChangeStageEvent(pam_proto.Stage_brokerSelection),
+								gdm_test.ChangeStageEvent(proto.Stage_brokerSelection),
 							},
 							commands: []tea.Cmd{
 								sendEvent(gdmTestWaitForStage{
-									stage: pam_proto.Stage_brokerSelection,
+									stage: proto.Stage_brokerSelection,
 									events: []*gdm.EventData{
-										gdm_test.ChangeStageEvent(pam_proto.Stage_userSelection),
+										gdm_test.ChangeStageEvent(proto.Stage_userSelection),
 									},
 									commands: []tea.Cmd{
-										sendEvent(gdmTestWaitForStage{stage: pam_proto.Stage_userSelection}),
+										sendEvent(gdmTestWaitForStage{stage: proto.Stage_userSelection}),
 									},
 								}),
 							},
@@ -1669,7 +1672,7 @@ func TestGdmModel(t *testing.T) {
 			wantNoGdmEvents: []gdm.EventType{
 				gdm.EventType_authEvent,
 			},
-			wantStage:      pam_proto.Stage_userSelection,
+			wantStage:      proto.Stage_userSelection,
 			wantExitStatus: gdmTestEarlyStopExitStatus,
 		},
 
@@ -1781,7 +1784,7 @@ func TestGdmModel(t *testing.T) {
 			},
 			wantExitStatus: pamError{
 				status: pam.ErrSystem,
-				msg:    "can't select broker: error during broker selection",
+				msg:    "error during broker selection",
 			},
 		},
 		"Error_during_broker_selection_if_session_ID_is_empty": {
@@ -1877,7 +1880,7 @@ func TestGdmModel(t *testing.T) {
 			pamUser: "pam-preset-user-for-client-selected-broker",
 			messages: []tea.Msg{
 				gdmTestWaitForStage{
-					stage: pam_proto.Stage_brokerSelection,
+					stage: proto.Stage_brokerSelection,
 					events: []*gdm.EventData{
 						gdm_test.SelectBrokerEvent(firstBrokerInfo.Id),
 					},
@@ -1908,7 +1911,7 @@ func TestGdmModel(t *testing.T) {
 			pamUser: "pam-preset-user-for-client-selected-broker",
 			messages: []tea.Msg{
 				gdmTestWaitForStage{
-					stage: pam_proto.Stage_brokerSelection,
+					stage: proto.Stage_brokerSelection,
 					events: []*gdm.EventData{
 						gdm_test.SelectBrokerEvent(firstBrokerInfo.Id),
 					},
@@ -1939,7 +1942,7 @@ func TestGdmModel(t *testing.T) {
 			pamUser: "pam-preset-user-for-client-selected-broker",
 			messages: []tea.Msg{
 				gdmTestWaitForStage{
-					stage: pam_proto.Stage_brokerSelection,
+					stage: proto.Stage_brokerSelection,
 					events: []*gdm.EventData{
 						gdm_test.SelectBrokerEvent(firstBrokerInfo.Id),
 					},
@@ -1971,7 +1974,7 @@ func TestGdmModel(t *testing.T) {
 			pamUser: "pam-preset-user-with-client-selected-broker",
 			messages: []tea.Msg{
 				gdmTestWaitForStage{
-					stage: pam_proto.Stage_brokerSelection,
+					stage: proto.Stage_brokerSelection,
 					events: []*gdm.EventData{
 						gdm_test.SelectBrokerEvent(firstBrokerInfo.Id),
 					},
@@ -2006,7 +2009,7 @@ func TestGdmModel(t *testing.T) {
 			pamUser: "pam-preset-user-for-client-selected-broker",
 			messages: []tea.Msg{
 				gdmTestWaitForStage{
-					stage: pam_proto.Stage_brokerSelection,
+					stage: proto.Stage_brokerSelection,
 					events: []*gdm.EventData{
 						gdm_test.SelectBrokerEvent(firstBrokerInfo.Id),
 					},
@@ -2030,10 +2033,10 @@ func TestGdmModel(t *testing.T) {
 				gdm.EventType_authModeSelected,
 				gdm.EventType_uiLayoutReceived,
 			},
-			wantStage: pam_proto.Stage_challenge,
+			wantStage: proto.Stage_challenge,
 			wantExitStatus: pamError{
 				status: pam.ErrSystem,
-				msg:    "authentication status failure: some authentication error",
+				msg:    "some authentication error",
 			},
 		},
 		"Error_on_authentication_client_invalid_message": {
@@ -2079,13 +2082,13 @@ func TestGdmModel(t *testing.T) {
 			pamUser: "pam-preset-user-for-client-selected-brokers-with-wrong-pass",
 			messages: []tea.Msg{
 				gdmTestWaitForStage{
-					stage: pam_proto.Stage_brokerSelection,
+					stage: proto.Stage_brokerSelection,
 					events: []*gdm.EventData{
 						gdm_test.SelectBrokerEvent(firstBrokerInfo.Id),
 					},
 				},
 				gdmTestWaitForStage{
-					stage: pam_proto.Stage_authModeSelection,
+					stage: proto.Stage_authModeSelection,
 					commands: []tea.Cmd{
 						sendEvent(gdmTestSendAuthDataWhenReady{&authd.IARequest_AuthenticationData_Secret{
 							Secret: "gdm-wrong-password",
@@ -2126,13 +2129,13 @@ func TestGdmModel(t *testing.T) {
 			pamUser: "pam-preset-user-and-client-selected-broker-with-wrong-pass",
 			messages: []tea.Msg{
 				gdmTestWaitForStage{
-					stage: pam_proto.Stage_brokerSelection,
+					stage: proto.Stage_brokerSelection,
 					events: []*gdm.EventData{
 						gdm_test.SelectBrokerEvent(firstBrokerInfo.Id),
 					},
 				},
 				gdmTestWaitForStage{
-					stage: pam_proto.Stage_challenge,
+					stage: proto.Stage_challenge,
 					commands: []tea.Cmd{
 						sendEvent(gdmTestSendAuthDataWhenReady{&authd.IARequest_AuthenticationData_Secret{
 							Secret: "gdm-wrong-password",
@@ -2172,7 +2175,7 @@ func TestGdmModel(t *testing.T) {
 			pamUser: "pam-preset-user-and-daemon-selected-broker-with-wrong-pass",
 			messages: []tea.Msg{
 				gdmTestWaitForStage{
-					stage: pam_proto.Stage_challenge,
+					stage: proto.Stage_challenge,
 					commands: []tea.Cmd{
 						sendEvent(gdmTestSendAuthDataWhenReadyFull{
 							authData: &authd.IARequest_AuthenticationData_Secret{
@@ -2224,7 +2227,7 @@ func TestGdmModel(t *testing.T) {
 			pamUser: "pam-preset-user-and-daemon-selected-broker-with-wrong-pass",
 			messages: []tea.Msg{
 				gdmTestWaitForStage{
-					stage: pam_proto.Stage_challenge,
+					stage: proto.Stage_challenge,
 					commands: []tea.Cmd{
 						sendEvent(gdmTestSendAuthDataWhenReady{&authd.IARequest_AuthenticationData_Secret{
 							Secret: "gdm-some-password",
@@ -2269,7 +2272,7 @@ func TestGdmModel(t *testing.T) {
 			pamUser: "pam-preset-user-and-daemon-selected-broker-with-wrong-pass",
 			messages: []tea.Msg{
 				gdmTestWaitForStage{
-					stage: pam_proto.Stage_challenge,
+					stage: proto.Stage_challenge,
 					commands: []tea.Cmd{
 						sendEvent(gdmTestSendAuthDataWhenReady{&authd.IARequest_AuthenticationData_Secret{
 							Secret: "gdm-some-password",
@@ -2372,7 +2375,7 @@ func TestGdmModel(t *testing.T) {
 				}): errors.New("this is a stage change error"),
 			},
 			gdmEvents: []*gdm.EventData{
-				gdm_test.ChangeStageEvent(pam_proto.Stage_brokerSelection),
+				gdm_test.ChangeStageEvent(proto.Stage_brokerSelection),
 			},
 			wantExitStatus: pamError{
 				status: pam.ErrSystem,
@@ -2401,13 +2404,13 @@ func TestGdmModel(t *testing.T) {
 			pamUser: "gdm-pam-preset-user",
 			messages: []tea.Msg{
 				gdmTestWaitForStage{
-					stage: pam_proto.Stage_challenge,
+					stage: proto.Stage_challenge,
 					events: []*gdm.EventData{
-						gdm_test.ChangeStageEvent(pam_proto.Stage_userSelection),
+						gdm_test.ChangeStageEvent(proto.Stage_userSelection),
 					},
 					commands: []tea.Cmd{
 						sendEvent(gdmTestWaitForStage{
-							stage: pam_proto.Stage_userSelection,
+							stage: proto.Stage_userSelection,
 							events: []*gdm.EventData{
 								gdm_test.SelectUserEvent("another-selected-user"),
 							},
@@ -2433,7 +2436,7 @@ func TestGdmModel(t *testing.T) {
 				gdm.EventType_authModeSelected,
 				gdm.EventType_authEvent,
 			},
-			wantStage: pam_proto.Stage_userSelection,
+			wantStage: proto.Stage_userSelection,
 			wantExitStatus: pamError{
 				status: pam.ErrPermDenied,
 				msg:    `Changing username "gdm-pam-preset-user" to "another-selected-user" is not allowed`,
@@ -2450,6 +2453,9 @@ func TestGdmModel(t *testing.T) {
 			if tc.client == nil {
 				tc.client = pam_test.NewDummyClient(gdmTestPrivateKey, tc.clientOptions...)
 			}
+			if tc.sessionMode == authd.SessionMode_UNDEFINED {
+				tc.sessionMode = authd.SessionMode_LOGIN
+			}
 
 			messagesToSend := tc.messages
 			messagesToWait := append(tc.messages, tc.wantMessages...)
@@ -2477,7 +2483,7 @@ func TestGdmModel(t *testing.T) {
 
 			var exitStatus PamReturnStatus
 			uiModel := newUIModelForClients(pam_test.NewModuleTransactionDummy(gdmHandler),
-				Gdm, authd.SessionMode_LOGIN, tc.client, nil, &exitStatus)
+				Gdm, tc.sessionMode, tc.client, nil, &exitStatus)
 
 			appState := gdmTestUIModel{
 				uiModel:             uiModel,
@@ -2555,7 +2561,7 @@ func TestGdmModel(t *testing.T) {
 
 				t.Log("Waiting for expected events")
 				if tc.timeout == 0 {
-					tc.timeout = 10 * time.Second
+					tc.timeout = 20 * time.Second
 				}
 				waitChan := make(chan struct{})
 				go func() {
diff --git a/pam/internal/adapter/gdmmodel_uimodel_test.go b/pam/internal/adapter/gdmmodel_uimodel_test.go
index c446197bdd..36511f680e 100644
--- a/pam/internal/adapter/gdmmodel_uimodel_test.go
+++ b/pam/internal/adapter/gdmmodel_uimodel_test.go
@@ -8,12 +8,12 @@ import (
 	"sync/atomic"
 	"time"
 
+	"github.com/canonical/authd/internal/proto/authd"
+	"github.com/canonical/authd/log"
+	"github.com/canonical/authd/pam/internal/gdm"
+	"github.com/canonical/authd/pam/internal/gdm_test"
+	"github.com/canonical/authd/pam/internal/proto"
 	tea "github.com/charmbracelet/bubbletea"
-	"github.com/ubuntu/authd/internal/proto/authd"
-	"github.com/ubuntu/authd/log"
-	"github.com/ubuntu/authd/pam/internal/gdm"
-	"github.com/ubuntu/authd/pam/internal/gdm_test"
-	"github.com/ubuntu/authd/pam/internal/proto"
 )
 
 var gdmTestSequentialMessages atomic.Int64
diff --git a/pam/internal/adapter/list.go b/pam/internal/adapter/list.go
index 169b19a30f..970a34f82f 100644
--- a/pam/internal/adapter/list.go
+++ b/pam/internal/adapter/list.go
@@ -9,10 +9,10 @@ import (
 	"sync/atomic"
 	"unicode"
 
+	"github.com/canonical/authd/log"
 	tea_list "github.com/charmbracelet/bubbles/list"
 	tea "github.com/charmbracelet/bubbletea"
 	"github.com/charmbracelet/lipgloss"
-	"github.com/ubuntu/authd/log"
 )
 
 var listIDs atomic.Uint32
diff --git a/pam/internal/adapter/model.go b/pam/internal/adapter/model.go
index d8f7f6998b..5c4770aa11 100644
--- a/pam/internal/adapter/model.go
+++ b/pam/internal/adapter/model.go
@@ -10,14 +10,13 @@ import (
 	"strings"
 	"time"
 
+	"github.com/canonical/authd/internal/consts"
+	"github.com/canonical/authd/internal/proto/authd"
+	"github.com/canonical/authd/log"
+	"github.com/canonical/authd/pam/internal/proto"
 	tea "github.com/charmbracelet/bubbletea"
 	"github.com/charmbracelet/lipgloss"
 	"github.com/msteinert/pam/v2"
-	"github.com/ubuntu/authd/internal/consts"
-	"github.com/ubuntu/authd/internal/proto/authd"
-	"github.com/ubuntu/authd/log"
-	"github.com/ubuntu/authd/pam/internal/proto"
-	pam_proto "github.com/ubuntu/authd/pam/internal/proto"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/codes"
 	healthgrpc "google.golang.org/grpc/health/grpc_health_v1"
@@ -54,6 +53,8 @@ type sessionInfo struct {
 
 // uiModel is the global models orchestrator.
 type uiModel struct {
+	width int
+
 	// pamMTx is the [pam.ModuleTransaction] used to communicate with PAM.
 	pamMTx pam.ModuleTransaction
 	// conn is the [grpc.ClientConn] opened with authd daemon.
@@ -120,7 +121,7 @@ type SessionEnded struct{}
 
 // ChangeStage signals that the model requires a stage change.
 type ChangeStage struct {
-	Stage pam_proto.Stage
+	Stage proto.Stage
 }
 
 // StageChanged signals that the model just finished a stage change.
@@ -162,7 +163,7 @@ func newUIModelForClients(mTx pam.ModuleTransaction, clientType PamClientType, m
 	m.userSelectionModel = newUserSelectionModel(m.pamMTx, m.clientType)
 	m.brokerSelectionModel = newBrokerSelectionModel(m.client, m.clientType)
 	m.authModeSelectionModel = newAuthModeSelectionModel(m.clientType)
-	m.authenticationModel = newAuthenticationModel(m.client, m.clientType)
+	m.authenticationModel = newAuthenticationModel(m.client, m.clientType, mode)
 	m.healthCheckCancel = func() {}
 
 	return m
@@ -203,6 +204,7 @@ func (m *uiModel) startHealthCheck() tea.Cmd {
 	}
 
 	var ctx context.Context
+	//nolint:gosec // G118 - cancel is stored in m.healthCheckCancel and called in MsgFilter() on quit.
 	ctx, m.healthCheckCancel = context.WithCancel(context.Background())
 	healthClient := healthgrpc.NewHealthClient(m.conn)
 	hcReq := &healthgrpc.HealthCheckRequest{Service: consts.ServiceName}
@@ -235,6 +237,9 @@ func (m *uiModel) startHealthCheck() tea.Cmd {
 // Update handles events and actions to be done from the main model orchestrator.
 func (m uiModel) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 	switch msg := msg.(type) {
+	case tea.WindowSizeMsg:
+		m.width = msg.Width
+
 	// Key presses
 	case tea.KeyMsg:
 		safeMessageDebugWithPrefix("Key", msg, "in stage %q", m.currentStage())
@@ -343,7 +348,7 @@ func (m uiModel) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 
 		return m, tea.Sequence(
 			getAuthenticationModes(m.client, m.currentSession.sessionID, m.authModeSelectionModel.SupportedUILayouts()),
-			sendEvent(ChangeStage{pam_proto.Stage_authModeSelection}),
+			sendEvent(ChangeStage{proto.Stage_authModeSelection}),
 		)
 
 	case AuthModeSelected:
@@ -422,84 +427,90 @@ func (m uiModel) View() string {
 		return ""
 	}
 
-	var view strings.Builder
+	var viewBuilder strings.Builder
 
 	switch m.currentStage() {
-	case pam_proto.Stage_userSelection:
-		view.WriteString(m.userSelectionModel.View())
-	case pam_proto.Stage_brokerSelection:
-		view.WriteString(m.brokerSelectionModel.View())
-	case pam_proto.Stage_authModeSelection:
-		view.WriteString(m.authModeSelectionModel.View())
-	case pam_proto.Stage_challenge:
-		view.WriteString(m.authenticationModel.View())
+	case proto.Stage_userSelection:
+		viewBuilder.WriteString(m.userSelectionModel.View())
+	case proto.Stage_brokerSelection:
+		viewBuilder.WriteString(m.brokerSelectionModel.View())
+	case proto.Stage_authModeSelection:
+		viewBuilder.WriteString(m.authModeSelectionModel.View())
+	case proto.Stage_challenge:
+		viewBuilder.WriteString(m.authenticationModel.View())
 	default:
-		view.WriteString("INVALID STAGE")
+		viewBuilder.WriteString("INVALID STAGE")
 	}
 
 	if debug != "" {
-		view.WriteString(debug)
+		viewBuilder.WriteString(debug)
 	}
 
-	if view.Len() > 0 && m.canGoBack() {
+	view := viewBuilder.String()
+
+	if len(view) > 0 && m.canGoBack() {
 		infoMessage := infoMsgStyle.Render(fmt.Sprintf("Press escape key to %s",
 			goBackLabel(m.previousStage())))
-		return lipgloss.JoinVertical(lipgloss.Left, view.String(), infoMessage)
+		view = lipgloss.JoinVertical(lipgloss.Left, view, infoMessage)
 	}
 
-	return view.String()
+	if m.width == 0 {
+		return view
+	}
+	// Wrap the view to the terminal width.
+	return lipgloss.NewStyle().Width(m.width).Render(view)
 }
 
 // currentStage returns our current stage step.
-func (m uiModel) currentStage() pam_proto.Stage {
+func (m uiModel) currentStage() proto.Stage {
 	if m.userSelectionModel.Focused() {
-		return pam_proto.Stage_userSelection
+		return proto.Stage_userSelection
 	}
 	if m.brokerSelectionModel.Focused() {
-		return pam_proto.Stage_brokerSelection
+		return proto.Stage_brokerSelection
 	}
 	if m.authModeSelectionModel.Focused() {
-		return pam_proto.Stage_authModeSelection
+		return proto.Stage_authModeSelection
 	}
 	if m.authenticationModel.Focused() {
-		return pam_proto.Stage_challenge
+		return proto.Stage_challenge
 	}
-	return pam_proto.Stage_userSelection
+	return proto.Stage_userSelection
 }
 
 // changeStage returns a command acting to change the current stage and reset any previous views.
-func (m *uiModel) changeStage(s pam_proto.Stage) tea.Cmd {
+func (m *uiModel) changeStage(s proto.Stage) tea.Cmd {
 	var commands []tea.Cmd
 	currentStage := m.currentStage()
 
 	if currentStage != s {
 		switch currentStage {
-		case pam_proto.Stage_userSelection:
+		case proto.Stage_userSelection:
 			m.userSelectionModel.Blur()
-		case pam_proto.Stage_brokerSelection:
+		case proto.Stage_brokerSelection:
 			m.brokerSelectionModel.Blur()
-		case pam_proto.Stage_authModeSelection:
+		case proto.Stage_authModeSelection:
 			m.authModeSelectionModel.Blur()
-		case pam_proto.Stage_challenge:
+		case proto.Stage_challenge:
 			m.authenticationModel.Blur()
 			commands = append(commands, m.authenticationModel.Reset())
 		}
 	}
 
 	switch s {
-	case pam_proto.Stage_userSelection:
+	case proto.Stage_userSelection:
 		// The session should be ended when going back to previous state, but we don’t quit the stage immediately
 		// and so, we should always ensure we cancel previous session.
 		commands = append(commands, endSession(m.client, m.currentSession), m.userSelectionModel.Focus())
 
-	case pam_proto.Stage_brokerSelection:
+	case proto.Stage_brokerSelection:
 		m.authModeSelectionModel.Reset()
 		commands = append(commands, endSession(m.client, m.currentSession), m.brokerSelectionModel.Focus())
 
-	case pam_proto.Stage_authModeSelection:
+	case proto.Stage_authModeSelection:
 		commands = append(commands, m.authModeSelectionModel.Focus())
 
-	case pam_proto.Stage_challenge:
+	case proto.Stage_challenge:
 		commands = append(commands, m.authenticationModel.Focus())
 
 	default:
@@ -516,7 +527,7 @@ func (m *uiModel) changeStage(s pam_proto.Stage) tea.Cmd {
 	return tea.Sequence(commands...)
 }
 
-func (m uiModel) previousStage() pam_proto.Stage {
+func (m uiModel) previousStage() proto.Stage {
 	currentStage := m.currentStage()
 	if currentStage > proto.Stage_authModeSelection && len(m.availableAuthModes()) > 1 {
 		return proto.Stage_authModeSelection
diff --git a/pam/internal/adapter/nativemodel.go b/pam/internal/adapter/nativemodel.go
index 328967f0c3..2821b01c61 100644
--- a/pam/internal/adapter/nativemodel.go
+++ b/pam/internal/adapter/nativemodel.go
@@ -9,18 +9,17 @@ import (
 	"strconv"
 	"strings"
 
+	"github.com/canonical/authd/internal/brokers"
+	"github.com/canonical/authd/internal/brokers/auth"
+	"github.com/canonical/authd/internal/brokers/layouts"
+	"github.com/canonical/authd/internal/brokers/layouts/entries"
+	"github.com/canonical/authd/internal/proto/authd"
+	"github.com/canonical/authd/log"
+	"github.com/canonical/authd/pam/internal/proto"
 	tea "github.com/charmbracelet/bubbletea"
 	"github.com/msteinert/pam/v2"
 	"github.com/muesli/termenv"
 	"github.com/skip2/go-qrcode"
-	"github.com/ubuntu/authd/internal/brokers"
-	"github.com/ubuntu/authd/internal/brokers/auth"
-	"github.com/ubuntu/authd/internal/brokers/layouts"
-	"github.com/ubuntu/authd/internal/brokers/layouts/entries"
-	"github.com/ubuntu/authd/internal/proto/authd"
-	"github.com/ubuntu/authd/log"
-	"github.com/ubuntu/authd/pam/internal/proto"
-	pam_proto "github.com/ubuntu/authd/pam/internal/proto"
 )
 
 type nativeModel struct {
@@ -55,7 +54,7 @@ const (
 // nativeStageChangeRequest is the internal event to request that a stage change.
 type nativeStageChangeRequest ChangeStage
 
-// nativeUserSelection is the internal event that an user needs to be (re)set.
+// nativeUserSelection is the internal event that a user needs to be (re)set.
 type nativeUserSelection struct{}
 
 // nativeBrokerSelection is the internal event that a broker needs to be (re)selected.
@@ -184,7 +183,7 @@ func (m nativeModel) Update(msg tea.Msg) (nativeModel, tea.Cmd) {
 
 	case userRequired:
 		m.userSelectionAllowed = true
-		return m, m.requestStageChange(pam_proto.Stage_userSelection)
+		return m, m.requestStageChange(proto.Stage_userSelection)
 
 	case nativeUserSelection:
 		if !m.checkStage(proto.Stage_userSelection) {
@@ -233,7 +232,7 @@ func (m nativeModel) Update(msg tea.Msg) (nativeModel, tea.Cmd) {
 		}
 		return m.startAsyncOp(func() tea.Cmd {
 			return m.maybePreCheckUser(user,
-				m.requestStageChange(pam_proto.Stage_brokerSelection))
+				m.requestStageChange(proto.Stage_brokerSelection))
 		})
 
 	case nativeBrokerSelection:
@@ -293,10 +292,10 @@ func (m nativeModel) Update(msg tea.Msg) (nativeModel, tea.Cmd) {
 		m.uiLayout = msg.layout
 
 	case startAuthentication:
-		return m, m.requestStageChange(pam_proto.Stage_challenge)
+		return m, m.requestStageChange(proto.Stage_challenge)
 
 	case nativeChallengeRequested:
-		if !m.checkStage(pam_proto.Stage_challenge) {
+		if !m.checkStage(proto.Stage_challenge) {
 			return m, nil
 		}
 		if m.busy {
@@ -544,7 +543,7 @@ func (m nativeModel) authModeSelection() tea.Cmd {
 		return sendEvent(nativeGoBack{})
 	}
 	if errors.Is(err, errEmptyResponse) {
-		return m.requestStageChange(pam_proto.Stage_challenge)
+		return m.requestStageChange(proto.Stage_challenge)
 	}
 	if err != nil {
 		return sendEvent(pamError{
@@ -691,7 +690,7 @@ func (m nativeModel) promptForSecret(prompt string) (string, error) {
 	case entries.DigitsPassword:
 		return m.promptForNumericInputAsString(pam.PromptEchoOff, prompt)
 	default:
-		return "", fmt.Errorf("Unhandled entry %q", m.uiLayout.GetEntry())
+		return "", fmt.Errorf("unhandled entry %q", m.uiLayout.GetEntry())
 	}
 }
 
@@ -891,7 +890,7 @@ func (m nativeModel) canGoBack() bool {
 	return m.previousStage() > proto.Stage_userSelection
 }
 
-func (m nativeModel) previousStage() pam_proto.Stage {
+func (m nativeModel) previousStage() proto.Stage {
 	if m.currentStage > proto.Stage_authModeSelection && len(m.authModes) > 1 {
 		return proto.Stage_authModeSelection
 	}
diff --git a/pam/internal/adapter/newpasswordmodel.go b/pam/internal/adapter/newpasswordmodel.go
index 64d7d9cdab..4eb87ff4d7 100644
--- a/pam/internal/adapter/newpasswordmodel.go
+++ b/pam/internal/adapter/newpasswordmodel.go
@@ -4,11 +4,11 @@ import (
 	"context"
 	"slices"
 
+	"github.com/canonical/authd/internal/brokers/layouts"
+	"github.com/canonical/authd/internal/proto/authd"
+	"github.com/canonical/authd/log"
 	tea "github.com/charmbracelet/bubbletea"
 	"github.com/charmbracelet/lipgloss"
-	"github.com/ubuntu/authd/internal/brokers/layouts"
-	"github.com/ubuntu/authd/internal/proto/authd"
-	"github.com/ubuntu/authd/log"
 )
 
 // newPasswordModel is the form layout type to allow authentication and return a password.
diff --git a/pam/internal/adapter/qrcodemodel.go b/pam/internal/adapter/qrcodemodel.go
index bd440bffe1..eabdcb4cff 100644
--- a/pam/internal/adapter/qrcodemodel.go
+++ b/pam/internal/adapter/qrcodemodel.go
@@ -6,13 +6,13 @@ import (
 	"os"
 	"strings"
 
+	"github.com/canonical/authd/internal/brokers/layouts"
+	"github.com/canonical/authd/internal/proto/authd"
+	"github.com/canonical/authd/log"
 	tea "github.com/charmbracelet/bubbletea"
 	"github.com/charmbracelet/lipgloss"
 	"github.com/muesli/termenv"
 	"github.com/skip2/go-qrcode"
-	"github.com/ubuntu/authd/internal/brokers/layouts"
-	"github.com/ubuntu/authd/internal/proto/authd"
-	"github.com/ubuntu/authd/log"
 )
 
 var centeredStyle = lipgloss.NewStyle().Align(lipgloss.Center, lipgloss.Top)
diff --git a/pam/internal/adapter/textinputmodel.go b/pam/internal/adapter/textinputmodel.go
index 52c92524d2..3f965f0ed0 100644
--- a/pam/internal/adapter/textinputmodel.go
+++ b/pam/internal/adapter/textinputmodel.go
@@ -1,9 +1,9 @@
 package adapter
 
 import (
+	"github.com/canonical/authd/internal/brokers/layouts/entries"
 	"github.com/charmbracelet/bubbles/textinput"
 	tea "github.com/charmbracelet/bubbletea"
-	"github.com/ubuntu/authd/internal/brokers/layouts/entries"
 )
 
 // textinputModel is a base block for handling textinput.Model, delegating to a tea.Model approach.
diff --git a/pam/internal/adapter/userselection.go b/pam/internal/adapter/userselection.go
index 5ce6ff9551..b07bb3966f 100644
--- a/pam/internal/adapter/userselection.go
+++ b/pam/internal/adapter/userselection.go
@@ -5,15 +5,15 @@ import (
 	"fmt"
 	"strings"
 
+	"github.com/canonical/authd/log"
+	"github.com/canonical/authd/pam/internal/proto"
 	"github.com/charmbracelet/bubbles/cursor"
 	"github.com/charmbracelet/bubbles/textinput"
 	tea "github.com/charmbracelet/bubbletea"
 	"github.com/msteinert/pam/v2"
-	"github.com/ubuntu/authd/log"
-	"github.com/ubuntu/authd/pam/internal/proto"
 )
 
-// userSelectionModel allows selecting from PAM or interactively an user.
+// userSelectionModel allows selecting from PAM or interactively a user.
 type userSelectionModel struct {
 	textinput.Model
 
@@ -154,7 +154,7 @@ func (m userSelectionModel) Username() string {
 		return ""
 	}
 	// authd uses lowercase usernames
-	return strings.ToLower(m.Model.Value())
+	return strings.ToLower(m.Value())
 }
 
 // Focus sets the focus state on the model. We also mark as the user is not
diff --git a/pam/internal/adapter/utils.go b/pam/internal/adapter/utils.go
index fe86ec549f..05ca8e0eee 100644
--- a/pam/internal/adapter/utils.go
+++ b/pam/internal/adapter/utils.go
@@ -9,13 +9,12 @@ import (
 	"strings"
 	"sync"
 
+	"github.com/canonical/authd/internal/proto/authd"
+	"github.com/canonical/authd/log"
+	"github.com/canonical/authd/pam/internal/proto"
 	tea "github.com/charmbracelet/bubbletea"
 	"github.com/charmbracelet/x/term"
 	"github.com/msteinert/pam/v2"
-	"github.com/ubuntu/authd/internal/proto/authd"
-	"github.com/ubuntu/authd/log"
-	"github.com/ubuntu/authd/pam/internal/proto"
-	pam_proto "github.com/ubuntu/authd/pam/internal/proto"
 )
 
 var (
@@ -239,7 +238,7 @@ func safeMessageDebugWithPrefix(prefix string, msg tea.Msg, formatAndArgs ...any
 	log.Debugf(context.Background(), "%s, %s", m, fmt.Sprintf(format, args...))
 }
 
-func goBackLabel(previousStage pam_proto.Stage) string {
+func goBackLabel(previousStage proto.Stage) string {
 	switch previousStage {
 	case proto.Stage_authModeSelection:
 		return "go back to select the authentication method"
diff --git a/pam/internal/adapter/utils_test.go b/pam/internal/adapter/utils_test.go
index 2b7cbfcdbd..3998432061 100644
--- a/pam/internal/adapter/utils_test.go
+++ b/pam/internal/adapter/utils_test.go
@@ -5,11 +5,11 @@ import (
 	"fmt"
 	"testing"
 
+	"github.com/canonical/authd/internal/proto/authd"
+	"github.com/canonical/authd/log"
+	"github.com/canonical/authd/pam/internal/proto"
 	tea "github.com/charmbracelet/bubbletea"
 	"github.com/stretchr/testify/require"
-	"github.com/ubuntu/authd/internal/proto/authd"
-	"github.com/ubuntu/authd/log"
-	"github.com/ubuntu/authd/pam/internal/proto"
 )
 
 func TestDebugMessageFormatter(t *testing.T) {
diff --git a/pam/internal/dbusmodule/transaction.go b/pam/internal/dbusmodule/transaction.go
index 7e0830910b..04e144af87 100644
--- a/pam/internal/dbusmodule/transaction.go
+++ b/pam/internal/dbusmodule/transaction.go
@@ -7,10 +7,10 @@ import (
 	"fmt"
 	"strings"
 
+	"github.com/canonical/authd/internal/decorate"
+	"github.com/canonical/authd/log"
 	"github.com/godbus/dbus/v5"
 	"github.com/msteinert/pam/v2"
-	"github.com/ubuntu/authd/log"
-	"github.com/ubuntu/decorate"
 )
 
 // Transaction is a [pam.Transaction] with dbus support.
diff --git a/pam/internal/dbusmodule/transaction_test.go b/pam/internal/dbusmodule/transaction_test.go
index 34e21d345c..fc18c433ad 100644
--- a/pam/internal/dbusmodule/transaction_test.go
+++ b/pam/internal/dbusmodule/transaction_test.go
@@ -7,12 +7,12 @@ import (
 	"sync"
 	"testing"
 
+	"github.com/canonical/authd/internal/testutils"
+	"github.com/canonical/authd/log"
+	"github.com/canonical/authd/pam/internal/dbusmodule"
 	"github.com/godbus/dbus/v5"
 	"github.com/msteinert/pam/v2"
 	"github.com/stretchr/testify/require"
-	"github.com/ubuntu/authd/internal/testutils"
-	"github.com/ubuntu/authd/log"
-	"github.com/ubuntu/authd/pam/internal/dbusmodule"
 )
 
 const ifaceName = "com.ubuntu.authd.pam"
diff --git a/pam/internal/gdm/conversation.go b/pam/internal/gdm/conversation.go
index 1b1f3cd8ef..e0e9191ddb 100644
--- a/pam/internal/gdm/conversation.go
+++ b/pam/internal/gdm/conversation.go
@@ -7,8 +7,8 @@ import (
 	"regexp"
 	"sync/atomic"
 
+	"github.com/canonical/authd/log"
 	"github.com/msteinert/pam/v2"
-	"github.com/ubuntu/authd/log"
 )
 
 var conversations atomic.Int32
diff --git a/pam/internal/gdm/conversation_test.go b/pam/internal/gdm/conversation_test.go
index 6167b94a96..1d2f57f4f5 100644
--- a/pam/internal/gdm/conversation_test.go
+++ b/pam/internal/gdm/conversation_test.go
@@ -7,11 +7,11 @@ import (
 	"fmt"
 	"testing"
 
+	"github.com/canonical/authd/internal/brokers/layouts"
+	authd "github.com/canonical/authd/internal/proto/authd"
+	"github.com/canonical/authd/pam/internal/pam_test"
 	"github.com/msteinert/pam/v2"
 	"github.com/stretchr/testify/require"
-	"github.com/ubuntu/authd/internal/brokers/layouts"
-	authd "github.com/ubuntu/authd/internal/proto/authd"
-	"github.com/ubuntu/authd/pam/internal/pam_test"
 	"google.golang.org/protobuf/encoding/protojson"
 )
 
diff --git a/pam/internal/gdm/extension_test.go b/pam/internal/gdm/extension_test.go
index 02c9846273..197b045166 100644
--- a/pam/internal/gdm/extension_test.go
+++ b/pam/internal/gdm/extension_test.go
@@ -5,9 +5,9 @@ import (
 	"testing"
 	"unsafe"
 
+	"github.com/canonical/authd/pam/internal/pam_test"
 	"github.com/msteinert/pam/v2"
 	"github.com/stretchr/testify/require"
-	"github.com/ubuntu/authd/pam/internal/pam_test"
 )
 
 func TestExtension(t *testing.T) {
diff --git a/pam/internal/gdm/extensions/gdm-custom-json-pam-extension.h b/pam/internal/gdm/extensions/gdm-custom-json-pam-extension.h
index 4d3c75afb8..07052cf299 100644
--- a/pam/internal/gdm/extensions/gdm-custom-json-pam-extension.h
+++ b/pam/internal/gdm/extensions/gdm-custom-json-pam-extension.h
@@ -1,6 +1,8 @@
 // TiCS: disabled // Header files are not built by default.
 
 /* -*- Mode: C; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 8 -*-
+ *
+ * Based on https://gitlab.gnome.org/GNOME/gdm/-/blob/8c3fbd5ddefb8097d990a12581453582ec71a32f/pam-extensions/gdm-custom-json-pam-extension.h
  *
  * Copyright (C) 2023 Canonical Ltd.
  *
diff --git a/pam/internal/gdm/gdm.pb.go b/pam/internal/gdm/gdm.pb.go
index a6bfccaf4f..53161ea085 100644
--- a/pam/internal/gdm/gdm.pb.go
+++ b/pam/internal/gdm/gdm.pb.go
@@ -1,14 +1,14 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.5
-// 	protoc        v5.29.0
+// 	protoc-gen-go v1.36.10
+// 	protoc        v6.33.1
 // source: gdm.proto
 
 package gdm
 
 import (
-	authd "github.com/ubuntu/authd/internal/proto/authd"
-	proto "github.com/ubuntu/authd/pam/internal/proto"
+	authd "github.com/canonical/authd/internal/proto/authd"
+	proto "github.com/canonical/authd/pam/internal/proto"
 	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
 	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
 	reflect "reflect"
@@ -160,7 +160,7 @@ type EventType int32
 const (
 	// EventType_unknownEvent is an unknown EventType.
 	EventType_unknownEvent EventType = 0
-	// EventType_userSelected is an user selected EventType.
+	// EventType_userSelected is a user selected EventType.
 	EventType_userSelected EventType = 1
 	// EventType_brokersReceived is a broker received EventType.
 	EventType_brokersReceived EventType = 2
@@ -1579,212 +1579,116 @@ func (x *Events_UiLayoutReceived) GetUiLayout() *authd.UILayout {
 
 var File_gdm_proto protoreflect.FileDescriptor
 
-var file_gdm_proto_rawDesc = string([]byte{
-	0x0a, 0x09, 0x67, 0x64, 0x6d, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x03, 0x67, 0x64, 0x6d,
-	0x1a, 0x0b, 0x61, 0x75, 0x74, 0x68, 0x64, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x09, 0x70,
-	0x61, 0x6d, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0xc5, 0x02, 0x0a, 0x04, 0x44, 0x61, 0x74,
-	0x61, 0x12, 0x21, 0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0e, 0x32,
-	0x0d, 0x2e, 0x67, 0x64, 0x6d, 0x2e, 0x44, 0x61, 0x74, 0x61, 0x54, 0x79, 0x70, 0x65, 0x52, 0x04,
-	0x74, 0x79, 0x70, 0x65, 0x12, 0x29, 0x0a, 0x05, 0x68, 0x65, 0x6c, 0x6c, 0x6f, 0x18, 0x02, 0x20,
-	0x01, 0x28, 0x0b, 0x32, 0x0e, 0x2e, 0x67, 0x64, 0x6d, 0x2e, 0x48, 0x65, 0x6c, 0x6c, 0x6f, 0x44,
-	0x61, 0x74, 0x61, 0x48, 0x00, 0x52, 0x05, 0x68, 0x65, 0x6c, 0x6c, 0x6f, 0x88, 0x01, 0x01, 0x12,
-	0x2f, 0x0a, 0x07, 0x72, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b,
-	0x32, 0x10, 0x2e, 0x67, 0x64, 0x6d, 0x2e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x44, 0x61,
-	0x74, 0x61, 0x48, 0x01, 0x52, 0x07, 0x72, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x88, 0x01, 0x01,
-	0x12, 0x32, 0x0a, 0x08, 0x72, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x18, 0x04, 0x20, 0x01,
-	0x28, 0x0b, 0x32, 0x11, 0x2e, 0x67, 0x64, 0x6d, 0x2e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73,
-	0x65, 0x44, 0x61, 0x74, 0x61, 0x48, 0x02, 0x52, 0x08, 0x72, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73,
-	0x65, 0x88, 0x01, 0x01, 0x12, 0x29, 0x0a, 0x05, 0x65, 0x76, 0x65, 0x6e, 0x74, 0x18, 0x05, 0x20,
-	0x01, 0x28, 0x0b, 0x32, 0x0e, 0x2e, 0x67, 0x64, 0x6d, 0x2e, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x44,
-	0x61, 0x74, 0x61, 0x48, 0x03, 0x52, 0x05, 0x65, 0x76, 0x65, 0x6e, 0x74, 0x88, 0x01, 0x01, 0x12,
-	0x32, 0x0a, 0x0c, 0x70, 0x6f, 0x6c, 0x6c, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x18,
-	0x06, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x0e, 0x2e, 0x67, 0x64, 0x6d, 0x2e, 0x45, 0x76, 0x65, 0x6e,
-	0x74, 0x44, 0x61, 0x74, 0x61, 0x52, 0x0c, 0x70, 0x6f, 0x6c, 0x6c, 0x52, 0x65, 0x73, 0x70, 0x6f,
-	0x6e, 0x73, 0x65, 0x42, 0x08, 0x0a, 0x06, 0x5f, 0x68, 0x65, 0x6c, 0x6c, 0x6f, 0x42, 0x0a, 0x0a,
-	0x08, 0x5f, 0x72, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x42, 0x0b, 0x0a, 0x09, 0x5f, 0x72, 0x65,
-	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x42, 0x08, 0x0a, 0x06, 0x5f, 0x65, 0x76, 0x65, 0x6e, 0x74,
-	0x22, 0x25, 0x0a, 0x09, 0x48, 0x65, 0x6c, 0x6c, 0x6f, 0x44, 0x61, 0x74, 0x61, 0x12, 0x18, 0x0a,
-	0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x07,
-	0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x22, 0x53, 0x0a, 0x08, 0x52, 0x65, 0x71, 0x75, 0x65,
-	0x73, 0x74, 0x73, 0x1a, 0x16, 0x0a, 0x14, 0x55, 0x69, 0x4c, 0x61, 0x79, 0x6f, 0x75, 0x74, 0x43,
-	0x61, 0x70, 0x61, 0x62, 0x69, 0x6c, 0x69, 0x74, 0x69, 0x65, 0x73, 0x1a, 0x2f, 0x0a, 0x0b, 0x43,
-	0x68, 0x61, 0x6e, 0x67, 0x65, 0x53, 0x74, 0x61, 0x67, 0x65, 0x12, 0x20, 0x0a, 0x05, 0x73, 0x74,
-	0x61, 0x67, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x0a, 0x2e, 0x70, 0x61, 0x6d, 0x2e,
-	0x53, 0x74, 0x61, 0x67, 0x65, 0x52, 0x05, 0x73, 0x74, 0x61, 0x67, 0x65, 0x22, 0xd4, 0x01, 0x0a,
-	0x0b, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x44, 0x61, 0x74, 0x61, 0x12, 0x24, 0x0a, 0x04,
-	0x74, 0x79, 0x70, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x10, 0x2e, 0x67, 0x64, 0x6d,
-	0x2e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x54, 0x79, 0x70, 0x65, 0x52, 0x04, 0x74, 0x79,
-	0x70, 0x65, 0x12, 0x58, 0x0a, 0x14, 0x75, 0x69, 0x4c, 0x61, 0x79, 0x6f, 0x75, 0x74, 0x43, 0x61,
-	0x70, 0x61, 0x62, 0x69, 0x6c, 0x69, 0x74, 0x69, 0x65, 0x73, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x0b,
-	0x32, 0x22, 0x2e, 0x67, 0x64, 0x6d, 0x2e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x73, 0x2e,
-	0x55, 0x69, 0x4c, 0x61, 0x79, 0x6f, 0x75, 0x74, 0x43, 0x61, 0x70, 0x61, 0x62, 0x69, 0x6c, 0x69,
-	0x74, 0x69, 0x65, 0x73, 0x48, 0x00, 0x52, 0x14, 0x75, 0x69, 0x4c, 0x61, 0x79, 0x6f, 0x75, 0x74,
-	0x43, 0x61, 0x70, 0x61, 0x62, 0x69, 0x6c, 0x69, 0x74, 0x69, 0x65, 0x73, 0x12, 0x3d, 0x0a, 0x0b,
-	0x63, 0x68, 0x61, 0x6e, 0x67, 0x65, 0x53, 0x74, 0x61, 0x67, 0x65, 0x18, 0x0b, 0x20, 0x01, 0x28,
-	0x0b, 0x32, 0x19, 0x2e, 0x67, 0x64, 0x6d, 0x2e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x73,
-	0x2e, 0x43, 0x68, 0x61, 0x6e, 0x67, 0x65, 0x53, 0x74, 0x61, 0x67, 0x65, 0x48, 0x00, 0x52, 0x0b,
-	0x63, 0x68, 0x61, 0x6e, 0x67, 0x65, 0x53, 0x74, 0x61, 0x67, 0x65, 0x42, 0x06, 0x0a, 0x04, 0x64,
-	0x61, 0x74, 0x61, 0x22, 0x6b, 0x0a, 0x09, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x73,
-	0x1a, 0x05, 0x0a, 0x03, 0x41, 0x63, 0x6b, 0x1a, 0x57, 0x0a, 0x14, 0x55, 0x69, 0x4c, 0x61, 0x79,
-	0x6f, 0x75, 0x74, 0x43, 0x61, 0x70, 0x61, 0x62, 0x69, 0x6c, 0x69, 0x74, 0x69, 0x65, 0x73, 0x12,
-	0x3f, 0x0a, 0x12, 0x73, 0x75, 0x70, 0x70, 0x6f, 0x72, 0x74, 0x65, 0x64, 0x55, 0x69, 0x4c, 0x61,
-	0x79, 0x6f, 0x75, 0x74, 0x73, 0x18, 0x0a, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x0f, 0x2e, 0x61, 0x75,
-	0x74, 0x68, 0x64, 0x2e, 0x55, 0x49, 0x4c, 0x61, 0x79, 0x6f, 0x75, 0x74, 0x52, 0x12, 0x73, 0x75,
-	0x70, 0x70, 0x6f, 0x72, 0x74, 0x65, 0x64, 0x55, 0x69, 0x4c, 0x61, 0x79, 0x6f, 0x75, 0x74, 0x73,
-	0x22, 0xbf, 0x01, 0x0a, 0x0c, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x44, 0x61, 0x74,
-	0x61, 0x12, 0x24, 0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0e, 0x32,
-	0x10, 0x2e, 0x67, 0x64, 0x6d, 0x2e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x54, 0x79, 0x70,
-	0x65, 0x52, 0x04, 0x74, 0x79, 0x70, 0x65, 0x12, 0x26, 0x0a, 0x03, 0x61, 0x63, 0x6b, 0x18, 0x0a,
-	0x20, 0x01, 0x28, 0x0b, 0x32, 0x12, 0x2e, 0x67, 0x64, 0x6d, 0x2e, 0x52, 0x65, 0x73, 0x70, 0x6f,
-	0x6e, 0x73, 0x65, 0x73, 0x2e, 0x41, 0x63, 0x6b, 0x48, 0x00, 0x52, 0x03, 0x61, 0x63, 0x6b, 0x12,
-	0x59, 0x0a, 0x14, 0x75, 0x69, 0x4c, 0x61, 0x79, 0x6f, 0x75, 0x74, 0x43, 0x61, 0x70, 0x61, 0x62,
-	0x69, 0x6c, 0x69, 0x74, 0x69, 0x65, 0x73, 0x18, 0x0b, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x23, 0x2e,
-	0x67, 0x64, 0x6d, 0x2e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x73, 0x2e, 0x55, 0x69,
-	0x4c, 0x61, 0x79, 0x6f, 0x75, 0x74, 0x43, 0x61, 0x70, 0x61, 0x62, 0x69, 0x6c, 0x69, 0x74, 0x69,
-	0x65, 0x73, 0x48, 0x00, 0x52, 0x14, 0x75, 0x69, 0x4c, 0x61, 0x79, 0x6f, 0x75, 0x74, 0x43, 0x61,
-	0x70, 0x61, 0x62, 0x69, 0x6c, 0x69, 0x74, 0x69, 0x65, 0x73, 0x42, 0x06, 0x0a, 0x04, 0x64, 0x61,
-	0x74, 0x61, 0x22, 0xa9, 0x05, 0x0a, 0x06, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x73, 0x1a, 0x53, 0x0a,
-	0x0f, 0x42, 0x72, 0x6f, 0x6b, 0x65, 0x72, 0x73, 0x52, 0x65, 0x63, 0x65, 0x69, 0x76, 0x65, 0x64,
-	0x12, 0x40, 0x0a, 0x0c, 0x62, 0x72, 0x6f, 0x6b, 0x65, 0x72, 0x73, 0x49, 0x6e, 0x66, 0x6f, 0x73,
-	0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1c, 0x2e, 0x61, 0x75, 0x74, 0x68, 0x64, 0x2e, 0x41,
-	0x42, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x2e, 0x42, 0x72, 0x6f, 0x6b, 0x65, 0x72,
-	0x49, 0x6e, 0x66, 0x6f, 0x52, 0x0c, 0x62, 0x72, 0x6f, 0x6b, 0x65, 0x72, 0x73, 0x49, 0x6e, 0x66,
-	0x6f, 0x73, 0x1a, 0x2c, 0x0a, 0x0e, 0x42, 0x72, 0x6f, 0x6b, 0x65, 0x72, 0x53, 0x65, 0x6c, 0x65,
-	0x63, 0x74, 0x65, 0x64, 0x12, 0x1a, 0x0a, 0x08, 0x62, 0x72, 0x6f, 0x6b, 0x65, 0x72, 0x49, 0x64,
-	0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x62, 0x72, 0x6f, 0x6b, 0x65, 0x72, 0x49, 0x64,
-	0x1a, 0x26, 0x0a, 0x0c, 0x55, 0x73, 0x65, 0x72, 0x53, 0x65, 0x6c, 0x65, 0x63, 0x74, 0x65, 0x64,
-	0x12, 0x16, 0x0a, 0x06, 0x75, 0x73, 0x65, 0x72, 0x49, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09,
-	0x52, 0x06, 0x75, 0x73, 0x65, 0x72, 0x49, 0x64, 0x1a, 0x15, 0x0a, 0x13, 0x53, 0x74, 0x61, 0x72,
-	0x74, 0x41, 0x75, 0x74, 0x68, 0x65, 0x6e, 0x74, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x1a,
-	0x58, 0x0a, 0x11, 0x41, 0x75, 0x74, 0x68, 0x4d, 0x6f, 0x64, 0x65, 0x73, 0x52, 0x65, 0x63, 0x65,
-	0x69, 0x76, 0x65, 0x64, 0x12, 0x43, 0x0a, 0x09, 0x61, 0x75, 0x74, 0x68, 0x4d, 0x6f, 0x64, 0x65,
-	0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x25, 0x2e, 0x61, 0x75, 0x74, 0x68, 0x64, 0x2e,
-	0x47, 0x41, 0x4d, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x2e, 0x41, 0x75, 0x74, 0x68,
-	0x65, 0x6e, 0x74, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x4d, 0x6f, 0x64, 0x65, 0x52, 0x09,
-	0x61, 0x75, 0x74, 0x68, 0x4d, 0x6f, 0x64, 0x65, 0x73, 0x1a, 0x32, 0x0a, 0x10, 0x41, 0x75, 0x74,
-	0x68, 0x4d, 0x6f, 0x64, 0x65, 0x53, 0x65, 0x6c, 0x65, 0x63, 0x74, 0x65, 0x64, 0x12, 0x1e, 0x0a,
-	0x0a, 0x61, 0x75, 0x74, 0x68, 0x4d, 0x6f, 0x64, 0x65, 0x49, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28,
-	0x09, 0x52, 0x0a, 0x61, 0x75, 0x74, 0x68, 0x4d, 0x6f, 0x64, 0x65, 0x49, 0x64, 0x1a, 0x3a, 0x0a,
-	0x09, 0x41, 0x75, 0x74, 0x68, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x12, 0x2d, 0x0a, 0x08, 0x72, 0x65,
-	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x11, 0x2e, 0x61,
-	0x75, 0x74, 0x68, 0x64, 0x2e, 0x49, 0x41, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x52,
-	0x08, 0x72, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x1a, 0x12, 0x0a, 0x10, 0x52, 0x65, 0x73,
-	0x65, 0x6c, 0x65, 0x63, 0x74, 0x41, 0x75, 0x74, 0x68, 0x4d, 0x6f, 0x64, 0x65, 0x1a, 0x70, 0x0a,
-	0x18, 0x49, 0x73, 0x41, 0x75, 0x74, 0x68, 0x65, 0x6e, 0x74, 0x69, 0x63, 0x61, 0x74, 0x65, 0x64,
-	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x65, 0x64, 0x12, 0x54, 0x0a, 0x13, 0x61, 0x75, 0x74,
-	0x68, 0x65, 0x6e, 0x74, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x64, 0x61, 0x74, 0x61,
-	0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x23, 0x2e, 0x61, 0x75, 0x74, 0x68, 0x64, 0x2e, 0x49,
-	0x41, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x2e, 0x41, 0x75, 0x74, 0x68, 0x65, 0x6e, 0x74,
-	0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x44, 0x61, 0x74, 0x61, 0x52, 0x12, 0x61, 0x75, 0x74,
-	0x68, 0x65, 0x6e, 0x74, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x44, 0x61, 0x74, 0x61, 0x1a,
-	0x1a, 0x0a, 0x18, 0x49, 0x73, 0x41, 0x75, 0x74, 0x68, 0x65, 0x6e, 0x74, 0x69, 0x63, 0x61, 0x74,
-	0x65, 0x64, 0x43, 0x61, 0x6e, 0x63, 0x65, 0x6c, 0x6c, 0x65, 0x64, 0x1a, 0x30, 0x0a, 0x0c, 0x53,
-	0x74, 0x61, 0x67, 0x65, 0x43, 0x68, 0x61, 0x6e, 0x67, 0x65, 0x64, 0x12, 0x20, 0x0a, 0x05, 0x73,
-	0x74, 0x61, 0x67, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x0a, 0x2e, 0x70, 0x61, 0x6d,
-	0x2e, 0x53, 0x74, 0x61, 0x67, 0x65, 0x52, 0x05, 0x73, 0x74, 0x61, 0x67, 0x65, 0x1a, 0x3f, 0x0a,
-	0x10, 0x55, 0x69, 0x4c, 0x61, 0x79, 0x6f, 0x75, 0x74, 0x52, 0x65, 0x63, 0x65, 0x69, 0x76, 0x65,
-	0x64, 0x12, 0x2b, 0x0a, 0x08, 0x75, 0x69, 0x4c, 0x61, 0x79, 0x6f, 0x75, 0x74, 0x18, 0x01, 0x20,
-	0x01, 0x28, 0x0b, 0x32, 0x0f, 0x2e, 0x61, 0x75, 0x74, 0x68, 0x64, 0x2e, 0x55, 0x49, 0x4c, 0x61,
-	0x79, 0x6f, 0x75, 0x74, 0x52, 0x08, 0x75, 0x69, 0x4c, 0x61, 0x79, 0x6f, 0x75, 0x74, 0x22, 0xcd,
-	0x07, 0x0a, 0x09, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x44, 0x61, 0x74, 0x61, 0x12, 0x22, 0x0a, 0x04,
-	0x74, 0x79, 0x70, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x0e, 0x2e, 0x67, 0x64, 0x6d,
-	0x2e, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x54, 0x79, 0x70, 0x65, 0x52, 0x04, 0x74, 0x79, 0x70, 0x65,
-	0x12, 0x47, 0x0a, 0x0f, 0x62, 0x72, 0x6f, 0x6b, 0x65, 0x72, 0x73, 0x52, 0x65, 0x63, 0x65, 0x69,
-	0x76, 0x65, 0x64, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1b, 0x2e, 0x67, 0x64, 0x6d, 0x2e,
-	0x45, 0x76, 0x65, 0x6e, 0x74, 0x73, 0x2e, 0x42, 0x72, 0x6f, 0x6b, 0x65, 0x72, 0x73, 0x52, 0x65,
-	0x63, 0x65, 0x69, 0x76, 0x65, 0x64, 0x48, 0x00, 0x52, 0x0f, 0x62, 0x72, 0x6f, 0x6b, 0x65, 0x72,
-	0x73, 0x52, 0x65, 0x63, 0x65, 0x69, 0x76, 0x65, 0x64, 0x12, 0x44, 0x0a, 0x0e, 0x62, 0x72, 0x6f,
-	0x6b, 0x65, 0x72, 0x53, 0x65, 0x6c, 0x65, 0x63, 0x74, 0x65, 0x64, 0x18, 0x0b, 0x20, 0x01, 0x28,
-	0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x64, 0x6d, 0x2e, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x73, 0x2e, 0x42,
-	0x72, 0x6f, 0x6b, 0x65, 0x72, 0x53, 0x65, 0x6c, 0x65, 0x63, 0x74, 0x65, 0x64, 0x48, 0x00, 0x52,
-	0x0e, 0x62, 0x72, 0x6f, 0x6b, 0x65, 0x72, 0x53, 0x65, 0x6c, 0x65, 0x63, 0x74, 0x65, 0x64, 0x12,
-	0x4d, 0x0a, 0x11, 0x61, 0x75, 0x74, 0x68, 0x4d, 0x6f, 0x64, 0x65, 0x73, 0x52, 0x65, 0x63, 0x65,
-	0x69, 0x76, 0x65, 0x64, 0x18, 0x0c, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1d, 0x2e, 0x67, 0x64, 0x6d,
-	0x2e, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x73, 0x2e, 0x41, 0x75, 0x74, 0x68, 0x4d, 0x6f, 0x64, 0x65,
-	0x73, 0x52, 0x65, 0x63, 0x65, 0x69, 0x76, 0x65, 0x64, 0x48, 0x00, 0x52, 0x11, 0x61, 0x75, 0x74,
-	0x68, 0x4d, 0x6f, 0x64, 0x65, 0x73, 0x52, 0x65, 0x63, 0x65, 0x69, 0x76, 0x65, 0x64, 0x12, 0x4a,
-	0x0a, 0x10, 0x61, 0x75, 0x74, 0x68, 0x4d, 0x6f, 0x64, 0x65, 0x53, 0x65, 0x6c, 0x65, 0x63, 0x74,
-	0x65, 0x64, 0x18, 0x0d, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1c, 0x2e, 0x67, 0x64, 0x6d, 0x2e, 0x45,
-	0x76, 0x65, 0x6e, 0x74, 0x73, 0x2e, 0x41, 0x75, 0x74, 0x68, 0x4d, 0x6f, 0x64, 0x65, 0x53, 0x65,
-	0x6c, 0x65, 0x63, 0x74, 0x65, 0x64, 0x48, 0x00, 0x52, 0x10, 0x61, 0x75, 0x74, 0x68, 0x4d, 0x6f,
-	0x64, 0x65, 0x53, 0x65, 0x6c, 0x65, 0x63, 0x74, 0x65, 0x64, 0x12, 0x62, 0x0a, 0x18, 0x69, 0x73,
-	0x41, 0x75, 0x74, 0x68, 0x65, 0x6e, 0x74, 0x69, 0x63, 0x61, 0x74, 0x65, 0x64, 0x52, 0x65, 0x71,
-	0x75, 0x65, 0x73, 0x74, 0x65, 0x64, 0x18, 0x0e, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x24, 0x2e, 0x67,
-	0x64, 0x6d, 0x2e, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x73, 0x2e, 0x49, 0x73, 0x41, 0x75, 0x74, 0x68,
-	0x65, 0x6e, 0x74, 0x69, 0x63, 0x61, 0x74, 0x65, 0x64, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
-	0x65, 0x64, 0x48, 0x00, 0x52, 0x18, 0x69, 0x73, 0x41, 0x75, 0x74, 0x68, 0x65, 0x6e, 0x74, 0x69,
-	0x63, 0x61, 0x74, 0x65, 0x64, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x65, 0x64, 0x12, 0x3e,
-	0x0a, 0x0c, 0x73, 0x74, 0x61, 0x67, 0x65, 0x43, 0x68, 0x61, 0x6e, 0x67, 0x65, 0x64, 0x18, 0x0f,
-	0x20, 0x01, 0x28, 0x0b, 0x32, 0x18, 0x2e, 0x67, 0x64, 0x6d, 0x2e, 0x45, 0x76, 0x65, 0x6e, 0x74,
-	0x73, 0x2e, 0x53, 0x74, 0x61, 0x67, 0x65, 0x43, 0x68, 0x61, 0x6e, 0x67, 0x65, 0x64, 0x48, 0x00,
-	0x52, 0x0c, 0x73, 0x74, 0x61, 0x67, 0x65, 0x43, 0x68, 0x61, 0x6e, 0x67, 0x65, 0x64, 0x12, 0x4a,
-	0x0a, 0x10, 0x75, 0x69, 0x4c, 0x61, 0x79, 0x6f, 0x75, 0x74, 0x52, 0x65, 0x63, 0x65, 0x69, 0x76,
-	0x65, 0x64, 0x18, 0x10, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1c, 0x2e, 0x67, 0x64, 0x6d, 0x2e, 0x45,
-	0x76, 0x65, 0x6e, 0x74, 0x73, 0x2e, 0x55, 0x69, 0x4c, 0x61, 0x79, 0x6f, 0x75, 0x74, 0x52, 0x65,
-	0x63, 0x65, 0x69, 0x76, 0x65, 0x64, 0x48, 0x00, 0x52, 0x10, 0x75, 0x69, 0x4c, 0x61, 0x79, 0x6f,
-	0x75, 0x74, 0x52, 0x65, 0x63, 0x65, 0x69, 0x76, 0x65, 0x64, 0x12, 0x35, 0x0a, 0x09, 0x61, 0x75,
-	0x74, 0x68, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x18, 0x11, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x15, 0x2e,
-	0x67, 0x64, 0x6d, 0x2e, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x73, 0x2e, 0x41, 0x75, 0x74, 0x68, 0x45,
-	0x76, 0x65, 0x6e, 0x74, 0x48, 0x00, 0x52, 0x09, 0x61, 0x75, 0x74, 0x68, 0x45, 0x76, 0x65, 0x6e,
-	0x74, 0x12, 0x4a, 0x0a, 0x10, 0x72, 0x65, 0x73, 0x65, 0x6c, 0x65, 0x63, 0x74, 0x41, 0x75, 0x74,
-	0x68, 0x4d, 0x6f, 0x64, 0x65, 0x18, 0x12, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1c, 0x2e, 0x67, 0x64,
-	0x6d, 0x2e, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x73, 0x2e, 0x52, 0x65, 0x73, 0x65, 0x6c, 0x65, 0x63,
-	0x74, 0x41, 0x75, 0x74, 0x68, 0x4d, 0x6f, 0x64, 0x65, 0x48, 0x00, 0x52, 0x10, 0x72, 0x65, 0x73,
-	0x65, 0x6c, 0x65, 0x63, 0x74, 0x41, 0x75, 0x74, 0x68, 0x4d, 0x6f, 0x64, 0x65, 0x12, 0x53, 0x0a,
-	0x13, 0x73, 0x74, 0x61, 0x72, 0x74, 0x41, 0x75, 0x74, 0x68, 0x65, 0x6e, 0x74, 0x69, 0x63, 0x61,
-	0x74, 0x69, 0x6f, 0x6e, 0x18, 0x13, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1f, 0x2e, 0x67, 0x64, 0x6d,
-	0x2e, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x73, 0x2e, 0x53, 0x74, 0x61, 0x72, 0x74, 0x41, 0x75, 0x74,
-	0x68, 0x65, 0x6e, 0x74, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x48, 0x00, 0x52, 0x13, 0x73,
-	0x74, 0x61, 0x72, 0x74, 0x41, 0x75, 0x74, 0x68, 0x65, 0x6e, 0x74, 0x69, 0x63, 0x61, 0x74, 0x69,
-	0x6f, 0x6e, 0x12, 0x3e, 0x0a, 0x0c, 0x75, 0x73, 0x65, 0x72, 0x53, 0x65, 0x6c, 0x65, 0x63, 0x74,
-	0x65, 0x64, 0x18, 0x14, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x18, 0x2e, 0x67, 0x64, 0x6d, 0x2e, 0x45,
-	0x76, 0x65, 0x6e, 0x74, 0x73, 0x2e, 0x55, 0x73, 0x65, 0x72, 0x53, 0x65, 0x6c, 0x65, 0x63, 0x74,
-	0x65, 0x64, 0x48, 0x00, 0x52, 0x0c, 0x75, 0x73, 0x65, 0x72, 0x53, 0x65, 0x6c, 0x65, 0x63, 0x74,
-	0x65, 0x64, 0x12, 0x62, 0x0a, 0x18, 0x69, 0x73, 0x41, 0x75, 0x74, 0x68, 0x65, 0x6e, 0x74, 0x69,
-	0x63, 0x61, 0x74, 0x65, 0x64, 0x43, 0x61, 0x6e, 0x63, 0x65, 0x6c, 0x6c, 0x65, 0x64, 0x18, 0x15,
-	0x20, 0x01, 0x28, 0x0b, 0x32, 0x24, 0x2e, 0x67, 0x64, 0x6d, 0x2e, 0x45, 0x76, 0x65, 0x6e, 0x74,
-	0x73, 0x2e, 0x49, 0x73, 0x41, 0x75, 0x74, 0x68, 0x65, 0x6e, 0x74, 0x69, 0x63, 0x61, 0x74, 0x65,
-	0x64, 0x43, 0x61, 0x6e, 0x63, 0x65, 0x6c, 0x6c, 0x65, 0x64, 0x48, 0x00, 0x52, 0x18, 0x69, 0x73,
-	0x41, 0x75, 0x74, 0x68, 0x65, 0x6e, 0x74, 0x69, 0x63, 0x61, 0x74, 0x65, 0x64, 0x43, 0x61, 0x6e,
-	0x63, 0x65, 0x6c, 0x6c, 0x65, 0x64, 0x42, 0x06, 0x0a, 0x04, 0x64, 0x61, 0x74, 0x61, 0x2a, 0x76,
-	0x0a, 0x08, 0x44, 0x61, 0x74, 0x61, 0x54, 0x79, 0x70, 0x65, 0x12, 0x0f, 0x0a, 0x0b, 0x75, 0x6e,
-	0x6b, 0x6e, 0x6f, 0x77, 0x6e, 0x54, 0x79, 0x70, 0x65, 0x10, 0x00, 0x12, 0x09, 0x0a, 0x05, 0x68,
-	0x65, 0x6c, 0x6c, 0x6f, 0x10, 0x01, 0x12, 0x09, 0x0a, 0x05, 0x65, 0x76, 0x65, 0x6e, 0x74, 0x10,
-	0x02, 0x12, 0x0c, 0x0a, 0x08, 0x65, 0x76, 0x65, 0x6e, 0x74, 0x41, 0x63, 0x6b, 0x10, 0x03, 0x12,
-	0x0b, 0x0a, 0x07, 0x72, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x10, 0x04, 0x12, 0x0c, 0x0a, 0x08,
-	0x72, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x10, 0x05, 0x12, 0x08, 0x0a, 0x04, 0x70, 0x6f,
-	0x6c, 0x6c, 0x10, 0x06, 0x12, 0x10, 0x0a, 0x0c, 0x70, 0x6f, 0x6c, 0x6c, 0x52, 0x65, 0x73, 0x70,
-	0x6f, 0x6e, 0x73, 0x65, 0x10, 0x07, 0x2a, 0x82, 0x01, 0x0a, 0x0b, 0x52, 0x65, 0x71, 0x75, 0x65,
-	0x73, 0x74, 0x54, 0x79, 0x70, 0x65, 0x12, 0x12, 0x0a, 0x0e, 0x75, 0x6e, 0x6b, 0x6e, 0x6f, 0x77,
-	0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x10, 0x00, 0x12, 0x15, 0x0a, 0x11, 0x75, 0x70,
-	0x64, 0x61, 0x74, 0x65, 0x42, 0x72, 0x6f, 0x6b, 0x65, 0x72, 0x73, 0x4c, 0x69, 0x73, 0x74, 0x10,
-	0x01, 0x12, 0x1d, 0x0a, 0x19, 0x63, 0x6f, 0x6d, 0x70, 0x6f, 0x73, 0x65, 0x41, 0x75, 0x74, 0x68,
-	0x65, 0x6e, 0x74, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x56, 0x69, 0x65, 0x77, 0x10, 0x02,
-	0x12, 0x18, 0x0a, 0x14, 0x75, 0x69, 0x4c, 0x61, 0x79, 0x6f, 0x75, 0x74, 0x43, 0x61, 0x70, 0x61,
-	0x62, 0x69, 0x6c, 0x69, 0x74, 0x69, 0x65, 0x73, 0x10, 0x03, 0x12, 0x0f, 0x0a, 0x0b, 0x63, 0x68,
-	0x61, 0x6e, 0x67, 0x65, 0x53, 0x74, 0x61, 0x67, 0x65, 0x10, 0x04, 0x2a, 0xa7, 0x02, 0x0a, 0x09,
-	0x45, 0x76, 0x65, 0x6e, 0x74, 0x54, 0x79, 0x70, 0x65, 0x12, 0x10, 0x0a, 0x0c, 0x75, 0x6e, 0x6b,
-	0x6e, 0x6f, 0x77, 0x6e, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x10, 0x00, 0x12, 0x10, 0x0a, 0x0c, 0x75,
-	0x73, 0x65, 0x72, 0x53, 0x65, 0x6c, 0x65, 0x63, 0x74, 0x65, 0x64, 0x10, 0x01, 0x12, 0x13, 0x0a,
-	0x0f, 0x62, 0x72, 0x6f, 0x6b, 0x65, 0x72, 0x73, 0x52, 0x65, 0x63, 0x65, 0x69, 0x76, 0x65, 0x64,
-	0x10, 0x02, 0x12, 0x12, 0x0a, 0x0e, 0x62, 0x72, 0x6f, 0x6b, 0x65, 0x72, 0x53, 0x65, 0x6c, 0x65,
-	0x63, 0x74, 0x65, 0x64, 0x10, 0x03, 0x12, 0x15, 0x0a, 0x11, 0x61, 0x75, 0x74, 0x68, 0x4d, 0x6f,
-	0x64, 0x65, 0x73, 0x52, 0x65, 0x63, 0x65, 0x69, 0x76, 0x65, 0x64, 0x10, 0x04, 0x12, 0x14, 0x0a,
-	0x10, 0x61, 0x75, 0x74, 0x68, 0x4d, 0x6f, 0x64, 0x65, 0x53, 0x65, 0x6c, 0x65, 0x63, 0x74, 0x65,
-	0x64, 0x10, 0x05, 0x12, 0x14, 0x0a, 0x10, 0x72, 0x65, 0x73, 0x65, 0x6c, 0x65, 0x63, 0x74, 0x41,
-	0x75, 0x74, 0x68, 0x4d, 0x6f, 0x64, 0x65, 0x10, 0x06, 0x12, 0x0d, 0x0a, 0x09, 0x61, 0x75, 0x74,
-	0x68, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x10, 0x07, 0x12, 0x14, 0x0a, 0x10, 0x75, 0x69, 0x4c, 0x61,
-	0x79, 0x6f, 0x75, 0x74, 0x52, 0x65, 0x63, 0x65, 0x69, 0x76, 0x65, 0x64, 0x10, 0x08, 0x12, 0x17,
-	0x0a, 0x13, 0x73, 0x74, 0x61, 0x72, 0x74, 0x41, 0x75, 0x74, 0x68, 0x65, 0x6e, 0x74, 0x69, 0x63,
-	0x61, 0x74, 0x69, 0x6f, 0x6e, 0x10, 0x09, 0x12, 0x1c, 0x0a, 0x18, 0x69, 0x73, 0x41, 0x75, 0x74,
-	0x68, 0x65, 0x6e, 0x74, 0x69, 0x63, 0x61, 0x74, 0x65, 0x64, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
-	0x74, 0x65, 0x64, 0x10, 0x0a, 0x12, 0x1c, 0x0a, 0x18, 0x69, 0x73, 0x41, 0x75, 0x74, 0x68, 0x65,
-	0x6e, 0x74, 0x69, 0x63, 0x61, 0x74, 0x65, 0x64, 0x43, 0x61, 0x6e, 0x63, 0x65, 0x6c, 0x6c, 0x65,
-	0x64, 0x10, 0x0b, 0x12, 0x10, 0x0a, 0x0c, 0x73, 0x74, 0x61, 0x67, 0x65, 0x43, 0x68, 0x61, 0x6e,
-	0x67, 0x65, 0x64, 0x10, 0x0c, 0x42, 0x21, 0x5a, 0x1f, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e,
-	0x63, 0x6f, 0x6d, 0x2f, 0x75, 0x62, 0x75, 0x6e, 0x74, 0x75, 0x2f, 0x61, 0x75, 0x74, 0x68, 0x64,
-	0x2f, 0x70, 0x61, 0x6d, 0x2f, 0x67, 0x64, 0x6d, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
-})
+const file_gdm_proto_rawDesc = "" +
+	"\n" +
+	"\tgdm.proto\x12\x03gdm\x1a\vauthd.proto\x1a\tpam.proto\"\xc5\x02\n" +
+	"\x04Data\x12!\n" +
+	"\x04type\x18\x01 \x01(\x0e2\r.gdm.DataTypeR\x04type\x12)\n" +
+	"\x05hello\x18\x02 \x01(\v2\x0e.gdm.HelloDataH\x00R\x05hello\x88\x01\x01\x12/\n" +
+	"\arequest\x18\x03 \x01(\v2\x10.gdm.RequestDataH\x01R\arequest\x88\x01\x01\x122\n" +
+	"\bresponse\x18\x04 \x01(\v2\x11.gdm.ResponseDataH\x02R\bresponse\x88\x01\x01\x12)\n" +
+	"\x05event\x18\x05 \x01(\v2\x0e.gdm.EventDataH\x03R\x05event\x88\x01\x01\x122\n" +
+	"\fpollResponse\x18\x06 \x03(\v2\x0e.gdm.EventDataR\fpollResponseB\b\n" +
+	"\x06_helloB\n" +
+	"\n" +
+	"\b_requestB\v\n" +
+	"\t_responseB\b\n" +
+	"\x06_event\"%\n" +
+	"\tHelloData\x12\x18\n" +
+	"\aversion\x18\x01 \x01(\rR\aversion\"S\n" +
+	"\bRequests\x1a\x16\n" +
+	"\x14UiLayoutCapabilities\x1a/\n" +
+	"\vChangeStage\x12 \n" +
+	"\x05stage\x18\x01 \x01(\x0e2\n" +
+	".pam.StageR\x05stage\"\xd4\x01\n" +
+	"\vRequestData\x12$\n" +
+	"\x04type\x18\x01 \x01(\x0e2\x10.gdm.RequestTypeR\x04type\x12X\n" +
+	"\x14uiLayoutCapabilities\x18\n" +
+	" \x01(\v2\".gdm.Requests.UiLayoutCapabilitiesH\x00R\x14uiLayoutCapabilities\x12=\n" +
+	"\vchangeStage\x18\v \x01(\v2\x19.gdm.Requests.ChangeStageH\x00R\vchangeStageB\x06\n" +
+	"\x04data\"k\n" +
+	"\tResponses\x1a\x05\n" +
+	"\x03Ack\x1aW\n" +
+	"\x14UiLayoutCapabilities\x12?\n" +
+	"\x12supportedUiLayouts\x18\n" +
+	" \x03(\v2\x0f.authd.UILayoutR\x12supportedUiLayouts\"\xbf\x01\n" +
+	"\fResponseData\x12$\n" +
+	"\x04type\x18\x01 \x01(\x0e2\x10.gdm.RequestTypeR\x04type\x12&\n" +
+	"\x03ack\x18\n" +
+	" \x01(\v2\x12.gdm.Responses.AckH\x00R\x03ack\x12Y\n" +
+	"\x14uiLayoutCapabilities\x18\v \x01(\v2#.gdm.Responses.UiLayoutCapabilitiesH\x00R\x14uiLayoutCapabilitiesB\x06\n" +
+	"\x04data\"\xa9\x05\n" +
+	"\x06Events\x1aS\n" +
+	"\x0fBrokersReceived\x12@\n" +
+	"\fbrokersInfos\x18\x01 \x03(\v2\x1c.authd.ABResponse.BrokerInfoR\fbrokersInfos\x1a,\n" +
+	"\x0eBrokerSelected\x12\x1a\n" +
+	"\bbrokerId\x18\x01 \x01(\tR\bbrokerId\x1a&\n" +
+	"\fUserSelected\x12\x16\n" +
+	"\x06userId\x18\x01 \x01(\tR\x06userId\x1a\x15\n" +
+	"\x13StartAuthentication\x1aX\n" +
+	"\x11AuthModesReceived\x12C\n" +
+	"\tauthModes\x18\x01 \x03(\v2%.authd.GAMResponse.AuthenticationModeR\tauthModes\x1a2\n" +
+	"\x10AuthModeSelected\x12\x1e\n" +
+	"\n" +
+	"authModeId\x18\x01 \x01(\tR\n" +
+	"authModeId\x1a:\n" +
+	"\tAuthEvent\x12-\n" +
+	"\bresponse\x18\x01 \x01(\v2\x11.authd.IAResponseR\bresponse\x1a\x12\n" +
+	"\x10ReselectAuthMode\x1ap\n" +
+	"\x18IsAuthenticatedRequested\x12T\n" +
+	"\x13authentication_data\x18\x01 \x01(\v2#.authd.IARequest.AuthenticationDataR\x12authenticationData\x1a\x1a\n" +
+	"\x18IsAuthenticatedCancelled\x1a0\n" +
+	"\fStageChanged\x12 \n" +
+	"\x05stage\x18\x01 \x01(\x0e2\n" +
+	".pam.StageR\x05stage\x1a?\n" +
+	"\x10UiLayoutReceived\x12+\n" +
+	"\buiLayout\x18\x01 \x01(\v2\x0f.authd.UILayoutR\buiLayout\"\xcd\a\n" +
+	"\tEventData\x12\"\n" +
+	"\x04type\x18\x01 \x01(\x0e2\x0e.gdm.EventTypeR\x04type\x12G\n" +
+	"\x0fbrokersReceived\x18\n" +
+	" \x01(\v2\x1b.gdm.Events.BrokersReceivedH\x00R\x0fbrokersReceived\x12D\n" +
+	"\x0ebrokerSelected\x18\v \x01(\v2\x1a.gdm.Events.BrokerSelectedH\x00R\x0ebrokerSelected\x12M\n" +
+	"\x11authModesReceived\x18\f \x01(\v2\x1d.gdm.Events.AuthModesReceivedH\x00R\x11authModesReceived\x12J\n" +
+	"\x10authModeSelected\x18\r \x01(\v2\x1c.gdm.Events.AuthModeSelectedH\x00R\x10authModeSelected\x12b\n" +
+	"\x18isAuthenticatedRequested\x18\x0e \x01(\v2$.gdm.Events.IsAuthenticatedRequestedH\x00R\x18isAuthenticatedRequested\x12>\n" +
+	"\fstageChanged\x18\x0f \x01(\v2\x18.gdm.Events.StageChangedH\x00R\fstageChanged\x12J\n" +
+	"\x10uiLayoutReceived\x18\x10 \x01(\v2\x1c.gdm.Events.UiLayoutReceivedH\x00R\x10uiLayoutReceived\x125\n" +
+	"\tauthEvent\x18\x11 \x01(\v2\x15.gdm.Events.AuthEventH\x00R\tauthEvent\x12J\n" +
+	"\x10reselectAuthMode\x18\x12 \x01(\v2\x1c.gdm.Events.ReselectAuthModeH\x00R\x10reselectAuthMode\x12S\n" +
+	"\x13startAuthentication\x18\x13 \x01(\v2\x1f.gdm.Events.StartAuthenticationH\x00R\x13startAuthentication\x12>\n" +
+	"\fuserSelected\x18\x14 \x01(\v2\x18.gdm.Events.UserSelectedH\x00R\fuserSelected\x12b\n" +
+	"\x18isAuthenticatedCancelled\x18\x15 \x01(\v2$.gdm.Events.IsAuthenticatedCancelledH\x00R\x18isAuthenticatedCancelledB\x06\n" +
+	"\x04data*v\n" +
+	"\bDataType\x12\x0f\n" +
+	"\vunknownType\x10\x00\x12\t\n" +
+	"\x05hello\x10\x01\x12\t\n" +
+	"\x05event\x10\x02\x12\f\n" +
+	"\beventAck\x10\x03\x12\v\n" +
+	"\arequest\x10\x04\x12\f\n" +
+	"\bresponse\x10\x05\x12\b\n" +
+	"\x04poll\x10\x06\x12\x10\n" +
+	"\fpollResponse\x10\a*\x82\x01\n" +
+	"\vRequestType\x12\x12\n" +
+	"\x0eunknownRequest\x10\x00\x12\x15\n" +
+	"\x11updateBrokersList\x10\x01\x12\x1d\n" +
+	"\x19composeAuthenticationView\x10\x02\x12\x18\n" +
+	"\x14uiLayoutCapabilities\x10\x03\x12\x0f\n" +
+	"\vchangeStage\x10\x04*\xa7\x02\n" +
+	"\tEventType\x12\x10\n" +
+	"\funknownEvent\x10\x00\x12\x10\n" +
+	"\fuserSelected\x10\x01\x12\x13\n" +
+	"\x0fbrokersReceived\x10\x02\x12\x12\n" +
+	"\x0ebrokerSelected\x10\x03\x12\x15\n" +
+	"\x11authModesReceived\x10\x04\x12\x14\n" +
+	"\x10authModeSelected\x10\x05\x12\x14\n" +
+	"\x10reselectAuthMode\x10\x06\x12\r\n" +
+	"\tauthEvent\x10\a\x12\x14\n" +
+	"\x10uiLayoutReceived\x10\b\x12\x17\n" +
+	"\x13startAuthentication\x10\t\x12\x1c\n" +
+	"\x18isAuthenticatedRequested\x10\n" +
+	"\x12\x1c\n" +
+	"\x18isAuthenticatedCancelled\x10\v\x12\x10\n" +
+	"\fstageChanged\x10\fB$Z\"github.com/canonical/authd/pam/gdmb\x06proto3"
 
 var (
 	file_gdm_proto_rawDescOnce sync.Once
diff --git a/pam/internal/gdm/gdm.proto b/pam/internal/gdm/gdm.proto
index b000430b34..63f881d86f 100644
--- a/pam/internal/gdm/gdm.proto
+++ b/pam/internal/gdm/gdm.proto
@@ -1,7 +1,7 @@
 syntax = "proto3";
 package gdm;
 
-option go_package = "github.com/ubuntu/authd/pam/gdm";
+option go_package = "github.com/canonical/authd/pam/gdm";
 
 import "authd.proto";
 import "pam.proto";
@@ -85,7 +85,7 @@ message ResponseData {
 enum EventType {
     // EventType_unknownEvent is an unknown EventType.
     unknownEvent = 0;
-    // EventType_userSelected is an user selected EventType.
+    // EventType_userSelected is a user selected EventType.
     userSelected = 1;
     // EventType_brokersReceived is a broker received EventType.
     brokersReceived = 2;
diff --git a/pam/internal/gdm/main_test.go b/pam/internal/gdm/main_test.go
index e2c033da59..88598e461f 100644
--- a/pam/internal/gdm/main_test.go
+++ b/pam/internal/gdm/main_test.go
@@ -4,8 +4,8 @@ import (
 	"os"
 	"testing"
 
-	"github.com/ubuntu/authd/log"
-	"github.com/ubuntu/authd/pam/internal/pam_test"
+	"github.com/canonical/authd/log"
+	"github.com/canonical/authd/pam/internal/pam_test"
 )
 
 func TestMain(m *testing.M) {
diff --git a/pam/internal/gdm/protocol.go b/pam/internal/gdm/protocol.go
index 8b8a54a107..aa269e15dc 100644
--- a/pam/internal/gdm/protocol.go
+++ b/pam/internal/gdm/protocol.go
@@ -9,7 +9,7 @@ import (
 	"reflect"
 	"slices"
 
-	"github.com/ubuntu/authd/internal/proto/authd"
+	"github.com/canonical/authd/internal/proto/authd"
 	"google.golang.org/protobuf/encoding/protojson"
 )
 
diff --git a/pam/internal/gdm/protocol_test.go b/pam/internal/gdm/protocol_test.go
index 17ee2262f1..c6df2baa21 100644
--- a/pam/internal/gdm/protocol_test.go
+++ b/pam/internal/gdm/protocol_test.go
@@ -7,10 +7,10 @@ import (
 	"strings"
 	"testing"
 
+	"github.com/canonical/authd/internal/brokers/auth"
+	"github.com/canonical/authd/internal/proto/authd"
+	"github.com/canonical/authd/pam/internal/gdm"
 	"github.com/stretchr/testify/require"
-	"github.com/ubuntu/authd/internal/brokers/auth"
-	"github.com/ubuntu/authd/internal/proto/authd"
-	"github.com/ubuntu/authd/pam/internal/gdm"
 )
 
 func reformatJSON(t *testing.T, input []byte) []byte {
diff --git a/pam/internal/gdm_test/gdm_utils.go b/pam/internal/gdm_test/gdm_utils.go
index 962a48395d..70e8b22bf9 100644
--- a/pam/internal/gdm_test/gdm_utils.go
+++ b/pam/internal/gdm_test/gdm_utils.go
@@ -4,10 +4,10 @@ import (
 	"encoding/json"
 	"testing"
 
+	"github.com/canonical/authd/internal/proto/authd"
+	"github.com/canonical/authd/pam/internal/gdm"
+	"github.com/canonical/authd/pam/internal/proto"
 	"github.com/stretchr/testify/require"
-	"github.com/ubuntu/authd/internal/proto/authd"
-	"github.com/ubuntu/authd/pam/internal/gdm"
-	"github.com/ubuntu/authd/pam/internal/proto"
 )
 
 // RequireEqualData ensures that data is equal by checking the marshalled values.
diff --git a/pam/internal/pam_test/module-transaction-dummy_test.go b/pam/internal/pam_test/module-transaction-dummy_test.go
index 6dc29cd425..95eec073d4 100644
--- a/pam/internal/pam_test/module-transaction-dummy_test.go
+++ b/pam/internal/pam_test/module-transaction-dummy_test.go
@@ -33,7 +33,7 @@ func TestSetGetItem(t *testing.T) {
 	}{
 		"Set_user": {
 			item:  pam.User,
-			value: ptrValue("an user"),
+			value: ptrValue("a user"),
 		},
 		"Returns_empty_when_getting_an_unset_user": {
 			item:      pam.User,
diff --git a/pam/internal/pam_test/pam-client-dummy.go b/pam/internal/pam_test/pam-client-dummy.go
index 80a57376b1..01ed14ab46 100644
--- a/pam/internal/pam_test/pam-client-dummy.go
+++ b/pam/internal/pam_test/pam-client-dummy.go
@@ -13,13 +13,13 @@ import (
 	"sync"
 	"time"
 
+	"github.com/canonical/authd/internal/brokers/auth"
+	"github.com/canonical/authd/internal/brokers/layouts"
+	"github.com/canonical/authd/internal/brokers/layouts/entries"
+	"github.com/canonical/authd/internal/proto/authd"
+	"github.com/canonical/authd/internal/testutils"
+	"github.com/canonical/authd/log"
 	"github.com/google/uuid"
-	"github.com/ubuntu/authd/internal/brokers/auth"
-	"github.com/ubuntu/authd/internal/brokers/layouts"
-	"github.com/ubuntu/authd/internal/brokers/layouts/entries"
-	"github.com/ubuntu/authd/internal/proto/authd"
-	"github.com/ubuntu/authd/internal/testutils"
-	"github.com/ubuntu/authd/log"
 	"golang.org/x/exp/maps"
 	"google.golang.org/grpc"
 )
diff --git a/pam/internal/pam_test/pam-client-dummy_test.go b/pam/internal/pam_test/pam-client-dummy_test.go
index f37b2649ec..f5ea961c9d 100644
--- a/pam/internal/pam_test/pam-client-dummy_test.go
+++ b/pam/internal/pam_test/pam-client-dummy_test.go
@@ -12,11 +12,11 @@ import (
 	"testing"
 	"time"
 
+	"github.com/canonical/authd/internal/brokers/auth"
+	"github.com/canonical/authd/internal/brokers/layouts"
+	"github.com/canonical/authd/internal/proto/authd"
 	"github.com/google/uuid"
 	"github.com/stretchr/testify/require"
-	"github.com/ubuntu/authd/internal/brokers/auth"
-	"github.com/ubuntu/authd/internal/brokers/layouts"
-	"github.com/ubuntu/authd/internal/proto/authd"
 )
 
 var errTest = errors.New("an error")
@@ -100,9 +100,9 @@ func TestGetPreviousBroker(t *testing.T) {
 		"With_predefined_default_for_user_empty_return_value": {
 			client: NewDummyClient(nil,
 				WithPreviousBrokerForUser("user0", "broker0"),
-				WithPreviousBrokerForUser("user1", "broker1"),
+				WithPreviousBrokerForUser("user1@example.com", "broker1"),
 			),
-			args:    &authd.GPBRequest{Username: "user1"},
+			args:    &authd.GPBRequest{Username: "user1@example.com"},
 			wantRet: &authd.GPBResponse{PreviousBroker: "broker1"},
 		},
 
diff --git a/pam/internal/pam_test/runner-utils.go b/pam/internal/pam_test/runner-utils.go
index 18aacfaa78..85f2e7a43a 100644
--- a/pam/internal/pam_test/runner-utils.go
+++ b/pam/internal/pam_test/runner-utils.go
@@ -4,8 +4,8 @@ import (
 	"errors"
 	"fmt"
 
+	"github.com/canonical/authd/internal/proto/authd"
 	"github.com/msteinert/pam/v2"
-	"github.com/ubuntu/authd/internal/proto/authd"
 )
 
 const (
diff --git a/pam/internal/proto/pam.pb.go b/pam/internal/proto/pam.pb.go
index 06f50162b4..88b919ecb2 100644
--- a/pam/internal/proto/pam.pb.go
+++ b/pam/internal/proto/pam.pb.go
@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.5
-// 	protoc        v5.29.0
+// 	protoc-gen-go v1.36.10
+// 	protoc        v6.33.1
 // source: pam.proto
 
 package proto
@@ -80,18 +80,14 @@ func (Stage) EnumDescriptor() ([]byte, []int) {
 
 var File_pam_proto protoreflect.FileDescriptor
 
-var file_pam_proto_rawDesc = string([]byte{
-	0x0a, 0x09, 0x70, 0x61, 0x6d, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x03, 0x70, 0x61, 0x6d,
-	0x2a, 0x55, 0x0a, 0x05, 0x53, 0x74, 0x61, 0x67, 0x65, 0x12, 0x11, 0x0a, 0x0d, 0x75, 0x73, 0x65,
-	0x72, 0x53, 0x65, 0x6c, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x10, 0x00, 0x12, 0x13, 0x0a, 0x0f,
-	0x62, 0x72, 0x6f, 0x6b, 0x65, 0x72, 0x53, 0x65, 0x6c, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x10,
-	0x01, 0x12, 0x15, 0x0a, 0x11, 0x61, 0x75, 0x74, 0x68, 0x4d, 0x6f, 0x64, 0x65, 0x53, 0x65, 0x6c,
-	0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x10, 0x02, 0x12, 0x0d, 0x0a, 0x09, 0x63, 0x68, 0x61, 0x6c,
-	0x6c, 0x65, 0x6e, 0x67, 0x65, 0x10, 0x03, 0x42, 0x2c, 0x5a, 0x2a, 0x67, 0x69, 0x74, 0x68, 0x75,
-	0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x75, 0x62, 0x75, 0x6e, 0x74, 0x75, 0x2f, 0x61, 0x75, 0x74,
-	0x68, 0x64, 0x2f, 0x70, 0x61, 0x6d, 0x2f, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2f,
-	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
-})
+const file_pam_proto_rawDesc = "" +
+	"\n" +
+	"\tpam.proto\x12\x03pam*U\n" +
+	"\x05Stage\x12\x11\n" +
+	"\ruserSelection\x10\x00\x12\x13\n" +
+	"\x0fbrokerSelection\x10\x01\x12\x15\n" +
+	"\x11authModeSelection\x10\x02\x12\r\n" +
+	"\tchallenge\x10\x03B/Z-github.com/canonical/authd/pam/internal/protob\x06proto3"
 
 var (
 	file_pam_proto_rawDescOnce sync.Once
diff --git a/pam/internal/proto/pam.proto b/pam/internal/proto/pam.proto
index a790b5de59..079522dc42 100644
--- a/pam/internal/proto/pam.proto
+++ b/pam/internal/proto/pam.proto
@@ -1,7 +1,7 @@
 syntax = "proto3";
 package pam;
 
-option go_package = "github.com/ubuntu/authd/pam/internal/proto";
+option go_package = "github.com/canonical/authd/pam/internal/proto";
 
 // state represents the stage object for the UI.
 enum Stage {
diff --git a/pam/main-exec.go b/pam/main-exec.go
index 5720c1586c..bf0575169c 100644
--- a/pam/main-exec.go
+++ b/pam/main-exec.go
@@ -9,9 +9,9 @@ import (
 	"runtime"
 	"time"
 
+	"github.com/canonical/authd/log"
+	"github.com/canonical/authd/pam/internal/dbusmodule"
 	"github.com/msteinert/pam/v2"
-	"github.com/ubuntu/authd/log"
-	"github.com/ubuntu/authd/pam/internal/dbusmodule"
 )
 
 var (
diff --git a/pam/pam.go b/pam/pam.go
index bf9cf85208..1626160b2c 100644
--- a/pam/pam.go
+++ b/pam/pam.go
@@ -13,17 +13,17 @@ import (
 	"strings"
 	"time"
 
+	"github.com/canonical/authd/internal/brokers"
+	"github.com/canonical/authd/internal/consts"
+	"github.com/canonical/authd/internal/grpcutils"
+	"github.com/canonical/authd/internal/proto/authd"
+	"github.com/canonical/authd/internal/services/errmessages"
+	"github.com/canonical/authd/log"
+	"github.com/canonical/authd/pam/internal/adapter"
+	"github.com/canonical/authd/pam/internal/gdm"
 	tea "github.com/charmbracelet/bubbletea"
 	"github.com/coreos/go-systemd/v22/journal"
 	"github.com/msteinert/pam/v2"
-	"github.com/ubuntu/authd/internal/brokers"
-	"github.com/ubuntu/authd/internal/consts"
-	"github.com/ubuntu/authd/internal/grpcutils"
-	"github.com/ubuntu/authd/internal/proto/authd"
-	"github.com/ubuntu/authd/internal/services/errmessages"
-	"github.com/ubuntu/authd/log"
-	"github.com/ubuntu/authd/pam/internal/adapter"
-	"github.com/ubuntu/authd/pam/internal/gdm"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/credentials/insecure"
 )
diff --git a/pam/tools/pam-runner/pam-runner.go b/pam/tools/pam-runner/pam-runner.go
index f48bccea4a..e53ad6d308 100644
--- a/pam/tools/pam-runner/pam-runner.go
+++ b/pam/tools/pam-runner/pam-runner.go
@@ -14,8 +14,8 @@ import (
 	"runtime"
 	"strings"
 
+	"github.com/canonical/authd/pam/internal/pam_test"
 	"github.com/msteinert/pam/v2"
-	"github.com/ubuntu/authd/pam/internal/pam_test"
 	"golang.org/x/term"
 )
 
@@ -61,17 +61,16 @@ func main() {
 		defaultArgs = append(defaultArgs, "--exec-debug", "--exec-log", logFile)
 	}
 
-	if coverDir := os.Getenv("GOCOVERDIR"); coverDir != "" {
-		defaultArgs = append(defaultArgs, "--exec-env", fmt.Sprintf("GOCOVERDIR=%s", coverDir))
-	}
-	if goRace := os.Getenv("GORACE"); goRace != "" {
-		defaultArgs = append(defaultArgs, "--exec-env", fmt.Sprintf("GORACE=%s", goRace))
-	}
-	if asanOptions := os.Getenv("ASAN_OPTIONS"); asanOptions != "" {
-		defaultArgs = append(defaultArgs, "--exec-env", fmt.Sprintf("ASAN_OPTIONS=%s", asanOptions))
-	}
-	if lsanOptions := os.Getenv("LSAN_OPTIONS"); lsanOptions != "" {
-		defaultArgs = append(defaultArgs, "--exec-env", fmt.Sprintf("LSAN_OPTIONS=%s", lsanOptions))
+	for _, env := range []string{
+		"GOCOVERDIR",
+		"GORACE",
+		"ASAN_OPTIONS",
+		"LSAN_OPTIONS",
+	} {
+		if _, ok := os.LookupEnv(env); !ok {
+			continue
+		}
+		defaultArgs = append(defaultArgs, "--exec-env", env)
 	}
 
 	if len(os.Args) < 2 {
@@ -82,7 +81,7 @@ func main() {
 	args = append(defaultArgs, args...)
 
 	if pamService == "" {
-		pamService = "authd-cli"
+		pamService = "authd-pam-runner-service"
 	}
 	serviceFile, err := pam_test.CreateService(tmpDir, pamService, []pam_test.ServiceLine{
 		{Action: pam_test.Auth, Control: pam_test.SufficientRequisite, Module: execModule, Args: args},
diff --git a/scripts/generate-vendored-copyright b/scripts/generate-vendored-copyright
index 3c05d0a829..4b0a9ab7fd 100755
--- a/scripts/generate-vendored-copyright
+++ b/scripts/generate-vendored-copyright
@@ -1,4 +1,7 @@
 #!/usr/bin/env python3
+
+# SPDX-License-Identifier: GPL-3.0-or-later OR LGPL-3.0-or-later
+
 """
 Generate Debian copyright files from vendored dependencies.
 
diff --git a/shell-completion/bash/authctl b/shell-completion/bash/authctl
new file mode 100644
index 0000000000..3a97824dbe
--- /dev/null
+++ b/shell-completion/bash/authctl
@@ -0,0 +1,426 @@
+# bash completion V2 for authctl                              -*- shell-script -*-
+
+__authctl_debug()
+{
+    if [[ -n ${BASH_COMP_DEBUG_FILE-} ]]; then
+        echo "$*" >> "${BASH_COMP_DEBUG_FILE}"
+    fi
+}
+
+# Macs have bash3 for which the bash-completion package doesn't include
+# _init_completion. This is a minimal version of that function.
+__authctl_init_completion()
+{
+    COMPREPLY=()
+    _get_comp_words_by_ref "$@" cur prev words cword
+}
+
+# This function calls the authctl program to obtain the completion
+# results and the directive.  It fills the 'out' and 'directive' vars.
+__authctl_get_completion_results() {
+    local requestComp lastParam lastChar args
+
+    # Prepare the command to request completions for the program.
+    # Calling ${words[0]} instead of directly authctl allows handling aliases
+    args=("${words[@]:1}")
+    requestComp="${words[0]} __complete ${args[*]}"
+
+    lastParam=${words[$((${#words[@]}-1))]}
+    lastChar=${lastParam:$((${#lastParam}-1)):1}
+    __authctl_debug "lastParam ${lastParam}, lastChar ${lastChar}"
+
+    if [[ -z ${cur} && ${lastChar} != = ]]; then
+        # If the last parameter is complete (there is a space following it)
+        # We add an extra empty parameter so we can indicate this to the go method.
+        __authctl_debug "Adding extra empty parameter"
+        requestComp="${requestComp} ''"
+    fi
+
+    # When completing a flag with an = (e.g., authctl -n=<TAB>)
+    # bash focuses on the part after the =, so we need to remove
+    # the flag part from $cur
+    if [[ ${cur} == -*=* ]]; then
+        cur="${cur#*=}"
+    fi
+
+    __authctl_debug "Calling ${requestComp}"
+    # Use eval to handle any environment variables and such
+    out=$(eval "${requestComp}" 2>/dev/null)
+
+    # Extract the directive integer at the very end of the output following a colon (:)
+    directive=${out##*:}
+    # Remove the directive
+    out=${out%:*}
+    if [[ ${directive} == "${out}" ]]; then
+        # There is not directive specified
+        directive=0
+    fi
+    __authctl_debug "The completion directive is: ${directive}"
+    __authctl_debug "The completions are: ${out}"
+}
+
+__authctl_process_completion_results() {
+    local shellCompDirectiveError=1
+    local shellCompDirectiveNoSpace=2
+    local shellCompDirectiveNoFileComp=4
+    local shellCompDirectiveFilterFileExt=8
+    local shellCompDirectiveFilterDirs=16
+    local shellCompDirectiveKeepOrder=32
+
+    if (((directive & shellCompDirectiveError) != 0)); then
+        # Error code.  No completion.
+        __authctl_debug "Received error from custom completion go code"
+        return
+    else
+        if (((directive & shellCompDirectiveNoSpace) != 0)); then
+            if [[ $(type -t compopt) == builtin ]]; then
+                __authctl_debug "Activating no space"
+                compopt -o nospace
+            else
+                __authctl_debug "No space directive not supported in this version of bash"
+            fi
+        fi
+        if (((directive & shellCompDirectiveKeepOrder) != 0)); then
+            if [[ $(type -t compopt) == builtin ]]; then
+                # no sort isn't supported for bash less than < 4.4
+                if [[ ${BASH_VERSINFO[0]} -lt 4 || ( ${BASH_VERSINFO[0]} -eq 4 && ${BASH_VERSINFO[1]} -lt 4 ) ]]; then
+                    __authctl_debug "No sort directive not supported in this version of bash"
+                else
+                    __authctl_debug "Activating keep order"
+                    compopt -o nosort
+                fi
+            else
+                __authctl_debug "No sort directive not supported in this version of bash"
+            fi
+        fi
+        if (((directive & shellCompDirectiveNoFileComp) != 0)); then
+            if [[ $(type -t compopt) == builtin ]]; then
+                __authctl_debug "Activating no file completion"
+                compopt +o default
+            else
+                __authctl_debug "No file completion directive not supported in this version of bash"
+            fi
+        fi
+    fi
+
+    # Separate activeHelp from normal completions
+    local completions=()
+    local activeHelp=()
+    __authctl_extract_activeHelp
+
+    if (((directive & shellCompDirectiveFilterFileExt) != 0)); then
+        # File extension filtering
+        local fullFilter="" filter filteringCmd
+
+        # Do not use quotes around the $completions variable or else newline
+        # characters will be kept.
+        for filter in ${completions[*]}; do
+            fullFilter+="$filter|"
+        done
+
+        filteringCmd="_filedir $fullFilter"
+        __authctl_debug "File filtering command: $filteringCmd"
+        $filteringCmd
+    elif (((directive & shellCompDirectiveFilterDirs) != 0)); then
+        # File completion for directories only
+
+        local subdir
+        subdir=${completions[0]}
+        if [[ -n $subdir ]]; then
+            __authctl_debug "Listing directories in $subdir"
+            pushd "$subdir" >/dev/null 2>&1 && _filedir -d && popd >/dev/null 2>&1 || return
+        else
+            __authctl_debug "Listing directories in ."
+            _filedir -d
+        fi
+    else
+        __authctl_handle_completion_types
+    fi
+
+    __authctl_handle_special_char "$cur" :
+    __authctl_handle_special_char "$cur" =
+
+    # Print the activeHelp statements before we finish
+    __authctl_handle_activeHelp
+}
+
+__authctl_handle_activeHelp() {
+    # Print the activeHelp statements
+    if ((${#activeHelp[*]} != 0)); then
+        if [ -z $COMP_TYPE ]; then
+            # Bash v3 does not set the COMP_TYPE variable.
+            printf "\n";
+            printf "%s\n" "${activeHelp[@]}"
+            printf "\n"
+            __authctl_reprint_commandLine
+            return
+        fi
+
+        # Only print ActiveHelp on the second TAB press
+        if [ $COMP_TYPE -eq 63 ]; then
+            printf "\n"
+            printf "%s\n" "${activeHelp[@]}"
+
+            if ((${#COMPREPLY[*]} == 0)); then
+                # When there are no completion choices from the program, file completion
+                # may kick in if the program has not disabled it; in such a case, we want
+                # to know if any files will match what the user typed, so that we know if
+                # there will be completions presented, so that we know how to handle ActiveHelp.
+                # To find out, we actually trigger the file completion ourselves;
+                # the call to _filedir will fill COMPREPLY if files match.
+                if (((directive & shellCompDirectiveNoFileComp) == 0)); then
+                    __authctl_debug "Listing files"
+                    _filedir
+                fi
+            fi
+
+            if ((${#COMPREPLY[*]} != 0)); then
+                # If there are completion choices to be shown, print a delimiter.
+                # Re-printing the command-line will automatically be done
+                # by the shell when it prints the completion choices.
+                printf -- "--"
+            else
+                # When there are no completion choices at all, we need
+                # to re-print the command-line since the shell will
+                # not be doing it itself.
+                __authctl_reprint_commandLine
+            fi
+        elif [ $COMP_TYPE -eq 37 ] || [ $COMP_TYPE -eq 42 ]; then
+            # For completion type: menu-complete/menu-complete-backward and insert-completions
+            # the completions are immediately inserted into the command-line, so we first
+            # print the activeHelp message and reprint the command-line since the shell won't.
+            printf "\n"
+            printf "%s\n" "${activeHelp[@]}"
+
+            __authctl_reprint_commandLine
+        fi
+    fi
+}
+
+__authctl_reprint_commandLine() {
+    # The prompt format is only available from bash 4.4.
+    # We test if it is available before using it.
+    if (x=${PS1@P}) 2> /dev/null; then
+        printf "%s" "${PS1@P}${COMP_LINE[@]}"
+    else
+        # Can't print the prompt.  Just print the
+        # text the user had typed, it is workable enough.
+        printf "%s" "${COMP_LINE[@]}"
+    fi
+}
+
+# Separate activeHelp lines from real completions.
+# Fills the $activeHelp and $completions arrays.
+__authctl_extract_activeHelp() {
+    local activeHelpMarker="_activeHelp_ "
+    local endIndex=${#activeHelpMarker}
+
+    while IFS='' read -r comp; do
+        [[ -z $comp ]] && continue
+
+        if [[ ${comp:0:endIndex} == $activeHelpMarker ]]; then
+            comp=${comp:endIndex}
+            __authctl_debug "ActiveHelp found: $comp"
+            if [[ -n $comp ]]; then
+                activeHelp+=("$comp")
+            fi
+        else
+            # Not an activeHelp line but a normal completion
+            completions+=("$comp")
+        fi
+    done <<<"${out}"
+}
+
+__authctl_handle_completion_types() {
+    __authctl_debug "__authctl_handle_completion_types: COMP_TYPE is $COMP_TYPE"
+
+    case $COMP_TYPE in
+    37|42)
+        # Type: menu-complete/menu-complete-backward and insert-completions
+        # If the user requested inserting one completion at a time, or all
+        # completions at once on the command-line we must remove the descriptions.
+        # https://github.com/spf13/cobra/issues/1508
+
+        # If there are no completions, we don't need to do anything
+        (( ${#completions[@]} == 0 )) && return 0
+
+        local tab=$'\t'
+
+        # Strip any description and escape the completion to handled special characters
+        IFS=$'\n' read -ra completions -d '' < <(printf "%q\n" "${completions[@]%%$tab*}")
+
+        # Only consider the completions that match
+        IFS=$'\n' read -ra COMPREPLY -d '' < <(IFS=$'\n'; compgen -W "${completions[*]}" -- "${cur}")
+
+        # compgen looses the escaping so we need to escape all completions again since they will
+        # all be inserted on the command-line.
+        IFS=$'\n' read -ra COMPREPLY -d '' < <(printf "%q\n" "${COMPREPLY[@]}")
+        ;;
+
+    *)
+        # Type: complete (normal completion)
+        __authctl_handle_standard_completion_case
+        ;;
+    esac
+}
+
+__authctl_handle_standard_completion_case() {
+    local tab=$'\t'
+
+    # If there are no completions, we don't need to do anything
+    (( ${#completions[@]} == 0 )) && return 0
+
+    # Short circuit to optimize if we don't have descriptions
+    if [[ "${completions[*]}" != *$tab* ]]; then
+        # First, escape the completions to handle special characters
+        IFS=$'\n' read -ra completions -d '' < <(printf "%q\n" "${completions[@]}")
+        # Only consider the completions that match what the user typed
+        IFS=$'\n' read -ra COMPREPLY -d '' < <(IFS=$'\n'; compgen -W "${completions[*]}" -- "${cur}")
+
+        # compgen looses the escaping so, if there is only a single completion, we need to
+        # escape it again because it will be inserted on the command-line.  If there are multiple
+        # completions, we don't want to escape them because they will be printed in a list
+        # and we don't want to show escape characters in that list.
+        if (( ${#COMPREPLY[@]} == 1 )); then
+            COMPREPLY[0]=$(printf "%q" "${COMPREPLY[0]}")
+        fi
+        return 0
+    fi
+
+    local longest=0
+    local compline
+    # Look for the longest completion so that we can format things nicely
+    while IFS='' read -r compline; do
+        [[ -z $compline ]] && continue
+
+        # Before checking if the completion matches what the user typed,
+        # we need to strip any description and escape the completion to handle special
+        # characters because those escape characters are part of what the user typed.
+        # Don't call "printf" in a sub-shell because it will be much slower
+        # since we are in a loop.
+        printf -v comp "%q" "${compline%%$tab*}" &>/dev/null || comp=$(printf "%q" "${compline%%$tab*}")
+
+        # Only consider the completions that match
+        [[ $comp == "$cur"* ]] || continue
+
+        # The completions matches.  Add it to the list of full completions including
+        # its description.  We don't escape the completion because it may get printed
+        # in a list if there are more than one and we don't want show escape characters
+        # in that list.
+        COMPREPLY+=("$compline")
+
+        # Strip any description before checking the length, and again, don't escape
+        # the completion because this length is only used when printing the completions
+        # in a list and we don't want show escape characters in that list.
+        comp=${compline%%$tab*}
+        if ((${#comp}>longest)); then
+            longest=${#comp}
+        fi
+    done < <(printf "%s\n" "${completions[@]}")
+
+    # If there is a single completion left, remove the description text and escape any special characters
+    if ((${#COMPREPLY[*]} == 1)); then
+        __authctl_debug "COMPREPLY[0]: ${COMPREPLY[0]}"
+        COMPREPLY[0]=$(printf "%q" "${COMPREPLY[0]%%$tab*}")
+        __authctl_debug "Removed description from single completion, which is now: ${COMPREPLY[0]}"
+    else
+        # Format the descriptions
+        __authctl_format_comp_descriptions $longest
+    fi
+}
+
+__authctl_handle_special_char()
+{
+    local comp="$1"
+    local char=$2
+    if [[ "$comp" == *${char}* && "$COMP_WORDBREAKS" == *${char}* ]]; then
+        local word=${comp%"${comp##*${char}}"}
+        local idx=${#COMPREPLY[*]}
+        while ((--idx >= 0)); do
+            COMPREPLY[idx]=${COMPREPLY[idx]#"$word"}
+        done
+    fi
+}
+
+__authctl_format_comp_descriptions()
+{
+    local tab=$'\t'
+    local comp desc maxdesclength
+    local longest=$1
+
+    local i ci
+    for ci in ${!COMPREPLY[*]}; do
+        comp=${COMPREPLY[ci]}
+        # Properly format the description string which follows a tab character if there is one
+        if [[ "$comp" == *$tab* ]]; then
+            __authctl_debug "Original comp: $comp"
+            desc=${comp#*$tab}
+            comp=${comp%%$tab*}
+
+            # $COLUMNS stores the current shell width.
+            # Remove an extra 4 because we add 2 spaces and 2 parentheses.
+            maxdesclength=$(( COLUMNS - longest - 4 ))
+
+            # Make sure we can fit a description of at least 8 characters
+            # if we are to align the descriptions.
+            if ((maxdesclength > 8)); then
+                # Add the proper number of spaces to align the descriptions
+                for ((i = ${#comp} ; i < longest ; i++)); do
+                    comp+=" "
+                done
+            else
+                # Don't pad the descriptions so we can fit more text after the completion
+                maxdesclength=$(( COLUMNS - ${#comp} - 4 ))
+            fi
+
+            # If there is enough space for any description text,
+            # truncate the descriptions that are too long for the shell width
+            if ((maxdesclength > 0)); then
+                if ((${#desc} > maxdesclength)); then
+                    desc=${desc:0:$(( maxdesclength - 1 ))}
+                    desc+="…"
+                fi
+                comp+="  ($desc)"
+            fi
+            COMPREPLY[ci]=$comp
+            __authctl_debug "Final comp: $comp"
+        fi
+    done
+}
+
+__start_authctl()
+{
+    local cur prev words cword split
+
+    COMPREPLY=()
+
+    # Call _init_completion from the bash-completion package
+    # to prepare the arguments properly
+    if declare -F _init_completion >/dev/null 2>&1; then
+        _init_completion -n =: || return
+    else
+        __authctl_init_completion -n =: || return
+    fi
+
+    __authctl_debug
+    __authctl_debug "========= starting completion logic =========="
+    __authctl_debug "cur is ${cur}, words[*] is ${words[*]}, #words[@] is ${#words[@]}, cword is $cword"
+
+    # The user could have moved the cursor backwards on the command-line.
+    # We need to trigger completion from the $cword location, so we need
+    # to truncate the command-line ($words) up to the $cword location.
+    words=("${words[@]:0:$cword+1}")
+    __authctl_debug "Truncated words[*]: ${words[*]},"
+
+    local out directive
+    __authctl_get_completion_results
+    __authctl_process_completion_results
+}
+
+if [[ $(type -t compopt) = "builtin" ]]; then
+    complete -o default -F __start_authctl authctl
+else
+    complete -o default -o nospace -F __start_authctl authctl
+fi
+
+# ex: ts=4 sw=4 et filetype=sh
diff --git a/shell-completion/fish/authctl.fish b/shell-completion/fish/authctl.fish
new file mode 100644
index 0000000000..a59163359d
--- /dev/null
+++ b/shell-completion/fish/authctl.fish
@@ -0,0 +1,235 @@
+# fish completion for authctl                              -*- shell-script -*-
+
+function __authctl_debug
+    set -l file "$BASH_COMP_DEBUG_FILE"
+    if test -n "$file"
+        echo "$argv" >> $file
+    end
+end
+
+function __authctl_perform_completion
+    __authctl_debug "Starting __authctl_perform_completion"
+
+    # Extract all args except the last one
+    set -l args (commandline -opc)
+    # Extract the last arg and escape it in case it is a space
+    set -l lastArg (string escape -- (commandline -ct))
+
+    __authctl_debug "args: $args"
+    __authctl_debug "last arg: $lastArg"
+
+    # Disable ActiveHelp which is not supported for fish shell
+    set -l requestComp "AUTHCTL_ACTIVE_HELP=0 $args[1] __complete $args[2..-1] $lastArg"
+
+    __authctl_debug "Calling $requestComp"
+    set -l results (eval $requestComp 2> /dev/null)
+
+    # Some programs may output extra empty lines after the directive.
+    # Let's ignore them or else it will break completion.
+    # Ref: https://github.com/spf13/cobra/issues/1279
+    for line in $results[-1..1]
+        if test (string trim -- $line) = ""
+            # Found an empty line, remove it
+            set results $results[1..-2]
+        else
+            # Found non-empty line, we have our proper output
+            break
+        end
+    end
+
+    set -l comps $results[1..-2]
+    set -l directiveLine $results[-1]
+
+    # For Fish, when completing a flag with an = (e.g., <program> -n=<TAB>)
+    # completions must be prefixed with the flag
+    set -l flagPrefix (string match -r -- '-.*=' "$lastArg")
+
+    __authctl_debug "Comps: $comps"
+    __authctl_debug "DirectiveLine: $directiveLine"
+    __authctl_debug "flagPrefix: $flagPrefix"
+
+    for comp in $comps
+        printf "%s%s\n" "$flagPrefix" "$comp"
+    end
+
+    printf "%s\n" "$directiveLine"
+end
+
+# this function limits calls to __authctl_perform_completion, by caching the result behind $__authctl_perform_completion_once_result
+function __authctl_perform_completion_once
+    __authctl_debug "Starting __authctl_perform_completion_once"
+
+    if test -n "$__authctl_perform_completion_once_result"
+        __authctl_debug "Seems like a valid result already exists, skipping __authctl_perform_completion"
+        return 0
+    end
+
+    set --global __authctl_perform_completion_once_result (__authctl_perform_completion)
+    if test -z "$__authctl_perform_completion_once_result"
+        __authctl_debug "No completions, probably due to a failure"
+        return 1
+    end
+
+    __authctl_debug "Performed completions and set __authctl_perform_completion_once_result"
+    return 0
+end
+
+# this function is used to clear the $__authctl_perform_completion_once_result variable after completions are run
+function __authctl_clear_perform_completion_once_result
+    __authctl_debug ""
+    __authctl_debug "========= clearing previously set __authctl_perform_completion_once_result variable =========="
+    set --erase __authctl_perform_completion_once_result
+    __authctl_debug "Successfully erased the variable __authctl_perform_completion_once_result"
+end
+
+function __authctl_requires_order_preservation
+    __authctl_debug ""
+    __authctl_debug "========= checking if order preservation is required =========="
+
+    __authctl_perform_completion_once
+    if test -z "$__authctl_perform_completion_once_result"
+        __authctl_debug "Error determining if order preservation is required"
+        return 1
+    end
+
+    set -l directive (string sub --start 2 $__authctl_perform_completion_once_result[-1])
+    __authctl_debug "Directive is: $directive"
+
+    set -l shellCompDirectiveKeepOrder 32
+    set -l keeporder (math (math --scale 0 $directive / $shellCompDirectiveKeepOrder) % 2)
+    __authctl_debug "Keeporder is: $keeporder"
+
+    if test $keeporder -ne 0
+        __authctl_debug "This does require order preservation"
+        return 0
+    end
+
+    __authctl_debug "This doesn't require order preservation"
+    return 1
+end
+
+
+# This function does two things:
+# - Obtain the completions and store them in the global __authctl_comp_results
+# - Return false if file completion should be performed
+function __authctl_prepare_completions
+    __authctl_debug ""
+    __authctl_debug "========= starting completion logic =========="
+
+    # Start fresh
+    set --erase __authctl_comp_results
+
+    __authctl_perform_completion_once
+    __authctl_debug "Completion results: $__authctl_perform_completion_once_result"
+
+    if test -z "$__authctl_perform_completion_once_result"
+        __authctl_debug "No completion, probably due to a failure"
+        # Might as well do file completion, in case it helps
+        return 1
+    end
+
+    set -l directive (string sub --start 2 $__authctl_perform_completion_once_result[-1])
+    set --global __authctl_comp_results $__authctl_perform_completion_once_result[1..-2]
+
+    __authctl_debug "Completions are: $__authctl_comp_results"
+    __authctl_debug "Directive is: $directive"
+
+    set -l shellCompDirectiveError 1
+    set -l shellCompDirectiveNoSpace 2
+    set -l shellCompDirectiveNoFileComp 4
+    set -l shellCompDirectiveFilterFileExt 8
+    set -l shellCompDirectiveFilterDirs 16
+
+    if test -z "$directive"
+        set directive 0
+    end
+
+    set -l compErr (math (math --scale 0 $directive / $shellCompDirectiveError) % 2)
+    if test $compErr -eq 1
+        __authctl_debug "Received error directive: aborting."
+        # Might as well do file completion, in case it helps
+        return 1
+    end
+
+    set -l filefilter (math (math --scale 0 $directive / $shellCompDirectiveFilterFileExt) % 2)
+    set -l dirfilter (math (math --scale 0 $directive / $shellCompDirectiveFilterDirs) % 2)
+    if test $filefilter -eq 1; or test $dirfilter -eq 1
+        __authctl_debug "File extension filtering or directory filtering not supported"
+        # Do full file completion instead
+        return 1
+    end
+
+    set -l nospace (math (math --scale 0 $directive / $shellCompDirectiveNoSpace) % 2)
+    set -l nofiles (math (math --scale 0 $directive / $shellCompDirectiveNoFileComp) % 2)
+
+    __authctl_debug "nospace: $nospace, nofiles: $nofiles"
+
+    # If we want to prevent a space, or if file completion is NOT disabled,
+    # we need to count the number of valid completions.
+    # To do so, we will filter on prefix as the completions we have received
+    # may not already be filtered so as to allow fish to match on different
+    # criteria than the prefix.
+    if test $nospace -ne 0; or test $nofiles -eq 0
+        set -l prefix (commandline -t | string escape --style=regex)
+        __authctl_debug "prefix: $prefix"
+
+        set -l completions (string match -r -- "^$prefix.*" $__authctl_comp_results)
+        set --global __authctl_comp_results $completions
+        __authctl_debug "Filtered completions are: $__authctl_comp_results"
+
+        # Important not to quote the variable for count to work
+        set -l numComps (count $__authctl_comp_results)
+        __authctl_debug "numComps: $numComps"
+
+        if test $numComps -eq 1; and test $nospace -ne 0
+            # We must first split on \t to get rid of the descriptions to be
+            # able to check what the actual completion will be.
+            # We don't need descriptions anyway since there is only a single
+            # real completion which the shell will expand immediately.
+            set -l split (string split --max 1 \t $__authctl_comp_results[1])
+
+            # Fish won't add a space if the completion ends with any
+            # of the following characters: @=/:.,
+            set -l lastChar (string sub -s -1 -- $split)
+            if not string match -r -q "[@=/:.,]" -- "$lastChar"
+                # In other cases, to support the "nospace" directive we trick the shell
+                # by outputting an extra, longer completion.
+                __authctl_debug "Adding second completion to perform nospace directive"
+                set --global __authctl_comp_results $split[1] $split[1].
+                __authctl_debug "Completions are now: $__authctl_comp_results"
+            end
+        end
+
+        if test $numComps -eq 0; and test $nofiles -eq 0
+            # To be consistent with bash and zsh, we only trigger file
+            # completion when there are no other completions
+            __authctl_debug "Requesting file completion"
+            return 1
+        end
+    end
+
+    return 0
+end
+
+# Since Fish completions are only loaded once the user triggers them, we trigger them ourselves
+# so we can properly delete any completions provided by another script.
+# Only do this if the program can be found, or else fish may print some errors; besides,
+# the existing completions will only be loaded if the program can be found.
+if type -q "authctl"
+    # The space after the program name is essential to trigger completion for the program
+    # and not completion of the program name itself.
+    # Also, we use '> /dev/null 2>&1' since '&>' is not supported in older versions of fish.
+    complete --do-complete "authctl " > /dev/null 2>&1
+end
+
+# Remove any pre-existing completions for the program since we will be handling all of them.
+complete -c authctl -e
+
+# this will get called after the two calls below and clear the $__authctl_perform_completion_once_result global
+complete -c authctl -n '__authctl_clear_perform_completion_once_result'
+# The call to __authctl_prepare_completions will setup __authctl_comp_results
+# which provides the program's completion choices.
+# If this doesn't require order preservation, we don't use the -k flag
+complete -c authctl -n 'not __authctl_requires_order_preservation && __authctl_prepare_completions' -f -a '$__authctl_comp_results'
+# otherwise we use the -k flag
+complete -k -c authctl -n '__authctl_requires_order_preservation && __authctl_prepare_completions' -f -a '$__authctl_comp_results'
diff --git a/shell-completion/generate.go b/shell-completion/generate.go
new file mode 100644
index 0000000000..308ea397c4
--- /dev/null
+++ b/shell-completion/generate.go
@@ -0,0 +1,9 @@
+//go:build generate
+
+// TiCS: disabled // This is a helper file to generate the shell completion code.
+
+//go:generate sh -c "go run ../cmd/authctl/main.go completion bash > bash/authctl"
+//go:generate sh -c "go run ../cmd/authctl/main.go completion zsh > zsh/_authctl"
+//go:generate sh -c "go run ../cmd/authctl/main.go completion fish > fish/authctl.fish"
+
+package shell_completion
diff --git a/shell-completion/zsh/_authctl b/shell-completion/zsh/_authctl
new file mode 100644
index 0000000000..fa9ff15acd
--- /dev/null
+++ b/shell-completion/zsh/_authctl
@@ -0,0 +1,212 @@
+#compdef authctl
+compdef _authctl authctl
+
+# zsh completion for authctl                              -*- shell-script -*-
+
+__authctl_debug()
+{
+    local file="$BASH_COMP_DEBUG_FILE"
+    if [[ -n ${file} ]]; then
+        echo "$*" >> "${file}"
+    fi
+}
+
+_authctl()
+{
+    local shellCompDirectiveError=1
+    local shellCompDirectiveNoSpace=2
+    local shellCompDirectiveNoFileComp=4
+    local shellCompDirectiveFilterFileExt=8
+    local shellCompDirectiveFilterDirs=16
+    local shellCompDirectiveKeepOrder=32
+
+    local lastParam lastChar flagPrefix requestComp out directive comp lastComp noSpace keepOrder
+    local -a completions
+
+    __authctl_debug "\n========= starting completion logic =========="
+    __authctl_debug "CURRENT: ${CURRENT}, words[*]: ${words[*]}"
+
+    # The user could have moved the cursor backwards on the command-line.
+    # We need to trigger completion from the $CURRENT location, so we need
+    # to truncate the command-line ($words) up to the $CURRENT location.
+    # (We cannot use $CURSOR as its value does not work when a command is an alias.)
+    words=("${=words[1,CURRENT]}")
+    __authctl_debug "Truncated words[*]: ${words[*]},"
+
+    lastParam=${words[-1]}
+    lastChar=${lastParam[-1]}
+    __authctl_debug "lastParam: ${lastParam}, lastChar: ${lastChar}"
+
+    # For zsh, when completing a flag with an = (e.g., authctl -n=<TAB>)
+    # completions must be prefixed with the flag
+    setopt local_options BASH_REMATCH
+    if [[ "${lastParam}" =~ '-.*=' ]]; then
+        # We are dealing with a flag with an =
+        flagPrefix="-P ${BASH_REMATCH}"
+    fi
+
+    # Prepare the command to obtain completions
+    requestComp="${words[1]} __complete ${words[2,-1]}"
+    if [ "${lastChar}" = "" ]; then
+        # If the last parameter is complete (there is a space following it)
+        # We add an extra empty parameter so we can indicate this to the go completion code.
+        __authctl_debug "Adding extra empty parameter"
+        requestComp="${requestComp} \"\""
+    fi
+
+    __authctl_debug "About to call: eval ${requestComp}"
+
+    # Use eval to handle any environment variables and such
+    out=$(eval ${requestComp} 2>/dev/null)
+    __authctl_debug "completion output: ${out}"
+
+    # Extract the directive integer following a : from the last line
+    local lastLine
+    while IFS='\n' read -r line; do
+        lastLine=${line}
+    done < <(printf "%s\n" "${out[@]}")
+    __authctl_debug "last line: ${lastLine}"
+
+    if [ "${lastLine[1]}" = : ]; then
+        directive=${lastLine[2,-1]}
+        # Remove the directive including the : and the newline
+        local suffix
+        (( suffix=${#lastLine}+2))
+        out=${out[1,-$suffix]}
+    else
+        # There is no directive specified.  Leave $out as is.
+        __authctl_debug "No directive found.  Setting do default"
+        directive=0
+    fi
+
+    __authctl_debug "directive: ${directive}"
+    __authctl_debug "completions: ${out}"
+    __authctl_debug "flagPrefix: ${flagPrefix}"
+
+    if [ $((directive & shellCompDirectiveError)) -ne 0 ]; then
+        __authctl_debug "Completion received error. Ignoring completions."
+        return
+    fi
+
+    local activeHelpMarker="_activeHelp_ "
+    local endIndex=${#activeHelpMarker}
+    local startIndex=$((${#activeHelpMarker}+1))
+    local hasActiveHelp=0
+    while IFS='\n' read -r comp; do
+        # Check if this is an activeHelp statement (i.e., prefixed with $activeHelpMarker)
+        if [ "${comp[1,$endIndex]}" = "$activeHelpMarker" ];then
+            __authctl_debug "ActiveHelp found: $comp"
+            comp="${comp[$startIndex,-1]}"
+            if [ -n "$comp" ]; then
+                compadd -x "${comp}"
+                __authctl_debug "ActiveHelp will need delimiter"
+                hasActiveHelp=1
+            fi
+
+            continue
+        fi
+
+        if [ -n "$comp" ]; then
+            # If requested, completions are returned with a description.
+            # The description is preceded by a TAB character.
+            # For zsh's _describe, we need to use a : instead of a TAB.
+            # We first need to escape any : as part of the completion itself.
+            comp=${comp//:/\\:}
+
+            local tab="$(printf '\t')"
+            comp=${comp//$tab/:}
+
+            __authctl_debug "Adding completion: ${comp}"
+            completions+=${comp}
+            lastComp=$comp
+        fi
+    done < <(printf "%s\n" "${out[@]}")
+
+    # Add a delimiter after the activeHelp statements, but only if:
+    # - there are completions following the activeHelp statements, or
+    # - file completion will be performed (so there will be choices after the activeHelp)
+    if [ $hasActiveHelp -eq 1 ]; then
+        if [ ${#completions} -ne 0 ] || [ $((directive & shellCompDirectiveNoFileComp)) -eq 0 ]; then
+            __authctl_debug "Adding activeHelp delimiter"
+            compadd -x "--"
+            hasActiveHelp=0
+        fi
+    fi
+
+    if [ $((directive & shellCompDirectiveNoSpace)) -ne 0 ]; then
+        __authctl_debug "Activating nospace."
+        noSpace="-S ''"
+    fi
+
+    if [ $((directive & shellCompDirectiveKeepOrder)) -ne 0 ]; then
+        __authctl_debug "Activating keep order."
+        keepOrder="-V"
+    fi
+
+    if [ $((directive & shellCompDirectiveFilterFileExt)) -ne 0 ]; then
+        # File extension filtering
+        local filteringCmd
+        filteringCmd='_files'
+        for filter in ${completions[@]}; do
+            if [ ${filter[1]} != '*' ]; then
+                # zsh requires a glob pattern to do file filtering
+                filter="\*.$filter"
+            fi
+            filteringCmd+=" -g $filter"
+        done
+        filteringCmd+=" ${flagPrefix}"
+
+        __authctl_debug "File filtering command: $filteringCmd"
+        _arguments '*:filename:'"$filteringCmd"
+    elif [ $((directive & shellCompDirectiveFilterDirs)) -ne 0 ]; then
+        # File completion for directories only
+        local subdir
+        subdir="${completions[1]}"
+        if [ -n "$subdir" ]; then
+            __authctl_debug "Listing directories in $subdir"
+            pushd "${subdir}" >/dev/null 2>&1
+        else
+            __authctl_debug "Listing directories in ."
+        fi
+
+        local result
+        _arguments '*:dirname:_files -/'" ${flagPrefix}"
+        result=$?
+        if [ -n "$subdir" ]; then
+            popd >/dev/null 2>&1
+        fi
+        return $result
+    else
+        __authctl_debug "Calling _describe"
+        if eval _describe $keepOrder "completions" completions $flagPrefix $noSpace; then
+            __authctl_debug "_describe found some completions"
+
+            # Return the success of having called _describe
+            return 0
+        else
+            __authctl_debug "_describe did not find completions."
+            __authctl_debug "Checking if we should do file completion."
+            if [ $((directive & shellCompDirectiveNoFileComp)) -ne 0 ]; then
+                __authctl_debug "deactivating file completion"
+
+                # We must return an error code here to let zsh know that there were no
+                # completions found by _describe; this is what will trigger other
+                # matching algorithms to attempt to find completions.
+                # For example zsh can match letters in the middle of words.
+                return 1
+            else
+                # Perform file completion
+                __authctl_debug "Activating file completion"
+
+                # We must return the result of this command, so it must be the
+                # last command, or else we must store its result to return it.
+                _arguments '*:filename:_files'" ${flagPrefix}"
+            fi
+        fi
+    fi
+}
+
+# don't run the completion function when being source-ed or eval-ed
+if [ "$funcstack[1]" = "_authctl" ]; then
+    _authctl
+fi
diff --git a/snap/hooks/install b/snap/hooks/install
new file mode 100755
index 0000000000..ca17529d9c
--- /dev/null
+++ b/snap/hooks/install
@@ -0,0 +1,6 @@
+#!/bin/sh
+
+set -eu
+
+cp --update=none "${SNAP}/conf/broker.conf.orig" "${SNAP_DATA}/broker.conf"
+chmod 0600 "${SNAP_DATA}/broker.conf"
diff --git a/snap/hooks/post-refresh b/snap/hooks/post-refresh
new file mode 100755
index 0000000000..907bdb1004
--- /dev/null
+++ b/snap/hooks/post-refresh
@@ -0,0 +1,83 @@
+#!/bin/sh
+
+set -eu
+
+# In previous versions, the broker.conf was created with mode 0777 - umask.
+# This is not secure, because the file can contain sensitive information
+# (like the client_secret), so we ensure that the mode is 0600.
+if [ -f "${SNAP_DATA}/broker.conf" ]; then
+  chmod 0600 "${SNAP_DATA}/broker.conf"
+fi
+
+PREVIOUS_VERSION=$(snapctl get previous-version)
+
+# Important: If you add new migrations, make sure to tag the commit which
+# first introduces the change, so that pre-release versions which already
+# contain the change (and which automatically uploaded to the edge channel)
+# will not be migrated.
+INITIAL_ALLOWED_USERS_VERSION="0.2.0-pre1"
+
+log() {
+  logger -t "${SNAP_NAME}" "post-refresh: $*"
+}
+
+version_less_than() {
+  output=$(semver compare "$1" "$2") || exit 1
+  [ "${output}" = "less" ]
+}
+
+valid_semver() {
+  if ! output=$(semver check "$1") && [ "${output}" != "invalid" ]; then
+    exit 1
+  fi
+  [ "${output}" = "valid" ]
+}
+
+should_transition_to_allowed_users() {
+  # Do not transition if the previous version is set but not a valid
+  # semantic version. That's the case for snaps published to the edge
+  # channel before the 0.2.0 release, which already ship the allowed users
+  # configuration.
+  # TODO: We can remove this check once all users have updated to 0.2.0.
+  if [ -n "${PREVIOUS_VERSION}" ] && ! valid_semver "${PREVIOUS_VERSION}"; then
+    return 1
+  fi
+
+  # Transition to allowed users if:
+  # - previous-version is not set (that means that the previous version is
+  #   older than 0.2.0, i.e. the version where we introduced setting the
+  #   previous-version in the pre-refresh hook).
+  # - previous-version is set, but it is less than 0.2.0. That should never
+  #   happen, but we check it to give an example how the previous-version
+  #   can be used to transition data from older versions.
+  [ -z "${PREVIOUS_VERSION}" ] || version_less_than "${PREVIOUS_VERSION}" "${INITIAL_ALLOWED_USERS_VERSION}"
+}
+
+transition_to_allowed_users() {
+  log "Transitioning to allowed users"
+  src_dir="${SNAP}/conf/migrations/pre-${INITIAL_ALLOWED_USERS_VERSION}/broker.conf.d"
+  dest_dir="${SNAP_DATA}/broker.conf.d"
+
+  if [ ! -d "${src_dir}" ]; then
+    log "Error: ${src_dir} does not exist, cannot transition to allowed users"
+    return
+  fi
+
+  # shellcheck disable=SC2174 # it's fine that --mode only applies to the deepest directory, because the SNAP_DATA
+  # directory is created by snapd with the correct permissions.
+  mkdir -p --mode=0700 "${dest_dir}"
+  for f in "${src_dir}"/*; do
+    cp --update=none "${f}" "${dest_dir}"
+    chmod 0600 "${dest_dir}/$(basename "${f}")"
+  done
+}
+
+if [ -z "${PREVIOUS_VERSION}" ]; then
+  log "previous-version: <not set>"
+else
+  log "previous-version: $PREVIOUS_VERSION"
+fi
+
+if should_transition_to_allowed_users; then
+  transition_to_allowed_users
+fi
diff --git a/snap/hooks/pre-refresh b/snap/hooks/pre-refresh
new file mode 100755
index 0000000000..1ef840dd4c
--- /dev/null
+++ b/snap/hooks/pre-refresh
@@ -0,0 +1,8 @@
+#!/bin/sh
+set -eu
+
+if [ -n "${DEBUG:-}" ]; then
+  logger -t "${SNAP_NAME}" "pre-refresh: Setting previous-version to ${SNAP_VERSION}"
+fi
+
+snapctl set previous-version="${SNAP_VERSION}"
diff --git a/snap/scripts/prepare-variant b/snap/scripts/prepare-variant
new file mode 100755
index 0000000000..f50a50e62f
--- /dev/null
+++ b/snap/scripts/prepare-variant
@@ -0,0 +1,67 @@
+#!/bin/bash
+
+set -euo pipefail
+
+SCRIPT_DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
+
+usage() {
+    cat << EOF
+Usage: $0 --broker <broker> [--copy]
+
+Prepare the snapcraft.yaml for building the specified broker snap.
+
+Options:
+  --broker <broker>  The broker to use (oidc, msentraid or google).
+  --copy             Copy files instead of creating symlinks.
+                     This is needed by the 'update-snap-branches' CI job but
+                     should not be necessary locally.
+EOF
+}
+
+while [[ $# -gt 0 ]]; do
+    case $1 in
+        --broker)
+            BROKER="$2"
+            shift 2
+            ;;
+        --copy)
+            COPY=1
+            shift
+            ;;
+        -h | --help)
+            usage
+            exit 0
+            ;;
+        *)
+            echo "Unknown option: $1"
+            usage
+            exit 1
+            ;;
+    esac
+done
+
+if [[ -z "${BROKER:-}" ]]; then
+    echo "Error: --broker is required."
+    usage
+    exit 1
+fi
+
+# Strip "authd-" prefix from the broker name if present
+BROKER="${BROKER#authd-}"
+
+set -x
+
+DEST_DIR="${SCRIPT_DIR}/.."
+cd "$DEST_DIR"
+
+SRC_FILE="variants/${BROKER}/snapcraft.yaml"
+if ! [ -e "$SRC_FILE" ]; then
+    echo "Error: $SRC_FILE does not exist."
+    exit 1
+fi
+
+if [ -n "${COPY:-}" ]; then
+    cp --target-directory "$DEST_DIR" "$SRC_FILE"
+else
+    ln -sf --target-directory "$DEST_DIR" "$SRC_FILE"
+fi
diff --git a/snap/scripts/version b/snap/scripts/version
new file mode 100755
index 0000000000..b040c255a9
--- /dev/null
+++ b/snap/scripts/version
@@ -0,0 +1,69 @@
+#!/bin/sh
+set -eu
+
+# This scripts prints the version of the snap based on the git tags and the
+# current branch. The version is determined as follows:
+#
+# The highest version tag which is prefixed with "broker-" and is merged into the
+# current branch is used as the base version.
+# If there is no such tag, "0.0.0" is used as the base version.
+#
+# If the current commit is tagged, that tag is used as the version as is.
+#
+# If the current commit is not tagged, the version is appended with the short
+# sha of the current commit. When the current branch is not "main", the version
+# is further appended with the short sha of the last commit merged from the main
+# branch.
+#
+# Finally, the version is appended with ".dirty" if there are uncommitted changes.
+
+get_version() {
+    current_branch=$(git branch --show-current)
+
+    # Get the highest version tag which is prefixed with "broker-"
+    tag=$(git -c "versionsort.suffix=-pre" tag --sort=-v:refname --merged="${current_branch}" | grep -E '^broker-' | head -n 1)
+    version="${tag}"
+
+    # Strip the "broker-" prefix
+    version="${version#broker-}"
+
+    if [ -z "${version}" ]; then
+        # No tag found, use "0.0.0"
+        version="0.0.0"
+    fi
+
+    # If the highest version tag is on the current commit, use it as is after
+    # stripping the prefix.
+    if [ -n "${tag}" ] && [ "$(git describe --tags --exact-match 2>/dev/null)" = "${tag}" ]; then
+        echo "${version}"
+        return
+    fi
+
+    # Current commit is not tagged, append commit(s) sha.
+    version="${version}+$(git rev-parse --short=7 HEAD)"
+
+    # If the current branch is not "main", append the short sha of the last commit
+    if [ "${current_branch}" = "main" ]; then
+        # Current branch is "main", return the version as is.
+        echo "${version}"
+        return
+    fi
+
+    # Get the short version of the last commit merged from the main branch.
+    last_commit_on_main=$(git rev-parse --short=7 "$(git merge-base main HEAD)")
+    echo "${version}.${last_commit_on_main}"
+}
+
+version=$(get_version)
+
+if ! "${SEMVER:-semver}" check "${version}" >/dev/null; then
+    echo "Version ${version} is not a valid semantic version."
+    exit 1
+fi
+
+# append ".dirty" if there are uncommitted changes.
+if [ -n "$(git status --porcelain)" ]; then
+    version="${version}.dirty"
+fi
+
+echo "${version}"
diff --git a/snap/variants/google/icon.svg b/snap/variants/google/icon.svg
new file mode 100644
index 0000000000..c403f80531
--- /dev/null
+++ b/snap/variants/google/icon.svg
@@ -0,0 +1,12 @@
+<svg width="60" height="60" viewBox="0 0 60 60" fill="none" xmlns="http://www.w3.org/2000/svg">
+<rect width="60" height="60" fill="#E95420"/>
+<path d="M39.8748 0H20.1255V28.1417H39.8748V0Z" fill="white"/>
+<path d="M24.8511 19.4031C25.9798 19.4031 26.8947 18.49 26.8947 17.3637C26.8947 16.2373 25.9798 15.3242 24.8511 15.3242C23.7224 15.3242 22.8074 16.2373 22.8074 17.3637C22.8074 18.49 23.7224 19.4031 24.8511 19.4031Z" fill="#E95420"/>
+<path d="M33.3638 14.9295C34.4924 14.9295 35.4074 14.0164 35.4074 12.89C35.4074 11.7637 34.4924 10.8506 33.3638 10.8506C32.2351 10.8506 31.3201 11.7637 31.3201 12.89C31.3201 14.0164 32.2351 14.9295 33.3638 14.9295Z" fill="#E95420"/>
+<path d="M29.4596 22.6125C27.9876 22.2974 26.757 21.359 26.065 20.0293C25.5204 20.2766 24.9072 20.352 24.3169 20.2436C25.1537 22.294 26.9289 23.7847 29.1081 24.2505C29.5866 24.353 30.0736 24.4021 30.5597 24.3995C30.1845 23.9075 29.9754 23.3138 29.961 22.6946C29.7924 22.676 29.6247 22.6489 29.4596 22.6133V22.6125Z" fill="#E95420"/>
+<path d="M32.9023 24.6629C34.031 24.6629 34.946 23.7498 34.946 22.6234C34.946 21.4971 34.031 20.584 32.9023 20.584C31.7736 20.584 30.8586 21.4971 30.8586 22.6234C30.8586 23.7498 31.7736 24.6629 32.9023 24.6629Z" fill="#E95420"/>
+<path d="M35.7463 21.8741C36.3823 21.0746 36.8295 20.1294 37.0455 19.1249C37.4216 17.3734 37.0701 15.5355 36.0817 14.0449C35.8462 14.598 35.4465 15.0663 34.9324 15.3882C35.4837 16.4257 35.6514 17.6233 35.4041 18.7743C35.283 19.3375 35.0696 19.8694 34.7681 20.3547C35.2491 20.7485 35.5888 21.2779 35.7463 21.8741Z" fill="#E95420"/>
+<path d="M24.6924 14.437C24.744 14.4344 24.7966 14.4327 24.8482 14.4327C25.0549 14.4327 25.2607 14.4547 25.4648 14.4979C25.7976 14.5691 26.111 14.6953 26.3981 14.8731C27.3188 13.5527 28.8035 12.76 30.4127 12.7312C30.4211 12.5771 30.4415 12.4229 30.4745 12.2722C30.5685 11.8351 30.7599 11.4269 31.0326 11.0771C28.4621 10.8739 25.9645 12.1976 24.6924 14.437Z" fill="#E95420"/>
+<path d="M16.392 41.132C15.944 41.132 15.544 41.068 15.192 40.94C14.84 40.812 14.564 40.604 14.364 40.316C14.164 40.028 14.064 39.648 14.064 39.176C14.064 38.72 14.176 38.352 14.4 38.072C14.624 37.784 14.932 37.576 15.324 37.448C15.724 37.32 16.172 37.256 16.668 37.256C16.892 37.256 17.128 37.276 17.376 37.316C17.624 37.356 17.78 37.392 17.844 37.424V37.064C17.844 36.792 17.808 36.532 17.736 36.284C17.672 36.028 17.536 35.82 17.328 35.66C17.12 35.5 16.804 35.42 16.38 35.42C15.94 35.42 15.604 35.452 15.372 35.516C15.14 35.58 14.968 35.632 14.856 35.672L14.736 34.904C14.88 34.84 15.1 34.78 15.396 34.724C15.692 34.668 16.04 34.64 16.44 34.64C17.008 34.64 17.456 34.74 17.784 34.94C18.12 35.14 18.36 35.416 18.504 35.768C18.656 36.112 18.732 36.508 18.732 36.956V40.856C18.564 40.896 18.264 40.952 17.832 41.024C17.4 41.096 16.92 41.132 16.392 41.132ZM16.524 40.364C16.804 40.364 17.056 40.356 17.28 40.34C17.504 40.316 17.692 40.288 17.844 40.256V38.168C17.764 38.128 17.628 38.088 17.436 38.048C17.244 38.008 16.996 37.988 16.692 37.988C16.436 37.988 16.176 38.016 15.912 38.072C15.648 38.128 15.424 38.24 15.24 38.408C15.064 38.576 14.976 38.828 14.976 39.164C14.976 39.612 15.116 39.924 15.396 40.1C15.676 40.276 16.052 40.364 16.524 40.364ZM23.0961 41.12C22.4721 41.12 21.9761 41.004 21.6081 40.772C21.2481 40.532 20.9881 40.196 20.8281 39.764C20.6761 39.332 20.6001 38.832 20.6001 38.264V34.784H21.5001V38.024C21.5001 38.584 21.5561 39.032 21.6681 39.368C21.7801 39.704 21.9601 39.948 22.2081 40.1C22.4641 40.244 22.8001 40.316 23.2161 40.316C23.5521 40.316 23.8481 40.3 24.1041 40.268C24.3681 40.228 24.5401 40.196 24.6201 40.172V34.784H25.5081V40.784C25.2681 40.848 24.9441 40.92 24.5361 41C24.1361 41.08 23.6561 41.12 23.0961 41.12ZM29.5555 41.132C29.0275 41.132 28.6115 41.04 28.3075 40.856C28.0035 40.672 27.7875 40.396 27.6595 40.028C27.5395 39.66 27.4795 39.2 27.4795 38.648V32.984L28.3795 32.828V34.784H30.8155V35.54H28.3795V38.72C28.3795 39.16 28.4275 39.496 28.5235 39.728C28.6275 39.96 28.7715 40.12 28.9555 40.208C29.1475 40.288 29.3715 40.328 29.6275 40.328C29.9315 40.328 30.1835 40.292 30.3835 40.22C30.5915 40.148 30.7555 40.084 30.8755 40.028L31.0675 40.76C30.9475 40.832 30.7475 40.912 30.4675 41C30.1955 41.088 29.8915 41.132 29.5555 41.132ZM32.2385 41V31.844L33.1385 31.688V34.94C33.3705 34.852 33.6145 34.784 33.8705 34.736C34.1345 34.688 34.3905 34.664 34.6385 34.664C35.2945 34.664 35.8025 34.784 36.1625 35.024C36.5225 35.264 36.7745 35.6 36.9185 36.032C37.0705 36.456 37.1465 36.952 37.1465 37.52V41H36.2465V37.772C36.2465 37.204 36.1945 36.752 36.0905 36.416C35.9865 36.08 35.8105 35.836 35.5625 35.684C35.3145 35.532 34.9665 35.456 34.5185 35.456C34.3505 35.456 34.1665 35.476 33.9665 35.516C33.7745 35.548 33.6025 35.584 33.4505 35.624C33.2985 35.664 33.1945 35.696 33.1385 35.72V41H32.2385ZM41.8059 41.144C41.1979 41.144 40.6619 41.016 40.1979 40.76C39.7339 40.496 39.3739 40.124 39.1179 39.644C38.8619 39.156 38.7339 38.576 38.7339 37.904C38.7339 37.264 38.8419 36.7 39.0579 36.212C39.2819 35.724 39.6019 35.344 40.0179 35.072C40.4419 34.792 40.9499 34.652 41.5419 34.652C41.9259 34.652 42.2619 34.708 42.5499 34.82C42.8459 34.924 43.0659 35.028 43.2099 35.132V31.844L44.0979 31.688V40.808C43.9459 40.856 43.7579 40.908 43.5339 40.964C43.3099 41.012 43.0539 41.052 42.7659 41.084C42.4859 41.124 42.1659 41.144 41.8059 41.144ZM41.8179 40.34C42.1699 40.34 42.4579 40.324 42.6819 40.292C42.9139 40.252 43.0899 40.216 43.2099 40.184V35.972C43.0739 35.86 42.8659 35.748 42.5859 35.636C42.3059 35.516 41.9899 35.456 41.6379 35.456C41.2779 35.456 40.9699 35.52 40.7139 35.648C40.4659 35.768 40.2619 35.94 40.1019 36.164C39.9499 36.388 39.8379 36.648 39.7659 36.944C39.7019 37.24 39.6699 37.556 39.6699 37.892C39.6699 38.412 39.7579 38.856 39.9339 39.224C40.1179 39.584 40.3699 39.86 40.6899 40.052C41.0179 40.244 41.3939 40.34 41.8179 40.34Z" fill="white"/>
+<path d="M7.96356 53.3226C7.35023 53.3226 6.80023 53.1826 6.31356 52.9026C5.83356 52.6226 5.45356 52.216 5.17356 51.6826C4.90023 51.1426 4.76356 50.486 4.76356 49.7126C4.76356 48.9393 4.91023 48.286 5.20356 47.7526C5.50356 47.2126 5.90023 46.8026 6.39356 46.5226C6.89356 46.2426 7.44356 46.1026 8.04356 46.1026C8.3969 46.1026 8.7069 46.1293 8.97356 46.1826C9.24023 46.236 9.4669 46.2993 9.65356 46.3726C9.84023 46.446 9.98023 46.516 10.0736 46.5826L9.82356 47.2426C9.6369 47.1093 9.38356 47.0026 9.06356 46.9226C8.75023 46.8359 8.41023 46.7926 8.04356 46.7926C7.5769 46.7926 7.1569 46.9026 6.78356 47.1226C6.4169 47.3426 6.12356 47.6693 5.90356 48.1026C5.69023 48.536 5.58356 49.0726 5.58356 49.7126C5.58356 50.306 5.6769 50.8226 5.86356 51.2626C6.05023 51.7026 6.3269 52.0426 6.69356 52.2826C7.0669 52.5226 7.5269 52.6426 8.07356 52.6426C8.39356 52.6426 8.66023 52.626 8.87356 52.5926C9.09356 52.5526 9.24356 52.5193 9.32356 52.4926V49.8626H10.1036V52.9926C9.9769 53.046 9.72356 53.1126 9.34356 53.1926C8.97023 53.2793 8.51023 53.3226 7.96356 53.3226ZM13.7044 53.3026C13.2444 53.3026 12.8344 53.1926 12.4744 52.9726C12.1144 52.746 11.8311 52.4293 11.6244 52.0226C11.4244 51.616 11.3244 51.1393 11.3244 50.5926C11.3244 50.046 11.4244 49.5726 11.6244 49.1726C11.8311 48.766 12.1144 48.4493 12.4744 48.2226C12.8344 47.996 13.2444 47.8826 13.7044 47.8826C14.1711 47.8826 14.5844 47.996 14.9444 48.2226C15.3044 48.4493 15.5844 48.766 15.7844 49.1726C15.9911 49.5726 16.0944 50.046 16.0944 50.5926C16.0944 51.1393 15.9911 51.616 15.7844 52.0226C15.5844 52.4293 15.3044 52.746 14.9444 52.9726C14.5911 53.1926 14.1778 53.3026 13.7044 53.3026ZM13.7044 52.6326C14.0378 52.6326 14.3244 52.5493 14.5644 52.3826C14.8044 52.216 14.9878 51.9793 15.1144 51.6726C15.2478 51.366 15.3144 51.006 15.3144 50.5926C15.3144 50.1793 15.2478 49.8193 15.1144 49.5126C14.9878 49.206 14.8044 48.9693 14.5644 48.8026C14.3244 48.636 14.0378 48.5526 13.7044 48.5526C13.3778 48.5526 13.0944 48.636 12.8544 48.8026C12.6144 48.9693 12.4278 49.206 12.2944 49.5126C12.1678 49.8193 12.1044 50.1793 12.1044 50.5926C12.1044 51.006 12.1678 51.366 12.2944 51.6726C12.4278 51.9793 12.6144 52.216 12.8544 52.3826C13.0944 52.5493 13.3778 52.6326 13.7044 52.6326ZM19.554 53.3026C19.094 53.3026 18.684 53.1926 18.324 52.9726C17.964 52.746 17.6807 52.4293 17.474 52.0226C17.274 51.616 17.174 51.1393 17.174 50.5926C17.174 50.046 17.274 49.5726 17.474 49.1726C17.6807 48.766 17.964 48.4493 18.324 48.2226C18.684 47.996 19.094 47.8826 19.554 47.8826C20.0207 47.8826 20.434 47.996 20.794 48.2226C21.154 48.4493 21.434 48.766 21.634 49.1726C21.8407 49.5726 21.944 50.046 21.944 50.5926C21.944 51.1393 21.8407 51.616 21.634 52.0226C21.434 52.4293 21.154 52.746 20.794 52.9726C20.4407 53.1926 20.0274 53.3026 19.554 53.3026ZM19.554 52.6326C19.8874 52.6326 20.174 52.5493 20.414 52.3826C20.654 52.216 20.8374 51.9793 20.964 51.6726C21.0974 51.366 21.164 51.006 21.164 50.5926C21.164 50.1793 21.0974 49.8193 20.964 49.5126C20.8374 49.206 20.654 48.9693 20.414 48.8026C20.174 48.636 19.8874 48.5526 19.554 48.5526C19.2274 48.5526 18.944 48.636 18.704 48.8026C18.464 48.9693 18.2774 49.206 18.144 49.5126C18.0174 49.8193 17.954 50.1793 17.954 50.5926C17.954 51.006 18.0174 51.366 18.144 51.6726C18.2774 51.9793 18.464 52.216 18.704 52.3826C18.944 52.5493 19.2274 52.6326 19.554 52.6326ZM24.9536 55.0626C24.627 55.0626 24.3236 55.036 24.0436 54.9826C23.7636 54.9293 23.5236 54.8693 23.3236 54.8026L23.4736 54.1426C23.6403 54.2093 23.8603 54.2693 24.1336 54.3226C24.407 54.3826 24.687 54.4126 24.9736 54.4126C25.3736 54.4126 25.697 54.3626 25.9436 54.2626C26.1903 54.1626 26.3703 54.0026 26.4836 53.7826C26.6036 53.5626 26.6636 53.2726 26.6636 52.9126V52.5826C26.5703 52.6493 26.4103 52.7326 26.1836 52.8326C25.957 52.926 25.667 52.9726 25.3136 52.9726C24.907 52.9726 24.527 52.8893 24.1736 52.7226C23.827 52.5493 23.547 52.2793 23.3336 51.9126C23.127 51.546 23.0236 51.066 23.0236 50.4726C23.0236 49.9793 23.1203 49.5393 23.3136 49.1526C23.5136 48.766 23.797 48.4626 24.1636 48.2426C24.537 48.016 24.9803 47.9026 25.4936 47.9026C25.9603 47.9026 26.3436 47.936 26.6436 48.0026C26.9503 48.0626 27.2003 48.1226 27.3936 48.1826V52.8726C27.3936 53.6526 27.1903 54.2126 26.7836 54.5526C26.3836 54.8926 25.7736 55.0626 24.9536 55.0626ZM25.3436 52.3126C25.617 52.3126 25.8703 52.2726 26.1036 52.1926C26.3436 52.1126 26.527 52.0193 26.6536 51.9126V48.6926C26.547 48.6593 26.407 48.6293 26.2336 48.6026C26.0603 48.576 25.817 48.5626 25.5036 48.5626C25.1436 48.5626 24.837 48.6426 24.5836 48.8026C24.3303 48.9626 24.137 49.1893 24.0036 49.4826C23.8703 49.7693 23.8036 50.1026 23.8036 50.4826C23.8036 50.8093 23.847 51.0893 23.9336 51.3226C24.0203 51.556 24.137 51.746 24.2836 51.8926C24.4303 52.0393 24.5936 52.146 24.7736 52.2126C24.9603 52.2793 25.1503 52.3126 25.3436 52.3126ZM30.4756 53.2726C30.1556 53.2593 29.8889 53.206 29.6756 53.1126C29.4689 53.0193 29.3156 52.876 29.2156 52.6826C29.1156 52.4826 29.0656 52.216 29.0656 51.8826V45.5526L29.8156 45.4226V51.8326C29.8156 52.1526 29.8723 52.3593 29.9856 52.4526C30.1056 52.546 30.3056 52.6126 30.5856 52.6526L30.4756 53.2726ZM33.9628 53.2926C33.3561 53.2926 32.8628 53.176 32.4828 52.9426C32.1094 52.7093 31.8328 52.3893 31.6528 51.9826C31.4794 51.576 31.3928 51.1126 31.3928 50.5926C31.3928 49.986 31.5028 49.4826 31.7228 49.0826C31.9428 48.6826 32.2261 48.3826 32.5728 48.1826C32.9261 47.9826 33.2961 47.8826 33.6828 47.8826C34.1161 47.8826 34.4895 47.976 34.8028 48.1626C35.1228 48.3426 35.3695 48.6226 35.5428 49.0026C35.7161 49.376 35.8028 49.8526 35.8028 50.4326C35.8028 50.4793 35.7995 50.536 35.7928 50.6026C35.7928 50.6626 35.7895 50.7193 35.7828 50.7726H32.1728C32.1994 51.3593 32.3561 51.816 32.6428 52.1426C32.9361 52.4626 33.3894 52.6226 34.0028 52.6226C34.3428 52.6226 34.6195 52.5926 34.8328 52.5326C35.0528 52.466 35.2095 52.4093 35.3028 52.3626L35.4328 52.9926C35.3395 53.046 35.1561 53.1093 34.8828 53.1826C34.6161 53.256 34.3094 53.2926 33.9628 53.2926ZM32.1928 50.1626H35.0428C35.0361 49.8226 34.9794 49.5326 34.8728 49.2926C34.7661 49.046 34.6128 48.8593 34.4128 48.7326C34.2195 48.5993 33.9795 48.5326 33.6928 48.5326C33.3994 48.5326 33.1428 48.6093 32.9228 48.7626C32.7028 48.916 32.5294 49.116 32.4028 49.3626C32.2828 49.6093 32.2128 49.876 32.1928 50.1626ZM39.5455 53.1826V46.2526H40.3255V53.1826H39.5455ZM41.3141 53.1826C41.6741 52.216 42.0041 51.336 42.3041 50.5426C42.6041 49.7493 42.8974 49.006 43.1841 48.3126C43.4774 47.6126 43.7874 46.926 44.1141 46.2526H44.8141C45.0541 46.7593 45.2841 47.2726 45.5041 47.7926C45.7308 48.306 45.9541 48.8393 46.1741 49.3926C46.3941 49.946 46.6208 50.536 46.8541 51.1626C47.0941 51.7826 47.3474 52.456 47.6141 53.1826H46.7641C46.6441 52.8493 46.5274 52.5326 46.4141 52.2326C46.3008 51.926 46.1941 51.626 46.0941 51.3326H42.7941C42.6874 51.626 42.5774 51.926 42.4641 52.2326C42.3508 52.5326 42.2374 52.8493 42.1241 53.1826H41.3141ZM43.0241 50.6726H45.8641C45.7374 50.3393 45.6141 50.016 45.4941 49.7026C45.3741 49.3893 45.2541 49.086 45.1341 48.7926C45.0208 48.4993 44.9041 48.216 44.7841 47.9426C44.6708 47.6626 44.5541 47.3893 44.4341 47.1226C44.3208 47.3893 44.2041 47.6626 44.0841 47.9426C43.9708 48.216 43.8541 48.4993 43.7341 48.7926C43.6208 49.086 43.5041 49.3893 43.3841 49.7026C43.2641 50.016 43.1441 50.3393 43.0241 50.6726ZM48.438 53.1826C48.4647 52.5693 48.4947 51.9593 48.528 51.3526C48.5614 50.746 48.598 50.1526 48.638 49.5726C48.678 48.986 48.7214 48.416 48.768 47.8626C48.8147 47.3026 48.868 46.766 48.928 46.2526H49.628C49.8214 46.5726 50.0247 46.946 50.238 47.3726C50.458 47.7926 50.678 48.236 50.898 48.7026C51.118 49.1626 51.328 49.616 51.528 50.0626C51.7347 50.5093 51.918 50.9126 52.078 51.2726C52.238 50.9126 52.418 50.5093 52.618 50.0626C52.8247 49.616 53.038 49.1626 53.258 48.7026C53.478 48.236 53.698 47.7926 53.918 47.3726C54.138 46.946 54.3414 46.5726 54.528 46.2526H55.188C55.248 46.766 55.3014 47.3026 55.348 47.8626C55.4014 48.416 55.4447 48.986 55.478 49.5726C55.518 50.1526 55.5547 50.746 55.588 51.3526C55.628 51.9593 55.6614 52.5693 55.688 53.1826H54.908C54.8814 52.5026 54.8514 51.836 54.818 51.1826C54.7914 50.5226 54.758 49.886 54.718 49.2726C54.678 48.6593 54.6314 48.0793 54.578 47.5326C54.5114 47.6593 54.4047 47.8693 54.258 48.1626C54.118 48.4493 53.958 48.7826 53.778 49.1626C53.598 49.536 53.4147 49.9193 53.228 50.3126C53.048 50.706 52.8814 51.0693 52.728 51.4026C52.5814 51.736 52.468 51.9993 52.388 52.1926H51.718C51.638 51.9993 51.5214 51.736 51.368 51.4026C51.2214 51.0693 51.0547 50.706 50.868 50.3126C50.688 49.9193 50.508 49.536 50.328 49.1626C50.148 48.7826 49.9847 48.4493 49.838 48.1626C49.698 47.8693 49.5947 47.6593 49.528 47.5326C49.4747 48.0793 49.428 48.6593 49.388 49.2726C49.348 49.886 49.3114 50.5226 49.278 51.1826C49.2514 51.836 49.2247 52.5026 49.198 53.1826H48.438Z" fill="white"/>
+</svg>
diff --git a/snap/variants/google/snapcraft.yaml b/snap/variants/google/snapcraft.yaml
new file mode 100644
index 0000000000..8ab2247580
--- /dev/null
+++ b/snap/variants/google/snapcraft.yaml
@@ -0,0 +1,102 @@
+name: authd-google
+summary: authd - Google IAM Cloud Authentication for Ubuntu
+description: |
+  authd is a powerful authentication service for Ubuntu, designed to integrate with cloud identity providers like
+  Google IAM. It delivers a secure, flexible solution for organizations and individuals who are transitioning
+  to cloud-based identity management on Ubuntu workstations and servers.
+  authd uses the OAuth Device Authorization Grant and ensures a consistent and secure login experience across
+  Ubuntu Desktop and Server — whether through GDM, SSH, or network services like NFS and Samba.
+
+  Key Features
+  * Cloud identity provider integration: Connects with Google IAM
+  * Secure login: authd leverages the OAuth Device Authorization Grant RFC 8628-compliant workflows for reliability
+    and security.
+  * Open-source: Free and community-driven, with contributions welcomed.
+  * Enterprise ready: Ubuntu Pro customers will benefit from the same expanded security and support guarantees.
+  * authd is free for all Ubuntu Desktop and Server 24.04 LTS users and is under active development.
+    Explore the official documentation for installation and configuration steps, or visit the GitHub repository to
+    contribute or provide feedback.
+icon: snap/variants/google/icon.svg
+website:
+  - https://github.com/ubuntu/authd-oidc-brokers
+  - https://github.com/ubuntu/authd
+issues: https://github.com/ubuntu/authd/issues
+source-code: https://github.com/ubuntu/authd-oidc-brokers/tree/google
+adopt-info: version
+grade: stable
+base: core24
+confinement: strict
+license: GPL-3.0
+
+apps:
+  authd-google:
+    command: bin/authd-google
+    daemon: dbus
+    slots:
+      - dbus-authd
+    plugs:
+      - network
+    restart-condition: always
+    activates-on: [dbus-authd]
+    environment:
+      SYSLOG_IDENTIFIER: authd-google
+
+slots:
+  dbus-authd:
+    interface: dbus
+    bus: system
+    name: com.ubuntu.authd.Google
+
+parts:
+  broker:
+    source: authd-oidc-brokers
+    source-type: local
+    plugin: nil
+    build-snaps:
+      - go
+    build-environment:
+      - GOFLAGS: "-tags=release"
+      - GOBIN: ${CRAFT_PART_INSTALL}/bin
+    override-build: |
+      go mod download all
+      go mod vendor
+      VERSION=$(craftctl get version)
+      export GOFLAGS="-ldflags=-X=github.com/ubuntu/authd-oidc-brokers/internal/consts.Version=${VERSION}"
+      go build -tags=withgoogle -o ${GOBIN}/authd-google ./cmd/authd-oidc
+    after:
+      - version
+  config:
+    source: authd-oidc-brokers/conf/
+    source-type: local
+    plugin: dump
+    organize:
+      "variants/google/authd.conf": "conf/authd/google.conf"
+      "variants/google/broker.conf": "conf/broker.conf.orig"
+      "migrations": "conf/migrations"
+    stage:
+      - conf
+  # SemVer comparison helper
+  semver:
+    source: authd-oidc-brokers/tools
+    source-type: local
+    plugin: nil
+    build-snaps:
+      - go
+    build-environment:
+      - GOBIN: ${CRAFT_PART_INSTALL}/bin
+    override-build: |
+      go mod download all
+      go mod vendor
+      go build -o ${GOBIN}/semver semver/semver.go
+  # Build the snap version from the git repository and current tree state.
+  version:
+    source: .
+    plugin: nil
+    build-packages:
+      - git # The script needs Git.
+    override-build: |
+      if [ -z "$(craftctl get version)" ]; then
+        craftctl set version="$(./snap/scripts/version)"
+      fi
+    after:
+      - semver
diff --git a/snap/variants/msentraid/icon.svg b/snap/variants/msentraid/icon.svg
new file mode 100644
index 0000000000..530931441a
--- /dev/null
+++ b/snap/variants/msentraid/icon.svg
@@ -0,0 +1,19 @@
+<svg width="60" height="60" viewBox="0 0 60 60" fill="none" xmlns="http://www.w3.org/2000/svg">
+<g clip-path="url(#clip0_16_191)">
+<rect width="60" height="60" fill="#E95420"/>
+<path d="M39.8746 -5.75391H20.1254V28.1417H39.8746V-5.75391Z" fill="white"/>
+<path d="M16.392 41.132C15.944 41.132 15.544 41.068 15.192 40.94C14.84 40.812 14.564 40.604 14.364 40.316C14.164 40.028 14.064 39.648 14.064 39.176C14.064 38.72 14.176 38.352 14.4 38.072C14.624 37.784 14.932 37.576 15.324 37.448C15.724 37.32 16.172 37.256 16.668 37.256C16.892 37.256 17.128 37.276 17.376 37.316C17.624 37.356 17.78 37.392 17.844 37.424V37.064C17.844 36.792 17.808 36.532 17.736 36.284C17.672 36.028 17.536 35.82 17.328 35.66C17.12 35.5 16.804 35.42 16.38 35.42C15.94 35.42 15.604 35.452 15.372 35.516C15.14 35.58 14.968 35.632 14.856 35.672L14.736 34.904C14.88 34.84 15.1 34.78 15.396 34.724C15.692 34.668 16.04 34.64 16.44 34.64C17.008 34.64 17.456 34.74 17.784 34.94C18.12 35.14 18.36 35.416 18.504 35.768C18.656 36.112 18.732 36.508 18.732 36.956V40.856C18.564 40.896 18.264 40.952 17.832 41.024C17.4 41.096 16.92 41.132 16.392 41.132ZM16.524 40.364C16.804 40.364 17.056 40.356 17.28 40.34C17.504 40.316 17.692 40.288 17.844 40.256V38.168C17.764 38.128 17.628 38.088 17.436 38.048C17.244 38.008 16.996 37.988 16.692 37.988C16.436 37.988 16.176 38.016 15.912 38.072C15.648 38.128 15.424 38.24 15.24 38.408C15.064 38.576 14.976 38.828 14.976 39.164C14.976 39.612 15.116 39.924 15.396 40.1C15.676 40.276 16.052 40.364 16.524 40.364ZM23.0961 41.12C22.4721 41.12 21.9761 41.004 21.6081 40.772C21.2481 40.532 20.9881 40.196 20.8281 39.764C20.6761 39.332 20.6001 38.832 20.6001 38.264V34.784H21.5001V38.024C21.5001 38.584 21.5561 39.032 21.6681 39.368C21.7801 39.704 21.9601 39.948 22.2081 40.1C22.4641 40.244 22.8001 40.316 23.2161 40.316C23.5521 40.316 23.8481 40.3 24.1041 40.268C24.3681 40.228 24.5401 40.196 24.6201 40.172V34.784H25.5081V40.784C25.2681 40.848 24.9441 40.92 24.5361 41C24.1361 41.08 23.6561 41.12 23.0961 41.12ZM29.5555 41.132C29.0275 41.132 28.6115 41.04 28.3075 40.856C28.0035 40.672 27.7875 40.396 27.6595 40.028C27.5395 39.66 27.4795 39.2 27.4795 38.648V32.984L28.3795 32.828V34.784H30.8155V35.54H28.3795V38.72C28.3795 39.16 28.4275 39.496 28.5235 39.728C28.6275 39.96 28.7715 40.12 28.9555 40.208C29.1475 40.288 29.3715 40.328 29.6275 40.328C29.9315 40.328 30.1835 40.292 30.3835 40.22C30.5915 40.148 30.7555 40.084 30.8755 40.028L31.0675 40.76C30.9475 40.832 30.7475 40.912 30.4675 41C30.1955 41.088 29.8915 41.132 29.5555 41.132ZM32.2385 41V31.844L33.1385 31.688V34.94C33.3705 34.852 33.6145 34.784 33.8705 34.736C34.1345 34.688 34.3905 34.664 34.6385 34.664C35.2945 34.664 35.8025 34.784 36.1625 35.024C36.5225 35.264 36.7745 35.6 36.9185 36.032C37.0705 36.456 37.1465 36.952 37.1465 37.52V41H36.2465V37.772C36.2465 37.204 36.1945 36.752 36.0905 36.416C35.9865 36.08 35.8105 35.836 35.5625 35.684C35.3145 35.532 34.9665 35.456 34.5185 35.456C34.3505 35.456 34.1665 35.476 33.9665 35.516C33.7745 35.548 33.6025 35.584 33.4505 35.624C33.2985 35.664 33.1945 35.696 33.1385 35.72V41H32.2385ZM41.8059 41.144C41.1979 41.144 40.6619 41.016 40.1979 40.76C39.7339 40.496 39.3739 40.124 39.1179 39.644C38.8619 39.156 38.7339 38.576 38.7339 37.904C38.7339 37.264 38.8419 36.7 39.0579 36.212C39.2819 35.724 39.6019 35.344 40.0179 35.072C40.4419 34.792 40.9499 34.652 41.5419 34.652C41.9259 34.652 42.2619 34.708 42.5499 34.82C42.8459 34.924 43.0659 35.028 43.2099 35.132V31.844L44.0979 31.688V40.808C43.9459 40.856 43.7579 40.908 43.5339 40.964C43.3099 41.012 43.0539 41.052 42.7659 41.084C42.4859 41.124 42.1659 41.144 41.8059 41.144ZM41.8179 40.34C42.1699 40.34 42.4579 40.324 42.6819 40.292C42.9139 40.252 43.0899 40.216 43.2099 40.184V35.972C43.0739 35.86 42.8659 35.748 42.5859 35.636C42.3059 35.516 41.9899 35.456 41.6379 35.456C41.2779 35.456 40.9699 35.52 40.7139 35.648C40.4659 35.768 40.2619 35.94 40.1019 36.164C39.9499 36.388 39.8379 36.648 39.7659 36.944C39.7019 37.24 39.6699 37.556 39.6699 37.892C39.6699 38.412 39.7579 38.856 39.9339 39.224C40.1179 39.584 40.3699 39.86 40.6899 40.052C41.0179 40.244 41.3939 40.34 41.8179 40.34Z" fill="white"/>
+<path d="M6.864 53.1826C6.896 52.4466 6.932 51.7146 6.972 50.9866C7.012 50.2586 7.056 49.5466 7.104 48.8506C7.152 48.1466 7.204 47.4626 7.26 46.7986C7.316 46.1266 7.38 45.4826 7.452 44.8666H8.292C8.524 45.2506 8.768 45.6986 9.024 46.2106C9.288 46.7146 9.552 47.2466 9.816 47.8066C10.08 48.3586 10.332 48.9026 10.572 49.4386C10.82 49.9746 11.04 50.4586 11.232 50.8906C11.424 50.4586 11.64 49.9746 11.88 49.4386C12.128 48.9026 12.384 48.3586 12.648 47.8066C12.912 47.2466 13.176 46.7146 13.44 46.2106C13.704 45.6986 13.948 45.2506 14.172 44.8666H14.964C15.036 45.4826 15.1 46.1266 15.156 46.7986C15.22 47.4626 15.272 48.1466 15.312 48.8506C15.36 49.5466 15.404 50.2586 15.444 50.9866C15.492 51.7146 15.532 52.4466 15.564 53.1826H14.628C14.596 52.3666 14.56 51.5666 14.52 50.7826C14.488 49.9906 14.448 49.2266 14.4 48.4906C14.352 47.7546 14.296 47.0586 14.232 46.4026C14.152 46.5546 14.024 46.8066 13.848 47.1586C13.68 47.5026 13.488 47.9026 13.272 48.3586C13.056 48.8066 12.836 49.2666 12.612 49.7386C12.396 50.2106 12.196 50.6466 12.012 51.0466C11.836 51.4466 11.7 51.7626 11.604 51.9946H10.8C10.704 51.7626 10.564 51.4466 10.38 51.0466C10.204 50.6466 10.004 50.2106 9.78 49.7386C9.564 49.2666 9.348 48.8066 9.132 48.3586C8.916 47.9026 8.72 47.5026 8.544 47.1586C8.376 46.8066 8.252 46.5546 8.172 46.4026C8.108 47.0586 8.052 47.7546 8.004 48.4906C7.956 49.2266 7.912 49.9906 7.872 50.7826C7.84 51.5666 7.808 52.3666 7.776 53.1826H6.864ZM19.3337 53.3626C18.6857 53.3626 18.1457 53.2906 17.7137 53.1466C17.2897 53.0026 16.9977 52.8826 16.8377 52.7866L17.1377 51.9946C17.3057 52.0906 17.5737 52.2066 17.9417 52.3426C18.3177 52.4786 18.7817 52.5466 19.3337 52.5466C19.9657 52.5466 20.4537 52.4346 20.7977 52.2106C21.1417 51.9786 21.3137 51.6146 21.3137 51.1186C21.3137 50.7346 21.2177 50.4346 21.0257 50.2186C20.8417 49.9946 20.5937 49.8146 20.2817 49.6786C19.9777 49.5346 19.6417 49.3906 19.2737 49.2466C18.8257 49.0706 18.4337 48.8866 18.0977 48.6946C17.7697 48.4946 17.5137 48.2546 17.3297 47.9746C17.1537 47.6866 17.0657 47.3266 17.0657 46.8946C17.0657 46.4146 17.1737 46.0106 17.3897 45.6826C17.6057 45.3546 17.9177 45.1066 18.3257 44.9386C18.7337 44.7706 19.2177 44.6866 19.7777 44.6866C20.2417 44.6866 20.6697 44.7466 21.0617 44.8666C21.4617 44.9786 21.7697 45.1026 21.9857 45.2386L21.6737 46.0186C21.4417 45.8586 21.1577 45.7306 20.8217 45.6346C20.4937 45.5386 20.1417 45.4906 19.7657 45.4906C19.2537 45.4906 18.8337 45.5946 18.5057 45.8026C18.1777 46.0106 18.0137 46.3506 18.0137 46.8226C18.0137 47.1426 18.0937 47.4026 18.2537 47.6026C18.4137 47.8026 18.6337 47.9706 18.9137 48.1066C19.1937 48.2426 19.5097 48.3826 19.8617 48.5266C20.3177 48.7026 20.7257 48.8906 21.0857 49.0906C21.4537 49.2826 21.7457 49.5346 21.9617 49.8466C22.1777 50.1506 22.2857 50.5626 22.2857 51.0826C22.2857 51.5866 22.1657 52.0066 21.9257 52.3426C21.6857 52.6786 21.3457 52.9346 20.9057 53.1106C20.4657 53.2786 19.9417 53.3626 19.3337 53.3626ZM26.5328 53.1826V44.8666H31.4288V45.6706H27.4688V48.4186H30.9968V49.2106H27.4688V52.3786H31.7288V53.1826H26.5328ZM33.1994 53.1826V47.1826C33.4474 47.1186 33.7714 47.0466 34.1714 46.9666C34.5714 46.8866 35.0514 46.8466 35.6114 46.8466C36.2594 46.8466 36.7634 46.9666 37.1234 47.2066C37.4834 47.4466 37.7354 47.7826 37.8794 48.2146C38.0314 48.6386 38.1074 49.1346 38.1074 49.7026V53.1826H37.2074V49.9546C37.2074 49.3866 37.1554 48.9346 37.0514 48.5986C36.9474 48.2626 36.7714 48.0186 36.5234 47.8666C36.2754 47.7146 35.9314 47.6386 35.4914 47.6386C35.1554 47.6386 34.8594 47.6586 34.6034 47.6986C34.3474 47.7386 34.1794 47.7706 34.0994 47.7946V53.1826H33.1994ZM42.0829 53.3146C41.5549 53.3146 41.1389 53.2226 40.8349 53.0386C40.5309 52.8546 40.3149 52.5786 40.1869 52.2106C40.0669 51.8426 40.0069 51.3826 40.0069 50.8306V45.1666L40.9069 45.0106V46.9666H43.3429V47.7226H40.9069V50.9026C40.9069 51.3426 40.9549 51.6786 41.0509 51.9106C41.1549 52.1426 41.2989 52.3026 41.4829 52.3906C41.6749 52.4706 41.8989 52.5106 42.1549 52.5106C42.4589 52.5106 42.7109 52.4746 42.9109 52.4026C43.1189 52.3306 43.2829 52.2666 43.4029 52.2106L43.5949 52.9426C43.4749 53.0146 43.2749 53.0946 42.9949 53.1826C42.7229 53.2706 42.4189 53.3146 42.0829 53.3146ZM44.7658 53.1826V47.2546C44.9738 47.1666 45.2578 47.0786 45.6178 46.9906C45.9858 46.8946 46.4258 46.8466 46.9378 46.8466C47.1058 46.8466 47.2698 46.8586 47.4298 46.8826C47.5978 46.8986 47.7458 46.9226 47.8738 46.9546C48.0098 46.9786 48.1098 47.0026 48.1738 47.0266L47.9938 47.7946C47.9218 47.7626 47.7858 47.7306 47.5858 47.6986C47.3858 47.6586 47.1298 47.6386 46.8178 47.6386C46.5138 47.6386 46.2618 47.6626 46.0618 47.7106C45.8618 47.7506 45.7298 47.7866 45.6658 47.8186V53.1826H44.7658ZM51.185 53.3146C50.737 53.3146 50.337 53.2506 49.985 53.1226C49.633 52.9946 49.357 52.7866 49.157 52.4986C48.957 52.2106 48.857 51.8306 48.857 51.3586C48.857 50.9026 48.969 50.5346 49.193 50.2546C49.417 49.9666 49.725 49.7586 50.117 49.6306C50.517 49.5026 50.965 49.4386 51.461 49.4386C51.685 49.4386 51.921 49.4586 52.169 49.4986C52.417 49.5386 52.573 49.5746 52.637 49.6066V49.2466C52.637 48.9746 52.601 48.7146 52.529 48.4666C52.465 48.2106 52.329 48.0026 52.121 47.8426C51.913 47.6826 51.597 47.6026 51.173 47.6026C50.733 47.6026 50.397 47.6346 50.165 47.6986C49.933 47.7626 49.761 47.8146 49.649 47.8546L49.529 47.0866C49.673 47.0226 49.893 46.9626 50.189 46.9066C50.485 46.8506 50.833 46.8226 51.233 46.8226C51.801 46.8226 52.249 46.9226 52.577 47.1226C52.913 47.3226 53.153 47.5986 53.297 47.9506C53.449 48.2946 53.525 48.6906 53.525 49.1386V53.0386C53.357 53.0786 53.057 53.1346 52.625 53.2066C52.193 53.2786 51.713 53.3146 51.185 53.3146ZM51.317 52.5466C51.597 52.5466 51.849 52.5386 52.073 52.5226C52.297 52.4986 52.485 52.4706 52.637 52.4386V50.3506C52.557 50.3106 52.421 50.2706 52.229 50.2306C52.037 50.1906 51.789 50.1706 51.485 50.1706C51.229 50.1706 50.969 50.1986 50.705 50.2546C50.441 50.3106 50.217 50.4226 50.033 50.5906C49.857 50.7586 49.769 51.0106 49.769 51.3466C49.769 51.7946 49.909 52.1066 50.189 52.2826C50.469 52.4586 50.845 52.5466 51.317 52.5466Z" fill="white"/>
+<path d="M24.851 19.4031C25.9797 19.4031 26.8947 18.49 26.8947 17.3637C26.8947 16.2373 25.9797 15.3242 24.851 15.3242C23.7223 15.3242 22.8074 16.2373 22.8074 17.3637C22.8074 18.49 23.7223 19.4031 24.851 19.4031Z" fill="#E95420"/>
+<path d="M33.3637 14.9295C34.4924 14.9295 35.4074 14.0164 35.4074 12.89C35.4074 11.7637 34.4924 10.8506 33.3637 10.8506C32.235 10.8506 31.3201 11.7637 31.3201 12.89C31.3201 14.0164 32.235 14.9295 33.3637 14.9295Z" fill="#E95420"/>
+<path d="M29.4595 22.6125C27.9876 22.2974 26.7569 21.359 26.065 20.0293C25.5204 20.2766 24.9072 20.352 24.3169 20.2436C25.1537 22.294 26.9289 23.7847 29.1081 24.2505C29.5866 24.353 30.0736 24.4021 30.5597 24.3995C30.1845 23.9075 29.9753 23.3138 29.9609 22.6946C29.7924 22.676 29.6247 22.6489 29.4595 22.6133V22.6125Z" fill="#E95420"/>
+<path d="M32.9023 24.6629C34.031 24.6629 34.946 23.7498 34.946 22.6234C34.946 21.4971 34.031 20.584 32.9023 20.584C31.7736 20.584 30.8586 21.4971 30.8586 22.6234C30.8586 23.7498 31.7736 24.6629 32.9023 24.6629Z" fill="#E95420"/>
+<path d="M35.7463 21.8741C36.3823 21.0746 36.8295 20.1294 37.0455 19.1249C37.4215 17.3734 37.0701 15.5355 36.0817 14.0449C35.8462 14.598 35.4465 15.0663 34.9324 15.3882C35.4837 16.4257 35.6514 17.6233 35.4041 18.7743C35.283 19.3375 35.0696 19.8694 34.7681 20.3547C35.2491 20.7485 35.5887 21.2779 35.7463 21.8741Z" fill="#E95420"/>
+<path d="M24.6924 14.437C24.744 14.4344 24.7965 14.4327 24.8482 14.4327C25.0549 14.4327 25.2607 14.4547 25.4648 14.4979C25.7976 14.5691 26.111 14.6953 26.3981 14.8731C27.3188 13.5527 28.8035 12.76 30.4127 12.7312C30.4211 12.5771 30.4414 12.4229 30.4745 12.2722C30.5685 11.8351 30.7599 11.4269 31.0326 11.0771C28.4621 10.8739 25.9645 12.1976 24.6924 14.437Z" fill="#E95420"/>
+</g>
+<defs>
+<clipPath id="clip0_16_191">
+<rect width="60" height="60" fill="white"/>
+</clipPath>
+</defs>
+</svg>
diff --git a/snap/variants/msentraid/snapcraft.yaml b/snap/variants/msentraid/snapcraft.yaml
new file mode 100644
index 0000000000..d4e957f677
--- /dev/null
+++ b/snap/variants/msentraid/snapcraft.yaml
@@ -0,0 +1,125 @@
+name: authd-msentraid
+summary: authd - Microsoft Entra ID Cloud Authentication for Ubuntu
+description: |
+  authd is a powerful authentication service for Ubuntu, designed to integrate with cloud identity providers like
+  Microsoft Entra ID. It delivers a secure, flexible solution for organizations and individuals who are transitioning
+  to cloud-based identity management on Ubuntu workstations and servers.
+  authd uses the OAuth Device Authorization Grant and ensures a consistent and secure login experience across
+  Ubuntu Desktop and Server — whether through GDM, SSH, or network services like NFS and Samba.
+
+  Key Features
+  * Cloud identity provider integration: Connects with Microsoft Entra ID
+  * Secure login: authd leverages the OAuth Device Authorization Grant RFC 8628-compliant workflows for reliability
+    and security.
+  * Open-source: Free and community-driven, with contributions welcomed.
+  * Enterprise ready: Ubuntu Pro customers will benefit from the same expanded security and support guarantees.
+  * authd is free for all Ubuntu Desktop and Server 24.04 LTS users and is under active development.
+    Explore the official documentation for installation and configuration steps, or visit the GitHub repository to
+    contribute or provide feedback.
+icon: snap/variants/msentraid/icon.svg
+website:
+  - https://github.com/ubuntu/authd-oidc-brokers
+  - https://github.com/ubuntu/authd
+issues: https://github.com/ubuntu/authd/issues
+source-code: https://github.com/ubuntu/authd-oidc-brokers/tree/msentraid
+adopt-info: version
+grade: stable
+base: core24
+confinement: strict
+license: GPL-3.0
+
+apps:
+  authd-msentraid:
+    command: bin/authd-msentraid
+    daemon: dbus
+    slots:
+      - dbus-authd
+    plugs:
+      - network
+    restart-condition: always
+    activates-on: [dbus-authd]
+    environment:
+      SYSLOG_IDENTIFIER: authd-msentraid
+
+slots:
+  dbus-authd:
+    interface: dbus
+    bus: system
+    name: com.ubuntu.authd.MSEntraID
+
+parts:
+  libhimmelblau:
+    source: ./authd-oidc-brokers/third_party/libhimmelblau
+    plugin: rust
+    build-packages:
+      - libssl-dev
+    override-pull: |
+      snapcraftctl pull
+      cp "$SNAPCRAFT_PROJECT_DIR/authd-oidc-brokers/rust-toolchain.toml" "$SNAPCRAFT_PART_SRC/"
+    override-build: |
+      cargo install cargo-c
+      cargo cbuild --release --lib --features=broker,changepassword,on_behalf_of
+      echo "Installing libhimmelblau.so and himmelblau.h"
+      TARGET_TRIPLE=$(rustc -vV | awk '/host:/ {print $2}')
+      install -D target/${TARGET_TRIPLE}/release/libhimmelblau.so ${CRAFT_PART_INSTALL}/lib/libhimmelblau.so.0
+      ln -s libhimmelblau.so.0 ${CRAFT_PART_INSTALL}/lib/libhimmelblau.so
+      install -D target/${TARGET_TRIPLE}/release/himmelblau.h ${CRAFT_PART_INSTALL}/include/himmelblau.h
+    prime:
+      - -include/**
+      - -lib/**.so
+  broker:
+    source: authd-oidc-brokers
+    source-type: local
+    plugin: nil
+    build-snaps:
+      - go
+    after:
+      - libhimmelblau
+      - version
+    build-environment:
+      - GOFLAGS: "-tags=release"
+      # Add libhimmelblau to the CFLAGS and LDFLAGS so that it can be found by the Go linker.
+      - CGO_CFLAGS: -I${CRAFT_STAGE}/include
+      - CGO_LDFLAGS: -L${CRAFT_STAGE}/lib -lhimmelblau
+      - GOBIN: ${CRAFT_PART_INSTALL}/bin
+    override-build: |
+      go mod download all
+      go mod vendor
+      VERSION=$(craftctl get version)
+      export GOFLAGS="-ldflags=-X=github.com/ubuntu/authd-oidc-brokers/internal/consts.Version=${VERSION}"
+      go build -tags=withmsentraid -o ${GOBIN}/authd-msentraid ./cmd/authd-oidc
+  config:
+    source: authd-oidc-brokers/conf/
+    source-type: local
+    plugin: dump
+    organize:
+      "variants/msentraid/authd.conf": "conf/authd/msentraid.conf"
+      "variants/msentraid/broker.conf": "conf/broker.conf.orig"
+      "migrations": "conf/migrations"
+    stage:
+      - conf
+  # SemVer comparison helper
+  semver:
+    source: authd-oidc-brokers/tools
+    source-type: local
+    plugin: nil
+    build-snaps:
+      - go
+    build-environment:
+      - GOBIN: ${CRAFT_PART_INSTALL}/bin
+    override-build: |
+      go mod download all
+      go mod vendor
+      go build -o ${GOBIN}/semver semver/semver.go
+  # Build the snap version from the git repository and current tree state.
+  version:
+    source: .
+    plugin: nil
+    build-packages:
+      - git # The script needs Git.
+    override-build: |
+      if [ -z "$(craftctl get version)" ]; then
+        craftctl set version="$(./snap/scripts/version)"
+      fi
+    after:
+      - semver
diff --git a/snap/variants/oidc/icon.svg b/snap/variants/oidc/icon.svg
new file mode 100644
index 0000000000..dc42f956ed
--- /dev/null
+++ b/snap/variants/oidc/icon.svg
@@ -0,0 +1,19 @@
+<svg width="60" height="60" viewBox="0 0 60 60" fill="none" xmlns="http://www.w3.org/2000/svg">
+<g clip-path="url(#clip0_16_206)">
+<rect width="60" height="60" fill="#E95420"/>
+<path d="M39.8746 -5.75391H20.1254V28.1417H39.8746V-5.75391Z" fill="white"/>
+<path d="M16.892 41.132C16.444 41.132 16.044 41.068 15.692 40.94C15.34 40.812 15.064 40.604 14.864 40.316C14.664 40.028 14.564 39.648 14.564 39.176C14.564 38.72 14.676 38.352 14.9 38.072C15.124 37.784 15.432 37.576 15.824 37.448C16.224 37.32 16.672 37.256 17.168 37.256C17.392 37.256 17.628 37.276 17.876 37.316C18.124 37.356 18.28 37.392 18.344 37.424V37.064C18.344 36.792 18.308 36.532 18.236 36.284C18.172 36.028 18.036 35.82 17.828 35.66C17.62 35.5 17.304 35.42 16.88 35.42C16.44 35.42 16.104 35.452 15.872 35.516C15.64 35.58 15.468 35.632 15.356 35.672L15.236 34.904C15.38 34.84 15.6 34.78 15.896 34.724C16.192 34.668 16.54 34.64 16.94 34.64C17.508 34.64 17.956 34.74 18.284 34.94C18.62 35.14 18.86 35.416 19.004 35.768C19.156 36.112 19.232 36.508 19.232 36.956V40.856C19.064 40.896 18.764 40.952 18.332 41.024C17.9 41.096 17.42 41.132 16.892 41.132ZM17.024 40.364C17.304 40.364 17.556 40.356 17.78 40.34C18.004 40.316 18.192 40.288 18.344 40.256V38.168C18.264 38.128 18.128 38.088 17.936 38.048C17.744 38.008 17.496 37.988 17.192 37.988C16.936 37.988 16.676 38.016 16.412 38.072C16.148 38.128 15.924 38.24 15.74 38.408C15.564 38.576 15.476 38.828 15.476 39.164C15.476 39.612 15.616 39.924 15.896 40.1C16.176 40.276 16.552 40.364 17.024 40.364ZM23.5961 41.12C22.9721 41.12 22.4761 41.004 22.1081 40.772C21.7481 40.532 21.4881 40.196 21.3281 39.764C21.1761 39.332 21.1001 38.832 21.1001 38.264V34.784H22.0001V38.024C22.0001 38.584 22.0561 39.032 22.1681 39.368C22.2801 39.704 22.4601 39.948 22.7081 40.1C22.9641 40.244 23.3001 40.316 23.7161 40.316C24.0521 40.316 24.3481 40.3 24.6041 40.268C24.8681 40.228 25.0401 40.196 25.1201 40.172V34.784H26.0081V40.784C25.7681 40.848 25.4441 40.92 25.0361 41C24.6361 41.08 24.1561 41.12 23.5961 41.12ZM30.0555 41.132C29.5275 41.132 29.1115 41.04 28.8075 40.856C28.5035 40.672 28.2875 40.396 28.1595 40.028C28.0395 39.66 27.9795 39.2 27.9795 38.648V32.984L28.8795 32.828V34.784H31.3155V35.54H28.8795V38.72C28.8795 39.16 28.9275 39.496 29.0235 39.728C29.1275 39.96 29.2715 40.12 29.4555 40.208C29.6475 40.288 29.8715 40.328 30.1275 40.328C30.4315 40.328 30.6835 40.292 30.8835 40.22C31.0915 40.148 31.2555 40.084 31.3755 40.028L31.5675 40.76C31.4475 40.832 31.2475 40.912 30.9675 41C30.6955 41.088 30.3915 41.132 30.0555 41.132ZM32.7385 41V31.844L33.6385 31.688V34.94C33.8705 34.852 34.1145 34.784 34.3705 34.736C34.6345 34.688 34.8905 34.664 35.1385 34.664C35.7945 34.664 36.3025 34.784 36.6625 35.024C37.0225 35.264 37.2745 35.6 37.4185 36.032C37.5705 36.456 37.6465 36.952 37.6465 37.52V41H36.7465V37.772C36.7465 37.204 36.6945 36.752 36.5905 36.416C36.4865 36.08 36.3105 35.836 36.0625 35.684C35.8145 35.532 35.4665 35.456 35.0185 35.456C34.8505 35.456 34.6665 35.476 34.4665 35.516C34.2745 35.548 34.1025 35.584 33.9505 35.624C33.7985 35.664 33.6945 35.696 33.6385 35.72V41H32.7385ZM42.3059 41.144C41.6979 41.144 41.1619 41.016 40.6979 40.76C40.2339 40.496 39.8739 40.124 39.6179 39.644C39.3619 39.156 39.2339 38.576 39.2339 37.904C39.2339 37.264 39.3419 36.7 39.5579 36.212C39.7819 35.724 40.1019 35.344 40.5179 35.072C40.9419 34.792 41.4499 34.652 42.0419 34.652C42.4259 34.652 42.7619 34.708 43.0499 34.82C43.3459 34.924 43.5659 35.028 43.7099 35.132V31.844L44.5979 31.688V40.808C44.4459 40.856 44.2579 40.908 44.0339 40.964C43.8099 41.012 43.5539 41.052 43.2659 41.084C42.9859 41.124 42.6659 41.144 42.3059 41.144ZM42.3179 40.34C42.6699 40.34 42.9579 40.324 43.1819 40.292C43.4139 40.252 43.5899 40.216 43.7099 40.184V35.972C43.5739 35.86 43.3659 35.748 43.0859 35.636C42.8059 35.516 42.4899 35.456 42.1379 35.456C41.7779 35.456 41.4699 35.52 41.2139 35.648C40.9659 35.768 40.7619 35.94 40.6019 36.164C40.4499 36.388 40.3379 36.648 40.2659 36.944C40.2019 37.24 40.1699 37.556 40.1699 37.892C40.1699 38.412 40.2579 38.856 40.4339 39.224C40.6179 39.584 40.8699 39.86 41.1899 40.052C41.5179 40.244 41.8939 40.34 42.3179 40.34Z" fill="white"/>
+<path d="M20.656 53.3626C19.952 53.3626 19.3 53.1986 18.7 52.8706C18.108 52.5426 17.632 52.0586 17.272 51.4186C16.912 50.7706 16.732 49.9706 16.732 49.0186C16.732 48.3066 16.836 47.6826 17.044 47.1466C17.252 46.6026 17.536 46.1506 17.896 45.7906C18.264 45.4226 18.684 45.1466 19.156 44.9626C19.628 44.7786 20.128 44.6866 20.656 44.6866C21.368 44.6866 22.02 44.8506 22.612 45.1786C23.204 45.4986 23.68 45.9826 24.04 46.6306C24.4 47.2706 24.58 48.0666 24.58 49.0186C24.58 49.9706 24.4 50.7706 24.04 51.4186C23.68 52.0586 23.204 52.5426 22.612 52.8706C22.02 53.1986 21.368 53.3626 20.656 53.3626ZM20.656 52.5226C21.256 52.5226 21.776 52.3826 22.216 52.1026C22.656 51.8146 22.996 51.4106 23.236 50.8906C23.476 50.3626 23.596 49.7386 23.596 49.0186C23.596 48.2986 23.476 47.6786 23.236 47.1586C22.996 46.6306 22.656 46.2266 22.216 45.9466C21.776 45.6666 21.256 45.5266 20.656 45.5266C20.056 45.5266 19.536 45.6666 19.096 45.9466C18.656 46.2266 18.316 46.6306 18.076 47.1586C17.836 47.6786 17.716 48.2986 17.716 49.0186C17.716 49.7386 17.836 50.3626 18.076 50.8906C18.316 51.4106 18.656 51.8146 19.096 52.1026C19.536 52.3826 20.056 52.5226 20.656 52.5226ZM26.3844 53.1826V44.8666H27.3204V53.1826H26.3844ZM31.5307 53.2546C31.1947 53.2546 30.8387 53.2386 30.4627 53.2066C30.0867 53.1746 29.7507 53.1186 29.4547 53.0386V45.0226C29.7507 44.9426 30.0867 44.8866 30.4627 44.8546C30.8467 44.8146 31.2067 44.7946 31.5427 44.7946C32.4467 44.7946 33.2427 44.9506 33.9307 45.2626C34.6187 45.5666 35.1547 46.0306 35.5387 46.6546C35.9307 47.2786 36.1267 48.0666 36.1267 49.0186C36.1267 49.9626 35.9307 50.7506 35.5387 51.3826C35.1547 52.0066 34.6187 52.4746 33.9307 52.7866C33.2427 53.0986 32.4427 53.2546 31.5307 53.2546ZM31.6267 52.4506C32.7947 52.4506 33.6707 52.1466 34.2547 51.5386C34.8467 50.9226 35.1427 50.0826 35.1427 49.0186C35.1427 47.9546 34.8507 47.1186 34.2667 46.5106C33.6827 45.9026 32.8067 45.5986 31.6387 45.5986C31.2467 45.5986 30.9547 45.6106 30.7627 45.6346C30.5707 45.6586 30.4467 45.6746 30.3907 45.6826V52.3666C30.4467 52.3746 30.5667 52.3906 30.7507 52.4146C30.9347 52.4386 31.2267 52.4506 31.6267 52.4506ZM41.4194 53.3626C40.6914 53.3626 40.0354 53.1946 39.4514 52.8586C38.8754 52.5226 38.4194 52.0346 38.0834 51.3946C37.7554 50.7466 37.5914 49.9546 37.5914 49.0186C37.5914 48.3226 37.6954 47.7066 37.9034 47.1706C38.1114 46.6266 38.3954 46.1706 38.7554 45.8026C39.1234 45.4346 39.5394 45.1586 40.0034 44.9746C40.4754 44.7826 40.9674 44.6866 41.4794 44.6866C41.9034 44.6866 42.2714 44.7226 42.5834 44.7946C42.9034 44.8586 43.1674 44.9346 43.3754 45.0226C43.5834 45.1106 43.7354 45.1866 43.8314 45.2506L43.5314 46.0426C43.3314 45.9226 43.0714 45.8066 42.7514 45.6946C42.4394 45.5826 42.0594 45.5266 41.6114 45.5266C40.9554 45.5266 40.3994 45.6746 39.9434 45.9706C39.4954 46.2586 39.1554 46.6666 38.9234 47.1946C38.6914 47.7146 38.5754 48.3266 38.5754 49.0306C38.5754 49.7346 38.6874 50.3506 38.9114 50.8786C39.1354 51.3986 39.4634 51.8026 39.8954 52.0906C40.3354 52.3786 40.8714 52.5226 41.5034 52.5226C42.0314 52.5226 42.4714 52.4746 42.8234 52.3786C43.1754 52.2746 43.4474 52.1706 43.6394 52.0666L43.8914 52.8586C43.7634 52.9386 43.4834 53.0426 43.0514 53.1706C42.6274 53.2986 42.0834 53.3626 41.4194 53.3626Z" fill="white"/>
+<path d="M24.851 19.4031C25.9797 19.4031 26.8947 18.49 26.8947 17.3637C26.8947 16.2373 25.9797 15.3242 24.851 15.3242C23.7223 15.3242 22.8074 16.2373 22.8074 17.3637C22.8074 18.49 23.7223 19.4031 24.851 19.4031Z" fill="#E95420"/>
+<path d="M33.3637 14.9295C34.4924 14.9295 35.4074 14.0164 35.4074 12.89C35.4074 11.7637 34.4924 10.8506 33.3637 10.8506C32.235 10.8506 31.3201 11.7637 31.3201 12.89C31.3201 14.0164 32.235 14.9295 33.3637 14.9295Z" fill="#E95420"/>
+<path d="M29.4595 22.6125C27.9876 22.2974 26.7569 21.359 26.065 20.0293C25.5204 20.2766 24.9072 20.352 24.3169 20.2436C25.1537 22.294 26.9289 23.7847 29.1081 24.2505C29.5866 24.353 30.0736 24.4021 30.5597 24.3995C30.1845 23.9075 29.9753 23.3138 29.9609 22.6946C29.7924 22.676 29.6247 22.6489 29.4595 22.6133V22.6125Z" fill="#E95420"/>
+<path d="M32.9023 24.6629C34.031 24.6629 34.946 23.7498 34.946 22.6234C34.946 21.4971 34.031 20.584 32.9023 20.584C31.7736 20.584 30.8586 21.4971 30.8586 22.6234C30.8586 23.7498 31.7736 24.6629 32.9023 24.6629Z" fill="#E95420"/>
+<path d="M35.7463 21.8741C36.3823 21.0746 36.8295 20.1294 37.0455 19.1249C37.4215 17.3734 37.0701 15.5355 36.0817 14.0449C35.8462 14.598 35.4465 15.0663 34.9324 15.3882C35.4837 16.4257 35.6514 17.6233 35.4041 18.7743C35.283 19.3375 35.0696 19.8694 34.7681 20.3547C35.2491 20.7485 35.5887 21.2779 35.7463 21.8741Z" fill="#E95420"/>
+<path d="M24.6924 14.437C24.744 14.4344 24.7965 14.4327 24.8482 14.4327C25.0549 14.4327 25.2607 14.4547 25.4648 14.4979C25.7976 14.5691 26.111 14.6953 26.3981 14.8731C27.3188 13.5527 28.8035 12.76 30.4127 12.7312C30.4211 12.5771 30.4414 12.4229 30.4745 12.2722C30.5685 11.8351 30.7599 11.4269 31.0326 11.0771C28.4621 10.8739 25.9645 12.1976 24.6924 14.437Z" fill="#E95420"/>
+</g>
+<defs>
+<clipPath id="clip0_16_206">
+<rect width="60" height="60" fill="white"/>
+</clipPath>
+</defs>
+</svg>
diff --git a/snap/variants/oidc/snapcraft.yaml b/snap/variants/oidc/snapcraft.yaml
new file mode 100644
index 0000000000..9e554f6de5
--- /dev/null
+++ b/snap/variants/oidc/snapcraft.yaml
@@ -0,0 +1,100 @@
+name: authd-oidc
+summary: authd - OIDC Authentication for Ubuntu
+description: |
+  authd is a powerful authentication service for Ubuntu, designed to integrate with OIDC identity providers.
+  It delivers a secure, flexible solution for organizations and individuals who are transitioning
+  to cloud-based identity management on Ubuntu workstations and servers.
+  authd uses the OAuth Device Authorization Grant and ensures a consistent and secure login experience across
+  Ubuntu Desktop and Server — whether through GDM, SSH, or network services like NFS and Samba.
+
+  Key Features
+  * Cloud identity provider integration: Connects with any OpenID Connect compliant identity provider.
+  * Secure login: authd leverages the OAuth Device Authorization Grant RFC 8628-compliant workflows for reliability
+    and security.
+  * Open-source: Free and community-driven, with contributions welcomed.
+  * Enterprise ready: Ubuntu Pro customers will benefit from the same expanded security and support guarantees.
+  * authd is free for all Ubuntu Desktop and Server 24.04 LTS users and is under active development.
+    Explore the official documentation for installation and configuration steps, or visit the GitHub repository to
+    contribute or provide feedback.
+icon: snap/variants/oidc/icon.svg
+website: https://documentation.ubuntu.com/authd
+issues: https://github.com/canonical/authd/issues
+source-code: https://github.com/canonical/authd
+adopt-info: version
+grade: stable
+base: core24
+confinement: strict
+license: GPL-3.0
+
+apps:
+  authd-oidc:
+    command: bin/authd-oidc
+    daemon: dbus
+    slots:
+      - dbus-authd
+    plugs:
+      - network
+    restart-condition: always
+    activates-on: [dbus-authd]
+    environment:
+      SYSLOG_IDENTIFIER: authd-oidc
+
+slots:
+  dbus-authd:
+    interface: dbus
+    bus: system
+    name: com.ubuntu.authd.Oidc
+
+parts:
+  broker:
+    source: authd-oidc-brokers
+    source-type: local
+    plugin: nil
+    build-snaps:
+      - go
+    build-environment:
+      - GOFLAGS: "-tags=release"
+      - GOBIN: ${CRAFT_PART_INSTALL}/bin
+    override-build: |
+      go mod download all
+      go mod vendor
+      VERSION=$(craftctl get version)
+      export GOFLAGS="-ldflags=-X=github.com/canonical/authd/authd-oidc-brokers/internal/consts.Version=${VERSION}"
+      go build -o ${GOBIN}/authd-oidc ./cmd/authd-oidc
+    after:
+      - version
+  config:
+    source: authd-oidc-brokers/conf/
+    source-type: local
+    plugin: dump
+    organize:
+      "variants/oidc/authd.conf": "conf/authd/oidc.conf"
+      "variants/oidc/broker.conf": "conf/broker.conf.orig"
+      "migrations": "conf/migrations"
+    stage:
+      - conf
+  # SemVer comparison helper
+  semver:
+    source: authd-oidc-brokers/tools
+    source-type: local
+    plugin: nil
+    build-snaps:
+      - go
+    build-environment:
+      - GOBIN: ${CRAFT_PART_INSTALL}/bin
+    override-build: |
+      go mod download all
+      go mod vendor
+      go build -o ${GOBIN}/semver semver/semver.go
+  # Build the snap version from the git repository and current tree state.
+  version:
+    source: .
+    plugin: nil
+    build-packages:
+      - git # The script needs Git.
+    override-build: |
+      if [ -z "$(craftctl get version)" ]; then
+        craftctl set version="$(./snap/scripts/version)"
+      fi
+    after:
+      - semver
diff --git a/tools/generate-proto.sh b/tools/generate-proto.sh
index 8f19a73b49..b8e7e0c6d4 100755
--- a/tools/generate-proto.sh
+++ b/tools/generate-proto.sh
@@ -3,7 +3,7 @@
 set -euo pipefail
 
 if [ -v DEB_HOST_GNU_TYPE ]; then
-    echo "Proto files should not be regenerated during package building"
+    echo "generate-proto.sh: Package build environment detected, skipping proto generation"
     exit 0
 fi
 
diff --git a/tools/go.mod b/tools/go.mod
index eaf0dcd944..794cd05dbf 100644
--- a/tools/go.mod
+++ b/tools/go.mod
@@ -1,63 +1,78 @@
-module github.com/ubuntu/authd/tools
+module github.com/canonical/authd/tools
 
-go 1.23.0
+go 1.25.0
 
-toolchain go1.23.10
+toolchain go1.25.8
 
 require (
 	github.com/golang/protobuf v1.5.4
-	github.com/golangci/golangci-lint v1.64.8
+	github.com/golangci/golangci-lint/v2 v2.11.3
 	github.com/msteinert/pam/v2 v2.0.0-00010101000000-000000000000
-	google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.5.1
+	google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.6.1
 )
 
 require (
 	4d63.com/gocheckcompilerdirectives v1.3.0 // indirect
 	4d63.com/gochecknoglobals v0.2.2 // indirect
-	github.com/4meepo/tagalign v1.4.2 // indirect
-	github.com/Abirdcfly/dupword v0.1.3 // indirect
-	github.com/Antonboom/errname v1.0.0 // indirect
-	github.com/Antonboom/nilnil v1.0.1 // indirect
-	github.com/Antonboom/testifylint v1.5.2 // indirect
-	github.com/BurntSushi/toml v1.4.1-0.20240526193622-a339e1f7089c // indirect
-	github.com/Crocmagnon/fatcontext v0.7.1 // indirect
-	github.com/Djarvur/go-err113 v0.0.0-20210108212216-aea10b59be24 // indirect
-	github.com/GaijinEntertainment/go-exhaustruct/v3 v3.3.1 // indirect
-	github.com/Masterminds/semver/v3 v3.3.0 // indirect
+	codeberg.org/chavacava/garif v0.2.0 // indirect
+	codeberg.org/polyfloyd/go-errorlint v1.9.0 // indirect
+	dev.gaijin.team/go/exhaustruct/v4 v4.0.0 // indirect
+	dev.gaijin.team/go/golib v0.6.0 // indirect
+	github.com/4meepo/tagalign v1.4.3 // indirect
+	github.com/Abirdcfly/dupword v0.1.7 // indirect
+	github.com/AdminBenni/iota-mixing v1.0.0 // indirect
+	github.com/AlwxSin/noinlineerr v1.0.5 // indirect
+	github.com/Antonboom/errname v1.1.1 // indirect
+	github.com/Antonboom/nilnil v1.1.1 // indirect
+	github.com/Antonboom/testifylint v1.6.4 // indirect
+	github.com/BurntSushi/toml v1.6.0 // indirect
+	github.com/Djarvur/go-err113 v0.1.1 // indirect
+	github.com/Masterminds/semver/v3 v3.4.0 // indirect
+	github.com/MirrexOne/unqueryvet v1.5.4 // indirect
 	github.com/OpenPeeDeeP/depguard/v2 v2.2.1 // indirect
+	github.com/alecthomas/chroma/v2 v2.23.1 // indirect
 	github.com/alecthomas/go-check-sumtype v0.3.1 // indirect
-	github.com/alexkohler/nakedret/v2 v2.0.5 // indirect
-	github.com/alexkohler/prealloc v1.0.0 // indirect
+	github.com/alexkohler/nakedret/v2 v2.0.6 // indirect
+	github.com/alexkohler/prealloc v1.1.0 // indirect
+	github.com/alfatraining/structtag v1.0.0 // indirect
 	github.com/alingse/asasalint v0.0.11 // indirect
-	github.com/alingse/nilnesserr v0.1.2 // indirect
-	github.com/ashanbrown/forbidigo v1.6.0 // indirect
-	github.com/ashanbrown/makezero v1.2.0 // indirect
+	github.com/alingse/nilnesserr v0.2.0 // indirect
+	github.com/ashanbrown/forbidigo/v2 v2.3.0 // indirect
+	github.com/ashanbrown/makezero/v2 v2.1.0 // indirect
+	github.com/aymanbagabas/go-osc52/v2 v2.0.1 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/bkielbasa/cyclop v1.2.3 // indirect
 	github.com/blizzy78/varnamelen v0.8.0 // indirect
-	github.com/bombsimon/wsl/v4 v4.5.0 // indirect
-	github.com/breml/bidichk v0.3.2 // indirect
-	github.com/breml/errchkjson v0.4.0 // indirect
-	github.com/butuzov/ireturn v0.3.1 // indirect
+	github.com/bombsimon/wsl/v4 v4.7.0 // indirect
+	github.com/bombsimon/wsl/v5 v5.6.0 // indirect
+	github.com/breml/bidichk v0.3.3 // indirect
+	github.com/breml/errchkjson v0.4.1 // indirect
+	github.com/butuzov/ireturn v0.4.0 // indirect
 	github.com/butuzov/mirror v1.3.0 // indirect
-	github.com/catenacyber/perfsprint v0.8.2 // indirect
-	github.com/ccojocar/zxcvbn-go v1.0.2 // indirect
+	github.com/catenacyber/perfsprint v0.10.1 // indirect
+	github.com/ccojocar/zxcvbn-go v1.0.4 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
-	github.com/charithe/durationcheck v0.0.10 // indirect
-	github.com/chavacava/garif v0.1.0 // indirect
-	github.com/ckaznocha/intrange v0.3.0 // indirect
+	github.com/charithe/durationcheck v0.0.11 // indirect
+	github.com/charmbracelet/colorprofile v0.2.3-0.20250311203215-f60798e515dc // indirect
+	github.com/charmbracelet/lipgloss v1.1.0 // indirect
+	github.com/charmbracelet/x/ansi v0.10.1 // indirect
+	github.com/charmbracelet/x/cellbuf v0.0.13-0.20250311204145-2c3ea96c31dd // indirect
+	github.com/charmbracelet/x/term v0.2.1 // indirect
+	github.com/ckaznocha/intrange v0.3.1 // indirect
 	github.com/curioswitch/go-reassign v0.3.0 // indirect
-	github.com/daixiang0/gci v0.13.5 // indirect
+	github.com/daixiang0/gci v0.13.7 // indirect
+	github.com/dave/dst v0.27.3 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/denis-tingaikin/go-header v0.5.0 // indirect
+	github.com/dlclark/regexp2 v1.11.5 // indirect
 	github.com/ettle/strcase v0.2.0 // indirect
 	github.com/fatih/color v1.18.0 // indirect
 	github.com/fatih/structtag v1.2.0 // indirect
-	github.com/firefart/nonamedreturns v1.0.5 // indirect
+	github.com/firefart/nonamedreturns v1.0.6 // indirect
 	github.com/fsnotify/fsnotify v1.5.4 // indirect
 	github.com/fzipp/gocyclo v0.6.0 // indirect
-	github.com/ghostiam/protogetter v0.3.9 // indirect
-	github.com/go-critic/go-critic v0.12.0 // indirect
+	github.com/ghostiam/protogetter v0.3.20 // indirect
+	github.com/go-critic/go-critic v0.14.3 // indirect
 	github.com/go-toolsmith/astcast v1.1.0 // indirect
 	github.com/go-toolsmith/astcopy v1.1.0 // indirect
 	github.com/go-toolsmith/astequal v1.2.0 // indirect
@@ -65,136 +80,144 @@ require (
 	github.com/go-toolsmith/astp v1.1.0 // indirect
 	github.com/go-toolsmith/strparse v1.1.0 // indirect
 	github.com/go-toolsmith/typep v1.1.0 // indirect
-	github.com/go-viper/mapstructure/v2 v2.2.1 // indirect
+	github.com/go-viper/mapstructure/v2 v2.5.0 // indirect
 	github.com/go-xmlfmt/xmlfmt v1.1.3 // indirect
 	github.com/gobwas/glob v0.2.3 // indirect
-	github.com/gofrs/flock v0.12.1 // indirect
+	github.com/godoc-lint/godoc-lint v0.11.2 // indirect
+	github.com/gofrs/flock v0.13.0 // indirect
+	github.com/golangci/asciicheck v0.5.0 // indirect
 	github.com/golangci/dupl v0.0.0-20250308024227-f665c8d69b32 // indirect
-	github.com/golangci/go-printf-func-name v0.1.0 // indirect
+	github.com/golangci/go-printf-func-name v0.1.1 // indirect
 	github.com/golangci/gofmt v0.0.0-20250106114630-d62b90e6713d // indirect
-	github.com/golangci/misspell v0.6.0 // indirect
-	github.com/golangci/plugin-module-register v0.1.1 // indirect
+	github.com/golangci/golines v0.15.0 // indirect
+	github.com/golangci/misspell v0.8.0 // indirect
+	github.com/golangci/plugin-module-register v0.1.2 // indirect
 	github.com/golangci/revgrep v0.8.0 // indirect
-	github.com/golangci/unconvert v0.0.0-20240309020433-c5143eacb3ed // indirect
+	github.com/golangci/swaggoswag v0.0.0-20250504205917-77f2aca3143e // indirect
+	github.com/golangci/unconvert v0.0.0-20250410112200-a129a6e6413e // indirect
 	github.com/google/go-cmp v0.7.0 // indirect
-	github.com/gordonklaus/ineffassign v0.1.0 // indirect
+	github.com/gordonklaus/ineffassign v0.2.0 // indirect
 	github.com/gostaticanalysis/analysisutil v0.7.1 // indirect
 	github.com/gostaticanalysis/comment v1.5.0 // indirect
 	github.com/gostaticanalysis/forcetypeassert v0.2.0 // indirect
-	github.com/gostaticanalysis/nilerr v0.1.1 // indirect
+	github.com/gostaticanalysis/nilerr v0.1.2 // indirect
 	github.com/hashicorp/go-immutable-radix/v2 v2.1.0 // indirect
-	github.com/hashicorp/go-version v1.7.0 // indirect
+	github.com/hashicorp/go-version v1.8.0 // indirect
 	github.com/hashicorp/golang-lru/v2 v2.0.7 // indirect
 	github.com/hashicorp/hcl v1.0.0 // indirect
 	github.com/hexops/gotextdiff v1.0.3 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
-	github.com/jgautheron/goconst v1.7.1 // indirect
+	github.com/jgautheron/goconst v1.8.2 // indirect
 	github.com/jingyugao/rowserrcheck v1.1.1 // indirect
-	github.com/jjti/go-spancheck v0.6.4 // indirect
+	github.com/jjti/go-spancheck v0.6.5 // indirect
 	github.com/julz/importas v0.2.0 // indirect
-	github.com/karamaru-alpha/copyloopvar v1.2.1 // indirect
-	github.com/kisielk/errcheck v1.9.0 // indirect
+	github.com/karamaru-alpha/copyloopvar v1.2.2 // indirect
+	github.com/kisielk/errcheck v1.10.0 // indirect
 	github.com/kkHAIKE/contextcheck v1.1.6 // indirect
-	github.com/kulti/thelper v0.6.3 // indirect
-	github.com/kunwardeep/paralleltest v1.0.10 // indirect
+	github.com/kulti/thelper v0.7.1 // indirect
+	github.com/kunwardeep/paralleltest v1.0.15 // indirect
 	github.com/lasiar/canonicalheader v1.1.2 // indirect
-	github.com/ldez/exptostd v0.4.2 // indirect
-	github.com/ldez/gomoddirectives v0.6.1 // indirect
-	github.com/ldez/grignotin v0.9.0 // indirect
-	github.com/ldez/tagliatelle v0.7.1 // indirect
-	github.com/ldez/usetesting v0.4.2 // indirect
+	github.com/ldez/exptostd v0.4.5 // indirect
+	github.com/ldez/gomoddirectives v0.8.0 // indirect
+	github.com/ldez/grignotin v0.10.1 // indirect
+	github.com/ldez/structtags v0.6.1 // indirect
+	github.com/ldez/tagliatelle v0.7.2 // indirect
+	github.com/ldez/usetesting v0.5.0 // indirect
 	github.com/leonklingele/grouper v1.1.2 // indirect
-	github.com/macabu/inamedparam v0.1.3 // indirect
+	github.com/lucasb-eyer/go-colorful v1.2.0 // indirect
+	github.com/macabu/inamedparam v0.2.0 // indirect
 	github.com/magiconair/properties v1.8.6 // indirect
-	github.com/maratori/testableexamples v1.0.0 // indirect
-	github.com/maratori/testpackage v1.1.1 // indirect
+	github.com/manuelarte/embeddedstructfieldcheck v0.4.0 // indirect
+	github.com/manuelarte/funcorder v0.5.0 // indirect
+	github.com/maratori/testableexamples v1.0.1 // indirect
+	github.com/maratori/testpackage v1.1.2 // indirect
 	github.com/matoous/godox v1.1.0 // indirect
 	github.com/mattn/go-colorable v0.1.14 // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect
 	github.com/mattn/go-runewidth v0.0.16 // indirect
 	github.com/matttproud/golang_protobuf_extensions v1.0.1 // indirect
-	github.com/mgechev/revive v1.7.0 // indirect
+	github.com/mgechev/revive v1.15.0 // indirect
 	github.com/mitchellh/go-homedir v1.1.0 // indirect
 	github.com/mitchellh/mapstructure v1.5.0 // indirect
 	github.com/moricho/tparallel v0.3.2 // indirect
+	github.com/muesli/termenv v0.16.0 // indirect
 	github.com/nakabonne/nestif v0.3.1 // indirect
 	github.com/nishanths/exhaustive v0.12.0 // indirect
 	github.com/nishanths/predeclared v0.2.2 // indirect
-	github.com/nunnatsa/ginkgolinter v0.19.1 // indirect
-	github.com/olekukonko/tablewriter v0.0.5 // indirect
+	github.com/nunnatsa/ginkgolinter v0.23.0 // indirect
 	github.com/pelletier/go-toml v1.9.5 // indirect
-	github.com/pelletier/go-toml/v2 v2.2.3 // indirect
+	github.com/pelletier/go-toml/v2 v2.2.4 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
-	github.com/polyfloyd/go-errorlint v1.7.1 // indirect
 	github.com/prometheus/client_golang v1.12.1 // indirect
 	github.com/prometheus/client_model v0.2.0 // indirect
 	github.com/prometheus/common v0.32.1 // indirect
 	github.com/prometheus/procfs v0.7.3 // indirect
-	github.com/quasilyte/go-ruleguard v0.4.3-0.20240823090925-0fe6f58b47b1 // indirect
-	github.com/quasilyte/go-ruleguard/dsl v0.3.22 // indirect
+	github.com/quasilyte/go-ruleguard v0.4.5 // indirect
+	github.com/quasilyte/go-ruleguard/dsl v0.3.23 // indirect
 	github.com/quasilyte/gogrep v0.5.0 // indirect
 	github.com/quasilyte/regex/syntax v0.0.0-20210819130434-b3f0c404a727 // indirect
 	github.com/quasilyte/stdinfo v0.0.0-20220114132959-f7386bf02567 // indirect
 	github.com/raeperd/recvcheck v0.2.0 // indirect
 	github.com/rivo/uniseg v0.4.7 // indirect
 	github.com/rogpeppe/go-internal v1.14.1 // indirect
-	github.com/ryancurrah/gomodguard v1.3.5 // indirect
+	github.com/ryancurrah/gomodguard v1.4.1 // indirect
 	github.com/ryanrolds/sqlclosecheck v0.5.1 // indirect
 	github.com/sanposhiho/wastedassign/v2 v2.1.0 // indirect
-	github.com/santhosh-tekuri/jsonschema/v6 v6.0.1 // indirect
+	github.com/santhosh-tekuri/jsonschema/v6 v6.0.2 // indirect
 	github.com/sashamelentyev/interfacebloat v1.1.0 // indirect
-	github.com/sashamelentyev/usestdlibvars v1.28.0 // indirect
-	github.com/securego/gosec/v2 v2.22.2 // indirect
-	github.com/sirupsen/logrus v1.9.3 // indirect
+	github.com/sashamelentyev/usestdlibvars v1.29.0 // indirect
+	github.com/securego/gosec/v2 v2.24.8-0.20260309165252-619ce2117e08 // indirect
+	github.com/sirupsen/logrus v1.9.4 // indirect
 	github.com/sivchari/containedctx v1.0.3 // indirect
-	github.com/sivchari/tenv v1.12.1 // indirect
-	github.com/sonatard/noctx v0.1.0 // indirect
+	github.com/sonatard/noctx v0.5.0 // indirect
 	github.com/sourcegraph/go-diff v0.7.0 // indirect
-	github.com/spf13/afero v1.12.0 // indirect
+	github.com/spf13/afero v1.15.0 // indirect
 	github.com/spf13/cast v1.5.0 // indirect
-	github.com/spf13/cobra v1.9.1 // indirect
+	github.com/spf13/cobra v1.10.2 // indirect
 	github.com/spf13/jwalterweatherman v1.1.0 // indirect
-	github.com/spf13/pflag v1.0.6 // indirect
+	github.com/spf13/pflag v1.0.10 // indirect
 	github.com/spf13/viper v1.12.0 // indirect
 	github.com/ssgreg/nlreturn/v2 v2.2.1 // indirect
-	github.com/stbenjam/no-sprintf-host-port v0.2.0 // indirect
+	github.com/stbenjam/no-sprintf-host-port v0.3.1 // indirect
 	github.com/stretchr/objx v0.5.2 // indirect
-	github.com/stretchr/testify v1.10.0 // indirect
+	github.com/stretchr/testify v1.11.1 // indirect
 	github.com/subosito/gotenv v1.4.1 // indirect
-	github.com/tdakkota/asciicheck v0.4.1 // indirect
-	github.com/tetafro/godot v1.5.0 // indirect
-	github.com/timakin/bodyclose v0.0.0-20241017074812-ed6a65f985e3 // indirect
-	github.com/timonwong/loggercheck v0.10.1 // indirect
-	github.com/tomarrell/wrapcheck/v2 v2.10.0 // indirect
+	github.com/tetafro/godot v1.5.4 // indirect
+	github.com/timakin/bodyclose v0.0.0-20241222091800-1db5c5ca4d67 // indirect
+	github.com/timonwong/loggercheck v0.11.0 // indirect
+	github.com/tomarrell/wrapcheck/v2 v2.12.0 // indirect
 	github.com/tommy-muehle/go-mnd/v2 v2.5.1 // indirect
 	github.com/ultraware/funlen v0.2.0 // indirect
 	github.com/ultraware/whitespace v0.2.0 // indirect
-	github.com/uudashr/gocognit v1.2.0 // indirect
-	github.com/uudashr/iface v1.3.1 // indirect
-	github.com/xen0n/gosmopolitan v1.2.2 // indirect
+	github.com/uudashr/gocognit v1.2.1 // indirect
+	github.com/uudashr/iface v1.4.1 // indirect
+	github.com/xen0n/gosmopolitan v1.3.0 // indirect
+	github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect
 	github.com/yagipy/maintidx v1.0.0 // indirect
 	github.com/yeya24/promlinter v0.3.0 // indirect
 	github.com/ykadowak/zerologlint v0.1.5 // indirect
 	gitlab.com/bosi/decorder v0.4.2 // indirect
-	go-simpler.org/musttag v0.13.0 // indirect
-	go-simpler.org/sloglint v0.9.0 // indirect
-	go.uber.org/atomic v1.7.0 // indirect
-	go.uber.org/automaxprocs v1.6.0 // indirect
-	go.uber.org/multierr v1.6.0 // indirect
-	go.uber.org/zap v1.24.0 // indirect
-	golang.org/x/exp/typeparams v0.0.0-20250210185358-939b2ce775ac // indirect
-	golang.org/x/mod v0.24.0 // indirect
-	golang.org/x/sync v0.12.0 // indirect
-	golang.org/x/sys v0.31.0 // indirect
-	golang.org/x/text v0.22.0 // indirect
-	golang.org/x/tools v0.31.0 // indirect
-	google.golang.org/protobuf v1.36.5 // indirect
+	go-simpler.org/musttag v0.14.0 // indirect
+	go-simpler.org/sloglint v0.11.1 // indirect
+	go.augendre.info/arangolint v0.4.0 // indirect
+	go.augendre.info/fatcontext v0.9.0 // indirect
+	go.uber.org/multierr v1.10.0 // indirect
+	go.uber.org/zap v1.27.0 // indirect
+	go.yaml.in/yaml/v3 v3.0.4 // indirect
+	golang.org/x/exp/typeparams v0.0.0-20260209203927-2842357ff358 // indirect
+	golang.org/x/mod v0.33.0 // indirect
+	golang.org/x/sync v0.20.0 // indirect
+	golang.org/x/sys v0.41.0 // indirect
+	golang.org/x/text v0.34.0 // indirect
+	golang.org/x/tools v0.42.0 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20250818200422-3122310a409c // indirect
+	google.golang.org/protobuf v1.36.11 // indirect
 	gopkg.in/ini.v1 v1.67.0 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
-	honnef.co/go/tools v0.6.1 // indirect
-	mvdan.cc/gofumpt v0.7.0 // indirect
-	mvdan.cc/unparam v0.0.0-20240528143540-8a5130ca722f // indirect
+	honnef.co/go/tools v0.7.0 // indirect
+	mvdan.cc/gofumpt v0.9.2 // indirect
+	mvdan.cc/unparam v0.0.0-20251027182757-5beb8c8f8f15 // indirect
 )
 
 replace github.com/msteinert/pam/v2 => github.com/3v1n0/go-pam/v2 v2.0.0-20240218173232-e182844e4e11
diff --git a/tools/go.sum b/tools/go.sum
index 7375f9e9b7..07598b5b2b 100644
--- a/tools/go.sum
+++ b/tools/go.sum
@@ -34,58 +34,72 @@ cloud.google.com/go/storage v1.5.0/go.mod h1:tpKbwo567HUNpVclU5sGELwQWBDZ8gh0Zeo
 cloud.google.com/go/storage v1.6.0/go.mod h1:N7U0C8pVQ/+NIKOBQyamJIeKQKkZ+mxpohlUTyfDhBk=
 cloud.google.com/go/storage v1.8.0/go.mod h1:Wv1Oy7z6Yz3DshWRJFhqM/UCfaWIRTdp0RXyy7KQOVs=
 cloud.google.com/go/storage v1.10.0/go.mod h1:FLPqc6j+Ki4BU591ie1oL6qBQGu2Bl/tZ9ullr3+Kg0=
+codeberg.org/chavacava/garif v0.2.0 h1:F0tVjhYbuOCnvNcU3YSpO6b3Waw6Bimy4K0mM8y6MfY=
+codeberg.org/chavacava/garif v0.2.0/go.mod h1:P2BPbVbT4QcvLZrORc2T29szK3xEOlnl0GiPTJmEqBQ=
+codeberg.org/polyfloyd/go-errorlint v1.9.0 h1:VkdEEmA1VBpH6ecQoMR4LdphVI3fA4RrCh2an7YmodI=
+codeberg.org/polyfloyd/go-errorlint v1.9.0/go.mod h1:GPRRu2LzVijNn4YkrZYJfatQIdS+TrcK8rL5Xs24qw8=
+dev.gaijin.team/go/exhaustruct/v4 v4.0.0 h1:873r7aNneqoBB3IaFIzhvt2RFYTuHgmMjoKfwODoI1Y=
+dev.gaijin.team/go/exhaustruct/v4 v4.0.0/go.mod h1:aZ/k2o4Y05aMJtiux15x8iXaumE88YdiB0Ai4fXOzPI=
+dev.gaijin.team/go/golib v0.6.0 h1:v6nnznFTs4bppib/NyU1PQxobwDHwCXXl15P7DV5Zgo=
+dev.gaijin.team/go/golib v0.6.0/go.mod h1:uY1mShx8Z/aNHWDyAkZTkX+uCi5PdX7KsG1eDQa2AVE=
 dmitri.shuralyov.com/gpu/mtl v0.0.0-20190408044501-666a987793e9/go.mod h1:H6x//7gZCb22OMCxBHrMx7a5I7Hp++hsVxbQ4BYO7hU=
 github.com/3v1n0/go-pam/v2 v2.0.0-20240218173232-e182844e4e11 h1:zGS1p61QyPZKDpk53NMEy50eNhLB3GILQQf6LnEWgr4=
 github.com/3v1n0/go-pam/v2 v2.0.0-20240218173232-e182844e4e11/go.mod h1:KT28NNIcDFf3PcBmNI2mIGO4zZJ+9RSs/At2PB3IDVc=
-github.com/4meepo/tagalign v1.4.2 h1:0hcLHPGMjDyM1gHG58cS73aQF8J4TdVR96TZViorO9E=
-github.com/4meepo/tagalign v1.4.2/go.mod h1:+p4aMyFM+ra7nb41CnFG6aSDXqRxU/w1VQqScKqDARI=
-github.com/Abirdcfly/dupword v0.1.3 h1:9Pa1NuAsZvpFPi9Pqkd93I7LIYRURj+A//dFd5tgBeE=
-github.com/Abirdcfly/dupword v0.1.3/go.mod h1:8VbB2t7e10KRNdwTVoxdBaxla6avbhGzb8sCTygUMhw=
-github.com/Antonboom/errname v1.0.0 h1:oJOOWR07vS1kRusl6YRSlat7HFnb3mSfMl6sDMRoTBA=
-github.com/Antonboom/errname v1.0.0/go.mod h1:gMOBFzK/vrTiXN9Oh+HFs+e6Ndl0eTFbtsRTSRdXyGI=
-github.com/Antonboom/nilnil v1.0.1 h1:C3Tkm0KUxgfO4Duk3PM+ztPncTFlOf0b2qadmS0s4xs=
-github.com/Antonboom/nilnil v1.0.1/go.mod h1:CH7pW2JsRNFgEh8B2UaPZTEPhCMuFowP/e8Udp9Nnb0=
-github.com/Antonboom/testifylint v1.5.2 h1:4s3Xhuv5AvdIgbd8wOOEeo0uZG7PbDKQyKY5lGoQazk=
-github.com/Antonboom/testifylint v1.5.2/go.mod h1:vxy8VJ0bc6NavlYqjZfmp6EfqXMtBgQ4+mhCojwC1P8=
+github.com/4meepo/tagalign v1.4.3 h1:Bnu7jGWwbfpAie2vyl63Zup5KuRv21olsPIha53BJr8=
+github.com/4meepo/tagalign v1.4.3/go.mod h1:00WwRjiuSbrRJnSVeGWPLp2epS5Q/l4UEy0apLLS37c=
+github.com/Abirdcfly/dupword v0.1.7 h1:2j8sInznrje4I0CMisSL6ipEBkeJUJAmK1/lfoNGWrQ=
+github.com/Abirdcfly/dupword v0.1.7/go.mod h1:K0DkBeOebJ4VyOICFdppB23Q0YMOgVafM0zYW0n9lF4=
+github.com/AdminBenni/iota-mixing v1.0.0 h1:Os6lpjG2dp/AE5fYBPAA1zfa2qMdCAWwPMCgpwKq7wo=
+github.com/AdminBenni/iota-mixing v1.0.0/go.mod h1:i4+tpAaB+qMVIV9OK3m4/DAynOd5bQFaOu+2AhtBCNY=
+github.com/AlwxSin/noinlineerr v1.0.5 h1:RUjt63wk1AYWTXtVXbSqemlbVTb23JOSRiNsshj7TbY=
+github.com/AlwxSin/noinlineerr v1.0.5/go.mod h1:+QgkkoYrMH7RHvcdxdlI7vYYEdgeoFOVjU9sUhw/rQc=
+github.com/Antonboom/errname v1.1.1 h1:bllB7mlIbTVzO9jmSWVWLjxTEbGBVQ1Ff/ClQgtPw9Q=
+github.com/Antonboom/errname v1.1.1/go.mod h1:gjhe24xoxXp0ScLtHzjiXp0Exi1RFLKJb0bVBtWKCWQ=
+github.com/Antonboom/nilnil v1.1.1 h1:9Mdr6BYd8WHCDngQnNVV0b554xyisFioEKi30sksufQ=
+github.com/Antonboom/nilnil v1.1.1/go.mod h1:yCyAmSw3doopbOWhJlVci+HuyNRuHJKIv6V2oYQa8II=
+github.com/Antonboom/testifylint v1.6.4 h1:gs9fUEy+egzxkEbq9P4cpcMB6/G0DYdMeiFS87UiqmQ=
+github.com/Antonboom/testifylint v1.6.4/go.mod h1:YO33FROXX2OoUfwjz8g+gUxQXio5i9qpVy7nXGbxDD4=
 github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
-github.com/BurntSushi/toml v1.4.1-0.20240526193622-a339e1f7089c h1:pxW6RcqyfI9/kWtOwnv/G+AzdKuy2ZrqINhenH4HyNs=
-github.com/BurntSushi/toml v1.4.1-0.20240526193622-a339e1f7089c/go.mod h1:ukJfTF/6rtPPRCnwkur4qwRxa8vTRFBF0uk2lLoLwho=
+github.com/BurntSushi/toml v1.6.0 h1:dRaEfpa2VI55EwlIW72hMRHdWouJeRF7TPYhI+AUQjk=
+github.com/BurntSushi/toml v1.6.0/go.mod h1:ukJfTF/6rtPPRCnwkur4qwRxa8vTRFBF0uk2lLoLwho=
 github.com/BurntSushi/xgb v0.0.0-20160522181843-27f122750802/go.mod h1:IVnqGOEym/WlBOVXweHU+Q+/VP0lqqI8lqeDx9IjBqo=
-github.com/Crocmagnon/fatcontext v0.7.1 h1:SC/VIbRRZQeQWj/TcQBS6JmrXcfA+BU4OGSVUt54PjM=
-github.com/Crocmagnon/fatcontext v0.7.1/go.mod h1:1wMvv3NXEBJucFGfwOJBxSVWcoIO6emV215SMkW9MFU=
-github.com/Djarvur/go-err113 v0.0.0-20210108212216-aea10b59be24 h1:sHglBQTwgx+rWPdisA5ynNEsoARbiCBOyGcJM4/OzsM=
-github.com/Djarvur/go-err113 v0.0.0-20210108212216-aea10b59be24/go.mod h1:4UJr5HIiMZrwgkSPdsjy2uOQExX/WEILpIrO9UPGuXs=
-github.com/GaijinEntertainment/go-exhaustruct/v3 v3.3.1 h1:Sz1JIXEcSfhz7fUi7xHnhpIE0thVASYjvosApmHuD2k=
-github.com/GaijinEntertainment/go-exhaustruct/v3 v3.3.1/go.mod h1:n/LSCXNuIYqVfBlVXyHfMQkZDdp1/mmxfSjADd3z1Zg=
-github.com/Masterminds/semver/v3 v3.3.0 h1:B8LGeaivUe71a5qox1ICM/JLl0NqZSW5CHyL+hmvYS0=
-github.com/Masterminds/semver/v3 v3.3.0/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM=
+github.com/Djarvur/go-err113 v0.1.1 h1:eHfopDqXRwAi+YmCUas75ZE0+hoBHJ2GQNLYRSxao4g=
+github.com/Djarvur/go-err113 v0.1.1/go.mod h1:IaWJdYFLg76t2ihfflPZnM1LIQszWOsFDh2hhhAVF6k=
+github.com/Masterminds/semver/v3 v3.4.0 h1:Zog+i5UMtVoCU8oKka5P7i9q9HgrJeGzI9SA1Xbatp0=
+github.com/Masterminds/semver/v3 v3.4.0/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM=
+github.com/MirrexOne/unqueryvet v1.5.4 h1:38QOxShO7JmMWT+eCdDMbcUgGCOeJphVkzzRgyLJgsQ=
+github.com/MirrexOne/unqueryvet v1.5.4/go.mod h1:fs9Zq6eh1LRIhsDIsxf9PONVUjYdFHdtkHIgZdJnyPU=
 github.com/OpenPeeDeeP/depguard/v2 v2.2.1 h1:vckeWVESWp6Qog7UZSARNqfu/cZqvki8zsuj3piCMx4=
 github.com/OpenPeeDeeP/depguard/v2 v2.2.1/go.mod h1:q4DKzC4UcVaAvcfd41CZh0PWpGgzrVxUYBlgKNGquUo=
 github.com/alecthomas/assert/v2 v2.11.0 h1:2Q9r3ki8+JYXvGsDyBXwH3LcJ+WK5D0gc5E8vS6K3D0=
 github.com/alecthomas/assert/v2 v2.11.0/go.mod h1:Bze95FyfUr7x34QZrjL+XP+0qgp/zg8yS+TtBj1WA3k=
+github.com/alecthomas/chroma/v2 v2.23.1 h1:nv2AVZdTyClGbVQkIzlDm/rnhk1E9bU9nXwmZ/Vk/iY=
+github.com/alecthomas/chroma/v2 v2.23.1/go.mod h1:NqVhfBR0lte5Ouh3DcthuUCTUpDC9cxBOfyMbMQPs3o=
 github.com/alecthomas/go-check-sumtype v0.3.1 h1:u9aUvbGINJxLVXiFvHUlPEaD7VDULsrxJb4Aq31NLkU=
 github.com/alecthomas/go-check-sumtype v0.3.1/go.mod h1:A8TSiN3UPRw3laIgWEUOHHLPa6/r9MtoigdlP5h3K/E=
-github.com/alecthomas/repr v0.4.0 h1:GhI2A8MACjfegCPVq9f1FLvIBS+DrQ2KQBFZP1iFzXc=
-github.com/alecthomas/repr v0.4.0/go.mod h1:Fr0507jx4eOXV7AlPV6AVZLYrLIuIeSOWtW57eE/O/4=
+github.com/alecthomas/repr v0.5.2 h1:SU73FTI9D1P5UNtvseffFSGmdNci/O6RsqzeXJtP0Qs=
+github.com/alecthomas/repr v0.5.2/go.mod h1:Fr0507jx4eOXV7AlPV6AVZLYrLIuIeSOWtW57eE/O/4=
 github.com/alecthomas/template v0.0.0-20160405071501-a0175ee3bccc/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
 github.com/alecthomas/template v0.0.0-20190718012654-fb15b899a751/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
 github.com/alecthomas/units v0.0.0-20151022065526-2efee857e7cf/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0=
 github.com/alecthomas/units v0.0.0-20190717042225-c3de453c63f4/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0=
 github.com/alecthomas/units v0.0.0-20190924025748-f65c72e2690d/go.mod h1:rBZYJk541a8SKzHPHnH3zbiI+7dagKZ0cgpgrD7Fyho=
-github.com/alexkohler/nakedret/v2 v2.0.5 h1:fP5qLgtwbx9EJE8dGEERT02YwS8En4r9nnZ71RK+EVU=
-github.com/alexkohler/nakedret/v2 v2.0.5/go.mod h1:bF5i0zF2Wo2o4X4USt9ntUWve6JbFv02Ff4vlkmS/VU=
-github.com/alexkohler/prealloc v1.0.0 h1:Hbq0/3fJPQhNkN0dR95AVrr6R7tou91y0uHG5pOcUuw=
-github.com/alexkohler/prealloc v1.0.0/go.mod h1:VetnK3dIgFBBKmg0YnD9F9x6Icjd+9cvfHR56wJVlKE=
+github.com/alexkohler/nakedret/v2 v2.0.6 h1:ME3Qef1/KIKr3kWX3nti3hhgNxw6aqN5pZmQiFSsuzQ=
+github.com/alexkohler/nakedret/v2 v2.0.6/go.mod h1:l3RKju/IzOMQHmsEvXwkqMDzHHvurNQfAgE1eVmT40Q=
+github.com/alexkohler/prealloc v1.1.0 h1:cKGRBqlXw5iyQGLYhrXrDlcHxugXpTq4tQ5c91wkf8M=
+github.com/alexkohler/prealloc v1.1.0/go.mod h1:fT39Jge3bQrfA7nPMDngUfvUbQGQeJyGQnR+913SCig=
+github.com/alfatraining/structtag v1.0.0 h1:2qmcUqNcCoyVJ0up879K614L9PazjBSFruTB0GOFjCc=
+github.com/alfatraining/structtag v1.0.0/go.mod h1:p3Xi5SwzTi+Ryj64DqjLWz7XurHxbGsq6y3ubePJPus=
 github.com/alingse/asasalint v0.0.11 h1:SFwnQXJ49Kx/1GghOFz1XGqHYKp21Kq1nHad/0WQRnw=
 github.com/alingse/asasalint v0.0.11/go.mod h1:nCaoMhw7a9kSJObvQyVzNTPBDbNpdocqrSP7t/cW5+I=
-github.com/alingse/nilnesserr v0.1.2 h1:Yf8Iwm3z2hUUrP4muWfW83DF4nE3r1xZ26fGWUKCZlo=
-github.com/alingse/nilnesserr v0.1.2/go.mod h1:1xJPrXonEtX7wyTq8Dytns5P2hNzoWymVUIaKm4HNFg=
-github.com/ashanbrown/forbidigo v1.6.0 h1:D3aewfM37Yb3pxHujIPSpTf6oQk9sc9WZi8gerOIVIY=
-github.com/ashanbrown/forbidigo v1.6.0/go.mod h1:Y8j9jy9ZYAEHXdu723cUlraTqbzjKF1MUyfOKL+AjcU=
-github.com/ashanbrown/makezero v1.2.0 h1:/2Lp1bypdmK9wDIq7uWBlDF1iMUpIIS4A+pF6C9IEUU=
-github.com/ashanbrown/makezero v1.2.0/go.mod h1:dxlPhHbDMC6N6xICzFBSK+4njQDdK8euNO0qjQMtGY4=
-github.com/benbjohnson/clock v1.1.0 h1:Q92kusRqC1XV2MjkWETPvjJVqKetz1OzxZB7mHJLju8=
-github.com/benbjohnson/clock v1.1.0/go.mod h1:J11/hYXuz8f4ySSvYwY0FKfm+ezbsZBKZxNJlLklBHA=
+github.com/alingse/nilnesserr v0.2.0 h1:raLem5KG7EFVb4UIDAXgrv3N2JIaffeKNtcEXkEWd/w=
+github.com/alingse/nilnesserr v0.2.0/go.mod h1:1xJPrXonEtX7wyTq8Dytns5P2hNzoWymVUIaKm4HNFg=
+github.com/ashanbrown/forbidigo/v2 v2.3.0 h1:OZZDOchCgsX5gvToVtEBoV2UWbFfI6RKQTir2UZzSxo=
+github.com/ashanbrown/forbidigo/v2 v2.3.0/go.mod h1:5p6VmsG5/1xx3E785W9fouMxIOkvY2rRV9nMdWadd6c=
+github.com/ashanbrown/makezero/v2 v2.1.0 h1:snuKYMbqosNokUKm+R6/+vOPs8yVAi46La7Ck6QYSaE=
+github.com/ashanbrown/makezero/v2 v2.1.0/go.mod h1:aEGT/9q3S8DHeE57C88z2a6xydvgx8J5hgXIGWgo0MY=
+github.com/aymanbagabas/go-osc52/v2 v2.0.1 h1:HwpRHbFMcZLEVr42D4p7XBqjyuxQH5SMiErDT4WkJ2k=
+github.com/aymanbagabas/go-osc52/v2 v2.0.1/go.mod h1:uYgXzlJ7ZpABp8OJ+exZzJJhRNQ2ASbcXHWsFqH8hp8=
 github.com/beorn7/perks v0.0.0-20180321164747-3a771d992973/go.mod h1:Dwedo/Wpr24TaqPxmxbtue+5NUziq4I4S80YR8gNf3Q=
 github.com/beorn7/perks v1.0.0/go.mod h1:KWe93zE9D1o94FZ5RNwFwVgaQK1VOXiVxmqh+CedLV8=
 github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
@@ -94,48 +108,62 @@ github.com/bkielbasa/cyclop v1.2.3 h1:faIVMIGDIANuGPWH031CZJTi2ymOQBULs9H21HSMa5
 github.com/bkielbasa/cyclop v1.2.3/go.mod h1:kHTwA9Q0uZqOADdupvcFJQtp/ksSnytRMe8ztxG8Fuo=
 github.com/blizzy78/varnamelen v0.8.0 h1:oqSblyuQvFsW1hbBHh1zfwrKe3kcSj0rnXkKzsQ089M=
 github.com/blizzy78/varnamelen v0.8.0/go.mod h1:V9TzQZ4fLJ1DSrjVDfl89H7aMnTvKkApdHeyESmyR7k=
-github.com/bombsimon/wsl/v4 v4.5.0 h1:iZRsEvDdyhd2La0FVi5k6tYehpOR/R7qIUjmKk7N74A=
-github.com/bombsimon/wsl/v4 v4.5.0/go.mod h1:NOQ3aLF4nD7N5YPXMruR6ZXDOAqLoM0GEpLwTdvmOSc=
-github.com/breml/bidichk v0.3.2 h1:xV4flJ9V5xWTqxL+/PMFF6dtJPvZLPsyixAoPe8BGJs=
-github.com/breml/bidichk v0.3.2/go.mod h1:VzFLBxuYtT23z5+iVkamXO386OB+/sVwZOpIj6zXGos=
-github.com/breml/errchkjson v0.4.0 h1:gftf6uWZMtIa/Is3XJgibewBm2ksAQSY/kABDNFTAdk=
-github.com/breml/errchkjson v0.4.0/go.mod h1:AuBOSTHyLSaaAFlWsRSuRBIroCh3eh7ZHh5YeelDIk8=
-github.com/butuzov/ireturn v0.3.1 h1:mFgbEI6m+9W8oP/oDdfA34dLisRFCj2G6o/yiI1yZrY=
-github.com/butuzov/ireturn v0.3.1/go.mod h1:ZfRp+E7eJLC0NQmk1Nrm1LOrn/gQlOykv+cVPdiXH5M=
+github.com/bombsimon/wsl/v4 v4.7.0 h1:1Ilm9JBPRczjyUs6hvOPKvd7VL1Q++PL8M0SXBDf+jQ=
+github.com/bombsimon/wsl/v4 v4.7.0/go.mod h1:uV/+6BkffuzSAVYD+yGyld1AChO7/EuLrCF/8xTiapg=
+github.com/bombsimon/wsl/v5 v5.6.0 h1:4z+/sBqC5vUmSp1O0mS+czxwH9+LKXtCWtHH9rZGQL8=
+github.com/bombsimon/wsl/v5 v5.6.0/go.mod h1:Uqt2EfrMj2NV8UGoN1f1Y3m0NpUVCsUdrNCdet+8LvU=
+github.com/breml/bidichk v0.3.3 h1:WSM67ztRusf1sMoqH6/c4OBCUlRVTKq+CbSeo0R17sE=
+github.com/breml/bidichk v0.3.3/go.mod h1:ISbsut8OnjB367j5NseXEGGgO/th206dVa427kR8YTE=
+github.com/breml/errchkjson v0.4.1 h1:keFSS8D7A2T0haP9kzZTi7o26r7kE3vymjZNeNDRDwg=
+github.com/breml/errchkjson v0.4.1/go.mod h1:a23OvR6Qvcl7DG/Z4o0el6BRAjKnaReoPQFciAl9U3s=
+github.com/butuzov/ireturn v0.4.0 h1:+s76bF/PfeKEdbG8b54aCocxXmi0wvYdOVsWxVO7n8E=
+github.com/butuzov/ireturn v0.4.0/go.mod h1:ghI0FrCmap8pDWZwfPisFD1vEc56VKH4NpQUxDHta70=
 github.com/butuzov/mirror v1.3.0 h1:HdWCXzmwlQHdVhwvsfBb2Au0r3HyINry3bDWLYXiKoc=
 github.com/butuzov/mirror v1.3.0/go.mod h1:AEij0Z8YMALaq4yQj9CPPVYOyJQyiexpQEQgihajRfI=
-github.com/catenacyber/perfsprint v0.8.2 h1:+o9zVmCSVa7M4MvabsWvESEhpsMkhfE7k0sHNGL95yw=
-github.com/catenacyber/perfsprint v0.8.2/go.mod h1:q//VWC2fWbcdSLEY1R3l8n0zQCDPdE4IjZwyY1HMunM=
-github.com/ccojocar/zxcvbn-go v1.0.2 h1:na/czXU8RrhXO4EZme6eQJLR4PzcGsahsBOAwU6I3Vg=
-github.com/ccojocar/zxcvbn-go v1.0.2/go.mod h1:g1qkXtUSvHP8lhHp5GrSmTz6uWALGRMQdw6Qnz/hi60=
+github.com/catenacyber/perfsprint v0.10.1 h1:u7Riei30bk46XsG8nknMhKLXG9BcXz3+3tl/WpKm0PQ=
+github.com/catenacyber/perfsprint v0.10.1/go.mod h1:DJTGsi/Zufpuus6XPGJyKOTMELe347o6akPvWG9Zcsc=
+github.com/ccojocar/zxcvbn-go v1.0.4 h1:FWnCIRMXPj43ukfX000kvBZvV6raSxakYr1nzyNrUcc=
+github.com/ccojocar/zxcvbn-go v1.0.4/go.mod h1:3GxGX+rHmueTUMvm5ium7irpyjmm7ikxYFOSJB21Das=
 github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
 github.com/cespare/xxhash/v2 v2.1.1/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/cespare/xxhash/v2 v2.1.2/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
 github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
-github.com/charithe/durationcheck v0.0.10 h1:wgw73BiocdBDQPik+zcEoBG/ob8uyBHf2iyoHGPf5w4=
-github.com/charithe/durationcheck v0.0.10/go.mod h1:bCWXb7gYRysD1CU3C+u4ceO49LoGOY1C1L6uouGNreQ=
-github.com/chavacava/garif v0.1.0 h1:2JHa3hbYf5D9dsgseMKAmc/MZ109otzgNFk5s87H9Pc=
-github.com/chavacava/garif v0.1.0/go.mod h1:XMyYCkEL58DF0oyW4qDjjnPWONs2HBqYKI+UIPD+Gww=
+github.com/charithe/durationcheck v0.0.11 h1:g1/EX1eIiKS57NTWsYtHDZ/APfeXKhye1DidBcABctk=
+github.com/charithe/durationcheck v0.0.11/go.mod h1:x5iZaixRNl8ctbM+3B2RrPG5t856TxRyVQEnbIEM2X4=
+github.com/charmbracelet/colorprofile v0.2.3-0.20250311203215-f60798e515dc h1:4pZI35227imm7yK2bGPcfpFEmuY1gc2YSTShr4iJBfs=
+github.com/charmbracelet/colorprofile v0.2.3-0.20250311203215-f60798e515dc/go.mod h1:X4/0JoqgTIPSFcRA/P6INZzIuyqdFY5rm8tb41s9okk=
+github.com/charmbracelet/lipgloss v1.1.0 h1:vYXsiLHVkK7fp74RkV7b2kq9+zDLoEU4MZoFqR/noCY=
+github.com/charmbracelet/lipgloss v1.1.0/go.mod h1:/6Q8FR2o+kj8rz4Dq0zQc3vYf7X+B0binUUBwA0aL30=
+github.com/charmbracelet/x/ansi v0.10.1 h1:rL3Koar5XvX0pHGfovN03f5cxLbCF2YvLeyz7D2jVDQ=
+github.com/charmbracelet/x/ansi v0.10.1/go.mod h1:3RQDQ6lDnROptfpWuUVIUG64bD2g2BgntdxH0Ya5TeE=
+github.com/charmbracelet/x/cellbuf v0.0.13-0.20250311204145-2c3ea96c31dd h1:vy0GVL4jeHEwG5YOXDmi86oYw2yuYUGqz6a8sLwg0X8=
+github.com/charmbracelet/x/cellbuf v0.0.13-0.20250311204145-2c3ea96c31dd/go.mod h1:xe0nKWGd3eJgtqZRaN9RjMtK7xUYchjzPr7q6kcvCCs=
+github.com/charmbracelet/x/term v0.2.1 h1:AQeHeLZ1OqSXhrAWpYUtZyX1T3zVxfpZuEQMIQaGIAQ=
+github.com/charmbracelet/x/term v0.2.1/go.mod h1:oQ4enTYFV7QN4m0i9mzHrViD7TQKvNEEkHUMCmsxdUg=
 github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWRnGsAI=
 github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e/go.mod h1:nSuG5e5PlCu98SY8svDHJxuZscDgtXS6KTTbou5AhLI=
 github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU=
-github.com/ckaznocha/intrange v0.3.0 h1:VqnxtK32pxgkhJgYQEeOArVidIPg+ahLP7WBOXZd5ZY=
-github.com/ckaznocha/intrange v0.3.0/go.mod h1:+I/o2d2A1FBHgGELbGxzIcyd3/9l9DuwjM8FsbSS3Lo=
+github.com/ckaznocha/intrange v0.3.1 h1:j1onQyXvHUsPWujDH6WIjhyH26gkRt/txNlV7LspvJs=
+github.com/ckaznocha/intrange v0.3.1/go.mod h1:QVepyz1AkUoFQkpEqksSYpNpUo3c5W7nWh/s6SHIJJk=
 github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
 github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
 github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
 github.com/curioswitch/go-reassign v0.3.0 h1:dh3kpQHuADL3cobV/sSGETA8DOv457dwl+fbBAhrQPs=
 github.com/curioswitch/go-reassign v0.3.0/go.mod h1:nApPCCTtqLJN/s8HfItCcKV0jIPwluBOvZP+dsJGA88=
-github.com/daixiang0/gci v0.13.5 h1:kThgmH1yBmZSBCh1EJVxQ7JsHpm5Oms0AMed/0LaH4c=
-github.com/daixiang0/gci v0.13.5/go.mod h1:12etP2OniiIdP4q+kjUGrC/rUagga7ODbqsom5Eo5Yk=
+github.com/daixiang0/gci v0.13.7 h1:+0bG5eK9vlI08J+J/NWGbWPTNiXPG4WhNLJOkSxWITQ=
+github.com/daixiang0/gci v0.13.7/go.mod h1:812WVN6JLFY9S6Tv76twqmNqevN0pa3SX3nih0brVzQ=
+github.com/dave/dst v0.27.3 h1:P1HPoMza3cMEquVf9kKy8yXsFirry4zEnWOdYPOoIzY=
+github.com/dave/dst v0.27.3/go.mod h1:jHh6EOibnHgcUW3WjKHisiooEkYwqpHLBSX1iOBhEyc=
+github.com/dave/jennifer v1.7.1 h1:B4jJJDHelWcDhlRQxWeo0Npa/pYKBLrirAQoTN45txo=
+github.com/dave/jennifer v1.7.1/go.mod h1:nXbxhEmQfOZhWml3D1cDK5M1FLnMSozpbFN/m3RmGZc=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/denis-tingaikin/go-header v0.5.0 h1:SRdnP5ZKvcO9KKRP1KJrhFR3RrlGuD+42t4429eC9k8=
 github.com/denis-tingaikin/go-header v0.5.0/go.mod h1:mMenU5bWrok6Wl2UsZjy+1okegmwQ3UgWl4V1D8gjlY=
-github.com/dlclark/regexp2 v1.11.0 h1:G/nrcoOa7ZXlpoa/91N3X7mM3r8eIlMBBJZvsz/mxKI=
-github.com/dlclark/regexp2 v1.11.0/go.mod h1:DHkYz0B9wPfa6wondMfaivmHpzrQ3v9q8cnmRbL6yW8=
+github.com/dlclark/regexp2 v1.11.5 h1:Q/sSnsKerHeCkc/jSTNq1oCm7KiVgUMZRDUoRu0JQZQ=
+github.com/dlclark/regexp2 v1.11.5/go.mod h1:DHkYz0B9wPfa6wondMfaivmHpzrQ3v9q8cnmRbL6yW8=
 github.com/envoyproxy/go-control-plane v0.9.0/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
 github.com/envoyproxy/go-control-plane v0.9.1-0.20191026205805-5f8ba28d4473/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
 github.com/envoyproxy/go-control-plane v0.9.4/go.mod h1:6rpuAdCZL397s3pYoYcLgu1mIlRU8Am5FuJP05cCM98=
@@ -146,18 +174,18 @@ github.com/fatih/color v1.18.0 h1:S8gINlzdQ840/4pfAwic/ZE0djQEH3wM94VfqLTZcOM=
 github.com/fatih/color v1.18.0/go.mod h1:4FelSpRwEGDpQ12mAdzqdOukCy4u8WUtOY6lkT/6HfU=
 github.com/fatih/structtag v1.2.0 h1:/OdNE99OxoI/PqaW/SuSK9uxxT3f/tcSZgon/ssNSx4=
 github.com/fatih/structtag v1.2.0/go.mod h1:mBJUNpUnHmRKrKlQQlmCrh5PuhftFbNv8Ys4/aAZl94=
-github.com/firefart/nonamedreturns v1.0.5 h1:tM+Me2ZaXs8tfdDw3X6DOX++wMCOqzYUho6tUTYIdRA=
-github.com/firefart/nonamedreturns v1.0.5/go.mod h1:gHJjDqhGM4WyPt639SOZs+G89Ko7QKH5R5BhnO6xJhw=
+github.com/firefart/nonamedreturns v1.0.6 h1:vmiBcKV/3EqKY3ZiPxCINmpS431OcE1S47AQUwhrg8E=
+github.com/firefart/nonamedreturns v1.0.6/go.mod h1:R8NisJnSIpvPWheCq0mNRXJok6D8h7fagJTF8EMEwCo=
 github.com/frankban/quicktest v1.14.3 h1:FJKSZTDHjyhriyC81FLQ0LY93eSai0ZyR/ZIkd3ZUKE=
 github.com/frankban/quicktest v1.14.3/go.mod h1:mgiwOwqx65TmIk1wJ6Q7wvnVMocbUorkibMOrVTHZps=
 github.com/fsnotify/fsnotify v1.5.4 h1:jRbGcIw6P2Meqdwuo0H1p6JVLbL5DHKAKlYndzMwVZI=
 github.com/fsnotify/fsnotify v1.5.4/go.mod h1:OVB6XrOHzAwXMpEM7uPOzcehqUV2UqJxmVXmkdnm1bU=
 github.com/fzipp/gocyclo v0.6.0 h1:lsblElZG7d3ALtGMx9fmxeTKZaLLpU8mET09yN4BBLo=
 github.com/fzipp/gocyclo v0.6.0/go.mod h1:rXPyn8fnlpa0R2csP/31uerbiVBugk5whMdlyaLkLoA=
-github.com/ghostiam/protogetter v0.3.9 h1:j+zlLLWzqLay22Cz/aYwTHKQ88GE2DQ6GkWSYFOI4lQ=
-github.com/ghostiam/protogetter v0.3.9/go.mod h1:WZ0nw9pfzsgxuRsPOFQomgDVSWtDLJRfQJEhsGbmQMA=
-github.com/go-critic/go-critic v0.12.0 h1:iLosHZuye812wnkEz1Xu3aBwn5ocCPfc9yqmFG9pa6w=
-github.com/go-critic/go-critic v0.12.0/go.mod h1:DpE0P6OVc6JzVYzmM5gq5jMU31zLr4am5mB/VfFK64w=
+github.com/ghostiam/protogetter v0.3.20 h1:oW7OPFit2FxZOpmMRPP9FffU4uUpfeE/rEdE1f+MzD0=
+github.com/ghostiam/protogetter v0.3.20/go.mod h1:FjIu5Yfs6FT391m+Fjp3fbAYJ6rkL/J6ySpZBfnODuI=
+github.com/go-critic/go-critic v0.14.3 h1:5R1qH2iFeo4I/RJU8vTezdqs08Egi4u5p6vOESA0pog=
+github.com/go-critic/go-critic v0.14.3/go.mod h1:xwntfW6SYAd7h1OqDzmN6hBX/JxsEKl5up/Y2bsxgVQ=
 github.com/go-gl/glfw v0.0.0-20190409004039-e6da0acd62b1/go.mod h1:vR7hzQXu2zJy9AVAgeJqvqgH9Q5CA+iKCZ2gyEVpxRU=
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20191125211704-12ad95a8df72/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20200222043503-6f7a984d4dc4/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
@@ -167,8 +195,8 @@ github.com/go-kit/log v0.1.0/go.mod h1:zbhenjAZHb184qTLMA9ZjW7ThYL0H2mk7Q6pNt4vb
 github.com/go-logfmt/logfmt v0.3.0/go.mod h1:Qt1PoO58o5twSAckw1HlFXLmHsOX5/0LbT9GBnD5lWE=
 github.com/go-logfmt/logfmt v0.4.0/go.mod h1:3RMwSq7FuexP4Kalkev3ejPJsZTpXXBr9+V4qmtdjCk=
 github.com/go-logfmt/logfmt v0.5.0/go.mod h1:wCYkCAKZfumFQihp8CzCvQ3paCTfi41vtzG1KdI/P7A=
-github.com/go-logr/logr v1.4.2 h1:6pFjapn8bFcIbiKo3XT4j/BhANplGihG6tvd+8rYgrY=
-github.com/go-logr/logr v1.4.2/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
+github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
 github.com/go-quicktest/qt v1.101.0 h1:O1K29Txy5P2OK0dGo59b7b0LR6wKfIhttaAhHUyn7eI=
 github.com/go-quicktest/qt v1.101.0/go.mod h1:14Bz/f7NwaXPtdYEgzsx46kqSxVwTbzVZsDC26tQJow=
 github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
@@ -193,14 +221,16 @@ github.com/go-toolsmith/strparse v1.1.0 h1:GAioeZUK9TGxnLS+qfdqNbA4z0SSm5zVNtCQi
 github.com/go-toolsmith/strparse v1.1.0/go.mod h1:7ksGy58fsaQkGQlY8WVoBFNyEPMGuJin1rfoPS4lBSQ=
 github.com/go-toolsmith/typep v1.1.0 h1:fIRYDyF+JywLfqzyhdiHzRop/GQDxxNhLGQ6gFUNHus=
 github.com/go-toolsmith/typep v1.1.0/go.mod h1:fVIw+7zjdsMxDA3ITWnH1yOiw1rnTQKCsF/sk2H/qig=
-github.com/go-viper/mapstructure/v2 v2.2.1 h1:ZAaOCxANMuZx5RCeg0mBdEZk7DZasvvZIxtHqx8aGss=
-github.com/go-viper/mapstructure/v2 v2.2.1/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM=
+github.com/go-viper/mapstructure/v2 v2.5.0 h1:vM5IJoUAy3d7zRSVtIwQgBj7BiWtMPfmPEgAXnvj1Ro=
+github.com/go-viper/mapstructure/v2 v2.5.0/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM=
 github.com/go-xmlfmt/xmlfmt v1.1.3 h1:t8Ey3Uy7jDSEisW2K3somuMKIpzktkWptA0iFCnRUWY=
 github.com/go-xmlfmt/xmlfmt v1.1.3/go.mod h1:aUCEOzzezBEjDBbFBoSiya/gduyIiWYRP6CnSFIV8AM=
 github.com/gobwas/glob v0.2.3 h1:A4xDbljILXROh+kObIiy5kIaPYD8e96x1tgBhUI5J+Y=
 github.com/gobwas/glob v0.2.3/go.mod h1:d3Ez4x06l9bZtSvzIay5+Yzi0fmZzPgnTbPcKjJAkT8=
-github.com/gofrs/flock v0.12.1 h1:MTLVXXHf8ekldpJk3AKicLij9MdwOWkZ+a/jHHZby9E=
-github.com/gofrs/flock v0.12.1/go.mod h1:9zxTsyu5xtJ9DK+1tFZyibEV7y3uwDxPPfbxeeHCoD0=
+github.com/godoc-lint/godoc-lint v0.11.2 h1:Bp0FkJWoSdNsBikdNgIcgtaoo+xz6I/Y9s5WSBQUeeM=
+github.com/godoc-lint/godoc-lint v0.11.2/go.mod h1:iVpGdL1JCikNH2gGeAn3Hh+AgN5Gx/I/cxV+91L41jo=
+github.com/gofrs/flock v0.13.0 h1:95JolYOvGMqeH31+FC7D2+uULf6mG61mEZ/A8dRYMzw=
+github.com/gofrs/flock v0.13.0/go.mod h1:jxeyy9R1auM5S6JYDBhDt+E2TCo7DkratH4Pgi8P+Z0=
 github.com/gogo/protobuf v1.1.1/go.mod h1:r8qH/GZQm5c6nD/R0oafs1akxWv10x8SbQlK7atdtwQ=
 github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
 github.com/golang/groupcache v0.0.0-20190702054246-869f871628b6/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
@@ -231,22 +261,28 @@ github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaS
 github.com/golang/protobuf v1.5.2/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
 github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
 github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
+github.com/golangci/asciicheck v0.5.0 h1:jczN/BorERZwK8oiFBOGvlGPknhvq0bjnysTj4nUfo0=
+github.com/golangci/asciicheck v0.5.0/go.mod h1:5RMNAInbNFw2krqN6ibBxN/zfRFa9S6tA1nPdM0l8qQ=
 github.com/golangci/dupl v0.0.0-20250308024227-f665c8d69b32 h1:WUvBfQL6EW/40l6OmeSBYQJNSif4O11+bmWEz+C7FYw=
 github.com/golangci/dupl v0.0.0-20250308024227-f665c8d69b32/go.mod h1:NUw9Zr2Sy7+HxzdjIULge71wI6yEg1lWQr7Evcu8K0E=
-github.com/golangci/go-printf-func-name v0.1.0 h1:dVokQP+NMTO7jwO4bwsRwLWeudOVUPPyAKJuzv8pEJU=
-github.com/golangci/go-printf-func-name v0.1.0/go.mod h1:wqhWFH5mUdJQhweRnldEywnR5021wTdZSNgwYceV14s=
+github.com/golangci/go-printf-func-name v0.1.1 h1:hIYTFJqAGp1iwoIfsNTpoq1xZAarogrvjO9AfiW3B4U=
+github.com/golangci/go-printf-func-name v0.1.1/go.mod h1:Es64MpWEZbh0UBtTAICOZiB+miW53w/K9Or/4QogJss=
 github.com/golangci/gofmt v0.0.0-20250106114630-d62b90e6713d h1:viFft9sS/dxoYY0aiOTsLKO2aZQAPT4nlQCsimGcSGE=
 github.com/golangci/gofmt v0.0.0-20250106114630-d62b90e6713d/go.mod h1:ivJ9QDg0XucIkmwhzCDsqcnxxlDStoTl89jDMIoNxKY=
-github.com/golangci/golangci-lint v1.64.8 h1:y5TdeVidMtBGG32zgSC7ZXTFNHrsJkDnpO4ItB3Am+I=
-github.com/golangci/golangci-lint v1.64.8/go.mod h1:5cEsUQBSr6zi8XI8OjmcY2Xmliqc4iYL7YoPrL+zLJ4=
-github.com/golangci/misspell v0.6.0 h1:JCle2HUTNWirNlDIAUO44hUsKhOFqGPoC4LZxlaSXDs=
-github.com/golangci/misspell v0.6.0/go.mod h1:keMNyY6R9isGaSAu+4Q8NMBwMPkh15Gtc8UCVoDtAWo=
-github.com/golangci/plugin-module-register v0.1.1 h1:TCmesur25LnyJkpsVrupv1Cdzo+2f7zX0H6Jkw1Ol6c=
-github.com/golangci/plugin-module-register v0.1.1/go.mod h1:TTpqoB6KkwOJMV8u7+NyXMrkwwESJLOkfl9TxR1DGFc=
+github.com/golangci/golangci-lint/v2 v2.11.3 h1:ySX1GtLwlwOEzcLKJifI/aIVesrcHDno+5mrro8rWes=
+github.com/golangci/golangci-lint/v2 v2.11.3/go.mod h1:HmDEVZuxz77cNLumPfNNHAFyMX/b7IbA0tpmAbwiVfo=
+github.com/golangci/golines v0.15.0 h1:Qnph25g8Y1c5fdo1X7GaRDGgnMHgnxh4Gk4VfPTtRx0=
+github.com/golangci/golines v0.15.0/go.mod h1:AZjXd23tbHMpowhtnGlj9KCNsysj72aeZVVHnVcZx10=
+github.com/golangci/misspell v0.8.0 h1:qvxQhiE2/5z+BVRo1kwYA8yGz+lOlu5Jfvtx2b04Jbg=
+github.com/golangci/misspell v0.8.0/go.mod h1:WZyyI2P3hxPY2UVHs3cS8YcllAeyfquQcKfdeE9AFVg=
+github.com/golangci/plugin-module-register v0.1.2 h1:e5WM6PO6NIAEcij3B053CohVp3HIYbzSuP53UAYgOpg=
+github.com/golangci/plugin-module-register v0.1.2/go.mod h1:1+QGTsKBvAIvPvoY/os+G5eoqxWn70HYDm2uvUyGuVw=
 github.com/golangci/revgrep v0.8.0 h1:EZBctwbVd0aMeRnNUsFogoyayvKHyxlV3CdUA46FX2s=
 github.com/golangci/revgrep v0.8.0/go.mod h1:U4R/s9dlXZsg8uJmaR1GrloUr14D7qDl8gi2iPXJH8k=
-github.com/golangci/unconvert v0.0.0-20240309020433-c5143eacb3ed h1:IURFTjxeTfNFP0hTEi1YKjB/ub8zkpaOqFFMApi2EAs=
-github.com/golangci/unconvert v0.0.0-20240309020433-c5143eacb3ed/go.mod h1:XLXN8bNw4CGRPaqgl3bv/lhz7bsGPh4/xSaMTbo2vkQ=
+github.com/golangci/swaggoswag v0.0.0-20250504205917-77f2aca3143e h1:ai0EfmVYE2bRA5htgAG9r7s3tHsfjIhN98WshBTJ9jM=
+github.com/golangci/swaggoswag v0.0.0-20250504205917-77f2aca3143e/go.mod h1:Vrn4B5oR9qRwM+f54koyeH3yzphlecwERs0el27Fr/s=
+github.com/golangci/unconvert v0.0.0-20250410112200-a129a6e6413e h1:gD6P7NEo7Eqtt0ssnqSJNNndxe69DOQ24A5h7+i3KpM=
+github.com/golangci/unconvert v0.0.0-20250410112200-a129a6e6413e/go.mod h1:h+wZwLjUTJnm/P2rwlbJdRPZXOzaT36/FwnPnY2inzc=
 github.com/google/btree v0.0.0-20180813153112-4030bb1f1f0c/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
 github.com/google/btree v1.0.0/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
 github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M=
@@ -259,7 +295,6 @@ github.com/google/go-cmp v0.5.1/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/
 github.com/google/go-cmp v0.5.2/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.4/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.6/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.8/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
@@ -273,23 +308,22 @@ github.com/google/pprof v0.0.0-20200212024743-f11f1df84d12/go.mod h1:ZgVRPoUq/hf
 github.com/google/pprof v0.0.0-20200229191704-1ebb73c60ed3/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
 github.com/google/pprof v0.0.0-20200430221834-fc25d7d30c6d/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
 github.com/google/pprof v0.0.0-20200708004538-1a94d8640e99/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
-github.com/google/pprof v0.0.0-20241210010833-40e02aabc2ad h1:a6HEuzUHeKH6hwfN/ZoQgRgVIWFJljSWa/zetS2WTvg=
-github.com/google/pprof v0.0.0-20241210010833-40e02aabc2ad/go.mod h1:vavhavw2zAxS5dIdcRluK6cSGGPlZynqzFM8NdvU144=
+github.com/google/pprof v0.0.0-20260115054156-294ebfa9ad83 h1:z2ogiKUYzX5Is6zr/vP9vJGqPwcdqsWjOt+V8J7+bTc=
+github.com/google/pprof v0.0.0-20260115054156-294ebfa9ad83/go.mod h1:MxpfABSjhmINe3F1It9d+8exIHFvUqtLIRCdOGNXqiI=
 github.com/google/renameio v0.1.0/go.mod h1:KWCgfxg9yswjAJkECMjeO8J8rahYeXnNhOm40UhjYkI=
 github.com/googleapis/gax-go/v2 v2.0.4/go.mod h1:0Wqv26UfaUD9n4G6kQubkQ+KchISgw+vpHVxEJEs9eg=
 github.com/googleapis/gax-go/v2 v2.0.5/go.mod h1:DWXyrwAJ9X0FpwwEdw+IPEYBICEFu5mhpdKc/us6bOk=
-github.com/gordonklaus/ineffassign v0.1.0 h1:y2Gd/9I7MdY1oEIt+n+rowjBNDcLQq3RsH5hwJd0f9s=
-github.com/gordonklaus/ineffassign v0.1.0/go.mod h1:Qcp2HIAYhR7mNUVSIxZww3Guk4it82ghYcEXIAk+QT0=
+github.com/gordonklaus/ineffassign v0.2.0 h1:Uths4KnmwxNJNzq87fwQQDDnbNb7De00VOk9Nu0TySs=
+github.com/gordonklaus/ineffassign v0.2.0/go.mod h1:TIpymnagPSexySzs7F9FnO1XFTy8IT3a59vmZp5Y9Lw=
 github.com/gostaticanalysis/analysisutil v0.7.1 h1:ZMCjoue3DtDWQ5WyU16YbjbQEQ3VuzwxALrpYd+HeKk=
 github.com/gostaticanalysis/analysisutil v0.7.1/go.mod h1:v21E3hY37WKMGSnbsw2S/ojApNWb6C1//mXO48CXbVc=
-github.com/gostaticanalysis/comment v1.4.1/go.mod h1:ih6ZxzTHLdadaiSnF5WY3dxUoXfXAlTaRzuaNDlSado=
 github.com/gostaticanalysis/comment v1.4.2/go.mod h1:KLUTGDv6HOCotCH8h2erHKmpci2ZoR8VPu34YA2uzdM=
 github.com/gostaticanalysis/comment v1.5.0 h1:X82FLl+TswsUMpMh17srGRuKaaXprTaytmEpgnKIDu8=
 github.com/gostaticanalysis/comment v1.5.0/go.mod h1:V6eb3gpCv9GNVqb6amXzEUX3jXLVK/AdA+IrAMSqvEc=
 github.com/gostaticanalysis/forcetypeassert v0.2.0 h1:uSnWrrUEYDr86OCxWa4/Tp2jeYDlogZiZHzGkWFefTk=
 github.com/gostaticanalysis/forcetypeassert v0.2.0/go.mod h1:M5iPavzE9pPqWyeiVXSFghQjljW1+l/Uke3PXHS6ILY=
-github.com/gostaticanalysis/nilerr v0.1.1 h1:ThE+hJP0fEp4zWLkWHWcRyI2Od0p7DlgYG3Uqrmrcpk=
-github.com/gostaticanalysis/nilerr v0.1.1/go.mod h1:wZYb6YI5YAxxq0i1+VJbY0s2YONW0HU0GPE3+5PWN4A=
+github.com/gostaticanalysis/nilerr v0.1.2 h1:S6nk8a9N8g062nsx63kUkF6AzbHGw7zzyHMcpu52xQU=
+github.com/gostaticanalysis/nilerr v0.1.2/go.mod h1:A19UHhoY3y8ahoL7YKz6sdjDtduwTSI4CsymaC2htPA=
 github.com/gostaticanalysis/testutil v0.3.1-0.20210208050101-bfb5c8eec0e4/go.mod h1:D+FIZ+7OahH3ePw/izIEeH5I06eKs1IKI4Xr64/Am3M=
 github.com/gostaticanalysis/testutil v0.5.0 h1:Dq4wT1DdTwTGCQQv3rl3IvD5Ld0E6HiY+3Zh0sUGqw8=
 github.com/gostaticanalysis/testutil v0.5.0/go.mod h1:OLQSbuM6zw2EvCcXTz1lVq5unyoNft372msDY0nY5Hs=
@@ -298,8 +332,8 @@ github.com/hashicorp/go-immutable-radix/v2 v2.1.0/go.mod h1:hgdqLXA4f6NIjRVisM1T
 github.com/hashicorp/go-uuid v1.0.3 h1:2gKiV6YVmrJ1i2CKKa9obLvRieoRGviZFL26PcT/Co8=
 github.com/hashicorp/go-uuid v1.0.3/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
 github.com/hashicorp/go-version v1.2.1/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09ZGVZPK5anwXA=
-github.com/hashicorp/go-version v1.7.0 h1:5tqGy27NaOTB8yJKUZELlFAS/LTKJkrmONwQKeRZfjY=
-github.com/hashicorp/go-version v1.7.0/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09ZGVZPK5anwXA=
+github.com/hashicorp/go-version v1.8.0 h1:KAkNb1HAiZd1ukkxDFGmokVZe1Xy9HG6NUp+bPle2i4=
+github.com/hashicorp/go-version v1.8.0/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09ZGVZPK5anwXA=
 github.com/hashicorp/golang-lru v0.5.0/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
 github.com/hashicorp/golang-lru v0.5.1/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
 github.com/hashicorp/golang-lru/v2 v2.0.7 h1:a+bsQ5rvGLjzHuww6tVxozPZFVghXaHOwFs4luLUK2k=
@@ -311,12 +345,12 @@ github.com/hexops/gotextdiff v1.0.3/go.mod h1:pSWU5MAI3yDq+fZBTazCSJysOMbxWL1BSo
 github.com/ianlancetaylor/demangle v0.0.0-20181102032728-5e5cf60278f6/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc=
 github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
-github.com/jgautheron/goconst v1.7.1 h1:VpdAG7Ca7yvvJk5n8dMwQhfEZJh95kl/Hl9S1OI5Jkk=
-github.com/jgautheron/goconst v1.7.1/go.mod h1:aAosetZ5zaeC/2EfMeRswtxUFBpe2Hr7HzkgX4fanO4=
+github.com/jgautheron/goconst v1.8.2 h1:y0XF7X8CikZ93fSNT6WBTb/NElBu9IjaY7CCYQrCMX4=
+github.com/jgautheron/goconst v1.8.2/go.mod h1:A0oxgBCHy55NQn6sYpO7UdnA9p+h7cPtoOZUmvNIako=
 github.com/jingyugao/rowserrcheck v1.1.1 h1:zibz55j/MJtLsjP1OF4bSdgXxwL1b+Vn7Tjzq7gFzUs=
 github.com/jingyugao/rowserrcheck v1.1.1/go.mod h1:4yvlZSDb3IyDTUZJUmpZfm2Hwok+Dtp+nu2qOq+er9c=
-github.com/jjti/go-spancheck v0.6.4 h1:Tl7gQpYf4/TMU7AT84MN83/6PutY21Nb9fuQjFTpRRc=
-github.com/jjti/go-spancheck v0.6.4/go.mod h1:yAEYdKJ2lRkDA8g7X+oKUHXOWVAXSBJRv04OhF+QUjk=
+github.com/jjti/go-spancheck v0.6.5 h1:lmi7pKxa37oKYIMScialXUK6hP3iY5F1gu+mLBPgYB8=
+github.com/jjti/go-spancheck v0.6.5/go.mod h1:aEogkeatBrbYsyW6y5TgDfihCulDYciL1B7rG2vSsrU=
 github.com/jpillora/backoff v1.0.0/go.mod h1:J/6gKK9jxlEcS3zixgDgUAsiuZ7yrSoa/FX5e0EB2j4=
 github.com/json-iterator/go v1.1.6/go.mod h1:+SdeFBvtyEkXs7REEP0seUULqWtbJapLOCVDaaPEHmU=
 github.com/json-iterator/go v1.1.10/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
@@ -328,10 +362,10 @@ github.com/julienschmidt/httprouter v1.2.0/go.mod h1:SYymIcj16QtmaHHD7aYtjjsJG7V
 github.com/julienschmidt/httprouter v1.3.0/go.mod h1:JR6WtHb+2LUe8TCKY3cZOxFyyO8IZAc4RVcycCCAKdM=
 github.com/julz/importas v0.2.0 h1:y+MJN/UdL63QbFJHws9BVC5RpA2iq0kpjrFajTGivjQ=
 github.com/julz/importas v0.2.0/go.mod h1:pThlt589EnCYtMnmhmRYY/qn9lCf/frPOK+WMx3xiJY=
-github.com/karamaru-alpha/copyloopvar v1.2.1 h1:wmZaZYIjnJ0b5UoKDjUHrikcV0zuPyyxI4SVplLd2CI=
-github.com/karamaru-alpha/copyloopvar v1.2.1/go.mod h1:nFmMlFNlClC2BPvNaHMdkirmTJxVCY0lhxBtlfOypMM=
-github.com/kisielk/errcheck v1.9.0 h1:9xt1zI9EBfcYBvdU1nVrzMzzUPUtPKs9bVSIM3TAb3M=
-github.com/kisielk/errcheck v1.9.0/go.mod h1:kQxWMMVZgIkDq7U8xtG/n2juOjbLgZtedi0D+/VL/i8=
+github.com/karamaru-alpha/copyloopvar v1.2.2 h1:yfNQvP9YaGQR7VaWLYcfZUlRP2eo2vhExWKxD/fP6q0=
+github.com/karamaru-alpha/copyloopvar v1.2.2/go.mod h1:oY4rGZqZ879JkJMtX3RRkcXRkmUvH0x35ykgaKgsgJY=
+github.com/kisielk/errcheck v1.10.0 h1:Lvs/YAHP24YKg08LA8oDw2z9fJVme090RAXd90S+rrw=
+github.com/kisielk/errcheck v1.10.0/go.mod h1:kQxWMMVZgIkDq7U8xtG/n2juOjbLgZtedi0D+/VL/i8=
 github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
 github.com/kkHAIKE/contextcheck v1.1.6 h1:7HIyRcnyzxL9Lz06NGhiKvenXq7Zw6Q0UQu/ttjfJCE=
 github.com/kkHAIKE/contextcheck v1.1.6/go.mod h1:3dDbMRNBFaq8HFXWC1JyvDSPm43CmE6IuHam8Wr0rkg=
@@ -345,32 +379,40 @@ github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
 github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
-github.com/kulti/thelper v0.6.3 h1:ElhKf+AlItIu+xGnI990no4cE2+XaSu1ULymV2Yulxs=
-github.com/kulti/thelper v0.6.3/go.mod h1:DsqKShOvP40epevkFrvIwkCMNYxMeTNjdWL4dqWHZ6I=
-github.com/kunwardeep/paralleltest v1.0.10 h1:wrodoaKYzS2mdNVnc4/w31YaXFtsc21PCTdvWJ/lDDs=
-github.com/kunwardeep/paralleltest v1.0.10/go.mod h1:2C7s65hONVqY7Q5Efj5aLzRCNLjw2h4eMc9EcypGjcY=
+github.com/kulti/thelper v0.7.1 h1:fI8QITAoFVLx+y+vSyuLBP+rcVIB8jKooNSCT2EiI98=
+github.com/kulti/thelper v0.7.1/go.mod h1:NsMjfQEy6sd+9Kfw8kCP61W1I0nerGSYSFnGaxQkcbs=
+github.com/kunwardeep/paralleltest v1.0.15 h1:ZMk4Qt306tHIgKISHWFJAO1IDQJLc6uDyJMLyncOb6w=
+github.com/kunwardeep/paralleltest v1.0.15/go.mod h1:di4moFqtfz3ToSKxhNjhOZL+696QtJGCFe132CbBLGk=
 github.com/lasiar/canonicalheader v1.1.2 h1:vZ5uqwvDbyJCnMhmFYimgMZnJMjwljN5VGY0VKbMXb4=
 github.com/lasiar/canonicalheader v1.1.2/go.mod h1:qJCeLFS0G/QlLQ506T+Fk/fWMa2VmBUiEI2cuMK4djI=
-github.com/ldez/exptostd v0.4.2 h1:l5pOzHBz8mFOlbcifTxzfyYbgEmoUqjxLFHZkjlbHXs=
-github.com/ldez/exptostd v0.4.2/go.mod h1:iZBRYaUmcW5jwCR3KROEZ1KivQQp6PHXbDPk9hqJKCQ=
-github.com/ldez/gomoddirectives v0.6.1 h1:Z+PxGAY+217f/bSGjNZr/b2KTXcyYLgiWI6geMBN2Qc=
-github.com/ldez/gomoddirectives v0.6.1/go.mod h1:cVBiu3AHR9V31em9u2kwfMKD43ayN5/XDgr+cdaFaKs=
-github.com/ldez/grignotin v0.9.0 h1:MgOEmjZIVNn6p5wPaGp/0OKWyvq42KnzAt/DAb8O4Ow=
-github.com/ldez/grignotin v0.9.0/go.mod h1:uaVTr0SoZ1KBii33c47O1M8Jp3OP3YDwhZCmzT9GHEk=
-github.com/ldez/tagliatelle v0.7.1 h1:bTgKjjc2sQcsgPiT902+aadvMjCeMHrY7ly2XKFORIk=
-github.com/ldez/tagliatelle v0.7.1/go.mod h1:3zjxUpsNB2aEZScWiZTHrAXOl1x25t3cRmzfK1mlo2I=
-github.com/ldez/usetesting v0.4.2 h1:J2WwbrFGk3wx4cZwSMiCQQ00kjGR0+tuuyW0Lqm4lwA=
-github.com/ldez/usetesting v0.4.2/go.mod h1:eEs46T3PpQ+9RgN9VjpY6qWdiw2/QmfiDeWmdZdrjIQ=
+github.com/ldez/exptostd v0.4.5 h1:kv2ZGUVI6VwRfp/+bcQ6Nbx0ghFWcGIKInkG/oFn1aQ=
+github.com/ldez/exptostd v0.4.5/go.mod h1:QRjHRMXJrCTIm9WxVNH6VW7oN7KrGSht69bIRwvdFsM=
+github.com/ldez/gomoddirectives v0.8.0 h1:JqIuTtgvFC2RdH1s357vrE23WJF2cpDCPFgA/TWDGpk=
+github.com/ldez/gomoddirectives v0.8.0/go.mod h1:jutzamvZR4XYJLr0d5Honycp4Gy6GEg2mS9+2YX3F1Q=
+github.com/ldez/grignotin v0.10.1 h1:keYi9rYsgbvqAZGI1liek5c+jv9UUjbvdj3Tbn5fn4o=
+github.com/ldez/grignotin v0.10.1/go.mod h1:UlDbXFCARrXbWGNGP3S5vsysNXAPhnSuBufpTEbwOas=
+github.com/ldez/structtags v0.6.1 h1:bUooFLbXx41tW8SvkfwfFkkjPYvFFs59AAMgVg6DUBk=
+github.com/ldez/structtags v0.6.1/go.mod h1:YDxVSgDy/MON6ariaxLF2X09bh19qL7MtGBN5MrvbdY=
+github.com/ldez/tagliatelle v0.7.2 h1:KuOlL70/fu9paxuxbeqlicJnCspCRjH0x8FW+NfgYUk=
+github.com/ldez/tagliatelle v0.7.2/go.mod h1:PtGgm163ZplJfZMZ2sf5nhUT170rSuPgBimoyYtdaSI=
+github.com/ldez/usetesting v0.5.0 h1:3/QtzZObBKLy1F4F8jLuKJiKBjjVFi1IavpoWbmqLwc=
+github.com/ldez/usetesting v0.5.0/go.mod h1:Spnb4Qppf8JTuRgblLrEWb7IE6rDmUpGvxY3iRrzvDQ=
 github.com/leonklingele/grouper v1.1.2 h1:o1ARBDLOmmasUaNDesWqWCIFH3u7hoFlM84YrjT3mIY=
 github.com/leonklingele/grouper v1.1.2/go.mod h1:6D0M/HVkhs2yRKRFZUoGjeDy7EZTfFBE9gl4kjmIGkA=
-github.com/macabu/inamedparam v0.1.3 h1:2tk/phHkMlEL/1GNe/Yf6kkR/hkcUdAEY3L0hjYV1Mk=
-github.com/macabu/inamedparam v0.1.3/go.mod h1:93FLICAIk/quk7eaPPQvbzihUdn/QkGDwIZEoLtpH6I=
+github.com/lucasb-eyer/go-colorful v1.2.0 h1:1nnpGOrhyZZuNyfu1QjKiUICQ74+3FNCN69Aj6K7nkY=
+github.com/lucasb-eyer/go-colorful v1.2.0/go.mod h1:R4dSotOR9KMtayYi1e77YzuveK+i7ruzyGqttikkLy0=
+github.com/macabu/inamedparam v0.2.0 h1:VyPYpOc10nkhI2qeNUdh3Zket4fcZjEWe35poddBCpE=
+github.com/macabu/inamedparam v0.2.0/go.mod h1:+Pee9/YfGe5LJ62pYXqB89lJ+0k5bsR8Wgz/C0Zlq3U=
 github.com/magiconair/properties v1.8.6 h1:5ibWZ6iY0NctNGWo87LalDlEZ6R41TqbbDamhfG/Qzo=
 github.com/magiconair/properties v1.8.6/go.mod h1:y3VJvCyxH9uVvJTWEGAELF3aiYNyPKd5NZ3oSwXrF60=
-github.com/maratori/testableexamples v1.0.0 h1:dU5alXRrD8WKSjOUnmJZuzdxWOEQ57+7s93SLMxb2vI=
-github.com/maratori/testableexamples v1.0.0/go.mod h1:4rhjL1n20TUTT4vdh3RDqSizKLyXp7K2u6HgraZCGzE=
-github.com/maratori/testpackage v1.1.1 h1:S58XVV5AD7HADMmD0fNnziNHqKvSdDuEKdPD1rNTU04=
-github.com/maratori/testpackage v1.1.1/go.mod h1:s4gRK/ym6AMrqpOa/kEbQTV4Q4jb7WeLZzVhVVVOQMc=
+github.com/manuelarte/embeddedstructfieldcheck v0.4.0 h1:3mAIyaGRtjK6EO9E73JlXLtiy7ha80b2ZVGyacxgfww=
+github.com/manuelarte/embeddedstructfieldcheck v0.4.0/go.mod h1:z8dFSyXqp+fC6NLDSljRJeNQJJDWnY7RoWFzV3PC6UM=
+github.com/manuelarte/funcorder v0.5.0 h1:llMuHXXbg7tD0i/LNw8vGnkDTHFpTnWqKPI85Rknc+8=
+github.com/manuelarte/funcorder v0.5.0/go.mod h1:Yt3CiUQthSBMBxjShjdXMexmzpP8YGvGLjrxJNkO2hA=
+github.com/maratori/testableexamples v1.0.1 h1:HfOQXs+XgfeRBJ+Wz0XfH+FHnoY9TVqL6Fcevpzy4q8=
+github.com/maratori/testableexamples v1.0.1/go.mod h1:XE2F/nQs7B9N08JgyRmdGjYVGqxWwClLPCGSQhXQSrQ=
+github.com/maratori/testpackage v1.1.2 h1:ffDSh+AgqluCLMXhM19f/cpvQAKygKAJXFl9aUjmbqs=
+github.com/maratori/testpackage v1.1.2/go.mod h1:8F24GdVDFW5Ew43Et02jamrVMNXLUNaOynhDssITGfc=
 github.com/matoous/godox v1.1.0 h1:W5mqwbyWrwZv6OQ5Z1a/DHGMOvXYCBP3+Ht7KMoJhq4=
 github.com/matoous/godox v1.1.0/go.mod h1:jgE/3fUXiTurkdHOLT5WEkThTSuE7yxHv5iWPa80afs=
 github.com/matryer/is v1.4.0 h1:sosSmIWwkYITGrxZ25ULNDeKiMNzFSr4V/eqBQP0PeE=
@@ -379,13 +421,12 @@ github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHP
 github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
 github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
 github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
-github.com/mattn/go-runewidth v0.0.9/go.mod h1:H031xJmbD/WCDINGzjvQ9THkh0rPKHF+m2gUSrubnMI=
 github.com/mattn/go-runewidth v0.0.16 h1:E5ScNMtiwvlvB5paMFdw9p4kSQzbXFikJ5SQO6TULQc=
 github.com/mattn/go-runewidth v0.0.16/go.mod h1:Jdepj2loyihRzMpdS35Xk/zdY8IAYHsh153qUoGf23w=
 github.com/matttproud/golang_protobuf_extensions v1.0.1 h1:4hp9jkHxhMHkqkrB3Ix0jegS5sx/RkqARlsWZ6pIwiU=
 github.com/matttproud/golang_protobuf_extensions v1.0.1/go.mod h1:D8He9yQNgCq6Z5Ld7szi9bcBfOoFv/3dc6xSMkL2PC0=
-github.com/mgechev/revive v1.7.0 h1:JyeQ4yO5K8aZhIKf5rec56u0376h8AlKNQEmjfkjKlY=
-github.com/mgechev/revive v1.7.0/go.mod h1:qZnwcNhoguE58dfi96IJeSTPeZQejNeoMQLUZGi4SW4=
+github.com/mgechev/revive v1.15.0 h1:vJ0HzSBzfNyPbHKolgiFjHxLek9KUijhqh42yGoqZ8Q=
+github.com/mgechev/revive v1.15.0/go.mod h1:LlAKO3QQe9OJ0pVZzI2GPa8CbXGZ/9lNpCGvK4T/a8A=
 github.com/mitchellh/go-homedir v1.1.0 h1:lukF9ziXFxDFPkA1vsr5zpc1XuPDn/wFntq5mG+4E0Y=
 github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
 github.com/mitchellh/mapstructure v1.5.0 h1:jeMsZIYE/09sWLaz43PL7Gy6RuMjD2eJVyuac5Z2hdY=
@@ -397,6 +438,8 @@ github.com/modern-go/reflect2 v1.0.1/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3Rllmb
 github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
 github.com/moricho/tparallel v0.3.2 h1:odr8aZVFA3NZrNybggMkYO3rgPRcqjeQUlBBFVxKHTI=
 github.com/moricho/tparallel v0.3.2/go.mod h1:OQ+K3b4Ln3l2TZveGCywybl68glfLEwFGqvnjok8b+U=
+github.com/muesli/termenv v0.16.0 h1:S5AlUN9dENB57rsbnkPyfdGuWIlkmzJjbFf0Tf5FWUc=
+github.com/muesli/termenv v0.16.0/go.mod h1:ZRfOIKPFDYQoDFF4Olj7/QJbW60Ol/kL1pU3VfY/Cnk=
 github.com/mwitkow/go-conntrack v0.0.0-20161129095857-cc309e4a2223/go.mod h1:qRWi+5nqEBWmkhHvq77mSJWrCKwh8bxhgT7d/eI7P4U=
 github.com/mwitkow/go-conntrack v0.0.0-20190716064945-2f068394615f/go.mod h1:qRWi+5nqEBWmkhHvq77mSJWrCKwh8bxhgT7d/eI7P4U=
 github.com/nakabonne/nestif v0.3.1 h1:wm28nZjhQY5HyYPx+weN3Q65k6ilSBxDb8v5S81B81U=
@@ -405,14 +448,12 @@ github.com/nishanths/exhaustive v0.12.0 h1:vIY9sALmw6T/yxiASewa4TQcFsVYZQQRUQJhK
 github.com/nishanths/exhaustive v0.12.0/go.mod h1:mEZ95wPIZW+x8kC4TgC+9YCUgiST7ecevsVDTgc2obs=
 github.com/nishanths/predeclared v0.2.2 h1:V2EPdZPliZymNAn79T8RkNApBjMmVKh5XRpLm/w98Vk=
 github.com/nishanths/predeclared v0.2.2/go.mod h1:RROzoN6TnGQupbC+lqggsOlcgysk3LMK/HI84Mp280c=
-github.com/nunnatsa/ginkgolinter v0.19.1 h1:mjwbOlDQxZi9Cal+KfbEJTCz327OLNfwNvoZ70NJ+c4=
-github.com/nunnatsa/ginkgolinter v0.19.1/go.mod h1:jkQ3naZDmxaZMXPWaS9rblH+i+GWXQCaS/JFIWcOH2s=
-github.com/olekukonko/tablewriter v0.0.5 h1:P2Ga83D34wi1o9J6Wh1mRuqd4mF/x/lgBS7N7AbDhec=
-github.com/olekukonko/tablewriter v0.0.5/go.mod h1:hPp6KlRPjbx+hW8ykQs1w3UBbZlj6HuIJcUGPhkA7kY=
-github.com/onsi/ginkgo/v2 v2.22.2 h1:/3X8Panh8/WwhU/3Ssa6rCKqPLuAkVY2I0RoyDLySlU=
-github.com/onsi/ginkgo/v2 v2.22.2/go.mod h1:oeMosUL+8LtarXBHu/c0bx2D/K9zyQ6uX3cTyztHwsk=
-github.com/onsi/gomega v1.36.2 h1:koNYke6TVk6ZmnyHrCXba/T/MoLBXFjeC1PtvYgw0A8=
-github.com/onsi/gomega v1.36.2/go.mod h1:DdwyADRjrc825LhMEkD76cHR5+pUnjhUN8GlHlRPHzY=
+github.com/nunnatsa/ginkgolinter v0.23.0 h1:x3o4DGYOWbBMP/VdNQKgSj+25aJKx2Pe6lHr8gBcgf8=
+github.com/nunnatsa/ginkgolinter v0.23.0/go.mod h1:9qN1+0akwXEccwV1CAcCDfcoBlWXHB+ML9884pL4SZ4=
+github.com/onsi/ginkgo/v2 v2.28.1 h1:S4hj+HbZp40fNKuLUQOYLDgZLwNUVn19N3Atb98NCyI=
+github.com/onsi/ginkgo/v2 v2.28.1/go.mod h1:CLtbVInNckU3/+gC8LzkGUb9oF+e8W8TdUsxPwvdOgE=
+github.com/onsi/gomega v1.39.1 h1:1IJLAad4zjPn2PsnhH70V4DKRFlrCzGBNrNaru+Vf28=
+github.com/onsi/gomega v1.39.1/go.mod h1:hL6yVALoTOxeWudERyfppUcZXjMwIMLnuSfruD2lcfg=
 github.com/otiai10/copy v1.2.0/go.mod h1:rrF5dJ5F0t/EWSYODDu4j9/vEeYHMkc8jt0zJChqQWw=
 github.com/otiai10/copy v1.14.0 h1:dCI/t1iTdYGtkvCuBG2BgR6KZa83PTclw4U5n2wAllU=
 github.com/otiai10/copy v1.14.0/go.mod h1:ECfuL02W+/FkTWZWgQqXPWZgW9oeKCSQ5qVfSc4qc4w=
@@ -422,18 +463,13 @@ github.com/otiai10/mint v1.3.0/go.mod h1:F5AjcsTsWUqX+Na9fpHb52P8pcRX2CI6A3ctIT9
 github.com/otiai10/mint v1.3.1/go.mod h1:/yxELlJQ0ufhjUwhshSj+wFjZ78CnZ48/1wtmBH1OTc=
 github.com/pelletier/go-toml v1.9.5 h1:4yBQzkHv+7BHq2PQUZF3Mx0IYxG7LsP222s7Agd3ve8=
 github.com/pelletier/go-toml v1.9.5/go.mod h1:u1nR/EPcESfeI/szUZKdtJ0xRNbUoANCkoOuaOx1Y+c=
-github.com/pelletier/go-toml/v2 v2.2.3 h1:YmeHyLY8mFWbdkNWwpr+qIL2bEqT0o95WSdkNHvL12M=
-github.com/pelletier/go-toml/v2 v2.2.3/go.mod h1:MfCQTFTvCcUyyvvwm1+G6H/jORL20Xlb6rzQu9GuUkc=
+github.com/pelletier/go-toml/v2 v2.2.4 h1:mye9XuhQ6gvn5h28+VilKrrPoQVanw5PMw/TB0t5Ec4=
+github.com/pelletier/go-toml/v2 v2.2.4/go.mod h1:2gIqNv+qfxSVS7cM2xJQKtLSTLUE9V8t9Stt+h56mCY=
 github.com/pkg/errors v0.8.0/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
-github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/polyfloyd/go-errorlint v1.7.1 h1:RyLVXIbosq1gBdk/pChWA8zWYLsq9UEw7a1L5TVMCnA=
-github.com/polyfloyd/go-errorlint v1.7.1/go.mod h1:aXjNb1x2TNhoLsk26iv1yl7a+zTnXPhwEMtEXukiLR8=
-github.com/prashantv/gostub v1.1.0 h1:BTyx3RfQjRHnUWaGF9oQos79AlQ5k8WNktv7VGvVH4g=
-github.com/prashantv/gostub v1.1.0/go.mod h1:A5zLQHz7ieHGG7is6LLXLz7I8+3LZzsrV0P1IAHhP5U=
 github.com/prometheus/client_golang v0.9.1/go.mod h1:7SWBe2y4D6OKWSNQJUaRYU/AaXPKyh/dDVn+NZz0KFw=
 github.com/prometheus/client_golang v1.0.0/go.mod h1:db9x61etRT2tGnBNRi70OPL5FsnadC4Ky3P0J6CfImo=
 github.com/prometheus/client_golang v1.7.1/go.mod h1:PY5Wy2awLA44sXw4AOSfFBetzPP4j5+D6mVACh+pe2M=
@@ -456,10 +492,10 @@ github.com/prometheus/procfs v0.1.3/go.mod h1:lV6e/gmhEcM9IjHGsFOCxxuZ+z1YqCvr4O
 github.com/prometheus/procfs v0.6.0/go.mod h1:cz+aTbrPOrUb4q7XlbU9ygM+/jj0fzG6c1xBZuNvfVA=
 github.com/prometheus/procfs v0.7.3 h1:4jVXhlkAyzOScmCkXBTOLRLTz8EeU+eyjrwB/EPq0VU=
 github.com/prometheus/procfs v0.7.3/go.mod h1:cz+aTbrPOrUb4q7XlbU9ygM+/jj0fzG6c1xBZuNvfVA=
-github.com/quasilyte/go-ruleguard v0.4.3-0.20240823090925-0fe6f58b47b1 h1:+Wl/0aFp0hpuHM3H//KMft64WQ1yX9LdJY64Qm/gFCo=
-github.com/quasilyte/go-ruleguard v0.4.3-0.20240823090925-0fe6f58b47b1/go.mod h1:GJLgqsLeo4qgavUoL8JeGFNS7qcisx3awV/w9eWTmNI=
-github.com/quasilyte/go-ruleguard/dsl v0.3.22 h1:wd8zkOhSNr+I+8Qeciml08ivDt1pSXe60+5DqOpCjPE=
-github.com/quasilyte/go-ruleguard/dsl v0.3.22/go.mod h1:KeCP03KrjuSO0H1kTuZQCWlQPulDV6YMIXmpQss17rU=
+github.com/quasilyte/go-ruleguard v0.4.5 h1:AGY0tiOT5hJX9BTdx/xBdoCubQUAE2grkqY2lSwvZcA=
+github.com/quasilyte/go-ruleguard v0.4.5/go.mod h1:Vl05zJ538vcEEwu16V/Hdu7IYZWyKSwIy4c88Ro1kRE=
+github.com/quasilyte/go-ruleguard/dsl v0.3.23 h1:lxjt5B6ZCiBeeNO8/oQsegE6fLeCzuMRoVWSkXC4uvY=
+github.com/quasilyte/go-ruleguard/dsl v0.3.23/go.mod h1:KeCP03KrjuSO0H1kTuZQCWlQPulDV6YMIXmpQss17rU=
 github.com/quasilyte/gogrep v0.5.0 h1:eTKODPXbI8ffJMN+W2aE0+oL0z/nh8/5eNdiO34SOAo=
 github.com/quasilyte/gogrep v0.5.0/go.mod h1:Cm9lpz9NZjEoL1tgZ2OgeUKPIxL1meE7eo60Z6Sk+Ng=
 github.com/quasilyte/regex/syntax v0.0.0-20210819130434-b3f0c404a727 h1:TCg2WBOl980XxGFEZSS6KlBGIV0diGdySzxATTWoqaU=
@@ -475,96 +511,90 @@ github.com/rogpeppe/go-internal v1.3.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFR
 github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
 github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
-github.com/ryancurrah/gomodguard v1.3.5 h1:cShyguSwUEeC0jS7ylOiG/idnd1TpJ1LfHGpV3oJmPU=
-github.com/ryancurrah/gomodguard v1.3.5/go.mod h1:MXlEPQRxgfPQa62O8wzK3Ozbkv9Rkqr+wKjSxTdsNJE=
+github.com/ryancurrah/gomodguard v1.4.1 h1:eWC8eUMNZ/wM/PWuZBv7JxxqT5fiIKSIyTvjb7Elr+g=
+github.com/ryancurrah/gomodguard v1.4.1/go.mod h1:qnMJwV1hX9m+YJseXEBhd2s90+1Xn6x9dLz11ualI1I=
 github.com/ryanrolds/sqlclosecheck v0.5.1 h1:dibWW826u0P8jNLsLN+En7+RqWWTYrjCB9fJfSfdyCU=
 github.com/ryanrolds/sqlclosecheck v0.5.1/go.mod h1:2g3dUjoS6AL4huFdv6wn55WpLIDjY7ZgUR4J8HOO/XQ=
 github.com/sanposhiho/wastedassign/v2 v2.1.0 h1:crurBF7fJKIORrV85u9UUpePDYGWnwvv3+A96WvwXT0=
 github.com/sanposhiho/wastedassign/v2 v2.1.0/go.mod h1:+oSmSC+9bQ+VUAxA66nBb0Z7N8CK7mscKTDYC6aIek4=
-github.com/santhosh-tekuri/jsonschema/v6 v6.0.1 h1:PKK9DyHxif4LZo+uQSgXNqs0jj5+xZwwfKHgph2lxBw=
-github.com/santhosh-tekuri/jsonschema/v6 v6.0.1/go.mod h1:JXeL+ps8p7/KNMjDQk3TCwPpBy0wYklyWTfbkIzdIFU=
+github.com/santhosh-tekuri/jsonschema/v6 v6.0.2 h1:KRzFb2m7YtdldCEkzs6KqmJw4nqEVZGK7IN2kJkjTuQ=
+github.com/santhosh-tekuri/jsonschema/v6 v6.0.2/go.mod h1:JXeL+ps8p7/KNMjDQk3TCwPpBy0wYklyWTfbkIzdIFU=
 github.com/sashamelentyev/interfacebloat v1.1.0 h1:xdRdJp0irL086OyW1H/RTZTr1h/tMEOsumirXcOJqAw=
 github.com/sashamelentyev/interfacebloat v1.1.0/go.mod h1:+Y9yU5YdTkrNvoX0xHc84dxiN1iBi9+G8zZIhPVoNjQ=
-github.com/sashamelentyev/usestdlibvars v1.28.0 h1:jZnudE2zKCtYlGzLVreNp5pmCdOxXUzwsMDBkR21cyQ=
-github.com/sashamelentyev/usestdlibvars v1.28.0/go.mod h1:9nl0jgOfHKWNFS43Ojw0i7aRoS4j6EBye3YBhmAIRF8=
-github.com/securego/gosec/v2 v2.22.2 h1:IXbuI7cJninj0nRpZSLCUlotsj8jGusohfONMrHoF6g=
-github.com/securego/gosec/v2 v2.22.2/go.mod h1:UEBGA+dSKb+VqM6TdehR7lnQtIIMorYJ4/9CW1KVQBE=
+github.com/sashamelentyev/usestdlibvars v1.29.0 h1:8J0MoRrw4/NAXtjQqTHrbW9NN+3iMf7Knkq057v4XOQ=
+github.com/sashamelentyev/usestdlibvars v1.29.0/go.mod h1:8PpnjHMk5VdeWlVb4wCdrB8PNbLqZ3wBZTZWkrpZZL8=
+github.com/securego/gosec/v2 v2.24.8-0.20260309165252-619ce2117e08 h1:AoLtJX4WUtZkhhUUMFy3GgecAALp/Mb4S1iyQOA2s0U=
+github.com/securego/gosec/v2 v2.24.8-0.20260309165252-619ce2117e08/go.mod h1:+XLCJiRE95ga77XInNELh2M6zQP+PdqiT9Zpm0D9Wpk=
+github.com/sergi/go-diff v1.2.0 h1:XU+rvMAioB0UC3q1MFrIQy4Vo5/4VsRDQQXHsEya6xQ=
+github.com/sergi/go-diff v1.2.0/go.mod h1:STckp+ISIX8hZLjrqAeVduY0gWCT9IjLuqbuNXdaHfM=
 github.com/shurcooL/go v0.0.0-20180423040247-9e1955d9fb6e/go.mod h1:TDJrrUr11Vxrven61rcy3hJMUqaf/CLWYhHNPmT14Lk=
 github.com/shurcooL/go-goon v0.0.0-20170922171312-37c2f522c041/go.mod h1:N5mDOmsrJOB+vfqUK+7DmDyjhSLIIBnXo9lvZJj3MWQ=
 github.com/sirupsen/logrus v1.2.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPxbbu5VWo=
 github.com/sirupsen/logrus v1.4.2/go.mod h1:tLMulIdttU9McNUspp0xgXVQah82FyeX6MwdIuYE2rE=
 github.com/sirupsen/logrus v1.6.0/go.mod h1:7uNnSEd1DgxDLC74fIahvMZmmYsHGZGEOFrfsX/uA88=
-github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
-github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
+github.com/sirupsen/logrus v1.9.4 h1:TsZE7l11zFCLZnZ+teH4Umoq5BhEIfIzfRDZ1Uzql2w=
+github.com/sirupsen/logrus v1.9.4/go.mod h1:ftWc9WdOfJ0a92nsE2jF5u5ZwH8Bv2zdeOC42RjbV2g=
 github.com/sivchari/containedctx v1.0.3 h1:x+etemjbsh2fB5ewm5FeLNi5bUjK0V8n0RB+Wwfd0XE=
 github.com/sivchari/containedctx v1.0.3/go.mod h1:c1RDvCbnJLtH4lLcYD/GqwiBSSf4F5Qk0xld2rBqzJ4=
-github.com/sivchari/tenv v1.12.1 h1:+E0QzjktdnExv/wwsnnyk4oqZBUfuh89YMQT1cyuvSY=
-github.com/sivchari/tenv v1.12.1/go.mod h1:1LjSOUCc25snIr5n3DtGGrENhX3LuWefcplwVGC24mw=
-github.com/sonatard/noctx v0.1.0 h1:JjqOc2WN16ISWAjAk8M5ej0RfExEXtkEyExl2hLW+OM=
-github.com/sonatard/noctx v0.1.0/go.mod h1:0RvBxqY8D4j9cTTTWE8ylt2vqj2EPI8fHmrxHdsaZ2c=
+github.com/sonatard/noctx v0.5.0 h1:e/jdaqAsuWVOKQ0P6NWiIdDNHmHT5SwuuSfojFjzwrw=
+github.com/sonatard/noctx v0.5.0/go.mod h1:64XdbzFb18XL4LporKXp8poqZtPKbCrqQ402CV+kJas=
 github.com/sourcegraph/go-diff v0.7.0 h1:9uLlrd5T46OXs5qpp8L/MTltk0zikUGi0sNNyCpA8G0=
 github.com/sourcegraph/go-diff v0.7.0/go.mod h1:iBszgVvyxdc8SFZ7gm69go2KDdt3ag071iBaWPF6cjs=
-github.com/spf13/afero v1.12.0 h1:UcOPyRBYczmFn6yvphxkn9ZEOY65cpwGKb5mL36mrqs=
-github.com/spf13/afero v1.12.0/go.mod h1:ZTlWwG4/ahT8W7T0WQ5uYmjI9duaLQGy3Q2OAl4sk/4=
+github.com/spf13/afero v1.15.0 h1:b/YBCLWAJdFWJTN9cLhiXXcD7mzKn9Dm86dNnfyQw1I=
+github.com/spf13/afero v1.15.0/go.mod h1:NC2ByUVxtQs4b3sIUphxK0NioZnmxgyCrfzeuq8lxMg=
 github.com/spf13/cast v1.5.0 h1:rj3WzYc11XZaIZMPKmwP96zkFEnnAmV8s6XbB2aY32w=
 github.com/spf13/cast v1.5.0/go.mod h1:SpXXQ5YoyJw6s3/6cMTQuxvgRl3PCJiyaX9p6b155UU=
-github.com/spf13/cobra v1.9.1 h1:CXSaggrXdbHK9CF+8ywj8Amf7PBRmPCOJugH954Nnlo=
-github.com/spf13/cobra v1.9.1/go.mod h1:nDyEzZ8ogv936Cinf6g1RU9MRY64Ir93oCnqb9wxYW0=
+github.com/spf13/cobra v1.10.2 h1:DMTTonx5m65Ic0GOoRY2c16WCbHxOOw6xxezuLaBpcU=
+github.com/spf13/cobra v1.10.2/go.mod h1:7C1pvHqHw5A4vrJfjNwvOdzYu0Gml16OCs2GRiTUUS4=
 github.com/spf13/jwalterweatherman v1.1.0 h1:ue6voC5bR5F8YxI5S67j9i582FU4Qvo2bmqnqMYADFk=
 github.com/spf13/jwalterweatherman v1.1.0/go.mod h1:aNWZUN0dPAAO/Ljvb5BEdw96iTZ0EXowPYD95IqWIGo=
 github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
-github.com/spf13/pflag v1.0.6 h1:jFzHGLGAlb3ruxLB8MhbI6A8+AQX/2eW4qeyNZXNp2o=
-github.com/spf13/pflag v1.0.6/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/spf13/pflag v1.0.9/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
+github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 github.com/spf13/viper v1.12.0 h1:CZ7eSOd3kZoaYDLbXnmzgQI5RlciuXBMA+18HwHRfZQ=
 github.com/spf13/viper v1.12.0/go.mod h1:b6COn30jlNxbm/V2IqWiNWkJ+vZNiMNksliPCiuKtSI=
 github.com/ssgreg/nlreturn/v2 v2.2.1 h1:X4XDI7jstt3ySqGU86YGAURbxw3oTDPK9sPEi6YEwQ0=
 github.com/ssgreg/nlreturn/v2 v2.2.1/go.mod h1:E/iiPB78hV7Szg2YfRgyIrk1AD6JVMTRkkxBiELzh2I=
-github.com/stbenjam/no-sprintf-host-port v0.2.0 h1:i8pxvGrt1+4G0czLr/WnmyH7zbZ8Bg8etvARQ1rpyl4=
-github.com/stbenjam/no-sprintf-host-port v0.2.0/go.mod h1:eL0bQ9PasS0hsyTyfTjjG+E80QIyPnBVQbYZyv20Jfk=
+github.com/stbenjam/no-sprintf-host-port v0.3.1 h1:AyX7+dxI4IdLBPtDbsGAyqiTSLpCP9hWRrXQDU4Cm/g=
+github.com/stbenjam/no-sprintf-host-port v0.3.1/go.mod h1:ODbZesTCHMVKthBHskvUUexdcNHAQRXk9NpSsL8p/HQ=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
-github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
-github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
 github.com/stretchr/objx v0.5.2 h1:xuMeJ0Sdp5ZMRXx/aWO6RZxdr3beISkG5/G/aIRr3pY=
 github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
 github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
 github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
-github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA=
-github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
-github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
-github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
-github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
+github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
+github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
 github.com/subosito/gotenv v1.4.1 h1:jyEFiXpy21Wm81FBN71l9VoMMV8H8jG+qIK3GCpY6Qs=
 github.com/subosito/gotenv v1.4.1/go.mod h1:ayKnFf/c6rvx/2iiLrJUk1e6plDbT3edrFNGqEflhK0=
-github.com/tdakkota/asciicheck v0.4.1 h1:bm0tbcmi0jezRA2b5kg4ozmMuGAFotKI3RZfrhfovg8=
-github.com/tdakkota/asciicheck v0.4.1/go.mod h1:0k7M3rCfRXb0Z6bwgvkEIMleKH3kXNz9UqJ9Xuqopr8=
 github.com/tenntenn/modver v1.0.1 h1:2klLppGhDgzJrScMpkj9Ujy3rXPUspSjAcev9tSEBgA=
 github.com/tenntenn/modver v1.0.1/go.mod h1:bePIyQPb7UeioSRkw3Q0XeMhYZSMx9B8ePqg6SAMGH0=
 github.com/tenntenn/text/transform v0.0.0-20200319021203-7eef512accb3 h1:f+jULpRQGxTSkNYKJ51yaw6ChIqO+Je8UqsTKN/cDag=
 github.com/tenntenn/text/transform v0.0.0-20200319021203-7eef512accb3/go.mod h1:ON8b8w4BN/kE1EOhwT0o+d62W65a6aPw1nouo9LMgyY=
-github.com/tetafro/godot v1.5.0 h1:aNwfVI4I3+gdxjMgYPus9eHmoBeJIbnajOyqZYStzuw=
-github.com/tetafro/godot v1.5.0/go.mod h1:2oVxTBSftRTh4+MVfUaUXR6bn2GDXCaMcOG4Dk3rfio=
-github.com/timakin/bodyclose v0.0.0-20241017074812-ed6a65f985e3 h1:y4mJRFlM6fUyPhoXuFg/Yu02fg/nIPFMOY8tOqppoFg=
-github.com/timakin/bodyclose v0.0.0-20241017074812-ed6a65f985e3/go.mod h1:mkjARE7Yr8qU23YcGMSALbIxTQ9r9QBVahQOBRfU460=
-github.com/timonwong/loggercheck v0.10.1 h1:uVZYClxQFpw55eh+PIoqM7uAOHMrhVcDoWDery9R8Lg=
-github.com/timonwong/loggercheck v0.10.1/go.mod h1:HEAWU8djynujaAVX7QI65Myb8qgfcZ1uKbdpg3ZzKl8=
-github.com/tomarrell/wrapcheck/v2 v2.10.0 h1:SzRCryzy4IrAH7bVGG4cK40tNUhmVmMDuJujy4XwYDg=
-github.com/tomarrell/wrapcheck/v2 v2.10.0/go.mod h1:g9vNIyhb5/9TQgumxQyOEqDHsmGYcGsVMOx/xGkqdMo=
+github.com/tetafro/godot v1.5.4 h1:u1ww+gqpRLiIA16yF2PV1CV1n/X3zhyezbNXC3E14Sg=
+github.com/tetafro/godot v1.5.4/go.mod h1:eOkMrVQurDui411nBY2FA05EYH01r14LuWY/NrVDVcU=
+github.com/timakin/bodyclose v0.0.0-20241222091800-1db5c5ca4d67 h1:9LPGD+jzxMlnk5r6+hJnar67cgpDIz/iyD+rfl5r2Vk=
+github.com/timakin/bodyclose v0.0.0-20241222091800-1db5c5ca4d67/go.mod h1:mkjARE7Yr8qU23YcGMSALbIxTQ9r9QBVahQOBRfU460=
+github.com/timonwong/loggercheck v0.11.0 h1:jdaMpYBl+Uq9mWPXv1r8jc5fC3gyXx4/WGwTnnNKn4M=
+github.com/timonwong/loggercheck v0.11.0/go.mod h1:HEAWU8djynujaAVX7QI65Myb8qgfcZ1uKbdpg3ZzKl8=
+github.com/tomarrell/wrapcheck/v2 v2.12.0 h1:H/qQ1aNWz/eeIhxKAFvkfIA+N7YDvq6TWVFL27Of9is=
+github.com/tomarrell/wrapcheck/v2 v2.12.0/go.mod h1:AQhQuZd0p7b6rfW+vUwHm5OMCGgp63moQ9Qr/0BpIWo=
 github.com/tommy-muehle/go-mnd/v2 v2.5.1 h1:NowYhSdyE/1zwK9QCLeRb6USWdoif80Ie+v+yU8u1Zw=
 github.com/tommy-muehle/go-mnd/v2 v2.5.1/go.mod h1:WsUAkMJMYww6l/ufffCD3m+P7LEvr8TnZn9lwVDlgzw=
 github.com/ultraware/funlen v0.2.0 h1:gCHmCn+d2/1SemTdYMiKLAHFYxTYz7z9VIDRaTGyLkI=
 github.com/ultraware/funlen v0.2.0/go.mod h1:ZE0q4TsJ8T1SQcjmkhN/w+MceuatI6pBFSxxyteHIJA=
 github.com/ultraware/whitespace v0.2.0 h1:TYowo2m9Nfj1baEQBjuHzvMRbp19i+RCcRYrSWoFa+g=
 github.com/ultraware/whitespace v0.2.0/go.mod h1:XcP1RLD81eV4BW8UhQlpaR+SDc2givTvyI8a586WjW8=
-github.com/uudashr/gocognit v1.2.0 h1:3BU9aMr1xbhPlvJLSydKwdLN3tEUUrzPSSM8S4hDYRA=
-github.com/uudashr/gocognit v1.2.0/go.mod h1:k/DdKPI6XBZO1q7HgoV2juESI2/Ofj9AcHPZhBBdrTU=
-github.com/uudashr/iface v1.3.1 h1:bA51vmVx1UIhiIsQFSNq6GZ6VPTk3WNMZgRiCe9R29U=
-github.com/uudashr/iface v1.3.1/go.mod h1:4QvspiRd3JLPAEXBQ9AiZpLbJlrWWgRChOKDJEuQTdg=
-github.com/xen0n/gosmopolitan v1.2.2 h1:/p2KTnMzwRexIW8GlKawsTWOxn7UHA+jCMF/V8HHtvU=
-github.com/xen0n/gosmopolitan v1.2.2/go.mod h1:7XX7Mj61uLYrj0qmeN0zi7XDon9JRAEhYQqAPLVNTeg=
+github.com/uudashr/gocognit v1.2.1 h1:CSJynt5txTnORn/DkhiB4mZjwPuifyASC8/6Q0I/QS4=
+github.com/uudashr/gocognit v1.2.1/go.mod h1:acaubQc6xYlXFEMb9nWX2dYBzJ/bIjEkc1zzvyIZg5Q=
+github.com/uudashr/iface v1.4.1 h1:J16Xl1wyNX9ofhpHmQ9h9gk5rnv2A6lX/2+APLTo0zU=
+github.com/uudashr/iface v1.4.1/go.mod h1:pbeBPlbuU2qkNDn0mmfrxP2X+wjPMIQAy+r1MBXSXtg=
+github.com/xen0n/gosmopolitan v1.3.0 h1:zAZI1zefvo7gcpbCOrPSHJZJYA9ZgLfJqtKzZ5pHqQM=
+github.com/xen0n/gosmopolitan v1.3.0/go.mod h1:rckfr5T6o4lBtM1ga7mLGKZmLxswUoH1zxHgNXOsEt4=
+github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e h1:JVG44RsyaB9T2KIHavMF/ppJZNG9ZpyihvCd0w101no=
+github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e/go.mod h1:RbqR21r5mrJuqunuUZ/Dhy/avygyECGrLceyNeo4LiM=
 github.com/yagipy/maintidx v1.0.0 h1:h5NvIsCz+nRDapQ0exNv4aJ0yXSI0420omVANTv3GJM=
 github.com/yagipy/maintidx v1.0.0/go.mod h1:0qNf/I/CCZXSMhsRsrEPDZ+DkekpKLXAJfsTACwgXLk=
 github.com/yeya24/promlinter v0.3.0 h1:JVDbMp08lVCP7Y6NP3qHroGAO6z2yGKQtS5JsjqtoFs=
@@ -582,25 +612,27 @@ gitlab.com/bosi/decorder v0.4.2 h1:qbQaV3zgwnBZ4zPMhGLW4KZe7A7NwxEhJx39R3shffo=
 gitlab.com/bosi/decorder v0.4.2/go.mod h1:muuhHoaJkA9QLcYHq4Mj8FJUwDZ+EirSHRiaTcTf6T8=
 go-simpler.org/assert v0.9.0 h1:PfpmcSvL7yAnWyChSjOz6Sp6m9j5lyK8Ok9pEL31YkQ=
 go-simpler.org/assert v0.9.0/go.mod h1:74Eqh5eI6vCK6Y5l3PI8ZYFXG4Sa+tkr70OIPJAUr28=
-go-simpler.org/musttag v0.13.0 h1:Q/YAW0AHvaoaIbsPj3bvEI5/QFP7w696IMUpnKXQfCE=
-go-simpler.org/musttag v0.13.0/go.mod h1:FTzIGeK6OkKlUDVpj0iQUXZLUO1Js9+mvykDQy9C5yM=
-go-simpler.org/sloglint v0.9.0 h1:/40NQtjRx9txvsB/RN022KsUJU+zaaSb/9q9BSefSrE=
-go-simpler.org/sloglint v0.9.0/go.mod h1:G/OrAF6uxj48sHahCzrbarVMptL2kjWTaUeC8+fOGww=
+go-simpler.org/musttag v0.14.0 h1:XGySZATqQYSEV3/YTy+iX+aofbZZllJaqwFWs+RTtSo=
+go-simpler.org/musttag v0.14.0/go.mod h1:uP8EymctQjJ4Z1kUnjX0u2l60WfUdQxCwSNKzE1JEOE=
+go-simpler.org/sloglint v0.11.1 h1:xRbPepLT/MHPTCA6TS/wNfZrDzkGvCCqUv4Bdwc3H7s=
+go-simpler.org/sloglint v0.11.1/go.mod h1:2PowwiCOK8mjiF+0KGifVOT8ZsCNiFzvfyJeJOIt8MQ=
+go.augendre.info/arangolint v0.4.0 h1:xSCZjRoS93nXazBSg5d0OGCi9APPLNMmmLrC995tR50=
+go.augendre.info/arangolint v0.4.0/go.mod h1:l+f/b4plABuFISuKnTGD4RioXiCCgghv2xqst/xOvAA=
+go.augendre.info/fatcontext v0.9.0 h1:Gt5jGD4Zcj8CDMVzjOJITlSb9cEch54hjRRlN3qDojE=
+go.augendre.info/fatcontext v0.9.0/go.mod h1:L94brOAT1OOUNue6ph/2HnwxoNlds9aXDF2FcUntbNw=
 go.opencensus.io v0.21.0/go.mod h1:mSImk1erAIZhrmZN+AvHh14ztQfjbGwt4TtuofqLduU=
 go.opencensus.io v0.22.0/go.mod h1:+kGneAE2xo2IficOXnaByMWTGM9T73dGwxeWcUqIpI8=
 go.opencensus.io v0.22.2/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
 go.opencensus.io v0.22.3/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
 go.opencensus.io v0.22.4/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
-go.uber.org/atomic v1.7.0 h1:ADUqmZGgLDDfbSL9ZmPxKTybcoEYHgpYfELNoN+7hsw=
-go.uber.org/atomic v1.7.0/go.mod h1:fEN4uk6kAWBTFdckzkM89CLk9XfWZrxpCo0nPH17wJc=
-go.uber.org/automaxprocs v1.6.0 h1:O3y2/QNTOdbF+e/dpXNNW7Rx2hZ4sTIPyybbxyNqTUs=
-go.uber.org/automaxprocs v1.6.0/go.mod h1:ifeIMSnPZuznNm6jmdzmU3/bfk01Fe2fotchwEFJ8r8=
-go.uber.org/goleak v1.1.11 h1:wy28qYRKZgnJTxGxvye5/wgWr1EKjmUDGYox5mGlRlI=
-go.uber.org/goleak v1.1.11/go.mod h1:cwTWslyiVhfpKIDGSZEM2HlOvcqm+tG4zioyIeLoqMQ=
-go.uber.org/multierr v1.6.0 h1:y6IPFStTAIT5Ytl7/XYmHvzXQ7S3g/IeZW9hyZ5thw4=
-go.uber.org/multierr v1.6.0/go.mod h1:cdWPpRnG4AhwMwsgIHip0KRBQjJy5kYEpYjJxpXp9iU=
-go.uber.org/zap v1.24.0 h1:FiJd5l1UOLj0wCgbSE0rwwXHzEdAZS6hiiSnxJN/D60=
-go.uber.org/zap v1.24.0/go.mod h1:2kMP+WWQ8aoFoedH3T2sq6iJ2yDWpHbP0f6MQbS9Gkg=
+go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
+go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
+go.uber.org/multierr v1.10.0 h1:S0h4aNzvfcFsC3dRF1jLoaov7oRaKqRGC/pUEJ2yvPQ=
+go.uber.org/multierr v1.10.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y=
+go.uber.org/zap v1.27.0 h1:aJMhYGrd5QSmlpLMr2MftRKl7t8J8PTZPA732ud/XR8=
+go.uber.org/zap v1.27.0/go.mod h1:GB2qFLM7cTU87MWRP2mPIjqfIDnGu+VIO4V/SdhGo2E=
+go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
+go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
 golang.org/x/crypto v0.0.0-20180904163835-0709b304e793/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20190510104115-cbcb75029529/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
@@ -620,12 +652,12 @@ golang.org/x/exp v0.0.0-20191227195350-da58074b4299/go.mod h1:2RIsYlXP63K8oxa1u0
 golang.org/x/exp v0.0.0-20200119233911-0405dc783f0a/go.mod h1:2RIsYlXP63K8oxa1u096TMicItID8zy7Y6sNkU49FU4=
 golang.org/x/exp v0.0.0-20200207192155-f17229e696bd/go.mod h1:J/WKrq2StrnmMY6+EHIKF9dgMWnmCNThgcyBT1FY9mM=
 golang.org/x/exp v0.0.0-20200224162631-6cc2880d07d6/go.mod h1:3jZMyOhIsHpP37uCMkUooju7aAi5cS1Q23tOzKc+0MU=
-golang.org/x/exp v0.0.0-20240909161429-701f63a606c0 h1:e66Fs6Z+fZTbFBAxKfP3PALWBtpfqks2bwGcexMxgtk=
-golang.org/x/exp v0.0.0-20240909161429-701f63a606c0/go.mod h1:2TbTHSBQa924w8M6Xs1QcRcFwyucIwBGpK1p2f1YFFY=
+golang.org/x/exp v0.0.0-20250620022241-b7579e27df2b h1:M2rDM6z3Fhozi9O7NWsxAkg/yqS/lQJ6PmkyIV3YP+o=
+golang.org/x/exp v0.0.0-20250620022241-b7579e27df2b/go.mod h1:3//PLf8L/X+8b4vuAfHzxeRUl04Adcb341+IGKfnqS8=
 golang.org/x/exp/typeparams v0.0.0-20220428152302-39d4317da171/go.mod h1:AbB0pIl9nAr9wVwH+Z2ZpaocVmF5I4GyWCDIsVjR0bk=
 golang.org/x/exp/typeparams v0.0.0-20230203172020-98cc5a0785f9/go.mod h1:AbB0pIl9nAr9wVwH+Z2ZpaocVmF5I4GyWCDIsVjR0bk=
-golang.org/x/exp/typeparams v0.0.0-20250210185358-939b2ce775ac h1:TSSpLIG4v+p0rPv1pNOQtl1I8knsO4S9trOxNMOLVP4=
-golang.org/x/exp/typeparams v0.0.0-20250210185358-939b2ce775ac/go.mod h1:AbB0pIl9nAr9wVwH+Z2ZpaocVmF5I4GyWCDIsVjR0bk=
+golang.org/x/exp/typeparams v0.0.0-20260209203927-2842357ff358 h1:qWFG1Dj7TBjOjOvhEOkmyGPVoquqUKnIU0lEVLp8xyk=
+golang.org/x/exp/typeparams v0.0.0-20260209203927-2842357ff358/go.mod h1:4Mzdyp/6jzw9auFDJ3OMF5qksa7UvPnzKqTVGcb04ms=
 golang.org/x/image v0.0.0-20190227222117-0694c2d4d067/go.mod h1:kZ7UVZpmo3dzQBMxlp+ypCbDeSB+sBbTgSJuh5dn5js=
 golang.org/x/image v0.0.0-20190802002840-cff245a6509b/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
 golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
@@ -650,13 +682,11 @@ golang.org/x/mod v0.4.1/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.6.0-dev.0.20220106191415-9b9b3d81d5e3/go.mod h1:3p9vT2HGsQu2K1YbXdKPJLVgG5VJdoTa1poYQBtP1AY=
 golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
-golang.org/x/mod v0.7.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
-golang.org/x/mod v0.9.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.13.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
-golang.org/x/mod v0.24.0 h1:ZfthKaKaT4NrhGVZHO1/WDTwGES4De8KtWO0SIbNJMU=
-golang.org/x/mod v0.24.0/go.mod h1:IXM97Txy2VM4PJ3gI61r1YEk/gAj6zAHN3AdZt6S9Ww=
+golang.org/x/mod v0.33.0 h1:tHFzIWbBifEmbwtGz65eaWyGiGZatSrT9prnU8DbVL8=
+golang.org/x/mod v0.33.0/go.mod h1:swjeQEj+6r7fODbD2cqrnje9PnziFuw4bmLbBZFrQ5w=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20181114220301-adae6a3d119a/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -691,14 +721,12 @@ golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96b
 golang.org/x/net v0.0.0-20210525063256-abc453219eb5/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20211015210444-4f30a5c0130f/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
-golang.org/x/net v0.2.0/go.mod h1:KqCZLdyyvdV855qA2rE3GC2aiw5xGR5TEjj8smXukLY=
 golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
-golang.org/x/net v0.8.0/go.mod h1:QVkue5JL9kW//ek3r6jTKnTFis1tRmNAW2P1shuFdJc=
 golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
 golang.org/x/net v0.15.0/go.mod h1:idbUs1IY1+zTqbi8yxTbhexhEEk5ur9LInksu6HrEpk=
 golang.org/x/net v0.16.0/go.mod h1:NxSsAGuq816PNPmqtQdLE42eU2Fs7NoRIZrHJAlaCOE=
-golang.org/x/net v0.37.0 h1:1zLorHbz+LYj7MQlSf1+2tPIIgibq2eL5xkrGk6f+2c=
-golang.org/x/net v0.37.0/go.mod h1:ivrbrMbzFq5J41QOQh0siUuly180yBYtLp+CKbEaFx8=
+golang.org/x/net v0.51.0 h1:94R/GTO7mt3/4wIKpcR5gkGmRLOuE/2hNGeWq/GBIFo=
+golang.org/x/net v0.51.0/go.mod h1:aamm+2QF5ogm02fjy5Bb7CQ0WMt1/WVM7FtyaTLlA9Y=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
@@ -720,8 +748,8 @@ golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJ
 golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.3.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
 golang.org/x/sync v0.4.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
-golang.org/x/sync v0.12.0 h1:MHc5BpPuC30uJk597Ri8TV3CNZcTLu6B6z4lJy+g6Jw=
-golang.org/x/sync v0.12.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
+golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=
+golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20181116152217-5ac8a444bdc5/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
@@ -766,21 +794,17 @@ golang.org/x/sys v0.0.0-20211105183446-c75c47738b0c/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20220114195835-da31bd327af9/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220412211240-33da011f77ad/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.13.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.31.0 h1:ioabZlmFYtWhL+TRYpcnNlLwhyxaM9kWTDEmfnprqik=
-golang.org/x/sys v0.31.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
+golang.org/x/sys v0.41.0 h1:Ivj+2Cp/ylzLiEU89QhWblYnOE9zerudt9Ftecq2C6k=
+golang.org/x/sys v0.41.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
-golang.org/x/term v0.2.0/go.mod h1:TVmDHMZPmdnySmBfhjOoOdhjzdE1h4u1VwSiw2l1Nuc=
 golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
-golang.org/x/term v0.6.0/go.mod h1:m6U89DPEgQRMq3DNkDClhWw02AUbt2daBVO4cn4Hv9U=
 golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo=
 golang.org/x/term v0.12.0/go.mod h1:owVbMEjm3cBLCHdkQu9b1opXd4ETQWc3BhuQGKgXgvU=
 golang.org/x/term v0.13.0/go.mod h1:LTmsnFJwVN6bCy1rVCoS+qHT1HhALEFxKncY3WNNh4U=
@@ -791,13 +815,11 @@ golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
-golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
-golang.org/x/text v0.8.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
 golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
 golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
-golang.org/x/text v0.22.0 h1:bofq7m3/HAFvbF51jz3Q9wLg3jkvSPuiZu/pD1XwgtM=
-golang.org/x/text v0.22.0/go.mod h1:YRoo4H8PVmsu+E3Ou7cqLVH8oXWIHVoX0jqUWALQhfY=
+golang.org/x/text v0.34.0 h1:oL/Qq0Kdaqxa1KbNeMKwQq0reLCCaFtqu2eNuSeNHbk=
+golang.org/x/text v0.34.0/go.mod h1:homfLqTYRFyVYemLBFl5GgL/DWEiH5wcsQ5gSh1yziA=
 golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
@@ -833,7 +855,6 @@ golang.org/x/tools v0.0.0-20200224181240-023911ca70b2/go.mod h1:TB2adYChydJhpapK
 golang.org/x/tools v0.0.0-20200227222343-706bc42d1f0d/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
 golang.org/x/tools v0.0.0-20200304193943-95d2e580d8eb/go.mod h1:o4KQGtdN14AW+yjsvvwRTJJuXz8XRtIHtEnmAXLyFUw=
 golang.org/x/tools v0.0.0-20200312045724-11d5b4c81c7d/go.mod h1:o4KQGtdN14AW+yjsvvwRTJJuXz8XRtIHtEnmAXLyFUw=
-golang.org/x/tools v0.0.0-20200324003944-a576cf524670/go.mod h1:Sl4aGygMT6LrqrWclx+PTx3U+LnKx/seiNR+3G19Ar8=
 golang.org/x/tools v0.0.0-20200329025819-fd4102a86c65/go.mod h1:Sl4aGygMT6LrqrWclx+PTx3U+LnKx/seiNR+3G19Ar8=
 golang.org/x/tools v0.0.0-20200331025713-a30bf2db82d4/go.mod h1:Sl4aGygMT6LrqrWclx+PTx3U+LnKx/seiNR+3G19Ar8=
 golang.org/x/tools v0.0.0-20200501065659-ab2804fb9c9d/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
@@ -843,22 +864,21 @@ golang.org/x/tools v0.0.0-20200618134242-20370b0cb4b2/go.mod h1:EkVYQZoAsY45+roY
 golang.org/x/tools v0.0.0-20200724022722-7017fd6b1305/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA=
 golang.org/x/tools v0.0.0-20200729194436-6467de6f59a7/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA=
 golang.org/x/tools v0.0.0-20200804011535-6c149bb5ef0d/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA=
-golang.org/x/tools v0.0.0-20200820010801-b793a1359eac/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA=
 golang.org/x/tools v0.0.0-20200825202427-b303f430e36d/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA=
-golang.org/x/tools v0.0.0-20201023174141-c8cfbd0f21e6/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
 golang.org/x/tools v0.1.1-0.20210205202024-ef80cdb6ec6d/go.mod h1:9bzcO0MWcOuT0tm1iBGzDVPshzfwoVvREIui8C+MHqU=
 golang.org/x/tools v0.1.1-0.20210302220138-2ac05c832e1a/go.mod h1:9bzcO0MWcOuT0tm1iBGzDVPshzfwoVvREIui8C+MHqU=
 golang.org/x/tools v0.1.1/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
-golang.org/x/tools v0.1.5/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
 golang.org/x/tools v0.1.10/go.mod h1:Uh6Zz+xoGYZom868N8YTex3t7RhtHDBrE8Gzo9bV56E=
 golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
-golang.org/x/tools v0.3.0/go.mod h1:/rWhSS2+zyEVwoJf8YAX6L2f0ntZ7Kn/mGgAWcipA5k=
 golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
-golang.org/x/tools v0.7.0/go.mod h1:4pg6aUX35JBAogB10C9AtvVL+qowtN4pT3CGSQex14s=
 golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58=
 golang.org/x/tools v0.14.0/go.mod h1:uYBEerGOWcJyEORxN+Ek8+TT266gXkNlHdJBwexUsBg=
-golang.org/x/tools v0.31.0 h1:0EedkvKDbh+qistFTd0Bcwe/YLh4vHwWEkiI0toFIBU=
-golang.org/x/tools v0.31.0/go.mod h1:naFTU+Cev749tSJRXJlna0T3WxKvb1kWEx15xA4SdmQ=
+golang.org/x/tools v0.42.0 h1:uNgphsn75Tdz5Ji2q36v/nsFSfR/9BRFvqhGBaJGd5k=
+golang.org/x/tools v0.42.0/go.mod h1:Ma6lCIwGZvHK6XtgbswSoWroEkhugApmsXyrUmBhfr0=
+golang.org/x/tools/go/expect v0.1.1-deprecated h1:jpBZDwmgPhXsKZC6WhL20P4b/wmnpsEAGHaNy0n/rJM=
+golang.org/x/tools/go/expect v0.1.1-deprecated/go.mod h1:eihoPOH+FgIqa3FpoTwguz/bVUSGBlGQU67vpBeOrBY=
+golang.org/x/tools/go/packages/packagestest v0.1.1-deprecated h1:1h2MnaIAIXISqTFKdENegdpAgUXz6NrPEsbIeWaBRvM=
+golang.org/x/tools/go/packages/packagestest v0.1.1-deprecated/go.mod h1:RVAQXBGNv1ib0J382/DPCRS/BPnsGebyM1Gj5VSDpG8=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
@@ -914,9 +934,8 @@ google.golang.org/genproto v0.0.0-20200618031413-b414f8b61790/go.mod h1:jDfRM7Fc
 google.golang.org/genproto v0.0.0-20200729003335-053ba62fc06f/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
 google.golang.org/genproto v0.0.0-20200804131852-c06518451d9c/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
 google.golang.org/genproto v0.0.0-20200825200019-8632dd797987/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20241118233622-e639e219e697 h1:ToEetK57OidYuqD4Q5w+vfEnPvPpuTwedCNVohYJfNk=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20250219182151-9fdb1cabc7b2 h1:DMTIbak9GhdaSxEjvVzAeNZvyc03I61duqNbnm3SU0M=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20250219182151-9fdb1cabc7b2/go.mod h1:LuRYeWDFV6WOn90g357N17oMCaxpgCnbi/44qJvDn2I=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250818200422-3122310a409c h1:qXWI/sQtv5UKboZ/zUk7h+mrf/lXORyI+n9DKDAusdg=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250818200422-3122310a409c/go.mod h1:gw1tLEfykwDz2ET4a12jcXt4couGAm7IwsVaTy0Sflo=
 google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
 google.golang.org/grpc v1.20.1/go.mod h1:10oTOabMzJvdu6/UiuZezV6QK5dSlG84ov/aaiqXj38=
 google.golang.org/grpc v1.21.1/go.mod h1:oYelfM1adQP15Ek0mdvEgi9Df8B9CZIaU1084ijfRaM=
@@ -929,10 +948,10 @@ google.golang.org/grpc v1.28.0/go.mod h1:rpkK4SK4GF4Ach/+MFLZUBavHOvF2JJB5uozKKa
 google.golang.org/grpc v1.29.1/go.mod h1:itym6AZVZYACWQqET3MqgPpjcuV5QH3BxFS3IjizoKk=
 google.golang.org/grpc v1.30.0/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak=
 google.golang.org/grpc v1.31.0/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak=
-google.golang.org/grpc v1.70.0 h1:pWFv03aZoHzlRKHWicjsZytKAiYCtNS0dHbXnIdq7jQ=
-google.golang.org/grpc v1.70.0/go.mod h1:ofIJqVKDXx/JiXrwr2IG4/zwdH9txy3IlF40RmcJSQw=
-google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.5.1 h1:F29+wU6Ee6qgu9TddPgooOdaqsxTMunOoj8KA5yuS5A=
-google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.5.1/go.mod h1:5KF+wpkbTSbGcR9zteSqZV6fqFOWBl4Yde8En8MryZA=
+google.golang.org/grpc v1.75.0 h1:+TW+dqTd2Biwe6KKfhE5JpiYIBWq865PhKGSXiivqt4=
+google.golang.org/grpc v1.75.0/go.mod h1:JtPAzKiq4v1xcAB2hydNlWI2RnF85XXcV0mhKXr2ecQ=
+google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.6.1 h1:/WILD1UcXj/ujCxgoL/DvRgt2CP3txG8+FwkUbb9110=
+google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.6.1/go.mod h1:YNKnb2OAApgYn2oYY47Rn7alMr1zWjb2U8Q0aoGWiNc=
 google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
 google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
 google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=
@@ -945,8 +964,8 @@ google.golang.org/protobuf v1.24.0/go.mod h1:r/3tXBNzIEhYS9I1OUVjXDlt8tc493IdKGj
 google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlbajtzgsN7c=
 google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
 google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
-google.golang.org/protobuf v1.36.5 h1:tPhr+woSbjfYvY6/GPufUoYizxw1cF/yFoxJ2fmpwlM=
-google.golang.org/protobuf v1.36.5/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=
+google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
+google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
 gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
@@ -963,7 +982,6 @@ gopkg.in/yaml.v2 v2.2.5/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.3.0/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
 gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
-gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
@@ -973,12 +991,12 @@ honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWh
 honnef.co/go/tools v0.0.1-2019.2.3/go.mod h1:a3bituU0lyd329TUQxRnasdCoJDkEUEAqEt0JzvZhAg=
 honnef.co/go/tools v0.0.1-2020.1.3/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
 honnef.co/go/tools v0.0.1-2020.1.4/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
-honnef.co/go/tools v0.6.1 h1:R094WgE8K4JirYjBaOpz/AvTyUu/3wbmAoskKN/pxTI=
-honnef.co/go/tools v0.6.1/go.mod h1:3puzxxljPCe8RGJX7BIy1plGbxEOZni5mR2aXe3/uk4=
-mvdan.cc/gofumpt v0.7.0 h1:bg91ttqXmi9y2xawvkuMXyvAA/1ZGJqYAEGjXuP0JXU=
-mvdan.cc/gofumpt v0.7.0/go.mod h1:txVFJy/Sc/mvaycET54pV8SW8gWxTlUuGHVEcncmNUo=
-mvdan.cc/unparam v0.0.0-20240528143540-8a5130ca722f h1:lMpcwN6GxNbWtbpI1+xzFLSW8XzX0u72NttUGVFjO3U=
-mvdan.cc/unparam v0.0.0-20240528143540-8a5130ca722f/go.mod h1:RSLa7mKKCNeTTMHBw5Hsy2rfJmd6O2ivt9Dw9ZqCQpQ=
+honnef.co/go/tools v0.7.0 h1:w6WUp1VbkqPEgLz4rkBzH/CSU6HkoqNLp6GstyTx3lU=
+honnef.co/go/tools v0.7.0/go.mod h1:pm29oPxeP3P82ISxZDgIYeOaf9ta6Pi0EWvCFoLG2vc=
+mvdan.cc/gofumpt v0.9.2 h1:zsEMWL8SVKGHNztrx6uZrXdp7AX8r421Vvp23sz7ik4=
+mvdan.cc/gofumpt v0.9.2/go.mod h1:iB7Hn+ai8lPvofHd9ZFGVg2GOr8sBUw1QUWjNbmIL/s=
+mvdan.cc/unparam v0.0.0-20251027182757-5beb8c8f8f15 h1:ssMzja7PDPJV8FStj7hq9IKiuiKhgz9ErWw+m68e7DI=
+mvdan.cc/unparam v0.0.0-20251027182757-5beb8c8f8f15/go.mod h1:4M5MMXl2kW6fivUT6yRGpLLPNfuGtU2Z0cPvFquGDYU=
 rsc.io/binaryregexp v0.2.0/go.mod h1:qTv7/COck+e2FymRvadv62gMdZztPaShugOCi3I+8D8=
 rsc.io/quote/v3 v3.1.0/go.mod h1:yEA65RcK8LyAZtP9Kv3t0HmxON59tX3rD+tICJqUlj0=
 rsc.io/sampler v1.3.0/go.mod h1:T1hPZKmBbMNahiBKFy5HrXp6adAjACjK9JXDnKaTXpA=
diff --git a/tools/tools.go b/tools/tools.go
index c3bf7d18b3..ec3547a68f 100644
--- a/tools/tools.go
+++ b/tools/tools.go
@@ -5,7 +5,7 @@
 package tools
 
 import (
-	_ "github.com/golangci/golangci-lint/cmd/golangci-lint"
+	_ "github.com/golangci/golangci-lint/v2/cmd/golangci-lint"
 	_ "github.com/msteinert/pam/v2/cmd/pam-moduler"
 	_ "google.golang.org/grpc/cmd/protoc-gen-go-grpc"
 	_ "github.com/golang/protobuf/protoc-gen-go"