diff --git a/.bumpversion.cfg b/.bumpversion.cfg
index 86c9f2dba..2a8fcebe6 100644
--- a/.bumpversion.cfg
+++ b/.bumpversion.cfg
@@ -1,5 +1,5 @@
 [bumpversion]
-current_version = 0.8.15-beta
+current_version = 0.9.0-pre4
 tag = True
 commit = True
 parse = (?P<major>\d+)\.(?P<minor>\d+)\.(?P<patch>\d+)\-(?P<release>.*)
@@ -22,4 +22,3 @@ values =
 [bumpversion:file:.github/workflows/release.yml]
 
 [bumpversion:file:passbook/__init__.py]
-
diff --git a/.github/FUNDING.yml b/.github/FUNDING.yml
index 07ba451a3..133f36b27 100644
--- a/.github/FUNDING.yml
+++ b/.github/FUNDING.yml
@@ -1 +1 @@
-custom: ["https://www.paypal.me/octocat"]
+custom: ["https://www.paypal.me/beryju"]
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 95d620a74..180afcda9 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -16,11 +16,11 @@ jobs:
       - name: Building Docker Image
         run: docker build
           --no-cache
-          -t beryju/passbook:0.8.15-beta
+          -t beryju/passbook:0.9.0-pre4
           -t beryju/passbook:latest
           -f Dockerfile .
       - name: Push Docker Container to Registry (versioned)
-        run: docker push beryju/passbook:0.8.15-beta
+        run: docker push beryju/passbook:0.9.0-pre4
       - name: Push Docker Container to Registry (latest)
         run: docker push beryju/passbook:latest
   build-gatekeeper:
@@ -37,11 +37,11 @@ jobs:
           cd gatekeeper
           docker build \
           --no-cache \
-          -t beryju/passbook-gatekeeper:0.8.15-beta \
+          -t beryju/passbook-gatekeeper:0.9.0-pre4 \
           -t beryju/passbook-gatekeeper:latest \
           -f Dockerfile .
       - name: Push Docker Container to Registry (versioned)
-        run: docker push beryju/passbook-gatekeeper:0.8.15-beta
+        run: docker push beryju/passbook-gatekeeper:0.9.0-pre4
       - name: Push Docker Container to Registry (latest)
         run: docker push beryju/passbook-gatekeeper:latest
   build-static:
@@ -66,11 +66,11 @@ jobs:
         run: docker build
           --no-cache
           --network=$(docker network ls | grep github | awk '{print $1}')
-          -t beryju/passbook-static:0.8.15-beta
+          -t beryju/passbook-static:0.9.0-pre4
           -t beryju/passbook-static:latest
           -f static.Dockerfile .
       - name: Push Docker Container to Registry (versioned)
-        run: docker push beryju/passbook-static:0.8.15-beta
+        run: docker push beryju/passbook-static:0.9.0-pre4
       - name: Push Docker Container to Registry (latest)
         run: docker push beryju/passbook-static:latest
   test-release:
@@ -82,8 +82,7 @@ jobs:
       - uses: actions/checkout@v1
       - name: Run test suite in final docker images
         run: |
-          export PASSBOOK_DOMAIN=localhost
-          docker-compose pull
+          docker-compose pull -q
           docker-compose up --no-start
           docker-compose start postgresql redis
           docker-compose run -u root server bash -c "pip install --no-cache -r requirements-dev.txt && ./manage.py test"
diff --git a/.github/workflows/tag.yml b/.github/workflows/tag.yml
index a65546dfb..8497e400e 100644
--- a/.github/workflows/tag.yml
+++ b/.github/workflows/tag.yml
@@ -13,8 +13,7 @@ jobs:
       - uses: actions/checkout@master
       - name: Pre-release test
         run: |
-          export PASSBOOK_DOMAIN=localhost
-          docker-compose pull
+          docker-compose pull -q
           docker build \
             --no-cache \
             -t beryju/passbook:latest \
diff --git a/.gitignore b/.gitignore
index d6e348963..606885d70 100644
--- a/.gitignore
+++ b/.gitignore
@@ -196,3 +196,6 @@ local.env.yml
 ### Helm ###
 # Chart dependencies
 **/charts/*.tgz
+
+# Selenium Screenshots
+selenium_screenshots/**
diff --git a/Pipfile b/Pipfile
index 5230760fc..cad4fd1b6 100644
--- a/Pipfile
+++ b/Pipfile
@@ -40,7 +40,7 @@ signxml = "*"
 structlog = "*"
 swagger-spec-validator = "*"
 urllib3 = {extras = ["secure"],version = "*"}
-jinja2 = "*"
+facebook-sdk = "*"
 
 [requires]
 python_version = "3.8"
@@ -56,6 +56,8 @@ pylint = "*"
 pylint-django = "*"
 unittest-xml-reporting = "*"
 black = "*"
+selenium = "*"
+docker = "*"
 
 [pipenv]
 allow_prereleases = true
diff --git a/Pipfile.lock b/Pipfile.lock
index 06a8d01b3..0f130494b 100644
--- a/Pipfile.lock
+++ b/Pipfile.lock
@@ -1,7 +1,7 @@
 {
     "_meta": {
         "hash": {
-            "sha256": "c9232d99b062ee14eda43d176481f16da78ce53f912c844db3f33f1b3e8a47b7"
+            "sha256": "fd0192b73c01aaffb90716ce7b6d4e5be9adb8788d3ebd58e54ccd6f85d9b71b"
         },
         "pipfile-spec": 6,
         "requires": {
@@ -25,17 +25,10 @@
         },
         "asgiref": {
             "hashes": [
-                "sha256:8036f90603c54e93521e5777b2b9a39ba1bad05773fcf2d208f0299d1df58ce5",
-                "sha256:9ca8b952a0a9afa61d30aa6d3d9b570bb3fd6bafcf7ec9e6bed43b936133db1c"
+                "sha256:7e51911ee147dd685c3c8b805c0ad0cb58d360987b56953878f8c06d2d1c6f1a",
+                "sha256:9fc6fb5d39b8af147ba40765234fa822b39818b12cc80b35ad9b0cef3a476aed"
             ],
-            "version": "==3.2.7"
-        },
-        "asn1crypto": {
-            "hashes": [
-                "sha256:5a215cb8dc12f892244e3a113fe05397ee23c5c4ca7a69cd6e69811755efc42d",
-                "sha256:831d2710d3274c8a74befdddaf9f17fcbf6e350534565074818722d6d615b315"
-            ],
-            "version": "==1.3.0"
+            "version": "==3.2.10"
         },
         "attrs": {
             "hashes": [
@@ -53,33 +46,33 @@
         },
         "boto3": {
             "hashes": [
-                "sha256:26f8564b46d009b8f4c6470a6d6cde147b282a197339c7e31cbb0fe9fd9e5f5d",
-                "sha256:f59d0bd230ed3a4b932c5c4e497a0e0ff3c93b46b7e8cde54efb6fe10c8266ba"
+                "sha256:c2a223f4b48782e8b160b2130265e2a66081df111f630a5a384d6909e29a5aa9",
+                "sha256:ce5a4ab6af9e993d1864209cbbb6f4812f65fbc57ad6b95e5967d8bf38b1dcfb"
             ],
             "index": "pypi",
-            "version": "==1.13.20"
+            "version": "==1.14.16"
         },
         "botocore": {
             "hashes": [
-                "sha256:990f3fc33dec746829740b1a9e1fe86183cdc96aedba6a632ccfcbae03e097cc",
-                "sha256:d4cc47ac989a7f1d2992ef7679fb423a7966f687becf623a291a555a2d7ce1c0"
+                "sha256:99d995ef99cf77458a661f3fc64e0c3a4ce77ca30facfdf0472f44b2953dd856",
+                "sha256:fe0c4f7cd6b67eff3b7cb8dff6709a65d6fca10b7b7449a493b2036915e98b4c"
             ],
-            "version": "==1.16.20"
+            "version": "==1.17.16"
         },
         "celery": {
             "hashes": [
-                "sha256:108a0bf9018a871620936c33a3ee9f6336a89f8ef0a0f567a9001f4aa361415f",
-                "sha256:5b4b37e276033fe47575107a2775469f0b721646a08c96ec2c61531e4fe45f2a"
+                "sha256:ef17d7dffde7fc73ecab3a3b6389d93d3213bac53fa7f28e68e33647ad50b916",
+                "sha256:fd77e4248bb1b7af5f7922dd8e81156f540306e3a5c4b1c24167c1f5f06025da"
             ],
             "index": "pypi",
-            "version": "==4.4.2"
+            "version": "==4.4.6"
         },
         "certifi": {
             "hashes": [
-                "sha256:1d987a998c75633c40847cc966fcf5904906c920a7f17ef374f5aa4282abd304",
-                "sha256:51fcb31174be6e6664c5f69e3e1691a2d72a1a12e90f872cbdb1567eb47b6519"
+                "sha256:5930595817496dd21bb8dc35dad090f1c2cd0adfaf21204bf6732ca5d8ee34d3",
+                "sha256:8fc0819f1f30ba15bdb34cceffb9ef04d99f420f68eb75d901e9560b8749fc41"
             ],
-            "version": "==2020.4.5.1"
+            "version": "==2020.6.20"
         },
         "cffi": {
             "hashes": [
@@ -169,11 +162,11 @@
         },
         "django": {
             "hashes": [
-                "sha256:051ba55d42daa3eeda3944a8e4df2bc96d4c62f94316dea217248a22563c3621",
-                "sha256:9aaa6a09678e1b8f0d98a948c56482eac3e3dd2ddbfb8de70a868135ef3b5e01"
+                "sha256:31a5fbbea5fc71c99e288ec0b2f00302a0a92c44b13ede80b73a6a4d6d205582",
+                "sha256:5457fc953ec560c5521b41fad9e6734a4668b7ba205832191bbdff40ec61073c"
             ],
             "index": "pypi",
-            "version": "==3.0.6"
+            "version": "==3.0.8"
         },
         "django-cors-middleware": {
             "hashes": [
@@ -192,19 +185,19 @@
         },
         "django-filter": {
             "hashes": [
-                "sha256:558c727bce3ffa89c4a7a0b13bc8976745d63e5fd576b3a9a851650ef11c401b",
-                "sha256:c3deb57f0dd7ff94d7dce52a047516822013e2b441bed472b722a317658cfd14"
+                "sha256:11e63dd759835d9ba7a763926ffb2662cf8a6dcb4c7971a95064de34dbc7e5af",
+                "sha256:616848eab6fc50193a1b3730140c49b60c57a3eda1f7fc57fa8505ac156c6c75"
             ],
             "index": "pypi",
-            "version": "==2.2.0"
+            "version": "==2.3.0"
         },
         "django-guardian": {
             "hashes": [
-                "sha256:8cacf49ebcc1e545f0a8997971eec0fe109f5ed31fc2a569a7bf5615453696e2",
-                "sha256:ac81e88372fdf1795d84ba065550e739b42e9c6d07cdf201cf5bbf9efa7f396c"
+                "sha256:0e70706c6cda88ddaf8849bddb525b8df49de05ba0798d4b3506049f0d95cbc8",
+                "sha256:ed2de26e4defb800919c5749fb1bbe370d72829fbd72895b6cf4f7f1a7607e1b"
             ],
             "index": "pypi",
-            "version": "==2.2.0"
+            "version": "==2.3.0"
         },
         "django-model-utils": {
             "hashes": [
@@ -231,19 +224,19 @@
         },
         "django-otp": {
             "hashes": [
-                "sha256:0c67cf6f4bd6fca84027879ace9049309213b6ac81f88e954376a6b5535d96c4",
-                "sha256:f456639addace8b6d1eb77f9edaada1a53dbb4d6f3c19f17c476c4e3e4beb73f"
+                "sha256:97849f7bf1b50c4c36a5845ab4d2e11dd472fa8e6bcc34fe18b6d3af6e4aa449",
+                "sha256:d2390e61794bc10dea2fd949cbcfb7946e9ae4fb248df5494ccc4ef9ac50427e"
             ],
             "index": "pypi",
-            "version": "==0.9.1"
+            "version": "==0.9.3"
         },
         "django-prometheus": {
             "hashes": [
-                "sha256:1a8cb752ae4181e38df00e7bd7d5f6495cde18b8b3ff697c22f9d8d2fe48bf28",
-                "sha256:9f024af5495447c8e309f07e5289e7bc1100c5a380ac7cd0afe3a1b2a0b3b534"
+                "sha256:054924b6aedd41f3f76940578127e7fac852a696805f956da39b7941c78bba91",
+                "sha256:208e55e3a11ac9edd53a3b342b033e140ffe27914af1202f0b064edf99e83fc3"
             ],
             "index": "pypi",
-            "version": "==2.1.0.dev14"
+            "version": "==2.1.0.dev46"
         },
         "django-recaptcha": {
             "hashes": [
@@ -313,6 +306,14 @@
             ],
             "version": "==1.0.0"
         },
+        "facebook-sdk": {
+            "hashes": [
+                "sha256:2e987b3e0f466a6f4ee77b935eb023dba1384134f004a2af21f1cfff7fe0806e",
+                "sha256:cabcd2e69ea3d9f042919c99b353df7aa1e2be86d040121f6e9f5e63c1cf0f8d"
+            ],
+            "index": "pypi",
+            "version": "==3.1.0"
+        },
         "future": {
             "hashes": [
                 "sha256:b1bead90b70cf6ec3f0710ae53a525360fa360d306a86583adc6bf83a4db537d"
@@ -321,17 +322,17 @@
         },
         "idna": {
             "hashes": [
-                "sha256:7588d1c14ae4c77d74036e8c22ff447b26d0fde8f007354fd48a7814db15b7cb",
-                "sha256:a068a21ceac8a4d63dbfd964670474107f541babbd2250d61922f029858365fa"
+                "sha256:b307872f855b18632ce0c21c5e45be78c0ea7ae4c15c828c20788b26921eb3f6",
+                "sha256:b97d804b1e9b523befed77c48dacec60e6dcb0b5391d57af6a65a312a90648c0"
             ],
-            "version": "==2.9"
+            "version": "==2.10"
         },
         "inflection": {
             "hashes": [
-                "sha256:32a5c3341d9583ec319548b9015b7fbdf8c429cbcb575d326c33ae3a0e90d52c",
-                "sha256:9a15d3598f01220e93f2207c432cfede50daff53137ce660fb8be838ef1ca6cc"
+                "sha256:88b101b2668a1d81d6d72d4c2018e53bc6c7fc544c987849da1c7f77545c3bc9",
+                "sha256:f576e85132d34f5bf7df5183c2c6f94cfb32e528f53065345cf71329ba0b8924"
             ],
-            "version": "==0.4.0"
+            "version": "==0.5.0"
         },
         "itypes": {
             "hashes": [
@@ -345,7 +346,6 @@
                 "sha256:c10142f819c2d22bdcd17548c46fa9b77cf4fda45097854c689666bf425e7484",
                 "sha256:c922560ac46888d47384de1dbdc3daaa2ea993af4b26a436dec31fa2c19ec668"
             ],
-            "index": "pypi",
             "version": "==3.0.0a1"
         },
         "jmespath": {
@@ -364,11 +364,11 @@
         },
         "kombu": {
             "hashes": [
-                "sha256:ab0afaa5388dd2979cbc439d3623b86a4f7a58d41f621096bef7767c37bc2505",
-                "sha256:aece08f48706743aaa1b9d607fee300559481eafcc5ee56451aa0ef867a3be07"
+                "sha256:be48cdffb54a2194d93ad6533d73f69408486483d189fe9f5990ee24255b0e0a",
+                "sha256:ca1b45faac8c0b18493d02a8571792f3c40291cf2bcf1f55afed3d8f3aa7ba74"
             ],
             "index": "pypi",
-            "version": "==4.6.9"
+            "version": "==4.6.11"
         },
         "ldap3": {
             "hashes": [
@@ -520,74 +520,74 @@
         },
         "pycryptodome": {
             "hashes": [
-                "sha256:07024fc364869eae8d6ac0d316e089956e6aeffe42dbdcf44fe1320d96becf7f",
-                "sha256:09b6d6bcc01a4eb1a2b4deeff5aa602a108ec5aed8ac75ae554f97d1d7f0a5ad",
-                "sha256:0e10f352ccbbcb5bb2dc4ecaf106564e65702a717d72ab260f9ac4c19753cfc2",
-                "sha256:1f4752186298caf2e9ff5354f2e694d607ca7342aa313a62005235d46e28cf04",
-                "sha256:2fbc472e0b567318fe2052281d5a8c0ae70099b446679815f655e9fbc18c3a65",
-                "sha256:3ec3dc2f80f71fd0c955ce48b81bfaf8914c6f63a41a738f28885a1c4892968a",
-                "sha256:426c188c83c10df71f053e04b4003b1437bae5cb37606440e498b00f160d71d0",
-                "sha256:626c0a1d4d83ec6303f970a17158114f75c3ba1736f7f2983f7b40a265861bd8",
-                "sha256:767ad0fb5d23efc36a4d5c2fc608ac603f3de028909bcf59abc943e0d0bc5a36",
-                "sha256:7ac729d9091ed5478af2b4a4f44f5335a98febbc008af619e4569a59fe503e40",
-                "sha256:83295a3fb5cf50c48631eb5b440cb5e9832d8c14d81d1d45f4497b67a9987de8",
-                "sha256:8be56bde3312e022d9d1d6afa124556460ad5c844c2fc63642f6af723c098d35",
-                "sha256:8f06556a8f7ea7b1e42eff39726bb0dca1c251205debae64e6eebea3cd7b438a",
-                "sha256:9230fcb5d948c3fb40049bace4d33c5d254f8232c2c0bba05d2570aea3ba4520",
-                "sha256:9378c309aec1f8cd8bad361ed0816a440151b97a2a3f6ffdaba1d1a1fb76873a",
-                "sha256:9977086e0f93adb326379897437373871b80501e1d176fec63c7f46fb300c862",
-                "sha256:9a94fca11fdc161460bd8659c15b6adef45c1b20da86402256eaf3addfaab324",
-                "sha256:9c739b7795ccf2ef1fdad8d44e539a39ad300ee6786e804ea7f0c6a786eb5343",
-                "sha256:b1e332587b3b195542e77681389c296e1837ca01240399d88803a075447d3557",
-                "sha256:c109a26a21f21f695d369ff9b87f5d43e0d6c768d8384e10bc74142bed2e092e",
-                "sha256:c818dc1f3eace93ee50c2b6b5c2becf7c418fa5dd1ba6fc0ef7db279ea21d5e4",
-                "sha256:cff31f5a8977534f255f729d5d2467526f2b10563a30bbdade92223e0bf264bd",
-                "sha256:d4f94368ce2d65873a87ad867eb3bf63f4ba81eb97a9ee66d38c2b71ce5a7439",
-                "sha256:d61b012baa8c2b659e9890011358455c0019a4108536b811602d2f638c40802a",
-                "sha256:d6e1bc5c94873bec742afe2dfadce0d20445b18e75c47afc0c115b19e5dd38dd",
-                "sha256:ea83bcd9d6c03248ebd46e71ac313858e0afd5aa2fa81478c0e653242f3eb476",
-                "sha256:ed5761b37615a1f222c5345bbf45272ae2cf8c7dff88a4f53a1e9f977cbb6d95",
-                "sha256:f011cd0062e54658b7086a76f8cf0f4222812acc66e219e196ea2d0a8849d0ed",
-                "sha256:f1add21b6d179179b3c177c33d18a2186a09cc0d3af41ff5ed3f377360b869f2",
-                "sha256:f655addaaaa9974108d4808f4150652589cada96074c87115c52e575bfcd87d5"
+                "sha256:02e51e1d5828d58f154896ddfd003e2e7584869c275e5acbe290443575370fba",
+                "sha256:03d5cca8618620f45fd40f827423f82b86b3a202c8d44108601b0f5f56b04299",
+                "sha256:0e24171cf01021bc5dc17d6a9d4f33a048f09d62cc3f62541e95ef104588bda4",
+                "sha256:132a56abba24e2e06a479d8e5db7a48271a73a215f605017bbd476d31f8e71c1",
+                "sha256:1e655746f539421d923fd48df8f6f40b3443d80b75532501c0085b64afed9df5",
+                "sha256:2b998dc45ef5f4e5cf5248a6edfcd8d8e9fb5e35df8e4259b13a1b10eda7b16b",
+                "sha256:360955eece2cd0fa694a708d10303c6abd7b39614fa2547b6bd245da76198beb",
+                "sha256:39ef9fb52d6ec7728fce1f1693cb99d60ce302aeebd59bcedea70ca3203fda60",
+                "sha256:4350a42028240c344ee855f032c7d4ad6ff4f813bfbe7121547b7dc579ecc876",
+                "sha256:50348edd283afdccddc0938cdc674484533912ba8a99a27c7bfebb75030aa856",
+                "sha256:54bdedd28476dea8a3cd86cb67c0df1f0e3d71cae8022354b0f879c41a3d27b2",
+                "sha256:55eb61aca2c883db770999f50d091ff7c14016f2769ad7bca3d9b75d1d7c1b68",
+                "sha256:6276478ada411aca97c0d5104916354b3d740d368407912722bd4d11aa9ee4c2",
+                "sha256:67dcad1b8b201308586a8ca2ffe89df1e4f731d5a4cdd0610cc4ea790351c739",
+                "sha256:709b9f144d23e290b9863121d1ace14a72e01f66ea9c903fbdc690520dfdfcf0",
+                "sha256:8063a712fba642f78d3c506b0896846601b6de7f5c3d534e388ad0cc07f5a149",
+                "sha256:80d57177a0b7c14d4594c62bbb47fe2f6309ad3b0a34348a291d570925c97a82",
+                "sha256:a207231a52426de3ff20f5608f0687261a3329d97a036c51f7d4c606a6f30c23",
+                "sha256:abc2e126c9490e58a36a0f83516479e781d83adfb134576a5cbe5c6af2a3e93c",
+                "sha256:b56638d58a3a4be13229c6a815cd448f9e3ce40c00880a5398471b42ee86f50e",
+                "sha256:bcd5b8416e73e4b0d48afba3704d8c826414764dafaed7a1a93c442188d90ccc",
+                "sha256:bec2bcdf7c9ce7f04d718e51887f3b05dc5c1cfaf5d2c2e9065ecddd1b2f6c9a",
+                "sha256:c8bf40cf6e281a4378e25846924327e728a887e8bf0ee83b2604a0f4b61692e8",
+                "sha256:d8074c8448cfd0705dfa71ca333277fce9786d0b9cac75d120545de6253f996a",
+                "sha256:dd302b6ae3965afeb5ef1b0d92486f986c0e65183cd7835973f0b593800590e6",
+                "sha256:de6e1cd75677423ff64712c337521e62e3a7a4fc84caabbd93207752e831a85a",
+                "sha256:ef39c98d9b8c0736d91937d193653e47c3b19ddf4fc3bccdc5e09aaa4b0c5d21",
+                "sha256:f521178e5a991ffd04182ed08f552daca1affcb826aeda0e1945cd989a9d4345",
+                "sha256:f78a68c2c820e4731e510a2df3eef0322f24fde1781ced970bf497b6c7d92982",
+                "sha256:fbe65d5cfe04ff2f7684160d50f5118bdefb01e3af4718eeb618bfed40f19d94"
             ],
             "index": "pypi",
-            "version": "==3.9.7"
+            "version": "==3.9.8"
         },
         "pycryptodomex": {
             "hashes": [
-                "sha256:1537d2d15b604b303aef56e7f440895a1c81adbee786b91f1f06eddc34da5314",
-                "sha256:1d20ab8369b7558168fc014a0745c678613f9f486dae468cca2d68145196b8a4",
-                "sha256:1ecc9db7409db67765eb008e558879d298406642d33ade43a6488224d23e8081",
-                "sha256:37033976f72af829fe15f7fe5fe1dbed308cc43a98d9dd9d2a0a76de8ca5ee78",
-                "sha256:3c3dd9d4c9c1e279d3945ae422895c901f98987333acc132dc094faf52afec35",
-                "sha256:3c9b3fba037ea52c626060c5a87ee6de7e86c99e8a7c6ee07302539985d2bd64",
-                "sha256:45ee555fc5e28c119a46d44ce373f5237e54a35c61b750fb3a94446b09855dbc",
-                "sha256:4c93038ac011b36512cb0bf2ee3e2aec774e8bc81021d015917c89fe02bb0ee5",
-                "sha256:50163324834edd0c9ce3e4512ded3e221c969086e10fdd5d3fdcaadac5e24a78",
-                "sha256:59b0ea9cda5490f924771456912a225d8d9e678891f9f986661af718534719b2",
-                "sha256:5cf306a17cccc327a33cdc3845629fa13f4573a4ec620ed607c79cf6785f2e27",
-                "sha256:5fff8da399af16a1855f58771223acbbdac720b9969cd03fc5013d2e9a7bd9a4",
-                "sha256:68650ce5b9f7152b8283302a4617269f821695a612692640dd247bd12ab21c0b",
-                "sha256:6b3a9a562688996f760b5077714c3ab8b62ca56061b6e9ab7906841e43e19f91",
-                "sha256:7e938ed51a59e29431ea86fab60423ada2757728db0f78952329fa02a789bd31",
-                "sha256:87aa70daad6f039e814790a06422a3189311198b674b62f13933a2bdcb6b1bcc",
-                "sha256:99be3a1df2b2b9f731ebe1c264a2c07c465e71cee68e35e1640b645b5213a755",
-                "sha256:a3f2908666e6f74b8c4893f86dd02e16170f50e4a78ae7f3468b6208d54bc205",
-                "sha256:ae3d44a639fd11dbdeca47e35e94febb1ee8bc15daf26673331add37146e0b85",
-                "sha256:afb4c2fa3c6f492fd9a8b38d76e13f32d429b8e5e1e00238309391b5591cde0d",
-                "sha256:b1515ce3a8a2c3fa537d137c5ca5f8b7a902044d04e07d7c3aa26c3e026120fb",
-                "sha256:bf391b377413a197000b43ef2b74359974d8927d329a897c9f5ba7b63dca7b9c",
-                "sha256:c436919117c23355740c669f89720673578b9aa4569bbfe105f6c10101fc1966",
-                "sha256:d2c3c280975638e2a2c2fd9cb36ab111980219757fa163a2755594b9448e4138",
-                "sha256:e585d530764c459cbd5d460aed0288807bb881f376ca9a20e653645217895961",
-                "sha256:e76e6638ead4a7d93262a24218f0ff3ff74de6b6c823b7e19dccb31b6a481978",
-                "sha256:ebfc2f885cafda076c31ae30fa0dd81e7e919ec34059a88d3018ed66e83fcce3",
-                "sha256:f5797a39933a3d41526da60856735e6684b2b71a8ca99d5f79555ca121be2f4b",
-                "sha256:f7e5fc5e124200b19a14be33fb0099e956e6ebb5e25d287b0829ef0a78ed76c7",
-                "sha256:fb350e31e55211fec8ddc89fc0256f3b9bc3b44b68a8bde1cf44b3b4e80c0e42"
+                "sha256:06f5a458624c9b0e04c0086c7f84bcc578567dab0ddc816e0476b3057b18339f",
+                "sha256:1714675fb4ac29a26ced38ca22eb8ffd923ac851b7a6140563863194d7158422",
+                "sha256:17272d06e4b2f6455ee2cbe93e8eb50d9450a5dc6223d06862ee1ea5d1235861",
+                "sha256:2199708ebeed4b82eb45b10e1754292677f5a0df7d627ee91ea01290b9bab7e6",
+                "sha256:2275a663c9e744ee4eace816ef2d446b3060554c5773a92fbc79b05bf47debda",
+                "sha256:2710fc8d83b3352b370db932b3710033b9d630b970ff5aaa3e7458b5336e3b32",
+                "sha256:35b9c9177a9fe7288b19dd41554c9c8ca1063deb426dd5a02e7e2a7416b6bd11",
+                "sha256:3caa32cf807422adf33c10c88c22e9e2e08b9d9d042f12e1e25fe23113dd618f",
+                "sha256:48cc2cfc251f04a6142badeb666d1ff49ca6fdfc303fd72579f62b768aaa52b9",
+                "sha256:4ae6379350a09339109e9b6f419bb2c3f03d3e441f4b0f5b8ca699d47cc9ff7e",
+                "sha256:4e0b27697fa1621c6d3d3b4edeec723c2e841285de6a8d378c1962da77b349be",
+                "sha256:58e19560814dabf5d788b95a13f6b98279cf41a49b1e49ee6cf6c79a57adb4c9",
+                "sha256:8044eae59301dd392fbb4a7c5d64e1aea8ef0be2540549807ecbe703d6233d68",
+                "sha256:89be1bf55e50116fe7e493a7c0c483099770dd7f81b87ac8d04a43b1a203e259",
+                "sha256:8fcdda24dddf47f716400d54fc7f75cadaaba1dd47cc127e59d752c9c0fc3c48",
+                "sha256:914fbb18e29c54585e6aa39d300385f90d0fa3b3cc02ed829b08f95c1acf60c2",
+                "sha256:93a75d1acd54efed314b82c952b39eac96ce98d241ad7431547442e5c56138aa",
+                "sha256:9fd758e5e2fe02d57860b85da34a1a1e7037155c4eadc2326fc7af02f9cae214",
+                "sha256:a2bc4e1a2e6ca3a18b2e0be6131a23af76fecb37990c159df6edc7da6df913e3",
+                "sha256:a2ee8ba99d33e1a434fcd27d7d0aa7964163efeee0730fe2efc9d60edae1fc71",
+                "sha256:b2d756620078570d3f940c84bc94dd30aa362b795cce8b2723300a8800b87f1c",
+                "sha256:c0d085c8187a1e4d3402f626c9e438b5861151ab132d8761d9c5ce6491a87761",
+                "sha256:c990f2c58f7c67688e9e86e6557ed05952669ff6f1343e77b459007d85f7df00",
+                "sha256:ccbbec59bf4b74226170c54476da5780c9176bae084878fc94d9a2c841218e34",
+                "sha256:dc2bed32c7b138f1331794e454a953360c8cedf3ee62ae31f063822da6007489",
+                "sha256:e070a1f91202ed34c396be5ea842b886f6fa2b90d2db437dc9fb35a26c80c060",
+                "sha256:e42860fbe1292668b682f6dabd225fbe2a7a4fa1632f0c39881c019e93dea594",
+                "sha256:e4e1c486bf226822c8dceac81d0ec59c0a2399dbd1b9e04f03c3efa3605db677",
+                "sha256:ea4d4b58f9bc34e224ef4b4604a6be03d72ef1f8c486391f970205f6733dbc46",
+                "sha256:f60b3484ce4be04f5da3777c51c5140d3fe21cdd6674f2b6568f41c8130bcdeb"
             ],
-            "version": "==3.9.7"
+            "version": "==3.9.8"
         },
         "pyjwkest": {
             "hashes": [
@@ -604,10 +604,10 @@
         },
         "pyparsing": {
             "hashes": [
-                "sha256:67199f0c41a9c702154efb0e7a8cc08accf830eb003b4d9fa42c4059002e2492",
-                "sha256:700d17888d441604b0bd51535908dcb297561b040819cccde647a92439db5a2a"
+                "sha256:1060635ca5ac864c2b7bc7b05a448df4e32d7d8c65e33cbe1514810d339672a2",
+                "sha256:56a551039101858c9e189ac9e66e330a03fb7079e97ba6b50193643905f450ce"
             ],
-            "version": "==3.0.0a1"
+            "version": "==3.0.0a2"
         },
         "pyrsistent": {
             "hashes": [
@@ -631,35 +631,21 @@
         },
         "pyuwsgi": {
             "hashes": [
-                "sha256:15a4626740753b0d0dfeeac7d367f9b2e89ab6af16c195927e60f75359fc1bbc",
-                "sha256:24c40c3b889eb9f283d43feffbc0f7c7fc024e914451425156ddb68af3df1e71",
-                "sha256:393737bd43a7e38f0a4a1601a37a69c4bf893635b37665ff958170fdb604fdb7",
-                "sha256:5a08308f87e639573c1efaa5966a6d04410cd45a73c4586a932fe3ee4b56369d",
-                "sha256:5f4b36c0dbb9931c4da8008aa423158be596e3b4a23cec95a958631603a94e45",
-                "sha256:7c31794f71bbd0ccf542cab6bddf38aa69e84e31ae0f9657a2e18ebdc150c01a",
-                "sha256:802ec6dad4b6707b934370926ec1866603abe31ba03c472f56149001b3533ba1",
-                "sha256:814d73d4569add69a6c19bb4a27cd5adb72b196e5e080caed17dbda740402072",
-                "sha256:829299cd117cf8abe837796bf587e61ce6bfe18423a3a1c510c21e9825789c2c",
-                "sha256:85f2210ceae5f48b7d8fad2240d831f4b890cac85cd98ca82683ac6aa481dfc8",
-                "sha256:861c94442b28cd64af033e88e0f63c66dbd5609f67952dc18694098b47a43f3a",
-                "sha256:957bc6316ffc8463795d56d9953d58e7f32aa5aad1c5ac80bc45c69f3299961e",
-                "sha256:9760c3f56fb5f15852d163429096600906478e9ed2c189a52f2bb21d8a2a986c",
-                "sha256:9fdfb98a2992de01e8efad2aeed22c825e36db628b144b2d6b93d81fb549f811",
-                "sha256:a4b24703ea818196d0be1dc64b3b57b79c67e8dee0cfa207a4216220912035a7",
-                "sha256:ad7f4968c1ddbf139a306d9b075360d959cc554d994ba5e1f512af9a40e62357",
-                "sha256:b1127d34b90f74faf1707718c57a4193ac028b9f4aec0238638983132297d456",
-                "sha256:bcb04d6ec644b3e08d03c64851e06edd7110489261e50627a4bcadf66ff6920e",
-                "sha256:bebfebb9ee83d7cf37668bf54275b677b7ae283e84a944f9f3ac6a4b66f95d4b",
-                "sha256:c29892dafc65a8b6eb95823fa4bac7754ca3fd1c28ab8d2a973289531b340a27",
-                "sha256:cb296b50b51ba022b0090b28d032ff1dd395a6db03672b65a39e83532edad527",
-                "sha256:ce777ebdf49ce736fc04abf555b5c41ab3f130127543a689dcf8d4871cd18fe4",
-                "sha256:d8b4bf930b6a19bc9ee982b9163d948c87501ad91b71516924e8ed25fe85d2ee",
-                "sha256:e2a420f2c4d35f3ec0b7e752a80d7bd385e2c5a64f67c05f2d2d74230e3114b6",
-                "sha256:ef5eb630f541af6b69378d58594be90a0922fa6d6a50a9248c25b9502585f6bf",
-                "sha256:fed899ce96f4f2b4d1b9f338dd145a4040ee1d8a5152213af0dd8d4a4d36e9fe"
+                "sha256:1a4dd8d99b8497f109755e09484b0bd2aeaa533f7621e7c7e2a120a72111219d",
+                "sha256:206937deaebbac5c87692657c3151a5a9d40ecbc9b051b94154205c50a48e963",
+                "sha256:2cf35d9145208cc7c96464d688caa3de745bfc969e1a1ae23cb046fc10b0ac7e",
+                "sha256:3ab84a168633eeb55847d59475d86e9078d913d190c2a1aed804c562a10301a3",
+                "sha256:430406d1bcf288a87f14fde51c66877eaf5e98516838a1c6f761af5d814936fc",
+                "sha256:72be25ce7aa86c5616c59d12c2961b938e7bde47b7ff6a996ff83b89f7c5cd27",
+                "sha256:aa4d615de430e2066a1c76d9cc2a70abf2dfc703a82c21aee625b445866f2c3b",
+                "sha256:aadd231256a672cf4342ef9fb976051949e4d5b616195e696bcb7b8a9c07789e",
+                "sha256:b15ee6a7759b0465786d856334b8231d882deda5291cf243be6a343a8f3ef910",
+                "sha256:bd1d0a8d4cb87eb63417a72e6b1bac47053f9b0be550adc6d2a375f4cbaa22f0",
+                "sha256:d5787779ec24b67ac8898be9dc2b2b4e35f17d79f14361f6cf303d6283a848f2",
+                "sha256:ecfae85d6504e0ecbba100a795032a88ce8f110b62b93243f2df1bd116eca67f"
             ],
             "index": "pypi",
-            "version": "==2.0.18.post0"
+            "version": "==2.0.19.1"
         },
         "pyyaml": {
             "hashes": [
@@ -695,10 +681,10 @@
         },
         "requests": {
             "hashes": [
-                "sha256:43999036bfa82904b6af1d99e4882b560e5e2c68e5c4b0aa03b655f3d7d73fee",
-                "sha256:b3f43d496c6daba4493e7c431722aeb7dbc6288f52a6e04e7b6023b0247817e6"
+                "sha256:b3559a131db72c33ee969480840fff4bb6dd111de7dd27c8ee1f820f4f00231b",
+                "sha256:fe75cc94a9443b9246fc7049224f75604b113c36acb93f87b80ed42c44cbb898"
             ],
-            "version": "==2.23.0"
+            "version": "==2.24.0"
         },
         "requests-oauthlib": {
             "hashes": [
@@ -749,11 +735,11 @@
         },
         "sentry-sdk": {
             "hashes": [
-                "sha256:0e5e947d0f7a969314aa23669a94a9712be5a688ff069ff7b9fc36c66adc160c",
-                "sha256:799a8bf76b012e3030a881be00e97bc0b922ce35dde699c6537122b751d80e2c"
+                "sha256:06825c15a78934e78941ea25910db71314c891608a46492fc32c15902c6b2119",
+                "sha256:3ac0c430761b3cb7682ce612151d829f8644bb3830d4e530c75b02ceb745ff49"
             ],
             "index": "pypi",
-            "version": "==0.14.4"
+            "version": "==0.15.1"
         },
         "service-identity": {
             "hashes": [
@@ -765,11 +751,11 @@
         },
         "signxml": {
             "hashes": [
-                "sha256:2e186c117284fe5a0c543f5bcdde68f5a2341eeae219af9eb7e512dacf4bfce7",
-                "sha256:7d6af724542cae915bbb9000d333a52ce495d0b3cdcb4dc590c3c4a149b079ed"
+                "sha256:4c996153153c9b1eb7ff40cf624722946f8c2ab059febfa641e54cd59725acd9",
+                "sha256:d116c283f2c940bc2b4edf011330107ba02f197650a4878466987e04142d43b1"
             ],
             "index": "pypi",
-            "version": "==2.7.2"
+            "version": "==2.8.0"
         },
         "six": {
             "hashes": [
@@ -795,10 +781,11 @@
         },
         "swagger-spec-validator": {
             "hashes": [
-                "sha256:ba4e636d89bf547a6f41a6945bb503cf06dde13664ad978a7407aaed772ae75f"
+                "sha256:d1514ec7e3c058c701f27cc74f85ceb876d6418c9db57786b9c54085ed5e29eb",
+                "sha256:f4f23ee4dbd52bfcde90b1144dde22304add6260e9f29252e9fd7814c9b8fd16"
             ],
             "index": "pypi",
-            "version": "==2.6.0"
+            "version": "==2.7.3"
         },
         "uritemplate": {
             "hashes": [
@@ -837,17 +824,17 @@
         },
         "asgiref": {
             "hashes": [
-                "sha256:8036f90603c54e93521e5777b2b9a39ba1bad05773fcf2d208f0299d1df58ce5",
-                "sha256:9ca8b952a0a9afa61d30aa6d3d9b570bb3fd6bafcf7ec9e6bed43b936133db1c"
+                "sha256:7e51911ee147dd685c3c8b805c0ad0cb58d360987b56953878f8c06d2d1c6f1a",
+                "sha256:9fc6fb5d39b8af147ba40765234fa822b39818b12cc80b35ad9b0cef3a476aed"
             ],
-            "version": "==3.2.7"
+            "version": "==3.2.10"
         },
         "astroid": {
             "hashes": [
-                "sha256:4c17cea3e592c21b6e222f673868961bad77e1f985cb1694ed077475a89229c1",
-                "sha256:d8506842a3faf734b81599c8b98dcc423de863adcc1999248480b18bd31a0f38"
+                "sha256:2f4078c2a41bf377eea06d71c9d2ba4eb8f6b1af2135bec27bbbb7d8f12bb703",
+                "sha256:bc58d83eb610252fd8de6363e39d4f1d0619c894b0ed24603b881c02e64c7386"
             ],
-            "version": "==2.4.1"
+            "version": "==2.4.2"
         },
         "attrs": {
             "hashes": [
@@ -894,6 +881,53 @@
             "index": "pypi",
             "version": "==0.6.0"
         },
+        "certifi": {
+            "hashes": [
+                "sha256:5930595817496dd21bb8dc35dad090f1c2cd0adfaf21204bf6732ca5d8ee34d3",
+                "sha256:8fc0819f1f30ba15bdb34cceffb9ef04d99f420f68eb75d901e9560b8749fc41"
+            ],
+            "version": "==2020.6.20"
+        },
+        "cffi": {
+            "hashes": [
+                "sha256:001bf3242a1bb04d985d63e138230802c6c8d4db3668fb545fb5005ddf5bb5ff",
+                "sha256:00789914be39dffba161cfc5be31b55775de5ba2235fe49aa28c148236c4e06b",
+                "sha256:028a579fc9aed3af38f4892bdcc7390508adabc30c6af4a6e4f611b0c680e6ac",
+                "sha256:14491a910663bf9f13ddf2bc8f60562d6bc5315c1f09c704937ef17293fb85b0",
+                "sha256:1cae98a7054b5c9391eb3249b86e0e99ab1e02bb0cc0575da191aedadbdf4384",
+                "sha256:2089ed025da3919d2e75a4d963d008330c96751127dd6f73c8dc0c65041b4c26",
+                "sha256:2d384f4a127a15ba701207f7639d94106693b6cd64173d6c8988e2c25f3ac2b6",
+                "sha256:337d448e5a725bba2d8293c48d9353fc68d0e9e4088d62a9571def317797522b",
+                "sha256:399aed636c7d3749bbed55bc907c3288cb43c65c4389964ad5ff849b6370603e",
+                "sha256:3b911c2dbd4f423b4c4fcca138cadde747abdb20d196c4a48708b8a2d32b16dd",
+                "sha256:3d311bcc4a41408cf5854f06ef2c5cab88f9fded37a3b95936c9879c1640d4c2",
+                "sha256:62ae9af2d069ea2698bf536dcfe1e4eed9090211dbaafeeedf5cb6c41b352f66",
+                "sha256:66e41db66b47d0d8672d8ed2708ba91b2f2524ece3dee48b5dfb36be8c2f21dc",
+                "sha256:675686925a9fb403edba0114db74e741d8181683dcf216be697d208857e04ca8",
+                "sha256:7e63cbcf2429a8dbfe48dcc2322d5f2220b77b2e17b7ba023d6166d84655da55",
+                "sha256:8a6c688fefb4e1cd56feb6c511984a6c4f7ec7d2a1ff31a10254f3c817054ae4",
+                "sha256:8c0ffc886aea5df6a1762d0019e9cb05f825d0eec1f520c51be9d198701daee5",
+                "sha256:95cd16d3dee553f882540c1ffe331d085c9e629499ceadfbda4d4fde635f4b7d",
+                "sha256:99f748a7e71ff382613b4e1acc0ac83bf7ad167fb3802e35e90d9763daba4d78",
+                "sha256:b8c78301cefcf5fd914aad35d3c04c2b21ce8629b5e4f4e45ae6812e461910fa",
+                "sha256:c420917b188a5582a56d8b93bdd8e0f6eca08c84ff623a4c16e809152cd35793",
+                "sha256:c43866529f2f06fe0edc6246eb4faa34f03fe88b64a0a9a942561c8e22f4b71f",
+                "sha256:cab50b8c2250b46fe738c77dbd25ce017d5e6fb35d3407606e7a4180656a5a6a",
+                "sha256:cef128cb4d5e0b3493f058f10ce32365972c554572ff821e175dbc6f8ff6924f",
+                "sha256:cf16e3cf6c0a5fdd9bc10c21687e19d29ad1fe863372b5543deaec1039581a30",
+                "sha256:e56c744aa6ff427a607763346e4170629caf7e48ead6921745986db3692f987f",
+                "sha256:e577934fc5f8779c554639376beeaa5657d54349096ef24abe8c74c5d9c117c3",
+                "sha256:f2b0fa0c01d8a0c7483afd9f31d7ecf2d71760ca24499c8697aeb5ca37dc090c"
+            ],
+            "version": "==1.14.0"
+        },
+        "chardet": {
+            "hashes": [
+                "sha256:84ab92ed1c4d4f16916e05906b6b75a6c0fb5db821cc65e70cbd64a3e2a5eaae",
+                "sha256:fc323ffcaeaed0e0a02bf4d117757b98aed530d9ed4531e3e15460124c106691"
+            ],
+            "version": "==3.0.4"
+        },
         "click": {
             "hashes": [
                 "sha256:d2b5255c7c6349bc1bd1e59e08cd12acbbd63ce649f2588755783aa94dfb6b1a",
@@ -946,13 +980,37 @@
             "index": "pypi",
             "version": "==5.1"
         },
+        "cryptography": {
+            "hashes": [
+                "sha256:091d31c42f444c6f519485ed528d8b451d1a0c7bf30e8ca583a0cac44b8a0df6",
+                "sha256:18452582a3c85b96014b45686af264563e3e5d99d226589f057ace56196ec78b",
+                "sha256:1dfa985f62b137909496e7fc182dac687206d8d089dd03eaeb28ae16eec8e7d5",
+                "sha256:1e4014639d3d73fbc5ceff206049c5a9a849cefd106a49fa7aaaa25cc0ce35cf",
+                "sha256:22e91636a51170df0ae4dcbd250d318fd28c9f491c4e50b625a49964b24fe46e",
+                "sha256:3b3eba865ea2754738616f87292b7f29448aec342a7c720956f8083d252bf28b",
+                "sha256:651448cd2e3a6bc2bb76c3663785133c40d5e1a8c1a9c5429e4354201c6024ae",
+                "sha256:726086c17f94747cedbee6efa77e99ae170caebeb1116353c6cf0ab67ea6829b",
+                "sha256:844a76bc04472e5135b909da6aed84360f522ff5dfa47f93e3dd2a0b84a89fa0",
+                "sha256:88c881dd5a147e08d1bdcf2315c04972381d026cdb803325c03fe2b4a8ed858b",
+                "sha256:96c080ae7118c10fcbe6229ab43eb8b090fccd31a09ef55f83f690d1ef619a1d",
+                "sha256:a0c30272fb4ddda5f5ffc1089d7405b7a71b0b0f51993cb4e5dbb4590b2fc229",
+                "sha256:bb1f0281887d89617b4c68e8db9a2c42b9efebf2702a3c5bf70599421a8623e3",
+                "sha256:c447cf087cf2dbddc1add6987bbe2f767ed5317adb2d08af940db517dd704365",
+                "sha256:c4fd17d92e9d55b84707f4fd09992081ba872d1a0c610c109c18e062e06a2e55",
+                "sha256:d0d5aeaedd29be304848f1c5059074a740fa9f6f26b84c5b63e8b29e73dfc270",
+                "sha256:daf54a4b07d67ad437ff239c8a4080cfd1cc7213df57d33c97de7b4738048d5e",
+                "sha256:e993468c859d084d5579e2ebee101de8f5a27ce8e2159959b6673b418fd8c785",
+                "sha256:f118a95c7480f5be0df8afeb9a11bd199aa20afab7a96bcf20409b411a3a85f0"
+            ],
+            "version": "==2.9.2"
+        },
         "django": {
             "hashes": [
-                "sha256:051ba55d42daa3eeda3944a8e4df2bc96d4c62f94316dea217248a22563c3621",
-                "sha256:9aaa6a09678e1b8f0d98a948c56482eac3e3dd2ddbfb8de70a868135ef3b5e01"
+                "sha256:31a5fbbea5fc71c99e288ec0b2f00302a0a92c44b13ede80b73a6a4d6d205582",
+                "sha256:5457fc953ec560c5521b41fad9e6734a4668b7ba205832191bbdff40ec61073c"
             ],
             "index": "pypi",
-            "version": "==3.0.6"
+            "version": "==3.0.8"
         },
         "django-debug-toolbar": {
             "hashes": [
@@ -962,6 +1020,14 @@
             "index": "pypi",
             "version": "==2.2"
         },
+        "docker": {
+            "hashes": [
+                "sha256:03a46400c4080cb6f7aa997f881ddd84fef855499ece219d75fbdb53289c17ab",
+                "sha256:26eebadce7e298f55b76a88c4f8802476c5eaddbdbe38dbc6cce8781c47c9b54"
+            ],
+            "index": "pypi",
+            "version": "==4.2.2"
+        },
         "gitdb": {
             "hashes": [
                 "sha256:91f36bfb1ab7949b3b40e23736db18231bf7593edada2ba5c3a174a7b23657ac",
@@ -976,6 +1042,13 @@
             ],
             "version": "==3.1.3"
         },
+        "idna": {
+            "hashes": [
+                "sha256:b307872f855b18632ce0c21c5e45be78c0ea7ae4c15c828c20788b26921eb3f6",
+                "sha256:b97d804b1e9b523befed77c48dacec60e6dcb0b5391d57af6a65a312a90648c0"
+            ],
+            "version": "==2.10"
+        },
         "isort": {
             "hashes": [
                 "sha256:54da7e92468955c4fceacd0c86bd0ec997b0e1ee80d97f67c35a78b719dccab1",
@@ -1037,13 +1110,20 @@
             ],
             "version": "==2.6.0"
         },
+        "pycparser": {
+            "hashes": [
+                "sha256:2d475327684562c3a96cc71adf7dc8c4f0565175cf86b6d7a404ff4c771f15f0",
+                "sha256:7582ad22678f0fcd81102833f60ef8d0e57288b6b5fb00323d101be910e35705"
+            ],
+            "version": "==2.20"
+        },
         "pylint": {
             "hashes": [
-                "sha256:b95e31850f3af163c2283ed40432f053acbc8fc6eba6a069cb518d9dbf71848c",
-                "sha256:dd506acce0427e9e08fb87274bcaa953d38b50a58207170dbf5b36cf3e16957b"
+                "sha256:7dd78437f2d8d019717dbf287772d0b2dbdfd13fc016aa7faa08d67bccc46adc",
+                "sha256:d0ece7d223fe422088b0e8f13fa0a1e8eb745ebffcb8ed53d3e95394b6101a1c"
             ],
             "index": "pypi",
-            "version": "==2.5.2"
+            "version": "==2.5.3"
         },
         "pylint-django": {
             "hashes": [
@@ -1060,6 +1140,13 @@
             ],
             "version": "==0.6"
         },
+        "pyopenssl": {
+            "hashes": [
+                "sha256:621880965a720b8ece2f1b2f54ea2071966ab00e2970ad2ce11d596102063504",
+                "sha256:9a24494b2602aaf402be5c9e30a0b82d4a5c67528fe8fb475e3f3bc00dd69507"
+            ],
+            "version": "==19.1.0"
+        },
         "pytz": {
             "hashes": [
                 "sha256:a494d53b6d39c3c6e44c3bec237336e14305e4f29bbf800b599253057fbb79ed",
@@ -1086,29 +1173,44 @@
         },
         "regex": {
             "hashes": [
-                "sha256:1386e75c9d1574f6aa2e4eb5355374c8e55f9aac97e224a8a5a6abded0f9c927",
-                "sha256:27ff7325b297fb6e5ebb70d10437592433601c423f5acf86e5bc1ee2919b9561",
-                "sha256:329ba35d711e3428db6b45a53b1b13a0a8ba07cbbcf10bbed291a7da45f106c3",
-                "sha256:3a9394197664e35566242686d84dfd264c07b20f93514e2e09d3c2b3ffdf78fe",
-                "sha256:51f17abbe973c7673a61863516bdc9c0ef467407a940f39501e786a07406699c",
-                "sha256:579ea215c81d18da550b62ff97ee187b99f1b135fd894a13451e00986a080cad",
-                "sha256:70c14743320a68c5dac7fc5a0f685be63bc2024b062fe2aaccc4acc3d01b14a1",
-                "sha256:7e61be8a2900897803c293247ef87366d5df86bf701083b6c43119c7c6c99108",
-                "sha256:8044d1c085d49673aadb3d7dc20ef5cb5b030c7a4fa253a593dda2eab3059929",
-                "sha256:89d76ce33d3266173f5be80bd4efcbd5196cafc34100fdab814f9b228dee0fa4",
-                "sha256:99568f00f7bf820c620f01721485cad230f3fb28f57d8fbf4a7967ec2e446994",
-                "sha256:a7c37f048ec3920783abab99f8f4036561a174f1314302ccfa4e9ad31cb00eb4",
-                "sha256:c2062c7d470751b648f1cacc3f54460aebfc261285f14bc6da49c6943bd48bdd",
-                "sha256:c9bce6e006fbe771a02bda468ec40ffccbf954803b470a0345ad39c603402577",
-                "sha256:ce367d21f33e23a84fb83a641b3834dd7dd8e9318ad8ff677fbfae5915a239f7",
-                "sha256:ce450ffbfec93821ab1fea94779a8440e10cf63819be6e176eb1973a6017aff5",
-                "sha256:ce5cc53aa9fbbf6712e92c7cf268274eaff30f6bd12a0754e8133d85a8fb0f5f",
-                "sha256:d466967ac8e45244b9dfe302bbe5e3337f8dc4dec8d7d10f5e950d83b140d33a",
-                "sha256:d881c2e657c51d89f02ae4c21d9adbef76b8325fe4d5cf0e9ad62f850f3a98fd",
-                "sha256:e565569fc28e3ba3e475ec344d87ed3cd8ba2d575335359749298a0899fe122e",
-                "sha256:ea55b80eb0d1c3f1d8d784264a6764f931e172480a2f1868f2536444c5f01e01"
+                "sha256:08997a37b221a3e27d68ffb601e45abfb0093d39ee770e4257bd2f5115e8cb0a",
+                "sha256:112e34adf95e45158c597feea65d06a8124898bdeac975c9087fe71b572bd938",
+                "sha256:1700419d8a18c26ff396b3b06ace315b5f2a6e780dad387e4c48717a12a22c29",
+                "sha256:2f6f211633ee8d3f7706953e9d3edc7ce63a1d6aad0be5dcee1ece127eea13ae",
+                "sha256:52e1b4bef02f4040b2fd547357a170fc1146e60ab310cdbdd098db86e929b387",
+                "sha256:55b4c25cbb3b29f8d5e63aeed27b49fa0f8476b0d4e1b3171d85db891938cc3a",
+                "sha256:5aaa5928b039ae440d775acea11d01e42ff26e1561c0ffcd3d805750973c6baf",
+                "sha256:654cb773b2792e50151f0e22be0f2b6e1c3a04c5328ff1d9d59c0398d37ef610",
+                "sha256:690f858d9a94d903cf5cada62ce069b5d93b313d7d05456dbcd99420856562d9",
+                "sha256:6ad8663c17db4c5ef438141f99e291c4d4edfeaacc0ce28b5bba2b0bf273d9b5",
+                "sha256:89cda1a5d3e33ec9e231ece7307afc101b5217523d55ef4dc7fb2abd6de71ba3",
+                "sha256:92d8a043a4241a710c1cf7593f5577fbb832cf6c3a00ff3fc1ff2052aff5dd89",
+                "sha256:95fa7726d073c87141f7bbfb04c284901f8328e2d430eeb71b8ffdd5742a5ded",
+                "sha256:97712e0d0af05febd8ab63d2ef0ab2d0cd9deddf4476f7aa153f76feef4b2754",
+                "sha256:b2ba0f78b3ef375114856cbdaa30559914d081c416b431f2437f83ce4f8b7f2f",
+                "sha256:bae83f2a56ab30d5353b47f9b2a33e4aac4de9401fb582b55c42b132a8ac3868",
+                "sha256:c78e66a922de1c95a208e4ec02e2e5cf0bb83a36ceececc10a72841e53fbf2bd",
+                "sha256:cf59bbf282b627130f5ba68b7fa3abdb96372b24b66bdf72a4920e8153fc7910",
+                "sha256:e3cdc9423808f7e1bb9c2e0bdb1c9dc37b0607b30d646ff6faf0d4e41ee8fee3",
+                "sha256:e9b64e609d37438f7d6e68c2546d2cb8062f3adb27e6336bc129b51be20773ac",
+                "sha256:fbff901c54c22425a5b809b914a3bfaf4b9570eee0e5ce8186ac71eb2025191c"
             ],
-            "version": "==2020.5.14"
+            "version": "==2020.6.8"
+        },
+        "requests": {
+            "hashes": [
+                "sha256:b3559a131db72c33ee969480840fff4bb6dd111de7dd27c8ee1f820f4f00231b",
+                "sha256:fe75cc94a9443b9246fc7049224f75604b113c36acb93f87b80ed42c44cbb898"
+            ],
+            "version": "==2.24.0"
+        },
+        "selenium": {
+            "hashes": [
+                "sha256:5f5489a0c5fe2f09cc6bc3f32a0d53441ab36882c987269f2afe805979633ac1",
+                "sha256:a9779ddc69cf03b75d94062c5e948f763919cf3341c77272f94cd05e6b4c7b32"
+            ],
+            "index": "pypi",
+            "version": "==4.0.0a6.post2"
         },
         "six": {
             "hashes": [
@@ -1133,10 +1235,10 @@
         },
         "stevedore": {
             "hashes": [
-                "sha256:18afaf1d623af5950cc0f7e75e70f917784c73b652a34a12d90b309451b5500b",
-                "sha256:a4e7dc759fb0f2e3e2f7d8ffe2358c19d45b9b8297f393ef1256858d82f69c9b"
+                "sha256:609912b87df5ad338ff8e44d13eaad4f4170a65b79ae9cb0aa5632598994a1b7",
+                "sha256:c4724f8d7b8f6be42130663855d01a9c2414d6046055b5a65ab58a0e38637688"
             ],
-            "version": "==1.32.0"
+            "version": "==2.0.1"
         },
         "toml": {
             "hashes": [
@@ -1179,6 +1281,25 @@
             "index": "pypi",
             "version": "==3.0.2"
         },
+        "urllib3": {
+            "extras": [
+                "secure"
+            ],
+            "hashes": [
+                "sha256:3018294ebefce6572a474f0604c2021e33b3fd8006ecd11d62107a5d2a963527",
+                "sha256:88206b0eb87e6d677d424843ac5209e3fb9d0190d0ee169599165ec25e9d9115"
+            ],
+            "index": "pypi",
+            "markers": null,
+            "version": "==1.25.9"
+        },
+        "websocket-client": {
+            "hashes": [
+                "sha256:0fc45c961324d79c781bab301359d5a1b00b13ad1b10415a4780229ef71a5549",
+                "sha256:d735b91d6d1692a6a181f2a8c9e0238e5f6373356f561bb9dc4c7af36f452010"
+            ],
+            "version": "==0.57.0"
+        },
         "wrapt": {
             "hashes": [
                 "sha256:b62ffa81fb85f4332a4f609cab4ac40709470da05643a082ec1eb88e6d9b97d7"
diff --git a/README.md b/README.md
index bb83b5d40..0502e5009 100644
--- a/README.md
+++ b/README.md
@@ -1,11 +1,12 @@
-# passbook
+<img src="passbook/static/static/passbook/logo.svg" height="50" alt="passbook logo"><img src="passbook/static/static/passbook/brand_inverted.svg" height="50" alt="passbook">
 
-![](https://img.shields.io/azure-devops/build/beryjuorg/5d94b893-6dea-4f68-a8fe-10f1674fc3a9/1?style=flat-square)
-![](https://img.shields.io/docker/pulls/beryju/passbook.svg?style=flat-square)
-![](https://img.shields.io/docker/pulls/beryju/passbook-gatekeeper.svg?style=flat-square)
-![](https://img.shields.io/docker/pulls/beryju/passbook-static.svg?style=flat-square)
-![](https://img.shields.io/docker/v/beryju/passbook?sort=semver&style=flat-square)
-![](https://img.shields.io/codecov/c/gh/beryju/passbook?style=flat-square)
+=======
+![CI Build status](https://img.shields.io/azure-devops/build/beryjuorg/5d94b893-6dea-4f68-a8fe-10f1674fc3a9/1?style=flat-square)
+![Docker pulls](https://img.shields.io/docker/pulls/beryju/passbook.svg?style=flat-square)
+![Docker pulls (gatekeeper)](https://img.shields.io/docker/pulls/beryju/passbook-gatekeeper.svg?style=flat-square)
+![Latest version](https://img.shields.io/docker/v/beryju/passbook?sort=semver&style=flat-square)
+![LGTM Grade](https://img.shields.io/lgtm/grade/python/github/BeryJu/passbook?style=flat-square)
+![Code Coverage](https://img.shields.io/codecov/c/gh/beryju/passbook?style=flat-square)
 
 ## What is passbook?
 
@@ -28,12 +29,12 @@ docker-compose up -d
 docker-compose exec server ./manage.py migrate
 ```
 
-For bigger setups, there is a Helm Chart in the `helm/` directory. This is documented [here](https://beryju.github.io/passbook/installation/kubernetes/)
+For bigger setups, there is a Helm Chart in the `helm/` directory. This is documented [here](https://passbook.beryju.org//installation/kubernetes/)
 
 ## Screenshots
 
-![](.github/screen_apps.png)
-![](.github/screen_admin.png)
+![](docs/images/screen_apps.png)
+![](docs/images/screen_admin.png)
 
 ## Development
 
diff --git a/azure-pipelines.yml b/azure-pipelines.yml
index c773ff6de..a482669c8 100644
--- a/azure-pipelines.yml
+++ b/azure-pipelines.yml
@@ -135,7 +135,23 @@ stages:
                 pipenv install --dev
           - task: CmdLine@2
             inputs:
-              script: pipenv run ./scripts/coverage.sh
+              script: |
+                cd e2e
+                docker-compose pull -q chrome
+                docker-compose up -d chrome
+          - task: CmdLine@2
+            inputs:
+              script: |
+                cd passbook/static/static
+                yarn
+          - task: CmdLine@2
+            inputs:
+              script: pipenv run coverage run ./manage.py test --failfast
+          - task: PublishBuildArtifacts@1
+            inputs:
+              PathtoPublish: 'selenium_screenshots/'
+              ArtifactName: 'drop'
+              publishLocation: 'Container'
           - task: CmdLine@2
             inputs:
               script: pipenv run coverage xml
@@ -156,7 +172,7 @@ stages:
             repository: 'beryju/passbook'
             command: 'buildAndPush'
             Dockerfile: 'Dockerfile'
-            tags: '$(Build.SourceBranchName)'
+            tags: 'gh-$(Build.SourceBranchName)'
       - job: build_gatekeeper
         pool:
           vmImage: 'ubuntu-latest'
@@ -170,7 +186,7 @@ stages:
             repository: 'beryju/passbook-gatekeeper'
             command: 'buildAndPush'
             Dockerfile: 'Dockerfile'
-            tags: '$(Build.SourceBranchName)'
+            tags: 'gh-$(Build.SourceBranchName)'
       - job: build_static
         pool:
           vmImage: 'ubuntu-latest'
@@ -187,11 +203,11 @@ stages:
             repository: 'beryju/passbook-static'
             command: 'build'
             Dockerfile: 'static.Dockerfile'
-            tags: '$(Build.SourceBranchName)'
+            tags: 'gh-$(Build.SourceBranchName)'
             arguments: "--network=beryjupassbook_default"
         - task: Docker@2
           inputs:
             containerRegistry: 'dockerhub'
             repository: 'beryju/passbook-static'
             command: 'push'
-            tags: '$(Build.SourceBranchName)'
+            tags: 'gh-$(Build.SourceBranchName)'
diff --git a/docker-compose.yml b/docker-compose.yml
index 95abb6381..a9a6aba8b 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -67,13 +67,13 @@ services:
       - traefik.docker.network=internal
   traefik:
     image: traefik:1.7
-    command: --api --docker
+    command: --api --docker --defaultentrypoints=https --entryPoints='Name:http Address::80 Redirect.EntryPoint:https' --entryPoints='Name:https Address::443 TLS'
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock:ro
     ports:
       - "0.0.0.0:80:80"
       - "0.0.0.0:443:443"
-      - "0.0.0.0:8080:8080"
+      - "127.0.0.1:8080:8080"
     networks:
       - internal
 
diff --git a/docker.env.yml b/docker.env.yml
new file mode 100644
index 000000000..f8961f7ef
--- /dev/null
+++ b/docker.env.yml
@@ -0,0 +1,9 @@
+debug: true
+postgresql:
+  user: postgres
+  host: postgresql
+
+redis:
+  host: redis
+
+log_level: debug
diff --git a/docs/Dockerfile b/docs/Dockerfile
deleted file mode 100644
index d0953e867..000000000
--- a/docs/Dockerfile
+++ /dev/null
@@ -1,14 +0,0 @@
-FROM python:3.8-slim-buster as builder
-
-WORKDIR /mkdocs
-
-RUN pip install mkdocs mkdocs-material
-
-COPY docs/ docs
-COPY mkdocs.yml .
-
-RUN mkdocs build
-
-FROM nginx
-
-COPY --from=builder /mkdocs/site /usr/share/nginx/html
diff --git a/docs/build.sh b/docs/build.sh
new file mode 100755
index 000000000..3ca164253
--- /dev/null
+++ b/docs/build.sh
@@ -0,0 +1,3 @@
+#!/bin/bash -x
+pip install -U mkdocs mkdocs-material
+mkdocs gh-deploy
diff --git a/docs/expressions/index.md b/docs/expressions/index.md
new file mode 100644
index 000000000..9f34050ef
--- /dev/null
+++ b/docs/expressions/index.md
@@ -0,0 +1,55 @@
+# Expressions
+
+Expressions allow you to write custom logic using Python code.
+
+Expressions are used in different places throughout passbook, and can do different things.
+
+!!! info
+    These functions/objects are available wherever expressions are used. For more specific information, see [Expression Policies](../policies/expression.md) and [Property Mappings](../property-mappings/expression.md)
+
+## Global objects
+
+- `pb_logger`: structlog BoundLogger. ([ref](https://www.structlog.org/en/stable/api.html#structlog.BoundLogger))
+- `requests`: requests Session object. ([ref](https://requests.readthedocs.io/en/master/user/advanced/))
+
+## Generally available functions
+
+### `regex_match(value: Any, regex: str) -> bool`
+
+Check if `value` matches Regular Expression `regex`.
+
+Example:
+
+```python
+return regex_match(request.user.username, '.*admin.*')
+```
+
+### `regex_replace(value: Any, regex: str, repl: str) -> str`
+
+Replace anything matching `regex` within `value` with `repl` and return it.
+
+Example:
+
+```python
+user_email_local = regex_replace(request.user.email, '(.+)@.+', '')
+```
+
+### `pb_is_group_member(user: User, **group_filters) -> bool`
+
+Check if `user` is member of a group matching `**group_filters`.
+
+Example:
+
+```python
+return pb_is_group_member(request.user, name="test_group")
+```
+
+### `pb_user_by(**filters) -> Optional[User]`
+
+Fetch a user matching `**filters`. Returns "None" if no user was found.
+
+Example:
+
+```python
+other_user = pb_user_by(username="other_user")
+```
diff --git a/docs/expressions/reference/user-object.md b/docs/expressions/reference/user-object.md
new file mode 100644
index 000000000..69eeeaaac
--- /dev/null
+++ b/docs/expressions/reference/user-object.md
@@ -0,0 +1,21 @@
+# Passbook User Object
+
+The User object has the following attributes:
+
+ - `username`: User's username.
+ - `email` User's email.
+ - `name` User's display mame.
+ - `is_staff` Boolean field if user is staff.
+ - `is_active` Boolean field if user is active.
+ - `date_joined` Date user joined/was created.
+ - `password_change_date` Date password was last changed.
+ - `attributes` Dynamic attributes.
+
+## Examples
+
+List all the User's group names:
+
+```python
+for group in user.groups.all():
+    yield group.name
+```
diff --git a/docs/factors.md b/docs/factors.md
deleted file mode 100644
index 8e55930c4..000000000
--- a/docs/factors.md
+++ /dev/null
@@ -1,23 +0,0 @@
-# Factors
-
-A factor represents a single authenticating factor for a user. Common examples of this would be a password or an OTP. These factors can be combined in any order, and can be dynamically enabled using policies.
-
-## Password Factor
-
-This is the standard Password Factor. It allows you to select which Backend the password is checked with. here you can also specify which Policies are used to check the password. You can also specify which Factors a User has to pass to recover their account.
-
-## Dummy Factor
-
-This factor waits a random amount of time. Mostly used for debugging.
-
-## E-Mail Factor
-
-This factor is mostly for recovery, and used in conjunction with the Password Factor.
-
-## OTP Factor
-
-This is your typical One-Time Password implementation, compatible with Authy and Google Authenticator. You can enfore this Factor so that every user has to configure it, or leave it optional.
-
-## Captcha Factor
-
-While this factor doesn't really authenticate a user, it is part of the Authentication Flow. passbook uses Google's reCaptcha implementation.
diff --git a/docs/flow/examples/login.md b/docs/flow/examples/login.md
new file mode 100644
index 000000000..1c141e8d1
--- /dev/null
+++ b/docs/flow/examples/login.md
@@ -0,0 +1,36 @@
+# Login Flow
+
+This document describes how a simple authentication flow can be created.
+
+This flow is created automatically when passbook is installed.
+
+1. Create an **Identification** stage
+
+    > Here you can select whichever fields the user can identify themselves with
+    > Select the Template **Default Login**, as this template shows the (optional) Flows
+    > Here you can also link optional enrollment and recovery flows.
+
+2. Create a **Password** stage
+
+    > Select the Backend you want the password to be checked against. Select "passbook-internal Userdatabase".
+
+3. Create a **User Login** stage
+
+    > This stage doesn't have any options.
+
+4. Create a flow
+
+    > Create a flow with the delegation of **Authentication**
+    > Assign a name and a slug. The slug is used in the URL when the flow is executed.
+
+5. Bind the stages to the flow
+
+    > Bind the **Identification** Stage with an order of 0
+    > Bind the **Password** Stage with an order of 1
+    > Bind the **User Login** Stage with an order of 2
+
+    ![](login.png)
+
+!!! notice
+
+    This flow can used by any user, authenticated and un-authenticated. This means any authenticated user that visits this flow can login again.
diff --git a/docs/flow/examples/login.png b/docs/flow/examples/login.png
new file mode 100644
index 000000000..5e5306d3b
Binary files /dev/null and b/docs/flow/examples/login.png differ
diff --git a/docs/flow/flows.md b/docs/flow/flows.md
new file mode 100644
index 000000000..d8eec0690
--- /dev/null
+++ b/docs/flow/flows.md
@@ -0,0 +1,45 @@
+# Flows
+
+Flows are a method of describing a sequence of stages. A stage represents a single verification or logic step. They are used to authenticate users, enroll them, and more.
+
+Upon flow execution, a plan containing all stages is generated. This means that all attached policies are evaluated upon execution. This behaviour can be altered by enabling the **Re-evaluate Policies** option on the binding.
+
+To determine which flow is linked, passbook searches all flows with the required designation and chooses the first instance the current user has access to.
+
+## Permissions
+
+Flows can have policies assigned to them. These policies determine if the current user is allowed to see and use this flow.
+
+## Designation
+
+Flows are designated for a single purpose. This designation changes when a flow is used. The following designations are available:
+
+### Authentication
+
+This is designates a flow to be used for authentication.
+
+The authentication flow should always contain a [**User Login**](stages/user_login.md) stage, which attaches the staged user to the current session.
+
+### Invalidation
+
+This designates a flow to be used to invalidate a session.
+
+This stage should always contain a [**User Logout**](stages/user_logout.md) stage, which resets the current session.
+
+### Enrollment
+
+This designates a flow for enrollment. This flow can contain any amount of verification stages, such as [**email**](stages/email/index.md) or [**captcha**](stages/captcha/index.md). At the end, to create the user, you can use the [**user_write**](stages/user_write.md) stage, which either updates the currently staged user, or if none exists, creates a new one.
+
+### Unenrollment
+
+This designates a flow for unenrollment. This flow can contain any amount of verification stages, such as [**email**](stages/email/index.md) or [**captcha**](stages/captcha/index.md). As a final stage, to delete the account, use the [**user_delete**](stages/user_delete.md) stage.
+
+### Recovery
+
+This designates a flow for recovery. This flow normally contains an [**identification**](stages/identification/index.md) stage to find the user. It can also contain any amount of verification stages, such as [**email**](stages/email/index.md) or [**captcha**](stages/captcha/index.md).
+Afterwards, use the [**prompt**](stages/prompt/index.md) stage to ask the user for a new password and the [**user_write**](stages/user_write.md) stage to update the password.
+
+### Change Password
+
+This designates a flow for password changes. This flow can contain any amount of verification stages, such as [**email**](stages/email/index.md) or [**captcha**](stages/captcha/index.md).
+Afterwards, use the [**prompt**](stages/prompt/index.md) stage to ask the user for a new password and the [**user_write**](stages/user_write.md) stage to update the password.
diff --git a/docs/flow/stages/captcha/captcha-admin.png b/docs/flow/stages/captcha/captcha-admin.png
new file mode 100644
index 000000000..f33a52972
Binary files /dev/null and b/docs/flow/stages/captcha/captcha-admin.png differ
diff --git a/docs/flow/stages/captcha/index.md b/docs/flow/stages/captcha/index.md
new file mode 100644
index 000000000..422caa4e4
--- /dev/null
+++ b/docs/flow/stages/captcha/index.md
@@ -0,0 +1,7 @@
+# Captcha stage
+
+This stage adds a form of verification using [Google's ReCaptcha](https://www.google.com/recaptcha/intro/v3.html).
+
+This stage has two required fields: Public key and private key. These can both be acquired at https://www.google.com/recaptcha/admin.
+
+![](captcha-admin.png)
diff --git a/docs/flow/stages/dummy/dummy.png b/docs/flow/stages/dummy/dummy.png
new file mode 100644
index 000000000..7040e66cb
Binary files /dev/null and b/docs/flow/stages/dummy/dummy.png differ
diff --git a/docs/flow/stages/dummy/index.md b/docs/flow/stages/dummy/index.md
new file mode 100644
index 000000000..9564585de
--- /dev/null
+++ b/docs/flow/stages/dummy/index.md
@@ -0,0 +1,5 @@
+# Dummy stage
+
+This stage is used for development and has no function. It presents the user with a form which requires a single confirmation.
+
+![](dummy.png)
diff --git a/docs/flow/stages/email/email-recovery.png b/docs/flow/stages/email/email-recovery.png
new file mode 100644
index 000000000..26c0cccb8
Binary files /dev/null and b/docs/flow/stages/email/email-recovery.png differ
diff --git a/docs/flow/stages/email/index.md b/docs/flow/stages/email/index.md
new file mode 100644
index 000000000..75dcb6d57
--- /dev/null
+++ b/docs/flow/stages/email/index.md
@@ -0,0 +1,5 @@
+# Email
+
+This stage can be used for email verification. passbook's background worker will send an email using the specified connection details. When an email can't be delivered, delivery is automatically retried periodically.
+
+![](email-recovery.png)
diff --git a/docs/flow/stages/identification/index.md b/docs/flow/stages/identification/index.md
new file mode 100644
index 000000000..c9b431e29
--- /dev/null
+++ b/docs/flow/stages/identification/index.md
@@ -0,0 +1,25 @@
+# Identification
+
+This stage provides a ready-to-go form for users to identify themselves.
+
+## Options
+
+### User Fields
+
+Select which fields the user can use to identify themselves. Multiple fields can be specified and separated with a comma.
+Valid choices:
+
+- email
+- username
+
+### Template
+
+This specifies which template is rendered. Currently there are two templates:
+
+The `Login` template shows configured Sources below the login form, as well as linking to the defined Enrollment and Recovery flows.
+
+The `Recovery` template shows only the form.
+
+### Enrollment/Recovery Flow
+
+These fields specify if and which flows are linked on the form. The enrollment flow is linked as `Need an account? Sign up.`, and the recovery flow is linked as `Forgot username or password?`.
diff --git a/docs/flow/stages/invitation/index.md b/docs/flow/stages/invitation/index.md
new file mode 100644
index 000000000..06fd798ac
--- /dev/null
+++ b/docs/flow/stages/invitation/index.md
@@ -0,0 +1,7 @@
+# Invitation Stage
+
+This stage can be used to invite users. You can use this to enroll users with preset values.
+
+If the option `Continue Flow without Invitation` is enabled, this stage will continue even when no invitation token is present.
+
+To check if a user has used an invitation within a policy, you can check `request.context.invitation_in_effect`.
diff --git a/docs/flow/stages/otp/index.md b/docs/flow/stages/otp/index.md
new file mode 100644
index 000000000..c14f6af27
--- /dev/null
+++ b/docs/flow/stages/otp/index.md
@@ -0,0 +1,7 @@
+# OTP Stage
+
+This stage offers a generic Time-based One-time Password authentication step.
+
+You can optionally enforce this step, which will force every user without OTP setup to configure it.
+
+This stage uses a 6-digit Code with a 30 second time-drift. This is currently not changeable.
diff --git a/docs/flow/stages/password/index.md b/docs/flow/stages/password/index.md
new file mode 100644
index 000000000..3c0aeeaed
--- /dev/null
+++ b/docs/flow/stages/password/index.md
@@ -0,0 +1,3 @@
+# Password Stage
+
+This is a generic password prompt which authenticates the current `pending_user`. This stage allows the selection of the source the user is authenticated against.
diff --git a/docs/flow/stages/prompt/index.md b/docs/flow/stages/prompt/index.md
new file mode 100644
index 000000000..61b2f83d0
--- /dev/null
+++ b/docs/flow/stages/prompt/index.md
@@ -0,0 +1,42 @@
+# Prompt Stage
+
+This stage is used to show the user arbitrary prompts.
+
+## Prompt
+
+The prompt can be any of the following types:
+
+| Type     | Description                                                      |
+|----------|------------------------------------------------------------------|
+| text     | Arbitrary text. No client-side validation is done.               |
+| email    | Email input. Requires a valid email adress.                      |
+| password | Password input.                                                  |
+| number   | Number input. Any number is allowed.                             |
+| checkbox | Simple checkbox.                                                 |
+| hidden   | Hidden input field. Allows for the pre-setting of default values.|
+
+A prompt has the following attributes:
+
+### `field_key`
+
+The HTML name used for the prompt. This key is also used to later retrieve the data in expression policies:
+
+```python
+request.context.get('prompt_data').get('<field_key>')
+```
+
+### `label`
+
+The label used to describe the field. Depending on the selected template, this may not be shown.
+
+### `required`
+
+A flag which decides whether or not this field is required.
+
+### `placeholder`
+
+A field placeholder, shown within the input field. This field is also used by the `hidden` type as the actual value.
+
+### `order`
+
+The numerical index of the prompt. This applies to all stages which this prompt is a part of.
diff --git a/docs/flow/stages/prompt/validation.md b/docs/flow/stages/prompt/validation.md
new file mode 100644
index 000000000..22d6b79f7
--- /dev/null
+++ b/docs/flow/stages/prompt/validation.md
@@ -0,0 +1,16 @@
+# Prompt Validation
+
+Further validation of prompts can be done using policies.
+
+To validate that two password fields are identical, create the following expression policy:
+
+```python
+if request.context.get('prompt_data').get('password') == request.context.get('prompt_data').get('password_repeat'):
+    return True
+
+pb_message("Passwords don't match.")
+return False
+```
+This policy expects you to have two password fields with `field_key` set to `password` and `password_repeat`.
+
+Afterwards, bind this policy to the prompt stage you want to validate.
diff --git a/docs/flow/stages/user_delete.md b/docs/flow/stages/user_delete.md
new file mode 100644
index 000000000..040337a81
--- /dev/null
+++ b/docs/flow/stages/user_delete.md
@@ -0,0 +1,8 @@
+# User Delete Stage
+
+!!! danger
+    This stage deletes the `pending_user` without any confirmation. You have to make sure the user is aware of this.
+
+This stage is intended for an unenrollment flow. It deletes the currently pending user.
+
+The pending user is also removed from the current session.
diff --git a/docs/flow/stages/user_login.md b/docs/flow/stages/user_login.md
new file mode 100644
index 000000000..ab3f18d6c
--- /dev/null
+++ b/docs/flow/stages/user_login.md
@@ -0,0 +1,5 @@
+# User Login Stage
+
+This stage attaches a currently pending user to the current session.
+
+It can be used after `user_write` during an enrollment flow, or after a `password` stage during an authentication flow.
diff --git a/docs/flow/stages/user_logout.md b/docs/flow/stages/user_logout.md
new file mode 100644
index 000000000..47c7b3b7b
--- /dev/null
+++ b/docs/flow/stages/user_logout.md
@@ -0,0 +1,3 @@
+# User Logout Stage
+
+Opposite stage of [User Login Stages](user_login.md). It removes the user from the current session.
diff --git a/docs/flow/stages/user_write.md b/docs/flow/stages/user_write.md
new file mode 100644
index 000000000..9fd718ce0
--- /dev/null
+++ b/docs/flow/stages/user_write.md
@@ -0,0 +1,3 @@
+# User Write Stage
+
+This stages writes data from the current context to the current pending user. If no user is pending, a new one is created.
diff --git a/docs/images/brand.svg b/docs/images/brand.svg
new file mode 100644
index 000000000..15c3f9d61
--- /dev/null
+++ b/docs/images/brand.svg
@@ -0,0 +1,2 @@
+<svg version="1.1" id="Layer_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px"
+  width="120px" height="20px" viewBox="15 0 10 10" enable-background="new 0 0 270 10" xml:space="preserve"><defs><style>.cls-1{isolation:isolate;}.cls-2{fill:#fff;}</style></defs><g class="cls-1"><path class="cls-2" d="M1.65,11V2.45H2.87V3a2.81,2.81,0,0,1,.47-.45A1.13,1.13,0,0,1,4,2.38,1.11,1.11,0,0,1,5.1,3a1.55,1.55,0,0,1,.16.5,5.61,5.61,0,0,1,0,.81V6.58c0,.45,0,.77,0,1a1.17,1.17,0,0,1-.55.9,1.23,1.23,0,0,1-.7.16,1.35,1.35,0,0,1-.64-.16A1.53,1.53,0,0,1,2.89,8h0v3ZM4.08,4.43a1.21,1.21,0,0,0-.14-.6.51.51,0,0,0-.46-.22A.54.54,0,0,0,3,3.82a.8.8,0,0,0-.17.54V6.73A.68.68,0,0,0,3,7.2a.6.6,0,0,0,.44.18A.53.53,0,0,0,4,7.17a1,1,0,0,0,.12-.5Z"/><path class="cls-2" d="M8.63,8.54V7.91h0a2.24,2.24,0,0,1-.48.52,1.13,1.13,0,0,1-.69.18A1.39,1.39,0,0,1,7,8.54a1.09,1.09,0,0,1-.43-.24,1.32,1.32,0,0,1-.33-.49A2.33,2.33,0,0,1,6.11,7a4.89,4.89,0,0,1,.08-.91,1.51,1.51,0,0,1,.31-.65,1.44,1.44,0,0,1,.59-.38A3.19,3.19,0,0,1,8,4.93h.59V4.33a1,1,0,0,0-.13-.52A.52.52,0,0,0,8,3.61a.71.71,0,0,0-.44.15.78.78,0,0,0-.26.46H6.13A2,2,0,0,1,6.69,2.9a1.73,1.73,0,0,1,.57-.38A2,2,0,0,1,8,2.38a2.18,2.18,0,0,1,.72.12,1.71,1.71,0,0,1,.59.36,2,2,0,0,1,.38.6,2.18,2.18,0,0,1,.14.84V8.54Zm0-2.62-.34,0a1.2,1.2,0,0,0-.67.18.76.76,0,0,0-.29.68.89.89,0,0,0,.17.56A.55.55,0,0,0,8,7.53a.63.63,0,0,0,.49-.2.91.91,0,0,0,.17-.58Z"/><path class="cls-2" d="M13,4.16a.59.59,0,0,0-.2-.47.65.65,0,0,0-.42-.16.59.59,0,0,0-.45.19.66.66,0,0,0-.15.43.8.8,0,0,0,.08.33.85.85,0,0,0,.44.29l.71.29a1.73,1.73,0,0,1,.95.72,2,2,0,0,1,.26,1,1.85,1.85,0,0,1-.52,1.3,1.56,1.56,0,0,1-.58.39,1.88,1.88,0,0,1-2-.32,1.58,1.58,0,0,1-.4-.57,1.81,1.81,0,0,1-.17-.8h1.15a1.11,1.11,0,0,0,.17.47.56.56,0,0,0,.49.22.71.71,0,0,0,.47-.18A.59.59,0,0,0,13,6.8a.69.69,0,0,0-.13-.43,1.08,1.08,0,0,0-.48-.32l-.59-.21a2.08,2.08,0,0,1-.9-.64,1.66,1.66,0,0,1-.33-1,1.89,1.89,0,0,1,.14-.72,1.78,1.78,0,0,1,.4-.57,1.5,1.5,0,0,1,.56-.36,1.82,1.82,0,0,1,.7-.13,1.93,1.93,0,0,1,.69.13,1.6,1.6,0,0,1,.54.38,1.85,1.85,0,0,1,.36.57,1.82,1.82,0,0,1,.13.7Z"/><path class="cls-2" d="M17.2,4.16a.63.63,0,0,0-.2-.47.69.69,0,0,0-.43-.16.55.55,0,0,0-.44.19.62.62,0,0,0-.16.43.68.68,0,0,0,.09.33.81.81,0,0,0,.43.29l.72.29a1.7,1.7,0,0,1,.94.72,2,2,0,0,1,.26,1,1.85,1.85,0,0,1-.52,1.3,1.61,1.61,0,0,1-.57.39,1.81,1.81,0,0,1-.74.15,1.76,1.76,0,0,1-1.24-.47,1.61,1.61,0,0,1-.41-.57,2,2,0,0,1-.17-.8h1.15a1.12,1.12,0,0,0,.18.47.53.53,0,0,0,.48.22.72.72,0,0,0,.48-.18.59.59,0,0,0,.21-.48.69.69,0,0,0-.14-.43,1,1,0,0,0-.48-.32l-.58-.21a2.06,2.06,0,0,1-.91-.64,1.66,1.66,0,0,1-.33-1A1.89,1.89,0,0,1,15,3.44a1.78,1.78,0,0,1,.4-.57,1.58,1.58,0,0,1,.56-.36,1.82,1.82,0,0,1,.7-.13,1.93,1.93,0,0,1,.69.13,1.75,1.75,0,0,1,.55.38,1.85,1.85,0,0,1,.36.57,2,2,0,0,1,.13.7Z"/><path class="cls-2" d="M19.2,8.54V0h1.22V3h0a1.53,1.53,0,0,1,.48-.47,1.39,1.39,0,0,1,.65-.16,1.26,1.26,0,0,1,.69.16,1.35,1.35,0,0,1,.4.39,1.18,1.18,0,0,1,.15.51,7.72,7.72,0,0,1,0,1V6.73a5.56,5.56,0,0,1-.05.8,1.56,1.56,0,0,1-.15.5,1.12,1.12,0,0,1-1.07.58,1.15,1.15,0,0,1-.7-.18A3.79,3.79,0,0,1,20.42,8v.55Zm2.44-4.21a1,1,0,0,0-.13-.51A.5.5,0,0,0,21,3.61a.57.57,0,0,0-.44.18.66.66,0,0,0-.18.48V6.63a.83.83,0,0,0,.17.54.52.52,0,0,0,.45.21.49.49,0,0,0,.45-.22,1.11,1.11,0,0,0,.15-.6Z"/><path class="cls-2" d="M23.76,4.49a4.83,4.83,0,0,1,0-.68A1.55,1.55,0,0,1,24,3.26a1.59,1.59,0,0,1,.62-.64,1.84,1.84,0,0,1,1-.24,1.87,1.87,0,0,1,1,.24,1.59,1.59,0,0,1,.62.64,1.55,1.55,0,0,1,.18.55,4.83,4.83,0,0,1,.05.68v2a4.72,4.72,0,0,1-.05.68,1.55,1.55,0,0,1-.18.55,1.59,1.59,0,0,1-.62.64,1.87,1.87,0,0,1-1,.24,1.84,1.84,0,0,1-1-.24A1.59,1.59,0,0,1,24,7.73a1.55,1.55,0,0,1-.18-.55,4.72,4.72,0,0,1,0-.68ZM25,6.69a.72.72,0,0,0,.17.52.53.53,0,0,0,.43.17A.55.55,0,0,0,26,7.21a.72.72,0,0,0,.16-.52V4.3A.74.74,0,0,0,26,3.78a.55.55,0,0,0-.44-.17.53.53,0,0,0-.43.17A.74.74,0,0,0,25,4.3Z"/><path class="cls-2" d="M28.2,4.49a4.83,4.83,0,0,1,.05-.68,1.55,1.55,0,0,1,.18-.55,1.59,1.59,0,0,1,.62-.64,1.84,1.84,0,0,1,1-.24,1.87,1.87,0,0,1,1,.24,1.59,1.59,0,0,1,.62.64,1.55,1.55,0,0,1,.18.55,4.83,4.83,0,0,1,.05.68v2a4.72,4.72,0,0,1-.05.68,1.55,1.55,0,0,1-.18.55,1.59,1.59,0,0,1-.62.64,1.87,1.87,0,0,1-1,.24,1.84,1.84,0,0,1-1-.24,1.59,1.59,0,0,1-.62-.64,1.55,1.55,0,0,1-.18-.55,4.72,4.72,0,0,1-.05-.68Zm1.22,2.2a.72.72,0,0,0,.17.52.53.53,0,0,0,.43.17.55.55,0,0,0,.44-.17.72.72,0,0,0,.16-.52V4.3a.74.74,0,0,0-.16-.52A.55.55,0,0,0,30,3.61a.53.53,0,0,0-.43.17.74.74,0,0,0-.17.52Z"/><path class="cls-2" d="M32.75,8.54V0H34V5.11h0l1.47-2.66H36.7L35.24,4.93,37,8.54H35.66l-1.1-2.63L34,6.83V8.54Z"/></g></svg>
diff --git a/docs/images/brand_inverted.svg b/docs/images/brand_inverted.svg
new file mode 100644
index 000000000..86711c6bb
--- /dev/null
+++ b/docs/images/brand_inverted.svg
@@ -0,0 +1,2 @@
+<svg version="1.1" id="Layer_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px"
+  width="120px" height="20px" viewBox="15 0 10 10" enable-background="new 0 0 270 10" xml:space="preserve"><defs><style>.cls-1{isolation:isolate;}.cls-2{fill:#000;}</style></defs><g class="cls-1"><path class="cls-2" d="M1.65,11V2.45H2.87V3a2.81,2.81,0,0,1,.47-.45A1.13,1.13,0,0,1,4,2.38,1.11,1.11,0,0,1,5.1,3a1.55,1.55,0,0,1,.16.5,5.61,5.61,0,0,1,0,.81V6.58c0,.45,0,.77,0,1a1.17,1.17,0,0,1-.55.9,1.23,1.23,0,0,1-.7.16,1.35,1.35,0,0,1-.64-.16A1.53,1.53,0,0,1,2.89,8h0v3ZM4.08,4.43a1.21,1.21,0,0,0-.14-.6.51.51,0,0,0-.46-.22A.54.54,0,0,0,3,3.82a.8.8,0,0,0-.17.54V6.73A.68.68,0,0,0,3,7.2a.6.6,0,0,0,.44.18A.53.53,0,0,0,4,7.17a1,1,0,0,0,.12-.5Z"/><path class="cls-2" d="M8.63,8.54V7.91h0a2.24,2.24,0,0,1-.48.52,1.13,1.13,0,0,1-.69.18A1.39,1.39,0,0,1,7,8.54a1.09,1.09,0,0,1-.43-.24,1.32,1.32,0,0,1-.33-.49A2.33,2.33,0,0,1,6.11,7a4.89,4.89,0,0,1,.08-.91,1.51,1.51,0,0,1,.31-.65,1.44,1.44,0,0,1,.59-.38A3.19,3.19,0,0,1,8,4.93h.59V4.33a1,1,0,0,0-.13-.52A.52.52,0,0,0,8,3.61a.71.71,0,0,0-.44.15.78.78,0,0,0-.26.46H6.13A2,2,0,0,1,6.69,2.9a1.73,1.73,0,0,1,.57-.38A2,2,0,0,1,8,2.38a2.18,2.18,0,0,1,.72.12,1.71,1.71,0,0,1,.59.36,2,2,0,0,1,.38.6,2.18,2.18,0,0,1,.14.84V8.54Zm0-2.62-.34,0a1.2,1.2,0,0,0-.67.18.76.76,0,0,0-.29.68.89.89,0,0,0,.17.56A.55.55,0,0,0,8,7.53a.63.63,0,0,0,.49-.2.91.91,0,0,0,.17-.58Z"/><path class="cls-2" d="M13,4.16a.59.59,0,0,0-.2-.47.65.65,0,0,0-.42-.16.59.59,0,0,0-.45.19.66.66,0,0,0-.15.43.8.8,0,0,0,.08.33.85.85,0,0,0,.44.29l.71.29a1.73,1.73,0,0,1,.95.72,2,2,0,0,1,.26,1,1.85,1.85,0,0,1-.52,1.3,1.56,1.56,0,0,1-.58.39,1.88,1.88,0,0,1-2-.32,1.58,1.58,0,0,1-.4-.57,1.81,1.81,0,0,1-.17-.8h1.15a1.11,1.11,0,0,0,.17.47.56.56,0,0,0,.49.22.71.71,0,0,0,.47-.18A.59.59,0,0,0,13,6.8a.69.69,0,0,0-.13-.43,1.08,1.08,0,0,0-.48-.32l-.59-.21a2.08,2.08,0,0,1-.9-.64,1.66,1.66,0,0,1-.33-1,1.89,1.89,0,0,1,.14-.72,1.78,1.78,0,0,1,.4-.57,1.5,1.5,0,0,1,.56-.36,1.82,1.82,0,0,1,.7-.13,1.93,1.93,0,0,1,.69.13,1.6,1.6,0,0,1,.54.38,1.85,1.85,0,0,1,.36.57,1.82,1.82,0,0,1,.13.7Z"/><path class="cls-2" d="M17.2,4.16a.63.63,0,0,0-.2-.47.69.69,0,0,0-.43-.16.55.55,0,0,0-.44.19.62.62,0,0,0-.16.43.68.68,0,0,0,.09.33.81.81,0,0,0,.43.29l.72.29a1.7,1.7,0,0,1,.94.72,2,2,0,0,1,.26,1,1.85,1.85,0,0,1-.52,1.3,1.61,1.61,0,0,1-.57.39,1.81,1.81,0,0,1-.74.15,1.76,1.76,0,0,1-1.24-.47,1.61,1.61,0,0,1-.41-.57,2,2,0,0,1-.17-.8h1.15a1.12,1.12,0,0,0,.18.47.53.53,0,0,0,.48.22.72.72,0,0,0,.48-.18.59.59,0,0,0,.21-.48.69.69,0,0,0-.14-.43,1,1,0,0,0-.48-.32l-.58-.21a2.06,2.06,0,0,1-.91-.64,1.66,1.66,0,0,1-.33-1A1.89,1.89,0,0,1,15,3.44a1.78,1.78,0,0,1,.4-.57,1.58,1.58,0,0,1,.56-.36,1.82,1.82,0,0,1,.7-.13,1.93,1.93,0,0,1,.69.13,1.75,1.75,0,0,1,.55.38,1.85,1.85,0,0,1,.36.57,2,2,0,0,1,.13.7Z"/><path class="cls-2" d="M19.2,8.54V0h1.22V3h0a1.53,1.53,0,0,1,.48-.47,1.39,1.39,0,0,1,.65-.16,1.26,1.26,0,0,1,.69.16,1.35,1.35,0,0,1,.4.39,1.18,1.18,0,0,1,.15.51,7.72,7.72,0,0,1,0,1V6.73a5.56,5.56,0,0,1-.05.8,1.56,1.56,0,0,1-.15.5,1.12,1.12,0,0,1-1.07.58,1.15,1.15,0,0,1-.7-.18A3.79,3.79,0,0,1,20.42,8v.55Zm2.44-4.21a1,1,0,0,0-.13-.51A.5.5,0,0,0,21,3.61a.57.57,0,0,0-.44.18.66.66,0,0,0-.18.48V6.63a.83.83,0,0,0,.17.54.52.52,0,0,0,.45.21.49.49,0,0,0,.45-.22,1.11,1.11,0,0,0,.15-.6Z"/><path class="cls-2" d="M23.76,4.49a4.83,4.83,0,0,1,0-.68A1.55,1.55,0,0,1,24,3.26a1.59,1.59,0,0,1,.62-.64,1.84,1.84,0,0,1,1-.24,1.87,1.87,0,0,1,1,.24,1.59,1.59,0,0,1,.62.64,1.55,1.55,0,0,1,.18.55,4.83,4.83,0,0,1,.05.68v2a4.72,4.72,0,0,1-.05.68,1.55,1.55,0,0,1-.18.55,1.59,1.59,0,0,1-.62.64,1.87,1.87,0,0,1-1,.24,1.84,1.84,0,0,1-1-.24A1.59,1.59,0,0,1,24,7.73a1.55,1.55,0,0,1-.18-.55,4.72,4.72,0,0,1,0-.68ZM25,6.69a.72.72,0,0,0,.17.52.53.53,0,0,0,.43.17A.55.55,0,0,0,26,7.21a.72.72,0,0,0,.16-.52V4.3A.74.74,0,0,0,26,3.78a.55.55,0,0,0-.44-.17.53.53,0,0,0-.43.17A.74.74,0,0,0,25,4.3Z"/><path class="cls-2" d="M28.2,4.49a4.83,4.83,0,0,1,.05-.68,1.55,1.55,0,0,1,.18-.55,1.59,1.59,0,0,1,.62-.64,1.84,1.84,0,0,1,1-.24,1.87,1.87,0,0,1,1,.24,1.59,1.59,0,0,1,.62.64,1.55,1.55,0,0,1,.18.55,4.83,4.83,0,0,1,.05.68v2a4.72,4.72,0,0,1-.05.68,1.55,1.55,0,0,1-.18.55,1.59,1.59,0,0,1-.62.64,1.87,1.87,0,0,1-1,.24,1.84,1.84,0,0,1-1-.24,1.59,1.59,0,0,1-.62-.64,1.55,1.55,0,0,1-.18-.55,4.72,4.72,0,0,1-.05-.68Zm1.22,2.2a.72.72,0,0,0,.17.52.53.53,0,0,0,.43.17.55.55,0,0,0,.44-.17.72.72,0,0,0,.16-.52V4.3a.74.74,0,0,0-.16-.52A.55.55,0,0,0,30,3.61a.53.53,0,0,0-.43.17.74.74,0,0,0-.17.52Z"/><path class="cls-2" d="M32.75,8.54V0H34V5.11h0l1.47-2.66H36.7L35.24,4.93,37,8.54H35.66l-1.1-2.63L34,6.83V8.54Z"/></g></svg>
diff --git a/.github/screen_admin.png b/docs/images/screen_admin.png
similarity index 100%
rename from .github/screen_admin.png
rename to docs/images/screen_admin.png
diff --git a/.github/screen_apps.png b/docs/images/screen_apps.png
similarity index 100%
rename from .github/screen_apps.png
rename to docs/images/screen_apps.png
diff --git a/docs/index.md b/docs/index.md
index 309acb089..954916e1d 100755
--- a/docs/index.md
+++ b/docs/index.md
@@ -1,31 +1,16 @@
-# Welcome
+#
+![passbook logo](images/logo.svg){: style="height:50px"}
+![passbook brand](images/brand.svg){: style="height:50px"}
 
-Welcome to the passbook Documentation. passbook is an open-source Identity Provider and Usermanagement software. It can be used as a central directory for users or customers and it can integrate with your existing Directory.
+## What is passbook?
 
-passbook can also be used as part of an Application to facilitate User Enrollment, Password recovery and Social Login.
+passbook is an open-source Identity Provider focused on flexibility and versatility. You can use passbook in an existing environment to add support for new protocols. passbook is also a great solution for implementing signup/recovery/etc in your application, so you don't have to deal with it.
 
-passbook uses the following Terminology:
+## Installation
 
-### Policy
+See [Docker-compose](installation/docker-compose.md) or [Kubernetes](installation/kubernetes.md)
 
-A Policy is at a base level a yes/no gate. It will either evaluate to True or False depending on the Policy Kind and settings. For example, a "Group Membership Policy" evaluates to True if the User is member of the specified Group and False if not. This can be used to conditionally apply Factors and grant/deny access.
+## Screenshots
 
-### Provider
-
-A Provider is a way for other Applications to authenticate against passbook. Common Providers are OpenID Connect (OIDC) and SAML.
-
-### Source
-
-Sources are ways to get users into passbook. This might be an LDAP Connection to import Users from Active Directory, or an OAuth2 Connection to allow Social Logins.
-
-### Application
-
-An application links together Policies with a Provider, allowing you to control access. It also holds Information like UI Name, Icon and more.
-
-### Factors
-
-Factors represent Authentication Factors, like a Password or OTP. These Factors can be dynamically enabled using policies. This allows you to, for example, force users from a certain IP ranges to complete a Captcha to authenticate.
-
-### Property Mappings
-
-Property Mappings allow you to make Information available for external Applications. For example, if you want to login to AWS with passbook, you'd use Property Mappings to set the User's Roles based on their Groups.
+![](images/screen_apps.png)
+![](images/screen_admin.png)
diff --git a/docs/installation/docker-compose.md b/docs/installation/docker-compose.md
index 76b4a6a27..53ae3b333 100644
--- a/docs/installation/docker-compose.md
+++ b/docs/installation/docker-compose.md
@@ -1,6 +1,6 @@
 # docker-compose
 
-This installation Method is for test-setups and small-scale productive setups.
+This installation method is for test-setups and small-scale productive setups.
 
 ## Prerequisites
 
@@ -11,16 +11,25 @@ This installation Method is for test-setups and small-scale productive setups.
 
 Download the latest `docker-compose.yml` from [here](https://raw.githubusercontent.com/BeryJu/passbook/master/docker-compose.yml). Place it in a directory of your choice.
 
-passbook needs to know it's primary URL to create links in E-Mails and set cookies, so you have to run the following command:
-
 ```
-export PASSBOOK_DOMAIN=domain.tld # this can be any domain or IP, it just needs to point to passbook.
+wget https://raw.githubusercontent.com/BeryJu/passbook/master/docker-compose.yml
+# Optionally enable Error-reporting
+# export PASSBOOK_ERROR_REPORTING=true
+# Optionally deploy a different version
+# export PASSBOOK_TAG=0.8.15-beta
+# If this is a productive installation, set a different PostgreSQL Password
+# export PG_PASS=$(pwgen 40 1)
+docker-compose pull
+docker-compose up -d
+docker-compose exec server ./manage.py migrate
 ```
 
-The compose file references the current latest version, which can be overridden with the `SERVER_TAG` Environment variable.
+The compose file references the current latest version, which can be overridden with the `SERVER_TAG` environment variable.
 
-If you plan to use this setup for production, it is also advised to change the PostgreSQL Password by setting `PG_PASS` to a password of your choice.
+If you plan to use this setup for production, it is also advised to change the PostgreSQL password by setting `PG_PASS` to a password of your choice.
 
 Now you can pull the Docker images needed by running `docker-compose pull`. After this has finished, run `docker-compose up -d` to start passbook.
 
-passbook will then be reachable on Port 80. You can optionally configure the packaged traefik to use Let's Encrypt for TLS Encryption.
+passbook will then be reachable via HTTP on port 80, and HTTPS on port 443. You can optionally configure the packaged traefik to use Let's Encrypt certificates for TLS Encryption.
+
+The initial setup process also creates a default admin user, the username and password for which is `pbadmin`. It is highly recommended to change this password as soon as you log in.
diff --git a/docs/installation/install.md b/docs/installation/install.md
deleted file mode 100755
index ebd88c387..000000000
--- a/docs/installation/install.md
+++ /dev/null
@@ -1,6 +0,0 @@
-# Installation
-
-There are two supported ways to install passbook:
-
--   [docker-compose](docker-compose.md) for test- or small productive setups
--   [Kubernetes](./kubernetes.md) for larger Productive setups
diff --git a/docs/installation/kubernetes.md b/docs/installation/kubernetes.md
index 1209bea09..35882adab 100644
--- a/docs/installation/kubernetes.md
+++ b/docs/installation/kubernetes.md
@@ -1,6 +1,8 @@
 # Kubernetes
 
-For a mid to high-load Installation, Kubernetes is recommended. passbook is installed using a helm-chart.
+For a mid to high-load installation, Kubernetes is recommended. passbook is installed using a helm-chart.
+
+This installation automatically applies database migrations on startup. After the installation is done, you can use `pbadmin` as username and password.
 
 ```
 # Default values for passbook.
diff --git a/docs/integrations/services/aws/index.md b/docs/integrations/services/aws/index.md
index af87c8d9d..f4835240f 100644
--- a/docs/integrations/services/aws/index.md
+++ b/docs/integrations/services/aws/index.md
@@ -9,19 +9,19 @@
 
 The following placeholders will be used:
 
--   `passbook.company` is the FQDN of the passbook Install
+-   `passbook.company` is the FQDN of the passbook install.
 
-Create an application in passbook and note the slug, as this will be used later. Create a SAML Provider with the following Parameters:
+Create an application in passbook and note the slug, as this will be used later. Create a SAML provider with the following parameters:
 
 -   ACS URL: `https://signin.aws.amazon.com/saml`
 -   Audience: `urn:amazon:webservices`
 -   Issuer: `passbook`
 
-You can of course use a custom Signing Certificate, and adjust durations.
+You can of course use a custom signing certificate, and adjust durations.
 
 ## AWS
 
-Create a Role with the Permissions you desire, and note the ARN.
+Create a role with the permissions you desire, and note the ARN.
 
 AWS requires two custom PropertyMappings; `Role` and `RoleSessionName`. Create them as following:
 
@@ -29,4 +29,4 @@ AWS requires two custom PropertyMappings; `Role` and `RoleSessionName`. Create t
 
 ![](./property-mapping-role-session-name.png)
 
-Afterwards export the Metadata from passbook, and create an Identity Provider [here](https://console.aws.amazon.com/iam/home#/providers).
+Afterwards export the metadata from passbook, and create an Identity Provider [here](https://console.aws.amazon.com/iam/home#/providers).
diff --git a/docs/integrations/services/gitlab/index.md b/docs/integrations/services/gitlab/index.md
index 7b04e5d83..2cd2bf47b 100644
--- a/docs/integrations/services/gitlab/index.md
+++ b/docs/integrations/services/gitlab/index.md
@@ -14,13 +14,13 @@ The following placeholders will be used:
 -   `gitlab.company` is the FQDN of the GitLab Install
 -   `passbook.company` is the FQDN of the passbook Install
 
-Create an application in passbook and note the slug, as this will be used later. Create a SAML Provider with the following Parameters:
+Create an application in passbook and note the slug, as this will be used later. Create a SAML provider with the following parameters:
 
 -   ACS URL: `https://gitlab.company/users/auth/saml/callback`
 -   Audience: `https://gitlab.company`
 -   Issuer: `https://gitlab.company`
 
-You can of course use a custom Signing Certificate, and adjust durations. To get the value for `idp_cert_fingerprint`, you can use a tool like [this](https://www.samltool.com/fingerprint.php).
+You can of course use a custom signing certificate, and adjust durations. To get the value for `idp_cert_fingerprint`, you can use a tool like [this](https://www.samltool.com/fingerprint.php).
 
 ## GitLab Configuration
 
diff --git a/docs/integrations/services/harbor/index.md b/docs/integrations/services/harbor/index.md
index fd1ac0142..4058a3e81 100644
--- a/docs/integrations/services/harbor/index.md
+++ b/docs/integrations/services/harbor/index.md
@@ -11,10 +11,10 @@ From https://goharbor.io
 
 The following placeholders will be used:
 
--   `harbor.company` is the FQDN of the Harbor Install
--   `passbook.company` is the FQDN of the passbook Install
+-   `harbor.company` is the FQDN of the Harbor install.
+-   `passbook.company` is the FQDN of the passbook install.
 
-Create an application in passbook. Create an OpenID Provider with the following Parameters:
+Create an application in passbook. Create an OpenID provider with the following parameters:
 
 -   Client Type: `Confidential`
 -   Response types: `code (Authorization Code Flow)`
diff --git a/docs/integrations/services/rancher/index.md b/docs/integrations/services/rancher/index.md
index ccd4e0152..e2c9d8d51 100644
--- a/docs/integrations/services/rancher/index.md
+++ b/docs/integrations/services/rancher/index.md
@@ -5,23 +5,23 @@
 From https://rancher.com/products/rancher
 
 !!! note ""
-    An Enterprise Platform for Managing Kubernetes Everywhere
+    An enterprise platform for managing Kubernetes Everywhere
     Rancher is a platform built to address the needs of the DevOps teams deploying applications with Kubernetes, and the IT staff responsible for delivering an enterprise-critical service.
 
 ## Preparation
 
 The following placeholders will be used:
 
--   `rancher.company` is the FQDN of the Rancher Install
--   `passbook.company` is the FQDN of the passbook Install
+-   `rancher.company` is the FQDN of the Rancher install.
+-   `passbook.company` is the FQDN of the passbook install.
 
-Create an application in passbook and note the slug, as this will be used later. Create a SAML Provider with the following Parameters:
+Create an application in passbook and note the slug, as this will be used later. Create a SAML provider with the following parameters:
 
 -   ACS URL: `https://rancher.company/v1-saml/adfs/saml/acs`
 -   Audience: `https://rancher.company/v1-saml/adfs/saml/metadata`
 -   Issuer: `passbook`
 
-You can of course use a custom Signing Certificate, and adjust durations.
+You can of course use a custom signing certificate, and adjust durations.
 
 ## Rancher
 
diff --git a/docs/integrations/services/sentry/index.md b/docs/integrations/services/sentry/index.md
index bb2456e36..d88de4fa7 100644
--- a/docs/integrations/services/sentry/index.md
+++ b/docs/integrations/services/sentry/index.md
@@ -15,10 +15,10 @@ From https://sentry.io
 
 The following placeholders will be used:
 
--   `sentry.company` is the FQDN of the Sentry Install
--   `passbook.company` is the FQDN of the passbook Install
+-   `sentry.company` is the FQDN of the Sentry install.
+-   `passbook.company` is the FQDN of the passbook install.
 
-Create an application in passbook. Create an OpenID Provider with the following Parameters:
+Create an application in passbook. Create an OpenID provider with the following parameters:
 
 -   Client Type: `Confidential`
 -   Response types: `code (Authorization Code Flow)`
diff --git a/docs/integrations/services/tower-awx/index.md b/docs/integrations/services/tower-awx/index.md
index 16c210e88..5855b8ab8 100644
--- a/docs/integrations/services/tower-awx/index.md
+++ b/docs/integrations/services/tower-awx/index.md
@@ -10,30 +10,30 @@ From https://docs.ansible.com/ansible/2.5/reference_appendices/tower.html
     Tower allows you to control access to who can access what, even allowing sharing of SSH credentials without someone being able to transfer those credentials. Inventory can be graphically managed or synced with a wide variety of cloud sources. It logs all of your jobs, integrates well with LDAP, and has an amazing browsable REST API. Command line tools are available for easy integration with Jenkins as well. Provisioning callbacks provide great support for autoscaling topologies.
 
 !!! note
-    AWX is the Open-Source version of Tower, and AWX will be used interchangeably throughout this document.
+    AWX is the open-source version of Tower. The term "AWX" will be used interchangeably throughout this document.
 
 ## Preparation
 
 The following placeholders will be used:
 
--   `awx.company` is the FQDN of the AWX/Tower Install
--   `passbook.company` is the FQDN of the passbook Install
+-   `awx.company` is the FQDN of the AWX/Tower install.
+-   `passbook.company` is the FQDN of the passbook install.
 
-Create an application in passbook and note the slug, as this will be used later. Create a SAML Provider with the following Parameters:
+Create an application in passbook and note the slug, as this will be used later. Create a SAML provider with the following parameters:
 
 -   ACS URL: `https://awx.company/sso/complete/saml/`
 -   Audience: `awx`
 -   Issuer: `https://awx.company/sso/metadata/saml/`
 
-You can of course use a custom Signing Certificate, and adjust durations.
+You can of course use a custom signing certificate, and adjust durations.
 
 ## AWX Configuration
 
 Navigate to `https://awx.company/#/settings/auth` to configure SAML. Set the Field `SAML SERVICE PROVIDER ENTITY ID` to `awx`.
 
-For the fields `SAML SERVICE PROVIDER PUBLIC CERTIFICATE` and `SAML SERVICE PROVIDER PRIVATE KEY`, you can either use custom Certificates, or use the self-signed Pair generated by Passbook.
+For the fields `SAML SERVICE PROVIDER PUBLIC CERTIFICATE` and `SAML SERVICE PROVIDER PRIVATE KEY`, you can either use custom certificates, or use the self-signed pair generated by passbook.
 
-Provide Metadata in the `SAML Service Provider Organization Info` Field:
+Provide metadata in the `SAML Service Provider Organization Info` field:
 
 ```json
 {
@@ -45,7 +45,7 @@ Provide Metadata in the `SAML Service Provider Organization Info` Field:
 }
 ```
 
-Provide Metadata in the  `SAML Service Provider Technical Contact` and `SAML Service Provider Technical Contact` Fields:
+Provide metadata in the  `SAML Service Provider Technical Contact` and `SAML Service Provider Technical Contact` fields:
 
 ```json
 {
@@ -71,4 +71,4 @@ In the `SAML Enabled Identity Providers` paste the following configuration:
 }
 ```
 
-`x509cert` is the Certificate configured in passbook. Remove the --BEGIN CERTIFICATE-- and --END CERTIFICATE-- headers, then enter the cert as one non-breaking string.
+`x509cert` is the certificate configured in passbook. Remove the `--BEGIN CERTIFICATE--` and `--END CERTIFICATE--` headers, then enter the cert as one non-breaking string.
diff --git a/docs/k8s/deployment.yml b/docs/k8s/deployment.yml
deleted file mode 100644
index 616245cbb..000000000
--- a/docs/k8s/deployment.yml
+++ /dev/null
@@ -1,33 +0,0 @@
----
-apiVersion: apps/v1beta2
-kind: Deployment
-metadata:
-  name: passbook-docs
-  namespace: prod-passbook-docs
-  labels:
-    app.kubernetes.io/name: passbook-docs
-    app.kubernetes.io/managed-by: passbook-docs
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: passbook-docs
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/name: passbook-docs
-    spec:
-      containers:
-        - name: passbook-docs
-          image: "beryju/passbook-docs:latest"
-          ports:
-            - name: http
-              containerPort: 80
-              protocol: TCP
-          resources:
-            limits:
-              cpu: 10m
-              memory: 20Mi
-            requests:
-              cpu: 10m
-              memory: 20Mi
diff --git a/docs/k8s/ingress.yml b/docs/k8s/ingress.yml
deleted file mode 100644
index 210826cad..000000000
--- a/docs/k8s/ingress.yml
+++ /dev/null
@@ -1,21 +0,0 @@
----
-apiVersion: extensions/v1beta1
-kind: Ingress
-metadata:
-  labels:
-    app.kubernetes.io/name: passbook-docs
-  name: passbook-docs
-  namespace: prod-passbook-docs
-spec:
-  rules:
-    - host: docs.passbook.beryju.org
-      http:
-        paths:
-          - backend:
-              serviceName: passbook-docs-http
-              servicePort: http
-            path: /
-  tls:
-    - hosts:
-        - docs.passbook.beryju.org
-      secretName: passbook-docs-acme
diff --git a/docs/k8s/service.yml b/docs/k8s/service.yml
deleted file mode 100644
index 0e83a1a8a..000000000
--- a/docs/k8s/service.yml
+++ /dev/null
@@ -1,17 +0,0 @@
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: passbook-docs-http
-  namespace: prod-passbook-docs
-  labels:
-    app.kubernetes.io/name: passbook-docs
-spec:
-  type: ClusterIP
-  ports:
-    - port: 80
-      targetPort: http
-      protocol: TCP
-      name: http
-  selector:
-    app.kubernetes.io/name: passbook-docs
diff --git a/docs/policies/expression.md b/docs/policies/expression.md
new file mode 100644
index 000000000..c057c9e41
--- /dev/null
+++ b/docs/policies/expression.md
@@ -0,0 +1,30 @@
+# Expression Policies
+
+!!! notice
+    These variables are available in addition to the common variables/functions defined in [**Expressions**](../expressions/index.md)
+
+The passing of the policy is determined by the return value of the code. Use `return True` to pass a policy and `return False` to fail it.
+
+### Available Functions
+
+#### `pb_message(message: str)`
+
+Add a message, visible by the end user. This can be used to show the reason why they were denied.
+
+Example:
+
+```python
+pb_message("Access denied")
+return False
+```
+
+### Context variables
+
+- `request`: A PolicyRequest object, which has the following properties:
+    - `request.user`: The current user, against which the policy is applied. ([ref](../expressions/reference/user-object.md))
+    - `request.http_request`: The Django HTTP Request. ([ref](https://docs.djangoproject.com/en/3.0/ref/request-response/#httprequest-objects))
+    - `request.obj`: A Django Model instance. This is only set if the policy is ran against an object.
+    - `request.context`: A dictionary with dynamic data. This depends on the origin of the execution.
+- `pb_is_sso_flow`: Boolean which is true if request was initiated by authenticating through an external provider.
+- `pb_client_ip`: Client's IP Address or '255.255.255.255' if no IP Address could be extracted.
+- `pb_flow_plan`: Current Plan if Policy is called from the Flow Planner.
diff --git a/docs/policies/expression/index.md b/docs/policies/expression/index.md
deleted file mode 100644
index 2bf6b2fb0..000000000
--- a/docs/policies/expression/index.md
+++ /dev/null
@@ -1,22 +0,0 @@
-# Expression Policy
-
-Expression Policies allows you to write custom Policy Logic using Jinja2 Templating language.
-
-For a language reference, see [here](https://jinja.palletsprojects.com/en/2.11.x/templates/).
-
-The following objects are passed into the variable:
-
-- `request`: A PolicyRequest object, which has the following properties:
-    - `request.user`: The current User, which the Policy is applied against. ([ref](../../property-mappings/reference/user-object.md))
-    - `request.http_request`: The Django HTTP Request, as documented [here](https://docs.djangoproject.com/en/3.0/ref/request-response/#httprequest-objects).
-    - `request.obj`: A Django Model instance. This is only set if the Policy is ran against an object.
-- `pb_flow_plan`: Current Plan if Policy is called while a flow is active.
-- `pb_is_sso_flow`: Boolean which is true if request was initiated by authenticating through an external Provider.
-- `pb_is_group_member(user, group_name)`: Function which checks if `user` is member of a Group with Name `gorup_name`.
-- `pb_logger`: Standard Python Logger Object, which can be used to debug expressions.
-- `pb_client_ip`: Client's IP Address.
-
-There are also the following custom filters available:
-
-- `regex_match(regex)`: Return True if value matches `regex`
-- `regex_replace(regex, repl)`: Replace string matched by `regex` with `repl`
diff --git a/docs/policies/index.md b/docs/policies/index.md
index b413a7794..ad612c3e5 100644
--- a/docs/policies/index.md
+++ b/docs/policies/index.md
@@ -2,29 +2,21 @@
 
 ## Kinds
 
-There are two different Kind of policies, a Standard Policy and a Password Policy. Normal Policies just evaluate to True or False, and can be used everywhere. Password Policies apply when a Password is set (during User enrollment, Recovery or anywhere else). These policies can be used to apply Password Rules like length, etc. The can also be used to expire passwords after a certain amount of time.
+There are two different kinds of policies; Standard Policy and Password Policy. Normal policies evaluate to True or False, and can be used everywhere. Password policies apply when a password is set (during user enrollment, recovery or anywhere else). These policies can be used to apply password rules such as length, complexity, etc. They can also be used to expire passwords after a certain amount of time.
 
 ## Standard Policies
 
 ---
 
-### Group-Membership Policy
-
-This policy evaluates to True if the current user is a Member of the selected group.
-
 ### Reputation Policy
 
-passbook keeps track of failed login attempts by Source IP and Attempted Username. These values are saved as scores. Each failed login decreases the Score for the Client IP as well as the targeted Username by one.
+passbook keeps track of failed login attempts by source IP and attempted username. These values are saved as scores. Each failed login decreases the score for the client IP as well as the targeted username by 1 (one).
 
-This policy can be used to for example prompt Clients with a low score to pass a Captcha before they can continue.
+This policy can be used, for example, to prompt clients with a low score to pass a captcha before they can continue.
 
 ## Expression Policy
 
-See [Expression Policy](expression/index.md).
-
-### Webhook Policy
-
-This policy allows you to send an arbitrary HTTP Request to any URL. You can then use JSONPath to extract the result you need.
+See [Expression Policy](expression.md).
 
 ## Password Policies
 
@@ -32,19 +24,19 @@ This policy allows you to send an arbitrary HTTP Request to any URL. You can the
 
 ### Password Policy
 
-This Policy allows you to specify Password rules, like Length and required Characters.
+This policy allows you to specify password rules, such as length and required characters.
 The following rules can be set:
 
--   Minimum amount of Uppercase Characters
--   Minimum amount of Lowercase Characters
--   Minimum amount of Symbols Characters
--   Minimum Length
--   Symbol charset (define which characters are counted as symbols)
+- Minimum amount of uppercase characters.
+- Minimum amount of lowercase characters.
+- Minimum amount of symbols characters.
+- Minimum length.
+- Symbol charset (define which characters are counted as symbols).
 
 ### Have I Been Pwned Policy
 
-This Policy checks the hashed Password against the [Have I Been Pwned](https://haveibeenpwned.com/) API. This only sends the first 5 characters of the hashed password. The remaining comparison is done within passbook.
+This policy checks the hashed password against the [Have I Been Pwned](https://haveibeenpwned.com/) API. This only sends the first 5 characters of the hashed password. The remaining comparison is done within passbook.
 
 ### Password-Expiry Policy
 
-This policy can enforce regular password rotation by expiring set Passwords after a finite amount of time. This forces users to set a new password.
+This policy can enforce regular password rotation by expiring set passwords after a finite amount of time. This forces users to set a new password.
diff --git a/docs/property-mappings/expression.md b/docs/property-mappings/expression.md
new file mode 100644
index 000000000..067386b52
--- /dev/null
+++ b/docs/property-mappings/expression.md
@@ -0,0 +1,12 @@
+# Property Mapping Expressions
+
+The property mapping should return a value that is expected by the Provider/Source. Supported types are documented in the individual Provider/Source. Returning `None` is always accepted and would simply skip the mapping for which `None` was returned.
+
+!!! notice
+    These variables are available in addition to the common variables/functions defined in [**Expressions**](../expressions/index.md)
+
+### Context Variables
+
+- `user`: The current user. This may be `None` if there is no contextual user. ([ref](../expressions/reference/user-object.md))
+- `request`: The current request. This may be `None` if there is no contextual request. ([ref](https://docs.djangoproject.com/en/3.0/ref/request-response/#httprequest-objects))
+- Other arbitrary arguments given by the provider, this is documented on the Provider/Source.
diff --git a/docs/property-mappings/index.md b/docs/property-mappings/index.md
index 0eebcb0d7..7b7edd0d4 100644
--- a/docs/property-mappings/index.md
+++ b/docs/property-mappings/index.md
@@ -1,21 +1,21 @@
 # Property Mappings
 
-Property Mappings allow you to pass information to external Applications. For example, pass the current user's Groups as a SAML Parameter. Property Mappings are also used to map Source fields to passbook fields, for example when using LDAP.
+Property Mappings allow you to pass information to external applications. For example, pass the current user's groups as a SAML parameter. Property Mappings are also used to map Source fields to passbook fields, for example when using LDAP.
 
 ## SAML Property Mapping
 
-SAML Property Mappings allow you embed Information into the SAML AuthN Request. THis Information can then be used by the Application to assign permissions for example.
+SAML Property Mappings allow you embed information into the SAML AuthN request. This information can then be used by the application to, for example, assign permissions to the object.
 
-You can find examples [here](integrations/)
+You can find examples [here](integrations/).
 
 ## LDAP Property Mapping
 
-LDAP Property Mappings are used when you define a LDAP Source. These Mappings define which LDAP Property maps to which passbook Property. By default, these mappings are created:
+LDAP Property Mappings are used when you define a LDAP Source. These mappings define which LDAP property maps to which passbook property. By default, the following mappings are created:
 
--   Autogenerated LDAP Mapping: givenName -> first_name
--   Autogenerated LDAP Mapping: mail -> email
--   Autogenerated LDAP Mapping: name -> name
--   Autogenerated LDAP Mapping: sAMAccountName -> username
--   Autogenerated LDAP Mapping: sn -> last_name
+- Autogenerated LDAP Mapping: givenName -> first_name
+- Autogenerated LDAP Mapping: mail -> email
+- Autogenerated LDAP Mapping: name -> name
+- Autogenerated LDAP Mapping: sAMAccountName -> username
+- Autogenerated LDAP Mapping: sn -> last_name
 
-These are configured for the most common LDAP Setups.
+These are configured with most common LDAP setups.
diff --git a/docs/property-mappings/reference/user-object.md b/docs/property-mappings/reference/user-object.md
deleted file mode 100644
index 8cc35c162..000000000
--- a/docs/property-mappings/reference/user-object.md
+++ /dev/null
@@ -1,20 +0,0 @@
-# Passbook User Object
-
-The User object has the following attributes:
-
- - `username`: User's Username
- - `email` User's E-Mail
- - `name` User's Display Name
- - `is_staff` Boolean field if user is staff
- - `is_active` Boolean field if user is active
- - `date_joined` Date User joined/was created
- - `password_change_date` Date Password was last changed
- - `attributes` Dynamic Attributes
-
-## Examples
-
-List all the User's Group Names
-
-```jinja2
-[{% for group in user.groups.all() %}'{{ group.name }}',{% endfor %}]
-```
diff --git a/docs/providers.md b/docs/providers.md
index e7504e532..b48312612 100644
--- a/docs/providers.md
+++ b/docs/providers.md
@@ -1,17 +1,24 @@
 # Providers
 
-Providers allow external Applications to authenticate against passbook and use its User Information.
+Providers allow external applications to authenticate against passbook and use its user information.
 
 ## OpenID Provider
 
-This provider uses the commonly used OpenID Connect variation of OAuth2.
+This provider utilises the commonly used OpenID Connect variation of OAuth2.
 
 ## OAuth2 Provider
 
-This provider is slightly different than the OpenID Provider. While it uses the same basic OAuth2 Protocol, it provides a GitHub-compatible Endpoint. This allows you to integrate Applications, which don't support Custom OpenID Providers.
-The API exposes Username, E-Mail, Name and Groups in a GitHub-compatible format.
+This provider is slightly different than the OpenID Provider. While it uses the same basic OAuth2 Protocol, it provides a GitHub-compatible endpoint. This allows you to integrate applications which don't support custom OpenID providers.
+The API exposes username, email, name, and groups in a GitHub-compatible format.
+This provider currently supports the following scopes:
+
+- `openid`: Access OpenID Userinfo
+- `userinfo`: Access OpenID Userinfo
+- `email`: Access OpenID Email
+- `user:email`: GitHub Compatibility: User Email
+- `read:org`: GitHub Compatibility: User Groups
 
 ## SAML Provider
 
-This provider allows you to integrate Enterprise Software using the SAML2 Protocol. It supports signed Requests. This Provider uses [Property Mappings](property-mappings/index.md#saml-property-mapping) to determine which fields are exposed and what values they return. This makes it possible to expose Vendor-specific Fields.
-Default fields are exposed through Auto-generated Property Mappings, which are prefixed with "Autogenerated..."
+This provider allows you to integrate enterprise software using the SAML2 Protocol. It supports signed requests and uses [Property Mappings](property-mappings/index.md#saml-property-mapping) to determine which fields are exposed and what values they return. This makes it possible to expose vendor-specific fields.
+Default fields are exposed through auto-generated Property Mappings, which are prefixed with "Autogenerated".
diff --git a/docs/requirements.txt b/docs/requirements.txt
new file mode 100644
index 000000000..9a8a4ca47
--- /dev/null
+++ b/docs/requirements.txt
@@ -0,0 +1,2 @@
+mkdocs
+mkdocs-material
diff --git a/docs/runtime.txt b/docs/runtime.txt
new file mode 100644
index 000000000..548d71365
--- /dev/null
+++ b/docs/runtime.txt
@@ -0,0 +1 @@
+3.7
\ No newline at end of file
diff --git a/docs/sources.md b/docs/sources.md
index 28c6e6bfd..d1ffab326 100644
--- a/docs/sources.md
+++ b/docs/sources.md
@@ -1,39 +1,39 @@
 # Sources
 
-Sources allow you to connect passbook to an existing User directory. They can also be used for Social-Login, using external Providers like Facebook, Twitter, etc.
+Sources allow you to connect passbook to an existing user directory. They can also be used for social logins, using external providers such as Facebook, Twitter, etc.
 
 ## Generic OAuth Source
 
 **All Integration-specific Sources are documented in the Integrations Section**
 
-This source allows users to enroll themselves with an External OAuth-based Identity Provider. The Generic Provider expects the Endpoint to return OpenID-Connect compatible Information. Vendor specific Implementations have their own OAuth Source.
+This source allows users to enroll themselves with an external OAuth-based Identity Provider. The generic provider expects the endpoint to return OpenID-Connect compatible information. Vendor-specific implementations have their own OAuth Source.
 
--   Policies: Allow/Forbid Users from linking their Accounts with this Provider
--   Request Token URL: This field is used for OAuth v1 Implementations and will be provided by the Provider.
--   Authorization URL: This value will be provided by the Provider.
--   Access Token URL: This value will be provided by the Provider.
--   Profile URL: This URL is called by passbook to retrieve User information upon successful authentication.
--   Consumer key/Consumer secret: These values will be provided by the Provider.
+-   Policies: Allow/Forbid users from linking their accounts with this provider.
+-   Request Token URL: This field is used for OAuth v1 implementations and will be provided by the provider.
+-   Authorization URL: This value will be provided by the provider.
+-   Access Token URL: This value will be provided by the provider.
+-   Profile URL: This URL is called by passbook to retrieve user information upon successful authentication.
+-   Consumer key/Consumer secret: These values will be provided by the provider.
 
 ## SAML Source
 
-This source allows passbook to act as a SAML Service Provider. Just like the SAML Provider, it supports signed Requests. Vendor specific documentation can be found in the Integrations Section
+This source allows passbook to act as a SAML Service Provider. Just like the SAML Provider, it supports signed requests. Vendor-specific documentation can be found in the Integrations Section.
 
 ## LDAP Source
 
-This source allows you to import Users and Groups from an LDAP Server
+This source allows you to import users and groups from an LDAP Server.
 
--   Server URI: URI to your LDAP Server/Domain Controller
--   Bind CN: CN to bind as, this can also be a UPN in the format of `user@domain.tld`
--   Bind password: Password used during the bind process
--   Enable Start TLS: Enables StartTLS functionality. To use SSL instead, use port `636`
--   Base DN: Base DN used for all LDAP queries
--   Addition User DN: Prepended to Base DN for User-queries.
--   Addition Group DN: Prepended to Base DN for Group-queries.
--   User object filter: Consider Objects matching this filter to be Users.
--   Group object filter: Consider Objects matching this filter to be Groups.
--   User group membership field: Field which contains Groups of user.
--   Object uniqueness field: Field which contains a unique Identifier.
--   Sync groups: Enable/disable Group synchronization. Groups are synced in the background every 5 minutes.
--   Sync parent group: Optionally set this Group as parent Group for all synced Groups (allows you to, for example, import AD Groups under a root `imported-from-ad` group.)
--   Property mappings: Define which LDAP Properties map to which passbook Properties. The default set of Property Mappings is generated for Active Directory. See also [LDAP Property Mappings](property-mappings/index.md#ldap-property-mapping)
+-   Server URI: URI to your LDAP server/Domain Controller.
+-   Bind CN: CN of the bind user. This can also be a UPN in the format of `user@domain.tld`.
+-   Bind password: Password used during the bind process.
+-   Enable StartTLS: Enables StartTLS functionality. To use LDAPS instead, use port `636`.
+-   Base DN: Base DN used for all LDAP queries.
+-   Addition User DN: Prepended to the base DN for user queries.
+-   Addition Group DN: Prepended to the base DN for group queries.
+-   User object filter: Consider objects matching this filter to be users.
+-   Group object filter: Consider objects matching this filter to be groups.
+-   User group membership field: This field contains the user's group memberships.
+-   Object uniqueness field: This field contains a unique identifier.
+-   Sync groups: Enable/disable group synchronization. Groups are synced in the background every 5 minutes.
+-   Sync parent group: Optionally set this group as the parent group for all synced groups. An example use case of this would be to import Active Directory groups under a root `imported-from-ad` group.
+-   Property mappings: Define which LDAP properties map to which passbook properties. The default set of property mappings is generated for Active Directory. See also [LDAP Property Mappings](property-mappings/index.md#ldap-property-mapping)
diff --git a/docs/terminology.md b/docs/terminology.md
new file mode 100644
index 000000000..db3e72947
--- /dev/null
+++ b/docs/terminology.md
@@ -0,0 +1,27 @@
+### Policy
+
+At a base level a policy is a yes/no gate. It will either evaluate to True or False depending on the Policy Kind and settings. For example, a "Group Membership Policy" evaluates to True if the user is member of the specified Group and False if not. This can be used to conditionally apply Stages, grant/deny access to various objects, and for other custom logic.
+
+### Provider
+
+A Provider is a way for other applications to authenticate against passbook. Common Providers are OpenID Connect (OIDC) and SAML.
+
+### Source
+
+Sources are locations from which users can be added to passbook. For example, an LDAP Connection to import Users from Active Directory, or an OAuth2 Connection to allow Social Logins.
+
+### Application
+
+An application links together Policies with a Provider, allowing you to control access. It also holds Information like UI Name, Icon and more.
+
+### Stages
+
+A stage represents a single verification or logic step. They are used to authenticate users, enroll users, and more. These stages can optionally be applied to a flow via policies.
+
+### Flows
+
+Flows are an ordered sequence of stages. These flows can be used to define how a user authenticates, enrolls, etc.
+
+### Property Mappings
+
+Property Mappings allow you to make information available for external applications. For example, if you want to login to AWS with passbook, you'd use Property Mappings to set the user's roles in AWS based on their group memberships in passbook.
diff --git a/docs/upgrading-from-0.8.x.md b/docs/upgrading-from-0.8.x.md
index 2e9e39d22..d0728f8db 100644
--- a/docs/upgrading-from-0.8.x.md
+++ b/docs/upgrading-from-0.8.x.md
@@ -4,13 +4,13 @@ Due to some database changes that had to be rather sooner than later, there is n
 
 To export data from your old instance, run this command:
 
-(with docker-compose)
+- docker-compose
 ```
 docker-compose exec server ./manage.py dumpdata -o /tmp/passbook_dump.json passbook_core.User passbook_core.Group passbook_crypto.CertificateKeyPair passbook_audit.Event
 docker cp passbook_server_1:/tmp/passbook_dump.json passbook_dump.json
 ```
 
-(with kubernetes)
+- kubernetes
 ```
 kubectl exec -it passbook-web-... -- ./manage.py dumpdata -o /tmp/passbook_dump.json passbook_core.User passbook_core.Group passbook_crypto.CertificateKeyPair passbook_audit.Event
 kubectl cp passbook-web-...:/tmp/passbook_dump.json passbook_dump.json
@@ -18,13 +18,13 @@ kubectl cp passbook-web-...:/tmp/passbook_dump.json passbook_dump.json
 
 After that, create a new passbook instance in a different namespace (kubernetes) or in a different folder (docker-compose). Once this instance is running, you can use the following commands to restore the data. On docker-compose, you still have to run the `migrate` command, to create all database structures.
 
-(docker-compose)
+- docker-compose
 ```
 docker cp passbook_dump.json new_passbook_server_1:/tmp/passbook_dump.json
 docker-compose exec server ./manage.py loaddata /tmp/passbook_dump.json
 ```
 
-(with kubernetes)
+- kubernetes
 ```
 kubectl cp passbook_dump.json passbook-web-...:/tmp/passbook_dump.json
 kubectl exec -it passbook-web-... -- ./manage.py loaddata /tmp/passbook_dump.json
diff --git a/passbook/policies/expression/tests/__init__.py b/e2e/__init__.py
similarity index 100%
rename from passbook/policies/expression/tests/__init__.py
rename to e2e/__init__.py
diff --git a/e2e/docker-compose.yml b/e2e/docker-compose.yml
new file mode 100644
index 000000000..1786d5c5e
--- /dev/null
+++ b/e2e/docker-compose.yml
@@ -0,0 +1,20 @@
+version: '3.7'
+
+services:
+  chrome:
+    image: selenium/standalone-chrome-debug:3.141.59-20200525
+    volumes:
+      - /dev/shm:/dev/shm
+    network_mode: host
+
+  postgresql:
+    image: postgres:11
+    restart: always
+    environment:
+      POSTGRES_HOST_AUTH_METHOD: trust
+      POSTGRES_DB: passbook
+    network_mode: host
+  redis:
+    image: redis
+    restart: always
+    network_mode: host
diff --git a/e2e/passbook.side b/e2e/passbook.side
new file mode 100644
index 000000000..631e930f8
--- /dev/null
+++ b/e2e/passbook.side
@@ -0,0 +1,498 @@
+{
+  "id": "7d9b2407-1520-4c04-b040-68e8ada9aecc",
+  "version": "2.0",
+  "name": "passbook",
+  "url": "http://localhost:8000",
+  "tests": [{
+    "id": "94b39863-74ec-4b7d-98c5-2b380b6d2c55",
+    "name": "passbook login simple",
+    "commands": [{
+      "id": "e60e4382-4f96-44c3-ba06-5e18609c9c2b",
+      "comment": "",
+      "command": "open",
+      "target": "/flows/default-authentication-flow/?next=%2F",
+      "targets": [],
+      "value": ""
+    }, {
+      "id": "b2652f24-931e-45b0-b01d-2f0ac0f74db8",
+      "comment": "",
+      "command": "click",
+      "target": "id=id_uid_field",
+      "targets": [
+        ["id=id_uid_field", "id"],
+        ["name=uid_field", "name"],
+        ["css=#id_uid_field", "css:finder"],
+        ["xpath=//input[@id='id_uid_field']", "xpath:attributes"],
+        ["xpath=//main[@id='flow-body']/div/form/div/input", "xpath:idRelative"],
+        ["xpath=//div/input", "xpath:position"]
+      ],
+      "value": ""
+    }, {
+      "id": "f1930f8a-984a-4076-a925-20937bb2f8d3",
+      "comment": "",
+      "command": "type",
+      "target": "id=id_uid_field",
+      "targets": [
+        ["id=id_uid_field", "id"],
+        ["name=uid_field", "name"],
+        ["css=#id_uid_field", "css:finder"],
+        ["xpath=//input[@id='id_uid_field']", "xpath:attributes"],
+        ["xpath=//main[@id='flow-body']/div/form/div/input", "xpath:idRelative"],
+        ["xpath=//div/input", "xpath:position"]
+      ],
+      "value": "admin@example.tld"
+    }, {
+      "id": "0b568ee3-1bed-4821-a3bc-f6b960dbed9d",
+      "comment": "",
+      "command": "sendKeys",
+      "target": "id=id_uid_field",
+      "targets": [
+        ["id=id_uid_field", "id"],
+        ["name=uid_field", "name"],
+        ["css=#id_uid_field", "css:finder"],
+        ["xpath=//input[@id='id_uid_field']", "xpath:attributes"],
+        ["xpath=//main[@id='flow-body']/div/form/div/input", "xpath:idRelative"],
+        ["xpath=//div/input", "xpath:position"]
+      ],
+      "value": "${KEY_ENTER}"
+    }, {
+      "id": "6d98e479-2825-484d-996a-ccf350d2761f",
+      "comment": "",
+      "command": "type",
+      "target": "id=id_password",
+      "targets": [
+        ["id=id_password", "id"],
+        ["name=password", "name"],
+        ["css=#id_password", "css:finder"],
+        ["xpath=//input[@id='id_password']", "xpath:attributes"],
+        ["xpath=//main[@id='flow-body']/div/form/div[2]/input", "xpath:idRelative"],
+        ["xpath=//div[2]/input", "xpath:position"]
+      ],
+      "value": "pbadmin"
+    }, {
+      "id": "6f7abec6-ff44-4eb5-ae23-520c1c29a706",
+      "comment": "",
+      "command": "sendKeys",
+      "target": "id=id_password",
+      "targets": [
+        ["id=id_password", "id"],
+        ["name=password", "name"],
+        ["css=#id_password", "css:finder"],
+        ["xpath=//input[@id='id_password']", "xpath:attributes"],
+        ["xpath=//main[@id='flow-body']/div/form/div[2]/input", "xpath:idRelative"],
+        ["xpath=//div[2]/input", "xpath:position"]
+      ],
+      "value": "${KEY_ENTER}"
+    }, {
+      "id": "04c5876f-1405-4077-a98b-e911f09113d7",
+      "comment": "",
+      "command": "assertText",
+      "target": "xpath=//a[contains(@href, '/-/user/')]",
+      "targets": [
+        ["linkText=pbadmin", "linkText"],
+        ["css=.pf-c-page__header-tools-group:nth-child(2) > .pf-c-button", "css:finder"],
+        ["xpath=//a[contains(text(),'pbadmin')]", "xpath:link"],
+        ["xpath=//div[@id='page-default-nav-example']/header/div[3]/div[2]/a", "xpath:idRelative"],
+        ["xpath=//a[contains(@href, '/-/user/')]", "xpath:href"],
+        ["xpath=//div[2]/a", "xpath:position"],
+        ["xpath=//a[contains(.,'pbadmin')]", "xpath:innerText"]
+      ],
+      "value": "pbadmin"
+    }]
+  }, {
+    "id": "61948b3c-3012-4f97-aa52-bc8f34fec333",
+    "name": "passbook enroll simple",
+    "commands": [{
+      "id": "0f4884b3-4891-41bc-956d-1fa433e892e9",
+      "comment": "",
+      "command": "open",
+      "target": "/flows/default-authentication-flow/?next=%2F",
+      "targets": [],
+      "value": ""
+    }, {
+      "id": "84d3861f-a60c-4650-8689-535f82b39577",
+      "comment": "",
+      "command": "click",
+      "target": "linkText=Sign up.",
+      "targets": [
+        ["linkText=Sign up.", "linkText"],
+        ["css=.pf-c-login__main-footer-band-item > a", "css:finder"],
+        ["xpath=//a[contains(text(),'Sign up.')]", "xpath:link"],
+        ["xpath=//main[@id='flow-body']/footer/div/p/a", "xpath:idRelative"],
+        ["xpath=//a[contains(@href, '/flows/default-enrollment-flow/')]", "xpath:href"],
+        ["xpath=//a", "xpath:position"],
+        ["xpath=//a[contains(.,'Sign up.')]", "xpath:innerText"]
+      ],
+      "value": ""
+    }, {
+      "id": "a32435ca-d84a-41e7-a915-fcbbc5f88341",
+      "comment": "",
+      "command": "type",
+      "target": "id=id_username",
+      "targets": [
+        ["id=id_username", "id"],
+        ["name=username", "name"],
+        ["css=#id_username", "css:finder"],
+        ["xpath=//input[@id='id_username']", "xpath:attributes"],
+        ["xpath=//main[@id='flow-body']/div/form/div/input", "xpath:idRelative"],
+        ["xpath=//div/input", "xpath:position"]
+      ],
+      "value": "foo"
+    }, {
+      "id": "3b5dcf53-8297-46c5-88b7-11c2eb25f34f",
+      "comment": "",
+      "command": "type",
+      "target": "id=id_password",
+      "targets": [
+        ["id=id_password", "id"],
+        ["name=password", "name"],
+        ["css=#id_password", "css:finder"],
+        ["xpath=//input[@id='id_password']", "xpath:attributes"],
+        ["xpath=//main[@id='flow-body']/div/form/div[2]/input", "xpath:idRelative"],
+        ["xpath=//div[2]/input", "xpath:position"]
+      ],
+      "value": "pbadmin"
+    }, {
+      "id": "e948d61c-dae6-4994-b56f-ff130892b342",
+      "comment": "",
+      "command": "type",
+      "target": "id=id_password_repeat",
+      "targets": [
+        ["id=id_password_repeat", "id"],
+        ["name=password_repeat", "name"],
+        ["css=#id_password_repeat", "css:finder"],
+        ["xpath=//input[@id='id_password_repeat']", "xpath:attributes"],
+        ["xpath=//main[@id='flow-body']/div/form/div[3]/input", "xpath:idRelative"],
+        ["xpath=//div[3]/input", "xpath:position"]
+      ],
+      "value": "pbadmin"
+    }, {
+      "id": "e7527bfc-ec74-4d96-86f0-5a3a55a59025",
+      "comment": "",
+      "command": "click",
+      "target": "css=.pf-c-button",
+      "targets": [
+        ["css=.pf-c-button", "css:finder"],
+        ["xpath=//button[@type='submit']", "xpath:attributes"],
+        ["xpath=//main[@id='flow-body']/div/form/div[4]/button", "xpath:idRelative"],
+        ["xpath=//button", "xpath:position"],
+        ["xpath=//button[contains(.,'Continue')]", "xpath:innerText"]
+      ],
+      "value": ""
+    }, {
+      "id": "434b842c-a659-4ff5-aca8-06a6a3489597",
+      "comment": "",
+      "command": "type",
+      "target": "id=id_name",
+      "targets": [
+        ["id=id_name", "id"],
+        ["name=name", "name"],
+        ["css=#id_name", "css:finder"],
+        ["xpath=//input[@id='id_name']", "xpath:attributes"],
+        ["xpath=//main[@id='flow-body']/div/form/div/input", "xpath:idRelative"],
+        ["xpath=//div/input", "xpath:position"]
+      ],
+      "value": "some name"
+    }, {
+      "id": "cbc43a1b-2cfe-46e2-85bc-476fb32c6cb1",
+      "comment": "",
+      "command": "type",
+      "target": "id=id_email",
+      "targets": [
+        ["id=id_email", "id"],
+        ["name=email", "name"],
+        ["css=#id_email", "css:finder"],
+        ["xpath=//input[@id='id_email']", "xpath:attributes"],
+        ["xpath=//main[@id='flow-body']/div/form/div[2]/input", "xpath:idRelative"],
+        ["xpath=//div[2]/input", "xpath:position"]
+      ],
+      "value": "foo@bar.baz"
+    }, {
+      "id": "e74389a0-228b-4312-9677-e9add6358de3",
+      "comment": "",
+      "command": "click",
+      "target": "css=.pf-c-button",
+      "targets": [
+        ["css=.pf-c-button", "css:finder"],
+        ["xpath=//button[@type='submit']", "xpath:attributes"],
+        ["xpath=//main[@id='flow-body']/div/form/div[3]/button", "xpath:idRelative"],
+        ["xpath=//button", "xpath:position"],
+        ["xpath=//button[contains(.,'Continue')]", "xpath:innerText"]
+      ],
+      "value": ""
+    }, {
+      "id": "3e22f9c2-5ebd-49c2-81b1-340fa0435bbc",
+      "comment": "",
+      "command": "click",
+      "target": "linkText=foo",
+      "targets": [
+        ["linkText=foo", "linkText"],
+        ["css=.pf-c-page__header-tools-group:nth-child(2) > .pf-c-button", "css:finder"],
+        ["xpath=//a[contains(text(),'foo')]", "xpath:link"],
+        ["xpath=//div[@id='page-default-nav-example']/header/div[3]/div[2]/a", "xpath:idRelative"],
+        ["xpath=//a[contains(@href, '/-/user/')]", "xpath:href"],
+        ["xpath=//div[2]/a", "xpath:position"],
+        ["xpath=//a[contains(.,'foo')]", "xpath:innerText"]
+      ],
+      "value": ""
+    }, {
+      "id": "60124cfd-f11c-4d7f-8b01-bef54c8cbd73",
+      "comment": "",
+      "command": "assertText",
+      "target": "xpath=//a[contains(@href, '/-/user/')]",
+      "targets": [
+        ["linkText=foo", "linkText"],
+        ["css=.pf-c-page__header-tools-group:nth-child(2) > .pf-c-button", "css:finder"],
+        ["xpath=//a[contains(text(),'foo')]", "xpath:link"],
+        ["xpath=//div[@id='page-default-nav-example']/header/div[3]/div[2]/a", "xpath:idRelative"],
+        ["xpath=//a[contains(@href, '/-/user/')]", "xpath:href"],
+        ["xpath=//div[2]/a", "xpath:position"],
+        ["xpath=//a[contains(.,'foo')]", "xpath:innerText"]
+      ],
+      "value": "foo"
+    }, {
+      "id": "429ee61b-9991-4919-8131-55f8e1bd9a0d",
+      "comment": "",
+      "command": "assertValue",
+      "target": "id=id_username",
+      "targets": [],
+      "value": "foo"
+    }, {
+      "id": "f6c50760-52ed-4c1d-b232-30f8afe144eb",
+      "comment": "",
+      "command": "assertText",
+      "target": "id=id_name",
+      "targets": [
+        ["id=id_name", "id"],
+        ["name=name", "name"],
+        ["css=#id_name", "css:finder"],
+        ["xpath=//input[@id='id_name']", "xpath:attributes"],
+        ["xpath=//main[@id='main-content']/section/div/div/div/div[2]/form/div[2]/div/input", "xpath:idRelative"],
+        ["xpath=//div[2]/div/input", "xpath:position"]
+      ],
+      "value": "some name"
+    }, {
+      "id": "b26905b5-89b5-4b41-abf5-a9f848f08622",
+      "comment": "",
+      "command": "assertText",
+      "target": "id=id_email",
+      "targets": [
+        ["id=id_email", "id"],
+        ["name=email", "name"],
+        ["css=#id_email", "css:finder"],
+        ["xpath=//input[@id='id_email']", "xpath:attributes"],
+        ["xpath=//main[@id='main-content']/section/div/div/div/div[2]/form/div[3]/div/input", "xpath:idRelative"],
+        ["xpath=//div[3]/div/input", "xpath:position"]
+      ],
+      "value": "foo@bar.baz"
+    }]
+  }, {
+    "id": "1a3172e0-ac23-4781-9367-19afccee4f4a",
+    "name": "flows stage setup password",
+    "commands": [{
+      "id": "77784f77-d840-4b3d-a42f-7928f02fb7e1",
+      "comment": "",
+      "command": "open",
+      "target": "/flows/default-authentication-flow/?next=%2F",
+      "targets": [],
+      "value": ""
+    }, {
+      "id": "783aa9a6-81e5-49c6-8789-2f360a5750b1",
+      "comment": "",
+      "command": "setWindowSize",
+      "target": "1699x1417",
+      "targets": [],
+      "value": ""
+    }, {
+      "id": "cb0cd63e-30e9-4443-af59-5345fe26dc88",
+      "comment": "",
+      "command": "click",
+      "target": "id=id_uid_field",
+      "targets": [
+        ["id=id_uid_field", "id"],
+        ["name=uid_field", "name"],
+        ["css=#id_uid_field", "css:finder"],
+        ["xpath=//input[@id='id_uid_field']", "xpath:attributes"],
+        ["xpath=//main[@id='flow-body']/div/form/div/input", "xpath:idRelative"],
+        ["xpath=//div/input", "xpath:position"]
+      ],
+      "value": ""
+    }, {
+      "id": "8466ded1-c5f6-451c-b63f-0889da38503a",
+      "comment": "",
+      "command": "type",
+      "target": "id=id_uid_field",
+      "targets": [
+        ["id=id_uid_field", "id"],
+        ["name=uid_field", "name"],
+        ["css=#id_uid_field", "css:finder"],
+        ["xpath=//input[@id='id_uid_field']", "xpath:attributes"],
+        ["xpath=//main[@id='flow-body']/div/form/div/input", "xpath:idRelative"],
+        ["xpath=//div/input", "xpath:position"]
+      ],
+      "value": "pbadmin"
+    }, {
+      "id": "27383093-d01a-4416-8fc6-9caad4926cd3",
+      "comment": "",
+      "command": "sendKeys",
+      "target": "id=id_uid_field",
+      "targets": [
+        ["id=id_uid_field", "id"],
+        ["name=uid_field", "name"],
+        ["css=#id_uid_field", "css:finder"],
+        ["xpath=//input[@id='id_uid_field']", "xpath:attributes"],
+        ["xpath=//main[@id='flow-body']/div/form/div/input", "xpath:idRelative"],
+        ["xpath=//div/input", "xpath:position"]
+      ],
+      "value": "${KEY_ENTER}"
+    }, {
+      "id": "4602745a-0ebb-4425-a841-a1ed4899659d",
+      "comment": "",
+      "command": "type",
+      "target": "id=id_password",
+      "targets": [
+        ["id=id_password", "id"],
+        ["name=password", "name"],
+        ["css=#id_password", "css:finder"],
+        ["xpath=//input[@id='id_password']", "xpath:attributes"],
+        ["xpath=//main[@id='flow-body']/div/form/div[2]/input", "xpath:idRelative"],
+        ["xpath=//div[2]/input", "xpath:position"]
+      ],
+      "value": "pbadmin"
+    }, {
+      "id": "d1ff4f81-d8f9-45dc-ad5d-f99b54c0cd18",
+      "comment": "",
+      "command": "sendKeys",
+      "target": "id=id_password",
+      "targets": [
+        ["id=id_password", "id"],
+        ["name=password", "name"],
+        ["css=#id_password", "css:finder"],
+        ["xpath=//input[@id='id_password']", "xpath:attributes"],
+        ["xpath=//main[@id='flow-body']/div/form/div[2]/input", "xpath:idRelative"],
+        ["xpath=//div[2]/input", "xpath:position"]
+      ],
+      "value": "${KEY_ENTER}"
+    }, {
+      "id": "014c8f57-7ef2-469c-b700-efa94ba81b66",
+      "comment": "",
+      "command": "click",
+      "target": "css=.pf-c-page__header",
+      "targets": [
+        ["css=.pf-c-page__header", "css:finder"],
+        ["xpath=//div[@id='page-default-nav-example']/header", "xpath:idRelative"],
+        ["xpath=//header", "xpath:position"]
+      ],
+      "value": ""
+    }, {
+      "id": "14e86b6f-6add-4bcc-913a-42b1e7322c79",
+      "comment": "",
+      "command": "click",
+      "target": "linkText=pbadmin",
+      "targets": [
+        ["linkText=pbadmin", "linkText"],
+        ["css=.pf-c-page__header-tools-group:nth-child(2) > .pf-c-button", "css:finder"],
+        ["xpath=//a[contains(text(),'pbadmin')]", "xpath:link"],
+        ["xpath=//div[@id='page-default-nav-example']/header/div[3]/div[2]/a", "xpath:idRelative"],
+        ["xpath=//a[contains(@href, '/-/user/')]", "xpath:href"],
+        ["xpath=//div[2]/a", "xpath:position"],
+        ["xpath=//a[contains(.,'pbadmin')]", "xpath:innerText"]
+      ],
+      "value": ""
+    }, {
+      "id": "8280da13-632e-4cba-9e18-ecae0d57d052",
+      "comment": "",
+      "command": "click",
+      "target": "linkText=Change password",
+      "targets": [
+        ["linkText=Change password", "linkText"],
+        ["css=.pf-c-nav__section:nth-child(2) .pf-c-nav__link", "css:finder"],
+        ["xpath=//a[contains(text(),'Change password')]", "xpath:link"],
+        ["xpath=//nav[@id='page-default-nav-example-primary-nav']/section[2]/ul/li/a", "xpath:idRelative"],
+        ["xpath=//a[contains(@href, '/-/user/stage/password/b929b529-e384-4409-8d40-ac4a195fcab2/change/?next=%2F-%2Fuser%2F')]", "xpath:href"],
+        ["xpath=//section[2]/ul/li/a", "xpath:position"],
+        ["xpath=//a[contains(.,'Change password')]", "xpath:innerText"]
+      ],
+      "value": ""
+    }, {
+      "id": "716d7e0c-79dc-469b-a31f-dceaa0765e9c",
+      "comment": "",
+      "command": "click",
+      "target": "id=id_password",
+      "targets": [
+        ["id=id_password", "id"],
+        ["name=password", "name"],
+        ["css=#id_password", "css:finder"],
+        ["xpath=//input[@id='id_password']", "xpath:attributes"],
+        ["xpath=//main[@id='flow-body']/div/form/div/input", "xpath:idRelative"],
+        ["xpath=//div/input", "xpath:position"]
+      ],
+      "value": ""
+    }, {
+      "id": "77005d70-adf0-4add-8329-b092d43f829a",
+      "comment": "",
+      "command": "type",
+      "target": "id=id_password",
+      "targets": [
+        ["id=id_password", "id"],
+        ["name=password", "name"],
+        ["css=#id_password", "css:finder"],
+        ["xpath=//input[@id='id_password']", "xpath:attributes"],
+        ["xpath=//main[@id='flow-body']/div/form/div/input", "xpath:idRelative"],
+        ["xpath=//div/input", "xpath:position"]
+      ],
+      "value": "test"
+    }, {
+      "id": "965ca365-99f4-45d1-97c3-c944269341b9",
+      "comment": "",
+      "command": "click",
+      "target": "id=id_password_repeat",
+      "targets": [
+        ["id=id_password_repeat", "id"],
+        ["name=password_repeat", "name"],
+        ["css=#id_password_repeat", "css:finder"],
+        ["xpath=//input[@id='id_password_repeat']", "xpath:attributes"],
+        ["xpath=//main[@id='flow-body']/div/form/div[2]/input", "xpath:idRelative"],
+        ["xpath=//div[2]/input", "xpath:position"]
+      ],
+      "value": ""
+    }, {
+      "id": "9b421468-c65e-4943-b6b1-1e80410a6b87",
+      "comment": "",
+      "command": "type",
+      "target": "id=id_password_repeat",
+      "targets": [
+        ["id=id_password_repeat", "id"],
+        ["name=password_repeat", "name"],
+        ["css=#id_password_repeat", "css:finder"],
+        ["xpath=//input[@id='id_password_repeat']", "xpath:attributes"],
+        ["xpath=//main[@id='flow-body']/div/form/div[2]/input", "xpath:idRelative"],
+        ["xpath=//div[2]/input", "xpath:position"]
+      ],
+      "value": "test"
+    }, {
+      "id": "572c1400-a0f2-499f-808a-18c1f56bf13f",
+      "comment": "",
+      "command": "click",
+      "target": "css=.pf-c-button",
+      "targets": [
+        ["css=.pf-c-button", "css:finder"],
+        ["xpath=//button[@type='submit']", "xpath:attributes"],
+        ["xpath=//main[@id='flow-body']/div/form/div[3]/button", "xpath:idRelative"],
+        ["xpath=//button", "xpath:position"],
+        ["xpath=//button[contains(.,'Continue')]", "xpath:innerText"]
+      ],
+      "value": ""
+    }]
+  }],
+  "suites": [{
+    "id": "495657fb-3f5e-4431-877c-4d0b248c0841",
+    "name": "Default Suite",
+    "persistSession": false,
+    "parallel": false,
+    "timeout": 300,
+    "tests": ["94b39863-74ec-4b7d-98c5-2b380b6d2c55"]
+  }],
+  "urls": ["http://localhost:8000/"],
+  "plugins": []
+}
\ No newline at end of file
diff --git a/e2e/setup.sh b/e2e/setup.sh
new file mode 100755
index 000000000..99c795e1f
--- /dev/null
+++ b/e2e/setup.sh
@@ -0,0 +1,20 @@
+#!/bin/bash -x
+# Setup docker & compose
+curl -fsSL https://get.docker.com | bash
+sudo usermod -a -G docker ubuntu
+sudo curl -L "https://github.com/docker/compose/releases/download/1.26.0/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose
+sudo chmod +x /usr/local/bin/docker-compose
+# Setup nodejs
+curl -sL https://deb.nodesource.com/setup_12.x | sudo -E bash -
+sudo apt-get install -y nodejs
+sudo npm install -g yarn
+# Setup python
+sudo apt install -y python3.8 python3-pip
+# Setup docker
+sudo pip3 install pipenv
+
+cd e2e
+sudo docker-compose up -d
+cd ..
+pipenv sync --dev
+pipenv shell
diff --git a/e2e/test_flows_enroll.py b/e2e/test_flows_enroll.py
new file mode 100644
index 000000000..0fec78d3f
--- /dev/null
+++ b/e2e/test_flows_enroll.py
@@ -0,0 +1,260 @@
+"""Test Enroll flow"""
+from time import sleep
+
+from django.test import override_settings
+from selenium.webdriver.common.by import By
+from selenium.webdriver.support import expected_conditions as ec
+
+from docker import DockerClient, from_env
+from docker.models.containers import Container
+from docker.types import Healthcheck
+from e2e.utils import USER, SeleniumTestCase
+from passbook.flows.models import Flow, FlowDesignation, FlowStageBinding
+from passbook.policies.expression.models import ExpressionPolicy
+from passbook.policies.models import PolicyBinding
+from passbook.stages.email.models import EmailStage, EmailTemplates
+from passbook.stages.identification.models import IdentificationStage
+from passbook.stages.prompt.models import FieldTypes, Prompt, PromptStage
+from passbook.stages.user_login.models import UserLoginStage
+from passbook.stages.user_write.models import UserWriteStage
+
+
+class TestFlowsEnroll(SeleniumTestCase):
+    """Test Enroll flow"""
+
+    def setUp(self):
+        super().setUp()
+        self.container = self.setup_client()
+
+    def setup_client(self) -> Container:
+        """Setup test IdP container"""
+        client: DockerClient = from_env()
+        container = client.containers.run(
+            image="mailhog/mailhog",
+            detach=True,
+            network_mode="host",
+            auto_remove=True,
+            healthcheck=Healthcheck(
+                test=["CMD", "wget", "-s", "http://localhost:8025"],
+                interval=5 * 100 * 1000000,
+                start_period=1 * 100 * 1000000,
+            ),
+        )
+        while True:
+            container.reload()
+            status = container.attrs.get("State", {}).get("Health", {}).get("Status")
+            if status == "healthy":
+                return container
+            sleep(1)
+
+    def tearDown(self):
+        self.container.kill()
+        super().tearDown()
+
+    def test_enroll_2_step(self):
+        """Test 2-step enroll flow"""
+        # First stage fields
+        username_prompt = Prompt.objects.create(
+            field_key="username", label="Username", order=0, type=FieldTypes.TEXT
+        )
+        password = Prompt.objects.create(
+            field_key="password", label="Password", order=1, type=FieldTypes.PASSWORD
+        )
+        password_repeat = Prompt.objects.create(
+            field_key="password_repeat",
+            label="Password (repeat)",
+            order=2,
+            type=FieldTypes.PASSWORD,
+        )
+
+        # Second stage fields
+        name_field = Prompt.objects.create(
+            field_key="name", label="Name", order=0, type=FieldTypes.TEXT
+        )
+        email = Prompt.objects.create(
+            field_key="email", label="E-Mail", order=1, type=FieldTypes.EMAIL
+        )
+
+        # Stages
+        first_stage = PromptStage.objects.create(name="prompt-stage-first")
+        first_stage.fields.set([username_prompt, password, password_repeat])
+        first_stage.save()
+        second_stage = PromptStage.objects.create(name="prompt-stage-second")
+        second_stage.fields.set([name_field, email])
+        second_stage.save()
+        user_write = UserWriteStage.objects.create(name="enroll-user-write")
+        user_login = UserLoginStage.objects.create(name="enroll-user-login")
+
+        # Password checking policy
+        password_policy = ExpressionPolicy.objects.create(
+            name="policy-enrollment-password-equals",
+            expression="return request.context['password'] == request.context['password_repeat']",
+        )
+        PolicyBinding.objects.create(
+            target=first_stage, policy=password_policy, order=0
+        )
+
+        flow = Flow.objects.create(
+            name="default-enrollment-flow",
+            slug="default-enrollment-flow",
+            designation=FlowDesignation.ENROLLMENT,
+        )
+
+        # Attach enrollment flow to identification stage
+        ident_stage: IdentificationStage = IdentificationStage.objects.first()
+        ident_stage.enrollment_flow = flow
+        ident_stage.save()
+
+        FlowStageBinding.objects.create(flow=flow, stage=first_stage, order=0)
+        FlowStageBinding.objects.create(flow=flow, stage=second_stage, order=1)
+        FlowStageBinding.objects.create(flow=flow, stage=user_write, order=2)
+        FlowStageBinding.objects.create(flow=flow, stage=user_login, order=3)
+
+        self.driver.get(self.live_server_url)
+        self.wait.until(
+            ec.presence_of_element_located((By.CSS_SELECTOR, "[role=enroll]"))
+        )
+        self.driver.find_element(By.CSS_SELECTOR, "[role=enroll]").click()
+
+        self.wait.until(ec.presence_of_element_located((By.ID, "id_username")))
+        self.driver.find_element(By.ID, "id_username").send_keys("foo")
+        self.driver.find_element(By.ID, "id_password").send_keys(USER().username)
+        self.driver.find_element(By.ID, "id_password_repeat").send_keys(USER().username)
+        self.driver.find_element(By.CSS_SELECTOR, ".pf-c-button").click()
+        self.driver.find_element(By.ID, "id_name").send_keys("some name")
+        self.driver.find_element(By.ID, "id_email").send_keys("foo@bar.baz")
+        self.driver.find_element(By.CSS_SELECTOR, ".pf-c-button").click()
+
+        self.wait.until(ec.presence_of_element_located((By.LINK_TEXT, "foo")))
+        self.driver.find_element(By.LINK_TEXT, "foo").click()
+
+        self.wait_for_url(self.url("passbook_core:user-settings"))
+        self.assertEqual(
+            self.driver.find_element(By.XPATH, "//a[contains(@href, '/-/user/')]").text,
+            "foo",
+        )
+        self.assertEqual(
+            self.driver.find_element(By.ID, "id_username").get_attribute("value"), "foo"
+        )
+        self.assertEqual(
+            self.driver.find_element(By.ID, "id_name").get_attribute("value"),
+            "some name",
+        )
+        self.assertEqual(
+            self.driver.find_element(By.ID, "id_email").get_attribute("value"),
+            "foo@bar.baz",
+        )
+
+    @override_settings(EMAIL_BACKEND="django.core.mail.backends.smtp.EmailBackend")
+    def test_enroll_email(self):
+        """Test enroll with Email verification"""
+        # First stage fields
+        username_prompt = Prompt.objects.create(
+            field_key="username", label="Username", order=0, type=FieldTypes.TEXT
+        )
+        password = Prompt.objects.create(
+            field_key="password", label="Password", order=1, type=FieldTypes.PASSWORD
+        )
+        password_repeat = Prompt.objects.create(
+            field_key="password_repeat",
+            label="Password (repeat)",
+            order=2,
+            type=FieldTypes.PASSWORD,
+        )
+
+        # Second stage fields
+        name_field = Prompt.objects.create(
+            field_key="name", label="Name", order=0, type=FieldTypes.TEXT
+        )
+        email = Prompt.objects.create(
+            field_key="email", label="E-Mail", order=1, type=FieldTypes.EMAIL
+        )
+
+        # Stages
+        first_stage = PromptStage.objects.create(name="prompt-stage-first")
+        first_stage.fields.set([username_prompt, password, password_repeat])
+        first_stage.save()
+        second_stage = PromptStage.objects.create(name="prompt-stage-second")
+        second_stage.fields.set([name_field, email])
+        second_stage.save()
+        email_stage = EmailStage.objects.create(
+            name="enroll-email",
+            host="localhost",
+            port=1025,
+            template=EmailTemplates.ACCOUNT_CONFIRM,
+        )
+        user_write = UserWriteStage.objects.create(name="enroll-user-write")
+        user_login = UserLoginStage.objects.create(name="enroll-user-login")
+
+        # Password checking policy
+        password_policy = ExpressionPolicy.objects.create(
+            name="policy-enrollment-password-equals",
+            expression="return request.context['password'] == request.context['password_repeat']",
+        )
+        PolicyBinding.objects.create(
+            target=first_stage, policy=password_policy, order=0
+        )
+
+        flow = Flow.objects.create(
+            name="default-enrollment-flow",
+            slug="default-enrollment-flow",
+            designation=FlowDesignation.ENROLLMENT,
+        )
+
+        # Attach enrollment flow to identification stage
+        ident_stage: IdentificationStage = IdentificationStage.objects.first()
+        ident_stage.enrollment_flow = flow
+        ident_stage.save()
+
+        FlowStageBinding.objects.create(flow=flow, stage=first_stage, order=0)
+        FlowStageBinding.objects.create(flow=flow, stage=second_stage, order=1)
+        FlowStageBinding.objects.create(flow=flow, stage=user_write, order=2)
+        FlowStageBinding.objects.create(flow=flow, stage=email_stage, order=3)
+        FlowStageBinding.objects.create(flow=flow, stage=user_login, order=4)
+
+        self.driver.get(self.live_server_url)
+        self.driver.find_element(By.CSS_SELECTOR, "[role=enroll]").click()
+        self.driver.find_element(By.ID, "id_username").send_keys("foo")
+        self.driver.find_element(By.ID, "id_password").send_keys(USER().username)
+        self.driver.find_element(By.ID, "id_password_repeat").send_keys(USER().username)
+        self.driver.find_element(By.CSS_SELECTOR, ".pf-c-button").click()
+        self.driver.find_element(By.ID, "id_name").send_keys("some name")
+        self.driver.find_element(By.ID, "id_email").send_keys("foo@bar.baz")
+        self.driver.find_element(By.CSS_SELECTOR, ".pf-c-button").click()
+        sleep(3)
+
+        # Open Mailhog
+        self.driver.get("http://localhost:8025")
+
+        # Click on first message
+        self.driver.find_element(By.CLASS_NAME, "msglist-message").click()
+        sleep(3)
+        self.driver.switch_to.frame(self.driver.find_element(By.CLASS_NAME, "tab-pane"))
+        self.driver.find_element(By.ID, "confirm").click()
+        self.driver.close()
+        self.driver.switch_to.window(self.driver.window_handles[0])
+
+        # We're now logged in
+        sleep(3)
+        self.wait.until(
+            ec.presence_of_element_located(
+                (By.XPATH, "//a[contains(@href, '/-/user/')]")
+            )
+        )
+        self.driver.find_element(By.XPATH, "//a[contains(@href, '/-/user/')]").click()
+
+        self.assertEqual(
+            self.driver.find_element(By.XPATH, "//a[contains(@href, '/-/user/')]").text,
+            "foo",
+        )
+        self.assertEqual(
+            self.driver.find_element(By.ID, "id_username").get_attribute("value"), "foo"
+        )
+        self.assertEqual(
+            self.driver.find_element(By.ID, "id_name").get_attribute("value"),
+            "some name",
+        )
+        self.assertEqual(
+            self.driver.find_element(By.ID, "id_email").get_attribute("value"),
+            "foo@bar.baz",
+        )
diff --git a/e2e/test_flows_login.py b/e2e/test_flows_login.py
new file mode 100644
index 000000000..c92b3cbc6
--- /dev/null
+++ b/e2e/test_flows_login.py
@@ -0,0 +1,22 @@
+"""test default login flow"""
+from selenium.webdriver.common.by import By
+from selenium.webdriver.common.keys import Keys
+
+from e2e.utils import USER, SeleniumTestCase
+
+
+class TestFlowsLogin(SeleniumTestCase):
+    """test default login flow"""
+
+    def test_login(self):
+        """test default login flow"""
+        self.driver.get(f"{self.live_server_url}/flows/default-authentication-flow/")
+        self.driver.find_element(By.ID, "id_uid_field").click()
+        self.driver.find_element(By.ID, "id_uid_field").send_keys(USER().username)
+        self.driver.find_element(By.ID, "id_uid_field").send_keys(Keys.ENTER)
+        self.driver.find_element(By.ID, "id_password").send_keys(USER().username)
+        self.driver.find_element(By.ID, "id_password").send_keys(Keys.ENTER)
+        self.assertEqual(
+            self.driver.find_element(By.XPATH, "//a[contains(@href, '/-/user/')]").text,
+            USER().username,
+        )
diff --git a/e2e/test_flows_stage_setup.py b/e2e/test_flows_stage_setup.py
new file mode 100644
index 000000000..ca32a99d2
--- /dev/null
+++ b/e2e/test_flows_stage_setup.py
@@ -0,0 +1,41 @@
+"""test stage setup flows (password change)"""
+import string
+from random import SystemRandom
+from time import sleep
+
+from selenium.webdriver.common.by import By
+from selenium.webdriver.common.keys import Keys
+
+from e2e.utils import USER, SeleniumTestCase
+from passbook.core.models import User
+
+
+class TestFlowsStageSetup(SeleniumTestCase):
+    """test stage setup flows"""
+
+    def test_password_change(self):
+        """test password change flow"""
+        new_password = "".join(
+            SystemRandom().choice(string.ascii_uppercase + string.digits)
+            for _ in range(8)
+        )
+
+        self.driver.get(
+            f"{self.live_server_url}/flows/default-authentication-flow/?next=%2F"
+        )
+        self.driver.find_element(By.ID, "id_uid_field").send_keys(USER().username)
+        self.driver.find_element(By.ID, "id_uid_field").send_keys(Keys.ENTER)
+        self.driver.find_element(By.ID, "id_password").send_keys(USER().username)
+        self.driver.find_element(By.ID, "id_password").send_keys(Keys.ENTER)
+        self.driver.find_element(By.CSS_SELECTOR, ".pf-c-page__header").click()
+        self.driver.find_element(By.XPATH, "//a[contains(@href, '/-/user/')]").click()
+        self.driver.find_element(By.LINK_TEXT, "Change password").click()
+        self.driver.find_element(By.ID, "id_password").send_keys(new_password)
+        self.driver.find_element(By.ID, "id_password_repeat").click()
+        self.driver.find_element(By.ID, "id_password_repeat").send_keys(new_password)
+        self.driver.find_element(By.CSS_SELECTOR, ".pf-c-button").click()
+
+        sleep(2)
+        # Because USER() is cached, we need to get the user manually here
+        user = User.objects.get(username=USER().username)
+        self.assertTrue(user.check_password(new_password))
diff --git a/e2e/test_provider_oauth.py b/e2e/test_provider_oauth.py
new file mode 100644
index 000000000..8960ac65d
--- /dev/null
+++ b/e2e/test_provider_oauth.py
@@ -0,0 +1,235 @@
+"""test OAuth Provider flow"""
+from time import sleep
+
+from oauth2_provider.generators import generate_client_id, generate_client_secret
+from selenium.webdriver.common.by import By
+from selenium.webdriver.common.keys import Keys
+
+from docker import DockerClient, from_env
+from docker.models.containers import Container
+from docker.types import Healthcheck
+from e2e.utils import USER, SeleniumTestCase
+from passbook.core.models import Application
+from passbook.flows.models import Flow
+from passbook.policies.expression.models import ExpressionPolicy
+from passbook.policies.models import PolicyBinding
+from passbook.providers.oauth.models import OAuth2Provider
+
+
+class TestProviderOAuth(SeleniumTestCase):
+    """test OAuth Provider flow"""
+
+    def setUp(self):
+        super().setUp()
+        self.client_id = generate_client_id()
+        self.client_secret = generate_client_secret()
+        self.container = self.setup_client()
+
+    def setup_client(self) -> Container:
+        """Setup client grafana container which we test OAuth against"""
+        client: DockerClient = from_env()
+        container = client.containers.run(
+            image="grafana/grafana:latest",
+            detach=True,
+            network_mode="host",
+            auto_remove=True,
+            healthcheck=Healthcheck(
+                test=["CMD", "wget", "--spider", "http://localhost:3000"],
+                interval=5 * 100 * 1000000,
+                start_period=1 * 100 * 1000000,
+            ),
+            environment={
+                "GF_AUTH_GITHUB_ENABLED": "true",
+                "GF_AUTH_GITHUB_allow_sign_up": "true",
+                "GF_AUTH_GITHUB_CLIENT_ID": self.client_id,
+                "GF_AUTH_GITHUB_CLIENT_SECRET": self.client_secret,
+                "GF_AUTH_GITHUB_SCOPES": "user:email,read:org",
+                "GF_AUTH_GITHUB_AUTH_URL": self.url(
+                    "passbook_providers_oauth:github-authorize"
+                ),
+                "GF_AUTH_GITHUB_TOKEN_URL": self.url(
+                    "passbook_providers_oauth:github-access-token"
+                ),
+                "GF_AUTH_GITHUB_API_URL": self.url(
+                    "passbook_providers_oauth:github-user"
+                ),
+                "GF_LOG_LEVEL": "debug",
+            },
+        )
+        while True:
+            container.reload()
+            status = container.attrs.get("State", {}).get("Health", {}).get("Status")
+            if status == "healthy":
+                return container
+            sleep(1)
+
+    def tearDown(self):
+        self.container.kill()
+        super().tearDown()
+
+    def test_authorization_consent_implied(self):
+        """test OAuth Provider flow (default authorization flow with implied consent)"""
+        sleep(1)
+        # Bootstrap all needed objects
+        authorization_flow = Flow.objects.get(
+            slug="default-provider-authorization-implicit-consent"
+        )
+        provider = OAuth2Provider.objects.create(
+            name="grafana",
+            client_type=OAuth2Provider.CLIENT_CONFIDENTIAL,
+            authorization_grant_type=OAuth2Provider.GRANT_AUTHORIZATION_CODE,
+            client_id=self.client_id,
+            client_secret=self.client_secret,
+            redirect_uris="http://localhost:3000/login/github",
+            skip_authorization=True,
+            authorization_flow=authorization_flow,
+        )
+        Application.objects.create(
+            name="Grafana", slug="grafana", provider=provider,
+        )
+
+        self.driver.get("http://localhost:3000")
+        self.driver.find_element(By.CLASS_NAME, "btn-service--github").click()
+        self.driver.find_element(By.ID, "id_uid_field").click()
+        self.driver.find_element(By.ID, "id_uid_field").send_keys(USER().username)
+        self.driver.find_element(By.ID, "id_uid_field").send_keys(Keys.ENTER)
+        self.driver.find_element(By.ID, "id_password").send_keys(USER().username)
+        self.driver.find_element(By.ID, "id_password").send_keys(Keys.ENTER)
+
+        self.wait_for_url("http://localhost:3000/?orgId=1")
+        self.driver.find_element(By.XPATH, "//a[contains(@href, '/profile')]").click()
+        self.assertEqual(
+            self.driver.find_element(By.CLASS_NAME, "page-header__title").text,
+            USER().username,
+        )
+        self.assertEqual(
+            self.driver.find_element(
+                By.XPATH,
+                "/html/body/grafana-app/div/div/div/react-profile-wrapper/form[1]/div[1]/div/input",
+            ).get_attribute("value"),
+            USER().username,
+        )
+        self.assertEqual(
+            self.driver.find_element(
+                By.XPATH,
+                "/html/body/grafana-app/div/div/div/react-profile-wrapper/form[1]/div[2]/div/input",
+            ).get_attribute("value"),
+            USER().email,
+        )
+        self.assertEqual(
+            self.driver.find_element(
+                By.XPATH,
+                "/html/body/grafana-app/div/div/div/react-profile-wrapper/form[1]/div[3]/div/input",
+            ).get_attribute("value"),
+            USER().username,
+        )
+
+    def test_authorization_consent_explicit(self):
+        """test OAuth Provider flow (default authorization flow with explicit consent)"""
+        sleep(1)
+        # Bootstrap all needed objects
+        authorization_flow = Flow.objects.get(
+            slug="default-provider-authorization-explicit-consent"
+        )
+        provider = OAuth2Provider.objects.create(
+            name="grafana",
+            client_type=OAuth2Provider.CLIENT_CONFIDENTIAL,
+            authorization_grant_type=OAuth2Provider.GRANT_AUTHORIZATION_CODE,
+            client_id=self.client_id,
+            client_secret=self.client_secret,
+            redirect_uris="http://localhost:3000/login/github",
+            skip_authorization=True,
+            authorization_flow=authorization_flow,
+        )
+        app = Application.objects.create(
+            name="Grafana", slug="grafana", provider=provider,
+        )
+
+        self.driver.get("http://localhost:3000")
+        self.driver.find_element(By.CLASS_NAME, "btn-service--github").click()
+        self.driver.find_element(By.ID, "id_uid_field").click()
+        self.driver.find_element(By.ID, "id_uid_field").send_keys(USER().username)
+        self.driver.find_element(By.ID, "id_uid_field").send_keys(Keys.ENTER)
+        self.driver.find_element(By.ID, "id_password").send_keys(USER().username)
+        self.driver.find_element(By.ID, "id_password").send_keys(Keys.ENTER)
+
+        self.assertIn(
+            app.name,
+            self.driver.find_element(
+                By.XPATH, "/html/body/div[2]/div/main/div/form/div[2]/p[1]"
+            ).text,
+        )
+        self.assertEqual(
+            "GitHub Compatibility: User Email",
+            self.driver.find_element(
+                By.XPATH, "/html/body/div[2]/div/main/div/form/div[2]/ul/li[1]"
+            ).text,
+        )
+        self.driver.find_element(By.CSS_SELECTOR, "[type=submit]").click()
+
+        self.wait_for_url("http://localhost:3000/?orgId=1")
+        self.driver.find_element(By.XPATH, "//a[contains(@href, '/profile')]").click()
+        self.assertEqual(
+            self.driver.find_element(By.CLASS_NAME, "page-header__title").text,
+            USER().username,
+        )
+        self.assertEqual(
+            self.driver.find_element(
+                By.XPATH,
+                "/html/body/grafana-app/div/div/div/react-profile-wrapper/form[1]/div[1]/div/input",
+            ).get_attribute("value"),
+            USER().username,
+        )
+        self.assertEqual(
+            self.driver.find_element(
+                By.XPATH,
+                "/html/body/grafana-app/div/div/div/react-profile-wrapper/form[1]/div[2]/div/input",
+            ).get_attribute("value"),
+            USER().email,
+        )
+        self.assertEqual(
+            self.driver.find_element(
+                By.XPATH,
+                "/html/body/grafana-app/div/div/div/react-profile-wrapper/form[1]/div[3]/div/input",
+            ).get_attribute("value"),
+            USER().username,
+        )
+
+    def test_denied(self):
+        """test OAuth Provider flow (default authorization flow, denied)"""
+        sleep(1)
+        # Bootstrap all needed objects
+        authorization_flow = Flow.objects.get(
+            slug="default-provider-authorization-explicit-consent"
+        )
+        provider = OAuth2Provider.objects.create(
+            name="grafana",
+            client_type=OAuth2Provider.CLIENT_CONFIDENTIAL,
+            authorization_grant_type=OAuth2Provider.GRANT_AUTHORIZATION_CODE,
+            client_id=self.client_id,
+            client_secret=self.client_secret,
+            redirect_uris="http://localhost:3000/login/github",
+            skip_authorization=True,
+            authorization_flow=authorization_flow,
+        )
+        app = Application.objects.create(
+            name="Grafana", slug="grafana", provider=provider,
+        )
+
+        negative_policy = ExpressionPolicy.objects.create(
+            name="negative-static", expression="return False"
+        )
+        PolicyBinding.objects.create(target=app, policy=negative_policy, order=0)
+
+        self.driver.get("http://localhost:3000")
+        self.driver.find_element(By.CLASS_NAME, "btn-service--github").click()
+        self.driver.find_element(By.ID, "id_uid_field").click()
+        self.driver.find_element(By.ID, "id_uid_field").send_keys(USER().username)
+        self.driver.find_element(By.ID, "id_uid_field").send_keys(Keys.ENTER)
+        self.driver.find_element(By.ID, "id_password").send_keys(USER().username)
+        self.driver.find_element(By.ID, "id_password").send_keys(Keys.ENTER)
+        self.wait_for_url(self.url("passbook_flows:denied"))
+        self.assertEqual(
+            self.driver.find_element(By.CSS_SELECTOR, "#flow-body > header > h1").text,
+            "Permission denied",
+        )
diff --git a/e2e/test_provider_oidc.py b/e2e/test_provider_oidc.py
new file mode 100644
index 000000000..1ccdffdbb
--- /dev/null
+++ b/e2e/test_provider_oidc.py
@@ -0,0 +1,303 @@
+"""test OpenID Provider flow"""
+from time import sleep
+
+from django.shortcuts import reverse
+from oauth2_provider.generators import generate_client_id, generate_client_secret
+from oidc_provider.models import Client, ResponseType
+from selenium.webdriver.common.by import By
+from selenium.webdriver.common.keys import Keys
+from selenium.webdriver.support import expected_conditions as ec
+
+from docker import DockerClient, from_env
+from docker.models.containers import Container
+from docker.types import Healthcheck
+from e2e.utils import USER, SeleniumTestCase, ensure_rsa_key
+from passbook.core.models import Application
+from passbook.flows.models import Flow
+from passbook.policies.expression.models import ExpressionPolicy
+from passbook.policies.models import PolicyBinding
+from passbook.providers.oidc.models import OpenIDProvider
+
+
+class TestProviderOIDC(SeleniumTestCase):
+    """test OpenID Provider flow"""
+
+    def setUp(self):
+        super().setUp()
+        self.client_id = generate_client_id()
+        self.client_secret = generate_client_secret()
+        self.container = self.setup_client()
+
+    def setup_client(self) -> Container:
+        """Setup client grafana container which we test OIDC against"""
+        client: DockerClient = from_env()
+        container = client.containers.run(
+            image="grafana/grafana:latest",
+            detach=True,
+            network_mode="host",
+            auto_remove=True,
+            healthcheck=Healthcheck(
+                test=["CMD", "wget", "--spider", "http://localhost:3000"],
+                interval=5 * 100 * 1000000,
+                start_period=1 * 100 * 1000000,
+            ),
+            environment={
+                "GF_AUTH_GENERIC_OAUTH_ENABLED": "true",
+                "GF_AUTH_GENERIC_OAUTH_CLIENT_ID": self.client_id,
+                "GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET": self.client_secret,
+                "GF_AUTH_GENERIC_OAUTH_SCOPES": "openid email profile",
+                "GF_AUTH_GENERIC_OAUTH_AUTH_URL": (
+                    self.live_server_url + reverse("passbook_providers_oidc:authorize")
+                ),
+                "GF_AUTH_GENERIC_OAUTH_TOKEN_URL": (
+                    self.live_server_url + reverse("oidc_provider:token")
+                ),
+                "GF_AUTH_GENERIC_OAUTH_API_URL": (
+                    self.live_server_url + reverse("oidc_provider:userinfo")
+                ),
+                "GF_LOG_LEVEL": "debug",
+            },
+        )
+        while True:
+            container.reload()
+            status = container.attrs.get("State", {}).get("Health", {}).get("Status")
+            if status == "healthy":
+                return container
+            sleep(1)
+
+    def tearDown(self):
+        self.container.kill()
+        super().tearDown()
+
+    def test_redirect_uri_error(self):
+        """test OpenID Provider flow (invalid redirect URI, check error message)"""
+        sleep(1)
+        # Bootstrap all needed objects
+        authorization_flow = Flow.objects.get(
+            slug="default-provider-authorization-implicit-consent"
+        )
+        client = Client.objects.create(
+            name="grafana",
+            client_type="confidential",
+            client_id=self.client_id,
+            client_secret=self.client_secret,
+            _redirect_uris="http://localhost:3000/",
+            _scope="openid userinfo",
+        )
+        # At least one of these objects must exist
+        ensure_rsa_key()
+        # This response_code object might exist or not, depending on the order the tests are run
+        rp_type, _ = ResponseType.objects.get_or_create(value="code")
+        client.response_types.set([rp_type])
+        client.save()
+        provider = OpenIDProvider.objects.create(
+            oidc_client=client, authorization_flow=authorization_flow,
+        )
+        Application.objects.create(
+            name="Grafana", slug="grafana", provider=provider,
+        )
+
+        self.driver.get("http://localhost:3000")
+        self.driver.find_element(By.CLASS_NAME, "btn-service--oauth").click()
+        self.driver.find_element(By.ID, "id_uid_field").click()
+        self.driver.find_element(By.ID, "id_uid_field").send_keys(USER().username)
+        self.driver.find_element(By.ID, "id_uid_field").send_keys(Keys.ENTER)
+        self.driver.find_element(By.ID, "id_password").send_keys(USER().username)
+        self.driver.find_element(By.ID, "id_password").send_keys(Keys.ENTER)
+        sleep(2)
+        self.assertEqual(
+            self.driver.find_element(By.CLASS_NAME, "pf-c-title").text,
+            "Redirect URI Error",
+        )
+
+    def test_authorization_consent_implied(self):
+        """test OpenID Provider flow (default authorization flow with implied consent)"""
+        sleep(1)
+        # Bootstrap all needed objects
+        authorization_flow = Flow.objects.get(
+            slug="default-provider-authorization-implicit-consent"
+        )
+        client = Client.objects.create(
+            name="grafana",
+            client_type="confidential",
+            client_id=self.client_id,
+            client_secret=self.client_secret,
+            _redirect_uris="http://localhost:3000/login/generic_oauth",
+            _scope="openid profile email",
+            reuse_consent=False,
+            require_consent=False,
+        )
+        # At least one of these objects must exist
+        ensure_rsa_key()
+        # This response_code object might exist or not, depending on the order the tests are run
+        rp_type, _ = ResponseType.objects.get_or_create(value="code")
+        client.response_types.set([rp_type])
+        client.save()
+        provider = OpenIDProvider.objects.create(
+            oidc_client=client, authorization_flow=authorization_flow,
+        )
+        Application.objects.create(
+            name="Grafana", slug="grafana", provider=provider,
+        )
+
+        self.driver.get("http://localhost:3000")
+        self.driver.find_element(By.CLASS_NAME, "btn-service--oauth").click()
+        self.driver.find_element(By.ID, "id_uid_field").click()
+        self.driver.find_element(By.ID, "id_uid_field").send_keys(USER().username)
+        self.driver.find_element(By.ID, "id_uid_field").send_keys(Keys.ENTER)
+        self.driver.find_element(By.ID, "id_password").send_keys(USER().username)
+        self.driver.find_element(By.ID, "id_password").send_keys(Keys.ENTER)
+        self.driver.find_element(By.XPATH, "//a[contains(@href, '/profile')]").click()
+        self.assertEqual(
+            self.driver.find_element(By.CLASS_NAME, "page-header__title").text,
+            USER().name,
+        )
+        self.assertEqual(
+            self.driver.find_element(
+                By.XPATH,
+                "/html/body/grafana-app/div/div/div/react-profile-wrapper/form[1]/div[1]/div/input",
+            ).get_attribute("value"),
+            USER().name,
+        )
+        self.assertEqual(
+            self.driver.find_element(
+                By.XPATH,
+                "/html/body/grafana-app/div/div/div/react-profile-wrapper/form[1]/div[2]/div/input",
+            ).get_attribute("value"),
+            USER().email,
+        )
+        self.assertEqual(
+            self.driver.find_element(
+                By.XPATH,
+                "/html/body/grafana-app/div/div/div/react-profile-wrapper/form[1]/div[3]/div/input",
+            ).get_attribute("value"),
+            USER().email,
+        )
+
+    def test_authorization_consent_explicit(self):
+        """test OpenID Provider flow (default authorization flow with explicit consent)"""
+        sleep(1)
+        # Bootstrap all needed objects
+        authorization_flow = Flow.objects.get(
+            slug="default-provider-authorization-explicit-consent"
+        )
+        client = Client.objects.create(
+            name="grafana",
+            client_type="confidential",
+            client_id=self.client_id,
+            client_secret=self.client_secret,
+            _redirect_uris="http://localhost:3000/login/generic_oauth",
+            _scope="openid profile email",
+            reuse_consent=False,
+            require_consent=False,
+        )
+        # At least one of these objects must exist
+        ensure_rsa_key()
+        # This response_code object might exist or not, depending on the order the tests are run
+        rp_type, _ = ResponseType.objects.get_or_create(value="code")
+        client.response_types.set([rp_type])
+        client.save()
+        provider = OpenIDProvider.objects.create(
+            oidc_client=client, authorization_flow=authorization_flow,
+        )
+        app = Application.objects.create(
+            name="Grafana", slug="grafana", provider=provider,
+        )
+
+        self.driver.get("http://localhost:3000")
+        self.driver.find_element(By.CLASS_NAME, "btn-service--oauth").click()
+        self.driver.find_element(By.ID, "id_uid_field").click()
+        self.driver.find_element(By.ID, "id_uid_field").send_keys(USER().username)
+        self.driver.find_element(By.ID, "id_uid_field").send_keys(Keys.ENTER)
+        self.driver.find_element(By.ID, "id_password").send_keys(USER().username)
+        self.driver.find_element(By.ID, "id_password").send_keys(Keys.ENTER)
+
+        self.assertIn(
+            app.name,
+            self.driver.find_element(
+                By.XPATH, "/html/body/div[2]/div/main/div/form/div[2]/p[1]"
+            ).text,
+        )
+        self.wait.until(
+            ec.presence_of_element_located((By.CSS_SELECTOR, "[type=submit]"))
+        )
+        self.driver.find_element(By.CSS_SELECTOR, "[type=submit]").click()
+
+        self.wait.until(
+            ec.presence_of_element_located(
+                (By.XPATH, "//a[contains(@href, '/profile')]")
+            )
+        )
+        self.driver.find_element(By.XPATH, "//a[contains(@href, '/profile')]").click()
+        self.assertEqual(
+            self.driver.find_element(By.CLASS_NAME, "page-header__title").text,
+            USER().name,
+        )
+        self.assertEqual(
+            self.driver.find_element(
+                By.XPATH,
+                "/html/body/grafana-app/div/div/div/react-profile-wrapper/form[1]/div[1]/div/input",
+            ).get_attribute("value"),
+            USER().name,
+        )
+        self.assertEqual(
+            self.driver.find_element(
+                By.XPATH,
+                "/html/body/grafana-app/div/div/div/react-profile-wrapper/form[1]/div[2]/div/input",
+            ).get_attribute("value"),
+            USER().email,
+        )
+        self.assertEqual(
+            self.driver.find_element(
+                By.XPATH,
+                "/html/body/grafana-app/div/div/div/react-profile-wrapper/form[1]/div[3]/div/input",
+            ).get_attribute("value"),
+            USER().email,
+        )
+
+    def test_authorization_denied(self):
+        """test OpenID Provider flow (default authorization with access deny)"""
+        sleep(1)
+        # Bootstrap all needed objects
+        authorization_flow = Flow.objects.get(
+            slug="default-provider-authorization-explicit-consent"
+        )
+        client = Client.objects.create(
+            name="grafana",
+            client_type="confidential",
+            client_id=self.client_id,
+            client_secret=self.client_secret,
+            _redirect_uris="http://localhost:3000/login/generic_oauth",
+            _scope="openid profile email",
+            reuse_consent=False,
+            require_consent=False,
+        )
+        # At least one of these objects must exist
+        ensure_rsa_key()
+        # This response_code object might exist or not, depending on the order the tests are run
+        rp_type, _ = ResponseType.objects.get_or_create(value="code")
+        client.response_types.set([rp_type])
+        client.save()
+        provider = OpenIDProvider.objects.create(
+            oidc_client=client, authorization_flow=authorization_flow,
+        )
+        app = Application.objects.create(
+            name="Grafana", slug="grafana", provider=provider,
+        )
+
+        negative_policy = ExpressionPolicy.objects.create(
+            name="negative-static", expression="return False"
+        )
+        PolicyBinding.objects.create(target=app, policy=negative_policy, order=0)
+        self.driver.get("http://localhost:3000")
+        self.driver.find_element(By.CLASS_NAME, "btn-service--oauth").click()
+        self.driver.find_element(By.ID, "id_uid_field").click()
+        self.driver.find_element(By.ID, "id_uid_field").send_keys(USER().username)
+        self.driver.find_element(By.ID, "id_uid_field").send_keys(Keys.ENTER)
+        self.driver.find_element(By.ID, "id_password").send_keys(USER().username)
+        self.driver.find_element(By.ID, "id_password").send_keys(Keys.ENTER)
+        self.wait_for_url(self.url("passbook_flows:denied"))
+        self.assertEqual(
+            self.driver.find_element(By.CSS_SELECTOR, "#flow-body > header > h1").text,
+            "Permission denied",
+        )
diff --git a/e2e/test_provider_saml.py b/e2e/test_provider_saml.py
new file mode 100644
index 000000000..5187f3849
--- /dev/null
+++ b/e2e/test_provider_saml.py
@@ -0,0 +1,216 @@
+"""test SAML Provider flow"""
+from time import sleep
+
+from selenium.webdriver.common.by import By
+from selenium.webdriver.common.keys import Keys
+
+from docker import DockerClient, from_env
+from docker.models.containers import Container
+from docker.types import Healthcheck
+from e2e.utils import USER, SeleniumTestCase
+from passbook.core.models import Application
+from passbook.crypto.models import CertificateKeyPair
+from passbook.flows.models import Flow
+from passbook.lib.utils.reflection import class_to_path
+from passbook.policies.expression.models import ExpressionPolicy
+from passbook.policies.models import PolicyBinding
+from passbook.providers.saml.models import (
+    SAMLBindings,
+    SAMLPropertyMapping,
+    SAMLProvider,
+)
+from passbook.providers.saml.processors.generic import GenericProcessor
+
+
+class TestProviderSAML(SeleniumTestCase):
+    """test SAML Provider flow"""
+
+    container: Container
+
+    def setup_client(self, provider: SAMLProvider) -> Container:
+        """Setup client saml-sp container which we test SAML against"""
+        client: DockerClient = from_env()
+        container = client.containers.run(
+            image="beryju/saml-test-sp",
+            detach=True,
+            network_mode="host",
+            auto_remove=True,
+            healthcheck=Healthcheck(
+                test=["CMD", "wget", "--spider", "http://localhost:9009/health"],
+                interval=5 * 100 * 1000000,
+                start_period=1 * 100 * 1000000,
+            ),
+            environment={
+                "SP_ENTITY_ID": provider.issuer,
+                "SP_SSO_BINDING": "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST",
+                "SP_METADATA_URL": (
+                    self.url(
+                        "passbook_providers_saml:metadata",
+                        application_slug=provider.application.slug,
+                    )
+                ),
+            },
+        )
+        while True:
+            container.reload()
+            status = container.attrs.get("State", {}).get("Health", {}).get("Status")
+            if status == "healthy":
+                return container
+            sleep(1)
+
+    def tearDown(self):
+        self.container.kill()
+        super().tearDown()
+
+    def test_sp_initiated_implicit(self):
+        """test SAML Provider flow SP-initiated flow (implicit consent)"""
+        # Bootstrap all needed objects
+        authorization_flow = Flow.objects.get(
+            slug="default-provider-authorization-implicit-consent"
+        )
+        provider: SAMLProvider = SAMLProvider.objects.create(
+            name="saml-test",
+            processor_path=class_to_path(GenericProcessor),
+            acs_url="http://localhost:9009/saml/acs",
+            audience="passbook-e2e",
+            issuer="passbook-e2e",
+            sp_binding=SAMLBindings.POST,
+            authorization_flow=authorization_flow,
+            signing_kp=CertificateKeyPair.objects.first(),
+        )
+        provider.property_mappings.set(SAMLPropertyMapping.objects.all())
+        provider.save()
+        Application.objects.create(
+            name="SAML", slug="passbook-saml", provider=provider,
+        )
+        self.container = self.setup_client(provider)
+        self.driver.get("http://localhost:9009")
+        self.driver.find_element(By.ID, "id_uid_field").click()
+        self.driver.find_element(By.ID, "id_uid_field").send_keys(USER().username)
+        self.driver.find_element(By.ID, "id_uid_field").send_keys(Keys.ENTER)
+        self.driver.find_element(By.ID, "id_password").send_keys(USER().username)
+        self.driver.find_element(By.ID, "id_password").send_keys(Keys.ENTER)
+        self.wait_for_url("http://localhost:9009/")
+        self.assertEqual(
+            self.driver.find_element(By.XPATH, "/html/body/pre").text,
+            f"Hello, {USER().name}!",
+        )
+
+    def test_sp_initiated_explicit(self):
+        """test SAML Provider flow SP-initiated flow (explicit consent)"""
+        # Bootstrap all needed objects
+        authorization_flow = Flow.objects.get(
+            slug="default-provider-authorization-explicit-consent"
+        )
+        provider: SAMLProvider = SAMLProvider.objects.create(
+            name="saml-test",
+            processor_path=class_to_path(GenericProcessor),
+            acs_url="http://localhost:9009/saml/acs",
+            audience="passbook-e2e",
+            issuer="passbook-e2e",
+            sp_binding=SAMLBindings.POST,
+            authorization_flow=authorization_flow,
+            signing_kp=CertificateKeyPair.objects.first(),
+        )
+        provider.property_mappings.set(SAMLPropertyMapping.objects.all())
+        provider.save()
+        app = Application.objects.create(
+            name="SAML", slug="passbook-saml", provider=provider,
+        )
+        self.container = self.setup_client(provider)
+        self.driver.get("http://localhost:9009")
+        self.driver.find_element(By.ID, "id_uid_field").click()
+        self.driver.find_element(By.ID, "id_uid_field").send_keys(USER().username)
+        self.driver.find_element(By.ID, "id_uid_field").send_keys(Keys.ENTER)
+        self.driver.find_element(By.ID, "id_password").send_keys(USER().username)
+        self.driver.find_element(By.ID, "id_password").send_keys(Keys.ENTER)
+        self.assertIn(
+            app.name,
+            self.driver.find_element(
+                By.XPATH, "/html/body/div[2]/div/main/div/form/div[2]/p[1]"
+            ).text,
+        )
+        sleep(1)
+        self.driver.find_element(By.CSS_SELECTOR, "[type=submit]").click()
+        self.wait_for_url("http://localhost:9009/")
+        self.assertEqual(
+            self.driver.find_element(By.XPATH, "/html/body/pre").text,
+            f"Hello, {USER().name}!",
+        )
+
+    def test_idp_initiated_implicit(self):
+        """test SAML Provider flow IdP-initiated flow (implicit consent)"""
+        # Bootstrap all needed objects
+        authorization_flow = Flow.objects.get(
+            slug="default-provider-authorization-implicit-consent"
+        )
+        provider: SAMLProvider = SAMLProvider.objects.create(
+            name="saml-test",
+            processor_path=class_to_path(GenericProcessor),
+            acs_url="http://localhost:9009/saml/acs",
+            audience="passbook-e2e",
+            issuer="passbook-e2e",
+            sp_binding=SAMLBindings.POST,
+            authorization_flow=authorization_flow,
+            signing_kp=CertificateKeyPair.objects.first(),
+        )
+        provider.property_mappings.set(SAMLPropertyMapping.objects.all())
+        provider.save()
+        Application.objects.create(
+            name="SAML", slug="passbook-saml", provider=provider,
+        )
+        self.container = self.setup_client(provider)
+        self.driver.get(
+            self.url(
+                "passbook_providers_saml:sso-init",
+                application_slug=provider.application.slug,
+            )
+        )
+        self.driver.find_element(By.ID, "id_uid_field").click()
+        self.driver.find_element(By.ID, "id_uid_field").send_keys(USER().username)
+        self.driver.find_element(By.ID, "id_uid_field").send_keys(Keys.ENTER)
+        self.driver.find_element(By.ID, "id_password").send_keys(USER().username)
+        self.driver.find_element(By.ID, "id_password").send_keys(Keys.ENTER)
+        self.wait_for_url("http://localhost:9009/")
+        self.assertEqual(
+            self.driver.find_element(By.XPATH, "/html/body/pre").text,
+            f"Hello, {USER().name}!",
+        )
+
+    def test_sp_initiated_denied(self):
+        """test SAML Provider flow SP-initiated flow (Policy denies access)"""
+        # Bootstrap all needed objects
+        authorization_flow = Flow.objects.get(
+            slug="default-provider-authorization-implicit-consent"
+        )
+        negative_policy = ExpressionPolicy.objects.create(
+            name="negative-static", expression="return False"
+        )
+        provider: SAMLProvider = SAMLProvider.objects.create(
+            name="saml-test",
+            processor_path=class_to_path(GenericProcessor),
+            acs_url="http://localhost:9009/saml/acs",
+            audience="passbook-e2e",
+            issuer="passbook-e2e",
+            sp_binding=SAMLBindings.POST,
+            authorization_flow=authorization_flow,
+            signing_kp=CertificateKeyPair.objects.first(),
+        )
+        provider.property_mappings.set(SAMLPropertyMapping.objects.all())
+        provider.save()
+        app = Application.objects.create(
+            name="SAML", slug="passbook-saml", provider=provider,
+        )
+        PolicyBinding.objects.create(target=app, policy=negative_policy, order=0)
+        self.container = self.setup_client(provider)
+        self.driver.get("http://localhost:9009/")
+        self.driver.find_element(By.ID, "id_uid_field").click()
+        self.driver.find_element(By.ID, "id_uid_field").send_keys(USER().username)
+        self.driver.find_element(By.ID, "id_uid_field").send_keys(Keys.ENTER)
+        self.driver.find_element(By.ID, "id_password").send_keys(USER().username)
+        self.driver.find_element(By.ID, "id_password").send_keys(Keys.ENTER)
+        self.wait_for_url(self.url("passbook_flows:denied"))
+        self.assertEqual(
+            self.driver.find_element(By.CSS_SELECTOR, "#flow-body > header > h1").text,
+            "Permission denied",
+        )
diff --git a/e2e/test_source_saml.py b/e2e/test_source_saml.py
new file mode 100644
index 000000000..78591d850
--- /dev/null
+++ b/e2e/test_source_saml.py
@@ -0,0 +1,127 @@
+"""test SAML Source"""
+from time import sleep
+
+from selenium.webdriver.common.by import By
+from selenium.webdriver.common.keys import Keys
+from selenium.webdriver.support import expected_conditions as ec
+
+from docker import DockerClient, from_env
+from docker.models.containers import Container
+from docker.types import Healthcheck
+from e2e.utils import SeleniumTestCase
+from passbook.crypto.models import CertificateKeyPair
+from passbook.flows.models import Flow
+from passbook.sources.saml.models import SAMLBindingTypes, SAMLSource
+
+IDP_CERT = """-----BEGIN CERTIFICATE-----
+MIIDXTCCAkWgAwIBAgIJALmVVuDWu4NYMA0GCSqGSIb3DQEBCwUAMEUxCzAJBgNV
+BAYTAkFVMRMwEQYDVQQIDApTb21lLVN0YXRlMSEwHwYDVQQKDBhJbnRlcm5ldCBX
+aWRnaXRzIFB0eSBMdGQwHhcNMTYxMjMxMTQzNDQ3WhcNNDgwNjI1MTQzNDQ3WjBF
+MQswCQYDVQQGEwJBVTETMBEGA1UECAwKU29tZS1TdGF0ZTEhMB8GA1UECgwYSW50
+ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
+CgKCAQEAzUCFozgNb1h1M0jzNRSCjhOBnR+uVbVpaWfXYIR+AhWDdEe5ryY+Cgav
+Og8bfLybyzFdehlYdDRgkedEB/GjG8aJw06l0qF4jDOAw0kEygWCu2mcH7XOxRt+
+YAH3TVHa/Hu1W3WjzkobqqqLQ8gkKWWM27fOgAZ6GieaJBN6VBSMMcPey3HWLBmc
++TYJmv1dbaO2jHhKh8pfKw0W12VM8P1PIO8gv4Phu/uuJYieBWKixBEyy0lHjyix
+YFCR12xdh4CA47q958ZRGnnDUGFVE1QhgRacJCOZ9bd5t9mr8KLaVBYTCJo5ERE8
+jymab5dPqe5qKfJsCZiqWglbjUo9twIDAQABo1AwTjAdBgNVHQ4EFgQUxpuwcs/C
+YQOyui+r1G+3KxBNhxkwHwYDVR0jBBgwFoAUxpuwcs/CYQOyui+r1G+3KxBNhxkw
+DAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAAiWUKs/2x/viNCKi3Y6b
+lEuCtAGhzOOZ9EjrvJ8+COH3Rag3tVBWrcBZ3/uhhPq5gy9lqw4OkvEws99/5jFs
+X1FJ6MKBgqfuy7yh5s1YfM0ANHYczMmYpZeAcQf2CGAaVfwTTfSlzNLsF2lW/ly7
+yapFzlYSJLGoVE+OHEu8g5SlNACUEfkXw+5Eghh+KzlIN7R6Q7r2ixWNFBC/jWf7
+NKUfJyX8qIG5md1YUeT6GBW9Bm2/1/RiO24JTaYlfLdKK9TYb8sG5B+OLab2DImG
+99CJ25RkAcSobWNF5zD0O6lgOo3cEdB/ksCq3hmtlC/DlLZ/D8CJ+7VuZnS1rR2n
+aQ==
+-----END CERTIFICATE-----"""
+
+
+class TestSourceSAML(SeleniumTestCase):
+    """test SAML Source flow"""
+
+    def setUp(self):
+        super().setUp()
+        self.container = self.setup_client()
+
+    def setup_client(self) -> Container:
+        """Setup test IdP container"""
+        client: DockerClient = from_env()
+        container = client.containers.run(
+            image="kristophjunge/test-saml-idp",
+            detach=True,
+            network_mode="host",
+            auto_remove=True,
+            healthcheck=Healthcheck(
+                test=["CMD", "curl", "http://localhost:8080"],
+                interval=5 * 100 * 1000000,
+                start_period=1 * 100 * 1000000,
+            ),
+            environment={
+                "SIMPLESAMLPHP_SP_ENTITY_ID": "entity-id",
+                "SIMPLESAMLPHP_SP_ASSERTION_CONSUMER_SERVICE": (
+                    f"{self.live_server_url}/source/saml/saml-idp-test/acs/"
+                ),
+            },
+        )
+        while True:
+            container.reload()
+            status = container.attrs.get("State", {}).get("Health", {}).get("Status")
+            if status == "healthy":
+                return container
+            sleep(1)
+
+    def tearDown(self):
+        self.container.kill()
+        super().tearDown()
+
+    def test_idp_redirect(self):
+        """test SAML Source With redirect binding"""
+        sleep(1)
+        # Bootstrap all needed objects
+        authentication_flow = Flow.objects.get(slug="default-source-authentication")
+        enrollment_flow = Flow.objects.get(slug="default-source-enrollment")
+        keypair = CertificateKeyPair.objects.create(
+            name="test-idp-cert", certificate_data=IDP_CERT
+        )
+
+        SAMLSource.objects.create(
+            name="saml-idp-test",
+            slug="saml-idp-test",
+            authentication_flow=authentication_flow,
+            enrollment_flow=enrollment_flow,
+            issuer="entity-id",
+            sso_url="http://localhost:8080/simplesaml/saml2/idp/SSOService.php",
+            binding_type=SAMLBindingTypes.Redirect,
+            signing_kp=keypair,
+        )
+
+        self.driver.get(self.live_server_url)
+
+        self.wait.until(
+            ec.presence_of_element_located(
+                (By.CLASS_NAME, "pf-c-login__main-footer-links-item-link")
+            )
+        )
+        self.driver.find_element(
+            By.CLASS_NAME, "pf-c-login__main-footer-links-item-link"
+        ).click()
+
+        # Now we should be at the IDP, wait for the username field
+        self.wait.until(ec.presence_of_element_located((By.ID, "username")))
+        self.driver.find_element(By.ID, "username").send_keys("user1")
+        self.driver.find_element(By.ID, "password").send_keys("user1pass")
+        self.driver.find_element(By.ID, "password").send_keys(Keys.ENTER)
+
+        # Wait until we're logged in
+        self.wait.until(
+            ec.presence_of_element_located(
+                (By.XPATH, "//a[contains(@href, '/-/user/')]")
+            )
+        )
+        self.driver.find_element(By.XPATH, "//a[contains(@href, '/-/user/')]").click()
+
+        # Wait until we've loaded the user info page
+        self.wait.until(ec.presence_of_element_located((By.ID, "id_username")))
+        self.assertNotEqual(
+            self.driver.find_element(By.ID, "id_username").get_attribute("value"), ""
+        )
diff --git a/e2e/utils.py b/e2e/utils.py
new file mode 100644
index 000000000..64d46e84a
--- /dev/null
+++ b/e2e/utils.py
@@ -0,0 +1,107 @@
+"""passbook e2e testing utilities"""
+from functools import lru_cache
+from glob import glob
+from importlib.util import module_from_spec, spec_from_file_location
+from inspect import getmembers, isfunction
+from os import makedirs
+from time import time
+
+from Cryptodome.PublicKey import RSA
+from django.apps import apps
+from django.contrib.staticfiles.testing import StaticLiveServerTestCase
+from django.db import connection, transaction
+from django.db.utils import IntegrityError
+from django.shortcuts import reverse
+from selenium import webdriver
+from selenium.webdriver.common.desired_capabilities import DesiredCapabilities
+from selenium.webdriver.remote.webdriver import WebDriver
+from selenium.webdriver.support.ui import WebDriverWait
+from structlog import get_logger
+
+from passbook.core.models import User
+
+
+@lru_cache
+# pylint: disable=invalid-name
+def USER() -> User:  # noqa
+    """Cached function that always returns pbadmin"""
+    return User.objects.get(username="pbadmin")
+
+
+def ensure_rsa_key():
+    """Ensure that at least one RSAKey Object exists, create one if none exist"""
+    from oidc_provider.models import RSAKey
+
+    if not RSAKey.objects.exists():
+        key = RSA.generate(2048)
+        rsakey = RSAKey(key=key.exportKey("PEM").decode("utf8"))
+        rsakey.save()
+
+
+class SeleniumTestCase(StaticLiveServerTestCase):
+    """StaticLiveServerTestCase which automatically creates a Webdriver instance"""
+
+    def setUp(self):
+        super().setUp()
+        makedirs("selenium_screenshots/", exist_ok=True)
+        self.driver = self._get_driver()
+        self.driver.maximize_window()
+        self.driver.implicitly_wait(300)
+        self.wait = WebDriverWait(self.driver, 500)
+        self.apply_default_data()
+        self.logger = get_logger()
+
+    def _get_driver(self) -> WebDriver:
+        return webdriver.Remote(
+            command_executor="http://localhost:4444/wd/hub",
+            desired_capabilities=DesiredCapabilities.CHROME,
+        )
+
+    def tearDown(self):
+        self.driver.save_screenshot(
+            f"selenium_screenshots/{self.__class__.__name__}_{time()}.png"
+        )
+        for line in self.driver.get_log("browser"):
+            self.logger.warning(
+                line["message"], source=line["source"], level=line["level"]
+            )
+        self.driver.quit()
+        super().tearDown()
+
+    def wait_for_url(self, desired_url):
+        """Wait until URL is `desired_url`."""
+        self.wait.until(
+            lambda driver: driver.current_url == desired_url,
+            f"URL {self.driver.current_url} doesn't match expected URL {desired_url}",
+        )
+
+    def url(self, view, **kwargs) -> str:
+        """reverse `view` with `**kwargs` into full URL using live_server_url"""
+        return self.live_server_url + reverse(view, kwargs=kwargs)
+
+    def apply_default_data(self):
+        """apply objects created by migrations after tables have been truncated"""
+        # Find all migration files
+        # load all functions
+        migration_files = glob("**/migrations/*.py", recursive=True)
+        matches = []
+        for migration in migration_files:
+            with open(migration, "r+") as migration_file:
+                # Check if they have a `RunPython`
+                if "RunPython" in migration_file.read():
+                    matches.append(migration)
+
+        with connection.schema_editor() as schema_editor:
+            for match in matches:
+                # Load module from file path
+                spec = spec_from_file_location("", match)
+                migration_module = module_from_spec(spec)
+                # pyright: reportGeneralTypeIssues=false
+                spec.loader.exec_module(migration_module)
+                # Call all functions from module
+                for _, func in getmembers(migration_module, isfunction):
+                    with transaction.atomic():
+                        try:
+                            func(apps, schema_editor)
+                        except IntegrityError:
+                            pass
diff --git a/gatekeeper/Dockerfile b/gatekeeper/Dockerfile
index ff9e1c10a..85f0060f7 100644
--- a/gatekeeper/Dockerfile
+++ b/gatekeeper/Dockerfile
@@ -1,4 +1,4 @@
-FROM quay.io/pusher/oauth2_proxy
+FROM quay.io/oauth2-proxy/oauth2-proxy
 
 COPY templates /templates
 
diff --git a/helm/Chart.yaml b/helm/Chart.yaml
index 18fedc7cf..8ccea9c97 100644
--- a/helm/Chart.yaml
+++ b/helm/Chart.yaml
@@ -1,6 +1,6 @@
 apiVersion: v1
-appVersion: "0.8.15-beta"
+appVersion: "0.9.0-pre4"
 description: A Helm chart for passbook.
 name: passbook
-version: "0.8.15-beta"
+version: "0.9.0-pre4"
 icon: https://git.beryju.org/uploads/-/system/project/avatar/108/logo.png
diff --git a/helm/values.yaml b/helm/values.yaml
index 6e8c2c597..d5a8f36ba 100644
--- a/helm/values.yaml
+++ b/helm/values.yaml
@@ -2,7 +2,7 @@
 # This is a YAML-formatted file.
 # Declare variables to be passed into your templates.
 image:
-  tag: 0.8.15-beta
+  tag: 0.9.0-pre4
 
 nameOverride: ""
 
diff --git a/manage.py b/manage.py
index 5a70f4ada..8b16cf9a3 100755
--- a/manage.py
+++ b/manage.py
@@ -2,6 +2,7 @@
 """Django manage.py"""
 import os
 import sys
+
 from defusedxml import defuse_stdlib
 
 defuse_stdlib()
diff --git a/mkdocs.yml b/mkdocs.yml
index cb31d86a1..5753f3a6f 100644
--- a/mkdocs.yml
+++ b/mkdocs.yml
@@ -1,23 +1,43 @@
 site_name: passbook Docs
-site_url: https://beryju.github.io/passbook
+site_url: https://passbook.beryju.org/
 copyright: "Copyright &copy; 2019 - 2020 BeryJu.org"
 
 nav:
   - Home: index.md
+  - Terminology: terminology.md
   - Installation:
-    - Installation: installation/install.md
     - docker-compose: installation/docker-compose.md
     - Kubernetes: installation/kubernetes.md
+  - Flows:
+      Overview: flow/flows.md
+      Examples:
+        - Login: flow/examples/login.md
+  - Stages:
+      - Captcha Stage: flow/stages/captcha/index.md
+      - Dummy Stage: flow/stages/dummy/index.md
+      - Email Stage: flow/stages/email/index.md
+      - Identification Stage: flow/stages/identification/index.md
+      - Invitation Stage: flow/stages/invitation/index.md
+      - OTP Stage: flow/stages/otp/index.md
+      - Password Stage: flow/stages/password/index.md
+      - Prompt Stage: flow/stages/prompt/index.md
+      - Prompt Stage Validation: flow/stages/prompt/validation.md
+      - User Delete Stage: flow/stages/user_delete.md
+      - User Login Stage: flow/stages/user_login.md
+      - User Logout Stage: flow/stages/user_logout.md
+      - User Write Stage: flow/stages/user_write.md
   - Sources: sources.md
   - Providers: providers.md
+  - Expressions:
+    - Overview: expressions/index.md
+    - Reference:
+      - User Object: expressions/reference/user-object.md
   - Property Mappings:
     - Overview: property-mappings/index.md
-    - Reference:
-      - User Object: property-mappings/reference/user-object.md
-  - Factors: factors.md
+    - Expressions: property-mappings/expression.md
   - Policies:
     - Overview: policies/index.md
-    - Expression: policies/expression/index.md
+    - Expression: policies/expression.md
   - Integrations:
     - as Provider:
         - Amazon Web Services: integrations/services/aws/index.md
@@ -31,10 +51,23 @@ nav:
 repo_name: "BeryJu/passbook"
 repo_url: https://github.com/BeryJu/passbook
 theme:
-  name: "material"
-  logo: "images/logo.svg"
+  name: material
+  logo: images/logo.svg
+  favicon: images/logo.svg
+  palette:
+    scheme: slate
+    primary: white
 
 markdown_extensions:
   - toc:
       permalink: "¶"
   - admonition
+  - codehilite
+  - pymdownx.betterem:
+      smart_enable: all
+  - pymdownx.inlinehilite
+  - pymdownx.magiclink
+  - attr_list
+
+plugins:
+  - search
diff --git a/passbook/__init__.py b/passbook/__init__.py
index 1cb087b69..44c95ee92 100644
--- a/passbook/__init__.py
+++ b/passbook/__init__.py
@@ -1,2 +1,2 @@
 """passbook"""
-__version__ = "0.8.15-beta"
+__version__ = "0.9.0-pre4"
diff --git a/passbook/admin/forms/source.py b/passbook/admin/forms/source.py
index b18d7157a..2207dec1c 100644
--- a/passbook/admin/forms/source.py
+++ b/passbook/admin/forms/source.py
@@ -1,4 +1,17 @@
 """passbook core source form fields"""
 
-SOURCE_FORM_FIELDS = ["name", "slug", "enabled"]
-SOURCE_SERIALIZER_FIELDS = ["pk", "name", "slug", "enabled"]
+SOURCE_FORM_FIELDS = [
+    "name",
+    "slug",
+    "enabled",
+    "authentication_flow",
+    "enrollment_flow",
+]
+SOURCE_SERIALIZER_FIELDS = [
+    "pk",
+    "name",
+    "slug",
+    "enabled",
+    "authentication_flow",
+    "enrollment_flow",
+]
diff --git a/passbook/admin/templates/administration/application/list.html b/passbook/admin/templates/administration/application/list.html
index 1e44f4e58..dca760042 100644
--- a/passbook/admin/templates/administration/application/list.html
+++ b/passbook/admin/templates/administration/application/list.html
@@ -16,11 +16,13 @@
 <section class="pf-c-page__main-section pf-m-no-padding-mobile">
     <div class="pf-c-card">
         {% if object_list %}
-        <div class="pf-c-toolbar" id="page-layout-table-simple-toolbar-top">
-            <div class="pf-c-toolbar__bulk-select">
-                <a href="{% url 'passbook_admin:application-create' %}?back={{ request.get_full_path }}" class="pf-c-button pf-m-primary" type="button">{% trans 'Create' %}</a>
+        <div class="pf-c-toolbar">
+            <div class="pf-c-toolbar__content">
+                <div class="pf-c-toolbar__bulk-select">
+                    <a href="{% url 'passbook_admin:application-create' %}?back={{ request.get_full_path }}" class="pf-c-button pf-m-primary" type="button">{% trans 'Create' %}</a>
+                </div>
+                {% include 'partials/pagination.html' %}
             </div>
-            {% include 'partials/pagination.html' %}
         </div>
         <table class="pf-c-table pf-m-compact pf-m-grid-xl" role="grid">
             <thead>
@@ -65,14 +67,16 @@
         </div>
         {% else %}
         <div class="pf-c-empty-state">
-            <i class="fas fa-cubes pf-c-empty-state__icon" aria-hidden="true"></i>
-            <h1 class="pf-c-title pf-m-lg">
-                {% trans 'No Applications.' %}
-            </h1>
-            <div class="pf-c-empty-state__body">
-                {% trans 'Currently no applications exist. Click the button below to create one.' %}
+            <div class="pf-c-empty-state__content">
+                <i class="fas fa-cubes pf-c-empty-state__icon" aria-hidden="true"></i>
+                <h1 class="pf-c-title pf-m-lg">
+                    {% trans 'No Applications.' %}
+                </h1>
+                <div class="pf-c-empty-state__body">
+                    {% trans 'Currently no applications exist. Click the button below to create one.' %}
+                </div>
+                <a href="{% url 'passbook_admin:application-create' %}?back={{ request.get_full_path }}" class="pf-c-button pf-m-primary" type="button">{% trans 'Create' %}</a>
             </div>
-            <a href="{% url 'passbook_admin:application-create' %}?back={{ request.get_full_path }}" class="pf-c-button pf-m-primary" type="button">{% trans 'Create' %}</a>
         </div>
         {% endif %}
     </div>
diff --git a/passbook/admin/templates/administration/base.html b/passbook/admin/templates/administration/base.html
index 7c4ccc5f7..cfcd243f3 100644
--- a/passbook/admin/templates/administration/base.html
+++ b/passbook/admin/templates/administration/base.html
@@ -14,7 +14,7 @@
 <link rel="stylesheet" href="{% static 'node_modules/codemirror/theme/monokai.css' %}">
 <script src="{% static 'node_modules/codemirror/mode/xml/xml.js' %}"></script>
 <script src="{% static 'node_modules/codemirror/mode/yaml/yaml.js' %}"></script>
-<script src="{% static 'node_modules/codemirror/mode/jinja2/jinja2.js' %}"></script>
+<script src="{% static 'node_modules/codemirror/mode/python/python.js' %}"></script>
 {% endblock %}
 
 {% block page_content %}
@@ -122,15 +122,21 @@
                         {% trans 'Certificates' %}
                     </a>
                 </li>
+                <li class="pf-c-nav__item">
+                    <a href="{% url 'passbook_admin:tokens' %}"
+                        class="pf-c-nav__link {% is_active 'passbook_admin:tokens' 'passbook_admin:token-delete' %}">
+                        {% trans 'Tokens' %}
+                    </a>
+                </li>
                 <li class="pf-c-nav__item">
                     <a href="{% url 'passbook_admin:users' %}"
-                        class="pf-c-nav__link {% is_active 'passbook_admin:users' 'passbook_admin:user-update' 'passbook_admin:user-delete' %}">
+                        class="pf-c-nav__link {% is_active 'passbook_admin:users' 'passbook_admin:user-create' 'passbook_admin:user-update' 'passbook_admin:user-delete' %}">
                         {% trans 'Users' %}
                     </a>
                 </li>
                 <li class="pf-c-nav__item">
                     <a href="{% url 'passbook_admin:groups' %}"
-                        class="pf-c-nav__link {% is_active 'passbook_admin:groups' 'passbook_admin:group-update' 'passbook_admin:group-delete' %}">
+                        class="pf-c-nav__link {% is_active 'passbook_admin:groups' 'passbook_admin:group-create' 'passbook_admin:group-update' 'passbook_admin:group-delete' %}">
                         {% trans 'Groups' %}
                     </a>
                 </li>
diff --git a/passbook/admin/templates/administration/certificatekeypair/list.html b/passbook/admin/templates/administration/certificatekeypair/list.html
index 265547ca3..d009495dc 100644
--- a/passbook/admin/templates/administration/certificatekeypair/list.html
+++ b/passbook/admin/templates/administration/certificatekeypair/list.html
@@ -16,11 +16,13 @@
 <section class="pf-c-page__main-section pf-m-no-padding-mobile">
     <div class="pf-c-card">
         {% if object_list %}
-        <div class="pf-c-toolbar" id="page-layout-table-simple-toolbar-top">
-            <div class="pf-c-toolbar__bulk-select">
-                <a href="{% url 'passbook_admin:certificatekeypair-create' %}?back={{ request.get_full_path }}" class="pf-c-button pf-m-primary" type="button">{% trans 'Create' %}</a>
+        <div class="pf-c-toolbar">
+            <div class="pf-c-toolbar__content">
+                <div class="pf-c-toolbar__bulk-select">
+                    <a href="{% url 'passbook_admin:certificatekeypair-create' %}?back={{ request.get_full_path }}" class="pf-c-button pf-m-primary" type="button">{% trans 'Create' %}</a>
+                </div>
+                {% include 'partials/pagination.html' %}
             </div>
-            {% include 'partials/pagination.html' %}
         </div>
         <table class="pf-c-table pf-m-compact pf-m-grid-xl" role="grid">
             <thead>
@@ -67,14 +69,16 @@
         </div>
         {% else %}
         <div class="pf-c-empty-state">
-            <i class="fas fa-cubes pf-c-empty-state__icon" aria-hidden="true"></i>
-            <h1 class="pf-c-title pf-m-lg">
-                {% trans 'No Certificates.' %}
-            </h1>
-            <div class="pf-c-empty-state__body">
-                {% trans 'Currently no certificates exist. Click the button below to create one.' %}
+            <div class="pf-c-empty-state__content">
+                <i class="fas fa-cubes pf-c-empty-state__icon" aria-hidden="true"></i>
+                <h1 class="pf-c-title pf-m-lg">
+                    {% trans 'No Certificates.' %}
+                </h1>
+                <div class="pf-c-empty-state__body">
+                    {% trans 'Currently no certificates exist. Click the button below to create one.' %}
+                </div>
+                <a href="{% url 'passbook_admin:certificatekeypair-create' %}?back={{ request.get_full_path }}" class="pf-c-button pf-m-primary" type="button">{% trans 'Create' %}</a>
             </div>
-            <a href="{% url 'passbook_admin:certificatekeypair-create' %}?back={{ request.get_full_path }}" class="pf-c-button pf-m-primary" type="button">{% trans 'Create' %}</a>
         </div>
         {% endif %}
     </div>
diff --git a/passbook/admin/templates/administration/flow/list.html b/passbook/admin/templates/administration/flow/list.html
index 9ee4e95c4..0956ead3f 100644
--- a/passbook/admin/templates/administration/flow/list.html
+++ b/passbook/admin/templates/administration/flow/list.html
@@ -16,16 +16,18 @@
 <section class="pf-c-page__main-section pf-m-no-padding-mobile">
     <div class="pf-c-card">
         {% if object_list %}
-        <div class="pf-c-toolbar" id="page-layout-table-simple-toolbar-top">
-            <div class="pf-c-toolbar__bulk-select">
-                <a href="{% url 'passbook_admin:flow-create' %}?back={{ request.get_full_path }}" class="pf-c-button pf-m-primary" type="button">{% trans 'Create' %}</a>
+        <div class="pf-c-toolbar">
+            <div class="pf-c-toolbar__content">
+                <div class="pf-c-toolbar__bulk-select">
+                    <a href="{% url 'passbook_admin:flow-create' %}?back={{ request.get_full_path }}" class="pf-c-button pf-m-primary" type="button">{% trans 'Create' %}</a>
+                </div>
+                {% include 'partials/pagination.html' %}
             </div>
-            {% include 'partials/pagination.html' %}
         </div>
         <table class="pf-c-table pf-m-compact pf-m-grid-xl" role="grid">
             <thead>
                 <tr role="row">
-                    <th role="columnheader" scope="col">{% trans 'Name' %}</th>
+                    <th role="columnheader" scope="col">{% trans 'Identifier' %}</th>
                     <th role="columnheader" scope="col">{% trans 'Designation' %}</th>
                     <th role="columnheader" scope="col">{% trans 'Stages' %}</th>
                     <th role="columnheader" scope="col">{% trans 'Policies' %}</th>
@@ -37,8 +39,8 @@
                 <tr role="row">
                     <th role="columnheader">
                         <div>
-                            <div>{{ flow.name }}</div>
-                            <small>{{ flow.slug }}</small>
+                            <div>{{ flow.slug }}</div>
+                            <small>{{ flow.name }}</small>
                         </div>
                     </th>
                     <td role="cell">
@@ -59,6 +61,7 @@
                     <td>
                         <a class="pf-c-button pf-m-secondary" href="{% url 'passbook_admin:flow-update' pk=flow.pk %}?back={{ request.get_full_path }}">{% trans 'Edit' %}</a>
                         <a class="pf-c-button pf-m-danger" href="{% url 'passbook_admin:flow-delete' pk=flow.pk %}?back={{ request.get_full_path }}">{% trans 'Delete' %}</a>
+                        <a class="pf-c-button pf-m-secondary" href="{% url 'passbook_admin:flow-execute' pk=flow.pk %}?next={{ request.get_full_path }}">{% trans 'Execute' %}</a>
                     </td>
                 </tr>
                 {% endfor %}
@@ -69,15 +72,16 @@
         </div>
         {% else %}
         <div class="pf-c-empty-state">
-            <i class="fas fa-cubes pf-c-empty-state__icon" aria-hidden="true"></i>
-            <h1 class="pf-c-title pf-m-lg">
-                {% trans 'No Flows.' %}
-            </h1>
-            <div class="pf-c-empty-state__body">
-                {% trans 'Currently no flows exist. Click the button below to create one.' %}
+            <div class="pf-c-empty-state__content">
+                <i class="fas fa-cubes pf-c-empty-state__icon" aria-hidden="true"></i>
+                <h1 class="pf-c-title pf-m-lg">
+                    {% trans 'No Flows.' %}
+                </h1>
+                <div class="pf-c-empty-state__body">
+                    {% trans 'Currently no flows exist. Click the button below to create one.' %}
+                </div>
+                <a href="{% url 'passbook_admin:flow-create' %}?back={{ request.get_full_path }}" class="pf-c-button pf-m-primary" type="button">{% trans 'Create' %}</a>
             </div>
-            <a href="{% url 'passbook_admin:flow-create' %}?back={{ request.get_full_path }}"
-                class="pf-c-button pf-m-primary" type="button">{% trans 'Create' %}</a>
         </div>
         {% endif %}
     </div>
diff --git a/passbook/admin/templates/administration/group/list.html b/passbook/admin/templates/administration/group/list.html
index 77a80773a..c9ddbc929 100644
--- a/passbook/admin/templates/administration/group/list.html
+++ b/passbook/admin/templates/administration/group/list.html
@@ -17,12 +17,14 @@
 <section class="pf-c-page__main-section pf-m-no-padding-mobile">
     <div class="pf-c-card">
         {% if object_list %}
-        <div class="pf-c-toolbar" id="page-layout-table-simple-toolbar-top">
-            <div class="pf-c-toolbar__bulk-select">
-                <a href="{% url 'passbook_admin:group-create' %}?back={{ request.get_full_path }}"
-                    class="pf-c-button pf-m-primary" type="button">{% trans 'Create' %}</a>
+        <div class="pf-c-toolbar">
+            <div class="pf-c-toolbar__content">
+                <div class="pf-c-toolbar__bulk-select">
+                    <a href="{% url 'passbook_admin:group-create' %}?back={{ request.get_full_path }}"
+                        class="pf-c-button pf-m-primary" type="button">{% trans 'Create' %}</a>
+                </div>
+                {% include 'partials/pagination.html' %}
             </div>
-            {% include 'partials/pagination.html' %}
         </div>
         <table class="pf-c-table pf-m-compact pf-m-grid-xl" role="grid">
             <thead>
@@ -64,14 +66,16 @@
         </div>
         {% else %}
         <div class="pf-c-empty-state">
-            <i class="fas fa-cubes pf-c-empty-state__icon" aria-hidden="true"></i>
-            <h1 class="pf-c-title pf-m-lg">
-                {% trans 'No Groups.' %}
-            </h1>
-            <div class="pf-c-empty-state__body">
-                {% trans 'Currently no group exist. Click the button below to create one.' %}
+            <div class="pf-c-empty-state__content">
+                <i class="fas fa-cubes pf-c-empty-state__icon" aria-hidden="true"></i>
+                <h1 class="pf-c-title pf-m-lg">
+                    {% trans 'No Groups.' %}
+                </h1>
+                <div class="pf-c-empty-state__body">
+                    {% trans 'Currently no group exist. Click the button below to create one.' %}
+                </div>
+                <a href="{% url 'passbook_admin:group-create' %}?back={{ request.get_full_path }}" class="pf-c-button pf-m-primary" type="button">{% trans 'Create' %}</a>
             </div>
-            <a href="{% url 'passbook_admin:group-create' %}?back={{ request.get_full_path }}" class="pf-c-button pf-m-primary" type="button">{% trans 'Create' %}</a>
         </div>
         {% endif %}
     </div>
diff --git a/passbook/admin/templates/administration/overview.html b/passbook/admin/templates/administration/overview.html
index 21dcb8906..1c4cd1a4f 100644
--- a/passbook/admin/templates/administration/overview.html
+++ b/passbook/admin/templates/administration/overview.html
@@ -11,8 +11,8 @@
 <section class="pf-c-page__main-section">
     <div class="pf-l-gallery pf-m-gutter">
         <a href="{% url 'passbook_admin:applications' %}" class="pf-c-card pf-m-hoverable pf-m-compact">
-            <div class="pf-c-card__head">
-                <div class="pf-c-card__head-main">
+            <div class="pf-c-card__header">
+                <div class="pf-c-card__header-main">
                     <i class="pf-icon pf-icon-applications"></i> {% trans 'Applications' %}
                 </div>
             </div>
@@ -22,8 +22,8 @@
         </a>
 
         <a href="{% url 'passbook_admin:sources' %}" class="pf-c-card pf-m-hoverable pf-m-compact">
-            <div class="pf-c-card__head">
-                <div class="pf-c-card__head-main">
+            <div class="pf-c-card__header">
+                <div class="pf-c-card__header-main">
                     <i class="pf-icon pf-icon-middleware"></i> {% trans 'Sources' %}
                 </div>
             </div>
@@ -33,8 +33,8 @@
         </a>
 
         <a href="{% url 'passbook_admin:providers' %}" class="pf-c-card pf-m-hoverable pf-m-compact">
-            <div class="pf-c-card__head">
-                <div class="pf-c-card__head-main">
+            <div class="pf-c-card__header">
+                <div class="pf-c-card__header-main">
                     <i class="pf-icon pf-icon-plugged"></i> {% trans 'Providers' %}
                 </div>
             </div>
@@ -49,8 +49,8 @@
         </a>
 
         <a href="{% url 'passbook_admin:stages' %}" class="pf-c-card pf-m-hoverable pf-m-compact">
-            <div class="pf-c-card__head">
-                <div class="pf-c-card__head-main">
+            <div class="pf-c-card__header">
+                <div class="pf-c-card__header-main">
                     <i class="pf-icon pf-icon-plugged"></i> {% trans 'Stages' %}
                 </div>
             </div>
@@ -65,8 +65,8 @@
         </a>
 
         <a href="{% url 'passbook_admin:stages' %}" class="pf-c-card pf-m-hoverable pf-m-compact">
-            <div class="pf-c-card__head">
-                <div class="pf-c-card__head-main">
+            <div class="pf-c-card__header">
+                <div class="pf-c-card__header-main">
                     <i class="pf-icon pf-icon-topology"></i> {% trans 'Flows' %}
                 </div>
             </div>
@@ -76,8 +76,8 @@
         </a>
 
         <a href="{% url 'passbook_admin:policies' %}" class="pf-c-card pf-m-hoverable pf-m-compact">
-            <div class="pf-c-card__head">
-                <div class="pf-c-card__head-main">
+            <div class="pf-c-card__header">
+                <div class="pf-c-card__header-main">
                     <i class="pf-icon pf-icon-infrastructure"></i> {% trans 'Policies' %}
                 </div>
             </div>
@@ -92,8 +92,8 @@
         </a>
 
         <a href="{% url 'passbook_admin:stage-invitations' %}" class="pf-c-card pf-m-hoverable pf-m-compact">
-            <div class="pf-c-card__head">
-                <div class="pf-c-card__head-main">
+            <div class="pf-c-card__header">
+                <div class="pf-c-card__header-main">
                     <i class="pf-icon pf-icon-migration"></i> {% trans 'Invitation' %}
                 </div>
             </div>
@@ -103,8 +103,8 @@
         </a>
 
         <a href="{% url 'passbook_admin:users' %}" class="pf-c-card pf-m-hoverable pf-m-compact">
-            <div class="pf-c-card__head">
-                <div class="pf-c-card__head-main">
+            <div class="pf-c-card__header">
+                <div class="pf-c-card__header-main">
                     <i class="pf-icon pf-icon-user"></i> {% trans 'Users' %}
                 </div>
             </div>
@@ -114,19 +114,29 @@
         </a>
 
         <div class="pf-c-card pf-m-hoverable pf-m-compact">
-            <div class="pf-c-card__head">
-                <div class="pf-c-card__head-main">
+            <div class="pf-c-card__header">
+                <div class="pf-c-card__header-main">
                     <i class="pf-icon pf-icon-bundle"></i> {% trans 'Version' %}
                 </div>
             </div>
             <div class="pf-c-card__body">
-                <i class="pf-icon pf-icon-ok"></i> {{ version }}
+                {% if version >= version_latest %}
+                <i class="pf-icon pf-icon-ok"></i>
+                    {% blocktrans with version=version %}
+                    {{ version }} (Up-to-date!)
+                    {% endblocktrans %}
+                {% else %}
+                <i class="pf-icon pf-icon-warning-triangle"></i>
+                    {% blocktrans with version=version latest=version_latest %}
+                    {{ version }} ({{ latest }} is available!)
+                    {% endblocktrans %}
+                {% endif %}
             </div>
         </div>
 
         <div class="pf-c-card pf-m-hoverable pf-m-compact">
-            <div class="pf-c-card__head">
-                <div class="pf-c-card__head-main">
+            <div class="pf-c-card__header">
+                <div class="pf-c-card__header-main">
                     <i class="pf-icon pf-icon-server"></i> {% trans 'Workers' %}
                 </div>
             </div>
@@ -141,8 +151,8 @@
         </div>
 
         <a class="pf-c-card pf-m-hoverable pf-m-compact" data-target="modal" data-modal="clearCacheModalRoot">
-            <div class="pf-c-card__head">
-                <div class="pf-c-card__head-main">
+            <div class="pf-c-card__header">
+                <div class="pf-c-card__header-main">
                     <i class="pf-icon pf-icon-server"></i> {% trans 'Cached Policies' %}
                 </div>
             </div>
diff --git a/passbook/admin/templates/administration/policy/list.html b/passbook/admin/templates/administration/policy/list.html
index 198d04dc6..bcbd15e50 100644
--- a/passbook/admin/templates/administration/policy/list.html
+++ b/passbook/admin/templates/administration/policy/list.html
@@ -16,28 +16,30 @@
 <section class="pf-c-page__main-section pf-m-no-padding-mobile">
     <div class="pf-c-card">
         {% if object_list %}
-        <div class="pf-c-toolbar" id="page-layout-table-simple-toolbar-top">
-            <div class="pf-c-toolbar__bulk-select">
-                <div class="pf-c-dropdown">
-                    <button class="pf-m-primary pf-c-dropdown__toggle" type="button">
-                        <span class="pf-c-dropdown__toggle-text">{% trans 'Create' %}</span>
-                        <i class="fas fa-caret-down pf-c-dropdown__toggle-icon" aria-hidden="true"></i>
-                    </button>
-                    <ul class="pf-c-dropdown__menu" hidden>
-                        {% for type, name in types.items %}
-                        <li>
-                            <a class="pf-c-dropdown__menu-item" href="{% url 'passbook_admin:policy-create' %}?type={{ type }}&back={{ request.get_full_path }}">
-                                {{ name|verbose_name }}<br>
-                                <small>
-                                    {{ name|doc }}
-                                </small>
-                            </a>
-                        </li>
-                        {% endfor %}
-                    </ul>
+        <div class="pf-c-toolbar">
+            <div class="pf-c-toolbar__content">
+                <div class="pf-c-toolbar__bulk-select">
+                    <div class="pf-c-dropdown">
+                        <button class="pf-m-primary pf-c-dropdown__toggle" type="button">
+                            <span class="pf-c-dropdown__toggle-text">{% trans 'Create' %}</span>
+                            <i class="fas fa-caret-down pf-c-dropdown__toggle-icon" aria-hidden="true"></i>
+                        </button>
+                        <ul class="pf-c-dropdown__menu" hidden>
+                            {% for type, name in types.items %}
+                            <li>
+                                <a class="pf-c-dropdown__menu-item" href="{% url 'passbook_admin:policy-create' %}?type={{ type }}&back={{ request.get_full_path }}">
+                                    {{ name|verbose_name }}<br>
+                                    <small>
+                                        {{ name|doc }}
+                                    </small>
+                                </a>
+                            </li>
+                            {% endfor %}
+                        </ul>
+                    </div>
                 </div>
+                {% include 'partials/pagination.html' %}
             </div>
-            {% include 'partials/pagination.html' %}
         </div>
         <table class="pf-c-table pf-m-compact pf-m-grid-xl" role="grid">
             <thead>
@@ -81,31 +83,33 @@
         </div>
         {% else %}
         <div class="pf-c-empty-state">
-            <i class="fas fa-cubes pf-c-empty-state__icon" aria-hidden="true"></i>
-            <h1 class="pf-c-title pf-m-lg">
-                {% trans 'No Policies.' %}
-            </h1>
-            <div class="pf-c-empty-state__body">
-                {% trans 'Currently no policies exist. Click the button below to create one.' %}
-            </div>
-            <div class="pf-c-dropdown">
-                <button class="pf-m-primary pf-c-dropdown__toggle" type="button">
-                    <span class="pf-c-dropdown__toggle-text">{% trans 'Create' %}</span>
-                    <i class="fas fa-caret-down pf-c-dropdown__toggle-icon" aria-hidden="true"></i>
-                </button>
-                <ul class="pf-c-dropdown__menu" hidden>
-                    {% for type, name in types.items %}
-                    <li>
-                        <a class="pf-c-dropdown__menu-item"
-                            href="{% url 'passbook_admin:policy-create' %}?type={{ type }}&back={{ request.get_full_path }}">
-                            {{ name|verbose_name }}<br>
-                            <small>
-                                {{ name|doc }}
-                            </small>
-                        </a>
-                    </li>
-                    {% endfor %}
-                </ul>
+            <div class="pf-c-empty-state__content">
+                <i class="fas fa-cubes pf-c-empty-state__icon" aria-hidden="true"></i>
+                <h1 class="pf-c-title pf-m-lg">
+                    {% trans 'No Policies.' %}
+                </h1>
+                <div class="pf-c-empty-state__body">
+                    {% trans 'Currently no policies exist. Click the button below to create one.' %}
+                </div>
+                <div class="pf-c-dropdown">
+                    <button class="pf-m-primary pf-c-dropdown__toggle" type="button">
+                        <span class="pf-c-dropdown__toggle-text">{% trans 'Create' %}</span>
+                        <i class="fas fa-caret-down pf-c-dropdown__toggle-icon" aria-hidden="true"></i>
+                    </button>
+                    <ul class="pf-c-dropdown__menu" hidden>
+                        {% for type, name in types.items %}
+                        <li>
+                            <a class="pf-c-dropdown__menu-item"
+                                href="{% url 'passbook_admin:policy-create' %}?type={{ type }}&back={{ request.get_full_path }}">
+                                {{ name|verbose_name }}<br>
+                                <small>
+                                    {{ name|doc }}
+                                </small>
+                            </a>
+                        </li>
+                        {% endfor %}
+                    </ul>
+                </div>
             </div>
         </div>
         {% endif %}
diff --git a/passbook/admin/templates/administration/policybinding/list.html b/passbook/admin/templates/administration/policybinding/list.html
index 173c56349..fc84753ae 100644
--- a/passbook/admin/templates/administration/policybinding/list.html
+++ b/passbook/admin/templates/administration/policybinding/list.html
@@ -16,12 +16,14 @@
 <section class="pf-c-page__main-section pf-m-no-padding-mobile">
     <div class="pf-c-card">
         {% if object_list %}
-        <div class="pf-c-toolbar" id="page-layout-table-simple-toolbar-top">
-            <div class="pf-c-toolbar__bulk-select">
-                <a href="{% url 'passbook_admin:policy-binding-create' %}?back={{ request.get_full_path }}"
-                    class="pf-c-button pf-m-primary" type="button">{% trans 'Create' %}</a>
+        <div class="pf-c-toolbar">
+            <div class="pf-c-toolbar__content">
+                <div class="pf-c-toolbar__bulk-select">
+                    <a href="{% url 'passbook_admin:policy-binding-create' %}?back={{ request.get_full_path }}"
+                        class="pf-c-button pf-m-primary" type="button">{% trans 'Create' %}</a>
+                </div>
+                {% include 'partials/pagination.html' %}
             </div>
-            {% include 'partials/pagination.html' %}
         </div>
         <table class="pf-c-table pf-m-compact pf-m-grid-xl" role="grid">
             <thead>
@@ -57,14 +59,16 @@
         </div>
         {% else %}
         <div class="pf-c-empty-state">
-            <i class="fas fa-cubes pf-c-empty-state__icon" aria-hidden="true"></i>
-            <h1 class="pf-c-title pf-m-lg">
-                {% trans 'No Policy Bindings.' %}
-            </h1>
-            <div class="pf-c-empty-state__body">
-                {% trans 'Currently no policy bindings exist. Click the button below to create one.' %}
+            <div class="pf-c-empty-state__content">
+                <i class="fas fa-cubes pf-c-empty-state__icon" aria-hidden="true"></i>
+                <h1 class="pf-c-title pf-m-lg">
+                    {% trans 'No Policy Bindings.' %}
+                </h1>
+                <div class="pf-c-empty-state__body">
+                    {% trans 'Currently no policy bindings exist. Click the button below to create one.' %}
+                </div>
+                <a href="{% url 'passbook_admin:policy-binding-create' %}?back={{ request.get_full_path }}" class="pf-c-button pf-m-primary" type="button">{% trans 'Create' %}</a>
             </div>
-            <a href="{% url 'passbook_admin:policy-binding-create' %}?back={{ request.get_full_path }}" class="pf-c-button pf-m-primary" type="button">{% trans 'Create' %}</a>
         </div>
         {% endif %}
     </div>
diff --git a/passbook/admin/templates/administration/property_mapping/list.html b/passbook/admin/templates/administration/property_mapping/list.html
index 00d674870..0e3ea5314 100644
--- a/passbook/admin/templates/administration/property_mapping/list.html
+++ b/passbook/admin/templates/administration/property_mapping/list.html
@@ -17,29 +17,31 @@
 <section class="pf-c-page__main-section pf-m-no-padding-mobile">
     <div class="pf-c-card">
         {% if object_list %}
-        <div class="pf-c-toolbar" id="page-layout-table-simple-toolbar-top">
-            <div class="pf-c-toolbar__bulk-select">
-                <div class="pf-c-dropdown">
-                    <button class="pf-m-primary pf-c-dropdown__toggle" type="button">
-                        <span class="pf-c-dropdown__toggle-text">{% trans 'Create' %}</span>
-                        <i class="fas fa-caret-down pf-c-dropdown__toggle-icon" aria-hidden="true"></i>
-                    </button>
-                    <ul class="pf-c-dropdown__menu" hidden>
-                        {% for type, name in types.items %}
-                        <li>
-                            <a class="pf-c-dropdown__menu-item"
-                                href="{% url 'passbook_admin:property-mapping-create' %}?type={{ type }}&back={{ request.get_full_path }}">
-                                {{ name|verbose_name }}<br>
-                                <small>
-                                    {{ name|doc }}
-                                </small>
-                            </a>
-                        </li>
-                        {% endfor %}
-                    </ul>
+        <div class="pf-c-toolbar">
+            <div class="pf-c-toolbar__content">
+                <div class="pf-c-toolbar__bulk-select">
+                    <div class="pf-c-dropdown">
+                        <button class="pf-m-primary pf-c-dropdown__toggle" type="button">
+                            <span class="pf-c-dropdown__toggle-text">{% trans 'Create' %}</span>
+                            <i class="fas fa-caret-down pf-c-dropdown__toggle-icon" aria-hidden="true"></i>
+                        </button>
+                        <ul class="pf-c-dropdown__menu" hidden>
+                            {% for type, name in types.items %}
+                            <li>
+                                <a class="pf-c-dropdown__menu-item"
+                                    href="{% url 'passbook_admin:property-mapping-create' %}?type={{ type }}&back={{ request.get_full_path }}">
+                                    {{ name|verbose_name }}<br>
+                                    <small>
+                                        {{ name|doc }}
+                                    </small>
+                                </a>
+                            </li>
+                            {% endfor %}
+                        </ul>
+                    </div>
                 </div>
+                {% include 'partials/pagination.html' %}
             </div>
-            {% include 'partials/pagination.html' %}
         </div>
         <table class="pf-c-table pf-m-compact pf-m-grid-xl" role="grid">
             <thead>
@@ -75,31 +77,33 @@
         </div>
         {% else %}
         <div class="pf-c-empty-state">
-            <i class="fas fa-cubes pf-c-empty-state__icon" aria-hidden="true"></i>
-            <h1 class="pf-c-title pf-m-lg">
-                {% trans 'No Property Mappings.' %}
-            </h1>
-            <div class="pf-c-empty-state__body">
-                {% trans 'Currently no property mappings exist. Click the button below to create one.' %}
-            </div>
-            <div class="pf-c-dropdown">
-                <button class="pf-m-primary pf-c-dropdown__toggle" type="button">
-                    <span class="pf-c-dropdown__toggle-text">{% trans 'Create' %}</span>
-                    <i class="fas fa-caret-down pf-c-dropdown__toggle-icon" aria-hidden="true"></i>
-                </button>
-                <ul class="pf-c-dropdown__menu" hidden>
-                    {% for type, name in types.items %}
-                    <li>
-                        <a class="pf-c-dropdown__menu-item"
-                            href="{% url 'passbook_admin:property-mapping-create' %}?type={{ type }}&back={{ request.get_full_path }}">
-                            {{ name|verbose_name }}<br>
-                            <small>
-                                {{ name|doc }}
-                            </small>
-                        </a>
-                    </li>
-                    {% endfor %}
-                </ul>
+            <div class="pf-c-empty-state__content">
+                <i class="fas fa-cubes pf-c-empty-state__icon" aria-hidden="true"></i>
+                <h1 class="pf-c-title pf-m-lg">
+                    {% trans 'No Property Mappings.' %}
+                </h1>
+                <div class="pf-c-empty-state__body">
+                    {% trans 'Currently no property mappings exist. Click the button below to create one.' %}
+                </div>
+                <div class="pf-c-dropdown">
+                    <button class="pf-m-primary pf-c-dropdown__toggle" type="button">
+                        <span class="pf-c-dropdown__toggle-text">{% trans 'Create' %}</span>
+                        <i class="fas fa-caret-down pf-c-dropdown__toggle-icon" aria-hidden="true"></i>
+                    </button>
+                    <ul class="pf-c-dropdown__menu" hidden>
+                        {% for type, name in types.items %}
+                        <li>
+                            <a class="pf-c-dropdown__menu-item"
+                                href="{% url 'passbook_admin:property-mapping-create' %}?type={{ type }}&back={{ request.get_full_path }}">
+                                {{ name|verbose_name }}<br>
+                                <small>
+                                    {{ name|doc }}
+                                </small>
+                            </a>
+                        </li>
+                        {% endfor %}
+                    </ul>
+                </div>
             </div>
         </div>
         {% endif %}
diff --git a/passbook/admin/templates/administration/provider/list.html b/passbook/admin/templates/administration/provider/list.html
index 9ae3a7f20..95cc490e4 100644
--- a/passbook/admin/templates/administration/provider/list.html
+++ b/passbook/admin/templates/administration/provider/list.html
@@ -18,28 +18,30 @@
 <section class="pf-c-page__main-section pf-m-no-padding-mobile">
     <div class="pf-c-card">
         {% if object_list %}
-        <div class="pf-c-toolbar" id="page-layout-table-simple-toolbar-top">
-            <div class="pf-c-toolbar__bulk-select">
-                <div class="pf-c-dropdown">
-                    <button class="pf-m-primary pf-c-dropdown__toggle" type="button">
-                        <span class="pf-c-dropdown__toggle-text">{% trans 'Create' %}</span>
-                        <i class="fas fa-caret-down pf-c-dropdown__toggle-icon" aria-hidden="true"></i>
-                    </button>
-                    <ul class="pf-c-dropdown__menu" hidden>
-                        {% for type, name in types.items %}
-                        <li>
-                            <a class="pf-c-dropdown__menu-item" href="{% url 'passbook_admin:provider-create' %}?type={{ type }}&back={{ request.get_full_path }}">
-                                {{ name|verbose_name }}
-                                <small>
-                                    {{ name|doc }}
-                                </small>
-                            </a>
-                        </li>
-                        {% endfor %}
-                    </ul>
+        <div class="pf-c-toolbar">
+            <div class="pf-c-toolbar__content">
+                <div class="pf-c-toolbar__bulk-select">
+                    <div class="pf-c-dropdown">
+                        <button class="pf-m-primary pf-c-dropdown__toggle" type="button">
+                            <span class="pf-c-dropdown__toggle-text">{% trans 'Create' %}</span>
+                            <i class="fas fa-caret-down pf-c-dropdown__toggle-icon" aria-hidden="true"></i>
+                        </button>
+                        <ul class="pf-c-dropdown__menu" hidden>
+                            {% for type, name in types.items %}
+                            <li>
+                                <a class="pf-c-dropdown__menu-item" href="{% url 'passbook_admin:provider-create' %}?type={{ type }}&back={{ request.get_full_path }}">
+                                    {{ name|verbose_name }}<br>
+                                    <small>
+                                        {{ name|doc }}
+                                    </small>
+                                </a>
+                            </li>
+                            {% endfor %}
+                        </ul>
+                    </div>
                 </div>
+                {% include 'partials/pagination.html' %}
             </div>
-            {% include 'partials/pagination.html' %}
         </div>
         <table class="pf-c-table pf-m-compact pf-m-grid-xl" role="grid">
             <thead>
@@ -94,30 +96,32 @@
         </div>
         {% else %}
         <div class="pf-c-empty-state">
-            <i class="fas fa-cubes pf-c-empty-state__icon" aria-hidden="true"></i>
-            <h1 class="pf-c-title pf-m-lg">
-                {% trans 'No Providers.' %}
-            </h1>
-            <div class="pf-c-empty-state__body">
-                {% trans 'Currently no providers exist. Click the button below to create one.' %}
-            </div>
-            <div class="pf-c-dropdown">
-                <button class="pf-m-primary pf-c-dropdown__toggle" type="button">
-                    <span class="pf-c-dropdown__toggle-text">{% trans 'Create' %}</span>
-                    <i class="fas fa-caret-down pf-c-dropdown__toggle-icon" aria-hidden="true"></i>
-                </button>
-                <ul class="pf-c-dropdown__menu" hidden>
-                    {% for type, name in types.items %}
-                    <li>
-                        <a class="pf-c-dropdown__menu-item" href="{% url 'passbook_admin:provider-create' %}?type={{ type }}&back={{ request.get_full_path }}">
-                            {{ name|verbose_name }}<br>
-                            <small>
-                                {{ name|doc }}
-                            </small>
-                        </a>
-                    </li>
-                    {% endfor %}
-                </ul>
+            <div class="pf-c-empty-state__content">
+                <i class="fas fa-cubes pf-c-empty-state__icon" aria-hidden="true"></i>
+                <h1 class="pf-c-title pf-m-lg">
+                    {% trans 'No Providers.' %}
+                </h1>
+                <div class="pf-c-empty-state__body">
+                    {% trans 'Currently no providers exist. Click the button below to create one.' %}
+                </div>
+                <div class="pf-c-dropdown">
+                    <button class="pf-m-primary pf-c-dropdown__toggle" type="button">
+                        <span class="pf-c-dropdown__toggle-text">{% trans 'Create' %}</span>
+                        <i class="fas fa-caret-down pf-c-dropdown__toggle-icon" aria-hidden="true"></i>
+                    </button>
+                    <ul class="pf-c-dropdown__menu" hidden>
+                        {% for type, name in types.items %}
+                        <li>
+                            <a class="pf-c-dropdown__menu-item" href="{% url 'passbook_admin:provider-create' %}?type={{ type }}&back={{ request.get_full_path }}">
+                                {{ name|verbose_name }}<br>
+                                <small>
+                                    {{ name|doc }}
+                                </small>
+                            </a>
+                        </li>
+                        {% endfor %}
+                    </ul>
+                </div>
             </div>
         </div>
         {% endif %}
diff --git a/passbook/admin/templates/administration/source/list.html b/passbook/admin/templates/administration/source/list.html
index 067a6501e..7ce88965a 100644
--- a/passbook/admin/templates/administration/source/list.html
+++ b/passbook/admin/templates/administration/source/list.html
@@ -18,28 +18,30 @@
 <section class="pf-c-page__main-section pf-m-no-padding-mobile">
     <div class="pf-c-card">
         {% if object_list %}
-        <div class="pf-c-toolbar" id="page-layout-table-simple-toolbar-top">
-            <div class="pf-c-toolbar__bulk-select">
-                <div class="pf-c-dropdown">
-                    <button class="pf-m-primary pf-c-dropdown__toggle" type="button">
-                        <span class="pf-c-dropdown__toggle-text">{% trans 'Create' %}</span>
-                        <i class="fas fa-caret-down pf-c-dropdown__toggle-icon" aria-hidden="true"></i>
-                    </button>
-                    <ul class="pf-c-dropdown__menu" hidden>
-                        {% for type, name in types.items %}
-                        <li>
-                            <a class="pf-c-dropdown__menu-item" href="{% url 'passbook_admin:source-create' %}?type={{ type }}&back={{ request.get_full_path }}">
-                                {{ name|verbose_name }}<br>
-                                <small>
-                                    {{ name|doc }}
-                                </small>
-                            </a>
-                        </li>
-                        {% endfor %}
-                    </ul>
+        <div class="pf-c-toolbar">
+            <div class="pf-c-toolbar__content">
+                <div class="pf-c-toolbar__bulk-select">
+                    <div class="pf-c-dropdown">
+                        <button class="pf-m-primary pf-c-dropdown__toggle" type="button">
+                            <span class="pf-c-dropdown__toggle-text">{% trans 'Create' %}</span>
+                            <i class="fas fa-caret-down pf-c-dropdown__toggle-icon" aria-hidden="true"></i>
+                        </button>
+                        <ul class="pf-c-dropdown__menu" hidden>
+                            {% for type, name in types.items %}
+                            <li>
+                                <a class="pf-c-dropdown__menu-item" href="{% url 'passbook_admin:source-create' %}?type={{ type }}&back={{ request.get_full_path }}">
+                                    {{ name|verbose_name }}<br>
+                                    <small>
+                                        {{ name|doc }}
+                                    </small>
+                                </a>
+                            </li>
+                            {% endfor %}
+                        </ul>
+                    </div>
                 </div>
+                {% include 'partials/pagination.html' %}
             </div>
-            {% include 'partials/pagination.html' %}
         </div>
         <table class="pf-c-table pf-m-compact pf-m-grid-xl" role="grid">
             <thead>
@@ -88,30 +90,32 @@
         </div>
         {% else %}
         <div class="pf-c-empty-state">
-            <i class="fas fa-cubes pf-c-empty-state__icon" aria-hidden="true"></i>
-            <h1 class="pf-c-title pf-m-lg">
-                {% trans 'No Sources.' %}
-            </h1>
-            <div class="pf-c-empty-state__body">
-                {% trans 'Currently no sources exist. Click the button below to create one.' %}
-            </div>
-            <div class="pf-c-dropdown">
-                <button class="pf-m-primary pf-c-dropdown__toggle" type="button">
-                    <span class="pf-c-dropdown__toggle-text">{% trans 'Create' %}</span>
-                    <i class="fas fa-caret-down pf-c-dropdown__toggle-icon" aria-hidden="true"></i>
-                </button>
-                <ul class="pf-c-dropdown__menu" hidden>
-                    {% for type, name in types.items %}
-                    <li>
-                        <a class="pf-c-dropdown__menu-item" href="{% url 'passbook_admin:source-create' %}?type={{ type }}&back={{ request.get_full_path }}">
-                            {{ name|verbose_name }}<br>
-                            <small>
-                                {{ name|doc }}
-                            </small>
-                        </a>
-                    </li>
-                    {% endfor %}
-                </ul>
+            <div class="pf-c-empty-state__content">
+                <i class="fas fa-cubes pf-c-empty-state__icon" aria-hidden="true"></i>
+                <h1 class="pf-c-title pf-m-lg">
+                    {% trans 'No Sources.' %}
+                </h1>
+                <div class="pf-c-empty-state__body">
+                    {% trans 'Currently no sources exist. Click the button below to create one.' %}
+                </div>
+                <div class="pf-c-dropdown">
+                    <button class="pf-m-primary pf-c-dropdown__toggle" type="button">
+                        <span class="pf-c-dropdown__toggle-text">{% trans 'Create' %}</span>
+                        <i class="fas fa-caret-down pf-c-dropdown__toggle-icon" aria-hidden="true"></i>
+                    </button>
+                    <ul class="pf-c-dropdown__menu" hidden>
+                        {% for type, name in types.items %}
+                        <li>
+                            <a class="pf-c-dropdown__menu-item" href="{% url 'passbook_admin:source-create' %}?type={{ type }}&back={{ request.get_full_path }}">
+                                {{ name|verbose_name }}<br>
+                                <small>
+                                    {{ name|doc }}
+                                </small>
+                            </a>
+                        </li>
+                        {% endfor %}
+                    </ul>
+                </div>
             </div>
         </div>
         {% endif %}
diff --git a/passbook/admin/templates/administration/stage/list.html b/passbook/admin/templates/administration/stage/list.html
index 624f5374e..8f92ebdcc 100644
--- a/passbook/admin/templates/administration/stage/list.html
+++ b/passbook/admin/templates/administration/stage/list.html
@@ -18,28 +18,30 @@
 <section class="pf-c-page__main-section pf-m-no-padding-mobile">
     <div class="pf-c-card">
         {% if object_list %}
-        <div class="pf-c-toolbar" id="page-layout-table-simple-toolbar-top">
-            <div class="pf-c-toolbar__bulk-select">
-                <div class="pf-c-dropdown">
-                    <button class="pf-m-primary pf-c-dropdown__toggle" type="button">
-                        <span class="pf-c-dropdown__toggle-text">{% trans 'Create' %}</span>
-                        <i class="fas fa-caret-down pf-c-dropdown__toggle-icon" aria-hidden="true"></i>
-                    </button>
-                    <ul class="pf-c-dropdown__menu" hidden>
-                        {% for type, name in types.items %}
-                        <li>
-                            <a class="pf-c-dropdown__menu-item" href="{% url 'passbook_admin:stage-create' %}?type={{ type }}&back={{ request.get_full_path }}">
-                                {{ name|verbose_name }}<br>
-                                <small>
-                                    {{ name|doc }}
-                                </small>
-                            </a>
-                        </li>
-                        {% endfor %}
-                    </ul>
+        <div class="pf-c-toolbar">
+            <div class="pf-c-toolbar__content">
+                <div class="pf-c-toolbar__bulk-select">
+                    <div class="pf-c-dropdown">
+                        <button class="pf-m-primary pf-c-dropdown__toggle" type="button">
+                            <span class="pf-c-dropdown__toggle-text">{% trans 'Create' %}</span>
+                            <i class="fas fa-caret-down pf-c-dropdown__toggle-icon" aria-hidden="true"></i>
+                        </button>
+                        <ul class="pf-c-dropdown__menu" hidden>
+                            {% for type, name in types.items %}
+                            <li>
+                                <a class="pf-c-dropdown__menu-item" href="{% url 'passbook_admin:stage-create' %}?type={{ type }}&back={{ request.get_full_path }}">
+                                    {{ name|verbose_name }}<br>
+                                    <small>
+                                        {{ name|doc }}
+                                    </small>
+                                </a>
+                            </li>
+                            {% endfor %}
+                        </ul>
+                    </div>
                 </div>
+                {% include 'partials/pagination.html' %}
             </div>
-            {% include 'partials/pagination.html' %}
         </div>
         <table class="pf-c-table pf-m-compact pf-m-grid-xl" role="grid">
             <thead>
@@ -62,6 +64,8 @@
                         <ul>
                             {% for flow in stage.flow_set.all %}
                             <li><a href="{% url 'passbook_admin:flow-update' pk=flow.pk %}">{{ flow.slug }}</a></li>
+                            {% empty %}
+                            <li>-</li>
                             {% endfor %}
                         </ul>
                     </td>
@@ -82,31 +86,33 @@
         </div>
         {% else %}
         <div class="pf-c-empty-state">
-            <i class="fas fa-cubes pf-c-empty-state__icon" aria-hidden="true"></i>
-            <h1 class="pf-c-title pf-m-lg">
-                {% trans 'No Stages.' %}
-            </h1>
-            <div class="pf-c-empty-state__body">
-                {% trans 'Currently no stages exist. Click the button below to create one.' %}
-            </div>
-            <div class="pf-c-dropdown">
-                <button class="pf-m-primary pf-c-dropdown__toggle" type="button">
-                    <span class="pf-c-dropdown__toggle-text">{% trans 'Create' %}</span>
-                    <i class="fas fa-caret-down pf-c-dropdown__toggle-icon" aria-hidden="true"></i>
-                </button>
-                <ul class="pf-c-dropdown__menu" hidden>
-                    {% for type, name in types.items %}
-                    <li>
-                        <a class="pf-c-dropdown__menu-item"
-                            href="{% url 'passbook_admin:stage-create' %}?type={{ type }}&back={{ request.get_full_path }}">
-                            {{ name|verbose_name }}<br>
-                            <small>
-                                {{ name|doc }}
-                            </small>
-                        </a>
-                    </li>
-                    {% endfor %}
-                </ul>
+            <div class="pf-c-empty-state__content">
+                <i class="fas fa-cubes pf-c-empty-state__icon" aria-hidden="true"></i>
+                <h1 class="pf-c-title pf-m-lg">
+                    {% trans 'No Stages.' %}
+                </h1>
+                <div class="pf-c-empty-state__body">
+                    {% trans 'Currently no stages exist. Click the button below to create one.' %}
+                </div>
+                <div class="pf-c-dropdown">
+                    <button class="pf-m-primary pf-c-dropdown__toggle" type="button">
+                        <span class="pf-c-dropdown__toggle-text">{% trans 'Create' %}</span>
+                        <i class="fas fa-caret-down pf-c-dropdown__toggle-icon" aria-hidden="true"></i>
+                    </button>
+                    <ul class="pf-c-dropdown__menu" hidden>
+                        {% for type, name in types.items %}
+                        <li>
+                            <a class="pf-c-dropdown__menu-item"
+                                href="{% url 'passbook_admin:stage-create' %}?type={{ type }}&back={{ request.get_full_path }}">
+                                {{ name|verbose_name }}<br>
+                                <small>
+                                    {{ name|doc }}
+                                </small>
+                            </a>
+                        </li>
+                        {% endfor %}
+                    </ul>
+                </div>
             </div>
         </div>
         {% endif %}
diff --git a/passbook/admin/templates/administration/stage_binding/list.html b/passbook/admin/templates/administration/stage_binding/list.html
index 7c1d94f79..a4342cf0e 100644
--- a/passbook/admin/templates/administration/stage_binding/list.html
+++ b/passbook/admin/templates/administration/stage_binding/list.html
@@ -16,12 +16,14 @@
 <section class="pf-c-page__main-section pf-m-no-padding-mobile">
     <div class="pf-c-card">
         {% if object_list %}
-        <div class="pf-c-toolbar" id="page-layout-table-simple-toolbar-top">
-            <div class="pf-c-toolbar__bulk-select">
-                <a href="{% url 'passbook_admin:stage-binding-create' %}?back={{ request.get_full_path }}"
-                    class="pf-c-button pf-m-primary" type="button">{% trans 'Create' %}</a>
+        <div class="pf-c-toolbar">
+            <div class="pf-c-toolbar__content">
+                <div class="pf-c-toolbar__bulk-select">
+                    <a href="{% url 'passbook_admin:stage-binding-create' %}?back={{ request.get_full_path }}"
+                        class="pf-c-button pf-m-primary" type="button">{% trans 'Create' %}</a>
+                </div>
+                {% include 'partials/pagination.html' %}
             </div>
-            {% include 'partials/pagination.html' %}
         </div>
         <table class="pf-c-table pf-m-compact pf-m-grid-xl" role="grid">
             <thead>
@@ -37,8 +39,8 @@
                 {% for flow in grouped_bindings %}
                     <tr role="role">
                         <td>
-                            {% blocktrans with name=flow.grouper.name %}
-                            Flow {{ name }}
+                            {% blocktrans with slug=flow.grouper.slug %}
+                            Flow {{ slug }}
                             {% endblocktrans %}
                         </td>
                         <td></td>
@@ -54,9 +56,9 @@
                         </td>
                         <th role="columnheader">
                             <div>
-                                <div>{{ binding.flow.name }}</div>
+                                <div>{{ binding.flow.slug }}</div>
                                 <small>
-                                    {{ binding.flow }}
+                                    {{ binding.flow.name }}
                                 </small>
                             </div>
                         </th>
@@ -84,14 +86,16 @@
         </div>
         {% else %}
         <div class="pf-c-empty-state">
-            <i class="fas fa-cubes pf-c-empty-state__icon" aria-hidden="true"></i>
-            <h1 class="pf-c-title pf-m-lg">
-                {% trans 'No Flow-Stage Bindings.' %}
-            </h1>
-            <div class="pf-c-empty-state__body">
-                {% trans 'Currently no flow-stage bindings exist. Click the button below to create one.' %}
+            <div class="pf-c-empty-state__content">
+                <i class="fas fa-cubes pf-c-empty-state__icon" aria-hidden="true"></i>
+                <h1 class="pf-c-title pf-m-lg">
+                    {% trans 'No Flow-Stage Bindings.' %}
+                </h1>
+                <div class="pf-c-empty-state__body">
+                    {% trans 'Currently no flow-stage bindings exist. Click the button below to create one.' %}
+                </div>
+                <a href="{% url 'passbook_admin:certificatekeypair-create' %}?back={{ request.get_full_path }}" class="pf-c-button pf-m-primary" type="button">{% trans 'Create' %}</a>
             </div>
-            <a href="{% url 'passbook_admin:certificatekeypair-create' %}?back={{ request.get_full_path }}" class="pf-c-button pf-m-primary" type="button">{% trans 'Create' %}</a>
         </div>
         {% endif %}
     </div>
diff --git a/passbook/admin/templates/administration/stage_invitation/list.html b/passbook/admin/templates/administration/stage_invitation/list.html
index 779e1344d..e341cae82 100644
--- a/passbook/admin/templates/administration/stage_invitation/list.html
+++ b/passbook/admin/templates/administration/stage_invitation/list.html
@@ -17,12 +17,14 @@
 <section class="pf-c-page__main-section pf-m-no-padding-mobile">
     <div class="pf-c-card">
         {% if object_list %}
-        <div class="pf-c-toolbar" id="page-layout-table-simple-toolbar-top">
-            <div class="pf-c-toolbar__bulk-select">
-                <a href="{% url 'passbook_admin:stage-invitation-create' %}?back={{ request.get_full_path }}"
-                    class="pf-c-button pf-m-primary" type="button">{% trans 'Create' %}</a>
+        <div class="pf-c-toolbar">
+            <div class="pf-c-toolbar__content">
+                <div class="pf-c-toolbar__bulk-select">
+                    <a href="{% url 'passbook_admin:stage-invitation-create' %}?back={{ request.get_full_path }}"
+                        class="pf-c-button pf-m-primary" type="button">{% trans 'Create' %}</a>
+                </div>
+                {% include 'partials/pagination.html' %}
             </div>
-            {% include 'partials/pagination.html' %}
         </div>
         <table class="pf-c-table pf-m-compact pf-m-grid-xl" role="grid">
             <thead>
@@ -57,14 +59,16 @@
         </div>
         {% else %}
         <div class="pf-c-empty-state">
-            <i class="fas fa-cubes pf-c-empty-state__icon" aria-hidden="true"></i>
-            <h1 class="pf-c-title pf-m-lg">
-                {% trans 'No Invitations.' %}
-            </h1>
-            <div class="pf-c-empty-state__body">
-                {% trans 'Currently no invitations exist. Click the button below to create one.' %}
+            <div class="pf-c-empty-state__content">
+                <i class="fas fa-cubes pf-c-empty-state__icon" aria-hidden="true"></i>
+                <h1 class="pf-c-title pf-m-lg">
+                    {% trans 'No Invitations.' %}
+                </h1>
+                <div class="pf-c-empty-state__body">
+                    {% trans 'Currently no invitations exist. Click the button below to create one.' %}
+                </div>
+                <a href="{% url 'passbook_admin:stage-invitation-create' %}?back={{ request.get_full_path }}" class="pf-c-button pf-m-primary" type="button">{% trans 'Create' %}</a>
             </div>
-            <a href="{% url 'passbook_admin:stage-invitation-create' %}?back={{ request.get_full_path }}" class="pf-c-button pf-m-primary" type="button">{% trans 'Create' %}</a>
         </div>
         {% endif %}
     </div>
diff --git a/passbook/admin/templates/administration/stage_prompt/list.html b/passbook/admin/templates/administration/stage_prompt/list.html
index 5aff63c69..7b9503944 100644
--- a/passbook/admin/templates/administration/stage_prompt/list.html
+++ b/passbook/admin/templates/administration/stage_prompt/list.html
@@ -17,11 +17,13 @@
 <section class="pf-c-page__main-section pf-m-no-padding-mobile">
     <div class="pf-c-card">
         {% if object_list %}
-        <div class="pf-c-toolbar" id="page-layout-table-simple-toolbar-top">
-            <div class="pf-c-toolbar__bulk-select">
-                <a href="{% url 'passbook_admin:stage-prompt-create' %}?back={{ request.get_full_path }}" class="pf-c-button pf-m-primary" type="button">{% trans 'Create' %}</a>
+        <div class="pf-c-toolbar">
+            <div class="pf-c-toolbar__content">
+                <div class="pf-c-toolbar__bulk-select">
+                    <a href="{% url 'passbook_admin:stage-prompt-create' %}?back={{ request.get_full_path }}" class="pf-c-button pf-m-primary" type="button">{% trans 'Create' %}</a>
+                </div>
+                {% include 'partials/pagination.html' %}
             </div>
-            {% include 'partials/pagination.html' %}
         </div>
         <table class="pf-c-table pf-m-compact pf-m-grid-xl" role="grid">
             <thead>
@@ -83,14 +85,16 @@
         </div>
         {% else %}
         <div class="pf-c-empty-state">
-            <i class="fas fa-cubes pf-c-empty-state__icon" aria-hidden="true"></i>
-            <h1 class="pf-c-title pf-m-lg">
-                {% trans 'No Stage Prompts.' %}
-            </h1>
-            <div class="pf-c-empty-state__body">
-                {% trans 'Currently no stage prompts exist. Click the button below to create one.' %}
+            <div class="pf-c-empty-state__content">
+                <i class="fas fa-cubes pf-c-empty-state__icon" aria-hidden="true"></i>
+                <h1 class="pf-c-title pf-m-lg">
+                    {% trans 'No Stage Prompts.' %}
+                </h1>
+                <div class="pf-c-empty-state__body">
+                    {% trans 'Currently no stage prompts exist. Click the button below to create one.' %}
+                </div>
+                <a href="{% url 'passbook_admin:stage-prompt-create' %}?back={{ request.get_full_path }}" class="pf-c-button pf-m-primary" type="button">{% trans 'Create' %}</a>
             </div>
-            <a href="{% url 'passbook_admin:stage-prompt-create' %}?back={{ request.get_full_path }}" class="pf-c-button pf-m-primary" type="button">{% trans 'Create' %}</a>
         </div>
         {% endif %}
     </div>
diff --git a/passbook/admin/templates/administration/token/list.html b/passbook/admin/templates/administration/token/list.html
new file mode 100644
index 000000000..2e03dd18c
--- /dev/null
+++ b/passbook/admin/templates/administration/token/list.html
@@ -0,0 +1,83 @@
+{% extends "administration/base.html" %}
+
+{% load i18n %}
+{% load passbook_utils %}
+
+{% block content %}
+<section class="pf-c-page__main-section pf-m-light">
+    <div class="pf-c-content">
+        <h1>
+            <i class="fas fa-key"></i>
+            {% trans 'Tokens' %}
+        </h1>
+        <p>{% trans "Tokens are used throughout passbook for Email validation stages, Recovery keys and API access." %}</p>
+    </div>
+</section>
+<section class="pf-c-page__main-section pf-m-no-padding-mobile">
+    <div class="pf-c-card">
+        {% if object_list %}
+        <div class="pf-c-toolbar">
+            <div class="pf-c-toolbar__content">
+                {% include 'partials/pagination.html' %}
+            </div>
+        </div>
+        <table class="pf-c-table pf-m-compact pf-m-grid-xl" role="grid">
+            <thead>
+                <tr role="row">
+                    <th role="columnheader" scope="col">{% trans 'Token' %}</th>
+                    <th role="columnheader" scope="col">{% trans 'User' %}</th>
+                    <th role="columnheader" scope="col">{% trans 'Expires?' %}</th>
+                    <th role="columnheader" scope="col">{% trans 'Expiry Date' %}</th>
+                    <th role="cell"></th>
+                </tr>
+            </thead>
+            <tbody role="rowgroup">
+                {% for token in object_list %}
+                <tr role="row">
+                    <th role="columnheader">
+                        <div>
+                            <div>{{ token.pk }}</div>
+                        </div>
+                    </th>
+                    <td role="cell">
+                        <span>
+                            {{ token.user }}
+                        </span>
+                    </td>
+                    <td role="cell">
+                        <span>
+                            {{ token.expiring|yesno:"Yes,No" }}
+                        </span>
+                    </td>
+                    <td role="cell">
+                        <span>
+                            {{ token.expires }}
+                        </span>
+                    </td>
+                    <td>
+                        <a class="pf-c-button pf-m-danger" href="{% url 'passbook_admin:token-delete' pk=token.pk %}?back={{ request.get_full_path }}">{% trans 'Delete' %}</a>
+                    </td>
+                </tr>
+                {% endfor %}
+            </tbody>
+        </table>
+        <div class="pf-c-toolbar" id="page-layout-table-simple-toolbar-bottom">
+            {% include 'partials/pagination.html' %}
+        </div>
+        {% else %}
+        <div class="pf-c-empty-state">
+            <div class="pf-c-empty-state__content">
+                <i class="fas fa-cubes pf-c-empty-state__icon" aria-hidden="true"></i>
+                <h1 class="pf-c-title pf-m-lg">
+                    {% trans 'No Applications.' %}
+                </h1>
+                <div class="pf-c-empty-state__body">
+                    {% trans 'Currently no applications exist. Click the button below to create one.' %}
+                </div>
+                <a href="{% url 'passbook_admin:application-create' %}?back={{ request.get_full_path }}" class="pf-c-button pf-m-primary" type="button">{% trans 'Create' %}</a>
+            </div>
+        </div>
+        {% endif %}
+    </div>
+</section>
+{% endblock %}
diff --git a/passbook/admin/templates/administration/user/list.html b/passbook/admin/templates/administration/user/list.html
index 8293b769f..770d903cd 100644
--- a/passbook/admin/templates/administration/user/list.html
+++ b/passbook/admin/templates/administration/user/list.html
@@ -15,11 +15,13 @@
 <section class="pf-c-page__main-section pf-m-no-padding-mobile">
     <div class="pf-c-card">
         {% if object_list %}
-        <div class="pf-c-toolbar" id="page-layout-table-simple-toolbar-top">
-            <div class="pf-c-toolbar__bulk-select">
-                <a href="{% url 'passbook_admin:user-create' %}?back={{ request.get_full_path }}" class="pf-c-button pf-m-primary" type="button">{% trans 'Create' %}</a>
+        <div class="pf-c-toolbar">
+            <div class="pf-c-toolbar__content">
+                <div class="pf-c-toolbar__bulk-select">
+                    <a href="{% url 'passbook_admin:user-create' %}?back={{ request.get_full_path }}" class="pf-c-button pf-m-primary" type="button">{% trans 'Create' %}</a>
+                </div>
+                {% include 'partials/pagination.html' %}
             </div>
-            {% include 'partials/pagination.html' %}
         </div>
         <table class="pf-c-table pf-m-compact pf-m-grid-xl" role="grid">
             <thead>
@@ -64,14 +66,16 @@
         </div>
         {% else %}
         <div class="pf-c-empty-state">
-            <i class="fas fa-cubes pf-c-empty-state__icon" aria-hidden="true"></i>
-            <h1 class="pf-c-title pf-m-lg">
-                {% trans 'No Users.' %}
-            </h1>
-            <div class="pf-c-empty-state__body">
-                {% trans 'Currently no users exist. How did you even get here.' %}
+            <div class="pf-c-empty-state__content">
+                <i class="fas fa-cubes pf-c-empty-state__icon" aria-hidden="true"></i>
+                <h1 class="pf-c-title pf-m-lg">
+                    {% trans 'No Users.' %}
+                </h1>
+                <div class="pf-c-empty-state__body">
+                    {% trans 'Currently no users exist. How did you even get here.' %}
+                </div>
+                <a href="{% url 'passbook_admin:user-create' %}?back={{ request.get_full_path }}" class="pf-c-button pf-m-primary" type="button">{% trans 'Create' %}</a>
             </div>
-            <a href="{% url 'passbook_admin:user-create' %}?back={{ request.get_full_path }}" class="pf-c-button pf-m-primary" type="button">{% trans 'Create' %}</a>
         </div>
         {% endif %}
     </div>
diff --git a/passbook/admin/templates/generic/create.html b/passbook/admin/templates/generic/create.html
index 3094c2da7..640ab3916 100644
--- a/passbook/admin/templates/generic/create.html
+++ b/passbook/admin/templates/generic/create.html
@@ -5,14 +5,14 @@
 
 {% block above_form %}
 <h1>
-    {% blocktrans with type=form|form_verbose_name|title %}
+    {% blocktrans with type=form|form_verbose_name %}
     Create {{ type }}
     {% endblocktrans %}
 </h1>
 {% endblock %}
 
 {% block action %}
-{% blocktrans with type=form|form_verbose_name|title %}
+{% blocktrans with type=form|form_verbose_name %}
 Create {{ type }}
 {% endblocktrans %}
 {% endblock %}
diff --git a/passbook/admin/templates/generic/form.html b/passbook/admin/templates/generic/form.html
index 1d535b5dd..44f8f0e83 100644
--- a/passbook/admin/templates/generic/form.html
+++ b/passbook/admin/templates/generic/form.html
@@ -35,10 +35,12 @@
                         {% block beneath_form %}
                         {% endblock %}
                         <div class="pf-c-form__group pf-m-action">
-                            <div class="pf-c-form__horizontal-group">
-                                <div class="pf-c-form__actions">
-                                    <input class="pf-c-button pf-m-primary" type="submit" value="{% block action %}{% endblock %}" />
-                                    <a class="pf-c-button pf-m-secondary" href="{% back %}">{% trans "Cancel" %}</a>
+                            <div class="pf-c-form__group-control">
+                                <div class="pf-c-form__horizontal-group">
+                                    <div class="pf-c-form__actions">
+                                        <input class="pf-c-button pf-m-primary" type="submit" value="{% block action %}{% endblock %}" />
+                                        <a class="pf-c-button pf-m-secondary" href="{% back %}">{% trans "Cancel" %}</a>
+                                    </div>
                                 </div>
                             </div>
                         </div>
diff --git a/passbook/admin/templates/generic/update.html b/passbook/admin/templates/generic/update.html
index 7c7f57290..cee51661c 100644
--- a/passbook/admin/templates/generic/update.html
+++ b/passbook/admin/templates/generic/update.html
@@ -6,7 +6,7 @@
 {% block above_form %}
 <h1>
     {% blocktrans with type=form|form_verbose_name|title inst=form.instance %}
-    Update {{ type }}: {{ inst }}
+    Update {{ inst }}
     {% endblocktrans %}
 </h1>
 {% endblock %}
diff --git a/passbook/admin/tests.py b/passbook/admin/tests.py
index efc8ee6b3..a7017775a 100644
--- a/passbook/admin/tests.py
+++ b/passbook/admin/tests.py
@@ -1,12 +1,15 @@
 """admin tests"""
+from importlib import import_module
 from typing import Callable
 
+from django.forms import ModelForm
 from django.shortcuts import reverse
 from django.test import Client, TestCase
 from django.urls.exceptions import NoReverseMatch
 
 from passbook.admin.urls import urlpatterns
 from passbook.core.models import User
+from passbook.lib.utils.reflection import get_apps
 
 
 class TestAdmin(TestCase):
@@ -34,4 +37,28 @@ def generic_view_tester(view_name: str) -> Callable:
 
 for url in urlpatterns:
     method_name = url.name.replace("-", "_")
-    setattr(TestAdmin, f"test_{method_name}", generic_view_tester(url.name))
+    setattr(TestAdmin, f"test_view_{method_name}", generic_view_tester(url.name))
+
+
+def generic_form_tester(form: ModelForm) -> Callable:
+    """Test a form"""
+
+    def tester(self: TestAdmin):
+        form_inst = form()
+        self.assertFalse(form_inst.is_valid())
+
+    return tester
+
+
+# Load the forms module from every app, so we have all forms loaded
+for app in get_apps():
+    module = app.__module__.replace(".apps", ".forms")
+    try:
+        import_module(module)
+    except ImportError:
+        pass
+
+for form_class in ModelForm.__subclasses__():
+    setattr(
+        TestAdmin, f"test_form_{form_class.__name__}", generic_form_tester(form_class)
+    )
diff --git a/passbook/admin/urls.py b/passbook/admin/urls.py
index c1a7f824a..a660f02c0 100644
--- a/passbook/admin/urls.py
+++ b/passbook/admin/urls.py
@@ -3,7 +3,6 @@ from django.urls import path
 
 from passbook.admin.views import (
     applications,
-    audit,
     certificate_key_pair,
     debug,
     flows,
@@ -18,6 +17,7 @@ from passbook.admin.views import (
     stages_bindings,
     stages_invitations,
     stages_prompts,
+    tokens,
     users,
 )
 
@@ -42,6 +42,13 @@ urlpatterns = [
         applications.ApplicationDeleteView.as_view(),
         name="application-delete",
     ),
+    # Tokens
+    path("tokens/", tokens.TokenListView.as_view(), name="tokens"),
+    path(
+        "tokens/<uuid:pk>/delete/",
+        tokens.TokenDeleteView.as_view(),
+        name="token-delete",
+    ),
     # Sources
     path("sources/", sources.SourceListView.as_view(), name="sources"),
     path("sources/create/", sources.SourceCreateView.as_view(), name="source-create"),
@@ -188,6 +195,11 @@ urlpatterns = [
     path(
         "flows/<uuid:pk>/update/", flows.FlowUpdateView.as_view(), name="flow-update",
     ),
+    path(
+        "flows/<uuid:pk>/execute/",
+        flows.FlowDebugExecuteView.as_view(),
+        name="flow-execute",
+    ),
     path(
         "flows/<uuid:pk>/delete/", flows.FlowDeleteView.as_view(), name="flow-delete",
     ),
@@ -252,8 +264,6 @@ urlpatterns = [
         certificate_key_pair.CertificateKeyPairDeleteView.as_view(),
         name="certificatekeypair-delete",
     ),
-    # Audit Log
-    path("audit/", audit.EventListView.as_view(), name="audit-log"),
     # Groups
     path("groups/", groups.GroupListView.as_view(), name="groups"),
     # Debug
diff --git a/passbook/admin/views/applications.py b/passbook/admin/views/applications.py
index 357e1ab2c..741cf0e50 100644
--- a/passbook/admin/views/applications.py
+++ b/passbook/admin/views/applications.py
@@ -1,5 +1,4 @@
 """passbook Application administration"""
-from django.contrib import messages
 from django.contrib.auth.mixins import LoginRequiredMixin
 from django.contrib.auth.mixins import (
     PermissionRequiredMixin as DjangoPermissionRequiredMixin,
@@ -7,9 +6,10 @@ from django.contrib.auth.mixins import (
 from django.contrib.messages.views import SuccessMessageMixin
 from django.urls import reverse_lazy
 from django.utils.translation import ugettext as _
-from django.views.generic import DeleteView, ListView, UpdateView
+from django.views.generic import ListView, UpdateView
 from guardian.mixins import PermissionListMixin, PermissionRequiredMixin
 
+from passbook.admin.views.utils import DeleteMessageView
 from passbook.core.forms.applications import ApplicationForm
 from passbook.core.models import Application
 from passbook.lib.views import CreateAssignPermView
@@ -24,9 +24,6 @@ class ApplicationListView(LoginRequiredMixin, PermissionListMixin, ListView):
     paginate_by = 40
     template_name = "administration/application/list.html"
 
-    def get_queryset(self):
-        return super().get_queryset().select_subclasses()
-
 
 class ApplicationCreateView(
     SuccessMessageMixin,
@@ -44,10 +41,6 @@ class ApplicationCreateView(
     success_url = reverse_lazy("passbook_admin:applications")
     success_message = _("Successfully created Application")
 
-    def get_context_data(self, **kwargs):
-        kwargs["type"] = "Application"
-        return super().get_context_data(**kwargs)
-
 
 class ApplicationUpdateView(
     SuccessMessageMixin, LoginRequiredMixin, PermissionRequiredMixin, UpdateView
@@ -64,7 +57,7 @@ class ApplicationUpdateView(
 
 
 class ApplicationDeleteView(
-    SuccessMessageMixin, LoginRequiredMixin, PermissionRequiredMixin, DeleteView
+    LoginRequiredMixin, PermissionRequiredMixin, DeleteMessageView
 ):
     """Delete application"""
 
@@ -74,7 +67,3 @@ class ApplicationDeleteView(
     template_name = "generic/delete.html"
     success_url = reverse_lazy("passbook_admin:applications")
     success_message = _("Successfully deleted Application")
-
-    def delete(self, request, *args, **kwargs):
-        messages.success(self.request, self.success_message)
-        return super().delete(request, *args, **kwargs)
diff --git a/passbook/admin/views/certificate_key_pair.py b/passbook/admin/views/certificate_key_pair.py
index 716434b84..79e1c5a47 100644
--- a/passbook/admin/views/certificate_key_pair.py
+++ b/passbook/admin/views/certificate_key_pair.py
@@ -1,5 +1,4 @@
 """passbook CertificateKeyPair administration"""
-from django.contrib import messages
 from django.contrib.auth.mixins import LoginRequiredMixin
 from django.contrib.auth.mixins import (
     PermissionRequiredMixin as DjangoPermissionRequiredMixin,
@@ -7,9 +6,10 @@ from django.contrib.auth.mixins import (
 from django.contrib.messages.views import SuccessMessageMixin
 from django.urls import reverse_lazy
 from django.utils.translation import ugettext as _
-from django.views.generic import DeleteView, ListView, UpdateView
+from django.views.generic import ListView, UpdateView
 from guardian.mixins import PermissionListMixin, PermissionRequiredMixin
 
+from passbook.admin.views.utils import DeleteMessageView
 from passbook.crypto.forms import CertificateKeyPairForm
 from passbook.crypto.models import CertificateKeyPair
 from passbook.lib.views import CreateAssignPermView
@@ -41,10 +41,6 @@ class CertificateKeyPairCreateView(
     success_url = reverse_lazy("passbook_admin:certificate_key_pair")
     success_message = _("Successfully created CertificateKeyPair")
 
-    def get_context_data(self, **kwargs):
-        kwargs["type"] = "Certificate-Key Pair"
-        return super().get_context_data(**kwargs)
-
 
 class CertificateKeyPairUpdateView(
     SuccessMessageMixin, LoginRequiredMixin, PermissionRequiredMixin, UpdateView
@@ -61,7 +57,7 @@ class CertificateKeyPairUpdateView(
 
 
 class CertificateKeyPairDeleteView(
-    SuccessMessageMixin, LoginRequiredMixin, PermissionRequiredMixin, DeleteView
+    LoginRequiredMixin, PermissionRequiredMixin, DeleteMessageView
 ):
     """Delete certificatekeypair"""
 
@@ -71,7 +67,3 @@ class CertificateKeyPairDeleteView(
     template_name = "generic/delete.html"
     success_url = reverse_lazy("passbook_admin:certificate_key_pair")
     success_message = _("Successfully deleted Certificate-Key Pair")
-
-    def delete(self, request, *args, **kwargs):
-        messages.success(self.request, self.success_message)
-        return super().delete(request, *args, **kwargs)
diff --git a/passbook/admin/views/flows.py b/passbook/admin/views/flows.py
index 377cf93f4..91e2910d6 100644
--- a/passbook/admin/views/flows.py
+++ b/passbook/admin/views/flows.py
@@ -1,17 +1,21 @@
 """passbook Flow administration"""
-from django.contrib import messages
 from django.contrib.auth.mixins import LoginRequiredMixin
 from django.contrib.auth.mixins import (
     PermissionRequiredMixin as DjangoPermissionRequiredMixin,
 )
 from django.contrib.messages.views import SuccessMessageMixin
+from django.http import HttpRequest, HttpResponse
 from django.urls import reverse_lazy
 from django.utils.translation import ugettext as _
-from django.views.generic import DeleteView, ListView, UpdateView
+from django.views.generic import DetailView, ListView, UpdateView
 from guardian.mixins import PermissionListMixin, PermissionRequiredMixin
 
+from passbook.admin.views.utils import DeleteMessageView
 from passbook.flows.forms import FlowForm
 from passbook.flows.models import Flow
+from passbook.flows.planner import PLAN_CONTEXT_PENDING_USER
+from passbook.flows.views import SESSION_KEY_PLAN, FlowPlanner
+from passbook.lib.utils.urls import redirect_with_qs
 from passbook.lib.views import CreateAssignPermView
 
 
@@ -41,10 +45,6 @@ class FlowCreateView(
     success_url = reverse_lazy("passbook_admin:flows")
     success_message = _("Successfully created Flow")
 
-    def get_context_data(self, **kwargs):
-        kwargs["type"] = "Flow"
-        return super().get_context_data(**kwargs)
-
 
 class FlowUpdateView(
     SuccessMessageMixin, LoginRequiredMixin, PermissionRequiredMixin, UpdateView
@@ -60,9 +60,7 @@ class FlowUpdateView(
     success_message = _("Successfully updated Flow")
 
 
-class FlowDeleteView(
-    SuccessMessageMixin, LoginRequiredMixin, PermissionRequiredMixin, DeleteView
-):
+class FlowDeleteView(LoginRequiredMixin, PermissionRequiredMixin, DeleteMessageView):
     """Delete flow"""
 
     model = Flow
@@ -72,6 +70,21 @@ class FlowDeleteView(
     success_url = reverse_lazy("passbook_admin:flows")
     success_message = _("Successfully deleted Flow")
 
-    def delete(self, request, *args, **kwargs):
-        messages.success(self.request, self.success_message)
-        return super().delete(request, *args, **kwargs)
+
+class FlowDebugExecuteView(LoginRequiredMixin, PermissionRequiredMixin, DetailView):
+    """Debug exectue flow, setting the current user as pending user"""
+
+    model = Flow
+    permission_required = "passbook_flows.view_flow"
+
+    # pylint: disable=unused-argument
+    def get(self, request: HttpRequest, pk: str) -> HttpResponse:
+        """Debug exectue flow, setting the current user as pending user"""
+        flow: Flow = self.get_object()
+        planner = FlowPlanner(flow)
+        planner.use_cache = False
+        plan = planner.plan(self.request, {PLAN_CONTEXT_PENDING_USER: request.user})
+        self.request.session[SESSION_KEY_PLAN] = plan
+        return redirect_with_qs(
+            "passbook_flows:flow-executor-shell", self.request.GET, flow_slug=flow.slug,
+        )
diff --git a/passbook/admin/views/groups.py b/passbook/admin/views/groups.py
index 4a5c91357..833949fd3 100644
--- a/passbook/admin/views/groups.py
+++ b/passbook/admin/views/groups.py
@@ -1,5 +1,4 @@
 """passbook Group administration"""
-from django.contrib import messages
 from django.contrib.auth.mixins import LoginRequiredMixin
 from django.contrib.auth.mixins import (
     PermissionRequiredMixin as DjangoPermissionRequiredMixin,
@@ -7,9 +6,10 @@ from django.contrib.auth.mixins import (
 from django.contrib.messages.views import SuccessMessageMixin
 from django.urls import reverse_lazy
 from django.utils.translation import ugettext as _
-from django.views.generic import DeleteView, ListView, UpdateView
+from django.views.generic import ListView, UpdateView
 from guardian.mixins import PermissionListMixin, PermissionRequiredMixin
 
+from passbook.admin.views.utils import DeleteMessageView
 from passbook.core.forms.groups import GroupForm
 from passbook.core.models import Group
 from passbook.lib.views import CreateAssignPermView
@@ -41,10 +41,6 @@ class GroupCreateView(
     success_url = reverse_lazy("passbook_admin:groups")
     success_message = _("Successfully created Group")
 
-    def get_context_data(self, **kwargs):
-        kwargs["type"] = "Group"
-        return super().get_context_data(**kwargs)
-
 
 class GroupUpdateView(
     SuccessMessageMixin, LoginRequiredMixin, PermissionRequiredMixin, UpdateView
@@ -60,7 +56,7 @@ class GroupUpdateView(
     success_message = _("Successfully updated Group")
 
 
-class GroupDeleteView(SuccessMessageMixin, LoginRequiredMixin, DeleteView):
+class GroupDeleteView(LoginRequiredMixin, DeleteMessageView):
     """Delete group"""
 
     model = Group
@@ -68,7 +64,3 @@ class GroupDeleteView(SuccessMessageMixin, LoginRequiredMixin, DeleteView):
     template_name = "generic/delete.html"
     success_url = reverse_lazy("passbook_admin:groups")
     success_message = _("Successfully deleted Group")
-
-    def delete(self, request, *args, **kwargs):
-        messages.success(self.request, self.success_message)
-        return super().delete(request, *args, **kwargs)
diff --git a/passbook/admin/views/overview.py b/passbook/admin/views/overview.py
index 83d0ea009..5c049cf7d 100644
--- a/passbook/admin/views/overview.py
+++ b/passbook/admin/views/overview.py
@@ -1,7 +1,11 @@
 """passbook administration overview"""
+from functools import lru_cache
+
 from django.core.cache import cache
 from django.shortcuts import redirect, reverse
 from django.views.generic import TemplateView
+from packaging.version import Version, parse
+from requests import RequestException, get
 
 from passbook import __version__
 from passbook.admin.mixins import AdminRequiredMixin
@@ -12,6 +16,19 @@ from passbook.root.celery import CELERY_APP
 from passbook.stages.invitation.models import Invitation
 
 
+@lru_cache
+def latest_version() -> Version:
+    """Get latest release from GitHub, cached"""
+    try:
+        data = get(
+            "https://api.github.com/repos/beryju/passbook/releases/latest"
+        ).json()
+        tag_name = data.get("tag_name")
+        return parse(tag_name.split("/")[1])
+    except RequestException:
+        return parse("0.0.0")
+
+
 class AdministrationOverviewView(AdminRequiredMixin, TemplateView):
     """Overview View"""
 
@@ -33,7 +50,8 @@ class AdministrationOverviewView(AdminRequiredMixin, TemplateView):
         kwargs["stage_count"] = len(Stage.objects.all())
         kwargs["flow_count"] = len(Flow.objects.all())
         kwargs["invitation_count"] = len(Invitation.objects.all())
-        kwargs["version"] = __version__
+        kwargs["version"] = parse(__version__)
+        kwargs["version_latest"] = latest_version()
         kwargs["worker_count"] = len(CELERY_APP.control.ping(timeout=0.5))
         kwargs["providers_without_application"] = Provider.objects.filter(
             application=None
diff --git a/passbook/admin/views/policies.py b/passbook/admin/views/policies.py
index 76196e70e..ac04ef537 100644
--- a/passbook/admin/views/policies.py
+++ b/passbook/admin/views/policies.py
@@ -8,22 +8,25 @@ from django.contrib.auth.mixins import (
 )
 from django.contrib.messages.views import SuccessMessageMixin
 from django.db.models import QuerySet
-from django.forms import Form
-from django.http import Http404, HttpRequest, HttpResponse
+from django.http import HttpResponse
 from django.urls import reverse_lazy
 from django.utils.translation import ugettext as _
-from django.views.generic import DeleteView, FormView, ListView, UpdateView
+from django.views.generic import FormView
 from django.views.generic.detail import DetailView
 from guardian.mixins import PermissionListMixin, PermissionRequiredMixin
 
 from passbook.admin.forms.policies import PolicyTestForm
-from passbook.lib.utils.reflection import all_subclasses, path_to_class
-from passbook.lib.views import CreateAssignPermView
+from passbook.admin.views.utils import (
+    DeleteMessageView,
+    InheritanceCreateView,
+    InheritanceListView,
+    InheritanceUpdateView,
+)
 from passbook.policies.models import Policy, PolicyBinding
 from passbook.policies.process import PolicyProcess, PolicyRequest
 
 
-class PolicyListView(LoginRequiredMixin, PermissionListMixin, ListView):
+class PolicyListView(LoginRequiredMixin, PermissionListMixin, InheritanceListView):
     """Show list of all policies"""
 
     model = Policy
@@ -32,19 +35,12 @@ class PolicyListView(LoginRequiredMixin, PermissionListMixin, ListView):
     ordering = "name"
     template_name = "administration/policy/list.html"
 
-    def get_context_data(self, **kwargs: Any) -> Dict[str, Any]:
-        kwargs["types"] = {x.__name__: x for x in all_subclasses(Policy)}
-        return super().get_context_data(**kwargs)
-
-    def get_queryset(self) -> QuerySet:
-        return super().get_queryset().select_subclasses()
-
 
 class PolicyCreateView(
     SuccessMessageMixin,
     LoginRequiredMixin,
     DjangoPermissionRequiredMixin,
-    CreateAssignPermView,
+    InheritanceCreateView,
 ):
     """Create new Policy"""
 
@@ -55,24 +51,12 @@ class PolicyCreateView(
     success_url = reverse_lazy("passbook_admin:policies")
     success_message = _("Successfully created Policy")
 
-    def get_context_data(self, **kwargs: Any) -> Dict[str, Any]:
-        kwargs = super().get_context_data(**kwargs)
-        form_cls = self.get_form_class()
-        if hasattr(form_cls, "template_name"):
-            kwargs["base_template"] = form_cls.template_name
-        return kwargs
-
-    def get_form_class(self) -> Form:
-        policy_type = self.request.GET.get("type")
-        try:
-            model = next(x for x in all_subclasses(Policy) if x.__name__ == policy_type)
-        except StopIteration as exc:
-            raise Http404 from exc
-        return path_to_class(model.form)
-
 
 class PolicyUpdateView(
-    SuccessMessageMixin, LoginRequiredMixin, PermissionRequiredMixin, UpdateView
+    SuccessMessageMixin,
+    LoginRequiredMixin,
+    PermissionRequiredMixin,
+    InheritanceUpdateView,
 ):
     """Update policy"""
 
@@ -83,27 +67,8 @@ class PolicyUpdateView(
     success_url = reverse_lazy("passbook_admin:policies")
     success_message = _("Successfully updated Policy")
 
-    def get_context_data(self, **kwargs: Any) -> Dict[str, Any]:
-        kwargs = super().get_context_data(**kwargs)
-        form_cls = self.get_form_class()
-        if hasattr(form_cls, "template_name"):
-            kwargs["base_template"] = form_cls.template_name
-        return kwargs
 
-    def get_form_class(self) -> Form:
-        form_class_path = self.get_object().form
-        form_class = path_to_class(form_class_path)
-        return form_class
-
-    def get_object(self, queryset=None) -> Policy:
-        return (
-            Policy.objects.filter(pk=self.kwargs.get("pk")).select_subclasses().first()
-        )
-
-
-class PolicyDeleteView(
-    SuccessMessageMixin, LoginRequiredMixin, PermissionRequiredMixin, DeleteView
-):
+class PolicyDeleteView(LoginRequiredMixin, PermissionRequiredMixin, DeleteMessageView):
     """Delete policy"""
 
     model = Policy
@@ -113,15 +78,6 @@ class PolicyDeleteView(
     success_url = reverse_lazy("passbook_admin:policies")
     success_message = _("Successfully deleted Policy")
 
-    def get_object(self, queryset=None) -> Policy:
-        return (
-            Policy.objects.filter(pk=self.kwargs.get("pk")).select_subclasses().first()
-        )
-
-    def delete(self, request: HttpRequest, *args, **kwargs) -> HttpResponse:
-        messages.success(self.request, self.success_message)
-        return super().delete(request, *args, **kwargs)
-
 
 class PolicyTestView(LoginRequiredMixin, DetailView, PermissionRequiredMixin, FormView):
     """View to test policy(s)"""
diff --git a/passbook/admin/views/policies_bindings.py b/passbook/admin/views/policies_bindings.py
index b2d34045c..058f78ef1 100644
--- a/passbook/admin/views/policies_bindings.py
+++ b/passbook/admin/views/policies_bindings.py
@@ -1,5 +1,4 @@
 """passbook PolicyBinding administration"""
-from django.contrib import messages
 from django.contrib.auth.mixins import LoginRequiredMixin
 from django.contrib.auth.mixins import (
     PermissionRequiredMixin as DjangoPermissionRequiredMixin,
@@ -7,9 +6,10 @@ from django.contrib.auth.mixins import (
 from django.contrib.messages.views import SuccessMessageMixin
 from django.urls import reverse_lazy
 from django.utils.translation import ugettext as _
-from django.views.generic import DeleteView, ListView, UpdateView
+from django.views.generic import ListView, UpdateView
 from guardian.mixins import PermissionListMixin, PermissionRequiredMixin
 
+from passbook.admin.views.utils import DeleteMessageView
 from passbook.lib.views import CreateAssignPermView
 from passbook.policies.forms import PolicyBindingForm
 from passbook.policies.models import PolicyBinding
@@ -55,16 +55,9 @@ class PolicyBindingUpdateView(
     success_url = reverse_lazy("passbook_admin:policies-bindings")
     success_message = _("Successfully updated PolicyBinding")
 
-    def get_context_data(self, **kwargs):
-        kwargs = super().get_context_data(**kwargs)
-        form_cls = self.get_form_class()
-        if hasattr(form_cls, "template_name"):
-            kwargs["base_template"] = form_cls.template_name
-        return kwargs
-
 
 class PolicyBindingDeleteView(
-    SuccessMessageMixin, LoginRequiredMixin, PermissionRequiredMixin, DeleteView
+    LoginRequiredMixin, PermissionRequiredMixin, DeleteMessageView
 ):
     """Delete policybinding"""
 
@@ -74,7 +67,3 @@ class PolicyBindingDeleteView(
     template_name = "generic/delete.html"
     success_url = reverse_lazy("passbook_admin:policies-bindings")
     success_message = _("Successfully deleted PolicyBinding")
-
-    def delete(self, request, *args, **kwargs):
-        messages.success(self.request, self.success_message)
-        return super().delete(request, *args, **kwargs)
diff --git a/passbook/admin/views/property_mapping.py b/passbook/admin/views/property_mapping.py
index 0f3d9ffa9..3ba8ad47e 100644
--- a/passbook/admin/views/property_mapping.py
+++ b/passbook/admin/views/property_mapping.py
@@ -1,22 +1,25 @@
 """passbook PropertyMapping administration"""
-from django.contrib import messages
 from django.contrib.auth.mixins import LoginRequiredMixin
 from django.contrib.auth.mixins import (
     PermissionRequiredMixin as DjangoPermissionRequiredMixin,
 )
 from django.contrib.messages.views import SuccessMessageMixin
-from django.http import Http404
 from django.urls import reverse_lazy
 from django.utils.translation import ugettext as _
-from django.views.generic import DeleteView, ListView, UpdateView
 from guardian.mixins import PermissionListMixin, PermissionRequiredMixin
 
+from passbook.admin.views.utils import (
+    DeleteMessageView,
+    InheritanceCreateView,
+    InheritanceListView,
+    InheritanceUpdateView,
+)
 from passbook.core.models import PropertyMapping
-from passbook.lib.utils.reflection import all_subclasses, path_to_class
-from passbook.lib.views import CreateAssignPermView
 
 
-class PropertyMappingListView(LoginRequiredMixin, PermissionListMixin, ListView):
+class PropertyMappingListView(
+    LoginRequiredMixin, PermissionListMixin, InheritanceListView
+):
     """Show list of all property_mappings"""
 
     model = PropertyMapping
@@ -25,19 +28,12 @@ class PropertyMappingListView(LoginRequiredMixin, PermissionListMixin, ListView)
     ordering = "name"
     paginate_by = 40
 
-    def get_context_data(self, **kwargs):
-        kwargs["types"] = {x.__name__: x for x in all_subclasses(PropertyMapping)}
-        return super().get_context_data(**kwargs)
-
-    def get_queryset(self):
-        return super().get_queryset().select_subclasses()
-
 
 class PropertyMappingCreateView(
     SuccessMessageMixin,
     LoginRequiredMixin,
     DjangoPermissionRequiredMixin,
-    CreateAssignPermView,
+    InheritanceCreateView,
 ):
     """Create new PropertyMapping"""
 
@@ -48,38 +44,12 @@ class PropertyMappingCreateView(
     success_url = reverse_lazy("passbook_admin:property-mappings")
     success_message = _("Successfully created Property Mapping")
 
-    def get_context_data(self, **kwargs):
-        kwargs = super().get_context_data(**kwargs)
-        property_mapping_type = self.request.GET.get("type")
-        try:
-            model = next(
-                x
-                for x in all_subclasses(PropertyMapping)
-                if x.__name__ == property_mapping_type
-            )
-        except StopIteration as exc:
-            raise Http404 from exc
-        kwargs["type"] = model._meta.verbose_name
-        form_cls = self.get_form_class()
-        if hasattr(form_cls, "template_name"):
-            kwargs["base_template"] = form_cls.template_name
-        return kwargs
-
-    def get_form_class(self):
-        property_mapping_type = self.request.GET.get("type")
-        try:
-            model = next(
-                x
-                for x in all_subclasses(PropertyMapping)
-                if x.__name__ == property_mapping_type
-            )
-        except StopIteration as exc:
-            raise Http404 from exc
-        return path_to_class(model.form)
-
 
 class PropertyMappingUpdateView(
-    SuccessMessageMixin, LoginRequiredMixin, PermissionRequiredMixin, UpdateView
+    SuccessMessageMixin,
+    LoginRequiredMixin,
+    PermissionRequiredMixin,
+    InheritanceUpdateView,
 ):
     """Update property_mapping"""
 
@@ -90,28 +60,9 @@ class PropertyMappingUpdateView(
     success_url = reverse_lazy("passbook_admin:property-mappings")
     success_message = _("Successfully updated Property Mapping")
 
-    def get_context_data(self, **kwargs):
-        kwargs = super().get_context_data(**kwargs)
-        form_cls = self.get_form_class()
-        if hasattr(form_cls, "template_name"):
-            kwargs["base_template"] = form_cls.template_name
-        return kwargs
-
-    def get_form_class(self):
-        form_class_path = self.get_object().form
-        form_class = path_to_class(form_class_path)
-        return form_class
-
-    def get_object(self, queryset=None):
-        return (
-            PropertyMapping.objects.filter(pk=self.kwargs.get("pk"))
-            .select_subclasses()
-            .first()
-        )
-
 
 class PropertyMappingDeleteView(
-    SuccessMessageMixin, LoginRequiredMixin, PermissionRequiredMixin, DeleteView
+    LoginRequiredMixin, PermissionRequiredMixin, DeleteMessageView
 ):
     """Delete property_mapping"""
 
@@ -121,14 +72,3 @@ class PropertyMappingDeleteView(
     template_name = "generic/delete.html"
     success_url = reverse_lazy("passbook_admin:property-mappings")
     success_message = _("Successfully deleted Property Mapping")
-
-    def get_object(self, queryset=None):
-        return (
-            PropertyMapping.objects.filter(pk=self.kwargs.get("pk"))
-            .select_subclasses()
-            .first()
-        )
-
-    def delete(self, request, *args, **kwargs):
-        messages.success(self.request, self.success_message)
-        return super().delete(request, *args, **kwargs)
diff --git a/passbook/admin/views/providers.py b/passbook/admin/views/providers.py
index da9a1c761..e4dffa264 100644
--- a/passbook/admin/views/providers.py
+++ b/passbook/admin/views/providers.py
@@ -1,22 +1,23 @@
 """passbook Provider administration"""
-from django.contrib import messages
 from django.contrib.auth.mixins import LoginRequiredMixin
 from django.contrib.auth.mixins import (
     PermissionRequiredMixin as DjangoPermissionRequiredMixin,
 )
 from django.contrib.messages.views import SuccessMessageMixin
-from django.http import Http404
 from django.urls import reverse_lazy
 from django.utils.translation import ugettext as _
-from django.views.generic import DeleteView, ListView, UpdateView
 from guardian.mixins import PermissionListMixin, PermissionRequiredMixin
 
+from passbook.admin.views.utils import (
+    DeleteMessageView,
+    InheritanceCreateView,
+    InheritanceListView,
+    InheritanceUpdateView,
+)
 from passbook.core.models import Provider
-from passbook.lib.utils.reflection import all_subclasses, path_to_class
-from passbook.lib.views import CreateAssignPermView
 
 
-class ProviderListView(LoginRequiredMixin, PermissionListMixin, ListView):
+class ProviderListView(LoginRequiredMixin, PermissionListMixin, InheritanceListView):
     """Show list of all providers"""
 
     model = Provider
@@ -25,19 +26,12 @@ class ProviderListView(LoginRequiredMixin, PermissionListMixin, ListView):
     paginate_by = 10
     ordering = "id"
 
-    def get_context_data(self, **kwargs):
-        kwargs["types"] = {x.__name__: x for x in all_subclasses(Provider)}
-        return super().get_context_data(**kwargs)
-
-    def get_queryset(self):
-        return super().get_queryset().select_subclasses()
-
 
 class ProviderCreateView(
     SuccessMessageMixin,
     LoginRequiredMixin,
     DjangoPermissionRequiredMixin,
-    CreateAssignPermView,
+    InheritanceCreateView,
 ):
     """Create new Provider"""
 
@@ -48,19 +42,12 @@ class ProviderCreateView(
     success_url = reverse_lazy("passbook_admin:providers")
     success_message = _("Successfully created Provider")
 
-    def get_form_class(self):
-        provider_type = self.request.GET.get("type")
-        try:
-            model = next(
-                x for x in all_subclasses(Provider) if x.__name__ == provider_type
-            )
-        except StopIteration as exc:
-            raise Http404 from exc
-        return path_to_class(model.form)
-
 
 class ProviderUpdateView(
-    SuccessMessageMixin, LoginRequiredMixin, PermissionRequiredMixin, UpdateView
+    SuccessMessageMixin,
+    LoginRequiredMixin,
+    PermissionRequiredMixin,
+    InheritanceUpdateView,
 ):
     """Update provider"""
 
@@ -71,21 +58,9 @@ class ProviderUpdateView(
     success_url = reverse_lazy("passbook_admin:providers")
     success_message = _("Successfully updated Provider")
 
-    def get_form_class(self):
-        form_class_path = self.get_object().form
-        form_class = path_to_class(form_class_path)
-        return form_class
-
-    def get_object(self, queryset=None):
-        return (
-            Provider.objects.filter(pk=self.kwargs.get("pk"))
-            .select_subclasses()
-            .first()
-        )
-
 
 class ProviderDeleteView(
-    SuccessMessageMixin, LoginRequiredMixin, PermissionRequiredMixin, DeleteView
+    LoginRequiredMixin, PermissionRequiredMixin, DeleteMessageView
 ):
     """Delete provider"""
 
@@ -95,14 +70,3 @@ class ProviderDeleteView(
     template_name = "generic/delete.html"
     success_url = reverse_lazy("passbook_admin:providers")
     success_message = _("Successfully deleted Provider")
-
-    def get_object(self, queryset=None):
-        return (
-            Provider.objects.filter(pk=self.kwargs.get("pk"))
-            .select_subclasses()
-            .first()
-        )
-
-    def delete(self, request, *args, **kwargs):
-        messages.success(self.request, self.success_message)
-        return super().delete(request, *args, **kwargs)
diff --git a/passbook/admin/views/sources.py b/passbook/admin/views/sources.py
index a8751be9f..41a87aa68 100644
--- a/passbook/admin/views/sources.py
+++ b/passbook/admin/views/sources.py
@@ -1,22 +1,23 @@
 """passbook Source administration"""
-from django.contrib import messages
 from django.contrib.auth.mixins import LoginRequiredMixin
 from django.contrib.auth.mixins import (
     PermissionRequiredMixin as DjangoPermissionRequiredMixin,
 )
 from django.contrib.messages.views import SuccessMessageMixin
-from django.http import Http404
 from django.urls import reverse_lazy
 from django.utils.translation import ugettext as _
-from django.views.generic import DeleteView, ListView, UpdateView
 from guardian.mixins import PermissionListMixin, PermissionRequiredMixin
 
+from passbook.admin.views.utils import (
+    DeleteMessageView,
+    InheritanceCreateView,
+    InheritanceListView,
+    InheritanceUpdateView,
+)
 from passbook.core.models import Source
-from passbook.lib.utils.reflection import all_subclasses, path_to_class
-from passbook.lib.views import CreateAssignPermView
 
 
-class SourceListView(LoginRequiredMixin, PermissionListMixin, ListView):
+class SourceListView(LoginRequiredMixin, PermissionListMixin, InheritanceListView):
     """Show list of all sources"""
 
     model = Source
@@ -25,19 +26,12 @@ class SourceListView(LoginRequiredMixin, PermissionListMixin, ListView):
     paginate_by = 40
     template_name = "administration/source/list.html"
 
-    def get_context_data(self, **kwargs):
-        kwargs["types"] = {x.__name__: x for x in all_subclasses(Source)}
-        return super().get_context_data(**kwargs)
-
-    def get_queryset(self):
-        return super().get_queryset().select_subclasses()
-
 
 class SourceCreateView(
     SuccessMessageMixin,
     LoginRequiredMixin,
     DjangoPermissionRequiredMixin,
-    CreateAssignPermView,
+    InheritanceCreateView,
 ):
     """Create new Source"""
 
@@ -48,17 +42,12 @@ class SourceCreateView(
     success_url = reverse_lazy("passbook_admin:sources")
     success_message = _("Successfully created Source")
 
-    def get_form_class(self):
-        source_type = self.request.GET.get("type")
-        try:
-            model = next(x for x in all_subclasses(Source) if x.__name__ == source_type)
-        except StopIteration as exc:
-            raise Http404 from exc
-        return path_to_class(model.form)
-
 
 class SourceUpdateView(
-    SuccessMessageMixin, LoginRequiredMixin, PermissionRequiredMixin, UpdateView
+    SuccessMessageMixin,
+    LoginRequiredMixin,
+    PermissionRequiredMixin,
+    InheritanceUpdateView,
 ):
     """Update source"""
 
@@ -69,20 +58,8 @@ class SourceUpdateView(
     success_url = reverse_lazy("passbook_admin:sources")
     success_message = _("Successfully updated Source")
 
-    def get_form_class(self):
-        form_class_path = self.get_object().form
-        form_class = path_to_class(form_class_path)
-        return form_class
 
-    def get_object(self, queryset=None):
-        return (
-            Source.objects.filter(pk=self.kwargs.get("pk")).select_subclasses().first()
-        )
-
-
-class SourceDeleteView(
-    SuccessMessageMixin, LoginRequiredMixin, PermissionRequiredMixin, DeleteView
-):
+class SourceDeleteView(LoginRequiredMixin, PermissionRequiredMixin, DeleteMessageView):
     """Delete source"""
 
     model = Source
@@ -91,12 +68,3 @@ class SourceDeleteView(
     template_name = "generic/delete.html"
     success_url = reverse_lazy("passbook_admin:sources")
     success_message = _("Successfully deleted Source")
-
-    def get_object(self, queryset=None):
-        return (
-            Source.objects.filter(pk=self.kwargs.get("pk")).select_subclasses().first()
-        )
-
-    def delete(self, request, *args, **kwargs):
-        messages.success(self.request, self.success_message)
-        return super().delete(request, *args, **kwargs)
diff --git a/passbook/admin/views/stages.py b/passbook/admin/views/stages.py
index 03ee9f549..9451cb2d0 100644
--- a/passbook/admin/views/stages.py
+++ b/passbook/admin/views/stages.py
@@ -1,22 +1,23 @@
 """passbook Stage administration"""
-from django.contrib import messages
 from django.contrib.auth.mixins import LoginRequiredMixin
 from django.contrib.auth.mixins import (
     PermissionRequiredMixin as DjangoPermissionRequiredMixin,
 )
 from django.contrib.messages.views import SuccessMessageMixin
-from django.http import Http404
 from django.urls import reverse_lazy
 from django.utils.translation import ugettext as _
-from django.views.generic import DeleteView, ListView, UpdateView
 from guardian.mixins import PermissionListMixin, PermissionRequiredMixin
 
+from passbook.admin.views.utils import (
+    DeleteMessageView,
+    InheritanceCreateView,
+    InheritanceListView,
+    InheritanceUpdateView,
+)
 from passbook.flows.models import Stage
-from passbook.lib.utils.reflection import all_subclasses, path_to_class
-from passbook.lib.views import CreateAssignPermView
 
 
-class StageListView(LoginRequiredMixin, PermissionListMixin, ListView):
+class StageListView(LoginRequiredMixin, PermissionListMixin, InheritanceListView):
     """Show list of all stages"""
 
     model = Stage
@@ -25,19 +26,12 @@ class StageListView(LoginRequiredMixin, PermissionListMixin, ListView):
     ordering = "name"
     paginate_by = 40
 
-    def get_context_data(self, **kwargs):
-        kwargs["types"] = {x.__name__: x for x in all_subclasses(Stage)}
-        return super().get_context_data(**kwargs)
-
-    def get_queryset(self):
-        return super().get_queryset().select_subclasses()
-
 
 class StageCreateView(
     SuccessMessageMixin,
     LoginRequiredMixin,
     DjangoPermissionRequiredMixin,
-    CreateAssignPermView,
+    InheritanceCreateView,
 ):
     """Create new Stage"""
 
@@ -48,24 +42,12 @@ class StageCreateView(
     success_url = reverse_lazy("passbook_admin:stages")
     success_message = _("Successfully created Stage")
 
-    def get_context_data(self, **kwargs):
-        kwargs = super().get_context_data(**kwargs)
-        stage_type = self.request.GET.get("type")
-        model = next(x for x in all_subclasses(Stage) if x.__name__ == stage_type)
-        kwargs["type"] = model._meta.verbose_name
-        return kwargs
-
-    def get_form_class(self):
-        stage_type = self.request.GET.get("type")
-        try:
-            model = next(x for x in all_subclasses(Stage) if x.__name__ == stage_type)
-        except StopIteration as exc:
-            raise Http404 from exc
-        return path_to_class(model.form)
-
 
 class StageUpdateView(
-    SuccessMessageMixin, LoginRequiredMixin, PermissionRequiredMixin, UpdateView
+    SuccessMessageMixin,
+    LoginRequiredMixin,
+    PermissionRequiredMixin,
+    InheritanceUpdateView,
 ):
     """Update stage"""
 
@@ -75,20 +57,8 @@ class StageUpdateView(
     success_url = reverse_lazy("passbook_admin:stages")
     success_message = _("Successfully updated Stage")
 
-    def get_form_class(self):
-        form_class_path = self.get_object().form
-        form_class = path_to_class(form_class_path)
-        return form_class
 
-    def get_object(self, queryset=None):
-        return (
-            Stage.objects.filter(pk=self.kwargs.get("pk")).select_subclasses().first()
-        )
-
-
-class StageDeleteView(
-    SuccessMessageMixin, LoginRequiredMixin, PermissionRequiredMixin, DeleteView
-):
+class StageDeleteView(LoginRequiredMixin, PermissionRequiredMixin, DeleteMessageView):
     """Delete stage"""
 
     model = Stage
@@ -96,12 +66,3 @@ class StageDeleteView(
     permission_required = "passbook_flows.delete_stage"
     success_url = reverse_lazy("passbook_admin:stages")
     success_message = _("Successfully deleted Stage")
-
-    def get_object(self, queryset=None):
-        return (
-            Stage.objects.filter(pk=self.kwargs.get("pk")).select_subclasses().first()
-        )
-
-    def delete(self, request, *args, **kwargs):
-        messages.success(self.request, self.success_message)
-        return super().delete(request, *args, **kwargs)
diff --git a/passbook/admin/views/stages_bindings.py b/passbook/admin/views/stages_bindings.py
index 65433a179..cfe86816c 100644
--- a/passbook/admin/views/stages_bindings.py
+++ b/passbook/admin/views/stages_bindings.py
@@ -1,5 +1,4 @@
 """passbook StageBinding administration"""
-from django.contrib import messages
 from django.contrib.auth.mixins import LoginRequiredMixin
 from django.contrib.auth.mixins import (
     PermissionRequiredMixin as DjangoPermissionRequiredMixin,
@@ -7,9 +6,10 @@ from django.contrib.auth.mixins import (
 from django.contrib.messages.views import SuccessMessageMixin
 from django.urls import reverse_lazy
 from django.utils.translation import ugettext as _
-from django.views.generic import DeleteView, ListView, UpdateView
+from django.views.generic import ListView, UpdateView
 from guardian.mixins import PermissionListMixin, PermissionRequiredMixin
 
+from passbook.admin.views.utils import DeleteMessageView
 from passbook.flows.forms import FlowStageBindingForm
 from passbook.flows.models import FlowStageBinding
 from passbook.lib.views import CreateAssignPermView
@@ -41,13 +41,6 @@ class StageBindingCreateView(
     success_url = reverse_lazy("passbook_admin:stage-bindings")
     success_message = _("Successfully created StageBinding")
 
-    def get_context_data(self, **kwargs):
-        kwargs = super().get_context_data(**kwargs)
-        form_cls = self.get_form_class()
-        if hasattr(form_cls, "template_name"):
-            kwargs["base_template"] = form_cls.template_name
-        return kwargs
-
 
 class StageBindingUpdateView(
     SuccessMessageMixin, LoginRequiredMixin, PermissionRequiredMixin, UpdateView
@@ -62,16 +55,9 @@ class StageBindingUpdateView(
     success_url = reverse_lazy("passbook_admin:stage-bindings")
     success_message = _("Successfully updated StageBinding")
 
-    def get_context_data(self, **kwargs):
-        kwargs = super().get_context_data(**kwargs)
-        form_cls = self.get_form_class()
-        if hasattr(form_cls, "template_name"):
-            kwargs["base_template"] = form_cls.template_name
-        return kwargs
-
 
 class StageBindingDeleteView(
-    SuccessMessageMixin, LoginRequiredMixin, PermissionRequiredMixin, DeleteView
+    LoginRequiredMixin, PermissionRequiredMixin, DeleteMessageView
 ):
     """Delete FlowStageBinding"""
 
@@ -81,7 +67,3 @@ class StageBindingDeleteView(
     template_name = "generic/delete.html"
     success_url = reverse_lazy("passbook_admin:stage-bindings")
     success_message = _("Successfully deleted FlowStageBinding")
-
-    def delete(self, request, *args, **kwargs):
-        messages.success(self.request, self.success_message)
-        return super().delete(request, *args, **kwargs)
diff --git a/passbook/admin/views/stages_invitations.py b/passbook/admin/views/stages_invitations.py
index 255c12d84..cfca9e5ae 100644
--- a/passbook/admin/views/stages_invitations.py
+++ b/passbook/admin/views/stages_invitations.py
@@ -1,5 +1,4 @@
 """passbook Invitation administration"""
-from django.contrib import messages
 from django.contrib.auth.mixins import LoginRequiredMixin
 from django.contrib.auth.mixins import (
     PermissionRequiredMixin as DjangoPermissionRequiredMixin,
@@ -8,9 +7,10 @@ from django.contrib.messages.views import SuccessMessageMixin
 from django.http import HttpResponseRedirect
 from django.urls import reverse_lazy
 from django.utils.translation import ugettext as _
-from django.views.generic import DeleteView, ListView
+from django.views.generic import ListView
 from guardian.mixins import PermissionListMixin, PermissionRequiredMixin
 
+from passbook.admin.views.utils import DeleteMessageView
 from passbook.core.signals import invitation_created
 from passbook.lib.views import CreateAssignPermView
 from passbook.stages.invitation.forms import InvitationForm
@@ -43,10 +43,6 @@ class InvitationCreateView(
     success_url = reverse_lazy("passbook_admin:stage-invitations")
     success_message = _("Successfully created Invitation")
 
-    def get_context_data(self, **kwargs):
-        kwargs["type"] = "Invitation"
-        return super().get_context_data(**kwargs)
-
     def form_valid(self, form):
         obj = form.save(commit=False)
         obj.created_by = self.request.user
@@ -56,7 +52,7 @@ class InvitationCreateView(
 
 
 class InvitationDeleteView(
-    SuccessMessageMixin, LoginRequiredMixin, PermissionRequiredMixin, DeleteView
+    LoginRequiredMixin, PermissionRequiredMixin, DeleteMessageView
 ):
     """Delete invitation"""
 
@@ -66,7 +62,3 @@ class InvitationDeleteView(
     template_name = "generic/delete.html"
     success_url = reverse_lazy("passbook_admin:stage-invitations")
     success_message = _("Successfully deleted Invitation")
-
-    def delete(self, request, *args, **kwargs):
-        messages.success(self.request, self.success_message)
-        return super().delete(request, *args, **kwargs)
diff --git a/passbook/admin/views/stages_prompts.py b/passbook/admin/views/stages_prompts.py
index 5614f206b..74b3c3aff 100644
--- a/passbook/admin/views/stages_prompts.py
+++ b/passbook/admin/views/stages_prompts.py
@@ -1,5 +1,4 @@
 """passbook Prompt administration"""
-from django.contrib import messages
 from django.contrib.auth.mixins import LoginRequiredMixin
 from django.contrib.auth.mixins import (
     PermissionRequiredMixin as DjangoPermissionRequiredMixin,
@@ -7,9 +6,10 @@ from django.contrib.auth.mixins import (
 from django.contrib.messages.views import SuccessMessageMixin
 from django.urls import reverse_lazy
 from django.utils.translation import ugettext as _
-from django.views.generic import DeleteView, ListView, UpdateView
+from django.views.generic import ListView, UpdateView
 from guardian.mixins import PermissionListMixin, PermissionRequiredMixin
 
+from passbook.admin.views.utils import DeleteMessageView
 from passbook.lib.views import CreateAssignPermView
 from passbook.stages.prompt.forms import PromptAdminForm
 from passbook.stages.prompt.models import Prompt
@@ -41,10 +41,6 @@ class PromptCreateView(
     success_url = reverse_lazy("passbook_admin:stage-prompts")
     success_message = _("Successfully created Prompt")
 
-    def get_context_data(self, **kwargs):
-        kwargs["type"] = "Prompt"
-        return super().get_context_data(**kwargs)
-
 
 class PromptUpdateView(
     SuccessMessageMixin, LoginRequiredMixin, PermissionRequiredMixin, UpdateView
@@ -60,9 +56,7 @@ class PromptUpdateView(
     success_message = _("Successfully updated Prompt")
 
 
-class PromptDeleteView(
-    SuccessMessageMixin, LoginRequiredMixin, PermissionRequiredMixin, DeleteView
-):
+class PromptDeleteView(LoginRequiredMixin, PermissionRequiredMixin, DeleteMessageView):
     """Delete prompt"""
 
     model = Prompt
@@ -71,7 +65,3 @@ class PromptDeleteView(
     template_name = "generic/delete.html"
     success_url = reverse_lazy("passbook_admin:stage-prompts")
     success_message = _("Successfully deleted Prompt")
-
-    def delete(self, request, *args, **kwargs):
-        messages.success(self.request, self.success_message)
-        return super().delete(request, *args, **kwargs)
diff --git a/passbook/admin/views/tokens.py b/passbook/admin/views/tokens.py
new file mode 100644
index 000000000..7b8e1c4b2
--- /dev/null
+++ b/passbook/admin/views/tokens.py
@@ -0,0 +1,30 @@
+"""passbook Token administration"""
+from django.contrib.auth.mixins import LoginRequiredMixin
+from django.urls import reverse_lazy
+from django.utils.translation import ugettext as _
+from django.views.generic import ListView
+from guardian.mixins import PermissionListMixin, PermissionRequiredMixin
+
+from passbook.admin.views.utils import DeleteMessageView
+from passbook.core.models import Token
+
+
+class TokenListView(LoginRequiredMixin, PermissionListMixin, ListView):
+    """Show list of all tokens"""
+
+    model = Token
+    permission_required = "passbook_core.view_token"
+    ordering = "expires"
+    paginate_by = 40
+    template_name = "administration/token/list.html"
+
+
+class TokenDeleteView(LoginRequiredMixin, PermissionRequiredMixin, DeleteMessageView):
+    """Delete token"""
+
+    model = Token
+    permission_required = "passbook_core.delete_token"
+
+    template_name = "generic/delete.html"
+    success_url = reverse_lazy("passbook_admin:tokens")
+    success_message = _("Successfully deleted Token")
diff --git a/passbook/admin/views/users.py b/passbook/admin/views/users.py
index 6acca6863..0e0d262d1 100644
--- a/passbook/admin/views/users.py
+++ b/passbook/admin/views/users.py
@@ -5,10 +5,12 @@ from django.contrib.auth.mixins import (
     PermissionRequiredMixin as DjangoPermissionRequiredMixin,
 )
 from django.contrib.messages.views import SuccessMessageMixin
+from django.http import HttpRequest, HttpResponse
 from django.shortcuts import redirect
 from django.urls import reverse, reverse_lazy
+from django.utils.http import urlencode
 from django.utils.translation import ugettext as _
-from django.views.generic import DeleteView, DetailView, ListView, UpdateView
+from django.views.generic import DetailView, ListView, UpdateView
 from guardian.mixins import (
     PermissionListMixin,
     PermissionRequiredMixin,
@@ -16,6 +18,7 @@ from guardian.mixins import (
 )
 
 from passbook.admin.forms.users import UserForm
+from passbook.admin.views.utils import DeleteMessageView
 from passbook.core.models import Token, User
 from passbook.lib.views import CreateAssignPermView
 
@@ -66,9 +69,7 @@ class UserUpdateView(
     success_message = _("Successfully updated User")
 
 
-class UserDeleteView(
-    SuccessMessageMixin, LoginRequiredMixin, PermissionRequiredMixin, DeleteView
-):
+class UserDeleteView(LoginRequiredMixin, PermissionRequiredMixin, DeleteMessageView):
     """Delete user"""
 
     model = User
@@ -80,10 +81,6 @@ class UserDeleteView(
     success_url = reverse_lazy("passbook_admin:users")
     success_message = _("Successfully deleted User")
 
-    def delete(self, request, *args, **kwargs):
-        messages.success(self.request, self.success_message)
-        return super().delete(request, *args, **kwargs)
-
 
 class UserPasswordResetView(LoginRequiredMixin, PermissionRequiredMixin, DetailView):
     """Get Password reset link for user"""
@@ -91,13 +88,13 @@ class UserPasswordResetView(LoginRequiredMixin, PermissionRequiredMixin, DetailV
     model = User
     permission_required = "passbook_core.reset_user_password"
 
-    def get(self, request, *args, **kwargs):
+    def get(self, request: HttpRequest, *args, **kwargs) -> HttpResponse:
         """Create token for user and return link"""
         super().get(request, *args, **kwargs)
-        # TODO: create plan for user, get token
         token = Token.objects.create(user=self.object)
+        querystring = urlencode({"token": token.token_uuid})
         link = request.build_absolute_uri(
-            reverse("passbook_flows:default-recovery", kwargs={"token": token.uuid})
+            reverse("passbook_flows:default-recovery") + f"?{querystring}"
         )
         messages.success(
             request, _("Password reset link: <pre>%(link)s</pre>" % {"link": link})
diff --git a/passbook/admin/views/utils.py b/passbook/admin/views/utils.py
new file mode 100644
index 000000000..1c2f5e74b
--- /dev/null
+++ b/passbook/admin/views/utils.py
@@ -0,0 +1,73 @@
+"""passbook admin util views"""
+from typing import Any, Dict
+
+from django.contrib import messages
+from django.contrib.messages.views import SuccessMessageMixin
+from django.http import Http404
+from django.views.generic import DeleteView, ListView, UpdateView
+
+from passbook.lib.utils.reflection import all_subclasses, path_to_class
+from passbook.lib.views import CreateAssignPermView
+
+
+class DeleteMessageView(SuccessMessageMixin, DeleteView):
+    """DeleteView which shows `self.success_message` on successful deletion"""
+
+    def delete(self, request, *args, **kwargs):
+        messages.success(self.request, self.success_message)
+        return super().delete(request, *args, **kwargs)
+
+
+class InheritanceListView(ListView):
+    """ListView for objects using InheritanceManager"""
+
+    def get_context_data(self, **kwargs):
+        kwargs["types"] = {x.__name__: x for x in all_subclasses(self.model)}
+        return super().get_context_data(**kwargs)
+
+    def get_queryset(self):
+        return super().get_queryset().select_subclasses()
+
+
+class InheritanceCreateView(CreateAssignPermView):
+    """CreateView for objects using InheritanceManager"""
+
+    def get_form_class(self):
+        provider_type = self.request.GET.get("type")
+        try:
+            model = next(
+                x for x in all_subclasses(self.model) if x.__name__ == provider_type
+            )
+        except StopIteration as exc:
+            raise Http404 from exc
+        return path_to_class(model.form)
+
+    def get_context_data(self, **kwargs: Any) -> Dict[str, Any]:
+        kwargs = super().get_context_data(**kwargs)
+        form_cls = self.get_form_class()
+        if hasattr(form_cls, "template_name"):
+            kwargs["base_template"] = form_cls.template_name
+        return kwargs
+
+
+class InheritanceUpdateView(UpdateView):
+    """UpdateView for objects using InheritanceManager"""
+
+    def get_context_data(self, **kwargs: Any) -> Dict[str, Any]:
+        kwargs = super().get_context_data(**kwargs)
+        form_cls = self.get_form_class()
+        if hasattr(form_cls, "template_name"):
+            kwargs["base_template"] = form_cls.template_name
+        return kwargs
+
+    def get_form_class(self):
+        form_class_path = self.get_object().form
+        form_class = path_to_class(form_class_path)
+        return form_class
+
+    def get_object(self, queryset=None):
+        return (
+            self.model.objects.filter(pk=self.kwargs.get("pk"))
+            .select_subclasses()
+            .first()
+        )
diff --git a/passbook/api/v2/urls.py b/passbook/api/v2/urls.py
index 4dc29f438..3035c7bf9 100644
--- a/passbook/api/v2/urls.py
+++ b/passbook/api/v2/urls.py
@@ -4,7 +4,6 @@ from django.urls import path
 from drf_yasg import openapi
 from drf_yasg.views import get_schema_view
 from rest_framework import routers
-from structlog import get_logger
 
 from passbook.api.permissions import CustomObjectPermissions
 from passbook.audit.api import EventViewSet
@@ -16,11 +15,11 @@ from passbook.core.api.providers import ProviderViewSet
 from passbook.core.api.sources import SourceViewSet
 from passbook.core.api.users import UserViewSet
 from passbook.flows.api import FlowStageBindingViewSet, FlowViewSet, StageViewSet
-from passbook.lib.utils.reflection import get_apps
 from passbook.policies.api import PolicyBindingViewSet, PolicyViewSet
 from passbook.policies.dummy.api import DummyPolicyViewSet
 from passbook.policies.expiry.api import PasswordExpiryPolicyViewSet
 from passbook.policies.expression.api import ExpressionPolicyViewSet
+from passbook.policies.group_membership.api import GroupMembershipPolicyViewSet
 from passbook.policies.hibp.api import HaveIBeenPwendPolicyViewSet
 from passbook.policies.password.api import PasswordPolicyViewSet
 from passbook.policies.reputation.api import ReputationPolicyViewSet
@@ -30,12 +29,16 @@ from passbook.providers.oidc.api import OpenIDProviderViewSet
 from passbook.providers.saml.api import SAMLPropertyMappingViewSet, SAMLProviderViewSet
 from passbook.sources.ldap.api import LDAPPropertyMappingViewSet, LDAPSourceViewSet
 from passbook.sources.oauth.api import OAuthSourceViewSet
+from passbook.sources.saml.api import SAMLSourceViewSet
 from passbook.stages.captcha.api import CaptchaStageViewSet
+from passbook.stages.consent.api import ConsentStageViewSet
 from passbook.stages.dummy.api import DummyStageViewSet
 from passbook.stages.email.api import EmailStageViewSet
 from passbook.stages.identification.api import IdentificationStageViewSet
 from passbook.stages.invitation.api import InvitationStageViewSet, InvitationViewSet
-from passbook.stages.otp.api import OTPStageViewSet
+from passbook.stages.otp_static.api import OTPStaticStageViewSet
+from passbook.stages.otp_time.api import OTPTimeStageViewSet
+from passbook.stages.otp_validate.api import OTPValidateStageViewSet
 from passbook.stages.password.api import PasswordStageViewSet
 from passbook.stages.prompt.api import PromptStageViewSet, PromptViewSet
 from passbook.stages.user_delete.api import UserDeleteStageViewSet
@@ -43,15 +46,8 @@ from passbook.stages.user_login.api import UserLoginStageViewSet
 from passbook.stages.user_logout.api import UserLogoutStageViewSet
 from passbook.stages.user_write.api import UserWriteStageViewSet
 
-LOGGER = get_logger()
 router = routers.DefaultRouter()
 
-for _passbook_app in get_apps():
-    if hasattr(_passbook_app, "api_mountpoint"):
-        for prefix, viewset in _passbook_app.api_mountpoint:
-            router.register(prefix, viewset)
-        LOGGER.debug("Mounted API URLs", app_name=_passbook_app.name)
-
 router.register("core/applications", ApplicationViewSet)
 router.register("core/groups", GroupViewSet)
 router.register("core/users", UserViewSet)
@@ -61,14 +57,16 @@ router.register("audit/events", EventViewSet)
 
 router.register("sources/all", SourceViewSet)
 router.register("sources/ldap", LDAPSourceViewSet)
+router.register("sources/saml", SAMLSourceViewSet)
 router.register("sources/oauth", OAuthSourceViewSet)
 
 router.register("policies/all", PolicyViewSet)
 router.register("policies/bindings", PolicyBindingViewSet)
 router.register("policies/expression", ExpressionPolicyViewSet)
+router.register("policies/group_membership", GroupMembershipPolicyViewSet)
 router.register("policies/haveibeenpwned", HaveIBeenPwendPolicyViewSet)
+router.register("policies/password_expiry", PasswordExpiryPolicyViewSet)
 router.register("policies/password", PasswordPolicyViewSet)
-router.register("policies/passwordexpiry", PasswordExpiryPolicyViewSet)
 router.register("policies/reputation", ReputationPolicyViewSet)
 
 router.register("providers/all", ProviderViewSet)
@@ -83,14 +81,17 @@ router.register("propertymappings/saml", SAMLPropertyMappingViewSet)
 
 router.register("stages/all", StageViewSet)
 router.register("stages/captcha", CaptchaStageViewSet)
+router.register("stages/consent", ConsentStageViewSet)
 router.register("stages/email", EmailStageViewSet)
 router.register("stages/identification", IdentificationStageViewSet)
 router.register("stages/invitation", InvitationStageViewSet)
 router.register("stages/invitation/invitations", InvitationViewSet)
-router.register("stages/otp", OTPStageViewSet)
+router.register("stages/otp_static", OTPStaticStageViewSet)
+router.register("stages/otp_time", OTPTimeStageViewSet)
+router.register("stages/otp_validate", OTPValidateStageViewSet)
 router.register("stages/password", PasswordStageViewSet)
-router.register("stages/prompt/stages", PromptStageViewSet)
 router.register("stages/prompt/prompts", PromptViewSet)
+router.register("stages/prompt/stages", PromptStageViewSet)
 router.register("stages/user_delete", UserDeleteStageViewSet)
 router.register("stages/user_login", UserLoginStageViewSet)
 router.register("stages/user_logout", UserLogoutStageViewSet)
diff --git a/passbook/audit/models.py b/passbook/audit/models.py
index 66c4b7980..e5dfebab6 100644
--- a/passbook/audit/models.py
+++ b/passbook/audit/models.py
@@ -12,6 +12,7 @@ from django.core.exceptions import ValidationError
 from django.db import models
 from django.http import HttpRequest
 from django.utils.translation import gettext as _
+from django.views.debug import CLEANSED_SUBSTITUTE, HIDDEN_SETTINGS
 from guardian.shortcuts import get_anonymous_user
 from structlog import get_logger
 
@@ -20,6 +21,22 @@ from passbook.lib.utils.http import get_client_ip
 LOGGER = get_logger()
 
 
+def cleanse_dict(source: Dict[Any, Any]) -> Dict[Any, Any]:
+    """Cleanse a dictionary, recursively"""
+    final_dict = {}
+    for key, value in source.items():
+        try:
+            if HIDDEN_SETTINGS.search(key):
+                final_dict[key] = CLEANSED_SUBSTITUTE
+            else:
+                final_dict[key] = value
+        except TypeError:
+            final_dict[key] = value
+        if isinstance(value, dict):
+            final_dict[key] = cleanse_dict(value)
+    return final_dict
+
+
 def sanitize_dict(source: Dict[Any, Any]) -> Dict[Any, Any]:
     """clean source of all Models that would interfere with the JSONField.
     Models are replaced with a dictionary of {
@@ -27,15 +44,16 @@ def sanitize_dict(source: Dict[Any, Any]) -> Dict[Any, Any]:
         name: str,
         pk: Any
     }"""
+    final_dict = {}
     for key, value in source.items():
         if isinstance(value, dict):
-            source[key] = sanitize_dict(value)
+            final_dict[key] = sanitize_dict(value)
         elif isinstance(value, models.Model):
             model_content_type = ContentType.objects.get_for_model(value)
             name = str(value)
             if hasattr(value, "name"):
                 name = value.name
-            source[key] = sanitize_dict(
+            final_dict[key] = sanitize_dict(
                 {
                     "app": model_content_type.app_label,
                     "model_name": model_content_type.model,
@@ -44,8 +62,10 @@ def sanitize_dict(source: Dict[Any, Any]) -> Dict[Any, Any]:
                 }
             )
         elif isinstance(value, UUID):
-            source[key] = value.hex
-    return source
+            final_dict[key] = value.hex
+        else:
+            final_dict[key] = value
+    return final_dict
 
 
 class EventAction(Enum):
@@ -104,7 +124,7 @@ class Event(models.Model):
             )
         if not app:
             app = getmodule(stack()[_inspect_offset][0]).__name__
-        cleaned_kwargs = sanitize_dict(kwargs)
+        cleaned_kwargs = cleanse_dict(sanitize_dict(kwargs))
         event = Event(action=action.value, app=app, context=cleaned_kwargs)
         return event
 
diff --git a/passbook/admin/templates/administration/audit/list.html b/passbook/audit/templates/audit/list.html
similarity index 93%
rename from passbook/admin/templates/administration/audit/list.html
rename to passbook/audit/templates/audit/list.html
index ed793e650..408195272 100644
--- a/passbook/admin/templates/administration/audit/list.html
+++ b/passbook/audit/templates/audit/list.html
@@ -15,8 +15,10 @@
     </section>
     <section class="pf-c-page__main-section pf-m-no-padding-mobile">
         <div class="pf-c-card">
-            <div class="pf-c-toolbar" id="page-layout-table-simple-toolbar-top">
-                {% include 'partials/pagination.html' %}
+            <div class="pf-c-toolbar">
+                <div class="pf-c-toolbar__content">
+                    {% include 'partials/pagination.html' %}
+                </div>
             </div>
             <table class="pf-c-table pf-m-compact pf-m-grid-xl" role="grid">
                 <thead>
diff --git a/passbook/audit/urls.py b/passbook/audit/urls.py
index f7327b0ac..83be4fe29 100644
--- a/passbook/audit/urls.py
+++ b/passbook/audit/urls.py
@@ -1,2 +1,9 @@
 """passbook audit urls"""
-urlpatterns = []
+from django.urls import path
+
+from passbook.audit.views import EventListView
+
+urlpatterns = [
+    # Audit Log
+    path("audit/", EventListView.as_view(), name="log"),
+]
diff --git a/passbook/admin/views/audit.py b/passbook/audit/views.py
similarity index 87%
rename from passbook/admin/views/audit.py
rename to passbook/audit/views.py
index 56b274c8f..90599db49 100644
--- a/passbook/admin/views/audit.py
+++ b/passbook/audit/views.py
@@ -9,7 +9,7 @@ class EventListView(PermissionListMixin, ListView):
     """Show list of all invitations"""
 
     model = Event
-    template_name = "administration/audit/list.html"
+    template_name = "audit/list.html"
     permission_required = "passbook_audit.view_event"
     ordering = "-created"
     paginate_by = 20
diff --git a/passbook/core/api/applications.py b/passbook/core/api/applications.py
index f0b4c69e2..f2bcb5e9c 100644
--- a/passbook/core/api/applications.py
+++ b/passbook/core/api/applications.py
@@ -15,7 +15,6 @@ class ApplicationSerializer(ModelSerializer):
             "pk",
             "name",
             "slug",
-            "skip_authorization",
             "provider",
             "meta_launch_url",
             "meta_icon_url",
diff --git a/passbook/core/api/providers.py b/passbook/core/api/providers.py
index 2b54a5807..c2830c06e 100644
--- a/passbook/core/api/providers.py
+++ b/passbook/core/api/providers.py
@@ -17,7 +17,7 @@ class ProviderSerializer(ModelSerializer):
     class Meta:
 
         model = Provider
-        fields = ["pk", "property_mappings", "__type__"]
+        fields = ["pk", "authorization_flow", "property_mappings", "__type__"]
 
 
 class ProviderViewSet(ReadOnlyModelViewSet):
diff --git a/passbook/core/expression.py b/passbook/core/expression.py
new file mode 100644
index 000000000..37a397ca0
--- /dev/null
+++ b/passbook/core/expression.py
@@ -0,0 +1,21 @@
+"""Property Mapping Evaluator"""
+from typing import Optional
+
+from django.http import HttpRequest
+
+from passbook.core.models import User
+from passbook.lib.expression.evaluator import BaseEvaluator
+
+
+class PropertyMappingEvaluator(BaseEvaluator):
+    """Custom Evalautor that adds some different context variables."""
+
+    def set_context(
+        self, user: Optional[User], request: Optional[HttpRequest], **kwargs
+    ):
+        """Update context with context from PropertyMapping's evaluate"""
+        if user:
+            self._context["user"] = user
+        if request:
+            self._context["request"] = request
+        self._context.update(**kwargs)
diff --git a/passbook/core/forms/applications.py b/passbook/core/forms/applications.py
index e63eeb06d..4eb071719 100644
--- a/passbook/core/forms/applications.py
+++ b/passbook/core/forms/applications.py
@@ -19,7 +19,6 @@ class ApplicationForm(forms.ModelForm):
         fields = [
             "name",
             "slug",
-            "skip_authorization",
             "provider",
             "meta_launch_url",
             "meta_icon_url",
diff --git a/passbook/core/forms/groups.py b/passbook/core/forms/groups.py
index 46577d957..3c8dae507 100644
--- a/passbook/core/forms/groups.py
+++ b/passbook/core/forms/groups.py
@@ -2,6 +2,7 @@
 from django import forms
 from django.contrib.admin.widgets import FilteredSelectMultiple
 
+from passbook.admin.fields import CodeMirrorWidget, YAMLField
 from passbook.core.models import Group, User
 
 
@@ -34,4 +35,8 @@ class GroupForm(forms.ModelForm):
         fields = ["name", "parent", "members", "attributes"]
         widgets = {
             "name": forms.TextInput(),
+            "attributes": CodeMirrorWidget,
+        }
+        field_classes = {
+            "attributes": YAMLField,
         }
diff --git a/passbook/core/migrations/0002_auto_20200523_1133.py b/passbook/core/migrations/0002_auto_20200523_1133.py
new file mode 100644
index 000000000..393a9be75
--- /dev/null
+++ b/passbook/core/migrations/0002_auto_20200523_1133.py
@@ -0,0 +1,52 @@
+# Generated by Django 3.0.6 on 2020-05-23 11:33
+
+import django.db.models.deletion
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("passbook_flows", "0003_auto_20200523_1133"),
+        ("passbook_core", "0001_initial"),
+    ]
+
+    operations = [
+        migrations.RemoveField(model_name="application", name="skip_authorization",),
+        migrations.AddField(
+            model_name="source",
+            name="authentication_flow",
+            field=models.ForeignKey(
+                blank=True,
+                default=None,
+                help_text="Flow to use when authenticating existing users.",
+                null=True,
+                on_delete=django.db.models.deletion.SET_NULL,
+                related_name="source_authentication",
+                to="passbook_flows.Flow",
+            ),
+        ),
+        migrations.AddField(
+            model_name="source",
+            name="enrollment_flow",
+            field=models.ForeignKey(
+                blank=True,
+                default=None,
+                help_text="Flow to use when enrolling new users.",
+                null=True,
+                on_delete=django.db.models.deletion.SET_NULL,
+                related_name="source_enrollment",
+                to="passbook_flows.Flow",
+            ),
+        ),
+        migrations.AddField(
+            model_name="provider",
+            name="authorization_flow",
+            field=models.ForeignKey(
+                help_text="Flow used when authorizing this provider.",
+                on_delete=django.db.models.deletion.CASCADE,
+                related_name="provider_authorization",
+                to="passbook_flows.Flow",
+            ),
+        ),
+    ]
diff --git a/passbook/core/migrations/0002_default_user.py b/passbook/core/migrations/0003_default_user.py
similarity index 55%
rename from passbook/core/migrations/0002_default_user.py
rename to passbook/core/migrations/0003_default_user.py
index 66e6a2d3e..63af2c780 100644
--- a/passbook/core/migrations/0002_default_user.py
+++ b/passbook/core/migrations/0003_default_user.py
@@ -6,21 +6,24 @@ from django.db.backends.base.schema import BaseDatabaseSchemaEditor
 
 
 def create_default_user(apps: Apps, schema_editor: BaseDatabaseSchemaEditor):
-    # User = apps.get_model("passbook_core", "User")
+    # We have to use a direct import here, otherwise we get an object manager error
     from passbook.core.models import User
 
-    pbadmin = User.objects.create(
-        username="pbadmin", email="root@localhost",  # password="pbadmin"
+    db_alias = schema_editor.connection.alias
+
+    pbadmin, _ = User.objects.using(db_alias).get_or_create(
+        username="pbadmin", email="root@localhost", name="passbook Default Admin"
     )
-    pbadmin.set_password("pbadmin")  # nosec
+    pbadmin.set_password("pbadmin")  # noqa # nosec
     pbadmin.is_superuser = True
+    pbadmin.is_staff = True
     pbadmin.save()
 
 
 class Migration(migrations.Migration):
 
     dependencies = [
-        ("passbook_core", "0001_initial"),
+        ("passbook_core", "0002_auto_20200523_1133"),
     ]
 
     operations = [
diff --git a/passbook/core/models.py b/passbook/core/models.py
index 13517ea0e..a632c8369 100644
--- a/passbook/core/models.py
+++ b/passbook/core/models.py
@@ -5,20 +5,18 @@ from uuid import uuid4
 
 from django.contrib.auth.models import AbstractUser
 from django.contrib.postgres.fields import JSONField
-from django.core.exceptions import ValidationError
 from django.db import models
 from django.http import HttpRequest
 from django.utils.timezone import now
 from django.utils.translation import gettext_lazy as _
 from guardian.mixins import GuardianUserMixin
-from jinja2 import Undefined
-from jinja2.exceptions import TemplateSyntaxError, UndefinedError
 from model_utils.managers import InheritanceManager
 from structlog import get_logger
 
 from passbook.core.exceptions import PropertyMappingExpressionException
 from passbook.core.signals import password_changed
 from passbook.core.types import UILoginButton, UIUserSettings
+from passbook.flows.models import Flow
 from passbook.lib.models import CreatedUpdatedModel
 from passbook.policies.models import PolicyBindingModel
 
@@ -78,6 +76,13 @@ class User(GuardianUserMixin, AbstractUser):
 class Provider(models.Model):
     """Application-independent Provider instance. For example SAML2 Remote, OAuth2 Application"""
 
+    authorization_flow = models.ForeignKey(
+        Flow,
+        on_delete=models.CASCADE,
+        help_text=_("Flow used when authorizing this provider."),
+        related_name="provider_authorization",
+    )
+
     property_mappings = models.ManyToManyField(
         "PropertyMapping", default=None, blank=True
     )
@@ -98,7 +103,6 @@ class Application(PolicyBindingModel):
 
     name = models.TextField(help_text=_("Application's display Name."))
     slug = models.SlugField(help_text=_("Internal application name, used in URLs."))
-    skip_authorization = models.BooleanField(default=False)
     provider = models.OneToOneField(
         "Provider", null=True, blank=True, default=None, on_delete=models.SET_DEFAULT
     )
@@ -108,8 +112,6 @@ class Application(PolicyBindingModel):
     meta_description = models.TextField(default="", blank=True)
     meta_publisher = models.TextField(default="", blank=True)
 
-    objects = InheritanceManager()
-
     def get_provider(self) -> Optional[Provider]:
         """Get casted provider instance"""
         if not self.provider:
@@ -131,6 +133,25 @@ class Source(PolicyBindingModel):
         "PropertyMapping", default=None, blank=True
     )
 
+    authentication_flow = models.ForeignKey(
+        Flow,
+        blank=True,
+        null=True,
+        default=None,
+        on_delete=models.SET_NULL,
+        help_text=_("Flow to use when authenticating existing users."),
+        related_name="source_authentication",
+    )
+    enrollment_flow = models.ForeignKey(
+        Flow,
+        blank=True,
+        null=True,
+        default=None,
+        on_delete=models.SET_NULL,
+        help_text=_("Flow to use when enrolling new users."),
+        related_name="source_enrollment",
+    )
+
     form = ""  # ModelForm-based class ued to create/edit instance
 
     objects = InheritanceManager()
@@ -206,30 +227,14 @@ class PropertyMapping(models.Model):
         self, user: Optional[User], request: Optional[HttpRequest], **kwargs
     ) -> Any:
         """Evaluate `self.expression` using `**kwargs` as Context."""
-        from passbook.policies.expression.evaluator import Evaluator
+        from passbook.core.expression import PropertyMappingEvaluator
 
-        evaluator = Evaluator()
+        evaluator = PropertyMappingEvaluator()
+        evaluator.set_context(user, request, **kwargs)
         try:
-            expression = evaluator.env.from_string(self.expression)
-        except TemplateSyntaxError as exc:
+            return evaluator.evaluate(self.expression)
+        except (ValueError, SyntaxError) as exc:
             raise PropertyMappingExpressionException from exc
-        try:
-            response = expression.render(user=user, request=request, **kwargs)
-            if isinstance(response, Undefined):
-                raise PropertyMappingExpressionException("Response was 'Undefined'")
-            return response
-        except UndefinedError as exc:
-            raise PropertyMappingExpressionException from exc
-
-    def save(self, *args, **kwargs):
-        from passbook.policies.expression.evaluator import Evaluator
-
-        evaluator = Evaluator()
-        try:
-            evaluator.env.from_string(self.expression)
-        except TemplateSyntaxError as exc:
-            raise ValidationError("Expression Syntax Error") from exc
-        return super().save(*args, **kwargs)
 
     def __str__(self):
         return f"Property Mapping {self.name}"
diff --git a/passbook/core/templates/base/page.html b/passbook/core/templates/base/page.html
index a7bdcefd5..9b918451f 100644
--- a/passbook/core/templates/base/page.html
+++ b/passbook/core/templates/base/page.html
@@ -25,22 +25,22 @@
             </a>
         </div>
         <div class="pf-c-page__header-nav">
-            <nav class="pf-c-nav" aria-label="Nav">
-                <ul class="pf-c-nav__horizontal-list ws-top-nav">
+            <nav class="pf-c-nav pf-m-horizontal" aria-label="Nav">
+                <ul class="pf-c-nav__list ws-top-nav">
                     <li class="pf-c-nav__item"><a class="pf-c-nav__link {% is_active_url 'passbook_core:overview' %}"
                             href="{% url 'passbook_core:overview' %}">{% trans 'Access' %}</a></li>
                     {% if user.is_superuser %}
                     <li class="pf-c-nav__item"><a class="pf-c-nav__link {% is_active_app 'passbook_admin' %}"
                             href="{% url 'passbook_admin:overview' %}">{% trans 'Administrate' %}</a></li>
-                    <li class="pf-c-nav__item"><a class="pf-c-nav__link {% is_active_url 'passbook_admin:audit-log' %}"
-                            href="{% url 'passbook_admin:audit-log' %}">{% trans 'Monitor' %}</a></li>
+                    <li class="pf-c-nav__item"><a class="pf-c-nav__link {% is_active_url 'passbook_audit:log' %}"
+                            href="{% url 'passbook_audit:log' %}">{% trans 'Monitor' %}</a></li>
                     {% endif %}
                 </ul>
             </nav>
         </div>
         <div class="pf-c-page__header-tools">
             <div class="pf-c-page__header-tools-group pf-m-icons">
-                <a href="{% url 'passbook_flows:default-invalidation' %}" class="pf-c-button pf-m-plain" type="button">
+                <a href="{% url 'passbook_flows:default-invalidation' %}" class="pf-c-button pf-m-plain" type="button" aria-label="logout">
                     <i class="fas fa-sign-out-alt" aria-hidden="true"></i>
                 </a>
             </div>
diff --git a/passbook/core/templates/base/skeleton.html b/passbook/core/templates/base/skeleton.html
index bcae7ff0d..f6edef55e 100644
--- a/passbook/core/templates/base/skeleton.html
+++ b/passbook/core/templates/base/skeleton.html
@@ -20,11 +20,15 @@
     </head>
     <body>
         {% if 'impersonate_id' in request.session %}
-        <div class="experimental-pf-bar">
-            <span id="experimentalBar" class="experimental-pf-text">
-                {% blocktrans with user=user %}You're currently impersonating {{ user }}.{% endblocktrans %}
-                <a href="?__unimpersonate=True" id="acceptMessage">{% trans 'Stop impersonation' %}</a>
-            </span>
+        <div class="pf-c-banner pf-m-warning pf-c-alert pf-m-sticky">
+            <div class="pf-l-flex pf-m-justify-content-center pf-m-justify-content-space-between-on-lg pf-m-nowrap" style="height: 100%;">
+                <div class=""></div>
+                <div class="pf-u-display-none pf-u-display-block-on-lg">
+                    {% blocktrans with user=user %}You're currently impersonating {{ user }}.{% endblocktrans %}
+                    <a href="?__unimpersonate=True" id="acceptMessage">{% trans 'Stop impersonation' %}</a>
+                </div>
+                <div class=""></div>
+            </div>
         </div>
         {% endif %}
         {% block body %}
diff --git a/passbook/core/templates/error/generic.html b/passbook/core/templates/error/generic.html
index 24595d1c8..4f1753b3e 100644
--- a/passbook/core/templates/error/generic.html
+++ b/passbook/core/templates/error/generic.html
@@ -1,20 +1,57 @@
-{% extends 'login/base.html' %}
+{% extends 'base/skeleton.html' %}
 
 {% load static %}
 {% load i18n %}
 {% load passbook_utils %}
 
-{% block card_title %}
-{% trans 'Bad Request' %}
-{% endblock %}
-
-{% block card %}
-<form>
-    {% if message %}
-    <h3>{% trans message %}</h3>
-    {% endif %}
-    {% if 'back' in request.GET %}
-    <a href="{% back %}" class="btn btn-primary btn-block btn-lg">{% trans 'Back' %}</a>
-    {% endif %}
-</form>
+{% block body %}
+<div class="pf-c-background-image">
+    <svg xmlns="http://www.w3.org/2000/svg" class="pf-c-background-image__filter" width="0" height="0">
+        <filter id="image_overlay">
+            <feColorMatrix type="matrix" values="1 0 0 0 0 1 0 0 0 0 1 0 0 0 0 0 0 0 1 0"></feColorMatrix>
+            <feComponentTransfer color-interpolation-filters="sRGB" result="duotone">
+                <feFuncR type="table" tableValues="0.086274509803922 0.43921568627451"></feFuncR>
+                <feFuncG type="table" tableValues="0.086274509803922 0.43921568627451"></feFuncG>
+                <feFuncB type="table" tableValues="0.086274509803922 0.43921568627451"></feFuncB>
+                <feFuncA type="table" tableValues="0 1"></feFuncA>
+            </feComponentTransfer>
+        </filter>
+    </svg>
+</div>
+<div class="pf-c-login">
+    <div class="pf-c-login__container">
+        <header class="pf-c-login__header">
+            <img class="pf-c-brand" src="{% static 'passbook/logo.svg' %}" style="height: 60px;" alt="passbook icon" />
+            <img class="pf-c-brand" src="{% static 'passbook/brand.svg' %}" style="height: 60px;" alt="passbook branding" />
+        </header>
+        <main class="pf-c-login__main" id="flow-body">
+            <header class="pf-c-login__main-header">
+                <h1 class="pf-c-title pf-m-3xl">
+                    {% trans 'Bad Request' %}
+                </h1>
+            </header>
+            <div class="pf-c-login__main-body">
+                {% block card %}
+                <form method="POST" class="pf-c-form">
+                    {% if message %}
+                    <h3>{% trans message %}</h3>
+                    {% endif %}
+                    {% if 'back' in request.GET %}
+                    <a href="{% back %}" class="btn btn-primary btn-block btn-lg">{% trans 'Back' %}</a>
+                    {% endif %}
+                </form>
+                {% endblock %}
+            </div>
+        </main>
+        <footer class="pf-c-login__footer">
+            <p></p>
+            <ul class="pf-c-list pf-m-inline">
+                <li>
+                    <a href="https://passbook.beryju.org/">{% trans 'Documentation' %}</a>
+                </li>
+                <!-- TODO:load config.passbook.footer.links -->
+            </ul>
+        </footer>
+    </div>
+</div>
 {% endblock %}
diff --git a/passbook/core/templates/login/base.html b/passbook/core/templates/login/base.html
index b7234adaa..5c8000887 100644
--- a/passbook/core/templates/login/base.html
+++ b/passbook/core/templates/login/base.html
@@ -20,3 +20,40 @@
     </form>
     {% endblock %}
 </div>
+<footer class="pf-c-login__main-footer">
+    {% if config.login.subtext %}
+    <p>{{ config.login.subtext }}</p>
+    {% endif %}
+    <ul class="pf-c-login__main-footer-links">
+        {% for source in sources %}
+        <li class="pf-c-login__main-footer-links-item">
+            <a href="{{ source.url }}" class="pf-c-login__main-footer-links-item-link">
+                {% if source.icon_path %}
+                <img src="{% static source.icon_path %}" alt="{{ source.name }}">
+                {% elif source.icon_url %}
+                <img src="icon_url" alt="{{ source.name }}">
+                {% else %}
+                <i class="pf-icon pf-icon-arrow" title="{{ source.name }}"></i>
+                {% endif %}
+            </a>
+        </li>
+        {% endfor %}
+    </ul>
+    {% if enroll_url or recovery_url %}
+    <div class="pf-c-login__main-footer-band">
+        {% if enroll_url %}
+        <p class="pf-c-login__main-footer-band-item">
+            {% trans 'Need an account?' %}
+            <a href="{{ enroll_url }}">{% trans 'Sign up.' %}</a>
+        </p>
+        {% endif %}
+        {% if recovery_url %}
+        <p class="pf-c-login__main-footer-band-item">
+            <a href="{{ recovery_url }}">
+                {% trans 'Forgot username or password?' %}
+            </a>
+        </p>
+        {% endif %}
+    </div>
+    {% endif %}
+</footer>
diff --git a/passbook/core/templates/login/denied.html b/passbook/core/templates/login/denied.html
index 35e9d6916..fd28cdd1b 100644
--- a/passbook/core/templates/login/denied.html
+++ b/passbook/core/templates/login/denied.html
@@ -1,21 +1,62 @@
-{% extends 'login/base.html' %}
+{% extends 'base/skeleton.html' %}
 
 {% load static %}
 {% load i18n %}
 {% load passbook_utils %}
 
-{% block card %}
-<form method="POST" class="pf-c-form">
-    {% csrf_token %}
-    {% include 'partials/form.html' %}
-    <div class="pf-c-form__group">
-        <p>
-            <i class="pf-icon pf-icon-error-circle-o"></i>
-            {% trans 'Access denied' %}
-        </p>
+{% block body %}
+<div class="pf-c-background-image">
+    <svg xmlns="http://www.w3.org/2000/svg" class="pf-c-background-image__filter" width="0" height="0">
+        <filter id="image_overlay">
+            <feColorMatrix type="matrix" values="1 0 0 0 0 1 0 0 0 0 1 0 0 0 0 0 0 0 1 0"></feColorMatrix>
+            <feComponentTransfer color-interpolation-filters="sRGB" result="duotone">
+                <feFuncR type="table" tableValues="0.086274509803922 0.43921568627451"></feFuncR>
+                <feFuncG type="table" tableValues="0.086274509803922 0.43921568627451"></feFuncG>
+                <feFuncB type="table" tableValues="0.086274509803922 0.43921568627451"></feFuncB>
+                <feFuncA type="table" tableValues="0 1"></feFuncA>
+            </feComponentTransfer>
+        </filter>
+    </svg>
+</div>
+<div class="pf-c-login">
+    <div class="pf-c-login__container">
+        <header class="pf-c-login__header">
+            <img class="pf-c-brand" src="{% static 'passbook/logo.svg' %}" style="height: 60px;" alt="passbook icon" />
+            <img class="pf-c-brand" src="{% static 'passbook/brand.svg' %}" style="height: 60px;" alt="passbook branding" />
+        </header>
+        <main class="pf-c-login__main" id="flow-body">
+            <header class="pf-c-login__main-header">
+                <h1 class="pf-c-title pf-m-3xl">
+                    {% trans 'Permission denied' %}
+                </h1>
+            </header>
+            <div class="pf-c-login__main-body">
+                {% block card %}
+                    <form method="POST" class="pf-c-form">
+                        {% csrf_token %}
+                        {% include 'partials/form.html' %}
+                        <div class="pf-c-form__group">
+                            <p>
+                                <i class="pf-icon pf-icon-error-circle-o"></i>
+                                {% trans 'Access denied' %}
+                            </p>
+                        </div>
+                        {% if 'back' in request.GET %}
+                        <a href="{% back %}" class="btn btn-primary btn-block btn-lg">{% trans 'Back' %}</a>
+                        {% endif %}
+                    </form>
+                {% endblock %}
+            </div>
+        </main>
+        <footer class="pf-c-login__footer">
+            <p></p>
+            <ul class="pf-c-list pf-m-inline">
+                <li>
+                    <a href="https://passbook.beryju.org/">{% trans 'Documentation' %}</a>
+                </li>
+                <!-- TODO: load config.passbook.footer.links -->
+            </ul>
+        </footer>
     </div>
-    {% if 'back' in request.GET %}
-    <a href="{% back %}" class="btn btn-primary btn-block btn-lg">{% trans 'Back' %}</a>
-    {% endif %}
-</form>
+</div>
 {% endblock %}
diff --git a/passbook/core/templates/login/form_with_user.html b/passbook/core/templates/login/form_with_user.html
index a7c2461fe..dfe6213a2 100644
--- a/passbook/core/templates/login/form_with_user.html
+++ b/passbook/core/templates/login/form_with_user.html
@@ -5,16 +5,13 @@
 
 {% block above_form %}
 <div class="pf-c-form__group">
-    <label class="pf-c-form__label" for="{{ field.name }}-{{ forloop.counter0 }}">
-        <span class="pf-c-form__label-text">{% trans "Username" %}</span>
-    </label>
     <div class="form-control-static">
         <div class="left">
             <img class="pf-c-avatar" src="{% gravatar user.email %}" alt="">
             {{ user.username }}
         </div>
         <div class="right">
-            <a href="{% url 'passbook_flows:default-authentication' %}">{% trans 'Not you?' %}</a>
+            <a href="{% url 'passbook_flows:cancel' %}">{% trans 'Not you?' %}</a>
         </div>
     </div>
 </div>
diff --git a/passbook/core/templates/overview/index.html b/passbook/core/templates/overview/index.html
index 18408f152..69df63e7d 100644
--- a/passbook/core/templates/overview/index.html
+++ b/passbook/core/templates/overview/index.html
@@ -43,17 +43,19 @@
         {% endfor %}
     </div>
     {% else %}
-    <div class="pf-c-empty-state">
-        <i class="fas fa-cubes pf-c-empty-state__icon" aria-hidden="true"></i>
-        <h1 class="pf-c-title pf-m-lg">{% trans 'No Applications available.' %}</h1>
-        <div class="pf-c-empty-state__body">
-            {% trans "Either no applications are defined, or you don't have access to any." %}
+    <div class="pf-c-empty-state pf-m-full-height">
+        <div class="pf-c-empty-state__content">
+            <i class="fas fa-cubes pf-c-empty-state__icon" aria-hidden="true"></i>
+            <h1 class="pf-c-title pf-m-lg">{% trans 'No Applications available.' %}</h1>
+            <div class="pf-c-empty-state__body">
+                {% trans "Either no applications are defined, or you don't have access to any." %}
+            </div>
+            {% if user.is_superuser %} {# TODO:use guardian permissions instead #}
+            <a href="{% url 'passbook_admin:application-create' %}" class="pf-c-button pf-m-primary" type="button">
+                {% trans 'Create Application' %}
+            </a>
+            {% endif %}
         </div>
-        {% if user.is_superuser %} {# todo: use guardian permissions instead #}
-        <a href="{% url 'passbook_admin:application-create' %}" class="pf-c-button pf-m-primary" type="button">
-            {% trans 'Create Application' %}
-        </a>
-        {% endif %}
     </div>
     {% endif %}
 </section>
diff --git a/passbook/core/templates/partials/form.html b/passbook/core/templates/partials/form.html
index efd249d08..c954ecb18 100644
--- a/passbook/core/templates/partials/form.html
+++ b/passbook/core/templates/partials/form.html
@@ -10,6 +10,9 @@
 </div>
 {% endif %}
 {% for field in form %}
+{% if field.field.widget|fieldtype == 'HiddenInput' %}
+    {{ field }}
+{% else %}
 <div class="pf-c-form__group {% if field.errors %} has-error {% endif %}">
     {% if field.field.widget|fieldtype == 'RadioSelect' %}
         <label class="pf-c-form__label" {% if field.field.required %}class="required" {% endif %}
@@ -66,4 +69,5 @@
     </p>
     {% endfor %}
 </div>
+{% endif %}
 {% endfor %}
diff --git a/passbook/core/templates/partials/form_horizontal.html b/passbook/core/templates/partials/form_horizontal.html
index facce648e..e2b4e6e3d 100644
--- a/passbook/core/templates/partials/form_horizontal.html
+++ b/passbook/core/templates/partials/form_horizontal.html
@@ -5,52 +5,74 @@
 {% for field in form %}
 <div class="pf-c-form__group {% if field.errors %} has-error {% endif %}">
     {% if field.field.widget|fieldtype == 'RadioSelect' %}
-        <label class="pf-c-form__label" for="{{ field.name }}-{{ forloop.counter0 }}">
-            <span class="pf-c-form__label-text">{{ field.label }}</span>
-            {% if field.field.required %}
-            <span class="pf-c-form__label-required" aria-hidden="true">&#42;</span>
-            {% endif %}
-        </label>
-        {% for c in field %}
-        <div class="radio col-sm-10">
-            <input type="radio" id="{{ field.name }}-{{ forloop.counter0 }}"
-                name="{% if wizard %}{{ wizard.steps.current }}-{% endif %}{{ field.name }}" value="{{ c.data.value }}"
-                {% if c.data.selected %} checked {% endif %}>
-            <label class="pf-c-form__label" for="{{ field.name }}-{{ forloop.counter0 }}">{{ c.choice_label }}</label>
+        <div class="pf-c-form__group-label">
+            <label class="pf-c-form__label" for="{{ field.name }}-{{ forloop.counter0 }}">
+                <span class="pf-c-form__label-text">{{ field.label }}</span>
+                {% if field.field.required %}
+                <span class="pf-c-form__label-required" aria-hidden="true">&#42;</span>
+                {% endif %}
+            </label>
         </div>
-        {% endfor %}
-    {% elif field.field.widget|fieldtype == 'Select' %}
-        <label class="pf-c-form__label" for="{{ field.name }}-{{ forloop.counter0 }}">
-            <span class="pf-c-form__label-text">{{ field.label }}</span>
-            {% if field.field.required %}
-            <span class="pf-c-form__label-required" aria-hidden="true">&#42;</span>
-            {% endif %}
-        </label>
-        <div class="pf-c-form__horizontal-group">
-            {{ field|css_class:"pf-c-form-control" }}
-        </div>
-    {% elif field.field.widget|fieldtype == 'CheckboxInput' %}
-        <div class="pf-c-form__horizontal-group">
-            <div class="pf-c-check">
-                {{ field|css_class:"pf-c-check__input" }}
-                <label class="pf-c-check__label" for="{{ field.name }}-{{ forloop.counter0 }}">{{ field.label }}</label>
+        <div class="pf-c-form__group-control">
+            {% for c in field %}
+            <div class="pf-c-radio">
+                <input class="pf-c-radio__input"
+                       type="radio" id="{{ field.name }}-{{ forloop.counter0 }}"
+                       name="{% if wizard %}{{ wizard.steps.current }}-{% endif %}{{ field.name }}"
+                       value="{{ c.data.value }}"
+                       {% if c.data.selected %} checked {% endif %}/>
+                <label class="pf-c-radio__label" for="{{ field.name }}-{{ forloop.counter0 }}">{{ c.choice_label }}</label>
             </div>
+            {% endfor %}
             {% if field.help_text %}
             <p class="pf-c-form__helper-text">{{ field.help_text }}</p>
             {% endif %}
         </div>
+    {% elif field.field.widget|fieldtype == 'Select' %}
+        <div class="pf-c-form__group-label">
+            <label class="pf-c-form__label" for="{{ field.name }}-{{ forloop.counter0 }}">
+                <span class="pf-c-form__label-text">{{ field.label }}</span>
+                {% if field.field.required %}
+                <span class="pf-c-form__label-required" aria-hidden="true">&#42;</span>
+                {% endif %}
+            </label>
+        </div>
+        <div class="pf-c-form__group-control">
+            <div class="pf-c-form__horizontal-group">
+                {{ field|css_class:"pf-c-form-control" }}
+                {% if field.help_text %}
+                <p class="pf-c-form__helper-text">{{ field.help_text|safe }}</p>
+                {% endif %}
+            </div>
+        </div>
+    {% elif field.field.widget|fieldtype == 'CheckboxInput' %}
+        <div class="pf-c-form__group-control">
+            <div class="pf-c-form__horizontal-group">
+                <div class="pf-c-check">
+                    {{ field|css_class:"pf-c-check__input" }}
+                    <label class="pf-c-check__label" for="{{ field.name }}-{{ forloop.counter0 }}">{{ field.label }}</label>
+                </div>
+                {% if field.help_text %}
+                <p class="pf-c-form__helper-text">{{ field.help_text|safe }}</p>
+                {% endif %}
+            </div>
+        </div>
     {% else %}
-        <label class="pf-c-form__label" for="{{ field.name }}-{{ forloop.counter0 }}">
-            <span class="pf-c-form__label-text">{{ field.label }}</span>
-            {% if field.field.required %}
-            <span class="pf-c-form__label-required" aria-hidden="true">&#42;</span>
-            {% endif %}
-        </label>
-        <div class="c-form__horizontal-group">
-            {{ field|css_class:'pf-c-form-control' }}
-            {% if field.help_text %}
-                <p class="pf-c-form__helper-text">{{ field.help_text }}</p>
-            {% endif %}
+        <div class="pf-c-form__group-label">
+            <label class="pf-c-form__label" for="{{ field.name }}-{{ forloop.counter0 }}">
+                <span class="pf-c-form__label-text">{{ field.label }}</span>
+                {% if field.field.required %}
+                <span class="pf-c-form__label-required" aria-hidden="true">&#42;</span>
+                {% endif %}
+            </label>
+        </div>
+        <div class="pf-c-form__group-control">
+            <div class="c-form__horizontal-group">
+                {{ field|css_class:'pf-c-form-control' }}
+                {% if field.help_text %}
+                    <p class="pf-c-form__helper-text">{{ field.help_text|safe }}</p>
+                {% endif %}
+            </div>
         </div>
     {% endif %}
     {% for error in field.errors %}
diff --git a/passbook/core/templates/partials/pagination.html b/passbook/core/templates/partials/pagination.html
index 9fbe8c855..c026e558c 100644
--- a/passbook/core/templates/partials/pagination.html
+++ b/passbook/core/templates/partials/pagination.html
@@ -1,43 +1,43 @@
 {% load i18n %}
 
-<div class="pf-c-pagination">
-    <div class="pf-c-pagination__total-items">
-        <b>{{ page_obj.start_index }} - {{ page_obj.end_index }}</b>of
-        <b>{{ page_obj.count }}</b>
-    </div>
-    {% with param=get_param|default:'page' %}
-    <nav class="pf-c-pagination__nav" aria-label="Pagination">
-        <a class="pf-c-button pf-m-plain" type="button" aria-label="Go to first page"
-            href="?{{ param }}=1">
-            <i class="fas fa-angle-double-left" aria-hidden="true"></i>
-        </a>
-        <a class="pf-c-button pf-m-plain" type="button" aria-label="Go to previous page"
-            {% if page_obj.has_previous %}
-            href="?{{ param }}={{ page_obj.previous_page_number }}"
-            {% else %}
-            disabled
-            {% endif %}>
-            <i class="fas fa-angle-left" aria-hidden="true"></i>
-        </a>
-        <div class="pf-c-pagination__nav-page-select">
-            <span>
-                {% blocktrans with current=page_obj.number total=page_obj.paginator.num_pages %}
-                {{ current }} of {{ total }}
-                {% endblocktrans %}
-            </span>
+<div class="pf-c-toolbar__item pf-m-pagination">
+    <div class="pf-c-pagination">
+        <div class="pf-c-pagination__total-items">
+            <b>{{ page_obj.start_index }} - {{ page_obj.end_index }}</b>of
+            <b>{{ page_obj.count }}</b>
         </div>
-        <a class="pf-c-button pf-m-plain" type="button" aria-label="Go to next page"
-            {% if page_obj.has_next %}
-            href="?{{ param }}={{ page_obj.next_page_number }}"
-            {% else %}
-            disabled
-            {% endif %}>
-            <i class="fas fa-angle-right" aria-hidden="true"></i>
-        </a>
-        <a class="pf-c-button pf-m-plain" type="button" aria-label="Go to last page"
-            href="?{{ param }}={{ page_obj.num_pages }}">
-            <i class="fas fa-angle-double-right" aria-hidden="true"></i>
-        </a>
-    </nav>
-    {% endwith %}
+        {% with param=get_param|default:'page' %}
+        <nav class="pf-c-pagination__nav" aria-label="Pagination">
+            <a class="pf-c-button pf-m-plain" type="button" aria-label="Go to first page" href="?{{ param }}=1">
+                <i class="fas fa-angle-double-left" aria-hidden="true"></i>
+            </a>
+            <a class="pf-c-button pf-m-plain" type="button" aria-label="Go to previous page"
+                {% if page_obj.has_previous %}
+                href="?{{ param }}={{ page_obj.previous_page_number }}"
+                {% else %}
+                disabled
+                {% endif %}>
+                <i class="fas fa-angle-left" aria-hidden="true"></i>
+            </a>
+            <div class="pf-c-pagination__nav-page-select">
+                <span>
+                    {% blocktrans with current=page_obj.number total=page_obj.paginator.num_pages %}
+                    {{ current }} of {{ total }}
+                    {% endblocktrans %}
+                </span>
+            </div>
+            <a class="pf-c-button pf-m-plain" type="button" aria-label="Go to next page"
+                {% if page_obj.has_next %}
+                href="?{{ param }}={{ page_obj.next_page_number }}"
+                {% else %}
+                disabled
+                {% endif %}>
+                <i class="fas fa-angle-right" aria-hidden="true"></i>
+            </a>
+            <a class="pf-c-button pf-m-plain" type="button" aria-label="Go to last page" href="?{{ param }}={{ page_obj.num_pages }}">
+                <i class="fas fa-angle-double-right" aria-hidden="true"></i>
+            </a>
+        </nav>
+        {% endwith %}
+    </div>
 </div>
diff --git a/passbook/core/templates/user/base.html b/passbook/core/templates/user/base.html
index 4c0c6798b..b746d4e38 100644
--- a/passbook/core/templates/user/base.html
+++ b/passbook/core/templates/user/base.html
@@ -25,8 +25,7 @@
                 <ul class="pf-c-nav__list">
                     {% for stage in user_stages_loc %}
                     <li class="pf-c-nav__item">
-                        <a href="{% url stage.view_name %}" class="pf-c-nav__link {% is_active stage.view_name %}">
-                            <i class="{{ stage.icon }}"></i>
+                        <a href="{{ stage.url }}" class="pf-c-nav__link {% if stage.url == request.get_full_path %} pf-m-current {% endif %}">
                             {{ stage.name }}
                         </a>
                     </li>
@@ -42,8 +41,7 @@
                     {% for source in user_sources_loc %}
                     <li class="pf-c-nav__item">
                         <a href="{{ source.view_name }}"
-                            class="pf-c-nav__link {% if user_settings.view_name == request.get_full_path %} pf-m-current {% endif %}">
-                            <i class="{{ source.icon }}"></i>
+                            class="pf-c-nav__link {% if source.url == request.get_full_path %} pf-m-current {% endif %}">
                             {{ source.name }}
                         </a>
                     </li>
@@ -56,9 +54,11 @@
 </div>
 <main role="main" class="pf-c-page__main" tabindex="-1" id="main-content">
     <section class="pf-c-page__main-section">
-        <div class="pf-l-split pf-m-gutter">
-            {% block page %}
-            {% endblock %}
+        <div class="pf-u-display-flex pf-u-justify-content-center">
+            <div class="pf-u-w-75">
+                {% block page %}
+                {% endblock %}
+            </div>
         </div>
     </section>
 </main>
diff --git a/passbook/core/templates/user/settings.html b/passbook/core/templates/user/settings.html
index 5e752f935..18b5b9431 100644
--- a/passbook/core/templates/user/settings.html
+++ b/passbook/core/templates/user/settings.html
@@ -3,28 +3,26 @@
 {% load i18n %}
 
 {% block page %}
-<div class="pf-l-split__item">
-    <div class="pf-c-card">
-        <div class="pf-c-card__header pf-c-title pf-m-md">
-            <h1>{% trans 'Update details' %}</h1>
-        </div>
-        <div class="pf-c-card__body">
-            <form action="" method="post" class="pf-c-form pf-m-horizontal">
-                {% include 'partials/form_horizontal.html' with form=form %}
-                {% block beneath_form %}
-                {% endblock %}
-                <div class="pf-c-form__group pf-m-action">
-                    <div class="pf-c-form__horizontal-group">
-                        <div class="pf-c-form__actions">
-                            <input class="pf-c-button pf-m-primary" type="submit" value="{% trans 'Update' %}" />
-                            {% if unenrollment_enabled %}
-                            <a class="pf-c-button pf-m-danger" href="{% url 'passbook_flows:default-unenrollment' %}?back={{ request.get_full_path }}">{% trans "Delete account" %}</a>
-                            {% endif %}
-                        </div>
+<div class="pf-c-card">
+    <div class="pf-c-card__header pf-c-title pf-m-md">
+        {% trans 'Update details' %}
+    </div>
+    <div class="pf-c-card__body">
+        <form action="" method="post" class="pf-c-form pf-m-horizontal">
+            {% include 'partials/form_horizontal.html' with form=form %}
+            {% block beneath_form %}
+            {% endblock %}
+            <div class="pf-c-form__group pf-m-action">
+                <div class="pf-c-form__horizontal-group">
+                    <div class="pf-c-form__actions">
+                        <input class="pf-c-button pf-m-primary" type="submit" value="{% trans 'Update' %}" />
+                        {% if unenrollment_enabled %}
+                        <a class="pf-c-button pf-m-danger" href="{% url 'passbook_flows:default-unenrollment' %}?back={{ request.get_full_path }}">{% trans "Delete account" %}</a>
+                        {% endif %}
                     </div>
                 </div>
-            </form>
-        </div>
+            </div>
+        </form>
     </div>
 </div>
 {% endblock %}
diff --git a/passbook/core/templatetags/passbook_user_settings.py b/passbook/core/templatetags/passbook_user_settings.py
index 7c0287eec..c04860627 100644
--- a/passbook/core/templatetags/passbook_user_settings.py
+++ b/passbook/core/templatetags/passbook_user_settings.py
@@ -23,7 +23,7 @@ def user_stages(context: RequestContext) -> List[UIUserSettings]:
         if not user_settings:
             continue
         matching_stages.append(user_settings)
-    return matching_stages
+    return sorted(matching_stages, key=lambda x: x.name)
 
 
 @register.simple_tag(takes_context=True)
@@ -38,10 +38,8 @@ def user_sources(context: RequestContext) -> List[UIUserSettings]:
         user_settings = source.ui_user_settings
         if not user_settings:
             continue
-        policy_engine = PolicyEngine(
-            source.policies.all(), user, context.get("request")
-        )
+        policy_engine = PolicyEngine(source, user, context.get("request"))
         policy_engine.build()
         if policy_engine.passing:
             matching_sources.append(user_settings)
-    return matching_sources
+    return sorted(matching_sources, key=lambda x: x.name)
diff --git a/passbook/core/tests/tests_tasks.py b/passbook/core/tests/tests_tasks.py
new file mode 100644
index 000000000..2dac97a5c
--- /dev/null
+++ b/passbook/core/tests/tests_tasks.py
@@ -0,0 +1,18 @@
+"""passbook user view tests"""
+from django.test import TestCase
+from django.utils.timezone import now
+from guardian.shortcuts import get_anonymous_user
+
+from passbook.core.models import Token
+from passbook.core.tasks import clean_tokens
+
+
+class TestTasks(TestCase):
+    """Test Tasks"""
+
+    def test_token_cleanup(self):
+        """Test Token cleanup task"""
+        Token.objects.create(expires=now(), user=get_anonymous_user())
+        self.assertEqual(Token.objects.all().count(), 1)
+        clean_tokens()
+        self.assertEqual(Token.objects.all().count(), 0)
diff --git a/passbook/core/types.py b/passbook/core/types.py
index 86d6eeea6..7804fcb29 100644
--- a/passbook/core/types.py
+++ b/passbook/core/types.py
@@ -8,8 +8,7 @@ class UIUserSettings:
     """Dataclass for Stage and Source's user_settings"""
 
     name: str
-    icon: str
-    view_name: str
+    url: str
 
 
 @dataclass
diff --git a/passbook/core/views/access.py b/passbook/core/views/access.py
deleted file mode 100644
index c2e07dd19..000000000
--- a/passbook/core/views/access.py
+++ /dev/null
@@ -1,40 +0,0 @@
-"""passbook access helper classes"""
-from django.contrib import messages
-from django.http import HttpRequest
-from django.utils.translation import gettext as _
-from structlog import get_logger
-
-from passbook.core.models import Application, Provider, User
-from passbook.policies.engine import PolicyEngine
-from passbook.policies.types import PolicyResult
-
-LOGGER = get_logger()
-
-
-class AccessMixin:
-    """Mixin class for usage in Authorization views.
-    Provider functions to check application access, etc"""
-
-    # request is set by view but since this Mixin has no base class
-    request: HttpRequest = None
-
-    def provider_to_application(self, provider: Provider) -> Application:
-        """Lookup application assigned to provider, throw error if no application assigned"""
-        try:
-            return provider.application
-        except Application.DoesNotExist as exc:
-            messages.error(
-                self.request,
-                _(
-                    'Provider "%(name)s" has no application assigned'
-                    % {"name": provider}
-                ),
-            )
-            raise exc
-
-    def user_has_access(self, application: Application, user: User) -> PolicyResult:
-        """Check if user has access to application."""
-        LOGGER.debug("Checking permissions", user=user, application=application)
-        policy_engine = PolicyEngine(application.policies.all(), user, self.request)
-        policy_engine.build()
-        return policy_engine.result
diff --git a/passbook/core/views/overview.py b/passbook/core/views/overview.py
index 6185dce05..ef5186ac6 100644
--- a/passbook/core/views/overview.py
+++ b/passbook/core/views/overview.py
@@ -16,9 +16,7 @@ class OverviewView(LoginRequiredMixin, TemplateView):
     def get_context_data(self, **kwargs):
         kwargs["applications"] = []
         for application in Application.objects.all().order_by("name"):
-            engine = PolicyEngine(
-                application.policies.all(), self.request.user, self.request
-            )
+            engine = PolicyEngine(application, self.request.user, self.request)
             engine.build()
             if engine.passing:
                 kwargs["applications"].append(application)
diff --git a/passbook/crypto/builder.py b/passbook/crypto/builder.py
index 67545f5bb..47722a463 100644
--- a/passbook/crypto/builder.py
+++ b/passbook/crypto/builder.py
@@ -36,11 +36,11 @@ class CertificateBuilder:
                 x509.Name(
                     [
                         x509.NameAttribute(
-                            NameOID.COMMON_NAME, u"passbook Self-signed Certificate",
+                            NameOID.COMMON_NAME, "passbook Self-signed Certificate",
                         ),
-                        x509.NameAttribute(NameOID.ORGANIZATION_NAME, u"passbook"),
+                        x509.NameAttribute(NameOID.ORGANIZATION_NAME, "passbook"),
                         x509.NameAttribute(
-                            NameOID.ORGANIZATIONAL_UNIT_NAME, u"Self-signed"
+                            NameOID.ORGANIZATIONAL_UNIT_NAME, "Self-signed"
                         ),
                     ]
                 )
@@ -49,7 +49,7 @@ class CertificateBuilder:
                 x509.Name(
                     [
                         x509.NameAttribute(
-                            NameOID.COMMON_NAME, u"passbook Self-signed Certificate",
+                            NameOID.COMMON_NAME, "passbook Self-signed Certificate",
                         ),
                     ]
                 )
diff --git a/passbook/flows/apps.py b/passbook/flows/apps.py
index 11f2d21d4..b5eeb0666 100644
--- a/passbook/flows/apps.py
+++ b/passbook/flows/apps.py
@@ -1,4 +1,6 @@
 """passbook flows app config"""
+from importlib import import_module
+
 from django.apps import AppConfig
 
 
@@ -9,3 +11,7 @@ class PassbookFlowsConfig(AppConfig):
     label = "passbook_flows"
     mountpoint = "flows/"
     verbose_name = "passbook Flows"
+
+    def ready(self):
+        """Flow signals that clear the cache"""
+        import_module("passbook.flows.signals")
diff --git a/passbook/flows/forms.py b/passbook/flows/forms.py
index 6f695050f..8c8d5bdc6 100644
--- a/passbook/flows/forms.py
+++ b/passbook/flows/forms.py
@@ -44,6 +44,9 @@ class FlowStageBindingForm(forms.ModelForm):
             "re_evaluate_policies",
             "order",
         ]
+        labels = {
+            "re_evaluate_policies": _("Re-evaluate Policies"),
+        }
         widgets = {
             "name": forms.TextInput(),
         }
diff --git a/passbook/flows/markers.py b/passbook/flows/markers.py
new file mode 100644
index 000000000..628f0cf28
--- /dev/null
+++ b/passbook/flows/markers.py
@@ -0,0 +1,50 @@
+"""Stage Markers"""
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, Optional
+
+from structlog import get_logger
+
+from passbook.core.models import User
+from passbook.flows.models import Stage
+from passbook.policies.engine import PolicyEngine
+from passbook.policies.models import PolicyBinding
+
+if TYPE_CHECKING:
+    from passbook.flows.planner import FlowPlan
+
+LOGGER = get_logger()
+
+
+@dataclass
+class StageMarker:
+    """Base stage marker class, no extra attributes, and has no special handler."""
+
+    # pylint: disable=unused-argument
+    def process(self, plan: "FlowPlan", stage: Stage) -> Optional[Stage]:
+        """Process callback for this marker. This should be overridden by sub-classes.
+        If a stage should be removed, return None."""
+        return stage
+
+
+@dataclass
+class ReevaluateMarker(StageMarker):
+    """Reevaluate Marker, forces stage's policies to be evaluated again."""
+
+    binding: PolicyBinding
+    user: User
+
+    def process(self, plan: "FlowPlan", stage: Stage) -> Optional[Stage]:
+        """Re-evaluate policies bound to stage, and if they fail, remove from plan"""
+        engine = PolicyEngine(self.binding, self.user)
+        engine.use_cache = False
+        engine.request.context = plan.context
+        engine.build()
+        result = engine.result
+        if result.passing:
+            return stage
+        LOGGER.warning(
+            "f(plan_inst)[re-eval marker]: stage failed re-evaluation",
+            stage=stage,
+            messages=result.messages,
+        )
+        return None
diff --git a/passbook/flows/migrations/0002_default_flows.py b/passbook/flows/migrations/0002_default_flows.py
index 21d61d338..15b45625c 100644
--- a/passbook/flows/migrations/0002_default_flows.py
+++ b/passbook/flows/migrations/0002_default_flows.py
@@ -20,42 +20,38 @@ def create_default_authentication_flow(
     )
     db_alias = schema_editor.connection.alias
 
-    if (
-        Flow.objects.using(db_alias)
-        .filter(designation=FlowDesignation.AUTHENTICATION)
-        .exists()
-    ):
-        # Only create default flow when none exist
-        return
+    identification_stage, _ = IdentificationStage.objects.using(
+        db_alias
+    ).update_or_create(
+        name="default-authentication-identification",
+        defaults={
+            "user_fields": [UserFields.E_MAIL, UserFields.USERNAME],
+            "template": Templates.DEFAULT_LOGIN,
+        },
+    )
 
-    if not IdentificationStage.objects.using(db_alias).exists():
-        IdentificationStage.objects.using(db_alias).create(
-            name="identification",
-            user_fields=[UserFields.E_MAIL],
-            template=Templates.DEFAULT_LOGIN,
-        )
+    password_stage, _ = PasswordStage.objects.using(db_alias).update_or_create(
+        name="default-authentication-password",
+        defaults={"backends": ["django.contrib.auth.backends.ModelBackend"]},
+    )
 
-    if not PasswordStage.objects.using(db_alias).exists():
-        PasswordStage.objects.using(db_alias).create(
-            name="password", backends=["django.contrib.auth.backends.ModelBackend"],
-        )
+    login_stage, _ = UserLoginStage.objects.using(db_alias).update_or_create(
+        name="default-authentication-login"
+    )
 
-    if not UserLoginStage.objects.using(db_alias).exists():
-        UserLoginStage.objects.using(db_alias).create(name="authentication")
-
-    flow = Flow.objects.using(db_alias).create(
-        name="default-authentication-flow",
+    flow, _ = Flow.objects.using(db_alias).update_or_create(
         slug="default-authentication-flow",
         designation=FlowDesignation.AUTHENTICATION,
+        defaults={"name": "Welcome to passbook!",},
     )
-    FlowStageBinding.objects.using(db_alias).create(
-        flow=flow, stage=IdentificationStage.objects.using(db_alias).first(), order=0,
+    FlowStageBinding.objects.using(db_alias).update_or_create(
+        flow=flow, stage=identification_stage, defaults={"order": 0,},
     )
-    FlowStageBinding.objects.using(db_alias).create(
-        flow=flow, stage=PasswordStage.objects.using(db_alias).first(), order=1,
+    FlowStageBinding.objects.using(db_alias).update_or_create(
+        flow=flow, stage=password_stage, defaults={"order": 1,},
     )
-    FlowStageBinding.objects.using(db_alias).create(
-        flow=flow, stage=UserLoginStage.objects.using(db_alias).first(), order=2,
+    FlowStageBinding.objects.using(db_alias).update_or_create(
+        flow=flow, stage=login_stage, defaults={"order": 2,},
     )
 
 
@@ -67,24 +63,19 @@ def create_default_invalidation_flow(
     UserLogoutStage = apps.get_model("passbook_stages_user_logout", "UserLogoutStage")
     db_alias = schema_editor.connection.alias
 
-    if (
-        Flow.objects.using(db_alias)
-        .filter(designation=FlowDesignation.INVALIDATION)
-        .exists()
-    ):
-        # Only create default flow when none exist
-        return
+    UserLogoutStage.objects.using(db_alias).update_or_create(
+        name="default-invalidation-logout"
+    )
 
-    if not UserLogoutStage.objects.using(db_alias).exists():
-        UserLogoutStage.objects.using(db_alias).create(name="logout")
-
-    flow = Flow.objects.using(db_alias).create(
-        name="default-invalidation-flow",
+    flow, _ = Flow.objects.using(db_alias).update_or_create(
         slug="default-invalidation-flow",
         designation=FlowDesignation.INVALIDATION,
+        defaults={"name": "Logout",},
     )
-    FlowStageBinding.objects.using(db_alias).create(
-        flow=flow, stage=UserLogoutStage.objects.using(db_alias).first(), order=0,
+    FlowStageBinding.objects.using(db_alias).update_or_create(
+        flow=flow,
+        stage=UserLogoutStage.objects.using(db_alias).first(),
+        defaults={"order": 0,},
     )
 
 
diff --git a/passbook/flows/migrations/0003_auto_20200523_1133.py b/passbook/flows/migrations/0003_auto_20200523_1133.py
new file mode 100644
index 000000000..951835239
--- /dev/null
+++ b/passbook/flows/migrations/0003_auto_20200523_1133.py
@@ -0,0 +1,29 @@
+# Generated by Django 3.0.6 on 2020-05-23 11:33
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("passbook_flows", "0002_default_flows"),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name="flow",
+            name="designation",
+            field=models.CharField(
+                choices=[
+                    ("authentication", "Authentication"),
+                    ("authorization", "Authorization"),
+                    ("invalidation", "Invalidation"),
+                    ("enrollment", "Enrollment"),
+                    ("unenrollment", "Unrenollment"),
+                    ("recovery", "Recovery"),
+                    ("password_change", "Password Change"),
+                ],
+                max_length=100,
+            ),
+        ),
+    ]
diff --git a/passbook/flows/migrations/0004_source_flows.py b/passbook/flows/migrations/0004_source_flows.py
new file mode 100644
index 000000000..933f986b5
--- /dev/null
+++ b/passbook/flows/migrations/0004_source_flows.py
@@ -0,0 +1,150 @@
+# Generated by Django 3.0.6 on 2020-05-23 15:47
+
+from django.apps.registry import Apps
+from django.db import migrations
+from django.db.backends.base.schema import BaseDatabaseSchemaEditor
+
+from passbook.flows.models import FlowDesignation
+from passbook.stages.prompt.models import FieldTypes
+
+FLOW_POLICY_EXPRESSION = """# This policy ensures that this flow can only be used when the user
+# is in a SSO Flow (meaning they come from an external IdP)
+return pb_is_sso_flow"""
+PROMPT_POLICY_EXPRESSION = """# Check if we've been given a username by the external IdP
+# and trigger the enrollment flow
+return 'username' in pb_flow_plan.context.get('prompt_data', {})"""
+
+
+def create_default_source_enrollment_flow(
+    apps: Apps, schema_editor: BaseDatabaseSchemaEditor
+):
+    Flow = apps.get_model("passbook_flows", "Flow")
+    FlowStageBinding = apps.get_model("passbook_flows", "FlowStageBinding")
+    PolicyBinding = apps.get_model("passbook_policies", "PolicyBinding")
+
+    ExpressionPolicy = apps.get_model(
+        "passbook_policies_expression", "ExpressionPolicy"
+    )
+
+    PromptStage = apps.get_model("passbook_stages_prompt", "PromptStage")
+    Prompt = apps.get_model("passbook_stages_prompt", "Prompt")
+    UserWriteStage = apps.get_model("passbook_stages_user_write", "UserWriteStage")
+    UserLoginStage = apps.get_model("passbook_stages_user_login", "UserLoginStage")
+
+    db_alias = schema_editor.connection.alias
+
+    # Create a policy that only allows this flow when doing an SSO Request
+    flow_policy, _ = ExpressionPolicy.objects.using(db_alias).update_or_create(
+        name="default-source-enrollment-if-sso",
+        defaults={"expression": FLOW_POLICY_EXPRESSION},
+    )
+
+    # This creates a Flow used by sources to enroll users
+    # It makes sure that a username is set, and if not, prompts the user for a Username
+    flow, _ = Flow.objects.using(db_alias).update_or_create(
+        slug="default-source-enrollment",
+        designation=FlowDesignation.ENROLLMENT,
+        defaults={"name": "Welcome to passbook!",},
+    )
+    PolicyBinding.objects.using(db_alias).update_or_create(
+        policy=flow_policy, target=flow, defaults={"order": 0}
+    )
+
+    # PromptStage to ask user for their username
+    prompt_stage, _ = PromptStage.objects.using(db_alias).update_or_create(
+        name="default-source-enrollment-username-prompt",
+    )
+    prompt, _ = Prompt.objects.using(db_alias).update_or_create(
+        field_key="username",
+        defaults={
+            "label": "Username",
+            "type": FieldTypes.TEXT,
+            "required": True,
+            "placeholder": "Username",
+        },
+    )
+    prompt_stage.fields.add(prompt)
+
+    # Policy to only trigger prompt when no username is given
+    prompt_policy, _ = ExpressionPolicy.objects.using(db_alias).update_or_create(
+        name="default-source-enrollment-if-username",
+        defaults={"expression": PROMPT_POLICY_EXPRESSION},
+    )
+
+    # UserWrite stage to create the user, and login stage to log user in
+    user_write, _ = UserWriteStage.objects.using(db_alias).update_or_create(
+        name="default-source-enrollment-write"
+    )
+    user_login, _ = UserLoginStage.objects.using(db_alias).update_or_create(
+        name="default-source-enrollment-login"
+    )
+
+    binding, _ = FlowStageBinding.objects.using(db_alias).update_or_create(
+        flow=flow, stage=prompt_stage, defaults={"order": 0}
+    )
+    PolicyBinding.objects.using(db_alias).update_or_create(
+        policy=prompt_policy, target=binding, defaults={"order": 0}
+    )
+
+    FlowStageBinding.objects.using(db_alias).update_or_create(
+        flow=flow, stage=user_write, defaults={"order": 1}
+    )
+    FlowStageBinding.objects.using(db_alias).update_or_create(
+        flow=flow, stage=user_login, defaults={"order": 2}
+    )
+
+
+def create_default_source_authentication_flow(
+    apps: Apps, schema_editor: BaseDatabaseSchemaEditor
+):
+    Flow = apps.get_model("passbook_flows", "Flow")
+    FlowStageBinding = apps.get_model("passbook_flows", "FlowStageBinding")
+    PolicyBinding = apps.get_model("passbook_policies", "PolicyBinding")
+
+    ExpressionPolicy = apps.get_model(
+        "passbook_policies_expression", "ExpressionPolicy"
+    )
+
+    UserLoginStage = apps.get_model("passbook_stages_user_login", "UserLoginStage")
+
+    db_alias = schema_editor.connection.alias
+
+    # Create a policy that only allows this flow when doing an SSO Request
+    flow_policy, _ = ExpressionPolicy.objects.using(db_alias).update_or_create(
+        name="default-source-authentication-if-sso",
+        defaults={"expression": FLOW_POLICY_EXPRESSION,},
+    )
+
+    # This creates a Flow used by sources to authenticate users
+    flow, _ = Flow.objects.using(db_alias).update_or_create(
+        slug="default-source-authentication",
+        designation=FlowDesignation.AUTHENTICATION,
+        defaults={"name": "Welcome to passbook!",},
+    )
+    PolicyBinding.objects.using(db_alias).update_or_create(
+        policy=flow_policy, target=flow, defaults={"order": 0}
+    )
+
+    user_login, _ = UserLoginStage.objects.using(db_alias).update_or_create(
+        name="default-source-authentication-login"
+    )
+    FlowStageBinding.objects.using(db_alias).update_or_create(
+        flow=flow, stage=user_login, defaults={"order": 0}
+    )
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("passbook_flows", "0003_auto_20200523_1133"),
+        ("passbook_policies", "0001_initial"),
+        ("passbook_policies_expression", "0001_initial"),
+        ("passbook_stages_prompt", "0001_initial"),
+        ("passbook_stages_user_write", "0001_initial"),
+        ("passbook_stages_user_login", "0001_initial"),
+    ]
+
+    operations = [
+        migrations.RunPython(create_default_source_enrollment_flow),
+        migrations.RunPython(create_default_source_authentication_flow),
+    ]
diff --git a/passbook/flows/migrations/0005_provider_flows.py b/passbook/flows/migrations/0005_provider_flows.py
new file mode 100644
index 000000000..764bf826d
--- /dev/null
+++ b/passbook/flows/migrations/0005_provider_flows.py
@@ -0,0 +1,48 @@
+# Generated by Django 3.0.6 on 2020-05-24 11:34
+
+from django.apps.registry import Apps
+from django.db import migrations
+from django.db.backends.base.schema import BaseDatabaseSchemaEditor
+
+from passbook.flows.models import FlowDesignation
+
+
+def create_default_provider_authorization_flow(
+    apps: Apps, schema_editor: BaseDatabaseSchemaEditor
+):
+    Flow = apps.get_model("passbook_flows", "Flow")
+    FlowStageBinding = apps.get_model("passbook_flows", "FlowStageBinding")
+
+    ConsentStage = apps.get_model("passbook_stages_consent", "ConsentStage")
+
+    db_alias = schema_editor.connection.alias
+
+    # Empty flow for providers where consent is implicitly given
+    Flow.objects.using(db_alias).update_or_create(
+        slug="default-provider-authorization-implicit-consent",
+        designation=FlowDesignation.AUTHORIZATION,
+        defaults={"name": "Authorize Application"},
+    )
+
+    # Flow with consent form to obtain explicit user consent
+    flow, _ = Flow.objects.using(db_alias).update_or_create(
+        slug="default-provider-authorization-explicit-consent",
+        designation=FlowDesignation.AUTHORIZATION,
+        defaults={"name": "Authorize Application"},
+    )
+    stage, _ = ConsentStage.objects.using(db_alias).update_or_create(
+        name="default-provider-authorization-consent"
+    )
+    FlowStageBinding.objects.using(db_alias).update_or_create(
+        flow=flow, stage=stage, defaults={"order": 0}
+    )
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("passbook_flows", "0004_source_flows"),
+        ("passbook_stages_consent", "0001_initial"),
+    ]
+
+    operations = [migrations.RunPython(create_default_provider_authorization_flow)]
diff --git a/passbook/flows/migrations/0006_auto_20200629_0857.py b/passbook/flows/migrations/0006_auto_20200629_0857.py
new file mode 100644
index 000000000..2a917c35f
--- /dev/null
+++ b/passbook/flows/migrations/0006_auto_20200629_0857.py
@@ -0,0 +1,29 @@
+# Generated by Django 3.0.7 on 2020-06-29 08:57
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("passbook_flows", "0005_provider_flows"),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name="flow",
+            name="designation",
+            field=models.CharField(
+                choices=[
+                    ("authentication", "Authentication"),
+                    ("authorization", "Authorization"),
+                    ("invalidation", "Invalidation"),
+                    ("enrollment", "Enrollment"),
+                    ("unenrollment", "Unrenollment"),
+                    ("recovery", "Recovery"),
+                    ("stage_setup", "Stage Setup"),
+                ],
+                max_length=100,
+            ),
+        ),
+    ]
diff --git a/passbook/flows/models.py b/passbook/flows/models.py
index ffb194386..1f71130a9 100644
--- a/passbook/flows/models.py
+++ b/passbook/flows/models.py
@@ -1,5 +1,5 @@
 """Flow models"""
-from typing import Optional
+from typing import Callable, Optional
 from uuid import uuid4
 
 from django.db import models
@@ -9,21 +9,30 @@ from model_utils.managers import InheritanceManager
 from structlog import get_logger
 
 from passbook.core.types import UIUserSettings
+from passbook.lib.utils.reflection import class_to_path
 from passbook.policies.models import PolicyBindingModel
 
 LOGGER = get_logger()
 
 
+class NotConfiguredAction(models.TextChoices):
+    """Decides how the FlowExecutor should proceed when a stage isn't configured"""
+
+    SKIP = "skip"
+    # CONFIGURE = "configure"
+
+
 class FlowDesignation(models.TextChoices):
     """Designation of what a Flow should be used for. At a later point, this
     should be replaced by a database entry."""
 
     AUTHENTICATION = "authentication"
+    AUTHORIZATION = "authorization"
     INVALIDATION = "invalidation"
     ENROLLMENT = "enrollment"
     UNRENOLLMENT = "unenrollment"
     RECOVERY = "recovery"
-    PASSWORD_CHANGE = "password_change"  # nosec # noqa
+    STAGE_SETUP = "stage_setup"
 
 
 class Stage(models.Model):
@@ -48,6 +57,14 @@ class Stage(models.Model):
         return f"Stage {self.name}"
 
 
+def in_memory_stage(_type: Callable) -> Stage:
+    """Creates an in-memory stage instance, based on a `_type` as view."""
+    class_path = class_to_path(_type)
+    stage = Stage()
+    stage.type = class_path
+    return stage
+
+
 class Flow(PolicyBindingModel):
     """Flow describes how a series of Stages should be executed to authenticate/enroll/recover
     a user. Additionally, policies can be applied, to specify which users
diff --git a/passbook/flows/planner.py b/passbook/flows/planner.py
index 262279434..aee17ecd9 100644
--- a/passbook/flows/planner.py
+++ b/passbook/flows/planner.py
@@ -9,13 +9,15 @@ from structlog import get_logger
 
 from passbook.core.models import User
 from passbook.flows.exceptions import EmptyFlowException, FlowNonApplicableException
-from passbook.flows.models import Flow, Stage
+from passbook.flows.markers import ReevaluateMarker, StageMarker
+from passbook.flows.models import Flow, FlowStageBinding, Stage
 from passbook.policies.engine import PolicyEngine
 
 LOGGER = get_logger()
 
 PLAN_CONTEXT_PENDING_USER = "pending_user"
 PLAN_CONTEXT_SSO = "is_sso"
+PLAN_CONTEXT_APPLICATION = "application"
 
 
 def cache_key(flow: Flow, user: Optional[User] = None) -> str:
@@ -32,12 +34,44 @@ class FlowPlan:
     of all Stages that should be run."""
 
     flow_pk: str
+
     stages: List[Stage] = field(default_factory=list)
     context: Dict[str, Any] = field(default_factory=dict)
+    markers: List[StageMarker] = field(default_factory=list)
 
-    def next(self) -> Stage:
+    def append(self, stage: Stage, marker: Optional[StageMarker] = None):
+        """Append `stage` to all stages, optionall with stage marker"""
+        self.stages.append(stage)
+        self.markers.append(marker or StageMarker())
+
+    def next(self) -> Optional[Stage]:
         """Return next pending stage from the bottom of the list"""
-        return self.stages[0]
+        if not self.has_stages:
+            return None
+        stage = self.stages[0]
+        marker = self.markers[0]
+
+        LOGGER.debug("f(plan_inst): stage has marker", stage=stage, marker=marker)
+        marked_stage = marker.process(self, stage)
+        if not marked_stage:
+            LOGGER.debug("f(plan_inst): marker returned none, next stage", stage=stage)
+            self.stages.remove(stage)
+            self.markers.remove(marker)
+            if not self.has_stages:
+                return None
+            # pylint: disable=not-callable
+            return self.next()
+        return marked_stage
+
+    def pop(self):
+        """Pop next pending stage from bottom of list"""
+        self.markers.pop(0)
+        self.stages.pop(0)
+
+    @property
+    def has_stages(self) -> bool:
+        """Check if there are any stages left in this plan"""
+        return len(self.markers) + len(self.stages) > 0
 
 
 class FlowPlanner:
@@ -45,10 +79,13 @@ class FlowPlanner:
     that should be applied."""
 
     use_cache: bool
+    allow_empty_flows: bool
+
     flow: Flow
 
     def __init__(self, flow: Flow):
         self.use_cache = True
+        self.allow_empty_flows = False
         self.flow = flow
 
     def plan(
@@ -80,11 +117,13 @@ class FlowPlanner:
             LOGGER.debug(
                 "f(plan): Taking plan from cache", flow=self.flow, key=cached_plan_key
             )
+            # Reset the context as this isn't factored into caching
+            cached_plan.context = default_context or {}
             return cached_plan
         LOGGER.debug("f(plan): building plan", flow=self.flow)
         plan = self._build_plan(user, request, default_context)
         cache.set(cache_key(self.flow, user), plan)
-        if not plan.stages:
+        if not plan.stages and not self.allow_empty_flows:
             raise EmptyFlowException()
         return plan
 
@@ -94,7 +133,8 @@ class FlowPlanner:
         request: HttpRequest,
         default_context: Optional[Dict[str, Any]],
     ) -> FlowPlan:
-        """Actually build flow plan"""
+        """Build flow plan by checking each stage in their respective
+        order and checking the applied policies"""
         start_time = time()
         plan = FlowPlan(flow_pk=self.flow.pk.hex)
         if default_context:
@@ -105,13 +145,24 @@ class FlowPlanner:
             .select_subclasses()
             .select_related()
         ):
-            binding = stage.flowstagebinding_set.get(flow__pk=self.flow.pk)
+            binding: FlowStageBinding = stage.flowstagebinding_set.get(
+                flow__pk=self.flow.pk
+            )
             engine = PolicyEngine(binding, user, request)
             engine.request.context = plan.context
             engine.build()
             if engine.passing:
                 LOGGER.debug("f(plan): Stage passing", stage=stage, flow=self.flow)
                 plan.stages.append(stage)
+                marker = StageMarker()
+                if binding.re_evaluate_policies:
+                    LOGGER.debug(
+                        "f(plan): Stage has re-evaluate marker",
+                        stage=stage,
+                        flow=self.flow,
+                    )
+                    marker = ReevaluateMarker(binding=binding, user=user)
+                plan.markers.append(marker)
         end_time = time()
         LOGGER.debug(
             "f(plan): Finished building",
diff --git a/passbook/flows/signals.py b/passbook/flows/signals.py
new file mode 100644
index 000000000..59c1bbc0d
--- /dev/null
+++ b/passbook/flows/signals.py
@@ -0,0 +1,37 @@
+"""passbook flow signals"""
+from django.core.cache import cache
+from django.db.models.signals import post_save
+from django.dispatch import receiver
+from structlog import get_logger
+
+LOGGER = get_logger()
+
+
+def delete_cache_prefix(prefix: str) -> int:
+    """Delete keys prefixed with `prefix` and return count of deleted keys."""
+    keys = cache.keys(prefix)
+    cache.delete_many(keys)
+    return len(keys)
+
+
+@receiver(post_save)
+# pylint: disable=unused-argument
+def invalidate_flow_cache(sender, instance, **_):
+    """Invalidate flow cache when flow is updated"""
+    from passbook.flows.models import Flow, FlowStageBinding, Stage
+    from passbook.flows.planner import cache_key
+
+    if isinstance(instance, Flow):
+        total = delete_cache_prefix(f"{cache_key(instance)}*")
+        LOGGER.debug("Invalidating Flow cache", flow=instance, len=total)
+    if isinstance(instance, FlowStageBinding):
+        total = delete_cache_prefix(f"{cache_key(instance.flow)}*")
+        LOGGER.debug(
+            "Invalidating Flow cache from FlowStageBinding", binding=instance, len=total
+        )
+    if isinstance(instance, Stage):
+        total = 0
+        for binding in FlowStageBinding.objects.filter(stage=instance):
+            prefix = cache_key(binding.flow)
+            total += delete_cache_prefix(f"{prefix}*")
+        LOGGER.debug("Invalidating Flow cache from Stage", stage=instance, len=total)
diff --git a/passbook/flows/templates/flows/error.html b/passbook/flows/templates/flows/error.html
new file mode 100644
index 000000000..9f549077c
--- /dev/null
+++ b/passbook/flows/templates/flows/error.html
@@ -0,0 +1,22 @@
+{% load i18n %}
+
+<style>
+    .pb-exception {
+        font-family: monospace;
+        overflow-x: scroll;
+    }
+</style>
+
+<header class="pf-c-login__main-header">
+    <h1 class="pf-c-title pf-m-3xl">
+        {% trans 'Whoops!' %}
+    </h1>
+</header>
+<div class="pf-c-login__main-body">
+    <h3>
+        {% trans 'Something went wrong! Please try again later.' %}
+    </h3>
+    {% if debug %}
+    <pre class="pb-exception">{{ tb }}</pre>
+    {% endif %}
+</div>
diff --git a/passbook/flows/templates/flows/shell.html b/passbook/flows/templates/flows/shell.html
index be6b22724..8dbdba633 100644
--- a/passbook/flows/templates/flows/shell.html
+++ b/passbook/flows/templates/flows/shell.html
@@ -57,9 +57,9 @@
             <p></p>
             <ul class="pf-c-list pf-m-inline">
                 <li>
-                    <a href="https://beryju.github.io/passbook/">{% trans 'Documentation' %}</a>
+                    <a href="https://passbook.beryju.org/">{% trans 'Documentation' %}</a>
                 </li>
-                <!-- todo: load config.passbook.footer.links -->
+                <!-- TODO:load config.passbook.footer.links -->
             </ul>
         </footer>
     </div>
@@ -113,19 +113,19 @@ const updateMessages = () => {
         });
     });
 };
-const updateCard = (response) => {
-    if (!response.ok) {
-        console.log("well");
-    }
-    if (response.redirected && !response.url.endsWith(flowBodyUrl)) {
-        window.location = response.url;
-    } else {
-        response.text().then(text => {
-            flowBody.innerHTML = text;
+const updateCard = (data) => {
+    switch (data.type) {
+        case "redirect":
+            window.location = data.to
+            break;
+        case "template":
+            flowBody.innerHTML = data.body;
+            checkAutofocus();
             updateMessages();
             loadFormCode();
             setFormSubmitHandlers();
-        });
+        default:
+            break;
     }
 };
 const showSpinner = () => {
@@ -139,10 +139,34 @@ const loadFormCode = () => {
         document.head.appendChild(newScript);
     });
 };
+const checkAutofocus = () => {
+    const autofocusElement = document.querySelector("#flow-body [autofocus]");
+    if (autofocusElement !== null) {
+        autofocusElement.focus();
+    }
+};
+const updateFormAction = (form) => {
+    for (let index = 0; index < form.elements.length; index++) {
+        const element = form.elements[index];
+        if (element.value === form.action) {
+            console.log("Found Form action URL in form elements, not changing form action.");
+            return false;
+        }
+    }
+    form.action = flowBodyUrl;
+    return true;
+};
+const checkAutosubmit = (form) => {
+    if ("autosubmit" in form.attributes) {
+        return form.submit();
+    }
+};
 const setFormSubmitHandlers = () => {
     document.querySelectorAll("#flow-body form").forEach(form => {
+        console.log(`Checking for autosubmit attribute ${form}`);
+        checkAutosubmit(form);
         console.log(`Setting action for form ${form}`);
-        form.action = flowBodyUrl;
+        updateFormAction(form);
         console.log(`Adding handler for form ${form}`);
         form.addEventListener('submit', (e) => {
             e.preventDefault();
@@ -150,19 +174,13 @@ const setFormSubmitHandlers = () => {
             fetch(flowBodyUrl, {
                 method: 'post',
                 body: formData,
-            }).then((response) => {
-                showSpinner();
-                if (!response.url.endsWith(flowBodyUrl)) {
-                    window.location = response.url;
-                } else {
-                    updateCard(response);
-                }
+            }).then(response => response.json()).then(data => {
+                updateCard(data);
             });
         });
     });
 };
 
-fetch(flowBodyUrl).then(updateCard);
-
+fetch(flowBodyUrl).then(response => response.json()).then(data => updateCard(data));
 </script>
 {% endblock %}
diff --git a/passbook/flows/tests/test_planner.py b/passbook/flows/tests/test_planner.py
index af6ae98fa..8c65e6636 100644
--- a/passbook/flows/tests/test_planner.py
+++ b/passbook/flows/tests/test_planner.py
@@ -1,6 +1,7 @@
 """flow planner tests"""
 from unittest.mock import MagicMock, PropertyMock, patch
 
+from django.contrib.sessions.middleware import SessionMiddleware
 from django.core.cache import cache
 from django.shortcuts import reverse
 from django.test import RequestFactory, TestCase
@@ -8,14 +9,19 @@ from guardian.shortcuts import get_anonymous_user
 
 from passbook.core.models import User
 from passbook.flows.exceptions import EmptyFlowException, FlowNonApplicableException
+from passbook.flows.markers import ReevaluateMarker, StageMarker
 from passbook.flows.models import Flow, FlowDesignation, FlowStageBinding
 from passbook.flows.planner import PLAN_CONTEXT_PENDING_USER, FlowPlanner, cache_key
+from passbook.policies.dummy.models import DummyPolicy
+from passbook.policies.models import PolicyBinding
 from passbook.policies.types import PolicyResult
 from passbook.stages.dummy.models import DummyStage
 
-POLICY_RESULT_MOCK = PropertyMock(return_value=PolicyResult(False))
+POLICY_RETURN_FALSE = PropertyMock(return_value=PolicyResult(False))
 TIME_NOW_MOCK = MagicMock(return_value=3)
 
+POLICY_RETURN_TRUE = MagicMock(return_value=PolicyResult(True))
+
 
 class TestFlowPlanner(TestCase):
     """Test planner logic"""
@@ -40,7 +46,7 @@ class TestFlowPlanner(TestCase):
             planner.plan(request)
 
     @patch(
-        "passbook.policies.engine.PolicyEngine.result", POLICY_RESULT_MOCK,
+        "passbook.policies.engine.PolicyEngine.result", POLICY_RETURN_FALSE,
     )
     def test_non_applicable_plan(self):
         """Test that empty plan raises exception"""
@@ -103,3 +109,71 @@ class TestFlowPlanner(TestCase):
         planner.plan(request, default_context={PLAN_CONTEXT_PENDING_USER: user})
         key = cache_key(flow, user)
         self.assertTrue(cache.get(key) is not None)
+
+    def test_planner_marker_reevaluate(self):
+        """Test that the planner creates the proper marker"""
+        flow = Flow.objects.create(
+            name="test-default-context",
+            slug="test-default-context",
+            designation=FlowDesignation.AUTHENTICATION,
+        )
+
+        FlowStageBinding.objects.create(
+            flow=flow,
+            stage=DummyStage.objects.create(name="dummy1"),
+            order=0,
+            re_evaluate_policies=True,
+        )
+
+        request = self.request_factory.get(
+            reverse("passbook_flows:flow-executor", kwargs={"flow_slug": flow.slug}),
+        )
+        request.user = get_anonymous_user()
+
+        planner = FlowPlanner(flow)
+        plan = planner.plan(request)
+
+        self.assertIsInstance(plan.markers[0], ReevaluateMarker)
+
+    def test_planner_reevaluate_actual(self):
+        """Test planner with re-evaluate"""
+        flow = Flow.objects.create(
+            name="test-default-context",
+            slug="test-default-context",
+            designation=FlowDesignation.AUTHENTICATION,
+        )
+        false_policy = DummyPolicy.objects.create(result=False, wait_min=1, wait_max=2)
+
+        binding = FlowStageBinding.objects.create(
+            flow=flow, stage=DummyStage.objects.create(name="dummy1"), order=0
+        )
+        binding2 = FlowStageBinding.objects.create(
+            flow=flow,
+            stage=DummyStage.objects.create(name="dummy2"),
+            order=1,
+            re_evaluate_policies=True,
+        )
+
+        PolicyBinding.objects.create(policy=false_policy, target=binding2, order=0)
+
+        request = self.request_factory.get(
+            reverse("passbook_flows:flow-executor", kwargs={"flow_slug": flow.slug}),
+        )
+        request.user = get_anonymous_user()
+
+        middleware = SessionMiddleware()
+        middleware.process_request(request)
+        request.session.save()
+
+        # Here we patch the dummy policy to evaluate to true so the stage is included
+        with patch(
+            "passbook.policies.dummy.models.DummyPolicy.passes", POLICY_RETURN_TRUE
+        ):
+            planner = FlowPlanner(flow)
+            plan = planner.plan(request)
+
+            self.assertEqual(plan.stages[0], binding.stage)
+            self.assertEqual(plan.stages[1], binding2.stage)
+
+            self.assertIsInstance(plan.markers[0], StageMarker)
+            self.assertIsInstance(plan.markers[1], ReevaluateMarker)
diff --git a/passbook/flows/tests/test_views.py b/passbook/flows/tests/test_views.py
index cacbe2004..f68173582 100644
--- a/passbook/flows/tests/test_views.py
+++ b/passbook/flows/tests/test_views.py
@@ -3,16 +3,21 @@ from unittest.mock import MagicMock, PropertyMock, patch
 
 from django.shortcuts import reverse
 from django.test import Client, TestCase
+from django.utils.encoding import force_text
 
 from passbook.flows.exceptions import EmptyFlowException, FlowNonApplicableException
+from passbook.flows.markers import ReevaluateMarker, StageMarker
 from passbook.flows.models import Flow, FlowDesignation, FlowStageBinding
 from passbook.flows.planner import FlowPlan
 from passbook.flows.views import NEXT_ARG_NAME, SESSION_KEY_PLAN
 from passbook.lib.config import CONFIG
+from passbook.policies.dummy.models import DummyPolicy
+from passbook.policies.models import PolicyBinding
 from passbook.policies.types import PolicyResult
 from passbook.stages.dummy.models import DummyStage
 
-POLICY_RESULT_MOCK = PropertyMock(return_value=PolicyResult(False))
+POLICY_RETURN_FALSE = PropertyMock(return_value=PolicyResult(False))
+POLICY_RETURN_TRUE = MagicMock(return_value=PolicyResult(True))
 
 
 class TestFlowExecutor(TestCase):
@@ -29,7 +34,9 @@ class TestFlowExecutor(TestCase):
             designation=FlowDesignation.AUTHENTICATION,
         )
         stage = DummyStage.objects.create(name="dummy")
-        plan = FlowPlan(flow_pk=flow.pk.hex + "a", stages=[stage])
+        plan = FlowPlan(
+            flow_pk=flow.pk.hex + "a", stages=[stage], markers=[StageMarker()]
+        )
         session = self.client.session
         session[SESSION_KEY_PLAN] = plan
         session.save()
@@ -45,7 +52,7 @@ class TestFlowExecutor(TestCase):
             self.assertEqual(cancel_mock.call_count, 1)
 
     @patch(
-        "passbook.policies.engine.PolicyEngine.result", POLICY_RESULT_MOCK,
+        "passbook.policies.engine.PolicyEngine.result", POLICY_RETURN_FALSE,
     )
     def test_invalid_non_applicable_flow(self):
         """Tests that a non-applicable flow returns the correct error message"""
@@ -125,3 +132,197 @@ class TestFlowExecutor(TestCase):
         session = self.client.session
         plan: FlowPlan = session[SESSION_KEY_PLAN]
         self.assertEqual(len(plan.stages), 1)
+
+    def test_reevaluate_remove_last(self):
+        """Test planner with re-evaluate (last stage is removed)"""
+        flow = Flow.objects.create(
+            name="test-default-context",
+            slug="test-default-context",
+            designation=FlowDesignation.AUTHENTICATION,
+        )
+        false_policy = DummyPolicy.objects.create(result=False, wait_min=1, wait_max=2)
+
+        binding = FlowStageBinding.objects.create(
+            flow=flow, stage=DummyStage.objects.create(name="dummy1"), order=0
+        )
+        binding2 = FlowStageBinding.objects.create(
+            flow=flow,
+            stage=DummyStage.objects.create(name="dummy2"),
+            order=1,
+            re_evaluate_policies=True,
+        )
+
+        PolicyBinding.objects.create(policy=false_policy, target=binding2, order=0)
+
+        # Here we patch the dummy policy to evaluate to true so the stage is included
+        with patch(
+            "passbook.policies.dummy.models.DummyPolicy.passes", POLICY_RETURN_TRUE
+        ):
+
+            exec_url = reverse(
+                "passbook_flows:flow-executor", kwargs={"flow_slug": flow.slug}
+            )
+            # First request, run the planner
+            response = self.client.get(exec_url)
+            self.assertEqual(response.status_code, 200)
+
+            plan: FlowPlan = self.client.session[SESSION_KEY_PLAN]
+
+            self.assertEqual(plan.stages[0], binding.stage)
+            self.assertEqual(plan.stages[1], binding2.stage)
+
+            self.assertIsInstance(plan.markers[0], StageMarker)
+            self.assertIsInstance(plan.markers[1], ReevaluateMarker)
+
+            # Second request, this passes the first dummy stage
+            response = self.client.post(exec_url)
+            self.assertEqual(response.status_code, 302)
+
+        # third request, this should trigger the re-evaluate
+        # We do this request without the patch, so the policy results in false
+        response = self.client.post(exec_url)
+        self.assertEqual(response.status_code, 302)
+        self.assertEqual(response.url, reverse("passbook_core:overview"))
+
+    def test_reevaluate_remove_middle(self):
+        """Test planner with re-evaluate (middle stage is removed)"""
+        flow = Flow.objects.create(
+            name="test-default-context",
+            slug="test-default-context",
+            designation=FlowDesignation.AUTHENTICATION,
+        )
+        false_policy = DummyPolicy.objects.create(result=False, wait_min=1, wait_max=2)
+
+        binding = FlowStageBinding.objects.create(
+            flow=flow, stage=DummyStage.objects.create(name="dummy1"), order=0
+        )
+        binding2 = FlowStageBinding.objects.create(
+            flow=flow,
+            stage=DummyStage.objects.create(name="dummy2"),
+            order=1,
+            re_evaluate_policies=True,
+        )
+        binding3 = FlowStageBinding.objects.create(
+            flow=flow, stage=DummyStage.objects.create(name="dummy3"), order=2
+        )
+
+        PolicyBinding.objects.create(policy=false_policy, target=binding2, order=0)
+
+        # Here we patch the dummy policy to evaluate to true so the stage is included
+        with patch(
+            "passbook.policies.dummy.models.DummyPolicy.passes", POLICY_RETURN_TRUE
+        ):
+
+            exec_url = reverse(
+                "passbook_flows:flow-executor", kwargs={"flow_slug": flow.slug}
+            )
+            # First request, run the planner
+            response = self.client.get(exec_url)
+
+            self.assertEqual(response.status_code, 200)
+            plan: FlowPlan = self.client.session[SESSION_KEY_PLAN]
+
+            self.assertEqual(plan.stages[0], binding.stage)
+            self.assertEqual(plan.stages[1], binding2.stage)
+            self.assertEqual(plan.stages[2], binding3.stage)
+
+            self.assertIsInstance(plan.markers[0], StageMarker)
+            self.assertIsInstance(plan.markers[1], ReevaluateMarker)
+            self.assertIsInstance(plan.markers[2], StageMarker)
+
+            # Second request, this passes the first dummy stage
+            response = self.client.post(exec_url)
+            self.assertEqual(response.status_code, 302)
+
+            plan: FlowPlan = self.client.session[SESSION_KEY_PLAN]
+
+            self.assertEqual(plan.stages[0], binding2.stage)
+            self.assertEqual(plan.stages[1], binding3.stage)
+
+            self.assertIsInstance(plan.markers[0], StageMarker)
+            self.assertIsInstance(plan.markers[1], StageMarker)
+
+        # third request, this should trigger the re-evaluate
+        # We do this request without the patch, so the policy results in false
+        response = self.client.post(exec_url)
+        self.assertEqual(response.status_code, 200)
+        self.assertJSONEqual(
+            force_text(response.content),
+            {"type": "redirect", "to": reverse("passbook_core:overview")},
+        )
+
+    def test_reevaluate_remove_consecutive(self):
+        """Test planner with re-evaluate (consecutive stages are removed)"""
+        flow = Flow.objects.create(
+            name="test-default-context",
+            slug="test-default-context",
+            designation=FlowDesignation.AUTHENTICATION,
+        )
+        false_policy = DummyPolicy.objects.create(result=False, wait_min=1, wait_max=2)
+
+        binding = FlowStageBinding.objects.create(
+            flow=flow, stage=DummyStage.objects.create(name="dummy1"), order=0
+        )
+        binding2 = FlowStageBinding.objects.create(
+            flow=flow,
+            stage=DummyStage.objects.create(name="dummy2"),
+            order=1,
+            re_evaluate_policies=True,
+        )
+        binding3 = FlowStageBinding.objects.create(
+            flow=flow,
+            stage=DummyStage.objects.create(name="dummy3"),
+            order=2,
+            re_evaluate_policies=True,
+        )
+        binding4 = FlowStageBinding.objects.create(
+            flow=flow, stage=DummyStage.objects.create(name="dummy4"), order=2
+        )
+
+        PolicyBinding.objects.create(policy=false_policy, target=binding2, order=0)
+        PolicyBinding.objects.create(policy=false_policy, target=binding3, order=0)
+
+        # Here we patch the dummy policy to evaluate to true so the stage is included
+        with patch(
+            "passbook.policies.dummy.models.DummyPolicy.passes", POLICY_RETURN_TRUE
+        ):
+
+            exec_url = reverse(
+                "passbook_flows:flow-executor", kwargs={"flow_slug": flow.slug}
+            )
+            # First request, run the planner
+            response = self.client.get(exec_url)
+            self.assertEqual(response.status_code, 200)
+            self.assertIn("dummy1", force_text(response.content))
+
+            plan: FlowPlan = self.client.session[SESSION_KEY_PLAN]
+
+            self.assertEqual(plan.stages[0], binding.stage)
+            self.assertEqual(plan.stages[1], binding2.stage)
+            self.assertEqual(plan.stages[2], binding3.stage)
+            self.assertEqual(plan.stages[3], binding4.stage)
+
+            self.assertIsInstance(plan.markers[0], StageMarker)
+            self.assertIsInstance(plan.markers[1], ReevaluateMarker)
+            self.assertIsInstance(plan.markers[2], ReevaluateMarker)
+            self.assertIsInstance(plan.markers[3], StageMarker)
+
+        # Second request, this passes the first dummy stage
+        response = self.client.post(exec_url)
+        self.assertEqual(response.status_code, 302)
+
+        # third request, this should trigger the re-evaluate
+        # A get request will evaluate the policies and this will return stage 4
+        # but it won't save it, hence we cant' check the plan
+        response = self.client.get(exec_url)
+        self.assertEqual(response.status_code, 200)
+        self.assertIn("dummy4", force_text(response.content))
+
+        # fourth request, this confirms the last stage (dummy4)
+        # We do this request without the patch, so the policy results in false
+        response = self.client.post(exec_url)
+        self.assertEqual(response.status_code, 200)
+        self.assertJSONEqual(
+            force_text(response.content),
+            {"type": "redirect", "to": reverse("passbook_core:overview")},
+        )
diff --git a/passbook/flows/tests/test_views_helper.py b/passbook/flows/tests/test_views_helper.py
index 0f59e4b7e..435146f5b 100644
--- a/passbook/flows/tests/test_views_helper.py
+++ b/passbook/flows/tests/test_views_helper.py
@@ -26,7 +26,7 @@ class TestHelperView(TestCase):
     def test_default_view_invalid_plan(self):
         """Test that ToDefaultFlow returns the expected URL (with an invalid plan)"""
         flow = Flow.objects.filter(designation=FlowDesignation.INVALIDATION,).first()
-        plan = FlowPlan(flow_pk=flow.pk.hex + "aa", stages=[])
+        plan = FlowPlan(flow_pk=flow.pk.hex + "aa")
         session = self.client.session
         session[SESSION_KEY_PLAN] = plan
         session.save()
diff --git a/passbook/flows/urls.py b/passbook/flows/urls.py
index c1a50a526..26b0ebb59 100644
--- a/passbook/flows/urls.py
+++ b/passbook/flows/urls.py
@@ -3,6 +3,7 @@ from django.urls import path
 
 from passbook.flows.models import FlowDesignation
 from passbook.flows.views import (
+    CancelView,
     FlowExecutorShellView,
     FlowExecutorView,
     FlowPermissionDeniedView,
@@ -36,11 +37,7 @@ urlpatterns = [
         ToDefaultFlow.as_view(designation=FlowDesignation.UNRENOLLMENT),
         name="default-unenrollment",
     ),
-    path(
-        "-/default/password_change/",
-        ToDefaultFlow.as_view(designation=FlowDesignation.PASSWORD_CHANGE),
-        name="default-password-change",
-    ),
+    path("-/cancel/", CancelView.as_view(), name="cancel"),
     path("b/<slug:flow_slug>/", FlowExecutorView.as_view(), name="flow-executor"),
     path(
         "<slug:flow_slug>/", FlowExecutorShellView.as_view(), name="flow-executor-shell"
diff --git a/passbook/flows/views.py b/passbook/flows/views.py
index 5c8c71f11..499e7413c 100644
--- a/passbook/flows/views.py
+++ b/passbook/flows/views.py
@@ -1,13 +1,22 @@
 """passbook multi-stage authentication engine"""
+from traceback import format_tb
 from typing import Any, Dict, Optional
 
-from django.http import Http404, HttpRequest, HttpResponse
-from django.shortcuts import get_object_or_404, redirect, reverse
+from django.http import (
+    Http404,
+    HttpRequest,
+    HttpResponse,
+    HttpResponseRedirect,
+    JsonResponse,
+)
+from django.shortcuts import get_object_or_404, redirect, render, reverse
+from django.template.response import TemplateResponse
 from django.utils.decorators import method_decorator
 from django.views.decorators.clickjacking import xframe_options_sameorigin
 from django.views.generic import TemplateView, View
 from structlog import get_logger
 
+from passbook.audit.models import cleanse_dict
 from passbook.core.views.utils import PermissionDeniedView
 from passbook.flows.exceptions import EmptyFlowException, FlowNonApplicableException
 from passbook.flows.models import Flow, FlowDesignation, Stage
@@ -20,6 +29,7 @@ LOGGER = get_logger()
 # Argument used to redirect user after login
 NEXT_ARG_NAME = "next"
 SESSION_KEY_PLAN = "passbook_flows_plan"
+SESSION_KEY_GET = "passbook_flows_get"
 
 
 @method_decorator(xframe_options_sameorigin, name="dispatch")
@@ -79,8 +89,13 @@ class FlowExecutorView(View):
             current_stage=self.current_stage,
             flow_slug=self.flow.slug,
         )
+        if not self.current_stage:
+            LOGGER.debug("f(exec): no more stages, flow is done.")
+            return self._flow_done()
         stage_cls = path_to_class(self.current_stage.type)
         self.current_stage_view = stage_cls(self)
+        self.current_stage_view.args = self.args
+        self.current_stage_view.kwargs = self.kwargs
         self.current_stage_view.request = request
         return super().dispatch(request)
 
@@ -89,18 +104,44 @@ class FlowExecutorView(View):
         LOGGER.debug(
             "f(exec): Passing GET",
             view_class=class_to_path(self.current_stage_view.__class__),
+            stage=self.current_stage,
             flow_slug=self.flow.slug,
         )
-        return self.current_stage_view.get(request, *args, **kwargs)
+        try:
+            stage_response = self.current_stage_view.get(request, *args, **kwargs)
+            return to_stage_response(request, stage_response)
+        except Exception as exc:  # pylint: disable=broad-except
+            LOGGER.exception(exc)
+            return to_stage_response(
+                request,
+                render(
+                    request,
+                    "flows/error.html",
+                    {"error": exc, "tb": "".join(format_tb(exc.__traceback__))},
+                ),
+            )
 
     def post(self, request: HttpRequest, *args, **kwargs) -> HttpResponse:
         """pass post request to current stage"""
         LOGGER.debug(
             "f(exec): Passing POST",
             view_class=class_to_path(self.current_stage_view.__class__),
+            stage=self.current_stage,
             flow_slug=self.flow.slug,
         )
-        return self.current_stage_view.post(request, *args, **kwargs)
+        try:
+            stage_response = self.current_stage_view.post(request, *args, **kwargs)
+            return to_stage_response(request, stage_response)
+        except Exception as exc:  # pylint: disable=broad-except
+            LOGGER.exception(exc)
+            return to_stage_response(
+                request,
+                render(
+                    request,
+                    "flows/error.html",
+                    {"error": exc, "tb": "".join(format_tb(exc.__traceback__))},
+                ),
+            )
 
     def _initiate_plan(self) -> FlowPlan:
         planner = FlowPlanner(self.flow)
@@ -111,7 +152,10 @@ class FlowExecutorView(View):
     def _flow_done(self) -> HttpResponse:
         """User Successfully passed all stages"""
         self.cancel()
-        next_param = self.request.GET.get(NEXT_ARG_NAME, "passbook_core:overview")
+        # Since this is wrapped by the ExecutorShell, the next argument is saved in the session
+        next_param = self.request.session.get(SESSION_KEY_GET, {}).get(
+            NEXT_ARG_NAME, "passbook_core:overview"
+        )
         return redirect_with_qs(next_param)
 
     def stage_ok(self) -> HttpResponse:
@@ -122,7 +166,11 @@ class FlowExecutorView(View):
             stage_class=class_to_path(self.current_stage_view.__class__),
             flow_slug=self.flow.slug,
         )
-        self.plan.stages.pop(0)
+        # We call plan.next here to check for re-evaluate markers
+        # this is important so we can save the result
+        # and we don't have to re-evaluate the policies each request
+        self.plan.next()
+        self.plan.pop()
         self.request.session[SESSION_KEY_PLAN] = self.plan
         if self.plan.stages:
             LOGGER.debug(
@@ -137,7 +185,7 @@ class FlowExecutorView(View):
         LOGGER.debug(
             "f(exec): User passed all stages",
             flow_slug=self.flow.slug,
-            context=self.plan.context,
+            context=cleanse_dict(self.plan.context),
         )
         return self._flow_done()
 
@@ -158,6 +206,30 @@ class FlowPermissionDeniedView(PermissionDeniedView):
     """User could not be authenticated"""
 
 
+class FlowExecutorShellView(TemplateView):
+    """Executor Shell view, loads a dummy card with a spinner
+    that loads the next stage in the background."""
+
+    template_name = "flows/shell.html"
+
+    def get_context_data(self, **kwargs) -> Dict[str, Any]:
+        kwargs["exec_url"] = reverse("passbook_flows:flow-executor", kwargs=self.kwargs)
+        kwargs["msg_url"] = reverse("passbook_api:messages-list")
+        self.request.session[SESSION_KEY_GET] = self.request.GET
+        return kwargs
+
+
+class CancelView(View):
+    """View which canels the currently active plan"""
+
+    def get(self, request: HttpRequest) -> HttpResponse:
+        """View which canels the currently active plan"""
+        if SESSION_KEY_PLAN in request.session:
+            del request.session[SESSION_KEY_PLAN]
+            LOGGER.debug("Canceled current plan")
+        return redirect("passbook_core:overview")
+
+
 class ToDefaultFlow(View):
     """Redirect to default flow matching by designation"""
 
@@ -181,13 +253,20 @@ class ToDefaultFlow(View):
         )
 
 
-class FlowExecutorShellView(TemplateView):
-    """Executor Shell view, loads a dummy card with a spinner
-    that loads the next stage in the background."""
-
-    template_name = "flows/shell.html"
-
-    def get_context_data(self, **kwargs) -> Dict[str, Any]:
-        kwargs["exec_url"] = reverse("passbook_flows:flow-executor", kwargs=self.kwargs)
-        kwargs["msg_url"] = reverse("passbook_api:messages-list")
-        return kwargs
+def to_stage_response(request: HttpRequest, source: HttpResponse) -> HttpResponse:
+    """Convert normal HttpResponse into JSON Response"""
+    if isinstance(source, HttpResponseRedirect) or source.status_code == 302:
+        redirect_url = source["Location"]
+        if request.path != redirect_url:
+            return JsonResponse({"type": "redirect", "to": redirect_url})
+        return source
+    if isinstance(source, TemplateResponse):
+        return JsonResponse(
+            {"type": "template", "body": source.render().content.decode("utf-8")}
+        )
+    # Check for actual HttpResponse (without isinstance as we dont want to check inheritance)
+    if source.__class__ == HttpResponse:
+        return JsonResponse(
+            {"type": "template", "body": source.content.decode("utf-8")}
+        )
+    return source
diff --git a/passbook/providers/samlv2/__init__.py b/passbook/lib/expression/__init__.py
similarity index 100%
rename from passbook/providers/samlv2/__init__.py
rename to passbook/lib/expression/__init__.py
diff --git a/passbook/lib/expression/evaluator.py b/passbook/lib/expression/evaluator.py
new file mode 100644
index 000000000..3a252f08b
--- /dev/null
+++ b/passbook/lib/expression/evaluator.py
@@ -0,0 +1,101 @@
+"""passbook expression policy evaluator"""
+import re
+from textwrap import indent
+from typing import Any, Dict, Iterable, Optional
+
+from django.core.exceptions import ValidationError
+from requests import Session
+from structlog import get_logger
+
+from passbook.core.models import User
+
+LOGGER = get_logger()
+
+
+class BaseEvaluator:
+    """Validate and evaluate python-based expressions"""
+
+    # Globals that can be used by function
+    _globals: Dict[str, Any]
+    # Context passed as locals to exec()
+    _context: Dict[str, Any]
+
+    # Filename used for exec
+    _filename: str
+
+    def __init__(self):
+        # update passbook/policies/expression/templates/policy/expression/form.html
+        # update docs/policies/expression/index.md
+        self._globals = {
+            "regex_match": BaseEvaluator.expr_filter_regex_match,
+            "regex_replace": BaseEvaluator.expr_filter_regex_replace,
+            "pb_is_group_member": BaseEvaluator.expr_func_is_group_member,
+            "pb_user_by": BaseEvaluator.expr_func_user_by,
+            "pb_logger": get_logger(),
+            "requests": Session(),
+        }
+        self._context = {}
+        self._filename = "BaseEvalautor"
+
+    @staticmethod
+    def expr_filter_regex_match(value: Any, regex: str) -> bool:
+        """Expression Filter to run re.search"""
+        return re.search(regex, value) is None
+
+    @staticmethod
+    def expr_filter_regex_replace(value: Any, regex: str, repl: str) -> str:
+        """Expression Filter to run re.sub"""
+        return re.sub(regex, repl, value)
+
+    @staticmethod
+    def expr_func_user_by(**filters) -> Optional[User]:
+        """Get user by filters"""
+        users = User.objects.filter(**filters)
+        if users:
+            return users.first()
+        return None
+
+    @staticmethod
+    def expr_func_is_group_member(user: User, **group_filters) -> bool:
+        """Check if `user` is member of group with name `group_name`"""
+        return user.groups.filter(**group_filters).exists()
+
+    def wrap_expression(self, expression: str, params: Iterable[str]) -> str:
+        """Wrap expression in a function, call it, and save the result as `result`"""
+        handler_signature = ",".join(params)
+        full_expression = f"def handler({handler_signature}):\n"
+        full_expression += indent(expression, "    ")
+        full_expression += f"\nresult = handler({handler_signature})"
+        return full_expression
+
+    def evaluate(self, expression_source: str) -> Any:
+        """Parse and evaluate expression. If the syntax is incorrect, a SyntaxError is raised.
+        If any exception is raised during execution, it is raised.
+        The result is returned without any type-checking."""
+        param_keys = self._context.keys()
+        ast_obj = compile(
+            self.wrap_expression(expression_source, param_keys), self._filename, "exec",
+        )
+        try:
+            _locals = self._context
+            # Yes this is an exec, yes it is potentially bad. Since we limit what variables are
+            # available here, and these policies can only be edited by admins, this is a risk
+            # we're willing to take.
+            # pylint: disable=exec-used
+            exec(ast_obj, self._globals, _locals)  # nosec # noqa
+            result = _locals["result"]
+        except Exception as exc:
+            LOGGER.warning("Expression error", exc=exc)
+            raise
+        return result
+
+    def validate(self, expression: str) -> bool:
+        """Validate expression's syntax, raise ValidationError if Syntax is invalid"""
+        param_keys = self._context.keys()
+        try:
+            compile(
+                self.wrap_expression(expression, param_keys), self._filename, "exec",
+            )
+            return True
+        except (ValueError, SyntaxError) as exc:
+            raise ValidationError(f"Expression Syntax Error: {str(exc)}") from exc
diff --git a/passbook/lib/templatetags/passbook_utils.py b/passbook/lib/templatetags/passbook_utils.py
index 2d5af96cb..aa8cc062f 100644
--- a/passbook/lib/templatetags/passbook_utils.py
+++ b/passbook/lib/templatetags/passbook_utils.py
@@ -5,7 +5,7 @@ from urllib.parse import urlencode
 from django import template
 from django.db.models import Model
 from django.template import Context
-from django.utils.html import escape
+from django.utils.html import escape, mark_safe
 from structlog import get_logger
 
 from passbook.lib.config import CONFIG
@@ -105,4 +105,4 @@ def debug(obj) -> str:
 @register.filter
 def doc(obj) -> str:
     """Return docstring of object"""
-    return obj.__doc__
+    return mark_safe(obj.__doc__.replace("\n", "<br>"))
diff --git a/passbook/lib/utils/reflection.py b/passbook/lib/utils/reflection.py
index 5fc72f948..0a218f6fd 100644
--- a/passbook/lib/utils/reflection.py
+++ b/passbook/lib/utils/reflection.py
@@ -1,12 +1,19 @@
 """passbook lib reflection utilities"""
 from importlib import import_module
 
+from django.conf import settings
+
 
 def all_subclasses(cls, sort=True):
     """Recursively return all subclassess of cls"""
     classes = set(cls.__subclasses__()).union(
         [s for c in cls.__subclasses__() for s in all_subclasses(c, sort=sort)]
     )
+    # Check if we're in debug mode, if not exclude classes which have `__debug_only__`
+    if not settings.DEBUG:
+        # Filter class out when __debug_only__ is not False
+        classes = [x for x in classes if not getattr(x, "__debug_only__", False)]
+        # classes = filter(lambda x: not getattr(x, "__debug_only__", False), classes)
     if sort:
         return sorted(classes, key=lambda x: x.__name__)
     return classes
@@ -34,10 +41,3 @@ def get_apps():
     for _app in apps.get_app_configs():
         if _app.name.startswith("passbook"):
             yield _app
-
-
-def app(name):
-    """Return true if app with `name` is enabled"""
-    from django.conf import settings
-
-    return name in settings.INSTALLED_APPS
diff --git a/passbook/lib/widgets.py b/passbook/lib/widgets.py
deleted file mode 100644
index 5012a1ff7..000000000
--- a/passbook/lib/widgets.py
+++ /dev/null
@@ -1,36 +0,0 @@
-"""Dynamic array widget"""
-from django import forms
-
-
-class DynamicArrayWidget(forms.TextInput):
-    """Dynamic array widget"""
-
-    template_name = "lib/arrayfield.html"
-
-    def get_context(self, name, value, attrs):
-        value = value or [""]
-        context = super().get_context(name, value, attrs)
-        final_attrs = context["widget"]["attrs"]
-        id_ = context["widget"]["attrs"].get("id")
-
-        subwidgets = []
-        for index, item in enumerate(context["widget"]["value"]):
-            widget_attrs = final_attrs.copy()
-            if id_:
-                widget_attrs["id"] = "{id_}_{index}".format(id_=id_, index=index)
-            widget = forms.TextInput()
-            widget.is_required = self.is_required
-            subwidgets.append(widget.get_context(name, item, widget_attrs)["widget"])
-
-        context["widget"]["subwidgets"] = subwidgets
-        return context
-
-    def value_from_datadict(self, data, files, name):
-        try:
-            getter = data.getlist
-            return [value for value in getter(name) if value]
-        except AttributeError:
-            return data.get(name)
-
-    def format_value(self, value):
-        return value or []
diff --git a/passbook/policies/apps.py b/passbook/policies/apps.py
index 946f84609..f300fe6f3 100644
--- a/passbook/policies/apps.py
+++ b/passbook/policies/apps.py
@@ -12,5 +12,5 @@ class PassbookPoliciesConfig(AppConfig):
     verbose_name = "passbook Policies"
 
     def ready(self):
-        """Load source_types from config file"""
+        """Load policy cache clearing signals"""
         import_module("passbook.policies.signals")
diff --git a/passbook/policies/dummy/models.py b/passbook/policies/dummy/models.py
index 5e7ca8c8b..a8172157a 100644
--- a/passbook/policies/dummy/models.py
+++ b/passbook/policies/dummy/models.py
@@ -16,6 +16,8 @@ class DummyPolicy(Policy):
     """Policy used for debugging the PolicyEngine. Returns a fixed result,
     but takes a random time to process."""
 
+    __debug_only__ = True
+
     result = models.BooleanField(default=False)
     wait_min = models.IntegerField(default=5)
     wait_max = models.IntegerField(default=30)
diff --git a/passbook/policies/expression/evaluator.py b/passbook/policies/expression/evaluator.py
index 01ed3b7ae..968e29834 100644
--- a/passbook/policies/expression/evaluator.py
+++ b/passbook/policies/expression/evaluator.py
@@ -1,81 +1,30 @@
 """passbook expression policy evaluator"""
-import re
-from typing import Any, Dict, List, Optional
+from typing import List
 
-from django.core.exceptions import ValidationError
 from django.http import HttpRequest
-from jinja2 import Undefined
-from jinja2.exceptions import TemplateSyntaxError
-from jinja2.nativetypes import NativeEnvironment
-from requests import Session
 from structlog import get_logger
 
-from passbook.core.models import User
 from passbook.flows.planner import PLAN_CONTEXT_SSO
 from passbook.flows.views import SESSION_KEY_PLAN
+from passbook.lib.expression.evaluator import BaseEvaluator
 from passbook.lib.utils.http import get_client_ip
 from passbook.policies.types import PolicyRequest, PolicyResult
 
 LOGGER = get_logger()
 
 
-class Evaluator:
-    """Validate and evaluate jinja2-based expressions"""
+class PolicyEvaluator(BaseEvaluator):
+    """Validate and evaluate python-based expressions"""
 
-    _env: NativeEnvironment
-
-    _context: Dict[str, Any]
     _messages: List[str]
 
-    def __init__(self):
-        self._env = NativeEnvironment(
-            extensions=["jinja2.ext.do"],
-            trim_blocks=True,
-            lstrip_blocks=True,
-            line_statement_prefix=">",
-        )
-        # update passbook/policies/expression/templates/policy/expression/form.html
-        # update docs/policies/expression/index.md
-        self._env.filters["regex_match"] = Evaluator.jinja2_filter_regex_match
-        self._env.filters["regex_replace"] = Evaluator.jinja2_filter_regex_replace
-        self._env.globals["pb_message"] = self.jinja2_func_message
-        self._context = {
-            "pb_is_group_member": Evaluator.jinja2_func_is_group_member,
-            "pb_user_by": Evaluator.jinja2_func_user_by,
-            "pb_logger": get_logger(),
-            "requests": Session(),
-        }
+    def __init__(self, policy_name: str):
+        super().__init__()
         self._messages = []
+        self._context["pb_message"] = self.expr_func_message
+        self._filename = policy_name or "PolicyEvaluator"
 
-    @property
-    def env(self) -> NativeEnvironment:
-        """Access to our custom NativeEnvironment"""
-        return self._env
-
-    @staticmethod
-    def jinja2_filter_regex_match(value: Any, regex: str) -> bool:
-        """Jinja2 Filter to run re.search"""
-        return re.search(regex, value) is None
-
-    @staticmethod
-    def jinja2_filter_regex_replace(value: Any, regex: str, repl: str) -> str:
-        """Jinja2 Filter to run re.sub"""
-        return re.sub(regex, repl, value)
-
-    @staticmethod
-    def jinja2_func_user_by(**filters) -> Optional[User]:
-        """Get user by filters"""
-        users = User.objects.filter(**filters)
-        if users:
-            return users.first()
-        return None
-
-    @staticmethod
-    def jinja2_func_is_group_member(user: User, group_name: str) -> bool:
-        """Check if `user` is member of group with name `group_name`"""
-        return user.groups.filter(name=group_name).exists()
-
-    def jinja2_func_message(self, message: str):
+    def expr_func_message(self, message: str):
         """Wrapper to append to messages list, which is returned with PolicyResult"""
         self._messages.append(message)
 
@@ -84,41 +33,35 @@ class Evaluator:
         # update passbook/policies/expression/templates/policy/expression/form.html
         # update docs/policies/expression/index.md
         self._context["pb_is_sso_flow"] = request.context.get(PLAN_CONTEXT_SSO, False)
-        self._context["request"] = request
         if request.http_request:
             self.set_http_request(request.http_request)
+        self._context["request"] = request
 
     def set_http_request(self, request: HttpRequest):
         """Update context based on http request"""
         # update passbook/policies/expression/templates/policy/expression/form.html
         # update docs/policies/expression/index.md
-        self._context["pb_client_ip"] = (
-            get_client_ip(request.http_request) or "255.255.255.255"
-        )
+        self._context["pb_client_ip"] = get_client_ip(request) or "255.255.255.255"
         self._context["request"] = request
-        if SESSION_KEY_PLAN in request.http_request.session:
-            self._context["pb_flow_plan"] = request.http_request.session[
-                SESSION_KEY_PLAN
-            ]
+        if SESSION_KEY_PLAN in request.session:
+            self._context["pb_flow_plan"] = request.session[SESSION_KEY_PLAN]
 
     def evaluate(self, expression_source: str) -> PolicyResult:
         """Parse and evaluate expression. Policy is expected to return a truthy object.
         Messages can be added using 'do pb_message()'."""
         try:
-            expression = self._env.from_string(expression_source.lstrip().rstrip())
-        except TemplateSyntaxError as exc:
+            result = super().evaluate(expression_source)
+        except (ValueError, SyntaxError) as exc:
             return PolicyResult(False, str(exc))
-        try:
-            result: Optional[Any] = expression.render(self._context)
         except Exception as exc:  # pylint: disable=broad-except
             LOGGER.warning("Expression error", exc=exc)
             return PolicyResult(False, str(exc))
         else:
             policy_result = PolicyResult(False)
             policy_result.messages = tuple(self._messages)
-            if isinstance(result, Undefined):
+            if result is None:
                 LOGGER.warning(
-                    "Expression policy returned undefined",
+                    "Expression policy returned None",
                     src=expression_source,
                     req=self._context,
                 )
@@ -126,11 +69,3 @@ class Evaluator:
             if result:
                 policy_result.passing = bool(result)
             return policy_result
-
-    def validate(self, expression: str):
-        """Validate expression's syntax, raise ValidationError if Syntax is invalid"""
-        try:
-            self._env.from_string(expression)
-            return True
-        except TemplateSyntaxError as exc:
-            raise ValidationError(f"Expression Syntax Error: {str(exc)}") from exc
diff --git a/passbook/policies/expression/forms.py b/passbook/policies/expression/forms.py
index edc7a3545..23d2bc47f 100644
--- a/passbook/policies/expression/forms.py
+++ b/passbook/policies/expression/forms.py
@@ -3,7 +3,7 @@
 from django import forms
 
 from passbook.admin.fields import CodeMirrorWidget
-from passbook.policies.expression.evaluator import Evaluator
+from passbook.policies.expression.evaluator import PolicyEvaluator
 from passbook.policies.expression.models import ExpressionPolicy
 from passbook.policies.forms import GENERAL_FIELDS
 
@@ -14,9 +14,9 @@ class ExpressionPolicyForm(forms.ModelForm):
     template_name = "policy/expression/form.html"
 
     def clean_expression(self):
-        """Test Jinja2 Syntax"""
+        """Test Syntax"""
         expression = self.cleaned_data.get("expression")
-        Evaluator().validate(expression)
+        PolicyEvaluator(self.instance.name).validate(expression)
         return expression
 
     class Meta:
@@ -27,5 +27,5 @@ class ExpressionPolicyForm(forms.ModelForm):
         ]
         widgets = {
             "name": forms.TextInput(),
-            "expression": CodeMirrorWidget(mode="jinja2"),
+            "expression": CodeMirrorWidget(mode="python"),
         }
diff --git a/passbook/policies/expression/models.py b/passbook/policies/expression/models.py
index e43f17560..67137d0b6 100644
--- a/passbook/policies/expression/models.py
+++ b/passbook/policies/expression/models.py
@@ -2,13 +2,13 @@
 from django.db import models
 from django.utils.translation import gettext as _
 
-from passbook.policies.expression.evaluator import Evaluator
+from passbook.policies.expression.evaluator import PolicyEvaluator
 from passbook.policies.models import Policy
 from passbook.policies.types import PolicyRequest, PolicyResult
 
 
 class ExpressionPolicy(Policy):
-    """Jinja2-based Expression policy that allows Admins to write their own logic"""
+    """Execute arbitrary Python code to implement custom checks and validation."""
 
     expression = models.TextField()
 
@@ -16,12 +16,12 @@ class ExpressionPolicy(Policy):
 
     def passes(self, request: PolicyRequest) -> PolicyResult:
         """Evaluate and render expression. Returns PolicyResult(false) on error."""
-        evaluator = Evaluator()
+        evaluator = PolicyEvaluator(self.name)
         evaluator.set_policy_request(request)
         return evaluator.evaluate(self.expression)
 
     def save(self, *args, **kwargs):
-        Evaluator().validate(self.expression)
+        PolicyEvaluator(self.name).validate(self.expression)
         return super().save(*args, **kwargs)
 
     class Meta:
diff --git a/passbook/policies/expression/templates/policy/expression/form.html b/passbook/policies/expression/templates/policy/expression/form.html
index 14bfa626e..95b3a8fb9 100644
--- a/passbook/policies/expression/templates/policy/expression/form.html
+++ b/passbook/policies/expression/templates/policy/expression/form.html
@@ -7,23 +7,8 @@
     <label for="" class="pf-c-form__label"></label>
     <div class="c-form__horizontal-group">
         <p>
-            Expression using <a href="https://jinja.palletsprojects.com/en/2.11.x/templates/">Jinja</a>. Following variables are available:
+            Expression using Python. See <a href="https://passbook.beryju.org/policies/expression/">here</a> for a list of all variables.
         </p>
-        <ul class="pf-c-list">
-            <li><code>request.user</code>: Passbook User Object (<a href="https://beryju.github.io/passbook/property-mappings/reference/user-object/">Reference</a>)</li>
-            <li><code>request.http_request</code>: Django HTTP Request Object (<a href="https://docs.djangoproject.com/en/3.0/ref/request-response/#httprequest-objects">Reference</a>) </li>
-            <li><code>request.obj</code>: Model the Policy is run against. </li>
-            <li><code>pb_flow_plan</code>: Current Plan if Policy is called while a flow is active.</li>
-            <li><code>pb_is_sso_flow</code>: Boolean which is true if request was initiated by authenticating through an external Provider.</li>
-            <li><code>pb_is_group_member(user, group_name)</code>: Function which checks if <code>user</code> is member of a Group with Name <code>group_name</code>.</li>
-            <li><code>pb_logger</code>: Standard Python Logger Object, which can be used to debug expressions.</li>
-            <li><code>pb_client_ip</code>: Client's IP Address.</li>
-        </ul>
-        <p>Custom Filters:</p>
-        <ul class="pf-c-list">
-            <li><code>regex_match(regex)</code>: Checks if value matches <code>regex</code></li>
-            <li><code>regex_replace(regex, repl)</code>: Replace string matched by <code>regex</code> with <code>repl</code></li>
-        </ul>
     </div>
 </div>
 {% endblock %}
diff --git a/passbook/policies/expression/tests/test_evaluator.py b/passbook/policies/expression/tests.py
similarity index 72%
rename from passbook/policies/expression/tests/test_evaluator.py
rename to passbook/policies/expression/tests.py
index e39cdfec9..0526d6c9c 100644
--- a/passbook/policies/expression/tests/test_evaluator.py
+++ b/passbook/policies/expression/tests.py
@@ -3,7 +3,7 @@ from django.core.exceptions import ValidationError
 from django.test import TestCase
 from guardian.shortcuts import get_anonymous_user
 
-from passbook.policies.expression.evaluator import Evaluator
+from passbook.policies.expression.evaluator import PolicyEvaluator
 from passbook.policies.types import PolicyRequest
 
 
@@ -15,15 +15,15 @@ class TestEvaluator(TestCase):
 
     def test_valid(self):
         """test simple value expression"""
-        template = "True"
-        evaluator = Evaluator()
+        template = "return True"
+        evaluator = PolicyEvaluator("test")
         evaluator.set_policy_request(self.request)
         self.assertEqual(evaluator.evaluate(template).passing, True)
 
     def test_messages(self):
         """test expression with message return"""
-        template = '{% do pb_message("some message") %}False'
-        evaluator = Evaluator()
+        template = 'pb_message("some message");return False'
+        evaluator = PolicyEvaluator("test")
         evaluator.set_policy_request(self.request)
         result = evaluator.evaluate(template)
         self.assertEqual(result.passing, False)
@@ -31,32 +31,32 @@ class TestEvaluator(TestCase):
 
     def test_invalid_syntax(self):
         """test invalid syntax"""
-        template = "{%"
-        evaluator = Evaluator()
+        template = ";"
+        evaluator = PolicyEvaluator("test")
         evaluator.set_policy_request(self.request)
         result = evaluator.evaluate(template)
         self.assertEqual(result.passing, False)
-        self.assertEqual(result.messages, ("tag name expected",))
+        self.assertEqual(result.messages, ("invalid syntax (test, line 2)",))
 
     def test_undefined(self):
         """test undefined result"""
         template = "{{ foo.bar }}"
-        evaluator = Evaluator()
+        evaluator = PolicyEvaluator("test")
         evaluator.set_policy_request(self.request)
         result = evaluator.evaluate(template)
         self.assertEqual(result.passing, False)
-        self.assertEqual(result.messages, ("'foo' is undefined",))
+        self.assertEqual(result.messages, ("name 'foo' is not defined",))
 
     def test_validate(self):
         """test validate"""
         template = "True"
-        evaluator = Evaluator()
+        evaluator = PolicyEvaluator("test")
         result = evaluator.validate(template)
         self.assertEqual(result, True)
 
     def test_validate_invalid(self):
         """test validate"""
-        template = "{%"
-        evaluator = Evaluator()
+        template = ";"
+        evaluator = PolicyEvaluator("test")
         with self.assertRaises(ValidationError):
             evaluator.validate(template)
diff --git a/passbook/providers/samlv2/saml/__init__.py b/passbook/policies/group_membership/__init__.py
similarity index 100%
rename from passbook/providers/samlv2/saml/__init__.py
rename to passbook/policies/group_membership/__init__.py
diff --git a/passbook/policies/group_membership/api.py b/passbook/policies/group_membership/api.py
new file mode 100644
index 000000000..e712dc19c
--- /dev/null
+++ b/passbook/policies/group_membership/api.py
@@ -0,0 +1,23 @@
+"""Group Membership Policy API"""
+from rest_framework.serializers import ModelSerializer
+from rest_framework.viewsets import ModelViewSet
+
+from passbook.policies.forms import GENERAL_SERIALIZER_FIELDS
+from passbook.policies.group_membership.models import GroupMembershipPolicy
+
+
+class GroupMembershipPolicySerializer(ModelSerializer):
+    """Group Membership Policy Serializer"""
+
+    class Meta:
+        model = GroupMembershipPolicy
+        fields = GENERAL_SERIALIZER_FIELDS + [
+            "group",
+        ]
+
+
+class GroupMembershipPolicyViewSet(ModelViewSet):
+    """Group Membership Policy Viewset"""
+
+    queryset = GroupMembershipPolicy.objects.all()
+    serializer_class = GroupMembershipPolicySerializer
diff --git a/passbook/policies/group_membership/apps.py b/passbook/policies/group_membership/apps.py
new file mode 100644
index 000000000..95ea0edb2
--- /dev/null
+++ b/passbook/policies/group_membership/apps.py
@@ -0,0 +1,11 @@
+"""passbook Group Membership policy app config"""
+
+from django.apps import AppConfig
+
+
+class PassbookPoliciesGroupMembershipConfig(AppConfig):
+    """passbook Group Membership policy app config"""
+
+    name = "passbook.policies.group_membership"
+    label = "passbook_policies_group_membership"
+    verbose_name = "passbook Policies.Group Membership"
diff --git a/passbook/policies/group_membership/forms.py b/passbook/policies/group_membership/forms.py
new file mode 100644
index 000000000..af2368694
--- /dev/null
+++ b/passbook/policies/group_membership/forms.py
@@ -0,0 +1,20 @@
+"""passbook Group Membership Policy forms"""
+
+from django import forms
+
+from passbook.policies.forms import GENERAL_FIELDS
+from passbook.policies.group_membership.models import GroupMembershipPolicy
+
+
+class GroupMembershipPolicyForm(forms.ModelForm):
+    """GroupMembershipPolicy Form"""
+
+    class Meta:
+
+        model = GroupMembershipPolicy
+        fields = GENERAL_FIELDS + [
+            "group",
+        ]
+        widgets = {
+            "name": forms.TextInput(),
+        }
diff --git a/passbook/policies/group_membership/migrations/0001_initial.py b/passbook/policies/group_membership/migrations/0001_initial.py
new file mode 100644
index 000000000..5c8325ae7
--- /dev/null
+++ b/passbook/policies/group_membership/migrations/0001_initial.py
@@ -0,0 +1,47 @@
+# Generated by Django 3.0.7 on 2020-07-01 19:01
+
+import django.db.models.deletion
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    initial = True
+
+    dependencies = [
+        ("passbook_policies", "0002_auto_20200528_1647"),
+        ("passbook_core", "0003_default_user"),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name="GroupMembershipPolicy",
+            fields=[
+                (
+                    "policy_ptr",
+                    models.OneToOneField(
+                        auto_created=True,
+                        on_delete=django.db.models.deletion.CASCADE,
+                        parent_link=True,
+                        primary_key=True,
+                        serialize=False,
+                        to="passbook_policies.Policy",
+                    ),
+                ),
+                (
+                    "group",
+                    models.ForeignKey(
+                        blank=True,
+                        null=True,
+                        on_delete=django.db.models.deletion.SET_NULL,
+                        to="passbook_core.Group",
+                    ),
+                ),
+            ],
+            options={
+                "verbose_name": "Group Membership Policy",
+                "verbose_name_plural": "Group Membership Policies",
+            },
+            bases=("passbook_policies.policy",),
+        ),
+    ]
diff --git a/passbook/providers/samlv2/views/__init__.py b/passbook/policies/group_membership/migrations/__init__.py
similarity index 100%
rename from passbook/providers/samlv2/views/__init__.py
rename to passbook/policies/group_membership/migrations/__init__.py
diff --git a/passbook/policies/group_membership/models.py b/passbook/policies/group_membership/models.py
new file mode 100644
index 000000000..730b49a9e
--- /dev/null
+++ b/passbook/policies/group_membership/models.py
@@ -0,0 +1,23 @@
+"""user field matcher models"""
+from django.db import models
+from django.utils.translation import gettext as _
+
+from passbook.core.models import Group
+from passbook.policies.models import Policy
+from passbook.policies.types import PolicyRequest, PolicyResult
+
+
+class GroupMembershipPolicy(Policy):
+    """Check that the user is member of the selected group."""
+
+    group = models.ForeignKey(Group, null=True, blank=True, on_delete=models.SET_NULL)
+
+    form = "passbook.policies.group_membership.forms.GroupMembershipPolicyForm"
+
+    def passes(self, request: PolicyRequest) -> PolicyResult:
+        return PolicyResult(self.group.user_set.filter(pk=request.user.pk).exists())
+
+    class Meta:
+
+        verbose_name = _("Group Membership Policy")
+        verbose_name_plural = _("Group Membership Policies")
diff --git a/passbook/policies/group_membership/tests.py b/passbook/policies/group_membership/tests.py
new file mode 100644
index 000000000..d0e7c43ea
--- /dev/null
+++ b/passbook/policies/group_membership/tests.py
@@ -0,0 +1,32 @@
+"""evaluator tests"""
+from django.test import TestCase
+from guardian.shortcuts import get_anonymous_user
+
+from passbook.core.models import Group
+from passbook.policies.group_membership.models import GroupMembershipPolicy
+from passbook.policies.types import PolicyRequest
+
+
+class TestGroupMembershipPolicy(TestCase):
+    """GroupMembershipPolicy tests"""
+
+    def setUp(self):
+        self.request = PolicyRequest(user=get_anonymous_user())
+
+    def test_invalid(self):
+        """user not in group"""
+        group = Group.objects.create(name="test")
+        policy: GroupMembershipPolicy = GroupMembershipPolicy.objects.create(
+            group=group
+        )
+        self.assertFalse(policy.passes(self.request).passing)
+
+    def test_valid(self):
+        """user in group"""
+        group = Group.objects.create(name="test")
+        group.user_set.add(get_anonymous_user())
+        group.save()
+        policy: GroupMembershipPolicy = GroupMembershipPolicy.objects.create(
+            group=group
+        )
+        self.assertTrue(policy.passes(self.request).passing)
diff --git a/passbook/policies/hibp/models.py b/passbook/policies/hibp/models.py
index 18b395e66..613594474 100644
--- a/passbook/policies/hibp/models.py
+++ b/passbook/policies/hibp/models.py
@@ -13,7 +13,7 @@ LOGGER = get_logger()
 
 
 class HaveIBeenPwendPolicy(Policy):
-    """Check if password is on HaveIBeenPwned's list by upload the first
+    """Check if password is on HaveIBeenPwned's list by uploading the first
     5 characters of the SHA1 Hash."""
 
     allowed_count = models.IntegerField(default=0)
diff --git a/passbook/policies/mixins.py b/passbook/policies/mixins.py
new file mode 100644
index 000000000..2e298b741
--- /dev/null
+++ b/passbook/policies/mixins.py
@@ -0,0 +1,62 @@
+"""passbook access helper classes"""
+from typing import Optional
+
+from django.contrib import messages
+from django.contrib.auth.mixins import AccessMixin
+from django.http import HttpRequest, HttpResponse
+from django.shortcuts import redirect
+from django.utils.translation import gettext as _
+from structlog import get_logger
+
+from passbook.core.models import Application, Provider, User
+from passbook.policies.engine import PolicyEngine
+from passbook.policies.types import PolicyResult
+
+LOGGER = get_logger()
+
+
+class BaseMixin:
+    """Base Mixin class, used to annotate View Member variables"""
+
+    request: HttpRequest
+
+
+class PolicyAccessMixin(BaseMixin, AccessMixin):
+    """Mixin class for usage in Authorization views.
+    Provider functions to check application access, etc"""
+
+    def handle_no_permission_authorized(self) -> HttpResponse:
+        """Function called when user has no permissions but is authorized"""
+        return redirect("passbook_flows:denied")
+
+    def provider_to_application(self, provider: Provider) -> Application:
+        """Lookup application assigned to provider, throw error if no application assigned"""
+        try:
+            return provider.application
+        except Application.DoesNotExist as exc:
+            messages.error(
+                self.request,
+                _(
+                    'Provider "%(name)s" has no application assigned'
+                    % {"name": provider}
+                ),
+            )
+            raise exc
+
+    def user_has_access(
+        self, application: Application, user: Optional[User] = None
+    ) -> PolicyResult:
+        """Check if user has access to application."""
+        user = user or self.request.user
+        policy_engine = PolicyEngine(
+            application, user or self.request.user, self.request
+        )
+        policy_engine.build()
+        result = policy_engine.result
+        LOGGER.debug(
+            "AccessMixin user_has_access", user=user, app=application, result=result,
+        )
+        if not result.passing:
+            for message in result.messages:
+                messages.error(self.request, _(message))
+        return result
diff --git a/passbook/policies/password/api.py b/passbook/policies/password/api.py
index db5e1bd58..6124d4bf1 100644
--- a/passbook/policies/password/api.py
+++ b/passbook/policies/password/api.py
@@ -1,4 +1,4 @@
-"""Source API Views"""
+"""Password Policy API Views"""
 from rest_framework.serializers import ModelSerializer
 from rest_framework.viewsets import ModelViewSet
 
@@ -22,7 +22,7 @@ class PasswordPolicySerializer(ModelSerializer):
 
 
 class PasswordPolicyViewSet(ModelViewSet):
-    """Source Viewset"""
+    """Password Policy Viewset"""
 
     queryset = PasswordPolicy.objects.all()
     serializer_class = PasswordPolicySerializer
diff --git a/passbook/policies/process.py b/passbook/policies/process.py
index a187627a6..f4af4819e 100644
--- a/passbook/policies/process.py
+++ b/passbook/policies/process.py
@@ -39,6 +39,8 @@ class PolicyProcess(Process):
         super().__init__()
         self.binding = binding
         self.request = request
+        if not isinstance(self.request, PolicyRequest):
+            raise ValueError(f"{self.request} is not a Policy Request.")
         if connection:
             self.connection = connection
 
diff --git a/passbook/policies/types.py b/passbook/policies/types.py
index 29bf02932..29ab69146 100644
--- a/passbook/policies/types.py
+++ b/passbook/policies/types.py
@@ -38,6 +38,9 @@ class PolicyResult:
         self.passing = passing
         self.messages = messages
 
+    def __repr__(self):
+        return self.__str__()
+
     def __str__(self):
         if self.messages:
             return f"PolicyResult passing={self.passing} messages={self.messages}"
diff --git a/passbook/providers/app_gw/forms.py b/passbook/providers/app_gw/forms.py
index ad4c7fc60..6dddc8927 100644
--- a/passbook/providers/app_gw/forms.py
+++ b/passbook/providers/app_gw/forms.py
@@ -32,7 +32,7 @@ class ApplicationGatewayProviderForm(forms.ModelForm):
     class Meta:
 
         model = ApplicationGatewayProvider
-        fields = ["name", "internal_host", "external_host"]
+        fields = ["name", "authorization_flow", "internal_host", "external_host"]
         widgets = {
             "name": forms.TextInput(),
             "internal_host": forms.TextInput(),
diff --git a/passbook/providers/app_gw/models.py b/passbook/providers/app_gw/models.py
index 664c75f8b..b85f759ee 100644
--- a/passbook/providers/app_gw/models.py
+++ b/passbook/providers/app_gw/models.py
@@ -14,7 +14,8 @@ from passbook.lib.utils.template import render_to_string
 
 
 class ApplicationGatewayProvider(Provider):
-    """This provider uses oauth2_proxy with the OIDC Provider."""
+    """Protect applications that don't support any of the other
+    Protocols by using a Reverse-Proxy."""
 
     name = models.TextField()
     internal_host = models.TextField()
diff --git a/passbook/providers/app_gw/templates/app_gw/docker-compose.yml b/passbook/providers/app_gw/templates/app_gw/docker-compose.yml
index 14b7cbd02..6e65148a6 100644
--- a/passbook/providers/app_gw/templates/app_gw/docker-compose.yml
+++ b/passbook/providers/app_gw/templates/app_gw/docker-compose.yml
@@ -2,7 +2,6 @@ version: "3.5"
 
 services:
   passbook_gatekeeper:
-    container_name: gatekeeper
     image: beryju/passbook-gatekeeper:{{ version }}
     ports:
       - 4180:4180
diff --git a/passbook/providers/oauth/forms.py b/passbook/providers/oauth/forms.py
index 9c4acc4e0..3d3a7517e 100644
--- a/passbook/providers/oauth/forms.py
+++ b/passbook/providers/oauth/forms.py
@@ -1,21 +1,32 @@
 """passbook OAuth2 Provider Forms"""
 
 from django import forms
+from django.utils.translation import gettext_lazy as _
 
+from passbook.flows.models import Flow, FlowDesignation
 from passbook.providers.oauth.models import OAuth2Provider
 
 
 class OAuth2ProviderForm(forms.ModelForm):
     """OAuth2 Provider form"""
 
+    authorization_flow = forms.ModelChoiceField(
+        queryset=Flow.objects.filter(designation=FlowDesignation.AUTHORIZATION)
+    )
+
     class Meta:
 
         model = OAuth2Provider
         fields = [
             "name",
+            "authorization_flow",
             "redirect_uris",
             "client_type",
             "authorization_grant_type",
             "client_id",
             "client_secret",
         ]
+        labels = {
+            "client_id": _("Client ID"),
+            "redirect_uris": _("Redirect URIs"),
+        }
diff --git a/passbook/providers/oauth/models.py b/passbook/providers/oauth/models.py
index b99ebaccf..7a42d1d0e 100644
--- a/passbook/providers/oauth/models.py
+++ b/passbook/providers/oauth/models.py
@@ -12,7 +12,9 @@ from passbook.lib.utils.template import render_to_string
 
 
 class OAuth2Provider(Provider, AbstractApplication):
-    """Associate an OAuth2 Application with a Product"""
+    """Generic OAuth2 Provider for applications not using OpenID-Connect.
+    This Provider also supports the GitHub-pretend mode for Applications that don't support
+    generic OAuth."""
 
     form = "passbook.providers.oauth.forms.OAuth2ProviderForm"
 
@@ -22,7 +24,7 @@ class OAuth2Provider(Provider, AbstractApplication):
     def html_setup_urls(self, request: HttpRequest) -> Optional[str]:
         """return template and context modal with URLs for authorize, token, openid-config, etc"""
         return render_to_string(
-            "oauth2_provider/setup_url_modal.html",
+            "providers/oauth/setup_url_modal.html",
             {
                 "provider": self,
                 "authorize_url": request.build_absolute_uri(
diff --git a/passbook/providers/oauth/settings.py b/passbook/providers/oauth/settings.py
index b8bd2e1a0..925787a30 100644
--- a/passbook/providers/oauth/settings.py
+++ b/passbook/providers/oauth/settings.py
@@ -23,10 +23,9 @@ OAUTH2_PROVIDER = {
     # this is the list of available scopes
     "SCOPES": {
         "openid": "Access OpenID Userinfo",
-        "openid:userinfo": "Access OpenID Userinfo",
-        # 'write': 'Write scope',
-        # 'groups': 'Access to your groups',
-        "user:email": "GitHub Compatibility: User E-Mail",
+        "userinfo": "Access OpenID Userinfo",
+        "email": "Access OpenID Email",
+        "user:email": "GitHub Compatibility: User Email",
         "read:org": "GitHub Compatibility: User Groups",
     }
 }
diff --git a/passbook/providers/oauth/templates/oauth2_provider/authorize.html b/passbook/providers/oauth/templates/oauth2_provider/authorize.html
deleted file mode 100644
index 24635ad37..000000000
--- a/passbook/providers/oauth/templates/oauth2_provider/authorize.html
+++ /dev/null
@@ -1,73 +0,0 @@
-{% extends "login/base.html" %}
-
-{% load passbook_utils %}
-{% load i18n %}
-
-{% block card_title %}
-{% trans 'Authorize Application' %}
-{% endblock %}
-
-{% block card %}
-<form method="POST" class="pf-c-form">
-    {% csrf_token %}
-    {% if not error %}
-        {% csrf_token %}
-        {% for field in form %}
-            {% if field.is_hidden %}
-                {{ field }}
-            {% endif %}
-        {% endfor %}
-        <div class="pf-c-form__group">
-            <p class="subtitle">
-                {% blocktrans with remote=application.name %}
-                You're about to sign into {{ remote }}.
-                {% endblocktrans %}
-            </p>
-            <p>{% trans "Application requires following permissions" %}</p>
-            <ul class="pf-c-list">
-                {% for scope in scopes_descriptions %}
-                <li>{{ scope }}</li>
-                {% endfor %}
-            </ul>
-            {{ form.errors }}
-            {{ form.non_field_errors }}
-        </div>
-        <div class="pf-c-form__group">
-            <p>
-                {% blocktrans with user=user %}
-                You are logged in as {{ user }}. Not you?
-                {% endblocktrans %}
-                <a href="{% url 'passbook_flows:default-invalidation' %}">{% trans 'Logout' %}</a>
-            </p>
-        </div>
-        <div class="pf-c-form__group pf-m-action">
-            <input type="submit" class="pf-c-button pf-m-primary" name="allow" value="{% trans 'Continue' %}">
-            <a href="{% back %}" class="pf-c-button pf-m-secondary">{% trans "Cancel" %}</a>
-        </div>
-        <div class="pf-c-form__group" style="display: none;" id="loading">
-            <div class="pf-c-form__horizontal-group">
-                <span class="pf-c-spinner" role="progressbar" aria-valuetext="Loading...">
-                    <span class="pf-c-spinner__clipper"></span>
-                    <span class="pf-c-spinner__lead-ball"></span>
-                    <span class="pf-c-spinner__tail-ball"></span>
-                </span>
-            </div>
-        </div>
-    {% else %}
-    <div class="login-group">
-        <p class="subtitle">
-            {% blocktrans with err=error.error %}Error: {{ err }}{% endblocktrans %}
-        </p>
-        <p>{{ error.description }}</p>
-    </div>
-    {% endif %}
-</form>
-{% endblock %}
-
-{% block scripts %}
-<script>
-document.querySelector("form").addEventListener("submit", (e) => {
-    document.getElementById("loading").removeAttribute("style");
-});
-</script>
-{% endblock %}
diff --git a/passbook/providers/oauth/templates/oauth2_provider/base.html b/passbook/providers/oauth/templates/oauth2_provider/base.html
deleted file mode 100644
index 8759a6fae..000000000
--- a/passbook/providers/oauth/templates/oauth2_provider/base.html
+++ /dev/null
@@ -1 +0,0 @@
-{% extends "base/skeleton.html" %}
\ No newline at end of file
diff --git a/passbook/providers/oauth/templates/providers/oauth/consent.html b/passbook/providers/oauth/templates/providers/oauth/consent.html
new file mode 100644
index 000000000..0fb2170c7
--- /dev/null
+++ b/passbook/providers/oauth/templates/providers/oauth/consent.html
@@ -0,0 +1,20 @@
+{% extends 'login/form_with_user.html' %}
+
+{% load i18n %}
+
+{% block beneath_form %}
+<div class="pf-c-form__group">
+    <p>
+        {% blocktrans with name=context.application.name %}
+        You're about to sign into {{ name }}.
+        {% endblocktrans %}
+    </p>
+    <p>{% trans "Application requires following permissions" %}</p>
+    <ul class="pf-c-list">
+        {% for scope in context.scope_descriptions %}
+        <li>{{ scope }}</li>
+        {% endfor %}
+    </ul>
+    {{ hidden_inputs }}
+</div>
+{% endblock %}
diff --git a/passbook/providers/oauth/templates/oauth2_provider/setup_url_modal.html b/passbook/providers/oauth/templates/providers/oauth/setup_url_modal.html
similarity index 100%
rename from passbook/providers/oauth/templates/oauth2_provider/setup_url_modal.html
rename to passbook/providers/oauth/templates/providers/oauth/setup_url_modal.html
diff --git a/passbook/providers/oauth/urls.py b/passbook/providers/oauth/urls.py
index a8b68f603..4da8b3a07 100644
--- a/passbook/providers/oauth/urls.py
+++ b/passbook/providers/oauth/urls.py
@@ -6,17 +6,12 @@ from oauth2_provider import views
 from passbook.providers.oauth.views import github, oauth2
 
 oauth_urlpatterns = [
-    # Custom OAuth 2 Authorize View
+    # Custom OAuth2 Authorize View
     path(
         "authorize/",
-        oauth2.PassbookAuthorizationView.as_view(),
+        oauth2.AuthorizationFlowInitView.as_view(),
         name="oauth2-authorize",
     ),
-    path(
-        "authorize/permission_denied/",
-        oauth2.OAuthPermissionDenied.as_view(),
-        name="oauth2-permission-denied",
-    ),
     # OAuth API
     path("token/", views.TokenView.as_view(), name="token"),
     path("revoke_token/", views.RevokeTokenView.as_view(), name="revoke-token"),
@@ -26,7 +21,7 @@ oauth_urlpatterns = [
 github_urlpatterns = [
     path(
         "login/oauth/authorize",
-        oauth2.PassbookAuthorizationView.as_view(),
+        oauth2.AuthorizationFlowInitView.as_view(),
         name="github-authorize",
     ),
     path(
@@ -35,6 +30,7 @@ github_urlpatterns = [
         name="github-access-token",
     ),
     path("user", github.GitHubUserView.as_view(), name="github-user"),
+    path("user/teams", github.GitHubUserTeamsView.as_view(), name="github-user-teams"),
 ]
 
 urlpatterns = [
diff --git a/passbook/providers/oauth/views/github.py b/passbook/providers/oauth/views/github.py
index b52446ee9..11adb9e0a 100644
--- a/passbook/providers/oauth/views/github.py
+++ b/passbook/providers/oauth/views/github.py
@@ -1,21 +1,32 @@
 """passbook pretend GitHub Views"""
-from django.http import JsonResponse
+from django.core.exceptions import PermissionDenied
+from django.http import HttpRequest, HttpResponse, JsonResponse
 from django.shortcuts import get_object_or_404
 from django.views import View
 from oauth2_provider.models import AccessToken
 
+from passbook.core.models import User
 
-class GitHubUserView(View):
+
+class GitHubPretendView(View):
+    """Emulate GitHub's API Endpoints"""
+
+    def verify_access_token(self) -> User:
+        """Verify access token manually since github uses /user?access_token=..."""
+        if "HTTP_AUTHORIZATION" in self.request.META:
+            full_token = self.request.META.get("HTTP_AUTHORIZATION")
+            _, token = full_token.split(" ")
+        elif "access_token" in self.request.GET:
+            token = self.request.GET.get("access_token", "")
+        else:
+            raise PermissionDenied("No access token passed.")
+        return get_object_or_404(AccessToken, token=token).user
+
+
+class GitHubUserView(GitHubPretendView):
     """Emulate GitHub's /user API Endpoint"""
 
-    def verify_access_token(self):
-        """Verify access token manually since github uses /user?access_token=..."""
-        token = get_object_or_404(
-            AccessToken, token=self.request.GET.get("access_token", "")
-        )
-        return token.user
-
-    def get(self, request):
+    def get(self, request: HttpRequest) -> HttpResponse:
         """Emulate GitHub's /user API Endpoint"""
         user = self.verify_access_token()
         return JsonResponse(
@@ -65,3 +76,11 @@ class GitHubUserView(View):
                 },
             }
         )
+
+
+class GitHubUserTeamsView(GitHubPretendView):
+    """Emulate GitHub's /user/teams API Endpoint"""
+
+    def get(self, request: HttpRequest) -> HttpResponse:
+        """Emulate GitHub's /user/teams API Endpoint"""
+        return JsonResponse([], safe=False)
diff --git a/passbook/providers/oauth/views/oauth2.py b/passbook/providers/oauth/views/oauth2.py
index 208dd99ac..b6a122352 100644
--- a/passbook/providers/oauth/views/oauth2.py
+++ b/passbook/providers/oauth/views/oauth2.py
@@ -1,76 +1,133 @@
 """passbook OAuth2 Views"""
-from typing import Optional
-from urllib.parse import urlencode
-
-from django.contrib import messages
-from django.forms import Form
-from django.http import HttpRequest, HttpResponse
-from django.shortcuts import get_object_or_404, redirect, reverse
+from django.contrib.auth.mixins import LoginRequiredMixin
+from django.http import HttpRequest, HttpResponse, HttpResponseRedirect
+from django.shortcuts import get_object_or_404
+from django.views import View
+from oauth2_provider.exceptions import OAuthToolkitError
+from oauth2_provider.scopes import get_scopes_backend
 from oauth2_provider.views.base import AuthorizationView
 from structlog import get_logger
 
 from passbook.audit.models import Event, EventAction
 from passbook.core.models import Application
-from passbook.core.views.access import AccessMixin
-from passbook.core.views.utils import PermissionDeniedView
+from passbook.flows.models import in_memory_stage
+from passbook.flows.planner import (
+    PLAN_CONTEXT_APPLICATION,
+    PLAN_CONTEXT_SSO,
+    FlowPlanner,
+)
+from passbook.flows.stage import StageView
+from passbook.flows.views import SESSION_KEY_PLAN
+from passbook.lib.utils.urls import redirect_with_qs
+from passbook.policies.mixins import PolicyAccessMixin
 from passbook.providers.oauth.models import OAuth2Provider
+from passbook.stages.consent.stage import PLAN_CONTEXT_CONSENT_TEMPLATE
 
 LOGGER = get_logger()
 
+PLAN_CONTEXT_CLIENT_ID = "client_id"
+PLAN_CONTEXT_REDIRECT_URI = "redirect_uri"
+PLAN_CONTEXT_RESPONSE_TYPE = "response_type"
+PLAN_CONTEXT_STATE = "state"
 
-class OAuthPermissionDenied(PermissionDeniedView):
-    """Show permission denied view"""
+PLAN_CONTEXT_CODE_CHALLENGE = "code_challenge"
+PLAN_CONTEXT_CODE_CHALLENGE_METHOD = "code_challenge_method"
+PLAN_CONTEXT_SCOPE = "scope"
+PLAN_CONTEXT_NONCE = "nonce"
+PLAN_CONTEXT_SCOPE_DESCRIPTION = "scope_descriptions"
 
 
-class PassbookAuthorizationView(AccessMixin, AuthorizationView):
-    """Custom OAuth2 Authorization View which checks policies, etc"""
+class AuthorizationFlowInitView(PolicyAccessMixin, LoginRequiredMixin, View):
+    """OAuth2 Flow initializer, checks access to application and starts flow"""
 
-    _application: Optional[Application] = None
-
-    def _inject_response_type(self):
-        """Inject response_type into querystring if not set"""
-        LOGGER.debug("response_type not set, defaulting to 'code'")
-        querystring = urlencode(self.request.GET)
-        querystring += "&response_type=code"
-        return redirect(
-            reverse("passbook_providers_oauth:oauth2-ok-authorize") + "?" + querystring
-        )
-
-    def dispatch(self, request: HttpRequest, *args, **kwargs) -> HttpResponse:
-        """Update OAuth2Provider's skip_authorization state"""
-        # Get client_id to get provider, so we can update skip_authorization field
+    # pylint: disable=unused-argument
+    def get(self, request: HttpRequest, *args, **kwargs) -> HttpResponse:
+        """Check access to application, start FlowPLanner, return to flow executor shell"""
         client_id = request.GET.get("client_id")
         provider = get_object_or_404(OAuth2Provider, client_id=client_id)
         try:
             application = self.provider_to_application(provider)
         except Application.DoesNotExist:
-            return redirect("passbook_providers_oauth:oauth2-permission-denied")
-        # Update field here so oauth-toolkit does work for us
-        provider.skip_authorization = application.skip_authorization
-        provider.save()
-        self._application = application
+            return self.handle_no_permission_authorized()
         # Check permissions
-        result = self.user_has_access(self._application, request.user)
+        result = self.user_has_access(application)
         if not result.passing:
-            for policy_message in result.messages:
-                messages.error(request, policy_message)
-            return redirect("passbook_providers_oauth:oauth2-permission-denied")
-        # Some clients don't pass response_type, so we default to code
-        if "response_type" not in request.GET:
-            return self._inject_response_type()
-        actual_response = AuthorizationView.dispatch(self, request, *args, **kwargs)
-        if actual_response.status_code == 400:
-            LOGGER.debug("Bad request", redirect_uri=request.GET.get("redirect_uri"))
-        return actual_response
+            return self.handle_no_permission_authorized()
+        # Regardless, we start the planner and return to it
+        planner = FlowPlanner(provider.authorization_flow)
+        planner.allow_empty_flows = True
+        # Save scope descriptions
+        scopes = request.GET.get(PLAN_CONTEXT_SCOPE)
+        all_scopes = get_scopes_backend().get_all_scopes()
 
-    def form_valid(self, form: Form):
-        # User has clicked on "Authorize"
-        Event.new(
-            EventAction.AUTHORIZE_APPLICATION, authorized_application=self._application,
-        ).from_http(self.request)
-        LOGGER.debug(
-            "User authorized Application",
-            user=self.request.user,
-            application=self._application,
+        plan = planner.plan(
+            self.request,
+            {
+                PLAN_CONTEXT_SSO: True,
+                PLAN_CONTEXT_APPLICATION: application,
+                PLAN_CONTEXT_CLIENT_ID: client_id,
+                PLAN_CONTEXT_REDIRECT_URI: request.GET.get(PLAN_CONTEXT_REDIRECT_URI),
+                PLAN_CONTEXT_RESPONSE_TYPE: request.GET.get(PLAN_CONTEXT_RESPONSE_TYPE),
+                PLAN_CONTEXT_STATE: request.GET.get(PLAN_CONTEXT_STATE),
+                PLAN_CONTEXT_SCOPE: scopes,
+                PLAN_CONTEXT_NONCE: request.GET.get(PLAN_CONTEXT_NONCE),
+                PLAN_CONTEXT_SCOPE_DESCRIPTION: [
+                    all_scopes[scope] for scope in scopes.split(" ")
+                ],
+                PLAN_CONTEXT_CONSENT_TEMPLATE: "providers/oauth/consent.html",
+            },
         )
-        return AuthorizationView.form_valid(self, form)
+
+        plan.append(in_memory_stage(OAuth2Stage))
+        self.request.session[SESSION_KEY_PLAN] = plan
+        return redirect_with_qs(
+            "passbook_flows:flow-executor-shell",
+            self.request.GET,
+            flow_slug=provider.authorization_flow.slug,
+        )
+
+
+class OAuth2Stage(AuthorizationView, StageView):
+    """OAuth2 Stage, dynamically injected into the plan"""
+
+    def get(self, request: HttpRequest, *args, **kwargs) -> HttpResponse:
+        """Last stage in flow, finalizes OAuth Response and redirects to Client"""
+        application: Application = self.executor.plan.context[PLAN_CONTEXT_APPLICATION]
+        provider: OAuth2Provider = application.provider
+
+        Event.new(
+            EventAction.AUTHORIZE_APPLICATION, authorized_application=application,
+        ).from_http(self.request)
+
+        credentials = {
+            "client_id": self.executor.plan.context[PLAN_CONTEXT_CLIENT_ID],
+            "redirect_uri": self.executor.plan.context[PLAN_CONTEXT_REDIRECT_URI],
+            "response_type": self.executor.plan.context.get(
+                PLAN_CONTEXT_RESPONSE_TYPE, None
+            ),
+            "state": self.executor.plan.context.get(PLAN_CONTEXT_STATE, None),
+            "nonce": self.executor.plan.context.get(PLAN_CONTEXT_NONCE, None),
+        }
+        if self.executor.plan.context.get(PLAN_CONTEXT_CODE_CHALLENGE, False):
+            credentials[PLAN_CONTEXT_CODE_CHALLENGE] = self.executor.plan.context.get(
+                PLAN_CONTEXT_CODE_CHALLENGE
+            )
+        if self.executor.plan.context.get(PLAN_CONTEXT_CODE_CHALLENGE_METHOD, False):
+            credentials[
+                PLAN_CONTEXT_CODE_CHALLENGE_METHOD
+            ] = self.executor.plan.context.get(PLAN_CONTEXT_CODE_CHALLENGE_METHOD)
+        scopes = self.executor.plan.context.get(PLAN_CONTEXT_SCOPE)
+
+        try:
+            uri, _headers, _body, _status = self.create_authorization_response(
+                request=self.request,
+                scopes=scopes,
+                credentials=credentials,
+                allow=True,
+            )
+            LOGGER.debug("Success url for the request: {0}".format(uri))
+        except OAuthToolkitError as error:
+            return self.error_response(error, provider)
+
+        self.executor.stage_ok()
+        return HttpResponseRedirect(self.redirect(uri, provider).url)
diff --git a/passbook/providers/oidc/apps.py b/passbook/providers/oidc/apps.py
index ee4f50191..363366e17 100644
--- a/passbook/providers/oidc/apps.py
+++ b/passbook/providers/oidc/apps.py
@@ -1,6 +1,4 @@
 """passbook auth oidc provider app config"""
-from importlib import import_module
-
 from django.apps import AppConfig
 from django.db.utils import InternalError, OperationalError, ProgrammingError
 from django.urls import include, path
@@ -15,6 +13,7 @@ class PassbookProviderOIDCConfig(AppConfig):
     name = "passbook.providers.oidc"
     label = "passbook_providers_oidc"
     verbose_name = "passbook Providers.OIDC"
+    mountpoint = "application/oidc/"
 
     def ready(self):
         try:
@@ -36,5 +35,3 @@ class PassbookProviderOIDCConfig(AppConfig):
                 include("oidc_provider.urls", namespace="oidc_provider"),
             ),
         )
-
-        import_module("passbook.providers.oidc.signals")
diff --git a/passbook/providers/oidc/auth.py b/passbook/providers/oidc/auth.py
index 91a0b9dcf..8563b7844 100644
--- a/passbook/providers/oidc/auth.py
+++ b/passbook/providers/oidc/auth.py
@@ -10,6 +10,8 @@ from structlog import get_logger
 
 from passbook.audit.models import Event, EventAction
 from passbook.core.models import Application, Provider, User
+from passbook.flows.planner import FlowPlan
+from passbook.flows.views import SESSION_KEY_PLAN
 from passbook.policies.engine import PolicyEngine
 
 LOGGER = get_logger()
@@ -38,15 +40,15 @@ def check_permissions(
     sections/settings.html#oidc-after-userlogin-hook"""
     provider = client_related_provider(client)
     if not provider:
-        return redirect("passbook_providers_oauth:oauth2-permission-denied")
+        return redirect("passbook_flows:denied")
     try:
         application = provider.application
     except Application.DoesNotExist:
-        return redirect("passbook_providers_oauth:oauth2-permission-denied")
+        return redirect("passbook_flows:denied")
     LOGGER.debug(
         "Checking permissions for application", user=user, application=application
     )
-    policy_engine = PolicyEngine(application.policies.all(), user, request)
+    policy_engine = PolicyEngine(application, user, request)
     policy_engine.build()
 
     # Check permissions
@@ -54,11 +56,12 @@ def check_permissions(
     if not result.passing:
         for policy_message in result.messages:
             messages.error(request, policy_message)
-        return redirect("passbook_providers_oauth:oauth2-permission-denied")
+        return redirect("passbook_flows:denied")
 
+    plan: FlowPlan = request.session[SESSION_KEY_PLAN]
     Event.new(
         EventAction.AUTHORIZE_APPLICATION,
         authorized_application=application,
-        skipped_authorization=False,
+        flow=plan.flow_pk,
     ).from_http(request)
     return None
diff --git a/passbook/providers/oidc/claims.py b/passbook/providers/oidc/claims.py
index 8ad905a22..f53c90f33 100644
--- a/passbook/providers/oidc/claims.py
+++ b/passbook/providers/oidc/claims.py
@@ -10,5 +10,5 @@ def userinfo(claims: Dict[str, Any], user: User) -> Dict[str, Any]:
     claims["given_name"] = user.name
     claims["family_name"] = user.name
     claims["email"] = user.email
-
+    claims["preferred_username"] = user.username
     return claims
diff --git a/passbook/providers/oidc/forms.py b/passbook/providers/oidc/forms.py
index 857adeef6..46e56d16b 100644
--- a/passbook/providers/oidc/forms.py
+++ b/passbook/providers/oidc/forms.py
@@ -4,12 +4,17 @@ from django import forms
 from oauth2_provider.generators import generate_client_id, generate_client_secret
 from oidc_provider.models import Client
 
+from passbook.flows.models import Flow, FlowDesignation
 from passbook.providers.oidc.models import OpenIDProvider
 
 
 class OIDCProviderForm(forms.ModelForm):
     """OpenID Client form"""
 
+    authorization_flow = forms.ModelChoiceField(
+        queryset=Flow.objects.filter(designation=FlowDesignation.AUTHORIZATION)
+    )
+
     def __init__(self, *args, **kwargs):
         # Correctly load data from 1:1 rel
         if "instance" in kwargs and kwargs["instance"]:
@@ -17,20 +22,35 @@ class OIDCProviderForm(forms.ModelForm):
         super().__init__(*args, **kwargs)
         self.fields["client_id"].initial = generate_client_id()
         self.fields["client_secret"].initial = generate_client_secret()
+        try:
+            self.fields[
+                "authorization_flow"
+            ].initial = self.instance.openidprovider.authorization_flow
+        # pylint: disable=no-member
+        except Client.openidprovider.RelatedObjectDoesNotExist:
+            pass
 
     def save(self, *args, **kwargs):
         self.instance.reuse_consent = False  # This is managed by passbook
-        self.instance.require_consent = True  # This is managed by passbook
+        self.instance.require_consent = False  # This is managed by passbook
         response = super().save(*args, **kwargs)
         # Check if openidprovider class instance exists
         if not OpenIDProvider.objects.filter(oidc_client=self.instance).exists():
-            OpenIDProvider.objects.create(oidc_client=self.instance)
+            OpenIDProvider.objects.create(
+                oidc_client=self.instance,
+                authorization_flow=self.cleaned_data.get("authorization_flow"),
+            )
+        self.instance.openidprovider.authorization_flow = self.cleaned_data.get(
+            "authorization_flow"
+        )
+        self.instance.openidprovider.save()
         return response
 
     class Meta:
         model = Client
         fields = [
             "name",
+            "authorization_flow",
             "client_type",
             "client_id",
             "client_secret",
diff --git a/passbook/providers/oidc/models.py b/passbook/providers/oidc/models.py
index 16c6d9d34..e0f3feaf0 100644
--- a/passbook/providers/oidc/models.py
+++ b/passbook/providers/oidc/models.py
@@ -12,7 +12,7 @@ from passbook.lib.utils.template import render_to_string
 
 
 class OpenIDProvider(Provider):
-    """Proxy model for OIDC Client"""
+    """OpenID Connect Provider for applications that support OIDC."""
 
     # Since oidc_provider doesn't currently support swappable models
     # (https://github.com/juanifioren/django-oidc-provider/pull/305)
@@ -28,7 +28,7 @@ class OpenIDProvider(Provider):
         return self.oidc_client.name
 
     def __str__(self):
-        return "OpenID Connect Provider %s" % self.oidc_client.__str__()
+        return f"OpenID Connect Provider {self.oidc_client.__str__()}"
 
     def html_setup_urls(self, request: HttpRequest) -> Optional[str]:
         """return template and context modal with URLs for authorize, token, openid-config, etc"""
@@ -37,14 +37,14 @@ class OpenIDProvider(Provider):
             {
                 "provider": self,
                 "authorize": request.build_absolute_uri(
-                    reverse("oidc_provider:authorize")
+                    reverse("passbook_providers_oidc:authorize")
                 ),
                 "token": request.build_absolute_uri(reverse("oidc_provider:token")),
                 "userinfo": request.build_absolute_uri(
                     reverse("oidc_provider:userinfo")
                 ),
                 "provider_info": request.build_absolute_uri(
-                    reverse("oidc_provider:provider-info")
+                    reverse("passbook_providers_oidc:provider-info")
                 ),
             },
         )
diff --git a/passbook/providers/oidc/signals.py b/passbook/providers/oidc/signals.py
deleted file mode 100644
index a74550388..000000000
--- a/passbook/providers/oidc/signals.py
+++ /dev/null
@@ -1,15 +0,0 @@
-"""OIDC Provider signals"""
-from django.db.models.signals import post_save
-from django.dispatch import receiver
-
-from passbook.core.models import Application
-from passbook.providers.oidc.models import OpenIDProvider
-
-
-@receiver(post_save, sender=Application)
-# pylint: disable=unused-argument
-def on_application_save(sender, instance: Application, **_):
-    """Synchronize application's skip_authorization with oidc_client's require_consent"""
-    if isinstance(instance.provider, OpenIDProvider):
-        instance.provider.oidc_client.require_consent = not instance.skip_authorization
-        instance.provider.oidc_client.save()
diff --git a/passbook/providers/oidc/templates/oidc_provider/authorize.html b/passbook/providers/oidc/templates/oidc_provider/authorize.html
index 9326ee625..aabbb262e 100644
--- a/passbook/providers/oidc/templates/oidc_provider/authorize.html
+++ b/passbook/providers/oidc/templates/oidc_provider/authorize.html
@@ -38,7 +38,7 @@
                 {% blocktrans with user=user %}
                 You are logged in as {{ user }}. Not you?
                 {% endblocktrans %}
-                <a href="{% url 'passbook_flows:default-invalidation' %}">{% trans 'Logout' %}</a>
+                <a href="{% url 'passbook_flows:cancel' %}">{% trans 'Logout' %}</a>
             </p>
         </div>
         <div class="pf-c-form__group pf-m-action">
diff --git a/passbook/providers/oidc/templates/providers/oidc/consent.html b/passbook/providers/oidc/templates/providers/oidc/consent.html
new file mode 100644
index 000000000..83ad45123
--- /dev/null
+++ b/passbook/providers/oidc/templates/providers/oidc/consent.html
@@ -0,0 +1,20 @@
+{% extends 'login/form_with_user.html' %}
+
+{% load i18n %}
+
+{% block beneath_form %}
+<div class="pf-c-form__group">
+    <p>
+        {% blocktrans with name=context.application.name %}
+        You're about to sign into {{ name }}.
+        {% endblocktrans %}
+    </p>
+    <p>{% trans "Application requires following permissions" %}</p>
+    <ul class="pf-c-list">
+        {% for scope in context.scopes %}
+        <li>{{ scope.name }}</li>
+        {% endfor %}
+    </ul>
+    {{ hidden_inputs }}
+</div>
+{% endblock %}
diff --git a/passbook/providers/oidc/urls.py b/passbook/providers/oidc/urls.py
new file mode 100644
index 000000000..a7f317709
--- /dev/null
+++ b/passbook/providers/oidc/urls.py
@@ -0,0 +1,13 @@
+"""oidc provider URLs"""
+from django.conf.urls import url
+
+from passbook.providers.oidc.views import AuthorizationFlowInitView, ProviderInfoView
+
+urlpatterns = [
+    url(r"^authorize/?$", AuthorizationFlowInitView.as_view(), name="authorize"),
+    url(
+        r"^\.well-known/openid-configuration/?$",
+        ProviderInfoView.as_view(),
+        name="provider-info",
+    ),
+]
diff --git a/passbook/providers/oidc/views.py b/passbook/providers/oidc/views.py
new file mode 100644
index 000000000..5bdbe7351
--- /dev/null
+++ b/passbook/providers/oidc/views.py
@@ -0,0 +1,129 @@
+"""passbook OIDC Views"""
+from django.contrib.auth.mixins import LoginRequiredMixin
+from django.http import HttpRequest, HttpResponse, JsonResponse
+from django.shortcuts import get_object_or_404, reverse
+from django.views import View
+from oidc_provider.lib.endpoints.authorize import AuthorizeEndpoint
+from oidc_provider.lib.utils.common import get_issuer, get_site_url
+from oidc_provider.models import ResponseType
+from oidc_provider.views import AuthorizeView
+from structlog import get_logger
+
+from passbook.core.models import Application
+from passbook.flows.models import in_memory_stage
+from passbook.flows.planner import (
+    PLAN_CONTEXT_APPLICATION,
+    PLAN_CONTEXT_SSO,
+    FlowPlan,
+    FlowPlanner,
+)
+from passbook.flows.stage import StageView
+from passbook.flows.views import SESSION_KEY_PLAN
+from passbook.lib.utils.urls import redirect_with_qs
+from passbook.policies.mixins import PolicyAccessMixin
+from passbook.providers.oidc.models import OpenIDProvider
+from passbook.stages.consent.stage import PLAN_CONTEXT_CONSENT_TEMPLATE
+
+LOGGER = get_logger()
+
+PLAN_CONTEXT_PARAMS = "params"
+PLAN_CONTEXT_SCOPES = "scopes"
+
+
+class AuthorizationFlowInitView(PolicyAccessMixin, LoginRequiredMixin, View):
+    """OIDC Flow initializer, checks access to application and starts flow"""
+
+    # pylint: disable=unused-argument
+    def get(self, request: HttpRequest, *args, **kwargs) -> HttpResponse:
+        """Check access to application, start FlowPLanner, return to flow executor shell"""
+        client_id = request.GET.get("client_id")
+        provider = get_object_or_404(OpenIDProvider, oidc_client__client_id=client_id)
+        try:
+            application = self.provider_to_application(provider)
+        except Application.DoesNotExist:
+            return self.handle_no_permission_authorized()
+        # Check permissions
+        result = self.user_has_access(application)
+        if not result.passing:
+            return self.handle_no_permission_authorized()
+        # Extract params so we can save them in the plan context
+        endpoint = AuthorizeEndpoint(request)
+        # Regardless, we start the planner and return to it
+        planner = FlowPlanner(provider.authorization_flow)
+        # planner.use_cache = False
+        planner.allow_empty_flows = True
+        plan = planner.plan(
+            self.request,
+            {
+                PLAN_CONTEXT_SSO: True,
+                PLAN_CONTEXT_APPLICATION: application,
+                PLAN_CONTEXT_PARAMS: endpoint.params,
+                PLAN_CONTEXT_SCOPES: endpoint.get_scopes_information(),
+                PLAN_CONTEXT_CONSENT_TEMPLATE: "providers/oidc/consent.html",
+            },
+        )
+        plan.append(in_memory_stage(OIDCStage))
+        self.request.session[SESSION_KEY_PLAN] = plan
+        return redirect_with_qs(
+            "passbook_flows:flow-executor-shell",
+            self.request.GET,
+            flow_slug=provider.authorization_flow.slug,
+        )
+
+
+class FlowAuthorizeEndpoint(AuthorizeEndpoint):
+    """Restore params from flow context"""
+
+    def _extract_params(self):
+        plan: FlowPlan = self.request.session[SESSION_KEY_PLAN]
+        self.params = plan.context[PLAN_CONTEXT_PARAMS]
+
+
+class OIDCStage(AuthorizeView, StageView):
+    """Finall stage, restores params from Flow."""
+
+    authorize_endpoint_class = FlowAuthorizeEndpoint
+
+
+class ProviderInfoView(View):
+    """Custom ProviderInfo View which shows our URLs instead"""
+
+    # pylint: disable=unused-argument
+    def get(self, request, *args, **kwargs):
+        """Custom ProviderInfo View which shows our URLs instead"""
+        dic = dict()
+
+        site_url = get_site_url(request=request)
+        dic["issuer"] = get_issuer(site_url=site_url, request=request)
+
+        dic["authorization_endpoint"] = site_url + reverse(
+            "passbook_providers_oidc:authorize"
+        )
+        dic["token_endpoint"] = site_url + reverse("oidc_provider:token")
+        dic["userinfo_endpoint"] = site_url + reverse("oidc_provider:userinfo")
+        dic["end_session_endpoint"] = site_url + reverse("oidc_provider:end-session")
+        dic["introspection_endpoint"] = site_url + reverse(
+            "oidc_provider:token-introspection"
+        )
+
+        types_supported = [
+            response_type.value for response_type in ResponseType.objects.all()
+        ]
+        dic["response_types_supported"] = types_supported
+
+        dic["jwks_uri"] = site_url + reverse("oidc_provider:jwks")
+
+        dic["id_token_signing_alg_values_supported"] = ["HS256", "RS256"]
+
+        # See: http://openid.net/specs/openid-connect-core-1_0.html#SubjectIDTypes
+        dic["subject_types_supported"] = ["public"]
+
+        dic["token_endpoint_auth_methods_supported"] = [
+            "client_secret_post",
+            "client_secret_basic",
+        ]
+
+        response = JsonResponse(dic)
+        response["Access-Control-Allow-Origin"] = "*"
+
+        return response
diff --git a/passbook/providers/saml/forms.py b/passbook/providers/saml/forms.py
index 76a56d66a..a5b4d17c7 100644
--- a/passbook/providers/saml/forms.py
+++ b/passbook/providers/saml/forms.py
@@ -2,8 +2,12 @@
 
 from django import forms
 from django.contrib.admin.widgets import FilteredSelectMultiple
+from django.utils.html import mark_safe
 from django.utils.translation import gettext as _
 
+from passbook.admin.fields import CodeMirrorWidget
+from passbook.core.expression import PropertyMappingEvaluator
+from passbook.flows.models import Flow, FlowDesignation
 from passbook.providers.saml.models import (
     SAMLPropertyMapping,
     SAMLProvider,
@@ -14,6 +18,9 @@ from passbook.providers.saml.models import (
 class SAMLProviderForm(forms.ModelForm):
     """SAML Provider form"""
 
+    authorization_flow = forms.ModelChoiceField(
+        queryset=Flow.objects.filter(designation=FlowDesignation.AUTHORIZATION)
+    )
     processor_path = forms.ChoiceField(
         choices=get_provider_choices(), label="Processor"
     )
@@ -23,10 +30,12 @@ class SAMLProviderForm(forms.ModelForm):
         model = SAMLProvider
         fields = [
             "name",
+            "authorization_flow",
             "processor_path",
             "acs_url",
             "audience",
             "issuer",
+            "sp_binding",
             "assertion_valid_not_before",
             "assertion_valid_not_on_or_after",
             "session_valid_not_on_or_after",
@@ -50,7 +59,14 @@ class SAMLProviderForm(forms.ModelForm):
 class SAMLPropertyMappingForm(forms.ModelForm):
     """SAML Property Mapping form"""
 
-    template_name = "saml/idp/property_mapping_form.html"
+    template_name = "providers/saml/property_mapping_form.html"
+
+    def clean_expression(self):
+        """Test Syntax"""
+        expression = self.cleaned_data.get("expression")
+        evaluator = PropertyMappingEvaluator()
+        evaluator.validate(expression)
+        return expression
 
     class Meta:
 
@@ -60,4 +76,13 @@ class SAMLPropertyMappingForm(forms.ModelForm):
             "name": forms.TextInput(),
             "saml_name": forms.TextInput(),
             "friendly_name": forms.TextInput(),
+            "expression": CodeMirrorWidget(mode="python"),
+        }
+        help_texts = {
+            "saml_name": mark_safe(
+                _(
+                    "URN OID used by SAML. This is optional. "
+                    '<a href="https://www.rfc-editor.org/rfc/rfc2798.html#section-2">Reference</a>'
+                )
+            ),
         }
diff --git a/passbook/providers/saml/migrations/0002_default_saml_property_mappings.py b/passbook/providers/saml/migrations/0002_default_saml_property_mappings.py
index 72575b6d6..9f1f13357 100644
--- a/passbook/providers/saml/migrations/0002_default_saml_property_mappings.py
+++ b/passbook/providers/saml/migrations/0002_default_saml_property_mappings.py
@@ -13,32 +13,32 @@ def create_default_property_mappings(apps, schema_editor):
         {
             "FriendlyName": "eduPersonPrincipalName",
             "Name": "urn:oid:1.3.6.1.4.1.5923.1.1.1.6",
-            "Expression": "{{ user.email }}",
+            "Expression": "return user.email",
         },
         {
             "FriendlyName": "cn",
             "Name": "urn:oid:2.5.4.3",
-            "Expression": "{{ user.name }}",
+            "Expression": "return user.name",
         },
         {
             "FriendlyName": "mail",
             "Name": "urn:oid:0.9.2342.19200300.100.1.3",
-            "Expression": "{{ user.email }}",
+            "Expression": "return user.email",
         },
         {
             "FriendlyName": "displayName",
             "Name": "urn:oid:2.16.840.1.113730.3.1.241",
-            "Expression": "{{ user.username }}",
+            "Expression": "return user.username",
         },
         {
             "FriendlyName": "uid",
             "Name": "urn:oid:0.9.2342.19200300.100.1.1",
-            "Expression": "{{ user.pk }}",
+            "Expression": "return user.pk",
         },
         {
             "FriendlyName": "member-of",
             "Name": "member-of",
-            "Expression": "[{% for group in user.groups.all() %}'{{ group.name }}',{% endfor %}]",
+            "Expression": "for group in user.groups.all():\n    yield group.name",
         },
     ]
     for default in defaults:
diff --git a/passbook/providers/saml/migrations/0003_samlprovider_sp_binding.py b/passbook/providers/saml/migrations/0003_samlprovider_sp_binding.py
new file mode 100644
index 000000000..20ffbbf06
--- /dev/null
+++ b/passbook/providers/saml/migrations/0003_samlprovider_sp_binding.py
@@ -0,0 +1,20 @@
+# Generated by Django 3.0.6 on 2020-06-06 13:25
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("passbook_providers_saml", "0002_default_saml_property_mappings"),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name="samlprovider",
+            name="sp_binding",
+            field=models.TextField(
+                choices=[("redirect", "Redirect"), ("post", "Post")], default="redirect"
+            ),
+        ),
+    ]
diff --git a/passbook/providers/saml/migrations/0004_auto_20200620_1950.py b/passbook/providers/saml/migrations/0004_auto_20200620_1950.py
new file mode 100644
index 000000000..175baeb5d
--- /dev/null
+++ b/passbook/providers/saml/migrations/0004_auto_20200620_1950.py
@@ -0,0 +1,22 @@
+# Generated by Django 3.0.7 on 2020-06-20 19:50
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("passbook_providers_saml", "0003_samlprovider_sp_binding"),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name="samlprovider",
+            name="sp_binding",
+            field=models.TextField(
+                choices=[("redirect", "Redirect"), ("post", "Post")],
+                default="redirect",
+                verbose_name="Service Prodier Binding",
+            ),
+        ),
+    ]
diff --git a/passbook/providers/saml/models.py b/passbook/providers/saml/models.py
index 4472df8c7..f5a63b6ed 100644
--- a/passbook/providers/saml/models.py
+++ b/passbook/providers/saml/models.py
@@ -17,8 +17,15 @@ from passbook.providers.saml.utils.time import timedelta_string_validator
 LOGGER = get_logger()
 
 
+class SAMLBindings(models.TextChoices):
+    """SAML Bindings supported by passbook"""
+
+    REDIRECT = "redirect"
+    POST = "post"
+
+
 class SAMLProvider(Provider):
-    """Model to save information about a Remote SAML Endpoint"""
+    """SAML 2.0 Endpoint for applications which support SAML."""
 
     name = models.TextField()
     processor_path = models.CharField(max_length=255, choices=[])
@@ -26,6 +33,11 @@ class SAMLProvider(Provider):
     acs_url = models.URLField(verbose_name=_("ACS URL"))
     audience = models.TextField(default="")
     issuer = models.TextField(help_text=_("Also known as EntityID"))
+    sp_binding = models.TextField(
+        choices=SAMLBindings.choices,
+        default=SAMLBindings.REDIRECT,
+        verbose_name=_("Service Prodier Binding"),
+    )
 
     assertion_valid_not_before = models.TextField(
         default="minutes=-5",
@@ -118,8 +130,8 @@ class SAMLProvider(Provider):
         try:
             # pylint: disable=no-member
             return reverse(
-                "passbook_providers_saml:saml-metadata",
-                kwargs={"application": self.application.slug},
+                "passbook_providers_saml:metadata",
+                kwargs={"application_slug": self.application.slug},
             )
         except Provider.application.RelatedObjectDoesNotExist:
             return None
@@ -132,7 +144,7 @@ class SAMLProvider(Provider):
             # pylint: disable=no-member
             metadata = DescriptorDownloadView.get_metadata(request, self)
             return render_to_string(
-                "saml/idp/admin_metadata_modal.html",
+                "providers/saml/admin_metadata_modal.html",
                 {"provider": self, "metadata": metadata},
             )
         except Provider.application.RelatedObjectDoesNotExist:
@@ -145,7 +157,7 @@ class SAMLProvider(Provider):
 
 
 class SAMLPropertyMapping(PropertyMapping):
-    """SAML Property mapping, allowing Name/FriendlyName mapping to a list of strings"""
+    """Map User/Group attribute to SAML Attribute, which can be used by the Service Provider."""
 
     saml_name = models.TextField(verbose_name="SAML Name")
     friendly_name = models.TextField(default=None, blank=True, null=True)
diff --git a/passbook/providers/saml/processors/base.py b/passbook/providers/saml/processors/base.py
index db65e37ff..05228a0b0 100644
--- a/passbook/providers/saml/processors/base.py
+++ b/passbook/providers/saml/processors/base.py
@@ -1,4 +1,5 @@
 """Basic SAML Processor"""
+from types import GeneratorType
 from typing import TYPE_CHECKING, Dict, List, Union
 
 from cryptography.exceptions import InvalidSignature
@@ -21,7 +22,7 @@ if TYPE_CHECKING:
 
 # pylint: disable=too-many-instance-attributes
 class Processor:
-    """Base SAML 2.0 AuthnRequest to Response Processor.
+    """Base SAML 2.0 Auth-N-Request to Response Processor.
     Sub-classes should provide Service Provider-specific functionality."""
 
     is_idp_initiated = False
@@ -111,6 +112,8 @@ class Processor:
                     request=self._http_request,
                     provider=self._remote,
                 )
+                if value is None:
+                    continue
                 mapping_payload = {
                     "Name": mapping.saml_name,
                     "FriendlyName": mapping.friendly_name,
@@ -119,6 +122,8 @@ class Processor:
                 # differently in the template
                 if isinstance(value, list):
                     mapping_payload["ValueArray"] = value
+                elif isinstance(value, GeneratorType):
+                    mapping_payload["ValueArray"] = list(value)
                 else:
                     mapping_payload["Value"] = value
                 attributes.append(mapping_payload)
@@ -127,7 +132,9 @@ class Processor:
                 continue
         self._assertion_params["ATTRIBUTES"] = attributes
         self._assertion_xml = get_assertion_xml(
-            "saml/xml/assertions/generic.xml", self._assertion_params, signed=True
+            "providers/saml/xml/assertions/generic.xml",
+            self._assertion_params,
+            signed=True,
         )
 
     def _format_response(self):
diff --git a/passbook/providers/saml/processors/salesforce.py b/passbook/providers/saml/processors/salesforce.py
index b2d3a369a..715b93c7f 100644
--- a/passbook/providers/saml/processors/salesforce.py
+++ b/passbook/providers/saml/processors/salesforce.py
@@ -10,5 +10,7 @@ class SalesForceProcessor(GenericProcessor):
     def _format_assertion(self):
         super()._format_assertion()
         self._assertion_xml = get_assertion_xml(
-            "saml/xml/assertions/salesforce.xml", self._assertion_params, signed=True
+            "providers/saml/xml/assertions/salesforce.xml",
+            self._assertion_params,
+            signed=True,
         )
diff --git a/passbook/providers/saml/templates/saml/idp/admin_metadata_modal.html b/passbook/providers/saml/templates/providers/saml/admin_metadata_modal.html
similarity index 100%
rename from passbook/providers/saml/templates/saml/idp/admin_metadata_modal.html
rename to passbook/providers/saml/templates/providers/saml/admin_metadata_modal.html
diff --git a/passbook/providers/saml/templates/providers/saml/autosubmit_form.html b/passbook/providers/saml/templates/providers/saml/autosubmit_form.html
new file mode 100644
index 000000000..6202797b1
--- /dev/null
+++ b/passbook/providers/saml/templates/providers/saml/autosubmit_form.html
@@ -0,0 +1,29 @@
+{% extends "login/base.html" %}
+
+{% load passbook_utils %}
+{% load i18n %}
+
+{% block card_title %}
+{% blocktrans with app=application.name %}
+Redirecting to {{ app }}...
+{% endblocktrans %}
+{% endblock %}
+
+{% block card %}
+<form method="POST" action="{{ url }}" autosubmit>
+    {% csrf_token %}
+    {% for key, value in attrs.items %}
+    <input type="hidden" name="{{ key }}" value="{{ value }}">
+    {% endfor %}
+    <div class="pf-c-form__group">
+        <span class="pf-c-spinner" role="progressbar" aria-valuetext="Loading...">
+            <span class="pf-c-spinner__clipper"></span>
+            <span class="pf-c-spinner__lead-ball"></span>
+            <span class="pf-c-spinner__tail-ball"></span>
+        </span>
+    </div>
+    <div class="pf-c-form__group pf-m-action">
+        <button class="pf-c-button pf-m-primary pf-m-block" type="submit">{% trans 'Continue' %}</button>
+    </div>
+</form>
+{% endblock %}
diff --git a/passbook/providers/saml/templates/providers/saml/consent.html b/passbook/providers/saml/templates/providers/saml/consent.html
new file mode 100644
index 000000000..f998f7119
--- /dev/null
+++ b/passbook/providers/saml/templates/providers/saml/consent.html
@@ -0,0 +1,14 @@
+{% extends 'login/form_with_user.html' %}
+
+{% load i18n %}
+
+{% block beneath_form %}
+<div class="pf-c-form__group">
+    <p>
+        {% blocktrans with name=context.application.name %}
+        You're about to sign into {{ name }}.
+        {% endblocktrans %}
+    </p>
+    {{ hidden_inputs }}
+</div>
+{% endblock %}
diff --git a/passbook/providers/saml/templates/saml/idp/logged_out.html b/passbook/providers/saml/templates/providers/saml/logged_out.html
similarity index 100%
rename from passbook/providers/saml/templates/saml/idp/logged_out.html
rename to passbook/providers/saml/templates/providers/saml/logged_out.html
diff --git a/passbook/providers/saml/templates/providers/saml/property_mapping_form.html b/passbook/providers/saml/templates/providers/saml/property_mapping_form.html
new file mode 100644
index 000000000..4bd3085af
--- /dev/null
+++ b/passbook/providers/saml/templates/providers/saml/property_mapping_form.html
@@ -0,0 +1,14 @@
+{% extends "generic/form.html" %}
+
+{% load i18n %}
+
+{% block beneath_form %}
+<div class="pf-c-form__group ">
+    <label for="" class="pf-c-form__label"></label>
+    <div class="c-form__horizontal-group">
+        <p>
+            Expression using Python. See <a href="https://passbook.beryju.org/property-mappings/expression/">here</a> for a list of all variables.
+        </p>
+    </div>
+</div>
+{% endblock %}
diff --git a/passbook/providers/saml/templates/saml/xml/assertions/generic.xml b/passbook/providers/saml/templates/providers/saml/xml/assertions/generic.xml
similarity index 94%
rename from passbook/providers/saml/templates/saml/xml/assertions/generic.xml
rename to passbook/providers/saml/templates/providers/saml/xml/assertions/generic.xml
index 1976b936c..c44402aa6 100644
--- a/passbook/providers/saml/templates/saml/xml/assertions/generic.xml
+++ b/passbook/providers/saml/templates/providers/saml/xml/assertions/generic.xml
@@ -3,7 +3,7 @@
         IssueInstant="{{ ISSUE_INSTANT }}"
         Version="2.0">
     <saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">{{ ISSUER }}</saml:Issuer>
-    {% include 'saml/xml/signature.xml' %}
+    {% include 'providers/saml/xml/signature.xml' %}
     {{ SUBJECT_STATEMENT }}
     <saml:Conditions NotBefore="{{ NOT_BEFORE }}" NotOnOrAfter="{{ NOT_ON_OR_AFTER }}">
       <saml:AudienceRestriction>
diff --git a/passbook/providers/saml/templates/saml/xml/assertions/google_apps.xml b/passbook/providers/saml/templates/providers/saml/xml/assertions/google_apps.xml
similarity index 85%
rename from passbook/providers/saml/templates/saml/xml/assertions/google_apps.xml
rename to passbook/providers/saml/templates/providers/saml/xml/assertions/google_apps.xml
index b4d262b45..8072b9ee4 100644
--- a/passbook/providers/saml/templates/saml/xml/assertions/google_apps.xml
+++ b/passbook/providers/saml/templates/providers/saml/xml/assertions/google_apps.xml
@@ -3,8 +3,8 @@
         IssueInstant="{{ ISSUE_INSTANT }}"
         Version="2.0">
     <saml:Issuer>{{ ISSUER }}</saml:Issuer>
-    {% include 'saml/xml/signature.xml' %}
-    {% include 'saml/xml/subject.xml' %}
+    {% include 'providers/saml/xml/signature.xml' %}
+    {% include 'providers/saml/xml/subject.xml' %}
     <saml:Conditions NotBefore="{{ NOT_BEFORE }}" NotOnOrAfter="{{ NOT_ON_OR_AFTER }}" />
     <saml:AuthnStatement AuthnInstant="{{ AUTH_INSTANT }}">
         <saml:AuthnContext>
diff --git a/passbook/providers/saml/templates/saml/xml/assertions/salesforce.xml b/passbook/providers/saml/templates/providers/saml/xml/assertions/salesforce.xml
similarity index 94%
rename from passbook/providers/saml/templates/saml/xml/assertions/salesforce.xml
rename to passbook/providers/saml/templates/providers/saml/xml/assertions/salesforce.xml
index 7451553a0..8887714f2 100644
--- a/passbook/providers/saml/templates/saml/xml/assertions/salesforce.xml
+++ b/passbook/providers/saml/templates/providers/saml/xml/assertions/salesforce.xml
@@ -4,7 +4,7 @@
         Version="2.0">
     <saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">{{ ISSUER }}</saml:Issuer>
     {{ ASSERTION_SIGNATURE|safe }}
-    {% include 'saml/xml/subject.xml' %}
+    {% include 'providers/saml/xml/subject.xml' %}
     <saml:Conditions NotBefore="{{ NOT_BEFORE }}" NotOnOrAfter="{{ NOT_ON_OR_AFTER }}">
         <saml:AudienceRestriction>
             <saml:Audience>{{ AUDIENCE }}</saml:Audience>
diff --git a/passbook/providers/saml/templates/saml/xml/attributes.xml b/passbook/providers/saml/templates/providers/saml/xml/attributes.xml
similarity index 100%
rename from passbook/providers/saml/templates/saml/xml/attributes.xml
rename to passbook/providers/saml/templates/providers/saml/xml/attributes.xml
diff --git a/passbook/providers/saml/templates/saml/xml/metadata.xml b/passbook/providers/saml/templates/providers/saml/xml/metadata.xml
similarity index 77%
rename from passbook/providers/saml/templates/saml/xml/metadata.xml
rename to passbook/providers/saml/templates/providers/saml/xml/metadata.xml
index 8bf514f4c..3f480bb1e 100644
--- a/passbook/providers/saml/templates/saml/xml/metadata.xml
+++ b/passbook/providers/saml/templates/providers/saml/xml/metadata.xml
@@ -11,8 +11,7 @@
     </md:KeyDescriptor>
     {% endif %}
     <md:NameIDFormat>{{ subject_format }}</md:NameIDFormat>
-    <md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="{{ slo_url }}"/>
-    <md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="{{ sso_post_url }}"/>
-    <md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="{{ sso_redirect_url }}"/>
+    <md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="{{ saml_sso_binding_post }}"/>
+    <md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="{{ saml_sso_binding_redirect }}"/>
   </md:IDPSSODescriptor>
 </md:EntityDescriptor>
diff --git a/passbook/providers/saml/templates/saml/xml/response.xml b/passbook/providers/saml/templates/providers/saml/xml/response.xml
similarity index 100%
rename from passbook/providers/saml/templates/saml/xml/response.xml
rename to passbook/providers/saml/templates/providers/saml/xml/response.xml
diff --git a/passbook/providers/saml/templates/saml/xml/signature.xml b/passbook/providers/saml/templates/providers/saml/xml/signature.xml
similarity index 100%
rename from passbook/providers/saml/templates/saml/xml/signature.xml
rename to passbook/providers/saml/templates/providers/saml/xml/signature.xml
diff --git a/passbook/providers/saml/templates/saml/xml/subject.xml b/passbook/providers/saml/templates/providers/saml/xml/subject.xml
similarity index 100%
rename from passbook/providers/saml/templates/saml/xml/subject.xml
rename to passbook/providers/saml/templates/providers/saml/xml/subject.xml
diff --git a/passbook/providers/saml/templates/saml/idp/autosubmit_form.html b/passbook/providers/saml/templates/saml/idp/autosubmit_form.html
deleted file mode 100644
index dff5c2dba..000000000
--- a/passbook/providers/saml/templates/saml/idp/autosubmit_form.html
+++ /dev/null
@@ -1,33 +0,0 @@
-{% extends "login/base.html" %}
-
-{% load passbook_utils %}
-{% load i18n %}
-
-{% block card_title %}
-{% trans 'Redirecting...' %}
-{% endblock %}
-
-{% block card %}
-<form method="POST" action="{{ url }}">
-    {% csrf_token %}
-    {% for key, value in attrs.items %}
-    <input type="hidden" name="{{ key }}" value="{{ value }}">
-    {% endfor %}
-    <div class="login-group">
-        <p>
-            {% blocktrans with user=user %}
-            You are logged in as {{ user }}.
-            {% endblocktrans %}
-            <a href="{% url 'passbook_flows:default-invalidation' %}">{% trans 'Not you?' %}</a>
-        </p>
-        <input class="btn btn-primary btn-block btn-lg" type="submit" value="{% trans 'Continue' %}" />
-    </div>
-</form>
-{% endblock %}
-
-{% block scripts %}
-{{ block.super }}
-<script>
-document.querySelector("form").submit();
-</script>
-{% endblock %}
diff --git a/passbook/providers/saml/templates/saml/idp/login.html b/passbook/providers/saml/templates/saml/idp/login.html
deleted file mode 100644
index 241b40e20..000000000
--- a/passbook/providers/saml/templates/saml/idp/login.html
+++ /dev/null
@@ -1,26 +0,0 @@
-{% extends "login/base.html" %}
-
-{% load passbook_utils %}
-{% load i18n %}
-
-{% block card %}
-<form method="POST" class="pf-c-form">
-    {% csrf_token %}
-    <div class="pf-c-form__group">
-        <h3>
-            {% blocktrans with provider=provider.application.name %}
-            You're about to sign into {{ provider }}
-            {% endblocktrans %}
-        </h3>
-        <p>
-            {% blocktrans with user=user %}
-            You are logged in as {{ user }}.
-            {% endblocktrans %}
-            <a href="{% url 'passbook_flows:default-invalidation' %}">{% trans 'Not you?' %}</a>
-        </p>
-    </div>
-    <div class="pf-c-form__group pf-m-action">
-        <input class="pf-c-button pf-m-primary pf-m-block" type="submit" value="{% trans 'Continue' %}" />
-    </div>
-</form>
-{% endblock %}
diff --git a/passbook/providers/saml/templates/saml/idp/property_mapping_form.html b/passbook/providers/saml/templates/saml/idp/property_mapping_form.html
deleted file mode 100644
index 7b5d3f36e..000000000
--- a/passbook/providers/saml/templates/saml/idp/property_mapping_form.html
+++ /dev/null
@@ -1,19 +0,0 @@
-{% extends "generic/form.html" %}
-
-{% load i18n %}
-
-{% block beneath_form %}
-<div class="pf-c-form__group ">
-    <label for="" class="pf-c-form__label"></label>
-    <div class="c-form__horizontal-group">
-        <p>
-            Expression using <a href="https://jinja.palletsprojects.com/en/2.11.x/templates/">Jinja</a>. Following variables are available:
-            <ul class="pf-c-list">
-                <li><code>user</code>: Passbook User Object (<a href="https://beryju.github.io/passbook/reference/property-mappings/user-object/">Reference</a>)</li>
-                <li><code>request</code>: Django HTTP Request Object (<a href="https://docs.djangoproject.com/en/3.0/ref/request-response/#httprequest-objects">Reference</a>) </li>
-                <li><code>provider</code>: Passbook SAML Provider Object (<a href="https://github.com/BeryJu/passbook/blob/master/passbook/providers/saml/models.py#L16">Reference</a>) </li>
-            </ul>
-        </p>
-    </div>
-</div>
-{% endblock %}
diff --git a/passbook/providers/saml/urls.py b/passbook/providers/saml/urls.py
index 5fe3b87dc..0a3edb654 100644
--- a/passbook/providers/saml/urls.py
+++ b/passbook/providers/saml/urls.py
@@ -4,31 +4,26 @@ from django.urls import path
 from passbook.providers.saml import views
 
 urlpatterns = [
-    # This view is used to initiate a Login-flow from the IDP
+    # SSO Bindings
     path(
-        "<slug:application>/login/initiate/",
-        views.InitiateLoginView.as_view(),
-        name="saml-login-initiate",
-    ),
-    # This view is the endpoint a SP would redirect to, and saves data into the session
-    # this is required as the process view which it redirects to might have to login first.
-    path(
-        "<slug:application>/login/", views.LoginBeginView.as_view(), name="saml-login"
+        "<slug:application_slug>/sso/binding/redirect/",
+        views.SAMLSSOBindingRedirectView.as_view(),
+        name="sso-redirect",
     ),
     path(
-        "<slug:application>/login/authorize/",
-        views.AuthorizeView.as_view(),
-        name="saml-login-authorize",
+        "<slug:application_slug>/sso/binding/post/",
+        views.SAMLSSOBindingPOSTView.as_view(),
+        name="sso-post",
     ),
-    path("<slug:application>/logout/", views.LogoutView.as_view(), name="saml-logout"),
+    # SSO IdP Initiated
     path(
-        "<slug:application>/logout/slo/",
-        views.SLOLogout.as_view(),
-        name="saml-logout-slo",
+        "<slug:application_slug>/sso/binding/init/",
+        views.SAMLSSOBindingInitView.as_view(),
+        name="sso-init",
     ),
     path(
-        "<slug:application>/metadata/",
+        "<slug:application_slug>/metadata/",
         views.DescriptorDownloadView.as_view(),
-        name="saml-metadata",
+        name="metadata",
     ),
 ]
diff --git a/passbook/providers/saml/utils/encoding.py b/passbook/providers/saml/utils/encoding.py
index 9aac5246a..3445024b4 100644
--- a/passbook/providers/saml/utils/encoding.py
+++ b/passbook/providers/saml/utils/encoding.py
@@ -20,5 +20,5 @@ def deflate_and_base64_encode(inflated: bytes, encoding="utf-8"):
 
 
 def nice64(src):
-    """ Returns src base64-encoded and formatted nicely for our XML. """
+    """Returns src base64-encoded and formatted nicely for our XML. """
     return base64.b64encode(src).decode("utf-8").replace("\n", "")
diff --git a/passbook/providers/saml/utils/xml_render.py b/passbook/providers/saml/utils/xml_render.py
index d740f9ac8..55a2dfb16 100644
--- a/passbook/providers/saml/utils/xml_render.py
+++ b/passbook/providers/saml/utils/xml_render.py
@@ -28,7 +28,7 @@ def _get_attribute_statement(params):
         return
     # Build complete AttributeStatement.
     params["ATTRIBUTE_STATEMENT"] = render_to_string(
-        "saml/xml/attributes.xml", {"attributes": attributes}
+        "providers/saml/xml/attributes.xml", {"attributes": attributes}
     )
 
 
@@ -48,7 +48,9 @@ def _get_in_response_to(params):
 
 def _get_subject(params):
     """Insert Subject. Modifies the params dict."""
-    params["SUBJECT_STATEMENT"] = render_to_string("saml/xml/subject.xml", params)
+    params["SUBJECT_STATEMENT"] = render_to_string(
+        "providers/saml/xml/subject.xml", params
+    )
 
 
 def get_assertion_xml(template, parameters, signed=False):
@@ -80,7 +82,7 @@ def get_response_xml(parameters, saml_provider: SAMLProvider, assertion_id=""):
     params["RESPONSE_SIGNATURE"] = ""
     _get_in_response_to(params)
 
-    raw_response = render_to_string("saml/xml/response.xml", params)
+    raw_response = render_to_string("providers/saml/xml/response.xml", params)
 
     if not saml_provider.signing_kp:
         return raw_response
diff --git a/passbook/providers/saml/utils/xml_signing.py b/passbook/providers/saml/utils/xml_signing.py
index 215b29830..ba9c0a1f4 100644
--- a/passbook/providers/saml/utils/xml_signing.py
+++ b/passbook/providers/saml/utils/xml_signing.py
@@ -35,4 +35,4 @@ def sign_with_signxml(data: str, provider: "SAMLProvider", reference_uri=None) -
 
 def get_signature_xml() -> str:
     """Returns XML Signature for subject."""
-    return render_to_string("saml/xml/signature.xml", {})
+    return render_to_string("providers/saml/xml/signature.xml", {})
diff --git a/passbook/providers/saml/views.py b/passbook/providers/saml/views.py
index 555b8e7a9..f2c55d0f6 100644
--- a/passbook/providers/saml/views.py
+++ b/passbook/providers/saml/views.py
@@ -1,16 +1,12 @@
 """passbook SAML IDP Views"""
 from typing import Optional
 
-from django.contrib.auth import logout
-from django.contrib.auth.mixins import AccessMixin
-from django.core.exceptions import ValidationError
+from django.contrib.auth.mixins import LoginRequiredMixin
 from django.core.validators import URLValidator
 from django.http import HttpRequest, HttpResponse
 from django.shortcuts import get_object_or_404, redirect, render, reverse
-from django.utils.datastructures import MultiValueDictKeyError
 from django.utils.decorators import method_decorator
-from django.utils.html import mark_safe
-from django.utils.translation import gettext as _
+from django.utils.http import urlencode
 from django.views import View
 from django.views.decorators.csrf import csrf_exempt
 from signxml.util import strip_pem_header
@@ -18,12 +14,22 @@ from structlog import get_logger
 
 from passbook.audit.models import Event, EventAction
 from passbook.core.models import Application, Provider
+from passbook.flows.models import in_memory_stage
+from passbook.flows.planner import (
+    PLAN_CONTEXT_APPLICATION,
+    PLAN_CONTEXT_SSO,
+    FlowPlanner,
+)
+from passbook.flows.stage import StageView
+from passbook.flows.views import SESSION_KEY_PLAN
 from passbook.lib.utils.template import render_to_string
+from passbook.lib.utils.urls import redirect_with_qs
 from passbook.lib.views import bad_request_message
-from passbook.policies.engine import PolicyEngine
+from passbook.policies.mixins import PolicyAccessMixin
 from passbook.providers.saml.exceptions import CannotHandleAssertion
-from passbook.providers.saml.models import SAMLProvider
+from passbook.providers.saml.models import SAMLBindings, SAMLProvider
 from passbook.providers.saml.processors.types import SAMLResponseParams
+from passbook.stages.consent.stage import PLAN_CONTEXT_CONSENT_TEMPLATE
 
 LOGGER = get_logger()
 URL_VALIDATOR = URLValidator(schemes=("http", "https"))
@@ -33,69 +39,67 @@ SESSION_KEY_RELAY_STATE = "RelayState"
 SESSION_KEY_PARAMS = "SAMLParams"
 
 
-class AccessRequiredView(AccessMixin, View):
-    """Mixin class for Views using a provider instance"""
+class SAMLSSOView(LoginRequiredMixin, PolicyAccessMixin, View):
+    """"SAML SSO Base View, which plans a flow and injects our final stage.
+    Calls get/post handler."""
 
-    _provider: Optional[SAMLProvider] = None
+    application: Application
+    provider: SAMLProvider
 
-    @property
-    def provider(self) -> SAMLProvider:
-        """Get provider instance"""
-        if not self._provider:
-            application = get_object_or_404(
-                Application, slug=self.kwargs["application"]
-            )
-            provider: SAMLProvider = get_object_or_404(
-                SAMLProvider, pk=application.provider_id
-            )
-            self._provider = provider
-            return self._provider
-        return self._provider
-
-    def _has_access(self) -> bool:
-        """Check if user has access to application"""
-        policy_engine = PolicyEngine(
-            self.provider.application.policies.all(), self.request.user, self.request
+    def dispatch(
+        self, request: HttpRequest, *args, application_slug: str, **kwargs
+    ) -> HttpResponse:
+        self.application = get_object_or_404(Application, slug=application_slug)
+        self.provider: SAMLProvider = get_object_or_404(
+            SAMLProvider, pk=self.application.provider_id
         )
-        policy_engine.build()
-        passing = policy_engine.passing
-        LOGGER.debug(
-            "saml_has_access",
-            user=self.request.user,
-            app=self.provider.application,
-            passing=passing,
-        )
-        return passing
-
-    def dispatch(self, request: HttpRequest, *args, **kwargs) -> HttpResponse:
         if not request.user.is_authenticated:
             return self.handle_no_permission()
-        if not self._has_access():
-            return render(
-                request,
-                "login/denied.html",
-                {"title": _("You don't have access to this application")},
-            )
-        return super().dispatch(request, *args, **kwargs)
+        if not self.user_has_access(self.application).passing:
+            return self.handle_no_permission_authorized()
+        # Call the method handler, which checks the SAML Request
+        method_response = super().dispatch(request, *args, application_slug, **kwargs)
+        if method_response:
+            return method_response
+        # Regardless, we start the planner and return to it
+        planner = FlowPlanner(self.provider.authorization_flow)
+        planner.allow_empty_flows = True
+        plan = planner.plan(
+            self.request,
+            {
+                PLAN_CONTEXT_SSO: True,
+                PLAN_CONTEXT_APPLICATION: self.application,
+                PLAN_CONTEXT_CONSENT_TEMPLATE: "providers/saml/consent.html",
+            },
+        )
+        plan.append(in_memory_stage(SAMLFlowFinalView))
+        self.request.session[SESSION_KEY_PLAN] = plan
+        return redirect_with_qs(
+            "passbook_flows:flow-executor-shell",
+            self.request.GET,
+            flow_slug=self.provider.authorization_flow.slug,
+        )
 
 
-class LoginBeginView(AccessRequiredView):
-    """Receives a SAML 2.0 AuthnRequest from a Service Provider and
-    stores it in the session prior to enforcing login."""
+class SAMLSSOBindingRedirectView(SAMLSSOView):
+    """SAML Handler for SSO/Redirect bindings, which are sent via GET"""
 
-    def handler(self, source, application: str) -> HttpResponse:
-        """Handle SAML Request whether its a POST or a Redirect binding"""
+    # pylint: disable=unused-argument
+    def get(  # lgtm [py/similar-function]
+        self, request: HttpRequest, application_slug: str
+    ) -> Optional[HttpResponse]:
+        """Handle REDIRECT bindings"""
         # Store these values now, because Django's login cycle won't preserve them.
-        try:
-            self.request.session[SESSION_KEY_SAML_REQUEST] = source[
-                SESSION_KEY_SAML_REQUEST
-            ]
-        except (KeyError, MultiValueDictKeyError):
+        if SESSION_KEY_SAML_REQUEST not in request.GET:
+            LOGGER.info("handle_saml_request: SAML payload missing")
             return bad_request_message(
                 self.request, "The SAML request payload is missing."
             )
 
-        self.request.session[SESSION_KEY_RELAY_STATE] = source.get(
+        self.request.session[SESSION_KEY_SAML_REQUEST] = request.GET[
+            SESSION_KEY_SAML_REQUEST
+        ]
+        self.request.session[SESSION_KEY_RELAY_STATE] = request.GET.get(
             SESSION_KEY_RELAY_STATE, ""
         )
 
@@ -105,195 +109,149 @@ class LoginBeginView(AccessRequiredView):
             self.request.session[SESSION_KEY_PARAMS] = params
         except CannotHandleAssertion as exc:
             LOGGER.info(exc)
-            did_you_mean_link = self.request.build_absolute_uri(
-                reverse(
-                    "passbook_providers_saml:saml-login-initiate",
-                    kwargs={"application": application},
-                )
-            )
-            did_you_mean_message = (
-                f" Did you mean to go <a href='{did_you_mean_link}'>here</a>?"
-            )
-            return bad_request_message(
-                self.request, mark_safe(str(exc) + did_you_mean_message)
-            )
-
-        return redirect(
-            reverse(
-                "passbook_providers_saml:saml-login-authorize",
-                kwargs={"application": application},
-            )
-        )
-
-    @method_decorator(csrf_exempt)
-    def dispatch(self, *args, **kwargs):
-        return super().dispatch(*args, **kwargs)
-
-    @method_decorator(csrf_exempt)
-    def get(self, request: HttpRequest, application: str) -> HttpResponse:
-        """Handle REDIRECT bindings"""
-        return self.handler(request.GET, application)
-
-    @method_decorator(csrf_exempt)
-    def post(self, request: HttpRequest, application: str) -> HttpResponse:
-        """Handle POST Bindings"""
-        return self.handler(request.POST, application)
+            return bad_request_message(self.request, str(exc))
+        return None
 
 
-class InitiateLoginView(AccessRequiredView):
-    """IdP-initiated Login"""
-
-    def get(self, request: HttpRequest, application: str) -> HttpResponse:
-        """Initiates an IdP-initiated link to a simple SP resource/target URL."""
-        self.provider.processor.is_idp_initiated = True
-        self.provider.processor.init_deep_link(request)
-        params = self.provider.processor.generate_response()
-        request.session[SESSION_KEY_PARAMS] = params
-        return redirect(
-            reverse(
-                "passbook_providers_saml:saml-login-authorize",
-                kwargs={"application": application},
-            )
-        )
-
-
-class AuthorizeView(AccessRequiredView):
-    """Ask the user for authorization to continue to the SP.
-    Presents a SAML 2.0 Assertion for POSTing back to the Service Provider."""
-
-    def get(self, request: HttpRequest, application: str) -> HttpResponse:
-        """Handle get request, i.e. render form"""
-        # User access gets checked in dispatch
-
-        # Otherwise we generate the IdP initiated session
-        try:
-            # application.skip_authorization is set so we directly redirect the user
-            if self.provider.application.skip_authorization:
-                LOGGER.debug("skipping authz", application=self.provider.application)
-                return self.post(request, application)
-
-            return render(
-                request,
-                "saml/idp/login.html",
-                {"provider": self.provider, "title": "Authorize Application"},
-            )
-
-        except KeyError:
-            return bad_request_message(request, "Missing SAML Payload")
+@method_decorator(csrf_exempt, name="dispatch")
+class SAMLSSOBindingPOSTView(SAMLSSOView):
+    """SAML Handler for SSO/POST bindings"""
 
     # pylint: disable=unused-argument
-    def post(self, request: HttpRequest, application: str) -> HttpResponse:
-        """Handle post request, return back to ACS"""
-        # User access gets checked in dispatch
+    def post(
+        self, request: HttpRequest, application_slug: str
+    ) -> Optional[HttpResponse]:
+        """Handle POST bindings"""
+        # Store these values now, because Django's login cycle won't preserve them.
+        if SESSION_KEY_SAML_REQUEST not in request.POST:
+            LOGGER.info("handle_saml_request: SAML payload missing")
+            return bad_request_message(
+                self.request, "The SAML request payload is missing."
+            )
 
-        # we get here when skip_authorization is True, and after the user accepted
-        # the authorization form
+        self.request.session[SESSION_KEY_SAML_REQUEST] = request.POST[
+            SESSION_KEY_SAML_REQUEST
+        ]
+        self.request.session[SESSION_KEY_RELAY_STATE] = request.POST.get(
+            SESSION_KEY_RELAY_STATE, ""
+        )
+
+        try:
+            self.provider.processor.can_handle(self.request)
+            params = self.provider.processor.generate_response()
+            self.request.session[SESSION_KEY_PARAMS] = params
+        except CannotHandleAssertion as exc:
+            LOGGER.info(exc)
+            return bad_request_message(self.request, str(exc))
+        return None
+
+
+class SAMLSSOBindingInitView(SAMLSSOView):
+    """SAML Handler for for IdP Initiated login flows"""
+
+    # pylint: disable=unused-argument
+    def get(
+        self, request: HttpRequest, application_slug: str
+    ) -> Optional[HttpResponse]:
+        """Create saml params from scratch"""
+        LOGGER.debug(
+            "handle_saml_no_request: No SAML Request, using IdP-initiated flow."
+        )
+        self.provider.processor.is_idp_initiated = True
+        self.provider.processor.init_deep_link(self.request)
+        params = self.provider.processor.generate_response()
+        self.request.session[SESSION_KEY_PARAMS] = params
+
+
+# This View doesn't have a URL on purpose, as its called by the FlowExecutor
+class SAMLFlowFinalView(StageView):
+    """View used by FlowExecutor after all stages have passed. Logs the authorization,
+    and redirects to the SP (if REDIRECT is configured) or shows and auto-submit for
+    (if POST is configured)."""
+
+    def get(self, request: HttpRequest, *args, **kwargs) -> HttpResponse:
+        application: Application = self.executor.plan.context[PLAN_CONTEXT_APPLICATION]
+        provider: SAMLProvider = get_object_or_404(
+            SAMLProvider, pk=application.provider_id
+        )
         # Log Application Authorization
         Event.new(
             EventAction.AUTHORIZE_APPLICATION,
-            authorized_application=self.provider.application,
-            skipped_authorization=self.provider.application.skip_authorization,
+            authorized_application=application,
+            flow=self.executor.plan.flow_pk,
         ).from_http(self.request)
         self.request.session.pop(SESSION_KEY_SAML_REQUEST, None)
         self.request.session.pop(SESSION_KEY_SAML_RESPONSE, None)
         self.request.session.pop(SESSION_KEY_RELAY_STATE, None)
+        if SESSION_KEY_PARAMS not in self.request.session:
+            return self.executor.stage_invalid()
         response: SAMLResponseParams = self.request.session.pop(SESSION_KEY_PARAMS)
-        return render(
-            self.request,
-            "saml/idp/autosubmit_form.html",
-            {
-                "url": response.acs_url,
-                "attrs": {
-                    "ACSUrl": response.acs_url,
+
+        if provider.sp_binding == SAMLBindings.POST:
+            return render(
+                self.request,
+                "providers/saml/autosubmit_form.html",
+                {
+                    "url": response.acs_url,
+                    "application": application,
+                    "attrs": {
+                        "ACSUrl": response.acs_url,
+                        SESSION_KEY_SAML_RESPONSE: response.saml_response,
+                        SESSION_KEY_RELAY_STATE: response.relay_state,
+                    },
+                },
+            )
+        if provider.sp_binding == SAMLBindings.REDIRECT:
+            querystring = urlencode(
+                {
                     SESSION_KEY_SAML_RESPONSE: response.saml_response,
                     SESSION_KEY_RELAY_STATE: response.relay_state,
-                },
-            },
-        )
+                }
+            )
+            return redirect(f"{response.acs_url}?{querystring}")
+        return bad_request_message(request, "Invalid sp_binding specified")
 
 
-@method_decorator(csrf_exempt, name="dispatch")
-class LogoutView(AccessRequiredView):
-    """Allows a non-SAML 2.0 URL to log out the user and
-    returns a standard logged-out page. (SalesForce and others use this method,
-    though it's technically not SAML 2.0)."""
-
-    # pylint: disable=unused-argument
-    def get(self, request: HttpRequest, application: str) -> HttpResponse:
-        """Perform logout"""
-        logout(request)
-
-        redirect_url = request.GET.get("redirect_to", "")
-
-        try:
-            URL_VALIDATOR(redirect_url)
-        except ValidationError:
-            pass
-        else:
-            return redirect(redirect_url)
-
-        return render(request, "saml/idp/logged_out.html")
-
-
-@method_decorator(csrf_exempt, name="dispatch")
-class SLOLogout(AccessRequiredView):
-    """Receives a SAML 2.0 LogoutRequest from a Service Provider,
-    logs out the user and returns a standard logged-out page."""
-
-    # pylint: disable=unused-argument
-    def post(self, request: HttpRequest, application: str) -> HttpResponse:
-        """Perform logout"""
-        request.session[SESSION_KEY_SAML_REQUEST] = request.POST[
-            SESSION_KEY_SAML_REQUEST
-        ]
-        # TODO: Parse SAML LogoutRequest from POST data, similar to login_process().
-        # TODO: Modify the base processor to handle logouts?
-        # TODO: Combine this with login_process(), since they are so very similar?
-        # TODO: Format a LogoutResponse and return it to the browser.
-        # XXX: For now, simply log out without validating the request.
-        logout(request)
-        return render(request, "saml/idp/logged_out.html")
-
-
-class DescriptorDownloadView(AccessRequiredView):
+class DescriptorDownloadView(View):
     """Replies with the XML Metadata IDSSODescriptor."""
 
     @staticmethod
     def get_metadata(request: HttpRequest, provider: SAMLProvider) -> str:
         """Return rendered XML Metadata"""
         entity_id = provider.issuer
-        slo_url = request.build_absolute_uri(
+        saml_sso_binding_post = request.build_absolute_uri(
             reverse(
-                "passbook_providers_saml:saml-logout",
-                kwargs={"application": provider.application.slug},
+                "passbook_providers_saml:sso-post",
+                kwargs={"application_slug": provider.application.slug},
             )
         )
-        sso_post_url = request.build_absolute_uri(
+        saml_sso_binding_redirect = request.build_absolute_uri(
             reverse(
-                "passbook_providers_saml:saml-login",
-                kwargs={"application": provider.application.slug},
+                "passbook_providers_saml:sso-redirect",
+                kwargs={"application_slug": provider.application.slug},
             )
         )
         subject_format = provider.processor.subject_format
         ctx = {
+            "saml_sso_binding_post": saml_sso_binding_post,
+            "saml_sso_binding_redirect": saml_sso_binding_redirect,
             "entity_id": entity_id,
-            "slo_url": slo_url,
-            # Currently, the same endpoint accepts POST and REDIRECT
-            "sso_post_url": sso_post_url,
-            "sso_redirect_url": sso_post_url,
             "subject_format": subject_format,
         }
         if provider.signing_kp:
             ctx["cert_public_key"] = strip_pem_header(
                 provider.signing_kp.certificate_data.replace("\r", "")
             ).replace("\n", "")
-        return render_to_string("saml/xml/metadata.xml", ctx)
+        return render_to_string("providers/saml/xml/metadata.xml", ctx)
 
-    # pylint: disable=unused-argument
-    def get(self, request: HttpRequest, application: str) -> HttpResponse:
+    def get(self, request: HttpRequest, application_slug: str) -> HttpResponse:
         """Replies with the XML Metadata IDSSODescriptor."""
+        application = get_object_or_404(Application, slug=application_slug)
+        provider: SAMLProvider = get_object_or_404(
+            SAMLProvider, pk=application.provider_id
+        )
         try:
-            metadata = DescriptorDownloadView.get_metadata(request, self.provider)
+            metadata = DescriptorDownloadView.get_metadata(request, provider)
         except Provider.application.RelatedObjectDoesNotExist:  # pylint: disable=no-member
             return bad_request_message(
                 request, "Provider is not assigned to an application."
@@ -302,5 +260,5 @@ class DescriptorDownloadView(AccessRequiredView):
             response = HttpResponse(metadata, content_type="application/xml")
             response[
                 "Content-Disposition"
-            ] = f'attachment; filename="{self.provider.name}_passbook_meta.xml"'
+            ] = f'attachment; filename="{provider.name}_passbook_meta.xml"'
             return response
diff --git a/passbook/providers/samlv2/apps.py b/passbook/providers/samlv2/apps.py
deleted file mode 100644
index ada8dd6ec..000000000
--- a/passbook/providers/samlv2/apps.py
+++ /dev/null
@@ -1,11 +0,0 @@
-"""passbook saml provider app config"""
-from django.apps import AppConfig
-
-
-class PassbookProviderSAMLv2Config(AppConfig):
-    """passbook samlv2 provider app config"""
-
-    name = "passbook.providers.samlv2"
-    label = "passbook_providers_samlv2"
-    verbose_name = "passbook Providers.SAMLv2"
-    mountpoint = "application/samlv2/"
diff --git a/passbook/providers/samlv2/saml/constants.py b/passbook/providers/samlv2/saml/constants.py
deleted file mode 100644
index 0b657dfe5..000000000
--- a/passbook/providers/samlv2/saml/constants.py
+++ /dev/null
@@ -1,15 +0,0 @@
-"""SAML-related constants"""
-NS_SAML_PROTOCOL = "urn:oasis:names:tc:SAML:2.0:protocol"
-NS_SAML_ASSERTION = "urn:oasis:names:tc:SAML:2.0:assertion"
-NS_SIGNATURE = "http://www.w3.org/2000/09/xmldsig#"
-
-REQ_KEY_REQUEST = "SAMLRequest"
-REQ_KEY_SIGNATURE = "Signature"
-
-SESSION_KEY = "passbook_saml_request"
-
-SAML_ATTRIB_ACS_URL = "AssertionConsumerServiceURL"
-SAML_ATTRIB_DESTINATION = "Destination"
-SAML_ATTRIB_ID = "ID"
-SAML_ATTRIB_ISSUE_INSTANT = "IssueInstant"
-SAML_ATTRIB_PROTOCOL_BINDING = "ProtocolBinding"
diff --git a/passbook/providers/samlv2/saml/parser.py b/passbook/providers/samlv2/saml/parser.py
deleted file mode 100644
index 1ffa04a69..000000000
--- a/passbook/providers/samlv2/saml/parser.py
+++ /dev/null
@@ -1,83 +0,0 @@
-"""SAML Request Parse/builder"""
-from typing import TYPE_CHECKING, Optional
-
-from defusedxml import ElementTree
-from signxml import XMLVerifier
-
-from passbook.crypto.models import CertificateKeyPair
-from passbook.providers.samlv2.saml.constants import (
-    NS_SAML_ASSERTION,
-    NS_SAML_PROTOCOL,
-    SAML_ATTRIB_ACS_URL,
-    SAML_ATTRIB_DESTINATION,
-    SAML_ATTRIB_ID,
-    SAML_ATTRIB_ISSUE_INSTANT,
-    SAML_ATTRIB_PROTOCOL_BINDING,
-)
-from passbook.providers.samlv2.saml.utils import decode_base64_and_inflate
-
-if TYPE_CHECKING:
-    from xml.etree.ElementTree import Element  # nosec
-
-
-# pylint: disable=too-many-instance-attributes
-class SAMLRequest:
-    """SAML Request data class, parse raw base64-encoded data, checks signature and more"""
-
-    _root: "Element"
-
-    acs_url: str
-    destination: str
-    id: str
-    issue_instant: str
-    protocol_binding: str
-
-    issuer: str
-
-    is_signed: bool
-    _detached_signature: str
-
-    def __init__(self):
-        self.acs_url = ""
-        self.destination = ""
-        # pylint: disable=invalid-name
-        self.id = ""
-        self.issue_instant = ""
-        self.protocol_binding = ""
-
-    @staticmethod
-    def parse(raw: str, detached_signature: Optional[str] = None) -> "SAMLRequest":
-        """Prase SAML request from raw string, which can be base64 encoded and deflated.
-        Optionally accepts a detached_signature, as from a REDIRECT request."""
-        decoded_xml = decode_base64_and_inflate(raw)
-        root = ElementTree.fromstring(decoded_xml)
-        req = SAMLRequest()
-        req._root = root  # pylint: disable=protected-access
-        # Verify the root element's tag
-        _expected_tag = f"{{{NS_SAML_PROTOCOL}}}AuthnRequest"
-        if root.tag != _expected_tag:
-            raise ValueError(
-                f"Invalid root tag, got '{root.tag}', expected '{_expected_tag}."
-            )
-        req.acs_url = root.attrib[SAML_ATTRIB_ACS_URL]
-        req.destination = root.attrib[SAML_ATTRIB_DESTINATION]
-        req.id = root.attrib[SAML_ATTRIB_ID]
-        req.issue_instant = root.attrib[SAML_ATTRIB_ISSUE_INSTANT]
-        req.protocol_binding = root.attrib[SAML_ATTRIB_PROTOCOL_BINDING]
-        req.issuer = root.find(f"{{{NS_SAML_ASSERTION}}}Issuer").text
-        # Check if this Request is signed
-        if detached_signature:
-            # pylint: disable=protected-access
-            req._detached_signature = detached_signature
-        return req
-
-    def verify_signature(self, keypair: CertificateKeyPair):
-        """Verify signature of SAML Request.
-        Raises `cryptography.exceptions.InvalidSignature` on validaton failure."""
-        verifier = XMLVerifier()
-        if self._detached_signature:
-            verifier.verify(
-                self._detached_signature, x509_cert=keypair.certificate_data
-            )
-        else:
-            verifier.verify(self._root, x509_cert=keypair.certificate_data)
diff --git a/passbook/providers/samlv2/saml/provider.py b/passbook/providers/samlv2/saml/provider.py
deleted file mode 100644
index fef98d4e5..000000000
--- a/passbook/providers/samlv2/saml/provider.py
+++ /dev/null
@@ -1,5 +0,0 @@
-"""SAML Provider logic"""
-
-
-class SAMLProvider:
-    """SAML Provider"""
diff --git a/passbook/providers/samlv2/saml/utils.py b/passbook/providers/samlv2/saml/utils.py
deleted file mode 100644
index 9aac5246a..000000000
--- a/passbook/providers/samlv2/saml/utils.py
+++ /dev/null
@@ -1,24 +0,0 @@
-"""Wrappers to de/encode and de/inflate strings"""
-import base64
-import zlib
-
-
-def decode_base64_and_inflate(encoded: str, encoding="utf-8") -> str:
-    """Base64 decode and ZLib decompress b64string"""
-    decoded_data = base64.b64decode(encoded)
-    try:
-        return zlib.decompress(decoded_data, -15).decode(encoding)
-    except zlib.error:
-        return decoded_data.decode(encoding)
-
-
-def deflate_and_base64_encode(inflated: bytes, encoding="utf-8"):
-    """Base64 and ZLib Compress b64string"""
-    zlibbed_str = zlib.compress(inflated)
-    compressed_string = zlibbed_str[2:-4]
-    return base64.b64encode(compressed_string).decode(encoding)
-
-
-def nice64(src):
-    """ Returns src base64-encoded and formatted nicely for our XML. """
-    return base64.b64encode(src).decode("utf-8").replace("\n", "")
diff --git a/passbook/providers/samlv2/urls.py b/passbook/providers/samlv2/urls.py
deleted file mode 100644
index 2bd987d70..000000000
--- a/passbook/providers/samlv2/urls.py
+++ /dev/null
@@ -1,35 +0,0 @@
-"""passbook samlv2 URLs"""
-from django.urls import path
-
-from passbook.providers.samlv2.views import authorize, idp_initiated, slo, sso
-
-urlpatterns = [
-    path(
-        "<slug:app_slug>/authorize/",
-        authorize.AuthorizeView.as_view(),
-        name="authorize",
-    ),
-    path(
-        "<slug:app_slug>/sso/redirect/",
-        sso.SAMLRedirectBindingView.as_view(),
-        name="sso-redirect",
-    ),
-    path(
-        "<slug:app_slug>/sso/post/", sso.SAMLPostBindingView.as_view(), name="sso-post",
-    ),
-    path(
-        "<slug:app_slug>/slo/redirect/",
-        slo.SAMLRedirectBindingView.as_view(),
-        name="slo-redirect",
-    ),
-    path(
-        "<slug:app_slug>/slo/redirect/",
-        slo.SAMLPostBindingView.as_view(),
-        name="slo-post",
-    ),
-    path(
-        "<slug:app_slug>/initiate/",
-        idp_initiated.IDPInitiatedView.as_view(),
-        name="initiate",
-    ),
-]
diff --git a/passbook/providers/samlv2/views/authorize.py b/passbook/providers/samlv2/views/authorize.py
deleted file mode 100644
index 9b000d00b..000000000
--- a/passbook/providers/samlv2/views/authorize.py
+++ /dev/null
@@ -1,6 +0,0 @@
-"""SAML Provider authorization view"""
-from django.views.generic import FormView
-
-
-class AuthorizeView(FormView):
-    """Authorization view"""
diff --git a/passbook/providers/samlv2/views/base.py b/passbook/providers/samlv2/views/base.py
deleted file mode 100644
index 6bea319bc..000000000
--- a/passbook/providers/samlv2/views/base.py
+++ /dev/null
@@ -1,31 +0,0 @@
-"""SAML base views"""
-from typing import Optional
-
-from django.http import HttpRequest, HttpResponse
-from django.shortcuts import get_object_or_404
-from django.views import View
-
-from passbook.core.models import Application
-from passbook.core.views.access import AccessMixin
-from passbook.providers.samlv2.saml.constants import SESSION_KEY
-from passbook.providers.samlv2.saml.parser import SAMLRequest
-
-
-class BaseSAMLView(AccessMixin, View):
-    """Base SAML View to resolve app_slug"""
-
-    application: Application
-
-    def setup(self, request: HttpRequest, *args, **kwargs):
-        View.setup(self, request, *args, **kwargs)
-        self.application = self.get_application(self.kwargs.get("app_slug"))
-
-    def get_application(self, app_slug: str) -> Optional[Application]:
-        """Return application or raise 404"""
-        return get_object_or_404(Application, slug=app_slug)
-
-    def handle_saml_request(self, request: SAMLRequest) -> HttpResponse:
-        """Handle SAML Request"""
-        self.request.SESSION[SESSION_KEY] = request
-        if self.application.skip_authorization:
-            pass
diff --git a/passbook/providers/samlv2/views/idp_initiated.py b/passbook/providers/samlv2/views/idp_initiated.py
deleted file mode 100644
index 1568f6eae..000000000
--- a/passbook/providers/samlv2/views/idp_initiated.py
+++ /dev/null
@@ -1,6 +0,0 @@
-"""IDP-Initiated Views"""
-from django.views import View
-
-
-class IDPInitiatedView(View):
-    """IDP-initiated Handler"""
diff --git a/passbook/providers/samlv2/views/slo.py b/passbook/providers/samlv2/views/slo.py
deleted file mode 100644
index f74730db9..000000000
--- a/passbook/providers/samlv2/views/slo.py
+++ /dev/null
@@ -1,10 +0,0 @@
-"""Single Logout Views"""
-from django.views import View
-
-
-class SAMLPostBindingView(View):
-    """Handle SAML POST-type Requests"""
-
-
-class SAMLRedirectBindingView(View):
-    """Handle SAML Redirect-type Requests"""
diff --git a/passbook/providers/samlv2/views/sso.py b/passbook/providers/samlv2/views/sso.py
deleted file mode 100644
index 1c563a881..000000000
--- a/passbook/providers/samlv2/views/sso.py
+++ /dev/null
@@ -1,41 +0,0 @@
-"""Single Signon Views"""
-from django.http import HttpRequest, HttpResponse, HttpResponseBadRequest
-
-from passbook.providers.samlv2.saml.constants import REQ_KEY_REQUEST, REQ_KEY_SIGNATURE
-from passbook.providers.samlv2.saml.parser import SAMLRequest
-from passbook.providers.samlv2.views.base import BaseSAMLView
-
-# SAML Authentication flow in passbook
-# - Parse and Verify SAML Request
-# - Check access to application (this is done after parsing as it might take a few seconds)
-# - Ask for user authorization (if required from Application)
-# - Log Access to audit log
-# - Create response with unique ID to protect against replay
-
-
-class SAMLPostBindingView(BaseSAMLView):
-    """Handle SAML POST-type Requests"""
-
-    # pylint: disable=unused-argument
-    def post(self, request: HttpRequest, app_slug: str) -> HttpResponse:
-        """Handle POST Requests"""
-        if REQ_KEY_REQUEST not in request.POST:
-            return HttpResponseBadRequest()
-        raw_saml_request = request.POST.get(REQ_KEY_REQUEST)
-        detached_signature = request.POST.get(REQ_KEY_SIGNATURE, None)
-        srq = SAMLRequest.parse(raw_saml_request, detached_signature)
-        return self.handle_saml_request(srq)
-
-
-class SAMLRedirectBindingView(BaseSAMLView):
-    """Handle SAML Redirect-type Requests"""
-
-    # pylint: disable=unused-argument
-    def get(self, request: HttpRequest, app_slug: str) -> HttpResponse:
-        """Handle GET Requests"""
-        if REQ_KEY_REQUEST not in request.GET:
-            return HttpResponseBadRequest()
-        raw_saml_request = request.GET.get(REQ_KEY_REQUEST)
-        detached_signature = request.GET.get(REQ_KEY_SIGNATURE, None)
-        srq = SAMLRequest.parse(raw_saml_request, detached_signature)
-        return self.handle_saml_request(srq)
diff --git a/passbook/root/settings.py b/passbook/root/settings.py
index 7b770f62d..ba53846e0 100644
--- a/passbook/root/settings.py
+++ b/passbook/root/settings.py
@@ -86,17 +86,18 @@ INSTALLED_APPS = [
     "passbook.policies.expression.apps.PassbookPolicyExpressionConfig",
     "passbook.policies.hibp.apps.PassbookPolicyHIBPConfig",
     "passbook.policies.password.apps.PassbookPoliciesPasswordConfig",
+    "passbook.policies.group_membership.apps.PassbookPoliciesGroupMembershipConfig",
     "passbook.policies.reputation.apps.PassbookPolicyReputationConfig",
     "passbook.providers.app_gw.apps.PassbookApplicationApplicationGatewayConfig",
     "passbook.providers.oauth.apps.PassbookProviderOAuthConfig",
     "passbook.providers.oidc.apps.PassbookProviderOIDCConfig",
     "passbook.providers.saml.apps.PassbookProviderSAMLConfig",
-    "passbook.providers.samlv2.apps.PassbookProviderSAMLv2Config",
     "passbook.recovery.apps.PassbookRecoveryConfig",
     "passbook.sources.ldap.apps.PassbookSourceLDAPConfig",
     "passbook.sources.oauth.apps.PassbookSourceOAuthConfig",
     "passbook.sources.saml.apps.PassbookSourceSAMLConfig",
     "passbook.stages.captcha.apps.PassbookStageCaptchaConfig",
+    "passbook.stages.consent.apps.PassbookStageConsentConfig",
     "passbook.stages.dummy.apps.PassbookStageDummyConfig",
     "passbook.stages.email.apps.PassbookStageEmailConfig",
     "passbook.stages.prompt.apps.PassbookStagPromptConfig",
@@ -106,7 +107,9 @@ INSTALLED_APPS = [
     "passbook.stages.user_login.apps.PassbookStageUserLoginConfig",
     "passbook.stages.user_logout.apps.PassbookStageUserLogoutConfig",
     "passbook.stages.user_write.apps.PassbookStageUserWriteConfig",
-    "passbook.stages.otp.apps.PassbookStageOTPConfig",
+    "passbook.stages.otp_static.apps.PassbookStageOTPStaticConfig",
+    "passbook.stages.otp_time.apps.PassbookStageOTPTimeConfig",
+    "passbook.stages.otp_validate.apps.PassbookStageOTPValidateConfig",
     "passbook.stages.password.apps.PassbookStagePasswordConfig",
     "passbook.static.apps.PassbookStaticConfig",
 ]
@@ -187,7 +190,7 @@ WSGI_APPLICATION = "passbook.root.wsgi.application"
 
 DATABASES = {
     "default": {
-        "ENGINE": "django_prometheus.db.backends.postgresql",
+        "ENGINE": "django.db.backends.postgresql",
         "HOST": CONFIG.y("postgresql.host"),
         "NAME": CONFIG.y("postgresql.name"),
         "USER": CONFIG.y("postgresql.user"),
@@ -329,13 +332,24 @@ LOGGING = {
     },
     "loggers": {},
 }
+
+TEST = False
+TEST_RUNNER = "xmlrunner.extra.djangotestrunner.XMLTestRunner"
 LOG_LEVEL = CONFIG.y("log_level").upper()
 
+TEST_OUTPUT_FILE_NAME = "unittest.xml"
+
+if len(sys.argv) >= 2 and sys.argv[1] == "test":
+    LOG_LEVEL = "DEBUG"
+    TEST = True
+    CELERY_TASK_ALWAYS_EAGER = True
+
 _LOGGING_HANDLER_MAP = {
     "": LOG_LEVEL,
     "passbook": LOG_LEVEL,
     "django": "WARNING",
     "celery": "WARNING",
+    "selenium": "WARNING",
     "grpc": LOG_LEVEL,
     "oauthlib": LOG_LEVEL,
     "oauth2_provider": LOG_LEVEL,
@@ -349,18 +363,6 @@ for handler_name, level in _LOGGING_HANDLER_MAP.items():
         "propagate": False,
     }
 
-TEST = False
-TEST_RUNNER = "xmlrunner.extra.djangotestrunner.XMLTestRunner"
-TEST_OUTPUT_VERBOSE = 2
-
-TEST_OUTPUT_FILE_NAME = "unittest.xml"
-
-if any("test" in arg for arg in sys.argv):
-    LOGGER.warning("Testing mode enabled, no logging from now on...")
-    LOGGING = None
-    TEST = True
-    CELERY_TASK_ALWAYS_EAGER = True
-
 
 _DISALLOWED_ITEMS = [
     "INSTALLED_APPS",
diff --git a/passbook/sources/ldap/connector.py b/passbook/sources/ldap/connector.py
index 748c25e9e..98d243bc8 100644
--- a/passbook/sources/ldap/connector.py
+++ b/passbook/sources/ldap/connector.py
@@ -164,9 +164,10 @@ class Connector:
                 continue
             mapping: LDAPPropertyMapping
             try:
-                properties[mapping.object_field] = mapping.evaluate(
-                    user=None, request=None, ldap=attributes
-                )
+                value = mapping.evaluate(user=None, request=None, ldap=attributes)
+                if value is None:
+                    continue
+                properties[mapping.object_field] = value
             except PropertyMappingExpressionException as exc:
                 LOGGER.warning("Mapping failed to evaluate", exc=exc, mapping=mapping)
                 continue
diff --git a/passbook/sources/ldap/forms.py b/passbook/sources/ldap/forms.py
index 48d71d48a..187a9d5dd 100644
--- a/passbook/sources/ldap/forms.py
+++ b/passbook/sources/ldap/forms.py
@@ -4,7 +4,9 @@ from django import forms
 from django.contrib.admin.widgets import FilteredSelectMultiple
 from django.utils.translation import gettext_lazy as _
 
+from passbook.admin.fields import CodeMirrorWidget
 from passbook.admin.forms.source import SOURCE_FORM_FIELDS
+from passbook.core.expression import PropertyMappingEvaluator
 from passbook.sources.ldap.models import LDAPPropertyMapping, LDAPSource
 
 
@@ -52,6 +54,13 @@ class LDAPPropertyMappingForm(forms.ModelForm):
 
     template_name = "ldap/property_mapping_form.html"
 
+    def clean_expression(self):
+        """Test Syntax"""
+        expression = self.cleaned_data.get("expression")
+        evaluator = PropertyMappingEvaluator()
+        evaluator.validate(expression)
+        return expression
+
     class Meta:
 
         model = LDAPPropertyMapping
@@ -60,4 +69,8 @@ class LDAPPropertyMappingForm(forms.ModelForm):
             "name": forms.TextInput(),
             "ldap_property": forms.TextInput(),
             "object_field": forms.TextInput(),
+            "expression": CodeMirrorWidget(mode="python"),
+        }
+        help_texts = {
+            "object_field": _("Field of the user object this value is written to.")
         }
diff --git a/passbook/sources/ldap/migrations/0003_default_ldap_property_mappings.py b/passbook/sources/ldap/migrations/0003_default_ldap_property_mappings.py
index 318952211..414ca84ef 100644
--- a/passbook/sources/ldap/migrations/0003_default_ldap_property_mappings.py
+++ b/passbook/sources/ldap/migrations/0003_default_ldap_property_mappings.py
@@ -7,11 +7,11 @@ from django.db import migrations
 def create_default_ad_property_mappings(apps: Apps, schema_editor):
     LDAPPropertyMapping = apps.get_model("passbook_sources_ldap", "LDAPPropertyMapping")
     mapping = {
-        "name": "{{ ldap.name }}",
-        "first_name": "{{ ldap.givenName }}",
-        "last_name": "{{ ldap.sn }}",
-        "username": "{{ ldap.sAMAccountName }}",
-        "email": "{{ ldap.mail }}",
+        "name": "return ldap.get('name')",
+        "first_name": "return ldap.get('givenName')",
+        "last_name": "return ldap.get('sn')",
+        "username": "return ldap.get('sAMAccountName')",
+        "email": "return ldap.get('mail')",
     }
     db_alias = schema_editor.connection.alias
     for object_field, expression in mapping.items():
diff --git a/passbook/sources/ldap/migrations/0004_auto_20200524_1146.py b/passbook/sources/ldap/migrations/0004_auto_20200524_1146.py
new file mode 100644
index 000000000..475398b1b
--- /dev/null
+++ b/passbook/sources/ldap/migrations/0004_auto_20200524_1146.py
@@ -0,0 +1,31 @@
+# Generated by Django 3.0.6 on 2020-05-24 11:46
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("passbook_sources_ldap", "0003_default_ldap_property_mappings"),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name="ldapsource",
+            name="additional_group_dn",
+            field=models.TextField(
+                blank=True,
+                help_text="Prepended to Base DN for Group-queries.",
+                verbose_name="Addition Group DN",
+            ),
+        ),
+        migrations.AlterField(
+            model_name="ldapsource",
+            name="additional_user_dn",
+            field=models.TextField(
+                blank=True,
+                help_text="Prepended to Base DN for User-queries.",
+                verbose_name="Addition User DN",
+            ),
+        ),
+    ]
diff --git a/passbook/sources/ldap/models.py b/passbook/sources/ldap/models.py
index 34fa96e56..0de975870 100644
--- a/passbook/sources/ldap/models.py
+++ b/passbook/sources/ldap/models.py
@@ -10,7 +10,7 @@ from passbook.core.models import Group, PropertyMapping, Source
 
 
 class LDAPSource(Source):
-    """LDAP Authentication source"""
+    """Federate LDAP Directory with passbook, or create new accounts in LDAP."""
 
     server_uri = models.TextField(
         validators=[URLValidator(schemes=["ldap", "ldaps"])],
@@ -55,7 +55,7 @@ class LDAPSource(Source):
 
     form = "passbook.sources.ldap.forms.LDAPSourceForm"
 
-    _connection: Optional[Connection]
+    _connection: Optional[Connection] = None
 
     @property
     def connection(self) -> Connection:
@@ -81,7 +81,7 @@ class LDAPSource(Source):
 
 
 class LDAPPropertyMapping(PropertyMapping):
-    """Map LDAP Property to User or Group object"""
+    """Map LDAP Property to User or Group object attribute"""
 
     object_field = models.TextField()
 
diff --git a/passbook/sources/ldap/templates/ldap/property_mapping_form.html b/passbook/sources/ldap/templates/ldap/property_mapping_form.html
index 63887ba7d..4bd3085af 100644
--- a/passbook/sources/ldap/templates/ldap/property_mapping_form.html
+++ b/passbook/sources/ldap/templates/ldap/property_mapping_form.html
@@ -7,10 +7,7 @@
     <label for="" class="pf-c-form__label"></label>
     <div class="c-form__horizontal-group">
         <p>
-            Expression using <a href="https://jinja.palletsprojects.com/en/2.11.x/templates/">Jinja</a>. Following variables are available:
-            <ul class="pf-c-list">
-                <li><code>ldap</code>: A Dictionary of all values retrieved from LDAP.</li>
-            </ul>
+            Expression using Python. See <a href="https://passbook.beryju.org/property-mappings/expression/">here</a> for a list of all variables.
         </p>
     </div>
 </div>
diff --git a/passbook/sources/oauth/clients.py b/passbook/sources/oauth/clients.py
index 35c58d7ba..0b3cb85f8 100644
--- a/passbook/sources/oauth/clients.py
+++ b/passbook/sources/oauth/clients.py
@@ -94,8 +94,6 @@ class OAuthClient(BaseOAuthClient):
                 "oauth_callback": callback,
                 "token": raw_token,
             }
-            callback = request.build_absolute_uri(callback or request.path)
-            callback = force_text(callback)
             try:
                 response = self.session.request(
                     "post",
diff --git a/passbook/sources/oauth/forms.py b/passbook/sources/oauth/forms.py
index e1e0de903..509ace23d 100644
--- a/passbook/sources/oauth/forms.py
+++ b/passbook/sources/oauth/forms.py
@@ -3,6 +3,7 @@
 from django import forms
 
 from passbook.admin.forms.source import SOURCE_FORM_FIELDS
+from passbook.flows.models import Flow, FlowDesignation
 from passbook.sources.oauth.models import OAuthSource
 from passbook.sources.oauth.types.manager import MANAGER
 
@@ -10,6 +11,13 @@ from passbook.sources.oauth.types.manager import MANAGER
 class OAuthSourceForm(forms.ModelForm):
     """OAuthSource Form"""
 
+    authentication_flow = forms.ModelChoiceField(
+        queryset=Flow.objects.filter(designation=FlowDesignation.AUTHENTICATION)
+    )
+    enrollment_flow = forms.ModelChoiceField(
+        queryset=Flow.objects.filter(designation=FlowDesignation.ENROLLMENT)
+    )
+
     def __init__(self, *args, **kwargs):
         super().__init__(*args, **kwargs)
         if hasattr(self.Meta, "overrides"):
@@ -76,9 +84,9 @@ class FacebookOAuthSourceForm(OAuthSourceForm):
         overrides = {
             "provider_type": "facebook",
             "request_token_url": "",
-            "authorization_url": "https://www.facebook.com/v2.8/dialog/oauth",
-            "access_token_url": "https://graph.facebook.com/v2.8/oauth/access_token",
-            "profile_url": "https://graph.facebook.com/v2.8/me?fields=name,email,short_name",
+            "authorization_url": "https://www.facebook.com/v7.0/dialog/oauth",
+            "access_token_url": "https://graph.facebook.com/v7.0/oauth/access_token",
+            "profile_url": "https://graph.facebook.com/v7.0/me?fields=id,name,email",
         }
 
 
diff --git a/passbook/sources/oauth/models.py b/passbook/sources/oauth/models.py
index 43f2a6280..1012f37dc 100644
--- a/passbook/sources/oauth/models.py
+++ b/passbook/sources/oauth/models.py
@@ -1,4 +1,5 @@
 """OAuth Client models"""
+from typing import Optional
 
 from django.db import models
 from django.urls import reverse, reverse_lazy
@@ -10,7 +11,7 @@ from passbook.sources.oauth.clients import get_client
 
 
 class OAuthSource(Source):
-    """Configuration for OAuth provider."""
+    """Login using a Generic OAuth provider."""
 
     provider_type = models.CharField(max_length=255)
     request_token_url = models.CharField(
@@ -61,16 +62,10 @@ class OAuthSource(Source):
         return f"Callback URL: <pre>{url}</pre>"
 
     @property
-    def ui_user_settings(self) -> UIUserSettings:
-        icon_type = self.provider_type
-        if icon_type == "azure ad":
-            icon_type = "windows"
-        icon_class = f"fab fa-{icon_type}"
+    def ui_user_settings(self) -> Optional[UIUserSettings]:
         view_name = "passbook_sources_oauth:oauth-client-user"
         return UIUserSettings(
-            name=self.name,
-            icon=icon_class,
-            view_name=reverse((view_name), kwargs={"source_slug": self.slug}),
+            name=self.name, url=reverse(view_name, kwargs={"source_slug": self.slug}),
         )
 
     def __str__(self) -> str:
@@ -83,7 +78,7 @@ class OAuthSource(Source):
 
 
 class GitHubOAuthSource(OAuthSource):
-    """Abstract subclass of OAuthSource to specify GitHub Form"""
+    """Social Login using GitHub.com or a GitHub-Enterprise Instance."""
 
     form = "passbook.sources.oauth.forms.GitHubOAuthSourceForm"
 
@@ -95,7 +90,7 @@ class GitHubOAuthSource(OAuthSource):
 
 
 class TwitterOAuthSource(OAuthSource):
-    """Abstract subclass of OAuthSource to specify Twitter Form"""
+    """Social Login using Twitter.com"""
 
     form = "passbook.sources.oauth.forms.TwitterOAuthSourceForm"
 
@@ -107,7 +102,7 @@ class TwitterOAuthSource(OAuthSource):
 
 
 class FacebookOAuthSource(OAuthSource):
-    """Abstract subclass of OAuthSource to specify Facebook Form"""
+    """Social Login using Facebook.com."""
 
     form = "passbook.sources.oauth.forms.FacebookOAuthSourceForm"
 
@@ -119,7 +114,7 @@ class FacebookOAuthSource(OAuthSource):
 
 
 class DiscordOAuthSource(OAuthSource):
-    """Abstract subclass of OAuthSource to specify Discord Form"""
+    """Social Login using Discord."""
 
     form = "passbook.sources.oauth.forms.DiscordOAuthSourceForm"
 
@@ -131,7 +126,7 @@ class DiscordOAuthSource(OAuthSource):
 
 
 class GoogleOAuthSource(OAuthSource):
-    """Abstract subclass of OAuthSource to specify Google Form"""
+    """Social Login using Google or Gsuite."""
 
     form = "passbook.sources.oauth.forms.GoogleOAuthSourceForm"
 
@@ -143,7 +138,7 @@ class GoogleOAuthSource(OAuthSource):
 
 
 class AzureADOAuthSource(OAuthSource):
-    """Abstract subclass of OAuthSource to specify AzureAD Form"""
+    """Social Login using Azure AD."""
 
     form = "passbook.sources.oauth.forms.AzureADOAuthSourceForm"
 
@@ -155,7 +150,7 @@ class AzureADOAuthSource(OAuthSource):
 
 
 class OpenIDOAuthSource(OAuthSource):
-    """Abstract subclass of OAuthSource to specify OpenID Form"""
+    """Login using a Generic OpenID-Connect compliant provider."""
 
     form = "passbook.sources.oauth.forms.OAuthSourceForm"
 
diff --git a/passbook/sources/oauth/tests.py b/passbook/sources/oauth/tests.py
new file mode 100644
index 000000000..1bc83970f
--- /dev/null
+++ b/passbook/sources/oauth/tests.py
@@ -0,0 +1,38 @@
+"""OAuth Source tests"""
+from django.shortcuts import reverse
+from django.test import Client, TestCase
+
+from passbook.sources.oauth.models import OAuthSource
+
+
+class OAuthSourceTests(TestCase):
+    """OAuth Source tests"""
+
+    def setUp(self):
+        self.client = Client()
+        self.source = OAuthSource.objects.create(
+            name="test",
+            slug="test",
+            provider_type="openid-connect",
+            authorization_url="",
+            profile_url="",
+            consumer_key="",
+        )
+
+    def test_source_redirect(self):
+        """test redirect view"""
+        self.client.get(
+            reverse(
+                "passbook_sources_oauth:oauth-client-login",
+                kwargs={"source_slug": self.source.slug},
+            )
+        )
+
+    def test_source_callback(self):
+        """test callback view"""
+        self.client.get(
+            reverse(
+                "passbook_sources_oauth:oauth-client-callback",
+                kwargs={"source_slug": self.source.slug},
+            )
+        )
diff --git a/passbook/sources/oauth/types/azure_ad.py b/passbook/sources/oauth/types/azure_ad.py
index 0ac83f2c6..ce4044435 100644
--- a/passbook/sources/oauth/types/azure_ad.py
+++ b/passbook/sources/oauth/types/azure_ad.py
@@ -1,6 +1,9 @@
 """AzureAD OAuth2 Views"""
 import uuid
+from typing import Any, Dict
 
+from passbook.core.models import User
+from passbook.sources.oauth.models import OAuthSource, UserOAuthSourceConnection
 from passbook.sources.oauth.types.manager import MANAGER, RequestKind
 from passbook.sources.oauth.utils import user_get_or_create
 from passbook.sources.oauth.views.core import OAuthCallback
@@ -10,10 +13,15 @@ from passbook.sources.oauth.views.core import OAuthCallback
 class AzureADOAuthCallback(OAuthCallback):
     """AzureAD OAuth2 Callback"""
 
-    def get_user_id(self, source, info):
-        return uuid.UUID(info.get("objectId")).int
+    def get_user_id(self, source: OAuthSource, info: Dict[str, Any]) -> str:
+        return str(uuid.UUID(info.get("objectId")).int)
 
-    def get_or_create_user(self, source, access, info):
+    def get_or_create_user(
+        self,
+        source: OAuthSource,
+        access: UserOAuthSourceConnection,
+        info: Dict[str, Any],
+    ) -> User:
         user_data = {
             "username": info.get("displayName"),
             "email": info.get("mail", None) or info.get("otherMails")[0],
diff --git a/passbook/sources/oauth/types/facebook.py b/passbook/sources/oauth/types/facebook.py
index 8b20cf3ee..397b4adb0 100644
--- a/passbook/sources/oauth/types/facebook.py
+++ b/passbook/sources/oauth/types/facebook.py
@@ -1,4 +1,9 @@
 """Facebook OAuth Views"""
+from typing import Any, Dict, Optional
+
+from facebook import GraphAPI
+
+from passbook.sources.oauth.clients import OAuth2Client
 from passbook.sources.oauth.types.manager import MANAGER, RequestKind
 from passbook.sources.oauth.utils import user_get_or_create
 from passbook.sources.oauth.views.core import OAuthCallback, OAuthRedirect
@@ -14,10 +19,20 @@ class FacebookOAuthRedirect(OAuthRedirect):
         }
 
 
+class FacebookOAuth2Client(OAuth2Client):
+    """Facebook OAuth2 Client"""
+
+    def get_profile_info(self, token: Dict[str, str]) -> Optional[Dict[str, Any]]:
+        api = GraphAPI(access_token=token["access_token"])
+        return api.get_object("me", fields="id,name,email")
+
+
 @MANAGER.source(kind=RequestKind.callback, name="Facebook")
 class FacebookOAuth2Callback(OAuthCallback):
     """Facebook OAuth2 Callback"""
 
+    client_class = FacebookOAuth2Client
+
     def get_or_create_user(self, source, access, info):
         user_data = {
             "username": info.get("name"),
diff --git a/passbook/sources/oauth/types/manager.py b/passbook/sources/oauth/types/manager.py
index 0900f4d29..3db0b1bde 100644
--- a/passbook/sources/oauth/types/manager.py
+++ b/passbook/sources/oauth/types/manager.py
@@ -54,7 +54,9 @@ class SourceTypeManager:
                 return OAuthCallback
             if kind.value == RequestKind.redirect:
                 return OAuthRedirect
-        raise KeyError
+        raise KeyError(
+            f"Provider Type {source.provider_type} (type {kind.value}) not found."
+        )
 
 
 MANAGER = SourceTypeManager()
diff --git a/passbook/sources/oauth/types/oidc.py b/passbook/sources/oauth/types/oidc.py
index 825460165..639d706c7 100644
--- a/passbook/sources/oauth/types/oidc.py
+++ b/passbook/sources/oauth/types/oidc.py
@@ -21,8 +21,8 @@ class OpenIDConnectOAuthRedirect(OAuthRedirect):
 class OpenIDConnectOAuth2Callback(OAuthCallback):
     """OpenIDConnect OAuth2 Callback"""
 
-    def get_user_id(self, source: OAuthSource, info: Dict[str, str]):
-        return info.get("sub")
+    def get_user_id(self, source: OAuthSource, info: Dict[str, str]) -> str:
+        return info.get("sub", "")
 
     def get_or_create_user(self, source: OAuthSource, access, info: Dict[str, str]):
         user_data = {
diff --git a/passbook/sources/oauth/views/core.py b/passbook/sources/oauth/views/core.py
index 9166ad3b6..604c8abcb 100644
--- a/passbook/sources/oauth/views/core.py
+++ b/passbook/sources/oauth/views/core.py
@@ -1,11 +1,11 @@
 """Core OAauth Views"""
-from typing import Callable, Optional
+from typing import Any, Callable, Dict, Optional
 
 from django.conf import settings
 from django.contrib import messages
 from django.contrib.auth import authenticate
 from django.contrib.auth.mixins import LoginRequiredMixin
-from django.http import Http404
+from django.http import Http404, HttpRequest, HttpResponse
 from django.shortcuts import get_object_or_404, redirect, render
 from django.urls import reverse
 from django.utils.translation import ugettext as _
@@ -13,7 +13,8 @@ from django.views.generic import RedirectView, View
 from structlog import get_logger
 
 from passbook.audit.models import Event, EventAction
-from passbook.flows.models import Flow, FlowDesignation
+from passbook.core.models import User
+from passbook.flows.models import Flow
 from passbook.flows.planner import (
     PLAN_CONTEXT_PENDING_USER,
     PLAN_CONTEXT_SSO,
@@ -49,18 +50,18 @@ class OAuthRedirect(OAuthClientMixin, RedirectView):
     params = None
 
     # pylint: disable=unused-argument
-    def get_additional_parameters(self, source):
+    def get_additional_parameters(self, source: OAuthSource) -> Dict[str, Any]:
         "Return additional redirect parameters for this source."
         return self.params or {}
 
-    def get_callback_url(self, source):
+    def get_callback_url(self, source: OAuthSource) -> str:
         "Return the callback url for this source."
         return reverse(
             "passbook_sources_oauth:oauth-client-callback",
             kwargs={"source_slug": source.slug},
         )
 
-    def get_redirect_url(self, **kwargs):
+    def get_redirect_url(self, **kwargs) -> str:
         "Build redirect url for a given source."
         slug = kwargs.get("source_slug", "")
         try:
@@ -84,7 +85,7 @@ class OAuthCallback(OAuthClientMixin, View):
     source_id = None
     source = None
 
-    def get(self, request, *_, **kwargs):
+    def get(self, request: HttpRequest, *_, **kwargs) -> HttpResponse:
         """View Get handler"""
         slug = kwargs.get("source_slug", "")
         try:
@@ -143,38 +144,38 @@ class OAuthCallback(OAuthClientMixin, View):
             return self.handle_existing_user(self.source, user, connection, info)
 
     # pylint: disable=unused-argument
-    def get_callback_url(self, source):
+    def get_callback_url(self, source: OAuthSource) -> str:
         "Return callback url if different than the current url."
-        return False
+        return ""
 
     # pylint: disable=unused-argument
-    def get_error_redirect(self, source, reason):
+    def get_error_redirect(self, source: OAuthSource, reason: str) -> str:
         "Return url to redirect on login failure."
         return settings.LOGIN_URL
 
-    def get_or_create_user(self, source, access, info):
+    def get_or_create_user(
+        self,
+        source: OAuthSource,
+        access: UserOAuthSourceConnection,
+        info: Dict[str, Any],
+    ) -> User:
         "Create a shell auth.User."
         raise NotImplementedError()
 
     # pylint: disable=unused-argument
-    def get_user_id(self, source, info):
-        "Return unique identifier from the profile info."
-        id_key = self.source_id or "id"
-        result = info
-        try:
-            for key in id_key.split("."):
-                result = result[key]
-            return result
-        except KeyError:
-            return None
+    def get_user_id(
+        self, source: UserOAuthSourceConnection, info: Dict[str, Any]
+    ) -> Optional[str]:
+        """Return unique identifier from the profile info."""
+        if "id" in info:
+            return info["id"]
+        return None
 
-    def handle_login(self, user, source, access):
+    def handle_login_flow(self, flow: Optional[Flow], user: User) -> HttpResponse:
         """Prepare Authentication Plan, redirect user FlowExecutor"""
-        user = authenticate(
-            source=access.source, identifier=access.identifier, request=self.request
-        )
+        if not flow:
+            raise Http404
         # We run the Flow planner here so we can pass the Pending user in the context
-        flow = get_object_or_404(Flow, designation=FlowDesignation.AUTHENTICATION)
         planner = FlowPlanner(flow)
         plan = planner.plan(
             self.request,
@@ -186,11 +187,17 @@ class OAuthCallback(OAuthClientMixin, View):
         )
         self.request.session[SESSION_KEY_PLAN] = plan
         return redirect_with_qs(
-            "passbook_flows:flow-executor", self.request.GET, flow_slug=flow.slug,
+            "passbook_flows:flow-executor-shell", self.request.GET, flow_slug=flow.slug,
         )
 
     # pylint: disable=unused-argument
-    def handle_existing_user(self, source, user, access, info):
+    def handle_existing_user(
+        self,
+        source: OAuthSource,
+        user: User,
+        access: UserOAuthSourceConnection,
+        info: Dict[str, Any],
+    ) -> HttpResponse:
         "Login user and redirect."
         messages.success(
             self.request,
@@ -199,15 +206,23 @@ class OAuthCallback(OAuthClientMixin, View):
                 % {"source": self.source.name}
             ),
         )
-        return self.handle_login(user, source, access)
+        user = authenticate(
+            source=access.source, identifier=access.identifier, request=self.request
+        )
+        return self.handle_login_flow(source.authentication_flow, user)
 
-    def handle_login_failure(self, source, reason):
+    def handle_login_failure(self, source: OAuthSource, reason: str) -> HttpResponse:
         "Message user and redirect on error."
         LOGGER.warning("Authentication Failure", reason=reason)
         messages.error(self.request, _("Authentication Failed."))
         return redirect(self.get_error_redirect(source, reason))
 
-    def handle_new_user(self, source, access, info):
+    def handle_new_user(
+        self,
+        source: OAuthSource,
+        access: UserOAuthSourceConnection,
+        info: Dict[str, Any],
+    ) -> HttpResponse:
         "Create a shell auth.User and redirect."
         was_authenticated = False
         if self.request.user.is_authenticated:
@@ -244,7 +259,7 @@ class OAuthCallback(OAuthClientMixin, View):
                 % {"source": self.source.name}
             ),
         )
-        return self.handle_login(user, source, access)
+        return self.handle_login_flow(source.enrollment_flow, user)
 
 
 class DisconnectView(LoginRequiredMixin, View):
diff --git a/passbook/sources/saml/api.py b/passbook/sources/saml/api.py
index 53d741fef..b594799e8 100644
--- a/passbook/sources/saml/api.py
+++ b/passbook/sources/saml/api.py
@@ -2,6 +2,7 @@
 from rest_framework.serializers import ModelSerializer
 from rest_framework.viewsets import ModelViewSet
 
+from passbook.admin.forms.source import SOURCE_FORM_FIELDS
 from passbook.sources.saml.models import SAMLSource
 
 
@@ -11,12 +12,12 @@ class SAMLSourceSerializer(ModelSerializer):
     class Meta:
 
         model = SAMLSource
-        fields = [
-            "pk",
+        fields = SOURCE_FORM_FIELDS + [
             "issuer",
-            "idp_url",
-            "idp_logout_url",
-            "auto_logout",
+            "sso_url",
+            "binding_type",
+            "slo_url",
+            "temporary_user_delete_after",
             "signing_kp",
         ]
 
diff --git a/passbook/sources/saml/apps.py b/passbook/sources/saml/apps.py
index d133474cc..39afcbc76 100644
--- a/passbook/sources/saml/apps.py
+++ b/passbook/sources/saml/apps.py
@@ -1,5 +1,7 @@
 """Passbook SAML app config"""
 
+from importlib import import_module
+
 from django.apps import AppConfig
 
 
@@ -10,3 +12,6 @@ class PassbookSourceSAMLConfig(AppConfig):
     label = "passbook_sources_saml"
     verbose_name = "passbook Sources.SAML"
     mountpoint = "source/saml/"
+
+    def ready(self):
+        import_module("passbook.sources.saml.signals")
diff --git a/passbook/sources/saml/forms.py b/passbook/sources/saml/forms.py
index cfc3bf2c5..7807338a7 100644
--- a/passbook/sources/saml/forms.py
+++ b/passbook/sources/saml/forms.py
@@ -1,8 +1,6 @@
 """passbook SAML SP Forms"""
 
 from django import forms
-from django.contrib.admin.widgets import FilteredSelectMultiple
-from django.utils.translation import gettext as _
 
 from passbook.admin.forms.source import SOURCE_FORM_FIELDS
 from passbook.sources.saml.models import SAMLSource
@@ -16,15 +14,16 @@ class SAMLSourceForm(forms.ModelForm):
         model = SAMLSource
         fields = SOURCE_FORM_FIELDS + [
             "issuer",
-            "idp_url",
-            "idp_logout_url",
-            "auto_logout",
+            "sso_url",
+            "binding_type",
+            "slo_url",
+            "temporary_user_delete_after",
             "signing_kp",
         ]
         widgets = {
             "name": forms.TextInput(),
-            "policies": FilteredSelectMultiple(_("policies"), False),
             "issuer": forms.TextInput(),
-            "idp_url": forms.TextInput(),
-            "idp_logout_url": forms.TextInput(),
+            "sso_url": forms.TextInput(),
+            "slo_url": forms.TextInput(),
+            "temporary_user_delete_after": forms.TextInput(),
         }
diff --git a/passbook/sources/saml/migrations/0002_auto_20200523_2329.py b/passbook/sources/saml/migrations/0002_auto_20200523_2329.py
new file mode 100644
index 000000000..8703b3517
--- /dev/null
+++ b/passbook/sources/saml/migrations/0002_auto_20200523_2329.py
@@ -0,0 +1,30 @@
+# Generated by Django 3.0.6 on 2020-05-23 23:29
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("passbook_sources_saml", "0001_initial"),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name="samlsource",
+            name="binding_type",
+            field=models.CharField(
+                choices=[("REDIRECT", "Redirect"), ("POST", "Post")],
+                default="REDIRECT",
+                max_length=100,
+            ),
+        ),
+        migrations.AlterField(
+            model_name="samlsource",
+            name="idp_url",
+            field=models.URLField(
+                help_text="URL that the initial SAML Request is sent to. Also known as a Binding.",
+                verbose_name="IDP URL",
+            ),
+        ),
+    ]
diff --git a/passbook/sources/saml/migrations/0003_auto_20200624_1957.py b/passbook/sources/saml/migrations/0003_auto_20200624_1957.py
new file mode 100644
index 000000000..8164b5d6a
--- /dev/null
+++ b/passbook/sources/saml/migrations/0003_auto_20200624_1957.py
@@ -0,0 +1,65 @@
+# Generated by Django 3.0.7 on 2020-06-24 19:57
+
+import django.db.models.deletion
+from django.db import migrations, models
+
+import passbook.providers.saml.utils.time
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("passbook_crypto", "0002_create_self_signed_kp"),
+        ("passbook_sources_saml", "0002_auto_20200523_2329"),
+    ]
+
+    operations = [
+        migrations.RemoveField(model_name="samlsource", name="auto_logout",),
+        migrations.RenameField(
+            model_name="samlsource", old_name="idp_url", new_name="sso_url",
+        ),
+        migrations.RenameField(
+            model_name="samlsource", old_name="idp_logout_url", new_name="slo_url",
+        ),
+        migrations.AddField(
+            model_name="samlsource",
+            name="temporary_user_delete_after",
+            field=models.TextField(
+                default="days=1",
+                help_text="Time offset when temporary users should be deleted. This only applies if your IDP uses the NameID Format 'transient', and the user doesn't log out manually. (Format: hours=1;minutes=2;seconds=3).",
+                validators=[
+                    passbook.providers.saml.utils.time.timedelta_string_validator
+                ],
+                verbose_name="Delete temporary users after",
+            ),
+        ),
+        migrations.AlterField(
+            model_name="samlsource",
+            name="signing_kp",
+            field=models.ForeignKey(
+                help_text="Certificate Key Pair of the IdP which Assertion's Signature is validated against.",
+                on_delete=django.db.models.deletion.PROTECT,
+                to="passbook_crypto.CertificateKeyPair",
+                verbose_name="Singing Keypair",
+            ),
+        ),
+        migrations.AlterField(
+            model_name="samlsource",
+            name="slo_url",
+            field=models.URLField(
+                blank=True,
+                default=None,
+                help_text="Optional URL if your IDP supports Single-Logout.",
+                null=True,
+                verbose_name="SLO URL",
+            ),
+        ),
+        migrations.AlterField(
+            model_name="samlsource",
+            name="sso_url",
+            field=models.URLField(
+                help_text="URL that the initial Login request is sent to.",
+                verbose_name="SSO URL",
+            ),
+        ),
+    ]
diff --git a/passbook/sources/saml/models.py b/passbook/sources/saml/models.py
index f98133ffc..d48716258 100644
--- a/passbook/sources/saml/models.py
+++ b/passbook/sources/saml/models.py
@@ -6,10 +6,18 @@ from django.utils.translation import gettext_lazy as _
 from passbook.core.models import Source
 from passbook.core.types import UILoginButton
 from passbook.crypto.models import CertificateKeyPair
+from passbook.providers.saml.utils.time import timedelta_string_validator
+
+
+class SAMLBindingTypes(models.TextChoices):
+    """SAML Binding types"""
+
+    Redirect = "REDIRECT"
+    POST = "POST"
 
 
 class SAMLSource(Source):
-    """SAML Source"""
+    """Authenticate using an external SAML Identity Provider."""
 
     issuer = models.TextField(
         blank=True,
@@ -18,20 +26,44 @@ class SAMLSource(Source):
         help_text=_("Also known as Entity ID. Defaults the Metadata URL."),
     )
 
-    idp_url = models.URLField(verbose_name=_("IDP URL"))
-    idp_logout_url = models.URLField(
-        default=None, blank=True, null=True, verbose_name=_("IDP Logout URL")
+    sso_url = models.URLField(
+        verbose_name=_("SSO URL"),
+        help_text=_("URL that the initial Login request is sent to."),
+    )
+    binding_type = models.CharField(
+        max_length=100,
+        choices=SAMLBindingTypes.choices,
+        default=SAMLBindingTypes.Redirect,
+    )
+
+    slo_url = models.URLField(
+        default=None,
+        blank=True,
+        null=True,
+        verbose_name=_("SLO URL"),
+        help_text=_("Optional URL if your IDP supports Single-Logout."),
+    )
+
+    temporary_user_delete_after = models.TextField(
+        default="days=1",
+        verbose_name=_("Delete temporary users after"),
+        validators=[timedelta_string_validator],
+        help_text=_(
+            (
+                "Time offset when temporary users should be deleted. This only applies if your IDP "
+                "uses the NameID Format 'transient', and the user doesn't log out manually. "
+                "(Format: hours=1;minutes=2;seconds=3)."
+            )
+        ),
     )
-    auto_logout = models.BooleanField(default=False)
 
     signing_kp = models.ForeignKey(
         CertificateKeyPair,
-        default=None,
-        null=True,
+        verbose_name=_("Singing Keypair"),
         help_text=_(
-            "Certificate Key Pair of the IdP which Assertions are validated against."
+            "Certificate Key Pair of the IdP which Assertion's Signature is validated against."
         ),
-        on_delete=models.SET_NULL,
+        on_delete=models.PROTECT,
     )
 
     form = "passbook.sources.saml.forms.SAMLSourceForm"
diff --git a/passbook/sources/saml/processors/base.py b/passbook/sources/saml/processors/base.py
index 5568d9286..036c034f5 100644
--- a/passbook/sources/saml/processors/base.py
+++ b/passbook/sources/saml/processors/base.py
@@ -1,22 +1,40 @@
 """passbook saml source processor"""
-from typing import TYPE_CHECKING, Optional
+from typing import TYPE_CHECKING, Dict
 
 from defusedxml import ElementTree
-from django.http import HttpRequest
+from django.http import HttpRequest, HttpResponse
 from signxml import XMLVerifier
 from structlog import get_logger
 
 from passbook.core.models import User
+from passbook.flows.models import Flow
+from passbook.flows.planner import (
+    PLAN_CONTEXT_PENDING_USER,
+    PLAN_CONTEXT_SSO,
+    FlowPlanner,
+)
+from passbook.flows.views import SESSION_KEY_PLAN
+from passbook.lib.utils.urls import redirect_with_qs
 from passbook.providers.saml.utils.encoding import decode_base64_and_inflate
 from passbook.sources.saml.exceptions import (
     MissingSAMLResponse,
     UnsupportedNameIDFormat,
 )
 from passbook.sources.saml.models import SAMLSource
+from passbook.sources.saml.processors.constants import (
+    SAML_NAME_ID_FORMAT_EMAIL,
+    SAML_NAME_ID_FORMAT_PRESISTENT,
+    SAML_NAME_ID_FORMAT_TRANSIENT,
+    SAML_NAME_ID_FORMAT_WINDOWS,
+    SAML_NAME_ID_FORMAT_X509,
+)
+from passbook.stages.password.stage import PLAN_CONTEXT_AUTHENTICATION_BACKEND
+from passbook.stages.prompt.stage import PLAN_CONTEXT_PROMPT
 
 LOGGER = get_logger()
 if TYPE_CHECKING:
     from xml.etree.ElementTree import Element  # nosec
+DEFAULT_BACKEND = "django.contrib.auth.backends.ModelBackend"
 
 
 class Processor:
@@ -46,41 +64,96 @@ class Processor:
     def _verify_signed(self):
         """Verify SAML Response's Signature"""
         verifier = XMLVerifier()
-        verifier.verify(self._root_xml, x509_cert=self._source.signing_kp.certificate)
+        verifier.verify(
+            self._root_xml, x509_cert=self._source.signing_kp.certificate_data
+        )
 
-    def _get_email(self) -> Optional[str]:
-        """
-        Returns the email out of the response.
+    def _handle_name_id_transient(self, request: HttpRequest) -> HttpResponse:
+        """Handle a NameID with the Format of Transient. This is a bit more complex than other
+        formats, as we need to create a temporary User that is used in the session. This
+        user has an attribute that refers to our Source for cleanup. The user is also deleted
+        on logout and periodically."""
+        # Create a temporary User
+        name_id = self._get_name_id().text
+        user: User = User.objects.create(
+            username=name_id,
+            attributes={
+                "saml": {"source": self._source.pk.hex, "delete_on_logout": True}
+            },
+        )
+        LOGGER.debug("Created temporary user for NameID Transient", username=name_id)
+        user.set_unusable_password()
+        user.save()
+        return self._flow_response(
+            request,
+            self._source.authentication_flow,
+            **{
+                PLAN_CONTEXT_PENDING_USER: user,
+                PLAN_CONTEXT_AUTHENTICATION_BACKEND: DEFAULT_BACKEND,
+            },
+        )
 
-        At present, response must pass the email address as the Subject, eg.:
-
-        <saml:Subject>
-                <saml:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
-                            SPNameQualifier=""
-                            >email@example.com</saml:NameID>
-        """
+    def _get_name_id(self) -> "Element":
+        """Get NameID Element"""
         assertion = self._root.find("{urn:oasis:names:tc:SAML:2.0:assertion}Assertion")
         subject = assertion.find("{urn:oasis:names:tc:SAML:2.0:assertion}Subject")
         name_id = subject.find("{urn:oasis:names:tc:SAML:2.0:assertion}NameID")
-        name_id_format = name_id.attrib["Format"]
-        if name_id_format != "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress":
-            raise UnsupportedNameIDFormat(
-                f"Assertion contains NameID with unsupported format {name_id_format}."
-            )
-        return name_id.text
+        if name_id is None:
+            raise ValueError("NameID Element not found!")
+        return name_id
 
-    def get_user(self) -> User:
-        """
-        Gets info out of the response and locally logs in this user.
-        May create a local user account first.
-        Returns the user object that was created.
-        """
-        email = self._get_email()
-        try:
-            user = User.objects.get(email=email)
-        except User.DoesNotExist:
-            user = User.objects.create_user(username=email, email=email)
-            # TODO: Property Mappings
-            user.set_unusable_password()
-            user.save()
-        return user
+    def _get_name_id_filter(self) -> Dict[str, str]:
+        """Returns the subject's NameID as a Filter for the `User`"""
+        name_id_el = self._get_name_id()
+        name_id = name_id_el.text
+        if not name_id:
+            raise UnsupportedNameIDFormat("Subject's NameID is empty.")
+        _format = name_id_el.attrib["Format"]
+        if _format == SAML_NAME_ID_FORMAT_EMAIL:
+            return {"email": name_id}
+        if _format == SAML_NAME_ID_FORMAT_PRESISTENT:
+            return {"username": name_id}
+        if _format == SAML_NAME_ID_FORMAT_X509:
+            # This attribute is statically set by the LDAP source
+            return {"attributes__distinguishedName": name_id}
+        if _format == SAML_NAME_ID_FORMAT_WINDOWS:
+            if "\\" in name_id:
+                name_id = name_id.split("\\")[1]
+            return {"username": name_id}
+        raise UnsupportedNameIDFormat(
+            f"Assertion contains NameID with unsupported format {_format}."
+        )
+
+    def prepare_flow(self, request: HttpRequest) -> HttpResponse:
+        """Prepare flow plan depending on whether or not the user exists"""
+        name_id = self._get_name_id()
+        # transient NameIDs are handeled seperately as they don't have to go through flows.
+        if name_id.attrib["Format"] == SAML_NAME_ID_FORMAT_TRANSIENT:
+            return self._handle_name_id_transient(request)
+
+        name_id_filter = self._get_name_id_filter()
+        matching_users = User.objects.filter(**name_id_filter)
+        if matching_users.exists():
+            # User exists already, switch to authentication flow
+            return self._flow_response(
+                request,
+                self._source.authentication_flow,
+                **{
+                    PLAN_CONTEXT_PENDING_USER: matching_users.first(),
+                    PLAN_CONTEXT_AUTHENTICATION_BACKEND: DEFAULT_BACKEND,
+                },
+            )
+        return self._flow_response(
+            request,
+            self._source.enrollment_flow,
+            **{PLAN_CONTEXT_PROMPT: name_id_filter},
+        )
+
+    def _flow_response(
+        self, request: HttpRequest, flow: Flow, **kwargs
+    ) -> HttpResponse:
+        kwargs[PLAN_CONTEXT_SSO] = True
+        request.session[SESSION_KEY_PLAN] = FlowPlanner(flow).plan(request, kwargs)
+        return redirect_with_qs(
+            "passbook_flows:flow-executor-shell", request.GET, flow_slug=flow.slug,
+        )
diff --git a/passbook/sources/saml/processors/constants.py b/passbook/sources/saml/processors/constants.py
new file mode 100644
index 000000000..1c74b04ac
--- /dev/null
+++ b/passbook/sources/saml/processors/constants.py
@@ -0,0 +1,8 @@
+"""SAML Source processor constants"""
+SAML_NAME_ID_FORMAT_EMAIL = "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
+SAML_NAME_ID_FORMAT_PRESISTENT = "urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"
+SAML_NAME_ID_FORMAT_X509 = "urn:oasis:names:tc:SAML:2.0:nameid-format:X509SubjectName"
+SAML_NAME_ID_FORMAT_WINDOWS = (
+    "urn:oasis:names:tc:SAML:2.0:nameid-format:WindowsDomainQualifiedName"
+)
+SAML_NAME_ID_FORMAT_TRANSIENT = "urn:oasis:names:tc:SAML:2.0:nameid-format:transient"
diff --git a/passbook/sources/saml/settings.py b/passbook/sources/saml/settings.py
new file mode 100644
index 000000000..63b7065c7
--- /dev/null
+++ b/passbook/sources/saml/settings.py
@@ -0,0 +1,9 @@
+"""saml source settings"""
+from celery.schedules import crontab
+
+CELERY_BEAT_SCHEDULE = {
+    "saml_source_cleanup": {
+        "task": "passbook.sources.saml.tasks.clean_temporary_users",
+        "schedule": crontab(minute="*/5"),
+    }
+}
diff --git a/passbook/sources/saml/signals.py b/passbook/sources/saml/signals.py
new file mode 100644
index 000000000..888560f81
--- /dev/null
+++ b/passbook/sources/saml/signals.py
@@ -0,0 +1,22 @@
+"""passbook saml source signal listener"""
+from django.contrib.auth.signals import user_logged_out
+from django.dispatch import receiver
+from django.http import HttpRequest
+from structlog import get_logger
+
+from passbook.core.models import User
+
+LOGGER = get_logger()
+
+
+@receiver(user_logged_out)
+# pylint: disable=unused-argument
+def on_user_logged_out(sender, request: HttpRequest, user: User, **_):
+    """Delete temporary user if the `delete_on_logout` flag is enabled"""
+    if not user:
+        return
+    if "saml" in user.attributes:
+        if "delete_on_logout" in user.attributes["saml"]:
+            if user.attributes["saml"]["delete_on_logout"]:
+                LOGGER.debug("Deleted temporary user", user=user)
+                user.delete()
diff --git a/passbook/sources/saml/tasks.py b/passbook/sources/saml/tasks.py
new file mode 100644
index 000000000..caad70dab
--- /dev/null
+++ b/passbook/sources/saml/tasks.py
@@ -0,0 +1,32 @@
+"""passbook saml source tasks"""
+from django.utils.timezone import now
+from structlog import get_logger
+
+from passbook.core.models import User
+from passbook.providers.saml.utils.time import timedelta_from_string
+from passbook.root.celery import CELERY_APP
+from passbook.sources.saml.models import SAMLSource
+
+LOGGER = get_logger()
+
+
+@CELERY_APP.task()
+def clean_temporary_users():
+    """Remove old temporary users"""
+    _now = now()
+    for user in User.objects.filter(attributes__saml__isnull=False):
+        sources = SAMLSource.objects.filter(
+            pk=user.attributes.get("saml", {}).get("source", "")
+        )
+        if not sources.exists():
+            LOGGER.warning(
+                "User has an invalid SAML Source and won't be deleted!", user=user
+            )
+        source = sources.first()
+        source_delta = timedelta_from_string(source.temporary_user_delete_after)
+        if _now - user.last_login >= source_delta:
+            LOGGER.debug(
+                "User is expired and will be deleted.", user=user, delta=source_delta
+            )
+            # TODO: Check if user is signed in anywhere?
+            user.delete()
diff --git a/passbook/sources/saml/templates/saml/sp/login.html b/passbook/sources/saml/templates/saml/sp/login.html
index 4a47376ac..89dcfa19b 100644
--- a/passbook/sources/saml/templates/saml/sp/login.html
+++ b/passbook/sources/saml/templates/saml/sp/login.html
@@ -14,7 +14,7 @@
 <form method="POST" action="{{ request_url }}">
     {% csrf_token %}
     <input type="hidden" name="SAMLRequest" value="{{ request }}" />
-    <input type="hidden" name="RelayState" value="{{ token }}" />
+    <input type="hidden" name="RelayState" value="{{ relay_state }}" />
     <div class="login-group">
         <h3>
             {% blocktrans with remote=source.name %}
diff --git a/passbook/sources/saml/views.py b/passbook/sources/saml/views.py
index 6dd38db93..7a4ca66b2 100644
--- a/passbook/sources/saml/views.py
+++ b/passbook/sources/saml/views.py
@@ -1,21 +1,24 @@
 """saml sp views"""
-from django.contrib.auth import login, logout
+from django.contrib.auth import logout
+from django.contrib.auth.mixins import LoginRequiredMixin
 from django.http import Http404, HttpRequest, HttpResponse
-from django.shortcuts import get_object_or_404, redirect, render, reverse
+from django.shortcuts import get_object_or_404, redirect, render
 from django.utils.decorators import method_decorator
+from django.utils.http import urlencode
 from django.views import View
 from django.views.decorators.csrf import csrf_exempt
+from signxml import InvalidSignature
 from signxml.util import strip_pem_header
 
 from passbook.lib.views import bad_request_message
 from passbook.providers.saml.utils import get_random_id, render_xml
-from passbook.providers.saml.utils.encoding import nice64
+from passbook.providers.saml.utils.encoding import deflate_and_base64_encode, nice64
 from passbook.providers.saml.utils.time import get_time_string
 from passbook.sources.saml.exceptions import (
     MissingSAMLResponse,
     UnsupportedNameIDFormat,
 )
-from passbook.sources.saml.models import SAMLSource
+from passbook.sources.saml.models import SAMLBindingTypes, SAMLSource
 from passbook.sources.saml.processors.base import Processor
 from passbook.sources.saml.utils import build_full_url, get_issuer
 from passbook.sources.saml.xml_render import get_authnrequest_xml
@@ -29,27 +32,33 @@ class InitiateView(View):
         source: SAMLSource = get_object_or_404(SAMLSource, slug=source_slug)
         if not source.enabled:
             raise Http404
-        sso_destination = request.GET.get("next", None)
-        request.session["sso_destination"] = sso_destination
+        relay_state = request.GET.get("next", "")
+        request.session["sso_destination"] = relay_state
         parameters = {
             "ACS_URL": build_full_url("acs", request, source),
-            "DESTINATION": source.idp_url,
+            "DESTINATION": source.sso_url,
             "AUTHN_REQUEST_ID": get_random_id(),
             "ISSUE_INSTANT": get_time_string(),
             "ISSUER": get_issuer(request, source),
         }
         authn_req = get_authnrequest_xml(parameters, signed=False)
-        _request = nice64(str.encode(authn_req))
-        return render(
-            request,
-            "saml/sp/login.html",
-            {
-                "request_url": source.idp_url,
-                "request": _request,
-                "token": sso_destination,
-                "source": source,
-            },
-        )
+        if source.binding_type == SAMLBindingTypes.Redirect:
+            _request = deflate_and_base64_encode(authn_req.encode())
+            url_args = urlencode({"SAMLRequest": _request, "RelayState": relay_state})
+            return redirect(f"{source.sso_url}?{url_args}")
+        if source.binding_type == SAMLBindingTypes.POST:
+            _request = nice64(authn_req.encode())
+            return render(
+                request,
+                "saml/sp/login.html",
+                {
+                    "request_url": source.sso_url,
+                    "request": _request,
+                    "relay_state": relay_state,
+                    "source": source,
+                },
+            )
+        raise Http404
 
 
 @method_decorator(csrf_exempt, name="dispatch")
@@ -66,20 +75,21 @@ class ACSView(View):
             processor.parse(request)
         except MissingSAMLResponse as exc:
             return bad_request_message(request, str(exc))
+        except InvalidSignature as exc:
+            return bad_request_message(request, str(exc))
 
         try:
-            user = processor.get_user()
-            login(request, user, backend="django.contrib.auth.backends.ModelBackend")
-            return redirect(reverse("passbook_core:overview"))
+            return processor.prepare_flow(request)
         except UnsupportedNameIDFormat as exc:
             return bad_request_message(request, str(exc))
 
 
-class SLOView(View):
+class SLOView(LoginRequiredMixin, View):
     """Single-Logout-View"""
 
     def dispatch(self, request: HttpRequest, source_slug: str) -> HttpResponse:
         """Replies with an XHTML SSO Request."""
+        # TODO: Replace with flows
         source: SAMLSource = get_object_or_404(SAMLSource, slug=source_slug)
         if not source.enabled:
             raise Http404
@@ -87,10 +97,7 @@ class SLOView(View):
         return render(
             request,
             "saml/sp/sso_single_logout.html",
-            {
-                "idp_logout_url": source.idp_logout_url,
-                "autosubmit": source.auto_logout,
-            },
+            {"idp_logout_url": source.slo_url},
         )
 
 
diff --git a/passbook/stages/captcha/models.py b/passbook/stages/captcha/models.py
index 492ac2f35..db52e4722 100644
--- a/passbook/stages/captcha/models.py
+++ b/passbook/stages/captcha/models.py
@@ -6,7 +6,7 @@ from passbook.flows.models import Stage
 
 
 class CaptchaStage(Stage):
-    """Captcha Stage instance"""
+    """Verify the user is human using Google's reCaptcha."""
 
     public_key = models.TextField(
         help_text=_(
diff --git a/passbook/stages/captcha/tests.py b/passbook/stages/captcha/tests.py
index a97b57eb0..c5c8f5850 100644
--- a/passbook/stages/captcha/tests.py
+++ b/passbook/stages/captcha/tests.py
@@ -2,8 +2,10 @@
 from django.conf import settings
 from django.shortcuts import reverse
 from django.test import Client, TestCase
+from django.utils.encoding import force_text
 
 from passbook.core.models import User
+from passbook.flows.markers import StageMarker
 from passbook.flows.models import Flow, FlowDesignation, FlowStageBinding
 from passbook.flows.planner import FlowPlan
 from passbook.flows.views import SESSION_KEY_PLAN
@@ -34,7 +36,9 @@ class TestCaptchaStage(TestCase):
 
     def test_valid(self):
         """Test valid captcha"""
-        plan = FlowPlan(flow_pk=self.flow.pk.hex, stages=[self.stage])
+        plan = FlowPlan(
+            flow_pk=self.flow.pk.hex, stages=[self.stage], markers=[StageMarker()]
+        )
         session = self.client.session
         session[SESSION_KEY_PLAN] = plan
         session.save()
@@ -44,5 +48,8 @@ class TestCaptchaStage(TestCase):
             ),
             {"g-recaptcha-response": "PASSED"},
         )
-        self.assertEqual(response.status_code, 302)
-        self.assertEqual(response.url, reverse("passbook_core:overview"))
+        self.assertEqual(response.status_code, 200)
+        self.assertJSONEqual(
+            force_text(response.content),
+            {"type": "redirect", "to": reverse("passbook_core:overview")},
+        )
diff --git a/passbook/stages/otp/__init__.py b/passbook/stages/consent/__init__.py
similarity index 100%
rename from passbook/stages/otp/__init__.py
rename to passbook/stages/consent/__init__.py
diff --git a/passbook/stages/consent/api.py b/passbook/stages/consent/api.py
new file mode 100644
index 000000000..845f840e6
--- /dev/null
+++ b/passbook/stages/consent/api.py
@@ -0,0 +1,21 @@
+"""ConsentStage API Views"""
+from rest_framework.serializers import ModelSerializer
+from rest_framework.viewsets import ModelViewSet
+
+from passbook.stages.consent.models import ConsentStage
+
+
+class ConsentStageSerializer(ModelSerializer):
+    """ConsentStage Serializer"""
+
+    class Meta:
+
+        model = ConsentStage
+        fields = ["pk", "name"]
+
+
+class ConsentStageViewSet(ModelViewSet):
+    """ConsentStage Viewset"""
+
+    queryset = ConsentStage.objects.all()
+    serializer_class = ConsentStageSerializer
diff --git a/passbook/stages/consent/apps.py b/passbook/stages/consent/apps.py
new file mode 100644
index 000000000..cba755dc0
--- /dev/null
+++ b/passbook/stages/consent/apps.py
@@ -0,0 +1,10 @@
+"""passbook consent app"""
+from django.apps import AppConfig
+
+
+class PassbookStageConsentConfig(AppConfig):
+    """passbook consent app"""
+
+    name = "passbook.stages.consent"
+    label = "passbook_stages_consent"
+    verbose_name = "passbook Stages.Consent"
diff --git a/passbook/stages/consent/forms.py b/passbook/stages/consent/forms.py
new file mode 100644
index 000000000..1b7b34d2c
--- /dev/null
+++ b/passbook/stages/consent/forms.py
@@ -0,0 +1,20 @@
+"""passbook consent stage forms"""
+from django import forms
+
+from passbook.stages.consent.models import ConsentStage
+
+
+class ConsentForm(forms.Form):
+    """passbook consent stage form"""
+
+
+class ConsentStageForm(forms.ModelForm):
+    """Form to edit ConsentStage Instance"""
+
+    class Meta:
+
+        model = ConsentStage
+        fields = ["name"]
+        widgets = {
+            "name": forms.TextInput(),
+        }
diff --git a/passbook/stages/consent/migrations/0001_initial.py b/passbook/stages/consent/migrations/0001_initial.py
new file mode 100644
index 000000000..b929f5bf0
--- /dev/null
+++ b/passbook/stages/consent/migrations/0001_initial.py
@@ -0,0 +1,37 @@
+# Generated by Django 3.0.6 on 2020-05-24 11:46
+
+import django.db.models.deletion
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    initial = True
+
+    dependencies = [
+        ("passbook_flows", "0004_source_flows"),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name="ConsentStage",
+            fields=[
+                (
+                    "stage_ptr",
+                    models.OneToOneField(
+                        auto_created=True,
+                        on_delete=django.db.models.deletion.CASCADE,
+                        parent_link=True,
+                        primary_key=True,
+                        serialize=False,
+                        to="passbook_flows.Stage",
+                    ),
+                ),
+            ],
+            options={
+                "verbose_name": "Consent Stage",
+                "verbose_name_plural": "Consent Stages",
+            },
+            bases=("passbook_flows.stage",),
+        ),
+    ]
diff --git a/passbook/stages/otp/migrations/__init__.py b/passbook/stages/consent/migrations/__init__.py
similarity index 100%
rename from passbook/stages/otp/migrations/__init__.py
rename to passbook/stages/consent/migrations/__init__.py
diff --git a/passbook/stages/consent/models.py b/passbook/stages/consent/models.py
new file mode 100644
index 000000000..3132474c5
--- /dev/null
+++ b/passbook/stages/consent/models.py
@@ -0,0 +1,19 @@
+"""passbook consent stage"""
+from django.utils.translation import gettext_lazy as _
+
+from passbook.flows.models import Stage
+
+
+class ConsentStage(Stage):
+    """Prompt the user for confirmation."""
+
+    type = "passbook.stages.consent.stage.ConsentStage"
+    form = "passbook.stages.consent.forms.ConsentStageForm"
+
+    def __str__(self):
+        return f"Consent Stage {self.name}"
+
+    class Meta:
+
+        verbose_name = _("Consent Stage")
+        verbose_name_plural = _("Consent Stages")
diff --git a/passbook/stages/consent/stage.py b/passbook/stages/consent/stage.py
new file mode 100644
index 000000000..3a1fa14a2
--- /dev/null
+++ b/passbook/stages/consent/stage.py
@@ -0,0 +1,30 @@
+"""passbook consent stage"""
+from typing import Any, Dict, List
+
+from django.views.generic import FormView
+
+from passbook.flows.stage import StageView
+from passbook.stages.consent.forms import ConsentForm
+
+PLAN_CONTEXT_CONSENT_TEMPLATE = "consent_template"
+
+
+class ConsentStage(FormView, StageView):
+    """Simple consent checker."""
+
+    form_class = ConsentForm
+
+    def get_context_data(self, **kwargs: Dict[str, Any]) -> Dict[str, Any]:
+        kwargs = super().get_context_data(**kwargs)
+        kwargs["current_stage"] = self.executor.current_stage
+        kwargs["context"] = self.executor.plan.context
+        return kwargs
+
+    def get_template_names(self) -> List[str]:
+        if PLAN_CONTEXT_CONSENT_TEMPLATE in self.executor.plan.context:
+            template_name = self.executor.plan.context[PLAN_CONTEXT_CONSENT_TEMPLATE]
+            return [template_name]
+        return super().get_template_names()
+
+    def form_valid(self, form):
+        return self.executor.stage_ok()
diff --git a/passbook/stages/consent/tests.py b/passbook/stages/consent/tests.py
new file mode 100644
index 000000000..e7f0f2534
--- /dev/null
+++ b/passbook/stages/consent/tests.py
@@ -0,0 +1,50 @@
+"""consent tests"""
+from django.shortcuts import reverse
+from django.test import Client, TestCase
+from django.utils.encoding import force_text
+
+from passbook.core.models import User
+from passbook.flows.markers import StageMarker
+from passbook.flows.models import Flow, FlowDesignation, FlowStageBinding
+from passbook.flows.planner import FlowPlan
+from passbook.flows.views import SESSION_KEY_PLAN
+from passbook.stages.consent.models import ConsentStage
+
+
+class TestConsentStage(TestCase):
+    """Consent tests"""
+
+    def setUp(self):
+        super().setUp()
+        self.user = User.objects.create_user(
+            username="unittest", email="test@beryju.org"
+        )
+        self.client = Client()
+
+        self.flow = Flow.objects.create(
+            name="test-consent",
+            slug="test-consent",
+            designation=FlowDesignation.AUTHENTICATION,
+        )
+        self.stage = ConsentStage.objects.create(name="consent",)
+        FlowStageBinding.objects.create(flow=self.flow, stage=self.stage, order=2)
+
+    def test_valid(self):
+        """Test valid consent"""
+        plan = FlowPlan(
+            flow_pk=self.flow.pk.hex, stages=[self.stage], markers=[StageMarker()]
+        )
+        session = self.client.session
+        session[SESSION_KEY_PLAN] = plan
+        session.save()
+        response = self.client.post(
+            reverse(
+                "passbook_flows:flow-executor", kwargs={"flow_slug": self.flow.slug}
+            ),
+            {},
+        )
+        self.assertEqual(response.status_code, 200)
+        self.assertJSONEqual(
+            force_text(response.content),
+            {"type": "redirect", "to": reverse("passbook_core:overview")},
+        )
diff --git a/passbook/stages/dummy/models.py b/passbook/stages/dummy/models.py
index 70457e217..3dfb1d891 100644
--- a/passbook/stages/dummy/models.py
+++ b/passbook/stages/dummy/models.py
@@ -5,7 +5,9 @@ from passbook.flows.models import Stage
 
 
 class DummyStage(Stage):
-    """Dummy stage, mostly used to debug"""
+    """Used for debugging."""
+
+    __debug_only__ = True
 
     type = "passbook.stages.dummy.stage.DummyStage"
     form = "passbook.stages.dummy.forms.DummyStageForm"
diff --git a/passbook/stages/dummy/stage.py b/passbook/stages/dummy/stage.py
index 43a3edcdf..07f3dacff 100644
--- a/passbook/stages/dummy/stage.py
+++ b/passbook/stages/dummy/stage.py
@@ -1,4 +1,6 @@
 """passbook multi-stage authentication engine"""
+from typing import Any, Dict
+
 from django.http import HttpRequest
 
 from passbook.flows.stage import StageView
@@ -10,3 +12,8 @@ class DummyStage(StageView):
     def post(self, request: HttpRequest):
         """Just redirect to next stage"""
         return self.executor.stage_ok()
+
+    def get_context_data(self, **kwargs: Dict[str, Any]) -> Dict[str, Any]:
+        kwargs = super().get_context_data(**kwargs)
+        kwargs["title"] = self.executor.current_stage.name
+        return kwargs
diff --git a/passbook/stages/dummy/tests.py b/passbook/stages/dummy/tests.py
index 390f47aa8..51dada874 100644
--- a/passbook/stages/dummy/tests.py
+++ b/passbook/stages/dummy/tests.py
@@ -1,6 +1,7 @@
 """dummy tests"""
 from django.shortcuts import reverse
 from django.test import Client, TestCase
+from django.utils.encoding import force_text
 
 from passbook.core.models import User
 from passbook.flows.models import Flow, FlowDesignation, FlowStageBinding
@@ -41,8 +42,11 @@ class TestDummyStage(TestCase):
             "passbook_flows:flow-executor", kwargs={"flow_slug": self.flow.slug}
         )
         response = self.client.post(url, {})
-        self.assertEqual(response.status_code, 302)
-        self.assertEqual(response.url, reverse("passbook_core:overview"))
+        self.assertEqual(response.status_code, 200)
+        self.assertJSONEqual(
+            force_text(response.content),
+            {"type": "redirect", "to": reverse("passbook_core:overview")},
+        )
 
     def test_form(self):
         """Test Form"""
diff --git a/passbook/stages/email/forms.py b/passbook/stages/email/forms.py
index e158743e1..03db70f4b 100644
--- a/passbook/stages/email/forms.py
+++ b/passbook/stages/email/forms.py
@@ -6,13 +6,13 @@ from passbook.stages.email.models import EmailStage
 
 
 class EmailStageSendForm(forms.Form):
-    """Form used when sending the e-mail to prevent multiple emails being sent"""
+    """Form used when sending the email to prevent multiple emails being sent"""
 
     invalid = forms.CharField(widget=forms.HiddenInput, required=True)
 
 
 class EmailStageForm(forms.ModelForm):
-    """Form to create/edit E-Mail Stage"""
+    """Form to create/edit Email Stage"""
 
     class Meta:
 
@@ -34,6 +34,7 @@ class EmailStageForm(forms.ModelForm):
         widgets = {
             "name": forms.TextInput(),
             "host": forms.TextInput(),
+            "subject": forms.TextInput(),
             "username": forms.TextInput(),
             "password": forms.TextInput(),
         }
diff --git a/passbook/stages/email/models.py b/passbook/stages/email/models.py
index 4eef283df..6508704b3 100644
--- a/passbook/stages/email/models.py
+++ b/passbook/stages/email/models.py
@@ -8,7 +8,7 @@ from passbook.flows.models import Stage
 
 
 class EmailTemplates(models.TextChoices):
-    """Templates used for rendering the E-Mail"""
+    """Templates used for rendering the Email"""
 
     PASSWORD_RESET = (
         "stages/email/for_email/password_reset.html",
@@ -21,7 +21,7 @@ class EmailTemplates(models.TextChoices):
 
 
 class EmailStage(Stage):
-    """email stage"""
+    """Sends an Email to the user with a token to confirm their Email address."""
 
     host = models.TextField(default="localhost")
     port = models.IntegerField(default=25)
diff --git a/passbook/stages/email/stage.py b/passbook/stages/email/stage.py
index e0dce139b..58f2ab03d 100644
--- a/passbook/stages/email/stage.py
+++ b/passbook/stages/email/stage.py
@@ -13,16 +13,19 @@ from structlog import get_logger
 from passbook.core.models import Token
 from passbook.flows.planner import PLAN_CONTEXT_PENDING_USER
 from passbook.flows.stage import StageView
+from passbook.flows.views import SESSION_KEY_GET
 from passbook.stages.email.forms import EmailStageSendForm
+from passbook.stages.email.models import EmailStage
 from passbook.stages.email.tasks import send_mails
 from passbook.stages.email.utils import TemplateEmailMessage
 
 LOGGER = get_logger()
 QS_KEY_TOKEN = "token"
+PLAN_CONTEXT_EMAIL_SENT = "email_sent"
 
 
 class EmailStageView(FormView, StageView):
-    """E-Mail stage which sends E-Mail for verification"""
+    """Email stage which sends Email for verification"""
 
     form_class = EmailStageSendForm
     template_name = "stages/email/waiting_message.html"
@@ -30,31 +33,25 @@ class EmailStageView(FormView, StageView):
     def get_full_url(self, **kwargs) -> str:
         """Get full URL to be used in template"""
         base_url = reverse(
-            "passbook_flows:flow-executor",
+            "passbook_flows:flow-executor-shell",
             kwargs={"flow_slug": self.executor.flow.slug},
         )
         relative_url = f"{base_url}?{urlencode(kwargs)}"
         return self.request.build_absolute_uri(relative_url)
 
-    def get(self, request: HttpRequest, *args, **kwargs) -> HttpResponse:
-        if QS_KEY_TOKEN in request.GET:
-            token = get_object_or_404(Token, pk=request.GET[QS_KEY_TOKEN])
-            self.executor.plan.context[PLAN_CONTEXT_PENDING_USER] = token.user
-            token.delete()
-            messages.success(request, _("Successfully verified E-Mail."))
-            return self.executor.stage_ok()
-        return super().get(request, *args, **kwargs)
-
-    def form_invalid(self, form: EmailStageSendForm) -> HttpResponse:
+    def send_email(self):
+        """Helper function that sends the actual email. Implies that you've
+        already checked that there is a pending user."""
         pending_user = self.executor.plan.context[PLAN_CONTEXT_PENDING_USER]
+        current_stage: EmailStage = self.executor.current_stage
         valid_delta = timedelta(
-            minutes=self.executor.current_stage.token_expiry + 1
+            minutes=current_stage.token_expiry + 1
         )  # + 1 because django timesince always rounds down
         token = Token.objects.create(user=pending_user, expires=now() + valid_delta)
         # Send mail to user
         message = TemplateEmailMessage(
-            subject=_("passbook - Password Recovery"),
-            template_name=self.executor.current_stage.template,
+            subject=_(current_stage.subject),
+            template_name=current_stage.template,
             to=[pending_user.email],
             template_context={
                 "url": self.get_full_url(**{QS_KEY_TOKEN: token.pk.hex}),
@@ -62,7 +59,32 @@ class EmailStageView(FormView, StageView):
                 "expires": token.expires,
             },
         )
-        send_mails(self.executor.current_stage, message)
+        send_mails(current_stage, message)
+
+    def get(self, request: HttpRequest, *args, **kwargs) -> HttpResponse:
+        # Check if the user came back from the email link to verify
+        if QS_KEY_TOKEN in request.session.get(SESSION_KEY_GET, {}):
+            token = get_object_or_404(
+                Token, pk=request.session[SESSION_KEY_GET][QS_KEY_TOKEN]
+            )
+            self.executor.plan.context[PLAN_CONTEXT_PENDING_USER] = token.user
+            token.delete()
+            messages.success(request, _("Successfully verified Email."))
+            return self.executor.stage_ok()
+        if PLAN_CONTEXT_PENDING_USER not in self.executor.plan.context:
+            messages.error(self.request, _("No pending user."))
+            return self.executor.stage_invalid()
+        # Check if we've already sent the initial e-mail
+        if PLAN_CONTEXT_EMAIL_SENT not in self.executor.plan.context:
+            self.send_email()
+            self.executor.plan.context[PLAN_CONTEXT_EMAIL_SENT] = True
+        return super().get(request, *args, **kwargs)
+
+    def form_invalid(self, form: EmailStageSendForm) -> HttpResponse:
+        if PLAN_CONTEXT_PENDING_USER not in self.executor.plan.context:
+            messages.error(self.request, _("No pending user."))
+            return super().form_invalid(form)
+        self.send_email()
         # We can't call stage_ok yet, as we're still waiting
         # for the user to click the link in the email
         return super().form_invalid(form)
diff --git a/passbook/stages/email/tasks.py b/passbook/stages/email/tasks.py
index 750a5326e..846df7c55 100644
--- a/passbook/stages/email/tasks.py
+++ b/passbook/stages/email/tasks.py
@@ -27,7 +27,7 @@ def send_mails(stage: EmailStage, *messages: List[EmailMultiAlternatives]):
 )
 # pylint: disable=unused-argument
 def _send_mail_task(self, email_stage_pk: int, message: Dict[Any, Any]):
-    """Send E-Mail according to EmailStage parameters from background worker.
+    """Send Email according to EmailStage parameters from background worker.
     Automatically retries if message couldn't be sent."""
     stage: EmailStage = EmailStage.objects.get(pk=email_stage_pk)
     backend = stage.backend
diff --git a/passbook/stages/email/templates/stages/email/for_email/account_confirm.html b/passbook/stages/email/templates/stages/email/for_email/account_confirmation.html
similarity index 80%
rename from passbook/stages/email/templates/stages/email/for_email/account_confirm.html
rename to passbook/stages/email/templates/stages/email/for_email/account_confirmation.html
index f300b6585..b384a8cd1 100644
--- a/passbook/stages/email/templates/stages/email/for_email/account_confirm.html
+++ b/passbook/stages/email/templates/stages/email/for_email/account_confirmation.html
@@ -1,6 +1,6 @@
-{% extends 'email/base.html' %}
+{% extends 'stages/email/for_email/base.html' %}
 
-{% load inline %}
+{% load passbook_stages_email %}
 {% load i18n %}
 
 {% block content %}
@@ -18,7 +18,7 @@
           <table role="presentation" border="0" cellpadding="0" cellspacing="0">
             <tbody>
               <tr>
-                <td> <a href="{{ url }}" target="_blank">{% trans 'Confirm Account' %}</a> </td>
+                <td> <a id="confirm" href="{{ url }}" rel="noopener noreferrer" target="_blank">{% trans 'Confirm Account' %}</a> </td>
               </tr>
             </tbody>
           </table>
diff --git a/passbook/stages/email/templates/stages/email/for_email/generic_email.html b/passbook/stages/email/templates/stages/email/for_email/generic_email.html
index 915e16398..8246f93b6 100644
--- a/passbook/stages/email/templates/stages/email/for_email/generic_email.html
+++ b/passbook/stages/email/templates/stages/email/for_email/generic_email.html
@@ -1,4 +1,4 @@
-{% extends "email/base.html" %}
+{% extends "stages/email/for_email/base.html" %}
 
 {% block content %}
 <tr>
diff --git a/passbook/stages/email/templates/stages/email/for_email/password_reset.html b/passbook/stages/email/templates/stages/email/for_email/password_reset.html
index d43467958..c023c3087 100644
--- a/passbook/stages/email/templates/stages/email/for_email/password_reset.html
+++ b/passbook/stages/email/templates/stages/email/for_email/password_reset.html
@@ -23,7 +23,7 @@
           <table role="presentation" border="0" cellpadding="0" cellspacing="0">
             <tbody>
               <tr>
-                <td> <a href="{{ url }}" target="_blank">{% trans 'Reset Password' %}</a> </td>
+                <td> <a id="confirm" href="{{ url }}" rel="noopener noreferrer" target="_blank">{% trans 'Reset Password' %}</a> </td>
               </tr>
             </tbody>
           </table>
@@ -33,7 +33,7 @@
   </table>
   <p>
     {% blocktrans with expires=expires|naturaltime %}
-    If you did not request a password change, please ignore this E-Mail. The link above is valid for {{ expires }}.
+    If you did not request a password change, please ignore this Email. The link above is valid for {{ expires }}.
     {% endblocktrans %}
   </p>
 </td>
diff --git a/passbook/stages/email/templates/stages/email/waiting_message.html b/passbook/stages/email/templates/stages/email/waiting_message.html
index bebfb7317..5f1762624 100644
--- a/passbook/stages/email/templates/stages/email/waiting_message.html
+++ b/passbook/stages/email/templates/stages/email/waiting_message.html
@@ -7,7 +7,7 @@
 <form method="POST" class="pf-c-form">
     <p>
         {% blocktrans %}
-        Check your E-Mails for a password reset link.
+        Check your Emails for a password reset link.
         {% endblocktrans %}
     </p>
     {% csrf_token %}
@@ -15,7 +15,7 @@
     {% block beneath_form %}
     {% endblock %}
     <div class="pf-c-form__group pf-m-action">
-        <button class="pf-c-button pf-m-primary pf-m-block" type="submit">{% trans "Send Recovery E-Mail." %}</button>
+        <button class="pf-c-button pf-m-block" type="submit">{% trans "Send Email again." %}</button>
     </div>
 </form>
 {% endblock %}
diff --git a/passbook/stages/email/tests.py b/passbook/stages/email/tests.py
index 69fd683ac..657cd1258 100644
--- a/passbook/stages/email/tests.py
+++ b/passbook/stages/email/tests.py
@@ -4,8 +4,10 @@ from unittest.mock import MagicMock, patch
 from django.core import mail
 from django.shortcuts import reverse
 from django.test import Client, TestCase
+from django.utils.encoding import force_text
 
 from passbook.core.models import Token, User
+from passbook.flows.markers import StageMarker
 from passbook.flows.models import Flow, FlowDesignation, FlowStageBinding
 from passbook.flows.planner import PLAN_CONTEXT_PENDING_USER, FlowPlan
 from passbook.flows.views import SESSION_KEY_PLAN
@@ -33,7 +35,9 @@ class TestEmailStage(TestCase):
 
     def test_rendering(self):
         """Test with pending user"""
-        plan = FlowPlan(flow_pk=self.flow.pk.hex, stages=[self.stage])
+        plan = FlowPlan(
+            flow_pk=self.flow.pk.hex, stages=[self.stage], markers=[StageMarker()]
+        )
         plan.context[PLAN_CONTEXT_PENDING_USER] = self.user
         session = self.client.session
         session[SESSION_KEY_PLAN] = plan
@@ -45,9 +49,26 @@ class TestEmailStage(TestCase):
         response = self.client.get(url)
         self.assertEqual(response.status_code, 200)
 
+    def test_without_user(self):
+        """Test without pending user"""
+        plan = FlowPlan(
+            flow_pk=self.flow.pk.hex, stages=[self.stage], markers=[StageMarker()]
+        )
+        session = self.client.session
+        session[SESSION_KEY_PLAN] = plan
+        session.save()
+
+        url = reverse(
+            "passbook_flows:flow-executor", kwargs={"flow_slug": self.flow.slug}
+        )
+        response = self.client.get(url)
+        self.assertEqual(response.status_code, 200)
+
     def test_pending_user(self):
         """Test with pending user"""
-        plan = FlowPlan(flow_pk=self.flow.pk.hex, stages=[self.stage])
+        plan = FlowPlan(
+            flow_pk=self.flow.pk.hex, stages=[self.stage], markers=[StageMarker()]
+        )
         plan.context[PLAN_CONTEXT_PENDING_USER] = self.user
         session = self.client.session
         session[SESSION_KEY_PLAN] = plan
@@ -62,26 +83,40 @@ class TestEmailStage(TestCase):
             response = self.client.post(url)
             self.assertEqual(response.status_code, 200)
             self.assertEqual(len(mail.outbox), 1)
-            self.assertEqual(mail.outbox[0].subject, "passbook - Password Recovery")
+            self.assertEqual(mail.outbox[0].subject, "passbook")
 
     def test_token(self):
         """Test with token"""
         # Make sure token exists
         self.test_pending_user()
-        plan = FlowPlan(flow_pk=self.flow.pk.hex, stages=[self.stage])
+        plan = FlowPlan(
+            flow_pk=self.flow.pk.hex, stages=[self.stage], markers=[StageMarker()]
+        )
         session = self.client.session
         session[SESSION_KEY_PLAN] = plan
         session.save()
 
         with patch("passbook.flows.views.FlowExecutorView.cancel", MagicMock()):
+            # Call the executor shell to preseed the session
             url = reverse(
-                "passbook_flows:flow-executor", kwargs={"flow_slug": self.flow.slug}
+                "passbook_flows:flow-executor-shell",
+                kwargs={"flow_slug": self.flow.slug},
             )
             token = Token.objects.get(user=self.user)
             url += f"?{QS_KEY_TOKEN}={token.pk.hex}"
-            response = self.client.get(url)
-            self.assertEqual(response.status_code, 302)
-            self.assertEqual(response.url, reverse("passbook_core:overview"))
+            self.client.get(url)
+            # Call the actual executor to get the JSON Response
+            response = self.client.get(
+                reverse(
+                    "passbook_flows:flow-executor", kwargs={"flow_slug": self.flow.slug}
+                )
+            )
+
+            self.assertEqual(response.status_code, 200)
+            self.assertJSONEqual(
+                force_text(response.content),
+                {"type": "redirect", "to": reverse("passbook_core:overview")},
+            )
 
             session = self.client.session
             plan: FlowPlan = session[SESSION_KEY_PLAN]
diff --git a/passbook/stages/identification/forms.py b/passbook/stages/identification/forms.py
index 882ce0f03..faf8389e6 100644
--- a/passbook/stages/identification/forms.py
+++ b/passbook/stages/identification/forms.py
@@ -1,9 +1,11 @@
 """passbook flows identification forms"""
 from django import forms
+from django.contrib.admin.widgets import FilteredSelectMultiple
 from django.core.validators import validate_email
 from django.utils.translation import gettext_lazy as _
 from structlog import get_logger
 
+from passbook.flows.models import Flow, FlowDesignation
 from passbook.lib.utils.ui import human_list
 from passbook.stages.identification.models import IdentificationStage, UserFields
 
@@ -13,12 +15,24 @@ LOGGER = get_logger()
 class IdentificationStageForm(forms.ModelForm):
     """Form to create/edit IdentificationStage instances"""
 
+    def __init__(self, *args, **kwargs):
+        super().__init__(*args, **kwargs)
+        self.fields["enrollment_flow"].queryset = Flow.objects.filter(
+            designation=FlowDesignation.ENROLLMENT
+        )
+        self.fields["recovery_flow"].queryset = Flow.objects.filter(
+            designation=FlowDesignation.RECOVERY
+        )
+
     class Meta:
 
         model = IdentificationStage
         fields = ["name", "user_fields", "template", "enrollment_flow", "recovery_flow"]
         widgets = {
             "name": forms.TextInput(),
+            "user_fields": FilteredSelectMultiple(
+                _("fields"), False, choices=UserFields.choices
+            ),
         }
 
 
@@ -35,8 +49,16 @@ class IdentificationForm(forms.Form):
         super().__init__(*args, **kwargs)
         if self.stage.user_fields == [UserFields.E_MAIL]:
             self.fields["uid_field"] = forms.EmailField()
-        self.fields["uid_field"].label = human_list(
-            [x.title() for x in self.stage.user_fields]
+        label = human_list([x.title() for x in self.stage.user_fields])
+        self.fields["uid_field"].label = label
+        self.fields["uid_field"].widget.attrs.update(
+            {
+                "placeholder": _(label),
+                "autofocus": "autofocus",
+                # Autocomplete according to
+                # https://www.chromium.org/developers/design-documents/form-styles-that-chromium-understands
+                "autocomplete": "username",
+            }
         )
 
     def clean_uid_field(self):
diff --git a/passbook/stages/identification/migrations/0003_auto_20200615_1641.py b/passbook/stages/identification/migrations/0003_auto_20200615_1641.py
new file mode 100644
index 000000000..a6451a360
--- /dev/null
+++ b/passbook/stages/identification/migrations/0003_auto_20200615_1641.py
@@ -0,0 +1,28 @@
+# Generated by Django 3.0.7 on 2020-06-15 16:41
+
+import django.db.models.deletion
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("passbook_flows", "0005_provider_flows"),
+        ("passbook_stages_identification", "0002_auto_20200530_2204"),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name="identificationstage",
+            name="recovery_flow",
+            field=models.ForeignKey(
+                blank=True,
+                default=None,
+                help_text="Optional recovery flow, which is linked at the bottom of the page.",
+                null=True,
+                on_delete=django.db.models.deletion.SET_DEFAULT,
+                related_name="+",
+                to="passbook_flows.Flow",
+            ),
+        ),
+    ]
diff --git a/passbook/stages/identification/models.py b/passbook/stages/identification/models.py
index 94bf0ec48..bc5c4cecc 100644
--- a/passbook/stages/identification/models.py
+++ b/passbook/stages/identification/models.py
@@ -21,7 +21,7 @@ class Templates(models.TextChoices):
 
 
 class IdentificationStage(Stage):
-    """Identification stage, allows a user to identify themselves to authenticate."""
+    """Allows the user to identify themselves for authentication."""
 
     user_fields = ArrayField(
         models.CharField(max_length=100, choices=UserFields.choices),
@@ -48,7 +48,7 @@ class IdentificationStage(Stage):
         related_name="+",
         default=None,
         help_text=_(
-            "Optional enrollment flow, which is linked at the bottom of the page."
+            "Optional recovery flow, which is linked at the bottom of the page."
         ),
     )
 
diff --git a/passbook/stages/identification/stage.py b/passbook/stages/identification/stage.py
index 38189bf1b..bc3375843 100644
--- a/passbook/stages/identification/stage.py
+++ b/passbook/stages/identification/stage.py
@@ -49,7 +49,7 @@ class IdentificationStageView(FormView, StageView):
 
         # Check all enabled source, add them if they have a UI Login button.
         kwargs["sources"] = []
-        sources = (
+        sources: List[Source] = (
             Source.objects.filter(enabled=True).order_by("name").select_subclasses()
         )
         for source in sources:
diff --git a/passbook/stages/identification/templates/stages/identification/login.html b/passbook/stages/identification/templates/stages/identification/login.html
index d95ebd675..95079ae13 100644
--- a/passbook/stages/identification/templates/stages/identification/login.html
+++ b/passbook/stages/identification/templates/stages/identification/login.html
@@ -43,12 +43,12 @@
         {% if enroll_url %}
         <p class="pf-c-login__main-footer-band-item">
             {% trans 'Need an account?' %}
-            <a href="{{ enroll_url }}">{% trans 'Sign up.' %}</a>
+            <a role="enroll" href="{{ enroll_url }}">{% trans 'Sign up.' %}</a>
         </p>
         {% endif %}
         {% if recovery_url %}
         <p class="pf-c-login__main-footer-band-item">
-            <a href="{{ recovery_url }}">{% trans 'Forgot username or password?' %}</a>
+            <a role="recovery" href="{{ recovery_url }}">{% trans 'Forgot username or password?' %}</a>
         </p>
         {% endif %}
     </div>
diff --git a/passbook/stages/identification/tests.py b/passbook/stages/identification/tests.py
index fa8c3919d..37eb67c51 100644
--- a/passbook/stages/identification/tests.py
+++ b/passbook/stages/identification/tests.py
@@ -1,6 +1,7 @@
 """identification tests"""
 from django.shortcuts import reverse
 from django.test import Client, TestCase
+from django.utils.encoding import force_text
 
 from passbook.core.models import User
 from passbook.flows.models import Flow, FlowDesignation, FlowStageBinding
@@ -53,11 +54,14 @@ class TestIdentificationStage(TestCase):
             "passbook_flows:flow-executor", kwargs={"flow_slug": self.flow.slug}
         )
         response = self.client.post(url, form_data)
-        self.assertEqual(response.status_code, 302)
-        self.assertEqual(response.url, reverse("passbook_core:overview"))
+        self.assertEqual(response.status_code, 200)
+        self.assertJSONEqual(
+            force_text(response.content),
+            {"type": "redirect", "to": reverse("passbook_core:overview")},
+        )
 
     def test_invalid_with_username(self):
-        """Test invalid with username (user exists but stage only allows e-mail)"""
+        """Test invalid with username (user exists but stage only allows email)"""
         form_data = {"uid_field": self.user.username}
         response = self.client.post(
             reverse(
@@ -68,7 +72,7 @@ class TestIdentificationStage(TestCase):
         self.assertEqual(response.status_code, 200)
 
     def test_invalid_with_invalid_email(self):
-        """Test with invalid e-mail (user doesn't exist) -> Will return to login form"""
+        """Test with invalid email (user doesn't exist) -> Will return to login form"""
         form_data = {"uid_field": self.user.email + "test"}
         response = self.client.post(
             reverse(
@@ -97,7 +101,7 @@ class TestIdentificationStage(TestCase):
             ),
         )
         self.assertEqual(response.status_code, 200)
-        self.assertIn(flow.slug, response.rendered_content)
+        self.assertIn(flow.slug, force_text(response.content))
 
     def test_recovery_flow(self):
         """Test that recovery flow is linked correctly"""
@@ -118,4 +122,4 @@ class TestIdentificationStage(TestCase):
             ),
         )
         self.assertEqual(response.status_code, 200)
-        self.assertIn(flow.slug, response.rendered_content)
+        self.assertIn(flow.slug, force_text(response.content))
diff --git a/passbook/stages/invitation/models.py b/passbook/stages/invitation/models.py
index 8974440c5..5b9024aec 100644
--- a/passbook/stages/invitation/models.py
+++ b/passbook/stages/invitation/models.py
@@ -10,7 +10,8 @@ from passbook.flows.models import Stage
 
 
 class InvitationStage(Stage):
-    """Invitation stage, to enroll themselves with enforced parameters"""
+    """Simplify enrollment; allow users to use a single
+    link to create their user with pre-defined parameters."""
 
     continue_flow_without_invitation = models.BooleanField(
         default=False,
diff --git a/passbook/stages/invitation/stage.py b/passbook/stages/invitation/stage.py
index 2ec3a5de7..be1582775 100644
--- a/passbook/stages/invitation/stage.py
+++ b/passbook/stages/invitation/stage.py
@@ -7,6 +7,7 @@ from passbook.stages.invitation.models import Invitation, InvitationStage
 from passbook.stages.prompt.stage import PLAN_CONTEXT_PROMPT
 
 INVITATION_TOKEN_KEY = "token"
+INVITATION_IN_EFFECT = "invitation_in_effect"
 
 
 class InvitationStageView(StageView):
@@ -23,4 +24,5 @@ class InvitationStageView(StageView):
         token = request.GET[INVITATION_TOKEN_KEY]
         invite: Invitation = get_object_or_404(Invitation, pk=token)
         self.executor.plan.context[PLAN_CONTEXT_PROMPT] = invite.fixed_data
+        self.executor.plan.context[INVITATION_IN_EFFECT] = True
         return self.executor.stage_ok()
diff --git a/passbook/stages/invitation/tests.py b/passbook/stages/invitation/tests.py
index 5998d26ac..f47ddc766 100644
--- a/passbook/stages/invitation/tests.py
+++ b/passbook/stages/invitation/tests.py
@@ -3,9 +3,11 @@ from unittest.mock import MagicMock, patch
 
 from django.shortcuts import reverse
 from django.test import Client, TestCase
+from django.utils.encoding import force_text
 from guardian.shortcuts import get_anonymous_user
 
 from passbook.core.models import User
+from passbook.flows.markers import StageMarker
 from passbook.flows.models import Flow, FlowDesignation, FlowStageBinding
 from passbook.flows.planner import PLAN_CONTEXT_PENDING_USER, FlowPlan
 from passbook.flows.views import SESSION_KEY_PLAN
@@ -38,7 +40,9 @@ class TestUserLoginStage(TestCase):
 
     def test_without_invitation_fail(self):
         """Test without any invitation, continue_flow_without_invitation not set."""
-        plan = FlowPlan(flow_pk=self.flow.pk.hex, stages=[self.stage])
+        plan = FlowPlan(
+            flow_pk=self.flow.pk.hex, stages=[self.stage], markers=[StageMarker()]
+        )
         plan.context[PLAN_CONTEXT_PENDING_USER] = self.user
         plan.context[
             PLAN_CONTEXT_AUTHENTICATION_BACKEND
@@ -52,14 +56,20 @@ class TestUserLoginStage(TestCase):
                 "passbook_flows:flow-executor", kwargs={"flow_slug": self.flow.slug}
             )
         )
-        self.assertEqual(response.status_code, 302)
-        self.assertEqual(response.url, reverse("passbook_flows:denied"))
+
+        self.assertEqual(response.status_code, 200)
+        self.assertJSONEqual(
+            force_text(response.content),
+            {"type": "redirect", "to": reverse("passbook_flows:denied")},
+        )
 
     def test_without_invitation_continue(self):
         """Test without any invitation, continue_flow_without_invitation is set."""
         self.stage.continue_flow_without_invitation = True
         self.stage.save()
-        plan = FlowPlan(flow_pk=self.flow.pk.hex, stages=[self.stage])
+        plan = FlowPlan(
+            flow_pk=self.flow.pk.hex, stages=[self.stage], markers=[StageMarker()]
+        )
         plan.context[PLAN_CONTEXT_PENDING_USER] = self.user
         plan.context[
             PLAN_CONTEXT_AUTHENTICATION_BACKEND
@@ -73,14 +83,21 @@ class TestUserLoginStage(TestCase):
                 "passbook_flows:flow-executor", kwargs={"flow_slug": self.flow.slug}
             )
         )
-        self.assertEqual(response.status_code, 302)
-        self.assertEqual(response.url, reverse("passbook_core:overview"))
+
+        self.assertEqual(response.status_code, 200)
+        self.assertJSONEqual(
+            force_text(response.content),
+            {"type": "redirect", "to": reverse("passbook_core:overview")},
+        )
+
         self.stage.continue_flow_without_invitation = False
         self.stage.save()
 
     def test_with_invitation(self):
         """Test with invitation, check data in session"""
-        plan = FlowPlan(flow_pk=self.flow.pk.hex, stages=[self.stage])
+        plan = FlowPlan(
+            flow_pk=self.flow.pk.hex, stages=[self.stage], markers=[StageMarker()]
+        )
         plan.context[PLAN_CONTEXT_PENDING_USER] = self.user
         plan.context[
             PLAN_CONTEXT_AUTHENTICATION_BACKEND
@@ -106,5 +123,8 @@ class TestUserLoginStage(TestCase):
         plan: FlowPlan = session[SESSION_KEY_PLAN]
         self.assertEqual(plan.context[PLAN_CONTEXT_PROMPT], data)
 
-        self.assertEqual(response.status_code, 302)
-        self.assertEqual(response.url, reverse("passbook_core:overview"))
+        self.assertEqual(response.status_code, 200)
+        self.assertJSONEqual(
+            force_text(response.content),
+            {"type": "redirect", "to": reverse("passbook_core:overview")},
+        )
diff --git a/passbook/stages/otp/api.py b/passbook/stages/otp/api.py
deleted file mode 100644
index 9378a4cb0..000000000
--- a/passbook/stages/otp/api.py
+++ /dev/null
@@ -1,21 +0,0 @@
-"""OTPStage API Views"""
-from rest_framework.serializers import ModelSerializer
-from rest_framework.viewsets import ModelViewSet
-
-from passbook.stages.otp.models import OTPStage
-
-
-class OTPStageSerializer(ModelSerializer):
-    """OTPStage Serializer"""
-
-    class Meta:
-
-        model = OTPStage
-        fields = ["pk", "name", "enforced"]
-
-
-class OTPStageViewSet(ModelViewSet):
-    """OTPStage Viewset"""
-
-    queryset = OTPStage.objects.all()
-    serializer_class = OTPStageSerializer
diff --git a/passbook/stages/otp/apps.py b/passbook/stages/otp/apps.py
deleted file mode 100644
index 88b5ce441..000000000
--- a/passbook/stages/otp/apps.py
+++ /dev/null
@@ -1,12 +0,0 @@
-"""passbook OTP AppConfig"""
-
-from django.apps.config import AppConfig
-
-
-class PassbookStageOTPConfig(AppConfig):
-    """passbook OTP AppConfig"""
-
-    name = "passbook.stages.otp"
-    label = "passbook_stages_otp"
-    verbose_name = "passbook Stages.OTP"
-    mountpoint = "user/otp/"
diff --git a/passbook/stages/otp/forms.py b/passbook/stages/otp/forms.py
deleted file mode 100644
index 0033667cf..000000000
--- a/passbook/stages/otp/forms.py
+++ /dev/null
@@ -1,78 +0,0 @@
-"""passbook OTP Forms"""
-
-from django import forms
-from django.core.validators import RegexValidator
-from django.utils.safestring import mark_safe
-from django.utils.translation import gettext_lazy as _
-from django_otp.models import Device
-
-from passbook.stages.otp.models import OTPStage
-
-OTP_CODE_VALIDATOR = RegexValidator(
-    r"^[0-9a-z]{6,8}$", _("Only alpha-numeric characters are allowed.")
-)
-
-
-class PictureWidget(forms.widgets.Widget):
-    """Widget to render value as img-tag"""
-
-    def render(self, name, value, attrs=None, renderer=None):
-        return mark_safe(f'<img src="{value}" />')  # nosec
-
-
-class OTPVerifyForm(forms.Form):
-    """Simple Form to verify OTP Code"""
-
-    order = ["code"]
-
-    code = forms.CharField(
-        label=_("Code"),
-        validators=[OTP_CODE_VALIDATOR],
-        widget=forms.TextInput(attrs={"autocomplete": "off", "placeholder": "Code"}),
-    )
-
-    def __init__(self, *args, **kwargs):
-        super().__init__(*args, **kwargs)
-        # This is a little helper so the field is focused by default
-        self.fields["code"].widget.attrs.update(
-            {"autofocus": "autofocus", "autocomplete": "off"}
-        )
-
-
-class OTPSetupForm(forms.Form):
-    """OTP Setup form"""
-
-    title = _("Set up OTP")
-    device: Device = None
-    qr_code = forms.CharField(
-        widget=PictureWidget,
-        disabled=True,
-        required=False,
-        label=_("Scan this Code with your OTP App."),
-    )
-    code = forms.CharField(
-        label=_("Code"),
-        validators=[OTP_CODE_VALIDATOR],
-        widget=forms.TextInput(attrs={"placeholder": _("One-Time Password")}),
-    )
-
-    tokens = forms.MultipleChoiceField(disabled=True, required=False)
-
-    def clean_code(self):
-        """Check code with new otp device"""
-        if self.device is not None:
-            if not self.device.verify_token(int(self.cleaned_data.get("code"))):
-                raise forms.ValidationError(_("OTP Code does not match"))
-        return self.cleaned_data.get("code")
-
-
-class OTPStageForm(forms.ModelForm):
-    """Form to edit OTPStage instances"""
-
-    class Meta:
-
-        model = OTPStage
-        fields = ["name", "enforced"]
-        widgets = {
-            "name": forms.TextInput(),
-        }
diff --git a/passbook/stages/otp/models.py b/passbook/stages/otp/models.py
deleted file mode 100644
index f0a6e1c88..000000000
--- a/passbook/stages/otp/models.py
+++ /dev/null
@@ -1,34 +0,0 @@
-"""OTP Stage"""
-from django.db import models
-from django.utils.translation import gettext as _
-
-from passbook.core.types import UIUserSettings
-from passbook.flows.models import Stage
-
-
-class OTPStage(Stage):
-    """OTP Stage"""
-
-    enforced = models.BooleanField(
-        default=False,
-        help_text=("Enforce enabled OTP for Users " "this stage applies to."),
-    )
-
-    type = "passbook.stages.otp.stages.OTPStage"
-    form = "passbook.stages.otp.forms.OTPStageForm"
-
-    @property
-    def ui_user_settings(self) -> UIUserSettings:
-        return UIUserSettings(
-            name="OTP",
-            icon="pficon-locked",
-            view_name="passbook_stages_otp:otp-user-settings",
-        )
-
-    def __str__(self):
-        return f"OTP Stage {self.name}"
-
-    class Meta:
-
-        verbose_name = _("OTP Stage")
-        verbose_name_plural = _("OTP Stages")
diff --git a/passbook/stages/otp/settings.py b/passbook/stages/otp/settings.py
deleted file mode 100644
index 6bd9d8f83..000000000
--- a/passbook/stages/otp/settings.py
+++ /dev/null
@@ -1,10 +0,0 @@
-"""passbook OTP Settings"""
-
-MIDDLEWARE = [
-    "django_otp.middleware.OTPMiddleware",
-]
-INSTALLED_APPS = [
-    "django_otp",
-    "django_otp.plugins.otp_static",
-    "django_otp.plugins.otp_totp",
-]
diff --git a/passbook/stages/otp/stage.py b/passbook/stages/otp/stage.py
deleted file mode 100644
index 7d303a9c1..000000000
--- a/passbook/stages/otp/stage.py
+++ /dev/null
@@ -1,59 +0,0 @@
-"""OTP Stage logic"""
-from django.contrib import messages
-from django.utils.translation import gettext as _
-from django.views.generic import FormView
-from django_otp import match_token, user_has_device
-from structlog import get_logger
-
-from passbook.flows.planner import PLAN_CONTEXT_PENDING_USER
-from passbook.flows.stage import StageView
-from passbook.stages.otp.forms import OTPVerifyForm
-from passbook.stages.otp.views import OTP_SETTING_UP_KEY, EnableView
-
-LOGGER = get_logger()
-
-
-class OTPStage(FormView, StageView):
-    """OTP Stage View"""
-
-    template_name = "stages/otp/stage.html"
-    form_class = OTPVerifyForm
-
-    def get_context_data(self, **kwargs):
-        kwargs = super().get_context_data(**kwargs)
-        kwargs["title"] = _("Enter Verification Code")
-        return kwargs
-
-    def get(self, request, *args, **kwargs):
-        """Check if User has OTP enabled and if OTP is enforced"""
-        pending_user = self.executor.plan.context[PLAN_CONTEXT_PENDING_USER]
-        if not user_has_device(pending_user):
-            LOGGER.debug("User doesn't have OTP Setup.")
-            if self.executor.current_stage.enforced:
-                # Redirect to setup view
-                LOGGER.debug("OTP is enforced, redirecting to setup")
-                request.user = pending_user
-                messages.info(request, _("OTP is enforced. Please setup OTP."))
-                return EnableView.as_view()(request)
-            LOGGER.debug("OTP is not enforced, skipping form")
-            return self.executor.user_ok()
-        return super().get(request, *args, **kwargs)
-
-    def post(self, request, *args, **kwargs):
-        """Check if setup is in progress and redirect to EnableView"""
-        if OTP_SETTING_UP_KEY in request.session:
-            LOGGER.debug("Passing POST to EnableView")
-            request.user = self.executor.plan.context[PLAN_CONTEXT_PENDING_USER]
-            return EnableView.as_view()(request)
-        return super().post(self, request, *args, **kwargs)
-
-    def form_valid(self, form: OTPVerifyForm):
-        """Verify OTP Token"""
-        device = match_token(
-            self.executor.plan.context[PLAN_CONTEXT_PENDING_USER],
-            form.cleaned_data.get("code"),
-        )
-        if device:
-            return self.executor.stage_ok()
-        messages.error(self.request, _("Invalid OTP."))
-        return self.form_invalid(form)
diff --git a/passbook/stages/otp/templates/stages/otp/factor.html b/passbook/stages/otp/templates/stages/otp/factor.html
deleted file mode 100644
index c95f13cbe..000000000
--- a/passbook/stages/otp/templates/stages/otp/factor.html
+++ /dev/null
@@ -1,8 +0,0 @@
-{% extends 'login/form_with_user.html' %}
-
-{% load i18n %}
-
-{% block above_form %}
-{{ block.super }}
-<p><b>{% trans 'Enter the Verification Code from your Authenticator App.' %}</b></p>
-{% endblock %}
diff --git a/passbook/stages/otp/urls.py b/passbook/stages/otp/urls.py
deleted file mode 100644
index 012ff2923..000000000
--- a/passbook/stages/otp/urls.py
+++ /dev/null
@@ -1,12 +0,0 @@
-"""passbook OTP Urls"""
-
-from django.urls import path
-
-from passbook.stages.otp import views
-
-urlpatterns = [
-    path("", views.UserSettingsView.as_view(), name="otp-user-settings"),
-    path("qr/", views.QRView.as_view(), name="otp-qr"),
-    path("enable/", views.EnableView.as_view(), name="otp-enable"),
-    path("disable/", views.DisableView.as_view(), name="otp-disable"),
-]
diff --git a/passbook/stages/otp/utils.py b/passbook/stages/otp/utils.py
deleted file mode 100644
index 978803747..000000000
--- a/passbook/stages/otp/utils.py
+++ /dev/null
@@ -1,17 +0,0 @@
-"""passbook OTP Utils"""
-
-from django.utils.http import urlencode
-
-
-def otpauth_url(accountname, secret, issuer=None, digits=6):
-    """Create otpauth according to
-    https://github.com/google/google-authenticator/wiki/Key-Uri-Format"""
-    # Ensure that the secret parameter is the FIRST parameter of the URI, this
-    # allows Microsoft Authenticator to work.
-    query = [
-        ("secret", secret),
-        ("digits", digits),
-        ("issuer", "passbook"),
-    ]
-
-    return "otpauth://totp/%s:%s?%s" % (issuer, accountname, urlencode(query))
diff --git a/passbook/stages/otp/views.py b/passbook/stages/otp/views.py
deleted file mode 100644
index e933bedec..000000000
--- a/passbook/stages/otp/views.py
+++ /dev/null
@@ -1,166 +0,0 @@
-"""passbook OTP Views"""
-from base64 import b32encode
-from binascii import unhexlify
-
-from django.contrib import messages
-from django.contrib.auth.mixins import LoginRequiredMixin
-from django.http import Http404, HttpRequest, HttpResponse
-from django.shortcuts import get_object_or_404, redirect
-from django.urls import reverse
-from django.utils.decorators import method_decorator
-from django.utils.translation import ugettext as _
-from django.views import View
-from django.views.decorators.cache import never_cache
-from django.views.generic import FormView, TemplateView
-from django_otp.plugins.otp_static.models import StaticDevice, StaticToken
-from django_otp.plugins.otp_totp.models import TOTPDevice
-from qrcode import make
-from qrcode.image.svg import SvgPathImage
-from structlog import get_logger
-
-from passbook.audit.models import Event, EventAction
-from passbook.lib.config import CONFIG
-from passbook.stages.otp.forms import OTPSetupForm
-from passbook.stages.otp.utils import otpauth_url
-
-OTP_SESSION_KEY = "passbook_stages_otp_key"
-OTP_SETTING_UP_KEY = "passbook_stages_otp_setup"
-LOGGER = get_logger()
-
-
-class UserSettingsView(LoginRequiredMixin, TemplateView):
-    """View for user settings to control OTP"""
-
-    template_name = "stages/otp/user_settings.html"
-
-    # TODO: Check if OTP Stage exists and applies to user
-    def get_context_data(self, **kwargs):
-        kwargs = super().get_context_data(**kwargs)
-        static = StaticDevice.objects.filter(user=self.request.user, confirmed=True)
-        if static.exists():
-            kwargs["static_tokens"] = StaticToken.objects.filter(
-                device=static.first()
-            ).order_by("token")
-        totp_devices = TOTPDevice.objects.filter(user=self.request.user, confirmed=True)
-        kwargs["state"] = totp_devices.exists() and static.exists()
-        return kwargs
-
-
-class DisableView(LoginRequiredMixin, View):
-    """Disable TOTP for user"""
-
-    def get(self, request: HttpRequest) -> HttpResponse:
-        """Delete all the devices for user"""
-        static = get_object_or_404(StaticDevice, user=request.user, confirmed=True)
-        static_tokens = StaticToken.objects.filter(device=static).order_by("token")
-        totp = TOTPDevice.objects.filter(user=request.user, confirmed=True)
-        static.delete()
-        totp.delete()
-        for token in static_tokens:
-            token.delete()
-        messages.success(request, "Successfully disabled OTP")
-        # Create event with email notification
-        Event.new(EventAction.CUSTOM, message="User disabled OTP.").from_http(request)
-        return redirect(reverse("passbook_stages_otp:otp-user-settings"))
-
-
-class EnableView(LoginRequiredMixin, FormView):
-    """View to set up OTP"""
-
-    title = _("Set up OTP")
-    form_class = OTPSetupForm
-    template_name = "login/form.html"
-
-    totp_device = None
-    static_device = None
-
-    # TODO: Check if OTP Stage exists and applies to user
-    def get_context_data(self, **kwargs):
-        kwargs["config"] = CONFIG.y("passbook")
-        kwargs["title"] = _("Configure OTP")
-        kwargs["primary_action"] = _("Setup")
-        return super().get_context_data(**kwargs)
-
-    def dispatch(self, request: HttpRequest, *args, **kwargs) -> HttpResponse:
-        # Check if user has TOTP setup already
-        finished_totp_devices = TOTPDevice.objects.filter(
-            user=request.user, confirmed=True
-        )
-        finished_static_devices = StaticDevice.objects.filter(
-            user=request.user, confirmed=True
-        )
-        if finished_totp_devices.exists() and finished_static_devices.exists():
-            messages.error(request, _("You already have TOTP enabled!"))
-            del request.session[OTP_SETTING_UP_KEY]
-            return redirect("passbook_stages_otp:otp-user-settings")
-        request.session[OTP_SETTING_UP_KEY] = True
-        # Check if there's an unconfirmed device left to set up
-        totp_devices = TOTPDevice.objects.filter(user=request.user, confirmed=False)
-        if not totp_devices.exists():
-            # Create new TOTPDevice and save it, but not confirm it
-            self.totp_device = TOTPDevice(user=request.user, confirmed=False)
-            self.totp_device.save()
-        else:
-            self.totp_device = totp_devices.first()
-
-        # Check if we have a static device already
-        static_devices = StaticDevice.objects.filter(user=request.user, confirmed=False)
-        if not static_devices.exists():
-            # Create new static device and some codes
-            self.static_device = StaticDevice(user=request.user, confirmed=False)
-            self.static_device.save()
-            # Create 9 tokens and save them
-            # TODO: Send static tokens via E-Mail
-            for _counter in range(0, 9):
-                token = StaticToken(
-                    device=self.static_device, token=StaticToken.random_token()
-                )
-                token.save()
-        else:
-            self.static_device = static_devices.first()
-
-        # Somehow convert the generated key to base32 for the QR code
-        rawkey = unhexlify(self.totp_device.key.encode("ascii"))
-        request.session[OTP_SESSION_KEY] = b32encode(rawkey).decode("utf-8")
-        return super().dispatch(request, *args, **kwargs)
-
-    def get_form(self, form_class=None):
-        form = super().get_form(form_class=form_class)
-        form.device = self.totp_device
-        form.fields["qr_code"].initial = reverse("passbook_stages_otp:otp-qr")
-        tokens = [(x.token, x.token) for x in self.static_device.token_set.all()]
-        form.fields["tokens"].choices = tokens
-        return form
-
-    def form_valid(self, form):
-        # Save device as confirmed
-        LOGGER.debug("Saved OTP Devices")
-        self.totp_device.confirmed = True
-        self.totp_device.save()
-        self.static_device.confirmed = True
-        self.static_device.save()
-        del self.request.session[OTP_SETTING_UP_KEY]
-        Event.new(EventAction.CUSTOM, message="User enabled OTP.").from_http(
-            self.request
-        )
-        return redirect("passbook_stages_otp:otp-user-settings")
-
-
-@method_decorator(never_cache, name="dispatch")
-class QRView(View):
-    """View returns an SVG image with the OTP token information"""
-
-    def get(self, request: HttpRequest) -> HttpResponse:
-        """View returns an SVG image with the OTP token information"""
-        # Get the data from the session
-        try:
-            key = request.session[OTP_SESSION_KEY]
-        except KeyError:
-            raise Http404
-
-        url = otpauth_url(accountname=request.user.username, secret=key)
-        # Make and return QR code
-        img = make(url, image_factory=SvgPathImage)
-        resp = HttpResponse(content_type="image/svg+xml; charset=utf-8")
-        img.save(resp)
-        return resp
diff --git a/passbook/providers/samlv2/models.py b/passbook/stages/otp_static/__init__.py
similarity index 100%
rename from passbook/providers/samlv2/models.py
rename to passbook/stages/otp_static/__init__.py
diff --git a/passbook/stages/otp_static/api.py b/passbook/stages/otp_static/api.py
new file mode 100644
index 000000000..fa706cb75
--- /dev/null
+++ b/passbook/stages/otp_static/api.py
@@ -0,0 +1,21 @@
+"""OTPStaticStage API Views"""
+from rest_framework.serializers import ModelSerializer
+from rest_framework.viewsets import ModelViewSet
+
+from passbook.stages.otp_static.models import OTPStaticStage
+
+
+class OTPStaticStageSerializer(ModelSerializer):
+    """OTPStaticStage Serializer"""
+
+    class Meta:
+
+        model = OTPStaticStage
+        fields = ["pk", "name", "token_count"]
+
+
+class OTPStaticStageViewSet(ModelViewSet):
+    """OTPStaticStage Viewset"""
+
+    queryset = OTPStaticStage.objects.all()
+    serializer_class = OTPStaticStageSerializer
diff --git a/passbook/stages/otp_static/apps.py b/passbook/stages/otp_static/apps.py
new file mode 100644
index 000000000..2bd71c7d6
--- /dev/null
+++ b/passbook/stages/otp_static/apps.py
@@ -0,0 +1,11 @@
+"""OTP Static stage"""
+from django.apps import AppConfig
+
+
+class PassbookStageOTPStaticConfig(AppConfig):
+    """OTP Static stage"""
+
+    name = "passbook.stages.otp_static"
+    label = "passbook_stages_otp_static"
+    verbose_name = "passbook OTP.Static"
+    mountpoint = "-/user/otp/static/"
diff --git a/passbook/stages/otp_static/forms.py b/passbook/stages/otp_static/forms.py
new file mode 100644
index 000000000..637f87770
--- /dev/null
+++ b/passbook/stages/otp_static/forms.py
@@ -0,0 +1,39 @@
+"""OTP Static forms"""
+from django import forms
+from django.utils.safestring import mark_safe
+
+from passbook.stages.otp_static.models import OTPStaticStage
+
+
+class StaticTokenWidget(forms.widgets.Widget):
+    """Widget to render tokens as multiple labels"""
+
+    def render(self, name, value, attrs=None, renderer=None):
+        final_string = '<ul class="pb-otp-tokens">'
+        for token in value:
+            final_string += f"<li>{token.token}</li>"
+        final_string += "</ul>"
+        return mark_safe(final_string)  # nosec
+
+
+class SetupForm(forms.Form):
+    """Form to setup Static OTP"""
+
+    tokens = forms.CharField(widget=StaticTokenWidget, disabled=True, required=False)
+
+    def __init__(self, tokens, *args, **kwargs):
+        super().__init__(*args, **kwargs)
+        self.fields["tokens"].initial = tokens
+
+
+class OTPStaticStageForm(forms.ModelForm):
+    """OTP Static Stage setup form"""
+
+    class Meta:
+
+        model = OTPStaticStage
+        fields = ["name", "token_count"]
+
+        widgets = {
+            "name": forms.TextInput(),
+        }
diff --git a/passbook/stages/otp_static/migrations/0001_initial.py b/passbook/stages/otp_static/migrations/0001_initial.py
new file mode 100644
index 000000000..93c26b3e5
--- /dev/null
+++ b/passbook/stages/otp_static/migrations/0001_initial.py
@@ -0,0 +1,38 @@
+# Generated by Django 3.0.7 on 2020-06-30 11:43
+
+import django.db.models.deletion
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    initial = True
+
+    dependencies = [
+        ("passbook_flows", "0006_auto_20200629_0857"),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name="OTPStaticStage",
+            fields=[
+                (
+                    "stage_ptr",
+                    models.OneToOneField(
+                        auto_created=True,
+                        on_delete=django.db.models.deletion.CASCADE,
+                        parent_link=True,
+                        primary_key=True,
+                        serialize=False,
+                        to="passbook_flows.Stage",
+                    ),
+                ),
+                ("token_count", models.IntegerField(default=6)),
+            ],
+            options={
+                "verbose_name": "OTP Static Setup Stage",
+                "verbose_name_plural": "OTP Static Setup Stages",
+            },
+            bases=("passbook_flows.stage",),
+        ),
+    ]
diff --git a/passbook/stages/otp_static/migrations/__init__.py b/passbook/stages/otp_static/migrations/__init__.py
new file mode 100644
index 000000000..e69de29bb
diff --git a/passbook/stages/otp_static/models.py b/passbook/stages/otp_static/models.py
new file mode 100644
index 000000000..0d6b9a7a0
--- /dev/null
+++ b/passbook/stages/otp_static/models.py
@@ -0,0 +1,32 @@
+"""OTP Static models"""
+from typing import Optional
+
+from django.db import models
+from django.shortcuts import reverse
+from django.utils.translation import gettext_lazy as _
+
+from passbook.core.types import UIUserSettings
+from passbook.flows.models import Stage
+
+
+class OTPStaticStage(Stage):
+    """Generate static tokens for the user as a backup."""
+
+    token_count = models.IntegerField(default=6)
+
+    type = "passbook.stages.otp_static.stage.OTPStaticStageView"
+    form = "passbook.stages.otp_static.forms.OTPStaticStageForm"
+
+    @property
+    def ui_user_settings(self) -> Optional[UIUserSettings]:
+        return UIUserSettings(
+            name="Static OTP", url=reverse("passbook_stages_otp_static:user-settings"),
+        )
+
+    def __str__(self) -> str:
+        return f"OTP Static Stage {self.name}"
+
+    class Meta:
+
+        verbose_name = _("OTP Static Setup Stage")
+        verbose_name_plural = _("OTP Static Setup Stages")
diff --git a/passbook/stages/otp_static/settings.py b/passbook/stages/otp_static/settings.py
new file mode 100644
index 000000000..9c3cc4952
--- /dev/null
+++ b/passbook/stages/otp_static/settings.py
@@ -0,0 +1,5 @@
+"""OTP Static settings"""
+
+INSTALLED_APPS = [
+    "django_otp.plugins.otp_static",
+]
diff --git a/passbook/stages/otp_static/stage.py b/passbook/stages/otp_static/stage.py
new file mode 100644
index 000000000..a37de0dfb
--- /dev/null
+++ b/passbook/stages/otp_static/stage.py
@@ -0,0 +1,62 @@
+"""Static OTP Setup stage"""
+from typing import Any, Dict
+
+from django.http import HttpRequest, HttpResponse
+from django.views.generic import FormView
+from django_otp.plugins.otp_static.models import StaticDevice, StaticToken
+from structlog import get_logger
+
+from passbook.flows.planner import PLAN_CONTEXT_PENDING_USER
+from passbook.flows.stage import StageView
+from passbook.stages.otp_static.forms import SetupForm
+from passbook.stages.otp_static.models import OTPStaticStage
+
+LOGGER = get_logger()
+SESSION_STATIC_DEVICE = "static_device"
+SESSION_STATIC_TOKENS = "static_device_tokens"
+
+
+class OTPStaticStageView(FormView, StageView):
+    """Static OTP Setup stage"""
+
+    form_class = SetupForm
+
+    def get_form_kwargs(self, **kwargs) -> Dict[str, Any]:
+        kwargs = super().get_form_kwargs(**kwargs)
+        tokens = self.request.session[SESSION_STATIC_TOKENS]
+        kwargs["tokens"] = tokens
+        return kwargs
+
+    def get(self, request: HttpRequest, *args, **kwargs) -> HttpResponse:
+        user = self.executor.plan.context.get(PLAN_CONTEXT_PENDING_USER)
+        if not user:
+            LOGGER.debug("No pending user, continuing")
+            return self.executor.stage_ok()
+
+        # Currently, this stage only supports one device per user. If the user already
+        # has a device, just skip to the next stage
+        if StaticDevice.objects.filter(user=user).exists():
+            return self.executor.stage_ok()
+
+        stage: OTPStaticStage = self.executor.current_stage
+
+        if SESSION_STATIC_DEVICE not in self.request.session:
+            device = StaticDevice(user=user, confirmed=True)
+            tokens = []
+            for _ in range(0, stage.token_count):
+                tokens.append(
+                    StaticToken(device=device, token=StaticToken.random_token())
+                )
+            self.request.session[SESSION_STATIC_DEVICE] = device
+            self.request.session[SESSION_STATIC_TOKENS] = tokens
+        return super().get(request, *args, **kwargs)
+
+    def form_valid(self, form: SetupForm) -> HttpResponse:
+        """Verify OTP Token"""
+        device: StaticDevice = self.request.session[SESSION_STATIC_DEVICE]
+        device.save()
+        for token in self.request.session[SESSION_STATIC_TOKENS]:
+            token.save()
+        del self.request.session[SESSION_STATIC_DEVICE]
+        del self.request.session[SESSION_STATIC_TOKENS]
+        return self.executor.stage_ok()
diff --git a/passbook/stages/otp_static/templates/stages/otp_static/user_settings.html b/passbook/stages/otp_static/templates/stages/otp_static/user_settings.html
new file mode 100644
index 000000000..ab443368a
--- /dev/null
+++ b/passbook/stages/otp_static/templates/stages/otp_static/user_settings.html
@@ -0,0 +1,20 @@
+{% extends "user/base.html" %}
+
+{% load passbook_utils %}
+{% load i18n %}
+
+{% block page %}
+<div class="pf-c-card">
+    <div class="pf-c-card__header pf-c-title pf-m-md">
+        {% trans "Static One-Time Passwords" %}
+    </div>
+    <div class="pf-c-card__body">
+        <ul class="pb-otp-tokens">
+            {% for token in tokens %}
+            <li>{{ token.token }}</li>
+            {% endfor %}
+        </ul>
+        <a href="{% url 'passbook_stages_otp_static:disable' %}" class="pf-c-button pf-m-danger">{% trans "Disable Static Tokens" %}</a>
+    </div>
+</div>
+{% endblock %}
diff --git a/passbook/stages/otp_static/urls.py b/passbook/stages/otp_static/urls.py
new file mode 100644
index 000000000..7eb2ce2c8
--- /dev/null
+++ b/passbook/stages/otp_static/urls.py
@@ -0,0 +1,9 @@
+"""OTP static urls"""
+from django.urls import path
+
+from passbook.stages.otp_static.views import DisableView, UserSettingsView
+
+urlpatterns = [
+    path("settings", UserSettingsView.as_view(), name="user-settings"),
+    path("disable", DisableView.as_view(), name="disable"),
+]
diff --git a/passbook/stages/otp_static/views.py b/passbook/stages/otp_static/views.py
new file mode 100644
index 000000000..c3bf9a4db
--- /dev/null
+++ b/passbook/stages/otp_static/views.py
@@ -0,0 +1,41 @@
+"""otp Static view Tokens"""
+from django.contrib import messages
+from django.contrib.auth.mixins import LoginRequiredMixin
+from django.http import HttpRequest, HttpResponse
+from django.shortcuts import redirect
+from django.views import View
+from django.views.generic import TemplateView
+from django_otp.plugins.otp_static.models import StaticDevice, StaticToken
+
+from passbook.audit.models import Event, EventAction
+
+
+class UserSettingsView(LoginRequiredMixin, TemplateView):
+    """View for user settings to control OTP"""
+
+    template_name = "stages/otp_static/user_settings.html"
+
+    # TODO: Check if OTP Stage exists and applies to user
+    def get_context_data(self, **kwargs):
+        kwargs = super().get_context_data(**kwargs)
+        static_devices = StaticDevice.objects.filter(
+            user=self.request.user, confirmed=True
+        )
+        if static_devices.exists():
+            kwargs["tokens"] = StaticToken.objects.filter(device=static_devices.first())
+        return kwargs
+
+
+class DisableView(LoginRequiredMixin, View):
+    """Disable Static Tokens for user"""
+
+    def get(self, request: HttpRequest) -> HttpResponse:
+        """Delete all the devices for user"""
+        devices = StaticDevice.objects.filter(user=request.user, confirmed=True)
+        devices.delete()
+        messages.success(request, "Successfully disabled Static OTP Tokens")
+        # Create event with email notification
+        Event.new(
+            EventAction.CUSTOM, message="User disabled Static OTP Tokens."
+        ).from_http(request)
+        return redirect("passbook_stages_otp:otp-user-settings")
diff --git a/passbook/stages/otp_time/__init__.py b/passbook/stages/otp_time/__init__.py
new file mode 100644
index 000000000..e69de29bb
diff --git a/passbook/stages/otp_time/api.py b/passbook/stages/otp_time/api.py
new file mode 100644
index 000000000..3ce955c01
--- /dev/null
+++ b/passbook/stages/otp_time/api.py
@@ -0,0 +1,21 @@
+"""OTPTimeStage API Views"""
+from rest_framework.serializers import ModelSerializer
+from rest_framework.viewsets import ModelViewSet
+
+from passbook.stages.otp_time.models import OTPTimeStage
+
+
+class OTPTimeStageSerializer(ModelSerializer):
+    """OTPTimeStage Serializer"""
+
+    class Meta:
+
+        model = OTPTimeStage
+        fields = ["pk", "name", "digits"]
+
+
+class OTPTimeStageViewSet(ModelViewSet):
+    """OTPTimeStage Viewset"""
+
+    queryset = OTPTimeStage.objects.all()
+    serializer_class = OTPTimeStageSerializer
diff --git a/passbook/stages/otp_time/apps.py b/passbook/stages/otp_time/apps.py
new file mode 100644
index 000000000..c4421055d
--- /dev/null
+++ b/passbook/stages/otp_time/apps.py
@@ -0,0 +1,11 @@
+"""OTP Time"""
+from django.apps import AppConfig
+
+
+class PassbookStageOTPTimeConfig(AppConfig):
+    """OTP time App config"""
+
+    name = "passbook.stages.otp_time"
+    label = "passbook_stages_otp_time"
+    verbose_name = "passbook OTP.Time"
+    mountpoint = "-/user/otp/time/"
diff --git a/passbook/stages/otp_time/forms.py b/passbook/stages/otp_time/forms.py
new file mode 100644
index 000000000..36052404d
--- /dev/null
+++ b/passbook/stages/otp_time/forms.py
@@ -0,0 +1,64 @@
+"""OTP Time forms"""
+from django import forms
+from django.utils.safestring import mark_safe
+from django.utils.translation import gettext_lazy as _
+from django_otp.models import Device
+
+from passbook.stages.otp_time.models import OTPTimeStage
+from passbook.stages.otp_validate.forms import OTP_CODE_VALIDATOR
+
+
+class PictureWidget(forms.widgets.Widget):
+    """Widget to render value as img-tag"""
+
+    def render(self, name, value, attrs=None, renderer=None):
+        return mark_safe(f"<br>{value}")  # nosec
+
+
+class SetupForm(forms.Form):
+    """Form to setup Time-based OTP"""
+
+    device: Device = None
+
+    qr_code = forms.CharField(
+        widget=PictureWidget,
+        disabled=True,
+        required=False,
+        label=_("Scan this Code with your OTP App."),
+    )
+    code = forms.CharField(
+        label=_("Please enter the Token on your device."),
+        validators=[OTP_CODE_VALIDATOR],
+        widget=forms.TextInput(
+            attrs={
+                "autocomplete": "off",
+                "placeholder": "Code",
+                "autofocus": "autofocus",
+            }
+        ),
+    )
+
+    def __init__(self, device, qr_code, *args, **kwargs):
+        super().__init__(*args, **kwargs)
+        self.device = device
+        self.fields["qr_code"].initial = qr_code
+
+    def clean_code(self):
+        """Check code with new otp device"""
+        if self.device is not None:
+            if not self.device.verify_token(self.cleaned_data.get("code")):
+                raise forms.ValidationError(_("OTP Code does not match"))
+        return self.cleaned_data.get("code")
+
+
+class OTPTimeStageForm(forms.ModelForm):
+    """OTP Time-based Stage setup form"""
+
+    class Meta:
+
+        model = OTPTimeStage
+        fields = ["name", "digits"]
+
+        widgets = {
+            "name": forms.TextInput(),
+        }
diff --git a/passbook/stages/otp_time/migrations/0001_initial.py b/passbook/stages/otp_time/migrations/0001_initial.py
new file mode 100644
index 000000000..d3bf815d8
--- /dev/null
+++ b/passbook/stages/otp_time/migrations/0001_initial.py
@@ -0,0 +1,38 @@
+# Generated by Django 3.0.7 on 2020-06-13 15:28
+
+import django.db.models.deletion
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    initial = True
+
+    dependencies = [
+        ("passbook_flows", "0005_provider_flows"),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name="OTPTimeStage",
+            fields=[
+                (
+                    "stage_ptr",
+                    models.OneToOneField(
+                        auto_created=True,
+                        on_delete=django.db.models.deletion.CASCADE,
+                        parent_link=True,
+                        primary_key=True,
+                        serialize=False,
+                        to="passbook_flows.Stage",
+                    ),
+                ),
+                ("digits", models.IntegerField(choices=[(6, "Six"), (8, "Eight")])),
+            ],
+            options={
+                "verbose_name": "OTP Time (TOTP) Setup Stage",
+                "verbose_name_plural": "OTP Time (TOTP) Setup Stages",
+            },
+            bases=("passbook_flows.stage",),
+        ),
+    ]
diff --git a/passbook/stages/otp_time/migrations/0002_auto_20200701_1900.py b/passbook/stages/otp_time/migrations/0002_auto_20200701_1900.py
new file mode 100644
index 000000000..ab7bbb259
--- /dev/null
+++ b/passbook/stages/otp_time/migrations/0002_auto_20200701_1900.py
@@ -0,0 +1,23 @@
+# Generated by Django 3.0.7 on 2020-07-01 19:00
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("passbook_stages_otp_time", "0001_initial"),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name="otptimestage",
+            name="digits",
+            field=models.IntegerField(
+                choices=[
+                    (6, "6 digits, widely compatible"),
+                    (8, "8 digits, not compatible with apps like Google Authenticator"),
+                ]
+            ),
+        ),
+    ]
diff --git a/passbook/stages/otp_time/migrations/__init__.py b/passbook/stages/otp_time/migrations/__init__.py
new file mode 100644
index 000000000..e69de29bb
diff --git a/passbook/stages/otp_time/models.py b/passbook/stages/otp_time/models.py
new file mode 100644
index 000000000..73b6840e5
--- /dev/null
+++ b/passbook/stages/otp_time/models.py
@@ -0,0 +1,40 @@
+"""OTP Time-based models"""
+from typing import Optional
+
+from django.db import models
+from django.shortcuts import reverse
+from django.utils.translation import gettext_lazy as _
+
+from passbook.core.types import UIUserSettings
+from passbook.flows.models import Stage
+
+
+class TOTPDigits(models.IntegerChoices):
+    """OTP Time Digits"""
+
+    SIX = 6, _("6 digits, widely compatible")
+    EIGHT = 8, _("8 digits, not compatible with apps like Google Authenticator")
+
+
+class OTPTimeStage(Stage):
+    """Enroll a user's device into Time-based OTP."""
+
+    digits = models.IntegerField(choices=TOTPDigits.choices)
+
+    type = "passbook.stages.otp_time.stage.OTPTimeStageView"
+    form = "passbook.stages.otp_time.forms.OTPTimeStageForm"
+
+    @property
+    def ui_user_settings(self) -> Optional[UIUserSettings]:
+        return UIUserSettings(
+            name="Time-based OTP",
+            url=reverse("passbook_stages_otp_time:user-settings"),
+        )
+
+    def __str__(self) -> str:
+        return f"OTP Time (TOTP) Stage {self.name}"
+
+    class Meta:
+
+        verbose_name = _("OTP Time (TOTP) Setup Stage")
+        verbose_name_plural = _("OTP Time (TOTP) Setup Stages")
diff --git a/passbook/stages/otp_time/settings.py b/passbook/stages/otp_time/settings.py
new file mode 100644
index 000000000..5392069f7
--- /dev/null
+++ b/passbook/stages/otp_time/settings.py
@@ -0,0 +1,6 @@
+"""OTP Time"""
+
+INSTALLED_APPS = [
+    "django_otp.plugins.otp_totp",
+]
+OTP_TOTP_ISSUER = "passbook"
diff --git a/passbook/stages/otp_time/stage.py b/passbook/stages/otp_time/stage.py
new file mode 100644
index 000000000..74e517a2a
--- /dev/null
+++ b/passbook/stages/otp_time/stage.py
@@ -0,0 +1,64 @@
+"""TOTP Setup stage"""
+from typing import Any, Dict
+
+from django.http import HttpRequest, HttpResponse
+from django.utils.encoding import force_text
+from django.views.generic import FormView
+from django_otp.plugins.otp_totp.models import TOTPDevice
+from lxml.etree import tostring  # nosec
+from qrcode import QRCode
+from qrcode.image.svg import SvgFillImage
+from structlog import get_logger
+
+from passbook.flows.planner import PLAN_CONTEXT_PENDING_USER
+from passbook.flows.stage import StageView
+from passbook.stages.otp_time.forms import SetupForm
+from passbook.stages.otp_time.models import OTPTimeStage
+
+LOGGER = get_logger()
+SESSION_TOTP_DEVICE = "totp_device"
+
+
+class OTPTimeStageView(FormView, StageView):
+    """OTP totp Setup stage"""
+
+    form_class = SetupForm
+
+    def get_form_kwargs(self, **kwargs) -> Dict[str, Any]:
+        kwargs = super().get_form_kwargs(**kwargs)
+        device: TOTPDevice = self.request.session[SESSION_TOTP_DEVICE]
+        kwargs["device"] = device
+        kwargs["qr_code"] = self._get_qr_code(device)
+        return kwargs
+
+    def _get_qr_code(self, device: TOTPDevice) -> str:
+        """Get QR Code SVG as string based on `device`"""
+        qr_code = QRCode(image_factory=SvgFillImage)
+        qr_code.add_data(device.config_url)
+        return force_text(tostring(qr_code.make_image().get_image()))
+
+    def get(self, request: HttpRequest, *args, **kwargs) -> HttpResponse:
+        user = self.executor.plan.context.get(PLAN_CONTEXT_PENDING_USER)
+        if not user:
+            LOGGER.debug("No pending user, continuing")
+            return self.executor.stage_ok()
+
+        # Currently, this stage only supports one device per user. If the user already
+        # has a device, just skip to the next stage
+        if TOTPDevice.objects.filter(user=user).exists():
+            return self.executor.stage_ok()
+
+        stage: OTPTimeStage = self.executor.current_stage
+
+        if SESSION_TOTP_DEVICE not in self.request.session:
+            device = TOTPDevice(user=user, confirmed=True, digits=stage.digits)
+
+            self.request.session[SESSION_TOTP_DEVICE] = device
+        return super().get(request, *args, **kwargs)
+
+    def form_valid(self, form: SetupForm) -> HttpResponse:
+        """Verify OTP Token"""
+        device: TOTPDevice = self.request.session[SESSION_TOTP_DEVICE]
+        device.save()
+        del self.request.session[SESSION_TOTP_DEVICE]
+        return self.executor.stage_ok()
diff --git a/passbook/stages/otp/templates/stages/otp/user_settings.html b/passbook/stages/otp_time/templates/stages/otp_time/user_settings.html
similarity index 53%
rename from passbook/stages/otp/templates/stages/otp/user_settings.html
rename to passbook/stages/otp_time/templates/stages/otp_time/user_settings.html
index 474a27716..98f13e177 100644
--- a/passbook/stages/otp/templates/stages/otp/user_settings.html
+++ b/passbook/stages/otp_time/templates/stages/otp_time/user_settings.html
@@ -6,7 +6,7 @@
 {% block page %}
 <div class="pf-c-card">
     <div class="pf-c-card__header pf-c-title pf-m-md">
-        {% trans "One-Time Passwords" %}
+        {% trans "Time-based One-Time Passwords" %}
     </div>
     <div class="pf-c-card__body">
         <p>
@@ -21,22 +21,11 @@
         </p>
         <p>
             {% if not state %}
-            <a href="{% url 'passbook_stages_otp:otp-enable' %}" class="btn btn-success btn-sm">{% trans "Enable OTP" %}</a>
+            <a href="{% url 'passbook_stages_otp_time:otp-enable' %}" class="pf-c-button pf-m-primary">{% trans "Enable Time-based OTP" %}</a>
             {% else %}
-            <a href="{% url 'passbook_stages_otp:otp-disable' %}" class="btn btn-danger btn-sm">{% trans "Disable OTP" %}</a>
+            <a href="{% url 'passbook_stages_otp_time:disable' %}" class="pf-c-button pf-m-danger">{% trans "Disable Time-based OTP" %}</a>
             {% endif %}
         </p>
     </div>
 </div>
-
-<div class="pf-c-card">
-    <div class="pf-c-card__header pf-c-title pf-m-md">
-        {% trans "Your Backup tokens:" %}
-    </div>
-    <div class="pf-c-card__body">
-        <pre>{% for token in static_tokens %}{{ token.token }}
-        {% empty %}{% trans 'N/A' %}{% endfor %}</pre>
-        </div>
-    </div>
-</div>
 {% endblock %}
diff --git a/passbook/stages/otp_time/urls.py b/passbook/stages/otp_time/urls.py
new file mode 100644
index 000000000..6aa07bc5a
--- /dev/null
+++ b/passbook/stages/otp_time/urls.py
@@ -0,0 +1,9 @@
+"""OTP Time urls"""
+from django.urls import path
+
+from passbook.stages.otp_time.views import DisableView, UserSettingsView
+
+urlpatterns = [
+    path("settings", UserSettingsView.as_view(), name="user-settings"),
+    path("disable", DisableView.as_view(), name="disable"),
+]
diff --git a/passbook/stages/otp_time/views.py b/passbook/stages/otp_time/views.py
new file mode 100644
index 000000000..63f5afdfc
--- /dev/null
+++ b/passbook/stages/otp_time/views.py
@@ -0,0 +1,38 @@
+"""otp time-based view"""
+from django.contrib import messages
+from django.contrib.auth.mixins import LoginRequiredMixin
+from django.http import HttpRequest, HttpResponse
+from django.shortcuts import redirect
+from django.views import View
+from django.views.generic import TemplateView
+from django_otp.plugins.otp_totp.models import TOTPDevice
+
+from passbook.audit.models import Event, EventAction
+
+
+class UserSettingsView(LoginRequiredMixin, TemplateView):
+    """View for user settings to control OTP"""
+
+    template_name = "stages/otp_time/user_settings.html"
+
+    # TODO: Check if OTP Stage exists and applies to user
+    def get_context_data(self, **kwargs):
+        kwargs = super().get_context_data(**kwargs)
+        totp_devices = TOTPDevice.objects.filter(user=self.request.user, confirmed=True)
+        kwargs["state"] = totp_devices.exists()
+        return kwargs
+
+
+class DisableView(LoginRequiredMixin, View):
+    """Disable TOTP for user"""
+
+    def get(self, request: HttpRequest) -> HttpResponse:
+        """Delete all the devices for user"""
+        totp = TOTPDevice.objects.filter(user=request.user, confirmed=True)
+        totp.delete()
+        messages.success(request, "Successfully disabled Time-based OTP")
+        # Create event with email notification
+        Event.new(
+            EventAction.CUSTOM, message="User disabled Time-based OTP."
+        ).from_http(request)
+        return redirect("passbook_stages_otp:otp-user-settings")
diff --git a/passbook/stages/otp_validate/__init__.py b/passbook/stages/otp_validate/__init__.py
new file mode 100644
index 000000000..e69de29bb
diff --git a/passbook/stages/otp_validate/api.py b/passbook/stages/otp_validate/api.py
new file mode 100644
index 000000000..5f6ccbb5f
--- /dev/null
+++ b/passbook/stages/otp_validate/api.py
@@ -0,0 +1,24 @@
+"""OTPValidateStage API Views"""
+from rest_framework.serializers import ModelSerializer
+from rest_framework.viewsets import ModelViewSet
+
+from passbook.stages.otp_validate.models import OTPValidateStage
+
+
+class OTPValidateStageSerializer(ModelSerializer):
+    """OTPValidateStage Serializer"""
+
+    class Meta:
+
+        model = OTPValidateStage
+        fields = [
+            "pk",
+            "name",
+        ]
+
+
+class OTPValidateStageViewSet(ModelViewSet):
+    """OTPValidateStage Viewset"""
+
+    queryset = OTPValidateStage.objects.all()
+    serializer_class = OTPValidateStageSerializer
diff --git a/passbook/stages/otp_validate/apps.py b/passbook/stages/otp_validate/apps.py
new file mode 100644
index 000000000..761d24ec2
--- /dev/null
+++ b/passbook/stages/otp_validate/apps.py
@@ -0,0 +1,10 @@
+"""OTP Validation Stage"""
+from django.apps import AppConfig
+
+
+class PassbookStageOTPValidateConfig(AppConfig):
+    """OTP Validation Stage"""
+
+    name = "passbook.stages.otp_validate"
+    label = "passbook_stages_otp_validate"
+    verbose_name = "passbook OTP.Validate"
diff --git a/passbook/stages/otp_validate/forms.py b/passbook/stages/otp_validate/forms.py
new file mode 100644
index 000000000..d1d58952c
--- /dev/null
+++ b/passbook/stages/otp_validate/forms.py
@@ -0,0 +1,55 @@
+"""OTP Validate stage forms"""
+from django import forms
+from django.core.validators import RegexValidator
+from django.utils.translation import gettext_lazy as _
+from django_otp import match_token
+
+from passbook.core.models import User
+from passbook.stages.otp_validate.models import OTPValidateStage
+
+OTP_CODE_VALIDATOR = RegexValidator(
+    r"^[0-9a-z]{6,8}$", _("Only alpha-numeric characters are allowed.")
+)
+
+
+class ValidationForm(forms.Form):
+    """OTP Validate stage forms"""
+
+    user: User
+
+    code = forms.CharField(
+        label=_("Please enter the token from your device."),
+        validators=[OTP_CODE_VALIDATOR],
+        widget=forms.TextInput(
+            attrs={
+                "autocomplete": "off",
+                "placeholder": "123456",
+                "autofocus": "autofocus",
+            }
+        ),
+    )
+
+    def __init__(self, user, *args, **kwargs):
+        super().__init__(*args, **kwargs)
+        self.user = user
+
+    def clean_code(self):
+        """Validate code against all confirmed devices"""
+        code = self.cleaned_data.get("code")
+        device = match_token(self.user, code)
+        if not device:
+            raise forms.ValidationError(_("Invalid Token"))
+        return code
+
+
+class OTPValidateStageForm(forms.ModelForm):
+    """OTP Validate stage forms"""
+
+    class Meta:
+
+        model = OTPValidateStage
+        fields = ["name"]
+
+        widgets = {
+            "name": forms.TextInput(),
+        }
diff --git a/passbook/stages/otp/migrations/0001_initial.py b/passbook/stages/otp_validate/migrations/0001_initial.py
similarity index 64%
rename from passbook/stages/otp/migrations/0001_initial.py
rename to passbook/stages/otp_validate/migrations/0001_initial.py
index d27bf3cec..f26447ddd 100644
--- a/passbook/stages/otp/migrations/0001_initial.py
+++ b/passbook/stages/otp_validate/migrations/0001_initial.py
@@ -1,4 +1,4 @@
-# Generated by Django 3.0.6 on 2020-05-19 22:08
+# Generated by Django 3.0.7 on 2020-06-13 15:28
 
 import django.db.models.deletion
 from django.db import migrations, models
@@ -9,12 +9,12 @@ class Migration(migrations.Migration):
     initial = True
 
     dependencies = [
-        ("passbook_flows", "0001_initial"),
+        ("passbook_flows", "0005_provider_flows"),
     ]
 
     operations = [
         migrations.CreateModel(
-            name="OTPStage",
+            name="OTPValidateStage",
             fields=[
                 (
                     "stage_ptr",
@@ -28,14 +28,14 @@ class Migration(migrations.Migration):
                     ),
                 ),
                 (
-                    "enforced",
-                    models.BooleanField(
-                        default=False,
-                        help_text="Enforce enabled OTP for Users this stage applies to.",
-                    ),
+                    "not_configured_action",
+                    models.TextField(choices=[("skip", "Skip")], default="skip"),
                 ),
             ],
-            options={"verbose_name": "OTP Stage", "verbose_name_plural": "OTP Stages",},
+            options={
+                "verbose_name": "OTP Validation Stage",
+                "verbose_name_plural": "OTP Validation Stages",
+            },
             bases=("passbook_flows.stage",),
         ),
     ]
diff --git a/passbook/stages/otp_validate/migrations/__init__.py b/passbook/stages/otp_validate/migrations/__init__.py
new file mode 100644
index 000000000..e69de29bb
diff --git a/passbook/stages/otp_validate/models.py b/passbook/stages/otp_validate/models.py
new file mode 100644
index 000000000..4015aa365
--- /dev/null
+++ b/passbook/stages/otp_validate/models.py
@@ -0,0 +1,24 @@
+"""OTP Validation Stage"""
+from django.db import models
+from django.utils.translation import gettext_lazy as _
+
+from passbook.flows.models import NotConfiguredAction, Stage
+
+
+class OTPValidateStage(Stage):
+    """Validate user's configured OTP Device."""
+
+    not_configured_action = models.TextField(
+        choices=NotConfiguredAction.choices, default=NotConfiguredAction.SKIP
+    )
+
+    type = "passbook.stages.otp_validate.stage.OTPValidateStageView"
+    form = "passbook.stages.otp_validate.forms.OTPValidateStageForm"
+
+    def __str__(self) -> str:
+        return f"OTP Validation Stage {self.name}"
+
+    class Meta:
+
+        verbose_name = _("OTP Validation Stage")
+        verbose_name_plural = _("OTP Validation Stages")
diff --git a/passbook/stages/otp_validate/settings.py b/passbook/stages/otp_validate/settings.py
new file mode 100644
index 000000000..34902a427
--- /dev/null
+++ b/passbook/stages/otp_validate/settings.py
@@ -0,0 +1,4 @@
+"""OTP Validate stage settings"""
+INSTALLED_APPS = [
+    "django_otp",
+]
diff --git a/passbook/stages/otp_validate/stage.py b/passbook/stages/otp_validate/stage.py
new file mode 100644
index 000000000..5d378e4cc
--- /dev/null
+++ b/passbook/stages/otp_validate/stage.py
@@ -0,0 +1,46 @@
+"""OTP Validation"""
+from typing import Any, Dict
+
+from django.http import HttpRequest, HttpResponse
+from django.views.generic import FormView
+from django_otp import user_has_device
+from structlog import get_logger
+
+from passbook.flows.models import NotConfiguredAction
+from passbook.flows.planner import PLAN_CONTEXT_PENDING_USER
+from passbook.flows.stage import StageView
+from passbook.stages.otp_validate.forms import ValidationForm
+from passbook.stages.otp_validate.models import OTPValidateStage
+
+LOGGER = get_logger()
+
+
+class OTPValidateStageView(FormView, StageView):
+    """OTP Validation"""
+
+    form_class = ValidationForm
+
+    def get_form_kwargs(self, **kwargs) -> Dict[str, Any]:
+        kwargs = super().get_form_kwargs(**kwargs)
+        kwargs["user"] = self.executor.plan.context.get(PLAN_CONTEXT_PENDING_USER)
+        return kwargs
+
+    def get(self, request: HttpRequest, *args, **kwargs) -> HttpResponse:
+        user = self.executor.plan.context.get(PLAN_CONTEXT_PENDING_USER)
+        if not user:
+            LOGGER.debug("No pending user, continuing")
+            return self.executor.stage_ok()
+        has_devices = user_has_device(user)
+        stage: OTPValidateStage = self.executor.current_stage
+
+        if not has_devices:
+            if stage.not_configured_action == NotConfiguredAction.SKIP:
+                LOGGER.debug("OTP not configured, skipping stage")
+                return self.executor.stage_ok()
+        return super().get(request, *args, **kwargs)
+
+    def form_valid(self, form: ValidationForm) -> HttpResponse:
+        """Verify OTP Token"""
+        # Since we do token checking in the form, we know the token is valid here
+        # so we can just continue
+        return self.executor.stage_ok()
diff --git a/passbook/stages/password/apps.py b/passbook/stages/password/apps.py
index 087e1f90c..7b7fdb8b8 100644
--- a/passbook/stages/password/apps.py
+++ b/passbook/stages/password/apps.py
@@ -8,3 +8,4 @@ class PassbookStagePasswordConfig(AppConfig):
     name = "passbook.stages.password"
     label = "passbook_stages_password"
     verbose_name = "passbook Stages.Password"
+    mountpoint = "-/user/stage/password/"
diff --git a/passbook/stages/password/forms.py b/passbook/stages/password/forms.py
index f9dc91421..c27a5f842 100644
--- a/passbook/stages/password/forms.py
+++ b/passbook/stages/password/forms.py
@@ -1,47 +1,60 @@
 """passbook administration forms"""
 from django import forms
-from django.conf import settings
 from django.contrib.admin.widgets import FilteredSelectMultiple
 from django.utils.translation import gettext_lazy as _
 
-from passbook.lib.utils.reflection import path_to_class
+from passbook.flows.models import Flow, FlowDesignation
 from passbook.stages.password.models import PasswordStage
 
 
 def get_authentication_backends():
     """Return all available authentication backends as tuple set"""
-    for backend in settings.AUTHENTICATION_BACKENDS:
-        klass = path_to_class(backend)
-        yield backend, getattr(
-            klass(), "name", "%s (%s)" % (klass.__name__, klass.__module__)
-        )
+    return [
+        (
+            "django.contrib.auth.backends.ModelBackend",
+            _("passbook-internal Userdatabase"),
+        ),
+        (
+            "passbook.sources.ldap.auth.LDAPBackend",
+            _("passbook LDAP (Only needed when User-Sync is not enabled."),
+        ),
+    ]
 
 
 class PasswordForm(forms.Form):
     """Password authentication form"""
 
+    username = forms.CharField(
+        widget=forms.HiddenInput(attrs={"autocomplete": "username"}), required=False
+    )
     password = forms.CharField(
+        label=_("Please enter your password."),
         widget=forms.PasswordInput(
             attrs={
                 "placeholder": _("Password"),
                 "autofocus": "autofocus",
                 "autocomplete": "current-password",
             }
-        )
+        ),
     )
 
 
 class PasswordStageForm(forms.ModelForm):
     """Form to create/edit Password Stages"""
 
+    def __init__(self, *args, **kwargs):
+        super().__init__(*args, **kwargs)
+        self.fields["change_flow"].queryset = Flow.objects.filter(
+            designation=FlowDesignation.STAGE_SETUP
+        )
+
     class Meta:
 
         model = PasswordStage
-        fields = ["name", "backends"]
+        fields = ["name", "backends", "change_flow"]
         widgets = {
             "name": forms.TextInput(),
             "backends": FilteredSelectMultiple(
                 _("backends"), False, choices=get_authentication_backends()
             ),
-            "password_policies": FilteredSelectMultiple(_("password policies"), False),
         }
diff --git a/passbook/stages/password/migrations/0002_passwordstage_change_flow.py b/passbook/stages/password/migrations/0002_passwordstage_change_flow.py
new file mode 100644
index 000000000..8b3fa4ade
--- /dev/null
+++ b/passbook/stages/password/migrations/0002_passwordstage_change_flow.py
@@ -0,0 +1,126 @@
+# Generated by Django 3.0.7 on 2020-06-29 08:51
+
+import django.db.models.deletion
+from django.apps.registry import Apps
+from django.db import migrations, models
+from django.db.backends.base.schema import BaseDatabaseSchemaEditor
+
+from passbook.flows.models import FlowDesignation
+from passbook.stages.prompt.models import FieldTypes
+
+PROMPT_POLICY_EXPRESSION = """# Check that both passwords are equal.
+return request.context['password'] == request.context['password_repeat']"""
+
+
+def create_default_password_change(apps: Apps, schema_editor: BaseDatabaseSchemaEditor):
+    Flow = apps.get_model("passbook_flows", "Flow")
+    FlowStageBinding = apps.get_model("passbook_flows", "FlowStageBinding")
+
+    PolicyBinding = apps.get_model("passbook_policies", "PolicyBinding")
+
+    ExpressionPolicy = apps.get_model(
+        "passbook_policies_expression", "ExpressionPolicy"
+    )
+
+    PromptStage = apps.get_model("passbook_stages_prompt", "PromptStage")
+    Prompt = apps.get_model("passbook_stages_prompt", "Prompt")
+
+    UserWriteStage = apps.get_model("passbook_stages_user_write", "UserWriteStage")
+
+    db_alias = schema_editor.connection.alias
+
+    flow, _ = Flow.objects.using(db_alias).update_or_create(
+        slug="default-password-change",
+        designation=FlowDesignation.STAGE_SETUP,
+        defaults={"name": "Change Password"},
+    )
+
+    prompt_stage, _ = PromptStage.objects.using(db_alias).update_or_create(
+        name="default-password-change-prompt",
+    )
+    password_prompt, _ = Prompt.objects.using(db_alias).update_or_create(
+        field_key="password",
+        defaults={
+            "label": "Password",
+            "type": FieldTypes.PASSWORD,
+            "required": True,
+            "placeholder": "Password",
+            "order": 0,
+        },
+    )
+    password_rep_prompt, _ = Prompt.objects.using(db_alias).update_or_create(
+        field_key="password_repeat",
+        defaults={
+            "label": "Password (repeat)",
+            "type": FieldTypes.PASSWORD,
+            "required": True,
+            "placeholder": "Password (repeat)",
+            "order": 1,
+        },
+    )
+    prompt_stage.fields.add(password_prompt)
+    prompt_stage.fields.add(password_rep_prompt)
+
+    # Policy to only trigger prompt when no username is given
+    prompt_policy, _ = ExpressionPolicy.objects.using(db_alias).update_or_create(
+        name="default-password-change-password-equal",
+        defaults={"expression": PROMPT_POLICY_EXPRESSION},
+    )
+    PolicyBinding.objects.using(db_alias).update_or_create(
+        policy=prompt_policy, target=prompt_stage, defaults={"order": 0}
+    )
+
+    user_write, _ = UserWriteStage.objects.using(db_alias).update_or_create(
+        name="default-password-change-write"
+    )
+
+    FlowStageBinding.objects.using(db_alias).update_or_create(
+        flow=flow, stage=prompt_stage, defaults={"order": 0}
+    )
+    FlowStageBinding.objects.using(db_alias).update_or_create(
+        flow=flow, stage=user_write, defaults={"order": 1}
+    )
+
+
+def update_default_stage_change(apps: Apps, schema_editor: BaseDatabaseSchemaEditor):
+    PasswordStage = apps.get_model("passbook_stages_password", "PasswordStage")
+    Flow = apps.get_model("passbook_flows", "Flow")
+
+    flow = Flow.objects.get(
+        slug="default-password-change", designation=FlowDesignation.STAGE_SETUP,
+    )
+
+    stages = PasswordStage.objects.filter(name="default-authentication-password")
+    if not stages.exists():
+        return
+    stage = stages.first()
+    stage.change_flow = flow
+    stage.save()
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("passbook_flows", "0006_auto_20200629_0857"),
+        ("passbook_policies_expression", "0001_initial"),
+        ("passbook_policies", "0001_initial"),
+        ("passbook_stages_password", "0001_initial"),
+        ("passbook_stages_prompt", "0004_auto_20200618_1735"),
+        ("passbook_stages_user_write", "0001_initial"),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name="passwordstage",
+            name="change_flow",
+            field=models.ForeignKey(
+                blank=True,
+                help_text="Flow used by an authenticated user to change their password. If empty, user will be unable to change their password.",
+                null=True,
+                on_delete=django.db.models.deletion.SET_NULL,
+                to="passbook_flows.Flow",
+            ),
+        ),
+        migrations.RunPython(create_default_password_change),
+        migrations.RunPython(update_default_stage_change),
+    ]
diff --git a/passbook/stages/password/models.py b/passbook/stages/password/models.py
index 8d585cfb6..24275916f 100644
--- a/passbook/stages/password/models.py
+++ b/passbook/stages/password/models.py
@@ -1,22 +1,51 @@
 """password stage models"""
+from typing import Optional
+
 from django.contrib.postgres.fields import ArrayField
 from django.db import models
+from django.shortcuts import reverse
+from django.utils.http import urlencode
 from django.utils.translation import gettext_lazy as _
 
-from passbook.flows.models import Stage
+from passbook.core.types import UIUserSettings
+from passbook.flows.models import Flow, Stage
+from passbook.flows.views import NEXT_ARG_NAME
 
 
 class PasswordStage(Stage):
-    """Password-based Django-backend Authentication Stage"""
+    """Prompts the user for their password, and validates it against the configured backends."""
 
     backends = ArrayField(
         models.TextField(),
         help_text=_("Selection of backends to test the password against."),
     )
 
+    change_flow = models.ForeignKey(
+        Flow,
+        on_delete=models.SET_NULL,
+        null=True,
+        blank=True,
+        help_text=_(
+            (
+                "Flow used by an authenticated user to change their password. "
+                "If empty, user will be unable to change their password."
+            )
+        ),
+    )
+
     type = "passbook.stages.password.stage.PasswordStage"
     form = "passbook.stages.password.forms.PasswordStageForm"
 
+    @property
+    def ui_user_settings(self) -> Optional[UIUserSettings]:
+        if not self.change_flow:
+            return None
+        base_url = reverse(
+            "passbook_stages_password:change", kwargs={"stage_uuid": self.pk}
+        )
+        args = urlencode({NEXT_ARG_NAME: reverse("passbook_core:user-settings")})
+        return UIUserSettings(name=_("Change password"), url=f"{base_url}?{args}")
+
     def __str__(self):
         return f"Password Stage {self.name}"
 
diff --git a/passbook/stages/password/stage.py b/passbook/stages/password/stage.py
index 41abac5f8..8dd708f25 100644
--- a/passbook/stages/password/stage.py
+++ b/passbook/stages/password/stage.py
@@ -52,9 +52,20 @@ class PasswordStage(FormView, StageView):
     form_class = PasswordForm
     template_name = "stages/password/backend.html"
 
+    def get_form(self, form_class=None) -> PasswordForm:
+        form = super().get_form(form_class=form_class)
+
+        # If there's a pending user, update the `username` field
+        # this field is only used by password managers.
+        # If there's no user set, an error is raised later.
+        if PLAN_CONTEXT_PENDING_USER in self.executor.plan.context:
+            pending_user: User = self.executor.plan.context[PLAN_CONTEXT_PENDING_USER]
+            form.fields["username"].initial = pending_user.username
+
+        return form
+
     def get_context_data(self, **kwargs):
         kwargs = super().get_context_data(**kwargs)
-        kwargs["primary_action"] = _("Log in")
         recovery_flow = Flow.objects.filter(designation=FlowDesignation.RECOVERY)
         if recovery_flow.exists():
             kwargs["recovery_flow"] = recovery_flow.first()
diff --git a/passbook/stages/password/templates/stages/password/backend.html b/passbook/stages/password/templates/stages/password/backend.html
index a2b3db483..fc313d520 100644
--- a/passbook/stages/password/templates/stages/password/backend.html
+++ b/passbook/stages/password/templates/stages/password/backend.html
@@ -1,39 +1,10 @@
+{% extends 'login/form_with_user.html' %}
+
 {% load i18n %}
 {% load passbook_utils %}
 
-<header class="pf-c-login__main-header">
-    <h1 class="pf-c-title pf-m-3xl">
-        {% block card_title %}
-        {% trans title %}
-        {% endblock %}
-    </h1>
-</header>
-<div class="pf-c-login__main-body">
-    {% block card %}
-    <form method="POST" class="pf-c-form">
-        <div class="pf-c-form__group">
-            <label class="pf-c-form__label" for="{{ field.name }}-{{ forloop.counter0 }}">
-                <span class="pf-c-form__label-text">{% trans "Username" %}</span>
-            </label>
-            <div class="form-control-static">
-                <div class="left">
-                    <img class="pf-c-avatar" src="{% gravatar user.email %}" alt="">
-                    {{ user.username }}
-                </div>
-                <div class="right">
-                    <a href="{% url 'passbook_flows:default-authentication' %}">{% trans 'Not you?' %}</a>
-                </div>
-            </div>
-        </div>
-
-        {% include 'partials/form.html' %}
-
-        {% if recovery_flow %}
-        <a href="{% url 'passbook_flows:flow-executor' flow_slug=recovery_flow.slug %}">{% trans 'Forgot password?' %}</a>
-        {% endif %}
-        <div class="pf-c-form__group pf-m-action">
-            <button class="pf-c-button pf-m-primary pf-m-block" type="submit">{% trans primary_action %}</button>
-        </div>
-    </form>
-    {% endblock %}
-</div>
+{% block beneath_form %}
+{% if recovery_flow %}
+<a href="{% url 'passbook_flows:flow-executor' flow_slug=recovery_flow.slug %}">{% trans 'Forgot password?' %}</a>
+{% endif %}
+{% endblock %}
diff --git a/passbook/stages/password/tests.py b/passbook/stages/password/tests.py
index d0cec72b8..3dbb6f9ec 100644
--- a/passbook/stages/password/tests.py
+++ b/passbook/stages/password/tests.py
@@ -6,8 +6,10 @@ from unittest.mock import MagicMock, patch
 from django.core.exceptions import PermissionDenied
 from django.shortcuts import reverse
 from django.test import Client, TestCase
+from django.utils.encoding import force_text
 
 from passbook.core.models import User
+from passbook.flows.markers import StageMarker
 from passbook.flows.models import Flow, FlowDesignation, FlowStageBinding
 from passbook.flows.planner import PLAN_CONTEXT_PENDING_USER, FlowPlan
 from passbook.flows.views import SESSION_KEY_PLAN
@@ -42,7 +44,9 @@ class TestPasswordStage(TestCase):
 
     def test_without_user(self):
         """Test without user"""
-        plan = FlowPlan(flow_pk=self.flow.pk.hex, stages=[self.stage])
+        plan = FlowPlan(
+            flow_pk=self.flow.pk.hex, stages=[self.stage], markers=[StageMarker()]
+        )
         session = self.client.session
         session[SESSION_KEY_PLAN] = plan
         session.save()
@@ -54,8 +58,12 @@ class TestPasswordStage(TestCase):
             # Still have to send the password so the form is valid
             {"password": self.password},
         )
-        self.assertEqual(response.status_code, 302)
-        self.assertEqual(response.url, reverse("passbook_flows:denied"))
+
+        self.assertEqual(response.status_code, 200)
+        self.assertJSONEqual(
+            force_text(response.content),
+            {"type": "redirect", "to": reverse("passbook_flows:denied")},
+        )
 
     def test_recovery_flow_link(self):
         """Test link to the default recovery flow"""
@@ -63,7 +71,9 @@ class TestPasswordStage(TestCase):
             designation=FlowDesignation.RECOVERY, slug="qewrqerqr"
         )
 
-        plan = FlowPlan(flow_pk=self.flow.pk.hex, stages=[self.stage])
+        plan = FlowPlan(
+            flow_pk=self.flow.pk.hex, stages=[self.stage], markers=[StageMarker()]
+        )
         session = self.client.session
         session[SESSION_KEY_PLAN] = plan
         session.save()
@@ -74,11 +84,13 @@ class TestPasswordStage(TestCase):
             ),
         )
         self.assertEqual(response.status_code, 200)
-        self.assertIn(flow.slug, response.rendered_content)
+        self.assertIn(flow.slug, force_text(response.content))
 
     def test_valid_password(self):
         """Test with a valid pending user and valid password"""
-        plan = FlowPlan(flow_pk=self.flow.pk.hex, stages=[self.stage])
+        plan = FlowPlan(
+            flow_pk=self.flow.pk.hex, stages=[self.stage], markers=[StageMarker()]
+        )
         plan.context[PLAN_CONTEXT_PENDING_USER] = self.user
         session = self.client.session
         session[SESSION_KEY_PLAN] = plan
@@ -91,12 +103,18 @@ class TestPasswordStage(TestCase):
             # Form data
             {"password": self.password},
         )
-        self.assertEqual(response.status_code, 302)
-        self.assertEqual(response.url, reverse("passbook_core:overview"))
+
+        self.assertEqual(response.status_code, 200)
+        self.assertJSONEqual(
+            force_text(response.content),
+            {"type": "redirect", "to": reverse("passbook_core:overview")},
+        )
 
     def test_invalid_password(self):
         """Test with a valid pending user and invalid password"""
-        plan = FlowPlan(flow_pk=self.flow.pk.hex, stages=[self.stage])
+        plan = FlowPlan(
+            flow_pk=self.flow.pk.hex, stages=[self.stage], markers=[StageMarker()]
+        )
         plan.context[PLAN_CONTEXT_PENDING_USER] = self.user
         session = self.client.session
         session[SESSION_KEY_PLAN] = plan
@@ -118,7 +136,9 @@ class TestPasswordStage(TestCase):
     def test_permission_denied(self):
         """Test with a valid pending user and valid password.
         Backend is patched to return PermissionError"""
-        plan = FlowPlan(flow_pk=self.flow.pk.hex, stages=[self.stage])
+        plan = FlowPlan(
+            flow_pk=self.flow.pk.hex, stages=[self.stage], markers=[StageMarker()]
+        )
         plan.context[PLAN_CONTEXT_PENDING_USER] = self.user
         session = self.client.session
         session[SESSION_KEY_PLAN] = plan
@@ -131,5 +151,9 @@ class TestPasswordStage(TestCase):
             # Form data
             {"password": self.password + "test"},
         )
-        self.assertEqual(response.status_code, 302)
-        self.assertEqual(response.url, reverse("passbook_flows:denied"))
+
+        self.assertEqual(response.status_code, 200)
+        self.assertJSONEqual(
+            force_text(response.content),
+            {"type": "redirect", "to": reverse("passbook_flows:denied")},
+        )
diff --git a/passbook/stages/password/urls.py b/passbook/stages/password/urls.py
new file mode 100644
index 000000000..3e8f2ae4c
--- /dev/null
+++ b/passbook/stages/password/urls.py
@@ -0,0 +1,8 @@
+"""password stage URLs"""
+from django.urls import path
+
+from passbook.stages.password.views import ChangeFlowInitView
+
+urlpatterns = [
+    path("<uuid:stage_uuid>/change/", ChangeFlowInitView.as_view(), name="change")
+]
diff --git a/passbook/stages/password/views.py b/passbook/stages/password/views.py
new file mode 100644
index 000000000..98d0e77a7
--- /dev/null
+++ b/passbook/stages/password/views.py
@@ -0,0 +1,32 @@
+"""password stage views"""
+from django.contrib.auth.mixins import LoginRequiredMixin
+from django.http import Http404, HttpRequest, HttpResponse
+from django.shortcuts import get_object_or_404
+from django.views import View
+
+from passbook.flows.planner import PLAN_CONTEXT_PENDING_USER, FlowPlanner
+from passbook.flows.views import SESSION_KEY_PLAN
+from passbook.lib.utils.urls import redirect_with_qs
+from passbook.stages.password.models import PasswordStage
+
+
+class ChangeFlowInitView(LoginRequiredMixin, View):
+    """Initiate planner for selected change flow and redirect to flow executor,
+    or raise Http404 if no change_flow has been set."""
+
+    def get(self, request: HttpRequest, stage_uuid: str) -> HttpResponse:
+        """Initiate planner for selected change flow and redirect to flow executor,
+        or raise Http404 if no change_flow has been set."""
+        stage: PasswordStage = get_object_or_404(PasswordStage, pk=stage_uuid)
+        if not stage.change_flow:
+            raise Http404
+
+        plan = FlowPlanner(stage.change_flow).plan(
+            request, {PLAN_CONTEXT_PENDING_USER: request.user}
+        )
+        request.session[SESSION_KEY_PLAN] = plan
+        return redirect_with_qs(
+            "passbook_flows:flow-executor-shell",
+            self.request.GET,
+            flow_slug=stage.change_flow.slug,
+        )
diff --git a/passbook/stages/prompt/forms.py b/passbook/stages/prompt/forms.py
index e9157d198..15bb648ae 100644
--- a/passbook/stages/prompt/forms.py
+++ b/passbook/stages/prompt/forms.py
@@ -1,5 +1,7 @@
 """Prompt forms"""
 from django import forms
+from django.contrib.admin.widgets import FilteredSelectMultiple
+from django.utils.translation import gettext_lazy as _
 from guardian.shortcuts import get_anonymous_user
 
 from passbook.flows.planner import PLAN_CONTEXT_PENDING_USER, FlowPlan
@@ -16,6 +18,7 @@ class PromptStageForm(forms.ModelForm):
         fields = ["name", "fields"]
         widgets = {
             "name": forms.TextInput(),
+            "fields": FilteredSelectMultiple(_("prompts"), False),
         }
 
 
diff --git a/passbook/stages/prompt/migrations/0003_auto_20200615_1641.py b/passbook/stages/prompt/migrations/0003_auto_20200615_1641.py
new file mode 100644
index 000000000..6ba175cc7
--- /dev/null
+++ b/passbook/stages/prompt/migrations/0003_auto_20200615_1641.py
@@ -0,0 +1,33 @@
+# Generated by Django 3.0.7 on 2020-06-15 16:41
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("passbook_stages_prompt", "0002_auto_20200528_2059"),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name="prompt",
+            name="type",
+            field=models.CharField(
+                choices=[
+                    ("text", "Text"),
+                    ("username", "Username"),
+                    ("e-mail", "Email"),
+                    ("password", "Password"),
+                    ("number", "Number"),
+                    ("checkbox", "Checkbox"),
+                    ("data", "Date"),
+                    ("data-time", "Date Time"),
+                    ("separator", "Separator"),
+                    ("hidden", "Hidden"),
+                    ("static", "Static"),
+                ],
+                max_length=100,
+            ),
+        ),
+    ]
diff --git a/passbook/stages/prompt/migrations/0004_auto_20200618_1735.py b/passbook/stages/prompt/migrations/0004_auto_20200618_1735.py
new file mode 100644
index 000000000..6e12574a0
--- /dev/null
+++ b/passbook/stages/prompt/migrations/0004_auto_20200618_1735.py
@@ -0,0 +1,33 @@
+# Generated by Django 3.0.7 on 2020-06-18 17:35
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("passbook_stages_prompt", "0003_auto_20200615_1641"),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name="prompt",
+            name="type",
+            field=models.CharField(
+                choices=[
+                    ("text", "Text"),
+                    ("username", "Username"),
+                    ("email", "Email"),
+                    ("password", "Password"),
+                    ("number", "Number"),
+                    ("checkbox", "Checkbox"),
+                    ("data", "Date"),
+                    ("data-time", "Date Time"),
+                    ("separator", "Separator"),
+                    ("hidden", "Hidden"),
+                    ("static", "Static"),
+                ],
+                max_length=100,
+            ),
+        ),
+    ]
diff --git a/passbook/stages/prompt/models.py b/passbook/stages/prompt/models.py
index fc12c7b2e..1cea88068 100644
--- a/passbook/stages/prompt/models.py
+++ b/passbook/stages/prompt/models.py
@@ -12,8 +12,11 @@ from passbook.policies.models import PolicyBindingModel
 class FieldTypes(models.TextChoices):
     """Field types an Prompt can be"""
 
+    # Simple text field
     TEXT = "text"
-    EMAIL = "e-mail"
+    # Same as text, but has autocomplete for password managers
+    USERNAME = "username"
+    EMAIL = "email"
     PASSWORD = "password"  # noqa # nosec
     NUMBER = "number"
     CHECKBOX = "checkbox"
@@ -52,8 +55,11 @@ class Prompt(models.Model):
         }
         if self.type == FieldTypes.EMAIL:
             field_class = forms.EmailField
+        if self.type == FieldTypes.USERNAME:
+            attrs["autocomplete"] = "username"
         if self.type == FieldTypes.PASSWORD:
             widget = forms.PasswordInput(attrs=attrs)
+            attrs["autocomplete"] = "new-password"
         if self.type == FieldTypes.NUMBER:
             field_class = forms.IntegerField
             widget = forms.NumberInput(attrs=attrs)
@@ -64,6 +70,10 @@ class Prompt(models.Model):
         if self.type == FieldTypes.CHECKBOX:
             field_class = forms.CheckboxInput
             kwargs["required"] = False
+        if self.type == FieldTypes.DATE:
+            field_class = forms.DateInput
+        if self.type == FieldTypes.DATE_TIME:
+            field_class = forms.DateTimeInput
 
         # TODO: Implement static
         # TODO: Implement separator
@@ -85,7 +95,7 @@ class Prompt(models.Model):
 
 
 class PromptStage(PolicyBindingModel, Stage):
-    """Prompt Stage, pointing to multiple prompts"""
+    """Define arbitrary prompts for the user."""
 
     fields = models.ManyToManyField(Prompt)
 
diff --git a/passbook/stages/prompt/tests.py b/passbook/stages/prompt/tests.py
index 85b66c1f8..b5893e8d7 100644
--- a/passbook/stages/prompt/tests.py
+++ b/passbook/stages/prompt/tests.py
@@ -3,8 +3,10 @@ from unittest.mock import MagicMock, patch
 
 from django.shortcuts import reverse
 from django.test import Client, TestCase
+from django.utils.encoding import force_text
 
 from passbook.core.models import User
+from passbook.flows.markers import StageMarker
 from passbook.flows.models import Flow, FlowDesignation, FlowStageBinding
 from passbook.flows.planner import FlowPlan
 from passbook.flows.views import SESSION_KEY_PLAN
@@ -95,7 +97,9 @@ class TestPromptStage(TestCase):
 
     def test_render(self):
         """Test render of form, check if all prompts are rendered correctly"""
-        plan = FlowPlan(flow_pk=self.flow.pk.hex, stages=[self.stage])
+        plan = FlowPlan(
+            flow_pk=self.flow.pk.hex, stages=[self.stage], markers=[StageMarker()]
+        )
         session = self.client.session
         session[SESSION_KEY_PLAN] = plan
         session.save()
@@ -107,16 +111,16 @@ class TestPromptStage(TestCase):
         )
         self.assertEqual(response.status_code, 200)
         for prompt in self.stage.fields.all():
-            self.assertIn(prompt.field_key, response.rendered_content)
-            self.assertIn(prompt.label, response.rendered_content)
-            self.assertIn(prompt.placeholder, response.rendered_content)
+            self.assertIn(prompt.field_key, force_text(response.content))
+            self.assertIn(prompt.label, force_text(response.content))
+            self.assertIn(prompt.placeholder, force_text(response.content))
 
-    def test_valid_form(self) -> PromptForm:
+    def test_valid_form_with_policy(self) -> PromptForm:
         """Test form validation"""
-        plan = FlowPlan(flow_pk=self.flow.pk.hex, stages=[self.stage])
-        expr = (
-            "{{ request.context.password_prompt == request.context.password2_prompt }}"
+        plan = FlowPlan(
+            flow_pk=self.flow.pk.hex, stages=[self.stage], markers=[StageMarker()]
         )
+        expr = "return request.context['password_prompt'] == request.context['password2_prompt']"
         expr_policy = ExpressionPolicy.objects.create(
             name="validate-form", expression=expr
         )
@@ -127,7 +131,9 @@ class TestPromptStage(TestCase):
 
     def test_invalid_form(self) -> PromptForm:
         """Test form validation"""
-        plan = FlowPlan(flow_pk=self.flow.pk.hex, stages=[self.stage])
+        plan = FlowPlan(
+            flow_pk=self.flow.pk.hex, stages=[self.stage], markers=[StageMarker()]
+        )
         expr = "False"
         expr_policy = ExpressionPolicy.objects.create(
             name="validate-form", expression=expr
@@ -139,12 +145,14 @@ class TestPromptStage(TestCase):
 
     def test_valid_form_request(self):
         """Test a request with valid form data"""
-        plan = FlowPlan(flow_pk=self.flow.pk.hex, stages=[self.stage])
+        plan = FlowPlan(
+            flow_pk=self.flow.pk.hex, stages=[self.stage], markers=[StageMarker()]
+        )
         session = self.client.session
         session[SESSION_KEY_PLAN] = plan
         session.save()
 
-        form = self.test_valid_form()
+        form = self.test_valid_form_with_policy()
 
         with patch("passbook.flows.views.FlowExecutorView.cancel", MagicMock()):
             response = self.client.post(
@@ -153,8 +161,11 @@ class TestPromptStage(TestCase):
                 ),
                 form.cleaned_data,
             )
-            self.assertEqual(response.status_code, 302)
-            self.assertEqual(response.url, reverse("passbook_core:overview"))
+        self.assertEqual(response.status_code, 200)
+        self.assertJSONEqual(
+            force_text(response.content),
+            {"type": "redirect", "to": reverse("passbook_core:overview")},
+        )
 
         # Check that valid data has been saved
         session = self.client.session
diff --git a/passbook/stages/user_delete/models.py b/passbook/stages/user_delete/models.py
index f7ad5a520..1e9483ad3 100644
--- a/passbook/stages/user_delete/models.py
+++ b/passbook/stages/user_delete/models.py
@@ -5,7 +5,8 @@ from passbook.flows.models import Stage
 
 
 class UserDeleteStage(Stage):
-    """Delete stage, delete a user from saved data."""
+    """Deletes the currently pending user without confirmation.
+    Use with caution."""
 
     type = "passbook.stages.user_delete.stage.UserDeleteStageView"
     form = "passbook.stages.user_delete.forms.UserDeleteStageForm"
diff --git a/passbook/stages/user_delete/tests.py b/passbook/stages/user_delete/tests.py
index 88ff49479..26376c683 100644
--- a/passbook/stages/user_delete/tests.py
+++ b/passbook/stages/user_delete/tests.py
@@ -1,8 +1,10 @@
 """delete tests"""
 from django.shortcuts import reverse
 from django.test import Client, TestCase
+from django.utils.encoding import force_text
 
 from passbook.core.models import User
+from passbook.flows.markers import StageMarker
 from passbook.flows.models import Flow, FlowDesignation, FlowStageBinding
 from passbook.flows.planner import PLAN_CONTEXT_PENDING_USER, FlowPlan
 from passbook.flows.views import SESSION_KEY_PLAN
@@ -28,7 +30,9 @@ class TestUserDeleteStage(TestCase):
 
     def test_no_user(self):
         """Test without user set"""
-        plan = FlowPlan(flow_pk=self.flow.pk.hex, stages=[self.stage])
+        plan = FlowPlan(
+            flow_pk=self.flow.pk.hex, stages=[self.stage], markers=[StageMarker()]
+        )
         session = self.client.session
         session[SESSION_KEY_PLAN] = plan
         session.save()
@@ -38,12 +42,17 @@ class TestUserDeleteStage(TestCase):
                 "passbook_flows:flow-executor", kwargs={"flow_slug": self.flow.slug}
             )
         )
-        self.assertEqual(response.status_code, 302)
-        self.assertEqual(response.url, reverse("passbook_flows:denied"))
+        self.assertEqual(response.status_code, 200)
+        self.assertJSONEqual(
+            force_text(response.content),
+            {"type": "redirect", "to": reverse("passbook_flows:denied")},
+        )
 
     def test_user_delete_get(self):
         """Test Form render"""
-        plan = FlowPlan(flow_pk=self.flow.pk.hex, stages=[self.stage])
+        plan = FlowPlan(
+            flow_pk=self.flow.pk.hex, stages=[self.stage], markers=[StageMarker()]
+        )
         plan.context[PLAN_CONTEXT_PENDING_USER] = self.user
         session = self.client.session
         session[SESSION_KEY_PLAN] = plan
@@ -58,7 +67,9 @@ class TestUserDeleteStage(TestCase):
 
     def test_user_delete_post(self):
         """Test User delete (actual)"""
-        plan = FlowPlan(flow_pk=self.flow.pk.hex, stages=[self.stage])
+        plan = FlowPlan(
+            flow_pk=self.flow.pk.hex, stages=[self.stage], markers=[StageMarker()]
+        )
         plan.context[PLAN_CONTEXT_PENDING_USER] = self.user
         session = self.client.session
         session[SESSION_KEY_PLAN] = plan
@@ -70,5 +81,10 @@ class TestUserDeleteStage(TestCase):
             ),
             {},
         )
-        self.assertEqual(response.status_code, 302)
+        self.assertEqual(response.status_code, 200)
+        self.assertJSONEqual(
+            force_text(response.content),
+            {"type": "redirect", "to": reverse("passbook_core:overview")},
+        )
+
         self.assertFalse(User.objects.filter(username=self.username).exists())
diff --git a/passbook/stages/user_login/models.py b/passbook/stages/user_login/models.py
index 18a5bf4aa..13c5164d5 100644
--- a/passbook/stages/user_login/models.py
+++ b/passbook/stages/user_login/models.py
@@ -5,7 +5,7 @@ from passbook.flows.models import Stage
 
 
 class UserLoginStage(Stage):
-    """Login stage, allows a user to identify themselves to authenticate."""
+    """Attaches the currently pending user to the current session."""
 
     type = "passbook.stages.user_login.stage.UserLoginStageView"
     form = "passbook.stages.user_login.forms.UserLoginStageForm"
diff --git a/passbook/stages/user_login/tests.py b/passbook/stages/user_login/tests.py
index 59b988d2b..4509c7b50 100644
--- a/passbook/stages/user_login/tests.py
+++ b/passbook/stages/user_login/tests.py
@@ -1,8 +1,10 @@
 """login tests"""
 from django.shortcuts import reverse
 from django.test import Client, TestCase
+from django.utils.encoding import force_text
 
 from passbook.core.models import User
+from passbook.flows.markers import StageMarker
 from passbook.flows.models import Flow, FlowDesignation, FlowStageBinding
 from passbook.flows.planner import PLAN_CONTEXT_PENDING_USER, FlowPlan
 from passbook.flows.views import SESSION_KEY_PLAN
@@ -29,7 +31,9 @@ class TestUserLoginStage(TestCase):
 
     def test_valid_password(self):
         """Test with a valid pending user and backend"""
-        plan = FlowPlan(flow_pk=self.flow.pk.hex, stages=[self.stage])
+        plan = FlowPlan(
+            flow_pk=self.flow.pk.hex, stages=[self.stage], markers=[StageMarker()]
+        )
         plan.context[PLAN_CONTEXT_PENDING_USER] = self.user
         plan.context[
             PLAN_CONTEXT_AUTHENTICATION_BACKEND
@@ -43,12 +47,18 @@ class TestUserLoginStage(TestCase):
                 "passbook_flows:flow-executor", kwargs={"flow_slug": self.flow.slug}
             )
         )
-        self.assertEqual(response.status_code, 302)
-        self.assertEqual(response.url, reverse("passbook_core:overview"))
+
+        self.assertEqual(response.status_code, 200)
+        self.assertJSONEqual(
+            force_text(response.content),
+            {"type": "redirect", "to": reverse("passbook_core:overview")},
+        )
 
     def test_without_user(self):
         """Test a plan without any pending user, resulting in a denied"""
-        plan = FlowPlan(flow_pk=self.flow.pk.hex, stages=[self.stage])
+        plan = FlowPlan(
+            flow_pk=self.flow.pk.hex, stages=[self.stage], markers=[StageMarker()]
+        )
         session = self.client.session
         session[SESSION_KEY_PLAN] = plan
         session.save()
@@ -58,12 +68,18 @@ class TestUserLoginStage(TestCase):
                 "passbook_flows:flow-executor", kwargs={"flow_slug": self.flow.slug}
             )
         )
-        self.assertEqual(response.status_code, 302)
-        self.assertEqual(response.url, reverse("passbook_flows:denied"))
+
+        self.assertEqual(response.status_code, 200)
+        self.assertJSONEqual(
+            force_text(response.content),
+            {"type": "redirect", "to": reverse("passbook_flows:denied")},
+        )
 
     def test_without_backend(self):
         """Test a plan with pending user, without backend, resulting in a denied"""
-        plan = FlowPlan(flow_pk=self.flow.pk.hex, stages=[self.stage])
+        plan = FlowPlan(
+            flow_pk=self.flow.pk.hex, stages=[self.stage], markers=[StageMarker()]
+        )
         plan.context[PLAN_CONTEXT_PENDING_USER] = self.user
         session = self.client.session
         session[SESSION_KEY_PLAN] = plan
@@ -74,8 +90,12 @@ class TestUserLoginStage(TestCase):
                 "passbook_flows:flow-executor", kwargs={"flow_slug": self.flow.slug}
             )
         )
-        self.assertEqual(response.status_code, 302)
-        self.assertEqual(response.url, reverse("passbook_flows:denied"))
+
+        self.assertEqual(response.status_code, 200)
+        self.assertJSONEqual(
+            force_text(response.content),
+            {"type": "redirect", "to": reverse("passbook_flows:denied")},
+        )
 
     def test_form(self):
         """Test Form"""
diff --git a/passbook/stages/user_logout/models.py b/passbook/stages/user_logout/models.py
index 55a03983b..51833bfe1 100644
--- a/passbook/stages/user_logout/models.py
+++ b/passbook/stages/user_logout/models.py
@@ -5,7 +5,7 @@ from passbook.flows.models import Stage
 
 
 class UserLogoutStage(Stage):
-    """Logout stage, allows a user to identify themselves to authenticate."""
+    """Resets the users current session."""
 
     type = "passbook.stages.user_logout.stage.UserLogoutStageView"
     form = "passbook.stages.user_logout.forms.UserLogoutStageForm"
diff --git a/passbook/stages/user_logout/tests.py b/passbook/stages/user_logout/tests.py
index 6f5a309e4..7263ccee2 100644
--- a/passbook/stages/user_logout/tests.py
+++ b/passbook/stages/user_logout/tests.py
@@ -1,8 +1,10 @@
 """logout tests"""
 from django.shortcuts import reverse
 from django.test import Client, TestCase
+from django.utils.encoding import force_text
 
 from passbook.core.models import User
+from passbook.flows.markers import StageMarker
 from passbook.flows.models import Flow, FlowDesignation, FlowStageBinding
 from passbook.flows.planner import PLAN_CONTEXT_PENDING_USER, FlowPlan
 from passbook.flows.views import SESSION_KEY_PLAN
@@ -29,7 +31,9 @@ class TestUserLogoutStage(TestCase):
 
     def test_valid_password(self):
         """Test with a valid pending user and backend"""
-        plan = FlowPlan(flow_pk=self.flow.pk.hex, stages=[self.stage])
+        plan = FlowPlan(
+            flow_pk=self.flow.pk.hex, stages=[self.stage], markers=[StageMarker()]
+        )
         plan.context[PLAN_CONTEXT_PENDING_USER] = self.user
         plan.context[
             PLAN_CONTEXT_AUTHENTICATION_BACKEND
@@ -43,8 +47,12 @@ class TestUserLogoutStage(TestCase):
                 "passbook_flows:flow-executor", kwargs={"flow_slug": self.flow.slug}
             )
         )
-        self.assertEqual(response.status_code, 302)
-        self.assertEqual(response.url, reverse("passbook_core:overview"))
+
+        self.assertEqual(response.status_code, 200)
+        self.assertJSONEqual(
+            force_text(response.content),
+            {"type": "redirect", "to": reverse("passbook_core:overview")},
+        )
 
     def test_form(self):
         """Test Form"""
diff --git a/passbook/stages/user_write/models.py b/passbook/stages/user_write/models.py
index 078b4e174..140b5623d 100644
--- a/passbook/stages/user_write/models.py
+++ b/passbook/stages/user_write/models.py
@@ -5,7 +5,8 @@ from passbook.flows.models import Stage
 
 
 class UserWriteStage(Stage):
-    """Write stage, write a user from saved data."""
+    """Writes currently pending data into the pending user, or if no user exists,
+    creates a new user with the data."""
 
     type = "passbook.stages.user_write.stage.UserWriteStageView"
     form = "passbook.stages.user_write.forms.UserWriteStageForm"
diff --git a/passbook/stages/user_write/stage.py b/passbook/stages/user_write/stage.py
index 28eab9853..bf1973b8e 100644
--- a/passbook/stages/user_write/stage.py
+++ b/passbook/stages/user_write/stage.py
@@ -1,5 +1,6 @@
 """Write stage logic"""
 from django.contrib import messages
+from django.contrib.auth import update_session_auth_hash
 from django.contrib.auth.backends import ModelBackend
 from django.http import HttpRequest, HttpResponse
 from django.utils.translation import gettext as _
@@ -48,6 +49,10 @@ class UserWriteStageView(StageView):
             else:
                 user.attributes[key] = value
         user.save()
+        # Check if the password has been updated, and update the session auth hash
+        if any(["password" in x for x in data.keys()]):
+            update_session_auth_hash(self.request, user)
+            LOGGER.debug("Updated session hash", user=user)
         LOGGER.debug(
             "Updated existing user", user=user, flow_slug=self.executor.flow.slug,
         )
diff --git a/passbook/stages/user_write/tests.py b/passbook/stages/user_write/tests.py
index d37012207..d36ce0c06 100644
--- a/passbook/stages/user_write/tests.py
+++ b/passbook/stages/user_write/tests.py
@@ -4,8 +4,10 @@ from random import SystemRandom
 
 from django.shortcuts import reverse
 from django.test import Client, TestCase
+from django.utils.encoding import force_text
 
 from passbook.core.models import User
+from passbook.flows.markers import StageMarker
 from passbook.flows.models import Flow, FlowDesignation, FlowStageBinding
 from passbook.flows.planner import PLAN_CONTEXT_PENDING_USER, FlowPlan
 from passbook.flows.views import SESSION_KEY_PLAN
@@ -36,7 +38,9 @@ class TestUserWriteStage(TestCase):
             for _ in range(8)
         )
 
-        plan = FlowPlan(flow_pk=self.flow.pk.hex, stages=[self.stage])
+        plan = FlowPlan(
+            flow_pk=self.flow.pk.hex, stages=[self.stage], markers=[StageMarker()]
+        )
         plan.context[PLAN_CONTEXT_PROMPT] = {
             "username": "test-user",
             "name": "name",
@@ -52,7 +56,12 @@ class TestUserWriteStage(TestCase):
                 "passbook_flows:flow-executor", kwargs={"flow_slug": self.flow.slug}
             )
         )
-        self.assertEqual(response.status_code, 302)
+
+        self.assertEqual(response.status_code, 200)
+        self.assertJSONEqual(
+            force_text(response.content),
+            {"type": "redirect", "to": reverse("passbook_core:overview")},
+        )
         user_qs = User.objects.filter(
             username=plan.context[PLAN_CONTEXT_PROMPT]["username"]
         )
@@ -65,7 +74,9 @@ class TestUserWriteStage(TestCase):
             SystemRandom().choice(string.ascii_uppercase + string.digits)
             for _ in range(8)
         )
-        plan = FlowPlan(flow_pk=self.flow.pk.hex, stages=[self.stage])
+        plan = FlowPlan(
+            flow_pk=self.flow.pk.hex, stages=[self.stage], markers=[StageMarker()]
+        )
         plan.context[PLAN_CONTEXT_PENDING_USER] = User.objects.create(
             username="unittest", email="test@beryju.org"
         )
@@ -83,7 +94,12 @@ class TestUserWriteStage(TestCase):
                 "passbook_flows:flow-executor", kwargs={"flow_slug": self.flow.slug}
             )
         )
-        self.assertEqual(response.status_code, 302)
+
+        self.assertEqual(response.status_code, 200)
+        self.assertJSONEqual(
+            force_text(response.content),
+            {"type": "redirect", "to": reverse("passbook_core:overview")},
+        )
         user_qs = User.objects.filter(
             username=plan.context[PLAN_CONTEXT_PROMPT]["username"]
         )
@@ -93,7 +109,9 @@ class TestUserWriteStage(TestCase):
 
     def test_without_data(self):
         """Test without data results in error"""
-        plan = FlowPlan(flow_pk=self.flow.pk.hex, stages=[self.stage])
+        plan = FlowPlan(
+            flow_pk=self.flow.pk.hex, stages=[self.stage], markers=[StageMarker()]
+        )
         session = self.client.session
         session[SESSION_KEY_PLAN] = plan
         session.save()
@@ -103,8 +121,12 @@ class TestUserWriteStage(TestCase):
                 "passbook_flows:flow-executor", kwargs={"flow_slug": self.flow.slug}
             )
         )
-        self.assertEqual(response.status_code, 302)
-        self.assertEqual(response.url, reverse("passbook_flows:denied"))
+
+        self.assertEqual(response.status_code, 200)
+        self.assertJSONEqual(
+            force_text(response.content),
+            {"type": "redirect", "to": reverse("passbook_flows:denied")},
+        )
 
     def test_form(self):
         """Test Form"""
diff --git a/passbook/static/static/package.json b/passbook/static/static/package.json
index 349978a86..e714a0bc5 100644
--- a/passbook/static/static/package.json
+++ b/passbook/static/static/package.json
@@ -1,8 +1,8 @@
 {
   "license": "MIT",
   "dependencies": {
-    "@fortawesome/fontawesome-free": "^5.13.0",
-    "@patternfly/patternfly": "^2.71.6",
-    "codemirror": "^5.54.0"
+    "@fortawesome/fontawesome-free": "^5.13.1",
+    "@patternfly/patternfly": "^4.16.7",
+    "codemirror": "^5.55.0"
   }
 }
diff --git a/passbook/static/static/passbook/brand_inverted.svg b/passbook/static/static/passbook/brand_inverted.svg
new file mode 100644
index 000000000..86711c6bb
--- /dev/null
+++ b/passbook/static/static/passbook/brand_inverted.svg
@@ -0,0 +1,2 @@
+<svg version="1.1" id="Layer_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px"
+  width="120px" height="20px" viewBox="15 0 10 10" enable-background="new 0 0 270 10" xml:space="preserve"><defs><style>.cls-1{isolation:isolate;}.cls-2{fill:#000;}</style></defs><g class="cls-1"><path class="cls-2" d="M1.65,11V2.45H2.87V3a2.81,2.81,0,0,1,.47-.45A1.13,1.13,0,0,1,4,2.38,1.11,1.11,0,0,1,5.1,3a1.55,1.55,0,0,1,.16.5,5.61,5.61,0,0,1,0,.81V6.58c0,.45,0,.77,0,1a1.17,1.17,0,0,1-.55.9,1.23,1.23,0,0,1-.7.16,1.35,1.35,0,0,1-.64-.16A1.53,1.53,0,0,1,2.89,8h0v3ZM4.08,4.43a1.21,1.21,0,0,0-.14-.6.51.51,0,0,0-.46-.22A.54.54,0,0,0,3,3.82a.8.8,0,0,0-.17.54V6.73A.68.68,0,0,0,3,7.2a.6.6,0,0,0,.44.18A.53.53,0,0,0,4,7.17a1,1,0,0,0,.12-.5Z"/><path class="cls-2" d="M8.63,8.54V7.91h0a2.24,2.24,0,0,1-.48.52,1.13,1.13,0,0,1-.69.18A1.39,1.39,0,0,1,7,8.54a1.09,1.09,0,0,1-.43-.24,1.32,1.32,0,0,1-.33-.49A2.33,2.33,0,0,1,6.11,7a4.89,4.89,0,0,1,.08-.91,1.51,1.51,0,0,1,.31-.65,1.44,1.44,0,0,1,.59-.38A3.19,3.19,0,0,1,8,4.93h.59V4.33a1,1,0,0,0-.13-.52A.52.52,0,0,0,8,3.61a.71.71,0,0,0-.44.15.78.78,0,0,0-.26.46H6.13A2,2,0,0,1,6.69,2.9a1.73,1.73,0,0,1,.57-.38A2,2,0,0,1,8,2.38a2.18,2.18,0,0,1,.72.12,1.71,1.71,0,0,1,.59.36,2,2,0,0,1,.38.6,2.18,2.18,0,0,1,.14.84V8.54Zm0-2.62-.34,0a1.2,1.2,0,0,0-.67.18.76.76,0,0,0-.29.68.89.89,0,0,0,.17.56A.55.55,0,0,0,8,7.53a.63.63,0,0,0,.49-.2.91.91,0,0,0,.17-.58Z"/><path class="cls-2" d="M13,4.16a.59.59,0,0,0-.2-.47.65.65,0,0,0-.42-.16.59.59,0,0,0-.45.19.66.66,0,0,0-.15.43.8.8,0,0,0,.08.33.85.85,0,0,0,.44.29l.71.29a1.73,1.73,0,0,1,.95.72,2,2,0,0,1,.26,1,1.85,1.85,0,0,1-.52,1.3,1.56,1.56,0,0,1-.58.39,1.88,1.88,0,0,1-2-.32,1.58,1.58,0,0,1-.4-.57,1.81,1.81,0,0,1-.17-.8h1.15a1.11,1.11,0,0,0,.17.47.56.56,0,0,0,.49.22.71.71,0,0,0,.47-.18A.59.59,0,0,0,13,6.8a.69.69,0,0,0-.13-.43,1.08,1.08,0,0,0-.48-.32l-.59-.21a2.08,2.08,0,0,1-.9-.64,1.66,1.66,0,0,1-.33-1,1.89,1.89,0,0,1,.14-.72,1.78,1.78,0,0,1,.4-.57,1.5,1.5,0,0,1,.56-.36,1.82,1.82,0,0,1,.7-.13,1.93,1.93,0,0,1,.69.13,1.6,1.6,0,0,1,.54.38,1.85,1.85,0,0,1,.36.57,1.82,1.82,0,0,1,.13.7Z"/><path class="cls-2" d="M17.2,4.16a.63.63,0,0,0-.2-.47.69.69,0,0,0-.43-.16.55.55,0,0,0-.44.19.62.62,0,0,0-.16.43.68.68,0,0,0,.09.33.81.81,0,0,0,.43.29l.72.29a1.7,1.7,0,0,1,.94.72,2,2,0,0,1,.26,1,1.85,1.85,0,0,1-.52,1.3,1.61,1.61,0,0,1-.57.39,1.81,1.81,0,0,1-.74.15,1.76,1.76,0,0,1-1.24-.47,1.61,1.61,0,0,1-.41-.57,2,2,0,0,1-.17-.8h1.15a1.12,1.12,0,0,0,.18.47.53.53,0,0,0,.48.22.72.72,0,0,0,.48-.18.59.59,0,0,0,.21-.48.69.69,0,0,0-.14-.43,1,1,0,0,0-.48-.32l-.58-.21a2.06,2.06,0,0,1-.91-.64,1.66,1.66,0,0,1-.33-1A1.89,1.89,0,0,1,15,3.44a1.78,1.78,0,0,1,.4-.57,1.58,1.58,0,0,1,.56-.36,1.82,1.82,0,0,1,.7-.13,1.93,1.93,0,0,1,.69.13,1.75,1.75,0,0,1,.55.38,1.85,1.85,0,0,1,.36.57,2,2,0,0,1,.13.7Z"/><path class="cls-2" d="M19.2,8.54V0h1.22V3h0a1.53,1.53,0,0,1,.48-.47,1.39,1.39,0,0,1,.65-.16,1.26,1.26,0,0,1,.69.16,1.35,1.35,0,0,1,.4.39,1.18,1.18,0,0,1,.15.51,7.72,7.72,0,0,1,0,1V6.73a5.56,5.56,0,0,1-.05.8,1.56,1.56,0,0,1-.15.5,1.12,1.12,0,0,1-1.07.58,1.15,1.15,0,0,1-.7-.18A3.79,3.79,0,0,1,20.42,8v.55Zm2.44-4.21a1,1,0,0,0-.13-.51A.5.5,0,0,0,21,3.61a.57.57,0,0,0-.44.18.66.66,0,0,0-.18.48V6.63a.83.83,0,0,0,.17.54.52.52,0,0,0,.45.21.49.49,0,0,0,.45-.22,1.11,1.11,0,0,0,.15-.6Z"/><path class="cls-2" d="M23.76,4.49a4.83,4.83,0,0,1,0-.68A1.55,1.55,0,0,1,24,3.26a1.59,1.59,0,0,1,.62-.64,1.84,1.84,0,0,1,1-.24,1.87,1.87,0,0,1,1,.24,1.59,1.59,0,0,1,.62.64,1.55,1.55,0,0,1,.18.55,4.83,4.83,0,0,1,.05.68v2a4.72,4.72,0,0,1-.05.68,1.55,1.55,0,0,1-.18.55,1.59,1.59,0,0,1-.62.64,1.87,1.87,0,0,1-1,.24,1.84,1.84,0,0,1-1-.24A1.59,1.59,0,0,1,24,7.73a1.55,1.55,0,0,1-.18-.55,4.72,4.72,0,0,1,0-.68ZM25,6.69a.72.72,0,0,0,.17.52.53.53,0,0,0,.43.17A.55.55,0,0,0,26,7.21a.72.72,0,0,0,.16-.52V4.3A.74.74,0,0,0,26,3.78a.55.55,0,0,0-.44-.17.53.53,0,0,0-.43.17A.74.74,0,0,0,25,4.3Z"/><path class="cls-2" d="M28.2,4.49a4.83,4.83,0,0,1,.05-.68,1.55,1.55,0,0,1,.18-.55,1.59,1.59,0,0,1,.62-.64,1.84,1.84,0,0,1,1-.24,1.87,1.87,0,0,1,1,.24,1.59,1.59,0,0,1,.62.64,1.55,1.55,0,0,1,.18.55,4.83,4.83,0,0,1,.05.68v2a4.72,4.72,0,0,1-.05.68,1.55,1.55,0,0,1-.18.55,1.59,1.59,0,0,1-.62.64,1.87,1.87,0,0,1-1,.24,1.84,1.84,0,0,1-1-.24,1.59,1.59,0,0,1-.62-.64,1.55,1.55,0,0,1-.18-.55,4.72,4.72,0,0,1-.05-.68Zm1.22,2.2a.72.72,0,0,0,.17.52.53.53,0,0,0,.43.17.55.55,0,0,0,.44-.17.72.72,0,0,0,.16-.52V4.3a.74.74,0,0,0-.16-.52A.55.55,0,0,0,30,3.61a.53.53,0,0,0-.43.17.74.74,0,0,0-.17.52Z"/><path class="cls-2" d="M32.75,8.54V0H34V5.11h0l1.47-2.66H36.7L35.24,4.93,37,8.54H35.66l-1.1-2.63L34,6.83V8.54Z"/></g></svg>
diff --git a/passbook/static/static/passbook/pf.css b/passbook/static/static/passbook/pf.css
index 49ec4eb54..5f18d0cd6 100644
--- a/passbook/static/static/passbook/pf.css
+++ b/passbook/static/static/passbook/pf.css
@@ -198,122 +198,9 @@ input[data-is-monospace] {
     font-family: monospace;
 }
 
-
-.ws-page-header {
-    background-color: #151515;
-    min-height: auto
-}
-
-@media (min-width: 992px) {
-    .ws-page-header .pf-c-page__header-nav {
-        margin-left:12px
-    }
-}
-
-.ws-page-header .pf-c-nav__scroll-button {
-    outline-offset: -4px;
-    height: 100%;
-    top: 0
-}
-
-.ws-page-header .pf-c-nav__horizontal-list .pf-c-nav__item {
-    margin-right: 0
-}
-
-.ws-page-header .pf-c-nav__horizontal-list .pf-c-nav__link {
-    padding-top: 22px;
-    padding-right: var(--pf-global--spacer--md);
-    padding-left: var(--pf-global--spacer--md);
-    color: var(--pf-global--Color--light-100)
-}
-
-@media (max-width: 991px) {
-    .ws-page-header .pf-c-nav__horizontal-list .pf-c-nav__link {
-        padding-top:10px
-    }
-}
-
-.ws-page-header .pf-c-nav__horizontal-list .pf-c-nav__link:after {
-    top: 0!important;
-    height: 4px
-}
-
-.ws-page-header .pf-c-nav__horizontal-list .pf-c-nav__link:active,.ws-page-header .pf-c-nav__horizontal-list .pf-c-nav__link:hover {
-    -webkit-transition: .5s;
-    transition: .5s
-}
-
-.ws-page-header .pf-c-nav__horizontal-list .pf-c-nav__link.pf-m-current,.ws-page-header .pf-c-nav__horizontal-list .pf-c-nav__link:active,.ws-page-header .pf-c-nav__horizontal-list .pf-c-nav__link:hover {
-    background-color: var(--pf-global--BackgroundColor--light-100);
-    color: #151515!important;
-    font-weight: var(--pf-global--FontWeight--normal)
-}
-
-.ws-page-header li a:after {
-    content: "";
-    position: absolute;
-    left: 50%!important;
-    bottom: 0;
-    -webkit-transform: translateX(-50%) scaleX(0);
-    transform: translateX(-50%) scaleX(0);
-    -webkit-transform-origin: 50% 50%;
-    transform-origin: 50% 50%;
-    width: 100%;
-    height: 1px;
-    background-color: var(--pf-global--BackgroundColor--light-100);
-    color: #151515!important;
-    -webkit-transition: -webkit-transform .25s;
-    transition: -webkit-transform .25s;
-    transition: transform .25s;
-    transition: transform .25s,-webkit-transform .25s
-}
-
-.ws-page-header li a:hover:after {
-    -webkit-transform: translateX(-50%) scaleX(1);
-    transform: translateX(-50%) scaleX(1)
-}
-
-.ws-page-header li a.pf-m-current:after {
-    left: 0!important;
-    -webkit-transform: none;
-    transform: none
-}
-
-.ws-page-sidebar#page-sidebar {
-    color: #fff;
-    box-shadow: none
-}
-
-.ws-page-sidebar .pf-c-nav {
-    margin-top: 16px
-}
-
-.pf-site-search {
-    padding: 0 0 2px;
-    width: 150px;
-    background: transparent;
-    -webkit-transition: .25s;
-    transition: .25s
-}
-
-.ws-page-header .pf-c-page__header-brand-toggle {
-    display: none;
-    visibility: hidden
-}
-
-@media (max-width: 768px) {
-    .pf-site-search {
-        width:100px
-    }
-
-    .ws-page-header .pf-c-page__header-brand-toggle {
-        display: block;
-        visibility: visible
-    }
-}
-
 /* Form with user */
 .form-control-static {
+    margin-top: var(--pf-global--spacer--sm);
     display: flex;
     align-items: center;
     justify-content: space-between;
@@ -323,10 +210,28 @@ input[data-is-monospace] {
     align-items: center;
 }
 .form-control-static img {
-    margin-right: 5px;
+    margin-right: var(--pf-global--spacer--xs);
 }
 .form-control-static a {
-    padding-top: 3px;
-    padding-bottom: 3px;
-    line-height: 32px;
+    padding-top: var(--pf-global--spacer--xs);
+    padding-bottom: var(--pf-global--spacer--xs);
+    line-height: var(--pf-global--spacer--xl);
+}
+
+/* Static OTP Tokens, passbook.stages.otp_static */
+.pb-otp-tokens {
+    list-style: circle;
+    columns: 2;
+    -webkit-columns: 2;
+    -moz-columns: 2;
+    margin-left: var(--pf-global--spacer--xs);
+}
+.pb-otp-tokens li {
+    font-size: var(--pf-global--FontSize--2xl);
+    font-family: monospace;
+}
+
+/* Fix pre elements within alerts */
+.pf-c-alert pre {
+    white-space: pre-wrap;
 }
diff --git a/passbook/static/static/passbook/pf.js b/passbook/static/static/passbook/pf.js
index 52c0aba4c..3e0a31645 100644
--- a/passbook/static/static/passbook/pf.js
+++ b/passbook/static/static/passbook/pf.js
@@ -22,6 +22,14 @@ document.querySelectorAll(".pf-c-modal-box [data-modal-close]").forEach((b) => {
     });
 });
 
+// Make Checkbox label click trigger checkbox toggle
+document.querySelectorAll(".pf-c-check__label").forEach((checkLabel) => {
+    checkLabel.addEventListener("click", (e) => {
+        const checkbox = e.target.parentElement.querySelector("input[type=checkbox]");
+        checkbox.checked = !checkbox.checked;
+    });
+});
+
 // CodeMirror
 document.querySelectorAll(".codemirror").forEach((cm) => {
     let cmMode = 'xml';
@@ -50,6 +58,9 @@ const convertToSlug = (text) => {
 document.querySelectorAll("input[name=name]").forEach((input) => {
     input.addEventListener("input", (e) => {
         const form = e.target.closest("form");
+        if (form === null) {
+            return;
+        }
         const slugField = form.querySelector("input[name=slug]");
         slugField.value = convertToSlug(e.target.value);
     });
diff --git a/passbook/static/static/yarn.lock b/passbook/static/static/yarn.lock
index 1a9902c0c..b09e04e53 100644
--- a/passbook/static/static/yarn.lock
+++ b/passbook/static/static/yarn.lock
@@ -2,17 +2,17 @@
 # yarn lockfile v1
 
 
-"@fortawesome/fontawesome-free@^5.13.0":
-  version "5.13.0"
-  resolved "https://registry.yarnpkg.com/@fortawesome/fontawesome-free/-/fontawesome-free-5.13.0.tgz#fcb113d1aca4b471b709e8c9c168674fbd6e06d9"
-  integrity sha512-xKOeQEl5O47GPZYIMToj6uuA2syyFlq9EMSl2ui0uytjY9xbe8XS0pexNWmxrdcCyNGyDmLyYw5FtKsalBUeOg==
+"@fortawesome/fontawesome-free@^5.13.1":
+  version "5.13.1"
+  resolved "https://registry.yarnpkg.com/@fortawesome/fontawesome-free/-/fontawesome-free-5.13.1.tgz#c53b4066edae16cd1fd669f687baf031b45fb9d6"
+  integrity sha512-D819f34FLHeBN/4xvw0HR0u7U2G7RqjPSggXqf7LktsxWQ48VAfGwvMrhcVuaZV2fF069c/619RdgCCms0DHhw==
 
-"@patternfly/patternfly@^2.71.6":
-  version "2.71.6"
-  resolved "https://registry.yarnpkg.com/@patternfly/patternfly/-/patternfly-2.71.6.tgz#6385cbd5aaca2f59bf65496e0189c541a7f00a82"
-  integrity sha512-mqqtuCVa+/FbyyK8hSAcfEIwNX73+zbnzHpmC4NrW0kyMzSszPtBqev/ZO79ZxGqZUpLOyUBTVaH7oKn8cL35Q==
+"@patternfly/patternfly@^4.16.7":
+  version "4.16.7"
+  resolved "https://registry.yarnpkg.com/@patternfly/patternfly/-/patternfly-4.16.7.tgz#6343eb530528e5b6c2670d24b115031e135f15ad"
+  integrity sha512-B5jP/xG1MxNNDO3p52rx7a2DJspq8aUJFixYdPk1peK7SaC5X9ju2oCyE9xN1Nfe1AjlPxAOpNWPd9TWw88yLQ==
 
-codemirror@^5.54.0:
-  version "5.54.0"
-  resolved "https://registry.yarnpkg.com/codemirror/-/codemirror-5.54.0.tgz#82b6adf662b29eeb7b867fe7839d49e25e4a0b38"
-  integrity sha512-Pgf3surv4zvw+KaW3doUU7pGjF0BPU8/sj7eglWJjzni46U/DDW8pu3nZY0QgQKUcICDXRkq8jZmq0y6KhxM3Q==
+codemirror@^5.55.0:
+  version "5.55.0"
+  resolved "https://registry.yarnpkg.com/codemirror/-/codemirror-5.55.0.tgz#23731f641288f202a6858fdc878f3149e0e04363"
+  integrity sha512-TumikSANlwiGkdF/Blnu/rqovZ0Y3Jh8yy9TqrPbSM0xxSucq3RgnpVDQ+mD9q6JERJEIT2FMuF/fBGfkhIR/g==
diff --git a/pyproject.toml b/pyproject.toml
new file mode 100644
index 000000000..b5413f6c7
--- /dev/null
+++ b/pyproject.toml
@@ -0,0 +1,2 @@
+[tool.black]
+target-version = ['py37']
diff --git a/scripts/coverage.sh b/scripts/coverage.sh
index c95d47574..eee3c35b6 100755
--- a/scripts/coverage.sh
+++ b/scripts/coverage.sh
@@ -1,5 +1,5 @@
 #!/bin/bash -xe
-coverage run --concurrency=multiprocessing manage.py test --failfast
+coverage run --concurrency=multiprocessing manage.py test passbook --failfast
 coverage combine
 coverage html
 coverage report
diff --git a/scripts/pre-commit.sh b/scripts/pre-commit.sh
index 1cf64708d..e8335a1a9 100755
--- a/scripts/pre-commit.sh
+++ b/scripts/pre-commit.sh
@@ -1,9 +1,9 @@
 #!/bin/bash -xe
-isort -rc passbook
+isort -rc .
 pyright
-black passbook
+black .
 ./manage.py generate_swagger -o swagger.yaml -f yaml
 scripts/coverage.sh
-bandit -r passbook
+bandit -r .
 pylint passbook
 prospector
diff --git a/swagger.yaml b/swagger.yaml
index 31c87f5be..10eb109b4 100755
--- a/swagger.yaml
+++ b/swagger.yaml
@@ -1222,6 +1222,133 @@ paths:
         required: true
         type: string
         format: uuid
+  /policies/group_membership/:
+    get:
+      operationId: policies_group_membership_list
+      description: Group Membership Policy Viewset
+      parameters:
+        - name: ordering
+          in: query
+          description: Which field to use when ordering the results.
+          required: false
+          type: string
+        - name: search
+          in: query
+          description: A search term.
+          required: false
+          type: string
+        - name: limit
+          in: query
+          description: Number of results to return per page.
+          required: false
+          type: integer
+        - name: offset
+          in: query
+          description: The initial index from which to return the results.
+          required: false
+          type: integer
+      responses:
+        '200':
+          description: ''
+          schema:
+            required:
+              - count
+              - results
+            type: object
+            properties:
+              count:
+                type: integer
+              next:
+                type: string
+                format: uri
+                x-nullable: true
+              previous:
+                type: string
+                format: uri
+                x-nullable: true
+              results:
+                type: array
+                items:
+                  $ref: '#/definitions/GroupMembershipPolicy'
+      tags:
+        - policies
+    post:
+      operationId: policies_group_membership_create
+      description: Group Membership Policy Viewset
+      parameters:
+        - name: data
+          in: body
+          required: true
+          schema:
+            $ref: '#/definitions/GroupMembershipPolicy'
+      responses:
+        '201':
+          description: ''
+          schema:
+            $ref: '#/definitions/GroupMembershipPolicy'
+      tags:
+        - policies
+    parameters: []
+  /policies/group_membership/{policy_uuid}/:
+    get:
+      operationId: policies_group_membership_read
+      description: Group Membership Policy Viewset
+      parameters: []
+      responses:
+        '200':
+          description: ''
+          schema:
+            $ref: '#/definitions/GroupMembershipPolicy'
+      tags:
+        - policies
+    put:
+      operationId: policies_group_membership_update
+      description: Group Membership Policy Viewset
+      parameters:
+        - name: data
+          in: body
+          required: true
+          schema:
+            $ref: '#/definitions/GroupMembershipPolicy'
+      responses:
+        '200':
+          description: ''
+          schema:
+            $ref: '#/definitions/GroupMembershipPolicy'
+      tags:
+        - policies
+    patch:
+      operationId: policies_group_membership_partial_update
+      description: Group Membership Policy Viewset
+      parameters:
+        - name: data
+          in: body
+          required: true
+          schema:
+            $ref: '#/definitions/GroupMembershipPolicy'
+      responses:
+        '200':
+          description: ''
+          schema:
+            $ref: '#/definitions/GroupMembershipPolicy'
+      tags:
+        - policies
+    delete:
+      operationId: policies_group_membership_delete
+      description: Group Membership Policy Viewset
+      parameters: []
+      responses:
+        '204':
+          description: ''
+      tags:
+        - policies
+    parameters:
+      - name: policy_uuid
+        in: path
+        description: A UUID string identifying this Group Membership Policy.
+        required: true
+        type: string
+        format: uuid
   /policies/haveibeenpwned/:
     get:
       operationId: policies_haveibeenpwned_list
@@ -1352,7 +1479,7 @@ paths:
   /policies/password/:
     get:
       operationId: policies_password_list
-      description: Source Viewset
+      description: Password Policy Viewset
       parameters:
         - name: ordering
           in: query
@@ -1401,7 +1528,7 @@ paths:
         - policies
     post:
       operationId: policies_password_create
-      description: Source Viewset
+      description: Password Policy Viewset
       parameters:
         - name: data
           in: body
@@ -1419,7 +1546,7 @@ paths:
   /policies/password/{policy_uuid}/:
     get:
       operationId: policies_password_read
-      description: Source Viewset
+      description: Password Policy Viewset
       parameters: []
       responses:
         '200':
@@ -1430,7 +1557,7 @@ paths:
         - policies
     put:
       operationId: policies_password_update
-      description: Source Viewset
+      description: Password Policy Viewset
       parameters:
         - name: data
           in: body
@@ -1446,7 +1573,7 @@ paths:
         - policies
     patch:
       operationId: policies_password_partial_update
-      description: Source Viewset
+      description: Password Policy Viewset
       parameters:
         - name: data
           in: body
@@ -1462,7 +1589,7 @@ paths:
         - policies
     delete:
       operationId: policies_password_delete
-      description: Source Viewset
+      description: Password Policy Viewset
       parameters: []
       responses:
         '204':
@@ -1476,9 +1603,9 @@ paths:
         required: true
         type: string
         format: uuid
-  /policies/passwordexpiry/:
+  /policies/password_expiry/:
     get:
-      operationId: policies_passwordexpiry_list
+      operationId: policies_password_expiry_list
       description: Password Expiry Viewset
       parameters:
         - name: ordering
@@ -1527,7 +1654,7 @@ paths:
       tags:
         - policies
     post:
-      operationId: policies_passwordexpiry_create
+      operationId: policies_password_expiry_create
       description: Password Expiry Viewset
       parameters:
         - name: data
@@ -1543,9 +1670,9 @@ paths:
       tags:
         - policies
     parameters: []
-  /policies/passwordexpiry/{policy_uuid}/:
+  /policies/password_expiry/{policy_uuid}/:
     get:
-      operationId: policies_passwordexpiry_read
+      operationId: policies_password_expiry_read
       description: Password Expiry Viewset
       parameters: []
       responses:
@@ -1556,7 +1683,7 @@ paths:
       tags:
         - policies
     put:
-      operationId: policies_passwordexpiry_update
+      operationId: policies_password_expiry_update
       description: Password Expiry Viewset
       parameters:
         - name: data
@@ -1572,7 +1699,7 @@ paths:
       tags:
         - policies
     patch:
-      operationId: policies_passwordexpiry_partial_update
+      operationId: policies_password_expiry_partial_update
       description: Password Expiry Viewset
       parameters:
         - name: data
@@ -1588,7 +1715,7 @@ paths:
       tags:
         - policies
     delete:
-      operationId: policies_passwordexpiry_delete
+      operationId: policies_password_expiry_delete
       description: Password Expiry Viewset
       parameters: []
       responses:
@@ -2951,6 +3078,133 @@ paths:
         required: true
         type: string
         format: uuid
+  /sources/saml/:
+    get:
+      operationId: sources_saml_list
+      description: SAMLSource Viewset
+      parameters:
+        - name: ordering
+          in: query
+          description: Which field to use when ordering the results.
+          required: false
+          type: string
+        - name: search
+          in: query
+          description: A search term.
+          required: false
+          type: string
+        - name: limit
+          in: query
+          description: Number of results to return per page.
+          required: false
+          type: integer
+        - name: offset
+          in: query
+          description: The initial index from which to return the results.
+          required: false
+          type: integer
+      responses:
+        '200':
+          description: ''
+          schema:
+            required:
+              - count
+              - results
+            type: object
+            properties:
+              count:
+                type: integer
+              next:
+                type: string
+                format: uri
+                x-nullable: true
+              previous:
+                type: string
+                format: uri
+                x-nullable: true
+              results:
+                type: array
+                items:
+                  $ref: '#/definitions/SAMLSource'
+      tags:
+        - sources
+    post:
+      operationId: sources_saml_create
+      description: SAMLSource Viewset
+      parameters:
+        - name: data
+          in: body
+          required: true
+          schema:
+            $ref: '#/definitions/SAMLSource'
+      responses:
+        '201':
+          description: ''
+          schema:
+            $ref: '#/definitions/SAMLSource'
+      tags:
+        - sources
+    parameters: []
+  /sources/saml/{pbm_uuid}/:
+    get:
+      operationId: sources_saml_read
+      description: SAMLSource Viewset
+      parameters: []
+      responses:
+        '200':
+          description: ''
+          schema:
+            $ref: '#/definitions/SAMLSource'
+      tags:
+        - sources
+    put:
+      operationId: sources_saml_update
+      description: SAMLSource Viewset
+      parameters:
+        - name: data
+          in: body
+          required: true
+          schema:
+            $ref: '#/definitions/SAMLSource'
+      responses:
+        '200':
+          description: ''
+          schema:
+            $ref: '#/definitions/SAMLSource'
+      tags:
+        - sources
+    patch:
+      operationId: sources_saml_partial_update
+      description: SAMLSource Viewset
+      parameters:
+        - name: data
+          in: body
+          required: true
+          schema:
+            $ref: '#/definitions/SAMLSource'
+      responses:
+        '200':
+          description: ''
+          schema:
+            $ref: '#/definitions/SAMLSource'
+      tags:
+        - sources
+    delete:
+      operationId: sources_saml_delete
+      description: SAMLSource Viewset
+      parameters: []
+      responses:
+        '204':
+          description: ''
+      tags:
+        - sources
+    parameters:
+      - name: pbm_uuid
+        in: path
+        description: A UUID string identifying this SAML Source.
+        required: true
+        type: string
+        format: uuid
   /stages/all/:
     get:
       operationId: stages_all_list
@@ -3148,6 +3402,133 @@ paths:
         required: true
         type: string
         format: uuid
+  /stages/consent/:
+    get:
+      operationId: stages_consent_list
+      description: ConsentStage Viewset
+      parameters:
+        - name: ordering
+          in: query
+          description: Which field to use when ordering the results.
+          required: false
+          type: string
+        - name: search
+          in: query
+          description: A search term.
+          required: false
+          type: string
+        - name: limit
+          in: query
+          description: Number of results to return per page.
+          required: false
+          type: integer
+        - name: offset
+          in: query
+          description: The initial index from which to return the results.
+          required: false
+          type: integer
+      responses:
+        '200':
+          description: ''
+          schema:
+            required:
+              - count
+              - results
+            type: object
+            properties:
+              count:
+                type: integer
+              next:
+                type: string
+                format: uri
+                x-nullable: true
+              previous:
+                type: string
+                format: uri
+                x-nullable: true
+              results:
+                type: array
+                items:
+                  $ref: '#/definitions/ConsentStage'
+      tags:
+        - stages
+    post:
+      operationId: stages_consent_create
+      description: ConsentStage Viewset
+      parameters:
+        - name: data
+          in: body
+          required: true
+          schema:
+            $ref: '#/definitions/ConsentStage'
+      responses:
+        '201':
+          description: ''
+          schema:
+            $ref: '#/definitions/ConsentStage'
+      tags:
+        - stages
+    parameters: []
+  /stages/consent/{stage_uuid}/:
+    get:
+      operationId: stages_consent_read
+      description: ConsentStage Viewset
+      parameters: []
+      responses:
+        '200':
+          description: ''
+          schema:
+            $ref: '#/definitions/ConsentStage'
+      tags:
+        - stages
+    put:
+      operationId: stages_consent_update
+      description: ConsentStage Viewset
+      parameters:
+        - name: data
+          in: body
+          required: true
+          schema:
+            $ref: '#/definitions/ConsentStage'
+      responses:
+        '200':
+          description: ''
+          schema:
+            $ref: '#/definitions/ConsentStage'
+      tags:
+        - stages
+    patch:
+      operationId: stages_consent_partial_update
+      description: ConsentStage Viewset
+      parameters:
+        - name: data
+          in: body
+          required: true
+          schema:
+            $ref: '#/definitions/ConsentStage'
+      responses:
+        '200':
+          description: ''
+          schema:
+            $ref: '#/definitions/ConsentStage'
+      tags:
+        - stages
+    delete:
+      operationId: stages_consent_delete
+      description: ConsentStage Viewset
+      parameters: []
+      responses:
+        '204':
+          description: ''
+      tags:
+        - stages
+    parameters:
+      - name: stage_uuid
+        in: path
+        description: A UUID string identifying this Consent Stage.
+        required: true
+        type: string
+        format: uuid
   /stages/dummy/:
     get:
       operationId: stages_dummy_list
@@ -3783,10 +4164,10 @@ paths:
         required: true
         type: string
         format: uuid
-  /stages/otp/:
+  /stages/otp_static/:
     get:
-      operationId: stages_otp_list
-      description: OTPStage Viewset
+      operationId: stages_otp_static_list
+      description: OTPStaticStage Viewset
       parameters:
         - name: ordering
           in: query
@@ -3830,73 +4211,73 @@ paths:
               results:
                 type: array
                 items:
-                  $ref: '#/definitions/OTPStage'
+                  $ref: '#/definitions/OTPStaticStage'
       tags:
         - stages
     post:
-      operationId: stages_otp_create
-      description: OTPStage Viewset
+      operationId: stages_otp_static_create
+      description: OTPStaticStage Viewset
       parameters:
         - name: data
           in: body
           required: true
           schema:
-            $ref: '#/definitions/OTPStage'
+            $ref: '#/definitions/OTPStaticStage'
       responses:
         '201':
           description: ''
           schema:
-            $ref: '#/definitions/OTPStage'
+            $ref: '#/definitions/OTPStaticStage'
       tags:
         - stages
     parameters: []
-  /stages/otp/{stage_uuid}/:
+  /stages/otp_static/{stage_uuid}/:
     get:
-      operationId: stages_otp_read
-      description: OTPStage Viewset
+      operationId: stages_otp_static_read
+      description: OTPStaticStage Viewset
       parameters: []
       responses:
         '200':
           description: ''
           schema:
-            $ref: '#/definitions/OTPStage'
+            $ref: '#/definitions/OTPStaticStage'
       tags:
         - stages
     put:
-      operationId: stages_otp_update
-      description: OTPStage Viewset
+      operationId: stages_otp_static_update
+      description: OTPStaticStage Viewset
       parameters:
         - name: data
           in: body
           required: true
           schema:
-            $ref: '#/definitions/OTPStage'
+            $ref: '#/definitions/OTPStaticStage'
       responses:
         '200':
           description: ''
           schema:
-            $ref: '#/definitions/OTPStage'
+            $ref: '#/definitions/OTPStaticStage'
       tags:
         - stages
     patch:
-      operationId: stages_otp_partial_update
-      description: OTPStage Viewset
+      operationId: stages_otp_static_partial_update
+      description: OTPStaticStage Viewset
       parameters:
         - name: data
           in: body
           required: true
           schema:
-            $ref: '#/definitions/OTPStage'
+            $ref: '#/definitions/OTPStaticStage'
       responses:
         '200':
           description: ''
           schema:
-            $ref: '#/definitions/OTPStage'
+            $ref: '#/definitions/OTPStaticStage'
       tags:
         - stages
     delete:
-      operationId: stages_otp_delete
-      description: OTPStage Viewset
+      operationId: stages_otp_static_delete
+      description: OTPStaticStage Viewset
       parameters: []
       responses:
         '204':
@@ -3906,7 +4287,261 @@ paths:
     parameters:
       - name: stage_uuid
         in: path
-        description: A UUID string identifying this OTP Stage.
+        description: A UUID string identifying this OTP Static Setup Stage.
+        required: true
+        type: string
+        format: uuid
+  /stages/otp_time/:
+    get:
+      operationId: stages_otp_time_list
+      description: OTPTimeStage Viewset
+      parameters:
+        - name: ordering
+          in: query
+          description: Which field to use when ordering the results.
+          required: false
+          type: string
+        - name: search
+          in: query
+          description: A search term.
+          required: false
+          type: string
+        - name: limit
+          in: query
+          description: Number of results to return per page.
+          required: false
+          type: integer
+        - name: offset
+          in: query
+          description: The initial index from which to return the results.
+          required: false
+          type: integer
+      responses:
+        '200':
+          description: ''
+          schema:
+            required:
+              - count
+              - results
+            type: object
+            properties:
+              count:
+                type: integer
+              next:
+                type: string
+                format: uri
+                x-nullable: true
+              previous:
+                type: string
+                format: uri
+                x-nullable: true
+              results:
+                type: array
+                items:
+                  $ref: '#/definitions/OTPTimeStage'
+      tags:
+        - stages
+    post:
+      operationId: stages_otp_time_create
+      description: OTPTimeStage Viewset
+      parameters:
+        - name: data
+          in: body
+          required: true
+          schema:
+            $ref: '#/definitions/OTPTimeStage'
+      responses:
+        '201':
+          description: ''
+          schema:
+            $ref: '#/definitions/OTPTimeStage'
+      tags:
+        - stages
+    parameters: []
+  /stages/otp_time/{stage_uuid}/:
+    get:
+      operationId: stages_otp_time_read
+      description: OTPTimeStage Viewset
+      parameters: []
+      responses:
+        '200':
+          description: ''
+          schema:
+            $ref: '#/definitions/OTPTimeStage'
+      tags:
+        - stages
+    put:
+      operationId: stages_otp_time_update
+      description: OTPTimeStage Viewset
+      parameters:
+        - name: data
+          in: body
+          required: true
+          schema:
+            $ref: '#/definitions/OTPTimeStage'
+      responses:
+        '200':
+          description: ''
+          schema:
+            $ref: '#/definitions/OTPTimeStage'
+      tags:
+        - stages
+    patch:
+      operationId: stages_otp_time_partial_update
+      description: OTPTimeStage Viewset
+      parameters:
+        - name: data
+          in: body
+          required: true
+          schema:
+            $ref: '#/definitions/OTPTimeStage'
+      responses:
+        '200':
+          description: ''
+          schema:
+            $ref: '#/definitions/OTPTimeStage'
+      tags:
+        - stages
+    delete:
+      operationId: stages_otp_time_delete
+      description: OTPTimeStage Viewset
+      parameters: []
+      responses:
+        '204':
+          description: ''
+      tags:
+        - stages
+    parameters:
+      - name: stage_uuid
+        in: path
+        description: A UUID string identifying this OTP Time (TOTP) Setup Stage.
+        required: true
+        type: string
+        format: uuid
+  /stages/otp_validate/:
+    get:
+      operationId: stages_otp_validate_list
+      description: OTPValidateStage Viewset
+      parameters:
+        - name: ordering
+          in: query
+          description: Which field to use when ordering the results.
+          required: false
+          type: string
+        - name: search
+          in: query
+          description: A search term.
+          required: false
+          type: string
+        - name: limit
+          in: query
+          description: Number of results to return per page.
+          required: false
+          type: integer
+        - name: offset
+          in: query
+          description: The initial index from which to return the results.
+          required: false
+          type: integer
+      responses:
+        '200':
+          description: ''
+          schema:
+            required:
+              - count
+              - results
+            type: object
+            properties:
+              count:
+                type: integer
+              next:
+                type: string
+                format: uri
+                x-nullable: true
+              previous:
+                type: string
+                format: uri
+                x-nullable: true
+              results:
+                type: array
+                items:
+                  $ref: '#/definitions/OTPValidateStage'
+      tags:
+        - stages
+    post:
+      operationId: stages_otp_validate_create
+      description: OTPValidateStage Viewset
+      parameters:
+        - name: data
+          in: body
+          required: true
+          schema:
+            $ref: '#/definitions/OTPValidateStage'
+      responses:
+        '201':
+          description: ''
+          schema:
+            $ref: '#/definitions/OTPValidateStage'
+      tags:
+        - stages
+    parameters: []
+  /stages/otp_validate/{stage_uuid}/:
+    get:
+      operationId: stages_otp_validate_read
+      description: OTPValidateStage Viewset
+      parameters: []
+      responses:
+        '200':
+          description: ''
+          schema:
+            $ref: '#/definitions/OTPValidateStage'
+      tags:
+        - stages
+    put:
+      operationId: stages_otp_validate_update
+      description: OTPValidateStage Viewset
+      parameters:
+        - name: data
+          in: body
+          required: true
+          schema:
+            $ref: '#/definitions/OTPValidateStage'
+      responses:
+        '200':
+          description: ''
+          schema:
+            $ref: '#/definitions/OTPValidateStage'
+      tags:
+        - stages
+    patch:
+      operationId: stages_otp_validate_partial_update
+      description: OTPValidateStage Viewset
+      parameters:
+        - name: data
+          in: body
+          required: true
+          schema:
+            $ref: '#/definitions/OTPValidateStage'
+      responses:
+        '200':
+          description: ''
+          schema:
+            $ref: '#/definitions/OTPValidateStage'
+      tags:
+        - stages
+    delete:
+      operationId: stages_otp_validate_delete
+      description: OTPValidateStage Viewset
+      parameters: []
+      responses:
+        '204':
+          description: ''
+      tags:
+        - stages
+    parameters:
+      - name: stage_uuid
+        in: path
+        description: A UUID string identifying this OTP Validation Stage.
         required: true
         type: string
         format: uuid
@@ -4875,9 +5510,6 @@ definitions:
         pattern: ^[-a-zA-Z0-9_]+$
         maxLength: 50
         minLength: 1
-      skip_authorization:
-        title: Skip authorization
-        type: boolean
       provider:
         title: Provider
         type: integer
@@ -5048,11 +5680,12 @@ definitions:
         type: string
         enum:
           - authentication
+          - authorization
           - invalidation
           - enrollment
           - unenrollment
           - recovery
-          - password_change
+          - stage_setup
       stages:
         type: array
         items:
@@ -5155,6 +5788,23 @@ definitions:
         title: Expression
         type: string
         minLength: 1
+  GroupMembershipPolicy:
+    type: object
+    properties:
+      pk:
+        title: Policy uuid
+        type: string
+        format: uuid
+        readOnly: true
+      name:
+        title: Name
+        type: string
+        x-nullable: true
+      group:
+        title: Group
+        type: string
+        format: uuid
+        x-nullable: true
   HaveIBeenPwendPolicy:
     type: object
     properties:
@@ -5335,12 +5985,19 @@ definitions:
         type: string
         minLength: 1
   Provider:
+    required:
+      - authorization_flow
     type: object
     properties:
       pk:
         title: ID
         type: integer
         readOnly: true
+      authorization_flow:
+        title: Authorization flow
+        description: Flow used when authorizing this provider.
+        type: string
+        format: uuid
       property_mappings:
         type: array
         items:
@@ -5594,6 +6251,18 @@ definitions:
       enabled:
         title: Enabled
         type: boolean
+      authentication_flow:
+        title: Authentication flow
+        description: Flow to use when authenticating existing users.
+        type: string
+        format: uuid
+        x-nullable: true
+      enrollment_flow:
+        title: Enrollment flow
+        description: Flow to use when enrolling new users.
+        type: string
+        format: uuid
+        x-nullable: true
       __type__:
         title: 'type  '
         type: string
@@ -5629,6 +6298,18 @@ definitions:
       enabled:
         title: Enabled
         type: boolean
+      authentication_flow:
+        title: Authentication flow
+        description: Flow to use when authenticating existing users.
+        type: string
+        format: uuid
+        x-nullable: true
+      enrollment_flow:
+        title: Enrollment flow
+        description: Flow to use when enrolling new users.
+        type: string
+        format: uuid
+        x-nullable: true
       server_uri:
         title: Server URI
         type: string
@@ -5726,6 +6407,18 @@ definitions:
       enabled:
         title: Enabled
         type: boolean
+      authentication_flow:
+        title: Authentication flow
+        description: Flow to use when authenticating existing users.
+        type: string
+        format: uuid
+        x-nullable: true
+      enrollment_flow:
+        title: Enrollment flow
+        description: Flow to use when enrolling new users.
+        type: string
+        format: uuid
+        x-nullable: true
       provider_type:
         title: Provider type
         type: string
@@ -5763,6 +6456,79 @@ definitions:
         title: Consumer secret
         type: string
         minLength: 1
+  SAMLSource:
+    required:
+      - name
+      - slug
+      - sso_url
+      - signing_kp
+    type: object
+    properties:
+      name:
+        title: Name
+        description: Source's display Name.
+        type: string
+        minLength: 1
+      slug:
+        title: Slug
+        description: Internal source name, used in URLs.
+        type: string
+        format: slug
+        pattern: ^[-a-zA-Z0-9_]+$
+        maxLength: 50
+        minLength: 1
+      enabled:
+        title: Enabled
+        type: boolean
+      authentication_flow:
+        title: Authentication flow
+        description: Flow to use when authenticating existing users.
+        type: string
+        format: uuid
+        x-nullable: true
+      enrollment_flow:
+        title: Enrollment flow
+        description: Flow to use when enrolling new users.
+        type: string
+        format: uuid
+        x-nullable: true
+      issuer:
+        title: Issuer
+        description: Also known as Entity ID. Defaults the Metadata URL.
+        type: string
+      sso_url:
+        title: SSO URL
+        description: URL that the initial Login request is sent to.
+        type: string
+        format: uri
+        maxLength: 200
+        minLength: 1
+      binding_type:
+        title: Binding type
+        type: string
+        enum:
+          - REDIRECT
+          - POST
+      slo_url:
+        title: SLO URL
+        description: Optional URL if your IDP supports Single-Logout.
+        type: string
+        format: uri
+        maxLength: 200
+        x-nullable: true
+      temporary_user_delete_after:
+        title: Delete temporary users after
+        description: "Time offset when temporary users should be deleted. This only\
+          \ applies if your IDP uses the NameID Format 'transient', and the user doesn't\
+          \ log out manually. (Format: hours=1;minutes=2;seconds=3)."
+        type: string
+        minLength: 1
+      signing_kp:
+        title: Singing Keypair
+        description: Certificate Key Pair of the IdP which Assertion's Signature is
+          validated against.
+        type: string
+        format: uuid
   Stage:
     required:
       - name
@@ -5811,6 +6577,20 @@ definitions:
         description: Private key, acquired from https://www.google.com/recaptcha/intro/v3.html
         type: string
         minLength: 1
+  ConsentStage:
+    required:
+      - name
+    type: object
+    properties:
+      pk:
+        title: Stage uuid
+        type: string
+        format: uuid
+        readOnly: true
+      name:
+        title: Name
+        type: string
+        minLength: 1
   DummyStage:
     required:
       - name
@@ -5927,7 +6707,7 @@ definitions:
         x-nullable: true
       recovery_flow:
         title: Recovery flow
-        description: Optional enrollment flow, which is linked at the bottom of the
+        description: Optional recovery flow, which is linked at the bottom of the
           page.
         type: string
         format: uuid
@@ -5968,7 +6748,47 @@ definitions:
       fixed_data:
         title: Fixed data
         type: object
-  OTPStage:
+  OTPStaticStage:
+    required:
+      - name
+    type: object
+    properties:
+      pk:
+        title: Stage uuid
+        type: string
+        format: uuid
+        readOnly: true
+      name:
+        title: Name
+        type: string
+        minLength: 1
+      token_count:
+        title: Token count
+        type: integer
+        maximum: 2147483647
+        minimum: -2147483648
+  OTPTimeStage:
+    required:
+      - name
+      - digits
+    type: object
+    properties:
+      pk:
+        title: Stage uuid
+        type: string
+        format: uuid
+        readOnly: true
+      name:
+        title: Name
+        type: string
+        minLength: 1
+      digits:
+        title: Digits
+        type: integer
+        enum:
+          - 6
+          - 8
+  OTPValidateStage:
     required:
       - name
     type: object
@@ -5982,10 +6802,6 @@ definitions:
         title: Name
         type: string
         minLength: 1
-      enforced:
-        title: Enforced
-        description: Enforce enabled OTP for Users this stage applies to.
-        type: boolean
   PasswordStage:
     required:
       - name
@@ -6038,7 +6854,8 @@ definitions:
         type: string
         enum:
           - text
-          - e-mail
+          - username
+          - email
           - password
           - number
           - checkbox