anchor.diff:      show_user_page(Session, false, [], false).
   
   
  -request_credential(#{session := Session, session_id := SessionId,
  +request_credential(#{session := Session,
                        body_qs:= #{ service_id:=ServiceId}}) ->
  -    {ok, Issuer, Subject} = tts_session:get_iss_sub(Session),
  -    {ok, UserInfo} = tts_user_cache:get_user_info(Issuer, Subject),
  -    {ok, Token} = tts_session:get_token(Session),
  -    true = tts_service:is_enabled(ServiceId),
       Iface = <<"web interface">>,
  -    case  tts_credential:request(ServiceId, UserInfo, Iface, Token, []) of
  +    case  tts:request_credential_for(ServiceId, Session, [], Iface) of
           {ok, Credential, Log} ->
  -            [#{name := id, value:=CredId}|_] = Credential,
  -            lager:info("~p: requested credential ~p",
  -                       [SessionId, CredId]),
               show_user_page(Session, Credential, Log, false);
  -        {error, Reason, Log} ->
  -            lager:warning("~p: credential request for ~p failed with ~p",
  -                       [SessionId, ServiceId, Reason]),
  +        {error, _Reason, Log} ->
               ErrMsg = <<"failed to request credential">>,
               show_user_page(Session, false, Log, ErrMsg)
       end;
  
positive.code:     redirect_to(ep_main, ReqMap).
  
  
  redirect_to_auth_server(#{body_qs:=BodyQs, session_id:=SessionId} = ReqMap) ->
      case maps:get(id, BodyQs, undefined) of
          undefined ->
              lager:info("~p: trying to redirect without provider", [SessionId]),
              redirect_to(main, ReqMap);
          OpenIdProvider ->
              lager:debug("~p: redirecting to provider ~p", [SessionId,
                                                           OpenIdProvider]),
              redirect_to(auth_server, maps:put(op_id , OpenIdProvider, ReqMap))
      end.
  
  
  login_user_with_authcode(#{qs := #{error := Error }
                             , session_id:=SessionId} = ReqMap) ->
      lager:warning("~p: error with auth code ~p~n", [SessionId, Error]),
      show_error_and_close_session(Error, ReqMap);
  login_user_with_authcode(#{qs := #{state:=OidcState}, session := Session} =
                           ReqMap) ->
      IsOidc = tts_session:is_oidc_state(OidcState, Session),
      retreive_oidc_token_if_state_fits(IsOidc, ReqMap);
  login_user_with_authcode(#{session_id := SessionId } = ReqMap) ->
      lager:error("~p: bad auth code response ~p~n", [SessionId, ReqMap]),
      Desc = <<"the data provided by the openid provider was invalide, please try
               again">>,
      show_error_and_close_session(Desc, ReqMap).
  
  
  retreive_oidc_token_if_state_fits(true, ReqMap) ->
      #{
                                            session := Session,
                                            qs := #{code := AuthCode }
                                           } = ReqMap,
      {ok, OpenIdProviderId} = tts_session:get_oidc_provider(Session),
      handle_oidc_token(oidcc:retrieve_token(AuthCode, OpenIdProviderId), ReqMap);
  retreive_oidc_token_if_state_fits(false, #{session_id := SessionId} = ReqMap) ->
      lager:info("~p: wrong state in jwt ~n", [SessionId]),
      Desc = <<"the returned state did not fit this session">>,
      show_error_and_close_session(Desc, ReqMap).
  
  handle_oidc_token({ok, Token}, #{session:=Session}=ReqMap) ->
      {ok, OpenIdProviderId} = tts_session:get_oidc_provider(Session),
      {ok, OidcNonce} = tts_session:get_oidc_nonce(Session),
      ok = tts_session:clear_oidc_state_nonce(Session),
      VerToken = oidcc:parse_and_validate_token(Token, OpenIdProviderId,
                                                OidcNonce),
      try_to_set_user(VerToken, ReqMap);
  handle_oidc_token({error, Error}, #{session_id := SessionId} = ReqMap) ->
      lager:warning("~p: bad token ~p", [SessionId, Error]),
      Desc = <<"An error occured on verifying your identity, please try to log in
               again">>,
      show_error_and_close_session(Desc, ReqMap).
  
  
  show_select_page(ReqMap) ->
      {ok, OIDCList} = oidcc:get_openid_provider_list(),
      GetIdAndDesc = fun({Id, Pid}, List) ->
                             {ok, #{description := Desc,
                                    ready := Enabled }} =
                             oidcc:get_openid_provider_info(Pid),
                             [ [ Id, Desc, Enabled ] | List]
                     end,
      OpList = lists:reverse(lists:foldl(GetIdAndDesc, [], OIDCList)),
      Error = maps:get(error, ReqMap, undefined),
      {ok, Version} = application:get_key(tts, vsn),
      {ok, Body} = tts_main_dtl:render([{ep_redirect, ?CONFIG(ep_redirect)},
  
negative.code: -export([handle/1]).
  -include("tts.hrl").
  
  handle(#{path := ep_main, logged_in := true} = ReqMap) ->
      redirect_to(user_page, ReqMap);
  handle(#{path := ep_user, method := post, logged_in := true} = ReqMap) ->
  