anchor.diff:      show_user_page(Session, false, [], Error).
   
   
  -revoke_credential(#{session := Session, session_id:=SessionId,
  +revoke_credential(#{session := Session,
                       body_qs:= #{ credential_id:=CredId}}) ->
  -    {ok, Issuer, Subject} = tts_session:get_iss_sub(Session),
  -    {ok, UserInfo} = tts_user_cache:get_user_info(Issuer, Subject),
  -    case tts_credential:revoke(CredId, UserInfo) of
  +    case tts:revoke_credential_for(CredId, Session) of
           {ok, _Result, Log} ->
  -            lager:info("~p: revoked credential ~p as ~p ~p",
  -                       [SessionId, CredId, Issuer, Subject]),
               show_user_page(Session, false, Log, false);
  -        {error, Error, Log} ->
  -            lager:warning("~p: revocation of credential ~p  as ~p ~p
  -            failed with ~p", [SessionId, CredId, Issuer, Subject, Error]),
  +        {error, _Error, Log} ->
               ErrMsg = <<"failed to revoke credential">>,
               show_user_page(Session, false, Log, ErrMsg)
       end.
   
   show_user_page(Session, Credential, Log, Error) ->
  -    {ok, Issuer, Subject} = tts_session:get_iss_sub(Session),
  -    {ok, UserInfo} = tts_user_cache:get_user_info(Issuer, Subject),
  -    #{ site := #{uid := UserId}} = UserInfo,
  -    {ok, ServiceList} = tts_service:get_list(UserId),
  -    {ok, CredentialList} = tts_credential:get_list(UserId),
  +    {ok, ServiceList} = tts:get_service_list_for(Session),
  +    {ok, CredentialList} = tts:get_credential_list_for(Session),
  +    {ok, AccessToken} = tts:get_access_token_for(Session),
  +    {ok, Name} = tts:get_display_name_for(Session),
  +
       {ok, Version} = application:get_key(tts, vsn),
  -    {ok, #{access := #{token := AccessToken}}} = tts_session:get_token(Session),
  -    {ok, Name} = tts_session:get_display_name(Session),
  -    BaseParams = [
  -                  {error, Error},
  -                  {name, Name},
  -                  {credential, Credential},
  -                  {credential_log, Log},
  -                  {service_list, ServiceList},
  -                  {credential_list, CredentialList},
  -                  {access_token, AccessToken},
  -                  {logged_in, true},
  -                  {version, Version}
  -                 ],
  -    Params = case ?DEBUG_MODE of
  -                 true ->
  -                     {ok, Token} = tts_session:get_token(Session),
  -                     TokenText = io_lib:format("~p", [Token]),
  -                     [{token, TokenText} |BaseParams];
  -                 _ -> BaseParams
  -             end,
  +    Params = [
  +              {error, Error},
  +              {name, Name},
  +              {credential, Credential},
  +              {credential_log, Log},
  +              {service_list, ServiceList},
  +              {credential_list, CredentialList},
  +              {access_token, AccessToken},
  +              {logged_in, true},
  +              {version, Version}
  +             ],
       {ok, Body} = tts_main_dtl:render(Params),
       #{body => Body, status => 200, cookie => update}.
   
  -
  -try_to_set_user({ok, #{id := #{claims := #{sub := Subject, iss := Issuer}},
  -                      access := #{token := AccessToken}} = Token},
  -                ReqMap) ->
  -    set_valid_user(tts_user_cache:get_user_info(Issuer, Subject, AccessToken),
  -                   maps:put(token, Token, ReqMap));
  -try_to_set_user(_, ReqMap) ->
  -    Error = <<"Invalid Token">>,
  -    show_error_and_close_session(Error, ReqMap).
  -
  -
  -set_valid_user({ok, UserInfo}, ReqMap) ->
  -    #{session := Session, session_id:=SessionId, token:=Token } = ReqMap,
  -    #{ oidc := #{ name := Name,
  -                  sub := Subject,
  -                  iss := Issuer }} = UserInfo,
  -    ok = tts_session:set_token(Token, Session),
  -    ok = tts_session:set_user_info(UserInfo, Session),
  -    lager:info("~p: user logged in ~p: ~p ~p",
  -               [SessionId, Name, Issuer, Subject]),
  -    redirect_to(user_page, ReqMap);
  -set_valid_user({error, Reason}, ReqMap) ->
  -    #{session_id := SessionId} = ReqMap,
  -    lager:info("~p: login failed due to ~p", [SessionId, Reason]),
  -    Desc = <<"An error occured during login, please try again later.
  -              If you keep getting the error inform an admin.">>,
  -    show_error_and_close_session(Desc, ReqMap).
  -
  -redirect_to(auth_server, #{op_id := OpenIdProviderId, session:=Session,
  -                           session_id:=SessionId}) ->
  -    {ok, OidcState} = tts_session:get_oidc_state(Session),
  -    {ok, OidcNonce} = tts_session:get_oidc_nonce(Session),
  -    ok = tts_session:set_oidc_provider(OpenIdProviderId, Session),
  -    {ok, Config} = oidcc:get_openid_provider_info(OpenIdProviderId),
  -    RequestScopes = case maps:get(request_scopes, Config) of
  -                        List when is_list(List) -> List;
  -                        _ -> ?CONFIG(request_scopes, [openid, profile])
  -                    end,
  -    {ok, Redirection} = oidcc:create_redirect_url(OpenIdProviderId,
  -                                                  RequestScopes,
  -                                                  %% [openid, email, profile],
  -                                                  OidcState, OidcNonce),
  -    lager:info("~p: redirecting to openid provider: ~p", [SessionId,
  -                                                          Redirection]),
  -    create_redirection(Redirection);
   redirect_to(user_page, _ReqMap) ->
       UserPath = ?CONFIG(ep_user),
       create_redirection(UserPath);
   redirect_to(_, _ReqMap) ->
       create_redirection("/").
   
  -show_error_and_close_session(Error, ReqMap) ->
  -    #{ session := Session, session_id := SessionId } = ReqMap,
  -    lager:info("~p: closing session due to error", [SessionId]),
  -    ok = tts_session:close(Session),
  -    Update = #{error => Error, status => 200, cookie => clear},
  -    NewReqMap = maps:merge(ReqMap, Update),
  -    show_select_page(NewReqMap).
  -
  -
  -
   create_redirection(Url) ->
       #{header => [{<<"location">>, Url}], cookie => update, status => 302}.
   
  
positive.code:     redirect_to(ep_main, ReqMap).
  
  
  redirect_to_auth_server(#{body_qs:=BodyQs, session_id:=SessionId} = ReqMap) ->
      case maps:get(id, BodyQs, undefined) of
          undefined ->
              lager:info("~p: trying to redirect without provider", [SessionId]),
              redirect_to(main, ReqMap);
          OpenIdProvider ->
              lager:debug("~p: redirecting to provider ~p", [SessionId,
                                                           OpenIdProvider]),
              redirect_to(auth_server, maps:put(op_id , OpenIdProvider, ReqMap))
      end.
  
  
  login_user_with_authcode(#{qs := #{error := Error }
                             , session_id:=SessionId} = ReqMap) ->
      lager:warning("~p: error with auth code ~p~n", [SessionId, Error]),
      show_error_and_close_session(Error, ReqMap);
  login_user_with_authcode(#{qs := #{state:=OidcState}, session := Session} =
                           ReqMap) ->
      IsOidc = tts_session:is_oidc_state(OidcState, Session),
      retreive_oidc_token_if_state_fits(IsOidc, ReqMap);
  login_user_with_authcode(#{session_id := SessionId } = ReqMap) ->
      lager:error("~p: bad auth code response ~p~n", [SessionId, ReqMap]),
      Desc = <<"the data provided by the openid provider was invalide, please try
               again">>,
      show_error_and_close_session(Desc, ReqMap).
  
  
  retreive_oidc_token_if_state_fits(true, ReqMap) ->
      #{
                                            session := Session,
                                            qs := #{code := AuthCode }
                                           } = ReqMap,
      {ok, OpenIdProviderId} = tts_session:get_oidc_provider(Session),
      handle_oidc_token(oidcc:retrieve_token(AuthCode, OpenIdProviderId), ReqMap);
  retreive_oidc_token_if_state_fits(false, #{session_id := SessionId} = ReqMap) ->
      lager:info("~p: wrong state in jwt ~n", [SessionId]),
      Desc = <<"the returned state did not fit this session">>,
      show_error_and_close_session(Desc, ReqMap).
  
  handle_oidc_token({ok, Token}, #{session:=Session}=ReqMap) ->
      {ok, OpenIdProviderId} = tts_session:get_oidc_provider(Session),
      {ok, OidcNonce} = tts_session:get_oidc_nonce(Session),
      ok = tts_session:clear_oidc_state_nonce(Session),
      VerToken = oidcc:parse_and_validate_token(Token, OpenIdProviderId,
                                                OidcNonce),
      try_to_set_user(VerToken, ReqMap);
  handle_oidc_token({error, Error}, #{session_id := SessionId} = ReqMap) ->
      lager:warning("~p: bad token ~p", [SessionId, Error]),
      Desc = <<"An error occured on verifying your identity, please try to log in
               again">>,
      show_error_and_close_session(Desc, ReqMap).
  
  
  show_select_page(ReqMap) ->
      {ok, OIDCList} = oidcc:get_openid_provider_list(),
      GetIdAndDesc = fun({Id, Pid}, List) ->
                             {ok, #{description := Desc,
                                    ready := Enabled }} =
                             oidcc:get_openid_provider_info(Pid),
                             [ [ Id, Desc, Enabled ] | List]
                     end,
      OpList = lists:reverse(lists:foldl(GetIdAndDesc, [], OIDCList)),
      Error = maps:get(error, ReqMap, undefined),
      {ok, Version} = application:get_key(tts, vsn),
      {ok, Body} = tts_main_dtl:render([{ep_redirect, ?CONFIG(ep_redirect)},
  
negative.code:     show_user_page(Session, false, [], false).
  
  
  request_credential(#{session := Session,
                       body_qs:= #{ service_id:=ServiceId}}) ->
      Iface = <<"web interface">>,
      case  tts:request_credential_for(ServiceId, Session, [], Iface) of
          {ok, Credential, Log} ->
              show_user_page(Session, Credential, Log, false);
          {error, _Reason, Log} ->
              ErrMsg = <<"failed to request credential">>,
              show_user_page(Session, false, Log, ErrMsg)
      end;
  