diff --git a/full/src/main/java/de/ids_mannheim/korap/security/auth/APIAuthentication.java b/full/src/main/java/de/ids_mannheim/korap/authentication/APIAuthentication.java
similarity index 96%
rename from full/src/main/java/de/ids_mannheim/korap/security/auth/APIAuthentication.java
rename to full/src/main/java/de/ids_mannheim/korap/authentication/APIAuthentication.java
index 5e4cfc2..c07744f 100644
--- a/full/src/main/java/de/ids_mannheim/korap/security/auth/APIAuthentication.java
+++ b/full/src/main/java/de/ids_mannheim/korap/authentication/APIAuthentication.java
@@ -1,4 +1,4 @@
-package de.ids_mannheim.korap.security.auth;
+package de.ids_mannheim.korap.authentication;
 
 import com.nimbusds.jose.JOSEException;
 import com.nimbusds.jwt.SignedJWT;
@@ -23,7 +23,7 @@
 /**
  * Created by hanl on 5/23/14.
  */
-public class APIAuthentication implements AuthenticationIface {
+public class APIAuthentication implements AuthenticationIface{
 
     private JWTSigner signedToken;
     private Cache invalided = CacheManager.getInstance().getCache(
diff --git a/full/src/main/java/de/ids_mannheim/korap/security/auth/BasicHttpAuth.java b/full/src/main/java/de/ids_mannheim/korap/authentication/BasicHttpAuth.java
similarity index 96%
rename from full/src/main/java/de/ids_mannheim/korap/security/auth/BasicHttpAuth.java
rename to full/src/main/java/de/ids_mannheim/korap/authentication/BasicHttpAuth.java
index ba1a26c..cb25b1f 100644
--- a/full/src/main/java/de/ids_mannheim/korap/security/auth/BasicHttpAuth.java
+++ b/full/src/main/java/de/ids_mannheim/korap/authentication/BasicHttpAuth.java
@@ -1,4 +1,4 @@
-package de.ids_mannheim.korap.security.auth;
+package de.ids_mannheim.korap.authentication;
 
 import java.util.Map;
 
@@ -6,7 +6,6 @@
 import org.springframework.beans.factory.annotation.Autowired;
 
 import de.ids_mannheim.korap.config.Attributes;
-import de.ids_mannheim.korap.config.BeansFactory;
 import de.ids_mannheim.korap.config.KustvaktConfiguration;
 import de.ids_mannheim.korap.config.Scopes;
 import de.ids_mannheim.korap.exceptions.KustvaktException;
@@ -20,7 +19,8 @@
 import de.ids_mannheim.korap.utils.StringUtils;
 import de.ids_mannheim.korap.utils.TimeUtils;
 
-/**
+/** EM: do not use at the moment, there is no authentication checking
+ * 
  * @author hanl
  * @date 28/04/2015
  */
diff --git a/full/src/main/java/de/ids_mannheim/korap/security/auth/KustvaktAuthenticationManager.java b/full/src/main/java/de/ids_mannheim/korap/authentication/KustvaktAuthenticationManager.java
similarity index 98%
rename from full/src/main/java/de/ids_mannheim/korap/security/auth/KustvaktAuthenticationManager.java
rename to full/src/main/java/de/ids_mannheim/korap/authentication/KustvaktAuthenticationManager.java
index 31d5f46..b420399 100644
--- a/full/src/main/java/de/ids_mannheim/korap/security/auth/KustvaktAuthenticationManager.java
+++ b/full/src/main/java/de/ids_mannheim/korap/authentication/KustvaktAuthenticationManager.java
@@ -1,4 +1,4 @@
-package de.ids_mannheim.korap.security.auth;
+package de.ids_mannheim.korap.authentication;
 
 import java.io.IOException;
 import java.io.UnsupportedEncodingException;
@@ -21,6 +21,7 @@
 
 import de.ids_mannheim.korap.auditing.AuditRecord;
 import de.ids_mannheim.korap.config.Attributes;
+import de.ids_mannheim.korap.config.AuthenticationType;
 import de.ids_mannheim.korap.config.BeansFactory;
 import de.ids_mannheim.korap.config.KustvaktConfiguration;
 import de.ids_mannheim.korap.config.URIParam;
@@ -170,15 +171,15 @@
 	 * @throws KustvaktException
 	 */
 	@Override
-	public User authenticate(int type, String username, String password, Map<String, Object> attributes)
+	public User authenticate(AuthenticationType type, String username, String password, Map<String, Object> attributes)
 			throws KustvaktException {
 		User user;
 		switch (type) {
-		case 1:
+		case SHIBBOLETH:
 			// todo:
 			user = authenticateShib(attributes);
 			break;
-		case 2:
+		case LDAP:
 			// IdM/LDAP: (09.02.17/FB)
 			user = authenticateIdM(username, password, attributes);
 			break;
diff --git a/full/src/main/java/de/ids_mannheim/korap/security/auth/LdapAuth3.java b/full/src/main/java/de/ids_mannheim/korap/authentication/LdapAuth3.java
similarity index 99%
rename from full/src/main/java/de/ids_mannheim/korap/security/auth/LdapAuth3.java
rename to full/src/main/java/de/ids_mannheim/korap/authentication/LdapAuth3.java
index 0f44a67..8d1d859 100644
--- a/full/src/main/java/de/ids_mannheim/korap/security/auth/LdapAuth3.java
+++ b/full/src/main/java/de/ids_mannheim/korap/authentication/LdapAuth3.java
@@ -24,7 +24,7 @@
  * - Passwort des Admin verschl�sseln.
  */
  
-package de.ids_mannheim.korap.security.auth;
+package de.ids_mannheim.korap.authentication;
 
 import com.unboundid.ldap.sdk.*;
 
diff --git a/full/src/main/java/de/ids_mannheim/korap/security/auth/LoginCounter.java b/full/src/main/java/de/ids_mannheim/korap/authentication/LoginCounter.java
similarity index 97%
rename from full/src/main/java/de/ids_mannheim/korap/security/auth/LoginCounter.java
rename to full/src/main/java/de/ids_mannheim/korap/authentication/LoginCounter.java
index 5f0a0e4..60289ce 100644
--- a/full/src/main/java/de/ids_mannheim/korap/security/auth/LoginCounter.java
+++ b/full/src/main/java/de/ids_mannheim/korap/authentication/LoginCounter.java
@@ -1,4 +1,4 @@
-package de.ids_mannheim.korap.security.auth;
+package de.ids_mannheim.korap.authentication;
 
 import de.ids_mannheim.korap.config.KustvaktConfiguration;
 import de.ids_mannheim.korap.utils.TimeUtils;
diff --git a/full/src/main/java/de/ids_mannheim/korap/security/auth/OpenIDconnectAuthentication.java b/full/src/main/java/de/ids_mannheim/korap/authentication/OpenIDconnectAuthentication.java
similarity index 98%
rename from full/src/main/java/de/ids_mannheim/korap/security/auth/OpenIDconnectAuthentication.java
rename to full/src/main/java/de/ids_mannheim/korap/authentication/OpenIDconnectAuthentication.java
index dad0ec1..78d1915 100644
--- a/full/src/main/java/de/ids_mannheim/korap/security/auth/OpenIDconnectAuthentication.java
+++ b/full/src/main/java/de/ids_mannheim/korap/authentication/OpenIDconnectAuthentication.java
@@ -1,4 +1,4 @@
-package de.ids_mannheim.korap.security.auth;
+package de.ids_mannheim.korap.authentication;
 
 import com.nimbusds.jwt.SignedJWT;
 import de.ids_mannheim.korap.config.JWTSigner;
diff --git a/full/src/main/java/de/ids_mannheim/korap/security/auth/SessionAuthentication.java b/full/src/main/java/de/ids_mannheim/korap/authentication/SessionAuthentication.java
similarity index 98%
rename from full/src/main/java/de/ids_mannheim/korap/security/auth/SessionAuthentication.java
rename to full/src/main/java/de/ids_mannheim/korap/authentication/SessionAuthentication.java
index d6060a5..bd015d6 100644
--- a/full/src/main/java/de/ids_mannheim/korap/security/auth/SessionAuthentication.java
+++ b/full/src/main/java/de/ids_mannheim/korap/authentication/SessionAuthentication.java
@@ -1,4 +1,4 @@
-package de.ids_mannheim.korap.security.auth;
+package de.ids_mannheim.korap.authentication;
 
 import de.ids_mannheim.korap.config.KustvaktConfiguration;
 import de.ids_mannheim.korap.exceptions.KustvaktException;
diff --git a/full/src/main/java/de/ids_mannheim/korap/security/auth/SessionFactory.java b/full/src/main/java/de/ids_mannheim/korap/authentication/SessionFactory.java
similarity index 98%
rename from full/src/main/java/de/ids_mannheim/korap/security/auth/SessionFactory.java
rename to full/src/main/java/de/ids_mannheim/korap/authentication/SessionFactory.java
index 2d6d53e..1817799 100644
--- a/full/src/main/java/de/ids_mannheim/korap/security/auth/SessionFactory.java
+++ b/full/src/main/java/de/ids_mannheim/korap/authentication/SessionFactory.java
@@ -1,4 +1,4 @@
-package de.ids_mannheim.korap.security.auth;
+package de.ids_mannheim.korap.authentication;
 
 import de.ids_mannheim.korap.exceptions.KustvaktException;
 import de.ids_mannheim.korap.exceptions.StatusCodes;
diff --git a/full/src/main/java/de/ids_mannheim/korap/web/controller/AuthenticationController.java b/full/src/main/java/de/ids_mannheim/korap/web/controller/AuthenticationController.java
index 43b17cc..745470a 100644
--- a/full/src/main/java/de/ids_mannheim/korap/web/controller/AuthenticationController.java
+++ b/full/src/main/java/de/ids_mannheim/korap/web/controller/AuthenticationController.java
@@ -27,12 +27,13 @@
 import com.sun.jersey.spi.container.ContainerRequest;
 import com.sun.jersey.spi.container.ResourceFilters;
 
+import de.ids_mannheim.korap.authentication.BasicHttpAuth;
 import de.ids_mannheim.korap.config.Attributes;
+import de.ids_mannheim.korap.config.AuthenticationType;
 import de.ids_mannheim.korap.config.BeansFactory;
 import de.ids_mannheim.korap.exceptions.KustvaktException;
 import de.ids_mannheim.korap.exceptions.StatusCodes;
 import de.ids_mannheim.korap.interfaces.AuthenticationManagerIface;
-import de.ids_mannheim.korap.security.auth.BasicHttpAuth;
 import de.ids_mannheim.korap.user.TokenContext;
 import de.ids_mannheim.korap.user.User;
 import de.ids_mannheim.korap.utils.JsonUtils;
@@ -44,7 +45,7 @@
 import de.ids_mannheim.korap.web.filter.PiwikFilter;
 import de.ids_mannheim.korap.web.utils.KustvaktResponseHandler;
 
-//import com.sun.xml.internal.messaging.saaj.util.Base64;
+// import com.sun.xml.internal.messaging.saaj.util.Base64;
 
 /**
  * @author hanl
@@ -58,12 +59,13 @@
 
     @Autowired
     KustvaktResponseHandler kustvaktResponseHandler;
-    
+
     private static Boolean DEBUG_LOG = true;
 
     //todo: bootstrap function to transmit certain default configuration settings and examples (example user queries,
     // default usersettings, etc.)
-    private static Logger jlog = KustvaktLogger.getLogger(AuthenticationController.class);
+    private static Logger jlog =
+            KustvaktLogger.getLogger(AuthenticationController.class);
 
     @Autowired
     private AuthenticationManagerIface controller;
@@ -193,7 +195,8 @@
         TokenContext context;
         try {
             // User user = controller.authenticate(0, values[0], values[1], attr); Implementation by Hanl
-            User user = controller.authenticate(2, values[0], values[1], attr); // Implementation with IdM/LDAP
+            User user = controller.authenticate(AuthenticationType.LDAP,
+                    values[0], values[1], attr); // Implementation with IdM/LDAP
             // Userdata data = this.controller.getUserData(user, UserDetails.class); // Implem. by Hanl
             // todo: is this necessary?
             //            attr.putAll(data.fields());
@@ -204,7 +207,8 @@
             attr.put(Attributes.LOCATION, user.getLocation());
             attr.put(Attributes.CORPUS_ACCESS, user.getCorpusAccess());
             context = controller.createTokenContext(user, attr,
-                    Attributes.API_AUTHENTICATION);
+                    AuthenticationType.LDAP.name());
+                    //Attributes.API_AUTHENTICATION);
         }
         catch (KustvaktException e) {
             throw kustvaktResponseHandler.throwit(e);
@@ -272,7 +276,8 @@
         TokenContext context;
         String contextJson;
         try {
-            User user = controller.authenticate(0, values[0], values[1], attr);
+            User user = controller.authenticate(AuthenticationType.SESSION,
+                    values[0], values[1], attr);
             context = controller.createTokenContext(user, attr,
                     Attributes.SESSION_AUTHENTICATION);
             contextJson = context.toJson();
@@ -308,7 +313,8 @@
 
         try {
             // todo: distinguish type KorAP/Shibusers
-            User user = controller.authenticate(1, null, null, attr);
+            User user = controller.authenticate(AuthenticationType.SHIBBOLETH,
+                    null, null, attr);
             context = controller.createTokenContext(user, attr, null);
         }
         catch (KustvaktException e) {
diff --git a/full/src/main/java/de/ids_mannheim/korap/web/controller/OAuthController.java b/full/src/main/java/de/ids_mannheim/korap/web/controller/OAuthController.java
index 33163fd..06988f1 100644
--- a/full/src/main/java/de/ids_mannheim/korap/web/controller/OAuthController.java
+++ b/full/src/main/java/de/ids_mannheim/korap/web/controller/OAuthController.java
@@ -533,7 +533,7 @@
 
                 openid_valid = true;
                 try {
-                    user = controller.authenticate(0,
+                    user = controller.authenticate(AuthenticationType.OAUTH2,
                             oauthRequest.getUsername(),
                             oauthRequest.getPassword(), attr);
                 }
@@ -569,7 +569,7 @@
                             Scopes.Scope.openid.toString())) {
                 try {
                     if (user == null)
-                        user = controller.authenticate(0,
+                        user = controller.authenticate(AuthenticationType.OAUTH2,
                                 oauthRequest.getUsername(),
                                 oauthRequest.getPassword(), attr);
                     Userdata data = controller.getUserData(user,
diff --git a/full/src/main/java/de/ids_mannheim/korap/web/filter/AdminFilter.java b/full/src/main/java/de/ids_mannheim/korap/web/filter/AdminFilter.java
index f78b1a1..3326380 100644
--- a/full/src/main/java/de/ids_mannheim/korap/web/filter/AdminFilter.java
+++ b/full/src/main/java/de/ids_mannheim/korap/web/filter/AdminFilter.java
@@ -12,10 +12,11 @@
 import com.sun.jersey.spi.container.ContainerResponseFilter;
 import com.sun.jersey.spi.container.ResourceFilter;
 
+import de.ids_mannheim.korap.authentication.BasicHttpAuth;
 import de.ids_mannheim.korap.config.Attributes;
+import de.ids_mannheim.korap.config.AuthenticationType;
 import de.ids_mannheim.korap.exceptions.KustvaktException;
 import de.ids_mannheim.korap.interfaces.AuthenticationManagerIface;
-import de.ids_mannheim.korap.security.auth.BasicHttpAuth;
 import de.ids_mannheim.korap.user.TokenContext;
 import de.ids_mannheim.korap.user.User;
 import de.ids_mannheim.korap.utils.StringUtils;
@@ -42,11 +43,12 @@
 			throw kustvaktResponseHandler.throwAuthenticationException("The authorization header value is missing.");
 		}
 
+		// EM: fix me: authentication header format
 		// decode password
 		String authenticationType = StringUtils.getTokenType(authentication);
 		String authenticationCode = StringUtils.stripTokenType(authentication);
 		String username = null, token = null;
-		int tokenType = 0;
+//		A tokenType = 0;
 		
 		if (authenticationType.equals(Attributes.BASIC_AUTHENTICATION)) {
 			String[] authContent = BasicHttpAuth.decode(authenticationCode);
@@ -60,7 +62,8 @@
 		attributes.put(Attributes.HOST, host);
 		attributes.put(Attributes.USER_AGENT, agent);
 		try {
-			User user = authManager.authenticate(tokenType, username, token, attributes);
+		    // EM: fix me: AuthenticationType based on header value
+			User user = authManager.authenticate(AuthenticationType.LDAP, username, token, attributes);
 			if (!user.isAdmin()){
 				throw kustvaktResponseHandler.throwAuthenticationException("Admin authentication failed.");
 			}
diff --git a/full/src/main/java/de/ids_mannheim/korap/web/filter/DemoFilter.java b/full/src/main/java/de/ids_mannheim/korap/web/filter/DemoFilter.java
index 2a06655..e2b8178 100644
--- a/full/src/main/java/de/ids_mannheim/korap/web/filter/DemoFilter.java
+++ b/full/src/main/java/de/ids_mannheim/korap/web/filter/DemoFilter.java
@@ -4,7 +4,8 @@
 import com.sun.jersey.spi.container.ContainerRequestFilter;
 import com.sun.jersey.spi.container.ContainerResponseFilter;
 import com.sun.jersey.spi.container.ResourceFilter;
-import de.ids_mannheim.korap.security.auth.BasicHttpAuth;
+
+import de.ids_mannheim.korap.authentication.BasicHttpAuth;
 import de.ids_mannheim.korap.config.Attributes;
 import de.ids_mannheim.korap.user.TokenContext;
 import de.ids_mannheim.korap.web.utils.KustvaktContext;
diff --git a/full/src/main/resources/default-config.xml b/full/src/main/resources/default-config.xml
index cae9cdc..46aa18a 100644
--- a/full/src/main/resources/default-config.xml
+++ b/full/src/main/resources/default-config.xml
@@ -195,24 +195,24 @@
 	</bean>
 
 	<!-- authentication providers to use -->
-	<bean id="api_auth" class="de.ids_mannheim.korap.security.auth.APIAuthentication">
+	<bean id="api_auth" class="de.ids_mannheim.korap.authentication.APIAuthentication">
 		<constructor-arg type="de.ids_mannheim.korap.config.KustvaktConfiguration"
 			ref="kustvakt_config" />
 	</bean>
 
 	<bean id="openid_auth"
-		class="de.ids_mannheim.korap.security.auth.OpenIDconnectAuthentication">
+		class="de.ids_mannheim.korap.authentication.OpenIDconnectAuthentication">
 		<constructor-arg type="de.ids_mannheim.korap.config.KustvaktConfiguration"
 			ref="kustvakt_config" />
 		<constructor-arg
 			type="de.ids_mannheim.korap.interfaces.db.PersistenceClient" ref="kustvakt_db" />
 	</bean>
 
-	<bean id="basic_auth" class="de.ids_mannheim.korap.security.auth.BasicHttpAuth" />
+	<bean id="basic_auth" class="de.ids_mannheim.korap.authentication.BasicHttpAuth" />
 
 
 	<bean id="session_auth"
-		class="de.ids_mannheim.korap.security.auth.SessionAuthentication">
+		class="de.ids_mannheim.korap.authentication.SessionAuthentication">
 		<constructor-arg type="de.ids_mannheim.korap.config.KustvaktConfiguration"
 			ref="kustvakt_config" />
 		<constructor-arg type="de.ids_mannheim.korap.interfaces.EncryptionIface"
@@ -251,7 +251,7 @@
 
 	<!-- specify type for constructor argument -->
 	<bean id="kustvakt_authenticationmanager"
-		class="de.ids_mannheim.korap.security.auth.KustvaktAuthenticationManager">
+		class="de.ids_mannheim.korap.authentication.KustvaktAuthenticationManager">
 		<constructor-arg
 			type="de.ids_mannheim.korap.interfaces.db.EntityHandlerIface" ref="kustvakt_userdb" />
 		<constructor-arg