diff --git a/src/test/java/de/ids_mannheim/korap/scenario/DNBTest.java b/src/test/java/de/ids_mannheim/korap/scenario/DNBTest.java
new file mode 100644
index 0000000..beefb14
--- /dev/null
+++ b/src/test/java/de/ids_mannheim/korap/scenario/DNBTest.java
@@ -0,0 +1,78 @@
+package de.ids_mannheim.korap.scenario;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+
+import org.junit.jupiter.api.AfterAll;
+import org.junit.jupiter.api.Test;
+import org.springframework.test.context.ContextConfiguration;
+
+import com.fasterxml.jackson.databind.JsonNode;
+
+import de.ids_mannheim.korap.config.SpringJerseyTest;
+import de.ids_mannheim.korap.exceptions.KustvaktException;
+import de.ids_mannheim.korap.util.KrillProperties;
+import de.ids_mannheim.korap.utils.JsonUtils;
+import jakarta.ws.rs.core.Response;
+import jakarta.ws.rs.core.Response.Status;
+
+@ContextConfiguration("classpath:test-config-dnb.xml")
+public class DNBTest extends SpringJerseyTest {
+
+    public final static String API_VERSION = "v1.0";
+
+    private JsonNode sendQuery (String query) throws KustvaktException {
+        Response r = target().path(API_VERSION).path("search")
+                .queryParam("q", query).queryParam("ql", "poliqarp")
+                .queryParam("show-tokens", true).request().get();
+        assertEquals(Status.OK.getStatusCode(), r.getStatus());
+        String entity = r.readEntity(String.class);
+        JsonNode node = JsonUtils.readTree(entity);
+
+        return node;
+
+    }
+    
+    @AfterAll
+    public static void resetKrillProperties() {
+        KrillProperties.loadProperties("kustvakt-test.conf");
+    }
+
+    @Test
+    public void testTokenMatchSize () throws KustvaktException {
+        assertEquals(1, KrillProperties.maxTokenMatchSize);
+        assertEquals(25, KrillProperties.maxTokenContextSize);
+
+        JsonNode node = sendQuery("[orth=das]");
+        assertEquals(KrillProperties.maxTokenMatchSize,
+                node.at("/matches/0/tokens/match").size());
+
+        node = sendQuery("[orth=das][orth=Glück]");
+        assertEquals(KrillProperties.maxTokenMatchSize,
+                node.at("/matches/0/tokens/match").size());
+    }
+
+    @Test
+    public void testTokenContextMatchSize () throws KustvaktException {
+        Response r = target().path(API_VERSION).path("search")
+                .queryParam("q", "[orth=das][orth=Glück]")
+                .queryParam("ql", "poliqarp").queryParam("show-tokens", true)
+                .queryParam("context", "30-token,30-token").request().get();
+        assertEquals(Status.OK.getStatusCode(), r.getStatus());
+        String entity = r.readEntity(String.class);
+        JsonNode node = JsonUtils.readTree(entity);
+
+        assertEquals(KrillProperties.maxTokenContextSize,
+                node.at("/meta/context/left/1").asInt());
+        assertEquals(KrillProperties.maxTokenContextSize,
+                node.at("/meta/context/right/1").asInt());
+        
+        assertEquals(KrillProperties.maxTokenContextSize,
+                node.at("/matches/0/tokens/left").size());
+        
+        // There is a bug in Krill (https://github.com/KorAP/Krill/issues/141)
+        // So the following test fails
+//        assertEquals(KrillProperties.maxTokenContextSize,
+//                node.at("/matches/0/tokens/right").size());
+    }
+
+}
diff --git a/src/test/resources/kustvakt-dnb.conf b/src/test/resources/kustvakt-dnb.conf
new file mode 100644
index 0000000..3b8d190
--- /dev/null
+++ b/src/test/resources/kustvakt-dnb.conf
@@ -0,0 +1,126 @@
+# Krill settings
+#
+# A sample configuration for the DNB instance
+
+krill.match.max.token=1
+krill.context.max.token=25
+
+krill.indexDir = sample-index
+
+krill.index.commit.count = 134217000
+krill.index.commit.log = log/krill.commit.log
+krill.index.commit.auto = 500
+krill.index.relations.max = 100
+# Directory path of virtual corpora to cache
+krill.namedVC = vc
+krill.test = true
+
+# LDAP configuration file
+#
+ldap.config = src/test/resources/test-ldap.conf
+
+# Kustvakt versions
+#
+# multiple versions separated by space
+current.api.version = v1.0
+supported.api.version = v0.1 v1.0
+
+# Server
+#
+server.port=8089
+server.host=localhost
+
+# Mail settings
+#
+mail.enabled = false
+mail.receiver = test@localhost
+mail.sender = noreply@ids-mannheim.de
+mail.address.retrieval = test
+
+# Mail.templates
+#
+template.group.invitation = notification.vm
+
+# Default foundries for specific layers (optional)
+#
+default.foundry.partOfSpeech = tt
+default.foundry.lemma = tt
+default.foundry.orthography = opennlp
+default.foundry.dependency = malt
+default.foundry.constituent = corenlp
+default.foundry.morphology = marmot
+default.foundry.surface = base
+
+# Delete configuration (default hard)
+#
+# delete.auto.group = hard
+delete.group = soft
+delete.group.member = soft
+
+# Virtual corpus and queries
+max.user.persistent.queries = 5
+
+# Availability regex only support |
+# It should be removed/commented when the data doesn't contain availability field.
+# 
+availability.regex.free = CC-BY.*
+availability.regex.public = ACA.*|QAO-NC
+availability.regex.all = QAO.*
+
+
+# Define resource filters for search and match info API
+# AuthenticationFilter activates authentication using OAuth2 tokens
+# DemoUserFilter allows access to API without login
+# 
+# Default values: AuthenticationFilter,DemoUserFilter
+#
+search.resource.filters=AuthenticationFilter,DemoUserFilter
+
+
+# options referring to the security module!
+
+# OAuth
+# (see de.ids_mannheim.korap.constant.AuthenticationMethod for possible 
+# oauth.password.authentication values)
+#
+oauth2.password.authentication = TEST
+oauth2.native.client.host = korap.ids-mannheim.de
+oauth2.max.attempts = 2
+# expiry in seconds (S), minutes (M), hours (H), days (D)
+oauth2.access.token.expiry = 3M
+oauth2.refresh.token.expiry = 90D
+oauth2.authorization.code.expiry = 10M
+# -- scopes separated by space
+oauth2.default.scopes = search match_info
+oauth2.client.credentials.scopes = client_info
+
+oauth2.initial.super.client=true
+
+
+# see SecureRandom Number Generation Algorithms
+# optional
+security.secure.random.algorithm=SHA1PRNG
+
+# see MessageDigest Algorithms
+# default MD5
+security.md.algoritm = SHA-256  
+
+# secure hash support: BCRYPT
+security.secure.hash.algorithm=BCRYPT
+security.encryption.loadFactor = 10
+
+# DEPRECATED
+# JWT
+security.jwt.issuer=https://korap.ids-mannheim.de
+security.sharedSecret=this-is-shared-secret-code-for-JWT-Signing.It-must-contains-minimum-256-bits
+
+# token expiration time
+security.longTokenTTL = 1D
+security.tokenTTL = 2S
+security.shortTokenTTL = 1S
+
+# Session authentication
+security.idleTimeoutDuration = 25M
+security.multipleLogIn = true
+security.loginAttemptNum = 3
+security.authAttemptTTL = 45M
diff --git a/src/test/resources/kustvakt-test.conf b/src/test/resources/kustvakt-test.conf
index facc03a..c88388f 100644
--- a/src/test/resources/kustvakt-test.conf
+++ b/src/test/resources/kustvakt-test.conf
@@ -10,6 +10,9 @@
 krill.namedVC = vc
 krill.test = true
 
+krill.match.max.token=50
+krill.context.max.token=60
+
 # LDAP configuration file
 #
 ldap.config = src/test/resources/test-ldap.conf
diff --git a/src/test/resources/test-config-dnb.xml b/src/test/resources/test-config-dnb.xml
new file mode 100644
index 0000000..53c8b8a
--- /dev/null
+++ b/src/test/resources/test-config-dnb.xml
@@ -0,0 +1,358 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<beans xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+	xmlns:p="http://www.springframework.org/schema/p"
+	xmlns:util="http://www.springframework.org/schema/util"
+	xmlns:aop="http://www.springframework.org/schema/aop"
+	xmlns:tx="http://www.springframework.org/schema/tx"
+	xmlns="http://www.springframework.org/schema/beans"
+	xmlns:context="http://www.springframework.org/schema/context"
+	xmlns:cache="http://www.springframework.org/schema/cache"
+	xsi:schemaLocation="http://www.springframework.org/schema/beans
+           http://www.springframework.org/schema/beans/spring-beans.xsd
+           http://www.springframework.org/schema/tx
+           http://www.springframework.org/schema/tx/spring-tx.xsd
+           http://www.springframework.org/schema/aop
+           http://www.springframework.org/schema/aop/spring-aop.xsd
+           http://www.springframework.org/schema/context
+           http://www.springframework.org/schema/context/spring-context.xsd
+           http://www.springframework.org/schema/util
+           http://www.springframework.org/schema/util/spring-util.xsd">
+
+	<context:component-scan
+		base-package="de.ids_mannheim.korap" />
+	<context:annotation-config />
+
+	<bean id="props"
+		class="org.springframework.beans.factory.config.PropertiesFactoryBean">
+		<property name="ignoreResourceNotFound" value="true" />
+		<property name="locations">
+			<array>
+				<value>classpath:kustvakt-dnb.conf</value>
+				<value>file:./kustvakt-dnb.conf</value>
+			</array>
+		</property>
+	</bean>
+
+	<bean id="placeholders"
+		class="org.springframework.context.support.PropertySourcesPlaceholderConfigurer">
+		<property name="ignoreResourceNotFound" value="true" />
+		<property name="locations">
+			<array>
+				<value>classpath:test-jdbc.properties</value>
+				<value>file:./test-jdbc.properties</value>
+				<value>classpath:properties/mail.properties</value>
+				<value>file:./mail.properties</value>
+				<value>classpath:test-hibernate.properties</value>
+				<value>file:./kustvakt-dnb.conf</value>
+				<value>classpath:kustvakt-dnb.conf</value>
+			</array>
+		</property>
+	</bean>
+
+	<!-- <bean id='cacheManager' class='org.springframework.cache.ehcache.EhCacheCacheManager' 
+		p:cacheManager-ref='ehcache' /> <bean id='ehcache' class='org.springframework.cache.ehcache.EhCacheManagerFactoryBean' 
+		p:configLocation='classpath:ehcache.xml' p:shared='true' /> -->
+
+	<bean id="dataSource"
+		class="org.apache.commons.dbcp2.BasicDataSource" lazy-init="true">
+		<!-- <property name="driverClassName" value="${jdbc.driverClassName}" /> -->
+		<property name="url" value="${jdbc.url}" />
+		<property name="username" value="${jdbc.username}" />
+		<property name="password" value="${jdbc.password}" />
+		<property name="maxTotal" value="4" />
+		<property name="maxIdle" value="1" />
+		<property name="minIdle" value="1" />
+		<property name="maxWaitMillis" value="15000" />
+		<!--<property name="poolPreparedStatements" value="true"/> -->
+	</bean>
+
+<!-- <bean id="sqliteDataSource"
+		class="org.springframework.jdbc.datasource.SingleConnectionDataSource"
+		lazy-init="true">
+		<property name="driverClassName" value="${jdbc.driverClassName}" />
+		<property name="url" value="${jdbc.url}" />
+		<property name="username" value="${jdbc.username}" />
+		<property name="password" value="${jdbc.password}" />
+		<property name="connectionProperties">
+			<props>
+				<prop key="date_string_format">yyyy-MM-dd HH:mm:ss</prop>
+			</props>
+		</property>
+
+		Sqlite can only have a single connection
+		<property name="suppressClose">
+			<value>true</value>
+		</property>
+	</bean>
+ -->
+	<bean id="c3p0DataSource"
+		class="com.mchange.v2.c3p0.ComboPooledDataSource"
+		destroy-method="close">
+		<property name="driverClass" value="${jdbc.driverClassName}" />
+		<property name="jdbcUrl" value="${jdbc.url}" />
+		<property name="user" value="${jdbc.username}" />
+		<property name="password" value="${jdbc.password}" />
+		<property name="maxPoolSize" value="4" />
+		<property name="minPoolSize" value="1" />
+		<property name="maxStatements" value="1" />
+		<property name="testConnectionOnCheckout" value="true" />
+	</bean>
+
+	<!-- to configure database for sqlite, mysql, etc. migrations -->
+	<bean id="flywayConfig"
+		class="org.flywaydb.core.api.configuration.ClassicConfiguration">
+		<!-- drop existing tables and create new tables -->
+		<property name="validateOnMigrate" value="true" />
+		<property name="cleanOnValidationError" value="true" />
+		<property name="baselineOnMigrate" value="false" />
+		<property name="locations"
+			value="#{'${jdbc.schemaPath}'.split(',')}" />
+		<!-- <property name="dataSource" ref="sqliteDataSource" /> -->
+		<property name="dataSource" ref="dataSource" />
+		<property name="outOfOrder" value="true" />
+	</bean>
+
+	<bean id="flyway" class="org.flywaydb.core.Flyway"
+		init-method="migrate">
+		<constructor-arg ref="flywayConfig" />
+	</bean>
+
+
+	<bean id="entityManagerFactory"
+		class="org.springframework.orm.jpa.LocalContainerEntityManagerFactoryBean">
+		<property name="dataSource" ref="dataSource" />
+		<!-- <property name="dataSource" ref="sqliteDataSource" /> -->
+		<property name="packagesToScan">
+			<array>
+				<value>de.ids_mannheim.korap.core.entity</value>
+				<value>de.ids_mannheim.korap.entity</value>
+				<value>de.ids_mannheim.korap.oauth2.entity</value>
+			</array>
+		</property>
+		<property name="jpaVendorAdapter">
+			<bean id="jpaVendorAdapter"
+				class="org.springframework.orm.jpa.vendor.HibernateJpaVendorAdapter">
+				<property name="databasePlatform"
+					value="${hibernate.dialect}" />
+			</bean>
+		</property>
+		<property name="jpaProperties">
+			<props>
+				<prop key="hibernate.dialect">${hibernate.dialect}</prop>
+				<prop key="hibernate.hbm2ddl.auto">${hibernate.hbm2ddl.auto}</prop>
+				<prop key="hibernate.show_sql">${hibernate.show_sql}</prop>
+				<prop key="hibernate.cache.use_query_cache">${hibernate.cache.use_query_cache}</prop>
+				<prop key="hibernate.cache.use_second_level_cache">${hibernate.cache.use_second_level_cache}
+				</prop>
+				<prop key="hibernate.cache.provider_class">${hibernate.cache.provider}</prop>
+				<prop key="hibernate.cache.region.factory_class">${hibernate.cache.region.factory}</prop>
+				<prop key="hibernate.jdbc.time_zone">${hibernate.jdbc.time_zone}</prop>
+				<!-- <prop key="net.sf.ehcache.configurationResourceName">classpath:ehcache.xml</prop> -->
+			</props>
+		</property>
+	</bean>
+
+	<tx:annotation-driven proxy-target-class="true"
+		transaction-manager="transactionManager" />
+	<bean id="transactionManager"
+		class="org.springframework.orm.jpa.JpaTransactionManager">
+		<property name="entityManagerFactory"
+			ref="entityManagerFactory" />
+	</bean>
+
+	<bean id="transactionTemplate"
+		class="org.springframework.transaction.support.TransactionTemplate">
+		<constructor-arg ref="transactionManager" />
+	</bean>
+
+	<!-- Data access objects -->
+	<bean id="adminDao" class="de.ids_mannheim.korap.dao.AdminDaoImpl" />
+	<bean id="resourceDao"
+		class="de.ids_mannheim.korap.dao.ResourceDao" />
+	<bean id="accessScopeDao"
+		class="de.ids_mannheim.korap.oauth2.dao.AccessScopeDao" />
+	<bean id="authorizationDao"
+		class="de.ids_mannheim.korap.oauth2.dao.CachedAuthorizationDaoImpl" />
+
+	<!-- Services -->
+	<bean id="scopeService"
+		class="de.ids_mannheim.korap.oauth2.service.OAuth2ScopeServiceImpl" />
+
+	<!-- props are injected from default-config.xml -->
+	<bean id="kustvakt_config"
+		class="de.ids_mannheim.korap.config.FullConfiguration">
+		<constructor-arg name="properties" ref="props" />
+	</bean>
+
+	<bean id="initializator"
+		class="de.ids_mannheim.korap.init.Initializator"
+		init-method="initTest">
+	</bean>
+
+	<!-- Krill -->
+	<bean id="search_krill"
+		class="de.ids_mannheim.korap.web.SearchKrill">
+		<constructor-arg value="${krill.indexDir}" />
+	</bean>
+
+	<!-- Validator -->
+	<bean id="validator"
+		class="de.ids_mannheim.korap.validator.ApacheValidator" />
+
+	<!-- URLValidator -->
+	<bean id="redirectURIValidator"
+		class="org.apache.commons.validator.routines.UrlValidator">
+		<constructor-arg value="http,https" index="0" />
+		<constructor-arg index="1" type="long"
+			value="#{T(org.apache.commons.validator.routines.UrlValidator).ALLOW_LOCAL_URLS + 
+		T(org.apache.commons.validator.routines.UrlValidator).NO_FRAGMENTS}" />
+	</bean>
+	<bean id="urlValidator"
+		class="org.apache.commons.validator.routines.UrlValidator">
+		<constructor-arg value="http,https" />
+	</bean>
+
+	<!-- Rewrite -->
+	<bean id="foundryRewrite"
+		class="de.ids_mannheim.korap.rewrite.FoundryRewrite" />
+	<bean id="collectionRewrite"
+		class="de.ids_mannheim.korap.rewrite.CollectionRewrite" />
+	<bean id="collectionCleanRewrite"
+		class="de.ids_mannheim.korap.rewrite.CollectionCleanRewrite" />
+	<bean id="virtualCorpusRewrite"
+		class="de.ids_mannheim.korap.rewrite.VirtualCorpusRewrite" />
+	<bean id="collectionConstraint"
+		class="de.ids_mannheim.korap.rewrite.CollectionConstraint" />
+	<bean id="queryReferenceRewrite"
+		class="de.ids_mannheim.korap.rewrite.QueryReferenceRewrite" />
+
+	<util:list id="rewriteTasks"
+		value-type="de.ids_mannheim.korap.rewrite.RewriteTask">
+		<!-- <ref bean="collectionConstraint" /> <ref bean="collectionCleanRewrite" 
+			/> -->
+		<ref bean="foundryRewrite" />
+		<ref bean="collectionRewrite" />
+		<ref bean="virtualCorpusRewrite" />
+		<ref bean="queryReferenceRewrite" />
+	</util:list>
+
+	<bean id="rewriteHandler"
+		class="de.ids_mannheim.korap.rewrite.RewriteHandler">
+		<constructor-arg ref="rewriteTasks" />
+	</bean>
+
+	<bean id="kustvaktResponseHandler"
+		class="de.ids_mannheim.korap.web.KustvaktResponseHandler">
+	</bean>
+
+	<!-- OAuth -->
+	<bean id="oauth2ResponseHandler"
+		class="de.ids_mannheim.korap.web.OAuth2ResponseHandler">
+	</bean>
+
+	<bean name="kustvakt_encryption"
+		class="de.ids_mannheim.korap.encryption.KustvaktEncryption">
+		<constructor-arg ref="kustvakt_config" />
+	</bean>
+
+	<!-- authentication providers to use -->
+	<bean id="basic_auth"
+		class="de.ids_mannheim.korap.authentication.BasicAuthentication" />
+
+
+	<bean id="session_auth"
+		class="de.ids_mannheim.korap.authentication.SessionAuthentication">
+		<constructor-arg
+			type="de.ids_mannheim.korap.config.KustvaktConfiguration"
+			ref="kustvakt_config" />
+		<constructor-arg
+			type="de.ids_mannheim.korap.interfaces.EncryptionIface"
+			ref="kustvakt_encryption" />
+	</bean>
+
+	<bean id="oauth2_auth"
+		class="de.ids_mannheim.korap.authentication.OAuth2Authentication" />
+
+
+	<util:list id="kustvakt_authproviders"
+		value-type="de.ids_mannheim.korap.interfaces.AuthenticationIface">
+		<ref bean="basic_auth" />
+		<ref bean="session_auth" />
+		<ref bean="oauth2_auth" />
+	</util:list>
+
+	<!-- specify type for constructor argument -->
+	<bean id="authenticationManager"
+		class="de.ids_mannheim.korap.authentication.KustvaktAuthenticationManager">
+		<constructor-arg
+			type="de.ids_mannheim.korap.interfaces.EncryptionIface"
+			ref="kustvakt_encryption" />
+		<constructor-arg ref="kustvakt_config" />
+		<!-- inject authentication providers to use -->
+		<property name="providers" ref="kustvakt_authproviders" />
+	</bean>
+
+	<!-- todo: if db interfaces not loaded via spring, does transaction even 
+		work then? -->
+	<!-- the transactional advice (i.e. what 'happens'; see the <aop:advisor/> 
+		bean below) -->
+	<tx:advice id="txAdvice" transaction-manager="txManager">
+		<!-- the transactional semantics... -->
+		<tx:attributes>
+			<!-- all methods starting with 'get' are read-only -->
+			<tx:method name="get*" read-only="true"
+				rollback-for="KorAPException" />
+			<!-- other methods use the default transaction settings (see below) -->
+			<tx:method name="*" rollback-for="KorAPException" />
+		</tx:attributes>
+	</tx:advice>
+
+	<!-- ensure that the above transactional advice runs for any execution of 
+		an operation defined by the service interface -->
+	<aop:config>
+		<aop:pointcut id="service"
+			expression="execution(* de.ids_mannheim.korap.interfaces.db.*.*(..))" />
+		<aop:advisor advice-ref="txAdvice" pointcut-ref="service" />
+	</aop:config>
+
+	<!-- similarly, don't forget the PlatformTransactionManager -->
+	<bean id="txManager"
+		class="org.springframework.jdbc.datasource.DataSourceTransactionManager">
+		<property name="dataSource" ref="dataSource" />
+	</bean>
+
+	<!-- mail -->
+	<bean id="authenticator"
+		class="de.ids_mannheim.korap.service.MailAuthenticator">
+		<constructor-arg index="0" value="${mail.username}" />
+		<constructor-arg index="1" value="${mail.password}" />
+	</bean>
+	<bean id="smtpSession" class="jakarta.mail.Session"
+		factory-method="getInstance">
+		<constructor-arg index="0">
+			<props>
+				<prop key="mail.smtp.submitter">${mail.username}</prop>
+				<prop key="mail.smtp.auth">${mail.auth}</prop>
+				<prop key="mail.smtp.host">${mail.host}</prop>
+				<prop key="mail.smtp.port">${mail.port}</prop>
+				<prop key="mail.smtp.starttls.enable">${mail.starttls.enable}</prop>
+				<prop key="mail.smtp.connectiontimeout">${mail.connectiontimeout}</prop>
+			</props>
+		</constructor-arg>
+		<constructor-arg index="1" ref="authenticator" />
+	</bean>
+	<bean id="mailSender"
+		class="org.springframework.mail.javamail.JavaMailSenderImpl">
+		<property name="session" ref="smtpSession" />
+	</bean>
+	<bean id="velocityEngine"
+		class="org.apache.velocity.app.VelocityEngine">
+		<constructor-arg index="0">
+			<props>
+				<prop key="resource.loader">class</prop>
+				<prop key="class.resource.loader.class">org.apache.velocity.runtime.resource.loader.ClasspathResourceLoader
+				</prop>
+			</props>
+		</constructor-arg>
+	</bean>
+</beans>