diff --git a/full/src/test/java/de/ids_mannheim/korap/config/BeanConfigBaseTest.java b/full/src/test/java/de/ids_mannheim/korap/config/BeanConfigBaseTest.java
index a625556..b69cecf 100644
--- a/full/src/test/java/de/ids_mannheim/korap/config/BeanConfigBaseTest.java
+++ b/full/src/test/java/de/ids_mannheim/korap/config/BeanConfigBaseTest.java
@@ -2,7 +2,8 @@
 
 import static org.junit.Assert.assertNotNull;
 
-import org.apache.log4j.Logger;
+import org.apache.logging.log4j.LogManager;
+import org.apache.logging.log4j.Logger;
 import org.junit.runner.RunWith;
 import org.junit.runner.notification.RunNotifier;
 import org.junit.runners.model.InitializationError;
@@ -26,7 +27,7 @@
 @DirtiesContext(classMode = DirtiesContext.ClassMode.AFTER_CLASS)
 public abstract class BeanConfigBaseTest {
 
-    private static Logger jlog = Logger.getLogger(BeanConfigBaseTest.class);
+    private static Logger jlog = LogManager.getLogger(BeanConfigBaseTest.class);
     @Autowired
     protected ApplicationContext context;
     
diff --git a/full/src/test/java/de/ids_mannheim/korap/config/BeanConfigTest.java b/full/src/test/java/de/ids_mannheim/korap/config/BeanConfigTest.java
index 7603c18..2268d87 100644
--- a/full/src/test/java/de/ids_mannheim/korap/config/BeanConfigTest.java
+++ b/full/src/test/java/de/ids_mannheim/korap/config/BeanConfigTest.java
@@ -2,7 +2,8 @@
 
 import static org.junit.Assert.assertNotNull;
 
-import org.apache.log4j.Logger;
+import org.apache.logging.log4j.LogManager;
+import org.apache.logging.log4j.Logger;
 import org.junit.runner.RunWith;
 import org.junit.runner.notification.RunNotifier;
 import org.junit.runners.model.InitializationError;
@@ -25,7 +26,7 @@
 @DirtiesContext(classMode = DirtiesContext.ClassMode.AFTER_CLASS)
 public abstract class BeanConfigTest {
 
-    private static Logger jlog = Logger.getLogger(BeanConfigTest.class);
+    private static Logger jlog = LogManager.getLogger(BeanConfigTest.class);
     @Autowired
     protected ApplicationContext context;
 
diff --git a/full/src/test/java/de/ids_mannheim/korap/misc/CollectionQueryBuilderTest.java b/full/src/test/java/de/ids_mannheim/korap/misc/CollectionQueryBuilderTest.java
index 3142330..87469ac 100644
--- a/full/src/test/java/de/ids_mannheim/korap/misc/CollectionQueryBuilderTest.java
+++ b/full/src/test/java/de/ids_mannheim/korap/misc/CollectionQueryBuilderTest.java
@@ -227,7 +227,7 @@
         KoralCollectionQueryBuilder test = new KoralCollectionQueryBuilder();
         test.with("corpusSigle=WPD");
         String json = test.toJSON();
-        System.out.println(json);
+//        System.out.println(json);
         //JsonNode node = (JsonNode) test.rebaseCollection(null);
         //node = b.mergeWith(node);
         //assertNotNull(node);
@@ -249,7 +249,7 @@
         // operator is not supposed to be here!
         test.and().with("corpusSigle=WPD");
         String json = test.toJSON();
-        System.out.println(json);
+//        System.out.println(json);
         //JsonNode node = (JsonNode) test.rebaseCollection(null);
         //node = b.mergeWith(node);
         //assertNotNull(node);
@@ -335,7 +335,7 @@
         builder.setBaseQuery(resource.getData());
         builder.or().with("pubPlace=Mannheim");
 
-        System.out.println("query " + builder.toJSON());
+//        System.out.println("query " + builder.toJSON());
         // todo: assertions
     }
 
@@ -354,7 +354,7 @@
         builder.setBaseQuery(resource.getData());
         builder.or().with("pubPlace=Mannheim");
 
-        System.out.println("query " + builder.toJSON());
+//        System.out.println("query " + builder.toJSON());
         // todo: assertions
     }
 
diff --git a/full/src/test/java/de/ids_mannheim/korap/web/controller/OAuth2AccessTokenTest.java b/full/src/test/java/de/ids_mannheim/korap/web/controller/OAuth2AccessTokenTest.java
index f9cd6e0..8126843 100644
--- a/full/src/test/java/de/ids_mannheim/korap/web/controller/OAuth2AccessTokenTest.java
+++ b/full/src/test/java/de/ids_mannheim/korap/web/controller/OAuth2AccessTokenTest.java
@@ -24,28 +24,23 @@
 
 public class OAuth2AccessTokenTest extends SpringJerseyTest {
 
-    private String testAccessToken = null;
 
-    private String requestToken()
-            throws KustvaktException {
-        if (testAccessToken == null) {
-            MultivaluedMap<String, String> form = new MultivaluedMapImpl();
-            form.add("grant_type", "password");
-            form.add("client_id", "fCBbQkAyYzI4NzUxMg");
-            form.add("client_secret", "secret");
-            form.add("username", "dory");
-            form.add("password", "password");
+    private String requestToken () throws KustvaktException {
+        MultivaluedMap<String, String> form = new MultivaluedMapImpl();
+        form.add("grant_type", "password");
+        form.add("client_id", "fCBbQkAyYzI4NzUxMg");
+        form.add("client_secret", "secret");
+        form.add("username", "dory");
+        form.add("password", "password");
 
-            ClientResponse response = resource().path("oauth2").path("token")
-                    .header(HttpHeaders.CONTENT_TYPE,
-                            ContentType.APPLICATION_FORM_URLENCODED)
-                    .entity(form).post(ClientResponse.class);
+        ClientResponse response = resource().path("oauth2").path("token")
+                .header(HttpHeaders.CONTENT_TYPE,
+                        ContentType.APPLICATION_FORM_URLENCODED)
+                .entity(form).post(ClientResponse.class);
 
-            String entity = response.getEntity(String.class);
-            JsonNode node = JsonUtils.readTree(entity);
-            testAccessToken = node.at("/access_token").asText();
-        }
-        return testAccessToken;
+        String entity = response.getEntity(String.class);
+        JsonNode node = JsonUtils.readTree(entity);
+        return node.at("/access_token").asText();
     }
 
     @Test
@@ -97,24 +92,4 @@
         assertEquals("Access token is not found",
                 node.at("/errors/0/1").asText());
     }
-
-    @Test
-    public void testSearchWithExpiredToken ()
-            throws KustvaktException, IOException {
-        ClientResponse response = resource().path("search")
-                .queryParam("q", "Wasser").queryParam("ql", "poliqarp")
-                .header(Attributes.AUTHORIZATION,
-                        "Bearer fia0123ikBWn931470H8s5gRqx7Moc4p")
-                .get(ClientResponse.class);
-
-        String ent = response.getEntity(String.class);
-
-        assertEquals(ClientResponse.Status.UNAUTHORIZED.getStatusCode(),
-                response.getStatus());
-
-        JsonNode node = JsonUtils.readTree(ent);
-        assertEquals(StatusCodes.EXPIRED, node.at("/errors/0/0").asInt());
-        assertEquals("Access token is expired",
-                node.at("/errors/0/1").asText());
-    }
 }
diff --git a/full/src/test/java/de/ids_mannheim/korap/web/controller/OAuth2ClientControllerTest.java b/full/src/test/java/de/ids_mannheim/korap/web/controller/OAuth2ClientControllerTest.java
index 4f13ad9..c742d1d 100644
--- a/full/src/test/java/de/ids_mannheim/korap/web/controller/OAuth2ClientControllerTest.java
+++ b/full/src/test/java/de/ids_mannheim/korap/web/controller/OAuth2ClientControllerTest.java
@@ -248,7 +248,6 @@
                 .delete(ClientResponse.class);
 
         String entity = response.getEntity(String.class);
-        System.out.println(entity);
         assertEquals(Status.BAD_REQUEST.getStatusCode(), response.getStatus());
 
         JsonNode node = JsonUtils.readTree(entity);
@@ -274,7 +273,6 @@
                 .entity(form).delete(ClientResponse.class);
 
         String entity = response.getEntity(String.class);
-        System.out.println(entity);
         assertEquals(Status.UNAUTHORIZED.getStatusCode(), response.getStatus());
 
         JsonNode node = JsonUtils.readTree(entity);
diff --git a/full/src/test/java/de/ids_mannheim/korap/web/controller/OAuth2OpenIdControllerTest.java b/full/src/test/java/de/ids_mannheim/korap/web/controller/OAuth2OpenIdControllerTest.java
index 8caafdc..a5e84d3 100644
--- a/full/src/test/java/de/ids_mannheim/korap/web/controller/OAuth2OpenIdControllerTest.java
+++ b/full/src/test/java/de/ids_mannheim/korap/web/controller/OAuth2OpenIdControllerTest.java
@@ -13,10 +13,8 @@
 import javax.ws.rs.core.MediaType;
 import javax.ws.rs.core.MultivaluedMap;
 
-import org.apache.http.HttpStatus;
 import org.apache.http.entity.ContentType;
 import org.apache.oltu.oauth2.common.message.types.TokenType;
-import org.junit.Ignore;
 import org.junit.Test;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.util.MultiValueMap;
@@ -42,7 +40,6 @@
 import de.ids_mannheim.korap.config.FullConfiguration;
 import de.ids_mannheim.korap.config.SpringJerseyTest;
 import de.ids_mannheim.korap.exceptions.KustvaktException;
-import de.ids_mannheim.korap.exceptions.StatusCodes;
 import de.ids_mannheim.korap.oauth2.constant.OAuth2Error;
 import de.ids_mannheim.korap.utils.JsonUtils;
 
@@ -107,36 +104,7 @@
         assertEquals("thisIsMyState", params.getFirst("state"));
     }
 
-    @Ignore
-    // cannot be tested dynamically
-    public void testRequestAuthorizationCodeAuthenticationTooOld ()
-            throws KustvaktException {
-        MultivaluedMap<String, String> form = new MultivaluedMapImpl();
-        form.add("response_type", "code");
-        form.add("client_id", "fCBbQkAyYzI4NzUxMg");
-        form.add("redirect_uri", redirectUri);
-        form.add("scope", "openid");
-        form.add("max_age", "1");
-
-        ClientResponse response =
-                resource().path("oauth2").path("openid").path("authorize")
-                        .header(Attributes.AUTHORIZATION,
-                                "Bearer ")
-                        .header(HttpHeaders.X_FORWARDED_FOR, "149.27.0.32")
-                        .header(HttpHeaders.CONTENT_TYPE,
-                                ContentType.APPLICATION_FORM_URLENCODED)
-                        .entity(form).post(ClientResponse.class);
-
-        assertEquals(HttpStatus.SC_UNAUTHORIZED, response.getStatus());
-        String entity = response.getEntity(String.class);
-        JsonNode node = JsonUtils.readTree(entity);
-        assertEquals(StatusCodes.USER_REAUTHENTICATION_REQUIRED,
-                node.at("/errors/0/0").asInt());
-        assertEquals(
-                "User reauthentication is required because the authentication "
-                        + "time is too old according to max_age",
-                node.at("/errors/0/1").asText());
-    }
+    
 
     private void testRequestAuthorizationCodeWithoutOpenID (
             MultivaluedMap<String, String> form, String redirectUri)
diff --git a/full/src/test/java/de/ids_mannheim/korap/web/controller/TokenExpiryTest.java b/full/src/test/java/de/ids_mannheim/korap/web/controller/TokenExpiryTest.java
new file mode 100644
index 0000000..3985fd6
--- /dev/null
+++ b/full/src/test/java/de/ids_mannheim/korap/web/controller/TokenExpiryTest.java
@@ -0,0 +1,104 @@
+package de.ids_mannheim.korap.web.controller;
+
+import static org.junit.Assert.assertEquals;
+
+import java.io.IOException;
+
+import javax.ws.rs.core.MultivaluedMap;
+
+import org.apache.http.HttpStatus;
+import org.apache.http.entity.ContentType;
+import org.junit.Test;
+
+import com.fasterxml.jackson.databind.JsonNode;
+import com.google.common.net.HttpHeaders;
+import com.sun.jersey.api.client.ClientResponse;
+import com.sun.jersey.core.util.MultivaluedMapImpl;
+
+import de.ids_mannheim.korap.config.Attributes;
+import de.ids_mannheim.korap.config.SpringJerseyTest;
+import de.ids_mannheim.korap.exceptions.KustvaktException;
+import de.ids_mannheim.korap.exceptions.StatusCodes;
+import de.ids_mannheim.korap.utils.JsonUtils;
+
+public class TokenExpiryTest extends SpringJerseyTest {
+
+    @Test
+    public void requestToken ()
+            throws KustvaktException, InterruptedException, IOException {
+        MultivaluedMap<String, String> form = new MultivaluedMapImpl();
+        form.add("grant_type", "password");
+        form.add("client_id", "fCBbQkAyYzI4NzUxMg");
+        form.add("client_secret", "secret");
+        form.add("username", "dory");
+        form.add("password", "password");
+
+        ClientResponse response = resource().path("oauth2").path("token")
+                .header(HttpHeaders.CONTENT_TYPE,
+                        ContentType.APPLICATION_FORM_URLENCODED)
+                .entity(form).post(ClientResponse.class);
+
+        String entity = response.getEntity(String.class);
+        JsonNode node = JsonUtils.readTree(entity);
+        String token = node.at("/access_token").asText();
+
+        Thread.sleep(1000);
+
+        testRequestAuthorizationCodeAuthenticationTooOld(token);
+        
+        Thread.sleep(1500);
+        testSearchWithExpiredToken(token);
+    }
+
+    // not possible to store expired token in the test database,
+    // because sqlite needs a trigger after INSERT to
+    // oauth_access_token to store created_date. Before INSERT trigger
+    // does not work.
+    private void testSearchWithExpiredToken (String token)
+            throws KustvaktException, IOException {
+        ClientResponse response = resource().path("search")
+                .queryParam("q", "Wasser").queryParam("ql", "poliqarp")
+                .header(Attributes.AUTHORIZATION, "Bearer " + token)
+                .get(ClientResponse.class);
+
+        String ent = response.getEntity(String.class);
+
+        assertEquals(ClientResponse.Status.UNAUTHORIZED.getStatusCode(),
+                response.getStatus());
+
+        JsonNode node = JsonUtils.readTree(ent);
+        assertEquals(StatusCodes.EXPIRED, node.at("/errors/0/0").asInt());
+        assertEquals("Access token is expired",
+                node.at("/errors/0/1").asText());
+    }
+
+    // cannot be tested dynamically
+    private void testRequestAuthorizationCodeAuthenticationTooOld (String token)
+            throws KustvaktException {
+        MultivaluedMap<String, String> form = new MultivaluedMapImpl();
+        form.add("response_type", "code");
+        form.add("client_id", "fCBbQkAyYzI4NzUxMg");
+        form.add("redirect_uri",
+                "https://korap.ids-mannheim.de/confidential/redirect");
+        form.add("scope", "openid");
+        form.add("max_age", "1");
+
+        ClientResponse response =
+                resource().path("oauth2").path("openid").path("authorize")
+                        .header(Attributes.AUTHORIZATION, "Bearer " + token)
+                        .header(HttpHeaders.X_FORWARDED_FOR, "149.27.0.32")
+                        .header(HttpHeaders.CONTENT_TYPE,
+                                ContentType.APPLICATION_FORM_URLENCODED)
+                        .entity(form).post(ClientResponse.class);
+
+        assertEquals(HttpStatus.SC_UNAUTHORIZED, response.getStatus());
+        String entity = response.getEntity(String.class);
+        JsonNode node = JsonUtils.readTree(entity);
+        assertEquals(StatusCodes.USER_REAUTHENTICATION_REQUIRED,
+                node.at("/errors/0/0").asInt());
+        assertEquals(
+                "User reauthentication is required because the authentication "
+                        + "time is too old according to max_age",
+                node.at("/errors/0/1").asText());
+    }
+}
diff --git a/full/src/test/java/de/ids_mannheim/korap/web/controller/UserGroupControllerAdminTest.java b/full/src/test/java/de/ids_mannheim/korap/web/controller/UserGroupControllerAdminTest.java
index 70fd51f..2af5234 100644
--- a/full/src/test/java/de/ids_mannheim/korap/web/controller/UserGroupControllerAdminTest.java
+++ b/full/src/test/java/de/ids_mannheim/korap/web/controller/UserGroupControllerAdminTest.java
@@ -120,6 +120,8 @@
         assertEquals(Status.OK.getStatusCode(), response.getStatus());
         String entity = response.getEntity(String.class);
         JsonNode node = JsonUtils.readTree(entity);
+        assertEquals(4, node.size());
+
         boolean containsHiddenStatus = false;
         for (int i = 0; i < node.size(); i++) {
             if (node.get(i).at("/status").asText().equals("HIDDEN")) {
diff --git a/full/src/test/resources/kustvakt-test.conf b/full/src/test/resources/kustvakt-test.conf
index b135ca7..8416b6a 100644
--- a/full/src/test/resources/kustvakt-test.conf
+++ b/full/src/test/resources/kustvakt-test.conf
@@ -81,8 +81,8 @@
 
 ## token expiration time
 security.longTokenTTL = 1D
-security.tokenTTL = 9S
-security.shortTokenTTL = 5S
+security.tokenTTL = 2S
+security.shortTokenTTL = 1S
 
 ## specifies the user data field that is used to salt user passwords
 security.passcode.salt=salt
diff --git a/full/src/test/resources/test-expired.token b/full/src/test/resources/test-expired.token
deleted file mode 100644
index 5d49da3..0000000
--- a/full/src/test/resources/test-expired.token
+++ /dev/null
@@ -1 +0,0 @@
-eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJ0ZXN0VXNlciIsImlzcyI6Imh0dHA6XC9cL2tvcmFwLmlkcy1tYW5uaGVpbS5kZSIsImV4cCI6MTUyODMwMzE5OX0.rmEFpdm8-_iyHGb2tEaJbKBoceiZwnyodixWhyLrU9w
\ No newline at end of file