diff --git a/src/main/java/de/ids_mannheim/korap/config/KustvaktConfiguration.java b/src/main/java/de/ids_mannheim/korap/config/KustvaktConfiguration.java
index 1ad51dd..f6e85af 100644
--- a/src/main/java/de/ids_mannheim/korap/config/KustvaktConfiguration.java
+++ b/src/main/java/de/ids_mannheim/korap/config/KustvaktConfiguration.java
@@ -93,6 +93,8 @@
     // deprec?!
     private final BACKENDS DEFAULT_ENGINE = BACKENDS.LUCENE;
 
+	private String ldapConfig;
+
 
     /**
      * loading of the properties and mapping to parameter variables
@@ -163,6 +165,8 @@
         passcodeSaltField = properties.getProperty("security.passcode.salt",
                 "accountCreation");
         
+        ldapConfig = properties.getProperty("ldap.config");
+        
 //        freeLicenses = Arrays.asList(license.split("|"));
 //        publicLicenses = Arrays.asList(properties.getProperty("kustvakt.availability.public","").split("|"));
 //        allLicenses = Arrays.asList(properties.getProperty("kustvakt.availability.all","").split("|"));
diff --git a/src/main/java/de/ids_mannheim/korap/security/auth/BasicHttpAuth.java b/src/main/java/de/ids_mannheim/korap/security/auth/BasicHttpAuth.java
index 82e2fb3..0da09f1 100644
--- a/src/main/java/de/ids_mannheim/korap/security/auth/BasicHttpAuth.java
+++ b/src/main/java/de/ids_mannheim/korap/security/auth/BasicHttpAuth.java
@@ -86,7 +86,7 @@
         if (values != null) {
             TokenContext c = new TokenContext();
             User user = dao.getAccount(values[0]);
-            if (user instanceof KorAPUser) {
+            if (user instanceof KorAPUser && ((KorAPUser) user).getPassword() != null) {
                 boolean check = crypto.checkHash(values[1],
                         ((KorAPUser) user).getPassword());
 
diff --git a/src/main/java/de/ids_mannheim/korap/security/auth/KustvaktAuthenticationManager.java b/src/main/java/de/ids_mannheim/korap/security/auth/KustvaktAuthenticationManager.java
index 7a87776..3fc69d1 100644
--- a/src/main/java/de/ids_mannheim/korap/security/auth/KustvaktAuthenticationManager.java
+++ b/src/main/java/de/ids_mannheim/korap/security/auth/KustvaktAuthenticationManager.java
@@ -404,7 +404,7 @@
 		// LDAP Access:
 		try {
 			// todo: unknown = ...
-			int ret = LdapAuth3.login(username, password);
+			int ret = LdapAuth3.login(username, password, config.getLdapConfig());
 			System.out.printf("Debug: autenticationIdM: Ldap.login(%s) returns: %d.\n", username, ret);
 			if (ret != LdapAuth3.LDAP_AUTH_ROK) {
 				jlog.error("LdapAuth3.login(username='{}') returns '{}'='{}'!", username, ret,
diff --git a/src/main/java/de/ids_mannheim/korap/security/auth/LdapAuth3.java b/src/main/java/de/ids_mannheim/korap/security/auth/LdapAuth3.java
index c7f69fd..fe8e055 100644
--- a/src/main/java/de/ids_mannheim/korap/security/auth/LdapAuth3.java
+++ b/src/main/java/de/ids_mannheim/korap/security/auth/LdapAuth3.java
@@ -114,11 +114,10 @@
 	 *  17.02.17/FB
 	 */
 	
-	static String loadProp() throws IOException
+	static String loadProp(String sConfFile) throws IOException
 	
 	{
 		String sPwd = null;
-		String sConfFile = System.getProperty("user.home") + "/.config/ldap.conf";
 		FileInputStream in;
 		Properties prop;
 		
@@ -188,7 +187,7 @@
 	 *  idsStatus = 3 -> Nutzer ist LDAP-weit gesperrt
 	 */
 
-	public static int login(String sUserDN, String sUserPwd) throws LDAPException
+	public static int login(String sUserDN, String sUserPwd, String ldapConfig) throws LDAPException
 
 	{
 
@@ -200,7 +199,7 @@
 	SearchResult srchRes = null;
 
 	try{
-		sPwd = loadProp();
+		sPwd = loadProp(ldapConfig);
 		}
 	catch( IOException e )
 		{
diff --git a/src/main/java/de/ids_mannheim/korap/web/SearchKrill.java b/src/main/java/de/ids_mannheim/korap/web/SearchKrill.java
index 41c89ff..3953323 100644
--- a/src/main/java/de/ids_mannheim/korap/web/SearchKrill.java
+++ b/src/main/java/de/ids_mannheim/korap/web/SearchKrill.java
@@ -150,10 +150,10 @@
                         layers, includeSpans, includeHighlights,
                         sentenceExpansion);
             	String availability = km.getAvailability();
-//            	String availability = "QAO-NC";
             	if (availability != null){
             		Matcher m = licensePattern.matcher(availability);
             		if (!m.matches()){
+            			km = new Match();
             			km.addError(StatusCodes.ACCESS_DENIED, 
             					"Retrieving match info with ID "+id+" is not allowed.");
             		}
diff --git a/src/main/java/de/ids_mannheim/korap/web/service/full/ResourceService.java b/src/main/java/de/ids_mannheim/korap/web/service/full/ResourceService.java
index 575e4d2..11169d8 100644
--- a/src/main/java/de/ids_mannheim/korap/web/service/full/ResourceService.java
+++ b/src/main/java/de/ids_mannheim/korap/web/service/full/ResourceService.java
@@ -503,7 +503,7 @@
         serializer.setQuery(q, ql, v);
         if (cq != null)
             serializer.setCollection(cq);
-
+        	// combine cq with availability CQ according to corpusAccess 
         MetaQueryBuilder meta = createMetaQuery(pageIndex, pageInteger, ctx,
                 pageLength, cutoff);
         serializer.setMeta(meta.raw());
diff --git a/src/test/java/de/ids_mannheim/korap/config/TestHelper.java b/src/test/java/de/ids_mannheim/korap/config/TestHelper.java
index 3dd77fe..3698e9c 100644
--- a/src/test/java/de/ids_mannheim/korap/config/TestHelper.java
+++ b/src/test/java/de/ids_mannheim/korap/config/TestHelper.java
@@ -119,9 +119,11 @@
         KustvaktAuthenticationManager manager = getBean(ContextHolder.KUSTVAKT_AUTHENTICATION_MANAGER);
 
         try {
-            getUser();
+            User user = getUser();
             jlog.debug("found user, skipping setup ...");
-            return this;
+            if (!user.getUsername().equals(data.get(Attributes.USERNAME))){
+            	return this;
+            }
         }
         catch (RuntimeException e) {
             // do nothing and continue
diff --git a/src/test/java/de/ids_mannheim/korap/web/service/full/FilterTest.java b/src/test/java/de/ids_mannheim/korap/web/service/full/FilterTest.java
index 43986a2..a8b1c6e 100644
--- a/src/test/java/de/ids_mannheim/korap/web/service/full/FilterTest.java
+++ b/src/test/java/de/ids_mannheim/korap/web/service/full/FilterTest.java
@@ -59,6 +59,8 @@
                 .header(Attributes.AUTHORIZATION,
                         BasicHttpAuth.encode("kustvakt", "kustvakt2015"))
                 .get(ClientResponse.class);
+        String entity = resp.getEntity(String.class);
+        System.out.println(entity);
         assertEquals(ClientResponse.Status.UNAUTHORIZED.getStatusCode(), resp.getStatus());
     }
 
diff --git a/src/test/java/de/ids_mannheim/korap/web/service/full/LightServiceTest.java b/src/test/java/de/ids_mannheim/korap/web/service/full/LightServiceTest.java
index 522d3b3..c98743c 100644
--- a/src/test/java/de/ids_mannheim/korap/web/service/full/LightServiceTest.java
+++ b/src/test/java/de/ids_mannheim/korap/web/service/full/LightServiceTest.java
@@ -144,11 +144,10 @@
     }
 
 	@Test
-	public void testMatchInfoGet1 () {
+	public void testMatchInfoGetWithoutSpans () {
         ClientResponse response = resource()
 			.path(getAPIVersion())
-			.path("corpus/GOE/AGI/04846/p36875-36876/matchInfo")
-			//.path("corpus/WPD/AAA.00001/p4-5/matchInfo")
+			.path("corpus/GOE/AGA/01784/p36-46/matchInfo")
 			.queryParam("foundry", "*")
 			.queryParam("spans", "false")
 			.get(ClientResponse.class);
@@ -157,16 +156,15 @@
         String ent = response.getEntity(String.class);
         JsonNode node = JsonUtils.readTree(ent);
         assertNotNull(node);
-        assertEquals("GOE/AGI/04846", node.at("/textSigle").asText());
-        assertEquals("Zweiter römischer Aufenthalt", node.at("/title").asText());
+        assertEquals("GOE/AGA/01784", node.at("/textSigle").asText());
+        assertEquals("Belagerung von Mainz", node.at("/title").asText());
 	};
 
 	@Test
 	public void testMatchInfoGet2 () {
         ClientResponse response = resource()
 			.path(getAPIVersion())
-			.path("corpus/GOE/AGI/04846/p36875-36876/matchInfo")
-			//.path("corpus/WPD/AAA.00001/p4-5/matchInfo")
+			.path("corpus/GOE/AGA/01784/p36-46/matchInfo")
 			.queryParam("foundry", "*")
 			.get(ClientResponse.class);
         assertEquals(ClientResponse.Status.OK.getStatusCode(),
@@ -174,8 +172,8 @@
         String ent = response.getEntity(String.class);
         JsonNode node = JsonUtils.readTree(ent);
         assertNotNull(node);
-        assertEquals("GOE/AGI/04846", node.at("/textSigle").asText());
-        assertEquals("Zweiter römischer Aufenthalt", node.at("/title").asText());
+        assertEquals("GOE/AGA/01784", node.at("/textSigle").asText());
+        assertEquals("Belagerung von Mainz", node.at("/title").asText());
 	};
 
     @Test
diff --git a/src/test/java/de/ids_mannheim/korap/web/service/full/MatchInfoLegacyServiceTest.java b/src/test/java/de/ids_mannheim/korap/web/service/full/MatchInfoLegacyServiceTest.java
deleted file mode 100644
index f0527ab..0000000
--- a/src/test/java/de/ids_mannheim/korap/web/service/full/MatchInfoLegacyServiceTest.java
+++ /dev/null
@@ -1,93 +0,0 @@
-package de.ids_mannheim.korap.web.service.full;
-
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.assertTrue;
-
-import org.junit.BeforeClass;
-import org.junit.Test;
-
-import com.fasterxml.jackson.databind.JsonNode;
-import com.sun.jersey.api.client.ClientResponse;
-
-import de.ids_mannheim.korap.exceptions.KustvaktException;
-import de.ids_mannheim.korap.utils.JsonUtils;
-import de.ids_mannheim.korap.web.service.FastJerseyTest;
-
-public class MatchInfoLegacyServiceTest extends FastJerseyTest {
-
-    @BeforeClass
-    public static void configure () throws Exception {
-        FastJerseyTest.setPackages("de.ids_mannheim.korap.web.service.full",
-                "de.ids_mannheim.korap.web.filter",
-                "de.ids_mannheim.korap.web.utils");
-    }
-
-
-    @Test
-    public void testGetMatchInfoPublicCorpus () {
-        ClientResponse response = resource().path(getAPIVersion())
-                .path("corpus").path("GOE").path("AGI.04846")
-                .path("p36875-36876").path("matchInfo")
-                .queryParam("foundry", "*")
-                .get(ClientResponse.class);
-       
-        String entity = response.getEntity(String.class);
-        assertEquals(ClientResponse.Status.OK.getStatusCode(),
-                response.getStatus());
-        JsonNode node = JsonUtils.readTree(entity);
-        assertNotNull(node);
-        assertEquals("GOE/AGI/04846", node.at("/textSigle").asText());
-        assertEquals("Zweiter römischer Aufenthalt",
-                node.at("/title").asText());
-        assertEquals("vom Juni 1787 bis April 1788",
-                node.at("/subTitle").asText());
-        assertEquals("Goethe, Johann Wolfgang von",
-                node.at("/author").asText());
-		assertTrue(node.at("/snippet").asText()
-				   .startsWith("<span class=\"context-left\"></span>"
-							   + "<span class=\"match\">"
-					   ));
-    }
-    
-    // EM: need reimplementation
-    @Test
-    public void testGetMatchOnlyUnauthorizeCorpus () {
-        ClientResponse response = resource().path(getAPIVersion())
-                .path("corpus").path("WPD15").path("B07.51608")
-                .path("p46-57").path("matchInfo").get(ClientResponse.class);
-
-        assertEquals(ClientResponse.Status.BAD_REQUEST.getStatusCode(),
-                response.getStatus());
-        String entity = response.getEntity(String.class);
-       // System.out.println(entity);
-        JsonNode node = JsonUtils.readTree(entity);
-        assertNotNull(node);
-        assertEquals(101, node.at("/errors/0/0").asInt());
-        assertEquals("[Cannot found public Corpus with ids: [WPD15]]",
-                node.at("/errors/0/2").asText());
-    }
-
-//    @Test
-//    public void testMatchInfoSave () {
-//
-//    }
-//
-//
-//    @Test
-//    public void testMatchInfoDelete () {
-//
-//    }
-//
-//
-//    @Test
-//    public void testGetMatches () {
-//
-//    }
-
-
-    @Override
-    public void initMethod () throws KustvaktException {
-        helper().runBootInterfaces();
-    }
-}
diff --git a/src/test/java/de/ids_mannheim/korap/web/service/full/MatchInfoServiceTest.java b/src/test/java/de/ids_mannheim/korap/web/service/full/MatchInfoServiceTest.java
index c6c0b04..4b58d10 100644
--- a/src/test/java/de/ids_mannheim/korap/web/service/full/MatchInfoServiceTest.java
+++ b/src/test/java/de/ids_mannheim/korap/web/service/full/MatchInfoServiceTest.java
@@ -6,7 +6,6 @@
 
 import org.eclipse.jetty.http.HttpHeaders;
 import org.junit.BeforeClass;
-import org.junit.Ignore;
 import org.junit.Test;
 
 import com.fasterxml.jackson.databind.JsonNode;
@@ -32,6 +31,32 @@
     public void testGetMatchInfoPublicCorpus () {
 
         ClientResponse response = resource().path(getAPIVersion())
+                .path("corpus").path("GOE").path("AGA").path("01784")
+                .path("p36-100").path("matchInfo")
+                .queryParam("foundry", "*")
+                .get(ClientResponse.class);
+
+        assertEquals(ClientResponse.Status.OK.getStatusCode(),
+                response.getStatus());
+        String entity = response.getEntity(String.class);
+        JsonNode node = JsonUtils.readTree(entity);
+        
+        assertNotNull(node);
+        assertEquals("GOE/AGA/01784", node.at("/textSigle").asText());
+        assertEquals("Belagerung von Mainz",
+                node.at("/title").asText());
+        assertEquals("Goethe, Johann Wolfgang von",
+                node.at("/author").asText());
+        assertTrue(node.at("/snippet").asText()
+                .startsWith("<span class=\"context-left\"></span>"
+                        + "<span class=\"match\">"
+					));
+    }
+    
+    @Test
+    public void testGetMatchInfoNotAllowed () {
+
+        ClientResponse response = resource().path(getAPIVersion())
                 .path("corpus").path("GOE").path("AGI").path("04846")
                 .path("p36875-36876").path("matchInfo")
                 .queryParam("foundry", "*")
@@ -41,6 +66,29 @@
                 response.getStatus());
         String entity = response.getEntity(String.class);
         JsonNode node = JsonUtils.readTree(entity);
+        
+        assertEquals("1003", node.at("/errors/0/0").asText());
+        assertEquals("Retrieving match info with ID "
+        		+ "match-GOE/AGI/04846-p36875-36876 is not allowed.", 
+        		node.at("/errors/0/1").asText());
+    }
+
+    @Test
+    public void testGetMatchInfoWithAuthentication () {
+        ClientResponse response = resource().path(getAPIVersion())
+                .path("corpus").path("GOE").path("AGI").path("04846")
+                .path("p36875-36876").path("matchInfo")
+                .queryParam("foundry", "*")
+                .header(Attributes.AUTHORIZATION,
+                        BasicHttpAuth.encode("kustvakt", "kustvakt2015"))
+                .header(HttpHeaders.X_FORWARDED_FOR, "172.27.0.32")
+                .get(ClientResponse.class);
+
+        String entity = response.getEntity(String.class);
+        assertEquals(ClientResponse.Status.OK.getStatusCode(),
+                response.getStatus());
+        
+        JsonNode node = JsonUtils.readTree(entity);
         assertNotNull(node);
         assertEquals("GOE/AGI/04846", node.at("/textSigle").asText());
         assertEquals("Zweiter römischer Aufenthalt",
@@ -53,34 +101,7 @@
                 .startsWith("<span class=\"context-left\"></span>"
                         + "<span class=\"match\">"
 					));
-    }
-
-    // EM: Cannot be tested yet
-    @Test
-    @Ignore
-    public void testGetMatchInfoWithAuthentication () {
-        ClientResponse response = resource().path(getAPIVersion())
-                .path("corpus").path("WPD15").path("B07").path("51608")
-                .path("p46-57").path("matchInfo")
-                .queryParam("foundry", "*")
-                .header(Attributes.AUTHORIZATION,
-                        BasicHttpAuth.encode("kustvakt", "kustvakt2015"))
-                .header(HttpHeaders.X_FORWARDED_FOR, "172.27.0.32")
-                .get(ClientResponse.class);
-
-        String entity = response.getEntity(String.class);
-//        System.out.println(entity);
-        assertEquals(ClientResponse.Status.OK.getStatusCode(),
-                response.getStatus());
-        
-        JsonNode node = JsonUtils.readTree(entity);
-        assertNotNull(node);
-        assertEquals("WPD15/B07/51608", node.at("/textSigle").asText());
-        assertEquals("Betty Allen",
-                node.at("/title").asText());
-        assertEquals("Monsieurbecker, u.a.",
-                node.at("/author").asText());
-        assertTrue(!node.at("/snippet").asText().isEmpty());
+        assertEquals("QAO-NC-LOC:ids", node.at("/availability").asText());
     }
 //    @Test
 //    public void testMatchInfoSave () {
diff --git a/src/test/java/de/ids_mannheim/korap/web/service/full/SearchServiceTest.java b/src/test/java/de/ids_mannheim/korap/web/service/full/SearchServiceTest.java
index be69d6e..b4f90bb 100644
--- a/src/test/java/de/ids_mannheim/korap/web/service/full/SearchServiceTest.java
+++ b/src/test/java/de/ids_mannheim/korap/web/service/full/SearchServiceTest.java
@@ -8,8 +8,8 @@
 import java.util.Iterator;
 import java.util.Set;
 
+import org.eclipse.jetty.http.HttpHeaders;
 import org.junit.BeforeClass;
-import org.junit.Ignore;
 import org.junit.Test;
 
 import com.fasterxml.jackson.databind.JsonNode;
@@ -47,7 +47,6 @@
                 "de.ids_mannheim.korap.web.utils");
     }
 
-    // FIX ME: asserts
     @Test
     public void testSearchQueryPublicCorpora () {
         ClientResponse response = resource().path(getAPIVersion())
@@ -61,12 +60,8 @@
         assertEquals("koral:doc", node.at("/collection/@type").asText());
         assertEquals("availability", node.at("/collection/key").asText());
         assertEquals("CC-BY.*", node.at("/collection/value").asText());
-//        assertEquals("koral:docGroup", node.at("/collection/@type").asText());
-//        assertEquals("operation:or", node.at("/collection/operation").asText());
-//        assertNotEquals(0, node.at("/collection/operands").size());
-//        assertEquals("corpusSigle([GOE, WPD13])",
-//                node.at("/collection/rewrites/0/scope").asText());
-//        assertEquals(6218, node.at("/meta/totalResults").asInt());
+        assertEquals("availability(\"CC-BY.*\")",
+                node.at("/collection/rewrites/0/scope").asText());
     }
 
 
@@ -92,7 +87,6 @@
         assertEquals(-1,node.at("/meta/totalResults").asInt());
     }
 
-    // FIX ME: asserts
     @Test
     public void testSearchQueryAuthorized () {
         ClientResponse response = resource().path(getAPIVersion())
@@ -100,18 +94,45 @@
                 .queryParam("ql", "poliqarp")
                 .header(Attributes.AUTHORIZATION,
                         BasicHttpAuth.encode("kustvakt", "kustvakt2015"))
+                .header(HttpHeaders.X_FORWARDED_FOR, "149.27.0.32")
                 .get(ClientResponse.class);
         assertEquals(ClientResponse.Status.OK.getStatusCode(),
                 response.getStatus());
         String entity = response.getEntity(String.class);
         JsonNode node = JsonUtils.readTree(entity);
         assertNotNull(node);
-//        assertNotEquals(0, node.path("matches").size());
-//        assertEquals("corpusSigle([GOE, WPD13, WPD15, BRZ10])",
-//                node.at("/collection/rewrites/0/scope").asText());
-//        assertEquals(7665, node.at("/meta/totalResults").asInt());
+        assertNotEquals(0, node.path("matches").size());
+        assertEquals("koral:docGroup", node.at("/collection/@type").asText());
+        assertEquals("CC-BY.*", node.at("/collection/operands/0/value").asText());
+        assertEquals("ACA.*", node.at("/collection/operands/1/value").asText());
+        assertEquals("operation:or", node.at("/collection/operation").asText());
+        assertEquals("availability()",
+                node.at("/collection/rewrites/0/scope").asText());
     }
 
+    @Test
+    public void testSearchQueryAuthorizedALL () {
+        ClientResponse response = resource().path(getAPIVersion())
+                .path("search").queryParam("q", "[orth=die]")
+                .queryParam("ql", "poliqarp")
+                .header(Attributes.AUTHORIZATION,
+                        BasicHttpAuth.encode("kustvakt", "kustvakt2015"))
+                .header(HttpHeaders.X_FORWARDED_FOR, "172.27.0.32")
+                .get(ClientResponse.class);
+        assertEquals(ClientResponse.Status.OK.getStatusCode(),
+                response.getStatus());
+        String entity = response.getEntity(String.class);
+        JsonNode node = JsonUtils.readTree(entity);
+        assertNotNull(node);
+        assertNotEquals(0, node.path("matches").size());
+        assertEquals("koral:docGroup", node.at("/collection/@type").asText());
+        assertEquals("QAO.*", node.at("/collection/operands/0/value").asText());
+        assertEquals("ACA.*", node.at("/collection/operands/1/operands/0/value").asText());
+        assertEquals("CC-BY.*", node.at("/collection/operands/1/operands/1/value").asText());
+        assertEquals("operation:or", node.at("/collection/operation").asText());
+        assertEquals("availability()",
+                node.at("/collection/rewrites/0/scope").asText());
+    }
 
     @Test
     public void testSearchQueryWithCollectionQueryAuthorized () {