diff --git a/full/Changes b/full/Changes
index 4c99586..8a401af 100644
--- a/full/Changes
+++ b/full/Changes
@@ -1,10 +1,12 @@
 version 0.60.4
-18/06/2018
+19/06/2018
     - implemented OAuth2 authorization code request with OpenID Authentication (margaretha)
     - enabled OAuth2 authorization without OpenID authentication using Nimbus library (margaretha)
     - implemented response handler for OpenID authentication errors in authorization requests (margaretha)
     - added tests regarding OpenID authentication in authorization requests (margaretha)
     - implemented OAuth2 authorization error response via redirect URI instead of JSON (margaretha)
+    - added state to OAuth2 authorization error response (margaretha)
+    - implemented OpenID token service for authorization code flow (margaretha)
     
 version 0.60.3
 06/06/2018
diff --git a/full/src/main/java/de/ids_mannheim/korap/oauth2/ClientDeregistrationValidator.java b/full/src/main/java/de/ids_mannheim/korap/oauth2/oltu/ClientDeregistrationValidator.java
similarity index 94%
rename from full/src/main/java/de/ids_mannheim/korap/oauth2/ClientDeregistrationValidator.java
rename to full/src/main/java/de/ids_mannheim/korap/oauth2/oltu/ClientDeregistrationValidator.java
index 422b346..72be70d 100644
--- a/full/src/main/java/de/ids_mannheim/korap/oauth2/ClientDeregistrationValidator.java
+++ b/full/src/main/java/de/ids_mannheim/korap/oauth2/oltu/ClientDeregistrationValidator.java
@@ -1,4 +1,4 @@
-package de.ids_mannheim.korap.oauth2;
+package de.ids_mannheim.korap.oauth2.oltu;
 
 import javax.servlet.http.HttpServletRequest;
 
diff --git a/full/src/main/java/de/ids_mannheim/korap/oauth2/OAuth2AuthorizationRequest.java b/full/src/main/java/de/ids_mannheim/korap/oauth2/oltu/OAuth2AuthorizationRequest.java
similarity index 95%
rename from full/src/main/java/de/ids_mannheim/korap/oauth2/OAuth2AuthorizationRequest.java
rename to full/src/main/java/de/ids_mannheim/korap/oauth2/oltu/OAuth2AuthorizationRequest.java
index a5d9add..503a5c8 100644
--- a/full/src/main/java/de/ids_mannheim/korap/oauth2/OAuth2AuthorizationRequest.java
+++ b/full/src/main/java/de/ids_mannheim/korap/oauth2/oltu/OAuth2AuthorizationRequest.java
@@ -1,4 +1,4 @@
-package de.ids_mannheim.korap.oauth2;
+package de.ids_mannheim.korap.oauth2.oltu;
 
 import javax.servlet.http.HttpServletRequest;
 
diff --git a/full/src/main/java/de/ids_mannheim/korap/oauth2/OAuth2DeregisterClientRequest.java b/full/src/main/java/de/ids_mannheim/korap/oauth2/oltu/OAuth2DeregisterClientRequest.java
similarity index 95%
rename from full/src/main/java/de/ids_mannheim/korap/oauth2/OAuth2DeregisterClientRequest.java
rename to full/src/main/java/de/ids_mannheim/korap/oauth2/oltu/OAuth2DeregisterClientRequest.java
index ecc2bc0..3da0c02 100644
--- a/full/src/main/java/de/ids_mannheim/korap/oauth2/OAuth2DeregisterClientRequest.java
+++ b/full/src/main/java/de/ids_mannheim/korap/oauth2/oltu/OAuth2DeregisterClientRequest.java
@@ -1,4 +1,4 @@
-package de.ids_mannheim.korap.oauth2;
+package de.ids_mannheim.korap.oauth2.oltu;
 
 import javax.servlet.http.HttpServletRequest;
 
diff --git a/full/src/main/java/de/ids_mannheim/korap/oauth2/oltu/service/OltuTokenService.java b/full/src/main/java/de/ids_mannheim/korap/oauth2/oltu/service/OltuTokenService.java
new file mode 100644
index 0000000..0df9a3c
--- /dev/null
+++ b/full/src/main/java/de/ids_mannheim/korap/oauth2/oltu/service/OltuTokenService.java
@@ -0,0 +1,116 @@
+package de.ids_mannheim.korap.oauth2.oltu.service;
+
+import java.util.Set;
+
+import javax.ws.rs.core.Response.Status;
+
+import org.apache.oltu.oauth2.as.issuer.OAuthIssuer;
+import org.apache.oltu.oauth2.as.request.AbstractOAuthTokenRequest;
+import org.apache.oltu.oauth2.as.response.OAuthASResponse;
+import org.apache.oltu.oauth2.common.exception.OAuthSystemException;
+import org.apache.oltu.oauth2.common.message.OAuthResponse;
+import org.apache.oltu.oauth2.common.message.types.GrantType;
+import org.apache.oltu.oauth2.common.message.types.TokenType;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.stereotype.Service;
+
+import de.ids_mannheim.korap.exceptions.KustvaktException;
+import de.ids_mannheim.korap.exceptions.StatusCodes;
+import de.ids_mannheim.korap.oauth2.constant.OAuth2Error;
+import de.ids_mannheim.korap.oauth2.dao.AccessTokenDao;
+import de.ids_mannheim.korap.oauth2.entity.AccessScope;
+import de.ids_mannheim.korap.oauth2.entity.Authorization;
+import de.ids_mannheim.korap.oauth2.service.OAuth2TokenService;
+
+@Service
+public class OltuTokenService extends OAuth2TokenService {
+
+    @Autowired
+    private OAuthIssuer oauthIssuer;
+
+    @Autowired
+    private AccessTokenDao tokenDao;
+
+    public OAuthResponse requestAccessToken (
+            AbstractOAuthTokenRequest oAuthRequest)
+            throws KustvaktException, OAuthSystemException {
+
+        String grantType = oAuthRequest.getGrantType();
+
+        if (grantType.equals(GrantType.AUTHORIZATION_CODE.toString())) {
+            Authorization authorization =
+                    requestAccessTokenWithAuthorizationCode(
+                            oAuthRequest.getCode(),
+                            oAuthRequest.getRedirectURI(),
+                            oAuthRequest.getClientId(),
+                            oAuthRequest.getClientSecret());
+            return createsAccessTokenResponse(authorization);
+        }
+        else if (grantType.equals(GrantType.PASSWORD.toString())) {
+            requestAccessTokenWithPassword(oAuthRequest.getUsername(),
+                    oAuthRequest.getPassword(), oAuthRequest.getScopes(),
+                    oAuthRequest.getClientId(), oAuthRequest.getClientSecret());
+            return createsAccessTokenResponse(oAuthRequest.getScopes(),
+                    oAuthRequest.getUsername());
+        }
+        else if (grantType.equals(GrantType.CLIENT_CREDENTIALS.toString())) {
+             Set<String> scopes = requestAccessTokenWithClientCredentials(
+                    oAuthRequest.getClientId(), oAuthRequest.getClientSecret(),
+                    oAuthRequest.getScopes());
+            return createsAccessTokenResponse(scopes, null);
+        }
+        else {
+            throw new KustvaktException(StatusCodes.UNSUPPORTED_GRANT_TYPE,
+                    grantType + " is not supported.",
+                    OAuth2Error.UNSUPPORTED_GRANT_TYPE);
+        }
+
+    }
+
+    /**
+     * Creates an OAuthResponse containing an access token and a
+     * refresh token with type Bearer.
+     * 
+     * @return an OAuthResponse containing an access token
+     * @throws OAuthSystemException
+     * @throws KustvaktException
+     */
+    private OAuthResponse createsAccessTokenResponse (Set<String> scopes,
+            String userId) throws OAuthSystemException, KustvaktException {
+
+        String accessToken = oauthIssuer.accessToken();
+        // String refreshToken = oauthIssuer.refreshToken();
+
+        Set<AccessScope> accessScopes =
+                scopeService.convertToAccessScope(scopes);
+        tokenDao.storeAccessToken(accessToken, accessScopes, userId);
+
+        return OAuthASResponse.tokenResponse(Status.OK.getStatusCode())
+                .setAccessToken(accessToken)
+                .setTokenType(TokenType.BEARER.toString())
+                .setExpiresIn(String.valueOf(config.getTokenTTL()))
+                // .setRefreshToken(refreshToken)
+                .setScope(String.join(" ", scopes)).buildJSONMessage();
+    }
+
+    private OAuthResponse createsAccessTokenResponse (
+            Authorization authorization)
+            throws OAuthSystemException, KustvaktException {
+        String accessToken = oauthIssuer.accessToken();
+        // String refreshToken = oauthIssuer.refreshToken();
+
+        tokenDao.storeAccessToken(authorization, accessToken);
+
+        String scopes = scopeService
+                .convertAccessScopesToString(authorization.getScopes());
+
+        OAuthResponse r =
+                OAuthASResponse.tokenResponse(Status.OK.getStatusCode())
+                        .setAccessToken(accessToken)
+                        .setTokenType(TokenType.BEARER.toString())
+                        .setExpiresIn(String.valueOf(config.getTokenTTL()))
+                        // .setRefreshToken(refreshToken)
+                        .setScope(scopes).buildJSONMessage();
+        return r;
+    }
+}
diff --git a/full/src/main/java/de/ids_mannheim/korap/oauth2/openid/OpenIdHttpRequestWrapper.java b/full/src/main/java/de/ids_mannheim/korap/oauth2/openid/OpenIdHttpRequestWrapper.java
new file mode 100644
index 0000000..8f6d80b
--- /dev/null
+++ b/full/src/main/java/de/ids_mannheim/korap/oauth2/openid/OpenIdHttpRequestWrapper.java
@@ -0,0 +1,38 @@
+package de.ids_mannheim.korap.oauth2.openid;
+
+import java.net.URL;
+import java.util.Enumeration;
+import java.util.Map;
+
+import javax.servlet.http.HttpServletRequest;
+
+import com.nimbusds.oauth2.sdk.ParseException;
+import com.nimbusds.oauth2.sdk.http.HTTPRequest;
+
+public class OpenIdHttpRequestWrapper extends HTTPRequest {
+
+    private Map<String, String> params;
+
+    public OpenIdHttpRequestWrapper (Method method, URL url) {
+        super(method, url);
+    }
+
+    @Override
+    public Map<String, String> getQueryParameters () {
+        return this.params;
+    }
+
+    public void toHttpRequest (HttpServletRequest servletRequest,
+            Map<String, String> map) throws ParseException {
+
+        this.params = map;
+        this.setClientIPAddress(servletRequest.getRemoteAddr());
+        this.setContentType(servletRequest.getContentType());
+
+        Enumeration<String> headerNames = servletRequest.getHeaderNames();
+        while (headerNames.hasMoreElements()) {
+            String name = headerNames.nextElement().toString();
+            this.setHeader(name, servletRequest.getHeader(name));
+        }
+    }
+}
diff --git a/full/src/main/java/de/ids_mannheim/korap/oauth2/openid/service/OpenIdTokenService.java b/full/src/main/java/de/ids_mannheim/korap/oauth2/openid/service/OpenIdTokenService.java
new file mode 100644
index 0000000..8ce9b16
--- /dev/null
+++ b/full/src/main/java/de/ids_mannheim/korap/oauth2/openid/service/OpenIdTokenService.java
@@ -0,0 +1,125 @@
+package de.ids_mannheim.korap.oauth2.openid.service;
+
+import java.net.URI;
+import java.util.Set;
+
+import org.springframework.stereotype.Service;
+
+import com.nimbusds.oauth2.sdk.AccessTokenResponse;
+import com.nimbusds.oauth2.sdk.AuthorizationCodeGrant;
+import com.nimbusds.oauth2.sdk.AuthorizationGrant;
+import com.nimbusds.oauth2.sdk.GrantType;
+import com.nimbusds.oauth2.sdk.Scope;
+import com.nimbusds.oauth2.sdk.TokenRequest;
+import com.nimbusds.oauth2.sdk.auth.ClientAuthentication;
+import com.nimbusds.oauth2.sdk.auth.ClientAuthenticationMethod;
+import com.nimbusds.oauth2.sdk.auth.ClientSecretBasic;
+import com.nimbusds.oauth2.sdk.auth.ClientSecretPost;
+import com.nimbusds.oauth2.sdk.token.AccessToken;
+import com.nimbusds.oauth2.sdk.token.BearerAccessToken;
+import com.nimbusds.oauth2.sdk.token.RefreshToken;
+import com.nimbusds.oauth2.sdk.token.Tokens;
+import com.nimbusds.openid.connect.sdk.OIDCTokenResponse;
+import com.nimbusds.openid.connect.sdk.token.OIDCTokens;
+
+import de.ids_mannheim.korap.exceptions.KustvaktException;
+import de.ids_mannheim.korap.exceptions.StatusCodes;
+import de.ids_mannheim.korap.oauth2.constant.OAuth2Error;
+import de.ids_mannheim.korap.oauth2.entity.AccessScope;
+import de.ids_mannheim.korap.oauth2.entity.Authorization;
+import de.ids_mannheim.korap.oauth2.service.OAuth2TokenService;
+
+@Service
+public class OpenIdTokenService extends OAuth2TokenService {
+
+    public AccessTokenResponse requestAccessToken (TokenRequest tokenRequest)
+            throws KustvaktException {
+        AuthorizationGrant grant = tokenRequest.getAuthorizationGrant();
+        GrantType grantType = grant.getType();
+        ClientAuthentication clientAuthentication =
+                tokenRequest.getClientAuthentication();
+        String[] clientCredentials =
+                extractClientCredentials(clientAuthentication);
+
+        if (grantType.equals(GrantType.AUTHORIZATION_CODE)) {
+            AuthorizationCodeGrant codeGrant = (AuthorizationCodeGrant) grant;
+            String authorizationCode =
+                    codeGrant.getAuthorizationCode().getValue();
+            URI redirectionURI = codeGrant.getRedirectionURI();
+            String redirectURI = null;
+            if (redirectionURI != null) {
+                redirectURI = redirectionURI.toString();
+            }
+            Authorization authorization =
+                    requestAccessTokenWithAuthorizationCode(authorizationCode,
+                            redirectURI, clientCredentials[0],
+                            clientCredentials[1]);
+            return createsAccessTokenResponse(authorization);
+        }
+        else if (grantType.equals(GrantType.PASSWORD)) {
+
+        }
+        else if (grantType.equals(GrantType.CLIENT_CREDENTIALS)) {
+
+        }
+        else {
+            throw new KustvaktException(StatusCodes.UNSUPPORTED_GRANT_TYPE,
+                    grantType + " is not supported.",
+                    OAuth2Error.UNSUPPORTED_GRANT_TYPE);
+        }
+        return null;
+    }
+
+
+    private AccessTokenResponse createsAccessTokenResponse (
+            Authorization authorization) {
+        Set<AccessScope> scopes = authorization.getScopes();
+        String[] scopeArray = scopes.stream().map(scope -> scope.toString())
+                .toArray(String[]::new);
+        Scope scope = new Scope(scopeArray);
+        AccessToken accessToken =
+                new BearerAccessToken(config.getTokenTTL(), scope);
+        RefreshToken refreshToken = new RefreshToken();
+
+        if (scope.contains("openid")) {
+            // id token should be encrypted according to keys and
+            // algorithms the client specified during registration
+            String idToken = "thisIsIdToken";
+            OIDCTokens tokens =
+                    new OIDCTokens(idToken, accessToken, refreshToken);
+            return new OIDCTokenResponse(tokens);
+        }
+        else {
+            Tokens tokens = new Tokens(accessToken, refreshToken);
+            return new AccessTokenResponse(tokens);
+        }
+    }
+
+
+    private String[] extractClientCredentials (
+            ClientAuthentication clientAuthentication)
+            throws KustvaktException {
+
+        ClientAuthenticationMethod method = clientAuthentication.getMethod();
+        String clientSecret;
+        String clientId;
+        if (method.equals(ClientAuthenticationMethod.CLIENT_SECRET_BASIC)) {
+            ClientSecretBasic basic = (ClientSecretBasic) clientAuthentication;
+            clientSecret = basic.getClientSecret().getValue();
+            clientId = basic.getClientID().getValue();
+        }
+        else if (method.equals(ClientAuthenticationMethod.CLIENT_SECRET_POST)) {
+            ClientSecretPost post = (ClientSecretPost) clientAuthentication;
+            clientSecret = post.getClientSecret().getValue();
+            clientId = post.getClientID().getValue();
+        }
+        else {
+            // client authentication method is not supported
+            throw new KustvaktException(
+                    StatusCodes.UNSUPPORTED_AUTHENTICATION_METHOD,
+                    method.getValue() + " is not supported.",
+                    OAuth2Error.INVALID_CLIENT);
+        }
+        return new String[] { clientId, clientSecret };
+    }
+}
diff --git a/full/src/main/java/de/ids_mannheim/korap/oauth2/service/OAuth2AuthorizationService.java b/full/src/main/java/de/ids_mannheim/korap/oauth2/service/OAuth2AuthorizationService.java
index 6bb584f..b103e33 100644
--- a/full/src/main/java/de/ids_mannheim/korap/oauth2/service/OAuth2AuthorizationService.java
+++ b/full/src/main/java/de/ids_mannheim/korap/oauth2/service/OAuth2AuthorizationService.java
@@ -152,8 +152,12 @@
         }
 
         String authorizedUri = authorization.getRedirectURI();
-        if (authorizedUri != null && !authorizedUri.isEmpty()
-                && !authorizedUri.equals(redirectURI)) {
+        if (authorizedUri != null && !authorizedUri.isEmpty()) {
+            if (!authorizedUri.equals(redirectURI))
+                throw new KustvaktException(StatusCodes.INVALID_REDIRECT_URI,
+                        "Invalid redirect URI", OAuth2Error.INVALID_GRANT);
+        }
+        else if (redirectURI != null && !redirectURI.isEmpty()) {
             throw new KustvaktException(StatusCodes.INVALID_REDIRECT_URI,
                     "Invalid redirect URI", OAuth2Error.INVALID_GRANT);
         }
diff --git a/full/src/main/java/de/ids_mannheim/korap/oauth2/service/OAuth2ScopeService.java b/full/src/main/java/de/ids_mannheim/korap/oauth2/service/OAuth2ScopeService.java
index 15b51e3..f47fa3c 100644
--- a/full/src/main/java/de/ids_mannheim/korap/oauth2/service/OAuth2ScopeService.java
+++ b/full/src/main/java/de/ids_mannheim/korap/oauth2/service/OAuth2ScopeService.java
@@ -50,9 +50,14 @@
     }
 
     public String convertAccessScopesToString (Set<AccessScope> scopes) {
+        Set<String> set = convertAccessScopesToStringSet(scopes);
+        return String.join(" ", set);
+    }
+    
+    public Set<String> convertAccessScopesToStringSet (Set<AccessScope> scopes) {
         Set<String> set = scopes.stream().map(scope -> scope.toString())
                 .collect(Collectors.toSet());
-        return String.join(" ", set);
+        return set;
     }
 
     /**
diff --git a/full/src/main/java/de/ids_mannheim/korap/oauth2/service/OAuth2TokenService.java b/full/src/main/java/de/ids_mannheim/korap/oauth2/service/OAuth2TokenService.java
index e6609d4..c64274d 100644
--- a/full/src/main/java/de/ids_mannheim/korap/oauth2/service/OAuth2TokenService.java
+++ b/full/src/main/java/de/ids_mannheim/korap/oauth2/service/OAuth2TokenService.java
@@ -4,15 +4,6 @@
 import java.util.Map;
 import java.util.Set;
 
-import javax.ws.rs.core.Response.Status;
-
-import org.apache.oltu.oauth2.as.issuer.OAuthIssuer;
-import org.apache.oltu.oauth2.as.request.AbstractOAuthTokenRequest;
-import org.apache.oltu.oauth2.as.response.OAuthASResponse;
-import org.apache.oltu.oauth2.common.exception.OAuthSystemException;
-import org.apache.oltu.oauth2.common.message.OAuthResponse;
-import org.apache.oltu.oauth2.common.message.types.GrantType;
-import org.apache.oltu.oauth2.common.message.types.TokenType;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.stereotype.Service;
 
@@ -22,8 +13,6 @@
 import de.ids_mannheim.korap.exceptions.StatusCodes;
 import de.ids_mannheim.korap.interfaces.AuthenticationManagerIface;
 import de.ids_mannheim.korap.oauth2.constant.OAuth2Error;
-import de.ids_mannheim.korap.oauth2.dao.AccessTokenDao;
-import de.ids_mannheim.korap.oauth2.entity.AccessScope;
 import de.ids_mannheim.korap.oauth2.entity.Authorization;
 import de.ids_mannheim.korap.oauth2.entity.OAuth2Client;
 
@@ -39,50 +28,17 @@
 
     @Autowired
     private OAuth2ClientService clientService;
-    
+
     @Autowired
     private OAuth2AuthorizationService authorizationService;
-    
-    @Autowired
-    private OAuth2ScopeService scopeService;
-    @Autowired
-    private AccessTokenDao tokenDao;
 
     @Autowired
-    private FullConfiguration config;
+    protected OAuth2ScopeService scopeService;
+
+    @Autowired
+    protected FullConfiguration config;
     @Autowired
     private AuthenticationManagerIface authenticationManager;
-    @Autowired
-    private OAuthIssuer oauthIssuer;
-
-    public OAuthResponse requestAccessToken (
-            AbstractOAuthTokenRequest oAuthRequest)
-            throws KustvaktException, OAuthSystemException {
-
-        String grantType = oAuthRequest.getGrantType();
-
-        if (grantType.equals(GrantType.AUTHORIZATION_CODE.toString())) {
-            return requestAccessTokenWithAuthorizationCode(
-                    oAuthRequest.getCode(), oAuthRequest.getRedirectURI(),
-                    oAuthRequest.getClientId(), oAuthRequest.getClientSecret());
-        }
-        else if (grantType.equals(GrantType.PASSWORD.toString())) {
-            return requestAccessTokenWithPassword(oAuthRequest.getUsername(),
-                    oAuthRequest.getPassword(), oAuthRequest.getScopes(),
-                    oAuthRequest.getClientId(), oAuthRequest.getClientSecret());
-        }
-        else if (grantType.equals(GrantType.CLIENT_CREDENTIALS.toString())) {
-            return requestAccessTokenWithClientCredentials(
-                    oAuthRequest.getClientId(), oAuthRequest.getClientSecret(),
-                    oAuthRequest.getScopes());
-        }
-        else {
-            throw new KustvaktException(StatusCodes.UNSUPPORTED_GRANT_TYPE,
-                    grantType + " is not supported.",
-                    OAuth2Error.UNSUPPORTED_GRANT_TYPE);
-        }
-
-    }
 
     /**
      * RFC 6749:
@@ -98,15 +54,13 @@
      * @param clientSecret
      *            clilent_secret, required if client_secret was issued
      *            for the client in client registration.
-     * @return an OAuthResponse containing an access token if
-     *         successful
+     * @return an authorization
      * @throws OAuthSystemException
      * @throws KustvaktException
      */
-    private OAuthResponse requestAccessTokenWithAuthorizationCode (
+    protected Authorization requestAccessTokenWithAuthorizationCode (
             String authorizationCode, String redirectURI, String clientId,
-            String clientSecret)
-            throws KustvaktException, OAuthSystemException {
+            String clientSecret) throws KustvaktException {
 
         Authorization authorization =
                 authorizationService.retrieveAuthorization(authorizationCode);
@@ -119,7 +73,7 @@
             authorizationService.addTotalAttempts(authorization);
             throw e;
         }
-        return createsAccessTokenResponse(authorization);
+        return authorization;
     }
 
 
@@ -152,10 +106,9 @@
      * @throws KustvaktException
      * @throws OAuthSystemException
      */
-    private OAuthResponse requestAccessTokenWithPassword (String username,
+    protected void requestAccessTokenWithPassword (String username,
             String password, Set<String> scopes, String clientId,
-            String clientSecret)
-            throws KustvaktException, OAuthSystemException {
+            String clientSecret) throws KustvaktException {
 
         OAuth2Client client =
                 clientService.authenticateClient(clientId, clientSecret);
@@ -167,7 +120,6 @@
 
         authenticateUser(username, password, scopes);
         // verify or limit scopes ?
-        return createsAccessTokenResponse(scopes, username);
     }
 
     public void authenticateUser (String username, String password,
@@ -204,9 +156,9 @@
      * @throws KustvaktException
      * @throws OAuthSystemException
      */
-    private OAuthResponse requestAccessTokenWithClientCredentials (
+    protected Set<String> requestAccessTokenWithClientCredentials (
             String clientId, String clientSecret, Set<String> scopes)
-            throws KustvaktException, OAuthSystemException {
+            throws KustvaktException {
 
         if (clientSecret == null || clientSecret.isEmpty()) {
             throw new KustvaktException(
@@ -228,54 +180,9 @@
 
         scopes = scopeService.filterScopes(scopes,
                 config.getClientCredentialsScopes());
-        return createsAccessTokenResponse(scopes, null);
+        return scopes;
     }
 
-    /**
-     * Creates an OAuthResponse containing an access token and a
-     * refresh token with type Bearer.
-     * 
-     * @return an OAuthResponse containing an access token
-     * @throws OAuthSystemException
-     * @throws KustvaktException
-     */
 
-    private OAuthResponse createsAccessTokenResponse (Set<String> scopes,
-            String userId) throws OAuthSystemException, KustvaktException {
 
-        String accessToken = oauthIssuer.accessToken();
-        // String refreshToken = oauthIssuer.refreshToken();
-
-        Set<AccessScope> accessScopes =
-                scopeService.convertToAccessScope(scopes);
-        tokenDao.storeAccessToken(accessToken, accessScopes, userId);
-
-        return OAuthASResponse.tokenResponse(Status.OK.getStatusCode())
-                .setAccessToken(accessToken)
-                .setTokenType(TokenType.BEARER.toString())
-                .setExpiresIn(String.valueOf(config.getTokenTTL()))
-                // .setRefreshToken(refreshToken)
-                .setScope(String.join(" ", scopes)).buildJSONMessage();
-    }
-
-    private OAuthResponse createsAccessTokenResponse (
-            Authorization authorization)
-            throws OAuthSystemException, KustvaktException {
-        String accessToken = oauthIssuer.accessToken();
-        // String refreshToken = oauthIssuer.refreshToken();
-
-        tokenDao.storeAccessToken(authorization, accessToken);
-
-        String scopes = scopeService
-                .convertAccessScopesToString(authorization.getScopes());
-
-        OAuthResponse r =
-                OAuthASResponse.tokenResponse(Status.OK.getStatusCode())
-                        .setAccessToken(accessToken)
-                        .setTokenType(TokenType.BEARER.toString())
-                        .setExpiresIn(String.valueOf(config.getTokenTTL()))
-                        // .setRefreshToken(refreshToken)
-                        .setScope(scopes).buildJSONMessage();
-        return r;
-    }
 }
diff --git a/full/src/main/java/de/ids_mannheim/korap/web/OAuth2ResponseHandler.java b/full/src/main/java/de/ids_mannheim/korap/web/OAuth2ResponseHandler.java
index d244e90..959803c 100644
--- a/full/src/main/java/de/ids_mannheim/korap/web/OAuth2ResponseHandler.java
+++ b/full/src/main/java/de/ids_mannheim/korap/web/OAuth2ResponseHandler.java
@@ -46,21 +46,44 @@
         return throwit(StatusCodes.OAUTH2_SYSTEM_ERROR, e.getMessage());
     }
 
+    public WebApplicationException throwit (OAuthSystemException e,
+            String state) {
+        if (state != null && !state.isEmpty()) {
+            return throwit(StatusCodes.OAUTH2_SYSTEM_ERROR, e.getMessage(),
+                    "state=" + state);
+        }
+        return throwit(e);
+    }
+
     public WebApplicationException throwit (OAuthProblemException e) {
+        return throwit(e, null);
+    }
+
+    public WebApplicationException throwit (OAuthProblemException e,
+            String state) {
         OAuthResponse oAuthResponse = null;
         try {
-            oAuthResponse = OAuthResponse.errorResponse(e.getResponseStatus())
-                    .error(e).buildJSONMessage();
+             OAuthErrorResponseBuilder builder = OAuthResponse.errorResponse(e.getResponseStatus())
+                    .error(e);
+                    
+             if (state != null && !state.isEmpty()) {
+                 builder.setState(state);
+             }
+             oAuthResponse = builder.buildJSONMessage();
         }
         catch (OAuthSystemException e1) {
-            throwit(e1);
+            throwit(e1, state);
         }
         Response r = createResponse(oAuthResponse);
         return new WebApplicationException(r);
     }
 
     @Override
-    public WebApplicationException throwit (KustvaktException e) {
+    public WebApplicationException throwit (KustvaktException e){
+        return throwit(e, null);
+    }
+    
+    public WebApplicationException throwit (KustvaktException e, String state) {
         OAuthResponse oAuthResponse = null;
         String errorCode = e.getEntity();
         try {
@@ -68,7 +91,7 @@
                     || errorCode.equals(OAuth2Error.UNAUTHORIZED_CLIENT)
                     || errorCode.equals(OAuth2Error.INVALID_TOKEN)) {
                 oAuthResponse = createOAuthResponse(e,
-                        Status.UNAUTHORIZED.getStatusCode());
+                        Status.UNAUTHORIZED.getStatusCode(), state);
             }
             else if (errorCode.equals(OAuth2Error.INVALID_GRANT)
                     || errorCode.equals(OAuth2Error.INVALID_REQUEST)
@@ -77,26 +100,26 @@
                     || errorCode.equals(OAuth2Error.UNSUPPORTED_RESPONSE_TYPE)
                     || errorCode.equals(OAuth2Error.ACCESS_DENIED)) {
                 oAuthResponse = createOAuthResponse(e,
-                        Status.BAD_REQUEST.getStatusCode());
+                        Status.BAD_REQUEST.getStatusCode(), state);
             }
             else if (errorCode.equals(OAuth2Error.INSUFFICIENT_SCOPE)) {
                 oAuthResponse = createOAuthResponse(e,
-                        Status.FORBIDDEN.getStatusCode());
+                        Status.FORBIDDEN.getStatusCode(), state);
             }
             else if (errorCode.equals(OAuth2Error.SERVER_ERROR)) {
                 oAuthResponse = createOAuthResponse(e,
-                        Status.INTERNAL_SERVER_ERROR.getStatusCode());
+                        Status.INTERNAL_SERVER_ERROR.getStatusCode(), state);
             }
             else if (errorCode.equals(OAuth2Error.TEMPORARILY_UNAVAILABLE)) {
                 oAuthResponse = createOAuthResponse(e,
-                        Status.SERVICE_UNAVAILABLE.getStatusCode());
+                        Status.SERVICE_UNAVAILABLE.getStatusCode(), state);
             }
             else {
                 return super.throwit(e);
             }
         }
         catch (OAuthSystemException e1) {
-            return throwit(e1);
+            return throwit(e1, state);
         }
 
         Response r = createResponse(oAuthResponse);
@@ -104,12 +127,16 @@
     }
 
     private OAuthResponse createOAuthResponse (KustvaktException e,
-            int statusCode) throws OAuthSystemException {
+            int statusCode, String state) throws OAuthSystemException {
         OAuthProblemException oAuthProblemException = OAuthProblemException
-                .error(e.getEntity()).description(e.getMessage());
+                .error(e.getEntity()).state(state).description(e.getMessage());
 
         OAuthErrorResponseBuilder responseBuilder = OAuthResponse
                 .errorResponse(statusCode).error(oAuthProblemException);
+        if (state!=null && !state.isEmpty()){
+            responseBuilder.setState(state);
+        }
+            
         URI redirectUri = e.getRedirectUri();
         if (redirectUri != null) {
             responseBuilder.location(redirectUri.toString());
diff --git a/full/src/main/java/de/ids_mannheim/korap/web/OpenIdResponseHandler.java b/full/src/main/java/de/ids_mannheim/korap/web/OpenIdResponseHandler.java
index 21cecdb..eb6a19e 100644
--- a/full/src/main/java/de/ids_mannheim/korap/web/OpenIdResponseHandler.java
+++ b/full/src/main/java/de/ids_mannheim/korap/web/OpenIdResponseHandler.java
@@ -7,13 +7,17 @@
 import javax.ws.rs.core.MediaType;
 import javax.ws.rs.core.Response;
 import javax.ws.rs.core.Response.ResponseBuilder;
+import javax.ws.rs.core.Response.Status;
 
+import org.apache.http.HttpHeaders;
 import org.springframework.stereotype.Service;
 
+import com.nimbusds.oauth2.sdk.AccessTokenResponse;
 import com.nimbusds.oauth2.sdk.AuthorizationErrorResponse;
 import com.nimbusds.oauth2.sdk.ErrorObject;
 import com.nimbusds.oauth2.sdk.ParseException;
 import com.nimbusds.oauth2.sdk.ResponseMode;
+import com.nimbusds.oauth2.sdk.TokenErrorResponse;
 import com.nimbusds.oauth2.sdk.id.State;
 import com.nimbusds.oauth2.sdk.token.BearerTokenError;
 import com.nimbusds.openid.connect.sdk.AuthenticationErrorResponse;
@@ -52,10 +56,12 @@
 
     final static Map<String, ErrorObject> tokenErrorObjectMap = new HashMap<>();
     {
-        errorObjectMap.put(OAuth2Error.INSUFFICIENT_SCOPE,
+        tokenErrorObjectMap.put(OAuth2Error.INSUFFICIENT_SCOPE,
                 BearerTokenError.INSUFFICIENT_SCOPE);
-        errorObjectMap.put(OAuth2Error.INVALID_TOKEN,
+        tokenErrorObjectMap.put(OAuth2Error.INVALID_TOKEN,
                 BearerTokenError.INVALID_TOKEN);
+        tokenErrorObjectMap.put(OAuth2Error.INVALID_REQUEST,
+                BearerTokenError.INVALID_REQUEST);
     }
 
     public OpenIdResponseHandler (AuditingIface iface) {
@@ -140,4 +146,71 @@
 
     }
 
+    public void createTokenErrorResponse (KustvaktException e) {
+
+        String errorCode = e.getEntity();
+        ErrorObject errorObject = tokenErrorObjectMap.get(errorCode);
+        if (errorObject == null) {
+            errorObject = errorObjectMap.get(errorCode);
+            if (errorObject == null) {
+                errorObject = new ErrorObject(e.getEntity(), e.getMessage());
+            }
+        }
+
+        TokenErrorResponse errorResponse = new TokenErrorResponse(errorObject);
+        Status status = determineErrorStatus(errorCode);
+        createResponse(errorResponse, status);
+    }
+
+    public Response createResponse (AccessTokenResponse tokenResponse,
+            Status status) {
+        String jsonString = tokenResponse.toJSONObject().toJSONString();
+        return createResponse(status, jsonString);
+    }
+    
+    public Response createResponse (TokenErrorResponse tokenResponse,
+            Status status) {
+        String jsonString = tokenResponse.toJSONObject().toJSONString();
+        return createResponse(status, jsonString);
+    }
+    
+    private Response createResponse(Status status, Object entity){
+        ResponseBuilder builder = Response.status(status);
+        builder.entity(entity);
+        builder.header(HttpHeaders.CACHE_CONTROL, "no-store");
+        builder.header(HttpHeaders.PRAGMA, "no-store");
+
+        if (status == Status.UNAUTHORIZED) {
+            builder.header(HttpHeaders.WWW_AUTHENTICATE,
+                    "Basic realm=\"Kustvakt\"");
+        }
+        return builder.build();
+    }
+
+    private Status determineErrorStatus (String errorCode) {
+        Status status = Status.BAD_REQUEST;
+        if (errorCode.equals(OAuth2Error.INVALID_CLIENT)
+                || errorCode.equals(OAuth2Error.UNAUTHORIZED_CLIENT)
+                || errorCode.equals(OAuth2Error.INVALID_TOKEN)) {
+            status = Status.UNAUTHORIZED;
+        }
+        else if (errorCode.equals(OAuth2Error.INVALID_GRANT)
+                || errorCode.equals(OAuth2Error.INVALID_REQUEST)
+                || errorCode.equals(OAuth2Error.INVALID_SCOPE)
+                || errorCode.equals(OAuth2Error.UNSUPPORTED_GRANT_TYPE)
+                || errorCode.equals(OAuth2Error.UNSUPPORTED_RESPONSE_TYPE)
+                || errorCode.equals(OAuth2Error.ACCESS_DENIED)) {
+            status = Status.BAD_REQUEST;
+        }
+        else if (errorCode.equals(OAuth2Error.INSUFFICIENT_SCOPE)) {
+            status = Status.FORBIDDEN;
+        }
+        else if (errorCode.equals(OAuth2Error.SERVER_ERROR)) {
+            status = Status.INTERNAL_SERVER_ERROR;
+        }
+        else if (errorCode.equals(OAuth2Error.TEMPORARILY_UNAVAILABLE)) {
+            status = Status.SERVICE_UNAVAILABLE;
+        }
+        return status;
+    }
 }
diff --git a/full/src/main/java/de/ids_mannheim/korap/web/controller/OAuth2Controller.java b/full/src/main/java/de/ids_mannheim/korap/web/controller/OAuth2Controller.java
index 6614f11..3726f17 100644
--- a/full/src/main/java/de/ids_mannheim/korap/web/controller/OAuth2Controller.java
+++ b/full/src/main/java/de/ids_mannheim/korap/web/controller/OAuth2Controller.java
@@ -25,9 +25,9 @@
 import com.sun.jersey.spi.container.ResourceFilters;
 
 import de.ids_mannheim.korap.exceptions.KustvaktException;
-import de.ids_mannheim.korap.oauth2.OAuth2AuthorizationRequest;
+import de.ids_mannheim.korap.oauth2.oltu.OAuth2AuthorizationRequest;
 import de.ids_mannheim.korap.oauth2.oltu.service.OltuAuthorizationService;
-import de.ids_mannheim.korap.oauth2.service.OAuth2TokenService;
+import de.ids_mannheim.korap.oauth2.oltu.service.OltuTokenService;
 import de.ids_mannheim.korap.security.context.TokenContext;
 import de.ids_mannheim.korap.web.OAuth2ResponseHandler;
 import de.ids_mannheim.korap.web.filter.AuthenticationFilter;
@@ -41,7 +41,7 @@
     @Autowired
     private OAuth2ResponseHandler responseHandler;
     @Autowired
-    private OAuth2TokenService oAuth2Service;
+    private OltuTokenService tokenService;
     @Autowired
     private OltuAuthorizationService authorizationService;
 
@@ -74,6 +74,7 @@
     public Response requestAuthorizationCode (
             @Context HttpServletRequest request,
             @Context SecurityContext context,
+            @FormParam("state") String state,
             MultivaluedMap<String, String> form) {
 
         TokenContext tokenContext = (TokenContext) context.getUserPrincipal();
@@ -89,13 +90,13 @@
             return responseHandler.sendRedirect(uri);
         }
         catch (OAuthSystemException e) {
-            throw responseHandler.throwit(e);
+            throw responseHandler.throwit(e, state);
         }
         catch (OAuthProblemException e) {
-            throw responseHandler.throwit(e);
+            throw responseHandler.throwit(e, state);
         }
         catch (KustvaktException e) {
-            throw responseHandler.throwit(e);
+            throw responseHandler.throwit(e, state);
         }
     }
 
@@ -167,7 +168,7 @@
             }
 
             OAuthResponse oAuthResponse =
-                    oAuth2Service.requestAccessToken(oAuthRequest);
+                    tokenService.requestAccessToken(oAuthRequest);
 
             return responseHandler.createResponse(oAuthResponse);
         }
diff --git a/full/src/main/java/de/ids_mannheim/korap/web/controller/OAuth2WithOpenIdController.java b/full/src/main/java/de/ids_mannheim/korap/web/controller/OAuth2WithOpenIdController.java
index 82affd6..d0e69d7 100644
--- a/full/src/main/java/de/ids_mannheim/korap/web/controller/OAuth2WithOpenIdController.java
+++ b/full/src/main/java/de/ids_mannheim/korap/web/controller/OAuth2WithOpenIdController.java
@@ -1,6 +1,8 @@
 package de.ids_mannheim.korap.web.controller;
 
+import java.net.MalformedURLException;
 import java.net.URI;
+import java.net.URL;
 import java.util.Map;
 
 import javax.servlet.http.HttpServletRequest;
@@ -13,18 +15,24 @@
 import javax.ws.rs.core.MultivaluedMap;
 import javax.ws.rs.core.Response;
 import javax.ws.rs.core.Response.ResponseBuilder;
+import javax.ws.rs.core.Response.Status;
 import javax.ws.rs.core.SecurityContext;
 
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.stereotype.Controller;
 
+import com.nimbusds.oauth2.sdk.AccessTokenResponse;
 import com.nimbusds.oauth2.sdk.ParseException;
 import com.nimbusds.oauth2.sdk.ResponseMode;
+import com.nimbusds.oauth2.sdk.TokenRequest;
+import com.nimbusds.oauth2.sdk.http.HTTPRequest.Method;
 import com.nimbusds.oauth2.sdk.id.State;
 import com.sun.jersey.spi.container.ResourceFilters;
 
 import de.ids_mannheim.korap.exceptions.KustvaktException;
+import de.ids_mannheim.korap.oauth2.openid.OpenIdHttpRequestWrapper;
 import de.ids_mannheim.korap.oauth2.openid.service.OpenIdAuthorizationService;
+import de.ids_mannheim.korap.oauth2.openid.service.OpenIdTokenService;
 import de.ids_mannheim.korap.security.context.TokenContext;
 import de.ids_mannheim.korap.web.OpenIdResponseHandler;
 import de.ids_mannheim.korap.web.filter.AuthenticationFilter;
@@ -38,6 +46,8 @@
     @Autowired
     private OpenIdAuthorizationService authzService;
     @Autowired
+    private OpenIdTokenService tokenService;
+    @Autowired
     private OpenIdResponseHandler openIdResponseHandler;
 
     /**
@@ -132,4 +142,46 @@
         return builder.build();
     }
 
+
+    @POST
+    @Path("token")
+    @Consumes(MediaType.APPLICATION_FORM_URLENCODED)
+    @Produces(MediaType.APPLICATION_JSON + ";charset=utf-8")
+    public Response requestAccessToken (
+            @Context HttpServletRequest servletRequest,
+            MultivaluedMap<String, String> form) {
+
+        Map<String, String> map = MapUtils.toMap(form);
+        Method method = Method.valueOf(servletRequest.getMethod());
+        URL url = null;
+        try {
+            url = new URL(servletRequest.getRequestURL().toString());
+        }
+        catch (MalformedURLException e) {
+            // TODO Auto-generated catch block
+            e.printStackTrace();
+        }
+
+        try {
+            OpenIdHttpRequestWrapper httpRequest =
+                    new OpenIdHttpRequestWrapper(method, url);
+            httpRequest.toHttpRequest(servletRequest, map);
+
+            TokenRequest tokenRequest = TokenRequest.parse(httpRequest);
+            AccessTokenResponse tokenResponse =
+                    tokenService.requestAccessToken(tokenRequest);
+            return openIdResponseHandler.createResponse(tokenResponse,
+                    Status.OK);
+        }
+        catch (ParseException e) {
+            // TODO Auto-generated catch block
+            e.printStackTrace();
+        }
+        catch (KustvaktException e) {
+            openIdResponseHandler.createTokenErrorResponse(e);
+        }
+
+        return null;
+
+    }
 }
diff --git a/full/src/main/java/de/ids_mannheim/korap/web/controller/OAuthClientController.java b/full/src/main/java/de/ids_mannheim/korap/web/controller/OAuthClientController.java
index cb00c12..2c36ad6 100644
--- a/full/src/main/java/de/ids_mannheim/korap/web/controller/OAuthClientController.java
+++ b/full/src/main/java/de/ids_mannheim/korap/web/controller/OAuthClientController.java
@@ -23,7 +23,7 @@
 
 import de.ids_mannheim.korap.dto.OAuth2ClientDto;
 import de.ids_mannheim.korap.exceptions.KustvaktException;
-import de.ids_mannheim.korap.oauth2.OAuth2DeregisterClientRequest;
+import de.ids_mannheim.korap.oauth2.oltu.OAuth2DeregisterClientRequest;
 import de.ids_mannheim.korap.oauth2.service.OAuth2ClientService;
 import de.ids_mannheim.korap.security.context.TokenContext;
 import de.ids_mannheim.korap.web.OAuth2ResponseHandler;
diff --git a/full/src/test/java/de/ids_mannheim/korap/web/controller/OAuth2ControllerTest.java b/full/src/test/java/de/ids_mannheim/korap/web/controller/OAuth2ControllerTest.java
index f7aa89a..97efe8d 100644
--- a/full/src/test/java/de/ids_mannheim/korap/web/controller/OAuth2ControllerTest.java
+++ b/full/src/test/java/de/ids_mannheim/korap/web/controller/OAuth2ControllerTest.java
@@ -77,6 +77,7 @@
         form.add("response_type", "code");
         form.add("client_id", "fCBbQkAyYzI4NzUxMg");
         form.add("redirect_uri", redirectUri);
+        form.add("state", "thisIsMyState");
         ClientResponse response = requestAuthorizationConfidentialClient(form);
 
         assertEquals(Status.BAD_REQUEST.getStatusCode(), response.getStatus());
@@ -87,13 +88,15 @@
                 node.at("/error").asText());
         assertEquals("Invalid redirect URI",
                 node.at("/error_description").asText());
+        assertEquals("thisIsMyState", node.at("/state").asText());
     }
 
     @Test
     public void testAuthorizeMissingRequiredParameters ()
             throws KustvaktException {
         MultivaluedMap<String, String> form = new MultivaluedMapImpl();
-        // missing code
+        form.add("state", "thisIsMyState");
+        // missing response_type
         ClientResponse response = requestAuthorizationConfidentialClient(form);
 
         assertEquals(Status.BAD_REQUEST.getStatusCode(), response.getStatus());
@@ -104,6 +107,7 @@
                 node.at("/error").asText());
         assertEquals("Missing response_type parameter value",
                 node.at("/error_description").asText());
+        assertEquals("thisIsMyState", node.at("/state").asText());
 
         // missing client_id
         form.add("response_type", "code");
@@ -118,7 +122,8 @@
     public void testAuthorizeInvalidResponseType () throws KustvaktException {
         MultivaluedMap<String, String> form = new MultivaluedMapImpl();
         form.add("response_type", "string");
-
+        form.add("state", "thisIsMyState");
+        
         ClientResponse response = requestAuthorizationConfidentialClient(form);
         assertEquals(Status.BAD_REQUEST.getStatusCode(), response.getStatus());
 
@@ -128,6 +133,7 @@
                 node.at("/error").asText());
         assertEquals("Invalid response_type parameter value",
                 node.at("/error_description").asText());
+        assertEquals("thisIsMyState", node.at("/state").asText());
     }
 
     @Test
@@ -136,7 +142,8 @@
         form.add("response_type", "code");
         form.add("client_id", "fCBbQkAyYzI4NzUxMg");
         form.add("scope", "read_address");
-
+        form.add("state", "thisIsMyState");
+        
         ClientResponse response = requestAuthorizationConfidentialClient(form);
         assertEquals(Status.BAD_REQUEST.getStatusCode(), response.getStatus());
 
@@ -145,6 +152,7 @@
                 UriComponentsBuilder.fromUri(location).build().getQueryParams();
         assertEquals(OAuth2Error.INVALID_SCOPE, params.getFirst("error"));
         assertEquals("read_address+is+an+invalid+scope", params.getFirst("error_description"));
+        assertEquals("thisIsMyState", params.getFirst("state"));
     }
 
     private ClientResponse requestToken (MultivaluedMap<String, String> form)
diff --git a/full/src/test/java/de/ids_mannheim/korap/web/controller/OAuth2OpenIdControllerTest.java b/full/src/test/java/de/ids_mannheim/korap/web/controller/OAuth2OpenIdControllerTest.java
index d4a337d..c4156d6 100644
--- a/full/src/test/java/de/ids_mannheim/korap/web/controller/OAuth2OpenIdControllerTest.java
+++ b/full/src/test/java/de/ids_mannheim/korap/web/controller/OAuth2OpenIdControllerTest.java
@@ -9,6 +9,7 @@
 import javax.ws.rs.core.MultivaluedMap;
 
 import org.apache.http.entity.ContentType;
+import org.apache.oltu.oauth2.common.message.types.TokenType;
 import org.junit.Test;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.util.MultiValueMap;
@@ -47,6 +48,15 @@
                         ContentType.APPLICATION_FORM_URLENCODED)
                 .entity(form).post(ClientResponse.class);
     }
+    
+    private ClientResponse sendTokenRequest (MultivaluedMap<String, String> form)
+            throws KustvaktException {
+        return resource().path("oauth2").path("openid").path("token")
+                .header(HttpHeaders.X_FORWARDED_FOR, "149.27.0.32")
+                .header(HttpHeaders.CONTENT_TYPE,
+                        ContentType.APPLICATION_FORM_URLENCODED)
+                .entity(form).post(ClientResponse.class);
+    }
 
     @Test
     public void testRequestAuthorizationCode ()
@@ -176,4 +186,40 @@
         assertEquals("unsupported+response_type%3A+id_token",
                 params.getFirst("error_description"));
     }
+    
+    @Test
+    public void testRequestAccessToken () throws KustvaktException {
+        MultivaluedMap<String, String> form = new MultivaluedMapImpl();
+        form.add("response_type", "code");
+        form.add("client_id", "fCBbQkAyYzI4NzUxMg");
+        form.add("redirect_uri", redirectUri);
+        form.add("scope", "openid");
+        form.add("state", "thisIsMyState");
+
+        ClientResponse response = sendAuthorizationRequest(form);
+        URI location = response.getLocation();
+        MultiValueMap<String, String> params =
+                UriComponentsBuilder.fromUri(location).build().getQueryParams();
+        String code = params.getFirst("code");
+        
+        MultivaluedMap<String, String> tokenForm = new MultivaluedMapImpl();
+        tokenForm.add("grant_type", "authorization_code");
+        tokenForm.add("redirect_uri", redirectUri);
+        tokenForm.add("client_id", "fCBbQkAyYzI4NzUxMg");
+        tokenForm.add("client_secret", "secret");
+        tokenForm.add("code", code);
+        
+        ClientResponse tokenResponse = sendTokenRequest(tokenForm);
+        String entity = tokenResponse.getEntity(String.class);
+//        System.out.println(entity);
+
+        JsonNode node = JsonUtils.readTree(entity);
+        assertNotNull(node.at("/access_token").asText());
+        assertNotNull(node.at("/refresh_token").asText());
+        assertEquals(TokenType.BEARER.toString(),
+                node.at("/token_type").asText());
+        assertNotNull(node.at("/expires_in").asText());
+        assertNotNull(node.at("/id_token").asText());
+
+    }
 }