diff --git a/src/app/Auth/SecondFactor.php b/src/app/Auth/SecondFactor.php
index 6ed9f1c9..e9528808 100644
--- a/src/app/Auth/SecondFactor.php
+++ b/src/app/Auth/SecondFactor.php
@@ -1,311 +1,335 @@
 <?php
 
 namespace App\Auth;
 
 use App\Sku;
+use App\User;
 use Illuminate\Support\Facades\Auth;
 use Illuminate\Support\Facades\DB;
 use Kolab2FA\Storage\Base;
 
 /**
  * A class to maintain 2-factor authentication
  */
 class SecondFactor extends Base
 {
     protected $user;
     protected $cache = [];
     protected $config = [
         'keymap' => [],
     ];
 
 
     /**
      * Class constructor
      *
      * @param \App\User $user User object
      */
     public function __construct($user)
     {
         $this->user = $user;
 
         parent::__construct();
     }
 
     /**
      * Validate 2-factor authentication code
      *
      * @param \Illuminate\Http\Request $request The API request.
      *
      * @return \Illuminate\Http\JsonResponse|null
      */
     public function requestHandler($request)
     {
         // get list of configured authentication factors
         $factors = $this->factors();
 
         // do nothing if no factors configured
         if (empty($factors)) {
             return null;
         }
 
         if (empty($request->secondfactor) || !is_string($request->secondfactor)) {
             $errors = ['secondfactor' => \trans('validation.2fareq')];
             return response()->json(['status' => 'error', 'errors' => $errors], 422);
         }
 
         // try to verify each configured factor
         foreach ($factors as $factor) {
             // verify the submitted code
             if (strpos($factor, 'dummy:') === 0) {
                 // This is for automated tests
                 if ($request->secondfactor === 'dummy') {
                     return null;
                 }
             } elseif ($this->verify($factor, $request->secondfactor)) {
                 return null;
             }
         }
 
         $errors = ['secondfactor' => \trans('validation.2fainvalid')];
         return response()->json(['status' => 'error', 'errors' => $errors], 422);
     }
 
     /**
      * Remove all configured 2FA methods for the current user
      *
      * @return bool True on success, False otherwise
      */
     public function removeFactors(): bool
     {
         $this->cache = [];
 
         $prefs = [];
         $prefs[$this->key2property('blob')]    = null;
         $prefs[$this->key2property('factors')] = null;
 
         return $this->savePrefs($prefs);
     }
 
     /**
      * Returns a list of 2nd factor methods configured for the user
      */
-    protected function factors(): ?array
+    public function factors(): array
     {
         // First check if the user has the 2FA SKU
         $sku_2fa = Sku::where('title', '2fa')->first();
 
-        if (!$sku_2fa) {
-            return null;
-        }
-
-        $has_2fa = $this->user->entitlements()->where('sku_id', $sku_2fa->id)->first();
+        if ($sku_2fa) {
+            $has_2fa = $this->user->entitlements()->where('sku_id', $sku_2fa->id)->first();
 
-        if ($has_2fa) {
-            $factors = (array) $this->enumerate();
-            $factors = array_unique($factors);
+            if ($has_2fa) {
+                $factors = (array) $this->enumerate();
+                $factors = array_unique($factors);
 
-            return $factors;
+                return $factors;
+            }
         }
 
-        return null;
+        return [];
     }
 
     /**
      * Helper method to verify the given method/code tuple
      *
      * @param string $factor Factor identifier (<method>:<id>)
      * @param string $code   Authentication code
      *
-     * @return bool
+     * @return bool True on successful validation
      */
-    protected function verify($factor, $code)
+    protected function verify($factor, $code): bool
     {
         if ($driver = $this->getDriver($factor)) {
             return $driver->verify($code, time());
         }
 
         return false;
     }
 
     /**
      * Load driver class for the given authentication factor
      *
      * @param string $factor Factor identifier (<method>:<id>)
      *
      * @return \Kolab2FA\Driver\Base
      */
-    protected function getDriver($factor)
+    protected function getDriver(string $factor)
     {
         list($method) = explode(':', $factor, 2);
 
         $config = \config('2fa.' . $method, []);
 
         $driver = \Kolab2FA\Driver\Base::factory($factor, $config);
 
         // configure driver
         $driver->storage  = $this;
         $driver->username = $this->user->email;
 
         return $driver;
     }
 
     /**
      * Helper for seeding a Roundcube account with 2FA setup
      * for testing.
      *
      * @param string $email Email address
      */
-    public static function seed($email)
+    public static function seed(string $email): void
     {
         $config = [
             'kolab_2fa_blob' => [
                 'totp:8132a46b1f741f88de25f47e' => [
                     'label' => 'Mobile app (TOTP)',
                     'created' => 1584573552,
                     'secret' => 'UAF477LDHZNWVLNA',
                     'active' => true,
                 ],
                 'dummy:dummy' => [
                     'active' => true,
                 ],
             ],
             'kolab_2fa_factors' => [
                 'totp:8132a46b1f741f88de25f47e',
                 'dummy:dummy',
             ]
         ];
 
         self::dbh()->table('users')->updateOrInsert(
             ['username' => $email, 'mail_host' => '127.0.0.1'],
             ['preferences' => serialize($config)]
         );
     }
 
+    /**
+     * Helper for generating current TOTP code for a test user
+     *
+     * @param string $email Email address
+     *
+     * @return string Generated code
+     */
+    public static function code(string $email): string
+    {
+        $sf = new self(User::where('email', $email)->first());
+        $driver = $sf->getDriver('totp:8132a46b1f741f88de25f47e');
+
+        return (string) $driver->get_code();
+    }
+
+
     //******************************************************
     //      Methods required by Kolab2FA Storage Base
     //******************************************************
 
     /**
      * Initialize the storage driver with the given config options
      */
     public function init(array $config)
     {
         $this->config = array_merge($this->config, $config);
     }
 
     /**
      * List methods activated for this user
      */
     public function enumerate()
     {
         if ($factors = $this->getFactors()) {
             return array_keys(array_filter($factors, function ($prop) {
                 return !empty($prop['active']);
             }));
         }
 
         return [];
     }
 
     /**
      * Read data for the given key
      */
     public function read($key)
     {
         \Log::debug(__METHOD__ . ' ' . $key);
 
         if (!isset($this->cache[$key])) {
             $factors = $this->getFactors();
             $this->cache[$key] = $factors[$key];
         }
 
         return $this->cache[$key];
     }
 
     /**
      * Save data for the given key
      */
     public function write($key, $value)
     {
         \Log::debug(__METHOD__ . ' ' . @json_encode($value));
 
         // TODO: Not implemented
         return false;
     }
 
     /**
      * Remove the data stored for the given key
      */
     public function remove($key)
     {
         return $this->write($key, null);
     }
 
     /**
      *
      */
-    protected function getFactors()
+    protected function getFactors(): array
     {
         $prefs = $this->getPrefs();
+        $key = $this->key2property('blob');
 
-        return (array) $prefs[$this->key2property('blob')];
+        return isset($prefs[$key]) ? (array) $prefs[$key] : [];
     }
 
     /**
      *
      */
     protected function key2property($key)
     {
         // map key to configured property name
         if (is_array($this->config['keymap']) && isset($this->config['keymap'][$key])) {
             return $this->config['keymap'][$key];
         }
 
         // default
         return 'kolab_2fa_' . $key;
     }
 
     /**
      * Gets user preferences from Roundcube users table
      */
     protected function getPrefs()
     {
         $user = $this->dbh()->table('users')
             ->select('preferences')
             ->where('username', strtolower($this->user->email))
             ->first();
 
         return $user ? (array) unserialize($user->preferences) : null;
     }
 
     /**
      * Saves user preferences in Roundcube users table.
      * This will merge into old preferences
      */
     protected function savePrefs($prefs)
     {
         $old_prefs = $this->getPrefs();
 
         if (!is_array($old_prefs)) {
             return false;
         }
 
         $prefs = array_merge($old_prefs, $prefs);
 
         $this->dbh()->table('users')
             ->where('username', strtolower($this->user->email))
             ->update(['preferences' => serialize($prefs)]);
 
         return true;
     }
 
     /**
      * Init connection to the Roundcube database
      */
-    protected static function dbh()
+    public static function dbh()
     {
-        \Config::set('database.connections.2fa', ['url' => \config('2fa.dsn')]);
+        $dsn = \config('2fa.dsn');
+
+        if (empty($dsn)) {
+            \Log::warning("2-FACTOR database not configured");
+
+            return DB::connection(\config('database.default'));
+        }
+
+        \Config::set('database.connections.2fa', ['url' => $dsn]);
 
         return DB::connection('2fa');
     }
 }
diff --git a/src/app/Observers/EntitlementObserver.php b/src/app/Observers/EntitlementObserver.php
index c2c961cd..54291a02 100644
--- a/src/app/Observers/EntitlementObserver.php
+++ b/src/app/Observers/EntitlementObserver.php
@@ -1,56 +1,73 @@
 <?php
 
 namespace App\Observers;
 
 use App\Entitlement;
 use Carbon\Carbon;
 
 /**
  * This is an observer for the Entitlement model definition.
  */
 class EntitlementObserver
 {
     /**
      * Handle the "creating" event on an Entitlement.
      *
      * Ensures that the entry uses a custom ID (uuid).
      *
      * Ensures that the {@link \App\Wallet} to which it is to be billed is owned or controlled by
      * the {@link \App\User} entitled.
      *
      * @param Entitlement $entitlement The entitlement being created.
      *
      * @return bool|null
      */
     public function creating(Entitlement $entitlement)
     {
         while (true) {
             $allegedly_unique = \App\Utils::uuidStr();
             if (!Entitlement::find($allegedly_unique)) {
                 $entitlement->{$entitlement->getKeyName()} = $allegedly_unique;
                 break;
             }
         }
 
         // can't dispatch job here because it'll fail serialization
 
         // Make sure the owner is at least a controller on the wallet
         $wallet = \App\Wallet::find($entitlement->wallet_id);
 
         if (!$wallet || !$wallet->owner) {
             return false;
         }
 
         $sku = \App\Sku::find($entitlement->sku_id);
 
         if (!$sku) {
             return false;
         }
 
         $result = $sku->handler_class::preReq($entitlement, $wallet->owner);
 
         if (!$result) {
             return false;
         }
     }
+
+    /**
+     * Handle the entitlement "deleted" event.
+     *
+     * @param \App\Entitlement $entitlement The entitlement.
+     *
+     * @return void
+     */
+    public function deleted(Entitlement $entitlement)
+    {
+        // Remove all configured 2FA methods from Roundcube database
+        if ($entitlement->sku->title == '2fa') {
+            // FIXME: Should that be an async job?
+            $sf = new \App\Auth\SecondFactor($entitlement->entitleable);
+            $sf->removeFactors();
+        }
+    }
 }
diff --git a/src/include/Kolab2FA/Driver/TOTP.php b/src/include/Kolab2FA/Driver/TOTP.php
index 5447c5ca..dd4845b2 100644
--- a/src/include/Kolab2FA/Driver/TOTP.php
+++ b/src/include/Kolab2FA/Driver/TOTP.php
@@ -1,120 +1,137 @@
 <?php
 
 /**
  * Kolab 2-Factor-Authentication TOTP driver implementation
  *
  * @author Thomas Bruederli <bruederli@kolabsys.com>
  *
  * Copyright (C) 2015, Kolab Systems AG <contact@kolabsys.com>
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU Affero General Public License as
  * published by the Free Software Foundation, either version 3 of the
  * License, or (at your option) any later version.
  *
  * This program is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  * GNU Affero General Public License for more details.
  *
  * You should have received a copy of the GNU Affero General Public License
  * along with this program. If not, see <http://www.gnu.org/licenses/>.
  */
 
 namespace Kolab2FA\Driver;
 
 class TOTP extends Base
 {
     public $method = 'totp';
 
     protected $config = array(
         'digits'   => 6,
         'interval' => 30,
         'digest'   => 'sha1',
     );
 
     protected $backend;
 
     /**
      *
      */
     public function init($config)
     {
         parent::init($config);
 
         $this->user_settings += array(
             'secret' => array(
                 'type'      => 'text',
                 'private'   => true,
                 'label'     => 'secret',
                 'generator' => 'generate_secret',
             ),
         );
 
         // copy config options
         $this->backend = new \Kolab2FA\OTP\TOTP();
         $this->backend
             ->setDigits($this->config['digits'])
             ->setInterval($this->config['interval'])
             ->setDigest($this->config['digest'])
             ->setIssuer($this->config['issuer'])
             ->setIssuerIncludedAsParameter(true);
     }
 
     /**
      *
      */
     public function verify($code, $timestamp = null)
     {
         // get my secret from the user storage
         $secret = $this->get('secret');
 
         if (!strlen($secret)) {
             // LOG: "no secret set for user $this->username"
             // rcube::console("VERIFY TOTP: no secret set for user $this->username");
             return false;
         }
 
         $this->backend->setLabel($this->username)->setSecret($secret);
 
         // PHP gets a string, but we're comparing integers.
         $code = (int)$code;
 //$code = (string) $code;
         // Pass a window to indicate the maximum timeslip between client (mobile
         // device) and server.
         $pass = $this->backend->verify($code, $timestamp, 150);
 
         // try all codes from $timestamp till now
         if (!$pass && $timestamp) {
             $now = time();
             while (!$pass && $timestamp < $now) {
                 $pass = $code === $this->backend->at($timestamp);
                 $timestamp += $this->config['interval'];
             }
         }
 
         // rcube::console('VERIFY TOTP', $this->username, $secret, $code, $timestamp, $pass);
         return $pass;
     }
 
+    /**
+     * Get current code (for testing)
+     */
+    public function get_code()
+    {
+        // get my secret from the user storage
+        $secret = $this->get('secret');
+
+        if (!strlen($secret)) {
+            return;
+        }
+
+        $this->backend->setLabel($this->username)->setSecret($secret);
+
+        return $this->backend->at(time());
+    }
+
     /**
      *
      */
     public function get_provisioning_uri()
     {
         // rcube::console('PROV', $this->secret);
         if (!$this->secret) {
             // generate new secret and store it
             $this->set('secret', $this->get('secret', true));
             $this->set('created', $this->get('created', true));
             // rcube::console('PROV2', $this->secret);
             $this->commit();
         }
 
         // TODO: deny call if already active?
 
         $this->backend->setLabel($this->username)->setSecret($this->secret);
         return $this->backend->getProvisioningUri();
     }
 
 }
diff --git a/src/tests/Browser.php b/src/tests/Browser.php
index 12b2dafe..50c2531e 100644
--- a/src/tests/Browser.php
+++ b/src/tests/Browser.php
@@ -1,191 +1,206 @@
 <?php
 
 namespace Tests;
 
 use Facebook\WebDriver\WebDriverKeys;
 use PHPUnit\Framework\Assert;
 use Tests\Browser\Components\Error;
+use Tests\Browser\Components\Toast;
 
 /**
  * Laravel Dusk Browser extensions
  */
 class Browser extends \Laravel\Dusk\Browser
 {
     /**
      * Assert number of (visible) elements
      */
     public function assertElementsCount($selector, $expected_count, $visible = true)
     {
         $elements = $this->elements($selector);
         $count = count($elements);
 
         if ($visible) {
             foreach ($elements as $element) {
                 if (!$element->isDisplayed()) {
                     $count--;
                 }
             }
         }
 
         Assert::assertEquals($expected_count, $count, "Count of [$selector] elements is not $count");
 
         return $this;
     }
 
     /**
      * Assert Tip element content
      */
     public function assertTip($selector, $content)
     {
         return $this->click($selector)
             ->withinBody(function ($browser) use ($content) {
                 $browser->assertSeeIn('div.tooltip .tooltip-inner', $content);
             })
             ->click($selector);
     }
 
+    /**
+     * Assert Toast element content (and close it)
+     */
+    public function assertToast($type, $title, $message)
+    {
+        return $this->withinBody(function ($browser) use ($type, $title, $message) {
+            $browser->with(new Toast($type), function (Browser $browser) use ($title, $message) {
+                $browser->assertToastTitle($title)
+                    ->assertToastMessage($message)
+                        ->closeToast();
+            });
+        });
+    }
+
     /**
      * Assert specified error page is displayed.
      */
     public function assertErrorPage(int $error_code)
     {
         $this->with(new Error($error_code), function ($browser) {
             // empty, assertions will be made by the Error component itself
         });
 
         return $this;
     }
 
     /**
      * Assert that the given element has specified class assigned.
      */
     public function assertHasClass($selector, $class_name)
     {
         $element = $this->resolver->findOrFail($selector);
         $classes = explode(' ', (string) $element->getAttribute('class'));
 
         Assert::assertContains($class_name, $classes, "[$selector] has no class '{$class_name}'");
 
         return $this;
     }
 
     /**
      * Assert that the given element is readonly
      */
     public function assertReadonly($selector)
     {
         $element = $this->resolver->findOrFail($selector);
         $value = $element->getAttribute('readonly');
 
         Assert::assertTrue($value == 'true', "Element [$selector] is not readonly");
 
         return $this;
     }
 
     /**
      * Assert that the given element is not readonly
      */
     public function assertNotReadonly($selector)
     {
         $element = $this->resolver->findOrFail($selector);
         $value = $element->getAttribute('readonly');
 
         Assert::assertTrue($value != 'true', "Element [$selector] is not readonly");
 
         return $this;
     }
 
     /**
      * Assert that the given element contains specified text,
      * no matter it's displayed or not.
      */
     public function assertText($selector, $text)
     {
         $element = $this->resolver->findOrFail($selector);
 
         Assert::assertTrue(strpos($element->getText(), $text) !== false, "No expected text in [$selector]");
 
         return $this;
     }
 
     /**
      * Remove all toast messages
      */
     public function clearToasts()
     {
         $this->script("jQuery('.toast-container > *').remove()");
 
         return $this;
     }
 
     /**
      * Check if in Phone mode
      */
     public static function isPhone()
     {
         return getenv('TESTS_MODE') == 'phone';
     }
 
     /**
      * Check if in Tablet mode
      */
     public static function isTablet()
     {
         return getenv('TESTS_MODE') == 'tablet';
     }
 
     /**
      * Check if in Desktop mode
      */
     public static function isDesktop()
     {
         return !self::isPhone() && !self::isTablet();
     }
 
     /**
      * Returns content of a downloaded file
      */
     public function readDownloadedFile($filename)
     {
         $filename = __DIR__ . "/Browser/downloads/$filename";
 
         // Give the browser a chance to finish download
         if (!file_exists($filename)) {
             sleep(2);
         }
 
         Assert::assertFileExists($filename);
 
         return file_get_contents($filename);
     }
 
     /**
      * Removes downloaded file
      */
     public function removeDownloadedFile($filename)
     {
         @unlink(__DIR__ . "/Browser/downloads/$filename");
 
         return $this;
     }
 
     /**
      * Execute code within body context.
      * Useful to execute code that selects elements outside of a component context
      */
     public function withinBody($callback)
     {
         if ($this->resolver->prefix != 'body') {
             $orig_prefix = $this->resolver->prefix;
             $this->resolver->prefix = 'body';
         }
 
         call_user_func($callback, $this);
 
         if (isset($orig_prefix)) {
             $this->resolver->prefix = $orig_prefix;
         }
 
         return $this;
     }
 }
diff --git a/src/tests/Browser/LogonTest.php b/src/tests/Browser/LogonTest.php
index 3fb95140..9d3f1641 100644
--- a/src/tests/Browser/LogonTest.php
+++ b/src/tests/Browser/LogonTest.php
@@ -1,159 +1,202 @@
 <?php
 
 namespace Tests\Browser;
 
 use Tests\Browser;
 use Tests\Browser\Components\Menu;
 use Tests\Browser\Components\Toast;
 use Tests\Browser\Pages\Dashboard;
 use Tests\Browser\Pages\Home;
 use Tests\TestCaseDusk;
 use Illuminate\Foundation\Testing\DatabaseMigrations;
 
 class LogonTest extends TestCaseDusk
 {
 
     /**
      * Test menu on logon page
      */
     public function testLogonMenu(): void
     {
         $this->browse(function (Browser $browser) {
             $browser->visit(new Home());
             $browser->within(new Menu(), function ($browser) {
                 $browser->assertMenuItems(['signup', 'explore', 'blog', 'support', 'webmail']);
             });
         });
     }
 
     /**
      * Test redirect to /login if user is unauthenticated
      */
     public function testLogonRedirect(): void
     {
         $this->browse(function (Browser $browser) {
             $browser->visit('/dashboard');
 
             // Checks if we're really on the login page
             $browser->waitForLocation('/login')
                 ->on(new Home());
         });
     }
 
     /**
      * Logon with wrong password/user test
      */
     public function testLogonWrongCredentials(): void
     {
         $this->browse(function (Browser $browser) {
             $browser->visit(new Home())
                 ->submitLogon('john@kolab.org', 'wrong');
 
             // Error message
             $browser->with(new Toast(Toast::TYPE_ERROR), function (Browser $browser) {
                 $browser->assertToastTitle('Error')
                     ->assertToastMessage('Invalid username or password.')
                     ->closeToast();
             });
 
             // Checks if we're still on the logon page
             $browser->on(new Home());
         });
     }
 
     /**
      * Successful logon test
      */
     public function testLogonSuccessful(): void
     {
         $this->browse(function (Browser $browser) {
             $browser->visit(new Home())
                 ->submitLogon('john@kolab.org', 'simple123', true);
 
             // Checks if we're really on Dashboard page
             $browser->on(new Dashboard())
                 ->within(new Menu(), function ($browser) {
                     $browser->assertMenuItems(['support', 'contact', 'webmail', 'logout']);
                 })
                 ->assertUser('john@kolab.org');
 
             // Assert no "Account status" for this account
             $browser->assertMissing('@status');
 
             // Goto /domains and assert that the link on logo element
             // leads to the dashboard
             $browser->visit('/domains')
                 ->waitForText('Domains')
                 ->click('a.navbar-brand')
                 ->on(new Dashboard());
 
             // Test that visiting '/' with logged in user does not open logon form
             // but "redirects" to the dashboard
             $browser->visit('/')->on(new Dashboard());
         });
     }
 
     /**
      * Logout test
      *
      * @depends testLogonSuccessful
      */
     public function testLogout(): void
     {
         $this->browse(function (Browser $browser) {
             $browser->on(new Dashboard());
 
             // Click the Logout button
             $browser->within(new Menu(), function ($browser) {
                 $browser->click('.link-logout');
             });
 
             // We expect the logon page
             $browser->waitForLocation('/login')
                 ->on(new Home());
 
             // with default menu
             $browser->within(new Menu(), function ($browser) {
                 $browser->assertMenuItems(['signup', 'explore', 'blog', 'support', 'webmail']);
             });
 
             // Success toast message
             $browser->with(new Toast(Toast::TYPE_SUCCESS), function (Browser $browser) {
                 $browser->assertToastTitle('')
                     ->assertToastMessage('Successfully logged out')
                     ->closeToast();
             });
         });
     }
 
     /**
      * Logout by URL test
      */
     public function testLogoutByURL(): void
     {
         $this->browse(function (Browser $browser) {
             $browser->visit(new Home())
                 ->submitLogon('john@kolab.org', 'simple123', true);
 
             // Checks if we're really on Dashboard page
             $browser->on(new Dashboard());
 
             // Use /logout url, and expect the logon page
             $browser->visit('/logout')
                 ->waitForLocation('/login')
                 ->on(new Home());
 
             // with default menu
             $browser->within(new Menu(), function ($browser) {
                 $browser->assertMenuItems(['signup', 'explore', 'blog', 'support', 'webmail']);
             });
 
             // Success toast message
             $browser->with(new Toast(Toast::TYPE_SUCCESS), function (Browser $browser) {
                 $browser->assertToastTitle('')
                     ->assertToastMessage('Successfully logged out')
                     ->closeToast();
             });
         });
     }
+
+    /**
+     * Test 2-Factor Authentication
+     *
+     * @depends testLogoutByURL
+     */
+    public function test2FA(): void
+    {
+        $this->browse(function (Browser $browser) {
+            // Test missing 2fa code
+            $browser->on(new Home())
+                ->type('@email-input', 'ned@kolab.org')
+                ->type('@password-input', 'simple123')
+                ->press('form button')
+                ->waitFor('@second-factor-input.is-invalid + small + .invalid-feedback')
+                ->assertSeeIn(
+                    '@second-factor-input.is-invalid + small + .invalid-feedback',
+                    'Second factor code is required.'
+                )
+                ->assertFocused('@second-factor-input')
+                ->assertToast(Toast::TYPE_ERROR, 'Error', 'Form validation error');
+
+            // Test invalid code
+            $browser->type('@second-factor-input', '123456')
+                ->press('form button')
+                ->waitUntilMissing('@second-factor-input.is-invalid')
+                ->waitFor('@second-factor-input.is-invalid + small + .invalid-feedback')
+                ->assertSeeIn(
+                    '@second-factor-input.is-invalid + small + .invalid-feedback',
+                    'Second factor code is invalid.'
+                )
+                ->assertFocused('@second-factor-input')
+                ->assertToast(Toast::TYPE_ERROR, 'Error', 'Form validation error');
+
+            $code = \App\Auth\SecondFactor::code('ned@kolab.org');
+
+            // Test valid (TOTP) code
+            $browser->type('@second-factor-input', $code)
+                ->press('form button')
+                ->waitUntilMissing('@second-factor-input.is-invalid')
+                ->waitForLocation('/dashboard')->on(new Dashboard());
+        });
+    }
 }
diff --git a/src/tests/Browser/Pages/Home.php b/src/tests/Browser/Pages/Home.php
index cea31d50..4f5a358a 100644
--- a/src/tests/Browser/Pages/Home.php
+++ b/src/tests/Browser/Pages/Home.php
@@ -1,65 +1,68 @@
 <?php
 
 namespace Tests\Browser\Pages;
 
 use Laravel\Dusk\Page;
 
 class Home extends Page
 {
     /**
      * Get the URL for the page.
      *
      * @return string
      */
     public function url()
     {
         return '/login';
     }
 
     /**
      * Assert that the browser is on the page.
      *
      * @param \Laravel\Dusk\Browser $browser The browser object
      *
      * @return void
      */
     public function assert($browser)
     {
         $browser->waitForLocation($this->url())
             ->assertVisible('form.form-signin');
     }
 
     /**
      * Get the element shortcuts for the page.
      *
      * @return array
      */
     public function elements()
     {
         return [
             '@app' => '#app',
+            '@email-input' => '#inputEmail',
+            '@password-input' => '#inputPassword',
+            '@second-factor-input' => '#secondfactor',
         ];
     }
 
     /**
      * Submit logon form.
      *
      * @param \Laravel\Dusk\Browser $browser  The browser object
      * @param string                $username User name
      * @param string                $password User password
      * @param bool                  $wait_for_dashboard
      *
      * @return void
      */
     public function submitLogon($browser, $username, $password, $wait_for_dashboard = false)
     {
         $browser
-            ->type('#inputEmail', $username)
-            ->type('#inputPassword', $password)
+            ->type('@email-input', $username)
+            ->type('@password-input', $password)
             ->press('form button');
 
         if ($wait_for_dashboard) {
             $browser->waitForLocation('/dashboard');
         }
     }
 }
diff --git a/src/tests/Feature/Auth/SecondFactorTest.php b/src/tests/Feature/Auth/SecondFactorTest.php
new file mode 100644
index 00000000..8f7e96c7
--- /dev/null
+++ b/src/tests/Feature/Auth/SecondFactorTest.php
@@ -0,0 +1,63 @@
+<?php
+
+namespace Tests\Feature;
+
+use App\Auth\SecondFactor;
+use App\Entitlement;
+use App\Sku;
+use App\User;
+use Tests\TestCase;
+
+class SecondFactorTest extends TestCase
+{
+
+    public function setUp(): void
+    {
+        parent::setUp();
+
+        $this->deleteTestUser('entitlement-test@kolabnow.com');
+    }
+
+    public function tearDown(): void
+    {
+        $this->deleteTestUser('entitlement-test@kolabnow.com');
+
+        parent::tearDown();
+    }
+
+    /**
+     * Test that 2FA config is removed from Roundcube database
+     * on entitlement delete
+     */
+    public function testEntitlementDelete(): void
+    {
+        // Create the user, and assign 2FA to him, and add Roundcube setup
+        $sku_2fa = Sku::where('title', '2fa')->first();
+        $user = $this->getTestUser('entitlement-test@kolabnow.com');
+        $user->assignSku($sku_2fa);
+        SecondFactor::seed('entitlement-test@kolabnow.com');
+
+        $entitlement = Entitlement::where('sku_id', $sku_2fa->id)
+            ->where('entitleable_id', $user->id)
+            ->first();
+
+        $this->assertTrue(!empty($entitlement));
+
+        $sf = new SecondFactor($user);
+        $factors = $sf->factors();
+
+        $this->assertCount(2, $factors);
+        $this->assertSame('totp:8132a46b1f741f88de25f47e', $factors[0]);
+        $this->assertSame('dummy:dummy', $factors[1]);
+
+        // Delete the entitlement, expect all configured 2FA methods in Roundcube removed
+        $entitlement->delete();
+
+        $this->assertTrue($entitlement->trashed());
+
+        $sf = new SecondFactor($user);
+        $factors = $sf->factors();
+
+        $this->assertCount(0, $factors);
+    }
+}
diff --git a/src/tests/Feature/Controller/UsersTest.php b/src/tests/Feature/Controller/UsersTest.php
index 0ad2406c..20460a34 100644
--- a/src/tests/Feature/Controller/UsersTest.php
+++ b/src/tests/Feature/Controller/UsersTest.php
@@ -1,837 +1,841 @@
 <?php
 
 namespace Tests\Feature\Controller;
 
 use App\Domain;
 use App\Http\Controllers\API\UsersController;
 use App\Package;
 use App\Sku;
 use App\User;
 use Illuminate\Support\Facades\Queue;
 use Illuminate\Support\Str;
 use Tests\TestCase;
 
 class UsersTest extends TestCase
 {
     /**
      * {@inheritDoc}
      */
     public function setUp(): void
     {
         parent::setUp();
 
         $this->deleteTestUser('UsersControllerTest1@userscontroller.com');
         $this->deleteTestUser('UsersControllerTest2@userscontroller.com');
         $this->deleteTestUser('UsersControllerTest3@userscontroller.com');
         $this->deleteTestUser('UserEntitlement2A@UserEntitlement.com');
         $this->deleteTestUser('john2.doe2@kolab.org');
         $this->deleteTestDomain('userscontroller.com');
     }
 
     /**
      * {@inheritDoc}
      */
     public function tearDown(): void
     {
         $this->deleteTestUser('UsersControllerTest1@userscontroller.com');
         $this->deleteTestUser('UsersControllerTest2@userscontroller.com');
         $this->deleteTestUser('UsersControllerTest3@userscontroller.com');
         $this->deleteTestUser('UserEntitlement2A@UserEntitlement.com');
         $this->deleteTestUser('john2.doe2@kolab.org');
         $this->deleteTestDomain('userscontroller.com');
 
         parent::tearDown();
     }
 
     /**
      * Test fetching current user info (/api/auth/info)
      */
     public function testInfo(): void
     {
         $user = $this->getTestUser('UsersControllerTest1@userscontroller.com');
         $domain = $this->getTestDomain('userscontroller.com', [
                 'status' => Domain::STATUS_NEW,
                 'type' => Domain::TYPE_PUBLIC,
         ]);
 
         $response = $this->actingAs($user)->get("api/auth/info");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertEquals($user->id, $json['id']);
         $this->assertEquals($user->email, $json['email']);
         $this->assertEquals(User::STATUS_NEW | User::STATUS_ACTIVE, $json['status']);
         $this->assertTrue(is_array($json['statusInfo']));
         $this->assertTrue(is_array($json['settings']));
         $this->assertTrue(is_array($json['aliases']));
 
         // Note: Details of the content are tested in testUserResponse()
     }
 
     /**
      * Test user deleting (DELETE /api/v4/users/<id>)
      */
     public function testDestroy(): void
     {
         // First create some users/accounts to delete
         $package_kolab = \App\Package::where('title', 'kolab')->first();
         $package_domain = \App\Package::where('title', 'domain-hosting')->first();
 
         $john = $this->getTestUser('john@kolab.org');
         $user1 = $this->getTestUser('UsersControllerTest1@userscontroller.com');
         $user2 = $this->getTestUser('UsersControllerTest2@userscontroller.com');
         $user3 = $this->getTestUser('UsersControllerTest3@userscontroller.com');
         $domain = $this->getTestDomain('userscontroller.com', [
                 'status' => Domain::STATUS_NEW,
                 'type' => Domain::TYPE_PUBLIC,
         ]);
         $user1->assignPackage($package_kolab);
         $domain->assignPackage($package_domain, $user1);
         $user1->assignPackage($package_kolab, $user2);
         $user1->assignPackage($package_kolab, $user3);
 
         // Test unauth access
         $response = $this->delete("api/v4/users/{$user2->id}");
         $response->assertStatus(401);
 
         // Test access to other user/account
         $response = $this->actingAs($john)->delete("api/v4/users/{$user2->id}");
         $response->assertStatus(403);
         $response = $this->actingAs($john)->delete("api/v4/users/{$user1->id}");
         $response->assertStatus(403);
         $json = $response->json();
 
         $this->assertSame('error', $json['status']);
         $this->assertSame("Access denied", $json['message']);
         $this->assertCount(2, $json);
 
         // Test that non-controller cannot remove himself
         $response = $this->actingAs($user3)->delete("api/v4/users/{$user3->id}");
         $response->assertStatus(403);
 
         // Test removing a non-controller user
         $response = $this->actingAs($user1)->delete("api/v4/users/{$user3->id}");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertEquals('success', $json['status']);
         $this->assertEquals('User deleted successfully.', $json['message']);
 
         // Test removing self (an account with users)
         $response = $this->actingAs($user1)->delete("api/v4/users/{$user1->id}");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertEquals('success', $json['status']);
         $this->assertEquals('User deleted successfully.', $json['message']);
     }
 
     /**
      * Test user deleting (DELETE /api/v4/users/<id>)
      */
     public function testDestroyByController(): void
     {
         // Create an account with additional controller - $user2
         $package_kolab = \App\Package::where('title', 'kolab')->first();
         $package_domain = \App\Package::where('title', 'domain-hosting')->first();
         $user1 = $this->getTestUser('UsersControllerTest1@userscontroller.com');
         $user2 = $this->getTestUser('UsersControllerTest2@userscontroller.com');
         $user3 = $this->getTestUser('UsersControllerTest3@userscontroller.com');
         $domain = $this->getTestDomain('userscontroller.com', [
                 'status' => Domain::STATUS_NEW,
                 'type' => Domain::TYPE_PUBLIC,
         ]);
         $user1->assignPackage($package_kolab);
         $domain->assignPackage($package_domain, $user1);
         $user1->assignPackage($package_kolab, $user2);
         $user1->assignPackage($package_kolab, $user3);
         $user1->wallets()->first()->addController($user2);
 
         // TODO/FIXME:
         //   For now controller can delete himself, as well as
         //   the whole account he has control to, including the owner
         //   Probably he should not be able to do either of those
         //   However, this is not 0-regression scenario as we
         //   do not fully support additional controllers.
 
         //$response = $this->actingAs($user2)->delete("api/v4/users/{$user2->id}");
         //$response->assertStatus(403);
 
         $response = $this->actingAs($user2)->delete("api/v4/users/{$user3->id}");
         $response->assertStatus(200);
 
         $response = $this->actingAs($user2)->delete("api/v4/users/{$user1->id}");
         $response->assertStatus(200);
 
         // Note: More detailed assertions in testDestroy() above
 
         $this->assertTrue($user1->fresh()->trashed());
         $this->assertTrue($user2->fresh()->trashed());
         $this->assertTrue($user3->fresh()->trashed());
     }
 
     /**
      * Test user listing (GET /api/v4/users)
      */
     public function testIndex(): void
     {
         // Test unauth access
         $response = $this->get("api/v4/users");
         $response->assertStatus(401);
 
         $jack = $this->getTestUser('jack@kolab.org');
         $john = $this->getTestUser('john@kolab.org');
         $ned = $this->getTestUser('ned@kolab.org');
 
         $response = $this->actingAs($jack)->get("/api/v4/users");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertCount(0, $json);
 
         $response = $this->actingAs($john)->get("/api/v4/users");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertCount(3, $json);
         $this->assertSame($jack->email, $json[0]['email']);
         $this->assertSame($john->email, $json[1]['email']);
         $this->assertSame($ned->email, $json[2]['email']);
         // Values below are tested by Unit tests
         $this->assertArrayHasKey('isDeleted', $json[0]);
         $this->assertArrayHasKey('isSuspended', $json[0]);
         $this->assertArrayHasKey('isActive', $json[0]);
         $this->assertArrayHasKey('isLdapReady', $json[0]);
         $this->assertArrayHasKey('isImapReady', $json[0]);
 
         $response = $this->actingAs($ned)->get("/api/v4/users");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertCount(3, $json);
         $this->assertSame($jack->email, $json[0]['email']);
         $this->assertSame($john->email, $json[1]['email']);
         $this->assertSame($ned->email, $json[2]['email']);
     }
 
     /**
      * Test /api/auth/login
      */
     public function testLogin(): string
     {
         // Request with no data
         $response = $this->post("api/auth/login", []);
         $response->assertStatus(422);
         $json = $response->json();
 
         $this->assertSame('error', $json['status']);
         $this->assertCount(2, $json['errors']);
         $this->assertArrayHasKey('email', $json['errors']);
         $this->assertArrayHasKey('password', $json['errors']);
 
         // Request with invalid password
         $post = ['email' => 'john@kolab.org', 'password' => 'wrong'];
         $response = $this->post("api/auth/login", $post);
         $response->assertStatus(401);
 
         $json = $response->json();
 
         $this->assertSame('error', $json['status']);
         $this->assertSame('Invalid username or password.', $json['message']);
 
         // Valid user+password
         $post = ['email' => 'john@kolab.org', 'password' => 'simple123'];
         $response = $this->post("api/auth/login", $post);
         $json = $response->json();
 
         $response->assertStatus(200);
         $this->assertTrue(!empty($json['access_token']));
         $this->assertEquals(\config('jwt.ttl') * 60, $json['expires_in']);
         $this->assertEquals('bearer', $json['token_type']);
 
+        // TODO: We have browser tests for 2FA but we should probably also test it here
+
         return $json['access_token'];
     }
 
     /**
      * Test /api/auth/logout
      *
      * @depends testLogin
      */
     public function testLogout($token): void
     {
         // Request with no token, testing that it requires auth
         $response = $this->post("api/auth/logout");
         $response->assertStatus(401);
 
         // Test the same using JSON mode
         $response = $this->json('POST', "api/auth/logout", []);
         $response->assertStatus(401);
 
         // Request with valid token
         $response = $this->withHeaders(['Authorization' => 'Bearer ' . $token])->post("api/auth/logout");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertEquals('success', $json['status']);
         $this->assertEquals('Successfully logged out.', $json['message']);
 
         // Check if it really destroyed the token?
         $response = $this->withHeaders(['Authorization' => 'Bearer ' . $token])->get("api/auth/info");
         $response->assertStatus(401);
     }
 
     public function testRefresh(): void
     {
         // TODO
         $this->markTestIncomplete();
     }
 
     public function testStatusInfo(): void
     {
         $user = $this->getTestUser('UsersControllerTest1@userscontroller.com');
         $domain = $this->getTestDomain('userscontroller.com', [
                 'status' => Domain::STATUS_NEW,
                 'type' => Domain::TYPE_PUBLIC,
         ]);
 
         $user->status = User::STATUS_NEW;
         $user->save();
 
         $result = UsersController::statusInfo($user);
 
         $this->assertFalse($result['isReady']);
         $this->assertCount(3, $result['process']);
         $this->assertSame('user-new', $result['process'][0]['label']);
         $this->assertSame(true, $result['process'][0]['state']);
         $this->assertSame('user-ldap-ready', $result['process'][1]['label']);
         $this->assertSame(false, $result['process'][1]['state']);
         $this->assertSame('user-imap-ready', $result['process'][2]['label']);
         $this->assertSame(false, $result['process'][2]['state']);
 
         $user->status |= User::STATUS_LDAP_READY | User::STATUS_IMAP_READY;
         $user->save();
 
         $result = UsersController::statusInfo($user);
 
         $this->assertTrue($result['isReady']);
         $this->assertCount(3, $result['process']);
         $this->assertSame('user-new', $result['process'][0]['label']);
         $this->assertSame(true, $result['process'][0]['state']);
         $this->assertSame('user-ldap-ready', $result['process'][1]['label']);
         $this->assertSame(true, $result['process'][1]['state']);
         $this->assertSame('user-imap-ready', $result['process'][2]['label']);
         $this->assertSame(true, $result['process'][2]['state']);
 
         $domain->status |= Domain::STATUS_VERIFIED;
         $domain->type = Domain::TYPE_EXTERNAL;
         $domain->save();
 
         $result = UsersController::statusInfo($user);
 
         $this->assertFalse($result['isReady']);
         $this->assertCount(7, $result['process']);
         $this->assertSame('user-new', $result['process'][0]['label']);
         $this->assertSame(true, $result['process'][0]['state']);
         $this->assertSame('user-ldap-ready', $result['process'][1]['label']);
         $this->assertSame(true, $result['process'][1]['state']);
         $this->assertSame('user-imap-ready', $result['process'][2]['label']);
         $this->assertSame(true, $result['process'][2]['state']);
         $this->assertSame('domain-new', $result['process'][3]['label']);
         $this->assertSame(true, $result['process'][3]['state']);
         $this->assertSame('domain-ldap-ready', $result['process'][4]['label']);
         $this->assertSame(false, $result['process'][4]['state']);
         $this->assertSame('domain-verified', $result['process'][5]['label']);
         $this->assertSame(true, $result['process'][5]['state']);
         $this->assertSame('domain-confirmed', $result['process'][6]['label']);
         $this->assertSame(false, $result['process'][6]['state']);
     }
 
     /**
      * Test user data response used in show and info actions
      */
     public function testUserResponse(): void
     {
         $user = $this->getTestUser('john@kolab.org');
         $wallet = $user->wallets()->first();
         $result = $this->invokeMethod(new UsersController(), 'userResponse', [$user]);
 
         $this->assertEquals($user->id, $result['id']);
         $this->assertEquals($user->email, $result['email']);
         $this->assertEquals($user->status, $result['status']);
         $this->assertTrue(is_array($result['statusInfo']));
 
         $this->assertTrue(is_array($result['aliases']));
         $this->assertCount(1, $result['aliases']);
         $this->assertSame('john.doe@kolab.org', $result['aliases'][0]);
 
         $this->assertTrue(is_array($result['settings']));
         $this->assertSame('US', $result['settings']['country']);
         $this->assertSame('USD', $result['settings']['currency']);
 
         $this->assertTrue(is_array($result['accounts']));
         $this->assertTrue(is_array($result['wallets']));
         $this->assertCount(0, $result['accounts']);
         $this->assertCount(1, $result['wallets']);
         $this->assertSame($wallet->id, $result['wallet']['id']);
 
         $ned = $this->getTestUser('ned@kolab.org');
         $ned_wallet = $ned->wallets()->first();
         $result = $this->invokeMethod(new UsersController(), 'userResponse', [$ned]);
 
         $this->assertEquals($ned->id, $result['id']);
         $this->assertEquals($ned->email, $result['email']);
         $this->assertTrue(is_array($result['accounts']));
         $this->assertTrue(is_array($result['wallets']));
         $this->assertCount(1, $result['accounts']);
         $this->assertCount(1, $result['wallets']);
         $this->assertSame($wallet->id, $result['wallet']['id']);
         $this->assertSame($wallet->id, $result['accounts'][0]['id']);
         $this->assertSame($ned_wallet->id, $result['wallets'][0]['id']);
     }
 
     /**
      * Test fetching user data/profile (GET /api/v4/users/<user-id>)
      */
     public function testShow(): void
     {
         $userA = $this->getTestUser('UserEntitlement2A@UserEntitlement.com');
 
         // Test getting profile of self
         $response = $this->actingAs($userA)->get("/api/v4/users/{$userA->id}");
 
         $json = $response->json();
 
         $response->assertStatus(200);
         $this->assertEquals($userA->id, $json['id']);
         $this->assertEquals($userA->email, $json['email']);
         $this->assertTrue(is_array($json['statusInfo']));
         $this->assertTrue(is_array($json['settings']));
         $this->assertTrue(is_array($json['aliases']));
         $this->assertSame([], $json['skus']);
         // Values below are tested by Unit tests
         $this->assertArrayHasKey('isDeleted', $json);
         $this->assertArrayHasKey('isSuspended', $json);
         $this->assertArrayHasKey('isActive', $json);
         $this->assertArrayHasKey('isLdapReady', $json);
         $this->assertArrayHasKey('isImapReady', $json);
 
         $john = $this->getTestUser('john@kolab.org');
         $jack = $this->getTestUser('jack@kolab.org');
         $ned = $this->getTestUser('ned@kolab.org');
 
         // Test unauthorized access to a profile of other user
         $response = $this->actingAs($jack)->get("/api/v4/users/{$userA->id}");
         $response->assertStatus(403);
 
         // Test authorized access to a profile of other user
         // Ned: Additional account controller
         $response = $this->actingAs($ned)->get("/api/v4/users/{$john->id}");
         $response->assertStatus(200);
         $response = $this->actingAs($ned)->get("/api/v4/users/{$jack->id}");
         $response->assertStatus(200);
 
         // John: Account owner
         $response = $this->actingAs($john)->get("/api/v4/users/{$jack->id}");
         $response->assertStatus(200);
         $response = $this->actingAs($john)->get("/api/v4/users/{$ned->id}");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $storage_sku = Sku::where('title', 'storage')->first();
         $groupware_sku = Sku::where('title', 'groupware')->first();
         $mailbox_sku = Sku::where('title', 'mailbox')->first();
+        $secondfactor_sku = Sku::where('title', '2fa')->first();
 
-        $this->assertCount(3, $json['skus']);
+        $this->assertCount(4, $json['skus']);
         $this->assertSame(2, $json['skus'][$storage_sku->id]['count']);
         $this->assertSame(1, $json['skus'][$groupware_sku->id]['count']);
         $this->assertSame(1, $json['skus'][$mailbox_sku->id]['count']);
+        $this->assertSame(1, $json['skus'][$secondfactor_sku->id]['count']);
     }
 
     /**
      * Test user creation (POST /api/v4/users)
      */
     public function testStore(): void
     {
         $jack = $this->getTestUser('jack@kolab.org');
         $john = $this->getTestUser('john@kolab.org');
 
         // Test empty request
         $response = $this->actingAs($john)->post("/api/v4/users", []);
         $response->assertStatus(422);
 
         $json = $response->json();
 
         $this->assertSame('error', $json['status']);
         $this->assertSame("The email field is required.", $json['errors']['email']);
         $this->assertSame("The password field is required.", $json['errors']['password'][0]);
         $this->assertCount(2, $json);
 
         // Test access by user not being a wallet controller
         $post = ['first_name' => 'Test'];
         $response = $this->actingAs($jack)->post("/api/v4/users", $post);
         $json = $response->json();
 
         $response->assertStatus(403);
 
         $this->assertSame('error', $json['status']);
         $this->assertSame("Access denied", $json['message']);
         $this->assertCount(2, $json);
 
         // Test some invalid data
         $post = ['password' => '12345678', 'email' => 'invalid'];
         $response = $this->actingAs($john)->post("/api/v4/users", $post);
         $response->assertStatus(422);
 
         $json = $response->json();
 
         $this->assertSame('error', $json['status']);
         $this->assertCount(2, $json);
         $this->assertSame('The password confirmation does not match.', $json['errors']['password'][0]);
         $this->assertSame('The specified email is invalid.', $json['errors']['email']);
 
         // Test existing user email
         $post = [
             'password' => 'simple',
             'password_confirmation' => 'simple',
             'first_name' => 'John2',
             'last_name' => 'Doe2',
             'email' => 'jack.daniels@kolab.org',
         ];
 
         $response = $this->actingAs($john)->post("/api/v4/users", $post);
         $response->assertStatus(422);
 
         $json = $response->json();
 
         $this->assertSame('error', $json['status']);
         $this->assertCount(2, $json);
         $this->assertSame('The specified email is not available.', $json['errors']['email']);
 
         $package_kolab = \App\Package::where('title', 'kolab')->first();
         $package_domain = \App\Package::where('title', 'domain-hosting')->first();
 
         $post = [
             'password' => 'simple',
             'password_confirmation' => 'simple',
             'first_name' => 'John2',
             'last_name' => 'Doe2',
             'email' => 'john2.doe2@kolab.org',
             'aliases' => ['useralias1@kolab.org', 'useralias2@kolab.org'],
         ];
 
         // Missing package
         $response = $this->actingAs($john)->post("/api/v4/users", $post);
         $json = $response->json();
 
         $response->assertStatus(422);
 
         $this->assertSame('error', $json['status']);
         $this->assertSame("Package is required.", $json['errors']['package']);
         $this->assertCount(2, $json);
 
         // Invalid package
         $post['package'] = $package_domain->id;
         $response = $this->actingAs($john)->post("/api/v4/users", $post);
         $json = $response->json();
 
         $response->assertStatus(422);
 
         $this->assertSame('error', $json['status']);
         $this->assertSame("Invalid package selected.", $json['errors']['package']);
         $this->assertCount(2, $json);
 
         // Test full and valid data
         $post['package'] = $package_kolab->id;
         $response = $this->actingAs($john)->post("/api/v4/users", $post);
         $json = $response->json();
 
         $response->assertStatus(200);
 
         $this->assertSame('success', $json['status']);
         $this->assertSame("User created successfully.", $json['message']);
         $this->assertCount(2, $json);
 
         $user = User::where('email', 'john2.doe2@kolab.org')->first();
         $this->assertInstanceOf(User::class, $user);
         $this->assertSame('John2', $user->getSetting('first_name'));
         $this->assertSame('Doe2', $user->getSetting('last_name'));
         $aliases = $user->aliases()->orderBy('alias')->get();
         $this->assertCount(2, $aliases);
         $this->assertSame('useralias1@kolab.org', $aliases[0]->alias);
         $this->assertSame('useralias2@kolab.org', $aliases[1]->alias);
         // Assert the new user entitlements
         $this->assertUserEntitlements($user, ['groupware', 'mailbox', 'storage', 'storage']);
         // Assert the wallet to which the new user should be assigned to
         $wallet = $user->wallet();
         $this->assertSame($john->wallets()->first()->id, $wallet->id);
 
         // Test acting as account controller (not owner)
         /*
         // FIXME: How do we know to which wallet the new user should be assigned to?
 
         $this->deleteTestUser('john2.doe2@kolab.org');
         $response = $this->actingAs($ned)->post("/api/v4/users", $post);
         $json = $response->json();
 
         $response->assertStatus(200);
 
         $this->assertSame('success', $json['status']);
         */
 
         $this->markTestIncomplete();
     }
 
     /**
      * Test user update (PUT /api/v4/users/<user-id>)
      */
     public function testUpdate(): void
     {
         $userA = $this->getTestUser('UsersControllerTest1@userscontroller.com');
         $jack = $this->getTestUser('jack@kolab.org');
         $john = $this->getTestUser('john@kolab.org');
         $ned = $this->getTestUser('ned@kolab.org');
         $domain = $this->getTestDomain(
             'userscontroller.com',
             ['status' => Domain::STATUS_NEW, 'type' => Domain::TYPE_EXTERNAL]
         );
 
         // Test unauthorized update of other user profile
         $response = $this->actingAs($jack)->get("/api/v4/users/{$userA->id}", []);
         $response->assertStatus(403);
 
         // Test authorized update of account owner by account controller
         $response = $this->actingAs($ned)->get("/api/v4/users/{$john->id}", []);
         $response->assertStatus(200);
 
         // Test updating of self (empty request)
         $response = $this->actingAs($userA)->put("/api/v4/users/{$userA->id}", []);
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertSame('success', $json['status']);
         $this->assertSame("User data updated successfully.", $json['message']);
         $this->assertCount(2, $json);
 
         // Test some invalid data
         $post = ['password' => '12345678', 'currency' => 'invalid'];
         $response = $this->actingAs($userA)->put("/api/v4/users/{$userA->id}", $post);
         $response->assertStatus(422);
 
         $json = $response->json();
 
         $this->assertSame('error', $json['status']);
         $this->assertCount(2, $json);
         $this->assertSame('The password confirmation does not match.', $json['errors']['password'][0]);
         $this->assertSame('The currency must be 3 characters.', $json['errors']['currency'][0]);
 
         // Test full profile update including password
         $post = [
             'password' => 'simple',
             'password_confirmation' => 'simple',
             'first_name' => 'John2',
             'last_name' => 'Doe2',
             'phone' => '+123 123 123',
             'external_email' => 'external@gmail.com',
             'billing_address' => 'billing',
             'country' => 'CH',
             'currency' => 'CHF',
             'aliases' => ['useralias1@' . \config('app.domain'), 'useralias2@' . \config('app.domain')]
         ];
 
         $response = $this->actingAs($userA)->put("/api/v4/users/{$userA->id}", $post);
         $json = $response->json();
 
         $response->assertStatus(200);
 
         $this->assertSame('success', $json['status']);
         $this->assertSame("User data updated successfully.", $json['message']);
         $this->assertCount(2, $json);
         $this->assertTrue($userA->password != $userA->fresh()->password);
         unset($post['password'], $post['password_confirmation'], $post['aliases']);
         foreach ($post as $key => $value) {
             $this->assertSame($value, $userA->getSetting($key));
         }
         $aliases = $userA->aliases()->orderBy('alias')->get();
         $this->assertCount(2, $aliases);
         $this->assertSame('useralias1@' . \config('app.domain'), $aliases[0]->alias);
         $this->assertSame('useralias2@' . \config('app.domain'), $aliases[1]->alias);
 
         // Test unsetting values
         $post = [
             'first_name' => '',
             'last_name' => '',
             'phone' => '',
             'external_email' => '',
             'billing_address' => '',
             'country' => '',
             'currency' => '',
             'aliases' => ['useralias2@' . \config('app.domain')]
         ];
 
         $response = $this->actingAs($userA)->put("/api/v4/users/{$userA->id}", $post);
         $json = $response->json();
 
         $response->assertStatus(200);
 
         $this->assertSame('success', $json['status']);
         $this->assertSame("User data updated successfully.", $json['message']);
         $this->assertCount(2, $json);
         unset($post['aliases']);
         foreach ($post as $key => $value) {
             $this->assertNull($userA->getSetting($key));
         }
         $aliases = $userA->aliases()->get();
         $this->assertCount(1, $aliases);
         $this->assertSame('useralias2@' . \config('app.domain'), $aliases[0]->alias);
 
         // Test error on setting an alias to other user's domain
         // and missing password confirmation
         $post = [
             'password' => 'simple123',
             'aliases' => ['useralias2@' . \config('app.domain'), 'useralias1@kolab.org']
         ];
 
         $response = $this->actingAs($userA)->put("/api/v4/users/{$userA->id}", $post);
         $json = $response->json();
 
         $response->assertStatus(422);
 
         $this->assertSame('error', $json['status']);
         $this->assertCount(2, $json['errors']);
         $this->assertCount(1, $json['errors']['aliases']);
         $this->assertSame("The specified domain is not available.", $json['errors']['aliases'][1]);
         $this->assertSame("The password confirmation does not match.", $json['errors']['password'][0]);
 
         // Test authorized update of other user
         $response = $this->actingAs($ned)->get("/api/v4/users/{$jack->id}", []);
         $response->assertStatus(200);
 
         // TODO: Test error on aliases with invalid/non-existing/other-user's domain
 
         // Create entitlements and additional user for following tests
         $owner = $this->getTestUser('UsersControllerTest1@userscontroller.com');
         $user = $this->getTestUser('UsersControllerTest2@userscontroller.com');
         $package_domain = Package::where('title', 'domain-hosting')->first();
         $package_kolab = Package::where('title', 'kolab')->first();
         $package_lite = Package::where('title', 'lite')->first();
         $sku_mailbox = Sku::where('title', 'mailbox')->first();
         $sku_storage = Sku::where('title', 'storage')->first();
         $sku_groupware = Sku::where('title', 'groupware')->first();
 
         $domain = $this->getTestDomain(
             'userscontroller.com',
             [
                 'status' => Domain::STATUS_NEW,
                 'type' => Domain::TYPE_EXTERNAL,
             ]
         );
 
         $domain->assignPackage($package_domain, $owner);
         $owner->assignPackage($package_kolab);
         $owner->assignPackage($package_lite, $user);
 
         // Non-controller cannot update his own entitlements
         $post = ['skus' => []];
         $response = $this->actingAs($user)->put("/api/v4/users/{$user->id}", $post);
         $response->assertStatus(422);
 
         // Test updating entitlements
         $post = [
             'skus' => [
                 $sku_mailbox->id => 1,
                 $sku_storage->id => 3,
                 $sku_groupware->id => 1,
             ],
         ];
 
         $response = $this->actingAs($owner)->put("/api/v4/users/{$user->id}", $post);
         $response->assertStatus(200);
 
         $storage_cost = $user->entitlements()
             ->where('sku_id', $sku_storage->id)
             ->orderBy('cost')
             ->pluck('cost')->all();
 
         $this->assertUserEntitlements($user, ['groupware', 'mailbox', 'storage', 'storage', 'storage']);
         $this->assertSame([0, 0, 25], $storage_cost);
     }
 
     /**
      * Test UsersController::updateEntitlements()
      */
     public function testUpdateEntitlements(): void
     {
         // TODO: Test more cases of entitlements update
         $this->markTestIncomplete();
     }
 
     /**
      * List of alias validation cases for testValidateEmail()
      *
      * @return array Arguments for testValidateEmail()
      */
     public function dataValidateEmail(): array
     {
         $this->refreshApplication();
         $public_domains = Domain::getPublicDomains();
         $domain = reset($public_domains);
 
         $john = $this->getTestUser('john@kolab.org');
         $jack = $this->getTestUser('jack@kolab.org');
         $user = $this->getTestUser('UsersControllerTest1@userscontroller.com');
 
         return [
             // Invalid format
             ["$domain", $john, true, 'The specified alias is invalid.'],
             [".@$domain", $john, true, 'The specified alias is invalid.'],
             ["test123456@localhost", $john, true, 'The specified domain is invalid.'],
             ["test123456@unknown-domain.org", $john, true, 'The specified domain is invalid.'],
 
             ["$domain", $john, false, 'The specified email is invalid.'],
             [".@$domain", $john, false, 'The specified email is invalid.'],
 
             // forbidden local part on public domains
             ["admin@$domain", $john, true, 'The specified alias is not available.'],
             ["administrator@$domain", $john, true, 'The specified alias is not available.'],
 
             // forbidden (other user's domain)
             ["testtest@kolab.org", $user, true, 'The specified domain is not available.'],
 
             // existing alias of other user
             ["jack.daniels@kolab.org", $john, true, 'The specified alias is not available.'],
 
             // existing user
             ["jack@kolab.org", $john, true, 'The specified alias is not available.'],
 
             // valid (user domain)
             ["admin@kolab.org", $john, true, null],
 
             // valid (public domain)
             ["test.test@$domain", $john, true, null],
         ];
     }
 
     /**
      * User email/alias validation.
      *
      * Note: Technically these include unit tests, but let's keep it here for now.
      * FIXME: Shall we do a http request for each case?
      *
      * @dataProvider dataValidateEmail
      */
     public function testValidateEmail($alias, $user, $is_alias, $expected_result): void
     {
         $result = $this->invokeMethod(new UsersController(), 'validateEmail', [$alias, $user, $is_alias]);
 
         $this->assertSame($expected_result, $result);
     }
 }
diff --git a/src/tests/Feature/EntitlementTest.php b/src/tests/Feature/EntitlementTest.php
index 8bd655c0..cd6c8592 100644
--- a/src/tests/Feature/EntitlementTest.php
+++ b/src/tests/Feature/EntitlementTest.php
@@ -1,107 +1,108 @@
 <?php
 
 namespace Tests\Feature;
 
+use App\Auth\SecondFactor;
 use App\Domain;
 use App\Entitlement;
 use App\Package;
 use App\Sku;
 use App\User;
 use Carbon\Carbon;
 use Tests\TestCase;
 
 class EntitlementTest extends TestCase
 {
 
     public function setUp(): void
     {
         parent::setUp();
 
         $this->deleteTestUser('entitlement-test@kolabnow.com');
         $this->deleteTestUser('entitled-user@custom-domain.com');
         $this->deleteTestDomain('custom-domain.com');
     }
 
     public function tearDown(): void
     {
         $this->deleteTestUser('entitlement-test@kolabnow.com');
         $this->deleteTestUser('entitled-user@custom-domain.com');
         $this->deleteTestDomain('custom-domain.com');
 
         parent::tearDown();
     }
 
     /**
      * Tests for User::AddEntitlement()
      */
     public function testUserAddEntitlement(): void
     {
         $package_domain = Package::where('title', 'domain-hosting')->first();
         $package_kolab = Package::where('title', 'kolab')->first();
 
         $sku_domain = Sku::where('title', 'domain-hosting')->first();
         $sku_mailbox = Sku::where('title', 'mailbox')->first();
 
         $owner = $this->getTestUser('entitlement-test@kolabnow.com');
         $user = $this->getTestUser('entitled-user@custom-domain.com');
 
         $domain = $this->getTestDomain(
             'custom-domain.com',
             [
                 'status' => Domain::STATUS_NEW,
                 'type' => Domain::TYPE_EXTERNAL,
             ]
         );
 
         $domain->assignPackage($package_domain, $owner);
 
         $owner->assignPackage($package_kolab);
         $owner->assignPackage($package_kolab, $user);
 
         $wallet = $owner->wallets->first();
 
         $this->assertCount(4, $owner->entitlements()->get());
         $this->assertCount(1, $sku_domain->entitlements()->where('wallet_id', $wallet->id)->get());
         $this->assertCount(2, $sku_mailbox->entitlements()->where('wallet_id', $wallet->id)->get());
         $this->assertCount(9, $wallet->entitlements);
 
         $this->backdateEntitlements($owner->entitlements, Carbon::now()->subMonths(1));
 
         $wallet->chargeEntitlements();
 
         $this->assertTrue($wallet->fresh()->balance < 0);
     }
 
     public function testAddExistingEntitlement(): void
     {
         $this->markTestIncomplete();
     }
 
     public function testEntitlementFunctions(): void
     {
         $user = $this->getTestUser('entitlement-test@kolabnow.com');
 
         $package = \App\Package::where('title', 'kolab')->first();
 
         $user->assignPackage($package);
 
         $wallet = $user->wallets()->first();
         $this->assertNotNull($wallet);
 
         $sku = \App\Sku::where('title', 'mailbox')->first();
         $this->assertNotNull($sku);
 
         $entitlement = Entitlement::where('wallet_id', $wallet->id)->where('sku_id', $sku->id)->first();
         $this->assertNotNull($entitlement);
 
         $e_sku = $entitlement->sku;
         $this->assertSame($sku->id, $e_sku->id);
 
         $e_wallet = $entitlement->wallet;
         $this->assertSame($wallet->id, $e_wallet->id);
 
         $e_entitleable = $entitlement->entitleable;
         $this->assertEquals($user->id, $e_entitleable->id);
         $this->assertTrue($e_entitleable instanceof \App\User);
     }
 }