Merge commit from fork

* fix(crypto): use authenticated encryption for IDP intent tokens

IDP intent tokens were encrypted with AES-CFB which provides no
integrity protection, making them malleable. Switch to A256GCM via
the existing AuthAlgorithm interface (EncryptToken/DecryptToken),
the same approach already used for OIDC and session tokens.

The idpConfigEncryption key type is widened from EncryptionAlgorithm
to AuthEncryptionAlgorithm so that data-at-rest encryption (IDP
client secrets, LDAP bind passwords, SAML keys) continues to use
the CFB path unmodified.

Co-authored-by: Cursor <[email protected]>

* fix(proto): raise IDP intent token max length to 500 for authenticated tokens

The switch to authenticated A256GCM (JWE compact serialization) makes IDP
intent tokens longer (~270 chars) than the previous AES-CFB base64 output.
Raise the max_len/max_length validation and OpenAPI constraints on every
idp_intent_token field from 200 to 500 so the new tokens are accepted:
user v2/v2beta (idp + user_service), session v2/v2beta, and resources
user v3alpha.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

---------

Co-authored-by: Cursor <[email protected]>
Co-authored-by: Claude Opus 4.8 <[email protected]>

backend/v3/domain/defaults.go

@@ -13,7 +13,7 @@ var (
 	legacyEventstore              eventstore.LegacyEventstore
 	sysConfig                     systemdefaults.SystemDefaults
 	passwordHasher                *crypto.Hasher
-	idpEncryptionAlgo             crypto.EncryptionAlgorithm
+	idpEncryptionAlgo             crypto.AuthEncryptionAlgorithm
 	sessionTokenDecryptor         SessionTokenDecryptor
 	mfaEncryptionAlgo             crypto.EncryptionAlgorithm
 	otpSMSSecretGeneratorConfig   *crypto.GeneratorConfig
@@ -37,7 +37,7 @@ func SetPasswordHasher(hasher *crypto.Hasher) {
 	passwordHasher = hasher
 }
 
-func SetIDPEncryptionAlgorithm(idpEncryptionAlg crypto.EncryptionAlgorithm) {
+func SetIDPEncryptionAlgorithm(idpEncryptionAlg crypto.AuthEncryptionAlgorithm) {
 	idpEncryptionAlgo = idpEncryptionAlg
 }
 

backend/v3/domain/session_check_idp_intent.go

@@ -22,7 +22,7 @@ type IDPIntentCheckCommand struct {
 
 	SessionID  string
 	InstanceID string
-	EncAlgo    crypto.EncryptionAlgorithm
+	EncAlgo    crypto.AuthEncryptionAlgorithm
 
 	FetchedUser        User
 	IsCheckComplete    bool
@@ -32,7 +32,7 @@ type IDPIntentCheckCommand struct {
 // NewIDPIntentCheckCommand returns an IDPIntentCheckCommand initialized with the input values.
 //
 // If encryptionAlgo is nil, the default [crypto.EncryptionAlgorithm] will be used
-func NewIDPIntentCheckCommand(request *CheckIDPIntentType, sessionID, instanceID string, encryptionAlgo crypto.EncryptionAlgorithm) *IDPIntentCheckCommand {
+func NewIDPIntentCheckCommand(request *CheckIDPIntentType, sessionID, instanceID string, encryptionAlgo crypto.AuthEncryptionAlgorithm) *IDPIntentCheckCommand {
 	idpCheckCommand := &IDPIntentCheckCommand{
 		CheckIntent: request,
 		SessionID:   sessionID,

backend/v3/domain/session_check_idp_intent_test.go

@@ -101,7 +101,7 @@ func TestIDPIntentCheckCommand_Validate(t *testing.T) {
 		sessionRepo         func(ctrl *gomock.Controller) domain.SessionRepository
 		idpIntentRepo       func(ctrl *gomock.Controller) domain.IDPIntentRepository
 		userRepo            func(ctrl *gomock.Controller) domain.UserRepository
-		encryptionAlgorithm func(ctrl *gomock.Controller) crypto.EncryptionAlgorithm
+		encryptionAlgorithm func(ctrl *gomock.Controller) crypto.AuthEncryptionAlgorithm
 		cmd                 *domain.IDPIntentCheckCommand
 		expectedError       error
 		expectedUser        domain.User
@@ -191,13 +191,10 @@ func TestIDPIntentCheckCommand_Validate(t *testing.T) {
 					Return(&domain.Session{ID: "session-1", UserID: "user-1"}, nil)
 				return repo
 			},
-			encryptionAlgorithm: func(ctrl *gomock.Controller) crypto.EncryptionAlgorithm {
-				cryptoAlg := crypto.NewMockEncryptionAlgorithm(ctrl)
+			encryptionAlgorithm: func(ctrl *gomock.Controller) crypto.AuthEncryptionAlgorithm {
+				cryptoAlg := crypto.NewMockAuthEncryptionAlgorithm(ctrl)
 				cryptoAlg.EXPECT().
-					EncryptionKeyID().
-					Times(1)
-				cryptoAlg.EXPECT().
-					DecryptString(gomock.Any(), gomock.Any()).
+					DecryptToken(gomock.Any()).
 					Times(1).
 					Return("", decryptionError)
 				return cryptoAlg
@@ -218,13 +215,10 @@ func TestIDPIntentCheckCommand_Validate(t *testing.T) {
 					Return(&domain.Session{ID: "session-1", UserID: "user-1"}, nil)
 				return repo
 			},
-			encryptionAlgorithm: func(ctrl *gomock.Controller) crypto.EncryptionAlgorithm {
-				cryptoAlg := crypto.NewMockEncryptionAlgorithm(ctrl)
+			encryptionAlgorithm: func(ctrl *gomock.Controller) crypto.AuthEncryptionAlgorithm {
+				cryptoAlg := crypto.NewMockAuthEncryptionAlgorithm(ctrl)
 				cryptoAlg.EXPECT().
-					EncryptionKeyID().
-					Times(1)
-				cryptoAlg.EXPECT().
-					DecryptString(gomock.Any(), gomock.Any()).
+					DecryptToken(gomock.Any()).
 					Times(1).
 					Return("intent-123", nil)
 				return cryptoAlg
@@ -252,13 +246,10 @@ func TestIDPIntentCheckCommand_Validate(t *testing.T) {
 					Return(&domain.Session{ID: "session-1", UserID: "user-1"}, nil)
 				return repo
 			},
-			encryptionAlgorithm: func(ctrl *gomock.Controller) crypto.EncryptionAlgorithm {
-				cryptoAlg := crypto.NewMockEncryptionAlgorithm(ctrl)
+			encryptionAlgorithm: func(ctrl *gomock.Controller) crypto.AuthEncryptionAlgorithm {
+				cryptoAlg := crypto.NewMockAuthEncryptionAlgorithm(ctrl)
 				cryptoAlg.EXPECT().
-					EncryptionKeyID().
-					Times(1)
-				cryptoAlg.EXPECT().
-					DecryptString(gomock.Any(), gomock.Any()).
+					DecryptToken(gomock.Any()).
 					Times(1).
 					Return("intent-123", nil)
 				return cryptoAlg
@@ -286,13 +277,10 @@ func TestIDPIntentCheckCommand_Validate(t *testing.T) {
 					Return(&domain.Session{ID: "session-1", UserID: "user-1"}, nil)
 				return repo
 			},
-			encryptionAlgorithm: func(ctrl *gomock.Controller) crypto.EncryptionAlgorithm {
-				cryptoAlg := crypto.NewMockEncryptionAlgorithm(ctrl)
+			encryptionAlgorithm: func(ctrl *gomock.Controller) crypto.AuthEncryptionAlgorithm {
+				cryptoAlg := crypto.NewMockAuthEncryptionAlgorithm(ctrl)
 				cryptoAlg.EXPECT().
-					EncryptionKeyID().
-					Times(1)
-				cryptoAlg.EXPECT().
-					DecryptString(gomock.Any(), gomock.Any()).
+					DecryptToken(gomock.Any()).
 					Times(1).
 					Return("intent-123", nil)
 				return cryptoAlg
@@ -320,13 +308,10 @@ func TestIDPIntentCheckCommand_Validate(t *testing.T) {
 					Return(&domain.Session{ID: "session-1", UserID: "user-1"}, nil)
 				return repo
 			},
-			encryptionAlgorithm: func(ctrl *gomock.Controller) crypto.EncryptionAlgorithm {
-				cryptoAlg := crypto.NewMockEncryptionAlgorithm(ctrl)
+			encryptionAlgorithm: func(ctrl *gomock.Controller) crypto.AuthEncryptionAlgorithm {
+				cryptoAlg := crypto.NewMockAuthEncryptionAlgorithm(ctrl)
 				cryptoAlg.EXPECT().
-					EncryptionKeyID().
-					Times(1)
-				cryptoAlg.EXPECT().
-					DecryptString(gomock.Any(), gomock.Any()).
+					DecryptToken(gomock.Any()).
 					Times(1).
 					Return("intent-123", nil)
 				return cryptoAlg
@@ -354,13 +339,10 @@ func TestIDPIntentCheckCommand_Validate(t *testing.T) {
 					Return(&domain.Session{ID: "session-1", UserID: "user-1"}, nil)
 				return repo
 			},
-			encryptionAlgorithm: func(ctrl *gomock.Controller) crypto.EncryptionAlgorithm {
-				cryptoAlg := crypto.NewMockEncryptionAlgorithm(ctrl)
+			encryptionAlgorithm: func(ctrl *gomock.Controller) crypto.AuthEncryptionAlgorithm {
+				cryptoAlg := crypto.NewMockAuthEncryptionAlgorithm(ctrl)
 				cryptoAlg.EXPECT().
-					EncryptionKeyID().
-					Times(1)
-				cryptoAlg.EXPECT().
-					DecryptString(gomock.Any(), gomock.Any()).
+					DecryptToken(gomock.Any()).
 					Times(1).
 					Return("intent-123", nil)
 				return cryptoAlg
@@ -388,13 +370,10 @@ func TestIDPIntentCheckCommand_Validate(t *testing.T) {
 					Return(&domain.Session{ID: "session-1", UserID: "user-1"}, nil)
 				return repo
 			},
-			encryptionAlgorithm: func(ctrl *gomock.Controller) crypto.EncryptionAlgorithm {
-				cryptoAlg := crypto.NewMockEncryptionAlgorithm(ctrl)
+			encryptionAlgorithm: func(ctrl *gomock.Controller) crypto.AuthEncryptionAlgorithm {
+				cryptoAlg := crypto.NewMockAuthEncryptionAlgorithm(ctrl)
 				cryptoAlg.EXPECT().
-					EncryptionKeyID().
-					Times(1)
-				cryptoAlg.EXPECT().
-					DecryptString(gomock.Any(), gomock.Any()).
+					DecryptToken(gomock.Any()).
 					Times(1).
 					Return("intent-123", nil)
 				return cryptoAlg
@@ -429,13 +408,10 @@ func TestIDPIntentCheckCommand_Validate(t *testing.T) {
 					Return(&domain.Session{ID: "session-1", UserID: "user-1"}, nil)
 				return repo
 			},
-			encryptionAlgorithm: func(ctrl *gomock.Controller) crypto.EncryptionAlgorithm {
-				cryptoAlg := crypto.NewMockEncryptionAlgorithm(ctrl)
+			encryptionAlgorithm: func(ctrl *gomock.Controller) crypto.AuthEncryptionAlgorithm {
+				cryptoAlg := crypto.NewMockAuthEncryptionAlgorithm(ctrl)
 				cryptoAlg.EXPECT().
-					EncryptionKeyID().
-					Times(1)
-				cryptoAlg.EXPECT().
-					DecryptString(gomock.Any(), gomock.Any()).
+					DecryptToken(gomock.Any()).
 					Times(1).
 					Return("intent-123", nil)
 				return cryptoAlg
@@ -470,13 +446,10 @@ func TestIDPIntentCheckCommand_Validate(t *testing.T) {
 					Return(&domain.Session{ID: "session-1", UserID: "user-1"}, nil)
 				return repo
 			},
-			encryptionAlgorithm: func(ctrl *gomock.Controller) crypto.EncryptionAlgorithm {
-				cryptoAlg := crypto.NewMockEncryptionAlgorithm(ctrl)
+			encryptionAlgorithm: func(ctrl *gomock.Controller) crypto.AuthEncryptionAlgorithm {
+				cryptoAlg := crypto.NewMockAuthEncryptionAlgorithm(ctrl)
 				cryptoAlg.EXPECT().
-					EncryptionKeyID().
-					Times(1)
-				cryptoAlg.EXPECT().
-					DecryptString(gomock.Any(), gomock.Any()).
+					DecryptToken(gomock.Any()).
 					Times(1).
 					Return("intent-123", nil)
 				return cryptoAlg
@@ -511,13 +484,10 @@ func TestIDPIntentCheckCommand_Validate(t *testing.T) {
 					Return(&domain.Session{ID: "session-1", UserID: "user-1"}, nil)
 				return repo
 			},
-			encryptionAlgorithm: func(ctrl *gomock.Controller) crypto.EncryptionAlgorithm {
-				cryptoAlg := crypto.NewMockEncryptionAlgorithm(ctrl)
+			encryptionAlgorithm: func(ctrl *gomock.Controller) crypto.AuthEncryptionAlgorithm {
+				cryptoAlg := crypto.NewMockAuthEncryptionAlgorithm(ctrl)
 				cryptoAlg.EXPECT().
-					EncryptionKeyID().
-					Times(1)
-				cryptoAlg.EXPECT().
-					DecryptString(gomock.Any(), gomock.Any()).
+					DecryptToken(gomock.Any()).
 					Times(1).
 					Return("intent-123", nil)
 				return cryptoAlg
@@ -565,13 +535,10 @@ func TestIDPIntentCheckCommand_Validate(t *testing.T) {
 					Return(&domain.Session{ID: "session-1", UserID: "user-1"}, nil)
 				return repo
 			},
-			encryptionAlgorithm: func(ctrl *gomock.Controller) crypto.EncryptionAlgorithm {
-				cryptoAlg := crypto.NewMockEncryptionAlgorithm(ctrl)
+			encryptionAlgorithm: func(ctrl *gomock.Controller) crypto.AuthEncryptionAlgorithm {
+				cryptoAlg := crypto.NewMockAuthEncryptionAlgorithm(ctrl)
 				cryptoAlg.EXPECT().
-					EncryptionKeyID().
-					Times(1)
-				cryptoAlg.EXPECT().
-					DecryptString(gomock.Any(), gomock.Any()).
+					DecryptToken(gomock.Any()).
 					Times(1).
 					Return("intent-123", nil)
 				return cryptoAlg
@@ -610,13 +577,10 @@ func TestIDPIntentCheckCommand_Validate(t *testing.T) {
 					Return(&domain.Session{ID: "session-1", UserID: "user-1"}, nil)
 				return repo
 			},
-			encryptionAlgorithm: func(ctrl *gomock.Controller) crypto.EncryptionAlgorithm {
-				cryptoAlg := crypto.NewMockEncryptionAlgorithm(ctrl)
+			encryptionAlgorithm: func(ctrl *gomock.Controller) crypto.AuthEncryptionAlgorithm {
+				cryptoAlg := crypto.NewMockAuthEncryptionAlgorithm(ctrl)
 				cryptoAlg.EXPECT().
-					EncryptionKeyID().
-					Times(1)
-				cryptoAlg.EXPECT().
-					DecryptString(gomock.Any(), gomock.Any()).
+					DecryptToken(gomock.Any()).
 					Times(1).
 					Return("intent-123", nil)
 				return cryptoAlg
@@ -655,13 +619,10 @@ func TestIDPIntentCheckCommand_Validate(t *testing.T) {
 					Return(&domain.Session{ID: "session-1", UserID: "user-1"}, nil)
 				return repo
 			},
-			encryptionAlgorithm: func(ctrl *gomock.Controller) crypto.EncryptionAlgorithm {
-				cryptoAlg := crypto.NewMockEncryptionAlgorithm(ctrl)
+			encryptionAlgorithm: func(ctrl *gomock.Controller) crypto.AuthEncryptionAlgorithm {
+				cryptoAlg := crypto.NewMockAuthEncryptionAlgorithm(ctrl)
 				cryptoAlg.EXPECT().
-					EncryptionKeyID().
-					Times(1)
-				cryptoAlg.EXPECT().
-					DecryptString(gomock.Any(), gomock.Any()).
+					DecryptToken(gomock.Any()).
 					Times(1).
 					Return("intent-123", nil)
 				return cryptoAlg

cmd/encryption/encryption_keys.go

@@ -39,7 +39,7 @@ type EncryptionKeyConfig struct {
 
 type EncryptionKeys struct {
 	DomainVerification crypto.EncryptionAlgorithm
-	IDPConfig          crypto.EncryptionAlgorithm
+	IDPConfig          crypto.AuthEncryptionAlgorithm
 	OIDC               crypto.AuthEncryptionAlgorithm
 	SAML               crypto.EncryptionAlgorithm
 	OTP                crypto.EncryptionAlgorithm

internal/api/grpc/user/v2/intent.go

@@ -237,7 +237,7 @@ func unmarshalIdpUser(idpUserData []byte, idpUser idp.User) (idp.User, error) {
 	return idpUser, nil
 }
 
-func idpIntentToIDPIntentPb(intent *command.IDPIntentWriteModel, alg crypto.EncryptionAlgorithm) (_ *user.RetrieveIdentityProviderIntentResponse, err error) {
+func idpIntentToIDPIntentPb(intent *command.IDPIntentWriteModel, alg crypto.AuthEncryptionAlgorithm) (_ *user.RetrieveIdentityProviderIntentResponse, err error) {
 	rawInformation := new(structpb.Struct)
 	err = rawInformation.UnmarshalJSON(intent.IDPUser)
 	if err != nil {
@@ -279,7 +279,7 @@ func idpIntentToIDPIntentPb(intent *command.IDPIntentWriteModel, alg crypto.Encr
 	return information, nil
 }
 
-func idpOAuthTokensToPb(idpIDToken string, idpAccessToken, idpRefreshToken *crypto.CryptoValue, alg crypto.EncryptionAlgorithm) (_ *user.IDPInformation_Oauth, err error) {
+func idpOAuthTokensToPb(idpIDToken string, idpAccessToken, idpRefreshToken *crypto.CryptoValue, alg crypto.AuthEncryptionAlgorithm) (_ *user.IDPInformation_Oauth, err error) {
 	var idToken *string
 	if idpIDToken != "" {
 		idToken = &idpIDToken

internal/api/grpc/user/v2/server.go

@@ -25,7 +25,7 @@ type Server struct {
 	command        *command.Commands
 	query          *query.Queries
 	userCodeAlg    crypto.EncryptionAlgorithm
-	idpAlg         crypto.EncryptionAlgorithm
+	idpAlg         crypto.AuthEncryptionAlgorithm
 	idpCallback    func(ctx context.Context) string
 	samlRootURL    func(ctx context.Context, idpID string) string
 
@@ -41,7 +41,7 @@ func CreateServer(
 	query *query.Queries,
 	systemDefaults systemdefaults.SystemDefaults,
 	userCodeAlg crypto.EncryptionAlgorithm,
-	idpAlg crypto.EncryptionAlgorithm,
+	idpAlg crypto.AuthEncryptionAlgorithm,
 	idpCallback func(ctx context.Context) string,
 	samlRootURL func(ctx context.Context, idpID string) string,
 	assetAPIPrefix func(ctx context.Context) string,

internal/api/grpc/user/v2/user_test.go

@@ -21,8 +21,8 @@ import (
 )
 
 func Test_idpIntentToIDPIntentPb(t *testing.T) {
-	decryption := func(err error) crypto.EncryptionAlgorithm {
-		mCrypto := crypto.NewMockEncryptionAlgorithm(gomock.NewController(t))
+	decryption := func(err error) crypto.AuthEncryptionAlgorithm {
+		mCrypto := crypto.NewMockAuthEncryptionAlgorithm(gomock.NewController(t))
 		mCrypto.EXPECT().Algorithm().Return("enc")
 		mCrypto.EXPECT().DecryptionKeyIDs().Return([]string{"id"})
 		mCrypto.EXPECT().DecryptString(gomock.Any(), gomock.Any()).DoAndReturn(
@@ -37,7 +37,7 @@ func Test_idpIntentToIDPIntentPb(t *testing.T) {
 
 	type args struct {
 		intent *command.IDPIntentWriteModel
-		alg    crypto.EncryptionAlgorithm
+		alg    crypto.AuthEncryptionAlgorithm
 	}
 	type res struct {
 		resp *user.RetrieveIdentityProviderIntentResponse

internal/api/grpc/user/v2beta/server.go

@@ -23,7 +23,7 @@ type Server struct {
 	command     *command.Commands
 	query       *query.Queries
 	userCodeAlg crypto.EncryptionAlgorithm
-	idpAlg      crypto.EncryptionAlgorithm
+	idpAlg      crypto.AuthEncryptionAlgorithm
 	idpCallback func(ctx context.Context) string
 	samlRootURL func(ctx context.Context, idpID string) string
 
@@ -38,7 +38,7 @@ func CreateServer(
 	command *command.Commands,
 	query *query.Queries,
 	userCodeAlg crypto.EncryptionAlgorithm,
-	idpAlg crypto.EncryptionAlgorithm,
+	idpAlg crypto.AuthEncryptionAlgorithm,
 	idpCallback func(ctx context.Context) string,
 	samlRootURL func(ctx context.Context, idpID string) string,
 	assetAPIPrefix func(ctx context.Context) string,

internal/api/grpc/user/v2beta/user.go

@@ -505,7 +505,7 @@ func (s *Server) RetrieveIdentityProviderIntent(ctx context.Context, req *connec
 	return idpIntentToIDPIntentPb(intent, s.idpAlg)
 }
 
-func idpIntentToIDPIntentPb(intent *command.IDPIntentWriteModel, alg crypto.EncryptionAlgorithm) (_ *connect.Response[user.RetrieveIdentityProviderIntentResponse], err error) {
+func idpIntentToIDPIntentPb(intent *command.IDPIntentWriteModel, alg crypto.AuthEncryptionAlgorithm) (_ *connect.Response[user.RetrieveIdentityProviderIntentResponse], err error) {
 	rawInformation := new(structpb.Struct)
 	err = rawInformation.UnmarshalJSON(intent.IDPUser)
 	if err != nil {
@@ -547,7 +547,7 @@ func idpIntentToIDPIntentPb(intent *command.IDPIntentWriteModel, alg crypto.Encr
 	return connect.NewResponse(information), nil
 }
 
-func idpOAuthTokensToPb(idpIDToken string, idpAccessToken, idpRefreshToken *crypto.CryptoValue, alg crypto.EncryptionAlgorithm) (_ *user.IDPInformation_Oauth, err error) {
+func idpOAuthTokensToPb(idpIDToken string, idpAccessToken, idpRefreshToken *crypto.CryptoValue, alg crypto.AuthEncryptionAlgorithm) (_ *user.IDPInformation_Oauth, err error) {
 	var idToken *string
 	if idpIDToken != "" {
 		idToken = &idpIDToken

internal/api/grpc/user/v2beta/user_test.go

@@ -22,8 +22,8 @@ import (
 )
 
 func Test_idpIntentToIDPIntentPb(t *testing.T) {
-	decryption := func(err error) crypto.EncryptionAlgorithm {
-		mCrypto := crypto.NewMockEncryptionAlgorithm(gomock.NewController(t))
+	decryption := func(err error) crypto.AuthEncryptionAlgorithm {
+		mCrypto := crypto.NewMockAuthEncryptionAlgorithm(gomock.NewController(t))
 		mCrypto.EXPECT().Algorithm().Return("enc")
 		mCrypto.EXPECT().DecryptionKeyIDs().Return([]string{"id"})
 		mCrypto.EXPECT().DecryptString(gomock.Any(), gomock.Any()).DoAndReturn(
@@ -38,7 +38,7 @@ func Test_idpIntentToIDPIntentPb(t *testing.T) {
 
 	type args struct {
 		intent *command.IDPIntentWriteModel
-		alg    crypto.EncryptionAlgorithm
+		alg    crypto.AuthEncryptionAlgorithm
 	}
 	type res struct {
 		resp *user.RetrieveIdentityProviderIntentResponse

internal/command/command.go

@@ -56,7 +56,7 @@ type Commands struct {
 	externalSecure bool
 	externalPort   uint16
 
-	idpConfigEncryption             crypto.EncryptionAlgorithm
+	idpConfigEncryption             crypto.AuthEncryptionAlgorithm
 	smtpEncryption                  crypto.EncryptionAlgorithm
 	smsEncryption                   crypto.EncryptionAlgorithm
 	userEncryption                  crypto.EncryptionAlgorithm
@@ -130,7 +130,8 @@ func StartCommands(
 	externalDomain string,
 	externalSecure bool,
 	externalPort uint16,
-	idpConfigEncryption, otpEncryption, smtpEncryption, smsEncryption, userEncryption, domainVerificationEncryption, samlEncryption, targetEncryption crypto.EncryptionAlgorithm,
+	idpConfigEncryption crypto.AuthEncryptionAlgorithm,
+	otpEncryption, smtpEncryption, smsEncryption, userEncryption, domainVerificationEncryption, samlEncryption, targetEncryption crypto.EncryptionAlgorithm,
 	oidcEncryption crypto.AuthEncryptionAlgorithm,
 	httpClient *http.Client,
 	permissionCheck domain.PermissionCheck,

internal/command/idp_intent.go

@@ -2,7 +2,6 @@ package command
 
 import (
 	"context"
-	"encoding/base64"
 	"encoding/json"
 	"encoding/xml"
 	"net/url"
@@ -241,11 +240,7 @@ func (c *Commands) RequestSAMLIDPIntent(ctx context.Context, writeModel *IDPInte
 }
 
 func (c *Commands) generateIntentToken(intentID string) (string, error) {
-	token, err := c.idpConfigEncryption.Encrypt([]byte(intentID))
-	if err != nil {
-		return "", err
-	}
-	return base64.RawURLEncoding.EncodeToString(token), nil
+	return c.idpConfigEncryption.EncryptToken(intentID)
 }
 
 func (c *Commands) SucceedLDAPIDPIntent(ctx context.Context, writeModel *IDPIntentWriteModel, idpUser idp.User, userID string, session *ldap.Session) (string, error) {

internal/command/idp_intent_test.go

@@ -428,7 +428,7 @@ func TestCommands_CreateIntent(t *testing.T) {
 func TestCommands_AuthFromProvider(t *testing.T) {
 	type fields struct {
 		eventstore   func(t *testing.T) *eventstore.Eventstore
-		secretCrypto crypto.EncryptionAlgorithm
+		secretCrypto crypto.AuthEncryptionAlgorithm
 		idGenerator  id.Generator
 	}
 	type args struct {
@@ -452,7 +452,7 @@ func TestCommands_AuthFromProvider(t *testing.T) {
 		{
 			"error no id generator",
 			fields{
-				secretCrypto: crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
+				secretCrypto: crypto.CreateMockAuthEncryptionAlg(gomock.NewController(t)),
 				eventstore:   expectEventstore(),
 				idGenerator:  mock.NewIDGeneratorExpectError(t, zerrors.ThrowInternal(nil, "", "error id")),
 			},
@@ -468,7 +468,7 @@ func TestCommands_AuthFromProvider(t *testing.T) {
 		{
 			"idp not existing",
 			fields{
-				secretCrypto: crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
+				secretCrypto: crypto.CreateMockAuthEncryptionAlg(gomock.NewController(t)),
 				eventstore: expectEventstore(
 					expectFilter(),
 				),
@@ -486,7 +486,7 @@ func TestCommands_AuthFromProvider(t *testing.T) {
 		{
 			"idp removed",
 			fields{
-				secretCrypto: crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
+				secretCrypto: crypto.CreateMockAuthEncryptionAlg(gomock.NewController(t)),
 				eventstore: expectEventstore(
 					expectFilter(
 						eventFromEventPusherWithInstanceID(
@@ -531,7 +531,7 @@ func TestCommands_AuthFromProvider(t *testing.T) {
 		{
 			"oauth auth redirect",
 			fields{
-				secretCrypto: crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
+				secretCrypto: crypto.CreateMockAuthEncryptionAlg(gomock.NewController(t)),
 				eventstore: expectEventstore(
 					expectFilter(
 						eventFromEventPusherWithInstanceID(
@@ -593,7 +593,7 @@ func TestCommands_AuthFromProvider(t *testing.T) {
 		{
 			"oauth auth redirect with login_hint",
 			fields{
-				secretCrypto: crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
+				secretCrypto: crypto.CreateMockAuthEncryptionAlg(gomock.NewController(t)),
 				eventstore: expectEventstore(
 					expectFilter(
 						eventFromEventPusherWithInstanceID(
@@ -656,7 +656,7 @@ func TestCommands_AuthFromProvider(t *testing.T) {
 		{
 			"migrated and push",
 			fields{
-				secretCrypto: crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
+				secretCrypto: crypto.CreateMockAuthEncryptionAlg(gomock.NewController(t)),
 				eventstore: expectEventstore(
 					expectFilter(
 						eventFromEventPusherWithInstanceID(
@@ -799,7 +799,7 @@ func assertRedirectAuthWithPKCE(t *testing.T, expected, actual idp.Auth) {
 func TestCommands_AuthFromProvider_SAML(t *testing.T) {
 	type fields struct {
 		eventstore   func(t *testing.T) *eventstore.Eventstore
-		secretCrypto crypto.EncryptionAlgorithm
+		secretCrypto crypto.AuthEncryptionAlgorithm
 		idGenerator  id.Generator
 	}
 	type args struct {
@@ -823,7 +823,7 @@ func TestCommands_AuthFromProvider_SAML(t *testing.T) {
 		{
 			"saml auth default redirect",
 			fields{
-				secretCrypto: crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
+				secretCrypto: crypto.CreateMockAuthEncryptionAlg(gomock.NewController(t)),
 				eventstore: expectEventstore(
 					expectFilter(
 						eventFromEventPusherWithInstanceID(
@@ -918,7 +918,7 @@ func TestCommands_AuthFromProvider_SAML(t *testing.T) {
 		{
 			"saml post auth",
 			fields{
-				secretCrypto: crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
+				secretCrypto: crypto.CreateMockAuthEncryptionAlg(gomock.NewController(t)),
 				eventstore: expectEventstore(
 					expectFilter(
 						eventFromEventPusherWithInstanceID(
@@ -1054,7 +1054,7 @@ func TestCommands_AuthFromProvider_SAML(t *testing.T) {
 func TestCommands_SucceedIDPIntent(t *testing.T) {
 	type fields struct {
 		eventstore          func(t *testing.T) *eventstore.Eventstore
-		idpConfigEncryption crypto.EncryptionAlgorithm
+		idpConfigEncryption crypto.AuthEncryptionAlgorithm
 	}
 	type args struct {
 		ctx        context.Context
@@ -1076,9 +1076,9 @@ func TestCommands_SucceedIDPIntent(t *testing.T) {
 		{
 			"encryption fails",
 			fields{
-				idpConfigEncryption: func() crypto.EncryptionAlgorithm {
-					m := crypto.NewMockEncryptionAlgorithm(gomock.NewController(t))
-					m.EXPECT().Encrypt(gomock.Any()).Return(nil, zerrors.ThrowInternal(nil, "id", "encryption failed"))
+				idpConfigEncryption: func() crypto.AuthEncryptionAlgorithm {
+					m := crypto.NewMockAuthEncryptionAlgorithm(gomock.NewController(t))
+					m.EXPECT().EncryptToken(gomock.Any()).Return("", zerrors.ThrowInternal(nil, "id", "encryption failed"))
 					return m
 				}(),
 				eventstore: expectEventstore(),
@@ -1094,9 +1094,9 @@ func TestCommands_SucceedIDPIntent(t *testing.T) {
 		{
 			"token encryption fails",
 			fields{
-				idpConfigEncryption: func() crypto.EncryptionAlgorithm {
-					m := crypto.NewMockEncryptionAlgorithm(gomock.NewController(t))
-					m.EXPECT().Encrypt(gomock.Any()).DoAndReturn(func(value []byte) ([]byte, error) {
+				idpConfigEncryption: func() crypto.AuthEncryptionAlgorithm {
+					m := crypto.NewMockAuthEncryptionAlgorithm(gomock.NewController(t))
+					m.EXPECT().EncryptToken(gomock.Any()).DoAndReturn(func(value string) (string, error) {
 						return value, nil
 					})
 					m.EXPECT().Encrypt(gomock.Any()).Return(nil, zerrors.ThrowInternal(nil, "id", "encryption failed"))
@@ -1122,7 +1122,7 @@ func TestCommands_SucceedIDPIntent(t *testing.T) {
 		{
 			"push",
 			fields{
-				idpConfigEncryption: crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
+				idpConfigEncryption: crypto.CreateMockAuthEncryptionAlg(gomock.NewController(t)),
 				eventstore: expectEventstore(
 					expectPush(
 						func() eventstore.Command {
@@ -1173,7 +1173,7 @@ func TestCommands_SucceedIDPIntent(t *testing.T) {
 				}),
 			},
 			res{
-				token: "aWQ",
+				token: "id",
 			},
 		},
 	}
@@ -1193,7 +1193,7 @@ func TestCommands_SucceedIDPIntent(t *testing.T) {
 func TestCommands_SucceedSAMLIDPIntent(t *testing.T) {
 	type fields struct {
 		eventstore          func(t *testing.T) *eventstore.Eventstore
-		idpConfigEncryption crypto.EncryptionAlgorithm
+		idpConfigEncryption crypto.AuthEncryptionAlgorithm
 	}
 	type args struct {
 		ctx        context.Context
@@ -1215,9 +1215,9 @@ func TestCommands_SucceedSAMLIDPIntent(t *testing.T) {
 		{
 			"encryption fails",
 			fields{
-				idpConfigEncryption: func() crypto.EncryptionAlgorithm {
-					m := crypto.NewMockEncryptionAlgorithm(gomock.NewController(t))
-					m.EXPECT().Encrypt(gomock.Any()).Return(nil, zerrors.ThrowInternal(nil, "id", "encryption failed"))
+				idpConfigEncryption: func() crypto.AuthEncryptionAlgorithm {
+					m := crypto.NewMockAuthEncryptionAlgorithm(gomock.NewController(t))
+					m.EXPECT().EncryptToken(gomock.Any()).Return("", zerrors.ThrowInternal(nil, "id", "encryption failed"))
 					return m
 				}(),
 				eventstore: expectEventstore(),
@@ -1233,7 +1233,7 @@ func TestCommands_SucceedSAMLIDPIntent(t *testing.T) {
 		{
 			"push",
 			fields{
-				idpConfigEncryption: crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
+				idpConfigEncryption: crypto.CreateMockAuthEncryptionAlg(gomock.NewController(t)),
 				eventstore: expectEventstore(
 					expectPush(
 						idpintent.NewSAMLSucceededEvent(
@@ -1268,13 +1268,13 @@ func TestCommands_SucceedSAMLIDPIntent(t *testing.T) {
 			}),
 		},
 		res{
-				token: "aWQ",
+			token: "id",
 		},
 	},
 	{
 		"push with userID",
 			fields{
-				idpConfigEncryption: crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
+				idpConfigEncryption: crypto.CreateMockAuthEncryptionAlg(gomock.NewController(t)),
 				eventstore: expectEventstore(
 					expectPush(
 						idpintent.NewSAMLSucceededEvent(
@@ -1310,7 +1310,7 @@ func TestCommands_SucceedSAMLIDPIntent(t *testing.T) {
 				userID: "user",
 			},
 			res{
-				token: "aWQ",
+				token: "id",
 			},
 		},
 	}
@@ -1381,7 +1381,7 @@ func TestCommands_RequestSAMLIDPIntent(t *testing.T) {
 func TestCommands_SucceedLDAPIDPIntent(t *testing.T) {
 	type fields struct {
 		eventstore          func(t *testing.T) *eventstore.Eventstore
-		idpConfigEncryption crypto.EncryptionAlgorithm
+		idpConfigEncryption crypto.AuthEncryptionAlgorithm
 	}
 	type args struct {
 		ctx        context.Context
@@ -1403,9 +1403,9 @@ func TestCommands_SucceedLDAPIDPIntent(t *testing.T) {
 		{
 			"encryption fails",
 			fields{
-				idpConfigEncryption: func() crypto.EncryptionAlgorithm {
-					m := crypto.NewMockEncryptionAlgorithm(gomock.NewController(t))
-					m.EXPECT().Encrypt(gomock.Any()).Return(nil, zerrors.ThrowInternal(nil, "id", "encryption failed"))
+				idpConfigEncryption: func() crypto.AuthEncryptionAlgorithm {
+					m := crypto.NewMockAuthEncryptionAlgorithm(gomock.NewController(t))
+					m.EXPECT().EncryptToken(gomock.Any()).Return("", zerrors.ThrowInternal(nil, "id", "encryption failed"))
 					return m
 				}(),
 				eventstore: expectEventstore(),
@@ -1421,7 +1421,7 @@ func TestCommands_SucceedLDAPIDPIntent(t *testing.T) {
 		{
 			"push",
 			fields{
-				idpConfigEncryption: crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
+				idpConfigEncryption: crypto.CreateMockAuthEncryptionAlg(gomock.NewController(t)),
 				eventstore: expectEventstore(
 					expectPush(
 						idpintent.NewLDAPSucceededEvent(
@@ -1467,7 +1467,7 @@ func TestCommands_SucceedLDAPIDPIntent(t *testing.T) {
 				),
 			},
 			res{
-				token: "aWQ",
+				token: "id",
 			},
 		},
 	}
@@ -1556,7 +1556,7 @@ func Test_tokensForSucceededIDPIntent(t *testing.T) {
 			"no tokens",
 			args{
 				&ldap.Session{},
-				crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
+				crypto.CreateMockAuthEncryptionAlg(gomock.NewController(t)),
 			},
 			res{
 				accessToken:  nil,
@@ -1599,7 +1599,7 @@ func Test_tokensForSucceededIDPIntent(t *testing.T) {
 						},
 					},
 				},
-				crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
+				crypto.CreateMockAuthEncryptionAlg(gomock.NewController(t)),
 			},
 			res{
 				accessToken: &crypto.CryptoValue{
@@ -1628,7 +1628,7 @@ func Test_tokensForSucceededIDPIntent(t *testing.T) {
 						},
 					},
 				},
-				crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
+				crypto.CreateMockAuthEncryptionAlg(gomock.NewController(t)),
 			},
 			res{
 				accessToken: &crypto.CryptoValue{
@@ -1654,7 +1654,7 @@ func Test_tokensForSucceededIDPIntent(t *testing.T) {
 						IDToken: "idToken",
 					},
 				},
-				crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
+				crypto.CreateMockAuthEncryptionAlg(gomock.NewController(t)),
 			},
 			res{
 				accessToken: &crypto.CryptoValue{
@@ -1681,7 +1681,7 @@ func Test_tokensForSucceededIDPIntent(t *testing.T) {
 						IDToken: "idToken",
 					},
 				},
-				crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
+				crypto.CreateMockAuthEncryptionAlg(gomock.NewController(t)),
 			},
 			res{
 				accessToken:  nil,
@@ -1702,7 +1702,7 @@ func Test_tokensForSucceededIDPIntent(t *testing.T) {
 						},
 					},
 				},
-				crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
+				crypto.CreateMockAuthEncryptionAlg(gomock.NewController(t)),
 			},
 			res{
 				accessToken: &crypto.CryptoValue{
@@ -1730,7 +1730,7 @@ func Test_tokensForSucceededIDPIntent(t *testing.T) {
 						},
 					},
 				},
-				crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
+				crypto.CreateMockAuthEncryptionAlg(gomock.NewController(t)),
 			},
 			res{
 				accessToken: &crypto.CryptoValue{

internal/command/instance_idp_config_test.go

@@ -23,7 +23,7 @@ func TestCommandSide_AddDefaultIDPConfig(t *testing.T) {
 	type fields struct {
 		eventstore   *eventstore.Eventstore
 		idGenerator  id.Generator
-		secretCrypto crypto.EncryptionAlgorithm
+		secretCrypto crypto.AuthEncryptionAlgorithm
 	}
 	type args struct {
 		ctx    context.Context
@@ -88,7 +88,7 @@ func TestCommandSide_AddDefaultIDPConfig(t *testing.T) {
 					),
 				),
 				idGenerator:  id_mock.NewIDGeneratorExpectIDs(t, "config1"),
-				secretCrypto: crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
+				secretCrypto: crypto.CreateMockAuthEncryptionAlg(gomock.NewController(t)),
 			},
 			args: args{
 				ctx: authz.WithInstanceID(context.Background(), "INSTANCE"),

internal/command/instance_idp_jwt_config_test.go

@@ -19,7 +19,7 @@ import (
 func TestCommandSide_ChangeDefaultIDPJWTConfig(t *testing.T) {
 	type fields struct {
 		eventstore   *eventstore.Eventstore
-		secretCrypto crypto.EncryptionAlgorithm
+		secretCrypto crypto.AuthEncryptionAlgorithm
 	}
 	type (
 		args struct {
@@ -148,7 +148,7 @@ func TestCommandSide_ChangeDefaultIDPJWTConfig(t *testing.T) {
 						),
 					),
 				),
-				secretCrypto: crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
+				secretCrypto: crypto.CreateMockAuthEncryptionAlg(gomock.NewController(t)),
 			},
 			args: args{
 				ctx:        context.Background(),
@@ -202,7 +202,7 @@ func TestCommandSide_ChangeDefaultIDPJWTConfig(t *testing.T) {
 						),
 					),
 				),
-				secretCrypto: crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
+				secretCrypto: crypto.CreateMockAuthEncryptionAlg(gomock.NewController(t)),
 			},
 			args: args{
 				ctx:        context.Background(),

internal/command/instance_idp_oidc_config_test.go

@@ -19,7 +19,7 @@ import (
 func TestCommandSide_ChangeDefaultIDPOIDCConfig(t *testing.T) {
 	type fields struct {
 		eventstore   *eventstore.Eventstore
-		secretCrypto crypto.EncryptionAlgorithm
+		secretCrypto crypto.AuthEncryptionAlgorithm
 	}
 	type (
 		args struct {
@@ -166,7 +166,7 @@ func TestCommandSide_ChangeDefaultIDPOIDCConfig(t *testing.T) {
 						),
 					),
 				),
-				secretCrypto: crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
+				secretCrypto: crypto.CreateMockAuthEncryptionAlg(gomock.NewController(t)),
 			},
 			args: args{
 				ctx:        context.Background(),
@@ -241,7 +241,7 @@ func TestCommandSide_ChangeDefaultIDPOIDCConfig(t *testing.T) {
 						),
 					),
 				),
-				secretCrypto: crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
+				secretCrypto: crypto.CreateMockAuthEncryptionAlg(gomock.NewController(t)),
 			},
 			args: args{
 				ctx:        context.Background(),

internal/command/instance_idp_test.go

@@ -116,7 +116,7 @@ func TestCommandSide_AddInstanceGenericOAuthIDP(t *testing.T) {
 	type fields struct {
 		eventstore   func(*testing.T) *eventstore.Eventstore
 		idGenerator  id.Generator
-		secretCrypto crypto.EncryptionAlgorithm
+		secretCrypto crypto.AuthEncryptionAlgorithm
 	}
 	type args struct {
 		ctx      context.Context
@@ -299,7 +299,7 @@ func TestCommandSide_AddInstanceGenericOAuthIDP(t *testing.T) {
 					),
 				),
 				idGenerator:  id_mock.NewIDGeneratorExpectIDs(t, "id1"),
-				secretCrypto: crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
+				secretCrypto: crypto.CreateMockAuthEncryptionAlg(gomock.NewController(t)),
 			},
 			args: args{
 				ctx: authz.WithInstanceID(context.Background(), "instance1"),
@@ -351,7 +351,7 @@ func TestCommandSide_AddInstanceGenericOAuthIDP(t *testing.T) {
 					),
 				),
 				idGenerator:  id_mock.NewIDGeneratorExpectIDs(t, "id1"),
-				secretCrypto: crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
+				secretCrypto: crypto.CreateMockAuthEncryptionAlg(gomock.NewController(t)),
 			},
 			args: args{
 				ctx: authz.WithInstanceID(context.Background(), "instance1"),
@@ -404,7 +404,7 @@ func TestCommandSide_AddInstanceGenericOAuthIDP(t *testing.T) {
 func TestCommandSide_UpdateInstanceGenericOAuthIDP(t *testing.T) {
 	type fields struct {
 		eventstore   func(*testing.T) *eventstore.Eventstore
-		secretCrypto crypto.EncryptionAlgorithm
+		secretCrypto crypto.AuthEncryptionAlgorithm
 	}
 	type args struct {
 		ctx      context.Context
@@ -676,7 +676,7 @@ func TestCommandSide_UpdateInstanceGenericOAuthIDP(t *testing.T) {
 						}(),
 					),
 				),
-				secretCrypto: crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
+				secretCrypto: crypto.CreateMockAuthEncryptionAlg(gomock.NewController(t)),
 			},
 			args: args{
 				ctx: authz.WithInstanceID(context.Background(), "instance1"),
@@ -728,7 +728,7 @@ func TestCommandSide_AddInstanceGenericOIDCIDP(t *testing.T) {
 	type fields struct {
 		eventstore   func(*testing.T) *eventstore.Eventstore
 		idGenerator  id.Generator
-		secretCrypto crypto.EncryptionAlgorithm
+		secretCrypto crypto.AuthEncryptionAlgorithm
 	}
 	type args struct {
 		ctx      context.Context
@@ -843,7 +843,7 @@ func TestCommandSide_AddInstanceGenericOIDCIDP(t *testing.T) {
 					),
 				),
 				idGenerator:  id_mock.NewIDGeneratorExpectIDs(t, "id1"),
-				secretCrypto: crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
+				secretCrypto: crypto.CreateMockAuthEncryptionAlg(gomock.NewController(t)),
 			},
 			args: args{
 				ctx: authz.WithInstanceID(context.Background(), "instance1"),
@@ -890,7 +890,7 @@ func TestCommandSide_AddInstanceGenericOIDCIDP(t *testing.T) {
 					),
 				),
 				idGenerator:  id_mock.NewIDGeneratorExpectIDs(t, "id1"),
-				secretCrypto: crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
+				secretCrypto: crypto.CreateMockAuthEncryptionAlg(gomock.NewController(t)),
 			},
 			args: args{
 				ctx: authz.WithInstanceID(context.Background(), "instance1"),
@@ -941,7 +941,7 @@ func TestCommandSide_AddInstanceGenericOIDCIDP(t *testing.T) {
 func TestCommandSide_UpdateInstanceGenericOIDCIDP(t *testing.T) {
 	type fields struct {
 		eventstore   func(*testing.T) *eventstore.Eventstore
-		secretCrypto crypto.EncryptionAlgorithm
+		secretCrypto crypto.AuthEncryptionAlgorithm
 	}
 	type args struct {
 		ctx      context.Context
@@ -1137,7 +1137,7 @@ func TestCommandSide_UpdateInstanceGenericOIDCIDP(t *testing.T) {
 						}(),
 					),
 				),
-				secretCrypto: crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
+				secretCrypto: crypto.CreateMockAuthEncryptionAlg(gomock.NewController(t)),
 			},
 			args: args{
 				ctx: authz.WithInstanceID(context.Background(), "instance1"),
@@ -1186,7 +1186,7 @@ func TestCommandSide_UpdateInstanceGenericOIDCIDP(t *testing.T) {
 func TestCommandSide_MigrateInstanceGenericOIDCToAzureADProvider(t *testing.T) {
 	type fields struct {
 		eventstore   func(*testing.T) *eventstore.Eventstore
-		secretCrypto crypto.EncryptionAlgorithm
+		secretCrypto crypto.AuthEncryptionAlgorithm
 	}
 	type args struct {
 		ctx      context.Context
@@ -1318,7 +1318,7 @@ func TestCommandSide_MigrateInstanceGenericOIDCToAzureADProvider(t *testing.T) {
 						}(),
 					),
 				),
-				secretCrypto: crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
+				secretCrypto: crypto.CreateMockAuthEncryptionAlg(gomock.NewController(t)),
 			},
 			args: args{
 				ctx: authz.WithInstanceID(context.Background(), "instance1"),
@@ -1382,7 +1382,7 @@ func TestCommandSide_MigrateInstanceGenericOIDCToAzureADProvider(t *testing.T) {
 						}(),
 					),
 				),
-				secretCrypto: crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
+				secretCrypto: crypto.CreateMockAuthEncryptionAlg(gomock.NewController(t)),
 			},
 			args: args{
 				ctx: authz.WithInstanceID(context.Background(), "instance1"),
@@ -1430,7 +1430,7 @@ func TestCommandSide_MigrateInstanceGenericOIDCToAzureADProvider(t *testing.T) {
 func TestCommandSide_MigrateInstanceOIDCToGoogleIDP(t *testing.T) {
 	type fields struct {
 		eventstore   func(*testing.T) *eventstore.Eventstore
-		secretCrypto crypto.EncryptionAlgorithm
+		secretCrypto crypto.AuthEncryptionAlgorithm
 	}
 	type args struct {
 		ctx      context.Context
@@ -1537,7 +1537,7 @@ func TestCommandSide_MigrateInstanceOIDCToGoogleIDP(t *testing.T) {
 						),
 					),
 				),
-				secretCrypto: crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
+				secretCrypto: crypto.CreateMockAuthEncryptionAlg(gomock.NewController(t)),
 			},
 			args: args{
 				ctx: authz.WithInstanceID(context.Background(), "instance1"),
@@ -1595,7 +1595,7 @@ func TestCommandSide_MigrateInstanceOIDCToGoogleIDP(t *testing.T) {
 						),
 					),
 				),
-				secretCrypto: crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
+				secretCrypto: crypto.CreateMockAuthEncryptionAlg(gomock.NewController(t)),
 			},
 			args: args{
 				ctx: authz.WithInstanceID(context.Background(), "instance1"),
@@ -1641,7 +1641,7 @@ func TestCommandSide_AddInstanceAzureADIDP(t *testing.T) {
 	type fields struct {
 		eventstore   func(*testing.T) *eventstore.Eventstore
 		idGenerator  id.Generator
-		secretCrypto crypto.EncryptionAlgorithm
+		secretCrypto crypto.AuthEncryptionAlgorithm
 	}
 	type args struct {
 		ctx      context.Context
@@ -1735,7 +1735,7 @@ func TestCommandSide_AddInstanceAzureADIDP(t *testing.T) {
 					),
 				),
 				idGenerator:  id_mock.NewIDGeneratorExpectIDs(t, "id1"),
-				secretCrypto: crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
+				secretCrypto: crypto.CreateMockAuthEncryptionAlg(gomock.NewController(t)),
 			},
 			args: args{
 				ctx: authz.WithInstanceID(context.Background(), "instance1"),
@@ -1779,7 +1779,7 @@ func TestCommandSide_AddInstanceAzureADIDP(t *testing.T) {
 					),
 				),
 				idGenerator:  id_mock.NewIDGeneratorExpectIDs(t, "id1"),
-				secretCrypto: crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
+				secretCrypto: crypto.CreateMockAuthEncryptionAlg(gomock.NewController(t)),
 			},
 			args: args{
 				ctx: authz.WithInstanceID(context.Background(), "instance1"),
@@ -1829,7 +1829,7 @@ func TestCommandSide_AddInstanceAzureADIDP(t *testing.T) {
 func TestCommandSide_UpdateInstanceAzureADIDP(t *testing.T) {
 	type fields struct {
 		eventstore   func(*testing.T) *eventstore.Eventstore
-		secretCrypto crypto.EncryptionAlgorithm
+		secretCrypto crypto.AuthEncryptionAlgorithm
 	}
 	type args struct {
 		ctx      context.Context
@@ -2001,7 +2001,7 @@ func TestCommandSide_UpdateInstanceAzureADIDP(t *testing.T) {
 						}(),
 					),
 				),
-				secretCrypto: crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
+				secretCrypto: crypto.CreateMockAuthEncryptionAlg(gomock.NewController(t)),
 			},
 			args: args{
 				ctx: authz.WithInstanceID(context.Background(), "instance1"),
@@ -2050,7 +2050,7 @@ func TestCommandSide_AddInstanceGitHubIDP(t *testing.T) {
 	type fields struct {
 		eventstore   func(*testing.T) *eventstore.Eventstore
 		idGenerator  id.Generator
-		secretCrypto crypto.EncryptionAlgorithm
+		secretCrypto crypto.AuthEncryptionAlgorithm
 	}
 	type args struct {
 		ctx      context.Context
@@ -2123,7 +2123,7 @@ func TestCommandSide_AddInstanceGitHubIDP(t *testing.T) {
 					),
 				),
 				idGenerator:  id_mock.NewIDGeneratorExpectIDs(t, "id1"),
-				secretCrypto: crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
+				secretCrypto: crypto.CreateMockAuthEncryptionAlg(gomock.NewController(t)),
 			},
 			args: args{
 				ctx: authz.WithInstanceID(context.Background(), "instance1"),
@@ -2164,7 +2164,7 @@ func TestCommandSide_AddInstanceGitHubIDP(t *testing.T) {
 					),
 				),
 				idGenerator:  id_mock.NewIDGeneratorExpectIDs(t, "id1"),
-				secretCrypto: crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
+				secretCrypto: crypto.CreateMockAuthEncryptionAlg(gomock.NewController(t)),
 			},
 			args: args{
 				ctx: authz.WithInstanceID(context.Background(), "instance1"),
@@ -2212,7 +2212,7 @@ func TestCommandSide_AddInstanceGitHubIDP(t *testing.T) {
 func TestCommandSide_UpdateInstanceGitHubIDP(t *testing.T) {
 	type fields struct {
 		eventstore   func(*testing.T) *eventstore.Eventstore
-		secretCrypto crypto.EncryptionAlgorithm
+		secretCrypto crypto.AuthEncryptionAlgorithm
 	}
 	type args struct {
 		ctx      context.Context
@@ -2358,7 +2358,7 @@ func TestCommandSide_UpdateInstanceGitHubIDP(t *testing.T) {
 						}(),
 					),
 				),
-				secretCrypto: crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
+				secretCrypto: crypto.CreateMockAuthEncryptionAlg(gomock.NewController(t)),
 			},
 			args: args{
 				ctx: authz.WithInstanceID(context.Background(), "instance1"),
@@ -2405,7 +2405,7 @@ func TestCommandSide_AddInstanceGitHubEnterpriseIDP(t *testing.T) {
 	type fields struct {
 		eventstore   func(*testing.T) *eventstore.Eventstore
 		idGenerator  id.Generator
-		secretCrypto crypto.EncryptionAlgorithm
+		secretCrypto crypto.AuthEncryptionAlgorithm
 	}
 	type args struct {
 		ctx      context.Context
@@ -2563,7 +2563,7 @@ func TestCommandSide_AddInstanceGitHubEnterpriseIDP(t *testing.T) {
 					),
 				),
 				idGenerator:  id_mock.NewIDGeneratorExpectIDs(t, "id1"),
-				secretCrypto: crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
+				secretCrypto: crypto.CreateMockAuthEncryptionAlg(gomock.NewController(t)),
 			},
 			args: args{
 				ctx: authz.WithInstanceID(context.Background(), "instance1"),
@@ -2611,7 +2611,7 @@ func TestCommandSide_AddInstanceGitHubEnterpriseIDP(t *testing.T) {
 					),
 				),
 				idGenerator:  id_mock.NewIDGeneratorExpectIDs(t, "id1"),
-				secretCrypto: crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
+				secretCrypto: crypto.CreateMockAuthEncryptionAlg(gomock.NewController(t)),
 			},
 			args: args{
 				ctx: authz.WithInstanceID(context.Background(), "instance1"),
@@ -2662,7 +2662,7 @@ func TestCommandSide_AddInstanceGitHubEnterpriseIDP(t *testing.T) {
 func TestCommandSide_UpdateInstanceGitHubEnterpriseIDP(t *testing.T) {
 	type fields struct {
 		eventstore   func(*testing.T) *eventstore.Eventstore
-		secretCrypto crypto.EncryptionAlgorithm
+		secretCrypto crypto.AuthEncryptionAlgorithm
 	}
 	type args struct {
 		ctx      context.Context
@@ -2903,7 +2903,7 @@ func TestCommandSide_UpdateInstanceGitHubEnterpriseIDP(t *testing.T) {
 						}(),
 					),
 				),
-				secretCrypto: crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
+				secretCrypto: crypto.CreateMockAuthEncryptionAlg(gomock.NewController(t)),
 			},
 			args: args{
 				ctx: authz.WithInstanceID(context.Background(), "instance1"),
@@ -2953,7 +2953,7 @@ func TestCommandSide_AddInstanceGitLabIDP(t *testing.T) {
 	type fields struct {
 		eventstore   func(*testing.T) *eventstore.Eventstore
 		idGenerator  id.Generator
-		secretCrypto crypto.EncryptionAlgorithm
+		secretCrypto crypto.AuthEncryptionAlgorithm
 	}
 	type args struct {
 		ctx      context.Context
@@ -3026,7 +3026,7 @@ func TestCommandSide_AddInstanceGitLabIDP(t *testing.T) {
 					),
 				),
 				idGenerator:  id_mock.NewIDGeneratorExpectIDs(t, "id1"),
-				secretCrypto: crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
+				secretCrypto: crypto.CreateMockAuthEncryptionAlg(gomock.NewController(t)),
 			},
 			args: args{
 				ctx: authz.WithInstanceID(context.Background(), "instance1"),
@@ -3067,7 +3067,7 @@ func TestCommandSide_AddInstanceGitLabIDP(t *testing.T) {
 					),
 				),
 				idGenerator:  id_mock.NewIDGeneratorExpectIDs(t, "id1"),
-				secretCrypto: crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
+				secretCrypto: crypto.CreateMockAuthEncryptionAlg(gomock.NewController(t)),
 			},
 			args: args{
 				ctx: authz.WithInstanceID(context.Background(), "instance1"),
@@ -3114,7 +3114,7 @@ func TestCommandSide_AddInstanceGitLabIDP(t *testing.T) {
 func TestCommandSide_UpdateInstanceGitLabIDP(t *testing.T) {
 	type fields struct {
 		eventstore   func(*testing.T) *eventstore.Eventstore
-		secretCrypto crypto.EncryptionAlgorithm
+		secretCrypto crypto.AuthEncryptionAlgorithm
 	}
 	type args struct {
 		ctx      context.Context
@@ -3259,7 +3259,7 @@ func TestCommandSide_UpdateInstanceGitLabIDP(t *testing.T) {
 						}(),
 					),
 				),
-				secretCrypto: crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
+				secretCrypto: crypto.CreateMockAuthEncryptionAlg(gomock.NewController(t)),
 			},
 			args: args{
 				ctx: authz.WithInstanceID(context.Background(), "instance1"),
@@ -3305,7 +3305,7 @@ func TestCommandSide_AddInstanceGitLabSelfHostedIDP(t *testing.T) {
 	type fields struct {
 		eventstore   func(*testing.T) *eventstore.Eventstore
 		idGenerator  id.Generator
-		secretCrypto crypto.EncryptionAlgorithm
+		secretCrypto crypto.AuthEncryptionAlgorithm
 	}
 	type args struct {
 		ctx      context.Context
@@ -3418,7 +3418,7 @@ func TestCommandSide_AddInstanceGitLabSelfHostedIDP(t *testing.T) {
 					),
 				),
 				idGenerator:  id_mock.NewIDGeneratorExpectIDs(t, "id1"),
-				secretCrypto: crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
+				secretCrypto: crypto.CreateMockAuthEncryptionAlg(gomock.NewController(t)),
 			},
 			args: args{
 				ctx: authz.WithInstanceID(context.Background(), "instance1"),
@@ -3462,7 +3462,7 @@ func TestCommandSide_AddInstanceGitLabSelfHostedIDP(t *testing.T) {
 					),
 				),
 				idGenerator:  id_mock.NewIDGeneratorExpectIDs(t, "id1"),
-				secretCrypto: crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
+				secretCrypto: crypto.CreateMockAuthEncryptionAlg(gomock.NewController(t)),
 			},
 			args: args{
 				ctx: authz.WithInstanceID(context.Background(), "instance1"),
@@ -3511,7 +3511,7 @@ func TestCommandSide_AddInstanceGitLabSelfHostedIDP(t *testing.T) {
 func TestCommandSide_UpdateInstanceGitLabSelfHostedIDP(t *testing.T) {
 	type fields struct {
 		eventstore   func(*testing.T) *eventstore.Eventstore
-		secretCrypto crypto.EncryptionAlgorithm
+		secretCrypto crypto.AuthEncryptionAlgorithm
 	}
 	type args struct {
 		ctx      context.Context
@@ -3701,7 +3701,7 @@ func TestCommandSide_UpdateInstanceGitLabSelfHostedIDP(t *testing.T) {
 						}(),
 					),
 				),
-				secretCrypto: crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
+				secretCrypto: crypto.CreateMockAuthEncryptionAlg(gomock.NewController(t)),
 			},
 			args: args{
 				ctx: authz.WithInstanceID(context.Background(), "instance1"),
@@ -3749,7 +3749,7 @@ func TestCommandSide_AddInstanceGoogleIDP(t *testing.T) {
 	type fields struct {
 		eventstore   func(*testing.T) *eventstore.Eventstore
 		idGenerator  id.Generator
-		secretCrypto crypto.EncryptionAlgorithm
+		secretCrypto crypto.AuthEncryptionAlgorithm
 	}
 	type args struct {
 		ctx      context.Context
@@ -3822,7 +3822,7 @@ func TestCommandSide_AddInstanceGoogleIDP(t *testing.T) {
 					),
 				),
 				idGenerator:  id_mock.NewIDGeneratorExpectIDs(t, "id1"),
-				secretCrypto: crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
+				secretCrypto: crypto.CreateMockAuthEncryptionAlg(gomock.NewController(t)),
 			},
 			args: args{
 				ctx: authz.WithInstanceID(context.Background(), "instance1"),
@@ -3863,7 +3863,7 @@ func TestCommandSide_AddInstanceGoogleIDP(t *testing.T) {
 					),
 				),
 				idGenerator:  id_mock.NewIDGeneratorExpectIDs(t, "id1"),
-				secretCrypto: crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
+				secretCrypto: crypto.CreateMockAuthEncryptionAlg(gomock.NewController(t)),
 			},
 			args: args{
 				ctx: authz.WithInstanceID(context.Background(), "instance1"),
@@ -3910,7 +3910,7 @@ func TestCommandSide_AddInstanceGoogleIDP(t *testing.T) {
 func TestCommandSide_UpdateInstanceGoogleIDP(t *testing.T) {
 	type fields struct {
 		eventstore   func(*testing.T) *eventstore.Eventstore
-		secretCrypto crypto.EncryptionAlgorithm
+		secretCrypto crypto.AuthEncryptionAlgorithm
 	}
 	type args struct {
 		ctx      context.Context
@@ -4055,7 +4055,7 @@ func TestCommandSide_UpdateInstanceGoogleIDP(t *testing.T) {
 						}(),
 					),
 				),
-				secretCrypto: crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
+				secretCrypto: crypto.CreateMockAuthEncryptionAlg(gomock.NewController(t)),
 			},
 			args: args{
 				ctx: authz.WithInstanceID(context.Background(), "instance1"),
@@ -4101,7 +4101,7 @@ func TestCommandSide_AddInstanceLDAPIDP(t *testing.T) {
 	type fields struct {
 		eventstore   func(*testing.T) *eventstore.Eventstore
 		idGenerator  id.Generator
-		secretCrypto crypto.EncryptionAlgorithm
+		secretCrypto crypto.AuthEncryptionAlgorithm
 	}
 	type args struct {
 		ctx      context.Context
@@ -4339,7 +4339,7 @@ func TestCommandSide_AddInstanceLDAPIDP(t *testing.T) {
 					),
 				),
 				idGenerator:  id_mock.NewIDGeneratorExpectIDs(t, "id1"),
-				secretCrypto: crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
+				secretCrypto: crypto.CreateMockAuthEncryptionAlg(gomock.NewController(t)),
 			},
 			args: args{
 				ctx: authz.WithInstanceID(context.Background(), "instance1"),
@@ -4410,7 +4410,7 @@ func TestCommandSide_AddInstanceLDAPIDP(t *testing.T) {
 					),
 				),
 				idGenerator:  id_mock.NewIDGeneratorExpectIDs(t, "id1"),
-				secretCrypto: crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
+				secretCrypto: crypto.CreateMockAuthEncryptionAlg(gomock.NewController(t)),
 			},
 			args: args{
 				ctx: authz.WithInstanceID(context.Background(), "instance1"),
@@ -4480,7 +4480,7 @@ func TestCommandSide_AddInstanceLDAPIDP(t *testing.T) {
 func TestCommandSide_UpdateInstanceLDAPIDP(t *testing.T) {
 	type fields struct {
 		eventstore   func(*testing.T) *eventstore.Eventstore
-		secretCrypto crypto.EncryptionAlgorithm
+		secretCrypto crypto.AuthEncryptionAlgorithm
 	}
 	type args struct {
 		ctx      context.Context
@@ -4831,7 +4831,7 @@ func TestCommandSide_UpdateInstanceLDAPIDP(t *testing.T) {
 						}(),
 					),
 				),
-				secretCrypto: crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
+				secretCrypto: crypto.CreateMockAuthEncryptionAlg(gomock.NewController(t)),
 			},
 			args: args{
 				ctx: authz.WithInstanceID(context.Background(), "instance1"),
@@ -4908,7 +4908,7 @@ func TestCommandSide_AddInstanceAppleIDP(t *testing.T) {
 	type fields struct {
 		eventstore   func(*testing.T) *eventstore.Eventstore
 		idGenerator  id.Generator
-		secretCrypto crypto.EncryptionAlgorithm
+		secretCrypto crypto.AuthEncryptionAlgorithm
 	}
 	type args struct {
 		ctx      context.Context
@@ -5033,7 +5033,7 @@ func TestCommandSide_AddInstanceAppleIDP(t *testing.T) {
 					),
 				),
 				idGenerator:  id_mock.NewIDGeneratorExpectIDs(t, "id1"),
-				secretCrypto: crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
+				secretCrypto: crypto.CreateMockAuthEncryptionAlg(gomock.NewController(t)),
 			},
 			args: args{
 				ctx: authz.WithInstanceID(context.Background(), "instance1"),
@@ -5078,7 +5078,7 @@ func TestCommandSide_AddInstanceAppleIDP(t *testing.T) {
 					),
 				),
 				idGenerator:  id_mock.NewIDGeneratorExpectIDs(t, "id1"),
-				secretCrypto: crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
+				secretCrypto: crypto.CreateMockAuthEncryptionAlg(gomock.NewController(t)),
 			},
 			args: args{
 				ctx: authz.WithInstanceID(context.Background(), "instance1"),
@@ -5122,7 +5122,7 @@ func TestCommandSide_AddInstanceAppleIDP(t *testing.T) {
 func TestCommandSide_UpdateInstanceAppleIDP(t *testing.T) {
 	type fields struct {
 		eventstore   func(*testing.T) *eventstore.Eventstore
-		secretCrypto crypto.EncryptionAlgorithm
+		secretCrypto crypto.AuthEncryptionAlgorithm
 	}
 	type args struct {
 		ctx      context.Context
@@ -5325,7 +5325,7 @@ func TestCommandSide_UpdateInstanceAppleIDP(t *testing.T) {
 						}(),
 					),
 				),
-				secretCrypto: crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
+				secretCrypto: crypto.CreateMockAuthEncryptionAlg(gomock.NewController(t)),
 			},
 			args: args{
 				ctx: authz.WithInstanceID(context.Background(), "instance1"),
@@ -5368,7 +5368,7 @@ func TestCommandSide_AddInstanceSAMLIDP(t *testing.T) {
 	type fields struct {
 		eventstore                 func(*testing.T) *eventstore.Eventstore
 		idGenerator                id.Generator
-		secretCrypto               crypto.EncryptionAlgorithm
+		secretCrypto               crypto.AuthEncryptionAlgorithm
 		certificateAndKeyGenerator func(id string) ([]byte, []byte, error)
 	}
 	type args struct {
@@ -5467,7 +5467,7 @@ func TestCommandSide_AddInstanceSAMLIDP(t *testing.T) {
 					),
 				),
 				idGenerator:                id_mock.NewIDGeneratorExpectIDs(t, "id1"),
-				secretCrypto:               crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
+				secretCrypto:               crypto.CreateMockAuthEncryptionAlg(gomock.NewController(t)),
 				certificateAndKeyGenerator: func(id string) ([]byte, []byte, error) { return []byte("key"), []byte("certificate"), nil },
 			},
 			args: args{
@@ -5515,7 +5515,7 @@ func TestCommandSide_AddInstanceSAMLIDP(t *testing.T) {
 					),
 				),
 				idGenerator:                id_mock.NewIDGeneratorExpectIDs(t, "id1"),
-				secretCrypto:               crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
+				secretCrypto:               crypto.CreateMockAuthEncryptionAlg(gomock.NewController(t)),
 				certificateAndKeyGenerator: func(id string) ([]byte, []byte, error) { return []byte("key"), []byte("certificate"), nil },
 			},
 			args: args{
@@ -5569,7 +5569,7 @@ func TestCommandSide_AddInstanceSAMLIDP(t *testing.T) {
 func TestCommandSide_UpdateInstanceGenericSAMLIDP(t *testing.T) {
 	type fields struct {
 		eventstore   func(*testing.T) *eventstore.Eventstore
-		secretCrypto crypto.EncryptionAlgorithm
+		secretCrypto crypto.AuthEncryptionAlgorithm
 	}
 	type args struct {
 		ctx      context.Context
@@ -5764,7 +5764,7 @@ func TestCommandSide_UpdateInstanceGenericSAMLIDP(t *testing.T) {
 						}(),
 					),
 				),
-				secretCrypto: crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
+				secretCrypto: crypto.CreateMockAuthEncryptionAlg(gomock.NewController(t)),
 			},
 			args: args{
 				ctx: authz.WithInstanceID(context.Background(), "instance1"),
@@ -5813,7 +5813,7 @@ func TestCommandSide_UpdateInstanceGenericSAMLIDP(t *testing.T) {
 func TestCommandSide_RegenerateInstanceSAMLProviderCertificate(t *testing.T) {
 	type fields struct {
 		eventstore                 func(*testing.T) *eventstore.Eventstore
-		secretCrypto               crypto.EncryptionAlgorithm
+		secretCrypto               crypto.AuthEncryptionAlgorithm
 		certificateAndKeyGenerator func(id string) ([]byte, []byte, error)
 	}
 	type args struct {
@@ -5903,7 +5903,7 @@ func TestCommandSide_RegenerateInstanceSAMLProviderCertificate(t *testing.T) {
 						}(),
 					),
 				),
-				secretCrypto: crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
+				secretCrypto: crypto.CreateMockAuthEncryptionAlg(gomock.NewController(t)),
 				certificateAndKeyGenerator: func(id string) ([]byte, []byte, error) {
 					return []byte("new key"), []byte("new certificate"), nil
 				},
@@ -5943,7 +5943,7 @@ func TestCommandSide_AddInstanceZitadelIDP(t *testing.T) {
 	type fields struct {
 		eventstore   func(*testing.T) *eventstore.Eventstore
 		idGenerator  id.Generator
-		secretCrypto crypto.EncryptionAlgorithm
+		secretCrypto crypto.AuthEncryptionAlgorithm
 	}
 	type args struct {
 		ctx      context.Context
@@ -6067,7 +6067,7 @@ func TestCommandSide_AddInstanceZitadelIDP(t *testing.T) {
 					),
 				),
 				idGenerator:  id_mock.NewIDGeneratorExpectIDs(t, "id1"),
-				secretCrypto: crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
+				secretCrypto: crypto.CreateMockAuthEncryptionAlg(gomock.NewController(t)),
 			},
 			args: args{
 				ctx: authz.WithInstanceID(context.Background(), "instance1"),
@@ -6118,7 +6118,7 @@ func TestCommandSide_AddInstanceZitadelIDP(t *testing.T) {
 					),
 				),
 				idGenerator:  id_mock.NewIDGeneratorExpectIDs(t, "id1"),
-				secretCrypto: crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
+				secretCrypto: crypto.CreateMockAuthEncryptionAlg(gomock.NewController(t)),
 			},
 			args: args{
 				ctx: authz.WithInstanceID(context.Background(), "instance1"),
@@ -6167,7 +6167,7 @@ func TestCommandSide_AddInstanceZitadelIDP(t *testing.T) {
 					),
 				),
 				idGenerator:  id_mock.NewIDGeneratorExpectIDs(t, "id1"),
-				secretCrypto: crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
+				secretCrypto: crypto.CreateMockAuthEncryptionAlg(gomock.NewController(t)),
 			},
 			args: args{
 				ctx: authz.WithInstanceID(context.Background(), "instance1"),
@@ -6231,7 +6231,7 @@ func TestCommandSide_AddInstanceZitadelIDP(t *testing.T) {
 					),
 				),
 				idGenerator:  id_mock.NewIDGeneratorExpectIDs(t, "id1"),
-				secretCrypto: crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
+				secretCrypto: crypto.CreateMockAuthEncryptionAlg(gomock.NewController(t)),
 			},
 			args: args{
 				ctx: authz.WithInstanceID(context.Background(), "instance1"),
@@ -6291,7 +6291,7 @@ func TestCommands_UpdateInstanceZitadelProvider(t *testing.T) {
 	pushErr := errors.New("push error")
 	type fields struct {
 		eventstore   func(*testing.T) *eventstore.Eventstore
-		secretCrypto crypto.EncryptionAlgorithm
+		secretCrypto crypto.AuthEncryptionAlgorithm
 	}
 	type args struct {
 		ctx      context.Context
@@ -6430,7 +6430,7 @@ func TestCommands_UpdateInstanceZitadelProvider(t *testing.T) {
 						),
 					),
 				),
-				secretCrypto: crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
+				secretCrypto: crypto.CreateMockAuthEncryptionAlg(gomock.NewController(t)),
 			},
 			args: args{
 				ctx: authz.WithInstanceID(context.Background(), "instance1"),
@@ -6573,7 +6573,7 @@ func TestCommands_UpdateInstanceZitadelProvider(t *testing.T) {
 						}(),
 					),
 				),
-				secretCrypto: crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
+				secretCrypto: crypto.CreateMockAuthEncryptionAlg(gomock.NewController(t)),
 			},
 			args: args{
 				ctx: authz.WithInstanceID(context.Background(), "instance1"),
@@ -6671,7 +6671,7 @@ func TestCommands_UpdateInstanceZitadelProvider(t *testing.T) {
 						}(),
 					),
 				),
-				secretCrypto: crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
+				secretCrypto: crypto.CreateMockAuthEncryptionAlg(gomock.NewController(t)),
 			},
 			args: args{
 				ctx: authz.WithInstanceID(context.Background(), "instance1"),
@@ -6759,7 +6759,7 @@ func TestCommands_UpdateInstanceZitadelProvider(t *testing.T) {
 						}(),
 					),
 				),
-				secretCrypto: crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
+				secretCrypto: crypto.CreateMockAuthEncryptionAlg(gomock.NewController(t)),
 			},
 			args: args{
 				ctx: authz.WithInstanceID(context.Background(), "instance1"),

internal/command/org_idp_config_test.go

@@ -24,7 +24,7 @@ func TestCommandSide_AddIDPConfig(t *testing.T) {
 	type fields struct {
 		eventstore   *eventstore.Eventstore
 		idGenerator  id.Generator
-		secretCrypto crypto.EncryptionAlgorithm
+		secretCrypto crypto.AuthEncryptionAlgorithm
 	}
 	type args struct {
 		ctx           context.Context
@@ -118,7 +118,7 @@ func TestCommandSide_AddIDPConfig(t *testing.T) {
 					),
 				),
 				idGenerator:  id_mock.NewIDGeneratorExpectIDs(t, "config1"),
-				secretCrypto: crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
+				secretCrypto: crypto.CreateMockAuthEncryptionAlg(gomock.NewController(t)),
 			},
 			args: args{
 				ctx:           context.Background(),

internal/command/org_idp_jwt_config_test.go

@@ -19,7 +19,7 @@ import (
 func TestCommandSide_ChangeIDPJWTConfig(t *testing.T) {
 	type fields struct {
 		eventstore   *eventstore.Eventstore
-		secretCrypto crypto.EncryptionAlgorithm
+		secretCrypto crypto.AuthEncryptionAlgorithm
 	}
 	type (
 		args struct {
@@ -165,7 +165,7 @@ func TestCommandSide_ChangeIDPJWTConfig(t *testing.T) {
 						),
 					),
 				),
-				secretCrypto: crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
+				secretCrypto: crypto.CreateMockAuthEncryptionAlg(gomock.NewController(t)),
 			},
 			args: args{
 				ctx: context.Background(),
@@ -220,7 +220,7 @@ func TestCommandSide_ChangeIDPJWTConfig(t *testing.T) {
 						),
 					),
 				),
-				secretCrypto: crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
+				secretCrypto: crypto.CreateMockAuthEncryptionAlg(gomock.NewController(t)),
 			},
 			args: args{
 				ctx: context.Background(),

internal/command/org_idp_oidc_config_test.go

@@ -19,7 +19,7 @@ import (
 func TestCommandSide_ChangeIDPOIDCConfig(t *testing.T) {
 	type fields struct {
 		eventstore   *eventstore.Eventstore
-		secretCrypto crypto.EncryptionAlgorithm
+		secretCrypto crypto.AuthEncryptionAlgorithm
 	}
 	type (
 		args struct {
@@ -183,7 +183,7 @@ func TestCommandSide_ChangeIDPOIDCConfig(t *testing.T) {
 						),
 					),
 				),
-				secretCrypto: crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
+				secretCrypto: crypto.CreateMockAuthEncryptionAlg(gomock.NewController(t)),
 			},
 			args: args{
 				ctx: context.Background(),
@@ -259,7 +259,7 @@ func TestCommandSide_ChangeIDPOIDCConfig(t *testing.T) {
 						),
 					),
 				),
-				secretCrypto: crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
+				secretCrypto: crypto.CreateMockAuthEncryptionAlg(gomock.NewController(t)),
 			},
 			args: args{
 				ctx: context.Background(),

internal/command/org_idp_test.go

@@ -25,7 +25,7 @@ func TestCommandSide_AddOrgGenericOAuthProvider(t *testing.T) {
 	type fields struct {
 		eventstore   func(*testing.T) *eventstore.Eventstore
 		idGenerator  id.Generator
-		secretCrypto crypto.EncryptionAlgorithm
+		secretCrypto crypto.AuthEncryptionAlgorithm
 	}
 	type args struct {
 		ctx           context.Context
@@ -216,7 +216,7 @@ func TestCommandSide_AddOrgGenericOAuthProvider(t *testing.T) {
 					),
 				),
 				idGenerator:  id_mock.NewIDGeneratorExpectIDs(t, "id1"),
-				secretCrypto: crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
+				secretCrypto: crypto.CreateMockAuthEncryptionAlg(gomock.NewController(t)),
 			},
 			args: args{
 				ctx:           context.Background(),
@@ -268,7 +268,7 @@ func TestCommandSide_AddOrgGenericOAuthProvider(t *testing.T) {
 					),
 				),
 				idGenerator:  id_mock.NewIDGeneratorExpectIDs(t, "id1"),
-				secretCrypto: crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
+				secretCrypto: crypto.CreateMockAuthEncryptionAlg(gomock.NewController(t)),
 			},
 			args: args{
 				ctx:           context.Background(),
@@ -322,7 +322,7 @@ func TestCommandSide_AddOrgGenericOAuthProvider(t *testing.T) {
 func TestCommandSide_UpdateOrgGenericOAuthIDP(t *testing.T) {
 	type fields struct {
 		eventstore   func(*testing.T) *eventstore.Eventstore
-		secretCrypto crypto.EncryptionAlgorithm
+		secretCrypto crypto.AuthEncryptionAlgorithm
 	}
 	type args struct {
 		ctx           context.Context
@@ -604,7 +604,7 @@ func TestCommandSide_UpdateOrgGenericOAuthIDP(t *testing.T) {
 						}(),
 					),
 				),
-				secretCrypto: crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
+				secretCrypto: crypto.CreateMockAuthEncryptionAlg(gomock.NewController(t)),
 			},
 			args: args{
 				ctx:           context.Background(),
@@ -657,7 +657,7 @@ func TestCommandSide_AddOrgGenericOIDCIDP(t *testing.T) {
 	type fields struct {
 		eventstore   func(*testing.T) *eventstore.Eventstore
 		idGenerator  id.Generator
-		secretCrypto crypto.EncryptionAlgorithm
+		secretCrypto crypto.AuthEncryptionAlgorithm
 	}
 	type args struct {
 		ctx           context.Context
@@ -777,7 +777,7 @@ func TestCommandSide_AddOrgGenericOIDCIDP(t *testing.T) {
 					),
 				),
 				idGenerator:  id_mock.NewIDGeneratorExpectIDs(t, "id1"),
-				secretCrypto: crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
+				secretCrypto: crypto.CreateMockAuthEncryptionAlg(gomock.NewController(t)),
 			},
 			args: args{
 				ctx:           context.Background(),
@@ -824,7 +824,7 @@ func TestCommandSide_AddOrgGenericOIDCIDP(t *testing.T) {
 					),
 				),
 				idGenerator:  id_mock.NewIDGeneratorExpectIDs(t, "id1"),
-				secretCrypto: crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
+				secretCrypto: crypto.CreateMockAuthEncryptionAlg(gomock.NewController(t)),
 			},
 			args: args{
 				ctx:           context.Background(),
@@ -876,7 +876,7 @@ func TestCommandSide_AddOrgGenericOIDCIDP(t *testing.T) {
 func TestCommandSide_UpdateOrgGenericOIDCIDP(t *testing.T) {
 	type fields struct {
 		eventstore   func(*testing.T) *eventstore.Eventstore
-		secretCrypto crypto.EncryptionAlgorithm
+		secretCrypto crypto.AuthEncryptionAlgorithm
 	}
 	type args struct {
 		ctx           context.Context
@@ -1079,7 +1079,7 @@ func TestCommandSide_UpdateOrgGenericOIDCIDP(t *testing.T) {
 						}(),
 					),
 				),
-				secretCrypto: crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
+				secretCrypto: crypto.CreateMockAuthEncryptionAlg(gomock.NewController(t)),
 			},
 			args: args{
 				ctx:           context.Background(),
@@ -1129,7 +1129,7 @@ func TestCommandSide_UpdateOrgGenericOIDCIDP(t *testing.T) {
 func TestCommandSide_MigrateOrgGenericOIDCToAzureADProvider(t *testing.T) {
 	type fields struct {
 		eventstore   func(*testing.T) *eventstore.Eventstore
-		secretCrypto crypto.EncryptionAlgorithm
+		secretCrypto crypto.AuthEncryptionAlgorithm
 	}
 	type args struct {
 		ctx           context.Context
@@ -1265,7 +1265,7 @@ func TestCommandSide_MigrateOrgGenericOIDCToAzureADProvider(t *testing.T) {
 						}(),
 					),
 				),
-				secretCrypto: crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
+				secretCrypto: crypto.CreateMockAuthEncryptionAlg(gomock.NewController(t)),
 			},
 			args: args{
 				ctx:           context.Background(),
@@ -1327,7 +1327,7 @@ func TestCommandSide_MigrateOrgGenericOIDCToAzureADProvider(t *testing.T) {
 						),
 					),
 				),
-				secretCrypto: crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
+				secretCrypto: crypto.CreateMockAuthEncryptionAlg(gomock.NewController(t)),
 			},
 			args: args{
 				ctx:           context.Background(),
@@ -1376,7 +1376,7 @@ func TestCommandSide_MigrateOrgGenericOIDCToAzureADProvider(t *testing.T) {
 func TestCommandSide_MigrateOrgOIDCToGoogleIDP(t *testing.T) {
 	type fields struct {
 		eventstore   func(*testing.T) *eventstore.Eventstore
-		secretCrypto crypto.EncryptionAlgorithm
+		secretCrypto crypto.AuthEncryptionAlgorithm
 	}
 	type args struct {
 		ctx           context.Context
@@ -1489,7 +1489,7 @@ func TestCommandSide_MigrateOrgOIDCToGoogleIDP(t *testing.T) {
 						),
 					),
 				),
-				secretCrypto: crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
+				secretCrypto: crypto.CreateMockAuthEncryptionAlg(gomock.NewController(t)),
 			},
 			args: args{
 				ctx:           context.Background(),
@@ -1548,7 +1548,7 @@ func TestCommandSide_MigrateOrgOIDCToGoogleIDP(t *testing.T) {
 						),
 					),
 				),
-				secretCrypto: crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
+				secretCrypto: crypto.CreateMockAuthEncryptionAlg(gomock.NewController(t)),
 			},
 			args: args{
 				ctx:           context.Background(),
@@ -1595,7 +1595,7 @@ func TestCommandSide_AddOrgAzureADIDP(t *testing.T) {
 	type fields struct {
 		eventstore   func(*testing.T) *eventstore.Eventstore
 		idGenerator  id.Generator
-		secretCrypto crypto.EncryptionAlgorithm
+		secretCrypto crypto.AuthEncryptionAlgorithm
 	}
 	type args struct {
 		ctx           context.Context
@@ -1693,7 +1693,7 @@ func TestCommandSide_AddOrgAzureADIDP(t *testing.T) {
 					),
 				),
 				idGenerator:  id_mock.NewIDGeneratorExpectIDs(t, "id1"),
-				secretCrypto: crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
+				secretCrypto: crypto.CreateMockAuthEncryptionAlg(gomock.NewController(t)),
 			},
 			args: args{
 				ctx:           context.Background(),
@@ -1738,7 +1738,7 @@ func TestCommandSide_AddOrgAzureADIDP(t *testing.T) {
 					),
 				),
 				idGenerator:  id_mock.NewIDGeneratorExpectIDs(t, "id1"),
-				secretCrypto: crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
+				secretCrypto: crypto.CreateMockAuthEncryptionAlg(gomock.NewController(t)),
 			},
 			args: args{
 				ctx:           context.Background(),
@@ -1789,7 +1789,7 @@ func TestCommandSide_AddOrgAzureADIDP(t *testing.T) {
 func TestCommandSide_UpdateOrgAzureADIDP(t *testing.T) {
 	type fields struct {
 		eventstore   func(*testing.T) *eventstore.Eventstore
-		secretCrypto crypto.EncryptionAlgorithm
+		secretCrypto crypto.AuthEncryptionAlgorithm
 	}
 	type args struct {
 		ctx           context.Context
@@ -1967,7 +1967,7 @@ func TestCommandSide_UpdateOrgAzureADIDP(t *testing.T) {
 						}(),
 					),
 				),
-				secretCrypto: crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
+				secretCrypto: crypto.CreateMockAuthEncryptionAlg(gomock.NewController(t)),
 			},
 			args: args{
 				ctx:           context.Background(),
@@ -2017,7 +2017,7 @@ func TestCommandSide_AddOrgGitHubIDP(t *testing.T) {
 	type fields struct {
 		eventstore   func(*testing.T) *eventstore.Eventstore
 		idGenerator  id.Generator
-		secretCrypto crypto.EncryptionAlgorithm
+		secretCrypto crypto.AuthEncryptionAlgorithm
 	}
 	type args struct {
 		ctx           context.Context
@@ -2093,7 +2093,7 @@ func TestCommandSide_AddOrgGitHubIDP(t *testing.T) {
 					),
 				),
 				idGenerator:  id_mock.NewIDGeneratorExpectIDs(t, "id1"),
-				secretCrypto: crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
+				secretCrypto: crypto.CreateMockAuthEncryptionAlg(gomock.NewController(t)),
 			},
 			args: args{
 				ctx:           context.Background(),
@@ -2135,7 +2135,7 @@ func TestCommandSide_AddOrgGitHubIDP(t *testing.T) {
 					),
 				),
 				idGenerator:  id_mock.NewIDGeneratorExpectIDs(t, "id1"),
-				secretCrypto: crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
+				secretCrypto: crypto.CreateMockAuthEncryptionAlg(gomock.NewController(t)),
 			},
 			args: args{
 				ctx:           context.Background(),
@@ -2184,7 +2184,7 @@ func TestCommandSide_AddOrgGitHubIDP(t *testing.T) {
 func TestCommandSide_UpdateOrgGitHubIDP(t *testing.T) {
 	type fields struct {
 		eventstore   func(*testing.T) *eventstore.Eventstore
-		secretCrypto crypto.EncryptionAlgorithm
+		secretCrypto crypto.AuthEncryptionAlgorithm
 	}
 	type args struct {
 		ctx           context.Context
@@ -2335,7 +2335,7 @@ func TestCommandSide_UpdateOrgGitHubIDP(t *testing.T) {
 						}(),
 					),
 				),
-				secretCrypto: crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
+				secretCrypto: crypto.CreateMockAuthEncryptionAlg(gomock.NewController(t)),
 			},
 			args: args{
 				ctx:           context.Background(),
@@ -2383,7 +2383,7 @@ func TestCommandSide_AddOrgGitHubEnterpriseIDP(t *testing.T) {
 	type fields struct {
 		eventstore   func(*testing.T) *eventstore.Eventstore
 		idGenerator  id.Generator
-		secretCrypto crypto.EncryptionAlgorithm
+		secretCrypto crypto.AuthEncryptionAlgorithm
 	}
 	type args struct {
 		ctx           context.Context
@@ -2548,7 +2548,7 @@ func TestCommandSide_AddOrgGitHubEnterpriseIDP(t *testing.T) {
 					),
 				),
 				idGenerator:  id_mock.NewIDGeneratorExpectIDs(t, "id1"),
-				secretCrypto: crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
+				secretCrypto: crypto.CreateMockAuthEncryptionAlg(gomock.NewController(t)),
 			},
 			args: args{
 				ctx:           context.Background(),
@@ -2597,7 +2597,7 @@ func TestCommandSide_AddOrgGitHubEnterpriseIDP(t *testing.T) {
 					),
 				),
 				idGenerator:  id_mock.NewIDGeneratorExpectIDs(t, "id1"),
-				secretCrypto: crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
+				secretCrypto: crypto.CreateMockAuthEncryptionAlg(gomock.NewController(t)),
 			},
 			args: args{
 				ctx:           context.Background(),
@@ -2649,7 +2649,7 @@ func TestCommandSide_AddOrgGitHubEnterpriseIDP(t *testing.T) {
 func TestCommandSide_UpdateOrgGitHubEnterpriseIDP(t *testing.T) {
 	type fields struct {
 		eventstore   func(*testing.T) *eventstore.Eventstore
-		secretCrypto crypto.EncryptionAlgorithm
+		secretCrypto crypto.AuthEncryptionAlgorithm
 	}
 	type args struct {
 		ctx           context.Context
@@ -2899,7 +2899,7 @@ func TestCommandSide_UpdateOrgGitHubEnterpriseIDP(t *testing.T) {
 						}(),
 					),
 				),
-				secretCrypto: crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
+				secretCrypto: crypto.CreateMockAuthEncryptionAlg(gomock.NewController(t)),
 			},
 			args: args{
 				ctx:           context.Background(),
@@ -2950,7 +2950,7 @@ func TestCommandSide_AddOrgGitLabIDP(t *testing.T) {
 	type fields struct {
 		eventstore   func(*testing.T) *eventstore.Eventstore
 		idGenerator  id.Generator
-		secretCrypto crypto.EncryptionAlgorithm
+		secretCrypto crypto.AuthEncryptionAlgorithm
 	}
 	type args struct {
 		ctx           context.Context
@@ -3026,7 +3026,7 @@ func TestCommandSide_AddOrgGitLabIDP(t *testing.T) {
 					),
 				),
 				idGenerator:  id_mock.NewIDGeneratorExpectIDs(t, "id1"),
-				secretCrypto: crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
+				secretCrypto: crypto.CreateMockAuthEncryptionAlg(gomock.NewController(t)),
 			},
 			args: args{
 				ctx:           context.Background(),
@@ -3068,7 +3068,7 @@ func TestCommandSide_AddOrgGitLabIDP(t *testing.T) {
 					),
 				),
 				idGenerator:  id_mock.NewIDGeneratorExpectIDs(t, "id1"),
-				secretCrypto: crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
+				secretCrypto: crypto.CreateMockAuthEncryptionAlg(gomock.NewController(t)),
 			},
 			args: args{
 				ctx:           context.Background(),
@@ -3116,7 +3116,7 @@ func TestCommandSide_AddOrgGitLabIDP(t *testing.T) {
 func TestCommandSide_UpdateOrgGitLabIDP(t *testing.T) {
 	type fields struct {
 		eventstore   func(*testing.T) *eventstore.Eventstore
-		secretCrypto crypto.EncryptionAlgorithm
+		secretCrypto crypto.AuthEncryptionAlgorithm
 	}
 	type args struct {
 		ctx           context.Context
@@ -3266,7 +3266,7 @@ func TestCommandSide_UpdateOrgGitLabIDP(t *testing.T) {
 						}(),
 					),
 				),
-				secretCrypto: crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
+				secretCrypto: crypto.CreateMockAuthEncryptionAlg(gomock.NewController(t)),
 			},
 			args: args{
 				ctx:           context.Background(),
@@ -3313,7 +3313,7 @@ func TestCommandSide_AddOrgGitLabSelfHostedIDP(t *testing.T) {
 	type fields struct {
 		eventstore   func(*testing.T) *eventstore.Eventstore
 		idGenerator  id.Generator
-		secretCrypto crypto.EncryptionAlgorithm
+		secretCrypto crypto.AuthEncryptionAlgorithm
 	}
 	type args struct {
 		ctx           context.Context
@@ -3431,7 +3431,7 @@ func TestCommandSide_AddOrgGitLabSelfHostedIDP(t *testing.T) {
 					),
 				),
 				idGenerator:  id_mock.NewIDGeneratorExpectIDs(t, "id1"),
-				secretCrypto: crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
+				secretCrypto: crypto.CreateMockAuthEncryptionAlg(gomock.NewController(t)),
 			},
 			args: args{
 				ctx:           context.Background(),
@@ -3476,7 +3476,7 @@ func TestCommandSide_AddOrgGitLabSelfHostedIDP(t *testing.T) {
 					),
 				),
 				idGenerator:  id_mock.NewIDGeneratorExpectIDs(t, "id1"),
-				secretCrypto: crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
+				secretCrypto: crypto.CreateMockAuthEncryptionAlg(gomock.NewController(t)),
 			},
 			args: args{
 				ctx:           context.Background(),
@@ -3526,7 +3526,7 @@ func TestCommandSide_AddOrgGitLabSelfHostedIDP(t *testing.T) {
 func TestCommandSide_UpdateOrgGitLabSelfHostedIDP(t *testing.T) {
 	type fields struct {
 		eventstore   func(*testing.T) *eventstore.Eventstore
-		secretCrypto crypto.EncryptionAlgorithm
+		secretCrypto crypto.AuthEncryptionAlgorithm
 	}
 	type args struct {
 		ctx           context.Context
@@ -3723,7 +3723,7 @@ func TestCommandSide_UpdateOrgGitLabSelfHostedIDP(t *testing.T) {
 						}(),
 					),
 				),
-				secretCrypto: crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
+				secretCrypto: crypto.CreateMockAuthEncryptionAlg(gomock.NewController(t)),
 			},
 			args: args{
 				ctx:           context.Background(),
@@ -3772,7 +3772,7 @@ func TestCommandSide_AddOrgGoogleIDP(t *testing.T) {
 	type fields struct {
 		eventstore   func(*testing.T) *eventstore.Eventstore
 		idGenerator  id.Generator
-		secretCrypto crypto.EncryptionAlgorithm
+		secretCrypto crypto.AuthEncryptionAlgorithm
 	}
 	type args struct {
 		ctx           context.Context
@@ -3848,7 +3848,7 @@ func TestCommandSide_AddOrgGoogleIDP(t *testing.T) {
 					),
 				),
 				idGenerator:  id_mock.NewIDGeneratorExpectIDs(t, "id1"),
-				secretCrypto: crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
+				secretCrypto: crypto.CreateMockAuthEncryptionAlg(gomock.NewController(t)),
 			},
 			args: args{
 				ctx:           context.Background(),
@@ -3890,7 +3890,7 @@ func TestCommandSide_AddOrgGoogleIDP(t *testing.T) {
 					),
 				),
 				idGenerator:  id_mock.NewIDGeneratorExpectIDs(t, "id1"),
-				secretCrypto: crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
+				secretCrypto: crypto.CreateMockAuthEncryptionAlg(gomock.NewController(t)),
 			},
 			args: args{
 				ctx:           context.Background(),
@@ -3938,7 +3938,7 @@ func TestCommandSide_AddOrgGoogleIDP(t *testing.T) {
 func TestCommandSide_UpdateOrgGoogleIDP(t *testing.T) {
 	type fields struct {
 		eventstore   func(*testing.T) *eventstore.Eventstore
-		secretCrypto crypto.EncryptionAlgorithm
+		secretCrypto crypto.AuthEncryptionAlgorithm
 	}
 	type args struct {
 		ctx           context.Context
@@ -4088,7 +4088,7 @@ func TestCommandSide_UpdateOrgGoogleIDP(t *testing.T) {
 						}(),
 					),
 				),
-				secretCrypto: crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
+				secretCrypto: crypto.CreateMockAuthEncryptionAlg(gomock.NewController(t)),
 			},
 			args: args{
 				ctx:           context.Background(),
@@ -4135,7 +4135,7 @@ func TestCommandSide_AddOrgLDAPIDP(t *testing.T) {
 	type fields struct {
 		eventstore   func(*testing.T) *eventstore.Eventstore
 		idGenerator  id.Generator
-		secretCrypto crypto.EncryptionAlgorithm
+		secretCrypto crypto.AuthEncryptionAlgorithm
 	}
 	type args struct {
 		ctx           context.Context
@@ -4383,7 +4383,7 @@ func TestCommandSide_AddOrgLDAPIDP(t *testing.T) {
 					),
 				),
 				idGenerator:  id_mock.NewIDGeneratorExpectIDs(t, "id1"),
-				secretCrypto: crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
+				secretCrypto: crypto.CreateMockAuthEncryptionAlg(gomock.NewController(t)),
 			},
 			args: args{
 				ctx:           context.Background(),
@@ -4455,7 +4455,7 @@ func TestCommandSide_AddOrgLDAPIDP(t *testing.T) {
 					),
 				),
 				idGenerator:  id_mock.NewIDGeneratorExpectIDs(t, "id1"),
-				secretCrypto: crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
+				secretCrypto: crypto.CreateMockAuthEncryptionAlg(gomock.NewController(t)),
 			},
 			args: args{
 				ctx:           context.Background(),
@@ -4526,7 +4526,7 @@ func TestCommandSide_AddOrgLDAPIDP(t *testing.T) {
 func TestCommandSide_UpdateOrgLDAPIDP(t *testing.T) {
 	type fields struct {
 		eventstore   func(*testing.T) *eventstore.Eventstore
-		secretCrypto crypto.EncryptionAlgorithm
+		secretCrypto crypto.AuthEncryptionAlgorithm
 	}
 	type args struct {
 		ctx           context.Context
@@ -4886,7 +4886,7 @@ func TestCommandSide_UpdateOrgLDAPIDP(t *testing.T) {
 						}(),
 					),
 				),
-				secretCrypto: crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
+				secretCrypto: crypto.CreateMockAuthEncryptionAlg(gomock.NewController(t)),
 			},
 			args: args{
 				ctx:           context.Background(),
@@ -4956,7 +4956,7 @@ func TestCommandSide_AddOrgAppleIDP(t *testing.T) {
 	type fields struct {
 		eventstore   func(*testing.T) *eventstore.Eventstore
 		idGenerator  id.Generator
-		secretCrypto crypto.EncryptionAlgorithm
+		secretCrypto crypto.AuthEncryptionAlgorithm
 	}
 	type args struct {
 		ctx           context.Context
@@ -5087,7 +5087,7 @@ func TestCommandSide_AddOrgAppleIDP(t *testing.T) {
 					),
 				),
 				idGenerator:  id_mock.NewIDGeneratorExpectIDs(t, "id1"),
-				secretCrypto: crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
+				secretCrypto: crypto.CreateMockAuthEncryptionAlg(gomock.NewController(t)),
 			},
 			args: args{
 				ctx:           context.Background(),
@@ -5133,7 +5133,7 @@ func TestCommandSide_AddOrgAppleIDP(t *testing.T) {
 					),
 				),
 				idGenerator:  id_mock.NewIDGeneratorExpectIDs(t, "id1"),
-				secretCrypto: crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
+				secretCrypto: crypto.CreateMockAuthEncryptionAlg(gomock.NewController(t)),
 			},
 			args: args{
 				ctx:           context.Background(),
@@ -5178,7 +5178,7 @@ func TestCommandSide_AddOrgAppleIDP(t *testing.T) {
 func TestCommandSide_UpdateOrgAppleIDP(t *testing.T) {
 	type fields struct {
 		eventstore   func(*testing.T) *eventstore.Eventstore
-		secretCrypto crypto.EncryptionAlgorithm
+		secretCrypto crypto.AuthEncryptionAlgorithm
 	}
 	type args struct {
 		ctx           context.Context
@@ -5388,7 +5388,7 @@ func TestCommandSide_UpdateOrgAppleIDP(t *testing.T) {
 						}(),
 					),
 				),
-				secretCrypto: crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
+				secretCrypto: crypto.CreateMockAuthEncryptionAlg(gomock.NewController(t)),
 			},
 			args: args{
 				ctx:           context.Background(),
@@ -5436,7 +5436,7 @@ func TestCommandSide_AddOrgSAMLIDP(t *testing.T) {
 	type fields struct {
 		eventstore                 func(*testing.T) *eventstore.Eventstore
 		idGenerator                id.Generator
-		secretCrypto               crypto.EncryptionAlgorithm
+		secretCrypto               crypto.AuthEncryptionAlgorithm
 		certificateAndKeyGenerator func(id string) ([]byte, []byte, error)
 	}
 	type args struct {
@@ -5539,7 +5539,7 @@ func TestCommandSide_AddOrgSAMLIDP(t *testing.T) {
 					),
 				),
 				idGenerator:  id_mock.NewIDGeneratorExpectIDs(t, "id1"),
-				secretCrypto: crypto.CreateMockEncryptionAlg(gomock.NewController(t)), certificateAndKeyGenerator: func(id string) ([]byte, []byte, error) { return []byte("key"), []byte("certificate"), nil },
+				secretCrypto: crypto.CreateMockAuthEncryptionAlg(gomock.NewController(t)), certificateAndKeyGenerator: func(id string) ([]byte, []byte, error) { return []byte("key"), []byte("certificate"), nil },
 			},
 			args: args{
 				ctx:           context.Background(),
@@ -5587,7 +5587,7 @@ func TestCommandSide_AddOrgSAMLIDP(t *testing.T) {
 					),
 				),
 				idGenerator:                id_mock.NewIDGeneratorExpectIDs(t, "id1"),
-				secretCrypto:               crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
+				secretCrypto:               crypto.CreateMockAuthEncryptionAlg(gomock.NewController(t)),
 				certificateAndKeyGenerator: func(id string) ([]byte, []byte, error) { return []byte("key"), []byte("certificate"), nil },
 			},
 			args: args{
@@ -5642,7 +5642,7 @@ func TestCommandSide_AddOrgSAMLIDP(t *testing.T) {
 func TestCommandSide_UpdateOrgSAMLIDP(t *testing.T) {
 	type fields struct {
 		eventstore   func(*testing.T) *eventstore.Eventstore
-		secretCrypto crypto.EncryptionAlgorithm
+		secretCrypto crypto.AuthEncryptionAlgorithm
 	}
 	type args struct {
 		ctx           context.Context
@@ -5846,7 +5846,7 @@ func TestCommandSide_UpdateOrgSAMLIDP(t *testing.T) {
 						}(),
 					),
 				),
-				secretCrypto: crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
+				secretCrypto: crypto.CreateMockAuthEncryptionAlg(gomock.NewController(t)),
 			},
 			args: args{
 				ctx:           context.Background(),
@@ -5896,7 +5896,7 @@ func TestCommandSide_UpdateOrgSAMLIDP(t *testing.T) {
 func TestCommandSide_RegenerateOrgSAMLProviderCertificate(t *testing.T) {
 	type fields struct {
 		eventstore                 func(*testing.T) *eventstore.Eventstore
-		secretCrypto               crypto.EncryptionAlgorithm
+		secretCrypto               crypto.AuthEncryptionAlgorithm
 		certificateAndKeyGenerator func(id string) ([]byte, []byte, error)
 	}
 	type args struct {
@@ -5991,7 +5991,7 @@ func TestCommandSide_RegenerateOrgSAMLProviderCertificate(t *testing.T) {
 						}(),
 					),
 				),
-				secretCrypto: crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
+				secretCrypto: crypto.CreateMockAuthEncryptionAlg(gomock.NewController(t)),
 				certificateAndKeyGenerator: func(id string) ([]byte, []byte, error) {
 					return []byte("new key"), []byte("new certificate"), nil
 				},
@@ -6031,7 +6031,7 @@ func TestCommandSide_AddOrgZitadelIDP(t *testing.T) {
 	type fields struct {
 		eventstore   func(*testing.T) *eventstore.Eventstore
 		idGenerator  id.Generator
-		secretCrypto crypto.EncryptionAlgorithm
+		secretCrypto crypto.AuthEncryptionAlgorithm
 	}
 	type args struct {
 		ctx           context.Context
@@ -6150,7 +6150,7 @@ func TestCommandSide_AddOrgZitadelIDP(t *testing.T) {
 					),
 				),
 				idGenerator:  id_mock.NewIDGeneratorExpectIDs(t, "id1"),
-				secretCrypto: crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
+				secretCrypto: crypto.CreateMockAuthEncryptionAlg(gomock.NewController(t)),
 			},
 			args: args{
 				ctx:           context.Background(),
@@ -6196,7 +6196,7 @@ func TestCommandSide_AddOrgZitadelIDP(t *testing.T) {
 					),
 				),
 				idGenerator:  id_mock.NewIDGeneratorExpectIDs(t, "id1"),
-				secretCrypto: crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
+				secretCrypto: crypto.CreateMockAuthEncryptionAlg(gomock.NewController(t)),
 			},
 			args: args{
 				ctx:           context.Background(),
@@ -6275,7 +6275,7 @@ func TestCommands_UpdateOrgZitadelIDP(t *testing.T) {
 	pushErr := errors.New("push error")
 	type fields struct {
 		eventstore   func(*testing.T) *eventstore.Eventstore
-		secretCrypto crypto.EncryptionAlgorithm
+		secretCrypto crypto.AuthEncryptionAlgorithm
 	}
 	type args struct {
 		id            string
@@ -6414,7 +6414,7 @@ func TestCommands_UpdateOrgZitadelIDP(t *testing.T) {
 						),
 					),
 				),
-				secretCrypto: crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
+				secretCrypto: crypto.CreateMockAuthEncryptionAlg(gomock.NewController(t)),
 			},
 			args: args{
 				id:            "id1",
@@ -6549,7 +6549,7 @@ func TestCommands_UpdateOrgZitadelIDP(t *testing.T) {
 						}(),
 					),
 				),
-				secretCrypto: crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
+				secretCrypto: crypto.CreateMockAuthEncryptionAlg(gomock.NewController(t)),
 			},
 			args: args{
 				id:            "id1",
@@ -6622,7 +6622,7 @@ func TestCommands_UpdateOrgZitadelIDP(t *testing.T) {
 						}(),
 					),
 				),
-				secretCrypto: crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
+				secretCrypto: crypto.CreateMockAuthEncryptionAlg(gomock.NewController(t)),
 			},
 			args: args{
 				id:            "id1",
@@ -6700,7 +6700,7 @@ func TestCommands_UpdateOrgZitadelIDP(t *testing.T) {
 						}(),
 					),
 				),
-				secretCrypto: crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
+				secretCrypto: crypto.CreateMockAuthEncryptionAlg(gomock.NewController(t)),
 			},
 			args: args{
 				id:            "id1",

internal/command/session.go

@@ -33,7 +33,7 @@ type SessionCommands struct {
 	eventCommands     []eventstore.Command
 
 	hasher               *crypto.Hasher
-	intentAlg            crypto.EncryptionAlgorithm
+	intentAlg            crypto.AuthEncryptionAlgorithm
 	totpAlg              crypto.EncryptionAlgorithm
 	otpAlg               crypto.EncryptionAlgorithm
 	createCode           encryptedCodeWithDefaultFunc

internal/command/session_test.go

@@ -421,15 +421,14 @@ func TestCommands_UpdateSession(t *testing.T) {
 }
 
 func TestCommands_updateSession(t *testing.T) {
-	decryption := func(err error) crypto.EncryptionAlgorithm {
-		mCrypto := crypto.NewMockEncryptionAlgorithm(gomock.NewController(t))
-		mCrypto.EXPECT().EncryptionKeyID().Return("id")
-		mCrypto.EXPECT().DecryptString(gomock.Any(), gomock.Any()).DoAndReturn(
-			func(code []byte, keyID string) (string, error) {
+	decryption := func(err error) crypto.AuthEncryptionAlgorithm {
+		mCrypto := crypto.NewMockAuthEncryptionAlgorithm(gomock.NewController(t))
+		mCrypto.EXPECT().DecryptToken(gomock.Any()).DoAndReturn(
+			func(token string) (string, error) {
 				if err != nil {
 					return "", err
 				}
-				return string(code), nil
+				return token, nil
 			})
 		return mCrypto
 	}
@@ -705,7 +704,7 @@ func TestCommands_updateSession(t *testing.T) {
 					sessionWriteModel: NewSessionWriteModel("sessionID", "instance1"),
 					sessionCommands: []SessionCommand{
 						CheckUser("userID", "org1", &language.Afrikaans),
-						CheckIntent("intent", "aW50ZW50"),
+						CheckIntent("intent", "intent"),
 					},
 					createToken: func(sessionID string) (string, string, error) {
 						return "tokenID",
@@ -756,7 +755,7 @@ func TestCommands_updateSession(t *testing.T) {
 					sessionWriteModel: NewSessionWriteModel("sessionID", "instance1"),
 					sessionCommands: []SessionCommand{
 						CheckUser("userID", "org1", &language.Afrikaans),
-						CheckIntent("intent", "aW50ZW50"),
+						CheckIntent("intent", "intent"),
 					},
 					createToken: func(sessionID string) (string, string, error) {
 						return "tokenID",
@@ -843,7 +842,7 @@ func TestCommands_updateSession(t *testing.T) {
 					sessionWriteModel: NewSessionWriteModel("sessionID", "instance1"),
 					sessionCommands: []SessionCommand{
 						CheckUser("userID", "org1", &language.Afrikaans),
-						CheckIntent("intent", "aW50ZW50"),
+						CheckIntent("intent", "intent"),
 					},
 					createToken: func(sessionID string) (string, string, error) {
 						return "tokenID",
@@ -894,7 +893,7 @@ func TestCommands_updateSession(t *testing.T) {
 					sessionWriteModel: NewSessionWriteModel("sessionID", "instance1"),
 					sessionCommands: []SessionCommand{
 						CheckUser("userID", "org1", &language.Afrikaans),
-						CheckIntent("intent", "aW50ZW50"),
+						CheckIntent("intent", "intent"),
 					},
 					createToken: func(sessionID string) (string, string, error) {
 						return "tokenID",
@@ -956,7 +955,7 @@ func TestCommands_updateSession(t *testing.T) {
 					sessionWriteModel: NewSessionWriteModel("sessionID", "instance1"),
 					sessionCommands: []SessionCommand{
 						CheckUser("userID", "org1", &language.Afrikaans),
-						CheckIntent("intent", "aW50ZW50"),
+						CheckIntent("intent", "intent"),
 					},
 					createToken: func(sessionID string) (string, string, error) {
 						return "tokenID",
@@ -1037,7 +1036,7 @@ func TestCommands_updateSession(t *testing.T) {
 					sessionWriteModel: NewSessionWriteModel("sessionID", "instance1"),
 					sessionCommands: []SessionCommand{
 						CheckUser("userID", "org1", &language.Afrikaans),
-						CheckIntent("intent", "aW50ZW50"),
+						CheckIntent("intent", "intent"),
 					},
 					createToken: func(sessionID string) (string, string, error) {
 						return "tokenID",

internal/crypto/code_mocker.go

@@ -37,6 +37,46 @@ func CreateMockEncryptionAlg(ctrl *gomock.Controller) EncryptionAlgorithm {
 	return mCrypto
 }
 
+func CreateMockAuthEncryptionAlg(ctrl *gomock.Controller) AuthEncryptionAlgorithm {
+	mCrypto := NewMockAuthEncryptionAlgorithm(ctrl)
+	mCrypto.EXPECT().Algorithm().AnyTimes().Return("enc")
+	mCrypto.EXPECT().EncryptionKeyID().AnyTimes().Return("id")
+	mCrypto.EXPECT().DecryptionKeyIDs().AnyTimes().Return([]string{"id"})
+	mCrypto.EXPECT().Encrypt(gomock.Any()).AnyTimes().DoAndReturn(
+		func(code []byte) ([]byte, error) {
+			return code, nil
+		},
+	)
+	mCrypto.EXPECT().DecryptString(gomock.Any(), gomock.Any()).AnyTimes().DoAndReturn(
+		func(code []byte, keyID string) (string, error) {
+			if keyID != "id" {
+				return "", zerrors.ThrowInternal(nil, "id", "invalid key id")
+			}
+			return string(code), nil
+		},
+	)
+	mCrypto.EXPECT().Decrypt(gomock.Any(), gomock.Any()).AnyTimes().DoAndReturn(
+		func(code []byte, keyID string) ([]byte, error) {
+			if keyID != "id" {
+				return nil, zerrors.ThrowInternal(nil, "id", "invalid key id")
+			}
+			return code, nil
+		},
+	)
+	mCrypto.EXPECT().EncryptToken(gomock.Any()).AnyTimes().DoAndReturn(
+		func(data string) (string, error) {
+			return data, nil
+		},
+	)
+	mCrypto.EXPECT().DecryptToken(gomock.Any()).AnyTimes().DoAndReturn(
+		func(token string) (string, error) {
+			return token, nil
+		},
+	)
+	mCrypto.EXPECT().LegacyTokenEnabled().AnyTimes().Return(false)
+	return mCrypto
+}
+
 func createMockCrypto(t *testing.T) EncryptionAlgorithm {
 	mCrypto := NewMockEncryptionAlgorithm(gomock.NewController(t))
 	mCrypto.EXPECT().Algorithm().AnyTimes().Return("crypto")

internal/crypto/crypto.go

@@ -2,7 +2,6 @@ package crypto
 
 import (
 	"database/sql/driver"
-	"encoding/base64"
 	"encoding/json"
 	"slices"
 
@@ -14,7 +13,7 @@ const (
 	TypeHash                  // Depcrecated: use [passwap.Swapper] instead
 )
 
-//go:generate mockgen -typed -package crypto -destination ./crypto.mock.go . EncryptionAlgorithm
+//go:generate mockgen -typed -package crypto -destination ./crypto.mock.go . EncryptionAlgorithm,AuthEncryptionAlgorithm
 
 // EncryptionAlgorithm is an interface that defines the methods for encrypting and decrypting values,
 // used for sensitive data stored in the database.
@@ -149,18 +148,14 @@ func checkEncryptionAlgorithm(value *CryptoValue, alg EncryptionAlgorithm) error
 	return zerrors.ThrowInvalidArgument(nil, "CRYPT-Kq12vn", "value was encrypted with a different key")
 }
 
-func CheckToken(alg EncryptionAlgorithm, token string, content string) error {
+func CheckToken(alg AuthAlgorithm, token string, content string) error {
 	if token == "" {
 		return zerrors.ThrowPermissionDenied(nil, "CRYPTO-Sfefs", "Errors.Intent.InvalidToken")
 	}
 	if alg == nil {
 		return zerrors.ThrowInvalidArgument(nil, "CRYPT-edCJsp", "input encryption algorithm cannot be nil")
 	}
-	data, err := base64.RawURLEncoding.DecodeString(token)
-	if err != nil {
-		return zerrors.ThrowPermissionDenied(err, "CRYPTO-Swg31", "Errors.Intent.InvalidToken")
-	}
-	decryptedToken, err := alg.DecryptString(data, alg.EncryptionKeyID())
+	decryptedToken, err := alg.DecryptToken(token)
 	if err != nil {
 		return zerrors.ThrowPermissionDenied(err, "CRYPTO-Sf4gt", "Errors.Intent.InvalidToken")
 	}

internal/crypto/crypto.mock.go

@@ -1,9 +1,9 @@
 // Code generated by MockGen. DO NOT EDIT.
-// Source: github.com/zitadel/zitadel/internal/crypto (interfaces: EncryptionAlgorithm)
+// Source: github.com/zitadel/zitadel/internal/crypto (interfaces: EncryptionAlgorithm,AuthEncryptionAlgorithm)
 //
 // Generated by this command:
 //
-//	mockgen -typed -package crypto -destination ./crypto.mock.go . EncryptionAlgorithm
+//	mockgen -typed -package crypto -destination ./crypto.mock.go . EncryptionAlgorithm,AuthEncryptionAlgorithm
 //
 
 // Package crypto is a generated GoMock package.
@@ -269,3 +269,374 @@ func (c *MockEncryptionAlgorithmEncryptionKeyIDCall) DoAndReturn(f func() string
 	c.Call = c.Call.DoAndReturn(f)
 	return c
 }
+
+// MockAuthEncryptionAlgorithm is a mock of AuthEncryptionAlgorithm interface.
+type MockAuthEncryptionAlgorithm struct {
+	ctrl     *gomock.Controller
+	recorder *MockAuthEncryptionAlgorithmMockRecorder
+	isgomock struct{}
+}
+
+// MockAuthEncryptionAlgorithmMockRecorder is the mock recorder for MockAuthEncryptionAlgorithm.
+type MockAuthEncryptionAlgorithmMockRecorder struct {
+	mock *MockAuthEncryptionAlgorithm
+}
+
+// NewMockAuthEncryptionAlgorithm creates a new mock instance.
+func NewMockAuthEncryptionAlgorithm(ctrl *gomock.Controller) *MockAuthEncryptionAlgorithm {
+	mock := &MockAuthEncryptionAlgorithm{ctrl: ctrl}
+	mock.recorder = &MockAuthEncryptionAlgorithmMockRecorder{mock}
+	return mock
+}
+
+// EXPECT returns an object that allows the caller to indicate expected use.
+func (m *MockAuthEncryptionAlgorithm) EXPECT() *MockAuthEncryptionAlgorithmMockRecorder {
+	return m.recorder
+}
+
+// Algorithm mocks base method.
+func (m *MockAuthEncryptionAlgorithm) Algorithm() string {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "Algorithm")
+	ret0, _ := ret[0].(string)
+	return ret0
+}
+
+// Algorithm indicates an expected call of Algorithm.
+func (mr *MockAuthEncryptionAlgorithmMockRecorder) Algorithm() *MockAuthEncryptionAlgorithmAlgorithmCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Algorithm", reflect.TypeOf((*MockAuthEncryptionAlgorithm)(nil).Algorithm))
+	return &MockAuthEncryptionAlgorithmAlgorithmCall{Call: call}
+}
+
+// MockAuthEncryptionAlgorithmAlgorithmCall wrap *gomock.Call
+type MockAuthEncryptionAlgorithmAlgorithmCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockAuthEncryptionAlgorithmAlgorithmCall) Return(arg0 string) *MockAuthEncryptionAlgorithmAlgorithmCall {
+	c.Call = c.Call.Return(arg0)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockAuthEncryptionAlgorithmAlgorithmCall) Do(f func() string) *MockAuthEncryptionAlgorithmAlgorithmCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockAuthEncryptionAlgorithmAlgorithmCall) DoAndReturn(f func() string) *MockAuthEncryptionAlgorithmAlgorithmCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// Decrypt mocks base method.
+func (m *MockAuthEncryptionAlgorithm) Decrypt(hashed []byte, keyID string) ([]byte, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "Decrypt", hashed, keyID)
+	ret0, _ := ret[0].([]byte)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// Decrypt indicates an expected call of Decrypt.
+func (mr *MockAuthEncryptionAlgorithmMockRecorder) Decrypt(hashed, keyID any) *MockAuthEncryptionAlgorithmDecryptCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Decrypt", reflect.TypeOf((*MockAuthEncryptionAlgorithm)(nil).Decrypt), hashed, keyID)
+	return &MockAuthEncryptionAlgorithmDecryptCall{Call: call}
+}
+
+// MockAuthEncryptionAlgorithmDecryptCall wrap *gomock.Call
+type MockAuthEncryptionAlgorithmDecryptCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockAuthEncryptionAlgorithmDecryptCall) Return(arg0 []byte, arg1 error) *MockAuthEncryptionAlgorithmDecryptCall {
+	c.Call = c.Call.Return(arg0, arg1)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockAuthEncryptionAlgorithmDecryptCall) Do(f func([]byte, string) ([]byte, error)) *MockAuthEncryptionAlgorithmDecryptCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockAuthEncryptionAlgorithmDecryptCall) DoAndReturn(f func([]byte, string) ([]byte, error)) *MockAuthEncryptionAlgorithmDecryptCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// DecryptString mocks base method.
+func (m *MockAuthEncryptionAlgorithm) DecryptString(hashed []byte, keyID string) (string, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "DecryptString", hashed, keyID)
+	ret0, _ := ret[0].(string)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// DecryptString indicates an expected call of DecryptString.
+func (mr *MockAuthEncryptionAlgorithmMockRecorder) DecryptString(hashed, keyID any) *MockAuthEncryptionAlgorithmDecryptStringCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DecryptString", reflect.TypeOf((*MockAuthEncryptionAlgorithm)(nil).DecryptString), hashed, keyID)
+	return &MockAuthEncryptionAlgorithmDecryptStringCall{Call: call}
+}
+
+// MockAuthEncryptionAlgorithmDecryptStringCall wrap *gomock.Call
+type MockAuthEncryptionAlgorithmDecryptStringCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockAuthEncryptionAlgorithmDecryptStringCall) Return(arg0 string, arg1 error) *MockAuthEncryptionAlgorithmDecryptStringCall {
+	c.Call = c.Call.Return(arg0, arg1)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockAuthEncryptionAlgorithmDecryptStringCall) Do(f func([]byte, string) (string, error)) *MockAuthEncryptionAlgorithmDecryptStringCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockAuthEncryptionAlgorithmDecryptStringCall) DoAndReturn(f func([]byte, string) (string, error)) *MockAuthEncryptionAlgorithmDecryptStringCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// DecryptToken mocks base method.
+func (m *MockAuthEncryptionAlgorithm) DecryptToken(token string) (string, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "DecryptToken", token)
+	ret0, _ := ret[0].(string)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// DecryptToken indicates an expected call of DecryptToken.
+func (mr *MockAuthEncryptionAlgorithmMockRecorder) DecryptToken(token any) *MockAuthEncryptionAlgorithmDecryptTokenCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DecryptToken", reflect.TypeOf((*MockAuthEncryptionAlgorithm)(nil).DecryptToken), token)
+	return &MockAuthEncryptionAlgorithmDecryptTokenCall{Call: call}
+}
+
+// MockAuthEncryptionAlgorithmDecryptTokenCall wrap *gomock.Call
+type MockAuthEncryptionAlgorithmDecryptTokenCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockAuthEncryptionAlgorithmDecryptTokenCall) Return(arg0 string, arg1 error) *MockAuthEncryptionAlgorithmDecryptTokenCall {
+	c.Call = c.Call.Return(arg0, arg1)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockAuthEncryptionAlgorithmDecryptTokenCall) Do(f func(string) (string, error)) *MockAuthEncryptionAlgorithmDecryptTokenCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockAuthEncryptionAlgorithmDecryptTokenCall) DoAndReturn(f func(string) (string, error)) *MockAuthEncryptionAlgorithmDecryptTokenCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// DecryptionKeyIDs mocks base method.
+func (m *MockAuthEncryptionAlgorithm) DecryptionKeyIDs() []string {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "DecryptionKeyIDs")
+	ret0, _ := ret[0].([]string)
+	return ret0
+}
+
+// DecryptionKeyIDs indicates an expected call of DecryptionKeyIDs.
+func (mr *MockAuthEncryptionAlgorithmMockRecorder) DecryptionKeyIDs() *MockAuthEncryptionAlgorithmDecryptionKeyIDsCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DecryptionKeyIDs", reflect.TypeOf((*MockAuthEncryptionAlgorithm)(nil).DecryptionKeyIDs))
+	return &MockAuthEncryptionAlgorithmDecryptionKeyIDsCall{Call: call}
+}
+
+// MockAuthEncryptionAlgorithmDecryptionKeyIDsCall wrap *gomock.Call
+type MockAuthEncryptionAlgorithmDecryptionKeyIDsCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockAuthEncryptionAlgorithmDecryptionKeyIDsCall) Return(arg0 []string) *MockAuthEncryptionAlgorithmDecryptionKeyIDsCall {
+	c.Call = c.Call.Return(arg0)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockAuthEncryptionAlgorithmDecryptionKeyIDsCall) Do(f func() []string) *MockAuthEncryptionAlgorithmDecryptionKeyIDsCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockAuthEncryptionAlgorithmDecryptionKeyIDsCall) DoAndReturn(f func() []string) *MockAuthEncryptionAlgorithmDecryptionKeyIDsCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// Encrypt mocks base method.
+func (m *MockAuthEncryptionAlgorithm) Encrypt(value []byte) ([]byte, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "Encrypt", value)
+	ret0, _ := ret[0].([]byte)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// Encrypt indicates an expected call of Encrypt.
+func (mr *MockAuthEncryptionAlgorithmMockRecorder) Encrypt(value any) *MockAuthEncryptionAlgorithmEncryptCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Encrypt", reflect.TypeOf((*MockAuthEncryptionAlgorithm)(nil).Encrypt), value)
+	return &MockAuthEncryptionAlgorithmEncryptCall{Call: call}
+}
+
+// MockAuthEncryptionAlgorithmEncryptCall wrap *gomock.Call
+type MockAuthEncryptionAlgorithmEncryptCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockAuthEncryptionAlgorithmEncryptCall) Return(arg0 []byte, arg1 error) *MockAuthEncryptionAlgorithmEncryptCall {
+	c.Call = c.Call.Return(arg0, arg1)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockAuthEncryptionAlgorithmEncryptCall) Do(f func([]byte) ([]byte, error)) *MockAuthEncryptionAlgorithmEncryptCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockAuthEncryptionAlgorithmEncryptCall) DoAndReturn(f func([]byte) ([]byte, error)) *MockAuthEncryptionAlgorithmEncryptCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// EncryptToken mocks base method.
+func (m *MockAuthEncryptionAlgorithm) EncryptToken(data string) (string, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "EncryptToken", data)
+	ret0, _ := ret[0].(string)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// EncryptToken indicates an expected call of EncryptToken.
+func (mr *MockAuthEncryptionAlgorithmMockRecorder) EncryptToken(data any) *MockAuthEncryptionAlgorithmEncryptTokenCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "EncryptToken", reflect.TypeOf((*MockAuthEncryptionAlgorithm)(nil).EncryptToken), data)
+	return &MockAuthEncryptionAlgorithmEncryptTokenCall{Call: call}
+}
+
+// MockAuthEncryptionAlgorithmEncryptTokenCall wrap *gomock.Call
+type MockAuthEncryptionAlgorithmEncryptTokenCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockAuthEncryptionAlgorithmEncryptTokenCall) Return(arg0 string, arg1 error) *MockAuthEncryptionAlgorithmEncryptTokenCall {
+	c.Call = c.Call.Return(arg0, arg1)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockAuthEncryptionAlgorithmEncryptTokenCall) Do(f func(string) (string, error)) *MockAuthEncryptionAlgorithmEncryptTokenCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockAuthEncryptionAlgorithmEncryptTokenCall) DoAndReturn(f func(string) (string, error)) *MockAuthEncryptionAlgorithmEncryptTokenCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// EncryptionKeyID mocks base method.
+func (m *MockAuthEncryptionAlgorithm) EncryptionKeyID() string {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "EncryptionKeyID")
+	ret0, _ := ret[0].(string)
+	return ret0
+}
+
+// EncryptionKeyID indicates an expected call of EncryptionKeyID.
+func (mr *MockAuthEncryptionAlgorithmMockRecorder) EncryptionKeyID() *MockAuthEncryptionAlgorithmEncryptionKeyIDCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "EncryptionKeyID", reflect.TypeOf((*MockAuthEncryptionAlgorithm)(nil).EncryptionKeyID))
+	return &MockAuthEncryptionAlgorithmEncryptionKeyIDCall{Call: call}
+}
+
+// MockAuthEncryptionAlgorithmEncryptionKeyIDCall wrap *gomock.Call
+type MockAuthEncryptionAlgorithmEncryptionKeyIDCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockAuthEncryptionAlgorithmEncryptionKeyIDCall) Return(arg0 string) *MockAuthEncryptionAlgorithmEncryptionKeyIDCall {
+	c.Call = c.Call.Return(arg0)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockAuthEncryptionAlgorithmEncryptionKeyIDCall) Do(f func() string) *MockAuthEncryptionAlgorithmEncryptionKeyIDCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockAuthEncryptionAlgorithmEncryptionKeyIDCall) DoAndReturn(f func() string) *MockAuthEncryptionAlgorithmEncryptionKeyIDCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// LegacyTokenEnabled mocks base method.
+func (m *MockAuthEncryptionAlgorithm) LegacyTokenEnabled() bool {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "LegacyTokenEnabled")
+	ret0, _ := ret[0].(bool)
+	return ret0
+}
+
+// LegacyTokenEnabled indicates an expected call of LegacyTokenEnabled.
+func (mr *MockAuthEncryptionAlgorithmMockRecorder) LegacyTokenEnabled() *MockAuthEncryptionAlgorithmLegacyTokenEnabledCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "LegacyTokenEnabled", reflect.TypeOf((*MockAuthEncryptionAlgorithm)(nil).LegacyTokenEnabled))
+	return &MockAuthEncryptionAlgorithmLegacyTokenEnabledCall{Call: call}
+}
+
+// MockAuthEncryptionAlgorithmLegacyTokenEnabledCall wrap *gomock.Call
+type MockAuthEncryptionAlgorithmLegacyTokenEnabledCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockAuthEncryptionAlgorithmLegacyTokenEnabledCall) Return(arg0 bool) *MockAuthEncryptionAlgorithmLegacyTokenEnabledCall {
+	c.Call = c.Call.Return(arg0)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockAuthEncryptionAlgorithmLegacyTokenEnabledCall) Do(f func() bool) *MockAuthEncryptionAlgorithmLegacyTokenEnabledCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockAuthEncryptionAlgorithmLegacyTokenEnabledCall) DoAndReturn(f func() bool) *MockAuthEncryptionAlgorithmLegacyTokenEnabledCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}

proto/zitadel/resources/user/v3alpha/user_service.proto

@@ -2154,11 +2154,11 @@ message GetIdentityProviderIntentRequest {
   ];
   // Token of the identity provider (IDP) intent, previously returned on the success response of the start identity provider intent.
   string idp_intent_token = 4 [
-    (validate.rules).string = {min_len: 1, max_len: 200},
+    (validate.rules).string = {min_len: 1, max_len: 500},
     (google.api.field_behavior) = REQUIRED,
     (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
       min_length: 1;
-      max_length: 200;
+      max_length: 500;
       example: "\"SJKL3ioIDpo342ioqw98fjp3sdf32wahb=\"";
     }
   ];

proto/zitadel/session/v2/session_service.proto

@@ -621,11 +621,11 @@ message CheckIDPIntent {
 
   // The token of the idp intent, previously returned on the success response of the IDP callback.
   string idp_intent_token = 2 [
-    (validate.rules).string = {min_len: 1, max_len: 200},
+    (validate.rules).string = {min_len: 1, max_len: 500},
     (google.api.field_behavior) = REQUIRED,
     (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
       min_length: 1;
-      max_length: 200;
+      max_length: 500;
       example: "\"SJKL3ioIDpo342ioqw98fjp3sdf32wahb=\"";
     }
   ];

proto/zitadel/session/v2beta/session_service.proto

@@ -480,11 +480,11 @@ message CheckIDPIntent {
     }
   ];
   string idp_intent_token = 2 [
-    (validate.rules).string = {min_len: 1, max_len: 200},
+    (validate.rules).string = {min_len: 1, max_len: 500},
     (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
       description: "token of the idp intent, previously returned on the success response of the IDP callback"
       min_length: 1;
-      max_length: 200;
+      max_length: 500;
       example: "\"SJKL3ioIDpo342ioqw98fjp3sdf32wahb=\"";
     }
   ];

proto/zitadel/user/v2/idp.proto

@@ -72,7 +72,7 @@ message IDPIntent {
     (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
       description: "token of the IDP intent"
       min_length: 1;
-      max_length: 200;
+      max_length: 500;
       example: "\"SJKL3ioIDpo342ioqw98fjp3sdf32wahb=\"";
     }
   ];

proto/zitadel/user/v2/user_service.proto

@@ -3206,11 +3206,11 @@ message RetrieveIdentityProviderIntentRequest{
     }
   ];
   string idp_intent_token = 2 [
-    (validate.rules).string = {min_len: 1, max_len: 200},
+    (validate.rules).string = {min_len: 1, max_len: 500},
     (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
       description: "token of the idp intent, previously returned on the success response of the IDP callback"
       min_length: 1;
-      max_length: 200;
+      max_length: 500;
       example: "\"SJKL3ioIDpo342ioqw98fjp3sdf32wahb=\"";
     }
   ];

proto/zitadel/user/v2beta/idp.proto

@@ -72,7 +72,7 @@ message IDPIntent {
     (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
       description: "token of the IDP intent"
       min_length: 1;
-      max_length: 200;
+      max_length: 500;
       example: "\"SJKL3ioIDpo342ioqw98fjp3sdf32wahb=\"";
     }
   ];

proto/zitadel/user/v2beta/user_service.proto

@@ -1821,11 +1821,11 @@ message RetrieveIdentityProviderIntentRequest{
     }
   ];
   string idp_intent_token = 2 [
-    (validate.rules).string = {min_len: 1, max_len: 200},
+    (validate.rules).string = {min_len: 1, max_len: 500},
     (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
       description: "token of the idp intent, previously returned on the success response of the IDP callback"
       min_length: 1;
-      max_length: 200;
+      max_length: 500;
       example: "\"SJKL3ioIDpo342ioqw98fjp3sdf32wahb=\"";
     }
   ];