Repository: apache/airavata-custos (language: python)

Issue:
moving keycloak to quay.io.9.0.2



Discussion / hints:

Fix patch:
diff --git a/custos-client-sdks/custos-java-clients/custos-clients-core/src/main/java/org/apache/custos/clients/core/ClientUtils.java b/custos-client-sdks/custos-java-clients/custos-clients-core/src/main/java/org/apache/custos/clients/core/ClientUtils.java
index 2bd9c6aed..afcccf503 100644
--- a/custos-client-sdks/custos-java-clients/custos-clients-core/src/main/java/org/apache/custos/clients/core/ClientUtils.java
+++ b/custos-client-sdks/custos-java-clients/custos-clients-core/src/main/java/org/apache/custos/clients/core/ClientUtils.java
@@ -78,6 +78,13 @@ public static Metadata getUserTokenHeader(String accessToken) {
         return header;
     }
 
+    public static Metadata getAgentEnablingHeader() {
+        Metadata header = new Metadata();
+        Metadata.Key<String> key = Metadata.Key.of(Constants.AUTHENTICATE_AGENT, Metadata.ASCII_STRING_MARSHALLER);
+        header.put(key, "true");
+        return header;
+    }
+
     /**
      * Provides file object
      *
diff --git a/custos-client-sdks/custos-java-clients/group-management-client/src/main/java/org/apache/custos/group/management/client/GroupManagementClient.java b/custos-client-sdks/custos-java-clients/group-management-client/src/main/java/org/apache/custos/group/management/client/GroupManagementClient.java
index eaa0ca989..42ab864f3 100644
--- a/custos-client-sdks/custos-java-clients/group-management-client/src/main/java/org/apache/custos/group/management/client/GroupManagementClient.java
+++ b/custos-client-sdks/custos-java-clients/group-management-client/src/main/java/org/apache/custos/group/management/client/GroupManagementClient.java
@@ -45,14 +45,14 @@ public GroupManagementClient(String serviceHost, int servicePort, String clientI
      * @param groupRepresentation
      * @return
      */
-    public GroupsResponse createGroup(String clientId, GroupRepresentation[] groupRepresentation) {
+    public GroupsResponse createKeycloakGroup(String clientId, GroupRepresentation[] groupRepresentation) {
 
         GroupsRequest request = GroupsRequest
                 .newBuilder()
                 .addAllGroups(Arrays.asList(groupRepresentation))
                 .setClientId(clientId)
                 .build();
-        return blockingStub.createGroups(request);
+        return blockingStub.createKeycloakGroups(request);
 
     }
 
@@ -64,14 +64,14 @@ public GroupsResponse createGroup(String clientId, GroupRepresentation[] groupRe
      * @param groupRepresentation
      * @return
      */
-    public GroupRepresentation updateGroup(String clientId, GroupRepresentation groupRepresentation) {
+    public GroupRepresentation updateKeycloakGroup(String clientId, GroupRepresentation groupRepresentation) {
 
         GroupRequest request = GroupRequest
                 .newBuilder()
                 .setGroup(groupRepresentation)
                 .setClientId(clientId)
                 .build();
-        return blockingStub.updateGroup(request);
+        return blockingStub.updateKeycloakGroup(request);
     }
 
     /**
@@ -81,14 +81,14 @@ public GroupRepresentation updateGroup(String clientId, GroupRepresentation grou
      * @param groupRepresentation
      * @return
      */
-    public OperationStatus deleteGroup(String clientId, GroupRepresentation groupRepresentation) {
+    public OperationStatus deleteKeycloakGroup(String clientId, GroupRepresentation groupRepresentation) {
 
         GroupRequest request = GroupRequest
                 .newBuilder()
                 .setGroup(groupRepresentation)
                 .setClientId(clientId)
                 .build();
-        return blockingStub.deleteGroup(request);
+        return blockingStub.deleteKeycloakGroup(request);
     }
 
 
@@ -100,7 +100,7 @@ public OperationStatus deleteGroup(String clientId, GroupRepresentation groupRep
      * @param groupId
      * @return
      */
-    public GroupRepresentation findGroup(String clientId, String groupName, String groupId) {
+    public GroupRepresentation findKeycloakGroup(String clientId, String groupName, String groupId) {
 
         GroupRepresentation groupRepresentation =
                 GroupRepresentation.newBuilder().build();
@@ -117,7 +117,7 @@ public GroupRepresentation findGroup(String clientId, String groupName, String g
                 .setGroup(groupRepresentation)
                 .setClientId(clientId)
                 .build();
-        return blockingStub.findGroup(request);
+        return blockingStub.findKeycloakGroup(request);
     }
 
 
@@ -127,12 +127,12 @@ public GroupRepresentation findGroup(String clientId, String groupName, String g
      * @param clientId
      * @return
      */
-    public GroupsResponse getAllGroups(String clientId) {
+    public GroupsResponse getAllKeycloakGroups(String clientId) {
         GroupRequest request = GroupRequest
                 .newBuilder()
                 .setClientId(clientId)
                 .build();
-        return blockingStub.getAllGroups(request);
+        return blockingStub.getAllKeycloakGroups(request);
     }
 
 
@@ -144,14 +144,14 @@ public GroupsResponse getAllGroups(String clientId) {
      * @param groupId
      * @return
      */
-    public OperationStatus addUserToGroup(String clientId, String username, String groupId, String type) {
+    public OperationStatus addUserToKeycloakGroup(String clientId, String username, String groupId, String type) {
         UserGroupMappingRequest request = UserGroupMappingRequest
                 .newBuilder()
                 .setUsername(username)
                 .setClientId(clientId)
                 .setMembershipType(type)
                 .setGroupId(groupId).build();
-        return blockingStub.addUserToGroup(request);
+        return blockingStub.addUserToKeycloakGroup(request);
 
     }
 
@@ -163,19 +163,151 @@ public OperationStatus addUserToGroup(String clientId, String username, String g
      * @param groupId
      * @return
      */
-    public OperationStatus removeUserFromGroup(String clientId, String username, String groupId) {
+    public OperationStatus removeUserFromKeycloakGroup(String clientId, String username, String groupId) {
 
         UserGroupMappingRequest request = UserGroupMappingRequest
                 .newBuilder()
                 .setUsername(username)
                 .setClientId(clientId)
                 .setGroupId(groupId).build();
+        return blockingStub.removeUserFromKeycloakGroup(request);
+
+    }
+
+
+    public Group createGroup(String clientId, Group group) {
+
+        org.apache.custos.user.profile.service.GroupRequest request =
+                org.apache.custos.user.profile.service.GroupRequest
+                        .newBuilder()
+                        .setGroup(group)
+                        .setClientId(clientId)
+                        .build();
+        return blockingStub.createGroup(request);
+
+    }
+
+
+    /**
+     * update group
+     *
+     * @param clientId
+     * @return
+     */
+    public Group updateGroup(String clientId, Group group) {
+
+        org.apache.custos.user.profile.service.GroupRequest request =
+                org.apache.custos.user.profile.service.GroupRequest
+                        .newBuilder()
+                        .setGroup(group)
+                        .setClientId(clientId)
+                        .build();
+        return blockingStub.updateGroup(request);
+    }
+
+    /**
+     * delete group
+     *
+     * @param clientId
+     * @param groupRepresentation
+     * @return
+     */
+    public Status deleteGroup(String clientId, Group group) {
+
+        org.apache.custos.user.profile.service.GroupRequest request =
+                org.apache.custos.user.profile.service.GroupRequest
+                        .newBuilder()
+                        .setGroup(group)
+                        .setClientId(clientId)
+                        .build();
+        return blockingStub.deleteGroup(request);
+    }
+
+
+    /**
+     * find group
+     *
+     * @param clientId
+     * @param groupName
+     * @param groupId
+     * @return
+     */
+    public Group findGroup(String clientId, String groupName, String groupId) {
+
+        Group group =
+                Group.newBuilder().build();
+        if (groupName != null) {
+            group = group.toBuilder().setName(groupName).build();
+        }
+
+        if (groupId != null) {
+            group = group.toBuilder().setId(groupId).build();
+        }
+
+        org.apache.custos.user.profile.service.GroupRequest request = org.apache.custos.user.profile.service.GroupRequest
+                .newBuilder()
+                .setGroup(group)
+                .setClientId(clientId)
+                .build();
+        return blockingStub.findGroup(request);
+    }
+
+
+    /**
+     * Get all groups
+     *
+     * @param clientId
+     * @return
+     */
+    public GetAllGroupsResponse getAllGroups(String clientId) {
+        org.apache.custos.user.profile.service.GroupRequest request = org.apache.custos.user.profile.service.GroupRequest
+                .newBuilder()
+                .setClientId(clientId)
+                .build();
+        return blockingStub.getAllGroups(request);
+    }
+
+
+    /**
+     * Add user to group
+     *
+     * @param clientId
+     * @param username
+     * @param groupId
+     * @return
+     */
+    public Status addUserToGroup(String clientId, String username, String groupId, String type) {
+        GroupMembership request = GroupMembership
+                .newBuilder()
+                .setUsername(username)
+                .setClientId(clientId)
+                .setType(type)
+                .setGroupId(groupId).build();
+        return blockingStub.addUserToGroup(request);
+
+    }
+
+    /**
+     * Remove user from group
+     *
+     * @param clientId
+     * @param username
+     * @param groupId
+     * @return
+     */
+    public Status removeUserFromGroup(String clientId, String username, String groupId) {
+
+        GroupMembership request = GroupMembership
+                .newBuilder()
+                .setUsername(username)
+                .setClientId(clientId)
+                .setGroupId(groupId).build();
         return blockingStub.removeUserFromGroup(request);
 
     }
 
 
-    public OperationStatus addChildGroupToParentGroup(String clientId, String parentId, String childId) {
+    public Status addChildGroupToParentGroup(String clientId, String parentId, String childId) {
         GroupToGroupMembership membership = GroupToGroupMembership
                 .newBuilder()
                 .setChildId(childId)
@@ -187,7 +319,7 @@ public OperationStatus addChildGroupToParentGroup(String clientId, String parent
     }
 
 
-    public OperationStatus removeChildGroupFromParentGroup(String clientId, String parentId, String childId) {
+    public Status removeChildGroupFromParentGroup(String clientId, String parentId, String childId) {
         GroupToGroupMembership membership = GroupToGroupMembership
                 .newBuilder()
                 .setChildId(childId)
@@ -265,7 +397,7 @@ public GetAllGroupsResponse getAllChildGroups(String clientId, String id) {
     }
 
 
-    public OperationStatus changeUserMembershipType(String clientId, String username, String groupId, String type) {
+    public Status changeUserMembershipType(String clientId, String username, String groupId, String type) {
 
         GroupMembership membership = GroupMembership
                 .newBuilder()
@@ -279,7 +411,7 @@ public OperationStatus changeUserMembershipType(String clientId, String username
     }
 
 
-    public OperationStatus hasAccess(String clientId, String groupId, String userId, String type) {
+    public Status hasAccess(String clientId, String groupId, String userId, String type) {
         GroupMembership membership = GroupMembership
                 .newBuilder()
                 .setUsername(userId)
diff --git a/custos-client-sdks/custos-java-clients/identity-management-client/src/main/java/org/apache/custos/identity/management/client/IdentityManagementClient.java b/custos-client-sdks/custos-java-clients/identity-management-client/src/main/java/org/apache/custos/identity/management/client/IdentityManagementClient.java
index c8fe1b9af..65f74b477 100644
--- a/custos-client-sdks/custos-java-clients/identity-management-client/src/main/java/org/apache/custos/identity/management/client/IdentityManagementClient.java
+++ b/custos-client-sdks/custos-java-clients/identity-management-client/src/main/java/org/apache/custos/identity/management/client/IdentityManagementClient.java
@@ -31,12 +31,13 @@
 import org.apache.custos.identity.management.service.IdentityManagementServiceGrpc;
 import org.apache.custos.identity.service.*;
 
+import java.io.Closeable;
 import java.io.IOException;
 
 /**
  * Java client to connect with the Custos Identity Management Service
  */
-public class IdentityManagementClient {
+public class IdentityManagementClient implements Closeable {
 
 
     private ManagedChannel managedChannel;
@@ -189,5 +190,30 @@ public User getUser(String clientId, String username, String accessToken) {
 
     }
 
+    public User getUser(String accessToken) {
+        AuthToken authToken = AuthToken.newBuilder()
+                .setAccessToken(accessToken)
+                .build();
+        return blockingStub.getUser(authToken);
+
+    }
 
+    public boolean isAuthenticated(String accessToken) {
+        try {
+            AuthToken authToken = AuthToken
+                    .newBuilder()
+                    .setAccessToken(accessToken)
+                    .build();
+            IsAuthenticatedResponse authenticatedResponse = blockingStub.isAuthenticated(authToken);
+            return authenticatedResponse.getAuthenticated();
+        } catch (Exception ex) {
+            return false;
+        }
+
+    }
+
+    @Override
+    public void close() throws IOException {
+        this.managedChannel.shutdown();
+    }
 }
diff --git a/custos-client-sdks/custos-java-clients/resource-secret-management-client/src/main/java/org/apache/custos/resource/secret/management/client/ResourceSecretManagementAgentClient.java b/custos-client-sdks/custos-java-clients/resource-secret-management-client/src/main/java/org/apache/custos/resource/secret/management/client/ResourceSecretManagementAgentClient.java
new file mode 100644
index 000000000..8d729fe09
--- /dev/null
+++ b/custos-client-sdks/custos-java-clients/resource-secret-management-client/src/main/java/org/apache/custos/resource/secret/management/client/ResourceSecretManagementAgentClient.java
@@ -0,0 +1,168 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing,
+ *  software distributed under the License is distributed on an
+ *  "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ *  KIND, either express or implied. See the License for the
+ *  specific language governing permissions and limitations
+ *  under the License.
+ */
+
+package org.apache.custos.resource.secret.management.client;
+
+import com.google.protobuf.Struct;
+import io.grpc.ManagedChannel;
+import io.grpc.Metadata;
+import io.grpc.stub.MetadataUtils;
+import org.apache.custos.clients.core.ClientUtils;
+import org.apache.custos.resource.secret.management.service.ResourceSecretManagementServiceGrpc;
+import org.apache.custos.resource.secret.service.*;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import java.io.IOException;
+import java.util.List;
+import java.util.Map;
+
+/**
+ * Client for agents or service accounts to manage secrets of Custos
+ */
+public class ResourceSecretManagementAgentClient extends ResourceSecretManagementClient  {
+
+    private static final Logger LOGGER = LoggerFactory.getLogger(ResourceSecretManagementAgentClient.class);
+
+
+    ManagedChannel managedChannel = null;
+
+    public ResourceSecretManagementAgentClient(String serviceHost, int servicePort,
+                                               String clientId, String clientSecret) throws IOException {
+
+        super(serviceHost, servicePort, clientId, clientSecret);
+        managedChannel = getManagedChannel();
+    }
+
+    public SecretMetadata getSecret(String userToken, String agentToken,
+                                    ResourceOwnerType ownerType, ResourceType resourceType) {
+
+        return super.getSecret(ownerType, resourceType, attachedHeaders(userToken, agentToken));
+    }
+
+
+    public Struct getJWKS(String userToken, String agentToken) {
+        attachedHeaders(userToken, agentToken);
+        return super.getJWKS();
+    }
+
+    public SecretMetadata getResourceCredentialSummary(String userToken, String agentToken, String clientId, String token) {
+        return super.getResourceCredentialSummary(clientId, token, attachedHeaders(userToken, agentToken));
+    }
+
+
+    public ResourceCredentialSummaries getAllResourceCredentialSummaries(String userToken, String agentToken,
+                                                                         String clientId, List<String> accessibleTokens) {
+        return super.getAllResourceCredentialSummaries(clientId, accessibleTokens, attachedHeaders(userToken, agentToken));
+    }
+
+    public AddResourceCredentialResponse generateSSHCredential(String userToken, String agentToken,
+                                                               String clientId, String description, String ownerId) {
+        return super.generateSSHCredential(clientId, description, ownerId, attachedHeaders(userToken, agentToken));
+    }
+
+    public AddResourceCredentialResponse addSSHCredential(String userToken, String agentToken, String csToken,
+                                                          String passphrase, String privateKey, String publicKey,
+                                                          String clientId, String description, String ownerId) {
+        return super.addSSHCredential(csToken, passphrase, privateKey,
+                publicKey, clientId, description, ownerId, attachedHeaders(userToken, agentToken));
+    }
+
+    public AddResourceCredentialResponse addPasswordCredential(String userToken, String agentToken,
+                                                               String clientId, String description, String ownerId,  String userId,String password) {
+        return super.addPasswordCredential(clientId,
+                description, ownerId, userId, password,attachedHeaders(userToken, agentToken));
+    }
+
+
+    public AddResourceCredentialResponse addPasswordCredential(String userToken, String agentToken,
+                                                               String token, String clientId, String description,
+                                                               String ownerId,  String userId, String password) {
+        return super.addPasswordCredential(token, clientId,
+                description, ownerId, userId,password, attachedHeaders(userToken, agentToken));
+    }
+
+    public SSHCredential getSSHCredential(String userToken, String agentToken, String csToken, boolean useShamirSecret) {
+        return super.getSSHCredential("",
+                csToken, useShamirSecret, attachedHeaders(userToken, agentToken));
+    }
+
+
+    public PasswordCredential getPasswordCredential(String userToken, String agentToken,
+                                                    String clientId, String token) {
+        return super.getPasswordCredential(clientId, token, attachedHeaders(userToken, agentToken));
+    }
+
+    public ResourceCredentialOperationStatus deleteSSHCredential(String userToken, String agentToken,
+                                                                 String clientId, String token) {
+        return super.deleteSSHCredential(clientId, token, attachedHeaders(userToken, agentToken));
+    }
+
+    public ResourceCredentialOperationStatus deletePWDCredential(String userToken, String agentToken,
+                                                                 String clientId, String token) {
+        return super.deletePWDCredential(clientId, token, attachedHeaders(userToken, agentToken));
+    }
+
+    public AddResourceCredentialResponse addCredentialMap(String userToken, String agentToken,
+                                                              String clientId, String description, String ownerId,
+                                                              String token, Map<String, String> credentialMap) {
+        return super.addCredentialMap(clientId, description, ownerId,
+                token, credentialMap, attachedHeaders(userToken, agentToken));
+    }
+
+    public CredentialMap getCredentialMap(String userToken, String agentToken, String clientId, String token) {
+        return super.getCredentialMap(clientId, token, attachedHeaders(userToken, agentToken));
+    }
+
+    public ResourceCredentialOperationStatus deleteCredentialMap(String userToken,
+                                                                 String agentToken, String clientId, String token) {
+        return super.deleteCredentialMap(clientId, token, attachedHeaders(userToken, agentToken));
+    }
+
+
+    public ResourceCredentialOperationStatus updateCredentialMap(String userToken, String agentToken,
+                                                                 String clientId, String description, String ownerId,
+                                                                 String token, Map<String, String> credentialMap) {
+        return super.updateCredentialMap(clientId, description, ownerId, token, credentialMap,
+                attachedHeaders(userToken, agentToken));
+    }
+
+
+    private ResourceSecretManagementServiceGrpc.ResourceSecretManagementServiceBlockingStub
+    attachedHeaders(String userToken, String agentToken) {
+        ResourceSecretManagementServiceGrpc.ResourceSecretManagementServiceBlockingStub
+                blockingStub = ResourceSecretManagementServiceGrpc.newBlockingStub(managedChannel);
+
+        Metadata authHeader = ClientUtils.getAuthorizationHeader(agentToken);
+        Metadata tokenHeader = ClientUtils.getUserTokenHeader(userToken);
+        Metadata agentEnablingHeaders = ClientUtils.getAgentEnablingHeader();
+        blockingStub = MetadataUtils.attachHeaders(blockingStub, authHeader);
+        blockingStub = MetadataUtils.attachHeaders(blockingStub, tokenHeader);
+        blockingStub = MetadataUtils.attachHeaders(blockingStub, agentEnablingHeaders);
+        return blockingStub;
+    }
+
+    @Override
+    public void close() throws IOException {
+        super.close();
+        if (this.managedChannel != null) {
+            this.managedChannel.shutdown();
+        }
+    }
+}
diff --git a/custos-client-sdks/custos-java-clients/resource-secret-management-client/src/main/java/org/apache/custos/resource/secret/management/client/ResourceSecretManagementClient.java b/custos-client-sdks/custos-java-clients/resource-secret-management-client/src/main/java/org/apache/custos/resource/secret/management/client/ResourceSecretManagementClient.java
index a43639a4f..3766b41c5 100644
--- a/custos-client-sdks/custos-java-clients/resource-secret-management-client/src/main/java/org/apache/custos/resource/secret/management/client/ResourceSecretManagementClient.java
+++ b/custos-client-sdks/custos-java-clients/resource-secret-management-client/src/main/java/org/apache/custos/resource/secret/management/client/ResourceSecretManagementClient.java
@@ -19,6 +19,7 @@
 
 package org.apache.custos.resource.secret.management.client;
 
+import com.google.protobuf.ByteString;
 import com.google.protobuf.Struct;
 import io.grpc.ManagedChannel;
 import io.grpc.netty.GrpcSslContexts;
@@ -26,21 +27,27 @@
 import io.grpc.stub.MetadataUtils;
 import org.apache.custos.clients.core.ClientUtils;
 import org.apache.custos.identity.service.GetJWKSRequest;
+import org.apache.custos.integration.core.utils.ShamirSecretHandler;
 import org.apache.custos.resource.secret.management.service.ResourceSecretManagementServiceGrpc;
 import org.apache.custos.resource.secret.service.*;
 
+import java.io.Closeable;
 import java.io.IOException;
 import java.util.List;
+import java.util.Map;
 
 /**
  * This class is responsible for managing resource secrets
  */
-public class ResourceSecretManagementClient {
+public class ResourceSecretManagementClient implements Closeable {
 
     private ManagedChannel managedChannel;
 
     private ResourceSecretManagementServiceGrpc.ResourceSecretManagementServiceBlockingStub blockingStub;
 
+    private int defaultNumOfShares = 5;
+    private int defaultThreshold = 3;
+
 
     public ResourceSecretManagementClient(String serviceHost, int servicePort, String clientId,
                                           String clientSecret) throws IOException {
@@ -84,7 +91,8 @@ public SecretMetadata getSecret(ResourceOwnerType ownerType, ResourceType resour
      *
      * @return
      */
-    public Struct getJWKS() {
+    public Struct getJWKS(ResourceSecretManagementServiceGrpc.
+                                  ResourceSecretManagementServiceBlockingStub blockingStub) {
         GetJWKSRequest request = GetJWKSRequest.newBuilder().build();
         return blockingStub.getJWKS(request);
     }
@@ -151,6 +159,27 @@ public AddResourceCredentialResponse generateSSHCredential(String clientId, Stri
 
     }
 
+    public AddResourceCredentialResponse addSSHCredential(String token, String passphrase, String privateKey,
+                                                          String publicKey, String clientId, String description, String ownerId) {
+        SecretMetadata metadata = SecretMetadata.newBuilder()
+                .setClientId(clientId)
+                .setDescription(description)
+                .setOwnerId(ownerId)
+                .setToken(token).
+                        build();
+
+        SSHCredential sshCredential = SSHCredential
+                .newBuilder()
+                .setMetadata(metadata)
+                .setPassphrase(passphrase)
+                .setPrivateKey(privateKey)
+                .setPublicKey(publicKey).build();
+
+        return blockingStub.addSSHCredential(sshCredential);
+
+    }
+
+
     /**
      * Save password credentials
      *
@@ -160,7 +189,7 @@ public AddResourceCredentialResponse generateSSHCredential(String clientId, Stri
      * @param password
      * @return AddResourceCredentialResponse
      */
-    public AddResourceCredentialResponse addPasswordCredential(String clientId, String description, String ownerId, String password) {
+    public AddResourceCredentialResponse addPasswordCredential(String clientId, String description, String ownerId, String userId, String password) {
         SecretMetadata metadata = SecretMetadata.newBuilder()
                 .setClientId(clientId)
                 .setDescription(description)
@@ -173,6 +202,34 @@ public AddResourceCredentialResponse addPasswordCredential(String clientId, Stri
                 .setPassword(password)
                 .build();
 
+        if (userId != null) {
+            sshCredential = sshCredential.toBuilder().setUserId(userId).build();
+        }
+
+        return blockingStub.addPasswordCredential(sshCredential);
+
+    }
+
+    public AddResourceCredentialResponse addPasswordCredential(String token, String clientId,
+                                                               String description, String ownerId, String userId, String password) {
+        SecretMetadata metadata = SecretMetadata.newBuilder()
+                .setClientId(clientId)
+                .setDescription(description)
+                .setOwnerId(ownerId)
+                .setToken(token)
+                .build();
+
+
+        PasswordCredential sshCredential = PasswordCredential
+                .newBuilder()
+                .setMetadata(metadata)
+                .setPassword(password)
+                .build();
+
+        if (userId != null) {
+            sshCredential = sshCredential.toBuilder().setUserId(userId).build();
+        }
+
         return blockingStub.addPasswordCredential(sshCredential);
 
     }
@@ -185,15 +242,29 @@ public AddResourceCredentialResponse addPasswordCredential(String clientId, Stri
      * @param token
      * @return SSHCredential
      */
-    public SSHCredential getSSHCredential(String clientId, String token) {
+    public SSHCredential getSSHCredential(String clientId, String token, boolean useShamirSecret) {
+
         GetResourceCredentialByTokenRequest tokenRequest = GetResourceCredentialByTokenRequest
                 .newBuilder()
                 .setClientId(clientId)
                 .setToken(token)
                 .build();
-
-
-        return blockingStub.getSSHCredential(tokenRequest);
+        if (useShamirSecret) {
+            tokenRequest = tokenRequest.toBuilder()
+                    .setUseShamirsSecretSharingWithEncryption(true)
+                    .setNumOfShares(defaultNumOfShares)
+                    .setThreshold(defaultThreshold)
+                    .build();
+        }
+
+        SSHCredential sshCredential = blockingStub.getSSHCredential(tokenRequest);
+
+        if (useShamirSecret) {
+            List<ByteString> shares = sshCredential.getPrivateKeySharesList();
+            String secret = ShamirSecretHandler.generateSecret(shares, defaultNumOfShares, defaultThreshold);
+            sshCredential = sshCredential.toBuilder().setPrivateKey(secret).build();
+        }
+        return sshCredential;
 
     }
 
@@ -253,4 +324,438 @@ public ResourceCredentialOperationStatus deletePWDCredential(String clientId, St
     }
 
 
+    /**
+     * provides resource secret for given owner type and resource type
+     *
+     * @param ownerType
+     * @param resourceType
+     * @return
+     */
+    public SecretMetadata getSecret(ResourceOwnerType ownerType, ResourceType resourceType, ResourceSecretManagementServiceGrpc.
+            ResourceSecretManagementServiceBlockingStub blockingStub) {
+
+        SecretMetadata metadata = SecretMetadata
+                .newBuilder()
+                .setOwnerType(ownerType)
+                .setResourceType(resourceType)
+                .build();
+
+        GetSecretRequest request = GetSecretRequest.newBuilder().setMetadata(metadata).build();
+        return blockingStub.getSecret(request);
+    }
+
+    /**
+     * provides JWKS keys for calling tenant
+     *
+     * @return
+     */
+    public Struct getJWKS() {
+        GetJWKSRequest request = GetJWKSRequest.newBuilder().build();
+        return blockingStub.getJWKS(request);
+    }
+
+
+    /**
+     * Provides metadata object of credentials
+     *
+     * @param clientId
+     * @param token
+     * @return SecretMetadata
+     */
+    public SecretMetadata getResourceCredentialSummary(String clientId, String token, ResourceSecretManagementServiceGrpc.
+            ResourceSecretManagementServiceBlockingStub blockingStub) {
+
+        GetResourceCredentialByTokenRequest tokenRequest = GetResourceCredentialByTokenRequest
+                .newBuilder()
+                .setClientId(clientId)
+                .setToken(token)
+                .build();
+
+        return blockingStub.getResourceCredentialSummary(tokenRequest);
+
+    }
+
+    /**
+     * Provides metadata array of credentials metadata
+     *
+     * @param clientId
+     * @param accessibleTokens
+     * @return SecretMetadata[]
+     */
+    public ResourceCredentialSummaries getAllResourceCredentialSummaries(String clientId, List<String> accessibleTokens, ResourceSecretManagementServiceGrpc.
+            ResourceSecretManagementServiceBlockingStub blockingStub) {
+        GetResourceCredentialSummariesRequest summariesRequest = GetResourceCredentialSummariesRequest
+                .newBuilder()
+                .setClientId(clientId)
+                .addAllAccessibleTokens(accessibleTokens).build();
+
+
+        return blockingStub.getAllResourceCredentialSummaries(summariesRequest);
+
+    }
+
+    /**
+     * Generate SSH credentials
+     *
+     * @param clientId
+     * @param description
+     * @param ownerId
+     * @return AddResourceCredentialResponse
+     */
+    public AddResourceCredentialResponse generateSSHCredential(String clientId, String description, String ownerId, ResourceSecretManagementServiceGrpc.
+            ResourceSecretManagementServiceBlockingStub blockingStub) {
+
+        SecretMetadata metadata = SecretMetadata.newBuilder()
+                .setClientId(clientId)
+                .setDescription(description)
+                .setOwnerId(ownerId).build();
+
+
+        SSHCredential sshCredential = SSHCredential
+                .newBuilder()
+                .setMetadata(metadata).build();
+
+        return blockingStub.addSSHCredential(sshCredential);
+
+    }
+
+    public AddResourceCredentialResponse addSSHCredential(String token, String passphrase, String privateKey,
+                                                          String publicKey, String clientId, String description, String ownerId,
+                                                          ResourceSecretManagementServiceGrpc.
+                                                                  ResourceSecretManagementServiceBlockingStub blockingStub) {
+        SecretMetadata metadata = SecretMetadata.newBuilder()
+                .setClientId(clientId)
+                .setDescription(description)
+                .setOwnerId(ownerId)
+                .setToken(token).
+                        build();
+
+        SSHCredential sshCredential = SSHCredential
+                .newBuilder()
+                .setMetadata(metadata)
+                .setPassphrase(passphrase)
+                .setPrivateKey(privateKey)
+                .setPublicKey(publicKey).build();
+
+        return blockingStub.addSSHCredential(sshCredential);
+
+    }
+
+
+    /**
+     * Save password credentials
+     *
+     * @param clientId
+     * @param description
+     * @param ownerId
+     * @param password
+     * @return AddResourceCredentialResponse
+     */
+    public AddResourceCredentialResponse addPasswordCredential(String clientId, String description,
+                                                               String ownerId, String userId, String password,
+                                                               ResourceSecretManagementServiceGrpc.
+                                                                       ResourceSecretManagementServiceBlockingStub blockingStub) {
+        SecretMetadata metadata = SecretMetadata.newBuilder()
+                .setClientId(clientId)
+                .setDescription(description)
+                .setOwnerId(ownerId).build();
+
+        PasswordCredential sshCredential = PasswordCredential
+                .newBuilder()
+                .setMetadata(metadata)
+                .setPassword(password)
+                .build();
+        if (userId != null) {
+            sshCredential = sshCredential.toBuilder().setUserId(userId).build();
+        }
+
+        return blockingStub.addPasswordCredential(sshCredential);
+    }
+
+
+    public AddResourceCredentialResponse addPasswordCredential(String token, String clientId,
+                                                               String description, String ownerId,
+                                                               String userId, String password,
+                                                               ResourceSecretManagementServiceGrpc.
+                                                                       ResourceSecretManagementServiceBlockingStub blockingStub) {
+        SecretMetadata metadata = SecretMetadata.newBuilder()
+                .setClientId(clientId)
+                .setDescription(description)
+                .setOwnerId(ownerId)
+                .setToken(token)
+                .build();
+
+        PasswordCredential sshCredential = PasswordCredential
+                .newBuilder()
+                .setMetadata(metadata)
+                .setPassword(password)
+                .build();
+
+        if (userId != null) {
+            sshCredential = sshCredential.toBuilder().setUserId(userId).build();
+        }
+
+        return blockingStub.addPasswordCredential(sshCredential);
+
+    }
+
+
+    /**
+     * Provides SSHCredential of given token
+     *
+     * @param clientId
+     * @param token
+     * @return SSHCredential
+     */
+    public SSHCredential getSSHCredential(String clientId, String token,
+                                          boolean useShamirSecret,
+                                          ResourceSecretManagementServiceGrpc.
+                                                  ResourceSecretManagementServiceBlockingStub blockingStub) {
+
+        GetResourceCredentialByTokenRequest tokenRequest = GetResourceCredentialByTokenRequest
+                .newBuilder()
+                .setClientId(clientId)
+                .setToken(token)
+                .build();
+        if (useShamirSecret) {
+            tokenRequest = tokenRequest.toBuilder()
+                    .setUseShamirsSecretSharingWithEncryption(true)
+                    .setNumOfShares(defaultNumOfShares)
+                    .setThreshold(defaultThreshold)
+                    .build();
+        }
+
+        SSHCredential sshCredential = blockingStub.getSSHCredential(tokenRequest);
+
+        if (useShamirSecret) {
+            List<ByteString> shares = sshCredential.getPrivateKeySharesList();
+            String secret = ShamirSecretHandler.generateSecret(shares, defaultNumOfShares, defaultThreshold);
+            sshCredential = sshCredential.toBuilder().setPrivateKey(secret).build();
+        }
+        return sshCredential;
+
+
+    }
+
+    /**
+     * provides PasswordCredential of given token
+     *
+     * @param clientId
+     * @param token
+     * @return PasswordCredential
+     */
+    public PasswordCredential getPasswordCredential(String clientId, String token, ResourceSecretManagementServiceGrpc.
+            ResourceSecretManagementServiceBlockingStub blockingStub) {
+
+        GetResourceCredentialByTokenRequest tokenRequest = GetResourceCredentialByTokenRequest
+                .newBuilder()
+                .setClientId(clientId)
+                .setToken(token)
+                .build();
+
+
+        return blockingStub.getPasswordCredential(tokenRequest);
+    }
+
+
+    /**
+     * Delete SSHCredential of given token
+     *
+     * @param clientId
+     * @param token
+     * @return ResourceCredentialOperationStatus
+     */
+    public ResourceCredentialOperationStatus deleteSSHCredential(String clientId, String token,
+                                                                 ResourceSecretManagementServiceGrpc.
+                                                                         ResourceSecretManagementServiceBlockingStub blockingStub) {
+        GetResourceCredentialByTokenRequest tokenRequest = GetResourceCredentialByTokenRequest
+                .newBuilder()
+                .setClientId(clientId)
+                .setToken(token)
+                .build();
+
+        return blockingStub.deleteSSHCredential(tokenRequest);
+    }
+
+    public AddResourceCredentialResponse addCredentialMap(String clientId, String description, String ownerId,
+                                                          String token, Map<String, String> credentialMap,
+                                                          ResourceSecretManagementServiceGrpc.
+                                                                  ResourceSecretManagementServiceBlockingStub blockingStub) {
+        SecretMetadata metadata = SecretMetadata.newBuilder()
+                .setClientId(clientId)
+                .setDescription(description)
+                .setOwnerId(ownerId)
+                .setToken(token).
+                        build();
+
+        CredentialMap creMap = CredentialMap
+                .newBuilder()
+                .setMetadata(metadata)
+                .putAllCredentialMap(credentialMap)
+                .build();
+
+        return blockingStub.addCredentialMap(creMap);
+    }
+
+    public CredentialMap getCredentialMap(String clientId, String token,
+                                          ResourceSecretManagementServiceGrpc.
+                                                  ResourceSecretManagementServiceBlockingStub blockingStub) {
+        SecretMetadata metadata = SecretMetadata.newBuilder()
+                .setClientId(clientId)
+                .setToken(token).
+                        build();
+
+        CredentialMap tokenRequest = CredentialMap
+                .newBuilder()
+                .setMetadata(metadata)
+                .build();
+
+        return blockingStub.getCredentialMap(tokenRequest);
+    }
+
+    public ResourceCredentialOperationStatus deleteCredentialMap(String clientId, String token,
+                                                                 ResourceSecretManagementServiceGrpc.
+                                                                         ResourceSecretManagementServiceBlockingStub blockingStub) {
+        SecretMetadata metadata = SecretMetadata.newBuilder()
+                .setClientId(clientId)
+                .setToken(token).
+                        build();
+
+        CredentialMap tokenRequest = CredentialMap
+                .newBuilder()
+                .setMetadata(metadata)
+                .build();
+
+        return blockingStub.deleteCredentialMap(tokenRequest);
+    }
+
+
+    public ResourceCredentialOperationStatus updateCredentialMap(String clientId, String description, String ownerId,
+                                                                 String token, Map<String, String> credentialMap,
+                                                                 ResourceSecretManagementServiceGrpc.
+                                                                         ResourceSecretManagementServiceBlockingStub blockingStub) {
+        SecretMetadata metadata = SecretMetadata.newBuilder()
+                .setClientId(clientId)
+                .setDescription(description)
+                .setOwnerId(ownerId)
+                .setToken(token).
+                        build();
+
+        CredentialMap creMap = CredentialMap
+                .newBuilder()
+                .setMetadata(metadata)
+                .putAllCredentialMap(credentialMap)
+                .build();
+
+        return blockingStub.updateCredentialMap(creMap);
+    }
+
+
+    public AddResourceCredentialResponse addCredentialMap(String clientId, String description, String ownerId,
+                                                          String token, Map<String, String> credentialMap) {
+        SecretMetadata metadata = SecretMetadata.newBuilder()
+                .setClientId(clientId)
+                .setDescription(description)
+                .setOwnerId(ownerId)
+                .setToken(token).
+                        build();
+
+        CredentialMap creMap = CredentialMap
+                .newBuilder()
+                .setMetadata(metadata)
+                .putAllCredentialMap(credentialMap)
+                .build();
+
+        return blockingStub.addCredentialMap(creMap);
+    }
+
+    public CredentialMap getCredentialMap(String clientId, String token) {
+        SecretMetadata metadata = SecretMetadata.newBuilder()
+                .setClientId(clientId)
+                .setToken(token).
+                        build();
+
+        CredentialMap tokenRequest = CredentialMap
+                .newBuilder()
+                .setMetadata(metadata)
+                .build();
+
+        return blockingStub.getCredentialMap(tokenRequest);
+    }
+
+    public ResourceCredentialOperationStatus deleteCredentialMap(String clientId, String token) {
+        SecretMetadata metadata = SecretMetadata.newBuilder()
+                .setClientId(clientId)
+                .setToken(token).
+                        build();
+
+        CredentialMap tokenRequest = CredentialMap
+                .newBuilder()
+                .setMetadata(metadata)
+                .build();
+
+        return blockingStub.deleteCredentialMap(tokenRequest);
+    }
+
+
+    public ResourceCredentialOperationStatus updateCredentialMap(String clientId, String description, String ownerId,
+                                                                 String token, Map<String, String> credentialMap) {
+        SecretMetadata metadata = SecretMetadata.newBuilder()
+                .setClientId(clientId)
+                .setDescription(description)
+                .setOwnerId(ownerId)
+                .setToken(token).
+                        build();
+
+        CredentialMap creMap = CredentialMap
+                .newBuilder()
+                .setMetadata(metadata)
+                .putAllCredentialMap(credentialMap)
+                .build();
+
+        return blockingStub.updateCredentialMap(creMap);
+    }
+
+
+    /**
+     * Delete Password Credential of given token
+     *
+     * @param clientId
+     * @param token
+     * @return ResourceCredentialOperationStatus
+     */
+    public ResourceCredentialOperationStatus deletePWDCredential(String clientId, String token, ResourceSecretManagementServiceGrpc.
+            ResourceSecretManagementServiceBlockingStub blockingStub) {
+        GetResourceCredentialByTokenRequest tokenRequest = GetResourceCredentialByTokenRequest
+                .newBuilder()
+                .setClientId(clientId)
+                .setToken(token)
+                .build();
+
+        return blockingStub.deletePWDCredential(tokenRequest);
+    }
+
+    ManagedChannel getManagedChannel() {
+        return managedChannel;
+    }
+
+    void setManagedChannel(ManagedChannel managedChannel) {
+        this.managedChannel = managedChannel;
+    }
+
+    public ResourceSecretManagementServiceGrpc.ResourceSecretManagementServiceBlockingStub getBlockingStub() {
+        return blockingStub;
+    }
+
+    public void setBlockingStub(ResourceSecretManagementServiceGrpc.ResourceSecretManagementServiceBlockingStub blockingStub) {
+        this.blockingStub = blockingStub;
+    }
+
+
+    @Override
+    public void close() throws IOException {
+        if (this.managedChannel != null) {
+            this.managedChannel.shutdown();
+        }
+    }
 }
diff --git a/custos-client-sdks/custos-java-clients/tenant-management-client/src/main/java/org/apache/custos/tenant/manamgement/client/TenantManagementClient.java b/custos-client-sdks/custos-java-clients/tenant-management-client/src/main/java/org/apache/custos/tenant/manamgement/client/TenantManagementClient.java
index 613a87d9b..9d77ed94b 100644
--- a/custos-client-sdks/custos-java-clients/tenant-management-client/src/main/java/org/apache/custos/tenant/manamgement/client/TenantManagementClient.java
+++ b/custos-client-sdks/custos-java-clients/tenant-management-client/src/main/java/org/apache/custos/tenant/manamgement/client/TenantManagementClient.java
@@ -127,7 +127,7 @@ public CreateTenantResponse registerTenant(String client_name, String requester_
      * @param comment
      * @return
      */
-    public GetTenantResponse updateTenant(String clientId, String client_name, String requester_email, String admin_frist_name,
+    public Tenant updateTenant(String clientId, String client_name, String requester_email, String admin_frist_name,
                                           String admin_last_name, String admin_email, String admin_username,
                                           String admin_password, String[] contacts, String[] redirect_uris,
                                           String client_uri, String scope, String domain, String logo_uri,
@@ -160,7 +160,7 @@ public GetTenantResponse updateTenant(String clientId, String client_name, Strin
     }
 
 
-    public GetTenantResponse getTenant(String clientId) {
+    public Tenant getTenant(String clientId) {
         GetTenantRequest tenantRequest = GetTenantRequest
                 .newBuilder()
                 .setClientId(clientId)
diff --git a/custos-client-sdks/custos-java-sdk/src/main/java/org/apache/custos/clients/CustosClientProvider.java b/custos-client-sdks/custos-java-sdk/src/main/java/org/apache/custos/clients/CustosClientProvider.java
index fa3f05a00..8a4d13498 100644
--- a/custos-client-sdks/custos-java-sdk/src/main/java/org/apache/custos/clients/CustosClientProvider.java
+++ b/custos-client-sdks/custos-java-sdk/src/main/java/org/apache/custos/clients/CustosClientProvider.java
@@ -22,6 +22,7 @@
 import org.apache.custos.agent.management.client.AgentManagementClient;
 import org.apache.custos.group.management.client.GroupManagementClient;
 import org.apache.custos.identity.management.client.IdentityManagementClient;
+import org.apache.custos.resource.secret.management.client.ResourceSecretManagementAgentClient;
 import org.apache.custos.resource.secret.management.client.ResourceSecretManagementClient;
 import org.apache.custos.sharing.management.client.SharingManagementClient;
 import org.apache.custos.tenant.manamgement.client.TenantManagementClient;
@@ -81,6 +82,11 @@ public UserManagementClient getUserManagementClient() throws IOException {
         return new UserManagementClient(this.serverHost, this.serverPort, this.clientId, this.clientSec);
     }
 
+    public ResourceSecretManagementClient getResourceSecretManagementClientForAgents() throws IOException {
+        return new ResourceSecretManagementAgentClient
+                (this.serverHost, this.serverPort, this.clientId, this.clientSec);
+    }
+
 
     public static class Builder {
 
diff --git a/custos-client-sdks/custos-python-sdk/custos/clients/resource_secret_management_client.py b/custos-client-sdks/custos-python-sdk/custos/clients/resource_secret_management_client.py
index cf63981c7..1b41dbca8 100644
--- a/custos-client-sdks/custos-python-sdk/custos/clients/resource_secret_management_client.py
+++ b/custos-client-sdks/custos-python-sdk/custos/clients/resource_secret_management_client.py
@@ -23,8 +23,7 @@
 from custos.server.integration.ResourceSecretManagementService_pb2_grpc import ResourceSecretManagementServiceStub
 from custos.server.core.IdentityService_pb2 import GetJWKSRequest
 from custos.server.core.ResourceSecretService_pb2 import GetSecretRequest, SecretMetadata, ResourceOwnerType, \
-    ResourceSource, \
-    ResourceType, SSHCredential, PasswordCredential, GetResourceCredentialByTokenRequest
+    ResourceSource, KVCredential, ResourceType, SSHCredential, PasswordCredential, GetResourceCredentialByTokenRequest
 from google.protobuf.json_format import MessageToJson
 from custos.clients.utils.certificate_fetching_rest_client import CertificateFetchingRestClient
 
@@ -140,3 +139,57 @@ def get_password_credential(self, token, client_id, password_credential_token):
         except Exception:
             logger.exception("Error occurred while creating password key")
             raise
+
+    def set_KV_credential(self, token, user_token, client_id, key, value):
+        try:
+            token = "Bearer " + token
+            metadata = (('authorization', token),('user_token', user_token),)
+            secret_metadata = SecretMetadata(client_id=client_id)
+            request = KVCredential(key=key, value=value, metadata=secret_metadata)
+
+            msg = self.resource_sec_client.addKVCredential(request=request, metadata=metadata)
+            return MessageToJson(msg)
+        except Exception:
+            logger.exception("Error occurred while creating KV credential")
+            raise
+
+    def update_KV_credential(self, token,user_token, client_id, key, value):
+        try:
+            token = "Bearer " + token
+            metadata = (('authorization', token),('user_token', user_token),)
+            secret_metadata = SecretMetadata(client_id=client_id)
+            request = KVCredential(key=key, value=value, metadata=secret_metadata)
+
+            msg = self.resource_sec_client.updateKVCredential(request=request, metadata=metadata)
+            return MessageToJson(msg)
+        except Exception:
+            logger.exception("Error occurred while updating KV credential")
+            raise
+
+    def delete_KV_credential(self, token, user_token, client_id, key):
+        try:
+            token = "Bearer " + token
+            metadata = (('authorization', token),('user_token', user_token),)
+            secret_metadata = SecretMetadata(client_id=client_id)
+            request = KVCredential(key=key, metadata=secret_metadata)
+
+            msg = self.resource_sec_client.deleteKVCredential(request=request, metadata=metadata)
+            return MessageToJson(msg)
+
+        except Exception:
+            logger.exception("Error occurred while deleting KV credential")
+            raise
+
+    def get_KV_credential(self, token, user_token, client_id, key):
+        try:
+            token = "Bearer " + token
+            metadata = (('authorization', token),('user_token', user_token),)
+            secret_metadata = SecretMetadata(client_id=client_id)
+            request = KVCredential(key=key, metadata=secret_metadata)
+
+            msg = self.resource_sec_client.getKVCredential(request=request, metadata=metadata)
+            return MessageToJson(msg)
+
+        except Exception:
+            logger.exception("Error occurred while get KV credential")
+            raise
diff --git a/custos-client-sdks/custos-python-sdk/custos/samples/resource_secert_management.py b/custos-client-sdks/custos-python-sdk/custos/samples/resource_secert_management.py
new file mode 100644
index 000000000..f2568cbf4
--- /dev/null
+++ b/custos-client-sdks/custos-python-sdk/custos/samples/resource_secert_management.py
@@ -0,0 +1,80 @@
+#  Licensed to the Apache Software Foundation (ASF) under one or more
+#  contributor license agreements.  See the NOTICE file distributed with
+#  this work for additional information regarding copyright ownership.
+#  The ASF licenses this file to You under the Apache License, Version 2.0
+#  (the "License"); you may not use this file except in compliance with
+#  the License.  You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+#  Unless required by applicable law or agreed to in writing, software
+#  distributed under the License is distributed on an "AS IS" BASIS,
+#  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#  See the License for the specific language governing permissions and
+#  limitations under the License.
+#
+import logging
+from custos.clients.user_management_client import UserManagementClient
+from custos.clients.identity_management_client import IdentityManagementClient
+from custos.clients.super_tenant_management_client import SuperTenantManagementClient
+from custos.clients.resource_secret_management_client import ResourceSecretManagementClient
+from google.protobuf.json_format import MessageToDict
+
+from custos.transport.settings import CustosServerClientSettings
+import custos.clients.utils.utilities as utl
+
+logger = logging.getLogger(__name__)
+
+logger.setLevel(logging.DEBUG)
+# create console handler with a higher log level
+handler = logging.StreamHandler()
+handler.setLevel(logging.DEBUG)
+
+custos_settings = CustosServerClientSettings()
+# load APIServerClient with default configuration
+client = UserManagementClient(custos_settings)
+id_client = IdentityManagementClient(custos_settings)
+resource_secret_client = ResourceSecretManagementClient(custos_settings)
+
+token = utl.get_token(custos_settings)
+
+admin_client = SuperTenantManagementClient(custos_settings)
+
+
+def user_login():
+    response = id_client.token(token=
+                               token,
+                               username="USERNAME",
+                               password="PASSWORD",
+                               grant_type="password")
+    dict_obj = MessageToDict(response)
+    return dict_obj['access_token']
+
+
+def setKVCredential():
+    token = user_login()
+    resp = resource_secret_client.set_KV_credential(token=token, user_token=token,
+                                                    client_id='CHANGE_ME', key='Your key',
+                                                    value='Your Value')
+    print(resp)
+
+
+def getKVCredential():
+    token = user_login()
+    resp = resource_secret_client.get_KV_credential(token=token, user_token=token,
+                                                    client_id='CHANGE_ME', key='Your key')
+    print(resp)
+
+
+def updateKVCredential():
+    token = user_login()
+    resp = resource_secret_client.update_KV_credential(token=token, user_token=token,
+                                                       client_id='CHANGE_ME', key='Your key')
+    print(resp)
+
+
+def deleteKVCredential():
+    token = user_login()
+    resp = resource_secret_client.delete_KV_credential(token=token, user_token=token,
+                                                       client_id='CHANGE_ME', key='Your key')
+    print(resp)
diff --git a/custos-client-sdks/custos-python-sdk/custos/server/core/ResourceSecretService_pb2.py b/custos-client-sdks/custos-python-sdk/custos/server/core/ResourceSecretService_pb2.py
index ab90d6803..cc23980ae 100644
--- a/custos-client-sdks/custos-python-sdk/custos/server/core/ResourceSecretService_pb2.py
+++ b/custos-client-sdks/custos-python-sdk/custos/server/core/ResourceSecretService_pb2.py
@@ -20,7 +20,7 @@
   syntax='proto3',
   serialized_options=b'P\001',
   create_key=_descriptor._internal_create_key,
-  serialized_pb=b'\n\x1bResourceSecretService.proto\x12)org.apache.custos.resource.secret.service\"\xda\x03\n\x0eSecretMetadata\x12P\n\nowner_type\x18\x01 \x01(\x0e\x32<.org.apache.custos.resource.secret.service.ResourceOwnerType\x12N\n\rresource_type\x18\x02 \x01(\x0e\x32\x37.org.apache.custos.resource.secret.service.ResourceType\x12I\n\x06source\x18\x03 \x01(\x0e\x32\x39.org.apache.custos.resource.secret.service.ResourceSource\x12\x0c\n\x04name\x18\x04 \x01(\t\x12\r\n\x05value\x18\x05 \x01(\t\x12K\n\x04type\x18\x06 \x01(\x0e\x32=.org.apache.custos.resource.secret.service.ResourceSecretType\x12\x10\n\x08tenantId\x18\x07 \x01(\x03\x12\x10\n\x08owner_id\x18\x08 \x01(\t\x12\x16\n\x0epersisted_time\x18\t \x01(\x03\x12\r\n\x05token\x18\n \x01(\t\x12\x13\n\x0b\x64\x65scription\x18\x0b \x01(\t\x12\x11\n\tclient_id\x18\x0c \x01(\t\"\xab\x01\n\x10GetSecretRequest\x12K\n\x08metadata\x18\x01 \x01(\x0b\x32\x39.org.apache.custos.resource.secret.service.SecretMetadata\x12\x10\n\x08tenantId\x18\x02 \x01(\x03\x12\x10\n\x08\x63lientId\x18\x03 \x01(\t\x12\x11\n\tclientSec\x18\x04 \x01(\t\x12\x13\n\x0b\x61\x63\x63\x65ssToken\x18\x05 \x01(\t\"\xc6\x01\n\x15\x43\x65rtificateCredential\x12K\n\x08metadata\x18\x01 \x01(\x0b\x32\x39.org.apache.custos.resource.secret.service.SecretMetadata\x12\x11\n\tx509_cert\x18\x03 \x01(\t\x12\x11\n\tnot_after\x18\x04 \x01(\t\x12\x13\n\x0bprivate_key\x18\x05 \x01(\t\x12\x11\n\tlife_time\x18\x06 \x01(\x03\x12\x12\n\nnot_before\x18\x07 \x01(\t\"s\n\x12PasswordCredential\x12K\n\x08metadata\x18\x01 \x01(\x0b\x32\x39.org.apache.custos.resource.secret.service.SecretMetadata\x12\x10\n\x08password\x18\x03 \x01(\t\"\x99\x01\n\rSSHCredential\x12K\n\x08metadata\x18\x01 \x01(\x0b\x32\x39.org.apache.custos.resource.secret.service.SecretMetadata\x12\x12\n\npassphrase\x18\x03 \x01(\t\x12\x12\n\npublic_key\x18\x04 \x01(\t\x12\x13\n\x0bprivate_key\x18\x05 \x01(\t\"o\n#GetResourceCredentialByTokenRequest\x12\x10\n\x08tenantId\x18\x01 \x01(\x03\x12\r\n\x05token\x18\x02 \x01(\t\x12\x14\n\x0cperformed_by\x18\x03 \x01(\t\x12\x11\n\tclient_id\x18\x04 \x01(\t\"\xd3\x01\n%GetResourceCredentialSummariesRequest\x12\x45\n\x04type\x18\x01 \x01(\x0e\x32\x37.org.apache.custos.resource.secret.service.ResourceType\x12\x19\n\x11\x61\x63\x63\x65ssible_tokens\x18\x02 \x03(\t\x12\x10\n\x08tenantId\x18\x03 \x01(\x03\x12\x10\n\x08owner_id\x18\x04 \x01(\t\x12\x11\n\tall_types\x18\x05 \x01(\x08\x12\x11\n\tclient_id\x18\x06 \x01(\t\"j\n\x1bResourceCredentialSummaries\x12K\n\x08metadata\x18\x01 \x03(\x0b\x32\x39.org.apache.custos.resource.secret.service.SecretMetadata\".\n\x1d\x41\x64\x64ResourceCredentialResponse\x12\r\n\x05token\x18\x01 \x01(\t\"3\n!ResourceCredentialOperationStatus\x12\x0e\n\x06status\x18\x01 \x01(\x08*<\n\x11ResourceOwnerType\x12\x0f\n\x0bTENANT_USER\x10\x00\x12\n\n\x06\x43USTOS\x10\x01\x12\n\n\x06TENANT\x10\x02*Y\n\x0cResourceType\x12\x16\n\x12SERVER_CERTIFICATE\x10\x00\x12\x1b\n\x17JWT_SIGNING_CERTIFICATE\x10\x01\x12\x14\n\x10VAULT_CREDENTIAL\x10\x02*D\n\x0eResourceSource\x12\x08\n\x04KUBE\x10\x00\x12\t\n\x05LOCAL\x10\x01\x12\x0c\n\x08\x45XTERNAL\x10\x02\x12\x0f\n\x0bLETSENCRYPT\x10\x03*A\n\x12ResourceSecretType\x12\x07\n\x03SSH\x10\x00\x12\x0c\n\x08PASSWORD\x10\x01\x12\x14\n\x10X509_CERTIFICATE\x10\x02\x32\x8f\x10\n\x15ResourceSecretService\x12\x83\x01\n\tgetSecret\x12;.org.apache.custos.resource.secret.service.GetSecretRequest\x1a\x39.org.apache.custos.resource.secret.service.SecretMetadata\x12\xa9\x01\n\x1cgetResourceCredentialSummary\x12N.org.apache.custos.resource.secret.service.GetResourceCredentialByTokenRequest\x1a\x39.org.apache.custos.resource.secret.service.SecretMetadata\x12\xbd\x01\n!getAllResourceCredentialSummaries\x12P.org.apache.custos.resource.secret.service.GetResourceCredentialSummariesRequest\x1a\x46.org.apache.custos.resource.secret.service.ResourceCredentialSummaries\x12\x96\x01\n\x10\x61\x64\x64SSHCredential\x12\x38.org.apache.custos.resource.secret.service.SSHCredential\x1aH.org.apache.custos.resource.secret.service.AddResourceCredentialResponse\x12\xa0\x01\n\x15\x61\x64\x64PasswordCredential\x12=.org.apache.custos.resource.secret.service.PasswordCredential\x1aH.org.apache.custos.resource.secret.service.AddResourceCredentialResponse\x12\xa6\x01\n\x18\x61\x64\x64\x43\x65rtificateCredential\x12@.org.apache.custos.resource.secret.service.CertificateCredential\x1aH.org.apache.custos.resource.secret.service.AddResourceCredentialResponse\x12\x9c\x01\n\x10getSSHCredential\x12N.org.apache.custos.resource.secret.service.GetResourceCredentialByTokenRequest\x1a\x38.org.apache.custos.resource.secret.service.SSHCredential\x12\xa6\x01\n\x15getPasswordCredential\x12N.org.apache.custos.resource.secret.service.GetResourceCredentialByTokenRequest\x1a=.org.apache.custos.resource.secret.service.PasswordCredential\x12\xac\x01\n\x18getCertificateCredential\x12N.org.apache.custos.resource.secret.service.GetResourceCredentialByTokenRequest\x1a@.org.apache.custos.resource.secret.service.CertificateCredential\x12\xb3\x01\n\x13\x64\x65leteSSHCredential\x12N.org.apache.custos.resource.secret.service.GetResourceCredentialByTokenRequest\x1aL.org.apache.custos.resource.secret.service.ResourceCredentialOperationStatus\x12\xb3\x01\n\x13\x64\x65letePWDCredential\x12N.org.apache.custos.resource.secret.service.GetResourceCredentialByTokenRequest\x1aL.org.apache.custos.resource.secret.service.ResourceCredentialOperationStatus\x12\xbb\x01\n\x1b\x64\x65leteCertificateCredential\x12N.org.apache.custos.resource.secret.service.GetResourceCredentialByTokenRequest\x1aL.org.apache.custos.resource.secret.service.ResourceCredentialOperationStatusB\x02P\x01\x62\x06proto3'
+  serialized_pb=b'\n\x1bResourceSecretService.proto\x12)org.apache.custos.resource.secret.service\"\xda\x03\n\x0eSecretMetadata\x12P\n\nowner_type\x18\x01 \x01(\x0e\x32<.org.apache.custos.resource.secret.service.ResourceOwnerType\x12N\n\rresource_type\x18\x02 \x01(\x0e\x32\x37.org.apache.custos.resource.secret.service.ResourceType\x12I\n\x06source\x18\x03 \x01(\x0e\x32\x39.org.apache.custos.resource.secret.service.ResourceSource\x12\x0c\n\x04name\x18\x04 \x01(\t\x12\r\n\x05value\x18\x05 \x01(\t\x12K\n\x04type\x18\x06 \x01(\x0e\x32=.org.apache.custos.resource.secret.service.ResourceSecretType\x12\x10\n\x08tenantId\x18\x07 \x01(\x03\x12\x10\n\x08owner_id\x18\x08 \x01(\t\x12\x16\n\x0epersisted_time\x18\t \x01(\x03\x12\r\n\x05token\x18\n \x01(\t\x12\x13\n\x0b\x64\x65scription\x18\x0b \x01(\t\x12\x11\n\tclient_id\x18\x0c \x01(\t\"\xb9\x02\n\x15\x43\x65rtificateCredential\x12K\n\x08metadata\x18\x01 \x01(\x0b\x32\x39.org.apache.custos.resource.secret.service.SecretMetadata\x12\x11\n\tx509_cert\x18\x03 \x01(\t\x12\x11\n\tnot_after\x18\x04 \x01(\t\x12\x13\n\x0bprivate_key\x18\x05 \x01(\t\x12\x11\n\tlife_time\x18\x06 \x01(\x03\x12\x12\n\nnot_before\x18\x07 \x01(\t\x12-\n%useShamirsSecretSharingWithEncryption\x18\x08 \x01(\x08\x12\x13\n\x0bnumOfShares\x18\t \x01(\x05\x12\x11\n\tthreshold\x18\n \x01(\x05\x12\x1a\n\x12private_key_shares\x18\x0b \x03(\x0c\"\xe1\x01\n\x12PasswordCredential\x12K\n\x08metadata\x18\x01 \x01(\x0b\x32\x39.org.apache.custos.resource.secret.service.SecretMetadata\x12\x10\n\x08password\x18\x03 \x01(\t\x12-\n%useShamirsSecretSharingWithEncryption\x18\x04 \x01(\x08\x12\x13\n\x0bnumOfShares\x18\x05 \x01(\x05\x12\x11\n\tthreshold\x18\x06 \x01(\x05\x12\x15\n\rsecret_shares\x18\x07 \x03(\x0c\"\x8c\x02\n\rSSHCredential\x12K\n\x08metadata\x18\x01 \x01(\x0b\x32\x39.org.apache.custos.resource.secret.service.SecretMetadata\x12\x12\n\npassphrase\x18\x03 \x01(\t\x12\x12\n\npublic_key\x18\x04 \x01(\t\x12\x13\n\x0bprivate_key\x18\x05 \x01(\t\x12-\n%useShamirsSecretSharingWithEncryption\x18\x06 \x01(\x08\x12\x13\n\x0bnumOfShares\x18\x07 \x01(\x05\x12\x11\n\tthreshold\x18\x08 \x01(\x05\x12\x1a\n\x12private_key_shares\x18\t \x03(\x0c\"\xc6\x01\n#GetResourceCredentialByTokenRequest\x12\x10\n\x08tenantId\x18\x01 \x01(\x03\x12\r\n\x05token\x18\x02 \x01(\t\x12\x14\n\x0cperformed_by\x18\x03 \x01(\t\x12\x11\n\tclient_id\x18\x04 \x01(\t\x12-\n%useShamirsSecretSharingWithEncryption\x18\x05 \x01(\x08\x12\x13\n\x0bnumOfShares\x18\x06 \x01(\x05\x12\x11\n\tthreshold\x18\x07 \x01(\x05\"\xd3\x01\n%GetResourceCredentialSummariesRequest\x12\x45\n\x04type\x18\x01 \x01(\x0e\x32\x37.org.apache.custos.resource.secret.service.ResourceType\x12\x19\n\x11\x61\x63\x63\x65ssible_tokens\x18\x02 \x03(\t\x12\x10\n\x08tenantId\x18\x03 \x01(\x03\x12\x10\n\x08owner_id\x18\x04 \x01(\t\x12\x11\n\tall_types\x18\x05 \x01(\x08\x12\x11\n\tclient_id\x18\x06 \x01(\t\"j\n\x1bResourceCredentialSummaries\x12K\n\x08metadata\x18\x01 \x03(\x0b\x32\x39.org.apache.custos.resource.secret.service.SecretMetadata\".\n\x1d\x41\x64\x64ResourceCredentialResponse\x12\r\n\x05token\x18\x01 \x01(\t\"3\n!ResourceCredentialOperationStatus\x12\x0e\n\x06status\x18\x01 \x01(\x08\"\x86\x01\n\x0cKVCredential\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t\x12K\n\x08metadata\x18\x03 \x01(\x0b\x32\x39.org.apache.custos.resource.secret.service.SecretMetadata\x12\r\n\x05token\x18\x04 \x01(\t\"\x99\x01\n\x10GetSecretRequest\x12K\n\x08metadata\x18\x01 \x01(\x0b\x32\x39.org.apache.custos.resource.secret.service.SecretMetadata\x12\x11\n\tclient_id\x18\x02 \x01(\t\x12\x11\n\ttenant_id\x18\x03 \x01(\x03\x12\x12\n\nclient_sec\x18\x04 \x01(\t*<\n\x11ResourceOwnerType\x12\x0f\n\x0bTENANT_USER\x10\x00\x12\n\n\x06\x43USTOS\x10\x01\x12\n\n\x06TENANT\x10\x02*y\n\x0cResourceType\x12\x16\n\x12SERVER_CERTIFICATE\x10\x00\x12\x1b\n\x17JWT_SIGNING_CERTIFICATE\x10\x01\x12\x14\n\x10VAULT_CREDENTIAL\x10\x02\x12\x06\n\x02VM\x10\x03\x12\x0b\n\x07\x41\x43\x43OUNT\x10\x04\x12\t\n\x05OTHER\x10\x05*D\n\x0eResourceSource\x12\x08\n\x04KUBE\x10\x00\x12\t\n\x05LOCAL\x10\x01\x12\x0c\n\x08\x45XTERNAL\x10\x02\x12\x0f\n\x0bLETSENCRYPT\x10\x03*W\n\x12ResourceSecretType\x12\x07\n\x03SSH\x10\x00\x12\x0c\n\x08PASSWORD\x10\x01\x12\x14\n\x10X509_CERTIFICATE\x10\x02\x12\x0c\n\x08RAW_DATA\x10\x03\x12\x06\n\x02KV\x10\x04\x32\xe6\x13\n\x15ResourceSecretService\x12\x83\x01\n\x0fgetKVCredential\x12\x37.org.apache.custos.resource.secret.service.KVCredential\x1a\x37.org.apache.custos.resource.secret.service.KVCredential\x12\x98\x01\n\x0fsetKVCredential\x12\x37.org.apache.custos.resource.secret.service.KVCredential\x1aL.org.apache.custos.resource.secret.service.ResourceCredentialOperationStatus\x12\x9b\x01\n\x12updateKVCredential\x12\x37.org.apache.custos.resource.secret.service.KVCredential\x1aL.org.apache.custos.resource.secret.service.ResourceCredentialOperationStatus\x12\x9b\x01\n\x12\x64\x65leteKVCredential\x12\x37.org.apache.custos.resource.secret.service.KVCredential\x1aL.org.apache.custos.resource.secret.service.ResourceCredentialOperationStatus\x12\xa9\x01\n\x1cgetResourceCredentialSummary\x12N.org.apache.custos.resource.secret.service.GetResourceCredentialByTokenRequest\x1a\x39.org.apache.custos.resource.secret.service.SecretMetadata\x12\xbd\x01\n!getAllResourceCredentialSummaries\x12P.org.apache.custos.resource.secret.service.GetResourceCredentialSummariesRequest\x1a\x46.org.apache.custos.resource.secret.service.ResourceCredentialSummaries\x12\x96\x01\n\x10\x61\x64\x64SSHCredential\x12\x38.org.apache.custos.resource.secret.service.SSHCredential\x1aH.org.apache.custos.resource.secret.service.AddResourceCredentialResponse\x12\xa0\x01\n\x15\x61\x64\x64PasswordCredential\x12=.org.apache.custos.resource.secret.service.PasswordCredential\x1aH.org.apache.custos.resource.secret.service.AddResourceCredentialResponse\x12\xa6\x01\n\x18\x61\x64\x64\x43\x65rtificateCredential\x12@.org.apache.custos.resource.secret.service.CertificateCredential\x1aH.org.apache.custos.resource.secret.service.AddResourceCredentialResponse\x12\x9c\x01\n\x10getSSHCredential\x12N.org.apache.custos.resource.secret.service.GetResourceCredentialByTokenRequest\x1a\x38.org.apache.custos.resource.secret.service.SSHCredential\x12\xa6\x01\n\x15getPasswordCredential\x12N.org.apache.custos.resource.secret.service.GetResourceCredentialByTokenRequest\x1a=.org.apache.custos.resource.secret.service.PasswordCredential\x12\xac\x01\n\x18getCertificateCredential\x12N.org.apache.custos.resource.secret.service.GetResourceCredentialByTokenRequest\x1a@.org.apache.custos.resource.secret.service.CertificateCredential\x12\xb3\x01\n\x13\x64\x65leteSSHCredential\x12N.org.apache.custos.resource.secret.service.GetResourceCredentialByTokenRequest\x1aL.org.apache.custos.resource.secret.service.ResourceCredentialOperationStatus\x12\xb3\x01\n\x13\x64\x65letePWDCredential\x12N.org.apache.custos.resource.secret.service.GetResourceCredentialByTokenRequest\x1aL.org.apache.custos.resource.secret.service.ResourceCredentialOperationStatus\x12\xbb\x01\n\x1b\x64\x65leteCertificateCredential\x12N.org.apache.custos.resource.secret.service.GetResourceCredentialByTokenRequest\x1aL.org.apache.custos.resource.secret.service.ResourceCredentialOperationStatusB\x02P\x01\x62\x06proto3'
 )
 
 _RESOURCEOWNERTYPE = _descriptor.EnumDescriptor(
@@ -48,8 +48,8 @@
   ],
   containing_type=None,
   serialized_options=None,
-  serialized_start=1735,
-  serialized_end=1795,
+  serialized_start=2283,
+  serialized_end=2343,
 )
 _sym_db.RegisterEnumDescriptor(_RESOURCEOWNERTYPE)
 
@@ -76,11 +76,26 @@
       serialized_options=None,
       type=None,
       create_key=_descriptor._internal_create_key),
+    _descriptor.EnumValueDescriptor(
+      name='VM', index=3, number=3,
+      serialized_options=None,
+      type=None,
+      create_key=_descriptor._internal_create_key),
+    _descriptor.EnumValueDescriptor(
+      name='ACCOUNT', index=4, number=4,
+      serialized_options=None,
+      type=None,
+      create_key=_descriptor._internal_create_key),
+    _descriptor.EnumValueDescriptor(
+      name='OTHER', index=5, number=5,
+      serialized_options=None,
+      type=None,
+      create_key=_descriptor._internal_create_key),
   ],
   containing_type=None,
   serialized_options=None,
-  serialized_start=1797,
-  serialized_end=1886,
+  serialized_start=2345,
+  serialized_end=2466,
 )
 _sym_db.RegisterEnumDescriptor(_RESOURCETYPE)
 
@@ -115,8 +130,8 @@
   ],
   containing_type=None,
   serialized_options=None,
-  serialized_start=1888,
-  serialized_end=1956,
+  serialized_start=2468,
+  serialized_end=2536,
 )
 _sym_db.RegisterEnumDescriptor(_RESOURCESOURCE)
 
@@ -143,11 +158,21 @@
       serialized_options=None,
       type=None,
       create_key=_descriptor._internal_create_key),
+    _descriptor.EnumValueDescriptor(
+      name='RAW_DATA', index=3, number=3,
+      serialized_options=None,
+      type=None,
+      create_key=_descriptor._internal_create_key),
+    _descriptor.EnumValueDescriptor(
+      name='KV', index=4, number=4,
+      serialized_options=None,
+      type=None,
+      create_key=_descriptor._internal_create_key),
   ],
   containing_type=None,
   serialized_options=None,
-  serialized_start=1958,
-  serialized_end=2023,
+  serialized_start=2538,
+  serialized_end=2625,
 )
 _sym_db.RegisterEnumDescriptor(_RESOURCESECRETTYPE)
 
@@ -158,6 +183,9 @@
 SERVER_CERTIFICATE = 0
 JWT_SIGNING_CERTIFICATE = 1
 VAULT_CREDENTIAL = 2
+VM = 3
+ACCOUNT = 4
+OTHER = 5
 KUBE = 0
 LOCAL = 1
 EXTERNAL = 2
@@ -165,6 +193,8 @@
 SSH = 0
 PASSWORD = 1
 X509_CERTIFICATE = 2
+RAW_DATA = 3
+KV = 4
 
 
 
@@ -277,113 +307,81 @@
 )
 
 
-_GETSECRETREQUEST = _descriptor.Descriptor(
-  name='GetSecretRequest',
-  full_name='org.apache.custos.resource.secret.service.GetSecretRequest',
+_CERTIFICATECREDENTIAL = _descriptor.Descriptor(
+  name='CertificateCredential',
+  full_name='org.apache.custos.resource.secret.service.CertificateCredential',
   filename=None,
   file=DESCRIPTOR,
   containing_type=None,
   create_key=_descriptor._internal_create_key,
   fields=[
     _descriptor.FieldDescriptor(
-      name='metadata', full_name='org.apache.custos.resource.secret.service.GetSecretRequest.metadata', index=0,
+      name='metadata', full_name='org.apache.custos.resource.secret.service.CertificateCredential.metadata', index=0,
       number=1, type=11, cpp_type=10, label=1,
       has_default_value=False, default_value=None,
       message_type=None, enum_type=None, containing_type=None,
       is_extension=False, extension_scope=None,
       serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
     _descriptor.FieldDescriptor(
-      name='tenantId', full_name='org.apache.custos.resource.secret.service.GetSecretRequest.tenantId', index=1,
-      number=2, type=3, cpp_type=2, label=1,
-      has_default_value=False, default_value=0,
-      message_type=None, enum_type=None, containing_type=None,
-      is_extension=False, extension_scope=None,
-      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
-    _descriptor.FieldDescriptor(
-      name='clientId', full_name='org.apache.custos.resource.secret.service.GetSecretRequest.clientId', index=2,
+      name='x509_cert', full_name='org.apache.custos.resource.secret.service.CertificateCredential.x509_cert', index=1,
       number=3, type=9, cpp_type=9, label=1,
       has_default_value=False, default_value=b"".decode('utf-8'),
       message_type=None, enum_type=None, containing_type=None,
       is_extension=False, extension_scope=None,
       serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
     _descriptor.FieldDescriptor(
-      name='clientSec', full_name='org.apache.custos.resource.secret.service.GetSecretRequest.clientSec', index=3,
+      name='not_after', full_name='org.apache.custos.resource.secret.service.CertificateCredential.not_after', index=2,
       number=4, type=9, cpp_type=9, label=1,
       has_default_value=False, default_value=b"".decode('utf-8'),
       message_type=None, enum_type=None, containing_type=None,
       is_extension=False, extension_scope=None,
       serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
     _descriptor.FieldDescriptor(
-      name='accessToken', full_name='org.apache.custos.resource.secret.service.GetSecretRequest.accessToken', index=4,
+      name='private_key', full_name='org.apache.custos.resource.secret.service.CertificateCredential.private_key', index=3,
       number=5, type=9, cpp_type=9, label=1,
       has_default_value=False, default_value=b"".decode('utf-8'),
       message_type=None, enum_type=None, containing_type=None,
       is_extension=False, extension_scope=None,
       serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
-  ],
-  extensions=[
-  ],
-  nested_types=[],
-  enum_types=[
-  ],
-  serialized_options=None,
-  is_extendable=False,
-  syntax='proto3',
-  extension_ranges=[],
-  oneofs=[
-  ],
-  serialized_start=552,
-  serialized_end=723,
-)
-
-
-_CERTIFICATECREDENTIAL = _descriptor.Descriptor(
-  name='CertificateCredential',
-  full_name='org.apache.custos.resource.secret.service.CertificateCredential',
-  filename=None,
-  file=DESCRIPTOR,
-  containing_type=None,
-  create_key=_descriptor._internal_create_key,
-  fields=[
     _descriptor.FieldDescriptor(
-      name='metadata', full_name='org.apache.custos.resource.secret.service.CertificateCredential.metadata', index=0,
-      number=1, type=11, cpp_type=10, label=1,
-      has_default_value=False, default_value=None,
+      name='life_time', full_name='org.apache.custos.resource.secret.service.CertificateCredential.life_time', index=4,
+      number=6, type=3, cpp_type=2, label=1,
+      has_default_value=False, default_value=0,
       message_type=None, enum_type=None, containing_type=None,
       is_extension=False, extension_scope=None,
       serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
     _descriptor.FieldDescriptor(
-      name='x509_cert', full_name='org.apache.custos.resource.secret.service.CertificateCredential.x509_cert', index=1,
-      number=3, type=9, cpp_type=9, label=1,
+      name='not_before', full_name='org.apache.custos.resource.secret.service.CertificateCredential.not_before', index=5,
+      number=7, type=9, cpp_type=9, label=1,
       has_default_value=False, default_value=b"".decode('utf-8'),
       message_type=None, enum_type=None, containing_type=None,
       is_extension=False, extension_scope=None,
       serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
     _descriptor.FieldDescriptor(
-      name='not_after', full_name='org.apache.custos.resource.secret.service.CertificateCredential.not_after', index=2,
-      number=4, type=9, cpp_type=9, label=1,
-      has_default_value=False, default_value=b"".decode('utf-8'),
+      name='useShamirsSecretSharingWithEncryption', full_name='org.apache.custos.resource.secret.service.CertificateCredential.useShamirsSecretSharingWithEncryption', index=6,
+      number=8, type=8, cpp_type=7, label=1,
+      has_default_value=False, default_value=False,
       message_type=None, enum_type=None, containing_type=None,
       is_extension=False, extension_scope=None,
       serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
     _descriptor.FieldDescriptor(
-      name='private_key', full_name='org.apache.custos.resource.secret.service.CertificateCredential.private_key', index=3,
-      number=5, type=9, cpp_type=9, label=1,
-      has_default_value=False, default_value=b"".decode('utf-8'),
+      name='numOfShares', full_name='org.apache.custos.resource.secret.service.CertificateCredential.numOfShares', index=7,
+      number=9, type=5, cpp_type=1, label=1,
+      has_default_value=False, default_value=0,
       message_type=None, enum_type=None, containing_type=None,
       is_extension=False, extension_scope=None,
       serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
     _descriptor.FieldDescriptor(
-      name='life_time', full_name='org.apache.custos.resource.secret.service.CertificateCredential.life_time', index=4,
-      number=6, type=3, cpp_type=2, label=1,
+      name='threshold', full_name='org.apache.custos.resource.secret.service.CertificateCredential.threshold', index=8,
+      number=10, type=5, cpp_type=1, label=1,
       has_default_value=False, default_value=0,
       message_type=None, enum_type=None, containing_type=None,
       is_extension=False, extension_scope=None,
       serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
     _descriptor.FieldDescriptor(
-      name='not_before', full_name='org.apache.custos.resource.secret.service.CertificateCredential.not_before', index=5,
-      number=7, type=9, cpp_type=9, label=1,
-      has_default_value=False, default_value=b"".decode('utf-8'),
+      name='private_key_shares', full_name='org.apache.custos.resource.secret.service.CertificateCredential.private_key_shares', index=9,
+      number=11, type=12, cpp_type=9, label=3,
+      has_default_value=False, default_value=[],
       message_type=None, enum_type=None, containing_type=None,
       is_extension=False, extension_scope=None,
       serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
@@ -399,8 +397,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=726,
-  serialized_end=924,
+  serialized_start=552,
+  serialized_end=865,
 )
 
 
@@ -426,6 +424,34 @@
       message_type=None, enum_type=None, containing_type=None,
       is_extension=False, extension_scope=None,
       serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='useShamirsSecretSharingWithEncryption', full_name='org.apache.custos.resource.secret.service.PasswordCredential.useShamirsSecretSharingWithEncryption', index=2,
+      number=4, type=8, cpp_type=7, label=1,
+      has_default_value=False, default_value=False,
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='numOfShares', full_name='org.apache.custos.resource.secret.service.PasswordCredential.numOfShares', index=3,
+      number=5, type=5, cpp_type=1, label=1,
+      has_default_value=False, default_value=0,
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='threshold', full_name='org.apache.custos.resource.secret.service.PasswordCredential.threshold', index=4,
+      number=6, type=5, cpp_type=1, label=1,
+      has_default_value=False, default_value=0,
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='secret_shares', full_name='org.apache.custos.resource.secret.service.PasswordCredential.secret_shares', index=5,
+      number=7, type=12, cpp_type=9, label=3,
+      has_default_value=False, default_value=[],
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
   ],
   extensions=[
   ],
@@ -438,8 +464,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=926,
-  serialized_end=1041,
+  serialized_start=868,
+  serialized_end=1093,
 )
 
 
@@ -479,6 +505,34 @@
       message_type=None, enum_type=None, containing_type=None,
       is_extension=False, extension_scope=None,
       serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='useShamirsSecretSharingWithEncryption', full_name='org.apache.custos.resource.secret.service.SSHCredential.useShamirsSecretSharingWithEncryption', index=4,
+      number=6, type=8, cpp_type=7, label=1,
+      has_default_value=False, default_value=False,
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='numOfShares', full_name='org.apache.custos.resource.secret.service.SSHCredential.numOfShares', index=5,
+      number=7, type=5, cpp_type=1, label=1,
+      has_default_value=False, default_value=0,
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='threshold', full_name='org.apache.custos.resource.secret.service.SSHCredential.threshold', index=6,
+      number=8, type=5, cpp_type=1, label=1,
+      has_default_value=False, default_value=0,
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='private_key_shares', full_name='org.apache.custos.resource.secret.service.SSHCredential.private_key_shares', index=7,
+      number=9, type=12, cpp_type=9, label=3,
+      has_default_value=False, default_value=[],
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
   ],
   extensions=[
   ],
@@ -491,8 +545,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=1044,
-  serialized_end=1197,
+  serialized_start=1096,
+  serialized_end=1364,
 )
 
 
@@ -532,6 +586,27 @@
       message_type=None, enum_type=None, containing_type=None,
       is_extension=False, extension_scope=None,
       serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='useShamirsSecretSharingWithEncryption', full_name='org.apache.custos.resource.secret.service.GetResourceCredentialByTokenRequest.useShamirsSecretSharingWithEncryption', index=4,
+      number=5, type=8, cpp_type=7, label=1,
+      has_default_value=False, default_value=False,
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='numOfShares', full_name='org.apache.custos.resource.secret.service.GetResourceCredentialByTokenRequest.numOfShares', index=5,
+      number=6, type=5, cpp_type=1, label=1,
+      has_default_value=False, default_value=0,
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='threshold', full_name='org.apache.custos.resource.secret.service.GetResourceCredentialByTokenRequest.threshold', index=6,
+      number=7, type=5, cpp_type=1, label=1,
+      has_default_value=False, default_value=0,
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
   ],
   extensions=[
   ],
@@ -544,8 +619,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=1199,
-  serialized_end=1310,
+  serialized_start=1367,
+  serialized_end=1565,
 )
 
 
@@ -611,8 +686,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=1313,
-  serialized_end=1524,
+  serialized_start=1568,
+  serialized_end=1779,
 )
 
 
@@ -643,8 +718,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=1526,
-  serialized_end=1632,
+  serialized_start=1781,
+  serialized_end=1887,
 )
 
 
@@ -675,8 +750,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=1634,
-  serialized_end=1680,
+  serialized_start=1889,
+  serialized_end=1935,
 )
 
 
@@ -707,22 +782,128 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=1682,
-  serialized_end=1733,
+  serialized_start=1937,
+  serialized_end=1988,
+)
+
+
+_KVCREDENTIAL = _descriptor.Descriptor(
+  name='KVCredential',
+  full_name='org.apache.custos.resource.secret.service.KVCredential',
+  filename=None,
+  file=DESCRIPTOR,
+  containing_type=None,
+  create_key=_descriptor._internal_create_key,
+  fields=[
+    _descriptor.FieldDescriptor(
+      name='key', full_name='org.apache.custos.resource.secret.service.KVCredential.key', index=0,
+      number=1, type=9, cpp_type=9, label=1,
+      has_default_value=False, default_value=b"".decode('utf-8'),
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='value', full_name='org.apache.custos.resource.secret.service.KVCredential.value', index=1,
+      number=2, type=9, cpp_type=9, label=1,
+      has_default_value=False, default_value=b"".decode('utf-8'),
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='metadata', full_name='org.apache.custos.resource.secret.service.KVCredential.metadata', index=2,
+      number=3, type=11, cpp_type=10, label=1,
+      has_default_value=False, default_value=None,
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='token', full_name='org.apache.custos.resource.secret.service.KVCredential.token', index=3,
+      number=4, type=9, cpp_type=9, label=1,
+      has_default_value=False, default_value=b"".decode('utf-8'),
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+  ],
+  extensions=[
+  ],
+  nested_types=[],
+  enum_types=[
+  ],
+  serialized_options=None,
+  is_extendable=False,
+  syntax='proto3',
+  extension_ranges=[],
+  oneofs=[
+  ],
+  serialized_start=1991,
+  serialized_end=2125,
+)
+
+
+_GETSECRETREQUEST = _descriptor.Descriptor(
+  name='GetSecretRequest',
+  full_name='org.apache.custos.resource.secret.service.GetSecretRequest',
+  filename=None,
+  file=DESCRIPTOR,
+  containing_type=None,
+  create_key=_descriptor._internal_create_key,
+  fields=[
+    _descriptor.FieldDescriptor(
+      name='metadata', full_name='org.apache.custos.resource.secret.service.GetSecretRequest.metadata', index=0,
+      number=1, type=11, cpp_type=10, label=1,
+      has_default_value=False, default_value=None,
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='client_id', full_name='org.apache.custos.resource.secret.service.GetSecretRequest.client_id', index=1,
+      number=2, type=9, cpp_type=9, label=1,
+      has_default_value=False, default_value=b"".decode('utf-8'),
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='tenant_id', full_name='org.apache.custos.resource.secret.service.GetSecretRequest.tenant_id', index=2,
+      number=3, type=3, cpp_type=2, label=1,
+      has_default_value=False, default_value=0,
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='client_sec', full_name='org.apache.custos.resource.secret.service.GetSecretRequest.client_sec', index=3,
+      number=4, type=9, cpp_type=9, label=1,
+      has_default_value=False, default_value=b"".decode('utf-8'),
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+  ],
+  extensions=[
+  ],
+  nested_types=[],
+  enum_types=[
+  ],
+  serialized_options=None,
+  is_extendable=False,
+  syntax='proto3',
+  extension_ranges=[],
+  oneofs=[
+  ],
+  serialized_start=2128,
+  serialized_end=2281,
 )
 
 _SECRETMETADATA.fields_by_name['owner_type'].enum_type = _RESOURCEOWNERTYPE
 _SECRETMETADATA.fields_by_name['resource_type'].enum_type = _RESOURCETYPE
 _SECRETMETADATA.fields_by_name['source'].enum_type = _RESOURCESOURCE
 _SECRETMETADATA.fields_by_name['type'].enum_type = _RESOURCESECRETTYPE
-_GETSECRETREQUEST.fields_by_name['metadata'].message_type = _SECRETMETADATA
 _CERTIFICATECREDENTIAL.fields_by_name['metadata'].message_type = _SECRETMETADATA
 _PASSWORDCREDENTIAL.fields_by_name['metadata'].message_type = _SECRETMETADATA
 _SSHCREDENTIAL.fields_by_name['metadata'].message_type = _SECRETMETADATA
 _GETRESOURCECREDENTIALSUMMARIESREQUEST.fields_by_name['type'].enum_type = _RESOURCETYPE
 _RESOURCECREDENTIALSUMMARIES.fields_by_name['metadata'].message_type = _SECRETMETADATA
+_KVCREDENTIAL.fields_by_name['metadata'].message_type = _SECRETMETADATA
+_GETSECRETREQUEST.fields_by_name['metadata'].message_type = _SECRETMETADATA
 DESCRIPTOR.message_types_by_name['SecretMetadata'] = _SECRETMETADATA
-DESCRIPTOR.message_types_by_name['GetSecretRequest'] = _GETSECRETREQUEST
 DESCRIPTOR.message_types_by_name['CertificateCredential'] = _CERTIFICATECREDENTIAL
 DESCRIPTOR.message_types_by_name['PasswordCredential'] = _PASSWORDCREDENTIAL
 DESCRIPTOR.message_types_by_name['SSHCredential'] = _SSHCREDENTIAL
@@ -731,6 +912,8 @@
 DESCRIPTOR.message_types_by_name['ResourceCredentialSummaries'] = _RESOURCECREDENTIALSUMMARIES
 DESCRIPTOR.message_types_by_name['AddResourceCredentialResponse'] = _ADDRESOURCECREDENTIALRESPONSE
 DESCRIPTOR.message_types_by_name['ResourceCredentialOperationStatus'] = _RESOURCECREDENTIALOPERATIONSTATUS
+DESCRIPTOR.message_types_by_name['KVCredential'] = _KVCREDENTIAL
+DESCRIPTOR.message_types_by_name['GetSecretRequest'] = _GETSECRETREQUEST
 DESCRIPTOR.enum_types_by_name['ResourceOwnerType'] = _RESOURCEOWNERTYPE
 DESCRIPTOR.enum_types_by_name['ResourceType'] = _RESOURCETYPE
 DESCRIPTOR.enum_types_by_name['ResourceSource'] = _RESOURCESOURCE
@@ -744,13 +927,6 @@
   })
 _sym_db.RegisterMessage(SecretMetadata)
 
-GetSecretRequest = _reflection.GeneratedProtocolMessageType('GetSecretRequest', (_message.Message,), {
-  'DESCRIPTOR' : _GETSECRETREQUEST,
-  '__module__' : 'ResourceSecretService_pb2'
-  # @@protoc_insertion_point(class_scope:org.apache.custos.resource.secret.service.GetSecretRequest)
-  })
-_sym_db.RegisterMessage(GetSecretRequest)
-
 CertificateCredential = _reflection.GeneratedProtocolMessageType('CertificateCredential', (_message.Message,), {
   'DESCRIPTOR' : _CERTIFICATECREDENTIAL,
   '__module__' : 'ResourceSecretService_pb2'
@@ -807,6 +983,20 @@
   })
 _sym_db.RegisterMessage(ResourceCredentialOperationStatus)
 
+KVCredential = _reflection.GeneratedProtocolMessageType('KVCredential', (_message.Message,), {
+  'DESCRIPTOR' : _KVCREDENTIAL,
+  '__module__' : 'ResourceSecretService_pb2'
+  # @@protoc_insertion_point(class_scope:org.apache.custos.resource.secret.service.KVCredential)
+  })
+_sym_db.RegisterMessage(KVCredential)
+
+GetSecretRequest = _reflection.GeneratedProtocolMessageType('GetSecretRequest', (_message.Message,), {
+  'DESCRIPTOR' : _GETSECRETREQUEST,
+  '__module__' : 'ResourceSecretService_pb2'
+  # @@protoc_insertion_point(class_scope:org.apache.custos.resource.secret.service.GetSecretRequest)
+  })
+_sym_db.RegisterMessage(GetSecretRequest)
+
 
 DESCRIPTOR._options = None
 
@@ -817,23 +1007,53 @@
   index=0,
   serialized_options=None,
   create_key=_descriptor._internal_create_key,
-  serialized_start=2026,
-  serialized_end=4089,
+  serialized_start=2628,
+  serialized_end=5162,
   methods=[
   _descriptor.MethodDescriptor(
-    name='getSecret',
-    full_name='org.apache.custos.resource.secret.service.ResourceSecretService.getSecret',
+    name='getKVCredential',
+    full_name='org.apache.custos.resource.secret.service.ResourceSecretService.getKVCredential',
     index=0,
     containing_service=None,
-    input_type=_GETSECRETREQUEST,
-    output_type=_SECRETMETADATA,
+    input_type=_KVCREDENTIAL,
+    output_type=_KVCREDENTIAL,
+    serialized_options=None,
+    create_key=_descriptor._internal_create_key,
+  ),
+  _descriptor.MethodDescriptor(
+    name='setKVCredential',
+    full_name='org.apache.custos.resource.secret.service.ResourceSecretService.setKVCredential',
+    index=1,
+    containing_service=None,
+    input_type=_KVCREDENTIAL,
+    output_type=_RESOURCECREDENTIALOPERATIONSTATUS,
+    serialized_options=None,
+    create_key=_descriptor._internal_create_key,
+  ),
+  _descriptor.MethodDescriptor(
+    name='updateKVCredential',
+    full_name='org.apache.custos.resource.secret.service.ResourceSecretService.updateKVCredential',
+    index=2,
+    containing_service=None,
+    input_type=_KVCREDENTIAL,
+    output_type=_RESOURCECREDENTIALOPERATIONSTATUS,
+    serialized_options=None,
+    create_key=_descriptor._internal_create_key,
+  ),
+  _descriptor.MethodDescriptor(
+    name='deleteKVCredential',
+    full_name='org.apache.custos.resource.secret.service.ResourceSecretService.deleteKVCredential',
+    index=3,
+    containing_service=None,
+    input_type=_KVCREDENTIAL,
+    output_type=_RESOURCECREDENTIALOPERATIONSTATUS,
     serialized_options=None,
     create_key=_descriptor._internal_create_key,
   ),
   _descriptor.MethodDescriptor(
     name='getResourceCredentialSummary',
     full_name='org.apache.custos.resource.secret.service.ResourceSecretService.getResourceCredentialSummary',
-    index=1,
+    index=4,
     containing_service=None,
     input_type=_GETRESOURCECREDENTIALBYTOKENREQUEST,
     output_type=_SECRETMETADATA,
@@ -843,7 +1063,7 @@
   _descriptor.MethodDescriptor(
     name='getAllResourceCredentialSummaries',
     full_name='org.apache.custos.resource.secret.service.ResourceSecretService.getAllResourceCredentialSummaries',
-    index=2,
+    index=5,
     containing_service=None,
     input_type=_GETRESOURCECREDENTIALSUMMARIESREQUEST,
     output_type=_RESOURCECREDENTIALSUMMARIES,
@@ -853,7 +1073,7 @@
   _descriptor.MethodDescriptor(
     name='addSSHCredential',
     full_name='org.apache.custos.resource.secret.service.ResourceSecretService.addSSHCredential',
-    index=3,
+    index=6,
     containing_service=None,
     input_type=_SSHCREDENTIAL,
     output_type=_ADDRESOURCECREDENTIALRESPONSE,
@@ -863,7 +1083,7 @@
   _descriptor.MethodDescriptor(
     name='addPasswordCredential',
     full_name='org.apache.custos.resource.secret.service.ResourceSecretService.addPasswordCredential',
-    index=4,
+    index=7,
     containing_service=None,
     input_type=_PASSWORDCREDENTIAL,
     output_type=_ADDRESOURCECREDENTIALRESPONSE,
@@ -873,7 +1093,7 @@
   _descriptor.MethodDescriptor(
     name='addCertificateCredential',
     full_name='org.apache.custos.resource.secret.service.ResourceSecretService.addCertificateCredential',
-    index=5,
+    index=8,
     containing_service=None,
     input_type=_CERTIFICATECREDENTIAL,
     output_type=_ADDRESOURCECREDENTIALRESPONSE,
@@ -883,7 +1103,7 @@
   _descriptor.MethodDescriptor(
     name='getSSHCredential',
     full_name='org.apache.custos.resource.secret.service.ResourceSecretService.getSSHCredential',
-    index=6,
+    index=9,
     containing_service=None,
     input_type=_GETRESOURCECREDENTIALBYTOKENREQUEST,
     output_type=_SSHCREDENTIAL,
@@ -893,7 +1113,7 @@
   _descriptor.MethodDescriptor(
     name='getPasswordCredential',
     full_name='org.apache.custos.resource.secret.service.ResourceSecretService.getPasswordCredential',
-    index=7,
+    index=10,
     containing_service=None,
     input_type=_GETRESOURCECREDENTIALBYTOKENREQUEST,
     output_type=_PASSWORDCREDENTIAL,
@@ -903,7 +1123,7 @@
   _descriptor.MethodDescriptor(
     name='getCertificateCredential',
     full_name='org.apache.custos.resource.secret.service.ResourceSecretService.getCertificateCredential',
-    index=8,
+    index=11,
     containing_service=None,
     input_type=_GETRESOURCECREDENTIALBYTOKENREQUEST,
     output_type=_CERTIFICATECREDENTIAL,
@@ -913,7 +1133,7 @@
   _descriptor.MethodDescriptor(
     name='deleteSSHCredential',
     full_name='org.apache.custos.resource.secret.service.ResourceSecretService.deleteSSHCredential',
-    index=9,
+    index=12,
     containing_service=None,
     input_type=_GETRESOURCECREDENTIALBYTOKENREQUEST,
     output_type=_RESOURCECREDENTIALOPERATIONSTATUS,
@@ -923,7 +1143,7 @@
   _descriptor.MethodDescriptor(
     name='deletePWDCredential',
     full_name='org.apache.custos.resource.secret.service.ResourceSecretService.deletePWDCredential',
-    index=10,
+    index=13,
     containing_service=None,
     input_type=_GETRESOURCECREDENTIALBYTOKENREQUEST,
     output_type=_RESOURCECREDENTIALOPERATIONSTATUS,
@@ -933,7 +1153,7 @@
   _descriptor.MethodDescriptor(
     name='deleteCertificateCredential',
     full_name='org.apache.custos.resource.secret.service.ResourceSecretService.deleteCertificateCredential',
-    index=11,
+    index=14,
     containing_service=None,
     input_type=_GETRESOURCECREDENTIALBYTOKENREQUEST,
     output_type=_RESOURCECREDENTIALOPERATIONSTATUS,
diff --git a/custos-client-sdks/custos-python-sdk/custos/server/core/ResourceSecretService_pb2_grpc.py b/custos-client-sdks/custos-python-sdk/custos/server/core/ResourceSecretService_pb2_grpc.py
index cb8bef360..996a5fd40 100644
--- a/custos-client-sdks/custos-python-sdk/custos/server/core/ResourceSecretService_pb2_grpc.py
+++ b/custos-client-sdks/custos-python-sdk/custos/server/core/ResourceSecretService_pb2_grpc.py
@@ -14,10 +14,25 @@ def __init__(self, channel):
         Args:
             channel: A grpc.Channel.
         """
-        self.getSecret = channel.unary_unary(
-                '/org.apache.custos.resource.secret.service.ResourceSecretService/getSecret',
-                request_serializer=ResourceSecretService__pb2.GetSecretRequest.SerializeToString,
-                response_deserializer=ResourceSecretService__pb2.SecretMetadata.FromString,
+        self.getKVCredential = channel.unary_unary(
+                '/org.apache.custos.resource.secret.service.ResourceSecretService/getKVCredential',
+                request_serializer=ResourceSecretService__pb2.KVCredential.SerializeToString,
+                response_deserializer=ResourceSecretService__pb2.KVCredential.FromString,
+                )
+        self.setKVCredential = channel.unary_unary(
+                '/org.apache.custos.resource.secret.service.ResourceSecretService/setKVCredential',
+                request_serializer=ResourceSecretService__pb2.KVCredential.SerializeToString,
+                response_deserializer=ResourceSecretService__pb2.ResourceCredentialOperationStatus.FromString,
+                )
+        self.updateKVCredential = channel.unary_unary(
+                '/org.apache.custos.resource.secret.service.ResourceSecretService/updateKVCredential',
+                request_serializer=ResourceSecretService__pb2.KVCredential.SerializeToString,
+                response_deserializer=ResourceSecretService__pb2.ResourceCredentialOperationStatus.FromString,
+                )
+        self.deleteKVCredential = channel.unary_unary(
+                '/org.apache.custos.resource.secret.service.ResourceSecretService/deleteKVCredential',
+                request_serializer=ResourceSecretService__pb2.KVCredential.SerializeToString,
+                response_deserializer=ResourceSecretService__pb2.ResourceCredentialOperationStatus.FromString,
                 )
         self.getResourceCredentialSummary = channel.unary_unary(
                 '/org.apache.custos.resource.secret.service.ResourceSecretService/getResourceCredentialSummary',
@@ -79,7 +94,25 @@ def __init__(self, channel):
 class ResourceSecretServiceServicer(object):
     """Missing associated documentation comment in .proto file."""
 
-    def getSecret(self, request, context):
+    def getKVCredential(self, request, context):
+        """Missing associated documentation comment in .proto file."""
+        context.set_code(grpc.StatusCode.UNIMPLEMENTED)
+        context.set_details('Method not implemented!')
+        raise NotImplementedError('Method not implemented!')
+
+    def setKVCredential(self, request, context):
+        """Missing associated documentation comment in .proto file."""
+        context.set_code(grpc.StatusCode.UNIMPLEMENTED)
+        context.set_details('Method not implemented!')
+        raise NotImplementedError('Method not implemented!')
+
+    def updateKVCredential(self, request, context):
+        """Missing associated documentation comment in .proto file."""
+        context.set_code(grpc.StatusCode.UNIMPLEMENTED)
+        context.set_details('Method not implemented!')
+        raise NotImplementedError('Method not implemented!')
+
+    def deleteKVCredential(self, request, context):
         """Missing associated documentation comment in .proto file."""
         context.set_code(grpc.StatusCode.UNIMPLEMENTED)
         context.set_details('Method not implemented!')
@@ -154,10 +187,25 @@ def deleteCertificateCredential(self, request, context):
 
 def add_ResourceSecretServiceServicer_to_server(servicer, server):
     rpc_method_handlers = {
-            'getSecret': grpc.unary_unary_rpc_method_handler(
-                    servicer.getSecret,
-                    request_deserializer=ResourceSecretService__pb2.GetSecretRequest.FromString,
-                    response_serializer=ResourceSecretService__pb2.SecretMetadata.SerializeToString,
+            'getKVCredential': grpc.unary_unary_rpc_method_handler(
+                    servicer.getKVCredential,
+                    request_deserializer=ResourceSecretService__pb2.KVCredential.FromString,
+                    response_serializer=ResourceSecretService__pb2.KVCredential.SerializeToString,
+            ),
+            'setKVCredential': grpc.unary_unary_rpc_method_handler(
+                    servicer.setKVCredential,
+                    request_deserializer=ResourceSecretService__pb2.KVCredential.FromString,
+                    response_serializer=ResourceSecretService__pb2.ResourceCredentialOperationStatus.SerializeToString,
+            ),
+            'updateKVCredential': grpc.unary_unary_rpc_method_handler(
+                    servicer.updateKVCredential,
+                    request_deserializer=ResourceSecretService__pb2.KVCredential.FromString,
+                    response_serializer=ResourceSecretService__pb2.ResourceCredentialOperationStatus.SerializeToString,
+            ),
+            'deleteKVCredential': grpc.unary_unary_rpc_method_handler(
+                    servicer.deleteKVCredential,
+                    request_deserializer=ResourceSecretService__pb2.KVCredential.FromString,
+                    response_serializer=ResourceSecretService__pb2.ResourceCredentialOperationStatus.SerializeToString,
             ),
             'getResourceCredentialSummary': grpc.unary_unary_rpc_method_handler(
                     servicer.getResourceCredentialSummary,
@@ -225,7 +273,7 @@ class ResourceSecretService(object):
     """Missing associated documentation comment in .proto file."""
 
     @staticmethod
-    def getSecret(request,
+    def getKVCredential(request,
             target,
             options=(),
             channel_credentials=None,
@@ -235,9 +283,60 @@ def getSecret(request,
             wait_for_ready=None,
             timeout=None,
             metadata=None):
-        return grpc.experimental.unary_unary(request, target, '/org.apache.custos.resource.secret.service.ResourceSecretService/getSecret',
-            ResourceSecretService__pb2.GetSecretRequest.SerializeToString,
-            ResourceSecretService__pb2.SecretMetadata.FromString,
+        return grpc.experimental.unary_unary(request, target, '/org.apache.custos.resource.secret.service.ResourceSecretService/getKVCredential',
+            ResourceSecretService__pb2.KVCredential.SerializeToString,
+            ResourceSecretService__pb2.KVCredential.FromString,
+            options, channel_credentials,
+            insecure, call_credentials, compression, wait_for_ready, timeout, metadata)
+
+    @staticmethod
+    def setKVCredential(request,
+            target,
+            options=(),
+            channel_credentials=None,
+            call_credentials=None,
+            insecure=False,
+            compression=None,
+            wait_for_ready=None,
+            timeout=None,
+            metadata=None):
+        return grpc.experimental.unary_unary(request, target, '/org.apache.custos.resource.secret.service.ResourceSecretService/setKVCredential',
+            ResourceSecretService__pb2.KVCredential.SerializeToString,
+            ResourceSecretService__pb2.ResourceCredentialOperationStatus.FromString,
+            options, channel_credentials,
+            insecure, call_credentials, compression, wait_for_ready, timeout, metadata)
+
+    @staticmethod
+    def updateKVCredential(request,
+            target,
+            options=(),
+            channel_credentials=None,
+            call_credentials=None,
+            insecure=False,
+            compression=None,
+            wait_for_ready=None,
+            timeout=None,
+            metadata=None):
+        return grpc.experimental.unary_unary(request, target, '/org.apache.custos.resource.secret.service.ResourceSecretService/updateKVCredential',
+            ResourceSecretService__pb2.KVCredential.SerializeToString,
+            ResourceSecretService__pb2.ResourceCredentialOperationStatus.FromString,
+            options, channel_credentials,
+            insecure, call_credentials, compression, wait_for_ready, timeout, metadata)
+
+    @staticmethod
+    def deleteKVCredential(request,
+            target,
+            options=(),
+            channel_credentials=None,
+            call_credentials=None,
+            insecure=False,
+            compression=None,
+            wait_for_ready=None,
+            timeout=None,
+            metadata=None):
+        return grpc.experimental.unary_unary(request, target, '/org.apache.custos.resource.secret.service.ResourceSecretService/deleteKVCredential',
+            ResourceSecretService__pb2.KVCredential.SerializeToString,
+            ResourceSecretService__pb2.ResourceCredentialOperationStatus.FromString,
             options, channel_credentials,
             insecure, call_credentials, compression, wait_for_ready, timeout, metadata)
 
diff --git a/custos-client-sdks/custos-python-sdk/custos/server/integration/ResourceSecretManagementService_pb2.py b/custos-client-sdks/custos-python-sdk/custos/server/integration/ResourceSecretManagementService_pb2.py
index d2b0f2f0e..8767a4b8e 100644
--- a/custos-client-sdks/custos-python-sdk/custos/server/integration/ResourceSecretManagementService_pb2.py
+++ b/custos-client-sdks/custos-python-sdk/custos/server/integration/ResourceSecretManagementService_pb2.py
@@ -24,7 +24,7 @@
   syntax='proto3',
   serialized_options=b'P\001',
   create_key=_descriptor._internal_create_key,
-  serialized_pb=b'\n%ResourceSecretManagementService.proto\x12\x34org.apache.custos.resource.secret.management.service\x1a\x1cgoogle/api/annotations.proto\x1a\x1bgoogle/protobuf/empty.proto\x1a\x1cgoogle/protobuf/struct.proto\x1a\x1bResourceSecretService.proto\x1a\x15IdentityService.proto2\xf4\x16\n\x1fResourceSecretManagementService\x12\xb6\x01\n\tgetSecret\x12;.org.apache.custos.resource.secret.service.GetSecretRequest\x1a\x39.org.apache.custos.resource.secret.service.SecretMetadata\"1\x82\xd3\xe4\x93\x02+\x12)/resource-secret-management/v1.0.0/secret\x12\x97\x01\n\x07getJWKS\x12\x32.org.apache.custos.identity.service.GetJWKSRequest\x1a\x17.google.protobuf.Struct\"?\x82\xd3\xe4\x93\x02\x39\x12\x37/resource-secret-management/v1.0.0/openid-connect/certs\x12\xe4\x01\n\x1cgetResourceCredentialSummary\x12N.org.apache.custos.resource.secret.service.GetResourceCredentialByTokenRequest\x1a\x39.org.apache.custos.resource.secret.service.SecretMetadata\"9\x82\xd3\xe4\x93\x02\x33\x12\x31/resource-secret-management/v1.0.0/secret/summary\x12\xfa\x01\n!getAllResourceCredentialSummaries\x12P.org.apache.custos.resource.secret.service.GetResourceCredentialSummariesRequest\x1a\x46.org.apache.custos.resource.secret.service.ResourceCredentialSummaries\";\x82\xd3\xe4\x93\x02\x35\x12\x33/resource-secret-management/v1.0.0/secret/summaries\x12\xcd\x01\n\x10\x61\x64\x64SSHCredential\x12\x38.org.apache.custos.resource.secret.service.SSHCredential\x1aH.org.apache.custos.resource.secret.service.AddResourceCredentialResponse\"5\x82\xd3\xe4\x93\x02/\"-/resource-secret-management/v1.0.0/secret/ssh\x12\xdc\x01\n\x15\x61\x64\x64PasswordCredential\x12=.org.apache.custos.resource.secret.service.PasswordCredential\x1aH.org.apache.custos.resource.secret.service.AddResourceCredentialResponse\":\x82\xd3\xe4\x93\x02\x34\"2/resource-secret-management/v1.0.0/secret/password\x12\xe5\x01\n\x18\x61\x64\x64\x43\x65rtificateCredential\x12@.org.apache.custos.resource.secret.service.CertificateCredential\x1aH.org.apache.custos.resource.secret.service.AddResourceCredentialResponse\"=\x82\xd3\xe4\x93\x02\x37\"5/resource-secret-management/v1.0.0/secret/certificate\x12\xd3\x01\n\x10getSSHCredential\x12N.org.apache.custos.resource.secret.service.GetResourceCredentialByTokenRequest\x1a\x38.org.apache.custos.resource.secret.service.SSHCredential\"5\x82\xd3\xe4\x93\x02/\x12-/resource-secret-management/v1.0.0/secret/ssh\x12\xe2\x01\n\x15getPasswordCredential\x12N.org.apache.custos.resource.secret.service.GetResourceCredentialByTokenRequest\x1a=.org.apache.custos.resource.secret.service.PasswordCredential\":\x82\xd3\xe4\x93\x02\x34\x12\x32/resource-secret-management/v1.0.0/secret/password\x12\xeb\x01\n\x18getCertificateCredential\x12N.org.apache.custos.resource.secret.service.GetResourceCredentialByTokenRequest\x1a@.org.apache.custos.resource.secret.service.CertificateCredential\"=\x82\xd3\xe4\x93\x02\x37\x12\x35/resource-secret-management/v1.0.0/secret/certificate\x12\xea\x01\n\x13\x64\x65leteSSHCredential\x12N.org.apache.custos.resource.secret.service.GetResourceCredentialByTokenRequest\x1aL.org.apache.custos.resource.secret.service.ResourceCredentialOperationStatus\"5\x82\xd3\xe4\x93\x02/*-/resource-secret-management/v1.0.0/secret/ssh\x12\xef\x01\n\x13\x64\x65letePWDCredential\x12N.org.apache.custos.resource.secret.service.GetResourceCredentialByTokenRequest\x1aL.org.apache.custos.resource.secret.service.ResourceCredentialOperationStatus\":\x82\xd3\xe4\x93\x02\x34*2/resource-secret-management/v1.0.0/secret/password\x12\xfa\x01\n\x1b\x64\x65leteCertificateCredential\x12N.org.apache.custos.resource.secret.service.GetResourceCredentialByTokenRequest\x1aL.org.apache.custos.resource.secret.service.ResourceCredentialOperationStatus\"=\x82\xd3\xe4\x93\x02\x37*5/resource-secret-management/v1.0.0/secret/certificateB\x02P\x01\x62\x06proto3'
+  serialized_pb=b'\n%ResourceSecretManagementService.proto\x12\x34org.apache.custos.resource.secret.management.service\x1a\x1cgoogle/api/annotations.proto\x1a\x1bgoogle/protobuf/empty.proto\x1a\x1cgoogle/protobuf/struct.proto\x1a\x1bResourceSecretService.proto\x1a\x15IdentityService.proto2\xa9\x1d\n\x1fResourceSecretManagementService\x12\xb6\x01\n\tgetSecret\x12;.org.apache.custos.resource.secret.service.GetSecretRequest\x1a\x39.org.apache.custos.resource.secret.service.SecretMetadata\"1\x82\xd3\xe4\x93\x02+\x12)/resource-secret-management/v1.0.0/secret\x12\xb9\x01\n\x0fgetKVCredential\x12\x37.org.apache.custos.resource.secret.service.KVCredential\x1a\x37.org.apache.custos.resource.secret.service.KVCredential\"4\x82\xd3\xe4\x93\x02.\x12,/resource-secret-management/v1.0.0/secret/kv\x12\xce\x01\n\x0f\x61\x64\x64KVCredential\x12\x37.org.apache.custos.resource.secret.service.KVCredential\x1aL.org.apache.custos.resource.secret.service.ResourceCredentialOperationStatus\"4\x82\xd3\xe4\x93\x02.\",/resource-secret-management/v1.0.0/secret/kv\x12\xd1\x01\n\x12updateKVCredential\x12\x37.org.apache.custos.resource.secret.service.KVCredential\x1aL.org.apache.custos.resource.secret.service.ResourceCredentialOperationStatus\"4\x82\xd3\xe4\x93\x02.\x1a,/resource-secret-management/v1.0.0/secret/kv\x12\xd1\x01\n\x12\x64\x65leteKVCredential\x12\x37.org.apache.custos.resource.secret.service.KVCredential\x1aL.org.apache.custos.resource.secret.service.ResourceCredentialOperationStatus\"4\x82\xd3\xe4\x93\x02.*,/resource-secret-management/v1.0.0/secret/kv\x12\x97\x01\n\x07getJWKS\x12\x32.org.apache.custos.identity.service.GetJWKSRequest\x1a\x17.google.protobuf.Struct\"?\x82\xd3\xe4\x93\x02\x39\x12\x37/resource-secret-management/v1.0.0/openid-connect/certs\x12\xe4\x01\n\x1cgetResourceCredentialSummary\x12N.org.apache.custos.resource.secret.service.GetResourceCredentialByTokenRequest\x1a\x39.org.apache.custos.resource.secret.service.SecretMetadata\"9\x82\xd3\xe4\x93\x02\x33\x12\x31/resource-secret-management/v1.0.0/secret/summary\x12\xfa\x01\n!getAllResourceCredentialSummaries\x12P.org.apache.custos.resource.secret.service.GetResourceCredentialSummariesRequest\x1a\x46.org.apache.custos.resource.secret.service.ResourceCredentialSummaries\";\x82\xd3\xe4\x93\x02\x35\x12\x33/resource-secret-management/v1.0.0/secret/summaries\x12\xcd\x01\n\x10\x61\x64\x64SSHCredential\x12\x38.org.apache.custos.resource.secret.service.SSHCredential\x1aH.org.apache.custos.resource.secret.service.AddResourceCredentialResponse\"5\x82\xd3\xe4\x93\x02/\"-/resource-secret-management/v1.0.0/secret/ssh\x12\xdc\x01\n\x15\x61\x64\x64PasswordCredential\x12=.org.apache.custos.resource.secret.service.PasswordCredential\x1aH.org.apache.custos.resource.secret.service.AddResourceCredentialResponse\":\x82\xd3\xe4\x93\x02\x34\"2/resource-secret-management/v1.0.0/secret/password\x12\xe5\x01\n\x18\x61\x64\x64\x43\x65rtificateCredential\x12@.org.apache.custos.resource.secret.service.CertificateCredential\x1aH.org.apache.custos.resource.secret.service.AddResourceCredentialResponse\"=\x82\xd3\xe4\x93\x02\x37\"5/resource-secret-management/v1.0.0/secret/certificate\x12\xd3\x01\n\x10getSSHCredential\x12N.org.apache.custos.resource.secret.service.GetResourceCredentialByTokenRequest\x1a\x38.org.apache.custos.resource.secret.service.SSHCredential\"5\x82\xd3\xe4\x93\x02/\x12-/resource-secret-management/v1.0.0/secret/ssh\x12\xe2\x01\n\x15getPasswordCredential\x12N.org.apache.custos.resource.secret.service.GetResourceCredentialByTokenRequest\x1a=.org.apache.custos.resource.secret.service.PasswordCredential\":\x82\xd3\xe4\x93\x02\x34\x12\x32/resource-secret-management/v1.0.0/secret/password\x12\xeb\x01\n\x18getCertificateCredential\x12N.org.apache.custos.resource.secret.service.GetResourceCredentialByTokenRequest\x1a@.org.apache.custos.resource.secret.service.CertificateCredential\"=\x82\xd3\xe4\x93\x02\x37\x12\x35/resource-secret-management/v1.0.0/secret/certificate\x12\xea\x01\n\x13\x64\x65leteSSHCredential\x12N.org.apache.custos.resource.secret.service.GetResourceCredentialByTokenRequest\x1aL.org.apache.custos.resource.secret.service.ResourceCredentialOperationStatus\"5\x82\xd3\xe4\x93\x02/*-/resource-secret-management/v1.0.0/secret/ssh\x12\xef\x01\n\x13\x64\x65letePWDCredential\x12N.org.apache.custos.resource.secret.service.GetResourceCredentialByTokenRequest\x1aL.org.apache.custos.resource.secret.service.ResourceCredentialOperationStatus\":\x82\xd3\xe4\x93\x02\x34*2/resource-secret-management/v1.0.0/secret/password\x12\xfa\x01\n\x1b\x64\x65leteCertificateCredential\x12N.org.apache.custos.resource.secret.service.GetResourceCredentialByTokenRequest\x1aL.org.apache.custos.resource.secret.service.ResourceCredentialOperationStatus\"=\x82\xd3\xe4\x93\x02\x37*5/resource-secret-management/v1.0.0/secret/certificateB\x02P\x01\x62\x06proto3'
   ,
   dependencies=[google_dot_api_dot_annotations__pb2.DESCRIPTOR,google_dot_protobuf_dot_empty__pb2.DESCRIPTOR,google_dot_protobuf_dot_struct__pb2.DESCRIPTOR,ResourceSecretService__pb2.DESCRIPTOR,IdentityService__pb2.DESCRIPTOR,])
 
@@ -43,7 +43,7 @@
   serialized_options=None,
   create_key=_descriptor._internal_create_key,
   serialized_start=237,
-  serialized_end=3169,
+  serialized_end=3990,
   methods=[
   _descriptor.MethodDescriptor(
     name='getSecret',
@@ -55,10 +55,50 @@
     serialized_options=b'\202\323\344\223\002+\022)/resource-secret-management/v1.0.0/secret',
     create_key=_descriptor._internal_create_key,
   ),
+  _descriptor.MethodDescriptor(
+    name='getKVCredential',
+    full_name='org.apache.custos.resource.secret.management.service.ResourceSecretManagementService.getKVCredential',
+    index=1,
+    containing_service=None,
+    input_type=ResourceSecretService__pb2._KVCREDENTIAL,
+    output_type=ResourceSecretService__pb2._KVCREDENTIAL,
+    serialized_options=b'\202\323\344\223\002.\022,/resource-secret-management/v1.0.0/secret/kv',
+    create_key=_descriptor._internal_create_key,
+  ),
+  _descriptor.MethodDescriptor(
+    name='addKVCredential',
+    full_name='org.apache.custos.resource.secret.management.service.ResourceSecretManagementService.addKVCredential',
+    index=2,
+    containing_service=None,
+    input_type=ResourceSecretService__pb2._KVCREDENTIAL,
+    output_type=ResourceSecretService__pb2._RESOURCECREDENTIALOPERATIONSTATUS,
+    serialized_options=b'\202\323\344\223\002.\",/resource-secret-management/v1.0.0/secret/kv',
+    create_key=_descriptor._internal_create_key,
+  ),
+  _descriptor.MethodDescriptor(
+    name='updateKVCredential',
+    full_name='org.apache.custos.resource.secret.management.service.ResourceSecretManagementService.updateKVCredential',
+    index=3,
+    containing_service=None,
+    input_type=ResourceSecretService__pb2._KVCREDENTIAL,
+    output_type=ResourceSecretService__pb2._RESOURCECREDENTIALOPERATIONSTATUS,
+    serialized_options=b'\202\323\344\223\002.\032,/resource-secret-management/v1.0.0/secret/kv',
+    create_key=_descriptor._internal_create_key,
+  ),
+  _descriptor.MethodDescriptor(
+    name='deleteKVCredential',
+    full_name='org.apache.custos.resource.secret.management.service.ResourceSecretManagementService.deleteKVCredential',
+    index=4,
+    containing_service=None,
+    input_type=ResourceSecretService__pb2._KVCREDENTIAL,
+    output_type=ResourceSecretService__pb2._RESOURCECREDENTIALOPERATIONSTATUS,
+    serialized_options=b'\202\323\344\223\002.*,/resource-secret-management/v1.0.0/secret/kv',
+    create_key=_descriptor._internal_create_key,
+  ),
   _descriptor.MethodDescriptor(
     name='getJWKS',
     full_name='org.apache.custos.resource.secret.management.service.ResourceSecretManagementService.getJWKS',
-    index=1,
+    index=5,
     containing_service=None,
     input_type=IdentityService__pb2._GETJWKSREQUEST,
     output_type=google_dot_protobuf_dot_struct__pb2._STRUCT,
@@ -68,7 +108,7 @@
   _descriptor.MethodDescriptor(
     name='getResourceCredentialSummary',
     full_name='org.apache.custos.resource.secret.management.service.ResourceSecretManagementService.getResourceCredentialSummary',
-    index=2,
+    index=6,
     containing_service=None,
     input_type=ResourceSecretService__pb2._GETRESOURCECREDENTIALBYTOKENREQUEST,
     output_type=ResourceSecretService__pb2._SECRETMETADATA,
@@ -78,7 +118,7 @@
   _descriptor.MethodDescriptor(
     name='getAllResourceCredentialSummaries',
     full_name='org.apache.custos.resource.secret.management.service.ResourceSecretManagementService.getAllResourceCredentialSummaries',
-    index=3,
+    index=7,
     containing_service=None,
     input_type=ResourceSecretService__pb2._GETRESOURCECREDENTIALSUMMARIESREQUEST,
     output_type=ResourceSecretService__pb2._RESOURCECREDENTIALSUMMARIES,
@@ -88,7 +128,7 @@
   _descriptor.MethodDescriptor(
     name='addSSHCredential',
     full_name='org.apache.custos.resource.secret.management.service.ResourceSecretManagementService.addSSHCredential',
-    index=4,
+    index=8,
     containing_service=None,
     input_type=ResourceSecretService__pb2._SSHCREDENTIAL,
     output_type=ResourceSecretService__pb2._ADDRESOURCECREDENTIALRESPONSE,
@@ -98,7 +138,7 @@
   _descriptor.MethodDescriptor(
     name='addPasswordCredential',
     full_name='org.apache.custos.resource.secret.management.service.ResourceSecretManagementService.addPasswordCredential',
-    index=5,
+    index=9,
     containing_service=None,
     input_type=ResourceSecretService__pb2._PASSWORDCREDENTIAL,
     output_type=ResourceSecretService__pb2._ADDRESOURCECREDENTIALRESPONSE,
@@ -108,7 +148,7 @@
   _descriptor.MethodDescriptor(
     name='addCertificateCredential',
     full_name='org.apache.custos.resource.secret.management.service.ResourceSecretManagementService.addCertificateCredential',
-    index=6,
+    index=10,
     containing_service=None,
     input_type=ResourceSecretService__pb2._CERTIFICATECREDENTIAL,
     output_type=ResourceSecretService__pb2._ADDRESOURCECREDENTIALRESPONSE,
@@ -118,7 +158,7 @@
   _descriptor.MethodDescriptor(
     name='getSSHCredential',
     full_name='org.apache.custos.resource.secret.management.service.ResourceSecretManagementService.getSSHCredential',
-    index=7,
+    index=11,
     containing_service=None,
     input_type=ResourceSecretService__pb2._GETRESOURCECREDENTIALBYTOKENREQUEST,
     output_type=ResourceSecretService__pb2._SSHCREDENTIAL,
@@ -128,7 +168,7 @@
   _descriptor.MethodDescriptor(
     name='getPasswordCredential',
     full_name='org.apache.custos.resource.secret.management.service.ResourceSecretManagementService.getPasswordCredential',
-    index=8,
+    index=12,
     containing_service=None,
     input_type=ResourceSecretService__pb2._GETRESOURCECREDENTIALBYTOKENREQUEST,
     output_type=ResourceSecretService__pb2._PASSWORDCREDENTIAL,
@@ -138,7 +178,7 @@
   _descriptor.MethodDescriptor(
     name='getCertificateCredential',
     full_name='org.apache.custos.resource.secret.management.service.ResourceSecretManagementService.getCertificateCredential',
-    index=9,
+    index=13,
     containing_service=None,
     input_type=ResourceSecretService__pb2._GETRESOURCECREDENTIALBYTOKENREQUEST,
     output_type=ResourceSecretService__pb2._CERTIFICATECREDENTIAL,
@@ -148,7 +188,7 @@
   _descriptor.MethodDescriptor(
     name='deleteSSHCredential',
     full_name='org.apache.custos.resource.secret.management.service.ResourceSecretManagementService.deleteSSHCredential',
-    index=10,
+    index=14,
     containing_service=None,
     input_type=ResourceSecretService__pb2._GETRESOURCECREDENTIALBYTOKENREQUEST,
     output_type=ResourceSecretService__pb2._RESOURCECREDENTIALOPERATIONSTATUS,
@@ -158,7 +198,7 @@
   _descriptor.MethodDescriptor(
     name='deletePWDCredential',
     full_name='org.apache.custos.resource.secret.management.service.ResourceSecretManagementService.deletePWDCredential',
-    index=11,
+    index=15,
     containing_service=None,
     input_type=ResourceSecretService__pb2._GETRESOURCECREDENTIALBYTOKENREQUEST,
     output_type=ResourceSecretService__pb2._RESOURCECREDENTIALOPERATIONSTATUS,
@@ -168,7 +208,7 @@
   _descriptor.MethodDescriptor(
     name='deleteCertificateCredential',
     full_name='org.apache.custos.resource.secret.management.service.ResourceSecretManagementService.deleteCertificateCredential',
-    index=12,
+    index=16,
     containing_service=None,
     input_type=ResourceSecretService__pb2._GETRESOURCECREDENTIALBYTOKENREQUEST,
     output_type=ResourceSecretService__pb2._RESOURCECREDENTIALOPERATIONSTATUS,
diff --git a/custos-client-sdks/custos-python-sdk/custos/server/integration/ResourceSecretManagementService_pb2_grpc.py b/custos-client-sdks/custos-python-sdk/custos/server/integration/ResourceSecretManagementService_pb2_grpc.py
index 46f45693f..eba7eeec6 100644
--- a/custos-client-sdks/custos-python-sdk/custos/server/integration/ResourceSecretManagementService_pb2_grpc.py
+++ b/custos-client-sdks/custos-python-sdk/custos/server/integration/ResourceSecretManagementService_pb2_grpc.py
@@ -21,6 +21,26 @@ def __init__(self, channel):
                 request_serializer=ResourceSecretService__pb2.GetSecretRequest.SerializeToString,
                 response_deserializer=ResourceSecretService__pb2.SecretMetadata.FromString,
                 )
+        self.getKVCredential = channel.unary_unary(
+                '/org.apache.custos.resource.secret.management.service.ResourceSecretManagementService/getKVCredential',
+                request_serializer=ResourceSecretService__pb2.KVCredential.SerializeToString,
+                response_deserializer=ResourceSecretService__pb2.KVCredential.FromString,
+                )
+        self.addKVCredential = channel.unary_unary(
+                '/org.apache.custos.resource.secret.management.service.ResourceSecretManagementService/addKVCredential',
+                request_serializer=ResourceSecretService__pb2.KVCredential.SerializeToString,
+                response_deserializer=ResourceSecretService__pb2.ResourceCredentialOperationStatus.FromString,
+                )
+        self.updateKVCredential = channel.unary_unary(
+                '/org.apache.custos.resource.secret.management.service.ResourceSecretManagementService/updateKVCredential',
+                request_serializer=ResourceSecretService__pb2.KVCredential.SerializeToString,
+                response_deserializer=ResourceSecretService__pb2.ResourceCredentialOperationStatus.FromString,
+                )
+        self.deleteKVCredential = channel.unary_unary(
+                '/org.apache.custos.resource.secret.management.service.ResourceSecretManagementService/deleteKVCredential',
+                request_serializer=ResourceSecretService__pb2.KVCredential.SerializeToString,
+                response_deserializer=ResourceSecretService__pb2.ResourceCredentialOperationStatus.FromString,
+                )
         self.getJWKS = channel.unary_unary(
                 '/org.apache.custos.resource.secret.management.service.ResourceSecretManagementService/getJWKS',
                 request_serializer=IdentityService__pb2.GetJWKSRequest.SerializeToString,
@@ -92,6 +112,30 @@ def getSecret(self, request, context):
         context.set_details('Method not implemented!')
         raise NotImplementedError('Method not implemented!')
 
+    def getKVCredential(self, request, context):
+        """Missing associated documentation comment in .proto file."""
+        context.set_code(grpc.StatusCode.UNIMPLEMENTED)
+        context.set_details('Method not implemented!')
+        raise NotImplementedError('Method not implemented!')
+
+    def addKVCredential(self, request, context):
+        """Missing associated documentation comment in .proto file."""
+        context.set_code(grpc.StatusCode.UNIMPLEMENTED)
+        context.set_details('Method not implemented!')
+        raise NotImplementedError('Method not implemented!')
+
+    def updateKVCredential(self, request, context):
+        """Missing associated documentation comment in .proto file."""
+        context.set_code(grpc.StatusCode.UNIMPLEMENTED)
+        context.set_details('Method not implemented!')
+        raise NotImplementedError('Method not implemented!')
+
+    def deleteKVCredential(self, request, context):
+        """Missing associated documentation comment in .proto file."""
+        context.set_code(grpc.StatusCode.UNIMPLEMENTED)
+        context.set_details('Method not implemented!')
+        raise NotImplementedError('Method not implemented!')
+
     def getJWKS(self, request, context):
         """Missing associated documentation comment in .proto file."""
         context.set_code(grpc.StatusCode.UNIMPLEMENTED)
@@ -172,6 +216,26 @@ def add_ResourceSecretManagementServiceServicer_to_server(servicer, server):
                     request_deserializer=ResourceSecretService__pb2.GetSecretRequest.FromString,
                     response_serializer=ResourceSecretService__pb2.SecretMetadata.SerializeToString,
             ),
+            'getKVCredential': grpc.unary_unary_rpc_method_handler(
+                    servicer.getKVCredential,
+                    request_deserializer=ResourceSecretService__pb2.KVCredential.FromString,
+                    response_serializer=ResourceSecretService__pb2.KVCredential.SerializeToString,
+            ),
+            'addKVCredential': grpc.unary_unary_rpc_method_handler(
+                    servicer.addKVCredential,
+                    request_deserializer=ResourceSecretService__pb2.KVCredential.FromString,
+                    response_serializer=ResourceSecretService__pb2.ResourceCredentialOperationStatus.SerializeToString,
+            ),
+            'updateKVCredential': grpc.unary_unary_rpc_method_handler(
+                    servicer.updateKVCredential,
+                    request_deserializer=ResourceSecretService__pb2.KVCredential.FromString,
+                    response_serializer=ResourceSecretService__pb2.ResourceCredentialOperationStatus.SerializeToString,
+            ),
+            'deleteKVCredential': grpc.unary_unary_rpc_method_handler(
+                    servicer.deleteKVCredential,
+                    request_deserializer=ResourceSecretService__pb2.KVCredential.FromString,
+                    response_serializer=ResourceSecretService__pb2.ResourceCredentialOperationStatus.SerializeToString,
+            ),
             'getJWKS': grpc.unary_unary_rpc_method_handler(
                     servicer.getJWKS,
                     request_deserializer=IdentityService__pb2.GetJWKSRequest.FromString,
@@ -259,6 +323,74 @@ def getSecret(request,
             options, channel_credentials,
             insecure, call_credentials, compression, wait_for_ready, timeout, metadata)
 
+    @staticmethod
+    def getKVCredential(request,
+            target,
+            options=(),
+            channel_credentials=None,
+            call_credentials=None,
+            insecure=False,
+            compression=None,
+            wait_for_ready=None,
+            timeout=None,
+            metadata=None):
+        return grpc.experimental.unary_unary(request, target, '/org.apache.custos.resource.secret.management.service.ResourceSecretManagementService/getKVCredential',
+            ResourceSecretService__pb2.KVCredential.SerializeToString,
+            ResourceSecretService__pb2.KVCredential.FromString,
+            options, channel_credentials,
+            insecure, call_credentials, compression, wait_for_ready, timeout, metadata)
+
+    @staticmethod
+    def addKVCredential(request,
+            target,
+            options=(),
+            channel_credentials=None,
+            call_credentials=None,
+            insecure=False,
+            compression=None,
+            wait_for_ready=None,
+            timeout=None,
+            metadata=None):
+        return grpc.experimental.unary_unary(request, target, '/org.apache.custos.resource.secret.management.service.ResourceSecretManagementService/addKVCredential',
+            ResourceSecretService__pb2.KVCredential.SerializeToString,
+            ResourceSecretService__pb2.ResourceCredentialOperationStatus.FromString,
+            options, channel_credentials,
+            insecure, call_credentials, compression, wait_for_ready, timeout, metadata)
+
+    @staticmethod
+    def updateKVCredential(request,
+            target,
+            options=(),
+            channel_credentials=None,
+            call_credentials=None,
+            insecure=False,
+            compression=None,
+            wait_for_ready=None,
+            timeout=None,
+            metadata=None):
+        return grpc.experimental.unary_unary(request, target, '/org.apache.custos.resource.secret.management.service.ResourceSecretManagementService/updateKVCredential',
+            ResourceSecretService__pb2.KVCredential.SerializeToString,
+            ResourceSecretService__pb2.ResourceCredentialOperationStatus.FromString,
+            options, channel_credentials,
+            insecure, call_credentials, compression, wait_for_ready, timeout, metadata)
+
+    @staticmethod
+    def deleteKVCredential(request,
+            target,
+            options=(),
+            channel_credentials=None,
+            call_credentials=None,
+            insecure=False,
+            compression=None,
+            wait_for_ready=None,
+            timeout=None,
+            metadata=None):
+        return grpc.experimental.unary_unary(request, target, '/org.apache.custos.resource.secret.management.service.ResourceSecretManagementService/deleteKVCredential',
+            ResourceSecretService__pb2.KVCredential.SerializeToString,
+            ResourceSecretService__pb2.ResourceCredentialOperationStatus.FromString,
+            options, channel_credentials,
+            insecure, call_credentials, compression, wait_for_ready, timeout, metadata)
+
     @staticmethod
     def getJWKS(request,
             target,
diff --git a/custos-core-services-client-stubs/credential-store-core-service-client-stubs/src/main/java/org/apache/custos/credential/store/client/CredentialStoreServiceClient.java b/custos-core-services-client-stubs/credential-store-core-service-client-stubs/src/main/java/org/apache/custos/credential/store/client/CredentialStoreServiceClient.java
index 5deea1431..0ef71bfcc 100644
--- a/custos-core-services-client-stubs/credential-store-core-service-client-stubs/src/main/java/org/apache/custos/credential/store/client/CredentialStoreServiceClient.java
+++ b/custos-core-services-client-stubs/credential-store-core-service-client-stubs/src/main/java/org/apache/custos/credential/store/client/CredentialStoreServiceClient.java
@@ -168,6 +168,13 @@ public GetAllCredentialsResponse getCredentialByAgentBasicAuth(TokenRequest requ
         return credentialStoreServiceBlockingStub.getCredentialByAgentBasicAuth(request);
     }
 
+    public GetAllCredentialsResponse getCredentialByAgentJWTToken(TokenRequest request) {
+        return credentialStoreServiceBlockingStub.getCredentialByAgentJWTToken(request);
+    }
+
+    public OperationStatus validateAgentJWTToken(TokenRequest request) {
+        return credentialStoreServiceBlockingStub.validateAgentJWTToken(request);
+    }
 
 
     private StreamObserver getObserver(ServiceCallback callback, String failureMsg) {
diff --git a/custos-core-services-client-stubs/iam-admin-core-service-client-stub/src/main/java/org/apache/custos/iam/admin/client/IamAdminServiceClient.java b/custos-core-services-client-stubs/iam-admin-core-service-client-stub/src/main/java/org/apache/custos/iam/admin/client/IamAdminServiceClient.java
index e5a820c6b..7a6d3ecbc 100644
--- a/custos-core-services-client-stubs/iam-admin-core-service-client-stub/src/main/java/org/apache/custos/iam/admin/client/IamAdminServiceClient.java
+++ b/custos-core-services-client-stubs/iam-admin-core-service-client-stub/src/main/java/org/apache/custos/iam/admin/client/IamAdminServiceClient.java
@@ -341,6 +341,10 @@ public AllRoles getRolesOfTenant(GetRolesRequest request) {
         return iamAdminServiceBlockingStub.getRolesOfTenant(request);
     }
 
+    public OperationStatus deleteRole(DeleteRoleRequest request) {
+        return iamAdminServiceBlockingStub.deleteRole(request);
+    }
+
     public Agent getAgent(UserSearchRequest request) {
         return iamAdminServiceBlockingStub.getAgent(request);
     }
diff --git a/custos-core-services-client-stubs/identity-core-service-client-stub/src/main/java/org/apache/custos/identity/client/IdentityClient.java b/custos-core-services-client-stubs/identity-core-service-client-stub/src/main/java/org/apache/custos/identity/client/IdentityClient.java
index 4a5f670e1..025932471 100644
--- a/custos-core-services-client-stubs/identity-core-service-client-stub/src/main/java/org/apache/custos/identity/client/IdentityClient.java
+++ b/custos-core-services-client-stubs/identity-core-service-client-stub/src/main/java/org/apache/custos/identity/client/IdentityClient.java
@@ -63,7 +63,7 @@ public void authenticateAsync(AuthenticationRequest request, final ServiceCallba
 
     public void isAuthenticatedAsync(AuthToken request, final ServiceCallback callback) {
         StreamObserver observer = this.getObserver(callback, "isAuthenticated task failed");
-        identityServiceStub.isAuthenticate(request, observer);
+        identityServiceStub.isAuthenticated(request, observer);
     }
 
 
@@ -83,8 +83,8 @@ public AuthToken authenticate(AuthenticationRequest request) {
     }
 
 
-    public IsAuthenticateResponse isAuthenticated(AuthToken request) {
-        return identityServiceBlockingStub.isAuthenticate(request);
+    public IsAuthenticatedResponse isAuthenticated(AuthToken request) {
+        return identityServiceBlockingStub.isAuthenticated(request);
     }
 
 
diff --git a/custos-core-services-client-stubs/resource-secret-core-service-client-stub/src/main/java/org/apache/custos/resource/secret/client/ResourceSecretClient.java b/custos-core-services-client-stubs/resource-secret-core-service-client-stub/src/main/java/org/apache/custos/resource/secret/client/ResourceSecretClient.java
index 1f789feb7..280601755 100644
--- a/custos-core-services-client-stubs/resource-secret-core-service-client-stub/src/main/java/org/apache/custos/resource/secret/client/ResourceSecretClient.java
+++ b/custos-core-services-client-stubs/resource-secret-core-service-client-stub/src/main/java/org/apache/custos/resource/secret/client/ResourceSecretClient.java
@@ -18,6 +18,7 @@
  */
 
 package org.apache.custos.resource.secret.client;
+
 import io.grpc.ClientInterceptor;
 import io.grpc.ManagedChannel;
 import io.grpc.ManagedChannelBuilder;
@@ -45,12 +46,6 @@ public ResourceSecretClient(List<ClientInterceptor> clientInterceptorList,
     }
 
 
-    public SecretMetadata getSecretResponse(GetSecretRequest request) {
-        return resourceSecretServiceBlockingStub.getSecret(request);
-
-    }
-
-
     public SecretMetadata getResourceCredentialSummary(GetResourceCredentialByTokenRequest request) {
 
         return resourceSecretServiceBlockingStub.getResourceCredentialSummary(request);
@@ -97,4 +92,36 @@ public ResourceCredentialOperationStatus deleteCertificateCredential(GetResource
     }
 
 
+    public KVCredential getKVCredential(KVCredential request) {
+        return resourceSecretServiceBlockingStub.getKVCredential(request);
+    }
+
+    public ResourceCredentialOperationStatus setKVCredential(KVCredential request) {
+        return resourceSecretServiceBlockingStub.setKVCredential(request);
+    }
+
+    public ResourceCredentialOperationStatus updateKVCredential(KVCredential request) {
+        return resourceSecretServiceBlockingStub.updateKVCredential(request);
+    }
+
+    public ResourceCredentialOperationStatus deleteKVCredential(KVCredential request) {
+        return resourceSecretServiceBlockingStub.deleteKVCredential(request);
+    }
+
+    public CredentialMap getCredentialMap(CredentialMap request) {
+        return resourceSecretServiceBlockingStub.getCredentialMap(request);
+    }
+
+    public AddResourceCredentialResponse setCredentialMap(CredentialMap request) {
+        return resourceSecretServiceBlockingStub.setCredentialMap(request);
+    }
+
+    public ResourceCredentialOperationStatus updateCredentialMap(CredentialMap request) {
+        return resourceSecretServiceBlockingStub.updateCredentialMap(request);
+    }
+
+    public ResourceCredentialOperationStatus deleteCredentialMap(CredentialMap request) {
+        return resourceSecretServiceBlockingStub.deleteCredentialMap(request);
+    }
+
 }
diff --git a/custos-core-services-client-stubs/user-profile-core-service-client-stub/src/main/java/org/apache/custos/user/profile/client/UserProfileClient.java b/custos-core-services-client-stubs/user-profile-core-service-client-stub/src/main/java/org/apache/custos/user/profile/client/UserProfileClient.java
index 3fa8f883b..775a658b1 100644
--- a/custos-core-services-client-stubs/user-profile-core-service-client-stub/src/main/java/org/apache/custos/user/profile/client/UserProfileClient.java
+++ b/custos-core-services-client-stubs/user-profile-core-service-client-stub/src/main/java/org/apache/custos/user/profile/client/UserProfileClient.java
@@ -202,6 +202,14 @@ public Status changeUserMembershipType(GroupMembership request) {
         return userProfileServiceBlockingStub.changeUserMembershipType(request);
     }
 
+    public Status addUserMembershipType(UserGroupMembershipTypeRequest request) {
+        return userProfileServiceBlockingStub.addUserGroupMembershipType(request);
+    }
+
+    public Status removeUserMembershipType(UserGroupMembershipTypeRequest request) {
+        return userProfileServiceBlockingStub.removeUserGroupMembershipType(request);
+    }
+
     public Status hasAccess(GroupMembership request) {
         return userProfileServiceBlockingStub.hasAccess(request);
     }
diff --git a/custos-core-services/agent-profile-core-service/pom.xml b/custos-core-services/agent-profile-core-service/pom.xml
index 6c4ca1f19..e0d6f7f31 100644
--- a/custos-core-services/agent-profile-core-service/pom.xml
+++ b/custos-core-services/agent-profile-core-service/pom.xml
@@ -116,6 +116,13 @@
                     <skip>false</skip>
                 </configuration>
             </plugin>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-antrun-plugin</artifactId>
+                <configuration>
+                    <skip>false</skip>
+                </configuration>
+            </plugin>
         </plugins>
     </build>
 
diff --git a/custos-core-services/agent-profile-core-service/src/main/helm/templates/deployment.yaml b/custos-core-services/agent-profile-core-service/src/main/helm/templates/deployment.yaml
index ab67be6f0..9bde73ad1 100644
--- a/custos-core-services/agent-profile-core-service/src/main/helm/templates/deployment.yaml
+++ b/custos-core-services/agent-profile-core-service/src/main/helm/templates/deployment.yaml
@@ -47,9 +47,9 @@ spec:
             httpGet:
               path: /actuator/health
               port: 8080
-              initialDelaySeconds: {{ .Values.readinessProbe.initialDelaySeconds }}
-              periodSeconds: {{ .Values.readinessProbe.periodSeconds }}
-              successThreshold: {{ .Values.readinessProbe.successThreshold }}
+            initialDelaySeconds: {{ .Values.readinessProbe.initialDelaySeconds }}
+            periodSeconds: {{ .Values.readinessProbe.periodSeconds }}
+            successThreshold: {{ .Values.readinessProbe.successThreshold }}
           resources:
             {{- toYaml .Values.resources | nindent 12 }}
       {{- with .Values.nodeSelector }}
diff --git a/custos-core-services/agent-profile-core-service/src/main/proto/AgentProfileService.proto b/custos-core-services/agent-profile-core-service/src/main/proto/AgentProfileService.proto
index 6ded328b7..2f5939344 100644
--- a/custos-core-services/agent-profile-core-service/src/main/proto/AgentProfileService.proto
+++ b/custos-core-services/agent-profile-core-service/src/main/proto/AgentProfileService.proto
@@ -46,7 +46,7 @@ message AgentAttribute {
 }
 
 message AgentRequest {
-    int64 tenantId = 1;
+    int64 tenant_id = 1;
     Agent agent = 2;
 }
 
diff --git a/custos-core-services/agent-profile-core-service/src/main/resources/application.properties b/custos-core-services/agent-profile-core-service/src/main/resources/application.properties
index 5fb3e7296..b43627df4 100644
--- a/custos-core-services/agent-profile-core-service/src/main/resources/application.properties
+++ b/custos-core-services/agent-profile-core-service/src/main/resources/application.properties
@@ -27,7 +27,7 @@ management.security.enabled=false
 management.endpoints.web.exposure.include=*
 management.endpoint.metrics.enabled=true
 
-spring.datasource.url = jdbc:mysql://mysql.custos.svc.cluster.local:3306/core_agent_profile?useSSL=false&serverTimezone=UTC&useLegacyDatetimeCode=false
+spring.datasource.url = jdbc:mysql://mysql-primary.custos.svc.cluster.local:3306/core_agent_profile?useSSL=false&serverTimezone=UTC&useLegacyDatetimeCode=false
 spring.datasource.username = root
 spring.datasource.password = root
 
diff --git a/custos-core-services/cluster-management-core-service/pom.xml b/custos-core-services/cluster-management-core-service/pom.xml
index eb514716c..0f0d6ffb2 100644
--- a/custos-core-services/cluster-management-core-service/pom.xml
+++ b/custos-core-services/cluster-management-core-service/pom.xml
@@ -117,6 +117,13 @@
                     <skip>false</skip>
                 </configuration>
             </plugin>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-antrun-plugin</artifactId>
+                <configuration>
+                    <skip>false</skip>
+                </configuration>
+            </plugin>
         </plugins>
     </build>
 
diff --git a/custos-core-services/cluster-management-core-service/src/main/helm/templates/deployment.yaml b/custos-core-services/cluster-management-core-service/src/main/helm/templates/deployment.yaml
index ab67be6f0..9bde73ad1 100644
--- a/custos-core-services/cluster-management-core-service/src/main/helm/templates/deployment.yaml
+++ b/custos-core-services/cluster-management-core-service/src/main/helm/templates/deployment.yaml
@@ -47,9 +47,9 @@ spec:
             httpGet:
               path: /actuator/health
               port: 8080
-              initialDelaySeconds: {{ .Values.readinessProbe.initialDelaySeconds }}
-              periodSeconds: {{ .Values.readinessProbe.periodSeconds }}
-              successThreshold: {{ .Values.readinessProbe.successThreshold }}
+            initialDelaySeconds: {{ .Values.readinessProbe.initialDelaySeconds }}
+            periodSeconds: {{ .Values.readinessProbe.periodSeconds }}
+            successThreshold: {{ .Values.readinessProbe.successThreshold }}
           resources:
             {{- toYaml .Values.resources | nindent 12 }}
       {{- with .Values.nodeSelector }}
diff --git a/custos-core-services/cluster-management-core-service/src/main/resources/application.properties b/custos-core-services/cluster-management-core-service/src/main/resources/application.properties
index 3768b3322..1a2e97cbf 100644
--- a/custos-core-services/cluster-management-core-service/src/main/resources/application.properties
+++ b/custos-core-services/cluster-management-core-service/src/main/resources/application.properties
@@ -27,7 +27,7 @@ management.security.enabled=false
 management.endpoints.web.exposure.include=*
 management.endpoint.metrics.enabled=true
 
-spring.datasource.url = jdbc:mysql://mysql.custos.svc.cluster.local:3306/core_cluster_manager?useSSL=false&serverTimezone=UTC&useLegacyDatetimeCode=false
+spring.datasource.url = jdbc:mysql://mysql-primary.custos.svc.cluster.local:3306/core_cluster_manager?useSSL=false&serverTimezone=UTC&useLegacyDatetimeCode=false
 spring.datasource.username = root
 spring.datasource.password = root
 
diff --git a/custos-core-services/credential-store-core-service/pom.xml b/custos-core-services/credential-store-core-service/pom.xml
index 75a354e63..0ea8a9a99 100644
--- a/custos-core-services/credential-store-core-service/pom.xml
+++ b/custos-core-services/credential-store-core-service/pom.xml
@@ -90,6 +90,7 @@
             <groupId>javax.persistence</groupId>
             <artifactId>persistence-api</artifactId>
         </dependency>
+
     </dependencies>
 
     <build>
@@ -108,6 +109,13 @@
                     <skip>false</skip>
                 </configuration>
             </plugin>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-antrun-plugin</artifactId>
+                <configuration>
+                    <skip>false</skip>
+                </configuration>
+            </plugin>
         </plugins>
     </build>
 
diff --git a/custos-core-services/credential-store-core-service/src/main/helm/templates/deployment.yaml b/custos-core-services/credential-store-core-service/src/main/helm/templates/deployment.yaml
index 31e54a6fc..74401f2c4 100644
--- a/custos-core-services/credential-store-core-service/src/main/helm/templates/deployment.yaml
+++ b/custos-core-services/credential-store-core-service/src/main/helm/templates/deployment.yaml
@@ -6,9 +6,10 @@ metadata:
 {{ include "helm.labels" . | indent 4 }}
 spec:
   replicas: {{ .Values.replicaCount }}
-  rollingUpdate:
-    maxSurge: {{ .Values.rollingUpdate.maxSurge }}
-    maxUnavailable: {{ .Values.rollingUpdate.maxUnavailable }}
+  strategy:
+    rollingUpdate:
+      maxSurge: {{ .Values.rollingUpdate.maxSurge }}
+      maxUnavailable: {{ .Values.rollingUpdate.maxUnavailable }}
   selector:
     matchLabels:
       app.kubernetes.io/name: {{ include "helm.name" . }}
@@ -45,9 +46,9 @@ spec:
             httpGet:
               path: /actuator/health
               port: 8080
-              initialDelaySeconds: {{ .Values.readinessProbe.initialDelaySeconds }}
-              periodSeconds: {{ .Values.readinessProbe.periodSeconds }}
-              successThreshold: {{ .Values.readinessProbe.successThreshold }}
+            initialDelaySeconds: {{ .Values.readinessProbe.initialDelaySeconds }}
+            periodSeconds: {{ .Values.readinessProbe.periodSeconds }}
+            successThreshold: {{ .Values.readinessProbe.successThreshold }}
           resources:
             {{- toYaml .Values.resources | nindent 12 }}
       {{- with .Values.nodeSelector }}
diff --git a/custos-core-services/credential-store-core-service/src/main/java/org/apache/custos/credential/store/credential/CredentialManager.java b/custos-core-services/credential-store-core-service/src/main/java/org/apache/custos/credential/store/credential/CredentialManager.java
index c9e7b83fd..d6c20f5be 100644
--- a/custos-core-services/credential-store-core-service/src/main/java/org/apache/custos/credential/store/credential/CredentialManager.java
+++ b/custos-core-services/credential-store-core-service/src/main/java/org/apache/custos/credential/store/credential/CredentialManager.java
@@ -202,6 +202,29 @@ public Credential decodeJWTToken(String token) {
 
     }
 
+    public Credential decodeAgentJWTToken(String token) {
+        try {
+            java.util.Base64.Decoder decoder = java.util.Base64.getUrlDecoder();
+            String[] parts = token.split("\\."); // split out the "parts" (header, payload and signature)
+
+            String headerJson = new String(decoder.decode(parts[0]));
+            String payloadJson = new String(decoder.decode(parts[1]));
+            String signatureJson = new String(decoder.decode(parts[2]));
+
+            ObjectMapper mapper = new ObjectMapper();
+            Map<String, Object> jsonMap = mapper.readValue(payloadJson, new TypeReference<Map<String, Object>>() {
+            });
+
+            Credential credential = new Credential();
+            credential.setId(jsonMap.get("agent-id").toString());
+            credential.setParentId(jsonMap.get("agent-parent-id").toString());
+            return credential;
+        } catch (Exception ex) {
+            throw new CredentialGenerationException
+                    ("Error occurred while decoding token ", ex);
+        }
+    }
+
     //TODO use UUID
     private String generateRandomClientId(int length) {
         StringBuilder returnValue = new StringBuilder(length);
diff --git a/custos-core-services/credential-store-core-service/src/main/java/org/apache/custos/credential/store/exceptions/CredentialGenerationException.java b/custos-core-services/credential-store-core-service/src/main/java/org/apache/custos/credential/store/exceptions/CredentialGenerationException.java
index 56202bef9..356255119 100644
--- a/custos-core-services/credential-store-core-service/src/main/java/org/apache/custos/credential/store/exceptions/CredentialGenerationException.java
+++ b/custos-core-services/credential-store-core-service/src/main/java/org/apache/custos/credential/store/exceptions/CredentialGenerationException.java
@@ -21,5 +21,6 @@
 
 public class CredentialGenerationException extends RuntimeException {
     public CredentialGenerationException(String s, Exception exception) {
+        super(s,exception);
     }
 }
diff --git a/custos-core-services/credential-store-core-service/src/main/java/org/apache/custos/credential/store/exceptions/CredentialsAuthenticationException.java b/custos-core-services/credential-store-core-service/src/main/java/org/apache/custos/credential/store/exceptions/CredentialsAuthenticationException.java
new file mode 100644
index 000000000..687fcaa4a
--- /dev/null
+++ b/custos-core-services/credential-store-core-service/src/main/java/org/apache/custos/credential/store/exceptions/CredentialsAuthenticationException.java
@@ -0,0 +1,25 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing,
+ *  software distributed under the License is distributed on an
+ *  "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ *  KIND, either express or implied. See the License for the
+ *  specific language governing permissions and limitations
+ *  under the License.
+ */
+
+package org.apache.custos.credential.store.exceptions;
+
+public class CredentialsAuthenticationException extends RuntimeException{
+    public CredentialsAuthenticationException(String s, Exception exception) {
+    }
+}
diff --git a/custos-core-services/credential-store-core-service/src/main/java/org/apache/custos/credential/store/model/Credential.java b/custos-core-services/credential-store-core-service/src/main/java/org/apache/custos/credential/store/model/Credential.java
index 3cc434cd8..1538ae693 100644
--- a/custos-core-services/credential-store-core-service/src/main/java/org/apache/custos/credential/store/model/Credential.java
+++ b/custos-core-services/credential-store-core-service/src/main/java/org/apache/custos/credential/store/model/Credential.java
@@ -31,6 +31,7 @@ public class Credential {
     private  boolean isAdmin;
     private String username;
     private String password;
+    private String parentId;
 
     public Credential(String id, String secret) {
         this.id = id;
@@ -95,4 +96,13 @@ public String getPassword() {
     public void setPassword(String password) {
         this.password = password;
     }
+
+
+    public String getParentId() {
+        return parentId;
+    }
+
+    public void setParentId(String parentId) {
+        this.parentId = parentId;
+    }
 }
diff --git a/custos-core-services/credential-store-core-service/src/main/java/org/apache/custos/credential/store/service/CredentialStoreService.java b/custos-core-services/credential-store-core-service/src/main/java/org/apache/custos/credential/store/service/CredentialStoreService.java
index cebe06b9c..ee4d32e1b 100644
--- a/custos-core-services/credential-store-core-service/src/main/java/org/apache/custos/credential/store/service/CredentialStoreService.java
+++ b/custos-core-services/credential-store-core-service/src/main/java/org/apache/custos/credential/store/service/CredentialStoreService.java
@@ -459,7 +459,7 @@ public void getCustosCredentialFromClientId(GetCredentialRequest request, Stream
 
 
         } catch (Exception ex) {
-            String msg = " Operation failed failed " + ex;
+            String msg = " Operation failed  " + ex;
             LOGGER.error(msg);
             responseObserver.onError(Status.INTERNAL.withDescription(msg).asRuntimeException());
         }
@@ -529,7 +529,7 @@ public void getAllCredentialsFromToken(TokenRequest request, StreamObserver<GetA
 
 
         } catch (Exception ex) {
-            String msg = " Operation failed failed " + ex;
+            String msg = " Operation failed " + ex.getMessage();
             LOGGER.error(msg);
             responseObserver.onError(Status.INTERNAL.withDescription(msg).asRuntimeException());
         }
@@ -610,7 +610,7 @@ public void getBasicCredentials(TokenRequest request, StreamObserver<Credentials
 
 
         } catch (Exception ex) {
-            String msg = " Operation failed failed " + ex;
+            String msg = " Operation failed " + ex;
             LOGGER.error(msg);
             responseObserver.onError(Status.INTERNAL.withDescription(msg).asRuntimeException());
         }
@@ -640,7 +640,6 @@ public void getAllCredentialsFromJWTToken(TokenRequest request, StreamObserver<G
             String subPath = BASE_PATH + entity.getOwnerId();
             List<String> paths = vaultTemplate.list(subPath);
 
-
             List<CredentialMetadata> credentialMetadata = new ArrayList<>();
 
             if (paths != null && !paths.isEmpty()) {
@@ -650,9 +649,7 @@ public void getAllCredentialsFromJWTToken(TokenRequest request, StreamObserver<G
                         VaultResponseSupport<Credential> crRe = vaultTemplate.read(path, Credential.class);
                         CredentialMetadata metadata = convertToCredentialMetadata(crRe.getData(), entity.getOwnerId(), key);
 
-
                         if (key.equals(Type.CUSTOS.name())) {
-
                             metadata = metadata.toBuilder()
                                     .setClientIdIssuedAt(entity.getIssuedAt().getTime())
                                     .setClientSecretExpiredAt(entity.getClientSecretExpiredAt())
@@ -665,7 +662,6 @@ public void getAllCredentialsFromJWTToken(TokenRequest request, StreamObserver<G
                 }
             }
 
-
             GetAllCredentialsResponse response = GetAllCredentialsResponse.newBuilder()
                     .addAllSecretList(credentialMetadata)
                     .setRequesterUserEmail(credential.getEmail())
@@ -677,9 +673,9 @@ public void getAllCredentialsFromJWTToken(TokenRequest request, StreamObserver<G
 
 
         } catch (Exception ex) {
-            String msg = " Operation failed  " + ex;
+            String msg = " Operation failed  " + ex.getMessage();
             LOGGER.error(msg);
-            responseObserver.onError(Status.UNAUTHENTICATED.withDescription(msg).asRuntimeException());
+            responseObserver.onError(Status.INTERNAL.withDescription(msg).asRuntimeException());
         }
     }
 
@@ -987,8 +983,99 @@ public void getCredentialByAgentBasicAuth(TokenRequest request, StreamObserver<G
     }
 
 
+    @Override
+    public void getCredentialByAgentJWTToken(TokenRequest request, StreamObserver<GetAllCredentialsResponse> responseObserver) {
+        try {
+            LOGGER.debug(" Request received to getCredentialByAgentJWTToken ");
+
+            String token = request.getToken();
+
+            Credential credential = credentialManager.decodeAgentJWTToken(token);
+
+            if (credential == null || credential.getId() == null || credential.getParentId() == null) {
+                LOGGER.error("Invalid agent access token");
+                responseObserver.onError(Status.NOT_FOUND.asRuntimeException());
+                return;
+            }
+
+            CredentialEntity exEntity = repository.findByClientId(credential.getParentId());
 
+            if (exEntity != null) {
 
+                AgentCredentialEntity entity = agentCredentialRepository.findByClientIdAndOwnerId(credential.getId(),
+                        exEntity.getOwnerId());
+
+                if (entity == null) {
+                    LOGGER.error("Agent not found with Id " + credential.getId());
+                    responseObserver.onError(Status.NOT_FOUND.asRuntimeException());
+                    return;
+                }
+                GetAllCredentialsResponse response = getAllCredentials(exEntity, credential);
+                responseObserver.onNext(response);
+                responseObserver.onCompleted();
+
+            } else {
+                String msg = " Cannot find a valid  tenant for agent " + credential.getId();
+                LOGGER.error(msg);
+                responseObserver.onError(Status.NOT_FOUND.withDescription(msg).asRuntimeException());
+            }
+        } catch (Exception ex) {
+            String msg = " Error occurred  reason:  " + ex;
+            LOGGER.error(msg);
+            responseObserver.onError(Status.INTERNAL.withDescription(msg).asRuntimeException());
+        }
+    }
+
+
+    @Override
+    public void validateAgentJWTToken(TokenRequest request, StreamObserver<OperationStatus> responseObserver) {
+        try {
+            LOGGER.debug(" Request received to validateAgentJWTToken ");
+
+            String token = request.getToken();
+
+            Credential credential = credentialManager.decodeAgentJWTToken(token);
+
+            if (credential == null || credential.getId() == null || credential.getParentId() == null) {
+                OperationStatus operationStatus = OperationStatus
+                        .newBuilder().setState(false).build();
+                responseObserver.onNext(operationStatus);
+                responseObserver.onCompleted();
+                return;
+            }
+            CredentialEntity exEntity = repository.findByClientId(credential.getParentId());
+
+            if (exEntity == null) {
+                OperationStatus operationStatus = OperationStatus
+                        .newBuilder().setState(false).build();
+                responseObserver.onNext(operationStatus);
+                responseObserver.onCompleted();
+                return;
+
+            }
+
+            AgentCredentialEntity entity = agentCredentialRepository.findByClientIdAndOwnerId(credential.getId(),
+                    exEntity.getOwnerId());
+
+            if (entity == null) {
+                OperationStatus operationStatus = OperationStatus
+                        .newBuilder().setState(false).build();
+                responseObserver.onNext(operationStatus);
+                responseObserver.onCompleted();
+                return;
+            }
+            OperationStatus operationStatus = OperationStatus
+                    .newBuilder().setState(true).build();
+            responseObserver.onNext(operationStatus);
+            responseObserver.onCompleted();
+
+        } catch (Exception ex) {
+            OperationStatus operationStatus = OperationStatus
+                    .newBuilder().setState(false).build();
+            responseObserver.onNext(operationStatus);
+            responseObserver.onCompleted();
+        }
+    }
 
     private OperationMetadata convertFromEntity(StatusEntity entity) {
         return OperationMetadata.newBuilder()
@@ -1018,4 +1105,41 @@ private boolean isMainType(String str) {
         }
         return false;
     }
+
+
+    private GetAllCredentialsResponse getAllCredentials(CredentialEntity entity, Credential credential) {
+        String subPath = BASE_PATH + entity.getOwnerId();
+        List<String> paths = vaultTemplate.list(subPath);
+
+        List<CredentialMetadata> metadataList = new ArrayList<>();
+
+
+        if (paths != null && !paths.isEmpty()) {
+            for (String key : paths) {
+                String path = subPath + "/" + key;
+                VaultResponseSupport<Credential> crRe = vaultTemplate.read(path, Credential.class);
+
+                if (isMainType(key)) {
+                    CredentialMetadata metadata = convertToCredentialMetadata(crRe.getData(), entity.getOwnerId(), key);
+                    metadataList.add(metadata);
+
+                } else if (key.equals(credential.getId())) {
+                    CredentialMetadata metadata = CredentialMetadata
+                            .newBuilder()
+                            .setType(Type.AGENT)
+                            .setId(credential.getId())
+                            .setSecret(crRe.getData().getSecret())
+                            .setOwnerId(entity.getOwnerId())
+                            .setInternalSec(crRe.getData().getPassword())
+                            .build();
+                    metadataList.add(metadata);
+                }
+            }
+        }
+        GetAllCredentialsResponse response = GetAllCredentialsResponse
+                .newBuilder()
+                .addAllSecretList(metadataList)
+                .build();
+        return response;
+    }
 }
diff --git a/custos-core-services/credential-store-core-service/src/main/java/org/apache/custos/credential/store/validator/InputValidator.java b/custos-core-services/credential-store-core-service/src/main/java/org/apache/custos/credential/store/validator/InputValidator.java
index cea136fb5..78fcbd346 100644
--- a/custos-core-services/credential-store-core-service/src/main/java/org/apache/custos/credential/store/validator/InputValidator.java
+++ b/custos-core-services/credential-store-core-service/src/main/java/org/apache/custos/credential/store/validator/InputValidator.java
@@ -59,6 +59,7 @@ public void validate(String methodName, Object obj) {
             case "getAllCredentialsFromJWTToken":
             case "getAllCredentialsFromToken":
             case "getCustosCredentialFromToken":
+            case "validateAgentJWTToken":
                 validateTokenRequest(obj, methodName);
                 break;
             case "getCredentialFromClientId":
diff --git a/custos-core-services/credential-store-core-service/src/main/proto/CredentialStoreService.proto b/custos-core-services/credential-store-core-service/src/main/proto/CredentialStoreService.proto
index ecb831567..da6002b4e 100644
--- a/custos-core-services/credential-store-core-service/src/main/proto/CredentialStoreService.proto
+++ b/custos-core-services/credential-store-core-service/src/main/proto/CredentialStoreService.proto
@@ -33,11 +33,11 @@ enum Type {
 }
 
 message CredentialMetadata {
-    int64 ownerId = 1;
+    int64 owner_id = 1;
     string id = 2;
     string secret = 3;
-    int64 clientSecretExpiredAt = 4;
-    int64 clientIdIssuedAt = 5;
+    int64 client_secret_expired_at = 4;
+    int64 client_id_issued_at = 5;
     Type type = 6;
     bool super_tenant = 7;
     bool super_admin = 8;
@@ -55,9 +55,9 @@ message GetAllCredentialsRequest {
 }
 
 message GetAllCredentialsResponse {
-    repeated CredentialMetadata secretList = 1;
-    string requesterUserEmail = 2;
-    string requesterUsername = 3;
+    repeated CredentialMetadata secret_list = 1;
+    string requester_user_email = 2;
+    string requester_username = 3;
 }
 
 message OperationStatus {
@@ -65,41 +65,41 @@ message OperationStatus {
 }
 
 message DeleteCredentialRequest {
-    int64 ownerId = 1;
+    int64 owner_id = 1;
     Type type = 2;
 }
 
 message GetOperationsMetadataRequest {
-    int64 traceId = 1;
+    int64 trace_id = 1;
 }
 
 message OperationMetadata {
     string event = 1;
     string status = 2;
-    string timeStamp = 3;
-    string performedBy = 4;
+    string time_stamp = 3;
+    string performed_by = 4;
 }
 message GetOperationsMetadataResponse {
     repeated OperationMetadata metadata = 1;
 }
 
 message GetNewCustosCredentialRequest {
-    int64 ownerId = 1;
-    string performedBy = 2;
+    int64 owner_id = 1;
+    string performed_by = 2;
 }
 
 message GetNewCustosCredentialResponse {
-    string clientId = 1;
-    string clientSecret = 2;
+    string client_id = 1;
+    string client_secret = 2;
 }
 
 message TokenRequest {
     string token = 1;
-    string parentClientId = 2;
+    string parent_client_id = 2;
 }
 
 message GetOwnerIdResponse {
-    int64 ownerId = 2;
+    int64 owner_id = 2;
 }
 
 message Credentials {
@@ -136,6 +136,7 @@ service CredentialStoreService {
     rpc deleteAgentCredential (CredentialMetadata) returns (OperationStatus);
     rpc getCredentialByAgentBasicAuth (TokenRequest) returns (GetAllCredentialsResponse);
     rpc getCredentialByAgentJWTToken (TokenRequest) returns (GetAllCredentialsResponse);
+    rpc validateAgentJWTToken(TokenRequest) returns (OperationStatus);
 
 
 }
\ No newline at end of file
diff --git a/custos-core-services/credential-store-core-service/src/main/resources/application.properties b/custos-core-services/credential-store-core-service/src/main/resources/application.properties
index a26a7d155..6f3c54b83 100644
--- a/custos-core-services/credential-store-core-service/src/main/resources/application.properties
+++ b/custos-core-services/credential-store-core-service/src/main/resources/application.properties
@@ -27,7 +27,7 @@ management.endpoints.web.exposure.include=*
 management.endpoint.metrics.enabled=true
 
 
-spring.datasource.url = jdbc:mysql://mysql.custos.svc.cluster.local:3306/core_credential_store?useSSL=false&serverTimezone=UTC&useLegacyDatetimeCode=false
+spring.datasource.url = jdbc:mysql://mysql-primary.custos.svc.cluster.local:3306/core_credential_store?useSSL=false&serverTimezone=UTC&useLegacyDatetimeCode=false
 spring.datasource.username = root
 spring.datasource.password = root
 
diff --git a/custos-core-services/credential-store-core-service/src/main/resources/bootstrap.properties b/custos-core-services/credential-store-core-service/src/main/resources/bootstrap.properties
index 3d6e403b0..dc723c813 100644
--- a/custos-core-services/credential-store-core-service/src/main/resources/bootstrap.properties
+++ b/custos-core-services/credential-store-core-service/src/main/resources/bootstrap.properties
@@ -14,13 +14,14 @@
 # "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
 # KIND, either express or implied. See the License for the
 #  specific language governing permissions and limitations
-#  under the License.
-#
+#  under the License
 
-spring.cloud.vault.token=vault_token
-spring.cloud.vault.scheme=http
+spring.cloud.vault.token={{vault_token}}
+spring.cloud.vault.scheme=https
 spring.cloud.vault.host=vault.custos.scigap.org
-spring.cloud.vault.port=30249
-spring.cloud.vault.uri=http://vault.custos.scigap.org:30249
+spring.cloud.vault.port=31190
+spring.cloud.vault.uri=https://vault.custos.scigap.org:31190
 spring.cloud.vault.authentication=token
+spring.cloud.vault.ssl.trust-store=vault-client-truststore.pkcs12
+spring.cloud.vault.ssl.trust-store-password=vaultpass
 
diff --git a/custos-core-services/credential-store-core-service/src/main/resources/vault-client-truststore.pkcs12 b/custos-core-services/credential-store-core-service/src/main/resources/vault-client-truststore.pkcs12
new file mode 100644
index 000000000..8314bc0db
Binary files /dev/null and b/custos-core-services/credential-store-core-service/src/main/resources/vault-client-truststore.pkcs12 differ
diff --git a/custos-core-services/custos-core-services-commons/src/main/java/org/apache/custos/core/services/commons/util/Constants.java b/custos-core-services/custos-core-services-commons/src/main/java/org/apache/custos/core/services/commons/util/Constants.java
index 4be0d49b3..de0daad83 100644
--- a/custos-core-services/custos-core-services-commons/src/main/java/org/apache/custos/core/services/commons/util/Constants.java
+++ b/custos-core-services/custos-core-services-commons/src/main/java/org/apache/custos/core/services/commons/util/Constants.java
@@ -26,4 +26,7 @@ public final class Constants {
     public static final String  OWNER_ID = "custos-ownerId";
     public static final String DESCRIPTION = "custos-description";
 
+    public static final String AGENT_ID ="agent-id";
+    public static final String AGENT_PARENT_ID = "agent-parent-id";
+
 }
diff --git a/custos-core-services/custos-logging/pom.xml b/custos-core-services/custos-logging/pom.xml
index 5bf6aff27..3d9c9a75a 100644
--- a/custos-core-services/custos-logging/pom.xml
+++ b/custos-core-services/custos-logging/pom.xml
@@ -94,6 +94,7 @@
             <groupId>javax.persistence</groupId>
             <artifactId>persistence-api</artifactId>
         </dependency>
+
     </dependencies>
 
 
@@ -113,6 +114,13 @@
                     <skip>false</skip>
                 </configuration>
             </plugin>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-antrun-plugin</artifactId>
+                <configuration>
+                    <skip>false</skip>
+                </configuration>
+            </plugin>
         </plugins>
     </build>
 
diff --git a/custos-core-services/custos-logging/src/main/helm/templates/deployment.yaml b/custos-core-services/custos-logging/src/main/helm/templates/deployment.yaml
index 31e54a6fc..74401f2c4 100644
--- a/custos-core-services/custos-logging/src/main/helm/templates/deployment.yaml
+++ b/custos-core-services/custos-logging/src/main/helm/templates/deployment.yaml
@@ -6,9 +6,10 @@ metadata:
 {{ include "helm.labels" . | indent 4 }}
 spec:
   replicas: {{ .Values.replicaCount }}
-  rollingUpdate:
-    maxSurge: {{ .Values.rollingUpdate.maxSurge }}
-    maxUnavailable: {{ .Values.rollingUpdate.maxUnavailable }}
+  strategy:
+    rollingUpdate:
+      maxSurge: {{ .Values.rollingUpdate.maxSurge }}
+      maxUnavailable: {{ .Values.rollingUpdate.maxUnavailable }}
   selector:
     matchLabels:
       app.kubernetes.io/name: {{ include "helm.name" . }}
@@ -45,9 +46,9 @@ spec:
             httpGet:
               path: /actuator/health
               port: 8080
-              initialDelaySeconds: {{ .Values.readinessProbe.initialDelaySeconds }}
-              periodSeconds: {{ .Values.readinessProbe.periodSeconds }}
-              successThreshold: {{ .Values.readinessProbe.successThreshold }}
+            initialDelaySeconds: {{ .Values.readinessProbe.initialDelaySeconds }}
+            periodSeconds: {{ .Values.readinessProbe.periodSeconds }}
+            successThreshold: {{ .Values.readinessProbe.successThreshold }}
           resources:
             {{- toYaml .Values.resources | nindent 12 }}
       {{- with .Values.nodeSelector }}
diff --git a/custos-core-services/custos-logging/src/main/resources/application.properties b/custos-core-services/custos-logging/src/main/resources/application.properties
index 2711f343c..a56cab7b4 100644
--- a/custos-core-services/custos-logging/src/main/resources/application.properties
+++ b/custos-core-services/custos-logging/src/main/resources/application.properties
@@ -28,7 +28,7 @@ management.endpoints.web.exposure.include=*
 management.endpoint.metrics.enabled=true
 
 
-spring.datasource.url = jdbc:mysql://mysql.custos.svc.cluster.local:3306/core_logging?useSSL=false&serverTimezone=UTC&useLegacyDatetimeCode=false
+spring.datasource.url = jdbc:mysql://mysql-primary.custos.svc.cluster.local:3306/core_logging?useSSL=false&serverTimezone=UTC&useLegacyDatetimeCode=false
 spring.datasource.username = root
 spring.datasource.password = root
 
diff --git a/custos-core-services/federated-authentication-core-service/pom.xml b/custos-core-services/federated-authentication-core-service/pom.xml
index fcfba0038..452a9a085 100644
--- a/custos-core-services/federated-authentication-core-service/pom.xml
+++ b/custos-core-services/federated-authentication-core-service/pom.xml
@@ -99,6 +99,7 @@
             <groupId>javax.persistence</groupId>
             <artifactId>persistence-api</artifactId>
         </dependency>
+
     </dependencies>
 
 
@@ -118,6 +119,13 @@
                     <skip>false</skip>
                 </configuration>
             </plugin>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-antrun-plugin</artifactId>
+                <configuration>
+                    <skip>false</skip>
+                </configuration>
+            </plugin>
         </plugins>
     </build>
 
diff --git a/custos-core-services/federated-authentication-core-service/src/main/helm/templates/deployment.yaml b/custos-core-services/federated-authentication-core-service/src/main/helm/templates/deployment.yaml
index 31e54a6fc..74401f2c4 100644
--- a/custos-core-services/federated-authentication-core-service/src/main/helm/templates/deployment.yaml
+++ b/custos-core-services/federated-authentication-core-service/src/main/helm/templates/deployment.yaml
@@ -6,9 +6,10 @@ metadata:
 {{ include "helm.labels" . | indent 4 }}
 spec:
   replicas: {{ .Values.replicaCount }}
-  rollingUpdate:
-    maxSurge: {{ .Values.rollingUpdate.maxSurge }}
-    maxUnavailable: {{ .Values.rollingUpdate.maxUnavailable }}
+  strategy:
+    rollingUpdate:
+      maxSurge: {{ .Values.rollingUpdate.maxSurge }}
+      maxUnavailable: {{ .Values.rollingUpdate.maxUnavailable }}
   selector:
     matchLabels:
       app.kubernetes.io/name: {{ include "helm.name" . }}
@@ -45,9 +46,9 @@ spec:
             httpGet:
               path: /actuator/health
               port: 8080
-              initialDelaySeconds: {{ .Values.readinessProbe.initialDelaySeconds }}
-              periodSeconds: {{ .Values.readinessProbe.periodSeconds }}
-              successThreshold: {{ .Values.readinessProbe.successThreshold }}
+            initialDelaySeconds: {{ .Values.readinessProbe.initialDelaySeconds }}
+            periodSeconds: {{ .Values.readinessProbe.periodSeconds }}
+            successThreshold: {{ .Values.readinessProbe.successThreshold }}
           resources:
             {{- toYaml .Values.resources | nindent 12 }}
       {{- with .Values.nodeSelector }}
diff --git a/custos-core-services/federated-authentication-core-service/src/main/proto/FederatedAuthenticationService.proto b/custos-core-services/federated-authentication-core-service/src/main/proto/FederatedAuthenticationService.proto
index ed554f0a5..900fb770e 100644
--- a/custos-core-services/federated-authentication-core-service/src/main/proto/FederatedAuthenticationService.proto
+++ b/custos-core-services/federated-authentication-core-service/src/main/proto/FederatedAuthenticationService.proto
@@ -31,49 +31,49 @@ enum InstitutionCacheType {
 
 
 message ClientMetadata {
-    int64 tenantId = 1;
-    string tenantName = 2;
+    int64 tenant_id = 1;
+    string tenant_name = 2;
     repeated string scope = 3;
-    string tenantURI = 4;
+    string tenant_uRI = 4;
     repeated string contacts = 5;
     string comment = 6;
-    repeated string redirectURIs = 7;
-    string clientId = 8;
-    string performedBy = 9;
+    repeated string redirect_uRIs = 7;
+    string client_id = 8;
+    string performed_by = 9;
 }
 
 
 message RegisterClientResponse {
-    string clientId = 1;
-    string clientSecret = 2;
-    int64 clientIdIssuedAt = 3;
-    int64 clientSecretExpiresAt = 4;
-    string clientRegistrationUri = 5;
+    string client_id = 1;
+    string client_secret = 2;
+    int64 client_id_issued_at = 3;
+    int64 client_secret_expires_at = 4;
+    string client_registration_uri = 5;
 }
 
 
 message GetClientRequest {
-    int64 tenantId = 1;
-    string clientId = 2;
+    int64 tenant_id= 1;
+    string client_id = 2;
 }
 
 message GetClientResponse {
-    string clientId = 1;
-    string clientName = 2;
-    repeated string redirectURIs = 3;
-    repeated string grantTypes = 4;
+    string client_id = 1;
+    string client_name = 2;
+    repeated string redirect_uRIs = 3;
+    repeated string grant_types = 4;
     repeated string scope = 5;
-    int64 clientIdIssuedAt = 6;
+    int64 client_id_issued_at = 6;
     string comment = 7;
-    string clientSecret = 8;
-    int64 clientSecretExpiresAt = 9;
-    string clientRegistrationUri = 10;
+    string client_secret = 8;
+    int64 client_secret_expires_at = 9;
+    string client_registration_uri = 10;
 }
 
 message DeleteClientRequest {
-    int64 tenantId = 1;
-    string clientId = 2;
-    string performedBy = 3;
+    int64 tenant_id = 1;
+    string client_id = 2;
+    string performed_by = 3;
 }
 
 message Empty {
@@ -81,14 +81,14 @@ message Empty {
 }
 
 message GetOperationsMetadataRequest {
-    int64 traceId = 1;
+    int64 trace_id = 1;
 }
 
 message OperationMetadata {
     string event = 1;
     string status = 2;
-    string timeStamp = 3;
-    string performedBy = 4;
+    string time_stamp = 3;
+    string performed_by = 4;
 }
 message GetOperationsMetadataResponse {
     repeated OperationMetadata metadata = 1;
diff --git a/custos-core-services/federated-authentication-core-service/src/main/resources/application.properties b/custos-core-services/federated-authentication-core-service/src/main/resources/application.properties
index 1904647a1..70fece97f 100644
--- a/custos-core-services/federated-authentication-core-service/src/main/resources/application.properties
+++ b/custos-core-services/federated-authentication-core-service/src/main/resources/application.properties
@@ -28,7 +28,7 @@ management.endpoints.web.exposure.include=*
 management.endpoint.metrics.enabled=true
 
 
-spring.datasource.url = jdbc:mysql://mysql.custos.svc.cluster.local:3306/core_federated_authentication?useSSL=false&serverTimezone=UTC&useLegacyDatetimeCode=false
+spring.datasource.url = jdbc:mysql://mysql-primary.custos.svc.cluster.local:3306/core_federated_authentication?useSSL=false&serverTimezone=UTC&useLegacyDatetimeCode=false
 spring.datasource.username = root
 spring.datasource.password = root
 
diff --git a/custos-core-services/iam-admin-core-service/pom.xml b/custos-core-services/iam-admin-core-service/pom.xml
index 5201c4cf3..890ef83fd 100644
--- a/custos-core-services/iam-admin-core-service/pom.xml
+++ b/custos-core-services/iam-admin-core-service/pom.xml
@@ -100,6 +100,7 @@
             <groupId>javax.persistence</groupId>
             <artifactId>persistence-api</artifactId>
         </dependency>
+
     </dependencies>
 
 
@@ -119,6 +120,13 @@
                     <skip>false</skip>
                 </configuration>
             </plugin>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-antrun-plugin</artifactId>
+                <configuration>
+                    <skip>false</skip>
+                </configuration>
+            </plugin>
         </plugins>
     </build>
 </project>
\ No newline at end of file
diff --git a/custos-core-services/iam-admin-core-service/src/main/helm/templates/deployment.yaml b/custos-core-services/iam-admin-core-service/src/main/helm/templates/deployment.yaml
index 31e54a6fc..74401f2c4 100644
--- a/custos-core-services/iam-admin-core-service/src/main/helm/templates/deployment.yaml
+++ b/custos-core-services/iam-admin-core-service/src/main/helm/templates/deployment.yaml
@@ -6,9 +6,10 @@ metadata:
 {{ include "helm.labels" . | indent 4 }}
 spec:
   replicas: {{ .Values.replicaCount }}
-  rollingUpdate:
-    maxSurge: {{ .Values.rollingUpdate.maxSurge }}
-    maxUnavailable: {{ .Values.rollingUpdate.maxUnavailable }}
+  strategy:
+    rollingUpdate:
+      maxSurge: {{ .Values.rollingUpdate.maxSurge }}
+      maxUnavailable: {{ .Values.rollingUpdate.maxUnavailable }}
   selector:
     matchLabels:
       app.kubernetes.io/name: {{ include "helm.name" . }}
@@ -45,9 +46,9 @@ spec:
             httpGet:
               path: /actuator/health
               port: 8080
-              initialDelaySeconds: {{ .Values.readinessProbe.initialDelaySeconds }}
-              periodSeconds: {{ .Values.readinessProbe.periodSeconds }}
-              successThreshold: {{ .Values.readinessProbe.successThreshold }}
+            initialDelaySeconds: {{ .Values.readinessProbe.initialDelaySeconds }}
+            periodSeconds: {{ .Values.readinessProbe.periodSeconds }}
+            successThreshold: {{ .Values.readinessProbe.successThreshold }}
           resources:
             {{- toYaml .Values.resources | nindent 12 }}
       {{- with .Values.nodeSelector }}
diff --git a/custos-core-services/iam-admin-core-service/src/main/java/org/apache/custos/iam/service/IamAdminService.java b/custos-core-services/iam-admin-core-service/src/main/java/org/apache/custos/iam/service/IamAdminService.java
index d6b47024a..d477ee96c 100644
--- a/custos-core-services/iam-admin-core-service/src/main/java/org/apache/custos/iam/service/IamAdminService.java
+++ b/custos-core-services/iam-admin-core-service/src/main/java/org/apache/custos/iam/service/IamAdminService.java
@@ -932,6 +932,7 @@ public void addRolesToTenant(AddRolesRequest request, StreamObserver<AllRoles> r
                     RoleRepresentation roleRepresentation = RoleRepresentation.
                             newBuilder().setName(role.getName())
                             .setComposite(role.isComposite())
+                            .setId(role.getId())
                             .build();
                     if (role.getDescription() != null) {
                         roleRepresentation = roleRepresentation.toBuilder().setDescription(role.getDescription()).build();
@@ -965,6 +966,24 @@ public void addRolesToTenant(AddRolesRequest request, StreamObserver<AllRoles> r
         }
     }
 
+    @Override
+    public void deleteRole(DeleteRoleRequest request, StreamObserver<org.apache.custos.iam.service.OperationStatus> responseObserver) {
+        try {
+            LOGGER.debug("Request received to add roles to tenant for " + request.getTenantId());
+
+            keycloakClient.deleteRole(request.getRole().getId(), String.valueOf(request.getTenantId()),
+                    request.getClientId(), request.getClientLevel());
+            org.apache.custos.iam.service.OperationStatus operationStatus =
+                    org.apache.custos.iam.service.OperationStatus.newBuilder().setStatus(true).build();
+            responseObserver.onNext(operationStatus);
+            responseObserver.onCompleted();
+        } catch (Exception ex) {
+            String msg = " Deleting role" + request.getRole().getName() + "   " +
+                    "failed for " + request.getTenantId() + " " + ex.getMessage();
+            LOGGER.error(msg, ex);
+            responseObserver.onError(io.grpc.Status.INTERNAL.withDescription(msg).asRuntimeException());
+        }
+    }
 
     @Override
     public void getRolesOfTenant(GetRolesRequest request, StreamObserver<AllRoles> responseObserver) {
@@ -981,6 +1000,7 @@ public void getRolesOfTenant(GetRolesRequest request, StreamObserver<AllRoles> r
                     RoleRepresentation roleRepresentation = RoleRepresentation.
                             newBuilder().setName(role.getName())
                             .setComposite(role.isComposite())
+                            .setId(role.getId())
                             .build();
                     if (role.getDescription() != null) {
                         roleRepresentation = roleRepresentation.toBuilder().setDescription(role.getDescription()).build();
diff --git a/custos-core-services/iam-admin-core-service/src/main/proto/IamAdminService.proto b/custos-core-services/iam-admin-core-service/src/main/proto/IamAdminService.proto
index 63a77fe08..77ff45bf2 100644
--- a/custos-core-services/iam-admin-core-service/src/main/proto/IamAdminService.proto
+++ b/custos-core-services/iam-admin-core-service/src/main/proto/IamAdminService.proto
@@ -37,28 +37,28 @@ enum FederatedIDPs {
 
 
 message SetUpTenantRequest {
-    int64 tenantId = 1;
-    string tenantName = 2;
-    string adminUsername = 3;
-    string adminFirstname = 4;
-    string adminLastname = 5;
-    string adminEmail = 6;
-    string adminPassword = 7;
-    string tenantURL = 8;
-    string requesterEmail = 9;
-    repeated string redirectURIs = 10;
-    string custosClientId = 11;
+    int64 tenant_id = 1;
+    string tenant_name = 2;
+    string admin_username = 3;
+    string admin_firstname = 4;
+    string admin_lastname = 5;
+    string admin_email = 6;
+    string admin_password = 7;
+    string tenant_uRL = 8;
+    string requester_email = 9;
+    repeated string redirect_uRIs = 10;
+    string custos_client_id = 11;
 
 }
 
 message ConfigureFederateIDPRequest {
-    int64 tenantId = 1;
+    int64 tenant_id = 1;
     FederatedIDPs type = 2;
-    string clientID = 3;
-    string clientSec = 4;
-    map<string, string> configMap = 5;
-    string requesterEmail = 6;
-    string idpId = 7;
+    string client_iD = 3;
+    string client_sec = 4;
+    map<string, string> config_map = 5;
+    string requester_email = 6;
+    string idp_id = 7;
     string scope = 8;
 }
 
@@ -68,14 +68,14 @@ message FederateIDPResponse {
 }
 
 message SetUpTenantResponse {
-    string clientId = 1;
-    string clientSecret = 2;
+    string client_id = 1;
+    string client_secret = 2;
 }
 
 message IsUsernameAvailableRequest {
-    int64 tenantId = 1;
-    string accessToken = 2;
-    string userName = 3;
+    int64 tenant_id = 1;
+    string access_token = 2;
+    string user_name = 3;
 
 }
 
@@ -115,21 +115,21 @@ message GroupRepresentation {
 
 
 message RegisterUserRequest {
-    int64 tenantId = 1;
-    string accessToken = 2;
-    string clientId = 3;
-    string clientSec = 4;
+    int64 tenant_id = 1;
+    string access_token = 2;
+    string client_id = 3;
+    string client_sec = 4;
     UserRepresentation user = 5;
-    string performedBy = 6;
+    string performed_by = 6;
 }
 
 
 message RegisterUsersRequest {
     repeated UserRepresentation users = 1;
-    int64 tenantId = 2;
-    string accessToken = 3;
-    string clientId = 4;
-    string performedBy = 5;
+    int64 tenant_id = 2;
+    string access_token = 3;
+    string client_id = 4;
+    string performed_by = 5;
 }
 
 message RegisterUserResponse {
@@ -137,8 +137,8 @@ message RegisterUserResponse {
 }
 
 message RegisterUsersResponse {
-    bool allUseresRegistered = 1;
-    repeated UserRepresentation failedUsers = 2;
+    bool all_useres_registered = 1;
+    repeated UserRepresentation failed_users = 2;
 }
 
 
@@ -154,8 +154,8 @@ message FindUsersRequest {
     UserSearchMetadata user = 3;
     int32 offset = 4;
     int32 limit = 5;
-    int64 tenantId = 1;
-    string accessToken = 2;
+    int64 tenant_id = 1;
+    string access_token = 2;
     string client_id = 6;
     string client_sec = 7;
 
@@ -163,11 +163,11 @@ message FindUsersRequest {
 
 message UserSearchRequest {
     UserSearchMetadata user = 1;
-    int64 tenantId = 2;
-    string accessToken = 3;
+    int64 tenant_id = 2;
+    string access_token = 3;
     string client_id = 4;
     string client_sec = 5;
-    string performedBy = 6;
+    string performed_by = 6;
 }
 
 message FindUsersResponse {
@@ -177,10 +177,10 @@ message FindUsersResponse {
 message ResetUserPassword {
     string username = 1;
     string password = 2;
-    int64 tenantId = 3;
-    string accessToken = 4;
-    string clientId = 5;
-    string clientSec = 6;
+    int64 tenant_id = 3;
+    string access_token = 4;
+    string client_id = 5;
+    string client_sec = 6;
 }
 
 
@@ -207,8 +207,8 @@ message AddUserRolesRequest {
 }
 
 message UpdateUserProfileRequest {
-    string accessToken = 1;
-    int64 tenantId = 2;
+    string access_token = 1;
+    int64 tenant_id = 2;
     UserRepresentation user = 3;
 
 }
@@ -218,21 +218,21 @@ message AddUserResponse {
 }
 
 message GetOperationsMetadataRequest {
-    int64 traceId = 1;
+    int64 trace_id = 1;
 }
 
 message OperationMetadata {
     string event = 1;
     string status = 2;
-    string timeStamp = 3;
-    string performedBy = 4;
+    string time_stamp = 3;
+    string performed_by = 4;
 }
 message GetOperationsMetadataResponse {
     repeated OperationMetadata metadata = 1;
 }
 
 message DeleteTenantRequest {
-    int64 tenantId = 1;
+    int64 tenant_id = 1;
 }
 
 message AddRolesRequest {
@@ -252,8 +252,14 @@ message RoleRepresentation {
     string name = 1;
     string description = 2;
     bool composite = 3;
+    string id = 4;
+}
 
-
+message DeleteRoleRequest {
+    bool client_level = 1;
+    int64 tenant_id = 2;
+    string client_id = 3;
+    RoleRepresentation role = 4;
 }
 
 message AllRoles {
@@ -410,6 +416,7 @@ service IamAdminService {
     rpc addRolesToTenant (AddRolesRequest) returns (AllRoles);
     rpc addProtocolMapper (AddProtocolMapperRequest) returns (OperationStatus);
     rpc getRolesOfTenant (GetRolesRequest) returns (AllRoles);
+    rpc deleteRole (DeleteRoleRequest) returns (OperationStatus);
 
     rpc isUsernameAvailable (UserSearchRequest) returns (OperationStatus);
     rpc registerUser (RegisterUserRequest) returns (RegisterUserResponse);
diff --git a/custos-core-services/iam-admin-core-service/src/main/resources/application.properties b/custos-core-services/iam-admin-core-service/src/main/resources/application.properties
index 8453f6922..9169a6a10 100644
--- a/custos-core-services/iam-admin-core-service/src/main/resources/application.properties
+++ b/custos-core-services/iam-admin-core-service/src/main/resources/application.properties
@@ -28,7 +28,7 @@ management.endpoints.web.exposure.include=*
 management.endpoint.metrics.enabled=true
 
 
-spring.datasource.url = jdbc:mysql://mysql.custos.svc.cluster.local:3306/core_iam?useSSL=false&serverTimezone=UTC&useLegacyDatetimeCode=false
+spring.datasource.url = jdbc:mysql://mysql-primary.custos.svc.cluster.local:3306/core_iam?useSSL=false&serverTimezone=UTC&useLegacyDatetimeCode=false
 spring.datasource.username = root
 spring.datasource.password = root
 
diff --git a/custos-core-services/iam-admin-core-service/src/main/resources/keycloak-client-truststore.pkcs12 b/custos-core-services/iam-admin-core-service/src/main/resources/keycloak-client-truststore.pkcs12
index 9d74713dc..84018cd25 100644
Binary files a/custos-core-services/iam-admin-core-service/src/main/resources/keycloak-client-truststore.pkcs12 and b/custos-core-services/iam-admin-core-service/src/main/resources/keycloak-client-truststore.pkcs12 differ
diff --git a/custos-core-services/identity-core-service/pom.xml b/custos-core-services/identity-core-service/pom.xml
index 0d9c7ee52..16f907e1c 100644
--- a/custos-core-services/identity-core-service/pom.xml
+++ b/custos-core-services/identity-core-service/pom.xml
@@ -103,6 +103,7 @@
             <groupId>javax.persistence</groupId>
             <artifactId>persistence-api</artifactId>
         </dependency>
+
     </dependencies>
 
 
@@ -122,6 +123,13 @@
                     <skip>false</skip>
                 </configuration>
             </plugin>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-antrun-plugin</artifactId>
+                <configuration>
+                    <skip>false</skip>
+                </configuration>
+            </plugin>
         </plugins>
     </build>
 
diff --git a/custos-core-services/identity-core-service/src/main/helm/templates/deployment.yaml b/custos-core-services/identity-core-service/src/main/helm/templates/deployment.yaml
index 31e54a6fc..74401f2c4 100644
--- a/custos-core-services/identity-core-service/src/main/helm/templates/deployment.yaml
+++ b/custos-core-services/identity-core-service/src/main/helm/templates/deployment.yaml
@@ -6,9 +6,10 @@ metadata:
 {{ include "helm.labels" . | indent 4 }}
 spec:
   replicas: {{ .Values.replicaCount }}
-  rollingUpdate:
-    maxSurge: {{ .Values.rollingUpdate.maxSurge }}
-    maxUnavailable: {{ .Values.rollingUpdate.maxUnavailable }}
+  strategy:
+    rollingUpdate:
+      maxSurge: {{ .Values.rollingUpdate.maxSurge }}
+      maxUnavailable: {{ .Values.rollingUpdate.maxUnavailable }}
   selector:
     matchLabels:
       app.kubernetes.io/name: {{ include "helm.name" . }}
@@ -45,9 +46,9 @@ spec:
             httpGet:
               path: /actuator/health
               port: 8080
-              initialDelaySeconds: {{ .Values.readinessProbe.initialDelaySeconds }}
-              periodSeconds: {{ .Values.readinessProbe.periodSeconds }}
-              successThreshold: {{ .Values.readinessProbe.successThreshold }}
+            initialDelaySeconds: {{ .Values.readinessProbe.initialDelaySeconds }}
+            periodSeconds: {{ .Values.readinessProbe.periodSeconds }}
+            successThreshold: {{ .Values.readinessProbe.successThreshold }}
           resources:
             {{- toYaml .Values.resources | nindent 12 }}
       {{- with .Values.nodeSelector }}
diff --git a/custos-core-services/identity-core-service/src/main/java/org/apache/custos/identity/service/IdentityService.java b/custos-core-services/identity-core-service/src/main/java/org/apache/custos/identity/service/IdentityService.java
index 3269182da..78df527e4 100644
--- a/custos-core-services/identity-core-service/src/main/java/org/apache/custos/identity/service/IdentityService.java
+++ b/custos-core-services/identity-core-service/src/main/java/org/apache/custos/identity/service/IdentityService.java
@@ -137,8 +137,8 @@ public void getUser(AuthToken request,
     }
 
     @Override
-    public void isAuthenticate(AuthToken request,
-                               StreamObserver<IsAuthenticateResponse> responseObserver) {
+    public void isAuthenticated(AuthToken request,
+                               StreamObserver<IsAuthenticatedResponse> responseObserver) {
         String username = null;
         String tenantId = null;
 
@@ -149,8 +149,9 @@ public void isAuthenticate(AuthToken request,
                 tenantId = claim.getValue();
             }
         }
-        LOGGER.debug("Authentication status checking for  " + username
-        );
+        LOGGER.debug("Authentication status checking for  " + username );
+        LOGGER.info("Authentication status checking for  " + username + " token "+ request.getAccessToken());
+
         String accessToken = request.getAccessToken();
 
 
@@ -193,7 +194,7 @@ public void isAuthenticate(AuthToken request,
             } else {
                 LOGGER.debug("User" + username + "in gateway" + tenantId + "is not authenticated");
             }
-            IsAuthenticateResponse isAuthenticateResponse = IsAuthenticateResponse
+            IsAuthenticatedResponse isAuthenticateResponse = IsAuthenticatedResponse
                     .newBuilder()
                     .setAuthenticated(isAuthenticated)
                     .build();
@@ -201,7 +202,7 @@ public void isAuthenticate(AuthToken request,
             responseObserver.onCompleted();
 
         } catch (Exception ex) {
-            String msg = "Error occurred while checking authentication for  user " + username + " " + ex.getMessage();
+            String msg = "Error occurred while validating authentication status of  user " + username + " " + ex.getMessage();
             LOGGER.error(msg);
             responseObserver.onError(Status.UNAUTHENTICATED.withDescription(msg).asRuntimeException());
         }
diff --git a/custos-core-services/identity-core-service/src/main/java/org/apache/custos/identity/validator/InputValidator.java b/custos-core-services/identity-core-service/src/main/java/org/apache/custos/identity/validator/InputValidator.java
index 11b355e8d..840f5c909 100644
--- a/custos-core-services/identity-core-service/src/main/java/org/apache/custos/identity/validator/InputValidator.java
+++ b/custos-core-services/identity-core-service/src/main/java/org/apache/custos/identity/validator/InputValidator.java
@@ -48,7 +48,7 @@ public void validate(String methodName, Object obj) {
             case "authenticate":
                 validateAuthenticate(obj);
                 break;
-            case "isAuthenticate":
+            case "isAuthenticated":
             case "getUser":
                 validateAuthzToken(obj);
                 break;
diff --git a/custos-core-services/identity-core-service/src/main/proto/IdentityService.proto b/custos-core-services/identity-core-service/src/main/proto/IdentityService.proto
index c6108d9ef..da949961d 100644
--- a/custos-core-services/identity-core-service/src/main/proto/IdentityService.proto
+++ b/custos-core-services/identity-core-service/src/main/proto/IdentityService.proto
@@ -38,10 +38,10 @@ message Claim {
 
 message User {
     string sub = 1;
-    string fullName = 2;
-    string firstName = 3;
-    string lastName = 4;
-    string emailAddress = 5;
+    string full_name = 2;
+    string first_name = 3;
+    string last_name = 4;
+    string email_address = 5;
     string username = 6;
 }
 
@@ -72,29 +72,29 @@ message TokenResponse {
 
 
 message AuthenticationRequest {
-    string clientId = 1;
-    string clientSecret = 2;
-    int64 tenantId = 3;
+    string client_id = 1;
+    string client_secret = 2;
+    int64 tenant_id = 3;
     string username = 4;
     string password = 5;
 }
 
-message IsAuthenticateResponse {
+message IsAuthenticatedResponse {
     bool authenticated = 1;
 }
 
 message GetUserManagementSATokenRequest {
-    string clientId = 1;
-    string clientSecret = 2;
-    int64 tenantId = 3;
+    string client_id = 1;
+    string client_secret = 2;
+    int64 tenant_id = 3;
 }
 
 message GetAuthorizationEndpointRequest {
-    int64 tenantId = 1;
+    int64 tenant_id = 1;
 }
 
 message AuthorizationResponse {
-    string authorizationEndpoint = 2;
+    string authorization_endpoint = 2;
 }
 
 message GetOIDCConfiguration {
@@ -122,7 +122,7 @@ message OperationStatus {
 
 service IdentityService {
     rpc authenticate (AuthenticationRequest) returns (AuthToken);
-    rpc isAuthenticate (AuthToken) returns (IsAuthenticateResponse);
+    rpc isAuthenticated (AuthToken) returns (IsAuthenticatedResponse);
     rpc getUser (AuthToken) returns (User);
     rpc getUserManagementServiceAccountAccessToken (GetUserManagementSATokenRequest) returns (AuthToken);
     rpc getToken (GetTokenRequest) returns (google.protobuf.Struct);
diff --git a/custos-core-services/identity-core-service/src/main/resources/application.properties b/custos-core-services/identity-core-service/src/main/resources/application.properties
index 27e8f3685..1893be2bc 100644
--- a/custos-core-services/identity-core-service/src/main/resources/application.properties
+++ b/custos-core-services/identity-core-service/src/main/resources/application.properties
@@ -28,7 +28,7 @@ management.endpoints.web.exposure.include=*
 management.endpoint.metrics.enabled=true
 
 
-spring.datasource.url = jdbc:mysql://mysql.custos.svc.cluster.local:3306/core_identity?useSSL=false&serverTimezone=UTC&useLegacyDatetimeCode=false
+spring.datasource.url = jdbc:mysql://mysql-primary.custos.svc.cluster.local:3306/core_identity?useSSL=false&serverTimezone=UTC&useLegacyDatetimeCode=false
 spring.datasource.username = root
 spring.datasource.password = root
 
diff --git a/custos-core-services/identity-core-service/src/main/resources/keycloak-client-truststore.pkcs12 b/custos-core-services/identity-core-service/src/main/resources/keycloak-client-truststore.pkcs12
index 9d74713dc..84018cd25 100644
Binary files a/custos-core-services/identity-core-service/src/main/resources/keycloak-client-truststore.pkcs12 and b/custos-core-services/identity-core-service/src/main/resources/keycloak-client-truststore.pkcs12 differ
diff --git a/custos-core-services/resource-secret-core-service/pom.xml b/custos-core-services/resource-secret-core-service/pom.xml
index 2d7ccaf5a..2380ec6b2 100644
--- a/custos-core-services/resource-secret-core-service/pom.xml
+++ b/custos-core-services/resource-secret-core-service/pom.xml
@@ -98,6 +98,11 @@
             <groupId>commons-io</groupId>
             <artifactId>commons-io</artifactId>
         </dependency>
+        <dependency>
+            <groupId>org.json</groupId>
+            <artifactId>json</artifactId>
+        </dependency>
+
 
     </dependencies>
 
@@ -118,6 +123,13 @@
                     <skip>false</skip>
                 </configuration>
             </plugin>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-antrun-plugin</artifactId>
+                <configuration>
+                    <skip>false</skip>
+                </configuration>
+            </plugin>
         </plugins>
     </build>
 
diff --git a/custos-core-services/resource-secret-core-service/src/main/helm/templates/deployment.yaml b/custos-core-services/resource-secret-core-service/src/main/helm/templates/deployment.yaml
index 31e54a6fc..74401f2c4 100644
--- a/custos-core-services/resource-secret-core-service/src/main/helm/templates/deployment.yaml
+++ b/custos-core-services/resource-secret-core-service/src/main/helm/templates/deployment.yaml
@@ -6,9 +6,10 @@ metadata:
 {{ include "helm.labels" . | indent 4 }}
 spec:
   replicas: {{ .Values.replicaCount }}
-  rollingUpdate:
-    maxSurge: {{ .Values.rollingUpdate.maxSurge }}
-    maxUnavailable: {{ .Values.rollingUpdate.maxUnavailable }}
+  strategy:
+    rollingUpdate:
+      maxSurge: {{ .Values.rollingUpdate.maxSurge }}
+      maxUnavailable: {{ .Values.rollingUpdate.maxUnavailable }}
   selector:
     matchLabels:
       app.kubernetes.io/name: {{ include "helm.name" . }}
@@ -45,9 +46,9 @@ spec:
             httpGet:
               path: /actuator/health
               port: 8080
-              initialDelaySeconds: {{ .Values.readinessProbe.initialDelaySeconds }}
-              periodSeconds: {{ .Values.readinessProbe.periodSeconds }}
-              successThreshold: {{ .Values.readinessProbe.successThreshold }}
+            initialDelaySeconds: {{ .Values.readinessProbe.initialDelaySeconds }}
+            periodSeconds: {{ .Values.readinessProbe.periodSeconds }}
+            successThreshold: {{ .Values.readinessProbe.successThreshold }}
           resources:
             {{- toYaml .Values.resources | nindent 12 }}
       {{- with .Values.nodeSelector }}
diff --git a/custos-core-services/resource-secret-core-service/src/main/java/org/apache/custos/resource/secret/exceptions/CredentialStoreException.java b/custos-core-services/resource-secret-core-service/src/main/java/org/apache/custos/resource/secret/exceptions/CredentialStoreException.java
index 645cf1540..99fb074e7 100644
--- a/custos-core-services/resource-secret-core-service/src/main/java/org/apache/custos/resource/secret/exceptions/CredentialStoreException.java
+++ b/custos-core-services/resource-secret-core-service/src/main/java/org/apache/custos/resource/secret/exceptions/CredentialStoreException.java
@@ -21,5 +21,6 @@
 
 public class CredentialStoreException extends RuntimeException {
     public CredentialStoreException(String s, Exception exception) {
+        super(s,exception);
     }
 }
diff --git a/custos-core-services/resource-secret-core-service/src/main/java/org/apache/custos/resource/secret/manager/CredentialGeneratorFactory.java b/custos-core-services/resource-secret-core-service/src/main/java/org/apache/custos/resource/secret/manager/CredentialGeneratorFactory.java
index 5d13bee1f..16967ee04 100644
--- a/custos-core-services/resource-secret-core-service/src/main/java/org/apache/custos/resource/secret/manager/CredentialGeneratorFactory.java
+++ b/custos-core-services/resource-secret-core-service/src/main/java/org/apache/custos/resource/secret/manager/CredentialGeneratorFactory.java
@@ -20,13 +20,14 @@
 package org.apache.custos.resource.secret.manager;
 
 import com.google.protobuf.GeneratedMessageV3;
-import org.apache.custos.resource.secret.service.CertificateCredential;
-import org.apache.custos.resource.secret.service.PasswordCredential;
-import org.apache.custos.resource.secret.service.SSHCredential;
+import org.apache.custos.resource.secret.service.*;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 import org.springframework.stereotype.Component;
 
+import java.util.ArrayList;
+import java.util.List;
+
 /**
  * This class is responsible for generate secrets
  */
@@ -44,10 +45,15 @@ public Credential getCredential(GeneratedMessageV3 message) throws Exception {
             return new org.apache.custos.resource.secret.manager.adaptor.outbound.CertificateCredential(message);
         } else if (message instanceof PasswordCredential) {
             return new org.apache.custos.resource.secret.manager.adaptor.outbound.PasswordCredential(message);
+        } else if (message instanceof  KVCredential){
+            return new org.apache.custos.resource.secret.manager.adaptor.outbound.KVCredential(message);
+        }else if (message instanceof CredentialMap){
+            return new org.apache.custos.resource.secret.manager.adaptor.outbound.CredentialMap(message);
         }
 
         return null;
     }
 
 
+
 }
diff --git a/custos-core-services/resource-secret-core-service/src/main/java/org/apache/custos/resource/secret/manager/adaptor/inbound/CredentialReader.java b/custos-core-services/resource-secret-core-service/src/main/java/org/apache/custos/resource/secret/manager/adaptor/inbound/CredentialReader.java
index f0eba2c91..53335bb40 100644
--- a/custos-core-services/resource-secret-core-service/src/main/java/org/apache/custos/resource/secret/manager/adaptor/inbound/CredentialReader.java
+++ b/custos-core-services/resource-secret-core-service/src/main/java/org/apache/custos/resource/secret/manager/adaptor/inbound/CredentialReader.java
@@ -19,14 +19,16 @@
 
 package org.apache.custos.resource.secret.manager.adaptor.inbound;
 
-import org.apache.custos.resource.secret.service.*;
-import org.apache.custos.resource.secret.utils.Constants;
+import com.fasterxml.jackson.core.JsonProcessingException;
 import org.apache.custos.resource.secret.manager.adaptor.outbound.CredentialWriter;
 import org.apache.custos.resource.secret.persistance.local.model.Secret;
 import org.apache.custos.resource.secret.persistance.local.repository.SecretRepository;
 import org.apache.custos.resource.secret.persistance.vault.Certificate;
+import org.apache.custos.resource.secret.persistance.vault.KVSecret;
 import org.apache.custos.resource.secret.persistance.vault.PasswordSecret;
 import org.apache.custos.resource.secret.persistance.vault.SSHCredentialSecrets;
+import org.apache.custos.resource.secret.service.*;
+import org.apache.custos.resource.secret.utils.Constants;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 import org.springframework.beans.factory.annotation.Autowired;
@@ -36,6 +38,7 @@
 
 import java.util.ArrayList;
 import java.util.List;
+import java.util.Map;
 import java.util.Optional;
 
 @Component
@@ -51,6 +54,7 @@ public class CredentialReader {
     private VaultTemplate vaultTemplate;
 
 
+
     /**
      * get SSH credentials
      *
@@ -58,38 +62,49 @@ public class CredentialReader {
      * @param token
      * @return
      */
-    public SSHCredential getSSHCredential(long tenantId, String token) {
-
-        Optional<Secret> secret = repository.findById(token);
+    public Optional<SSHCredential> getSSHCredential(long tenantId, String token) {
 
+        Secret secret = null;
 
-        if (secret.isEmpty()) {
-            return null;
+        if (token != null && !token.trim().equals("")) {
+            Optional<Secret> exSecret = repository.findById(token);
+            if (exSecret.isPresent()) {
+                secret = exSecret.get();
+            }
+        }
+        if (secret == null) {
+            List<Secret> secrets = repository.findAllByExternalIdAndTenantId(token, tenantId);
+            if (secrets != null && !secrets.isEmpty()) {
+                secret = secrets.get(0);
+            }
         }
 
-        Secret exSec = secret.get();
-
-        String vaultPath = Constants.VAULT_RESOURCE_SECRETS_PATH + tenantId + "/" + exSec.getOwnerId() +
-                "/" + Constants.SSH_CREDENTIALS + "/" + token;
+        if (secret == null) {
+            return Optional.empty();
+        }
 
+        String vaultPath = Constants.VAULT_RESOURCE_SECRETS_PATH + tenantId + "/" + secret.getOwnerId() +
+                "/" + Constants.SSH_CREDENTIALS + "/" + secret.getId();
 
         VaultResponseSupport<SSHCredentialSecrets> response = vaultTemplate.read(vaultPath, SSHCredentialSecrets.class);
 
         if (response == null || response.getData() == null && response.getData().getPrivateKey() == null) {
-            repository.delete(exSec);
-            return null;
+            repository.delete(secret);
+            return Optional.empty();
         }
 
         SSHCredentialSecrets sshCredentialSecrets = response.getData();
 
         SecretMetadata metadata = SecretMetadata.newBuilder()
-                .setOwnerId(exSec.getOwnerId())
+                .setOwnerId(secret.getOwnerId())
                 .setTenantId(tenantId)
-                .setPersistedTime(exSec.getCreatedAt().getTime())
-                .setDescription(exSec.getDiscription())
+                .setPersistedTime(secret.getCreatedAt().getTime())
+                .setDescription(secret.getDiscription())
                 .setResourceType(ResourceType.VAULT_CREDENTIAL)
                 .setSource(ResourceSource.EXTERNAL)
-                .setToken(token)
+                .setToken(
+                        (secret.getExternalId() != null &&
+                                !secret.getExternalId().trim().equals("")) ? secret.getExternalId() : secret.getId())
                 .build();
 
         SSHCredential credential = SSHCredential.newBuilder()
@@ -99,7 +114,7 @@ public SSHCredential getSSHCredential(long tenantId, String token) {
                 .setMetadata(metadata)
                 .build();
 
-        return credential;
+        return Optional.of(credential);
 
     }
 
@@ -111,46 +126,61 @@ public SSHCredential getSSHCredential(long tenantId, String token) {
      * @param token
      * @return
      */
-    public org.apache.custos.resource.secret.service.PasswordCredential getPasswordCredential(long tenantId, String token) {
-        Optional<Secret> secret = repository.findById(token);
-
-
-        if (secret.isEmpty()) {
-            return null;
+    public Optional<org.apache.custos.resource.secret.service.PasswordCredential> getPasswordCredential(long tenantId,
+                                                                                                        String token) {
+        Secret secret = null;
+
+        if (token != null && !token.trim().equals("")) {
+            Optional<Secret> exSecret = repository.findById(token);
+            if (exSecret.isPresent()) {
+                secret = exSecret.get();
+            }
+        }
+        if (secret == null) {
+            List<Secret> secrets = repository.findAllByExternalIdAndTenantId(token, tenantId);
+            if (secrets != null && !secrets.isEmpty()) {
+                secret = secrets.get(0);
+            }
         }
 
-        Secret exSec = secret.get();
+        if (secret == null) {
+            return Optional.empty();
+        }
 
-        String vaultPath = Constants.VAULT_RESOURCE_SECRETS_PATH + tenantId + "/" + exSec.getOwnerId() +
-                "/" + Constants.PASSWORD + "/" + token;
+        String vaultPath = Constants.VAULT_RESOURCE_SECRETS_PATH + tenantId + "/" + secret.getOwnerId() +
+                "/" + Constants.PASSWORD + "/" + secret.getId();
 
 
         VaultResponseSupport<PasswordSecret> response = vaultTemplate.read(vaultPath, PasswordSecret.class);
 
         if (response == null || response.getData() == null && response.getData().getPassword() == null) {
-            repository.delete(exSec);
-            return null;
+            repository.delete(secret);
+            return Optional.empty();
         }
 
         PasswordSecret passwordSecret = response.getData();
 
         SecretMetadata metadata = SecretMetadata.newBuilder()
-                .setOwnerId(exSec.getOwnerId())
+                .setOwnerId(secret.getOwnerId())
                 .setTenantId(tenantId)
-                .setPersistedTime(exSec.getCreatedAt().getTime())
-                .setDescription(exSec.getDiscription())
+                .setPersistedTime(secret.getCreatedAt().getTime())
+                .setDescription(secret.getDiscription())
                 .setResourceType(ResourceType.VAULT_CREDENTIAL)
                 .setSource(ResourceSource.EXTERNAL)
-                .setToken(token)
+                .setType(ResourceSecretType.PASSWORD)
+                .setToken(
+                        (secret.getExternalId() != null ||
+                                !secret.getExternalId().trim().equals("")) ? secret.getExternalId() : secret.getId())
                 .build();
 
         org.apache.custos.resource.secret.service.PasswordCredential credential =
                 org.apache.custos.resource.secret.service.PasswordCredential.newBuilder()
                         .setPassword(passwordSecret.getPassword())
+                        .setUserId(passwordSecret.getUserId() != null? passwordSecret.getUserId() : "")
                         .setMetadata(metadata)
                         .build();
 
-        return credential;
+        return Optional.of(credential);
 
 
     }
@@ -162,35 +192,50 @@ public org.apache.custos.resource.secret.service.PasswordCredential getPasswordC
      * @param token
      * @return
      */
-    public CertificateCredential getCertificateCredential(long tenantId, String token) {
-        Optional<Secret> secret = repository.findById(token);
+    public Optional<CertificateCredential> getCertificateCredential(long tenantId, String token) {
+        Secret secret = null;
+
+        if (token != null && !token.trim().equals("")) {
+            Optional<Secret> exSecret = repository.findById(token);
+            if (exSecret.isPresent()) {
+                secret = exSecret.get();
+            }
+        }
+        if (secret == null) {
+            List<Secret> secrets = repository.findAllByExternalIdAndTenantId(token, tenantId);
+            if (secrets != null && !secrets.isEmpty()) {
+                secret = secrets.get(0);
+            }
+        }
 
-        if (secret.isEmpty()) {
-            return null;
+        if (secret == null) {
+            return Optional.empty();
         }
 
-        Secret exSec = secret.get();
 
-        String vaultPath = Constants.VAULT_RESOURCE_SECRETS_PATH + tenantId + "/" + exSec.getOwnerId() +
-                "/" + Constants.PASSWORD + "/" + token;
+        String vaultPath = Constants.VAULT_RESOURCE_SECRETS_PATH + tenantId + "/" + secret.getOwnerId() +
+                "/" + Constants.PASSWORD + "/" + secret.getId();
 
         VaultResponseSupport<Certificate> response = vaultTemplate.read(vaultPath, Certificate.class);
 
         if (response == null || response.getData() == null && response.getData().getCertificate() == null) {
-            repository.delete(exSec);
-            return null;
+            repository.delete(secret);
+            return Optional.empty();
         }
 
         Certificate certificate = response.getData();
 
         SecretMetadata metadata = SecretMetadata.newBuilder()
-                .setOwnerId(exSec.getOwnerId())
+                .setOwnerId(secret.getOwnerId())
                 .setTenantId(tenantId)
-                .setPersistedTime(exSec.getCreatedAt().getTime())
-                .setDescription(exSec.getDiscription())
+                .setPersistedTime(secret.getCreatedAt().getTime())
+                .setDescription(secret.getDiscription())
                 .setResourceType(ResourceType.VAULT_CREDENTIAL)
                 .setSource(ResourceSource.EXTERNAL)
-                .setToken(token)
+                .setType(ResourceSecretType.X509_CERTIFICATE)
+                .setToken(
+                        (secret.getExternalId() != null &&
+                                !secret.getExternalId().trim().equals("")) ? secret.getExternalId() : secret.getId())
                 .build();
 
         CertificateCredential certificateCredential = CertificateCredential.newBuilder()
@@ -202,7 +247,7 @@ public CertificateCredential getCertificateCredential(long tenantId, String toke
                 .setMetadata(metadata)
                 .build();
 
-        return certificateCredential;
+        return Optional.of(certificateCredential);
 
     }
 
@@ -213,18 +258,31 @@ public CertificateCredential getCertificateCredential(long tenantId, String toke
      * @param token
      * @return
      */
-    public SecretMetadata getCredentialSummary(long tenantId, String token) {
+    public Optional<SecretMetadata> getCredentialSummary(long tenantId, String token) {
 
-        Optional<Secret> exSec = repository.findById(token);
+        Secret secret = null;
 
-        if (exSec.isEmpty()) {
-            return null;
+        if (token != null && !token.trim().equals("")) {
+            Optional<Secret> exSecret = repository.findById(token);
+            if (exSecret.isPresent()) {
+                secret = exSecret.get();
+            }
+        }
+        if (secret == null) {
+            List<Secret> secrets = repository.findAllByExternalIdAndTenantId(token, tenantId);
+            if (secrets != null && !secrets.isEmpty()) {
+                secret = secrets.get(0);
+            }
         }
 
-        Secret secret = exSec.get();
+        if (secret == null) {
+            return Optional.empty();
+        }
 
-        return SecretMetadata.newBuilder()
-                .setToken(token)
+        return Optional.of(SecretMetadata.newBuilder()
+                .setToken(
+                        (secret.getExternalId() != null &&
+                                !secret.getExternalId().trim().equals("")) ? secret.getExternalId() : secret.getId())
                 .setTenantId(tenantId)
                 .setDescription(secret.getDiscription())
                 .setPersistedTime(secret.getCreatedAt().getTime())
@@ -232,7 +290,7 @@ public SecretMetadata getCredentialSummary(long tenantId, String token) {
                 .setResourceType(ResourceType.VAULT_CREDENTIAL)
                 .setSource(ResourceSource.EXTERNAL)
                 .setOwnerId(secret.getOwnerId())
-                .build();
+                .build());
 
     }
 
@@ -244,16 +302,21 @@ public SecretMetadata getCredentialSummary(long tenantId, String token) {
      * @return
      */
     public List<SecretMetadata> getAllCredentialSummaries(long tenantId, List<String> tokens) {
-
-        List<Secret> secrets = repository.findAllById(tokens);
         List<SecretMetadata> metadata = new ArrayList<>();
+        if (tokens == null || tokens.isEmpty()) {
+            return metadata;
+        }
+        List<Secret> secrets = repository.getAllSecretsByIdOrExternalId(tenantId, tokens, tokens);
+
 
         if (secrets != null && !secrets.isEmpty()) {
 
 
             secrets.forEach(secret -> {
                 metadata.add(SecretMetadata.newBuilder()
-                        .setToken(secret.getId())
+                        .setToken(
+                                (secret.getExternalId() != null &&
+                                        !secret.getExternalId().trim().equals("")) ? secret.getExternalId() : secret.getId())
                         .setTenantId(tenantId)
                         .setDescription(secret.getDiscription())
                         .setPersistedTime(secret.getCreatedAt().getTime())
@@ -272,4 +335,131 @@ public List<SecretMetadata> getAllCredentialSummaries(long tenantId, List<String
     }
 
 
+    public Optional<KVCredential> getKVSecretByToken(String token, long tenantId, String ownerId) {
+        Optional<Secret> secret = repository.findById(token);
+
+        if (secret.isEmpty()) {
+            return Optional.empty();
+        }
+
+        Secret exSec = secret.get();
+
+        if (!exSec.getOwnerId().equals(ownerId)) {
+            return Optional.empty();
+        }
+
+        String vaultPath = Constants.VAULT_RESOURCE_SECRETS_PATH + tenantId + "/" + ownerId +
+                "/" + Constants.KV_SECRET + "/" + token;
+
+        VaultResponseSupport<KVSecret> response = vaultTemplate.read(vaultPath, KVSecret.class);
+
+        KVSecret kvSecret = response.getData();
+        if (kvSecret == null || kvSecret.getValue() == null) {
+            repository.delete(exSec);
+            return Optional.empty();
+        }
+        SecretMetadata metadata = SecretMetadata.newBuilder()
+                .setToken(token)
+                .setTenantId(tenantId)
+                .setDescription(exSec.getDiscription())
+                .setPersistedTime(exSec.getCreatedAt().getTime())
+                .setType(ResourceSecretType.valueOf(exSec.getSecretType()))
+                .setResourceType(ResourceType.OTHER)
+                .setSource(ResourceSource.EXTERNAL)
+                .setOwnerId(exSec.getOwnerId())
+                .build();
+
+        KVCredential kvCredential = KVCredential.newBuilder()
+                .setKey(exSec.getExternalId())
+                .setToken(exSec.getId())
+                .setValue(kvSecret.getValue())
+                .setMetadata(metadata).build();
+
+        return Optional.of(kvCredential);
+    }
+
+    public Optional<KVCredential> getKVSecretByKey(String key, long tenantId, String ownerId) {
+
+        List<Secret> secrets = repository.findAllByExternalIdAndOwnerIdAndTenantId(key, ownerId, tenantId);
+
+        if (secrets != null && secrets.isEmpty()) {
+            return Optional.empty();
+        }
+        Secret exSec = secrets.get(0);
+
+        String vaultPath = Constants.VAULT_RESOURCE_SECRETS_PATH + tenantId + "/" + ownerId +
+                "/" + Constants.KV_SECRET + "/" + exSec.getId();
+
+        VaultResponseSupport<KVSecret> response = vaultTemplate.read(vaultPath, KVSecret.class);
+
+        KVSecret kvSecret = response.getData();
+        if (kvSecret == null || kvSecret.getValue() == null) {
+            repository.delete(exSec);
+            return Optional.empty();
+        }
+        SecretMetadata metadata = SecretMetadata.newBuilder()
+                .setToken(exSec.getId())
+                .setTenantId(tenantId)
+                .setDescription(exSec.getDiscription())
+                .setPersistedTime(exSec.getCreatedAt().getTime())
+                .setType(ResourceSecretType.valueOf(exSec.getSecretType()))
+                .setResourceType(ResourceType.OTHER)
+                .setSource(ResourceSource.EXTERNAL)
+                .setOwnerId(exSec.getOwnerId())
+                .build();
+
+        KVCredential kvCredential = KVCredential.newBuilder()
+                .setKey(exSec.getExternalId())
+                .setToken(exSec.getId())
+                .setValue(kvSecret.getValue())
+                .setMetadata(metadata).build();
+
+        return Optional.of(kvCredential);
+    }
+
+    public Optional<CredentialMap> getCredentialMapByToken(String token, long tenantId) throws JsonProcessingException {
+        Optional<Secret> secret = repository.findById(token);
+
+        if (secret.isEmpty()) {
+            return Optional.empty();
+        }
+
+        Secret exSec = secret.get();
+
+        String vaultPath = Constants.VAULT_RESOURCE_SECRETS_PATH + tenantId + "/" + exSec.getOwnerId() +
+                "/" + Constants.SECRET_MAP + "/" + token;
+
+        VaultResponseSupport<KVSecret> response = vaultTemplate.read(vaultPath, KVSecret.class);
+
+        KVSecret kvSecret = response.getData();
+        if (kvSecret == null || kvSecret.getValue() == null) {
+            repository.delete(exSec);
+            return Optional.empty();
+        }
+
+        Map<String, String> valueMap = org.apache.custos.resource.secret.manager.adaptor.outbound.CredentialMap.
+                getCredentialMapFromString(response.getData().getValue());
+
+
+        SecretMetadata metadata = SecretMetadata.newBuilder()
+                .setToken(token)
+                .setTenantId(tenantId)
+                .setDescription(exSec.getDiscription())
+                .setPersistedTime(exSec.getCreatedAt().getTime())
+                .setType(ResourceSecretType.valueOf(exSec.getSecretType()))
+                .setResourceType(ResourceType.OTHER)
+                .setSource(ResourceSource.EXTERNAL)
+                .setResourceType(ResourceType.valueOf(exSec.getType()))
+                .setOwnerId(exSec.getOwnerId())
+                .build();
+
+        CredentialMap kvCredential = CredentialMap.newBuilder()
+                .putAllCredentialMap(valueMap)
+                .setMetadata(metadata).build();
+
+        return Optional.of(kvCredential);
+    }
 }
+
+
+
diff --git a/custos-core-services/resource-secret-core-service/src/main/java/org/apache/custos/resource/secret/manager/adaptor/outbound/CertificateCredential.java b/custos-core-services/resource-secret-core-service/src/main/java/org/apache/custos/resource/secret/manager/adaptor/outbound/CertificateCredential.java
index d52d677d2..5407c9f90 100644
--- a/custos-core-services/resource-secret-core-service/src/main/java/org/apache/custos/resource/secret/manager/adaptor/outbound/CertificateCredential.java
+++ b/custos-core-services/resource-secret-core-service/src/main/java/org/apache/custos/resource/secret/manager/adaptor/outbound/CertificateCredential.java
@@ -45,6 +45,7 @@ public class CertificateCredential extends ResourceCredential {
     private String privateKey;
 
 
+
     public CertificateCredential(GeneratedMessageV3 message) throws CertificateException {
         super(message);
         if (message instanceof org.apache.custos.resource.secret.service.CertificateCredential) {
diff --git a/custos-core-services/resource-secret-core-service/src/main/java/org/apache/custos/resource/secret/manager/adaptor/outbound/CredentialMap.java b/custos-core-services/resource-secret-core-service/src/main/java/org/apache/custos/resource/secret/manager/adaptor/outbound/CredentialMap.java
new file mode 100644
index 000000000..79c422bc7
--- /dev/null
+++ b/custos-core-services/resource-secret-core-service/src/main/java/org/apache/custos/resource/secret/manager/adaptor/outbound/CredentialMap.java
@@ -0,0 +1,76 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing,
+ *  software distributed under the License is distributed on an
+ *  "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ *  KIND, either express or implied. See the License for the
+ *  specific language governing permissions and limitations
+ *  under the License.
+ */
+
+package org.apache.custos.resource.secret.manager.adaptor.outbound;
+
+import com.fasterxml.jackson.core.JsonProcessingException;
+import com.fasterxml.jackson.core.type.TypeReference;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import com.google.protobuf.GeneratedMessageV3;
+import org.json.JSONObject;
+
+import java.util.HashMap;
+import java.util.Map;
+
+public class CredentialMap extends ResourceCredential {
+
+    private Map<String, String> credentialMap;
+
+    private JSONObject json;
+
+    private String credentialString;
+
+    public CredentialMap(GeneratedMessageV3 message) {
+        super(message);
+        if (message instanceof org.apache.custos.resource.secret.service.CredentialMap) {
+            this.credentialMap = ((org.apache.custos.resource.secret.service.CredentialMap) message).getCredentialMapMap();
+            if (this.credentialMap != null &&  !this.credentialMap.isEmpty()) {
+                this.json = new JSONObject(this.credentialMap);
+            }
+        }
+    }
+
+    public Map<String, String> getCredentialMap() {
+        return credentialMap;
+    }
+
+    public void setCredentialMap(Map<String, String> credentialMap) {
+        this.credentialMap = credentialMap;
+    }
+
+    public JSONObject getJson() {
+        return json;
+    }
+
+    public void setJson(JSONObject json) {
+        this.json = json;
+    }
+
+    public String getCredentialString() {
+        return this.json != null ? this.json.toString() : null;
+    }
+
+    public static Map<String, String> getCredentialMapFromString(String jsonString) throws JsonProcessingException {
+        Map<String, String> map = new HashMap<String, String>();
+        ObjectMapper mapper = new ObjectMapper();
+        return mapper.readValue(jsonString,
+                new TypeReference<HashMap<String, String>>() {
+                });
+    }
+}
diff --git a/custos-core-services/resource-secret-core-service/src/main/java/org/apache/custos/resource/secret/manager/adaptor/outbound/CredentialWriter.java b/custos-core-services/resource-secret-core-service/src/main/java/org/apache/custos/resource/secret/manager/adaptor/outbound/CredentialWriter.java
index edbb241f2..95f90658e 100644
--- a/custos-core-services/resource-secret-core-service/src/main/java/org/apache/custos/resource/secret/manager/adaptor/outbound/CredentialWriter.java
+++ b/custos-core-services/resource-secret-core-service/src/main/java/org/apache/custos/resource/secret/manager/adaptor/outbound/CredentialWriter.java
@@ -19,14 +19,15 @@
 
 package org.apache.custos.resource.secret.manager.adaptor.outbound;
 
-import org.apache.custos.resource.secret.utils.Constants;
 import org.apache.custos.resource.secret.exceptions.CredentialStoreException;
 import org.apache.custos.resource.secret.persistance.local.model.Secret;
 import org.apache.custos.resource.secret.persistance.local.repository.SecretRepository;
 import org.apache.custos.resource.secret.persistance.vault.Certificate;
+import org.apache.custos.resource.secret.persistance.vault.KVSecret;
 import org.apache.custos.resource.secret.persistance.vault.PasswordSecret;
 import org.apache.custos.resource.secret.persistance.vault.SSHCredentialSecrets;
 import org.apache.custos.resource.secret.service.ResourceSecretType;
+import org.apache.custos.resource.secret.utils.Constants;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 import org.springframework.beans.factory.annotation.Autowired;
@@ -34,6 +35,7 @@
 import org.springframework.vault.core.VaultTemplate;
 import org.springframework.vault.support.VaultResponseSupport;
 
+import java.util.List;
 import java.util.Optional;
 
 /**
@@ -63,13 +65,32 @@ public boolean saveSSHCredential(SSHCredential credential) {
         if (exSecret.isPresent()) {
             String msg = " Credential with token " + credential.getToken() + " already exist";
             LOGGER.error(msg);
-            throw new CredentialStoreException(msg, null);
+            throw new CredentialStoreException("Invalid token", null);
+        }
+
+        if (credential.getExternalId() != null && !credential.getExternalId().trim().equals("")) {
+
+            Optional<Secret> exToSec = repository.findById(credential.getExternalId());
+
+            if (exToSec.isPresent()) {
+                String msg = " Credential with token " + credential.getToken() + " already exist";
+                LOGGER.error(msg);
+                throw new CredentialStoreException("Invalid token", null);
+            }
+
+            List<Secret> secrets = repository.findAllByExternalIdAndTenantId(credential.getExternalId(),
+                    credential.getTenantId());
+            if (secrets != null && !secrets.isEmpty()) {
+                String msg = " Credential with externalId " + credential.getExternalId() + " already exist";
+                LOGGER.error(msg);
+                throw new CredentialStoreException("Invalid token", null);
+            }
+
         }
 
         String path = Constants.VAULT_RESOURCE_SECRETS_PATH + credential.getTenantId() + "/" + credential.getOwnerId()
                 + "/" + Constants.SSH_CREDENTIALS + "/" + credential.getToken();
 
-
         SSHCredentialSecrets sshCredentialSecrets = new SSHCredentialSecrets
                 (credential.getPrivateKey(), credential.getPublicKey(), credential.getPassPhrase());
         vaultTemplate.write(path, sshCredentialSecrets);
@@ -90,6 +111,8 @@ public boolean saveSSHCredential(SSHCredential credential) {
         secret.setOwnerType(credential.getResourceOwnerType().name());
         secret.setSecretType(ResourceSecretType.SSH.name());
         secret.setTenantId(credential.getTenantId());
+        secret.setExternalId(credential.getExternalId());
+        secret.setType(credential.getType());
         repository.save(secret);
         return true;
     }
@@ -106,14 +129,33 @@ public boolean savePasswordCredential(PasswordCredential credential) {
         if (exSecret.isPresent()) {
             String msg = " Credential with token " + credential.getToken() + " already exist";
             LOGGER.error(msg);
-            throw new CredentialStoreException(msg, null);
+            throw new CredentialStoreException("Invalid token", null);
+        }
+
+        if (credential.getExternalId() != null && !credential.getExternalId().trim().equals("")) {
+            Optional<Secret> exToSec = repository.findById(credential.getExternalId());
+
+            if (exToSec.isPresent()) {
+                String msg = " Credential with token " + credential.getToken() + " already exist";
+                LOGGER.error(msg);
+                throw new CredentialStoreException("Invalid token", null);
+            }
+
+            List<Secret> secrets = repository.findAllByExternalIdAndTenantId(credential.getExternalId(),
+                    credential.getTenantId());
+            if (secrets != null && !secrets.isEmpty()) {
+                String msg = " Credential with externalId " + credential.getExternalId() + " already exist";
+                LOGGER.error(msg);
+                throw new CredentialStoreException("Invalid token", null);
+            }
+
         }
 
         String path = Constants.VAULT_RESOURCE_SECRETS_PATH + credential.getTenantId() + "/" + credential.getOwnerId()
                 + "/" + Constants.PASSWORD + "/" + credential.getToken();
 
 
-        PasswordSecret passwordSecret = new PasswordSecret(credential.getPassword());
+        PasswordSecret passwordSecret = new PasswordSecret(credential.getPassword(), credential.getUserId());
         vaultTemplate.write(path, passwordSecret);
 
         VaultResponseSupport<PasswordSecret> response = vaultTemplate.read(path, PasswordSecret.class);
@@ -132,6 +174,8 @@ public boolean savePasswordCredential(PasswordCredential credential) {
         secret.setOwnerType(credential.getResourceOwnerType().name());
         secret.setSecretType(ResourceSecretType.PASSWORD.name());
         secret.setTenantId(credential.getTenantId());
+        secret.setExternalId(credential.getExternalId());
+        secret.setType(credential.getType());
         repository.save(secret);
         return true;
     }
@@ -148,9 +192,29 @@ public boolean saveCertificateCredential(CertificateCredential credential) {
         if (exSecret.isPresent()) {
             String msg = " Credential with token " + credential.getToken() + " already exist";
             LOGGER.error(msg);
-            throw new CredentialStoreException(msg, null);
+            throw new CredentialStoreException("Invalid token", null);
+        }
+
+        if (credential.getExternalId() != null && !credential.getExternalId().trim().equals("")) {
+            Optional<Secret> exToSec = repository.findById(credential.getExternalId());
+
+            if (exToSec.isPresent()) {
+                String msg = " Credential with token " + credential.getToken() + " already exist";
+                LOGGER.error(msg);
+                throw new CredentialStoreException("Invalid token", null);
+            }
+
+            List<Secret> secrets = repository.findAllByExternalIdAndTenantId(credential.getExternalId(),
+                    credential.getTenantId());
+            if (secrets != null && !secrets.isEmpty()) {
+                String msg = " Credential with externalId " + credential.getExternalId() + " already exist";
+                LOGGER.error(msg);
+                throw new CredentialStoreException("Invalid token", null);
+            }
+
         }
 
+
         String path = Constants.VAULT_RESOURCE_SECRETS_PATH + credential.getTenantId() + "/" + credential.getOwnerId() +
                 "/" + Constants.SSH_CREDENTIALS + "/" + credential.getToken();
 
@@ -179,6 +243,8 @@ public boolean saveCertificateCredential(CertificateCredential credential) {
         secret.setOwnerType(credential.getResourceOwnerType().name());
         secret.setSecretType(ResourceSecretType.X509_CERTIFICATE.name());
         secret.setTenantId(credential.getTenantId());
+        secret.setExternalId(credential.getExternalId());
+        secret.setType(credential.getType());
         repository.save(secret);
         return true;
     }
@@ -186,19 +252,26 @@ public boolean saveCertificateCredential(CertificateCredential credential) {
 
     /**
      * delete existing credential
+     *
      * @param tenantId
      * @param token
      * @return
      */
     public boolean deleteCredential(long tenantId, String token) {
 
+        Secret secret = null;
         Optional<Secret> exSec = repository.findById(token);
 
-        if (exSec.isEmpty()) {
-            return true;
+        if (exSec.isPresent()) {
+            secret = exSec.get();
         }
 
-        Secret secret = exSec.get();
+        if (exSec.isEmpty()) {
+            List<Secret> secrets = repository.findAllByExternalIdAndTenantId(token, tenantId);
+            if (secrets != null && !secrets.isEmpty()) {
+                secret = secrets.get(0);
+            }
+        }
 
         String type = null;
 
@@ -212,16 +285,247 @@ public boolean deleteCredential(long tenantId, String token) {
 
 
         String path = Constants.VAULT_RESOURCE_SECRETS_PATH + tenantId + "/" + secret.getOwnerId() +
-                "/" + type + "/" + token;
+                "/" + type + "/" + secret.getId();
+
+        vaultTemplate.delete(path);
+
+        repository.delete(secret);
+        return true;
+
+    }
+
+    public boolean saveKVCredential(KVCredential kvCredential) {
+        Optional<Secret> exSecret = repository.findById(kvCredential.getToken());
+
+        if (exSecret.isPresent()) {
+            String msg = " Credential with token " + kvCredential.getToken() + " already exist";
+            LOGGER.error(msg);
+            throw new CredentialStoreException("Invalid token", null);
+        }
+
+        List<Secret> secrets = repository.findAllByExternalIdAndOwnerIdAndTenantId(kvCredential.getKey(), kvCredential.getOwnerId(), kvCredential.getTenantId());
+
+        if (secrets != null && !secrets.isEmpty()) {
+            String msg = " Credential with key " + kvCredential.getKey() + " of user " + kvCredential.getOwnerId()
+                    + " in tenant " + kvCredential.getTenantId() + " is already exists, " +
+                    "please update or delete before setting it";
+            LOGGER.warn(msg);
+            throw new CredentialStoreException(msg, null);
+        }
+
+        String path = Constants.VAULT_RESOURCE_SECRETS_PATH + kvCredential.getTenantId() + "/" + kvCredential.getOwnerId() +
+                "/" + Constants.KV_SECRET + "/" + kvCredential.getToken();
+
+        KVSecret kvSecret = new KVSecret(kvCredential.getKey(), kvCredential.getValue());
+
+        vaultTemplate.write(path, kvSecret);
+
+        VaultResponseSupport<KVSecret> response = vaultTemplate.read(path, KVSecret.class);
+
+        if (response == null || response.getData() == null && response.getData().getKey() == null) {
+            String msg = " KV credential of tenant " + kvCredential.getTenantId() +
+                    " of user " + kvCredential.getOwnerId() + " is not saved in vault";
+            LOGGER.error(msg);
+            throw new CredentialStoreException(msg, null);
+        }
+
+        Secret secret = new Secret();
+        secret.setId(kvCredential.getToken());
+        secret.setDiscription(kvCredential.getDescription());
+        secret.setOwnerId(kvCredential.getOwnerId());
+        secret.setOwnerType(kvCredential.getResourceOwnerType().name());
+        secret.setSecretType(ResourceSecretType.KV.name());
+        secret.setTenantId(kvCredential.getTenantId());
+        secret.setExternalId(kvCredential.getKey());
+        secret.setType(kvCredential.getType());
+        repository.save(secret);
+        return true;
+
+    }
+
+    public boolean updateKVCredential(org.apache.custos.resource.secret.service.KVCredential kvCredential) {
+        Secret secret = null;
+
+        if (kvCredential.getToken() != null && !kvCredential.getToken().equals("")) {
+            Optional<Secret> exSecret = repository.findById(kvCredential.getToken());
+            if (!exSecret.isPresent() || (!exSecret.get().getOwnerId().equals(kvCredential.getMetadata().getOwnerId()) ||
+                    !exSecret.get().getExternalId().equals(kvCredential.getKey()))) {
+                String msg = " Cannot find record for token" + kvCredential.getToken()
+                        + " with given key " + kvCredential.getKey();
+                LOGGER.error(msg);
+                throw new CredentialStoreException(msg, null);
+            }
+            secret = exSecret.get();
+        } else {
+
+            List<Secret> secrets = repository.
+                    findAllByExternalIdAndOwnerIdAndTenantId(kvCredential.getKey(), kvCredential.getMetadata().getOwnerId(),
+                            kvCredential.getMetadata().getTenantId());
+
+            if (secrets == null && secrets.isEmpty()) {
+                String msg = " Cannot find record "
+                        + " with given key " + kvCredential.getKey();
+                LOGGER.error(msg);
+                throw new CredentialStoreException(msg, null);
+            }
+            secret = secrets.get(0);
+        }
+
+        String path = Constants.VAULT_RESOURCE_SECRETS_PATH + kvCredential.getMetadata().getTenantId() + "/" +
+                kvCredential.getMetadata().getOwnerId() +
+                "/" + Constants.KV_SECRET + "/" + secret.getId();
+
+        KVSecret kvSecret = new KVSecret(kvCredential.getKey(), kvCredential.getValue());
+
+        vaultTemplate.delete(path);
+        vaultTemplate.write(path, kvSecret);
+
+        VaultResponseSupport<KVSecret> response = vaultTemplate.read(path, KVSecret.class);
+
+        if (response == null || response.getData() == null && response.getData().getKey() == null) {
+            String msg = " KV credential of tenant " + kvCredential.getMetadata().getTenantId() +
+                    " of user " + kvCredential.getMetadata().getOwnerId() + " is not saved in vault";
+            LOGGER.error(msg);
+            throw new CredentialStoreException(msg, null);
+        }
+
+        secret.setDiscription(kvCredential.getMetadata().getDescription());
+        repository.save(secret);
+        return true;
+
+    }
+
+    public boolean deleteKVCredential(org.apache.custos.resource.secret.service.KVCredential kvCredential) {
+        Secret secret = null;
+        if (kvCredential.getToken() != null && !kvCredential.getToken().equals("")) {
+            Optional<Secret> exSecret = repository.findById(kvCredential.getToken());
+            if (!exSecret.isPresent() || (!exSecret.get().getOwnerId().equals(kvCredential.getMetadata().getOwnerId()) ||
+                    !exSecret.get().getExternalId().equals(kvCredential.getKey()))) {
+                String msg = " Cannot find record for token" + kvCredential.getToken()
+                        + " with given key " + kvCredential.getKey();
+                LOGGER.error(msg);
+                throw new CredentialStoreException(msg, null);
+            }
+            secret = exSecret.get();
+        } else {
+
+            List<Secret> secrets = repository.
+                    findAllByExternalIdAndOwnerIdAndTenantId(kvCredential.getKey(), kvCredential.getMetadata().getOwnerId(),
+                            kvCredential.getMetadata().getTenantId());
+
+            if (secrets == null && secrets.isEmpty()) {
+                String msg = " Cannot find record "
+                        + " with given key " + kvCredential.getKey();
+                LOGGER.error(msg);
+                throw new CredentialStoreException(msg, null);
+            }
+            secret = secrets.get(0);
+        }
+
+        String path = Constants.VAULT_RESOURCE_SECRETS_PATH + kvCredential.getMetadata().getTenantId() + "/"
+                + kvCredential.getMetadata().getOwnerId() +
+                "/" + Constants.KV_SECRET + "/" + secret.getId();
 
         vaultTemplate.delete(path);
 
         repository.delete(secret);
         return true;
+    }
+
+    public boolean saveCredentialMap(CredentialMap credentialMap) {
+        Optional<Secret> exSecret = repository.findById(credentialMap.getToken());
+
+        if (exSecret.isPresent()) {
+            String msg = " Credential with token " + credentialMap.getToken() + " already exist";
+            LOGGER.error(msg);
+            throw new CredentialStoreException("Invalid token", null);
+        }
+
+        String path = Constants.VAULT_RESOURCE_SECRETS_PATH + credentialMap.getTenantId() + "/" + credentialMap.getOwnerId() +
+                "/" + Constants.SECRET_MAP + "/" + credentialMap.getToken();
+
+        KVSecret kvSecret = new KVSecret(credentialMap.getToken(), credentialMap.getCredentialString());
+
+        vaultTemplate.write(path, kvSecret);
+
+        VaultResponseSupport<KVSecret> response = vaultTemplate.read(path, KVSecret.class);
+
+        if (response == null || response.getData() == null && response.getData().getKey() == null) {
+            String msg = "  credential Map of tenant " + credentialMap.getTenantId() +
+                    " of user " + credentialMap.getOwnerId() + " is not saved in vault";
+            LOGGER.error(msg);
+            throw new CredentialStoreException(msg, null);
+        }
+
+        Secret secret = new Secret();
+        secret.setId(credentialMap.getToken());
+        secret.setDiscription(credentialMap.getDescription());
+        secret.setOwnerId(credentialMap.getOwnerId());
+        secret.setOwnerType(credentialMap.getResourceOwnerType().name());
+        secret.setSecretType(ResourceSecretType.CREDENTIAL_MAP.name());
+        secret.setTenantId(credentialMap.getTenantId());
+        secret.setExternalId(credentialMap.getExternalId());
+        secret.setType(credentialMap.getType());
+        repository.save(secret);
+        return true;
+
+    }
+
+    public boolean updateCredentialMap(CredentialMap credentialMap) {
+
+        Optional<Secret> exSecret = repository.findById(credentialMap.getExternalId());
+        if (!exSecret.isPresent()) {
+            String msg = " Cannot find secret for token" + credentialMap.getToken();
+            LOGGER.error(msg);
+            throw new CredentialStoreException(msg, null);
+        }
+        Secret secret = exSecret.get();
+
+        String path = Constants.VAULT_RESOURCE_SECRETS_PATH + credentialMap.getTenantId() + "/" +
+                secret.getOwnerId() +
+                "/" + Constants.SECRET_MAP + "/" + secret.getId();
+
+        KVSecret kvSecret = new KVSecret(credentialMap.getExternalId(), credentialMap.getCredentialString());
+
+        VaultResponseSupport<KVSecret> responseEx = vaultTemplate.read(path, KVSecret.class);
+
+        vaultTemplate.delete(path);
+        vaultTemplate.write(path, kvSecret);
+
+        VaultResponseSupport<KVSecret> response = vaultTemplate.read(path, KVSecret.class);
+
+        if (response == null || response.getData() == null && response.getData().getKey() == null) {
+            // Writing back previouse data
+            vaultTemplate.write(path, responseEx.getData());
+
+            String msg = " CredentialMap  of tenant " + credentialMap.getTenantId() +
+                    " of user " + credentialMap.getOwnerId() + " is not saved in vault";
+            LOGGER.error(msg);
+            throw new CredentialStoreException(msg, null);
+        }
+        secret.setDiscription(credentialMap.getDescription());
+        repository.save(secret);
+        return true;
 
     }
 
+    public boolean deleteCredentialMap(CredentialMap credentialMap) {
+        Optional<Secret> exSecret = repository.findById(credentialMap.getExternalId());
+        if (!exSecret.isPresent()) {
+            String msg = " Cannot find secret for token" + credentialMap.getExternalId();
+            LOGGER.error(msg);
+            throw new CredentialStoreException(msg, null);
+        }
+        Secret secret = exSecret.get();
 
+        String path = Constants.VAULT_RESOURCE_SECRETS_PATH + credentialMap.getTenantId() + "/" +
+                secret.getOwnerId() +
+                "/" + Constants.SECRET_MAP + "/" + secret.getId();
+
+        vaultTemplate.delete(path);
+        repository.delete(secret);
+        return true;
+    }
 
 
 }
diff --git a/custos-core-services/resource-secret-core-service/src/main/java/org/apache/custos/resource/secret/manager/adaptor/outbound/KVCredential.java b/custos-core-services/resource-secret-core-service/src/main/java/org/apache/custos/resource/secret/manager/adaptor/outbound/KVCredential.java
new file mode 100644
index 000000000..aafa3f2e8
--- /dev/null
+++ b/custos-core-services/resource-secret-core-service/src/main/java/org/apache/custos/resource/secret/manager/adaptor/outbound/KVCredential.java
@@ -0,0 +1,52 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing,
+ *  software distributed under the License is distributed on an
+ *  "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ *  KIND, either express or implied. See the License for the
+ *  specific language governing permissions and limitations
+ *  under the License.
+ */
+
+package org.apache.custos.resource.secret.manager.adaptor.outbound;
+
+import com.google.protobuf.GeneratedMessageV3;
+
+
+public class KVCredential extends ResourceCredential {
+    private String key;
+    private String value;
+
+    public KVCredential(GeneratedMessageV3 message) {
+        super(message);
+        if (message instanceof org.apache.custos.resource.secret.service.KVCredential) {
+            this.key = ((org.apache.custos.resource.secret.service.KVCredential) message).getKey();
+            this.value = ((org.apache.custos.resource.secret.service.KVCredential) message).getValue();
+        }
+    }
+
+    public String getKey() {
+        return key;
+    }
+
+    public void setKey(String key) {
+        this.key = key;
+    }
+
+    public String getValue() {
+        return value;
+    }
+
+    public void setValue(String value) {
+        this.value = value;
+    }
+}
diff --git a/custos-core-services/resource-secret-core-service/src/main/java/org/apache/custos/resource/secret/manager/adaptor/outbound/PasswordCredential.java b/custos-core-services/resource-secret-core-service/src/main/java/org/apache/custos/resource/secret/manager/adaptor/outbound/PasswordCredential.java
index 6b7b03c1f..2cd4c6466 100644
--- a/custos-core-services/resource-secret-core-service/src/main/java/org/apache/custos/resource/secret/manager/adaptor/outbound/PasswordCredential.java
+++ b/custos-core-services/resource-secret-core-service/src/main/java/org/apache/custos/resource/secret/manager/adaptor/outbound/PasswordCredential.java
@@ -28,10 +28,14 @@ public class PasswordCredential extends ResourceCredential {
 
     private String password;
 
+    private String userId;
+
     public PasswordCredential(GeneratedMessageV3 message) {
         super(message);
         if (message instanceof org.apache.custos.resource.secret.service.PasswordCredential) {
           this.password =   ((org.apache.custos.resource.secret.service.PasswordCredential) message).getPassword();
+          this.userId = ((org.apache.custos.resource.secret.service.PasswordCredential) message).getUserId();
+
         }
     }
 
@@ -42,4 +46,12 @@ public String getPassword() {
     public void setPassword(String password) {
         this.password = password;
     }
+
+    public String getUserId() {
+        return userId;
+    }
+
+    public void setUserId(String userId) {
+        this.userId = userId;
+    }
 }
diff --git a/custos-core-services/resource-secret-core-service/src/main/java/org/apache/custos/resource/secret/manager/adaptor/outbound/ResourceCredential.java b/custos-core-services/resource-secret-core-service/src/main/java/org/apache/custos/resource/secret/manager/adaptor/outbound/ResourceCredential.java
index 27b6b10ad..5558f3453 100644
--- a/custos-core-services/resource-secret-core-service/src/main/java/org/apache/custos/resource/secret/manager/adaptor/outbound/ResourceCredential.java
+++ b/custos-core-services/resource-secret-core-service/src/main/java/org/apache/custos/resource/secret/manager/adaptor/outbound/ResourceCredential.java
@@ -40,6 +40,10 @@ public class ResourceCredential implements Credential {
 
     private long tenantId;
 
+    private String type;
+
+    private String externalId;
+
 
     public ResourceCredential(GeneratedMessageV3 message) {
 
@@ -47,24 +51,31 @@ public ResourceCredential(GeneratedMessageV3 message) {
 
         if (message instanceof SSHCredential) {
             SecretMetadata metadata = ((SSHCredential) message).getMetadata();
-            this.description = metadata.getDescription();
-            this.ownerId = metadata.getOwnerId();
-            this.tenantId = metadata.getTenantId();
+            parseMetadata(metadata);
             this.resourceOwnerType = ResourceOwnerType.TENANT;
+            this.externalId = metadata.getToken();
 
         } else if (message instanceof CertificateCredential) {
             SecretMetadata metadata = ((CertificateCredential) message).getMetadata();
-            this.description = metadata.getDescription();
-            this.ownerId = metadata.getOwnerId();
-            this.tenantId = metadata.getTenantId();
+            parseMetadata(metadata);
             this.resourceOwnerType = ResourceOwnerType.TENANT;
+            this.externalId = metadata.getToken();
 
         } else if (message instanceof PasswordCredential) {
             SecretMetadata metadata = ((PasswordCredential) message).getMetadata();
-            this.description = metadata.getDescription();
-            this.ownerId = metadata.getOwnerId();
-            this.tenantId = metadata.getTenantId();
+            parseMetadata(metadata);
             this.resourceOwnerType = ResourceOwnerType.TENANT;
+            this.externalId = metadata.getToken();
+        } else if (message instanceof org.apache.custos.resource.secret.service.KVCredential) {
+            SecretMetadata metadata = ((org.apache.custos.resource.secret.service.KVCredential) message).getMetadata();
+            parseMetadata(metadata);
+            this.resourceOwnerType = ResourceOwnerType.TENANT_USER;
+            this.externalId = ((org.apache.custos.resource.secret.service.KVCredential) message).getKey();
+        } else if (message instanceof org.apache.custos.resource.secret.service.CredentialMap) {
+            SecretMetadata metadata = ((org.apache.custos.resource.secret.service.CredentialMap) message).getMetadata();
+            parseMetadata(metadata);
+            this.resourceOwnerType = ResourceOwnerType.TENANT;
+            this.externalId = metadata.getToken();
         }
     }
 
@@ -114,4 +125,30 @@ private static String generateToken() {
 
         return UUID.randomUUID().toString();
     }
+
+
+    public String getExternalId() {
+        return externalId;
+    }
+
+    public void setExternalId(String externalId) {
+        this.externalId = externalId;
+    }
+
+    public String getType() {
+        return type;
+    }
+
+    public void setType(String type) {
+        this.type = type;
+    }
+
+    private boolean parseMetadata(SecretMetadata secretMetadata) {
+        this.description = secretMetadata.getDescription();
+        this.ownerId = secretMetadata.getOwnerId();
+        this.tenantId = secretMetadata.getTenantId();
+        this.type = secretMetadata.getResourceType().name();
+
+        return true;
+    }
 }
diff --git a/custos-core-services/resource-secret-core-service/src/main/java/org/apache/custos/resource/secret/manager/adaptor/outbound/SSHCredential.java b/custos-core-services/resource-secret-core-service/src/main/java/org/apache/custos/resource/secret/manager/adaptor/outbound/SSHCredential.java
index 5e2d6ebf8..ff6647a09 100644
--- a/custos-core-services/resource-secret-core-service/src/main/java/org/apache/custos/resource/secret/manager/adaptor/outbound/SSHCredential.java
+++ b/custos-core-services/resource-secret-core-service/src/main/java/org/apache/custos/resource/secret/manager/adaptor/outbound/SSHCredential.java
@@ -26,7 +26,6 @@
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
-
 import java.io.File;
 import java.util.UUID;
 
@@ -42,20 +41,24 @@ public class SSHCredential extends ResourceCredential {
     private String privateKey;
     private String passPhrase;
 
+
     public SSHCredential(GeneratedMessageV3 message) throws Exception {
         super(message);
-       if (message instanceof org.apache.custos.resource.secret.service.SSHCredential) {
+        if (message instanceof org.apache.custos.resource.secret.service.SSHCredential) {
+
+            this.passPhrase = ((org.apache.custos.resource.secret.service.SSHCredential) message).getPassphrase();
+            this.privateKey = ((org.apache.custos.resource.secret.service.SSHCredential) message).getPrivateKey();
+            this.publicKey = ((org.apache.custos.resource.secret.service.SSHCredential) message).getPublicKey();
 
-         this.passPhrase =  ((org.apache.custos.resource.secret.service.SSHCredential) message).getPassphrase();
-         this.privateKey = ((org.apache.custos.resource.secret.service.SSHCredential) message).getPrivateKey();
-         this.publicKey = ((org.apache.custos.resource.secret.service.SSHCredential) message).getPublicKey();
 
-         if (passPhrase == null || passPhrase.trim().equals("")) {
-             this.passPhrase = String.valueOf(UUID.randomUUID());
-         }
-          this.generateKeyPair(this.passPhrase);
+            if (passPhrase == null || passPhrase.trim().equals("")) {
+                this.passPhrase = String.valueOf(UUID.randomUUID());
+            }
+            if (this.publicKey == null || this.publicKey.trim().equals("")) {
+                this.generateKeyPair(this.passPhrase);
+            }
 
-       }
+        }
 
     }
 
@@ -83,15 +86,16 @@ public void setPassPhrase(String passPhrase) {
         this.passPhrase = passPhrase;
     }
 
-    private void  generateKeyPair(String passPhrase) throws Exception{
-        JSch jsch=new JSch();
-        try{
-            KeyPair kpair= KeyPair.genKeyPair(jsch, KeyPair.RSA, 2048);
+
+    private void generateKeyPair(String passPhrase) throws Exception {
+        JSch jsch = new JSch();
+        try {
+            KeyPair kpair = KeyPair.genKeyPair(jsch, KeyPair.RSA, 2048);
             File file = File.createTempFile("id_rsa", "");
             String fileName = file.getAbsolutePath();
 
             kpair.writePrivateKey(fileName, passPhrase.getBytes());
-            kpair.writePublicKey(fileName + ".pub"  , "");
+            kpair.writePublicKey(fileName + ".pub", "");
             kpair.dispose();
             byte[] priKey = FileUtils.readFileToByteArray(new File(fileName));
 
@@ -99,8 +103,7 @@ private void  generateKeyPair(String passPhrase) throws Exception{
             this.privateKey = new String(priKey);
             this.publicKey = new String(pubKey);
 
-        }
-        catch(Exception e){
+        } catch (Exception e) {
             LOGGER.error("Error while creating key pair", e);
             throw new Exception("Error while creating key pair", e);
         }
diff --git a/custos-core-services/resource-secret-core-service/src/main/java/org/apache/custos/resource/secret/persistance/local/model/Secret.java b/custos-core-services/resource-secret-core-service/src/main/java/org/apache/custos/resource/secret/persistance/local/model/Secret.java
index fc74e802e..50a4e04a0 100644
--- a/custos-core-services/resource-secret-core-service/src/main/java/org/apache/custos/resource/secret/persistance/local/model/Secret.java
+++ b/custos-core-services/resource-secret-core-service/src/main/java/org/apache/custos/resource/secret/persistance/local/model/Secret.java
@@ -62,6 +62,9 @@ public class Secret {
     @LastModifiedDate
     private Date lastModifiedAt;
 
+    @Column
+    private String externalId;
+
 
     public String getId() {
         return id;
@@ -134,4 +137,13 @@ public Date getLastModifiedAt() {
     public void setLastModifiedAt(Date lastModifiedAt) {
         this.lastModifiedAt = lastModifiedAt;
     }
+
+
+    public String getExternalId() {
+        return externalId;
+    }
+
+    public void setExternalId(String externalId) {
+        this.externalId = externalId;
+    }
 }
diff --git a/custos-core-services/resource-secret-core-service/src/main/java/org/apache/custos/resource/secret/persistance/local/repository/SecretRepository.java b/custos-core-services/resource-secret-core-service/src/main/java/org/apache/custos/resource/secret/persistance/local/repository/SecretRepository.java
index 34ee96671..26b1d0206 100644
--- a/custos-core-services/resource-secret-core-service/src/main/java/org/apache/custos/resource/secret/persistance/local/repository/SecretRepository.java
+++ b/custos-core-services/resource-secret-core-service/src/main/java/org/apache/custos/resource/secret/persistance/local/repository/SecretRepository.java
@@ -21,7 +21,21 @@
 
 import org.apache.custos.resource.secret.persistance.local.model.Secret;
 import org.springframework.data.jpa.repository.JpaRepository;
+import org.springframework.data.jpa.repository.Query;
+
+import java.util.Iterator;
+import java.util.List;
 
 public interface SecretRepository extends JpaRepository<Secret, String> {
 
+
+    public List<Secret> findAllByExternalIdAndOwnerIdAndTenantId(String externalId, String ownerId, long tenantId);
+
+    public List<Secret> findAllByExternalIdAndTenantId(String externalId, long tenantId);
+
+    @Query(value = "select * from secret s where s.tenant_id = ?1 and ( s.id  IN ?2 " +
+            "or s.external_id  IN ?3 )", nativeQuery = true)
+    public List<Secret> getAllSecretsByIdOrExternalId(long tenantId, List<String> tokens, List<String> externalIds);
+
+
 }
diff --git a/custos-core-services/resource-secret-core-service/src/main/java/org/apache/custos/resource/secret/persistance/vault/KVSecret.java b/custos-core-services/resource-secret-core-service/src/main/java/org/apache/custos/resource/secret/persistance/vault/KVSecret.java
new file mode 100644
index 000000000..d78a06512
--- /dev/null
+++ b/custos-core-services/resource-secret-core-service/src/main/java/org/apache/custos/resource/secret/persistance/vault/KVSecret.java
@@ -0,0 +1,54 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing,
+ *  software distributed under the License is distributed on an
+ *  "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ *  KIND, either express or implied. See the License for the
+ *  specific language governing permissions and limitations
+ *  under the License.
+ */
+
+package org.apache.custos.resource.secret.persistance.vault;
+
+/**
+ * KV secret store
+ */
+public class KVSecret {
+    private String key;
+
+    private String value;
+
+    public KVSecret() {
+
+    }
+
+    public KVSecret(String key, String value) {
+        this.key = key;
+        this.value = value;
+    }
+
+    public String getKey() {
+        return key;
+    }
+
+    public void setKey(String key) {
+        this.key = key;
+    }
+
+    public String getValue() {
+        return value;
+    }
+
+    public void setValue(String value) {
+        this.value = value;
+    }
+}
diff --git a/custos-core-services/resource-secret-core-service/src/main/java/org/apache/custos/resource/secret/persistance/vault/PasswordSecret.java b/custos-core-services/resource-secret-core-service/src/main/java/org/apache/custos/resource/secret/persistance/vault/PasswordSecret.java
index 1b094c414..399173b6e 100644
--- a/custos-core-services/resource-secret-core-service/src/main/java/org/apache/custos/resource/secret/persistance/vault/PasswordSecret.java
+++ b/custos-core-services/resource-secret-core-service/src/main/java/org/apache/custos/resource/secret/persistance/vault/PasswordSecret.java
@@ -26,6 +26,8 @@ public class PasswordSecret {
 
     private String password;
 
+    private String userId;
+
     public PasswordSecret() {
 
     }
@@ -35,6 +37,11 @@ public PasswordSecret(String password) {
         this.password = password;
     }
 
+    public PasswordSecret(String password, String userId) {
+        this.password = password;
+        this.userId = userId;
+    }
+
     public String getPassword() {
         return password;
     }
@@ -42,4 +49,13 @@ public String getPassword() {
     public void setPassword(String password) {
         this.password = password;
     }
+
+
+    public String getUserId() {
+        return userId;
+    }
+
+    public void setUserId(String userId) {
+        this.userId = userId;
+    }
 }
diff --git a/custos-core-services/resource-secret-core-service/src/main/java/org/apache/custos/resource/secret/service/ResourceSecretService.java b/custos-core-services/resource-secret-core-service/src/main/java/org/apache/custos/resource/secret/service/ResourceSecretService.java
index 2f50e1517..693d41705 100644
--- a/custos-core-services/resource-secret-core-service/src/main/java/org/apache/custos/resource/secret/service/ResourceSecretService.java
+++ b/custos-core-services/resource-secret-core-service/src/main/java/org/apache/custos/resource/secret/service/ResourceSecretService.java
@@ -25,8 +25,8 @@
 import org.apache.custos.core.services.commons.persistance.model.OperationStatus;
 import org.apache.custos.resource.secret.manager.Credential;
 import org.apache.custos.resource.secret.manager.CredentialGeneratorFactory;
-import org.apache.custos.resource.secret.manager.adaptor.outbound.CredentialWriter;
 import org.apache.custos.resource.secret.manager.adaptor.inbound.CredentialReader;
+import org.apache.custos.resource.secret.manager.adaptor.outbound.CredentialWriter;
 import org.apache.custos.resource.secret.utils.Operations;
 import org.lognet.springboot.grpc.GRpcService;
 import org.slf4j.Logger;
@@ -34,6 +34,7 @@
 import org.springframework.beans.factory.annotation.Autowired;
 
 import java.util.List;
+import java.util.Optional;
 
 /**
  * This class is responsible for handling resource secrets, such as SSH credentials, password credentials
@@ -57,24 +58,6 @@ public class ResourceSecretService extends ResourceSecretServiceGrpc.ResourceSec
     private CredentialReader credentialReader;
 
 
-    @Override
-    public void getSecret(GetSecretRequest request, StreamObserver<SecretMetadata> responseObserver) {
-        try {
-            LOGGER.debug(" Request received to getSecret in tenant " + request.getMetadata().getTenantId() +
-                    " of owner " + request.getMetadata().getOwnerId() + " with token  " + request.getMetadata().getToken());
-
-            responseObserver.onNext(SecretMetadata.newBuilder().build());
-            responseObserver.onCompleted();
-
-        } catch (Exception ex) {
-            String msg = "Exception occurred while fetching secret with " + request.getMetadata().getToken() +
-                    " : " + ex.getMessage();
-            LOGGER.error(msg);
-            responseObserver.onError(Status.INTERNAL.withDescription(msg).asRuntimeException());
-        }
-    }
-
-
     @Override
     public void getAllResourceCredentialSummaries(GetResourceCredentialSummariesRequest request, StreamObserver<ResourceCredentialSummaries> responseObserver) {
         try {
@@ -94,7 +77,7 @@ public void getAllResourceCredentialSummaries(GetResourceCredentialSummariesRequ
 
         } catch (Exception ex) {
             String msg = "Exception occurred while fetching credential summaries  " +
-                    " : " + ex.getMessage();
+                    " : " + ex;
             LOGGER.error(msg);
             responseObserver.onError(Status.INTERNAL.withDescription(msg).asRuntimeException());
         }
@@ -120,7 +103,8 @@ public void addSSHCredential(SSHCredential request, StreamObserver<AddResourceCr
 
             AddResourceCredentialResponse resourceCredentialResponse = AddResourceCredentialResponse
                     .newBuilder()
-                    .setToken(sshCredential.getToken())
+                    .setToken((sshCredential.getExternalId() != null &&
+                            !sshCredential.getExternalId().trim().equals("")) ? sshCredential.getExternalId() : sshCredential.getToken())
                     .build();
             responseObserver.onNext(resourceCredentialResponse);
             responseObserver.onCompleted();
@@ -128,7 +112,7 @@ public void addSSHCredential(SSHCredential request, StreamObserver<AddResourceCr
 
         } catch (Exception ex) {
             String msg = "Exception occurred while adding SSH credentials " + request.getMetadata().getToken() +
-                    " : " + ex.getMessage();
+                    " : " + ex;
             LOGGER.error(msg);
             responseObserver.onError(Status.INTERNAL.withDescription(msg).asRuntimeException());
         }
@@ -153,14 +137,15 @@ public void addPasswordCredential(PasswordCredential request, StreamObserver<Add
 
             AddResourceCredentialResponse resourceCredentialResponse = AddResourceCredentialResponse
                     .newBuilder()
-                    .setToken(passwordCredential.getToken())
+                    .setToken((passwordCredential.getExternalId() != null &&
+                            !passwordCredential.getExternalId().trim().equals("")) ? passwordCredential.getExternalId() : passwordCredential.getToken())
                     .build();
             responseObserver.onNext(resourceCredentialResponse);
             responseObserver.onCompleted();
 
         } catch (Exception ex) {
             String msg = "Exception occurred while adding password credentials " + request.getMetadata().getToken() +
-                    " : " + ex.getMessage();
+                    " : " + ex;
             LOGGER.error(msg);
             responseObserver.onError(Status.INTERNAL.withDescription(msg).asRuntimeException());
         }
@@ -185,14 +170,16 @@ public void addCertificateCredential(CertificateCredential request, StreamObserv
 
             AddResourceCredentialResponse resourceCredentialResponse = AddResourceCredentialResponse
                     .newBuilder()
-                    .setToken(certificateCredential.getToken())
+                    .setToken((certificateCredential.getExternalId() != null &&
+                            !certificateCredential.getExternalId().trim().equals("")) ?
+                            certificateCredential.getExternalId() : certificateCredential.getToken())
                     .build();
             responseObserver.onNext(resourceCredentialResponse);
             responseObserver.onCompleted();
 
         } catch (Exception ex) {
             String msg = "Exception occurred while adding certificate credential secret " + request.getMetadata().getToken() +
-                    " : " + ex.getMessage();
+                    " : " + ex;
             LOGGER.error(msg);
             responseObserver.onError(Status.INTERNAL.withDescription(msg).asRuntimeException());
         }
@@ -204,15 +191,15 @@ public void getResourceCredentialSummary(GetResourceCredentialByTokenRequest req
             LOGGER.debug(" Request received to getResourceCredentialSummary in tenant " + request.getTenantId() +
                     " with token  " + request.getToken());
 
-            SecretMetadata metadata = credentialReader.getCredentialSummary(request.getTenantId(), request.getToken());
+            Optional<SecretMetadata> metadata = credentialReader.getCredentialSummary(request.getTenantId(), request.getToken());
 
-            responseObserver.onNext(metadata);
+            responseObserver.onNext(metadata.get());
             responseObserver.onCompleted();
 
 
         } catch (Exception ex) {
             String msg = "Exception occurred while fetching resource credential summaries " + request.getToken() +
-                    " : " + ex.getMessage();
+                    " : " + ex;
             LOGGER.error(msg);
             responseObserver.onError(Status.INTERNAL.withDescription(msg).asRuntimeException());
         }
@@ -224,13 +211,13 @@ public void getSSHCredential(GetResourceCredentialByTokenRequest request, Stream
             LOGGER.debug(" Request received to getSSHCredential in tenant " + request.getTenantId() +
                     " with token  " + request.getToken());
 
-            SSHCredential sshCredential = credentialReader.getSSHCredential(request.getTenantId(), request.getToken());
-            responseObserver.onNext(sshCredential);
+            Optional<SSHCredential> sshCredential = credentialReader.getSSHCredential(request.getTenantId(), request.getToken());
+            responseObserver.onNext(sshCredential.get());
             responseObserver.onCompleted();
 
         } catch (Exception ex) {
             String msg = "Exception occurred while fetching SSH credential " + request.getToken() +
-                    " : " + ex.getMessage();
+                    " : " + ex;
             LOGGER.error(msg);
             responseObserver.onError(Status.INTERNAL.withDescription(msg).asRuntimeException());
         }
@@ -242,14 +229,14 @@ public void getPasswordCredential(GetResourceCredentialByTokenRequest request, S
             LOGGER.debug(" Request received to getPasswordCredential in tenant " + request.getTenantId() +
                     " with token  " + request.getToken());
 
-            PasswordCredential passwordCredential = credentialReader.
+            Optional<PasswordCredential> passwordCredential = credentialReader.
                     getPasswordCredential(request.getTenantId(), request.getToken());
-            responseObserver.onNext(passwordCredential);
+            responseObserver.onNext(passwordCredential.get());
             responseObserver.onCompleted();
 
         } catch (Exception ex) {
             String msg = "Exception occurred while fetching password credential " + request.getToken() +
-                    " : " + ex.getMessage();
+                    " : " + ex;
             LOGGER.error(msg);
             responseObserver.onError(Status.INTERNAL.withDescription(msg).asRuntimeException());
         }
@@ -261,14 +248,14 @@ public void getCertificateCredential(GetResourceCredentialByTokenRequest request
             LOGGER.debug(" Request received to getCertificateCredential in tenant " + request.getTenantId() +
                     " with token  " + request.getToken());
 
-            CertificateCredential certificateCredential = credentialReader.
+            Optional<CertificateCredential> certificateCredential = credentialReader.
                     getCertificateCredential(request.getTenantId(), request.getToken());
-            responseObserver.onNext(certificateCredential);
+            responseObserver.onNext(certificateCredential.get());
             responseObserver.onCompleted();
 
         } catch (Exception ex) {
             String msg = "Exception occurred while fetching certificate credential " + request.getToken() +
-                    " : " + ex.getMessage();
+                    " : " + ex;
             LOGGER.error(msg);
             responseObserver.onError(Status.INTERNAL.withDescription(msg).asRuntimeException());
         }
@@ -295,7 +282,7 @@ public void deleteSSHCredential(GetResourceCredentialByTokenRequest request, Str
 
         } catch (Exception ex) {
             String msg = "Exception occurred while deleting SSH secret " + request.getToken() +
-                    " : " + ex.getMessage();
+                    " : " + ex;
             LOGGER.error(msg);
             responseObserver.onError(Status.INTERNAL.withDescription(msg).asRuntimeException());
         }
@@ -321,6 +308,217 @@ public void deletePWDCredential(GetResourceCredentialByTokenRequest request, Str
 
         } catch (Exception ex) {
             String msg = "Exception occurred while deleting password credential " + request.getToken() +
+                    " : " + ex;
+            LOGGER.error(msg);
+            responseObserver.onError(Status.INTERNAL.withDescription(msg).asRuntimeException());
+        }
+    }
+
+    @Override
+    public void getKVCredential(KVCredential request, StreamObserver<KVCredential> responseObserver) {
+        try {
+            LOGGER.debug(" Request received to getKVCredential in tenant " + request.getMetadata().getTenantId() +
+                    " with key  " + request.getKey());
+            String token = request.getToken();
+            Optional<KVCredential> kvCredential = null;
+            if (token != null && !token.trim().equals("")) {
+                kvCredential = credentialReader.getKVSecretByToken(token,
+                        request.getMetadata().getTenantId(), request.getMetadata().getOwnerId());
+            } else {
+                kvCredential = credentialReader.getKVSecretByKey(request.getKey(),
+                        request.getMetadata().getTenantId(), request.getMetadata().getOwnerId());
+            }
+
+            responseObserver.onNext(kvCredential.get());
+            responseObserver.onCompleted();
+
+        } catch (Exception ex) {
+            String msg = "Exception occurred while fetching KV credentials " +
+                    " : " + ex;
+            LOGGER.error(msg);
+            responseObserver.onError(Status.INTERNAL.withDescription(msg).asRuntimeException());
+        }
+    }
+
+    @Override
+    public void setKVCredential(KVCredential request, StreamObserver<ResourceCredentialOperationStatus> responseObserver) {
+        try {
+            LOGGER.debug(" Request received to setKVCredential in tenant " + request.getMetadata().getTenantId() +
+                    " with key  " + request.getKey());
+            Credential credential = credentialGeneratorFactory.getCredential(request);
+
+            credentialWriter.saveKVCredential((org.apache.custos.resource.secret.manager.adaptor.outbound.KVCredential) credential);
+
+            statusUpdater.updateStatus(Operations.SAVE_KV_CREDENTIAL.name(), OperationStatus.SUCCESS,
+                    request.getMetadata().getTenantId(), request.getMetadata().getOwnerId());
+
+            ResourceCredentialOperationStatus operationStatus = ResourceCredentialOperationStatus
+                    .newBuilder()
+                    .setStatus(true)
+                    .build();
+            responseObserver.onNext(operationStatus);
+            responseObserver.onCompleted();
+
+
+        } catch (Exception ex) {
+            String msg = "Exception occurred while  setting KV credentials " +
+                    " : " + ex;
+            LOGGER.error(msg);
+            responseObserver.onError(Status.INTERNAL.withDescription(msg).asRuntimeException());
+        }
+    }
+
+    @Override
+    public void updateKVCredential(KVCredential request, StreamObserver<ResourceCredentialOperationStatus> responseObserver) {
+        try {
+            LOGGER.debug(" Request received to updateKVCredential in tenant " + request.getMetadata().getTenantId() +
+                    " with key  " + request.getKey());
+            credentialWriter.updateKVCredential(request);
+
+            statusUpdater.updateStatus(Operations.UPDATE_KV_CREDENTIAL.name(), OperationStatus.SUCCESS,
+                    request.getMetadata().getTenantId(), request.getMetadata().getOwnerId());
+
+            ResourceCredentialOperationStatus operationStatus = ResourceCredentialOperationStatus
+                    .newBuilder()
+                    .setStatus(true)
+                    .build();
+            responseObserver.onNext(operationStatus);
+            responseObserver.onCompleted();
+
+
+        } catch (Exception ex) {
+            String msg = "Exception occurred while updating  KV credential " +
+                    " : " + ex;
+            LOGGER.error(msg);
+            responseObserver.onError(Status.INTERNAL.withDescription(msg).asRuntimeException());
+        }
+    }
+
+    @Override
+    public void deleteKVCredential(KVCredential request, StreamObserver<ResourceCredentialOperationStatus> responseObserver) {
+        try {
+            LOGGER.debug(" Request received to deleteKVCredential in tenant " + request.getMetadata().getTenantId() +
+                    " with key  " + request.getKey());
+
+            credentialWriter.deleteKVCredential(request);
+
+            statusUpdater.updateStatus(Operations.DELETE_KV_CREDENTIAL.name(), OperationStatus.SUCCESS,
+                    request.getMetadata().getTenantId(), request.getMetadata().getOwnerId());
+
+            ResourceCredentialOperationStatus operationStatus = ResourceCredentialOperationStatus
+                    .newBuilder()
+                    .setStatus(true)
+                    .build();
+            responseObserver.onNext(operationStatus);
+            responseObserver.onCompleted();
+
+        } catch (Exception ex) {
+            String msg = "Exception occurred while deleting KV  credential " +
+                    " : " + ex;
+            LOGGER.error(msg);
+            responseObserver.onError(Status.INTERNAL.withDescription(msg).asRuntimeException());
+        }
+    }
+
+    @Override
+    public void getCredentialMap(CredentialMap request, StreamObserver<CredentialMap> responseObserver) {
+        try {
+            LOGGER.debug(" Request received to getCredentialMap in tenant " + request.getMetadata().getTenantId() +
+                    " with key  " + request.getMetadata().getToken());
+
+            Optional<CredentialMap> certificateCredential = credentialReader.
+                    getCredentialMapByToken(request.getMetadata().getToken(), request.getMetadata().getTenantId());
+            if (certificateCredential.isPresent()) {
+                responseObserver.onNext(certificateCredential.get());
+                responseObserver.onCompleted();
+            } else {
+                String msg = "Cannot find a credential with token " + request.getMetadata().getToken();
+                LOGGER.error(msg);
+                responseObserver.onError(Status.NOT_FOUND.withDescription(msg).asRuntimeException());
+            }
+
+        } catch (Exception ex) {
+            String msg = "Exception occurred while fetching credential  Map " +
+                    " : " + ex.getMessage();
+            LOGGER.error(msg);
+            responseObserver.onError(Status.INTERNAL.withDescription(msg).asRuntimeException());
+        }
+    }
+
+    @Override
+    public void setCredentialMap(CredentialMap request, StreamObserver<AddResourceCredentialResponse> responseObserver) {
+        try {
+            LOGGER.debug(" Request received to setCredentialMap in tenant " + request.getMetadata().getTenantId() +
+                    " with key  " + request.getMetadata().getToken());
+
+            Credential credential = credentialGeneratorFactory.getCredential(request);
+
+            credentialWriter.saveCredentialMap((org.apache.custos.resource.secret.manager.adaptor.outbound.CredentialMap) credential);
+
+            statusUpdater.updateStatus(Operations.SAVE_CREDENTIAL_MAP.name(), OperationStatus.SUCCESS,
+                    request.getMetadata().getTenantId(), request.getMetadata().getOwnerId());
+
+            AddResourceCredentialResponse operationStatus = AddResourceCredentialResponse
+                    .newBuilder()
+                    .setToken(((org.apache.custos.resource.secret.manager.adaptor.outbound.CredentialMap) credential).getToken())
+                    .build();
+            responseObserver.onNext(operationStatus);
+            responseObserver.onCompleted();
+
+        } catch (Exception ex) {
+            String msg = "Exception occurred while deleting KV  credential " +
+                    " : " + ex;
+            LOGGER.error(msg);
+            responseObserver.onError(Status.INTERNAL.withDescription(msg).asRuntimeException());
+        }
+    }
+
+    @Override
+    public void updateCredentialMap(CredentialMap request, StreamObserver<ResourceCredentialOperationStatus> responseObserver) {
+        try {
+            LOGGER.debug(" Request received to updateCredentialMap in tenant " + request.getMetadata().getTenantId() +
+                    " with key  " + request.getMetadata().getToken());
+            Credential credential = credentialGeneratorFactory.getCredential(request);
+            credentialWriter.updateCredentialMap((org.apache.custos.resource.secret.manager.adaptor.outbound.CredentialMap) credential);
+
+            statusUpdater.updateStatus(Operations.UPDATE_CREDENTIAL_MAP.name(), OperationStatus.SUCCESS,
+                    request.getMetadata().getTenantId(), request.getMetadata().getOwnerId());
+
+            ResourceCredentialOperationStatus operationStatus = ResourceCredentialOperationStatus
+                    .newBuilder()
+                    .setStatus(true)
+                    .build();
+            responseObserver.onNext(operationStatus);
+            responseObserver.onCompleted();
+
+        } catch (Exception ex) {
+            String msg = "Exception occurred while deleting KV  credential " +
+                    " : " + ex;
+            LOGGER.error(msg);
+            responseObserver.onError(Status.INTERNAL.withDescription(msg).asRuntimeException());
+        }
+    }
+
+    @Override
+    public void deleteCredentialMap(CredentialMap request, StreamObserver<ResourceCredentialOperationStatus> responseObserver) {
+        try {
+            LOGGER.debug(" Request received to deleteCredentialMap in tenant " + request.getMetadata().getTenantId() +
+                    " with key  " + request.getMetadata().getToken());
+            Credential credential = credentialGeneratorFactory.getCredential(request);
+            credentialWriter.deleteCredentialMap((org.apache.custos.resource.secret.manager.adaptor.outbound.CredentialMap) credential);
+
+            statusUpdater.updateStatus(Operations.DELETE_CREDENTIAL_MAP.name(), OperationStatus.SUCCESS,
+                    request.getMetadata().getTenantId(), request.getMetadata().getOwnerId());
+
+            ResourceCredentialOperationStatus operationStatus = ResourceCredentialOperationStatus
+                    .newBuilder()
+                    .setStatus(true)
+                    .build();
+            responseObserver.onNext(operationStatus);
+            responseObserver.onCompleted();
+
+        } catch (Exception ex) {
+            String msg = "Exception occurred while deleting CredentialMap " +
                     " : " + ex.getMessage();
             LOGGER.error(msg);
             responseObserver.onError(Status.INTERNAL.withDescription(msg).asRuntimeException());
diff --git a/custos-core-services/resource-secret-core-service/src/main/java/org/apache/custos/resource/secret/utils/Constants.java b/custos-core-services/resource-secret-core-service/src/main/java/org/apache/custos/resource/secret/utils/Constants.java
index 0b34ac1f6..8a7746c0f 100644
--- a/custos-core-services/resource-secret-core-service/src/main/java/org/apache/custos/resource/secret/utils/Constants.java
+++ b/custos-core-services/resource-secret-core-service/src/main/java/org/apache/custos/resource/secret/utils/Constants.java
@@ -25,6 +25,8 @@ public final class Constants {
     public static final String SSH_CREDENTIALS = "ssh";
     public static  final String CERTIFICATES = "certificates";
     public static final String PASSWORD = "passwd";
+    public static final String  KV_SECRET = "keyValue";
+    public static final String SECRET_MAP = "secretMap";
 
 
 }
diff --git a/custos-core-services/resource-secret-core-service/src/main/java/org/apache/custos/resource/secret/utils/Operations.java b/custos-core-services/resource-secret-core-service/src/main/java/org/apache/custos/resource/secret/utils/Operations.java
index 6749405c0..05d5018b6 100644
--- a/custos-core-services/resource-secret-core-service/src/main/java/org/apache/custos/resource/secret/utils/Operations.java
+++ b/custos-core-services/resource-secret-core-service/src/main/java/org/apache/custos/resource/secret/utils/Operations.java
@@ -26,6 +26,12 @@ public enum Operations {
     ADD_PASSWORD_CREDENTIAL,
     DELETE_SSH_CREDENTIAL,
     DELETE_CERTIFICATE_CREDENTIAL,
-    DELETE_PASSWORD_CREDENTIAL
+    DELETE_PASSWORD_CREDENTIAL,
+    SAVE_KV_CREDENTIAL,
+    UPDATE_KV_CREDENTIAL,
+    DELETE_KV_CREDENTIAL,
+    SAVE_CREDENTIAL_MAP,
+    UPDATE_CREDENTIAL_MAP,
+    DELETE_CREDENTIAL_MAP
 
 }
diff --git a/custos-core-services/resource-secret-core-service/src/main/proto/ResourceSecretService.proto b/custos-core-services/resource-secret-core-service/src/main/proto/ResourceSecretService.proto
index 0ca5a8d69..fce978f1e 100644
--- a/custos-core-services/resource-secret-core-service/src/main/proto/ResourceSecretService.proto
+++ b/custos-core-services/resource-secret-core-service/src/main/proto/ResourceSecretService.proto
@@ -34,6 +34,16 @@ enum ResourceType {
     SERVER_CERTIFICATE = 0;
     JWT_SIGNING_CERTIFICATE = 1;
     VAULT_CREDENTIAL = 2;
+    VM = 3;
+    ACCOUNT = 4;
+    OTHER = 5;
+    SCP =6;
+    S3 =7;
+    BOX =8;
+    AZURE =9;
+    GCS = 10;
+    DROPBOX=11;
+    FTP=12;
 }
 
 enum ResourceSource {
@@ -47,6 +57,9 @@ enum ResourceSecretType {
     SSH = 0;
     PASSWORD = 1;
     X509_CERTIFICATE = 2;
+    RAW_DATA= 3;
+    KV=4;
+    CREDENTIAL_MAP=5;
 }
 
 message SecretMetadata {
@@ -66,13 +79,7 @@ message SecretMetadata {
 }
 
 
-message GetSecretRequest {
-    SecretMetadata metadata = 1;
-    int64 tenantId = 2;
-    string clientId = 3;
-    string clientSec = 4;
-    string accessToken = 5;
-}
+
 
 
 message CertificateCredential {
@@ -82,11 +89,20 @@ message CertificateCredential {
     string private_key = 5;
     int64 life_time = 6;
     string not_before = 7;
+    bool use_shamirs_secret_sharing_with_encryption = 8;
+    int32 num_of_shares = 9;
+    int32 threshold = 10;
+    repeated bytes  private_key_shares = 11;
 }
 
 message PasswordCredential {
     SecretMetadata metadata = 1;
     string password = 3;
+    bool use_shamirs_secret_sharing_with_encryption = 4;
+    int32 num_of_shares = 5;
+    int32 threshold = 6;
+    repeated bytes  secret_shares = 7;
+    string userId = 8;
 }
 
 message SSHCredential {
@@ -94,6 +110,10 @@ message SSHCredential {
     string passphrase = 3;
     string public_key = 4;
     string private_key = 5;
+    bool use_shamirs_secret_sharing_with_encryption = 6;
+    int32 num_of_shares = 7;
+    int32 threshold = 8;
+    repeated bytes  private_key_shares = 9;
 }
 
 
@@ -102,6 +122,10 @@ message GetResourceCredentialByTokenRequest {
     string token = 2;
     string performed_by = 3;
     string client_id = 4;
+    bool use_shamirs_secret_sharing_with_encryption = 5;
+    int32 num_of_shares = 6;
+    int32 threshold = 7;
+
 }
 
 message GetResourceCredentialSummariesRequest {
@@ -126,8 +150,40 @@ message ResourceCredentialOperationStatus {
 }
 
 
+message KVCredential {
+    string key = 1;
+    string value = 2;
+    SecretMetadata metadata = 3;
+    string token = 4;
+}
+
+
+
+
+message GetSecretRequest {
+    SecretMetadata metadata = 1;
+    string client_id =2;
+    int64 tenant_id = 3;
+    string client_sec = 4;
+}
+
+message CredentialMap {
+    map<string,string> credential_map = 1;
+    SecretMetadata metadata = 2;
+}
+
+
+
 service ResourceSecretService {
-    rpc getSecret (GetSecretRequest) returns (SecretMetadata);
+    rpc getKVCredential (KVCredential) returns (KVCredential);
+    rpc setKVCredential(KVCredential)  returns (ResourceCredentialOperationStatus);
+    rpc updateKVCredential (KVCredential) returns (ResourceCredentialOperationStatus);
+    rpc deleteKVCredential (KVCredential) returns (ResourceCredentialOperationStatus);
+
+    rpc getCredentialMap (CredentialMap) returns (CredentialMap);
+    rpc setCredentialMap (CredentialMap) returns (AddResourceCredentialResponse);
+    rpc updateCredentialMap (CredentialMap) returns (ResourceCredentialOperationStatus);
+    rpc deleteCredentialMap (CredentialMap) returns (ResourceCredentialOperationStatus);
 
     rpc getResourceCredentialSummary (GetResourceCredentialByTokenRequest) returns (SecretMetadata);
     rpc getAllResourceCredentialSummaries (GetResourceCredentialSummariesRequest) returns (ResourceCredentialSummaries);
diff --git a/custos-core-services/resource-secret-core-service/src/main/resources/application.properties b/custos-core-services/resource-secret-core-service/src/main/resources/application.properties
index c34ddd3ce..3168f2d5c 100644
--- a/custos-core-services/resource-secret-core-service/src/main/resources/application.properties
+++ b/custos-core-services/resource-secret-core-service/src/main/resources/application.properties
@@ -27,7 +27,7 @@ management.security.enabled=false
 management.endpoints.web.exposure.include=*
 management.endpoint.metrics.enabled=true
 
-spring.datasource.url = jdbc:mysql://mysql.custos.svc.cluster.local:3306/core_resource_secret?useSSL=false&serverTimezone=UTC&useLegacyDatetimeCode=false
+spring.datasource.url = jdbc:mysql://mysql-primary.custos.svc.cluster.local:3306/core_resource_secret?useSSL=false&serverTimezone=UTC&useLegacyDatetimeCode=false
 spring.datasource.username = root
 spring.datasource.password = root
 
diff --git a/custos-core-services/resource-secret-core-service/src/main/resources/bootstrap.properties b/custos-core-services/resource-secret-core-service/src/main/resources/bootstrap.properties
index da2d1843f..1c35e80c3 100644
--- a/custos-core-services/resource-secret-core-service/src/main/resources/bootstrap.properties
+++ b/custos-core-services/resource-secret-core-service/src/main/resources/bootstrap.properties
@@ -17,9 +17,11 @@
 #  under the License.
 #
 
-spring.cloud.vault.token={{vault_token}}
-spring.cloud.vault.scheme=http
+spring.cloud.vault.token={{token}}
+spring.cloud.vault.scheme=https
 spring.cloud.vault.host=vault.custos.scigap.org
-spring.cloud.vault.port=30249
-spring.cloud.vault.uri=http://vault.custos.scigap.org:30249
+spring.cloud.vault.port=31190
+spring.cloud.vault.uri=https://vault.custos.scigap.org:31190
 spring.cloud.vault.authentication=token
+spring.cloud.vault.ssl.trust-store=vault-client-truststore.pkcs12
+spring.cloud.vault.ssl.trust-store-password=vaultpass
diff --git a/custos-core-services/resource-secret-core-service/src/main/resources/vault-client-truststore.pkcs12 b/custos-core-services/resource-secret-core-service/src/main/resources/vault-client-truststore.pkcs12
new file mode 100644
index 000000000..8314bc0db
Binary files /dev/null and b/custos-core-services/resource-secret-core-service/src/main/resources/vault-client-truststore.pkcs12 differ
diff --git a/custos-core-services/sharing-core-service/pom.xml b/custos-core-services/sharing-core-service/pom.xml
index c78d457f9..c47183d3a 100644
--- a/custos-core-services/sharing-core-service/pom.xml
+++ b/custos-core-services/sharing-core-service/pom.xml
@@ -95,6 +95,7 @@
             <artifactId>commons-io</artifactId>
         </dependency>
 
+
     </dependencies>
 
 
@@ -114,6 +115,13 @@
                     <skip>false</skip>
                 </configuration>
             </plugin>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-antrun-plugin</artifactId>
+                <configuration>
+                    <skip>false</skip>
+                </configuration>
+            </plugin>
         </plugins>
     </build>
 
diff --git a/custos-core-services/sharing-core-service/src/main/helm/templates/deployment.yaml b/custos-core-services/sharing-core-service/src/main/helm/templates/deployment.yaml
index 31e54a6fc..74401f2c4 100644
--- a/custos-core-services/sharing-core-service/src/main/helm/templates/deployment.yaml
+++ b/custos-core-services/sharing-core-service/src/main/helm/templates/deployment.yaml
@@ -6,9 +6,10 @@ metadata:
 {{ include "helm.labels" . | indent 4 }}
 spec:
   replicas: {{ .Values.replicaCount }}
-  rollingUpdate:
-    maxSurge: {{ .Values.rollingUpdate.maxSurge }}
-    maxUnavailable: {{ .Values.rollingUpdate.maxUnavailable }}
+  strategy:
+    rollingUpdate:
+      maxSurge: {{ .Values.rollingUpdate.maxSurge }}
+      maxUnavailable: {{ .Values.rollingUpdate.maxUnavailable }}
   selector:
     matchLabels:
       app.kubernetes.io/name: {{ include "helm.name" . }}
@@ -45,9 +46,9 @@ spec:
             httpGet:
               path: /actuator/health
               port: 8080
-              initialDelaySeconds: {{ .Values.readinessProbe.initialDelaySeconds }}
-              periodSeconds: {{ .Values.readinessProbe.periodSeconds }}
-              successThreshold: {{ .Values.readinessProbe.successThreshold }}
+            initialDelaySeconds: {{ .Values.readinessProbe.initialDelaySeconds }}
+            periodSeconds: {{ .Values.readinessProbe.periodSeconds }}
+            successThreshold: {{ .Values.readinessProbe.successThreshold }}
           resources:
             {{- toYaml .Values.resources | nindent 12 }}
       {{- with .Values.nodeSelector }}
diff --git a/custos-core-services/sharing-core-service/src/main/java/org/apache/custos/sharing/persistance/model/Sharing.java b/custos-core-services/sharing-core-service/src/main/java/org/apache/custos/sharing/persistance/model/Sharing.java
index 566da2e16..67ac600db 100644
--- a/custos-core-services/sharing-core-service/src/main/java/org/apache/custos/sharing/persistance/model/Sharing.java
+++ b/custos-core-services/sharing-core-service/src/main/java/org/apache/custos/sharing/persistance/model/Sharing.java
@@ -33,6 +33,7 @@
 public class Sharing {
 
     @Id
+    @Column(length = 1000)
     private String id;
 
     @Column(nullable = false)
diff --git a/custos-core-services/sharing-core-service/src/main/resources/application.properties b/custos-core-services/sharing-core-service/src/main/resources/application.properties
index bc2eb606b..01df48fed 100644
--- a/custos-core-services/sharing-core-service/src/main/resources/application.properties
+++ b/custos-core-services/sharing-core-service/src/main/resources/application.properties
@@ -27,7 +27,7 @@ management.security.enabled=false
 management.endpoints.web.exposure.include=*
 management.endpoint.metrics.enabled=true
 
-spring.datasource.url = jdbc:mysql://mysql.custos.svc.cluster.local:3306/core_sharing?useSSL=false&serverTimezone=UTC&useLegacyDatetimeCode=false
+spring.datasource.url = jdbc:mysql://mysql-primary.custos.svc.cluster.local:3306/core_sharing?useSSL=false&serverTimezone=UTC&useLegacyDatetimeCode=false
 spring.datasource.username = root
 spring.datasource.password = root
 
diff --git a/custos-core-services/tenant-profile-core-service/pom.xml b/custos-core-services/tenant-profile-core-service/pom.xml
index 31efefc84..3e9eca768 100644
--- a/custos-core-services/tenant-profile-core-service/pom.xml
+++ b/custos-core-services/tenant-profile-core-service/pom.xml
@@ -98,6 +98,7 @@
           <artifactId>persistence-api</artifactId>
       </dependency>
 
+
   </dependencies>
 
 
@@ -117,6 +118,13 @@
                     <skip>false</skip>
                 </configuration>
             </plugin>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-antrun-plugin</artifactId>
+                <configuration>
+                    <skip>false</skip>
+                </configuration>
+            </plugin>
         </plugins>
     </build>
 </project>
\ No newline at end of file
diff --git a/custos-core-services/tenant-profile-core-service/src/main/helm/templates/deployment.yaml b/custos-core-services/tenant-profile-core-service/src/main/helm/templates/deployment.yaml
index 31e54a6fc..74401f2c4 100644
--- a/custos-core-services/tenant-profile-core-service/src/main/helm/templates/deployment.yaml
+++ b/custos-core-services/tenant-profile-core-service/src/main/helm/templates/deployment.yaml
@@ -6,9 +6,10 @@ metadata:
 {{ include "helm.labels" . | indent 4 }}
 spec:
   replicas: {{ .Values.replicaCount }}
-  rollingUpdate:
-    maxSurge: {{ .Values.rollingUpdate.maxSurge }}
-    maxUnavailable: {{ .Values.rollingUpdate.maxUnavailable }}
+  strategy:
+    rollingUpdate:
+      maxSurge: {{ .Values.rollingUpdate.maxSurge }}
+      maxUnavailable: {{ .Values.rollingUpdate.maxUnavailable }}
   selector:
     matchLabels:
       app.kubernetes.io/name: {{ include "helm.name" . }}
@@ -45,9 +46,9 @@ spec:
             httpGet:
               path: /actuator/health
               port: 8080
-              initialDelaySeconds: {{ .Values.readinessProbe.initialDelaySeconds }}
-              periodSeconds: {{ .Values.readinessProbe.periodSeconds }}
-              successThreshold: {{ .Values.readinessProbe.successThreshold }}
+            initialDelaySeconds: {{ .Values.readinessProbe.initialDelaySeconds }}
+            periodSeconds: {{ .Values.readinessProbe.periodSeconds }}
+            successThreshold: {{ .Values.readinessProbe.successThreshold }}
           resources:
             {{- toYaml .Values.resources | nindent 12 }}
       {{- with .Values.nodeSelector }}
diff --git a/custos-core-services/tenant-profile-core-service/src/main/java/org/apache/custos/tenant/profile/persistance/respository/SearchTenantRepository.java b/custos-core-services/tenant-profile-core-service/src/main/java/org/apache/custos/tenant/profile/persistance/respository/SearchTenantRepository.java
new file mode 100644
index 000000000..ec4e7f148
--- /dev/null
+++ b/custos-core-services/tenant-profile-core-service/src/main/java/org/apache/custos/tenant/profile/persistance/respository/SearchTenantRepository.java
@@ -0,0 +1,31 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing,
+ *  software distributed under the License is distributed on an
+ *  "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ *  KIND, either express or implied. See the License for the
+ *  specific language governing permissions and limitations
+ *  under the License.
+ */
+
+package org.apache.custos.tenant.profile.persistance.respository;
+
+
+import org.apache.custos.tenant.profile.persistance.model.Tenant;
+
+import java.util.List;
+
+public interface SearchTenantRepository {
+
+
+    List<Tenant> searchTenants(String requestEmail, String status, long parentId, int limit, int offset);
+}
diff --git a/custos-core-services/tenant-profile-core-service/src/main/java/org/apache/custos/tenant/profile/persistance/respository/SearchTenantRepositoryImpl.java b/custos-core-services/tenant-profile-core-service/src/main/java/org/apache/custos/tenant/profile/persistance/respository/SearchTenantRepositoryImpl.java
new file mode 100644
index 000000000..47f684026
--- /dev/null
+++ b/custos-core-services/tenant-profile-core-service/src/main/java/org/apache/custos/tenant/profile/persistance/respository/SearchTenantRepositoryImpl.java
@@ -0,0 +1,88 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing,
+ *  software distributed under the License is distributed on an
+ *  "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ *  KIND, either express or implied. See the License for the
+ *  specific language governing permissions and limitations
+ *  under the License.
+ */
+
+package org.apache.custos.tenant.profile.persistance.respository;
+
+import org.apache.custos.tenant.profile.persistance.model.Tenant;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.stereotype.Repository;
+
+import javax.persistence.EntityManager;
+import javax.persistence.PersistenceContext;
+import javax.persistence.Query;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+
+@Repository
+public class SearchTenantRepositoryImpl implements SearchTenantRepository {
+
+    private static final Logger LOGGER = LoggerFactory.getLogger(SearchTenantRepositoryImpl.class);
+
+    @PersistenceContext
+    EntityManager entityManager;
+
+    @Override
+    public List<Tenant> searchTenants(String requestEmail, String status, long parentId, int limit, int offset) {
+        Map<String, Object> valueMap = new HashMap<>();
+        String query = createSQLQuery(requestEmail, status, parentId, limit, offset, valueMap);
+
+        Query q = entityManager.createNativeQuery(query, Tenant.class);
+        for (String key : valueMap.keySet()) {
+            q.setParameter(key, valueMap.get(key));
+        }
+
+        return q.getResultList();
+    }
+
+
+    private String createSQLQuery(String requestEmail, String status, long parentId, int limit, int offset,
+                                  Map<String, Object> valueMap) {
+        String query = "SELECT * FROM tenant E WHERE ";
+
+        if (requestEmail != null) {
+            query = query + "E.requester_email = :" + "requester_email" + " AND ";
+            valueMap.put("requester_email", requestEmail);
+        }
+
+        if (status != null) {
+            query = query + "E.status LIKE :" + "status" + " AND ";
+            valueMap.put("status", status);
+        }
+
+        if (parentId > 0) {
+            query = query + "E.parent_id = :" + "parent_id" + " AND ";
+            valueMap.put("parent_id", parentId);
+        }
+
+        query = query.substring(0, query.length() - 5);
+
+        query = query + " ORDER BY E.created_at DESC";
+        if (offset > 0 & limit > 0) {
+            query = query + " LIMIT " + ":limit" + " OFFSET " + ":offset";
+            valueMap.put("limit", limit);
+            valueMap.put("offset", offset);
+        }
+
+        return query;
+    }
+
+
+}
diff --git a/custos-core-services/tenant-profile-core-service/src/main/java/org/apache/custos/tenant/profile/persistance/respository/TenantRepository.java b/custos-core-services/tenant-profile-core-service/src/main/java/org/apache/custos/tenant/profile/persistance/respository/TenantRepository.java
index 0f0a48bb6..c84a3d528 100644
--- a/custos-core-services/tenant-profile-core-service/src/main/java/org/apache/custos/tenant/profile/persistance/respository/TenantRepository.java
+++ b/custos-core-services/tenant-profile-core-service/src/main/java/org/apache/custos/tenant/profile/persistance/respository/TenantRepository.java
@@ -25,10 +25,12 @@
 
 import java.util.List;
 
-public interface TenantRepository extends JpaRepository<Tenant, Long> {
+public interface TenantRepository extends JpaRepository<Tenant, Long>, SearchTenantRepository {
 
     public List<Tenant> findByRequesterEmail(String requesterEmail);
 
+    public List<Tenant> findByRequesterEmailAndStatus(String requesterEmail, String status);
+
     public List<Tenant> findByDomainAndName(String domain, String name);
 
     @Query(value = "select * from tenant t where t.status LIKE ?1 order by t.id limit ?2 offset ?3", nativeQuery = true)
diff --git a/custos-core-services/tenant-profile-core-service/src/main/java/org/apache/custos/tenant/profile/service/TenantProfileService.java b/custos-core-services/tenant-profile-core-service/src/main/java/org/apache/custos/tenant/profile/service/TenantProfileService.java
index defb7a24d..f3081eddf 100644
--- a/custos-core-services/tenant-profile-core-service/src/main/java/org/apache/custos/tenant/profile/service/TenantProfileService.java
+++ b/custos-core-services/tenant-profile-core-service/src/main/java/org/apache/custos/tenant/profile/service/TenantProfileService.java
@@ -125,12 +125,12 @@ public void updateTenant(org.apache.custos.tenant.profile.service.Tenant tenant,
 
             //Do not update the tenant status
 
-            if (tenantEntity.getParentId() > 0) {
-
-                tenantEntity.setStatus(exTenant.getStatus());
-            } else {
-                tenantEntity.setStatus(TenantStatus.REQUESTED.name());
-            }
+//            if (tenantEntity.getParentId() > 0) {
+//
+//                tenantEntity.setStatus(exTenant.getStatus());
+//            } else {
+//                tenantEntity.setStatus(TenantStatus.REQUESTED.name());
+//            }
 
             tenantEntity.setCreatedAt(exTenant.getCreatedAt());
 
@@ -164,7 +164,7 @@ public void getAllTenants(GetTenantsRequest request, StreamObserver<GetAllTenant
 
             String status = null;
 
-            if (request.getStatus() != null && !request.getStatus().name().equals("")){
+            if (request.getStatus() != null && !request.getStatus().name().equals("")) {
                 status = request.getStatus().name();
             }
 
@@ -175,19 +175,24 @@ public void getAllTenants(GetTenantsRequest request, StreamObserver<GetAllTenant
             String requesterEmail = request.getRequesterEmail();
 
             List<Tenant> tenants = null;
+            List<Tenant> total_tenants = null;
+
+//            if (status == null && requesterEmail != null && !requesterEmail.equals("")) {
+//              tenants = tenantRepository.findByRequesterEmail(requesterEmail);
+//            } else if(status != null && requesterEmail != null && !requesterEmail.equals("")) {
+//                tenants = tenantRepository.findByRequesterEmailAndStatus(requesterEmail, status);
+//            } else if (status == null && parentId == 0) {
+//                tenants = tenantRepository.getAllWithPaginate(limit,offset);
+//            } else if (status != null && parentId == 0){
+//                tenants = tenantRepository.findByStatusWithPaginate(status,limit,offset);
+//            } else if (status == null && parentId > 0) {
+//                tenants = tenantRepository.getAllChildTenantsWithPaginate(parentId,limit,offset);
+//            } else if (status != null && parentId >0 ) {
+//                tenants = tenantRepository.findChildTenantsByStatusWithPaginate(status,parentId,limit,offset);
+//            }
 
-            if (requesterEmail != null && !requesterEmail.equals("")) {
-              tenants = tenantRepository.findByRequesterEmail(requesterEmail);
-            } else if (status == null && parentId == 0) {
-                tenants = tenantRepository.getAllWithPaginate(limit,offset);
-            } else if (status != null && parentId == 0){
-                tenants = tenantRepository.findByStatusWithPaginate(status,limit,offset);
-            } else if (status == null && parentId > 0) {
-                tenants = tenantRepository.getAllChildTenantsWithPaginate(parentId,limit,offset);
-            } else if (status != null && parentId >0 ) {
-                tenants = tenantRepository.findChildTenantsByStatusWithPaginate(status,parentId,limit,offset);
-            }
-
+            tenants = tenantRepository.searchTenants(requesterEmail, status, parentId, limit, offset);
+            total_tenants = tenantRepository.searchTenants(requesterEmail, status, parentId, -1, -1);
 
             List<org.apache.custos.tenant.profile.service.Tenant> tenantList = new ArrayList<>();
 
@@ -196,7 +201,10 @@ public void getAllTenants(GetTenantsRequest request, StreamObserver<GetAllTenant
                 tenantList.add(t);
             }
 
-            GetAllTenantsResponse response = GetAllTenantsResponse.newBuilder().addAllTenant(tenantList).build();
+            GetAllTenantsResponse response = GetAllTenantsResponse
+                    .newBuilder()
+                    .setTotalNumOfTenants(total_tenants.size())
+                    .addAllTenant(tenantList).build();
             responseObserver.onNext(response);
             responseObserver.onCompleted();
 
diff --git a/custos-core-services/tenant-profile-core-service/src/main/java/org/apache/custos/tenant/profile/validator/InputValidator.java b/custos-core-services/tenant-profile-core-service/src/main/java/org/apache/custos/tenant/profile/validator/InputValidator.java
index 2949b9851..5e99319df 100644
--- a/custos-core-services/tenant-profile-core-service/src/main/java/org/apache/custos/tenant/profile/validator/InputValidator.java
+++ b/custos-core-services/tenant-profile-core-service/src/main/java/org/apache/custos/tenant/profile/validator/InputValidator.java
@@ -156,10 +156,6 @@ private boolean validateUpdateTenant(Object obj) {
                 throw new MissingParameterException(" Admin username should not be null", null);
             }
 
-            if (tenant.getAdminPassword() == null || tenant.getAdminPassword().trim() == "") {
-                throw new MissingParameterException(" Admin password should not be null", null);
-            }
-
             if (tenant.getRequesterEmail() == null || tenant.getRequesterEmail().trim() == "") {
                 throw new MissingParameterException("Tenant requester email  should not be null", null);
             }
diff --git a/custos-core-services/tenant-profile-core-service/src/main/proto/TenantProfileService.proto b/custos-core-services/tenant-profile-core-service/src/main/proto/TenantProfileService.proto
index af4f291e3..6073bfc07 100644
--- a/custos-core-services/tenant-profile-core-service/src/main/proto/TenantProfileService.proto
+++ b/custos-core-services/tenant-profile-core-service/src/main/proto/TenantProfileService.proto
@@ -64,21 +64,21 @@ enum TenantStatus {
 }
 
 message TenantAttributeUpdateMetadata {
-    string updatedAttribute = 1;
-    string updatedAttributeValue = 2;
-    string updatedBy = 3;
-    string updatedAt = 4;
+    string updated_attribute = 1;
+    string updated_attributeValue = 2;
+    string updated_by = 3;
+    string updated_at = 4;
 }
 
 message TenantStatusUpdateMetadata {
-    TenantStatus updatedStatus = 1;
-    string updatedBy = 2;
-    string updatedAt = 3;
+    TenantStatus updated_status = 1;
+    string updated_by = 2;
+    string updated_at = 3;
 }
 
 
 message AddTenantResponse {
-    int64 tenantId = 1;
+    int64 tenant_id = 1;
 }
 
 
@@ -88,7 +88,7 @@ message UpdateTenantResponse {
 }
 
 message GetTenantRequest {
-    int64 tenantId = 1;
+    int64 tenant_id = 1;
 }
 
 message GetTenantResponse {
@@ -98,18 +98,19 @@ message GetTenantResponse {
 
 message GetAllTenantsResponse {
     repeated Tenant tenant = 1;
+    int32 total_num_of_tenants =2;
 }
 
 message IsTenantExistRequest {
-    int64 tenantId = 1;
+    int64 tenant_id = 1;
 }
 
 message IsTenantExistResponse {
-    bool isExist = 1;
+    bool is_exist = 1;
 }
 
 message GetAllTenantsForUserRequest {
-    string requesterEmail = 1;
+    string requester_email = 1;
 }
 
 message GetAllTenantsForUserResponse {
@@ -119,19 +120,19 @@ message GetAllTenantsForUserResponse {
 message UpdateStatusRequest {
     string client_id = 1;
     TenantStatus status = 2;
-    string updatedBy = 3;
-    int64 tenantId = 4;
+    string updated_by = 3;
+    int64 tenant_id = 4;
     bool super_tenant = 5;
-    string accessToken = 6;
+    string access_token = 6;
 }
 
 message UpdateStatusResponse {
-    int64 tenantId = 1;
+    int64 tenant_id = 1;
     TenantStatus status = 2;
 }
 
 message GetAuditTrailRequest {
-    int64 tenantId = 1;
+    int64 tenant_id = 1;
 }
 
 message GetStatusUpdateAuditTrailResponse {
@@ -148,6 +149,7 @@ message GetTenantsRequest {
  int64 parent_id = 3;
  TenantStatus status = 4;
  string requester_email = 5;
+ string parent_client_id = 6;
 }
 
 service TenantProfileService {
diff --git a/custos-core-services/tenant-profile-core-service/src/main/resources/application.properties b/custos-core-services/tenant-profile-core-service/src/main/resources/application.properties
index af475b50b..af49ec2fa 100644
--- a/custos-core-services/tenant-profile-core-service/src/main/resources/application.properties
+++ b/custos-core-services/tenant-profile-core-service/src/main/resources/application.properties
@@ -27,7 +27,7 @@ management.security.enabled=false
 management.endpoints.web.exposure.include=*
 management.endpoint.metrics.enabled=true
 
-spring.datasource.url = jdbc:mysql://mysql.custos.svc.cluster.local:3306/core_tenant?useSSL=false&serverTimezone=UTC&useLegacyDatetimeCode=false
+spring.datasource.url = jdbc:mysql://mysql-primary.custos.svc.cluster.local:3306/core_tenant?useSSL=false&serverTimezone=UTC&useLegacyDatetimeCode=false
 spring.datasource.username = root
 spring.datasource.password = root
 
diff --git a/custos-core-services/user-profile-core-service/pom.xml b/custos-core-services/user-profile-core-service/pom.xml
index 9aef3344b..02cdadd31 100644
--- a/custos-core-services/user-profile-core-service/pom.xml
+++ b/custos-core-services/user-profile-core-service/pom.xml
@@ -96,6 +96,7 @@
             <artifactId>persistence-api</artifactId>
         </dependency>
 
+
     </dependencies>
 
 
@@ -115,6 +116,13 @@
                     <skip>false</skip>
                 </configuration>
             </plugin>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-antrun-plugin</artifactId>
+                <configuration>
+                    <skip>false</skip>
+                </configuration>
+            </plugin>
         </plugins>
     </build>
 
diff --git a/custos-core-services/user-profile-core-service/src/main/helm/templates/deployment.yaml b/custos-core-services/user-profile-core-service/src/main/helm/templates/deployment.yaml
index 31e54a6fc..74401f2c4 100644
--- a/custos-core-services/user-profile-core-service/src/main/helm/templates/deployment.yaml
+++ b/custos-core-services/user-profile-core-service/src/main/helm/templates/deployment.yaml
@@ -6,9 +6,10 @@ metadata:
 {{ include "helm.labels" . | indent 4 }}
 spec:
   replicas: {{ .Values.replicaCount }}
-  rollingUpdate:
-    maxSurge: {{ .Values.rollingUpdate.maxSurge }}
-    maxUnavailable: {{ .Values.rollingUpdate.maxUnavailable }}
+  strategy:
+    rollingUpdate:
+      maxSurge: {{ .Values.rollingUpdate.maxSurge }}
+      maxUnavailable: {{ .Values.rollingUpdate.maxUnavailable }}
   selector:
     matchLabels:
       app.kubernetes.io/name: {{ include "helm.name" . }}
@@ -45,9 +46,9 @@ spec:
             httpGet:
               path: /actuator/health
               port: 8080
-              initialDelaySeconds: {{ .Values.readinessProbe.initialDelaySeconds }}
-              periodSeconds: {{ .Values.readinessProbe.periodSeconds }}
-              successThreshold: {{ .Values.readinessProbe.successThreshold }}
+            initialDelaySeconds: {{ .Values.readinessProbe.initialDelaySeconds }}
+            periodSeconds: {{ .Values.readinessProbe.periodSeconds }}
+            successThreshold: {{ .Values.readinessProbe.successThreshold }}
           resources:
             {{- toYaml .Values.resources | nindent 12 }}
       {{- with .Values.nodeSelector }}
diff --git a/custos-core-services/user-profile-core-service/src/main/java/org/apache/custos/user/profile/persistance/repository/GroupRepository.java b/custos-core-services/user-profile-core-service/src/main/java/org/apache/custos/user/profile/persistance/repository/GroupRepository.java
index d7a534cb4..1c03ae303 100644
--- a/custos-core-services/user-profile-core-service/src/main/java/org/apache/custos/user/profile/persistance/repository/GroupRepository.java
+++ b/custos-core-services/user-profile-core-service/src/main/java/org/apache/custos/user/profile/persistance/repository/GroupRepository.java
@@ -24,8 +24,10 @@
 
 import java.util.List;
 
-public interface GroupRepository extends JpaRepository<Group, String> {
+public interface GroupRepository extends JpaRepository<Group, String>, SearchGroupsRepository {
 
 
     public List<Group> findByParentId(String s);
+
+    public List<Group> findAllByTenantId(long tenantId);
 }
diff --git a/custos-core-services/user-profile-core-service/src/main/java/org/apache/custos/user/profile/persistance/repository/SearchGroupsRepository.java b/custos-core-services/user-profile-core-service/src/main/java/org/apache/custos/user/profile/persistance/repository/SearchGroupsRepository.java
new file mode 100644
index 000000000..d2a798bf3
--- /dev/null
+++ b/custos-core-services/user-profile-core-service/src/main/java/org/apache/custos/user/profile/persistance/repository/SearchGroupsRepository.java
@@ -0,0 +1,29 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing,
+ *  software distributed under the License is distributed on an
+ *  "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ *  KIND, either express or implied. See the License for the
+ *  specific language governing permissions and limitations
+ *  under the License.
+ */
+
+package org.apache.custos.user.profile.persistance.repository;
+
+import org.apache.custos.user.profile.persistance.model.Group;
+
+import java.util.List;
+
+public interface SearchGroupsRepository {
+
+    List<Group> searchEntities(long tenantId, org.apache.custos.user.profile.service.Group group);
+}
diff --git a/custos-core-services/user-profile-core-service/src/main/java/org/apache/custos/user/profile/persistance/repository/SearchGroupsRepositoryImpl.java b/custos-core-services/user-profile-core-service/src/main/java/org/apache/custos/user/profile/persistance/repository/SearchGroupsRepositoryImpl.java
new file mode 100644
index 000000000..32362503a
--- /dev/null
+++ b/custos-core-services/user-profile-core-service/src/main/java/org/apache/custos/user/profile/persistance/repository/SearchGroupsRepositoryImpl.java
@@ -0,0 +1,113 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing,
+ *  software distributed under the License is distributed on an
+ *  "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ *  KIND, either express or implied. See the License for the
+ *  specific language governing permissions and limitations
+ *  under the License.
+ */
+
+package org.apache.custos.user.profile.persistance.repository;
+
+import org.apache.custos.user.profile.persistance.model.Group;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.stereotype.Repository;
+
+import javax.persistence.EntityManager;
+import javax.persistence.PersistenceContext;
+import javax.persistence.Query;
+import java.util.Date;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+
+@Repository
+public class SearchGroupsRepositoryImpl implements SearchGroupsRepository {
+
+    private static final Logger LOGGER = LoggerFactory.getLogger(SearchGroupsRepositoryImpl.class);
+
+    @PersistenceContext
+    EntityManager entityManager;
+
+    @Override
+    public List<Group> searchEntities(long tenantId, org.apache.custos.user.profile.service.Group group) {
+        Map<String, Object> valueMap = new HashMap<>();
+        String query = createSQLQuery(tenantId, group, valueMap);
+
+
+        Query q = entityManager.createNativeQuery(query, Group.class);
+        for (String key : valueMap.keySet()) {
+            q.setParameter(key, valueMap.get(key));
+        }
+
+        return q.getResultList();
+    }
+
+    private String createSQLQuery(long tenantId, org.apache.custos.user.profile.service.Group group, Map<String, Object> valueMap) {
+
+        String query = "SELECT * FROM group_entity E WHERE ";
+
+        if (!group.getName().isBlank()) {
+
+            query = query + "E.name  LIKE :" + "name" + " AND ";
+
+            valueMap.put("name", group.getName());
+        }
+
+        if (!group.getDescription().isBlank()) {
+
+            query = query + "E.description LIKE :" + "description" + " AND ";
+
+            valueMap.put("description", group.getDescription());
+        }
+
+        if (!group.getId().isBlank()) {
+            query = query + "E.external_id = :" + "external_id" + " AND ";
+
+            valueMap.put("external_id", group.getId());
+        }
+
+
+        if (group.getCreatedTime() != 0) {
+
+            Date date = new Date(group.getCreatedTime());
+
+            query = query + "E.created_at >= :" + "created_at" + " AND ";
+
+            valueMap.put("created_at", date);
+        }
+
+        if (group.getLastModifiedTime() != 0) {
+            Date date = new Date(group.getLastModifiedTime());
+            query = query + "E.last_modified_at >= :" + "last_modified_at" + " AND ";
+
+            valueMap.put("last_modified_at", date);
+        }
+        if (tenantId != 0) {
+
+            query = query + "E.tenant_id = :" + "tenant_id" + " AND ";
+
+            valueMap.put("tenant_id", tenantId);
+        }
+
+
+        query = query.substring(0, query.length() - 5);
+
+        query = query + " ORDER BY E.created_at DESC";
+
+        return query;
+    }
+
+
+}
diff --git a/custos-core-services/user-profile-core-service/src/main/java/org/apache/custos/user/profile/service/UserProfileService.java b/custos-core-services/user-profile-core-service/src/main/java/org/apache/custos/user/profile/service/UserProfileService.java
index 16490e3a3..c39af1b77 100644
--- a/custos-core-services/user-profile-core-service/src/main/java/org/apache/custos/user/profile/service/UserProfileService.java
+++ b/custos-core-services/user-profile-core-service/src/main/java/org/apache/custos/user/profile/service/UserProfileService.java
@@ -467,7 +467,7 @@ public void createGroup(GroupRequest request, StreamObserver<Group> responseObse
                 userGroupMembership.setUserGroupMembershipType(exist);
                 groupMembershipRepository.save(userGroupMembership);
 
-                Group exGroup = GroupMapper.createGroup(exOP.get(), ownerId);
+                Group exGroup = GroupMapper.createGroup(exOP.get(), userGroupMembership.getUserProfile().getUsername());
                 responseObserver.onNext(exGroup);
                 responseObserver.onCompleted();
             } else {
@@ -675,11 +675,17 @@ public void getAllGroups(GroupRequest request, StreamObserver<GetAllGroupsRespon
         try {
             LOGGER.debug("Request received to getAllGroups for " + request.getTenantId());
 
-            List<org.apache.custos.user.profile.persistance.model.Group> groups = groupRepository.findAll();
+            List<org.apache.custos.user.profile.persistance.model.Group> groups = groupRepository
+                    .searchEntities(request.getTenantId(), request.getGroup());
+            if (groups == null || groups.isEmpty()) {
+                groups = groupRepository.
+                        findAllByTenantId(request.getTenantId());
+
+            }
 
             List<Group> groupList = new ArrayList<>();
 
-            if (groups != null && groups.isEmpty()) {
+            if (groups != null && !groups.isEmpty()) {
                 for (org.apache.custos.user.profile.persistance.model.Group group : groups) {
 
                     List<UserGroupMembership> userGroupMemberships = groupMembershipRepository.findAllByGroupId(group.getId());
@@ -688,8 +694,10 @@ public void getAllGroups(GroupRequest request, StreamObserver<GetAllGroupsRespon
                     for (UserGroupMembership userGroupMembership : userGroupMemberships) {
                         if (userGroupMembership.getUserGroupMembershipType().getId().equals(DefaultGroupMembershipTypes.OWNER.name())) {
                             ownerId = userGroupMembership.getUserProfile().getUsername();
+                            break;
                         }
                     }
+
                     Group gr = GroupMapper.createGroup(group, ownerId);
 
                     groupList.add(gr);
diff --git a/custos-core-services/user-profile-core-service/src/main/proto/UserProfileService.proto b/custos-core-services/user-profile-core-service/src/main/proto/UserProfileService.proto
index d4c9c56cb..fb840ade3 100644
--- a/custos-core-services/user-profile-core-service/src/main/proto/UserProfileService.proto
+++ b/custos-core-services/user-profile-core-service/src/main/proto/UserProfileService.proto
@@ -71,8 +71,8 @@ message UserProfile {
 message UserProfileRequest {
     int64 tenantId = 1;
     UserProfile profile = 2;
-    string performedBy = 3;
-    string clientId = 4;
+    string performed_by = 3;
+    string client_id = 4;
 }
 
 
@@ -93,29 +93,31 @@ message GetUpdateAuditTrailRequest {
 }
 
 message UserProfileAttributeUpdateMetadata {
-    string updatedAttribute = 1;
-    string updatedAttributeValue = 2;
-    string updatedBy = 3;
-    string updatedAt = 4;
+    string updated_attribute = 1;
+    string updated_attribute_value = 2;
+    string updated_by = 3;
+    string updated_at = 4;
 }
 
 message UserProfileStatusUpdateMetadata {
-    UserStatus updatedStatus = 1;
-    string updatedBy = 2;
-    string updatedAt = 3;
+    UserStatus updated_status = 1;
+    string updated_by = 2;
+    string updated_at = 3;
 }
 
 message GetUpdateAuditTrailResponse {
-    repeated UserProfileAttributeUpdateMetadata attributeAudit = 1;
-    repeated UserProfileStatusUpdateMetadata statusAudit = 2;
+    repeated UserProfileAttributeUpdateMetadata attribute_audit = 1;
+    repeated UserProfileStatusUpdateMetadata status_audit = 2;
 }
 
 message GroupRequest {
-    int64 tenantId = 1;
+    int64 tenant_id = 1;
     Group group = 2;
-    string performedBy = 3;
-    string clientId = 4;
+    string performed_by = 3;
+    string client_id = 4;
     DefaultGroupMembershipTypes membership_type = 5;
+    string id = 6;
+    string client_sec =7;
 
 }
 
@@ -142,15 +144,16 @@ message GroupAttribute {
 }
 
 message GroupMembership {
-    int64 tenantId = 1;
+    int64 tenant_id = 1;
     string group_id = 2;
     string username = 3;
     string type = 4;
     string clientId = 5;
+    string clientSec = 6;
 }
 
 message GroupToGroupMembership {
-    int64 tenantId = 1;
+    int64 tenant_id = 1;
     string parent_id = 2;
     string child_id = 3;
     string client_id = 4;
@@ -162,6 +165,8 @@ message Status {
 
 message UserGroupMembershipTypeRequest {
     string type = 1;
+    int64 tenant_id = 2;
+    string client_id = 3;
 }
 
 
diff --git a/custos-core-services/user-profile-core-service/src/main/resources/application.properties b/custos-core-services/user-profile-core-service/src/main/resources/application.properties
index c045435ce..969557c58 100644
--- a/custos-core-services/user-profile-core-service/src/main/resources/application.properties
+++ b/custos-core-services/user-profile-core-service/src/main/resources/application.properties
@@ -27,7 +27,7 @@ management.security.enabled=false
 management.endpoints.web.exposure.include=*
 management.endpoint.metrics.enabled=true
 
-spring.datasource.url = jdbc:mysql://mysql.custos.svc.cluster.local:3306/core_user_profile?useSSL=false&serverTimezone=UTC&useLegacyDatetimeCode=false
+spring.datasource.url = jdbc:mysql://mysql-primary.custos.svc.cluster.local:3306/core_user_profile?useSSL=false&serverTimezone=UTC&useLegacyDatetimeCode=false
 spring.datasource.username = root
 spring.datasource.password = root
 
diff --git a/custos-core-services/utility-services/custos-configuration-service/pom.xml b/custos-core-services/utility-services/custos-configuration-service/pom.xml
index 6b0446dbc..c76630031 100644
--- a/custos-core-services/utility-services/custos-configuration-service/pom.xml
+++ b/custos-core-services/utility-services/custos-configuration-service/pom.xml
@@ -42,6 +42,7 @@
             <groupId>org.springframework.cloud</groupId>
             <artifactId>spring-cloud-config-server</artifactId>
         </dependency>
+
     </dependencies>
     <build>
         <plugins>
@@ -59,6 +60,29 @@
                     <skip>false</skip>
                 </configuration>
             </plugin>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-antrun-plugin</artifactId>
+                <configuration>
+                    <target>
+                        <!-- keyfile+passphrase or  password, choose one -->
+                        <!--
+                        <scp localFile="${project.basedir}/target/qos-spark-1.0.jar"
+                          remoteToFile="root@192.168.203.156:/usr/sanss" verbose="true"
+                          keyfile="C:\Users\shengw\.ssh\192.168.203.156\id_rsa"
+                          passphrase="">
+                        </scp>
+                         -->
+                        <scp localFile="${project.basedir}/target/helm/${project.artifactId}-${project.version}.tgz"
+                             remoteToFile="ubuntu@${host}:/home/ubuntu/custos/artifacts"
+                             verbose="true"
+                             keyfile="/Users/isururanawaka/.ssh/custos/id_rsa"
+                             passphrase="isjarana" trust="true">
+                        </scp>
+                    </target>
+                    <skip>true</skip>
+                </configuration>
+            </plugin>
         </plugins>
     </build>
 </project>
\ No newline at end of file
diff --git a/custos-core-services/utility-services/custos-configuration-service/src/main/helm/templates/deployment.yaml b/custos-core-services/utility-services/custos-configuration-service/src/main/helm/templates/deployment.yaml
index a040bc03f..b5440d0ea 100644
--- a/custos-core-services/utility-services/custos-configuration-service/src/main/helm/templates/deployment.yaml
+++ b/custos-core-services/utility-services/custos-configuration-service/src/main/helm/templates/deployment.yaml
@@ -6,9 +6,10 @@ metadata:
 {{ include "helm.labels" . | indent 4 }}
 spec:
   replicas: {{ .Values.replicaCount }}
-  rollingUpdate:
-    maxSurge: {{ .Values.rollingUpdate.maxSurge }}
-    maxUnavailable: {{ .Values.rollingUpdate.maxUnavailable }}
+  strategy:
+    rollingUpdate:
+      maxSurge: {{ .Values.rollingUpdate.maxSurge }}
+      maxUnavailable: {{ .Values.rollingUpdate.maxUnavailable }}
   selector:
     matchLabels:
       app.kubernetes.io/name: {{ include "helm.name" . }}
@@ -42,9 +43,9 @@ spec:
             httpGet:
               path: /actuator/health
               port: 9000
-              initialDelaySeconds: {{ .Values.readinessProbe.initialDelaySeconds }}
-              periodSeconds: {{ .Values.readinessProbe.periodSeconds }}
-              successThreshold: {{ .Values.readinessProbe.successThreshold }}
+            initialDelaySeconds: {{ .Values.readinessProbe.initialDelaySeconds }}
+            periodSeconds: {{ .Values.readinessProbe.periodSeconds }}
+            successThreshold: {{ .Values.readinessProbe.successThreshold }}
           resources:
             {{- toYaml .Values.resources | nindent 12 }}
       {{- with .Values.nodeSelector }}
diff --git a/custos-core-services/utility-services/custos-configuration-service/src/main/resources/federatedAuthenticationCoreService.properties b/custos-core-services/utility-services/custos-configuration-service/src/main/resources/federatedAuthenticationCoreService.properties
index dac040a7f..491f1b0f9 100644
--- a/custos-core-services/utility-services/custos-configuration-service/src/main/resources/federatedAuthenticationCoreService.properties
+++ b/custos-core-services/utility-services/custos-configuration-service/src/main/resources/federatedAuthenticationCoreService.properties
@@ -1,3 +1,3 @@
-ciLogon.admin.client.id=XXXXX
-ciLogon.admin.client.secret=XXXX
+ciLogon.admin.client.id={{clilogon_id}}
+ciLogon.admin.client.secret={{clilogon_sec}}
 ciLogon.admin.auth.endpoint=https://test.cilogon.org/oauth2/oidc-cm
\ No newline at end of file
diff --git a/custos-core-services/utility-services/custos-configuration-service/src/main/resources/iamAdminCoreService.properties b/custos-core-services/utility-services/custos-configuration-service/src/main/resources/iamAdminCoreService.properties
index 5f7b569de..7185e0cd7 100644
--- a/custos-core-services/utility-services/custos-configuration-service/src/main/resources/iamAdminCoreService.properties
+++ b/custos-core-services/utility-services/custos-configuration-service/src/main/resources/iamAdminCoreService.properties
@@ -2,8 +2,8 @@ iam.server.client.id=admin-cli
 iam.server.truststore.path=/home/ubuntu/keystore/keycloak-client-truststore.pkcs12
 iam.server.truststore.password=keycloak
 iam.server.url=https://keycloak.custos.scigap.org:31000/auth/
-iam.server.admin.username=XXXXXX
-iam.server.admin.password=XXXXXX
+iam.server.admin.username={{iam_id}}
+iam.server.admin.password={{iam_sec}}
 iam.server.super.admin.realm.id=master
 iam.federated.cilogon.authorization.endpoint=https://cilogon.org/authorize
 iam.federated.cilogon.token.endpoint=https://cilogon.org/oauth2/token
@@ -18,6 +18,6 @@ end.session.endpoint=https://custos.scigap.org/apiserver/identity-management/v1.
 user.info.endpoint=https://custos.scigap.org/apiserver/user-management/v1.0.0/userinfo
 jwks_uri=https://custos.scigap.org/apiserver/identity-management/v1.0.0/certs
 registration.endpoint=https://custos.scigap.org/apiserver/tenant-management/v1.0.0/oauth2/tenant
-ciLogon.admin.client.id=XXXXXXX
-ciLogon.admin.client.secret=XXXXXXXX
+ciLogon.admin.client.id={{cilogon_id}}
+ciLogon.admin.client.secret={{cilogon_sec}}
 ciLogon.admin.auth.endpoint=https://test.cilogon.org/oauth2/oidc-cm
\ No newline at end of file
diff --git a/custos-core-services/utility-services/custos-configuration-service/src/main/resources/identityCoreService.properties b/custos-core-services/utility-services/custos-configuration-service/src/main/resources/identityCoreService.properties
index 61f1cfb30..41b891505 100644
--- a/custos-core-services/utility-services/custos-configuration-service/src/main/resources/identityCoreService.properties
+++ b/custos-core-services/utility-services/custos-configuration-service/src/main/resources/identityCoreService.properties
@@ -31,14 +31,14 @@ user.info.endpoint=https://custos.scigap.org/apiserver/user-management/v1.0.0/us
 jwks_uri=https://custos.scigap.org/apiserver/identity-management/v1.0.0/certs
 registration.endpoint=https://custos.scigap.org:/apiserver/tenant-management/v1.0.0/oauth2/tenant
 iam.server.client.id=admin-cli
-iam.server.admin.username=XXXXXXX
-iam.server.admin.password=XXXXXXX
+iam.server.admin.username={{iam_id}}
+iam.server.admin.password={{iam_sec}}
 iam.server.super.admin.realm.id=master
 iam.federated.cilogon.authorization.endpoint=https://cilogon.org/authorize
 iam.federated.cilogon.token.endpoint=https://cilogon.org/oauth2/token
 iam.federated.cilogon.token.userinfo.endpoint=https://cilogon.org/oauth2/userinfo
 iam.federated.cilogon.issuer=https://cilogon.org
 iam.federated.cilogon.jwksUri=https://cilogon.org/oauth2/certs
-ciLogon.admin.client.id=XXXXXXX
-ciLogon.admin.client.secret=XXXXXXXXX
+ciLogon.admin.client.id={{cilong_id}}
+ciLogon.admin.client.secret={{cilogon_sec}}
 ciLogon.admin.auth.endpoint=https://test.cilogon.org/oauth2/oidc-cm
diff --git a/custos-external-services-distributions/custos-keycloak/Dockerfile b/custos-external-services-distributions/custos-keycloak/Dockerfile
index 58d8531ea..f1ea2c7c7 100644
--- a/custos-external-services-distributions/custos-keycloak/Dockerfile
+++ b/custos-external-services-distributions/custos-keycloak/Dockerfile
@@ -1,4 +1,4 @@
-FROM jboss/keycloak:7.0.0
+FROM quay.io/keycloak/keycloak:9.0.2
 COPY src/main/resources/standalone-ha.xml /opt/jboss/keycloak/standalone/configuration/standalone-ha.xml
 COPY src/main/resources/standalone.xml /opt/jboss/keycloak/standalone/configuration/standalone.xml
 COPY src/main/resources/themes  /opt/jboss/keycloak/themes/
\ No newline at end of file
diff --git a/custos-federated-services-clients/src/main/java/org/apache/custos/federated/services/clients/keycloak/KeycloakClient.java b/custos-federated-services-clients/src/main/java/org/apache/custos/federated/services/clients/keycloak/KeycloakClient.java
index e127c5a03..e4a128772 100644
--- a/custos-federated-services-clients/src/main/java/org/apache/custos/federated/services/clients/keycloak/KeycloakClient.java
+++ b/custos-federated-services-clients/src/main/java/org/apache/custos/federated/services/clients/keycloak/KeycloakClient.java
@@ -1128,6 +1128,42 @@ public boolean addRoles(List<RoleRepresentation> roleRepresentations, String rea
         return true;
     }
 
+    /**
+     * Delete Roles in keycloak Realm or Client
+     *
+     * @param realmId
+     * @param clientScope if true add roles to client else to realm
+     * @return
+     */
+    public boolean deleteRole(String id, String realmId, String clientId, boolean clientScope) {
+        Keycloak client = null;
+        try {
+            client = getClient(iamServerURL, superAdminRealmID, superAdminUserName, superAdminPassword);
+
+            RealmResource realmResource = client.realm(realmId);
+
+            if (clientScope) {
+                ClientRepresentation representation = realmResource.clients().findByClientId(clientId).get(0);
+                realmResource.clients().get(representation.getId()).roles().deleteRole(id);
+
+            } else {
+                realmResource.roles().deleteRole(id);
+
+            }
+
+        } catch (Exception ex) {
+            String msg = "Error occurred while delete role" + id +
+                    " in Keycloak Server, reason: " + ex.getMessage();
+            LOGGER.error(msg, ex);
+            throw new RuntimeException(msg, ex);
+        } finally {
+            if (client != null) {
+                client.close();
+            }
+        }
+        return true;
+    }
+
 
     /**
      * Provides all Roles belongs to client, if clientId not present, provides all
@@ -1252,8 +1288,8 @@ public EventRepresentation getLastLoginEvent(String realmId, String clientId, St
 
         } catch (Exception ex) {
             String msg = "Error occurred while pulling events, reason: " + ex.getMessage();
-            LOGGER.error(msg, ex);
-            throw new RuntimeException(msg, ex);
+            LOGGER.warn(msg, ex);
+            return null;
 
         } finally {
             if (client != null) {
diff --git a/custos-federated-services-clients/src/main/java/org/apache/custos/federated/services/clients/keycloak/auth/KeycloakAuthClient.java b/custos-federated-services-clients/src/main/java/org/apache/custos/federated/services/clients/keycloak/auth/KeycloakAuthClient.java
index 908f901f4..6354d12f1 100644
--- a/custos-federated-services-clients/src/main/java/org/apache/custos/federated/services/clients/keycloak/auth/KeycloakAuthClient.java
+++ b/custos-federated-services-clients/src/main/java/org/apache/custos/federated/services/clients/keycloak/auth/KeycloakAuthClient.java
@@ -160,7 +160,7 @@ public boolean isUserAuthenticated(String username, String realmId, String acces
             }
             return true;
         } catch (Exception e) {
-            String msg = "Error occurred while checking if user: " + username + " is authorized in gateway: " + realmId;
+            String msg = "Error occurred while validating if user: " + username + " is authorized in gateway: " + realmId;
             LOGGER.error(msg, e);
             throw new RuntimeException(msg, e);
         }
@@ -323,10 +323,10 @@ private User getUserInfo(String realmId, String token) throws Exception {
         String userInfoEndPoint = openIdConnectConfig.getString("userinfo_endpoint");
         JSONObject userInfo = new JSONObject(getFromUrl(userInfoEndPoint, token));
         return new User(userInfo.getString("sub"),
-                userInfo.getString("name"),
-                userInfo.getString("given_name"),
-                userInfo.getString("family_name"),
-                userInfo.getString("email"),
+                userInfo.has("name")?userInfo.getString("name"):"",
+                userInfo.has("given_name")?userInfo.getString("given_name"):"",
+                userInfo.has("family_name")?userInfo.getString("family_name"):"",
+                userInfo.has("email")?userInfo.getString("email"):"",
                 userInfo.getString("preferred_username"));
     }
 
diff --git a/custos-integration-core/pom.xml b/custos-integration-core/pom.xml
index a7f394c46..7fb086dd7 100644
--- a/custos-integration-core/pom.xml
+++ b/custos-integration-core/pom.xml
@@ -56,6 +56,10 @@
             <groupId>io.grpc</groupId>
             <artifactId>grpc-netty</artifactId>
         </dependency>
+        <dependency>
+            <groupId>com.codahale</groupId>
+            <artifactId>shamir</artifactId>
+        </dependency>
     </dependencies>
     <build>
         <plugins>
diff --git a/custos-integration-core/src/main/java/org/apache/custos/integration/core/exceptions/InValidParameterException.java b/custos-integration-core/src/main/java/org/apache/custos/integration/core/exceptions/InValidParameterException.java
new file mode 100644
index 000000000..bfd8721ed
--- /dev/null
+++ b/custos-integration-core/src/main/java/org/apache/custos/integration/core/exceptions/InValidParameterException.java
@@ -0,0 +1,27 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing,
+ *  software distributed under the License is distributed on an
+ *  "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ *  KIND, either express or implied. See the License for the
+ *  specific language governing permissions and limitations
+ *  under the License.
+ */
+
+package org.apache.custos.integration.core.exceptions;
+
+public class InValidParameterException extends RuntimeException {
+
+    public InValidParameterException(String message, Throwable cause) {
+        super(message, cause);
+    }
+}
diff --git a/custos-integration-core/src/main/java/org/apache/custos/integration/core/exceptions/NotAuthorizedException.java b/custos-integration-core/src/main/java/org/apache/custos/integration/core/exceptions/UnAuthorizedException.java
similarity index 85%
rename from custos-integration-core/src/main/java/org/apache/custos/integration/core/exceptions/NotAuthorizedException.java
rename to custos-integration-core/src/main/java/org/apache/custos/integration/core/exceptions/UnAuthorizedException.java
index f61b6cbe1..58cf1fed8 100644
--- a/custos-integration-core/src/main/java/org/apache/custos/integration/core/exceptions/NotAuthorizedException.java
+++ b/custos-integration-core/src/main/java/org/apache/custos/integration/core/exceptions/UnAuthorizedException.java
@@ -20,11 +20,11 @@
 package org.apache.custos.integration.core.exceptions;
 
 /**
- * Not authorized exception
+ * Un authorized exception
  */
-public class NotAuthorizedException extends RuntimeException {
+public class UnAuthorizedException extends RuntimeException {
 
-    public NotAuthorizedException(String msg, Throwable e) {
+    public UnAuthorizedException(String msg, Throwable e) {
         super(msg, e);
     }
 }
diff --git a/custos-integration-core/src/main/java/org/apache/custos/integration/core/interceptor/ServiceInterceptor.java b/custos-integration-core/src/main/java/org/apache/custos/integration/core/interceptor/ServiceInterceptor.java
index 251044ba5..d3c34fcce 100644
--- a/custos-integration-core/src/main/java/org/apache/custos/integration/core/interceptor/ServiceInterceptor.java
+++ b/custos-integration-core/src/main/java/org/apache/custos/integration/core/interceptor/ServiceInterceptor.java
@@ -21,7 +21,7 @@
 
 
 import io.grpc.*;
-import org.apache.custos.integration.core.exceptions.NotAuthorizedException;
+import org.apache.custos.integration.core.exceptions.UnAuthorizedException;
 import org.apache.custos.integration.core.utils.Constants;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
@@ -67,14 +67,14 @@ public void onMessage(ReqT message) {
                         resp = interceptor.intercept(methodName, metadata, (resp == null) ? message : resp);
                     }
                     super.onMessage(resp);
-                } catch (NotAuthorizedException ex) {
+                } catch (UnAuthorizedException ex) {
                     String msg = "Error while authorizing method " + methodName + ", " + ex.getMessage();
                     LOGGER.error(msg);
-                    serverCall.close(Status.UNAUTHENTICATED.withDescription(msg), metadata);
+                    serverCall.close(Status.UNAUTHENTICATED.withDescription(msg), new Metadata());
                 } catch (Exception ex) {
                     String msg = "Error while validating method " + methodName + ", " + ex.getMessage();
                     LOGGER.error(msg, ex);
-                    serverCall.close(Status.INVALID_ARGUMENT.withDescription(msg), metadata);
+                    serverCall.close(Status.INVALID_ARGUMENT.withDescription(msg), new Metadata());
                 }
             }
 
diff --git a/custos-integration-core/src/main/java/org/apache/custos/integration/core/utils/Constants.java b/custos-integration-core/src/main/java/org/apache/custos/integration/core/utils/Constants.java
index c99745c37..4a8445950 100644
--- a/custos-integration-core/src/main/java/org/apache/custos/integration/core/utils/Constants.java
+++ b/custos-integration-core/src/main/java/org/apache/custos/integration/core/utils/Constants.java
@@ -28,6 +28,8 @@ public final class Constants {
 
     public static final String USER_TOKEN = "user-token";
 
+    public static final String AUTHENTICATE_AGENT = "authenticate-agent";
+
     public static final String TenantId = "tenant-id";
 
     public static final String X_FORWARDED_FOR = "x-forwarded-for";
diff --git a/custos-integration-core/src/main/java/org/apache/custos/integration/core/utils/ShamirSecretHandler.java b/custos-integration-core/src/main/java/org/apache/custos/integration/core/utils/ShamirSecretHandler.java
new file mode 100644
index 000000000..3ad2374c7
--- /dev/null
+++ b/custos-integration-core/src/main/java/org/apache/custos/integration/core/utils/ShamirSecretHandler.java
@@ -0,0 +1,72 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing,
+ *  software distributed under the License is distributed on an
+ *  "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ *  KIND, either express or implied. See the License for the
+ *  specific language governing permissions and limitations
+ *  under the License.
+ */
+
+package org.apache.custos.integration.core.utils;
+
+import com.codahale.shamir.Scheme;
+import com.google.protobuf.ByteString;
+import org.apache.custos.integration.core.exceptions.InValidParameterException;
+
+import java.nio.charset.StandardCharsets;
+import java.security.SecureRandom;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.concurrent.atomic.AtomicInteger;
+
+public class ShamirSecretHandler {
+
+    public static Map<Integer, byte[]> splitSecret(String secret, int numOfsplits, int threshold) {
+
+        if (numOfsplits >= threshold) {
+            Scheme scheme = new Scheme(new SecureRandom(), numOfsplits, threshold);
+            byte[] secretArray = secret.getBytes(StandardCharsets.UTF_8);
+            final Map<Integer, byte[]> parts =  scheme.split(secretArray);
+            final Map<Integer, byte[]> selectedParts = new HashMap<>();
+            int count  = 1;
+            for (Integer integer : parts.keySet()){
+                selectedParts.put(integer, parts.get(integer));
+                count ++;
+                if (count == threshold){
+                    break;
+                }
+            }
+            return  selectedParts;
+        } else {
+            throw new
+                    InValidParameterException(
+                    "Cannot split message number of splits should be greater than threshold", null);
+        }
+    }
+
+
+    public static  String generateSecret(List<ByteString> byteStringList, int numOfsplits, int threshold) {
+        Scheme scheme = new Scheme(new SecureRandom(), numOfsplits, threshold);
+        Map<Integer, byte[]> selectedSplits = new HashMap<>();
+        AtomicInteger count = new AtomicInteger();
+        byteStringList.forEach(str-> {
+            selectedSplits.put(count.get(), str.toByteArray());
+            count.getAndIncrement();
+        });
+
+        final byte[] recovered = scheme.join(selectedSplits);
+        return new String(recovered, StandardCharsets.UTF_8);
+    }
+
+}
diff --git a/custos-integration-services/agent-management-service-parent/agent-management-service/pom.xml b/custos-integration-services/agent-management-service-parent/agent-management-service/pom.xml
index fc0dfc238..611bd16ac 100644
--- a/custos-integration-services/agent-management-service-parent/agent-management-service/pom.xml
+++ b/custos-integration-services/agent-management-service-parent/agent-management-service/pom.xml
@@ -118,6 +118,7 @@
             <groupId>com.google.api.grpc</groupId>
             <artifactId>proto-google-common-protos</artifactId>
         </dependency>
+
     </dependencies>
 
     <build>
@@ -136,6 +137,13 @@
                     <skip>false</skip>
                 </configuration>
             </plugin>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-antrun-plugin</artifactId>
+                <configuration>
+                    <skip>false</skip>
+                </configuration>
+            </plugin>
         </plugins>
     </build>
 
diff --git a/custos-integration-services/agent-management-service-parent/agent-management-service/src/main/helm/templates/deployment.yaml b/custos-integration-services/agent-management-service-parent/agent-management-service/src/main/helm/templates/deployment.yaml
index a0957f6b1..668c290e3 100644
--- a/custos-integration-services/agent-management-service-parent/agent-management-service/src/main/helm/templates/deployment.yaml
+++ b/custos-integration-services/agent-management-service-parent/agent-management-service/src/main/helm/templates/deployment.yaml
@@ -6,9 +6,10 @@ metadata:
 {{ include "helm.labels" . | indent 4 }}
 spec:
   replicas: {{ .Values.replicaCount }}
-  rollingUpdate:
-    maxSurge: {{ .Values.rollingUpdate.maxSurge }}
-    maxUnavailable: {{ .Values.rollingUpdate.maxUnavailable }}
+  strategy:
+    rollingUpdate:
+      maxSurge: {{ .Values.rollingUpdate.maxSurge }}
+      maxUnavailable: {{ .Values.rollingUpdate.maxUnavailable }}
   selector:
     matchLabels:
       app.kubernetes.io/name: {{ include "helm.name" . }}
@@ -45,9 +46,9 @@ spec:
             httpGet:
               path: /actuator/health
               port: {{ .Values.service.port }}
-              initialDelaySeconds: {{ .Values.readinessProbe.initialDelaySeconds }}
-              periodSeconds: {{ .Values.readinessProbe.periodSeconds }}
-              successThreshold: {{ .Values.readinessProbe.successThreshold }}
+            initialDelaySeconds: {{ .Values.readinessProbe.initialDelaySeconds }}
+            periodSeconds: {{ .Values.readinessProbe.periodSeconds }}
+            successThreshold: {{ .Values.readinessProbe.successThreshold }}
           resources:
               {{- toYaml .Values.resources | nindent 12 }}
         - name: {{ .Chart.Name }}-envoy-proxy
diff --git a/custos-integration-services/agent-management-service-parent/agent-management-service/src/main/helm/templates/ingress-grpc.yaml b/custos-integration-services/agent-management-service-parent/agent-management-service/src/main/helm/templates/ingress-grpc.yaml
index ebf2b9d6e..935c98a1d 100644
--- a/custos-integration-services/agent-management-service-parent/agent-management-service/src/main/helm/templates/ingress-grpc.yaml
+++ b/custos-integration-services/agent-management-service-parent/agent-management-service/src/main/helm/templates/ingress-grpc.yaml
@@ -1,4 +1,4 @@
-apiVersion: extensions/v1beta1
+apiVersion: networking.k8s.io/v1beta1
 kind: Ingress
 metadata:
   annotations:
diff --git a/custos-integration-services/agent-management-service-parent/agent-management-service/src/main/java/org/apache/custos/agent/management/interceptors/SuperTenantRestrictedOperationsInterceptorImpl.java b/custos-integration-services/agent-management-service-parent/agent-management-service/src/main/java/org/apache/custos/agent/management/interceptors/SuperTenantRestrictedOperationsInterceptorImpl.java
index d1f2a4e00..b48d0a130 100644
--- a/custos-integration-services/agent-management-service-parent/agent-management-service/src/main/java/org/apache/custos/agent/management/interceptors/SuperTenantRestrictedOperationsInterceptorImpl.java
+++ b/custos-integration-services/agent-management-service-parent/agent-management-service/src/main/java/org/apache/custos/agent/management/interceptors/SuperTenantRestrictedOperationsInterceptorImpl.java
@@ -21,9 +21,8 @@
 
 import io.grpc.Metadata;
 import org.apache.custos.credential.store.client.CredentialStoreServiceClient;
-import org.apache.custos.iam.service.GetAllResources;
 import org.apache.custos.identity.client.IdentityClient;
-import org.apache.custos.integration.core.exceptions.NotAuthorizedException;
+import org.apache.custos.integration.core.exceptions.UnAuthorizedException;
 import org.apache.custos.integration.services.commons.interceptors.AuthInterceptor;
 import org.apache.custos.integration.services.commons.model.AuthClaim;
 import org.apache.custos.tenant.profile.client.async.TenantProfileClient;
@@ -54,10 +53,10 @@ public <ReqT> ReqT intercept(String method, Metadata headers, ReqT msg) {
                 claim = authorizeUsingUserToken(headers);
             } catch (Exception ex) {
                 LOGGER.error(" Authorizing error " + ex.getMessage());
-                throw new NotAuthorizedException("Request is not authorized", ex);
+                throw new UnAuthorizedException("Request is not authorized", ex);
             }
             if (claim == null || !claim.isSuperTenant() || !claim.isAdmin()) {
-                throw new NotAuthorizedException("Request is not authorized", null);
+                throw new UnAuthorizedException("Request is not authorized", null);
             }
 
         }
diff --git a/custos-integration-services/agent-management-service-parent/agent-management-service/src/main/java/org/apache/custos/agent/management/interceptors/UserAuthInterceptorImpl.java b/custos-integration-services/agent-management-service-parent/agent-management-service/src/main/java/org/apache/custos/agent/management/interceptors/UserAuthInterceptorImpl.java
index d7ece06f9..dec111ca5 100644
--- a/custos-integration-services/agent-management-service-parent/agent-management-service/src/main/java/org/apache/custos/agent/management/interceptors/UserAuthInterceptorImpl.java
+++ b/custos-integration-services/agent-management-service-parent/agent-management-service/src/main/java/org/apache/custos/agent/management/interceptors/UserAuthInterceptorImpl.java
@@ -27,7 +27,7 @@
 import org.apache.custos.credential.store.service.Type;
 import org.apache.custos.iam.service.*;
 import org.apache.custos.identity.client.IdentityClient;
-import org.apache.custos.integration.core.exceptions.NotAuthorizedException;
+import org.apache.custos.integration.core.exceptions.UnAuthorizedException;
 import org.apache.custos.integration.services.commons.interceptors.AuthInterceptor;
 import org.apache.custos.integration.services.commons.model.AuthClaim;
 import org.apache.custos.tenant.profile.client.async.TenantProfileClient;
@@ -59,7 +59,7 @@ public <ReqT> ReqT intercept(String method, Metadata headers, ReqT msg) {
         long tenantId = claim.getTenantId();
 
         if (claim == null) {
-            throw new NotAuthorizedException("Request is not authorized", null);
+            throw new UnAuthorizedException("Request is not authorized", null);
         }
 
         if (!method.equals("enableAgents")) {
@@ -72,7 +72,7 @@ public <ReqT> ReqT intercept(String method, Metadata headers, ReqT msg) {
 
             CredentialMetadata metadata = this.credentialStoreServiceClient.getCredential(request);
             if (metadata == null || metadata.getId().equals("")) {
-                throw new NotAuthorizedException("Agent creation is not enabled", null);
+                throw new UnAuthorizedException("Agent creation is not enabled", null);
             }
 
         }
@@ -90,6 +90,7 @@ public <ReqT> ReqT intercept(String method, Metadata headers, ReqT msg) {
             return (ReqT) ((RegisterUserRequest) msg).toBuilder()
                     .setTenantId(tenantId)
                     .setAccessToken(token)
+                    .setClientId(claim.getCustosId())
                     .setPerformedBy(claim.getPerformedBy())
                     .build();
 
@@ -145,7 +146,7 @@ public <ReqT> ReqT intercept(String method, Metadata headers, ReqT msg) {
 
             CredentialMetadata metadata = this.credentialStoreServiceClient.getCredential(request);
             if (metadata == null || metadata.getId().equals("")) {
-                throw new NotAuthorizedException("Agent creation is not enabled", null);
+                throw new UnAuthorizedException("Agent creation is not enabled", null);
             }
 
             return (ReqT) ((AddProtocolMapperRequest) msg).toBuilder()
@@ -162,7 +163,7 @@ public <ReqT> ReqT intercept(String method, Metadata headers, ReqT msg) {
 
             CredentialMetadata metadata = this.credentialStoreServiceClient.getCredential(request);
             if (metadata == null || metadata.getId().equals("")) {
-                throw new NotAuthorizedException("Agent creation is not enabled", null);
+                throw new UnAuthorizedException("Agent creation is not enabled", null);
             }
 
             return (ReqT) ((AddRolesRequest) msg).toBuilder()
@@ -178,7 +179,7 @@ public <ReqT> ReqT intercept(String method, Metadata headers, ReqT msg) {
 
             CredentialMetadata metadata = this.credentialStoreServiceClient.getCredential(request);
             if (metadata == null || metadata.getId().equals("")) {
-                throw new NotAuthorizedException("Agent creation is not enabled", null);
+                throw new UnAuthorizedException("Agent creation is not enabled", null);
             }
 
             return (ReqT) ((GetAllResources) msg).toBuilder()
diff --git a/custos-integration-services/agent-management-service-parent/agent-management-service/src/main/java/org/apache/custos/agent/management/service/AgentManagementService.java b/custos-integration-services/agent-management-service-parent/agent-management-service/src/main/java/org/apache/custos/agent/management/service/AgentManagementService.java
index 342bbbe1a..8c98c8350 100644
--- a/custos-integration-services/agent-management-service-parent/agent-management-service/src/main/java/org/apache/custos/agent/management/service/AgentManagementService.java
+++ b/custos-integration-services/agent-management-service-parent/agent-management-service/src/main/java/org/apache/custos/agent/management/service/AgentManagementService.java
@@ -71,6 +71,9 @@ public class AgentManagementService extends org.apache.custos.agent.management.s
 
     private static final String CUSTOS_REALM_AGENT = "custos-realm-agent";
 
+    public static final String AGENT_ID = "agent-id";
+    public static final String AGENT_PARENT_ID = "agent-parent-id";
+
 
     @Override
     public void enableAgents(AgentClientMetadata request, StreamObserver<OperationStatus> responseObserver) {
@@ -130,13 +133,35 @@ public void enableAgents(AgentClientMetadata request, StreamObserver<OperationSt
                 return;
             }
 
+
+            AddProtocolMapperRequest addProtocolMapperRequest = AddProtocolMapperRequest
+                    .newBuilder()
+                    .setAddToAccessToken(true)
+                    .setAddToIdToken(true)
+                    .setMapperType(MapperTypes.USER_ATTRIBUTE)
+                    .setClaimName(AGENT_ID)
+                    .setName(AGENT_ID)
+                    .setAttributeName(AGENT_ID)
+                    .setTenantId(request.getTenantId())
+                    .setClientId(setUpTenantResponse.getClientId())
+                    .build();
+
+            iamAdminServiceClient.addProtocolMapper(addProtocolMapperRequest);
+
+            addProtocolMapperRequest = addProtocolMapperRequest.toBuilder()
+                    .setClaimName(AGENT_PARENT_ID).setName(AGENT_PARENT_ID)
+                    .setAttributeName(AGENT_PARENT_ID).build();
+
+            iamAdminServiceClient.addProtocolMapper(addProtocolMapperRequest);
+
             CredentialMetadata metadata = CredentialMetadata.newBuilder().
                     setId(setUpTenantResponse.getClientId())
                     .setSecret(setUpTenantResponse.getClientSecret())
                     .setOwnerId(request.getTenantId())
                     .setType(Type.AGENT_CLIENT)
                     .build();
-            org.apache.custos.credential.store.service.OperationStatus status = credentialStoreServiceClient.putCredential(metadata);
+            org.apache.custos.credential.store.service.OperationStatus status =
+                    credentialStoreServiceClient.putCredential(metadata);
 
             OperationStatus operationStatus = OperationStatus.newBuilder().setStatus(status.getState()).build();
             responseObserver.onNext(operationStatus);
@@ -155,7 +180,8 @@ public void enableAgents(AgentClientMetadata request, StreamObserver<OperationSt
 
 
     @Override
-    public void registerAndEnableAgent(RegisterUserRequest request, StreamObserver<org.apache.custos.agent.management.service.AgentRegistrationResponse> responseObserver) {
+    public void registerAndEnableAgent(RegisterUserRequest request,
+                                       StreamObserver<org.apache.custos.agent.management.service.AgentRegistrationResponse> responseObserver) {
         try {
 
             LOGGER.debug("Request received to registerAndEnableAgent for tenant " + request.getTenantId() +
@@ -163,6 +189,7 @@ public void registerAndEnableAgent(RegisterUserRequest request, StreamObserver<o
 
             UserSearchMetadata metadata = UserSearchMetadata.newBuilder().setId(request.getUser().getId()).build();
 
+
             UserSearchRequest userSearchRequest = UserSearchRequest.
                     newBuilder().setUser(metadata).
                     setTenantId(request.getTenantId())
@@ -194,7 +221,13 @@ public void registerAndEnableAgent(RegisterUserRequest request, StreamObserver<o
 
                 UserAttribute attribute = UserAttribute.newBuilder()
                         .setKey(CUSTOS_REALM_AGENT).addValues("true").build();
+                UserAttribute agentId = UserAttribute.newBuilder()
+                        .setKey(AGENT_ID).addValues(request.getUser().getId()).build();
+                UserAttribute agentParentId = UserAttribute.newBuilder()
+                        .setKey(AGENT_PARENT_ID).addValues(request.getClientId()).build();
+                newAtrList.add(agentId);
                 newAtrList.add(attribute);
+                newAtrList.add(agentParentId);
                 representation = representation.toBuilder().addAllAttributes(newAtrList).build();
 
                 request = request.toBuilder().setUser(representation).setClientId(AGENT_CLIENT).build();
diff --git a/custos-integration-services/custos-integration-services-commons/src/main/java/org/apache/custos/integration/services/commons/interceptors/AuthInterceptor.java b/custos-integration-services/custos-integration-services-commons/src/main/java/org/apache/custos/integration/services/commons/interceptors/AuthInterceptor.java
index 94eab5188..4b82ee6cb 100644
--- a/custos-integration-services/custos-integration-services-commons/src/main/java/org/apache/custos/integration/services/commons/interceptors/AuthInterceptor.java
+++ b/custos-integration-services/custos-integration-services-commons/src/main/java/org/apache/custos/integration/services/commons/interceptors/AuthInterceptor.java
@@ -26,8 +26,8 @@
 import org.apache.custos.identity.service.AuthToken;
 import org.apache.custos.identity.service.Claim;
 import org.apache.custos.identity.service.GetUserManagementSATokenRequest;
-import org.apache.custos.identity.service.IsAuthenticateResponse;
-import org.apache.custos.integration.core.exceptions.NotAuthorizedException;
+import org.apache.custos.identity.service.IsAuthenticatedResponse;
+import org.apache.custos.integration.core.exceptions.UnAuthorizedException;
 import org.apache.custos.integration.core.interceptor.IntegrationServiceInterceptor;
 import org.apache.custos.integration.core.utils.Constants;
 import org.apache.custos.integration.services.commons.model.AuthClaim;
@@ -36,12 +36,13 @@
 import org.apache.custos.tenant.profile.service.GetTenantResponse;
 import org.apache.custos.tenant.profile.service.Tenant;
 import org.apache.custos.tenant.profile.service.TenantStatus;
-import org.apache.tomcat.util.bcel.Const;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
 import java.util.ArrayList;
 import java.util.List;
+import java.util.concurrent.atomic.AtomicLong;
+import java.util.concurrent.atomic.AtomicReference;
 
 /**
  * Responsible for managing auth flow
@@ -69,11 +70,11 @@ public AuthClaim authorize(Metadata headers) {
             String formattedToken = getToken(headers);
 
             if (formattedToken == null) {
-                return null;
+                throw new UnAuthorizedException(" token not found ", null);
             }
             return authorize(formattedToken);
         } catch (Exception ex) {
-            throw new NotAuthorizedException("Wrong credentials " + ex.getMessage(), ex);
+            throw new UnAuthorizedException(" invalid token " + ex.getMessage(), ex);
         }
 
     }
@@ -87,7 +88,7 @@ public AuthClaim authorize(String formattedToken) {
             GetAllCredentialsResponse response = credentialStoreServiceClient.getAllCredentialFromToken(request);
             return getAuthClaim(response);
         } catch (Exception ex) {
-            throw new NotAuthorizedException("Wrong credentials " + ex.getMessage(), ex);
+            throw new UnAuthorizedException(" invalid token " + ex.getMessage(), ex);
         }
 
     }
@@ -99,12 +100,12 @@ public AuthClaim authorizeUsingUserToken(Metadata headers) {
             String formattedToken = getToken(headers);
 
             if (formattedToken == null) {
-                return null;
+                throw new UnAuthorizedException(" token not found ", null);
             }
 
             return authorizeUsingUserToken(formattedToken);
         } catch (Exception ex) {
-            throw new NotAuthorizedException("Wrong credentials " + ex.getMessage(), ex);
+            throw new UnAuthorizedException(" invalid token " + ex.getMessage(), ex);
         }
 
     }
@@ -145,15 +146,17 @@ public AuthClaim authorizeUsingUserToken(String formattedToken) {
                         .build();
 
 
-                IsAuthenticateResponse isAuthenticateResponse = identityClient.isAuthenticated(token);
+                IsAuthenticatedResponse isAuthenticateResponse = identityClient.isAuthenticated(token);
                 if (isAuthenticateResponse.getAuthenticated()) {
                     return claim;
+                } else {
+                    throw new UnAuthorizedException(" expired user token ", null);
                 }
+            } else {
+                throw new UnAuthorizedException(" expired user token ", null);
             }
-
-            return null;
         } catch (Exception ex) {
-            throw new NotAuthorizedException("Wrong credentials " + ex.getMessage(), ex);
+            throw new UnAuthorizedException(ex.getMessage(), ex);
         }
 
     }
@@ -165,7 +168,7 @@ public AuthClaim authorizeUsingAgentBasicToken(Metadata headers, String parentId
             String formattedToken = getToken(headers);
 
             if (formattedToken == null) {
-                return null;
+                throw new UnAuthorizedException(" token not found ", null);
             }
 
             TokenRequest request = TokenRequest
@@ -179,12 +182,103 @@ public AuthClaim authorizeUsingAgentBasicToken(Metadata headers, String parentId
             return getAuthClaim(response);
 
         } catch (Exception ex) {
-            throw new NotAuthorizedException("Wrong credentials " + ex.getMessage(), ex);
+            throw new UnAuthorizedException(" invalid token " + ex.getMessage(), ex);
+        }
+
+    }
+
+
+    public AuthClaim authorizeUsingAgentAndUserJWTTokens(Metadata headers) {
+        try {
+
+            String agentToken = getToken(headers);
+            TokenRequest request = TokenRequest
+                    .newBuilder()
+                    .setToken(agentToken)
+                    .build();
+
+            GetAllCredentialsResponse response = credentialStoreServiceClient.getCredentialByAgentJWTToken(request);
+
+            AtomicLong agentTenantId = new AtomicLong();
+            AtomicReference<String> agentId = new AtomicReference<>();
+            response.getSecretListList().forEach(sec -> {
+                if (sec.getType() == Type.AGENT) {
+                    agentTenantId.set(sec.getOwnerId());
+                    agentId.set(sec.getId());
+                }
+            });
+
+            Claim userNameClaim = Claim.newBuilder()
+                    .setKey("username")
+                    .setValue(agentId.get().toLowerCase()).build();
+
+            Claim tenantClaim = Claim.newBuilder()
+                    .setKey("tenantId")
+                    .setValue(String.valueOf(agentTenantId.get()))
+                    .build();
+
+
+            List<Claim> claimList = new ArrayList<>();
+            claimList.add(userNameClaim);
+            claimList.add(tenantClaim);
+
+
+            AuthToken token = AuthToken.newBuilder().
+                    setAccessToken(agentToken)
+                    .addAllClaims(claimList)
+                    .build();
+
+
+            IsAuthenticatedResponse isAuthenticateResponse = identityClient.isAuthenticated(token);
+            if (isAuthenticateResponse.getAuthenticated()) {
+
+                String userToken = getUserTokenFromUserTokenHeader(headers);
+
+                AuthClaim claim = authorizeUsingUserToken(userToken);
+
+                boolean status = validateParentChildTenantRelationShip(agentTenantId.get(), claim.getTenantId());
+
+                if (status) {
+                    return claim;
+                } else {
+                    throw new UnAuthorizedException("Agent" + agentId.get() + "" +
+                            "  is not authorized to access resources on behalf of tenant ", null);
+                }
+            } else {
+                throw new UnAuthorizedException("Agent" + agentId.get() + "" +
+                        "  is not authorized ", null);
+            }
+
+        } catch (Exception ex) {
+            throw new UnAuthorizedException(" invalid token " + ex.getMessage(), ex);
         }
 
     }
 
 
+    public boolean isValidAgentJWTToken(Metadata headers) {
+
+        try {
+            String formattedToken = getToken(headers);
+
+            if (formattedToken == null) {
+                return false;
+            }
+            TokenRequest request = TokenRequest
+                    .newBuilder()
+                    .setToken(formattedToken)
+                    .build();
+
+            OperationStatus status = credentialStoreServiceClient.validateAgentJWTToken(request);
+
+            return status.getState();
+
+        } catch (Exception ex) {
+            return false;
+        }
+
+    }
+
     public String getToken(Metadata headers) {
         String tokenWithBearer = headers.get(Metadata.Key.of("authorization", Metadata.ASCII_STRING_MARSHALLER));
         if (tokenWithBearer == null) {
@@ -305,6 +399,20 @@ public AuthToken getSAToken(String clientId, String clientSec, long tenantId) {
     }
 
 
+    public CredentialMetadata getCredentialsFromClientId(String clientId) {
+        GetCredentialRequest request = GetCredentialRequest.newBuilder()
+                .setId(clientId)
+                .build();
+        CredentialMetadata metadata = credentialStoreServiceClient.getCustosCredentialFromClientId(request);
+
+        if (metadata == null || metadata.getOwnerId() == 0) {
+            throw new UnAuthorizedException("Invalid client_id", null);
+        }
+
+        return metadata;
+    }
+
+
     private AuthClaim getAuthClaim(GetAllCredentialsResponse response) {
         if (response == null || response.getSecretListCount() == 0) {
             return null;
@@ -402,7 +510,7 @@ private boolean validateTenantStatus(long tenantId) {
     }
 
 
-    private boolean validateParentChildTenantRelationShip(long parentId, long childTenantId) {
+    public boolean validateParentChildTenantRelationShip(long parentId, long childTenantId) {
 
         GetTenantRequest childTenantReq = GetTenantRequest
                 .newBuilder()
@@ -428,7 +536,26 @@ private boolean validateParentChildTenantRelationShip(long parentId, long childT
 
 
     private void attachTenantId(String tenantId, Metadata headers) {
-        headers.put(Metadata.Key.of(Constants.TenantId,Metadata.ASCII_STRING_MARSHALLER), tenantId);
+        headers.put(Metadata.Key.of(Constants.TenantId, Metadata.ASCII_STRING_MARSHALLER), tenantId);
+    }
+
+    public String getUserTokenFromUserTokenHeader(Metadata headers) {
+        return headers.get(Metadata.Key.of(Constants.USER_TOKEN, Metadata.ASCII_STRING_MARSHALLER));
+    }
+
+    public boolean cleatUserTokenFromHeader(Metadata headers) {
+        String obj = headers.get(Metadata.Key.of(Constants.USER_TOKEN, Metadata.ASCII_STRING_MARSHALLER));
+        headers.remove(Metadata.Key.of(Constants.USER_TOKEN, Metadata.ASCII_STRING_MARSHALLER), obj);
+        return true;
+    }
+
+    public boolean isAgentAuthenticationEnabled(Metadata headers) {
+        String header = headers.get(Metadata.Key.of(Constants.AUTHENTICATE_AGENT, Metadata.ASCII_STRING_MARSHALLER));
+        if (header != null && Boolean.parseBoolean(header)) {
+            return true;
+        } else {
+            return false;
+        }
     }
 
 
diff --git a/custos-integration-services/custos-integration-services-commons/src/main/java/org/apache/custos/integration/services/commons/interceptors/MultiTenantAuthInterceptor.java b/custos-integration-services/custos-integration-services-commons/src/main/java/org/apache/custos/integration/services/commons/interceptors/MultiTenantAuthInterceptor.java
index 8b311e676..7482cbd13 100644
--- a/custos-integration-services/custos-integration-services-commons/src/main/java/org/apache/custos/integration/services/commons/interceptors/MultiTenantAuthInterceptor.java
+++ b/custos-integration-services/custos-integration-services-commons/src/main/java/org/apache/custos/integration/services/commons/interceptors/MultiTenantAuthInterceptor.java
@@ -22,7 +22,6 @@
 import io.grpc.Metadata;
 import org.apache.custos.credential.store.client.CredentialStoreServiceClient;
 import org.apache.custos.identity.client.IdentityClient;
-import org.apache.custos.integration.core.utils.Constants;
 import org.apache.custos.integration.services.commons.model.AuthClaim;
 import org.apache.custos.tenant.profile.client.async.TenantProfileClient;
 import org.slf4j.Logger;
@@ -53,25 +52,34 @@ public MultiTenantAuthInterceptor(CredentialStoreServiceClient credentialStoreSe
 
     public AuthClaim authorize(Metadata headers, String clientId) {
 
-        if (clientId != null && clientId.trim().equals("")) {
-            clientId = null;
-        }
+        try {
+
+            if (clientId != null && clientId.trim().equals("")) {
+                clientId = null;
+            }
+
+            String userToken = getUserTokenFromUserTokenHeader(headers);
+            boolean agentAuthenticationEnabled = isAgentAuthenticationEnabled(headers);
 
-        String userToken = headers.get(Metadata.Key.of(Constants.USER_TOKEN, Metadata.ASCII_STRING_MARSHALLER));
+            if (agentAuthenticationEnabled) {
+                return authorizeUsingAgentAndUserJWTTokens(headers);
+            }
 
-        if (clientId == null && userToken == null) {
-            return authorize(headers);
-        } else if (clientId != null && userToken == null) {
-            return authorizeWithParentChildTenantValidationByBasicAuth(headers, clientId);
-        } else if (clientId != null && userToken != null) {
-            return authorizeWithParentChildTenantValidationByBasicAuthAndUserTokenValidation(headers, clientId, userToken);
-        } else {
-            return authorizeUsingUserToken(headers);
+            if (clientId == null && userToken == null) {
+                return authorize(headers);
+            } else if (clientId != null && userToken == null) {
+                return authorizeWithParentChildTenantValidationByBasicAuth(headers, clientId);
+            } else if (clientId != null && userToken != null) {
+                return authorizeWithParentChildTenantValidationByBasicAuthAndUserTokenValidation(headers, clientId, userToken);
+            } else {
+                return authorizeUsingUserToken(headers);
+            }
+
+        } catch (Exception ex) {
+            cleatUserTokenFromHeader(headers);
+            throw ex;
         }
     }
 
 
-    public String getUserTokenFromUserTokenHeader(Metadata headers) {
-        return headers.get(Metadata.Key.of(Constants.USER_TOKEN, Metadata.ASCII_STRING_MARSHALLER));
-    }
 }
diff --git a/custos-integration-services/group-management-service-parent/group-management-service-sidecar/src/main/resources/group-management-service.pb b/custos-integration-services/group-management-service-parent/group-management-service-sidecar/src/main/resources/group-management-service.pb
index 11c7db697..da1d054b1 100644
Binary files a/custos-integration-services/group-management-service-parent/group-management-service-sidecar/src/main/resources/group-management-service.pb and b/custos-integration-services/group-management-service-parent/group-management-service-sidecar/src/main/resources/group-management-service.pb differ
diff --git a/custos-integration-services/group-management-service-parent/group-management-service/pom.xml b/custos-integration-services/group-management-service-parent/group-management-service/pom.xml
index 1ac8b6f27..7678ff97b 100644
--- a/custos-integration-services/group-management-service-parent/group-management-service/pom.xml
+++ b/custos-integration-services/group-management-service-parent/group-management-service/pom.xml
@@ -114,6 +114,7 @@
             <groupId>com.google.api.grpc</groupId>
             <artifactId>proto-google-common-protos</artifactId>
         </dependency>
+
     </dependencies>
 
     <build>
@@ -132,6 +133,13 @@
                     <skip>false</skip>
                 </configuration>
             </plugin>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-antrun-plugin</artifactId>
+                <configuration>
+                    <skip>false</skip>
+                </configuration>
+            </plugin>
         </plugins>
     </build>
 
diff --git a/custos-integration-services/group-management-service-parent/group-management-service/src/main/helm/templates/deployment.yaml b/custos-integration-services/group-management-service-parent/group-management-service/src/main/helm/templates/deployment.yaml
index a0957f6b1..668c290e3 100644
--- a/custos-integration-services/group-management-service-parent/group-management-service/src/main/helm/templates/deployment.yaml
+++ b/custos-integration-services/group-management-service-parent/group-management-service/src/main/helm/templates/deployment.yaml
@@ -6,9 +6,10 @@ metadata:
 {{ include "helm.labels" . | indent 4 }}
 spec:
   replicas: {{ .Values.replicaCount }}
-  rollingUpdate:
-    maxSurge: {{ .Values.rollingUpdate.maxSurge }}
-    maxUnavailable: {{ .Values.rollingUpdate.maxUnavailable }}
+  strategy:
+    rollingUpdate:
+      maxSurge: {{ .Values.rollingUpdate.maxSurge }}
+      maxUnavailable: {{ .Values.rollingUpdate.maxUnavailable }}
   selector:
     matchLabels:
       app.kubernetes.io/name: {{ include "helm.name" . }}
@@ -45,9 +46,9 @@ spec:
             httpGet:
               path: /actuator/health
               port: {{ .Values.service.port }}
-              initialDelaySeconds: {{ .Values.readinessProbe.initialDelaySeconds }}
-              periodSeconds: {{ .Values.readinessProbe.periodSeconds }}
-              successThreshold: {{ .Values.readinessProbe.successThreshold }}
+            initialDelaySeconds: {{ .Values.readinessProbe.initialDelaySeconds }}
+            periodSeconds: {{ .Values.readinessProbe.periodSeconds }}
+            successThreshold: {{ .Values.readinessProbe.successThreshold }}
           resources:
               {{- toYaml .Values.resources | nindent 12 }}
         - name: {{ .Chart.Name }}-envoy-proxy
diff --git a/custos-integration-services/group-management-service-parent/group-management-service/src/main/helm/templates/ingress-grpc.yaml b/custos-integration-services/group-management-service-parent/group-management-service/src/main/helm/templates/ingress-grpc.yaml
index 727abc111..fde80f9e7 100644
--- a/custos-integration-services/group-management-service-parent/group-management-service/src/main/helm/templates/ingress-grpc.yaml
+++ b/custos-integration-services/group-management-service-parent/group-management-service/src/main/helm/templates/ingress-grpc.yaml
@@ -1,4 +1,4 @@
-apiVersion: extensions/v1beta1
+apiVersion: networking.k8s.io/v1beta1
 kind: Ingress
 metadata:
   annotations:
diff --git a/custos-integration-services/group-management-service-parent/group-management-service/src/main/java/org/apache/custos/group/management/interceptors/ClientAuthInterceptorImpl.java b/custos-integration-services/group-management-service-parent/group-management-service/src/main/java/org/apache/custos/group/management/interceptors/ClientAuthInterceptorImpl.java
index fc4aa9583..848467ead 100644
--- a/custos-integration-services/group-management-service-parent/group-management-service/src/main/java/org/apache/custos/group/management/interceptors/ClientAuthInterceptorImpl.java
+++ b/custos-integration-services/group-management-service-parent/group-management-service/src/main/java/org/apache/custos/group/management/interceptors/ClientAuthInterceptorImpl.java
@@ -21,19 +21,13 @@
 
 import io.grpc.Metadata;
 import org.apache.custos.credential.store.client.CredentialStoreServiceClient;
-import org.apache.custos.iam.service.GroupRequest;
-import org.apache.custos.iam.service.GroupsRequest;
-import org.apache.custos.iam.service.UserGroupMappingRequest;
 import org.apache.custos.identity.client.IdentityClient;
-import org.apache.custos.identity.service.AuthToken;
-import org.apache.custos.integration.core.exceptions.NotAuthorizedException;
+import org.apache.custos.integration.core.exceptions.UnAuthorizedException;
 import org.apache.custos.integration.core.utils.Constants;
 import org.apache.custos.integration.services.commons.interceptors.MultiTenantAuthInterceptor;
 import org.apache.custos.integration.services.commons.model.AuthClaim;
 import org.apache.custos.tenant.profile.client.async.TenantProfileClient;
-import org.apache.custos.user.profile.service.GroupMembership;
-import org.apache.custos.user.profile.service.GroupToGroupMembership;
-import org.apache.custos.user.profile.service.UserProfileRequest;
+import org.apache.custos.user.profile.service.*;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 import org.springframework.beans.factory.annotation.Autowired;
@@ -62,7 +56,7 @@ public <ReqT> ReqT intercept(String method, Metadata headers, ReqT reqT) {
             AuthClaim claim = authorize(headers, request.getClientId());
 
             if (claim == null) {
-                throw new NotAuthorizedException("Request is not authorized", null);
+                throw new UnAuthorizedException("Request is not authorized", null);
             }
 
             String oauthId = claim.getIamAuthId();
@@ -70,26 +64,18 @@ public <ReqT> ReqT intercept(String method, Metadata headers, ReqT reqT) {
 
             long tenantId = claim.getTenantId();
 
-            AuthToken token = getSAToken(claim.getIamAuthId(), claim.getIamAuthSecret(), claim.getTenantId());
-            if (token == null || token.getAccessToken() == null) {
-                throw new NotAuthorizedException("Request is not authorized SA token is invalid", null);
-            }
-
-
-            return (ReqT) ((GroupRequest) reqT).toBuilder()
+            return (ReqT) ((org.apache.custos.user.profile.service.GroupRequest) reqT).toBuilder()
                     .setClientId(oauthId)
                     .setTenantId(tenantId)
-                    .setClientSec(oauthSec)
-                    .setAccessToken(token.getAccessToken())
-                    .setPerformedBy(claim.getPerformedBy() != null ? claim.getPerformedBy(): Constants.SYSTEM)
+                    .setPerformedBy(claim.getPerformedBy() != null ? claim.getPerformedBy() : Constants.SYSTEM)
                     .build();
 
-        } else if (method.equals("createGroups")) {
-            GroupsRequest request = (GroupsRequest) reqT;
+        } else if (method.equals("createGroup")) {
+            GroupRequest request = (GroupRequest) reqT;
             AuthClaim claim = authorize(headers, request.getClientId());
 
             if (claim == null) {
-                throw new NotAuthorizedException("Request is not authorized", null);
+                throw new UnAuthorizedException("Request is not authorized", null);
             }
 
             String oauthId = claim.getIamAuthId();
@@ -97,54 +83,39 @@ public <ReqT> ReqT intercept(String method, Metadata headers, ReqT reqT) {
 
             long tenantId = claim.getTenantId();
 
-            AuthToken token = getSAToken(claim.getIamAuthId(), claim.getIamAuthSecret(), claim.getTenantId());
-            if (token == null || token.getAccessToken() == null) {
-                throw new NotAuthorizedException("Request is not authorized SA token is invalid", null);
-            }
-
-
-            return (ReqT) ((GroupsRequest) reqT).toBuilder()
+            return (ReqT) ((GroupRequest) reqT).toBuilder()
                     .setClientId(oauthId)
                     .setTenantId(tenantId)
-                    .setClientSec(oauthSec)
-                    .setAccessToken(token.getAccessToken())
-                    .setPerformedBy(claim.getPerformedBy() != null ? claim.getPerformedBy(): Constants.SYSTEM)
+                    .setPerformedBy(claim.getPerformedBy() != null ? claim.getPerformedBy() : Constants.SYSTEM)
                     .build();
 
         } else if (method.equals("addUserToGroup") || method.equals("removeUserFromGroup")) {
-            UserGroupMappingRequest request = (UserGroupMappingRequest) reqT;
+            GroupMembership request = (GroupMembership) reqT;
             AuthClaim claim = authorize(headers, request.getClientId());
 
 
             if (claim == null) {
-                throw new NotAuthorizedException("Request is not authorized", null);
+                throw new UnAuthorizedException("Request is not authorized", null);
             }
 
             String oauthId = claim.getIamAuthId();
             String oauthSec = claim.getIamAuthSecret();
 
             long tenantId = claim.getTenantId();
-            AuthToken token = getSAToken(claim.getIamAuthId(), claim.getIamAuthSecret(), claim.getTenantId());
-            if (token == null || token.getAccessToken() == null) {
-                throw new NotAuthorizedException("Request is not authorized SA token is invalid", null);
-            }
 
-
-            return (ReqT) ((UserGroupMappingRequest) reqT).toBuilder()
+            return (ReqT) ((GroupMembership) reqT).toBuilder()
                     .setClientId(oauthId)
                     .setClientSec(oauthSec)
                     .setTenantId(tenantId)
-                    .setAccessToken(token.getAccessToken())
-                    .setPerformedBy(claim.getPerformedBy() != null ? claim.getPerformedBy(): Constants.SYSTEM)
                     .build();
 
         } else if (method.equals("addChildGroupToParentGroup") || method.equals("removeChildGroupFromParentGroup")) {
-            GroupToGroupMembership groupToGroupMembership = (GroupToGroupMembership)reqT;
+            GroupToGroupMembership groupToGroupMembership = (GroupToGroupMembership) reqT;
             AuthClaim claim = authorize(headers, groupToGroupMembership.getClientId());
 
 
             if (claim == null) {
-                throw new NotAuthorizedException("Request is not authorized", null);
+                throw new UnAuthorizedException("Request is not authorized", null);
             }
             long tenantId = claim.getTenantId();
 
@@ -155,12 +126,12 @@ public <ReqT> ReqT intercept(String method, Metadata headers, ReqT reqT) {
 
 
         } else if (method.equals("getAllGroupsOfUser")) {
-            UserProfileRequest request = (UserProfileRequest)reqT;
-            AuthClaim claim = authorize(headers,request.getClientId());
+            UserProfileRequest request = (UserProfileRequest) reqT;
+            AuthClaim claim = authorize(headers, request.getClientId());
 
 
             if (claim == null) {
-                throw new NotAuthorizedException("Request is not authorized", null);
+                throw new UnAuthorizedException("Request is not authorized", null);
             }
             long tenantId = claim.getTenantId();
 
@@ -178,7 +149,7 @@ public <ReqT> ReqT intercept(String method, Metadata headers, ReqT reqT) {
 
 
             if (claim == null) {
-                throw new NotAuthorizedException("Request is not authorized", null);
+                throw new UnAuthorizedException("Request is not authorized", null);
             }
             long tenantId = claim.getTenantId();
 
@@ -193,13 +164,27 @@ public <ReqT> ReqT intercept(String method, Metadata headers, ReqT reqT) {
 
 
             if (claim == null) {
-                throw new NotAuthorizedException("Request is not authorized", null);
+                throw new UnAuthorizedException("Request is not authorized", null);
             }
             long tenantId = claim.getTenantId();
 
             return (ReqT) ((GroupMembership) reqT).toBuilder()
                     .setTenantId(tenantId)
                     .build();
+        } else if (method.equals("addGroupMembershipType") || method.equals("removeUserGroupMembershipType")) {
+            UserGroupMembershipTypeRequest request =
+                    (UserGroupMembershipTypeRequest) reqT;
+            AuthClaim claim = authorize(headers, request.getClientId());
+
+
+            if (claim == null) {
+                throw new UnAuthorizedException("Request is not authorized", null);
+            }
+            long tenantId = claim.getTenantId();
+
+            return (ReqT) ((UserGroupMembershipTypeRequest) reqT).toBuilder()
+                    .setTenantId(tenantId)
+                    .build();
         }
         return reqT;
     }
diff --git a/custos-integration-services/group-management-service-parent/group-management-service/src/main/java/org/apache/custos/group/management/interceptors/InputValidator.java b/custos-integration-services/group-management-service-parent/group-management-service/src/main/java/org/apache/custos/group/management/interceptors/InputValidator.java
index ce6cdc10c..4cd6079d9 100644
--- a/custos-integration-services/group-management-service-parent/group-management-service/src/main/java/org/apache/custos/group/management/interceptors/InputValidator.java
+++ b/custos-integration-services/group-management-service-parent/group-management-service/src/main/java/org/apache/custos/group/management/interceptors/InputValidator.java
@@ -45,7 +45,7 @@ public class InputValidator implements IntegrationServiceInterceptor {
     private void validate(String methodName, Object body, Metadata headers) {
 
         switch (methodName) {
-            case "createGroups":
+            case "createGroup":
             case "updateGroup":
             case "deleteGroup":
             case "findGroup":
@@ -56,6 +56,8 @@ private void validate(String methodName, Object body, Metadata headers) {
             case "removeChildGroupFromParentGroup":
             case "getAllGroupsOfUser":
             case "getAllParentGroupsOfGroup":
+            case "addGroupMembershipType":
+            case "removeUserGroupMembershipType":
                 validateMethods(methodName, body, headers);
                 break;
             default:
diff --git a/custos-integration-services/group-management-service-parent/group-management-service/src/main/java/org/apache/custos/group/management/service/GroupManagementService.java b/custos-integration-services/group-management-service-parent/group-management-service/src/main/java/org/apache/custos/group/management/service/GroupManagementService.java
index 296a8b6df..5a0c2b288 100644
--- a/custos-integration-services/group-management-service-parent/group-management-service/src/main/java/org/apache/custos/group/management/service/GroupManagementService.java
+++ b/custos-integration-services/group-management-service-parent/group-management-service/src/main/java/org/apache/custos/group/management/service/GroupManagementService.java
@@ -38,6 +38,7 @@
 
 import java.util.ArrayList;
 import java.util.List;
+import java.util.UUID;
 
 @GRpcService
 public class GroupManagementService extends GroupManagementServiceGrpc.GroupManagementServiceImplBase {
@@ -57,7 +58,7 @@ public class GroupManagementService extends GroupManagementServiceGrpc.GroupMana
 
     //TODO: improve error handling to avoid database consistency
     @Override
-    public void createGroups(GroupsRequest request, StreamObserver<GroupsResponse> responseObserver) {
+    public void createKeycloakGroups(GroupsRequest request, StreamObserver<GroupsResponse> responseObserver) {
         try {
             LOGGER.debug("Request received create Groups for tenant " + request.getTenantId());
 
@@ -89,13 +90,13 @@ public void createGroups(GroupsRequest request, StreamObserver<GroupsResponse> r
 
     //TODO: improve error handling to avoid database consistency
     @Override
-    public void updateGroup(GroupRequest request, StreamObserver<GroupRepresentation> responseObserver) {
+    public void updateKeycloakGroup(GroupRequest request, StreamObserver<GroupRepresentation> responseObserver) {
         try {
             LOGGER.debug("Request received to updateGroup for tenant " + request.getTenantId());
 
             GroupRepresentation gr = request.getGroup();
 
-            if (request.getId() != null && ! request.getId().trim().equals("")) {
+            if (request.getId() != null && !request.getId().trim().equals("")) {
                 gr = gr.toBuilder().setId(request.getId()).build();
             }
             request = request.toBuilder().setGroup(gr).build();
@@ -140,12 +141,12 @@ public void updateGroup(GroupRequest request, StreamObserver<GroupRepresentation
 
     //TODO: improve error handling to avoid database consistency
     @Override
-    public void deleteGroup(GroupRequest request, StreamObserver<OperationStatus> responseObserver) {
+    public void deleteKeycloakGroup(GroupRequest request, StreamObserver<OperationStatus> responseObserver) {
         try {
             LOGGER.debug("Request received to updateGroup for tenant " + request.getTenantId());
 
             GroupRepresentation gr = request.getGroup();
-            if (request.getId() != null && ! request.getId().trim().equals("")) {
+            if (request.getId() != null && !request.getId().trim().equals("")) {
                 gr = gr.toBuilder().setId(request.getId()).build();
             }
             request = request.toBuilder().setGroup(gr).build();
@@ -180,7 +181,7 @@ public void deleteGroup(GroupRequest request, StreamObserver<OperationStatus> re
     }
 
     @Override
-    public void findGroup(GroupRequest request, StreamObserver<GroupRepresentation> responseObserver) {
+    public void findKeycloakGroup(GroupRequest request, StreamObserver<GroupRepresentation> responseObserver) {
         try {
             LOGGER.debug("Request received findGroup for group Id " + request.getGroup().getId() + " of  tenant "
                     + request.getTenantId());
@@ -220,7 +221,7 @@ public void findGroup(GroupRequest request, StreamObserver<GroupRepresentation>
     }
 
     @Override
-    public void getAllGroups(GroupRequest request, StreamObserver<GroupsResponse> responseObserver) {
+    public void getAllKeycloakGroups(GroupRequest request, StreamObserver<GroupsResponse> responseObserver) {
         try {
             LOGGER.debug("Request received getAllGroups for  tenant "
                     + request.getTenantId());
@@ -259,7 +260,7 @@ public void getAllGroups(GroupRequest request, StreamObserver<GroupsResponse> re
     }
 
     @Override
-    public void addUserToGroup(UserGroupMappingRequest request, StreamObserver<OperationStatus> responseObserver) {
+    public void addUserToKeycloakGroup(UserGroupMappingRequest request, StreamObserver<OperationStatus> responseObserver) {
         try {
             LOGGER.debug("Request received to addUserToGroup for  user  " + request.getUsername() + " of tenant "
                     + request.getTenantId());
@@ -299,7 +300,7 @@ public void addUserToGroup(UserGroupMappingRequest request, StreamObserver<Opera
 
 
     @Override
-    public void removeUserFromGroup(UserGroupMappingRequest request, StreamObserver<OperationStatus> responseObserver) {
+    public void removeUserFromKeycloakGroup(UserGroupMappingRequest request, StreamObserver<OperationStatus> responseObserver) {
         try {
             LOGGER.debug("Request received to removeUserFromGroup for  user  " + request.getUsername() + " of tenant "
                     + request.getTenantId());
@@ -336,54 +337,215 @@ public void removeUserFromGroup(UserGroupMappingRequest request, StreamObserver<
     }
 
 
+    @Override
+    public void createGroup(org.apache.custos.user.profile.service.GroupRequest request, StreamObserver<Group> responseObserver) {
+        try {
+            LOGGER.debug("Request received to createGroup   " + request.getGroup().getName() + " of tenant "
+                    + request.getTenantId());
+
+            String id = request.getGroup().getId();
+
+            updateProfile(request.getClientId(), request.getClientSec(),
+                    request.getTenantId(), request.getGroup().getOwnerId());
+            if (id != null && !id.trim().equals("")) {
+                Group group = Group.newBuilder()
+                        .setId(id)
+                        .build();
+
+                org.apache.custos.user.profile.service.GroupRequest groupRequest = org.apache.custos.user.profile.service.GroupRequest
+                        .newBuilder().
+                                setTenantId(request.getTenantId()).
+                                setPerformedBy(request.getPerformedBy()).
+                                setGroup(group).build();
+                Group exGroup = userProfileClient.getGroup(groupRequest);
+
+                if (exGroup.getName() != null && !exGroup.getName().trim().equals("")) {
+                    String msg = "Group already exist with given id " + id;
+                    LOGGER.error(msg);
+                    responseObserver.onError(Status.ALREADY_EXISTS.withDescription(msg).asRuntimeException());
+                }
+
+            } else {
+                id = request.getGroup().
+                        getName().toLowerCase().replace(" ", "_") + "_" + UUID.randomUUID();
+            }
+            Group group = request.getGroup().toBuilder().setId(id).build();
+            request = request.toBuilder().setGroup(group).build();
+            Group creadredGroup = userProfileClient.createGroup(request);
+            responseObserver.onNext(creadredGroup);
+            responseObserver.onCompleted();
+
+        } catch (Exception ex) {
+            String msg = "Error occurred at createGroup " + ex.getMessage();
+            LOGGER.error(msg, ex);
+            responseObserver.onError(Status.INTERNAL.withDescription(msg).asRuntimeException());
+        }
+    }
+
+    @Override
+    public void updateGroup(org.apache.custos.user.profile.service.GroupRequest request, StreamObserver<Group> responseObserver) {
+        try {
+            LOGGER.debug("Request received to updateGroup for  group  " + request.getGroup().getId() + " of tenant "
+                    + request.getTenantId());
+
+
+            if (request.getId() != null && !request.getId().trim().equals("")) {
+                Group group = request.getGroup().toBuilder().setId(request.getId()).build();
+                request = request.toBuilder().setGroup(group).build();
+            }
+
+            Group exGroup = userProfileClient.getGroup(request);
+            if (exGroup.getName() != null && !exGroup.getName().trim().equals("")) {
+                Group group = request.getGroup().toBuilder().setParentId(exGroup.getParentId()).build();
+                request = request.toBuilder().setGroup(group).build();
+                Group updatedGr = userProfileClient.updateGroup(request);
+                responseObserver.onNext(updatedGr);
+                responseObserver.onCompleted();
+            } else {
+                String msg = "Cannot find a group with id " + request.getId();
+                LOGGER.error(msg);
+                responseObserver.onError(Status.NOT_FOUND.withDescription(msg).asRuntimeException());
+            }
+
+        } catch (Exception ex) {
+            String msg = "Error occurred at updateGroup " + ex.getMessage();
+            LOGGER.error(msg, ex);
+            responseObserver.onError(Status.INTERNAL.withDescription(msg).asRuntimeException());
+
+        }
+    }
+
+    @Override
+    public void deleteGroup(org.apache.custos.user.profile.service.GroupRequest request,
+                            StreamObserver<org.apache.custos.user.profile.service.Status> responseObserver) {
+        try {
+            LOGGER.debug("Request received to deleteGroup for  group  " + request.getGroup().getId() + " of tenant "
+                    + request.getTenantId());
+            if (request.getId() != null && !request.getId().trim().equals("")) {
+                Group group = request.getGroup().toBuilder().setId(request.getId()).build();
+                request = request.toBuilder().setGroup(group).build();
+            }
+            userProfileClient.deleteGroup(request);
+            org.apache.custos.user.profile.service.Status status =
+                    org.apache.custos.user.profile.service.Status.newBuilder().setStatus(true).build();
+            responseObserver.onNext(status);
+            responseObserver.onCompleted();
+
+        } catch (Exception ex) {
+            String msg = "Error occurred at removeUserFromGroup " + ex.getMessage();
+            LOGGER.error(msg, ex);
+            responseObserver.onError(Status.INTERNAL.withDescription(msg).asRuntimeException());
+        }
+    }
+
+    @Override
+    public void findGroup(org.apache.custos.user.profile.service.GroupRequest request, StreamObserver<Group> responseObserver) {
+        try {
+            LOGGER.debug("Request received to findGroup  of tenant " + request.getTenantId());
+            Group group = userProfileClient.getGroup(request);
+            responseObserver.onNext(group);
+            responseObserver.onCompleted();
+
+        } catch (Exception ex) {
+            String msg = "Error occurred at removeUserFromGroup " + ex.getMessage();
+            LOGGER.error(msg, ex);
+            responseObserver.onError(Status.INTERNAL.withDescription(msg).asRuntimeException());
+
+        }
+    }
+
+    @Override
+    public void getAllGroups(org.apache.custos.user.profile.service.GroupRequest request, StreamObserver<GetAllGroupsResponse> responseObserver) {
+        try {
+            LOGGER.debug("Request received to getAllGroups of tenant " + request.getTenantId());
+            GetAllGroupsResponse response = userProfileClient.getAllGroups(request);
+            responseObserver.onNext(response);
+            responseObserver.onCompleted();
+
+        } catch (Exception ex) {
+            String msg = "Error occurred at removeUserFromGroup " + ex.getMessage();
+            LOGGER.error(msg, ex);
+            responseObserver.onError(Status.INTERNAL.withDescription(msg).asRuntimeException());
+
+        }
+    }
+
+    @Override
+    public void addUserToGroup(GroupMembership request, StreamObserver<org.apache.custos.user.profile.service.Status> responseObserver) {
+        try {
+            LOGGER.debug("Request received to addUserToGroup for  user  " + request.getUsername() + " of tenant "
+                    + request.getTenantId());
+
+            updateProfile(request.getClientId(), request.getClientSec(), request.getTenantId(), request.getUsername());
+
+            org.apache.custos.user.profile.service.Status status = userProfileClient.addUserToGroup(request);
+            responseObserver.onNext(status);
+            responseObserver.onCompleted();
+
+
+        } catch (Exception ex) {
+            String msg = "Error occurred at addUserToGroup " + ex.getMessage();
+            LOGGER.error(msg, ex);
+            responseObserver.onError(Status.INTERNAL.withDescription(msg).asRuntimeException());
+
+        }
+    }
+
+    @Override
+    public void removeUserFromGroup(GroupMembership request, StreamObserver<org.apache.custos.user.profile.service.Status> responseObserver) {
+        try {
+            LOGGER.debug("Request received to removeUserFromGroup for  user  " + request.getUsername() + " of tenant "
+                    + request.getTenantId());
+            org.apache.custos.user.profile.service.Status status = userProfileClient.removeUserFromGroup(request);
+            responseObserver.onNext(status);
+            responseObserver.onCompleted();
+        } catch (Exception ex) {
+            String msg = "Error occurred at removeUserFromGroup " + ex.getMessage();
+            LOGGER.error(msg, ex);
+            responseObserver.onError(Status.INTERNAL.withDescription(msg).asRuntimeException());
+
+        }
+    }
+
     @Override
     public void addChildGroupToParentGroup(GroupToGroupMembership request,
-                                           StreamObserver<OperationStatus> responseObserver) {
+                                           StreamObserver<org.apache.custos.user.profile.service.Status> responseObserver) {
         try {
             LOGGER.debug("Request received to addChildGroupToParentGroup for  group  " + request.getChildId() +
                     " to add " + request.getParentId() + " of tenant " + request.getTenantId());
 
             org.apache.custos.user.profile.service.Status status = userProfileClient.addChildGroupToParentGroup(request);
 
-            OperationStatus operationStatus = OperationStatus.newBuilder().setStatus(status.getStatus()).build();
 
-            responseObserver.onNext(operationStatus);
+            responseObserver.onNext(status);
             responseObserver.onCompleted();
 
         } catch (Exception ex) {
             String msg = "Error occurred at addChildGroupToParentGroup " + ex.getMessage();
             LOGGER.error(msg, ex);
-            if (ex.getMessage().contains("UNAUTHENTICATED")) {
-                responseObserver.onError(Status.UNAUTHENTICATED.withDescription(msg).asRuntimeException());
-            } else {
-                responseObserver.onError(Status.INTERNAL.withDescription(msg).asRuntimeException());
-            }
+            responseObserver.onError(Status.INTERNAL.withDescription(msg).asRuntimeException());
+
         }
     }
 
     @Override
     public void removeChildGroupFromParentGroup(GroupToGroupMembership request,
-                                                StreamObserver<OperationStatus> responseObserver) {
+                                                StreamObserver<org.apache.custos.user.profile.service.Status> responseObserver) {
         try {
             LOGGER.debug("Request received to removeUserFromGroup for  group  " + request.getChildId() +
                     " to remove " + request.getParentId() + " of tenant " + request.getTenantId());
 
             org.apache.custos.user.profile.service.Status status = userProfileClient.removeChildGroupFromParentGroup(request);
 
-            OperationStatus operationStatus = OperationStatus.newBuilder().setStatus(status.getStatus()).build();
-
-            responseObserver.onNext(operationStatus);
+            responseObserver.onNext(status);
             responseObserver.onCompleted();
 
 
         } catch (Exception ex) {
             String msg = "Error occurred at removeChildGroupFromParentGroup " + ex.getMessage();
             LOGGER.error(msg, ex);
-            if (ex.getMessage().contains("UNAUTHENTICATED")) {
-                responseObserver.onError(Status.UNAUTHENTICATED.withDescription(msg).asRuntimeException());
-            } else {
-                responseObserver.onError(Status.INTERNAL.withDescription(msg).asRuntimeException());
-            }
+            responseObserver.onError(Status.INTERNAL.withDescription(msg).asRuntimeException());
+
         }
     }
 
@@ -403,11 +565,8 @@ public void getAllGroupsOfUser(UserProfileRequest request,
         } catch (Exception ex) {
             String msg = "Error occurred at getAllGroupsOfUser " + ex.getMessage();
             LOGGER.error(msg, ex);
-            if (ex.getMessage().contains("UNAUTHENTICATED")) {
-                responseObserver.onError(Status.UNAUTHENTICATED.withDescription(msg).asRuntimeException());
-            } else {
-                responseObserver.onError(Status.INTERNAL.withDescription(msg).asRuntimeException());
-            }
+            responseObserver.onError(Status.INTERNAL.withDescription(msg).asRuntimeException());
+
         }
     }
 
@@ -426,11 +585,8 @@ public void getAllParentGroupsOfGroup(org.apache.custos.user.profile.service.Gro
         } catch (Exception ex) {
             String msg = "Error occurred at getAllParentGroupsOfGroup " + ex.getMessage();
             LOGGER.error(msg, ex);
-            if (ex.getMessage().contains("UNAUTHENTICATED")) {
-                responseObserver.onError(Status.UNAUTHENTICATED.withDescription(msg).asRuntimeException());
-            } else {
-                responseObserver.onError(Status.INTERNAL.withDescription(msg).asRuntimeException());
-            }
+            responseObserver.onError(Status.INTERNAL.withDescription(msg).asRuntimeException());
+
         }
     }
 
@@ -449,11 +605,8 @@ public void getAllChildUsers(org.apache.custos.user.profile.service.GroupRequest
         } catch (Exception ex) {
             String msg = "Error occurred at getAllChildUsers " + ex.getMessage();
             LOGGER.error(msg, ex);
-            if (ex.getMessage().contains("UNAUTHENTICATED")) {
-                responseObserver.onError(Status.UNAUTHENTICATED.withDescription(msg).asRuntimeException());
-            } else {
-                responseObserver.onError(Status.INTERNAL.withDescription(msg).asRuntimeException());
-            }
+            responseObserver.onError(Status.INTERNAL.withDescription(msg).asRuntimeException());
+
         }
     }
 
@@ -471,63 +624,147 @@ public void getAllChildGroups(org.apache.custos.user.profile.service.GroupReques
         } catch (Exception ex) {
             String msg = "Error occurred at getAllChildGroups " + ex.getMessage();
             LOGGER.error(msg, ex);
-            if (ex.getMessage().contains("UNAUTHENTICATED")) {
-                responseObserver.onError(Status.UNAUTHENTICATED.withDescription(msg).asRuntimeException());
-            } else {
-                responseObserver.onError(Status.INTERNAL.withDescription(msg).asRuntimeException());
-            }
+            responseObserver.onError(Status.INTERNAL.withDescription(msg).asRuntimeException());
+
         }
     }
 
     @Override
-    public void changeUserMembershipType(GroupMembership request, StreamObserver<OperationStatus> responseObserver) {
+    public void changeUserMembershipType(GroupMembership request, StreamObserver<org.apache.custos.user.profile.service.Status> responseObserver) {
         try {
             LOGGER.debug("Request received to changeUserMembershipType for  user  "
                     + request.getUsername() + " of tenant " + request.getTenantId());
 
             org.apache.custos.user.profile.service.Status response = userProfileClient.changeUserMembershipType(request);
 
-            OperationStatus status = OperationStatus.newBuilder().setStatus(response.getStatus()).build();
 
-            responseObserver.onNext(status);
+            responseObserver.onNext(response);
             responseObserver.onCompleted();
 
 
         } catch (Exception ex) {
             String msg = "Error occurred at changeUserMembershipType " + ex.getMessage();
             LOGGER.error(msg, ex);
-            if (ex.getMessage().contains("UNAUTHENTICATED")) {
-                responseObserver.onError(Status.UNAUTHENTICATED.withDescription(msg).asRuntimeException());
-            } else {
-                responseObserver.onError(Status.INTERNAL.withDescription(msg).asRuntimeException());
-            }
+            responseObserver.onError(Status.INTERNAL.withDescription(msg).asRuntimeException());
+
         }
     }
 
     @Override
-    public void hasAccess(GroupMembership request, StreamObserver<OperationStatus> responseObserver) {
+    public void hasAccess(GroupMembership request, StreamObserver<org.apache.custos.user.profile.service.Status> responseObserver) {
         try {
             LOGGER.debug("Request received to hasAccess for  user  "
                     + request.getUsername() + " of tenant " + request.getTenantId());
 
             org.apache.custos.user.profile.service.Status response = userProfileClient.hasAccess(request);
 
-            OperationStatus status = OperationStatus.newBuilder().setStatus(response.getStatus()).build();
-
-            responseObserver.onNext(status);
+            responseObserver.onNext(response);
             responseObserver.onCompleted();
 
         } catch (Exception ex) {
             String msg = "Error occurred at hasAccess " + ex.getMessage();
             LOGGER.error(msg, ex);
-            if (ex.getMessage().contains("UNAUTHENTICATED")) {
-                responseObserver.onError(Status.UNAUTHENTICATED.withDescription(msg).asRuntimeException());
-            } else {
-                responseObserver.onError(Status.INTERNAL.withDescription(msg).asRuntimeException());
-            }
+            responseObserver.onError(Status.INTERNAL.withDescription(msg).asRuntimeException());
+
         }
     }
 
+    @Override
+    public void addGroupMembershipType(UserGroupMembershipTypeRequest request,
+                                       StreamObserver<org.apache.custos.user.profile.service.Status> responseObserver) {
+        try {
+            LOGGER.debug("Request received to addGroupMembershipType for  tenant " + request.getTenantId()
+                    + ", type " + request.getType());
+
+            org.apache.custos.user.profile.service.Status response = userProfileClient.addUserMembershipType(request);
+
+            responseObserver.onNext(response);
+            responseObserver.onCompleted();
+
+        } catch (Exception ex) {
+            String msg = "Error occurred at addGroupMembershipType " + ex.getMessage();
+            LOGGER.error(msg, ex);
+            responseObserver.onError(Status.INTERNAL.withDescription(msg).asRuntimeException());
+
+        }
+
+    }
+
+    @Override
+    public void removeUserGroupMembershipType(UserGroupMembershipTypeRequest request,
+                                              StreamObserver<org.apache.custos.user.profile.service.Status> responseObserver) {
+        try {
+            LOGGER.debug("Request received to removeUserGroupMembershipType for  tenant " + request.getTenantId()
+                    + ", type " + request.getType());
+
+            org.apache.custos.user.profile.service.Status response = userProfileClient.removeUserMembershipType(request);
+
+            responseObserver.onNext(response);
+            responseObserver.onCompleted();
+
+        } catch (Exception ex) {
+            String msg = "Error occurred at removeUserGroupMembershipType " + ex.getMessage();
+            LOGGER.error(msg, ex);
+            responseObserver.onError(Status.INTERNAL.withDescription(msg).asRuntimeException());
+
+        }
+
+    }
+
+    private void updateProfile(String clientId, String clientSec, long tenantId, String username) {
+
+        UserProfile userProfile = UserProfile.newBuilder().setUsername(username).build();
+        UserProfileRequest userProfileRequest = UserProfileRequest
+                .newBuilder()
+                .setTenantId(tenantId)
+                .setProfile(userProfile)
+                .build();
+
+        UserProfile exUser = userProfileClient.getUser(userProfileRequest);
+        if (exUser.getUsername().isBlank()) {
+
+            GetUserManagementSATokenRequest userManagementSATokenRequest = GetUserManagementSATokenRequest
+                    .newBuilder()
+                    .setClientId(clientId)
+                    .setClientSecret(clientSec)
+                    .setTenantId(tenantId)
+                    .build();
+
+            AuthToken token = identityClient.getUserManagementSATokenRequest(userManagementSATokenRequest);
+            UserSearchMetadata userSearchMetadata = UserSearchMetadata
+                    .newBuilder().setUsername(username).build();
+
+            UserSearchRequest searchRequest = UserSearchRequest
+                    .newBuilder()
+                    .setClientId(clientId)
+                    .setTenantId(tenantId)
+                    .setAccessToken(token.getAccessToken())
+                    .setUser(userSearchMetadata)
+                    .build();
+
+            UserRepresentation representation = iamAdminServiceClient.getUser(searchRequest);
+
+            UserProfile profile = UserProfile
+                    .newBuilder()
+                    .setUsername(username)
+                    .setFirstName(representation.getFirstName())
+                    .setLastName(representation.getLastName())
+                    .setEmail(representation.getEmail())
+                    .build();
+
+            UserProfileRequest profileRequest = UserProfileRequest
+                    .newBuilder()
+                    .setTenantId(tenantId)
+                    .setProfile(profile)
+                    .build();
+
+            userProfileClient.createUserProfile(profileRequest);
+        }
+
+
+    }
+
+
     private org.apache.custos.user.profile.service.GroupRequest createGroup(GroupRepresentation representation,
                                                                             String parentId,
                                                                             long tenantId,
diff --git a/custos-integration-services/group-management-service-parent/group-management-service/src/main/proto/GroupManagementService.proto b/custos-integration-services/group-management-service-parent/group-management-service/src/main/proto/GroupManagementService.proto
index faab105b9..8a556b713 100644
--- a/custos-integration-services/group-management-service-parent/group-management-service/src/main/proto/GroupManagementService.proto
+++ b/custos-integration-services/group-management-service-parent/group-management-service/src/main/proto/GroupManagementService.proto
@@ -30,29 +30,81 @@ import "IamAdminService.proto";
 
 service GroupManagementService {
 
-    rpc createGroups (org.apache.custos.iam.service.GroupsRequest) returns (org.apache.custos.iam.service.GroupsResponse) {
+    rpc createKeycloakGroups (org.apache.custos.iam.service.GroupsRequest) returns (org.apache.custos.iam.service.GroupsResponse) {
 
         option (google.api.http) = {
-           post: "/group-management/v1.0.0/groups"
+           post: "/group-management/v1.0.0/keycloak/groups"
          };
     }
 
 
-    rpc updateGroup (org.apache.custos.iam.service.GroupRequest) returns (org.apache.custos.iam.service.GroupRepresentation) {
+    rpc updateKeycloakGroup (org.apache.custos.iam.service.GroupRequest) returns (org.apache.custos.iam.service.GroupRepresentation) {
+
+        option (google.api.http) = {
+           put: "/group-management/v1.0.0/keycloak/group/{id}"
+         };
+    }
+
+    rpc deleteKeycloakGroup (org.apache.custos.iam.service.GroupRequest) returns (org.apache.custos.iam.service.OperationStatus) {
+
+        option (google.api.http) = {
+           delete: "/group-management/v1.0.0/keycloak/group/{id}"
+         };
+    }
+
+    rpc findKeycloakGroup (org.apache.custos.iam.service.GroupRequest) returns (org.apache.custos.iam.service.GroupRepresentation) {
+
+        option (google.api.http) = {
+           get: "/group-management/v1.0.0/keycloak/group"
+         };
+    }
+
+
+    rpc getAllKeycloakGroups (org.apache.custos.iam.service.GroupRequest) returns (org.apache.custos.iam.service.GroupsResponse) {
+
+        option (google.api.http) = {
+           get: "/group-management/v1.0.0/keycloak/groups"
+         };
+    }
+
+    rpc addUserToKeycloakGroup (org.apache.custos.iam.service.UserGroupMappingRequest) returns (org.apache.custos.iam.service.OperationStatus) {
+
+        option (google.api.http) = {
+           post: "/group-management/v1.0.0/keycloak/user/group/membership"
+         };
+    }
+
+
+    rpc removeUserFromKeycloakGroup (org.apache.custos.iam.service.UserGroupMappingRequest) returns (org.apache.custos.iam.service.OperationStatus) {
+
+        option (google.api.http) = {
+           delete: "/group-management/v1.0.0/keycloak/user/group/membership"
+         };
+    }
+
+    rpc createGroup (org.apache.custos.user.profile.service.GroupRequest) returns (org.apache.custos.user.profile.service.Group) {
+
+        option (google.api.http) = {
+           post: "/group-management/v1.0.0/group"
+         };
+    }
+
+
+    rpc updateGroup (org.apache.custos.user.profile.service.GroupRequest) returns (org.apache.custos.user.profile.service.Group) {
 
         option (google.api.http) = {
            put: "/group-management/v1.0.0/group/{id}"
          };
     }
 
-    rpc deleteGroup (org.apache.custos.iam.service.GroupRequest) returns (org.apache.custos.iam.service.OperationStatus) {
+    rpc deleteGroup (org.apache.custos.user.profile.service.GroupRequest) returns (org.apache.custos.user.profile.service.Status) {
 
         option (google.api.http) = {
            delete: "/group-management/v1.0.0/group/{id}"
          };
     }
 
-    rpc findGroup (org.apache.custos.iam.service.GroupRequest) returns (org.apache.custos.iam.service.GroupRepresentation) {
+    rpc findGroup (org.apache.custos.user.profile.service.GroupRequest) returns (org.apache.custos.user.profile.service.Group) {
 
         option (google.api.http) = {
            get: "/group-management/v1.0.0/group"
@@ -60,14 +112,14 @@ service GroupManagementService {
     }
 
 
-    rpc getAllGroups (org.apache.custos.iam.service.GroupRequest) returns (org.apache.custos.iam.service.GroupsResponse) {
+    rpc getAllGroups (org.apache.custos.user.profile.service.GroupRequest) returns (org.apache.custos.user.profile.service.GetAllGroupsResponse) {
 
         option (google.api.http) = {
            get: "/group-management/v1.0.0/groups"
          };
     }
 
-    rpc addUserToGroup (org.apache.custos.iam.service.UserGroupMappingRequest) returns (org.apache.custos.iam.service.OperationStatus) {
+    rpc addUserToGroup (org.apache.custos.user.profile.service.GroupMembership) returns (org.apache.custos.user.profile.service.Status) {
 
         option (google.api.http) = {
            post: "/group-management/v1.0.0/user/group/membership"
@@ -75,20 +127,21 @@ service GroupManagementService {
     }
 
 
-    rpc removeUserFromGroup (org.apache.custos.iam.service.UserGroupMappingRequest) returns (org.apache.custos.iam.service.OperationStatus) {
+    rpc removeUserFromGroup (org.apache.custos.user.profile.service.GroupMembership) returns (org.apache.custos.user.profile.service.Status) {
 
         option (google.api.http) = {
            delete: "/group-management/v1.0.0/user/group/membership"
          };
     }
 
-    rpc addChildGroupToParentGroup (org.apache.custos.user.profile.service.GroupToGroupMembership) returns (org.apache.custos.iam.service.OperationStatus) {
+
+    rpc addChildGroupToParentGroup (org.apache.custos.user.profile.service.GroupToGroupMembership) returns (org.apache.custos.user.profile.service.Status) {
         option (google.api.http) = {
            post: "/group-management/v1.0.0/group/membership"
          };
 
     }
-    rpc removeChildGroupFromParentGroup (org.apache.custos.user.profile.service.GroupToGroupMembership) returns (org.apache.custos.iam.service.OperationStatus) {
+    rpc removeChildGroupFromParentGroup (org.apache.custos.user.profile.service.GroupToGroupMembership) returns (org.apache.custos.user.profile.service.Status) {
 
         option (google.api.http) = {
            delete: "/group-management/v1.0.0/group/membership"
@@ -122,19 +175,33 @@ service GroupManagementService {
          };
 
     }
-    rpc changeUserMembershipType (org.apache.custos.user.profile.service.GroupMembership) returns (org.apache.custos.iam.service.OperationStatus) {
+    rpc changeUserMembershipType (org.apache.custos.user.profile.service.GroupMembership) returns (org.apache.custos.user.profile.service.Status) {
         option (google.api.http) = {
            put: "/group-management/v1.0.0/user/group/membership"
          };
 
     }
-    rpc hasAccess(org.apache.custos.user.profile.service.GroupMembership) returns (org.apache.custos.iam.service.OperationStatus) {
+    rpc hasAccess(org.apache.custos.user.profile.service.GroupMembership) returns (org.apache.custos.user.profile.service.Status) {
         option (google.api.http) = {
            get: "/group-management/v1.0.0/user/group/access"
          };
 
     }
 
+    rpc addGroupMembershipType(org.apache.custos.user.profile.service.UserGroupMembershipTypeRequest) returns (org.apache.custos.user.profile.service.Status) {
+        option (google.api.http) = {
+           post: "/group-management/v1.0.0/user/group/membership/type"
+         };
+
+    }
+
+    rpc removeUserGroupMembershipType(org.apache.custos.user.profile.service.UserGroupMembershipTypeRequest) returns (org.apache.custos.user.profile.service.Status) {
+        option (google.api.http) = {
+           delete: "/group-management/v1.0.0/user/group/membership/type"
+         };
+
+    }
+
 
 }
 
diff --git a/custos-integration-services/identity-management-service-parent/identity-management-service/pom.xml b/custos-integration-services/identity-management-service-parent/identity-management-service/pom.xml
index 7ced6c43b..979775f1a 100644
--- a/custos-integration-services/identity-management-service-parent/identity-management-service/pom.xml
+++ b/custos-integration-services/identity-management-service-parent/identity-management-service/pom.xml
@@ -106,6 +106,7 @@
             <groupId>com.google.api.grpc</groupId>
             <artifactId>proto-google-common-protos</artifactId>
         </dependency>
+
     </dependencies>
 
     <build>
@@ -124,6 +125,13 @@
                     <skip>false</skip>
                 </configuration>
             </plugin>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-antrun-plugin</artifactId>
+                <configuration>
+                    <skip>false</skip>
+                </configuration>
+            </plugin>
         </plugins>
     </build>
 
diff --git a/custos-integration-services/identity-management-service-parent/identity-management-service/src/main/helm/templates/deployment.yaml b/custos-integration-services/identity-management-service-parent/identity-management-service/src/main/helm/templates/deployment.yaml
index a0957f6b1..668c290e3 100644
--- a/custos-integration-services/identity-management-service-parent/identity-management-service/src/main/helm/templates/deployment.yaml
+++ b/custos-integration-services/identity-management-service-parent/identity-management-service/src/main/helm/templates/deployment.yaml
@@ -6,9 +6,10 @@ metadata:
 {{ include "helm.labels" . | indent 4 }}
 spec:
   replicas: {{ .Values.replicaCount }}
-  rollingUpdate:
-    maxSurge: {{ .Values.rollingUpdate.maxSurge }}
-    maxUnavailable: {{ .Values.rollingUpdate.maxUnavailable }}
+  strategy:
+    rollingUpdate:
+      maxSurge: {{ .Values.rollingUpdate.maxSurge }}
+      maxUnavailable: {{ .Values.rollingUpdate.maxUnavailable }}
   selector:
     matchLabels:
       app.kubernetes.io/name: {{ include "helm.name" . }}
@@ -45,9 +46,9 @@ spec:
             httpGet:
               path: /actuator/health
               port: {{ .Values.service.port }}
-              initialDelaySeconds: {{ .Values.readinessProbe.initialDelaySeconds }}
-              periodSeconds: {{ .Values.readinessProbe.periodSeconds }}
-              successThreshold: {{ .Values.readinessProbe.successThreshold }}
+            initialDelaySeconds: {{ .Values.readinessProbe.initialDelaySeconds }}
+            periodSeconds: {{ .Values.readinessProbe.periodSeconds }}
+            successThreshold: {{ .Values.readinessProbe.successThreshold }}
           resources:
               {{- toYaml .Values.resources | nindent 12 }}
         - name: {{ .Chart.Name }}-envoy-proxy
diff --git a/custos-integration-services/identity-management-service-parent/identity-management-service/src/main/helm/templates/ingress-grpc.yaml b/custos-integration-services/identity-management-service-parent/identity-management-service/src/main/helm/templates/ingress-grpc.yaml
index 0fbbed621..bf25ca5cf 100644
--- a/custos-integration-services/identity-management-service-parent/identity-management-service/src/main/helm/templates/ingress-grpc.yaml
+++ b/custos-integration-services/identity-management-service-parent/identity-management-service/src/main/helm/templates/ingress-grpc.yaml
@@ -1,4 +1,4 @@
-apiVersion: extensions/v1beta1
+apiVersion: networking.k8s.io/v1beta1
 kind: Ingress
 metadata:
   annotations:
diff --git a/custos-integration-services/identity-management-service-parent/identity-management-service/src/main/java/org/apache/custos/identity/management/interceptors/AgentAuthInterceptor.java b/custos-integration-services/identity-management-service-parent/identity-management-service/src/main/java/org/apache/custos/identity/management/interceptors/AgentAuthInterceptor.java
index 155c402fb..99dbc3aed 100644
--- a/custos-integration-services/identity-management-service-parent/identity-management-service/src/main/java/org/apache/custos/identity/management/interceptors/AgentAuthInterceptor.java
+++ b/custos-integration-services/identity-management-service-parent/identity-management-service/src/main/java/org/apache/custos/identity/management/interceptors/AgentAuthInterceptor.java
@@ -24,7 +24,7 @@
 import org.apache.custos.identity.client.IdentityClient;
 import org.apache.custos.identity.management.service.EndSessionRequest;
 import org.apache.custos.identity.management.service.GetAgentTokenRequest;
-import org.apache.custos.integration.core.exceptions.NotAuthorizedException;
+import org.apache.custos.integration.core.exceptions.UnAuthorizedException;
 import org.apache.custos.integration.services.commons.interceptors.AuthInterceptor;
 import org.apache.custos.integration.services.commons.model.AuthClaim;
 import org.apache.custos.tenant.profile.client.async.TenantProfileClient;
@@ -50,7 +50,7 @@ public <ReqT> ReqT intercept(String method, Metadata headers, ReqT msg) {
         if (method.equals("getAgentToken")) {
             AuthClaim claim = authorizeUsingAgentBasicToken(headers, ((GetAgentTokenRequest) msg).getClientId());
             if (claim == null) {
-                throw new NotAuthorizedException("Request is not authorized", null);
+                throw new UnAuthorizedException("Request is not authorized", null);
             }
             GetAgentTokenRequest reqCore =
                     ((GetAgentTokenRequest) msg).toBuilder()
@@ -66,7 +66,7 @@ public <ReqT> ReqT intercept(String method, Metadata headers, ReqT msg) {
             LOGGER.info("ClientId " + ((EndSessionRequest) msg).getClientId());
             AuthClaim claim = authorizeUsingAgentBasicToken(headers, ((EndSessionRequest) msg).getClientId());
             if (claim == null) {
-                throw new NotAuthorizedException("Request is not authorized", null);
+                throw new UnAuthorizedException("Request is not authorized", null);
             }
 
 
diff --git a/custos-integration-services/identity-management-service-parent/identity-management-service/src/main/java/org/apache/custos/identity/management/interceptors/AuthInterceptorImpl.java b/custos-integration-services/identity-management-service-parent/identity-management-service/src/main/java/org/apache/custos/identity/management/interceptors/AuthInterceptorImpl.java
index 416b79c0f..2164eb77d 100644
--- a/custos-integration-services/identity-management-service-parent/identity-management-service/src/main/java/org/apache/custos/identity/management/interceptors/AuthInterceptorImpl.java
+++ b/custos-integration-services/identity-management-service-parent/identity-management-service/src/main/java/org/apache/custos/identity/management/interceptors/AuthInterceptorImpl.java
@@ -25,12 +25,11 @@
 import org.apache.custos.identity.client.IdentityClient;
 import org.apache.custos.identity.management.service.EndSessionRequest;
 import org.apache.custos.identity.management.service.GetCredentialsRequest;
-import org.apache.custos.identity.management.utils.Constants;
 import org.apache.custos.identity.service.AuthToken;
 import org.apache.custos.identity.service.AuthenticationRequest;
 import org.apache.custos.identity.service.Claim;
 import org.apache.custos.identity.service.GetTokenRequest;
-import org.apache.custos.integration.core.exceptions.NotAuthorizedException;
+import org.apache.custos.integration.core.exceptions.UnAuthorizedException;
 import org.apache.custos.integration.services.commons.interceptors.MultiTenantAuthInterceptor;
 import org.apache.custos.integration.services.commons.model.AuthClaim;
 import org.apache.custos.tenant.profile.client.async.TenantProfileClient;
@@ -64,7 +63,7 @@ public <ReqT> ReqT intercept(String method, Metadata headers, ReqT reqT) {
         if (method.equals("authenticate")) {
             AuthClaim claim = authorize(headers);
             if (claim == null) {
-                throw new NotAuthorizedException("Request is not authorized", null);
+                throw new UnAuthorizedException("Request is not authorized", null);
             }
             AuthenticationRequest reqCore =
                     ((AuthenticationRequest) reqT).toBuilder()
@@ -74,27 +73,22 @@ public <ReqT> ReqT intercept(String method, Metadata headers, ReqT reqT) {
                             .build();
 
             return (ReqT) reqCore;
-        } else if (method.equals("isAuthenticated")) {
+        } else if (method.equals("isAuthenticated") || method.equals("getUser")) {
             AuthClaim claim = authorize(headers);
             if (claim == null) {
-                throw new NotAuthorizedException("Request is not authorized", null);
+                throw new UnAuthorizedException("Request is not authorized", null);
             }
 
             String accessToken = ((AuthToken) reqT).getAccessToken();
 
+            AuthClaim authClaim = authorizeUsingUserToken(accessToken);
+
             AuthToken.Builder authzBuilder = AuthToken.newBuilder()
                     .setAccessToken(accessToken);
 
-            String username = null;
-
-            for (Claim claims : ((AuthToken) reqT).getClaimsList()) {
-                if (claims.getKey().equals("username")) {
-                    username = claims.getValue();
-                }
-            }
-            Claim userClaim = Claim.newBuilder().setKey("username").setValue(username).build();
+            Claim userClaim = Claim.newBuilder().setKey("username").setValue(authClaim.getUsername()).build();
 
-            Claim tenantClaim = Claim.newBuilder().setKey("tenantId").setValue(String.valueOf(claim.getTenantId())).build();
+            Claim tenantClaim = Claim.newBuilder().setKey("tenantId").setValue(String.valueOf(authClaim.getTenantId())).build();
 
             authzBuilder.addClaims(userClaim);
             authzBuilder.addClaims(tenantClaim);
@@ -102,43 +96,10 @@ public <ReqT> ReqT intercept(String method, Metadata headers, ReqT reqT) {
             return (ReqT) authzBuilder.build();
 
 
-        } else if (method.equals("getUser")) {
-
-            AuthToken authToken = ((AuthToken) reqT);
-            String clientId = null;
-            for (Claim claim : authToken.getClaimsList()) {
-                if (claim.getKey().equals(Constants.CLIENT_ID)) {
-                    clientId = claim.getValue();
-                }
-            }
-
-            String username = null;
-            for (Claim claims : ((AuthToken) reqT).getClaimsList()) {
-                if (claims.getKey().equals("username")) {
-                    username = claims.getValue();
-                }
-            }
-
-            String accessToken = ((AuthToken) reqT).getAccessToken();
-            AuthToken.Builder authzBuilder = AuthToken.newBuilder()
-                    .setAccessToken(accessToken);
-            AuthClaim claim = authorize(headers, clientId);
-            if (claim == null) {
-                throw new NotAuthorizedException("Request is not authorized", null);
-            }
-
-            long tenantId = claim.getTenantId();
-
-            Claim userClaim = Claim.newBuilder().setKey("username").setValue(username).build();
-            Claim tenantClaim = Claim.newBuilder().setKey("tenantId").setValue(String.valueOf(tenantId)).build();
-            authzBuilder.addClaims(userClaim);
-            authzBuilder.addClaims(tenantClaim);
-
-            return (ReqT) authzBuilder.build();
         } else if (method.equals("getUserManagementServiceAccountAccessToken")) {
             AuthClaim claim = authorize(headers);
             if (claim == null) {
-                throw new NotAuthorizedException("Request is not authorized", null);
+                throw new UnAuthorizedException("Request is not authorized", null);
             }
 
             org.apache.custos.identity.service.GetUserManagementSATokenRequest request =
@@ -153,7 +114,7 @@ public <ReqT> ReqT intercept(String method, Metadata headers, ReqT reqT) {
         } else if (method.equals("token")) {
             AuthClaim claim = authorize(headers);
             if (claim == null) {
-                throw new NotAuthorizedException("Request is not authorized", null);
+                throw new UnAuthorizedException("Request is not authorized", null);
             }
 
             GetTokenRequest request = ((GetTokenRequest) reqT).toBuilder()
@@ -166,7 +127,7 @@ public <ReqT> ReqT intercept(String method, Metadata headers, ReqT reqT) {
         } else if (method.equals("getCredentials")) {
             AuthClaim claim = authorize(headers);
             if (claim == null) {
-                throw new NotAuthorizedException("Request is not authorized", null);
+                throw new UnAuthorizedException("Request is not authorized", null);
             }
 
             Credentials credentials = Credentials.newBuilder()
@@ -185,7 +146,7 @@ public <ReqT> ReqT intercept(String method, Metadata headers, ReqT reqT) {
         } else if (method.equals("endUserSession")) {
             AuthClaim claim = authorize(headers);
             if (claim == null) {
-                throw new NotAuthorizedException("Request is not authorized", null);
+                throw new UnAuthorizedException("Request is not authorized", null);
             }
             org.apache.custos.identity.service.EndSessionRequest endSessionRequest =
                     ((EndSessionRequest) reqT).getBody().toBuilder()
diff --git a/custos-integration-services/identity-management-service-parent/identity-management-service/src/main/java/org/apache/custos/identity/management/service/IdentityManagementService.java b/custos-integration-services/identity-management-service-parent/identity-management-service/src/main/java/org/apache/custos/identity/management/service/IdentityManagementService.java
index 80e0ec625..22b463a6d 100644
--- a/custos-integration-services/identity-management-service-parent/identity-management-service/src/main/java/org/apache/custos/identity/management/service/IdentityManagementService.java
+++ b/custos-integration-services/identity-management-service-parent/identity-management-service/src/main/java/org/apache/custos/identity/management/service/IdentityManagementService.java
@@ -103,10 +103,10 @@ public void getUserManagementServiceAccountAccessToken(GetUserManagementSATokenR
     }
 
     @Override
-    public void isAuthenticated(AuthToken request, StreamObserver<IsAuthenticateResponse> responseObserver) {
+    public void isAuthenticated(AuthToken request, StreamObserver<IsAuthenticatedResponse> responseObserver) {
         try {
             LOGGER.debug("Request received  to isAuthenticated ");
-            IsAuthenticateResponse response = identityClient.isAuthenticated(request);
+            IsAuthenticatedResponse response = identityClient.isAuthenticated(request);
             responseObserver.onNext(response);
             responseObserver.onCompleted();
         } catch (Exception ex) {
diff --git a/custos-integration-services/identity-management-service-parent/identity-management-service/src/main/proto/IdentityManagementService.proto b/custos-integration-services/identity-management-service-parent/identity-management-service/src/main/proto/IdentityManagementService.proto
index ae10be18b..517d55750 100644
--- a/custos-integration-services/identity-management-service-parent/identity-management-service/src/main/proto/IdentityManagementService.proto
+++ b/custos-integration-services/identity-management-service-parent/identity-management-service/src/main/proto/IdentityManagementService.proto
@@ -78,7 +78,7 @@ service IdentityManagementService {
          };
     }
 
-    rpc isAuthenticated (org.apache.custos.identity.service.AuthToken) returns (org.apache.custos.identity.service.IsAuthenticateResponse) {
+    rpc isAuthenticated (org.apache.custos.identity.service.AuthToken) returns (org.apache.custos.identity.service.IsAuthenticatedResponse) {
         option (google.api.http) = {
            get: "/identity-management/v1.0.0/authenticate/status"
          };
@@ -149,4 +149,11 @@ service IdentityManagementService {
            body: "body"
          };
     }
+
+    rpc isAgentAuthenticated(org.apache.custos.identity.service.AuthToken) returns (org.apache.custos.identity.service.IsAuthenticatedResponse) {
+        option (google.api.http) = {
+           post: "/identity-management/v1.0.0/agent/authentication/status"
+           body: "body"
+         };
+    }
 }
\ No newline at end of file
diff --git a/custos-integration-services/log-management-service-parent/log-management-service/pom.xml b/custos-integration-services/log-management-service-parent/log-management-service/pom.xml
index b1392adc4..90d38f8af 100644
--- a/custos-integration-services/log-management-service-parent/log-management-service/pom.xml
+++ b/custos-integration-services/log-management-service-parent/log-management-service/pom.xml
@@ -144,6 +144,7 @@
             <version>1.0-SNAPSHOT</version>
             <scope>compile</scope>
         </dependency>
+
     </dependencies>
 
     <build>
@@ -162,6 +163,13 @@
                     <skip>false</skip>
                 </configuration>
             </plugin>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-antrun-plugin</artifactId>
+                <configuration>
+                    <skip>false</skip>
+                </configuration>
+            </plugin>
         </plugins>
     </build>
 </project>
\ No newline at end of file
diff --git a/custos-integration-services/log-management-service-parent/log-management-service/src/main/helm/templates/deployment.yaml b/custos-integration-services/log-management-service-parent/log-management-service/src/main/helm/templates/deployment.yaml
index a0957f6b1..668c290e3 100644
--- a/custos-integration-services/log-management-service-parent/log-management-service/src/main/helm/templates/deployment.yaml
+++ b/custos-integration-services/log-management-service-parent/log-management-service/src/main/helm/templates/deployment.yaml
@@ -6,9 +6,10 @@ metadata:
 {{ include "helm.labels" . | indent 4 }}
 spec:
   replicas: {{ .Values.replicaCount }}
-  rollingUpdate:
-    maxSurge: {{ .Values.rollingUpdate.maxSurge }}
-    maxUnavailable: {{ .Values.rollingUpdate.maxUnavailable }}
+  strategy:
+    rollingUpdate:
+      maxSurge: {{ .Values.rollingUpdate.maxSurge }}
+      maxUnavailable: {{ .Values.rollingUpdate.maxUnavailable }}
   selector:
     matchLabels:
       app.kubernetes.io/name: {{ include "helm.name" . }}
@@ -45,9 +46,9 @@ spec:
             httpGet:
               path: /actuator/health
               port: {{ .Values.service.port }}
-              initialDelaySeconds: {{ .Values.readinessProbe.initialDelaySeconds }}
-              periodSeconds: {{ .Values.readinessProbe.periodSeconds }}
-              successThreshold: {{ .Values.readinessProbe.successThreshold }}
+            initialDelaySeconds: {{ .Values.readinessProbe.initialDelaySeconds }}
+            periodSeconds: {{ .Values.readinessProbe.periodSeconds }}
+            successThreshold: {{ .Values.readinessProbe.successThreshold }}
           resources:
               {{- toYaml .Values.resources | nindent 12 }}
         - name: {{ .Chart.Name }}-envoy-proxy
diff --git a/custos-integration-services/log-management-service-parent/log-management-service/src/main/helm/templates/ingress-grpc.yaml b/custos-integration-services/log-management-service-parent/log-management-service/src/main/helm/templates/ingress-grpc.yaml
index aa9584019..b8598a30c 100644
--- a/custos-integration-services/log-management-service-parent/log-management-service/src/main/helm/templates/ingress-grpc.yaml
+++ b/custos-integration-services/log-management-service-parent/log-management-service/src/main/helm/templates/ingress-grpc.yaml
@@ -1,4 +1,4 @@
-apiVersion: extensions/v1beta1
+apiVersion: networking.k8s.io/v1beta1
 kind: Ingress
 metadata:
   annotations:
diff --git a/custos-integration-services/log-management-service-parent/log-management-service/src/main/java/org/apache/custos/log/management/interceptors/ClientAuthInterceptorImpl.java b/custos-integration-services/log-management-service-parent/log-management-service/src/main/java/org/apache/custos/log/management/interceptors/ClientAuthInterceptorImpl.java
index 4daee2edc..fadbdc6dc 100644
--- a/custos-integration-services/log-management-service-parent/log-management-service/src/main/java/org/apache/custos/log/management/interceptors/ClientAuthInterceptorImpl.java
+++ b/custos-integration-services/log-management-service-parent/log-management-service/src/main/java/org/apache/custos/log/management/interceptors/ClientAuthInterceptorImpl.java
@@ -22,7 +22,7 @@
 import io.grpc.Metadata;
 import org.apache.custos.credential.store.client.CredentialStoreServiceClient;
 import org.apache.custos.identity.client.IdentityClient;
-import org.apache.custos.integration.core.exceptions.NotAuthorizedException;
+import org.apache.custos.integration.core.exceptions.UnAuthorizedException;
 import org.apache.custos.integration.services.commons.interceptors.MultiTenantAuthInterceptor;
 import org.apache.custos.integration.services.commons.model.AuthClaim;
 import org.apache.custos.logging.service.LogEventRequest;
@@ -55,7 +55,7 @@ public <ReqT> ReqT intercept(String method, Metadata headers, ReqT reqT) {
             AuthClaim claim = authorize(headers, request.getClientId());
 
             if (claim == null) {
-                throw new NotAuthorizedException("Request is not authorized", null);
+                throw new UnAuthorizedException("Request is not authorized", null);
             }
 
             String oauthId = claim.getIamAuthId();
@@ -72,7 +72,7 @@ public <ReqT> ReqT intercept(String method, Metadata headers, ReqT reqT) {
             AuthClaim claim = authorize(headers, request.getClientId());
 
             if (claim == null) {
-                throw new NotAuthorizedException("Request is not authorized", null);
+                throw new UnAuthorizedException("Request is not authorized", null);
             }
 
             String oauthId = claim.getIamAuthId();
diff --git a/custos-integration-services/log-management-service-parent/log-management-service/src/main/java/org/apache/custos/log/management/interceptors/UserAuthInterceptorImpl.java b/custos-integration-services/log-management-service-parent/log-management-service/src/main/java/org/apache/custos/log/management/interceptors/UserAuthInterceptorImpl.java
index 1e403f46a..97060ede7 100644
--- a/custos-integration-services/log-management-service-parent/log-management-service/src/main/java/org/apache/custos/log/management/interceptors/UserAuthInterceptorImpl.java
+++ b/custos-integration-services/log-management-service-parent/log-management-service/src/main/java/org/apache/custos/log/management/interceptors/UserAuthInterceptorImpl.java
@@ -22,7 +22,7 @@
 import io.grpc.Metadata;
 import org.apache.custos.credential.store.client.CredentialStoreServiceClient;
 import org.apache.custos.identity.client.IdentityClient;
-import org.apache.custos.integration.core.exceptions.NotAuthorizedException;
+import org.apache.custos.integration.core.exceptions.UnAuthorizedException;
 import org.apache.custos.integration.core.utils.Constants;
 import org.apache.custos.integration.services.commons.interceptors.MultiTenantAuthInterceptor;
 import org.apache.custos.integration.services.commons.model.AuthClaim;
@@ -56,11 +56,11 @@ public <ReqT> ReqT intercept(String method, Metadata headers, ReqT msg) {
             AuthClaim claim = authorize(headers, loggingConfigRequest.getClientId());
 
             if (claim == null) {
-                throw new NotAuthorizedException("Request is not authorized", null);
+                throw new UnAuthorizedException("Request is not authorized", null);
             }
 
             if (!claim.isAdmin()) {
-                throw new NotAuthorizedException("Your are not a tenant admin", null);
+                throw new UnAuthorizedException("Your are not a tenant admin", null);
             }
 
             long tenantId = claim.getTenantId();
diff --git a/custos-integration-services/resource-secret-management-service-parent/resource-secret-management-service-sidecar/src/main/resources/resource-secret-management-service.pb b/custos-integration-services/resource-secret-management-service-parent/resource-secret-management-service-sidecar/src/main/resources/resource-secret-management-service.pb
index a2e19f040..f163e0213 100644
Binary files a/custos-integration-services/resource-secret-management-service-parent/resource-secret-management-service-sidecar/src/main/resources/resource-secret-management-service.pb and b/custos-integration-services/resource-secret-management-service-parent/resource-secret-management-service-sidecar/src/main/resources/resource-secret-management-service.pb differ
diff --git a/custos-integration-services/resource-secret-management-service-parent/resource-secret-management-service/pom.xml b/custos-integration-services/resource-secret-management-service-parent/resource-secret-management-service/pom.xml
index e4972c4d1..b5638519a 100644
--- a/custos-integration-services/resource-secret-management-service-parent/resource-secret-management-service/pom.xml
+++ b/custos-integration-services/resource-secret-management-service-parent/resource-secret-management-service/pom.xml
@@ -133,6 +133,7 @@
             <groupId>io.kubernetes</groupId>
             <artifactId>client-java</artifactId>
         </dependency>
+
     </dependencies>
 
     <build>
@@ -151,6 +152,13 @@
                     <skip>false</skip>
                 </configuration>
             </plugin>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-antrun-plugin</artifactId>
+                <configuration>
+                    <skip>false</skip>
+                </configuration>
+            </plugin>
         </plugins>
     </build>
 
diff --git a/custos-integration-services/resource-secret-management-service-parent/resource-secret-management-service/src/main/helm/templates/deployment.yaml b/custos-integration-services/resource-secret-management-service-parent/resource-secret-management-service/src/main/helm/templates/deployment.yaml
index a0957f6b1..668c290e3 100644
--- a/custos-integration-services/resource-secret-management-service-parent/resource-secret-management-service/src/main/helm/templates/deployment.yaml
+++ b/custos-integration-services/resource-secret-management-service-parent/resource-secret-management-service/src/main/helm/templates/deployment.yaml
@@ -6,9 +6,10 @@ metadata:
 {{ include "helm.labels" . | indent 4 }}
 spec:
   replicas: {{ .Values.replicaCount }}
-  rollingUpdate:
-    maxSurge: {{ .Values.rollingUpdate.maxSurge }}
-    maxUnavailable: {{ .Values.rollingUpdate.maxUnavailable }}
+  strategy:
+    rollingUpdate:
+      maxSurge: {{ .Values.rollingUpdate.maxSurge }}
+      maxUnavailable: {{ .Values.rollingUpdate.maxUnavailable }}
   selector:
     matchLabels:
       app.kubernetes.io/name: {{ include "helm.name" . }}
@@ -45,9 +46,9 @@ spec:
             httpGet:
               path: /actuator/health
               port: {{ .Values.service.port }}
-              initialDelaySeconds: {{ .Values.readinessProbe.initialDelaySeconds }}
-              periodSeconds: {{ .Values.readinessProbe.periodSeconds }}
-              successThreshold: {{ .Values.readinessProbe.successThreshold }}
+            initialDelaySeconds: {{ .Values.readinessProbe.initialDelaySeconds }}
+            periodSeconds: {{ .Values.readinessProbe.periodSeconds }}
+            successThreshold: {{ .Values.readinessProbe.successThreshold }}
           resources:
               {{- toYaml .Values.resources | nindent 12 }}
         - name: {{ .Chart.Name }}-envoy-proxy
diff --git a/custos-integration-services/resource-secret-management-service-parent/resource-secret-management-service/src/main/helm/templates/ingress-grpc.yaml b/custos-integration-services/resource-secret-management-service-parent/resource-secret-management-service/src/main/helm/templates/ingress-grpc.yaml
index 3c97bc2f2..730905f89 100644
--- a/custos-integration-services/resource-secret-management-service-parent/resource-secret-management-service/src/main/helm/templates/ingress-grpc.yaml
+++ b/custos-integration-services/resource-secret-management-service-parent/resource-secret-management-service/src/main/helm/templates/ingress-grpc.yaml
@@ -1,4 +1,4 @@
-apiVersion: extensions/v1beta1
+apiVersion: networking.k8s.io/v1beta1
 kind: Ingress
 metadata:
   annotations:
diff --git a/custos-integration-services/resource-secret-management-service-parent/resource-secret-management-service/src/main/java/org/apache/custos/resource/secret/management/interceptors/ClientAuthInterceptorImpl.java b/custos-integration-services/resource-secret-management-service-parent/resource-secret-management-service/src/main/java/org/apache/custos/resource/secret/management/interceptors/ClientAuthInterceptorImpl.java
index 3ffa22c3b..23810a4d1 100644
--- a/custos-integration-services/resource-secret-management-service-parent/resource-secret-management-service/src/main/java/org/apache/custos/resource/secret/management/interceptors/ClientAuthInterceptorImpl.java
+++ b/custos-integration-services/resource-secret-management-service-parent/resource-secret-management-service/src/main/java/org/apache/custos/resource/secret/management/interceptors/ClientAuthInterceptorImpl.java
@@ -23,7 +23,7 @@
 import org.apache.custos.credential.store.client.CredentialStoreServiceClient;
 import org.apache.custos.identity.client.IdentityClient;
 import org.apache.custos.identity.service.GetJWKSRequest;
-import org.apache.custos.integration.core.exceptions.NotAuthorizedException;
+import org.apache.custos.integration.core.exceptions.UnAuthorizedException;
 import org.apache.custos.integration.services.commons.interceptors.MultiTenantAuthInterceptor;
 import org.apache.custos.integration.services.commons.model.AuthClaim;
 import org.apache.custos.resource.secret.service.*;
@@ -53,7 +53,7 @@ public <ReqT> ReqT intercept(String method, Metadata headers, ReqT reqT) {
             AuthClaim claim = authorize(headers);
 
             if (claim == null) {
-                throw new NotAuthorizedException("Request is not authorized", null);
+                throw new UnAuthorizedException("Request is not authorized", null);
             }
 
             String oauthId = claim.getIamAuthId();
@@ -70,7 +70,7 @@ public <ReqT> ReqT intercept(String method, Metadata headers, ReqT reqT) {
             AuthClaim claim = authorize(headers);
 
             if (claim == null) {
-                throw new NotAuthorizedException("Request is not authorized", null);
+                throw new UnAuthorizedException("Request is not authorized", null);
             }
 
             String oauthId = claim.getIamAuthId();
@@ -88,7 +88,7 @@ public <ReqT> ReqT intercept(String method, Metadata headers, ReqT reqT) {
 
             AuthClaim claim = authorize(headers, clientId);
             if (claim == null) {
-                throw new NotAuthorizedException("Request is not authorized", null);
+                throw new UnAuthorizedException("Request is not authorized", null);
             }
             return (ReqT) ((GetResourceCredentialSummariesRequest) reqT).toBuilder().setTenantId(claim.getTenantId()).build();
 
@@ -98,7 +98,7 @@ public <ReqT> ReqT intercept(String method, Metadata headers, ReqT reqT) {
 
             AuthClaim claim = authorize(headers, clientId);
             if (claim == null) {
-                throw new NotAuthorizedException("Request is not authorized", null);
+                throw new UnAuthorizedException("Request is not authorized", null);
             }
             SecretMetadata metadata = ((SSHCredential) reqT).getMetadata().toBuilder().setTenantId(claim.getTenantId()).build();
 
@@ -110,7 +110,7 @@ public <ReqT> ReqT intercept(String method, Metadata headers, ReqT reqT) {
 
             AuthClaim claim = authorize(headers, clientId);
             if (claim == null) {
-                throw new NotAuthorizedException("Request is not authorized", null);
+                throw new UnAuthorizedException("Request is not authorized", null);
             }
             SecretMetadata metadata = ((PasswordCredential) reqT).getMetadata().toBuilder().setTenantId(claim.getTenantId()).build();
 
@@ -121,7 +121,7 @@ public <ReqT> ReqT intercept(String method, Metadata headers, ReqT reqT) {
 
             AuthClaim claim = authorize(headers, clientId);
             if (claim == null) {
-                throw new NotAuthorizedException("Request is not authorized", null);
+                throw new UnAuthorizedException("Request is not authorized", null);
             }
             SecretMetadata metadata = ((CertificateCredential) reqT).getMetadata().toBuilder().setTenantId(claim.getTenantId()).build();
 
@@ -134,10 +134,36 @@ public <ReqT> ReqT intercept(String method, Metadata headers, ReqT reqT) {
 
             AuthClaim claim = authorize(headers, clientId);
             if (claim == null) {
-                throw new NotAuthorizedException("Request is not authorized", null);
+                throw new UnAuthorizedException("Request is not authorized", null);
             }
             return (ReqT) ((GetResourceCredentialByTokenRequest) reqT).toBuilder().setTenantId(claim.getTenantId()).build();
 
+        } else if (method.equals("getKVCredential") || method.equals("addKVCredential") || method.equals("updateKVCredential")
+                || method.equals("deleteKVCredential")) {
+            String clientId = ((KVCredential) reqT).getMetadata().getClientId();
+
+            AuthClaim claim = authorize(headers, clientId);
+            if (claim == null) {
+                throw new UnAuthorizedException("Request is not authorized", null);
+            }
+            SecretMetadata metadata = ((KVCredential) reqT)
+                    .getMetadata()
+                    .toBuilder().setOwnerId(claim.getUsername()).setTenantId(claim.getTenantId()).build();
+            return (ReqT) ((KVCredential) reqT).toBuilder().setMetadata(metadata).build();
+
+        } else if (method.equals("getCredentialMap") || method.equals("addCredentialMap") || method.equals("updateCredentialMap")
+                || method.equals("deleteCredentialMap")) {
+            String clientId = ((CredentialMap) reqT).getMetadata().getClientId();
+
+            AuthClaim claim = authorize(headers, clientId);
+            if (claim == null) {
+                throw new UnAuthorizedException("Request is not authorized", null);
+            }
+            SecretMetadata metadata = ((CredentialMap) reqT)
+                    .getMetadata()
+                    .toBuilder().setTenantId(claim.getTenantId()).build();
+            return (ReqT) ((CredentialMap) reqT).toBuilder().setMetadata(metadata).build();
+
         }
         return reqT;
     }
diff --git a/custos-integration-services/resource-secret-management-service-parent/resource-secret-management-service/src/main/java/org/apache/custos/resource/secret/management/interceptors/InputValidator.java b/custos-integration-services/resource-secret-management-service-parent/resource-secret-management-service/src/main/java/org/apache/custos/resource/secret/management/interceptors/InputValidator.java
index 330995044..ce7f2d8d7 100644
--- a/custos-integration-services/resource-secret-management-service-parent/resource-secret-management-service/src/main/java/org/apache/custos/resource/secret/management/interceptors/InputValidator.java
+++ b/custos-integration-services/resource-secret-management-service-parent/resource-secret-management-service/src/main/java/org/apache/custos/resource/secret/management/interceptors/InputValidator.java
@@ -24,6 +24,7 @@
 import org.apache.custos.integration.core.exceptions.MissingParameterException;
 import org.apache.custos.integration.core.interceptor.IntegrationServiceInterceptor;
 import org.apache.custos.resource.secret.service.CertificateCredential;
+import org.apache.custos.resource.secret.service.KVCredential;
 import org.apache.custos.resource.secret.service.PasswordCredential;
 import org.apache.custos.resource.secret.service.SSHCredential;
 import org.slf4j.Logger;
@@ -68,6 +69,23 @@ public <ReqT> ReqT intercept(String method, Metadata headers, ReqT msg) {
         if (method.equals("addSSHCredential") || method.equals("addPasswordCredential")
                 || method.equals("addCertificateCredential")) {
             validateSecretMetadata(msg, method);
+        } else if (method.equals("addKVCredential") || method.equals("getKVCredential") ||
+                method.equals("updateKVCredential") || method.equals("deleteKVCredential")) {
+            if (msg instanceof KVCredential) {
+                String key = ((KVCredential) msg).getKey();
+                String value = (((KVCredential) msg)).getValue();
+                String token = (((KVCredential) msg)).getToken();
+                if ((token == null || token.trim().equals("")) && (key == null || key.trim().equals(""))) {
+                    throw new MissingParameterException("At least key or token should be added ", null);
+                }
+
+                if ((method.equals("addKVCredential") || method.equals("updateKVCredential")) && (value == null || value.trim().equals(""))) {
+                    throw new MissingParameterException("Value should not be null ", null);
+                }
+
+            } else {
+                throw new RuntimeException("Unknown message type", null);
+            }
         }
         return msg;
     }
diff --git a/custos-integration-services/resource-secret-management-service-parent/resource-secret-management-service/src/main/java/org/apache/custos/resource/secret/management/service/ResourceSecretManagementService.java b/custos-integration-services/resource-secret-management-service-parent/resource-secret-management-service/src/main/java/org/apache/custos/resource/secret/management/service/ResourceSecretManagementService.java
index ee48a5058..b7906237d 100644
--- a/custos-integration-services/resource-secret-management-service-parent/resource-secret-management-service/src/main/java/org/apache/custos/resource/secret/management/service/ResourceSecretManagementService.java
+++ b/custos-integration-services/resource-secret-management-service-parent/resource-secret-management-service/src/main/java/org/apache/custos/resource/secret/management/service/ResourceSecretManagementService.java
@@ -19,6 +19,7 @@
 
 package org.apache.custos.resource.secret.management.service;
 
+import com.google.protobuf.ByteString;
 import com.google.protobuf.Struct;
 import io.grpc.Status;
 import io.grpc.stub.StreamObserver;
@@ -27,6 +28,7 @@
 import org.apache.custos.cluster.management.service.GetServerCertificateResponse;
 import org.apache.custos.identity.client.IdentityClient;
 import org.apache.custos.identity.service.GetJWKSRequest;
+import org.apache.custos.integration.core.utils.ShamirSecretHandler;
 import org.apache.custos.resource.secret.client.ResourceSecretClient;
 import org.apache.custos.resource.secret.management.service.ResourceSecretManagementServiceGrpc.ResourceSecretManagementServiceImplBase;
 import org.apache.custos.resource.secret.service.*;
@@ -35,6 +37,10 @@
 import org.slf4j.LoggerFactory;
 import org.springframework.beans.factory.annotation.Autowired;
 
+import java.util.List;
+import java.util.Map;
+import java.util.stream.Collectors;
+
 @GRpcService
 public class ResourceSecretManagementService extends ResourceSecretManagementServiceImplBase {
 
@@ -128,6 +134,16 @@ public void addSSHCredential(SSHCredential request, StreamObserver<AddResourceCr
         LOGGER.debug("Request received to add SSHCredential ");
         try {
 
+            if (request.getUseShamirsSecretSharingWithEncryption()) {
+                List<ByteString> byteStringList = request.getPrivateKeySharesList();
+                if (byteStringList != null && byteStringList.size() > 0) {
+
+                    String secret = ShamirSecretHandler.
+                            generateSecret(byteStringList, request.getNumOfShares(), request.getThreshold());
+                    request = request.toBuilder().setPrivateKey(secret).build();
+                }
+            }
+
             AddResourceCredentialResponse response = resourceSecretClient.addSSHCredential(request);
 
             responseObserver.onNext(response);
@@ -143,6 +159,15 @@ public void addSSHCredential(SSHCredential request, StreamObserver<AddResourceCr
     public void addPasswordCredential(PasswordCredential request, StreamObserver<AddResourceCredentialResponse> responseObserver) {
         LOGGER.debug("Request received to add PasswordCredential ");
         try {
+            if (request.getUseShamirsSecretSharingWithEncryption()) {
+                List<ByteString> byteStringList = request.getSecretSharesList();
+                if (byteStringList != null && byteStringList.size() > 0) {
+
+                    String secret = ShamirSecretHandler.
+                            generateSecret(byteStringList, request.getNumOfShares(), request.getThreshold());
+                    request = request.toBuilder().setPassword(secret).build();
+                }
+            }
 
             AddResourceCredentialResponse response = resourceSecretClient.addPasswordCredential(request);
             responseObserver.onNext(response);
@@ -158,7 +183,15 @@ public void addPasswordCredential(PasswordCredential request, StreamObserver<Add
     public void addCertificateCredential(CertificateCredential request, StreamObserver<AddResourceCredentialResponse> responseObserver) {
         LOGGER.debug("Request received to add CertificateCredential ");
         try {
-
+            if (request.getUseShamirsSecretSharingWithEncryption()) {
+                List<ByteString> byteStringList = request.getPrivateKeySharesList();
+                if (byteStringList != null && byteStringList.size() > 0) {
+
+                    String secret = ShamirSecretHandler.
+                            generateSecret(byteStringList, request.getNumOfShares(), request.getThreshold());
+                    request = request.toBuilder().setPrivateKey(secret).build();
+                }
+            }
             AddResourceCredentialResponse response = resourceSecretClient.addCertificateCredential(request);
             responseObserver.onNext(response);
             responseObserver.onCompleted();
@@ -175,8 +208,28 @@ public void addCertificateCredential(CertificateCredential request, StreamObserv
     public void getSSHCredential(GetResourceCredentialByTokenRequest request, StreamObserver<SSHCredential> responseObserver) {
         LOGGER.debug("Request received to get SSHCredential ");
         try {
-
             SSHCredential response = resourceSecretClient.getSSHCredential(request);
+
+            if (request.getUseShamirsSecretSharingWithEncryption()) {
+
+                int numberOfShares = response.getNumOfShares();
+                int threshold = response.getThreshold();
+
+                String privateKey = response.getPrivateKey();
+
+                if (privateKey != null && privateKey.trim().equals("")) {
+                    Map<Integer, byte[]> shares = ShamirSecretHandler.splitSecret(privateKey, numberOfShares, threshold);
+
+                    List<ByteString> byteStringList = shares.values().stream().
+                            map(val -> ByteString.copyFromUtf8(new String(val))).collect(Collectors.toList());
+
+                    response = response.toBuilder().addAllPrivateKeyShares(byteStringList)
+                            .setPrivateKey("")
+                            .build();
+
+                }
+            }
+
             responseObserver.onNext(response);
             responseObserver.onCompleted();
         } catch (Exception ex) {
@@ -192,6 +245,25 @@ public void getPasswordCredential(GetResourceCredentialByTokenRequest request, S
         try {
 
             PasswordCredential response = resourceSecretClient.getPasswordCredential(request);
+            if (request.getUseShamirsSecretSharingWithEncryption()) {
+
+                int numberOfShares = response.getNumOfShares();
+                int threshold = response.getThreshold();
+
+                String privateKey = response.getPassword();
+
+                if (privateKey != null && privateKey.trim().equals("")) {
+                    Map<Integer, byte[]> shares = ShamirSecretHandler.splitSecret(privateKey, numberOfShares, threshold);
+
+                    List<ByteString> byteStringList = shares.values().stream().
+                            map(val -> ByteString.copyFromUtf8(new String(val))).collect(Collectors.toList());
+
+                    response = response.toBuilder().addAllSecretShares(byteStringList)
+                            .setPassword("")
+                            .build();
+
+                }
+            }
 
             responseObserver.onNext(response);
             responseObserver.onCompleted();
@@ -208,6 +280,25 @@ public void getCertificateCredential(GetResourceCredentialByTokenRequest request
         try {
 
             CertificateCredential response = resourceSecretClient.getCertificateCredential(request);
+            if (request.getUseShamirsSecretSharingWithEncryption()) {
+
+                int numberOfShares = response.getNumOfShares();
+                int threshold = response.getThreshold();
+
+                String privateKey = response.getPrivateKey();
+
+                if (privateKey != null && privateKey.trim().equals("")) {
+                    Map<Integer, byte[]> shares = ShamirSecretHandler.splitSecret(privateKey, numberOfShares, threshold);
+
+                    List<ByteString> byteStringList = shares.values().stream().
+                            map(val -> ByteString.copyFromUtf8(new String(val))).collect(Collectors.toList());
+
+                    response = response.toBuilder().addAllPrivateKeyShares(byteStringList)
+                            .setPrivateKey("")
+                            .build();
+
+                }
+            }
             responseObserver.onNext(response);
             responseObserver.onCompleted();
         } catch (Exception ex) {
@@ -262,4 +353,137 @@ public void deleteCertificateCredential(GetResourceCredentialByTokenRequest requ
             responseObserver.onError(Status.INTERNAL.withDescription(msg).asRuntimeException());
         }
     }
+
+
+    @Override
+    public void getKVCredential(KVCredential request, StreamObserver<KVCredential> responseObserver) {
+        LOGGER.debug("Request received to getKVCredential in tenant " + request.getMetadata().getTenantId()
+                + " of user " + request.getMetadata().getOwnerId() + "for key " + request.getKey());
+        try {
+
+            KVCredential kvCredential = resourceSecretClient.getKVCredential(request);
+
+            responseObserver.onNext(kvCredential);
+            responseObserver.onCompleted();
+
+        } catch (Exception ex) {
+            String msg = "Error occurred while fetching  KV credentials :  " + ex.getMessage();
+            LOGGER.error(msg, ex);
+            responseObserver.onError(Status.INTERNAL.withDescription(msg).asRuntimeException());
+        }
+    }
+
+    @Override
+    public void addKVCredential(KVCredential request, StreamObserver<ResourceCredentialOperationStatus> responseObserver) {
+        LOGGER.debug("Request received to addKVCredential in tenant " + request.getMetadata().getTenantId()
+                + " of user " + request.getMetadata().getOwnerId() + "for key " + request.getKey());
+        try {
+
+            ResourceCredentialOperationStatus status = resourceSecretClient.setKVCredential(request);
+            responseObserver.onNext(status);
+            responseObserver.onCompleted();
+
+        } catch (Exception ex) {
+            String msg = "Error occurred while adding  KV  credentials :  " + ex.getMessage();
+            LOGGER.error(msg, ex);
+            responseObserver.onError(Status.INTERNAL.withDescription(msg).asRuntimeException());
+        }
+    }
+
+    @Override
+    public void updateKVCredential(KVCredential request, StreamObserver<ResourceCredentialOperationStatus> responseObserver) {
+        LOGGER.debug("Request received to updateKVCredential in tenant " + request.getMetadata().getTenantId()
+                + " of user " + request.getMetadata().getOwnerId() + "for key " + request.getKey());
+        try {
+            ResourceCredentialOperationStatus status = resourceSecretClient.updateKVCredential(request);
+            responseObserver.onNext(status);
+            responseObserver.onCompleted();
+
+
+        } catch (Exception ex) {
+            String msg = "Error occurred while updating  KV credentials :  " + ex.getMessage();
+            LOGGER.error(msg, ex);
+            responseObserver.onError(Status.INTERNAL.withDescription(msg).asRuntimeException());
+        }
+    }
+
+    @Override
+    public void deleteKVCredential(KVCredential request, StreamObserver<ResourceCredentialOperationStatus> responseObserver) {
+        LOGGER.debug("Request received to deleteKVCredential in tenant " + request.getMetadata().getTenantId()
+                + " of user " + request.getMetadata().getOwnerId() + "for key " + request.getKey());
+        try {
+            ResourceCredentialOperationStatus status = resourceSecretClient.deleteKVCredential(request);
+            responseObserver.onNext(status);
+            responseObserver.onCompleted();
+
+        } catch (Exception ex) {
+            String msg = "Error occurred while deleting  KV credentials :  " + ex.getMessage();
+            LOGGER.error(msg, ex);
+            responseObserver.onError(Status.INTERNAL.withDescription(msg).asRuntimeException());
+        }
+    }
+
+    @Override
+    public void getCredentialMap(CredentialMap request, StreamObserver<CredentialMap> responseObserver) {
+        LOGGER.debug("Request received to getCredentialMap in tenant " + request.getMetadata().getTenantId()
+                + " of user " + request.getMetadata().getOwnerId() + "for key " + request.getMetadata().getToken());
+        try {
+            CredentialMap status = resourceSecretClient.getCredentialMap(request);
+            responseObserver.onNext(status);
+            responseObserver.onCompleted();
+
+        } catch (Exception ex) {
+            String msg = "Error occurred while fetching   Credentials  Map :  " + ex.getMessage();
+            LOGGER.error(msg, ex);
+            responseObserver.onError(Status.INTERNAL.withDescription(msg).asRuntimeException());
+        }
+    }
+
+    @Override
+    public void addCredentialMap(CredentialMap request, StreamObserver<AddResourceCredentialResponse> responseObserver) {
+        LOGGER.debug("Request received to addCredentialMap in tenant " + request.getMetadata().getTenantId()
+                + " of user " + request.getMetadata().getOwnerId() + "for key " + request.getMetadata().getToken());
+        try {
+            AddResourceCredentialResponse status = resourceSecretClient.setCredentialMap(request);
+            responseObserver.onNext(status);
+            responseObserver.onCompleted();
+
+        } catch (Exception ex) {
+            String msg = "Error occurred while saving  CredentialMap :  " + ex.getMessage();
+            LOGGER.error(msg, ex);
+            responseObserver.onError(Status.INTERNAL.withDescription(msg).asRuntimeException());
+        }
+    }
+
+    @Override
+    public void updateCredentialMap(CredentialMap request, StreamObserver<ResourceCredentialOperationStatus> responseObserver) {
+        LOGGER.debug("Request received to updateCredentialMap in tenant " + request.getMetadata().getTenantId()
+                + " of user " + request.getMetadata().getOwnerId() + "for key " + request.getMetadata().getToken());
+        try {
+            ResourceCredentialOperationStatus status = resourceSecretClient.updateCredentialMap(request);
+            responseObserver.onNext(status);
+            responseObserver.onCompleted();
+
+        } catch (Exception ex) {
+            String msg = "Error occurred while updaintg  Credentials  Map:  " + ex.getMessage();
+            LOGGER.error(msg, ex);
+            responseObserver.onError(Status.INTERNAL.withDescription(msg).asRuntimeException());
+        }
+    }
+
+    @Override
+    public void deleteCredentialMap(CredentialMap request, StreamObserver<ResourceCredentialOperationStatus> responseObserver) {
+        LOGGER.debug("Request received to deleteKVCredential in tenant " + request.getMetadata().getTenantId()
+                + " of user " + request.getMetadata().getOwnerId() + "for key " + request.getMetadata().getToken());
+        try {
+            ResourceCredentialOperationStatus status = resourceSecretClient.deleteCredentialMap(request);
+            responseObserver.onNext(status);
+            responseObserver.onCompleted();
+
+        } catch (Exception ex) {
+            String msg = "Error occurred while deleting  Credential Map :  " + ex.getMessage();
+            LOGGER.error(msg, ex);
+            responseObserver.onError(Status.INTERNAL.withDescription(msg).asRuntimeException());
+        }
+    }
 }
diff --git a/custos-integration-services/resource-secret-management-service-parent/resource-secret-management-service/src/main/proto/ResourceSecretManagementService.proto b/custos-integration-services/resource-secret-management-service-parent/resource-secret-management-service/src/main/proto/ResourceSecretManagementService.proto
index 50ff876ea..8089a6268 100644
--- a/custos-integration-services/resource-secret-management-service-parent/resource-secret-management-service/src/main/proto/ResourceSecretManagementService.proto
+++ b/custos-integration-services/resource-secret-management-service-parent/resource-secret-management-service/src/main/proto/ResourceSecretManagementService.proto
@@ -38,6 +38,27 @@ service ResourceSecretManagementService {
          };
     }
 
+    rpc getKVCredential (org.apache.custos.resource.secret.service.KVCredential) returns (org.apache.custos.resource.secret.service.KVCredential) {
+        option (google.api.http) = {
+           get: "/resource-secret-management/v1.0.0/secret/kv"
+         };
+    }
+    rpc addKVCredential (org.apache.custos.resource.secret.service.KVCredential) returns (org.apache.custos.resource.secret.service.ResourceCredentialOperationStatus) {
+        option (google.api.http) = {
+           post: "/resource-secret-management/v1.0.0/secret/kv"
+         };
+    }
+    rpc updateKVCredential (org.apache.custos.resource.secret.service.KVCredential) returns (org.apache.custos.resource.secret.service.ResourceCredentialOperationStatus) {
+        option (google.api.http) = {
+           put: "/resource-secret-management/v1.0.0/secret/kv"
+         };
+    }
+    rpc deleteKVCredential (org.apache.custos.resource.secret.service.KVCredential) returns (org.apache.custos.resource.secret.service.ResourceCredentialOperationStatus) {
+        option (google.api.http) = {
+           delete: "/resource-secret-management/v1.0.0/secret/kv"
+         };
+    }
+
     rpc getJWKS (org.apache.custos.identity.service.GetJWKSRequest) returns (google.protobuf.Struct) {
         option (google.api.http) = {
            get: "/resource-secret-management/v1.0.0/openid-connect/certs"
@@ -102,4 +123,25 @@ service ResourceSecretManagementService {
          };
     }
 
+    rpc getCredentialMap (org.apache.custos.resource.secret.service.CredentialMap) returns (org.apache.custos.resource.secret.service.CredentialMap) {
+        option (google.api.http) = {
+           get: "/resource-secret-management/v1.0.0/secret/map"
+         };
+    }
+    rpc addCredentialMap (org.apache.custos.resource.secret.service.CredentialMap) returns (org.apache.custos.resource.secret.service.AddResourceCredentialResponse) {
+        option (google.api.http) = {
+           post: "/resource-secret-management/v1.0.0/secret/map"
+         };
+    }
+    rpc updateCredentialMap (org.apache.custos.resource.secret.service.CredentialMap) returns (org.apache.custos.resource.secret.service.ResourceCredentialOperationStatus) {
+        option (google.api.http) = {
+           put: "/resource-secret-management/v1.0.0/secret/map"
+         };
+    }
+    rpc deleteCredentialMap (org.apache.custos.resource.secret.service.CredentialMap) returns (org.apache.custos.resource.secret.service.ResourceCredentialOperationStatus) {
+        option (google.api.http) = {
+           delete: "/resource-secret-management/v1.0.0/secret/map"
+         };
+    }
+
 }
\ No newline at end of file
diff --git a/custos-integration-services/scim-service/pom.xml b/custos-integration-services/scim-service/pom.xml
index 0ab3971cb..6aeb85d3f 100644
--- a/custos-integration-services/scim-service/pom.xml
+++ b/custos-integration-services/scim-service/pom.xml
@@ -122,6 +122,7 @@
             <artifactId>tenant-profile-core-service-client-stub</artifactId>
             <version>${project.version}</version>
         </dependency>
+
     </dependencies>
 
     <build>
@@ -140,6 +141,13 @@
                     <skip>false</skip>
                 </configuration>
             </plugin>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-antrun-plugin</artifactId>
+                <configuration>
+                    <skip>false</skip>
+                </configuration>
+            </plugin>
         </plugins>
     </build>
 
diff --git a/custos-integration-services/scim-service/src/main/helm/templates/deployment.yaml b/custos-integration-services/scim-service/src/main/helm/templates/deployment.yaml
index 8cc78dce8..202764018 100644
--- a/custos-integration-services/scim-service/src/main/helm/templates/deployment.yaml
+++ b/custos-integration-services/scim-service/src/main/helm/templates/deployment.yaml
@@ -44,9 +44,9 @@ spec:
             httpGet:
               path: /actuator/health
               port: {{ .Values.service.port }}
-              initialDelaySeconds: {{ .Values.readinessProbe.initialDelaySeconds }}
-              periodSeconds: {{ .Values.readinessProbe.periodSeconds }}
-              successThreshold: {{ .Values.readinessProbe.successThreshold }}
+            initialDelaySeconds: {{ .Values.readinessProbe.initialDelaySeconds }}
+            periodSeconds: {{ .Values.readinessProbe.periodSeconds }}
+            successThreshold: {{ .Values.readinessProbe.successThreshold }}
           resources:
               {{- toYaml .Values.resources | nindent 12 }}
       {{- with .Values.nodeSelector }}
diff --git a/custos-integration-services/sharing-management-service-parent/sharing-management-service/pom.xml b/custos-integration-services/sharing-management-service-parent/sharing-management-service/pom.xml
index 9015d9f7d..362cf0bad 100644
--- a/custos-integration-services/sharing-management-service-parent/sharing-management-service/pom.xml
+++ b/custos-integration-services/sharing-management-service-parent/sharing-management-service/pom.xml
@@ -123,6 +123,7 @@
             <groupId>com.google.api.grpc</groupId>
             <artifactId>proto-google-common-protos</artifactId>
         </dependency>
+
     </dependencies>
 
     <build>
@@ -141,6 +142,13 @@
                     <skip>false</skip>
                 </configuration>
             </plugin>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-antrun-plugin</artifactId>
+                <configuration>
+                    <skip>false</skip>
+                </configuration>
+            </plugin>
         </plugins>
     </build>
 
diff --git a/custos-integration-services/sharing-management-service-parent/sharing-management-service/src/main/helm/templates/deployment.yaml b/custos-integration-services/sharing-management-service-parent/sharing-management-service/src/main/helm/templates/deployment.yaml
index 2fe140f87..9fe298c77 100644
--- a/custos-integration-services/sharing-management-service-parent/sharing-management-service/src/main/helm/templates/deployment.yaml
+++ b/custos-integration-services/sharing-management-service-parent/sharing-management-service/src/main/helm/templates/deployment.yaml
@@ -6,9 +6,10 @@ metadata:
 {{ include "helm.labels" . | indent 4 }}
 spec:
   replicas: {{ .Values.replicaCount }}
-  rollingUpdate:
-    maxSurge: {{ .Values.rollingUpdate.maxSurge }}
-    maxUnavailable: {{ .Values.rollingUpdate.maxUnavailable }}
+  strategy:
+    rollingUpdate:
+      maxSurge: {{ .Values.rollingUpdate.maxSurge }}
+      maxUnavailable: {{ .Values.rollingUpdate.maxUnavailable }}
   selector:
     matchLabels:
       app.kubernetes.io/name: {{ include "helm.name" . }}
@@ -59,9 +60,9 @@ spec:
             httpGet:
               path: /actuator/health
               port: {{ .Values.service.port }}
-              initialDelaySeconds: {{ .Values.readinessProbe.initialDelaySeconds }}
-              periodSeconds: {{ .Values.readinessProbe.periodSeconds }}
-              successThreshold: {{ .Values.readinessProbe.successThreshold }}
+            initialDelaySeconds: {{ .Values.readinessProbe.initialDelaySeconds }}
+            periodSeconds: {{ .Values.readinessProbe.periodSeconds }}
+            successThreshold: {{ .Values.readinessProbe.successThreshold }}
           resources:
             {{- toYaml .Values.resources | nindent 12 }}
       {{- with .Values.nodeSelector }}
diff --git a/custos-integration-services/sharing-management-service-parent/sharing-management-service/src/main/helm/templates/ingress-grpc.yaml b/custos-integration-services/sharing-management-service-parent/sharing-management-service/src/main/helm/templates/ingress-grpc.yaml
index 3fe743db5..183e37c8d 100644
--- a/custos-integration-services/sharing-management-service-parent/sharing-management-service/src/main/helm/templates/ingress-grpc.yaml
+++ b/custos-integration-services/sharing-management-service-parent/sharing-management-service/src/main/helm/templates/ingress-grpc.yaml
@@ -1,4 +1,4 @@
-apiVersion: extensions/v1beta1
+apiVersion: networking.k8s.io/v1beta1
 kind: Ingress
 metadata:
   annotations:
diff --git a/custos-integration-services/sharing-management-service-parent/sharing-management-service/src/main/java/org/apache/custos/sharing/management/interceptors/AuthInterceptorImpl.java b/custos-integration-services/sharing-management-service-parent/sharing-management-service/src/main/java/org/apache/custos/sharing/management/interceptors/AuthInterceptorImpl.java
index 1c4a274c9..f3eb63492 100644
--- a/custos-integration-services/sharing-management-service-parent/sharing-management-service/src/main/java/org/apache/custos/sharing/management/interceptors/AuthInterceptorImpl.java
+++ b/custos-integration-services/sharing-management-service-parent/sharing-management-service/src/main/java/org/apache/custos/sharing/management/interceptors/AuthInterceptorImpl.java
@@ -22,7 +22,7 @@
 import io.grpc.Metadata;
 import org.apache.custos.credential.store.client.CredentialStoreServiceClient;
 import org.apache.custos.identity.client.IdentityClient;
-import org.apache.custos.integration.core.exceptions.NotAuthorizedException;
+import org.apache.custos.integration.core.exceptions.UnAuthorizedException;
 import org.apache.custos.integration.services.commons.interceptors.MultiTenantAuthInterceptor;
 import org.apache.custos.integration.services.commons.model.AuthClaim;
 import org.apache.custos.sharing.service.*;
@@ -109,10 +109,10 @@ private AuthClaim validateAuth(Metadata headers, String clientId) {
             claim = authorize(headers, clientId);
         } catch (Exception ex) {
             LOGGER.error(" Authorizing error " + ex.getMessage());
-            throw new NotAuthorizedException("Request is not authorized", ex);
+            throw new UnAuthorizedException("Request is not authorized", ex);
         }
         if (claim == null) {
-            throw new NotAuthorizedException("Request is not authorized", null);
+            throw new UnAuthorizedException("Request is not authorized", null);
         }
         return claim;
     }
diff --git a/custos-integration-services/sharing-management-service-parent/sharing-management-service/src/main/java/org/apache/custos/sharing/management/service/SharingManagementService.java b/custos-integration-services/sharing-management-service-parent/sharing-management-service/src/main/java/org/apache/custos/sharing/management/service/SharingManagementService.java
index 9c415ea5f..5a9f4985b 100644
--- a/custos-integration-services/sharing-management-service-parent/sharing-management-service/src/main/java/org/apache/custos/sharing/management/service/SharingManagementService.java
+++ b/custos-integration-services/sharing-management-service-parent/sharing-management-service/src/main/java/org/apache/custos/sharing/management/service/SharingManagementService.java
@@ -581,14 +581,8 @@ public void userHasAccess(SharingRequest request, StreamObserver<Status> respons
             long tenantId = request.getTenantId();
 
 
-            for (String username : request.getOwnerIdList()) {
-
-                validateAndGetUserProfile(username, clientId, clientSec, tenantId);
-            }
-
             UserProfile profile = UserProfile.newBuilder().setUsername(request.getOwnerId(0)).build();
 
-
             UserProfileRequest userProfileRequest = UserProfileRequest.newBuilder()
                     .setTenantId(tenantId)
                     .setProfile(profile)
@@ -609,6 +603,10 @@ public void userHasAccess(SharingRequest request, StreamObserver<Status> respons
             responseObserver.onNext(status);
             responseObserver.onCompleted();
 
+            for (String username : request.getOwnerIdList()) {
+
+                validateAndGetUserProfile(username, clientId, clientSec, tenantId);
+            }
 
         } catch (Exception ex) {
             String msg = "Error occurred at userHasAccess " + ex.getMessage();
diff --git a/custos-integration-services/tenant-management-service-parent/tenant-management-service-sidecar/src/main/resources/tenant-management-service.pb b/custos-integration-services/tenant-management-service-parent/tenant-management-service-sidecar/src/main/resources/tenant-management-service.pb
index 90cb160e4..ac3ffff38 100644
Binary files a/custos-integration-services/tenant-management-service-parent/tenant-management-service-sidecar/src/main/resources/tenant-management-service.pb and b/custos-integration-services/tenant-management-service-parent/tenant-management-service-sidecar/src/main/resources/tenant-management-service.pb differ
diff --git a/custos-integration-services/tenant-management-service-parent/tenant-management-service/pom.xml b/custos-integration-services/tenant-management-service-parent/tenant-management-service/pom.xml
index ddd6a8faa..64e09d325 100644
--- a/custos-integration-services/tenant-management-service-parent/tenant-management-service/pom.xml
+++ b/custos-integration-services/tenant-management-service-parent/tenant-management-service/pom.xml
@@ -121,6 +121,7 @@
               <groupId>com.google.api.grpc</groupId>
               <artifactId>proto-google-common-protos</artifactId>
           </dependency>
+
       </dependencies>
 
     <build>
@@ -139,6 +140,13 @@
                     <skip>false</skip>
                 </configuration>
             </plugin>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-antrun-plugin</artifactId>
+                <configuration>
+                    <skip>false</skip>
+                </configuration>
+            </plugin>
         </plugins>
     </build>
 
diff --git a/custos-integration-services/tenant-management-service-parent/tenant-management-service/src/main/helm/templates/deployment.yaml b/custos-integration-services/tenant-management-service-parent/tenant-management-service/src/main/helm/templates/deployment.yaml
index 2fe140f87..9fe298c77 100644
--- a/custos-integration-services/tenant-management-service-parent/tenant-management-service/src/main/helm/templates/deployment.yaml
+++ b/custos-integration-services/tenant-management-service-parent/tenant-management-service/src/main/helm/templates/deployment.yaml
@@ -6,9 +6,10 @@ metadata:
 {{ include "helm.labels" . | indent 4 }}
 spec:
   replicas: {{ .Values.replicaCount }}
-  rollingUpdate:
-    maxSurge: {{ .Values.rollingUpdate.maxSurge }}
-    maxUnavailable: {{ .Values.rollingUpdate.maxUnavailable }}
+  strategy:
+    rollingUpdate:
+      maxSurge: {{ .Values.rollingUpdate.maxSurge }}
+      maxUnavailable: {{ .Values.rollingUpdate.maxUnavailable }}
   selector:
     matchLabels:
       app.kubernetes.io/name: {{ include "helm.name" . }}
@@ -59,9 +60,9 @@ spec:
             httpGet:
               path: /actuator/health
               port: {{ .Values.service.port }}
-              initialDelaySeconds: {{ .Values.readinessProbe.initialDelaySeconds }}
-              periodSeconds: {{ .Values.readinessProbe.periodSeconds }}
-              successThreshold: {{ .Values.readinessProbe.successThreshold }}
+            initialDelaySeconds: {{ .Values.readinessProbe.initialDelaySeconds }}
+            periodSeconds: {{ .Values.readinessProbe.periodSeconds }}
+            successThreshold: {{ .Values.readinessProbe.successThreshold }}
           resources:
             {{- toYaml .Values.resources | nindent 12 }}
       {{- with .Values.nodeSelector }}
diff --git a/custos-integration-services/tenant-management-service-parent/tenant-management-service/src/main/helm/templates/ingress-grpc.yaml b/custos-integration-services/tenant-management-service-parent/tenant-management-service/src/main/helm/templates/ingress-grpc.yaml
index afc27467d..b6fa2314d 100644
--- a/custos-integration-services/tenant-management-service-parent/tenant-management-service/src/main/helm/templates/ingress-grpc.yaml
+++ b/custos-integration-services/tenant-management-service-parent/tenant-management-service/src/main/helm/templates/ingress-grpc.yaml
@@ -1,4 +1,4 @@
-apiVersion: extensions/v1beta1
+apiVersion: networking.k8s.io/v1beta1
 kind: Ingress
 metadata:
   annotations:
diff --git a/custos-integration-services/tenant-management-service-parent/tenant-management-service/src/main/java/org/apache/custos/tenant/management/interceptors/AuthInterceptorImpl.java b/custos-integration-services/tenant-management-service-parent/tenant-management-service/src/main/java/org/apache/custos/tenant/management/interceptors/AuthInterceptorImpl.java
index 593c5edda..d21c152e5 100644
--- a/custos-integration-services/tenant-management-service-parent/tenant-management-service/src/main/java/org/apache/custos/tenant/management/interceptors/AuthInterceptorImpl.java
+++ b/custos-integration-services/tenant-management-service-parent/tenant-management-service/src/main/java/org/apache/custos/tenant/management/interceptors/AuthInterceptorImpl.java
@@ -21,13 +21,11 @@
 
 import io.grpc.Metadata;
 import org.apache.custos.credential.store.client.CredentialStoreServiceClient;
+import org.apache.custos.credential.store.service.CredentialMetadata;
 import org.apache.custos.federated.authentication.service.CacheManipulationRequest;
-import org.apache.custos.iam.service.AddProtocolMapperRequest;
-import org.apache.custos.iam.service.AddRolesRequest;
-import org.apache.custos.iam.service.EventPersistenceRequest;
-import org.apache.custos.iam.service.GetRolesRequest;
+import org.apache.custos.iam.service.*;
 import org.apache.custos.identity.client.IdentityClient;
-import org.apache.custos.integration.core.exceptions.NotAuthorizedException;
+import org.apache.custos.integration.core.exceptions.UnAuthorizedException;
 import org.apache.custos.integration.services.commons.interceptors.AuthInterceptor;
 import org.apache.custos.integration.services.commons.model.AuthClaim;
 import org.apache.custos.tenant.management.service.Credentials;
@@ -65,6 +63,10 @@ public <ReqT> ReqT intercept(String method, Metadata headers, ReqT msg) {
 
         if (method.equals("createTenant")) {
 
+            String token = getToken(headers);
+            if (token == null) {
+                return msg;
+            }
             AuthClaim claim = authorize(headers);
             if (claim == null) {
                 return msg;
@@ -75,7 +77,7 @@ public <ReqT> ReqT intercept(String method, Metadata headers, ReqT msg) {
 
         } else if (method.equals("getTenant")) {
 
-            AuthClaim claim = validateAuth(headers);
+            AuthClaim claim = authorizeUsingUserToken(headers);
 
             GetTenantRequest tenantRequest = ((GetTenantRequest) msg);
 
@@ -87,7 +89,7 @@ public <ReqT> ReqT intercept(String method, Metadata headers, ReqT msg) {
         } else if (method.equals("updateTenant")) {
 
 
-            AuthClaim claim = validateAuth(headers);
+            AuthClaim claim = authorizeUsingUserToken(headers);
 
             UpdateTenantRequest tenantRequest = ((UpdateTenantRequest) msg);
 
@@ -97,7 +99,7 @@ public <ReqT> ReqT intercept(String method, Metadata headers, ReqT msg) {
                     .setTenantId(claim.getTenantId()).setCredentials(credentials).build();
         } else if (method.equals("deleteTenant")) {
 
-            AuthClaim claim = validateAuth(headers);
+            AuthClaim claim = authorizeUsingUserToken(headers);
 
             DeleteTenantRequest tenantRequest = ((DeleteTenantRequest) msg);
 
@@ -108,45 +110,135 @@ public <ReqT> ReqT intercept(String method, Metadata headers, ReqT msg) {
                     .setTenantId(claim.getTenantId()).setCredentials(credentials).build();
         } else if (method.equals("addTenantRoles")) {
 
-            AuthClaim claim = validateAuth(headers);
+            AuthClaim claim = authorizeUsingUserToken(headers);
 
             AddRolesRequest rolesRequest = ((AddRolesRequest) msg);
+            String clientId = rolesRequest.getClientId();
+            if (rolesRequest.getClientId() == null || rolesRequest.getClientId().trim().equals("")) {
+                return (ReqT) rolesRequest.toBuilder().setTenantId(claim.getTenantId()).
+                        setClientId(claim.getCustosId()).build();
+            }
 
-            return (ReqT) rolesRequest.toBuilder()
-                    .setTenantId(claim.getTenantId()).setClientId(claim.getCustosId()).build();
+            CredentialMetadata metadata = getCredentialsFromClientId(clientId);
+
+            if (claim.isSuperTenant()) {
+                return (ReqT) rolesRequest.toBuilder().setTenantId(metadata.getOwnerId()).build();
+            }
+
+            boolean validationStatus = validateParentChildTenantRelationShip(claim.getTenantId(), metadata.getOwnerId());
+
+            if (validationStatus) {
+                return (ReqT) rolesRequest.toBuilder().setTenantId(metadata.getOwnerId()).build();
+            } else {
+                String error = "Request is not authorized, user not authorized with requested clientId: " + clientId;
+                throw new UnAuthorizedException(error, null);
+            }
         } else if (method.equals("getTenantRoles")) {
 
-            AuthClaim claim = validateAuth(headers);
+            AuthClaim claim = authorizeUsingUserToken(headers);
 
             GetRolesRequest rolesRequest = ((GetRolesRequest) msg);
+            String clientId = rolesRequest.getClientId();
+            if (rolesRequest.getClientId() == null || rolesRequest.getClientId().trim().equals("")) {
+                return (ReqT) rolesRequest.toBuilder().setTenantId(claim.getTenantId()).
+                        setClientId(claim.getCustosId()).build();
+            }
+            CredentialMetadata metadata = getCredentialsFromClientId(clientId);
 
-            return (ReqT) rolesRequest.toBuilder()
-                    .setTenantId(claim.getTenantId()).setClientId(claim.getCustosId()).build();
+            if (claim.isSuperTenant()) {
+                return (ReqT) rolesRequest.toBuilder().setTenantId(metadata.getOwnerId()).build();
+            }
+
+            boolean validationStatus = validateParentChildTenantRelationShip(claim.getTenantId(), metadata.getOwnerId());
+
+            if (validationStatus) {
+                return (ReqT) rolesRequest.toBuilder().setTenantId(metadata.getOwnerId()).build();
+            } else {
+                String error = "Request is not authorized, user not authorized with requested clientId: " + clientId;
+                throw new UnAuthorizedException(error, null);
+            }
+        } else if (method.equals("deleteRole")) {
+
+            AuthClaim claim = authorizeUsingUserToken(headers);
+
+            DeleteRoleRequest rolesRequest = ((DeleteRoleRequest) msg);
+            String clientId = rolesRequest.getClientId();
+            if (rolesRequest.getClientId() == null || rolesRequest.getClientId().trim().equals("")) {
+                return (ReqT) rolesRequest.toBuilder().setTenantId(claim.getTenantId()).
+                        setClientId(claim.getCustosId()).build();
+            }
+            CredentialMetadata metadata = getCredentialsFromClientId(clientId);
+
+            if (claim.isSuperTenant()) {
+                return (ReqT) rolesRequest.toBuilder().setTenantId(metadata.getOwnerId()).build();
+            }
+
+            boolean validationStatus = validateParentChildTenantRelationShip(claim.getTenantId(), metadata.getOwnerId());
+
+            if (validationStatus) {
+                return (ReqT) rolesRequest.toBuilder().setTenantId(metadata.getOwnerId()).build();
+            } else {
+                String error = "Request is not authorized, user not authorized with requested clientId: " + clientId;
+                throw new UnAuthorizedException(error, null);
+            }
         } else if (method.equals("addProtocolMapper")) {
 
-            AuthClaim claim = validateAuth(headers);
+            AuthClaim claim = authorizeUsingUserToken(headers);
 
             AddProtocolMapperRequest rolesRequest = ((AddProtocolMapperRequest) msg);
+            String clientId = rolesRequest.getClientId();
 
-            return (ReqT) rolesRequest.toBuilder()
-                    .setTenantId(claim.getTenantId()).setClientId(claim.getCustosId()).build();
-        } else if (method.equals("configureEventPersistence")) {
+            if (rolesRequest.getClientId() == null || rolesRequest.getClientId().trim().equals("")) {
+                return (ReqT) rolesRequest.toBuilder().setTenantId(claim.getTenantId()).
+                        setClientId(claim.getCustosId()).build();
+            }
+            CredentialMetadata metadata = getCredentialsFromClientId(clientId);
 
-            AuthClaim claim = validateAuth(headers);
+            if (claim.isSuperTenant()) {
+                return (ReqT) rolesRequest.toBuilder().setTenantId(metadata.getOwnerId()).build();
+            }
+
+            boolean validationStatus = validateParentChildTenantRelationShip(claim.getTenantId(), metadata.getOwnerId());
 
+            if (validationStatus) {
+                return (ReqT) rolesRequest.toBuilder().setTenantId(metadata.getOwnerId()).build();
+            } else {
+                String error = "Request is not authorized, user not authorized with requested clientId: " + clientId;
+                throw new UnAuthorizedException(error, null);
+            }
+
+        } else if (method.equals("configureEventPersistence")) {
+
+            AuthClaim claim = authorizeUsingUserToken(headers);
             EventPersistenceRequest rolesRequest = ((EventPersistenceRequest) msg);
 
             return (ReqT) rolesRequest.toBuilder()
-                    .setTenantId(claim.getTenantId()).setPerformedBy("Tenant Admin")
+                    .setTenantId(claim.getTenantId()).setPerformedBy(claim.getUsername())
                     .build();
         } else if (method.equals("getChildTenants")) {
 
-            AuthClaim claim = validateAuth(headers);
+            AuthClaim claim = authorizeUsingUserToken(headers);
 
             GetTenantsRequest tenantsRequest = ((GetTenantsRequest) msg);
+            String clientId = tenantsRequest.getParentClientId();
+
+            if (tenantsRequest.getParentClientId() == null || tenantsRequest.getParentClientId().trim().equals("")) {
+                return (ReqT) tenantsRequest.toBuilder().setParentId(claim.getTenantId()).build();
+            }
+            CredentialMetadata metadata = getCredentialsFromClientId(clientId);
+
+            if (claim.isSuperTenant()) {
+                return (ReqT) tenantsRequest.toBuilder().setParentId(metadata.getOwnerId()).build();
+            }
 
-            return (ReqT) tenantsRequest.toBuilder()
-                    .setParentId(claim.getTenantId()).build();
+            boolean validationStatus = validateParentChildTenantRelationShip(claim.getTenantId(), metadata.getOwnerId());
+
+            if (validationStatus) {
+                return (ReqT) tenantsRequest.toBuilder().setParentId(metadata.getOwnerId()).build();
+            } else {
+                String error = "Request is not authorized, user not authorized with requested clientId: " + clientId;
+                throw new UnAuthorizedException(error, null);
+            }
         } else if (method.equals("getAllTenantsForUser")) {
             validateAuth(headers);
             return msg;
@@ -179,10 +271,10 @@ private AuthClaim validateAuth(Metadata headers) {
             claim = authorize(headers);
         } catch (Exception ex) {
             LOGGER.error(" Authorizing error " + ex.getMessage());
-            throw new NotAuthorizedException("Request is not authorized", ex);
+            throw new UnAuthorizedException("Request is not authorized", ex);
         }
         if (claim == null) {
-            throw new NotAuthorizedException("Request is not authorized", null);
+            throw new UnAuthorizedException("Request is not authorized", null);
         }
         return claim;
     }
@@ -199,10 +291,10 @@ private AuthClaim validateUserToken(Metadata headers) {
             claim = authorizeUsingUserToken(usertoken);
         } catch (Exception ex) {
             LOGGER.error(" Authorizing error " + ex.getMessage());
-            throw new NotAuthorizedException("Request is not authorized", ex);
+            throw new UnAuthorizedException("Request is not authorized", ex);
         }
         if (claim == null) {
-            throw new NotAuthorizedException("Request is not authorized", null);
+            throw new UnAuthorizedException("Request is not authorized", null);
         }
         return claim;
 
diff --git a/custos-integration-services/tenant-management-service-parent/tenant-management-service/src/main/java/org/apache/custos/tenant/management/interceptors/DynamicRegistrationValidator.java b/custos-integration-services/tenant-management-service-parent/tenant-management-service/src/main/java/org/apache/custos/tenant/management/interceptors/DynamicRegistrationValidator.java
index cdfe8b731..50c71cc6c 100644
--- a/custos-integration-services/tenant-management-service-parent/tenant-management-service/src/main/java/org/apache/custos/tenant/management/interceptors/DynamicRegistrationValidator.java
+++ b/custos-integration-services/tenant-management-service-parent/tenant-management-service/src/main/java/org/apache/custos/tenant/management/interceptors/DynamicRegistrationValidator.java
@@ -22,10 +22,8 @@
 import io.grpc.Metadata;
 import org.apache.custos.credential.store.client.CredentialStoreServiceClient;
 import org.apache.custos.credential.store.service.CredentialMetadata;
-import org.apache.custos.credential.store.service.GetCredentialRequest;
 import org.apache.custos.identity.client.IdentityClient;
-import org.apache.custos.integration.core.exceptions.NotAuthorizedException;
-import org.apache.custos.integration.core.interceptor.IntegrationServiceInterceptor;
+import org.apache.custos.integration.core.exceptions.UnAuthorizedException;
 import org.apache.custos.integration.services.commons.interceptors.AuthInterceptor;
 import org.apache.custos.integration.services.commons.model.AuthClaim;
 import org.apache.custos.tenant.management.service.DeleteTenantRequest;
@@ -41,7 +39,7 @@
  * This class validates the  conditions that should be satisfied by the Dynamic Registration Protocol
  */
 @Component
-public class DynamicRegistrationValidator extends AuthInterceptor implements IntegrationServiceInterceptor {
+public class DynamicRegistrationValidator extends AuthInterceptor  {
 
     private static final Logger LOGGER = LoggerFactory.getLogger(DynamicRegistrationValidator.class);
 
@@ -65,16 +63,9 @@ public <ReqT> ReqT intercept(String method, Metadata headers, ReqT msg) {
 
             String clientId = tenantRequest.getClientId();
 
-            GetCredentialRequest request = GetCredentialRequest.newBuilder()
-                    .setId(clientId)
-                    .build();
-            CredentialMetadata metadata = credentialStoreServiceClient.getCustosCredentialFromClientId(request);
+            CredentialMetadata metadata = getCredentialsFromClientId(clientId);
 
-            if (metadata == null || metadata.getOwnerId() == 0) {
-                throw new NotAuthorizedException("Invalid client_id", null);
-            }
-
-            Tenant tenant = validateTenant(metadata.getOwnerId(), tenantRequest.getTenantId(), headers);
+            Tenant tenant = validateTenantWithUserToken(metadata.getOwnerId(), tenantRequest.getTenantId(), headers);
             return (ReqT) tenantRequest.toBuilder().setTenantId(tenant != null ? tenant.getTenantId() :
                     tenantRequest.getTenantId()).setTenant(tenant).build();
 
@@ -83,7 +74,7 @@ public <ReqT> ReqT intercept(String method, Metadata headers, ReqT msg) {
             Tenant tenantRequest = ((Tenant) msg);
 
             if (tenantRequest.getParentTenantId() > 0) {
-                validateTenant(tenantRequest.getParentTenantId(), tenantRequest.getParentTenantId(), headers);
+                validateTenantWithBasicAuth(tenantRequest.getParentTenantId(), tenantRequest.getParentTenantId(), headers);
             }
 
         } else if (method.equals("updateTenant")) {
@@ -97,17 +88,10 @@ public <ReqT> ReqT intercept(String method, Metadata headers, ReqT msg) {
                 clientId = tenantRequest.getBody().getClientId();
             }
 
-            GetCredentialRequest request = GetCredentialRequest.newBuilder()
-                    .setId(clientId)
-                    .build();
-            CredentialMetadata metadata = credentialStoreServiceClient.getCustosCredentialFromClientId(request);
+            CredentialMetadata metadata = getCredentialsFromClientId(clientId);
 
-            if (metadata == null || metadata.getOwnerId() == 0) {
-                throw new NotAuthorizedException("Invalid client_id", null);
-            }
 
-
-            Tenant tenant = validateTenant(metadata.getOwnerId(), tenantRequest.getTenantId(), headers);
+            Tenant tenant = validateTenantWithUserToken(metadata.getOwnerId(), tenantRequest.getTenantId(), headers);
 
             return (ReqT) tenantRequest.toBuilder().setTenantId(tenant.getTenantId()).setClientId(clientId).build();
 
@@ -118,26 +102,19 @@ public <ReqT> ReqT intercept(String method, Metadata headers, ReqT msg) {
 
             String clientId = tenantRequest.getClientId();
 
-            GetCredentialRequest request = GetCredentialRequest.newBuilder()
-                    .setId(clientId)
-                    .build();
-            CredentialMetadata metadata = credentialStoreServiceClient.getCustosCredentialFromClientId(request);
+            CredentialMetadata metadata = getCredentialsFromClientId(clientId);
 
-            if (metadata == null || metadata.getOwnerId() == 0) {
-                throw new NotAuthorizedException("Invalid client_id", null);
-            }
-
-
-            Tenant tenant = validateTenant(metadata.getOwnerId(), tenantRequest.getTenantId(), headers);
+            Tenant tenant = validateTenantWithUserToken(metadata.getOwnerId(), tenantRequest.getTenantId(), headers);
 
             return (ReqT) tenantRequest.toBuilder().setTenantId(tenant.getTenantId()).build();
 
         }
         return msg;
+
     }
 
 
-    private Tenant validateTenant(long ownerId, long parentTenant, Metadata headers) {
+    private Tenant validateTenantWithBasicAuth(long ownerId, long parentTenant, Metadata headers) {
 
         org.apache.custos.tenant.profile.service.GetTenantRequest tenantReq =
                 org.apache.custos.tenant.profile.service.GetTenantRequest
@@ -155,9 +132,37 @@ private Tenant validateTenant(long ownerId, long parentTenant, Metadata headers)
         }
 
         if (tenant == null || (tenant.getParentTenantId() != 0 && tenant.getParentTenantId() != parentTenant)) {
-            throw new NotAuthorizedException("Not a valid admin client", null);
+            throw new UnAuthorizedException("Not a valid admin client", null);
         }
 
         return tenant;
     }
+
+    private Tenant validateTenantWithUserToken(long ownerId, long parentTenant, Metadata headers) {
+
+        org.apache.custos.tenant.profile.service.GetTenantRequest tenantReq =
+                org.apache.custos.tenant.profile.service.GetTenantRequest
+                        .newBuilder().setTenantId(ownerId).build();
+
+        org.apache.custos.tenant.profile.service.GetTenantResponse response =
+                tenantProfileClient.getTenant(tenantReq);
+
+        Tenant tenant = response.getTenant();
+
+        AuthClaim authClaim = authorizeUsingUserToken(headers);
+
+        if (authClaim != null && authClaim.isSuperTenant()) {
+            return tenant;
+        }
+
+        if (tenant == null || (tenant.getParentTenantId() != 0 && tenant.getParentTenantId() != parentTenant)) {
+            throw new UnAuthorizedException("Not a valid admin client", null);
+        }
+
+        return tenant;
+    }
+
+
+
+
 }
diff --git a/custos-integration-services/tenant-management-service-parent/tenant-management-service/src/main/java/org/apache/custos/tenant/management/interceptors/InputValidator.java b/custos-integration-services/tenant-management-service-parent/tenant-management-service/src/main/java/org/apache/custos/tenant/management/interceptors/InputValidator.java
index 16437886f..76f2f8da6 100644
--- a/custos-integration-services/tenant-management-service-parent/tenant-management-service/src/main/java/org/apache/custos/tenant/management/interceptors/InputValidator.java
+++ b/custos-integration-services/tenant-management-service-parent/tenant-management-service/src/main/java/org/apache/custos/tenant/management/interceptors/InputValidator.java
@@ -27,6 +27,7 @@
 import org.apache.custos.tenant.management.exceptions.MissingParameterException;
 import org.apache.custos.tenant.management.service.DeleteTenantRequest;
 import org.apache.custos.tenant.management.service.GetTenantRequest;
+import org.apache.custos.tenant.management.service.TenantValidationRequest;
 import org.apache.custos.tenant.management.service.UpdateTenantRequest;
 import org.apache.custos.tenant.management.utils.Constants;
 import org.apache.custos.tenant.profile.service.UpdateStatusRequest;
@@ -66,6 +67,9 @@ private void validate(String methodName, Object body, Metadata headers) {
             case "deleteTenant":
                 validateDeleteTenant(headers, body, methodName);
                 break;
+            case "validateTenant":
+                validateTenant(headers, body, methodName);
+                break;
             case "addTenantRoles":
                 validateAddRoleToTenant(headers, body, methodName);
                 break;
@@ -81,6 +85,7 @@ private void validate(String methodName, Object body, Metadata headers) {
             case "getFromCache":
             case "getInstitutions":
             case "getTenantRoles":
+            case "deleteRole":
                 validationAuthorizationHeader(headers);
                 break;
             default:
@@ -184,6 +189,21 @@ private boolean validateUpdateTenantStatus(Metadata headers, Object body, String
     }
 
 
+    private boolean validateTenant(Metadata headers, Object body, String method) {
+        validationAuthorizationHeader(headers);
+
+        TenantValidationRequest updateStatusRequest = ((TenantValidationRequest) body);
+
+        if (updateStatusRequest.getClientId() == null || updateStatusRequest.getClientId().trim().equals("")) {
+            throw new MissingParameterException("Client Id should not be null", null);
+        }
+        if (updateStatusRequest.getClientSec() == null || updateStatusRequest.getClientSec().trim().equals("")) {
+            throw new MissingParameterException("Client Secret should not be null", null);
+        }
+        return true;
+    }
+
+
     private boolean validationAuthorizationHeader(Metadata headers) {
         if (headers.get(Metadata.Key.of(Constants.AUTHORIZATION_HEADER, Metadata.ASCII_STRING_MARSHALLER)) == null
                 || headers.get(Metadata.Key.of("Authorization", Metadata.ASCII_STRING_MARSHALLER)) == null) {
diff --git a/custos-integration-services/tenant-management-service-parent/tenant-management-service/src/main/java/org/apache/custos/tenant/management/interceptors/SuperTenantRestrictedOperationsInterceptorImpl.java b/custos-integration-services/tenant-management-service-parent/tenant-management-service/src/main/java/org/apache/custos/tenant/management/interceptors/SuperTenantRestrictedOperationsInterceptorImpl.java
index cdaafd1ff..72fecd4f7 100644
--- a/custos-integration-services/tenant-management-service-parent/tenant-management-service/src/main/java/org/apache/custos/tenant/management/interceptors/SuperTenantRestrictedOperationsInterceptorImpl.java
+++ b/custos-integration-services/tenant-management-service-parent/tenant-management-service/src/main/java/org/apache/custos/tenant/management/interceptors/SuperTenantRestrictedOperationsInterceptorImpl.java
@@ -22,7 +22,7 @@
 import io.grpc.Metadata;
 import org.apache.custos.credential.store.client.CredentialStoreServiceClient;
 import org.apache.custos.identity.client.IdentityClient;
-import org.apache.custos.integration.core.exceptions.NotAuthorizedException;
+import org.apache.custos.integration.core.exceptions.UnAuthorizedException;
 import org.apache.custos.integration.services.commons.interceptors.AuthInterceptor;
 import org.apache.custos.integration.services.commons.model.AuthClaim;
 import org.apache.custos.tenant.management.service.Credentials;
@@ -50,17 +50,17 @@ public SuperTenantRestrictedOperationsInterceptorImpl(CredentialStoreServiceClie
     public <ReqT> ReqT intercept(String method, Metadata headers, ReqT msg) {
 
         if (method.equals("updateTenantStatus")) {
-            if ( !((UpdateStatusRequest)msg).getSuperTenant() ) {
+            if (!((UpdateStatusRequest) msg).getSuperTenant()) {
                 AuthClaim claim = null;
                 String token = getToken(headers);
                 try {
                     claim = authorizeUsingUserToken(headers);
                 } catch (Exception ex) {
                     LOGGER.error(" Authorizing error " + ex.getMessage());
-                    throw new NotAuthorizedException("Request is not authorized", ex);
+                    throw new UnAuthorizedException("Request is not authorized", ex);
                 }
                 if (claim == null || !claim.isSuperTenant() || !claim.isAdmin()) {
-                    throw new NotAuthorizedException("Request is not authorized", null);
+                    throw new UnAuthorizedException("Request is not authorized", null);
                 }
                 return (ReqT) ((UpdateStatusRequest) msg).toBuilder().setUpdatedBy(claim.getPerformedBy())
                         .setAccessToken(token).build();
@@ -70,14 +70,26 @@ public <ReqT> ReqT intercept(String method, Metadata headers, ReqT msg) {
         } else if (method.equals("getAllTenants")) {
             AuthClaim claim = null;
             try {
-                claim = authorize(headers);
-                LOGGER.info("Claim "+ claim);
-                LOGGER.info("Claim Auth "+ claim.isSuperTenant());
+                claim = authorizeUsingUserToken(headers);
             } catch (Exception ex) {
-                throw new NotAuthorizedException("Request is not authorized", ex);
+                throw new UnAuthorizedException("Request is not authorized", ex);
             }
             if (claim == null || !claim.isSuperTenant()) {
-                throw new NotAuthorizedException("Request is not authorized", null);
+                throw new UnAuthorizedException("Request is not authorized", null);
+            }
+
+            return msg;
+
+        } else if (method.equals("validateTenant")) {
+            AuthClaim claim = null;
+            try {
+                claim = authorizeUsingUserToken(headers);
+            } catch (Exception ex) {
+                LOGGER.error(" Authorizing error " + ex.getMessage());
+                throw new UnAuthorizedException("Request is not authorized", ex);
+            }
+            if (claim == null || !claim.isSuperTenant()) {
+                throw new UnAuthorizedException("Request is not authorized", null);
             }
 
             return msg;
diff --git a/custos-integration-services/tenant-management-service-parent/tenant-management-service/src/main/java/org/apache/custos/tenant/management/service/TenantManagementService.java b/custos-integration-services/tenant-management-service-parent/tenant-management-service/src/main/java/org/apache/custos/tenant/management/service/TenantManagementService.java
index 7db8d5be7..6ab953618 100644
--- a/custos-integration-services/tenant-management-service-parent/tenant-management-service/src/main/java/org/apache/custos/tenant/management/service/TenantManagementService.java
+++ b/custos-integration-services/tenant-management-service-parent/tenant-management-service/src/main/java/org/apache/custos/tenant/management/service/TenantManagementService.java
@@ -27,7 +27,6 @@
 import org.apache.custos.federated.authentication.client.FederatedAuthenticationClient;
 import org.apache.custos.federated.authentication.service.CacheManipulationRequest;
 import org.apache.custos.federated.authentication.service.DeleteClientRequest;
-import org.apache.custos.federated.authentication.service.GetInstitutionsIdsAsResponse;
 import org.apache.custos.federated.authentication.service.GetInstitutionsResponse;
 import org.apache.custos.iam.admin.client.IamAdminServiceClient;
 import org.apache.custos.iam.service.OperationStatus;
@@ -42,6 +41,7 @@
 import org.apache.custos.tenant.management.tasks.TenantActivationTask;
 import org.apache.custos.tenant.management.utils.Constants;
 import org.apache.custos.tenant.profile.client.async.TenantProfileClient;
+import org.apache.custos.tenant.profile.service.GetTenantResponse;
 import org.apache.custos.tenant.profile.service.*;
 import org.apache.custos.user.profile.client.UserProfileClient;
 import org.apache.custos.user.profile.service.UserProfile;
@@ -52,7 +52,6 @@
 import org.springframework.beans.factory.annotation.Autowired;
 
 import java.util.ArrayList;
-import java.util.Arrays;
 import java.util.List;
 
 
@@ -149,7 +148,7 @@ public void createTenant(Tenant request, StreamObserver<CreateTenantResponse> re
     }
 
     @Override
-    public void getTenant(GetTenantRequest request, StreamObserver<GetTenantResponse> responseObserver) {
+    public void getTenant(GetTenantRequest request, StreamObserver<Tenant> responseObserver) {
         try {
 
             Tenant tenant = request.getTenant(); // retrieved cached tenant from interceptors
@@ -162,50 +161,18 @@ public void getTenant(GetTenantRequest request, StreamObserver<GetTenantResponse
                 org.apache.custos.tenant.profile.service.GetTenantResponse response =
                         profileClient.getTenant(tenantReq);
                 tenant = response.getTenant();
-            }
-
-            double clientIdIssuedAt = request.getCredentials().getCustosClientIdIssuedAt();
-
-            if (!request.getCredentials().getCustosClientId().equals(request.getClientId())) {
 
-                GetCredentialRequest credentialRequest = GetCredentialRequest.newBuilder()
-                        .setOwnerId(tenant.getTenantId())
-                        .setId(request.getClientId())
-                        .setType(Type.CUSTOS).build();
-
-                clientIdIssuedAt = credentialStoreServiceClient.
-                        getCredential(credentialRequest).getClientIdIssuedAt();
             }
+            GetCredentialRequest credentialRequest = GetCredentialRequest.newBuilder()
+                    .setOwnerId(tenant.getTenantId())
+                    .setType(Type.CUSTOS).build();
 
+            CredentialMetadata metadata = credentialStoreServiceClient.
+                    getCredential(credentialRequest);
 
-            String[] grantTypes = {Constants.AUTHORIZATION_CODE};
-
-            GetTenantResponse tenantResponse = GetTenantResponse.newBuilder()
-                    .setClientId(request.getClientId())
-                    .setAdminEmail(tenant.getAdminEmail())
-                    .setAdminFirstName(tenant.getAdminFirstName())
-                    .setAdminLastName(tenant.getAdminLastName())
-                    .setAdminUsername(tenant.getAdminUsername())
-                    .setRequesterEmail(tenant.getRequesterEmail())
-                    .setApplicationType(tenant.getApplicationType())
-                    .setClientName(tenant.getClientName())
-                    .setClientUri(tenant.getClientUri())
-                    .setComment(tenant.getComment())
-                    .setDomain(tenant.getDomain())
-                    .setExampleExtensionParameter(tenant.getExampleExtensionParameter())
-                    .setJwksUri(tenant.getJwksUri())
-                    .addAllContacts(tenant.getContactsList())
-                    .addAllRedirectUris(tenant.getRedirectUrisList())
-                    .setLogoUri(tenant.getLogoUri())
-                    .setPolicyUri(tenant.getPolicyUri())
-                    .setTosUri(tenant.getTosUri())
-                    .setScope(tenant.getScope())
-                    .setSoftwareId(tenant.getSoftwareId())
-                    .setSoftwareVersion(tenant.getSoftwareVersion())
-                    .addAllGrantTypes(Arrays.asList(grantTypes))
-                    .setClientIdIssuedAt(clientIdIssuedAt)
-                    .build();
-            responseObserver.onNext(tenantResponse);
+            tenant = tenant.toBuilder().setClientId(metadata.getId()).build();
+
+            responseObserver.onNext(tenant);
             responseObserver.onCompleted();
 
         } catch (Exception ex) {
@@ -217,115 +184,109 @@ public void getTenant(GetTenantRequest request, StreamObserver<GetTenantResponse
 
 
     @Override
-    public void updateTenant(UpdateTenantRequest request, StreamObserver<GetTenantResponse> responseObserver) {
+    public void updateTenant(UpdateTenantRequest request, StreamObserver<Tenant> responseObserver) {
 
         try {
             Tenant tenant = request.getBody();
 
             tenant = tenant.toBuilder().setTenantId(request.getTenantId()).build();
 
-            Tenant updateTenant = profileClient.updateTenant(tenant);
+            org.apache.custos.tenant.profile.service.GetTenantRequest tenantRequest =
+                    org.apache.custos.tenant.profile.service.GetTenantRequest.newBuilder()
+                            .setTenantId(request.getTenantId()).build();
 
-            tenantActivationTask.activateTenant(updateTenant, Constants.GATEWAY_ADMIN, true);
+            GetTenantResponse tenantResponse = profileClient.getTenant(tenantRequest);
 
-            double clientIdIssuedAt = request.getCredentials().getCustosClientIdIssuedAt();
+            if (tenantResponse.getTenant() == null && tenantResponse.getTenant().getTenantId() == 0) {
+                String msg = "Cannot find tenant with Tenant name" + tenant.getClientName();
+                LOGGER.error(msg);
+                responseObserver.onError(Status.INVALID_ARGUMENT.withDescription(msg).asRuntimeException());
+                return;
+            }
 
+            Tenant exTenant = tenantResponse.getTenant();
 
-            if (!request.getCredentials().getCustosClientId().equals(request.getClientId())) {
+            tenant = tenant.toBuilder().setTenantStatus(exTenant.getTenantStatus()).build();
 
-                GetCredentialRequest credentialRequest = GetCredentialRequest.newBuilder()
-                        .setOwnerId(tenant.getTenantId())
-                        .setId(request.getClientId())
-                        .setType(Type.CUSTOS).build();
+            GetCredentialRequest passwordRequest = GetCredentialRequest
+                    .newBuilder()
+                    .setId(tenant.getAdminUsername())
+                    .setOwnerId(tenant.getTenantId())
+                    .setType(Type.INDIVIDUAL)
+                    .build();
+            CredentialMetadata metadata = credentialStoreServiceClient.getCredential(passwordRequest);
 
-                clientIdIssuedAt = credentialStoreServiceClient.
-                        getCredential(credentialRequest).getClientIdIssuedAt();
+            if (metadata != null && metadata.getSecret() != null) {
+                tenant = tenant.toBuilder().setAdminPassword(metadata.getSecret()).build();
             }
 
+            Tenant updateTenant = profileClient.updateTenant(tenant);
 
-            String[] grantTypes = {Constants.AUTHORIZATION_CODE,
-                    Constants.CLIENT_CREDENTIALS,
-                    Constants.PASSWORD_GRANT_TYPE,
-                    Constants.REFRESH_TOKEN};
-
-            GetCredentialRequest credentialRequest = GetCredentialRequest.newBuilder()
+            GetCredentialRequest clientIdRequest = GetCredentialRequest.newBuilder()
                     .setOwnerId(tenant.getTenantId())
-                    .setId(request.getClientId())
-                    .setType(Type.IAM).build();
-
-            CredentialMetadata iamCredential = credentialStoreServiceClient.
-                    getCredential(credentialRequest);
+                    .setType(Type.CUSTOS).build();
 
+            CredentialMetadata idMeta = credentialStoreServiceClient.
+                    getCredential(clientIdRequest);
 
-            GetUserManagementSATokenRequest userManagementSATokenRequest = GetUserManagementSATokenRequest
-                    .newBuilder()
-                    .setClientId(iamCredential.getId())
-                    .setClientSecret(iamCredential.getSecret())
-                    .setTenantId(request.getTenantId())
-                    .build();
-            AuthToken token = identityClient.getUserManagementSATokenRequest(userManagementSATokenRequest);
+            tenant = tenant.toBuilder().setClientId(idMeta.getId()).build();
 
-            if (token != null && token.getAccessToken() != null) {
-                UserSearchMetadata userSearchMetadata = UserSearchMetadata
-                        .newBuilder()
-                        .setUsername(tenant.getAdminUsername())
-                        .build();
+            if (tenant.getTenantStatus().equals(TenantStatus.ACTIVE)) {
 
-                UserSearchRequest searchRequest = UserSearchRequest.newBuilder().
-                        setTenantId(request.getTenantId())
-                        .setPerformedBy(Constants.GATEWAY_ADMIN)
-                        .setAccessToken(token.getAccessToken())
-                        .setUser(userSearchMetadata)
-                        .build();
+                tenantActivationTask.activateTenant(updateTenant, Constants.GATEWAY_ADMIN, true);
+                GetCredentialRequest credentialRequest = GetCredentialRequest.newBuilder()
+                        .setOwnerId(tenant.getTenantId())
+                        .setId(request.getClientId())
+                        .setType(Type.IAM).build();
 
-                UserRepresentation userRepresentation = iamAdminServiceClient.getUser(searchRequest);
+                CredentialMetadata iamCredential = credentialStoreServiceClient.
+                        getCredential(credentialRequest);
 
-                UserProfile profile = convertToProfile(userRepresentation);
 
-                UserProfileRequest userProfileRequest = UserProfileRequest
+                GetUserManagementSATokenRequest userManagementSATokenRequest = GetUserManagementSATokenRequest
                         .newBuilder()
-                        .setProfile(profile)
-                        .setPerformedBy(Constants.GATEWAY_ADMIN)
+                        .setClientId(iamCredential.getId())
+                        .setClientSecret(iamCredential.getSecret())
                         .setTenantId(request.getTenantId())
                         .build();
+                AuthToken token = identityClient.getUserManagementSATokenRequest(userManagementSATokenRequest);
 
-                UserProfile userProfile = userProfileClient.getUser(userProfileRequest);
+                if (token != null && token.getAccessToken() != null) {
+                    UserSearchMetadata userSearchMetadata = UserSearchMetadata
+                            .newBuilder()
+                            .setUsername(tenant.getAdminUsername())
+                            .build();
 
-                if (userProfile == null || userProfile.getUsername().equals("")) {
-                    userProfileClient.createUserProfile(userProfileRequest);
-                } else {
-                    userProfileClient.updateUserProfile(userProfileRequest);
-                }
+                    UserSearchRequest searchRequest = UserSearchRequest.newBuilder().
+                            setTenantId(request.getTenantId())
+                            .setPerformedBy(Constants.GATEWAY_ADMIN)
+                            .setAccessToken(token.getAccessToken())
+                            .setUser(userSearchMetadata)
+                            .build();
 
+                    UserRepresentation userRepresentation = iamAdminServiceClient.getUser(searchRequest);
 
-            }
+                    UserProfile profile = convertToProfile(userRepresentation);
 
-            GetTenantResponse tenantResponse = GetTenantResponse.newBuilder()
-                    .setClientId(request.getClientId())
-                    .setAdminEmail(tenant.getAdminEmail())
-                    .setAdminFirstName(tenant.getAdminFirstName())
-                    .setAdminLastName(tenant.getAdminLastName())
-                    .setRequesterEmail(tenant.getRequesterEmail())
-                    .setApplicationType(tenant.getApplicationType())
-                    .setClientName(tenant.getClientName())
-                    .setClientUri(tenant.getClientUri())
-                    .setComment(tenant.getComment())
-                    .setDomain(tenant.getDomain())
-                    .setExampleExtensionParameter(tenant.getExampleExtensionParameter())
-                    .setJwksUri(tenant.getJwksUri())
-                    .addAllContacts(tenant.getContactsList())
-                    .addAllRedirectUris(tenant.getRedirectUrisList())
-                    .setLogoUri(tenant.getLogoUri())
-                    .setPolicyUri(tenant.getPolicyUri())
-                    .setTosUri(tenant.getTosUri())
-                    .setScope(tenant.getScope())
-                    .setSoftwareId(tenant.getSoftwareId())
-                    .setSoftwareVersion(tenant.getSoftwareVersion())
-                    .addAllGrantTypes(Arrays.asList(grantTypes))
-                    .setClientIdIssuedAt(clientIdIssuedAt)
-                    .build();
+                    UserProfileRequest userProfileRequest = UserProfileRequest
+                            .newBuilder()
+                            .setProfile(profile)
+                            .setPerformedBy(Constants.GATEWAY_ADMIN)
+                            .setTenantId(request.getTenantId())
+                            .build();
 
-            responseObserver.onNext(tenantResponse);
+                    UserProfile userProfile = userProfileClient.getUser(userProfileRequest);
+
+                    if (userProfile == null || userProfile.getUsername().equals("")) {
+                        userProfileClient.createUserProfile(userProfileRequest);
+                    } else {
+                        userProfileClient.updateUserProfile(userProfileRequest);
+                    }
+                }
+
+            }
+
+            responseObserver.onNext(tenant);
             responseObserver.onCompleted();
 
         } catch (Exception ex) {
@@ -419,6 +380,35 @@ public void deleteTenant(DeleteTenantRequest request, StreamObserver<com.google.
     }
 
 
+    @Override
+    public void validateTenant(TenantValidationRequest request, StreamObserver<OperationStatus> responseObserver) {
+        try {
+            GetCredentialRequest credentialRequest = GetCredentialRequest
+                    .newBuilder()
+                    .setId(request.getClientId()).build();
+
+
+            CredentialMetadata metadata = credentialStoreServiceClient.getCustosCredentialFromClientId(credentialRequest);
+
+            if (metadata.getSecret() != null && metadata.getSecret().trim().
+                    equals(request.getClientSec().trim())) {
+                OperationStatus status = OperationStatus.newBuilder().setStatus(true).build();
+                responseObserver.onNext(status);
+                responseObserver.onCompleted();
+            } else {
+                OperationStatus status = OperationStatus.newBuilder().setStatus(false).build();
+                responseObserver.onNext(status);
+                responseObserver.onCompleted();
+            }
+
+        } catch (Exception ex) {
+            String msg = "Error occurred while validating tenant with Id " + request.getClientId()
+                    + " reason: " + ex.getMessage();
+            LOGGER.error(msg);
+            responseObserver.onError(Status.INTERNAL.withDescription(msg).asRuntimeException());
+        }
+    }
+
     @Override
     public void addTenantRoles(AddRolesRequest request, StreamObserver<AllRoles> responseObserver) {
         try {
@@ -450,6 +440,22 @@ public void getTenantRoles(GetRolesRequest request, StreamObserver<AllRoles> res
         }
     }
 
+    @Override
+    public void deleteRole(DeleteRoleRequest request, StreamObserver<OperationStatus> responseObserver) {
+        try {
+            OperationStatus operationStatus = iamAdminServiceClient.deleteRole(request);
+
+            responseObserver.onNext(operationStatus);
+            responseObserver.onCompleted();
+
+        } catch (Exception ex) {
+            String msg = "Error occurred at deleteRole " + request.getRole() + " of tenant "
+                    + request.getTenantId() + ex.getMessage();
+            LOGGER.error(msg);
+            responseObserver.onError(Status.INTERNAL.withDescription(msg).asRuntimeException());
+        }
+    }
+
     @Override
     public void addProtocolMapper(AddProtocolMapperRequest request, StreamObserver<OperationStatus> responseObserver) {
         try {
diff --git a/custos-integration-services/tenant-management-service-parent/tenant-management-service/src/main/proto/TenantManagementService.proto b/custos-integration-services/tenant-management-service-parent/tenant-management-service/src/main/proto/TenantManagementService.proto
index eeba841a2..f98032d85 100644
--- a/custos-integration-services/tenant-management-service-parent/tenant-management-service/src/main/proto/TenantManagementService.proto
+++ b/custos-integration-services/tenant-management-service-parent/tenant-management-service/src/main/proto/TenantManagementService.proto
@@ -106,14 +106,21 @@ message DeleteTenantRequest {
 
 
 message GetCredentialsRequest {
-    int64 tenantId = 1;
+    int64 tenant_id = 1;
 }
 
 message GetCredentialsResponse {
-    string iamClientId = 1;
-    string iamClientSecret = 2;
-    string ciLogonClientId = 3;
-    string ciLogonClientSecret = 4;
+    string iam_client_id = 1;
+    string iam_client_secret = 2;
+    string ci_logon_client_id = 3;
+    string ci_logon_client_secret = 4;
+}
+
+
+message TenantValidationRequest {
+    string client_id = 1;
+    string client_sec = 2;
+
 }
 
 service TenantManagementService {
@@ -124,13 +131,13 @@ service TenantManagementService {
          };
     }
 
-    rpc getTenant (GetTenantRequest) returns (GetTenantResponse) {
+    rpc getTenant (GetTenantRequest) returns (org.apache.custos.tenant.profile.service.Tenant) {
         option (google.api.http) = {
            get: "/tenant-management/v1.0.0/oauth2/tenant"
         };
     }
 
-    rpc updateTenant (UpdateTenantRequest) returns (GetTenantResponse) {
+    rpc updateTenant (UpdateTenantRequest) returns (org.apache.custos.tenant.profile.service.Tenant) {
         option (google.api.http) = {
            put: "/tenant-management/v1.0.0/oauth2/tenant"
            body: "body"
@@ -144,6 +151,12 @@ service TenantManagementService {
         };
     }
 
+    rpc validateTenant (TenantValidationRequest) returns (org.apache.custos.iam.service.OperationStatus) {
+        option (google.api.http) = {
+           post: "/tenant-management/v1.0.0/tenant/credentials/status"
+        };
+    }
+
     rpc addTenantRoles (org.apache.custos.iam.service.AddRolesRequest) returns (org.apache.custos.iam.service.AllRoles) {
         option (google.api.http) = {
            post: "/tenant-management/v1.0.0/roles"
@@ -156,6 +169,12 @@ service TenantManagementService {
         };
     }
 
+    rpc deleteRole (org.apache.custos.iam.service.DeleteRoleRequest) returns (org.apache.custos.iam.service.OperationStatus) {
+        option (google.api.http) = {
+           delete: "/tenant-management/v1.0.0/role"
+        };
+    }
+
     rpc addProtocolMapper (org.apache.custos.iam.service.AddProtocolMapperRequest) returns (org.apache.custos.iam.service.OperationStatus) {
         option (google.api.http) = {
            post: "/tenant-management/v1.0.0/protocol/mapper"
diff --git a/custos-integration-services/user-management-service-parent/user-management-service/pom.xml b/custos-integration-services/user-management-service-parent/user-management-service/pom.xml
index 23c254dac..83b47786e 100644
--- a/custos-integration-services/user-management-service-parent/user-management-service/pom.xml
+++ b/custos-integration-services/user-management-service-parent/user-management-service/pom.xml
@@ -132,6 +132,13 @@
                     <skip>false</skip>
                 </configuration>
             </plugin>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-antrun-plugin</artifactId>
+                <configuration>
+                    <skip>false</skip>
+                </configuration>
+            </plugin>
         </plugins>
     </build>
 
diff --git a/custos-integration-services/user-management-service-parent/user-management-service/src/main/helm/templates/deployment.yaml b/custos-integration-services/user-management-service-parent/user-management-service/src/main/helm/templates/deployment.yaml
index 2fe140f87..9fe298c77 100644
--- a/custos-integration-services/user-management-service-parent/user-management-service/src/main/helm/templates/deployment.yaml
+++ b/custos-integration-services/user-management-service-parent/user-management-service/src/main/helm/templates/deployment.yaml
@@ -6,9 +6,10 @@ metadata:
 {{ include "helm.labels" . | indent 4 }}
 spec:
   replicas: {{ .Values.replicaCount }}
-  rollingUpdate:
-    maxSurge: {{ .Values.rollingUpdate.maxSurge }}
-    maxUnavailable: {{ .Values.rollingUpdate.maxUnavailable }}
+  strategy:
+    rollingUpdate:
+      maxSurge: {{ .Values.rollingUpdate.maxSurge }}
+      maxUnavailable: {{ .Values.rollingUpdate.maxUnavailable }}
   selector:
     matchLabels:
       app.kubernetes.io/name: {{ include "helm.name" . }}
@@ -59,9 +60,9 @@ spec:
             httpGet:
               path: /actuator/health
               port: {{ .Values.service.port }}
-              initialDelaySeconds: {{ .Values.readinessProbe.initialDelaySeconds }}
-              periodSeconds: {{ .Values.readinessProbe.periodSeconds }}
-              successThreshold: {{ .Values.readinessProbe.successThreshold }}
+            initialDelaySeconds: {{ .Values.readinessProbe.initialDelaySeconds }}
+            periodSeconds: {{ .Values.readinessProbe.periodSeconds }}
+            successThreshold: {{ .Values.readinessProbe.successThreshold }}
           resources:
             {{- toYaml .Values.resources | nindent 12 }}
       {{- with .Values.nodeSelector }}
diff --git a/custos-integration-services/user-management-service-parent/user-management-service/src/main/helm/templates/ingress-grpc.yaml b/custos-integration-services/user-management-service-parent/user-management-service/src/main/helm/templates/ingress-grpc.yaml
index c8f348713..8e61028f5 100644
--- a/custos-integration-services/user-management-service-parent/user-management-service/src/main/helm/templates/ingress-grpc.yaml
+++ b/custos-integration-services/user-management-service-parent/user-management-service/src/main/helm/templates/ingress-grpc.yaml
@@ -1,4 +1,4 @@
-apiVersion: extensions/v1beta1
+apiVersion: networking.k8s.io/v1beta1
 kind: Ingress
 metadata:
   annotations:
diff --git a/custos-integration-services/user-management-service-parent/user-management-service/src/main/java/org/apache/custos/user/management/interceptors/ClientAuthInterceptorImpl.java b/custos-integration-services/user-management-service-parent/user-management-service/src/main/java/org/apache/custos/user/management/interceptors/ClientAuthInterceptorImpl.java
index 8abd0b16d..2a69222d6 100644
--- a/custos-integration-services/user-management-service-parent/user-management-service/src/main/java/org/apache/custos/user/management/interceptors/ClientAuthInterceptorImpl.java
+++ b/custos-integration-services/user-management-service-parent/user-management-service/src/main/java/org/apache/custos/user/management/interceptors/ClientAuthInterceptorImpl.java
@@ -27,7 +27,7 @@
 import org.apache.custos.iam.service.UserSearchRequest;
 import org.apache.custos.identity.client.IdentityClient;
 import org.apache.custos.identity.service.AuthToken;
-import org.apache.custos.integration.core.exceptions.NotAuthorizedException;
+import org.apache.custos.integration.core.exceptions.UnAuthorizedException;
 import org.apache.custos.integration.core.utils.Constants;
 import org.apache.custos.integration.services.commons.interceptors.MultiTenantAuthInterceptor;
 import org.apache.custos.integration.services.commons.model.AuthClaim;
@@ -61,7 +61,7 @@ public <ReqT> ReqT intercept(String method, Metadata headers, ReqT reqT) {
             AuthClaim claim = authorize(headers, request.getClientId());
 
             if (claim == null) {
-                throw new NotAuthorizedException("Request is not authorized", null);
+                throw new UnAuthorizedException("Request is not authorized", null);
             }
 
             String oauthId = claim.getIamAuthId();
@@ -80,7 +80,7 @@ public <ReqT> ReqT intercept(String method, Metadata headers, ReqT reqT) {
             AuthClaim claim = authorize(headers, request.getClientId());
 
             if (claim == null) {
-                throw new NotAuthorizedException("Request is not authorized", null);
+                throw new UnAuthorizedException("Request is not authorized", null);
             }
 
             String oauthId = claim.getIamAuthId();
@@ -101,7 +101,7 @@ public <ReqT> ReqT intercept(String method, Metadata headers, ReqT reqT) {
             AuthClaim claim = authorize(headers, request.getClientId());
 
             if (claim == null) {
-                throw new NotAuthorizedException("Request is not authorized", null);
+                throw new UnAuthorizedException("Request is not authorized", null);
             }
 
             String oauthId = claim.getIamAuthId();
@@ -123,7 +123,7 @@ public <ReqT> ReqT intercept(String method, Metadata headers, ReqT reqT) {
             AuthClaim claim = authorize(headers, req.getClientId());
 
             if (claim == null) {
-                throw new NotAuthorizedException("Request is not authorized", null);
+                throw new UnAuthorizedException("Request is not authorized", null);
             }
 
             String oauthId = claim.getIamAuthId();
@@ -140,7 +140,7 @@ public <ReqT> ReqT intercept(String method, Metadata headers, ReqT reqT) {
             AuthClaim claim = authorize(headers, req.getClientId());
 
             if (claim == null) {
-                throw new NotAuthorizedException("Request is not authorized", null);
+                throw new UnAuthorizedException("Request is not authorized", null);
             }
 
             String oauthId = claim.getIamAuthId();
@@ -155,7 +155,7 @@ public <ReqT> ReqT intercept(String method, Metadata headers, ReqT reqT) {
             AuthClaim claim = authorize(headers);
 
             if (claim == null) {
-                throw new NotAuthorizedException("Request is not authorized", null);
+                throw new UnAuthorizedException("Request is not authorized", null);
             }
 
             String oauthId = claim.getIamAuthId();
@@ -173,7 +173,7 @@ public <ReqT> ReqT intercept(String method, Metadata headers, ReqT reqT) {
             AuthClaim claim = authorize(headers, req.getClientId());
 
             if (claim == null) {
-                throw new NotAuthorizedException("Request is not authorized", null);
+                throw new UnAuthorizedException("Request is not authorized", null);
             }
 
             String oauthId = claim.getIamAuthId();
@@ -195,7 +195,7 @@ public <ReqT> ReqT intercept(String method, Metadata headers, ReqT reqT) {
             AuthClaim claim = authorize(headers, req.getClientId());
 
             if (claim == null) {
-                throw new NotAuthorizedException("Request is not authorized", null);
+                throw new UnAuthorizedException("Request is not authorized", null);
             }
 
             String oauthId = claim.getIamAuthId();
@@ -217,7 +217,7 @@ public <ReqT> ReqT intercept(String method, Metadata headers, ReqT reqT) {
             AuthClaim claim = authorize(headers, req.getClientId());
 
             if (claim == null) {
-                throw new NotAuthorizedException("Request is not authorized", null);
+                throw new UnAuthorizedException("Request is not authorized", null);
             }
 
             String oauthId = claim.getIamAuthId();
@@ -239,7 +239,7 @@ public <ReqT> ReqT intercept(String method, Metadata headers, ReqT reqT) {
             AuthClaim claim = authorize(headers, userProfileRequest.getClientId());
 
             if (claim == null) {
-                throw new NotAuthorizedException("Request is not authorized", null);
+                throw new UnAuthorizedException("Request is not authorized", null);
             }
 
             String oauthId = claim.getIamAuthId();
@@ -249,7 +249,7 @@ public <ReqT> ReqT intercept(String method, Metadata headers, ReqT reqT) {
 
             AuthToken token = getSAToken(claim.getIamAuthId(), claim.getIamAuthSecret(), claim.getTenantId());
             if (token == null || token.getAccessToken() == null) {
-                throw new NotAuthorizedException("Request is not authorized SA token is invalid", null);
+                throw new UnAuthorizedException("Request is not authorized SA token is invalid", null);
             }
 
             return (ReqT) ((UserProfileRequest) reqT).toBuilder()
diff --git a/custos-integration-services/user-management-service-parent/user-management-service/src/main/java/org/apache/custos/user/management/interceptors/SuperTenantRestrictedOperationsInterceptorImpl.java b/custos-integration-services/user-management-service-parent/user-management-service/src/main/java/org/apache/custos/user/management/interceptors/SuperTenantRestrictedOperationsInterceptorImpl.java
index 6f82546c3..85987c9f7 100644
--- a/custos-integration-services/user-management-service-parent/user-management-service/src/main/java/org/apache/custos/user/management/interceptors/SuperTenantRestrictedOperationsInterceptorImpl.java
+++ b/custos-integration-services/user-management-service-parent/user-management-service/src/main/java/org/apache/custos/user/management/interceptors/SuperTenantRestrictedOperationsInterceptorImpl.java
@@ -21,9 +21,8 @@
 
 import io.grpc.Metadata;
 import org.apache.custos.credential.store.client.CredentialStoreServiceClient;
-import org.apache.custos.iam.service.GetAllResources;
 import org.apache.custos.identity.client.IdentityClient;
-import org.apache.custos.integration.core.exceptions.NotAuthorizedException;
+import org.apache.custos.integration.core.exceptions.UnAuthorizedException;
 import org.apache.custos.integration.services.commons.interceptors.AuthInterceptor;
 import org.apache.custos.integration.services.commons.model.AuthClaim;
 import org.apache.custos.tenant.profile.client.async.TenantProfileClient;
@@ -54,10 +53,10 @@ public <ReqT> ReqT intercept(String method, Metadata headers, ReqT msg) {
                 claim = authorizeUsingUserToken(headers);
             } catch (Exception ex) {
                 LOGGER.error(" Authorizing error " + ex.getMessage());
-                throw new NotAuthorizedException("Request is not authorized", ex);
+                throw new UnAuthorizedException("Request is not authorized", ex);
             }
             if (claim == null || !claim.isSuperTenant() || !claim.isAdmin()) {
-                throw new NotAuthorizedException("Request is not authorized", null);
+                throw new UnAuthorizedException("Request is not authorized", null);
             }
 
         }
diff --git a/custos-integration-services/user-management-service-parent/user-management-service/src/main/java/org/apache/custos/user/management/interceptors/UserAuthInterceptorImpl.java b/custos-integration-services/user-management-service-parent/user-management-service/src/main/java/org/apache/custos/user/management/interceptors/UserAuthInterceptorImpl.java
index bb375cb3f..9d10f0494 100644
--- a/custos-integration-services/user-management-service-parent/user-management-service/src/main/java/org/apache/custos/user/management/interceptors/UserAuthInterceptorImpl.java
+++ b/custos-integration-services/user-management-service-parent/user-management-service/src/main/java/org/apache/custos/user/management/interceptors/UserAuthInterceptorImpl.java
@@ -24,13 +24,12 @@
 import org.apache.custos.iam.service.*;
 import org.apache.custos.identity.client.IdentityClient;
 import org.apache.custos.identity.service.AuthToken;
-import org.apache.custos.integration.core.exceptions.NotAuthorizedException;
+import org.apache.custos.integration.core.exceptions.UnAuthorizedException;
 import org.apache.custos.integration.core.utils.Constants;
 import org.apache.custos.integration.services.commons.interceptors.MultiTenantAuthInterceptor;
 import org.apache.custos.integration.services.commons.model.AuthClaim;
 import org.apache.custos.tenant.profile.client.async.TenantProfileClient;
 import org.apache.custos.user.management.service.LinkUserProfileRequest;
-import org.apache.custos.user.management.service.UserProfileRequest;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 import org.springframework.beans.factory.annotation.Autowired;
@@ -59,7 +58,7 @@ public <ReqT> ReqT intercept(String method, Metadata headers, ReqT msg) {
             AuthClaim claim = authorize(headers, userAttributesRequest.getClientId());
 
             if (claim == null) {
-                throw new NotAuthorizedException("Request is not authorized", null);
+                throw new UnAuthorizedException("Request is not authorized", null);
             }
 
             String oauthId = claim.getIamAuthId();
@@ -68,7 +67,7 @@ public <ReqT> ReqT intercept(String method, Metadata headers, ReqT msg) {
 
             AuthToken token = getSAToken(claim.getIamAuthId(), claim.getIamAuthSecret(), claim.getTenantId());
             if (token == null || token.getAccessToken() == null) {
-                throw new NotAuthorizedException("Request is not authorized SA token is invalid", null);
+                throw new UnAuthorizedException("Request is not authorized SA token is invalid", null);
             }
 
 
@@ -87,7 +86,7 @@ public <ReqT> ReqT intercept(String method, Metadata headers, ReqT msg) {
 
 
             if (claim == null) {
-                throw new NotAuthorizedException("Request is not authorized", null);
+                throw new UnAuthorizedException("Request is not authorized", null);
             }
 
             String oauthId = claim.getIamAuthId();
@@ -96,7 +95,7 @@ public <ReqT> ReqT intercept(String method, Metadata headers, ReqT msg) {
 
             AuthToken token = getSAToken(claim.getIamAuthId(), claim.getIamAuthSecret(), claim.getTenantId());
             if (token == null || token.getAccessToken() == null) {
-                throw new NotAuthorizedException("Request is not authorized SA token is invalid", null);
+                throw new UnAuthorizedException("Request is not authorized SA token is invalid", null);
             }
 
             return (ReqT) ((DeleteUserAttributeRequest) msg).toBuilder()
@@ -114,7 +113,7 @@ public <ReqT> ReqT intercept(String method, Metadata headers, ReqT msg) {
 
 
             if (claim == null) {
-                throw new NotAuthorizedException("Request is not authorized", null);
+                throw new UnAuthorizedException("Request is not authorized", null);
             }
 
             String oauthId = claim.getIamAuthId();
@@ -142,7 +141,7 @@ public <ReqT> ReqT intercept(String method, Metadata headers, ReqT msg) {
             AuthClaim claim = authorize(headers, registerUsersRequest.getClientId());
 
             if (claim == null) {
-                throw new NotAuthorizedException("Request is not authorized", null);
+                throw new UnAuthorizedException("Request is not authorized", null);
             }
 
             String oauthId = claim.getIamAuthId();
@@ -169,7 +168,7 @@ public <ReqT> ReqT intercept(String method, Metadata headers, ReqT msg) {
             AuthClaim claim = authorize(headers, deleteUserRolesRequest.getClientId());
 
             if (claim == null) {
-                throw new NotAuthorizedException("Request is not authorized", null);
+                throw new UnAuthorizedException("Request is not authorized", null);
             }
 
             String oauthId = claim.getIamAuthId();
@@ -199,7 +198,7 @@ public <ReqT> ReqT intercept(String method, Metadata headers, ReqT msg) {
             AuthClaim claim = authorize(headers, userSearchRequest.getClientId());
 
             if (claim == null) {
-                throw new NotAuthorizedException("Request is not authorized", null);
+                throw new UnAuthorizedException("Request is not authorized", null);
             }
 
             String oauthId = claim.getIamAuthId();
@@ -207,7 +206,7 @@ public <ReqT> ReqT intercept(String method, Metadata headers, ReqT msg) {
 
             AuthToken token = getSAToken(claim.getIamAuthId(), claim.getIamAuthSecret(), claim.getTenantId());
             if (token == null || token.getAccessToken() == null) {
-                throw new NotAuthorizedException("Request is not authorized SA token is invalid", null);
+                throw new UnAuthorizedException("Request is not authorized SA token is invalid", null);
             }
 
 
@@ -228,7 +227,7 @@ public <ReqT> ReqT intercept(String method, Metadata headers, ReqT msg) {
             AuthClaim claim = authorizeUsingUserToken(headers);
 
             if (claim == null) {
-                throw new NotAuthorizedException("Request is not authorized", null);
+                throw new UnAuthorizedException("Request is not authorized", null);
             }
 
             String oauthId = claim.getIamAuthId();
diff --git a/custos-integration-services/user-management-service-parent/user-management-service/src/main/proto/UserManagementService.proto b/custos-integration-services/user-management-service-parent/user-management-service/src/main/proto/UserManagementService.proto
index f6f73cbee..1a47a918c 100644
--- a/custos-integration-services/user-management-service-parent/user-management-service/src/main/proto/UserManagementService.proto
+++ b/custos-integration-services/user-management-service-parent/user-management-service/src/main/proto/UserManagementService.proto
@@ -30,40 +30,40 @@ import "IamAdminService.proto";
 
 message UserProfileRequest {
     org.apache.custos.user.profile.service.UserProfile user_profile = 1;
-    string clientId = 2;
-    int64 tenantId = 3;
-    string accessToken = 4;
-    string clientSecret = 5;
-    string performedBy = 6;
+    string client_id = 2;
+    int64 tenant_id = 3;
+    string access_token = 4;
+    string client_secret = 5;
+    string performed_by = 6;
 }
 
 message GetUserRequest {
     string username = 1;
-    org.apache.custos.iam.service.UserSearchRequest userSearchRequest = 2;
+    org.apache.custos.iam.service.UserSearchRequest user_search_request = 2;
 }
 
 message GetUsersRequest {
-    int64 tenantId = 1;
+    int64 tenant_id = 1;
     string email = 2;
     string username = 3;
     int32 offset = 4;
     int32 limit = 5;
     string search = 6;
-    string iamClientId = 7;
-    string iamClientSecret = 8;
+    string iam_client_id = 7;
+    string iam_client_secret = 8;
 }
 
 message ResetPassword {
-    int64 tenantId = 1;
-    string accessToken = 2;
+    int64 tenant_id = 1;
+    string access_token = 2;
     string username = 3;
     string password = 4;
-    string iamClientId = 5;
-    string iamClientSecret = 6;
+    string iam_client_id = 5;
+    string iam_client_secret = 6;
 }
 
 message ResetPasswordRequest {
-    ResetPassword passwordMetadata = 1;
+    ResetPassword password_metadata = 1;
 }
 
 message LinkUserProfileRequest {
@@ -71,15 +71,15 @@ message LinkUserProfileRequest {
     string previous_username = 2;
     repeated string linking_attributes = 3;
     int64 tenantId = 4;
-    string iamClientId = 5;
-    string iamClientSecret = 6;
-    string accessToken = 7;
-    string performedBy = 8;
+    string iam_client_id = 5;
+    string iam_client_secret = 6;
+    string access_token = 7;
+    string performed_by = 8;
 }
 
 message SynchronizeUserDBRequest {
-    int64 tenantId = 2;
-    string clientId = 4;
+    int64 tenant_id = 2;
+    string client_id = 4;
 }
 
 service UserManagementService {
diff --git a/pom.xml b/pom.xml
index 4b810fdff..a23ddb181 100644
--- a/pom.xml
+++ b/pom.xml
@@ -242,6 +242,12 @@
                 <version>${io.commons.version}</version>
             </dependency>
 
+            <!-- Secret handling dependencies -->
+            <dependency>
+                <groupId>com.codahale</groupId>
+                <artifactId>shamir</artifactId>
+                <version>${com.codahale.version}</version>
+            </dependency>
         </dependencies>
     </dependencyManagement>
 
@@ -386,7 +392,11 @@
                         <configuration>
                             <chartName>${project.artifactId}</chartName>
                             <chartFolder>src/main/helm</chartFolder>
-                            <chartRepoUrl>https://kubernetes-charts.storage.googleapis.com/</chartRepoUrl>
+                            <chartRepoUrl>https://charts.helm.sh/stable</chartRepoUrl>
+                            <!--                            <chartRepoUrl>https://kubernetes.oss-cn-hangzhou.aliyuncs.com/charts</chartRepoUrl>-->
+                            <helmVersion>3.4.2</helmVersion>
+                            <!--                            <chartRepoUrl>null</chartRepoUrl>-->
+                            <chartRepoUrl>https://kubernetes.oss-cn-hangzhou.aliyuncs.com/charts</chartRepoUrl>
                             <helmVersion>2.16.0</helmVersion>
                             <strictLint>true</strictLint>
                             <valuesFile>src/main/helm/values.yaml</valuesFile>
@@ -404,7 +414,66 @@
                             </execution>
                         </executions>
                     </plugin>
-
+                </plugins>
+            </build>
+        </profile>
+        <profile>
+            <id>scp-to-remote</id>
+            <build>
+                <plugins>
+                    <plugin>
+                        <groupId>org.apache.maven.plugins</groupId>
+                        <artifactId>maven-antrun-plugin</artifactId>
+                        <version>1.8</version>
+                        <executions>
+                            <execution>
+                                <goals>
+                                    <goal>run</goal>
+                                </goals>
+                            </execution>
+                        </executions>
+                        <dependencies>
+                            <dependency>
+                                <groupId>ant</groupId>
+                                <artifactId>ant-commons-net</artifactId>
+                                <version>1.6.5</version>
+                            </dependency>
+                            <dependency>
+                                <groupId>org.apache.ant</groupId>
+                                <artifactId>ant-jsch</artifactId>
+                                <version>1.10.9</version>
+                            </dependency>
+                        </dependencies>
+                        <configuration>
+                            <target>
+
+                                <scp localFile="${project.basedir}/target/helm/${project.artifactId}-${project.version}.tgz"
+                                     remoteToFile="ubuntu@${host}:/home/ubuntu/custos/artifacts"
+                                     verbose="true"
+                                     keyfile="${ssh.privatekey}"
+                                     passphrase="${ssh.passphrase}" trust="true">
+                                </scp>
+                                <sshexec host="${host}"
+                                         username="ubuntu"
+                                         keyfile="${ssh.privatekey}"
+                                         passphrase="${ssh.passphrase}" trust="true"
+                                         command="helm delete ${project.artifactId} -n custos"/>
+
+                                <sshexec host="${host}"
+                                         username="ubuntu"
+                                         keyfile="${ssh.privatekey}"
+                                         passphrase="${ssh.passphrase}" trust="true"
+                                         command="helm install ${project.artifactId} /home/ubuntu/custos/artifacts/${project.artifactId}-${project.version}.tgz -n custos"/>
+
+                                <!-- SSH -->
+                                <taskdef name="sshexec"
+                                         classname="org.apache.tools.ant.taskdefs.optional.ssh.SSHExec"
+                                         classpathref="maven.plugin.classpath" />
+
+                            </target>
+                            <skip>true</skip>
+                        </configuration>
+                    </plugin>
                 </plugins>
             </build>
         </profile>
@@ -459,6 +528,7 @@
                 <version>${os.maven.plugin}</version>
             </extension>
         </extensions>
+
     </build>
 
     <properties>
@@ -496,7 +566,7 @@
         <docker.image.repo>custos</docker.image.repo>
         <docker.plugin.version>1.4.13</docker.plugin.version>
 
-        <helm.maven.plugin.version>2.1.0</helm.maven.plugin.version>
+        <helm.maven.plugin.version>2.8.0</helm.maven.plugin.version>
         <maven.assembly.plugin.version>3.2.0</maven.assembly.plugin.version>
 
         <mysql.connector.java>8.0.18</mysql.connector.java>
@@ -527,7 +597,13 @@
 
         <io.commons.version>2.7</io.commons.version>
 
+        <com.codahale.version>0.7.0</com.codahale.version>
+
+        <host>service.staging.usecustos.org</host>
+
+        <ssh.privatekey></ssh.privatekey>
 
+        <ssh.passphrase></ssh.passphrase>
     </properties>
 
 </project>
\ No newline at end of file


Test patch:
diff --git a/custos-tests/src/test/java/org/apache/custos/integration/tests/TenantManagementTests.java b/custos-tests/src/test/java/org/apache/custos/integration/tests/TenantManagementTests.java
index 23a82736c..2bbdb7fac 100644
--- a/custos-tests/src/test/java/org/apache/custos/integration/tests/TenantManagementTests.java
+++ b/custos-tests/src/test/java/org/apache/custos/integration/tests/TenantManagementTests.java
@@ -6,6 +6,7 @@
 import org.apache.custos.tenant.management.service.GetTenantResponse;
 import org.apache.custos.tenant.manamgement.client.TenantManagementClient;
 import org.apache.custos.tenant.profile.service.GetAllTenantsResponse;
+import org.apache.custos.tenant.profile.service.Tenant;
 import org.junit.Assert;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
@@ -82,7 +83,7 @@ public void createTenant() {
     @Test(groups = {"tenant-management"}, dependsOnMethods = {"createTenant"})
     public void getTenant() {
         LOGGER.info("Executing getTenant test case ");
-        GetTenantResponse response = tenantManagementClient.getTenant(clientId);
+        Tenant response = tenantManagementClient.getTenant(clientId);
         Assert.assertEquals(response.getClientName(), "Testing tenant");
         Assert.assertEquals(response.getRequesterEmail(), "custos@airavata.apache.org");
         Assert.assertEquals(response.getScope(), "email openid profile org.cilogon.userinfo");
@@ -112,7 +113,7 @@ public void updateTenant() {
 
         String[] redirectURI = {"http://localhost:8080/callback", "http://localhost:8080/callback/updated"};
 
-        GetTenantResponse response = tenantManagementClient.updateTenant(clientId,
+        Tenant response = tenantManagementClient.updateTenant(clientId,
                 "Testing tenant updated",
                 "custos@airavata.apache.org",
                 "Merry",