Repository: Altinn/app-lib-dotnet
Pull request #1204: Support tokens from Altinn Test Tools in `IAuthenticationContext`/`Authenticated` and correctly set `InAltinnPortal` for localtest tokens
Author: login: martinothamar
Labels: name: bugfix
description: Label Pull requests with bugfix. Used when generation releasenotes
name: backport-ignore
description: This PR is a new feature and should not be cherry-picked onto release branches
Created: 2025-03-26T06:01:43Z | Merged: 2025-03-26T07:31:03Z

## Description
There were no tests for tokens coming from localtest and Altinn Test Tools, so now they have been added and the parsing code updated accordingly

## Related Issue(s)
- #1203
- #1205

## Verification
- [x] **Your** code builds clean without any errors or warnings
- [ ] Manual testing done (required)
- [x] Relevant automated test added (if you find this hard, leave it and we'll help out)
- [x] All tests run green

## Documentation
- [ ] User documentation is updated with a separate linked PR in [altinn-studio-docs.](https://github.com/Altinn/altinn-studio-docs) (if applicable)



Diff:
diff --git a/src/Altinn.App.Core/Features/Auth/Authenticated.cs b/src/Altinn.App.Core/Features/Auth/Authenticated.cs
index 0b0e355be..1cf4cc4ac 100644
--- a/src/Altinn.App.Core/Features/Auth/Authenticated.cs
+++ b/src/Altinn.App.Core/Features/Auth/Authenticated.cs
@@ -594,8 +594,21 @@ public async Task<Details> LoadDetails()
     // TODO: app token?
     // public sealed record App(string Token) : Authenticated;
 
+    internal delegate Authenticated Parser(
+        string tokenStr,
+        bool isAuthenticated,
+        ApplicationMetadata appMetadata,
+        Func<string?> getSelectedParty,
+        Func<int, Task<UserProfile?>> getUserProfile,
+        Func<int, Task<Party?>> lookupUserParty,
+        Func<string, Task<Party>> lookupOrgParty,
+        Func<int, Task<List<Party>?>> getPartyList,
+        Func<int, int, Task<bool?>> validateSelectedParty
+    );
+
     internal static Authenticated FromLocalTest(
         string tokenStr,
+        bool isAuthenticated,
         ApplicationMetadata appMetadata,
         Func<string?> getSelectedParty,
         Func<int, Task<UserProfile?>> getUserProfile,
@@ -607,7 +620,7 @@ internal static Authenticated FromLocalTest(
     {
         var context = new ParseContext(
             tokenStr,
-            !string.IsNullOrWhiteSpace(tokenStr),
+            isAuthenticated,
             appMetadata,
             getSelectedParty,
             getUserProfile,
@@ -622,14 +635,15 @@ internal static Authenticated FromLocalTest(
         var handler = new JwtSecurityTokenHandler();
         var token = handler.ReadJwtToken(tokenStr);
 
-        context.TokenIssuer = TokenIssuer.Altinn;
-        context.IsExchanged = true;
-
         context.ReadClaims(token);
 
+        context.TokenIssuer = context.OrgNoClaim.Exists ? TokenIssuer.Maskinporten : TokenIssuer.Altinn;
+        context.IsExchanged =
+            context.TokenIssuer == TokenIssuer.Maskinporten || context.TokenIssuer == TokenIssuer.IDporten;
         context.Scopes = context.ScopeClaim.IsValidString(out var scopeClaimValue)
             ? new Scopes(scopeClaimValue)
             : new Scopes(null);
+        context.IsInAltinnPortal = context.UserIdClaim.Exists;
 
         int? partyId = null;
         if (context.PartyIdClaim.Exists)
@@ -709,6 +723,7 @@ internal record struct ParseContext(
     )
     {
         public TokenClaim IssuerClaim = default;
+        public TokenClaim ActualIssuerClaim = default;
         public TokenClaim AuthLevelClaim = default;
         public TokenClaim AuthMethodClaim = default;
         public TokenClaim ScopeClaim = default;
@@ -804,6 +819,7 @@ public void ReadClaims(JwtSecurityToken token)
             foreach (var claim in token.Payload)
             {
                 TryAssign(claim, JwtClaimTypes.Issuer, ref IssuerClaim);
+                TryAssign(claim, "actual_iss", ref ActualIssuerClaim);
                 TryAssign(claim, AltinnCoreClaimTypes.AuthenticationLevel, ref AuthLevelClaim);
                 TryAssign(claim, AltinnCoreClaimTypes.AuthenticateMethod, ref AuthMethodClaim);
                 TryAssign(claim, JwtClaimTypes.Scope, ref ScopeClaim);
@@ -867,7 +883,13 @@ internal static Authenticated From(
         context.Scopes = context.ScopeClaim.IsValidString(out var scopeClaimValue)
             ? new Scopes(scopeClaimValue)
             : new Scopes(null);
-        context.IsInAltinnPortal = context.Scopes.HasScope("altinn:portal/enduser");
+        context.IsInAltinnPortal =
+            context.Scopes.HasScope("altinn:portal/enduser")
+            || (
+                context.ActualIssuerClaim.IsValidString(out var actualIssuer)
+                && actualIssuer == "altinn-test-tools"
+                && context.UserIdClaim.Exists
+            );
 
         context.ResolveIssuer();
 
@@ -918,12 +940,13 @@ static Authenticated NewUser(ref ParseContext context)
     {
         if (!context.UserIdClaim.Exists)
             throw new AuthenticationContextException("Missing user ID claim for user token");
-        if (!context.UserIdClaim.IsValidString(out var userIdStr))
+
+        if (!context.UserIdClaim.IsValidInt(out var userId))
+        {
             throw new AuthenticationContextException(
                 $"Invalid user ID claim value for user token: {context.UserIdClaim.Value}"
             );
-        if (!int.TryParse(userIdStr, CultureInfo.InvariantCulture, out var userId))
-            throw new AuthenticationContextException($"Invalid user ID claim value for user token: {userIdStr}");
+        }
 
         if (!context.PartyIdClaim.Exists)
             throw new AuthenticationContextException("Missing party ID for user token");
@@ -941,7 +964,13 @@ static Authenticated NewUser(ref ParseContext context)
             if (!context.UsernameClaim.IsValidString(out var usernameClaimValue))
                 throw new AuthenticationContextException("Missing username claim for self-identified user token");
 
-            return new SelfIdentifiedUser(usernameClaimValue, userId, partyId.Value, authMethodClaimValue, ref context);
+            return new SelfIdentifiedUser(
+                usernameClaimValue,
+                userId.Value,
+                partyId.Value,
+                authMethodClaimValue,
+                ref context
+            );
         }
 
         int selectedPartyId = partyId.Value;
@@ -953,7 +982,7 @@ static Authenticated NewUser(ref ParseContext context)
             selectedPartyId = selectedParty;
         }
 
-        return new User(userId, partyId.Value, authLevel, authMethodClaimValue, selectedPartyId, ref context);
+        return new User(userId.Value, partyId.Value, authLevel, authMethodClaimValue, selectedPartyId, ref context);
     }
 
     static Org NewOrg(ref ParseContext context)
@@ -971,17 +1000,7 @@ static SystemUser NewSystemUser(ref ParseContext context)
     {
         if (!context.AuthorizationDetailsClaim.IsJson(out var json))
             throw new AuthenticationContextException($"Invalid authorization details claim value for token: {json}");
-        var authorizationDetails = json.Value.ValueKind switch
-        {
-            JsonValueKind.Object => JsonSerializer.Deserialize<AuthorizationDetailsClaim>(json.Value),
-            JsonValueKind.Array when json.Value.GetArrayLength() == 1 => JsonSerializer
-                .Deserialize<AuthorizationDetailsClaim[]>(json.Value)
-                ?[0],
-            _ => throw new AuthenticationContextException(
-                "Invalid authorization details claim value for systemuser token: "
-                    + context.AuthorizationDetailsClaim.Value
-            ),
-        };
+        var authorizationDetails = AuthorizationDetailsClaim.Parse(json.Value);
         if (authorizationDetails is null)
             throw new AuthenticationContextException("Invalid authorization details claim value for systemuser token");
         if (authorizationDetails is not SystemUserAuthorizationDetailsClaim systemUser)
@@ -1061,10 +1080,25 @@ public bool IsValidInt([NotNullWhen(true)] out int? integer)
         {
             integer = null;
 
-            if (Type is not null && Value is int intValue)
+            if (Type is not null)
             {
-                integer = intValue;
-                return true;
+                if (Value is int intValue)
+                {
+                    integer = intValue;
+                    return true;
+                }
+                // We parse tokens from various different sources:
+                // * altinn-authentication
+                // * localtest
+                // * AltinnTesTools
+                // * TestAuthentication (this repo)
+                // All of them have slight differences in how values encoded in the JWT payload,
+                // so that's why we are flexible here...
+                if (Value is string strValue && int.TryParse(strValue, CultureInfo.InvariantCulture, out intValue))
+                {
+                    integer = intValue;
+                    return true;
+                }
             }
 
             return false;
@@ -1086,7 +1120,22 @@ public bool IsJson([NotNullWhen(true)] out JsonElement? json)
 
     [JsonPolymorphic(TypeDiscriminatorPropertyName = "type")]
     [JsonDerivedType(typeof(SystemUserAuthorizationDetailsClaim), typeDiscriminator: "urn:altinn:systemuser")]
-    internal record AuthorizationDetailsClaim();
+    internal record AuthorizationDetailsClaim()
+    {
+        public static AuthorizationDetailsClaim? Parse(JsonElement json)
+        {
+            return json.ValueKind switch
+            {
+                JsonValueKind.Object => JsonSerializer.Deserialize<AuthorizationDetailsClaim>(json),
+                JsonValueKind.Array when json.GetArrayLength() == 1 => JsonSerializer
+                    .Deserialize<AuthorizationDetailsClaim[]>(json)
+                    ?[0],
+                _ => throw new AuthenticationContextException(
+                    "Invalid authorization details claim value for systemuser token: " + json
+                ),
+            };
+        }
+    }
 
     internal sealed record SystemUserAuthorizationDetailsClaim(
         [property: JsonPropertyName("systemuser_id")] IReadOnlyList<Guid> SystemUserId,
diff --git a/src/Altinn.App.Core/Features/Auth/AuthenticationContext.cs b/src/Altinn.App.Core/Features/Auth/AuthenticationContext.cs
index 646933995..8fcac44a2 100644
--- a/src/Altinn.App.Core/Features/Auth/AuthenticationContext.cs
+++ b/src/Altinn.App.Core/Features/Auth/AuthenticationContext.cs
@@ -69,6 +69,7 @@ public Authenticated Current
                 {
                     authInfo = Authenticated.FromLocalTest(
                         tokenStr: token,
+                        isAuthenticated: true,
                         _appConfigurationCache.ApplicationMetadata,
                         () => _httpContext.Request.Cookies[_generalSettings.CurrentValue.GetAltinnPartyCookieName],
                         _profileClient.GetUserProfile,
diff --git a/test/Altinn.App.Core.Tests/Features/Auth/AuthenticatedTests.Can_Parse_Real_Tokens_type=Org_yeqB.verified.txt b/test/Altinn.App.Core.Tests/Features/Auth/AuthenticatedTests.Can_Parse_Real_Tokens_type=Org_yeqB.verified.txt
new file mode 100644
index 000000000..3c2371def
--- /dev/null
+++ b/test/Altinn.App.Core.Tests/Features/Auth/AuthenticatedTests.Can_Parse_Real_Tokens_type=Org_yeqB.verified.txt
@@ -0,0 +1,40 @@
+﻿{
+  Description: Maskinporten exchanged org token (not service owner),
+  AuthType: Altinn.App.Core.Features.Auth.Authenticated+Org,
+  Auth: {
+    OrgNo: 991825827,
+    AuthenticationLevel: 3,
+    AuthenticationMethod: maskinporten,
+    TokenIssuer: Maskinporten,
+    TokenIsExchanged: true,
+    Scopes: altinn:instances.read altinn:instances.write,
+    Token: eyJhbGciOiJSUzI1NiIsImtpZCI6IkQ4RDg2N0M3RDUyMTM2MEY0RjM1Q0Q1MTU4MEM0OUEwNTE2NUQ0RTEiLCJ4NXQiOiIyTmhueDlVaE5nOVBOYzFSV0F4Sm9GRmwxT0UiLCJ0eXAiOiJKV1QifQ.eyJzY29wZSI6ImFsdGlubjppbnN0YW5jZXMucmVhZCBhbHRpbm46aW5zdGFuY2VzLndyaXRlIiwidG9rZW5fdHlwZSI6IkJlYXJlciIsImV4cCI6MTczNzg0NDE1NywiaWF0IjoxNzM3ODQyMzU3LCJjbGllbnRfaWQiOiIwNDRmNTA0MC01NGUzLTRhMjctYTIyMS1hODUxNGZkMzBjYTkiLCJjb25zdW1lciI6eyJhdXRob3JpdHkiOiJpc282NTIzLWFjdG9yaWQtdXBpcyIsIklEIjoiMDE5Mjo5OTE4MjU4MjcifSwidXJuOmFsdGlubjpvcmdOdW1iZXIiOiI5OTE4MjU4MjciLCJ1cm46YWx0aW5uOmF1dGhlbnRpY2F0ZW1ldGhvZCI6Im1hc2tpbnBvcnRlbiIsInVybjphbHRpbm46YXV0aGxldmVsIjozLCJpc3MiOiJodHRwczovL3BsYXRmb3JtLnR0MDIuYWx0aW5uLm5vL2F1dGhlbnRpY2F0aW9uL2FwaS92MS9vcGVuaWQvIiwianRpIjoiMzUwYWNhOTYtYjNkZi00YTdmLTg4YWItOWY4ZDc4ZDYxMjI0IiwibmJmIjoxNzM3ODQyMzU3fQ.g6EFkX6pAKtA64p11CpoTDU6Nzzst4duOzBletMAexEmX-V5C4rXsndkwK3pL9JpZNBbjBZZaEAbBta177PIQo208dZwzYV2meLrip5fQ-hnWF3Ub0VdpxcgggDbcx8WqT1HSix-GQlNcSe2uyZB0KZ_8GRB2aKXjatX4R392A3CZfzBq8Dt3ra5AP0pWVxJAd4NuKHPQRKGbNWkC62J92zLYYtTz4j8DS9yogeP28hrcLzuqyVScDndmOiIjeexXXWdgrwVLDBO2mpVU_i4xqRUbjK9UdySrrkYfv-ZIZQRoZsyPE3ab0SDym-4kVxSIp4xyH3nQuzZJqz24LuBcw
+  },
+  Jwt: {
+    client_id: 044f5040-54e3-4a27-a221-a8514fd30ca9,
+    consumer: {
+      ValueKind: Object
+    },
+    exp: 1737844157,
+    iat: 1737842357,
+    iss: https://platform.tt02.altinn.no/authentication/api/v1/openid/,
+    jti: 350aca96-b3df-4a7f-88ab-9f8d78d61224,
+    nbf: 1737842357,
+    scope: altinn:instances.read altinn:instances.write,
+    token_type: Bearer,
+    urn:altinn:authenticatemethod: maskinporten,
+    urn:altinn:authlevel: 3,
+    urn:altinn:orgNumber: 991825827
+  },
+  Details: {
+    Party: {
+      PartyId: 1234,
+      PartyTypeName: Organisation,
+      OrgNumber: 991825827,
+      Name: Test AS,
+      IsDeleted: false,
+      OnlyHierarchyElementWithNoAccess: false
+    },
+    CanInstantiate: true
+  }
+}
\ No newline at end of file
diff --git a/test/Altinn.App.Core.Tests/Features/Auth/AuthenticatedTests.Can_Parse_Real_Tokens_type=SelfIdentifiedUser_ffv+.verified.txt b/test/Altinn.App.Core.Tests/Features/Auth/AuthenticatedTests.Can_Parse_Real_Tokens_type=SelfIdentifiedUser_ffv+.verified.txt
new file mode 100644
index 000000000..63efd1a90
--- /dev/null
+++ b/test/Altinn.App.Core.Tests/Features/Auth/AuthenticatedTests.Can_Parse_Real_Tokens_type=SelfIdentifiedUser_ffv+.verified.txt
@@ -0,0 +1,52 @@
+﻿{
+  Description: Altinn portal tt02 self identified, token extracted from AltinnStudioRuntime cookie,
+  AuthType: Altinn.App.Core.Features.Auth.Authenticated+SelfIdentifiedUser,
+  Auth: {
+    Username: martinothamar,
+    UserId: 1428813,
+    PartyId: 53328660,
+    AuthenticationMethod: SelfIdentified,
+    TokenIssuer: Altinn,
+    TokenIsExchanged: false,
+    Scopes: altinn:portal/enduser,
+    Token: eyJhbGciOiJSUzI1NiIsImtpZCI6IkQ4RDg2N0M3RDUyMTM2MEY0RjM1Q0Q1MTU4MEM0OUEwNTE2NUQ0RTEiLCJ4NXQiOiIyTmhueDlVaE5nOVBOYzFSV0F4Sm9GRmwxT0UiLCJ0eXAiOiJKV1QifQ.eyJuYW1laWQiOiIxNDI4ODEzIiwidXJuOmFsdGlubjp1c2VyaWQiOiIxNDI4ODEzIiwidXJuOmFsdGlubjp1c2VybmFtZSI6Im1hcnRpbm90aGFtYXIiLCJ1cm46YWx0aW5uOnBhcnR5aWQiOjUzMzI4NjYwLCJ1cm46YWx0aW5uOmF1dGhlbnRpY2F0ZW1ldGhvZCI6IlNlbGZJZGVudGlmaWVkIiwidXJuOmFsdGlubjphdXRobGV2ZWwiOjAsImp0aSI6Ijg3OGFkMDZiLWE0Y2EtNDFhZi04YjQzLWY3NTE2Mzk3Yzc3NyIsInNjb3BlIjoiYWx0aW5uOnBvcnRhbC9lbmR1c2VyIiwibmJmIjoxNzM3ODE1NjU0LCJleHAiOjE3Mzc4MTc0NTQsImlhdCI6MTczNzgxNTY1NH0.RLnlBcd_mfgixYkZcePG09iMsAk2XM25FdifashYcLEtebutWEub89GZyFHus7oLbCj_yDiyE1Rilpi3qBxUo9wVPH20ZsmFK5XX1jq7K_wzTsQGYlXPkjROyuXObOW1vuPZL973PEuSsFSc0MX38RfpHlOx7QZHx8gxOES3LwLFqCpdSCmTvsbPXmpHu4SKUb0BcaUFH3flexgbry4hixQbO65v6cQP7Od3A-5tTLCtPsBzCRY3u4EqbCVSJvXAj5x0PEYe-rKgQmY6nQl_dPfCre3uksPlKQeWtdDrmR1YiFfvKfg1DD_Fcf9wjeVGavyRh4qYhFV_7jueueGoqQ
+  },
+  Jwt: {
+    exp: 1737817454,
+    iat: 1737815654,
+    jti: 878ad06b-a4ca-41af-8b43-f7516397c777,
+    nameid: 1428813,
+    nbf: 1737815654,
+    scope: altinn:portal/enduser,
+    urn:altinn:authenticatemethod: SelfIdentified,
+    urn:altinn:authlevel: 0,
+    urn:altinn:partyid: 53328660,
+    urn:altinn:userid: 1428813,
+    urn:altinn:username: martinothamar
+  },
+  Details: {
+    Party: {
+      PartyId: 53328660,
+      PartyTypeName: Person,
+      SSN: 12345678901,
+      Name: Test Testesen,
+      IsDeleted: false,
+      OnlyHierarchyElementWithNoAccess: false
+    },
+    Profile: {
+      UserId: 1428813,
+      IsReserved: false,
+      PartyId: 53328660,
+      Party: {
+        PartyId: 53328660,
+        PartyTypeName: Person,
+        SSN: 12345678901,
+        Name: Test Testesen,
+        IsDeleted: false,
+        OnlyHierarchyElementWithNoAccess: false
+      }
+    },
+    RepresentsSelf: true,
+    CanInstantiate: true
+  }
+}
\ No newline at end of file
diff --git a/test/Altinn.App.Core.Tests/Features/Auth/AuthenticatedTests.Can_Parse_Real_Tokens_type=ServiceOwner_AmaP.verified.txt b/test/Altinn.App.Core.Tests/Features/Auth/AuthenticatedTests.Can_Parse_Real_Tokens_type=ServiceOwner_AmaP.verified.txt
new file mode 100644
index 000000000..cf0fe1409
--- /dev/null
+++ b/test/Altinn.App.Core.Tests/Features/Auth/AuthenticatedTests.Can_Parse_Real_Tokens_type=ServiceOwner_AmaP.verified.txt
@@ -0,0 +1,32 @@
+﻿{
+  Description: GetTestOrgToken in localtest,
+  AuthType: Altinn.App.Core.Features.Auth.Authenticated+ServiceOwner,
+  Auth: {
+    Name: skd,
+    OrgNo: 974761076,
+    AuthenticationLevel: 3,
+    AuthenticationMethod: localtest,
+    TokenIssuer: Maskinporten,
+    TokenIsExchanged: true,
+    Token: eyJhbGciOiJSUzI1NiIsImtpZCI6IjQ4Q0VFNjAzMzEwMkYzMjQzMTk2NDc4QUYwNkZCNDNBMTc2NEQ4NDMiLCJ4NXQiOiJTTTdtQXpFQzh5UXhsa2VLOEctME9oZGsyRU0iLCJ0eXAiOiJKV1QifQ.eyJ1cm46YWx0aW5uOm9yZyI6InNrZCIsInVybjphbHRpbm46YXV0aGxldmVsIjozLCJ1cm46YWx0aW5uOnNjb3BlIjoiYWx0aW5uOnNlcnZpY2Vvd25lci9pbnN0YW5jZXMud3JpdGUgYWx0aW5uOnNlcnZpY2Vvd25lci9pbnN0YW5jZXMucmVhZCIsInVybjphbHRpbm46b3JnTnVtYmVyIjoiOTc0NzYxMDc2IiwibmJmIjoxNzQyOTA2NDYyLCJleHAiOjE3NDI5NjQwNjIsImlhdCI6MTc0MjkwNjQ2Mn0.UJSqOGZG3xCMH7KUx148NhPvARATpI2yzK4RxxL_Fe2XqtEaRJQX6IBMTbfu-WLdHZ8l4m7Epk7cJwxE1ek3BP1XMayq95rrNIwjcXoicDBfLUb7Ug2II89jKd-pCinuZGT8ai4LmKz8ydPAXgq6fV1ExctsqcTQhQIbgDYa9TFVKInpmv3Mj9f7vdiJKdfuxE_rHOzu8cqUVECLvK4AU602pnw9JvclAXa53hBkDlHmNv8-JzVUdqkEMBiPrWklWDZqHNZuVkKrrvS_5-dS9Z6rjZ9IcnMZ2fSRNoTHO85qtVqGzTzLsN0QjRXOYGk_mZVD4LVjOp7JBDuWqcpefQ
+  },
+  Jwt: {
+    exp: 1742964062,
+    iat: 1742906462,
+    nbf: 1742906462,
+    urn:altinn:authlevel: 3,
+    urn:altinn:org: skd,
+    urn:altinn:orgNumber: 974761076,
+    urn:altinn:scope: altinn:serviceowner/instances.write altinn:serviceowner/instances.read
+  },
+  Details: {
+    Party: {
+      PartyId: 1234,
+      PartyTypeName: Organisation,
+      OrgNumber: 974761076,
+      Name: Test AS,
+      IsDeleted: false,
+      OnlyHierarchyElementWithNoAccess: false
+    }
+  }
+}
\ No newline at end of file
diff --git a/test/Altinn.App.Core.Tests/Features/Auth/AuthenticatedTests.Can_Parse_Real_Tokens_type=ServiceOwner_IrMn.verified.txt b/test/Altinn.App.Core.Tests/Features/Auth/AuthenticatedTests.Can_Parse_Real_Tokens_type=ServiceOwner_IrMn.verified.txt
new file mode 100644
index 000000000..e239e1667
--- /dev/null
+++ b/test/Altinn.App.Core.Tests/Features/Auth/AuthenticatedTests.Can_Parse_Real_Tokens_type=ServiceOwner_IrMn.verified.txt
@@ -0,0 +1,42 @@
+﻿{
+  Description: Altinn-Test-Tools GetEnterpriseToken,
+  AuthType: Altinn.App.Core.Features.Auth.Authenticated+ServiceOwner,
+  Auth: {
+    Name: digdir,
+    OrgNo: 991825827,
+    AuthenticationLevel: 3,
+    AuthenticationMethod: maskinporten,
+    TokenIssuer: Maskinporten,
+    TokenIsExchanged: true,
+    Scopes: altinn:serviceowner/instances.read altinn:serviceowner/instances.write,
+    Token: eyJhbGciOiJSUzI1NiIsImtpZCI6IkQ4RDg2N0M3RDUyMTM2MEY0RjM1Q0Q1MTU4MEM0OUEwNTE2NUQ0RTEiLCJ0eXAiOiJKV1QiLCJ4NWMiOiJEOEQ4NjdDN0Q1MjEzNjBGNEYzNUNENTE1ODBDNDlBMDUxNjVENEUxIn0.eyJzY29wZSI6ImFsdGlubjpzZXJ2aWNlb3duZXIvaW5zdGFuY2VzLnJlYWQgYWx0aW5uOnNlcnZpY2Vvd25lci9pbnN0YW5jZXMud3JpdGUiLCJ0b2tlbl90eXBlIjoiQmVhcmVyIiwiZXhwIjoxNzQyOTA5NDk3LCJpYXQiOjE3NDI5MDc2OTcsImNsaWVudF9pZCI6Ijc0M2U5MGZkLTAyMDItNDM5ZC05MzYwLTViYmZiOGU5MGYzYiIsImp0aSI6IkJIWTFzTXAxZGdCeEdOWDBjczdvUWNBdG1wVUlDdTlzY3A1dUFIY0F3T2YiLCJjb25zdW1lciI6eyJhdXRob3JpdHkiOiJpc282NTIzLWFjdG9yaWQtdXBpcyIsIklEIjoiMDE5Mjo5OTE4MjU4MjcifSwidXJuOmFsdGlubjpvcmdOdW1iZXIiOiI5OTE4MjU4MjciLCJ1cm46YWx0aW5uOmF1dGhlbnRpY2F0ZW1ldGhvZCI6Im1hc2tpbnBvcnRlbiIsInVybjphbHRpbm46YXV0aGxldmVsIjozLCJpc3MiOiJodHRwczovL3BsYXRmb3JtLnR0MDIuYWx0aW5uLm5vL2F1dGhlbnRpY2F0aW9uL2FwaS92MS9vcGVuaWQvIiwiYWN0dWFsX2lzcyI6ImFsdGlubi10ZXN0LXRvb2xzIiwibmJmIjoxNzQyOTA3Njk3LCJ1cm46YWx0aW5uOm9yZyI6ImRpZ2RpciJ9.YOX4cViSE1KG_sf3alCkR-aXDOJu1R850OS6fBBu7HYDitTa9DO4aoISeu42NzAjxMcpBee1r3wsg2n13cdAOs_Ab2BH385u_1EN-afXZURx9OjMr2SyWfDvVIEYGatiqpNB7pFf1zek8dJYRQfo3aenfOGuJTszHK0HAY_S7U2_ziMdXMWTUKlChel_lsGb40kUuTHLcUHwl5b10efU4dv-QZsj1PM_QHYDLikd6mCxS2KbqiAutcpdsv2zNgmh4uwXuntXvFF9X8oK0bkLlX8nNGvcWCsy9oRgLtq2y8cWUoVU89FgFR2NaHaEIdXIUwTCrxFzdIWZjEkMR1RYag
+  },
+  Jwt: {
+    actual_iss: altinn-test-tools,
+    client_id: 743e90fd-0202-439d-9360-5bbfb8e90f3b,
+    consumer: {
+      ValueKind: Object
+    },
+    exp: 1742909497,
+    iat: 1742907697,
+    iss: https://platform.tt02.altinn.no/authentication/api/v1/openid/,
+    jti: BHY1sMp1dgBxGNX0cs7oQcAtmpUICu9scp5uAHcAwOf,
+    nbf: 1742907697,
+    scope: altinn:serviceowner/instances.read altinn:serviceowner/instances.write,
+    token_type: Bearer,
+    urn:altinn:authenticatemethod: maskinporten,
+    urn:altinn:authlevel: 3,
+    urn:altinn:org: digdir,
+    urn:altinn:orgNumber: 991825827
+  },
+  Details: {
+    Party: {
+      PartyId: 1234,
+      PartyTypeName: Organisation,
+      OrgNumber: 991825827,
+      Name: Test AS,
+      IsDeleted: false,
+      OnlyHierarchyElementWithNoAccess: false
+    }
+  }
+}
\ No newline at end of file
diff --git a/test/Altinn.App.Core.Tests/Features/Auth/AuthenticatedTests.Can_Parse_Real_Tokens_type=ServiceOwner_eWOI.verified.txt b/test/Altinn.App.Core.Tests/Features/Auth/AuthenticatedTests.Can_Parse_Real_Tokens_type=ServiceOwner_eWOI.verified.txt
new file mode 100644
index 000000000..f9e0fdc36
--- /dev/null
+++ b/test/Altinn.App.Core.Tests/Features/Auth/AuthenticatedTests.Can_Parse_Real_Tokens_type=ServiceOwner_eWOI.verified.txt
@@ -0,0 +1,41 @@
+﻿{
+  Description: Maskinporten exchanged service owner token,
+  AuthType: Altinn.App.Core.Features.Auth.Authenticated+ServiceOwner,
+  Auth: {
+    Name: digdir,
+    OrgNo: 991825827,
+    AuthenticationLevel: 3,
+    AuthenticationMethod: maskinporten,
+    TokenIssuer: Maskinporten,
+    TokenIsExchanged: true,
+    Scopes: altinn:serviceowner/instances.write altinn:serviceowner/instances.read,
+    Token: eyJhbGciOiJSUzI1NiIsImtpZCI6IkQ4RDg2N0M3RDUyMTM2MEY0RjM1Q0Q1MTU4MEM0OUEwNTE2NUQ0RTEiLCJ4NXQiOiIyTmhueDlVaE5nOVBOYzFSV0F4Sm9GRmwxT0UiLCJ0eXAiOiJKV1QifQ.eyJzY29wZSI6ImFsdGlubjpzZXJ2aWNlb3duZXIvaW5zdGFuY2VzLndyaXRlIGFsdGlubjpzZXJ2aWNlb3duZXIvaW5zdGFuY2VzLnJlYWQiLCJ0b2tlbl90eXBlIjoiQmVhcmVyIiwiZXhwIjoxNzM3ODE5Mzc2LCJpYXQiOjE3Mzc4MTc1NzYsImNsaWVudF9pZCI6IjA0NGY1MDQwLTU0ZTMtNGEyNy1hMjIxLWE4NTE0ZmQzMGNhOSIsImNvbnN1bWVyIjp7ImF1dGhvcml0eSI6ImlzbzY1MjMtYWN0b3JpZC11cGlzIiwiSUQiOiIwMTkyOjk5MTgyNTgyNyJ9LCJ1cm46YWx0aW5uOm9yZyI6ImRpZ2RpciIsInVybjphbHRpbm46b3JnTnVtYmVyIjoiOTkxODI1ODI3IiwidXJuOmFsdGlubjphdXRoZW50aWNhdGVtZXRob2QiOiJtYXNraW5wb3J0ZW4iLCJ1cm46YWx0aW5uOmF1dGhsZXZlbCI6MywiaXNzIjoiaHR0cHM6Ly9wbGF0Zm9ybS50dDAyLmFsdGlubi5uby9hdXRoZW50aWNhdGlvbi9hcGkvdjEvb3BlbmlkLyIsImp0aSI6IjFmN2RlMDFhLTgyYjMtNDc3Yi04MmQzLTBiY2I5NDkzOGVjNyIsIm5iZiI6MTczNzgxNzU3Nn0.G9uZ_YK2IxUgv8ySP3zy_IG0kOO3qJtEqHPds2f3jh1_YHcQlHEnQXUecUR-xD-Qi8qtI_GEJizA3l-zXc9DLkxgv4HVamzBrOcm9aQWqd3s8_OuI1nF4WjWrcw5FHpaXl1DqbgqPQI8rxOJhmW-H4rE944TKHLwvBlsX-9brYU_CC1WfnymFwODKsGhT1hm5ljQeV6O6j0GkNsRANiQlUnIMJcMVQEBtcuHGBLeNq-u5JSXzs17GLB371IN9Jb8IoYKu7njW3-Pat-QWebDYT9jdMQHOYslr0WByTvlnhL6Z7aQ8KbllbNw3GoYOvCBphVVpmk7aaqcchUiBh30-g
+  },
+  Jwt: {
+    client_id: 044f5040-54e3-4a27-a221-a8514fd30ca9,
+    consumer: {
+      ValueKind: Object
+    },
+    exp: 1737819376,
+    iat: 1737817576,
+    iss: https://platform.tt02.altinn.no/authentication/api/v1/openid/,
+    jti: 1f7de01a-82b3-477b-82d3-0bcb94938ec7,
+    nbf: 1737817576,
+    scope: altinn:serviceowner/instances.write altinn:serviceowner/instances.read,
+    token_type: Bearer,
+    urn:altinn:authenticatemethod: maskinporten,
+    urn:altinn:authlevel: 3,
+    urn:altinn:org: digdir,
+    urn:altinn:orgNumber: 991825827
+  },
+  Details: {
+    Party: {
+      PartyId: 1234,
+      PartyTypeName: Organisation,
+      OrgNumber: 991825827,
+      Name: Test AS,
+      IsDeleted: false,
+      OnlyHierarchyElementWithNoAccess: false
+    }
+  }
+}
\ No newline at end of file
diff --git a/test/Altinn.App.Core.Tests/Features/Auth/AuthenticatedTests.Can_Parse_Real_Tokens_type=SystemUser_8nGc.verified.txt b/test/Altinn.App.Core.Tests/Features/Auth/AuthenticatedTests.Can_Parse_Real_Tokens_type=SystemUser_8nGc.verified.txt
new file mode 100644
index 000000000..0c5e710f4
--- /dev/null
+++ b/test/Altinn.App.Core.Tests/Features/Auth/AuthenticatedTests.Can_Parse_Real_Tokens_type=SystemUser_8nGc.verified.txt
@@ -0,0 +1,47 @@
+﻿{
+  Description: GetTestSystemUserToken in localtest,
+  AuthType: Altinn.App.Core.Features.Auth.Authenticated+SystemUser,
+  Auth: {
+    SystemUserId: [
+      d111dbab-d619-4f15-bf29-58fe570a9ae6
+    ],
+    SystemUserOrgNr: 0192:950474084,
+    SupplierOrgNr: 0192:913312465,
+    SystemId: 913312465_sbs,
+    AuthenticationLevel: 3,
+    AuthenticationMethod: maskinporten,
+    TokenIssuer: Maskinporten,
+    TokenIsExchanged: true,
+    Scopes: altinn:instances.read altinn:instances.write,
+    Token: eyJhbGciOiJSUzI1NiIsImtpZCI6IjQ4Q0VFNjAzMzEwMkYzMjQzMTk2NDc4QUYwNkZCNDNBMTc2NEQ4NDMiLCJ4NXQiOiJTTTdtQXpFQzh5UXhsa2VLOEctME9oZGsyRU0iLCJ0eXAiOiJKV1QifQ.eyJ0b2tlbl90eXBlIjoiQmVhcmVyIiwic2NvcGUiOiJhbHRpbm46aW5zdGFuY2VzLnJlYWQgYWx0aW5uOmluc3RhbmNlcy53cml0ZSIsImNsaWVudF9pZCI6Ijc2Yzg2NTE1LTkwN2ItNDZkYy1iNGYwLWZhMDc4MzRjYTY0MiIsImp0aSI6IjIzYjA4MTkzLTU5NWUtNDFhYS1iODUyLTlmNzAwZTA0MjhjMiIsInVybjphbHRpbm46b3JnTnVtYmVyIjoiOTEzMzEyNDY1IiwidXJuOmFsdGlubjphdXRoZW50aWNhdGVtZXRob2QiOiJtYXNraW5wb3J0ZW4iLCJ1cm46YWx0aW5uOmF1dGhsZXZlbCI6IjMiLCJhdXRob3JpemF0aW9uX2RldGFpbHMiOnsidHlwZSI6InVybjphbHRpbm46c3lzdGVtdXNlciIsInN5c3RlbXVzZXJfaWQiOlsiZDExMWRiYWItZDYxOS00ZjE1LWJmMjktNThmZTU3MGE5YWU2Il0sInN5c3RlbV9pZCI6IjkxMzMxMjQ2NV9zYnMiLCJzeXN0ZW11c2VyX29yZyI6eyJhdXRob3JpdHkiOiJpc282NTIzLWFjdG9yaWQtdXBpcyIsIklEIjoiMDE5Mjo5NTA0NzQwODQifX0sImNvbnN1bWVyIjp7ImF1dGhvcml0eSI6ImlzbzY1MjMtYWN0b3JpZC11cGlzIiwiSUQiOiIwMTkyOjkxMzMxMjQ2NSJ9LCJleHAiOjE3NDI5NjQ0NTQsImlhdCI6MTc0MjkwNjg1NCwibmJmIjoxNzQyOTA2ODU0fQ.nzWAs4U0u1L6m8xVlzX1S0cN45H690Aix2V4HIbqSPr5_m8fcE2FeZ3X1CP7WHk1L5VLjfJH0VRr5ODW_V_Xce2t0Q_64KpDauelDENRIrR9f4LwZHtPu0y6xMOjE3GBd901deiqqBizeVLKXRrme9e-CWifGAVAdgxFBBr7SHxAkC6WKCATfrISlKf8JAWHCkzy_UmPNGmJ3aIG0INYk8UXIJL7DJAQl5yO5hJOY4OCo9TSGT8MicNRQXZC-Naok8NnSctDWX-1MFi98-04SknvjElHbh2pZy-8b4RW-T_RCzRSSJog3AzNCHUuABTnWRHpmqudRAb-X9eU7StdeA
+  },
+  Jwt: {
+    authorization_details: {
+      ValueKind: Object
+    },
+    client_id: 76c86515-907b-46dc-b4f0-fa07834ca642,
+    consumer: {
+      ValueKind: Object
+    },
+    exp: 1742964454,
+    iat: 1742906854,
+    jti: 23b08193-595e-41aa-b852-9f700e0428c2,
+    nbf: 1742906854,
+    scope: altinn:instances.read altinn:instances.write,
+    token_type: Bearer,
+    urn:altinn:authenticatemethod: maskinporten,
+    urn:altinn:authlevel: 3,
+    urn:altinn:orgNumber: 913312465
+  },
+  Details: {
+    Party: {
+      PartyId: 1234,
+      PartyTypeName: Organisation,
+      OrgNumber: 950474084,
+      Name: Test AS,
+      IsDeleted: false,
+      OnlyHierarchyElementWithNoAccess: false
+    },
+    CanInstantiate: true
+  }
+}
\ No newline at end of file
diff --git a/test/Altinn.App.Core.Tests/Features/Auth/AuthenticatedTests.Can_Parse_Real_Tokens_type=SystemUser_EvgU.verified.txt b/test/Altinn.App.Core.Tests/Features/Auth/AuthenticatedTests.Can_Parse_Real_Tokens_type=SystemUser_EvgU.verified.txt
new file mode 100644
index 000000000..dba84a7a7
--- /dev/null
+++ b/test/Altinn.App.Core.Tests/Features/Auth/AuthenticatedTests.Can_Parse_Real_Tokens_type=SystemUser_EvgU.verified.txt
@@ -0,0 +1,48 @@
+﻿{
+  Description: Exchanged Maskinporten for systemuser, coming from the smartcloudaltinn.azurewebsites.net/api/maskinporten test endpoint,
+  AuthType: Altinn.App.Core.Features.Auth.Authenticated+SystemUser,
+  Auth: {
+    SystemUserId: [
+      f950ddae-06c3-4b57-b940-702417a90df0
+    ],
+    SystemUserOrgNr: 0192:310702641,
+    SupplierOrgNr: 0192:991825827,
+    SystemId: 991825827_smartcloud,
+    AuthenticationLevel: 3,
+    AuthenticationMethod: maskinporten,
+    TokenIssuer: Maskinporten,
+    TokenIsExchanged: true,
+    Scopes: altinn:systembruker.demo,
+    Token: eyJhbGciOiJSUzI1NiIsImtpZCI6IkQ4RDg2N0M3RDUyMTM2MEY0RjM1Q0Q1MTU4MEM0OUEwNTE2NUQ0RTEiLCJ4NXQiOiIyTmhueDlVaE5nOVBOYzFSV0F4Sm9GRmwxT0UiLCJ0eXAiOiJKV1QifQ.eyJhdXRob3JpemF0aW9uX2RldGFpbHMiOnsidHlwZSI6InVybjphbHRpbm46c3lzdGVtdXNlciIsInN5c3RlbXVzZXJfb3JnIjp7ImF1dGhvcml0eSI6ImlzbzY1MjMtYWN0b3JpZC11cGlzIiwiSUQiOiIwMTkyOjMxMDcwMjY0MSJ9LCJzeXN0ZW11c2VyX2lkIjpbImY5NTBkZGFlLTA2YzMtNGI1Ny1iOTQwLTcwMjQxN2E5MGRmMCJdLCJzeXN0ZW1faWQiOiI5OTE4MjU4Mjdfc21hcnRjbG91ZCIsImV4dGVybmFsUmVmIjoiZWQxYzM4ZjQtZjUyOC00ZWYxLTg2NTItYjFhZWI4NTYzZGZlIn0sInNjb3BlIjoiYWx0aW5uOnN5c3RlbWJydWtlci5kZW1vIiwidG9rZW5fdHlwZSI6IkJlYXJlciIsImV4cCI6MTczNzgxNTEyMCwiaWF0IjoxNzM3ODEzMzIwLCJjbGllbnRfaWQiOiJhMmVkNzEyZC00MTQ0LTQ0NzEtODM5Zi04MGFlNGE2ODE0NmIiLCJjb25zdW1lciI6eyJhdXRob3JpdHkiOiJpc282NTIzLWFjdG9yaWQtdXBpcyIsIklEIjoiMDE5Mjo5OTE4MjU4MjcifSwidXJuOmFsdGlubjpvcmdOdW1iZXIiOiI5OTE4MjU4MjciLCJ1cm46YWx0aW5uOmF1dGhlbnRpY2F0ZW1ldGhvZCI6Im1hc2tpbnBvcnRlbiIsInVybjphbHRpbm46YXV0aGxldmVsIjozLCJpc3MiOiJodHRwczovL3BsYXRmb3JtLnR0MDIuYWx0aW5uLm5vL2F1dGhlbnRpY2F0aW9uL2FwaS92MS9vcGVuaWQvIiwianRpIjoiMTliNGUyOWItNjRiMi00YTUyLWFlNDAtZTc3Njg1MjMxM2YyIiwibmJmIjoxNzM3ODEzMzIwfQ.m-5x5GscJYjD_rCnd0EWQBKSwymPyN4AE9Yti7bjeUuvAVyiPdtske9fahEGONVUvY9Pk2bDjdNOfAeaOPMHB2skEqMNYGqxxQRgBraZawAPFuQSSufTgkt5dEgOAymUam2x9NQ_giFPPtaWHez23rtDGSGAXkMaIBWe93XbO-z_4dFcyDEXvmK4SfkLeJWxizhugVcwwDstYrN7VlcQz3gBGuGKIcC8lnBPIT8u7tmJKt0JQ2L9oZQkGjatUu-4_qlcfzvDr40ojyNtOszoc1UblNRkTI-QxB2yRuvG9a7wMtej_Xgo9Pst8cz4MfBSxOq-2U_wHX95-d5GTLnFfw
+  },
+  Jwt: {
+    authorization_details: {
+      ValueKind: Object
+    },
+    client_id: a2ed712d-4144-4471-839f-80ae4a68146b,
+    consumer: {
+      ValueKind: Object
+    },
+    exp: 1737815120,
+    iat: 1737813320,
+    iss: https://platform.tt02.altinn.no/authentication/api/v1/openid/,
+    jti: 19b4e29b-64b2-4a52-ae40-e776852313f2,
+    nbf: 1737813320,
+    scope: altinn:systembruker.demo,
+    token_type: Bearer,
+    urn:altinn:authenticatemethod: maskinporten,
+    urn:altinn:authlevel: 3,
+    urn:altinn:orgNumber: 991825827
+  },
+  Details: {
+    Party: {
+      PartyId: 1234,
+      PartyTypeName: Organisation,
+      OrgNumber: 310702641,
+      Name: Test AS,
+      IsDeleted: false,
+      OnlyHierarchyElementWithNoAccess: false
+    },
+    CanInstantiate: true
+  }
+}
\ No newline at end of file
diff --git a/test/Altinn.App.Core.Tests/Features/Auth/AuthenticatedTests.Can_Parse_Real_Tokens_type=SystemUser_Gxg0.verified.txt b/test/Altinn.App.Core.Tests/Features/Auth/AuthenticatedTests.Can_Parse_Real_Tokens_type=SystemUser_Gxg0.verified.txt
new file mode 100644
index 000000000..4883672f4
--- /dev/null
+++ b/test/Altinn.App.Core.Tests/Features/Auth/AuthenticatedTests.Can_Parse_Real_Tokens_type=SystemUser_Gxg0.verified.txt
@@ -0,0 +1,45 @@
+﻿{
+  Description: Maskinporten for systemuser, coming from the smartcloudaltinn.azurewebsites.net/api/maskinporten test endpoint,
+  AuthType: Altinn.App.Core.Features.Auth.Authenticated+SystemUser,
+  Auth: {
+    SystemUserId: [
+      f950ddae-06c3-4b57-b940-702417a90df0
+    ],
+    SystemUserOrgNr: 0192:310702641,
+    SupplierOrgNr: 0192:991825827,
+    SystemId: 991825827_smartcloud,
+    AuthenticationLevel: 3,
+    AuthenticationMethod: maskinporten,
+    TokenIssuer: Maskinporten,
+    TokenIsExchanged: false,
+    Scopes: altinn:systembruker.demo,
+    Token: eyJraWQiOiJiZFhMRVduRGpMSGpwRThPZnl5TUp4UlJLbVo3MUxCOHUxeUREbVBpdVQwIiwiYWxnIjoiUlMyNTYifQ.eyJhdXRob3JpemF0aW9uX2RldGFpbHMiOlt7InR5cGUiOiJ1cm46YWx0aW5uOnN5c3RlbXVzZXIiLCJzeXN0ZW11c2VyX29yZyI6eyJhdXRob3JpdHkiOiJpc282NTIzLWFjdG9yaWQtdXBpcyIsIklEIjoiMDE5MjozMTA3MDI2NDEifSwic3lzdGVtdXNlcl9pZCI6WyJmOTUwZGRhZS0wNmMzLTRiNTctYjk0MC03MDI0MTdhOTBkZjAiXSwic3lzdGVtX2lkIjoiOTkxODI1ODI3X3NtYXJ0Y2xvdWQiLCJleHRlcm5hbFJlZiI6ImVkMWMzOGY0LWY1MjgtNGVmMS04NjUyLWIxYWViODU2M2RmZSJ9XSwic2NvcGUiOiJhbHRpbm46c3lzdGVtYnJ1a2VyLmRlbW8iLCJpc3MiOiJodHRwczovL3Rlc3QubWFza2lucG9ydGVuLm5vLyIsImNsaWVudF9hbXIiOiJwcml2YXRlX2tleV9qd3QiLCJ0b2tlbl90eXBlIjoiQmVhcmVyIiwiZXhwIjoxNzM3ODEzMzk4LCJpYXQiOjE3Mzc4MTMyNzgsImNsaWVudF9pZCI6ImEyZWQ3MTJkLTQxNDQtNDQ3MS04MzlmLTgwYWU0YTY4MTQ2YiIsImp0aSI6InZrWFlhNGxIR2lyOFFpcGVtc1dvdnNUMzdIci10ZExOaTYyODlTajVzU1UiLCJjb25zdW1lciI6eyJhdXRob3JpdHkiOiJpc282NTIzLWFjdG9yaWQtdXBpcyIsIklEIjoiMDE5Mjo5OTE4MjU4MjcifX0.b3JozeLFCBn76a703n1ZqbjqHaFaaCadpZb3T0cuqJvLnELEjiOKXvwSI1kuqnpqfEqxEX1UyBIyJh-rvIOZ-B7dXj1usWoh-oWofvENT0AzJcwpPrhuBBo-ZPoCtTVIJraWBJfYbjEFfajfFZdz0D_poz2i5MbJO9mSn5FMAEMdzmjZSA7O9n8Y02uApN31B3pHlKpqIEUK1HhxGl_z8_rzcAcbs2uOKUxVCK_vnEMk3XpcaEDsk0hr-ohkALshWYVUZCxzl7MzJ2wFhyr9JZqSLSV-dS_WY09cwUA-I1dyIlQE1LW1Ye4Ow5xExArBO8UT3sB-q23EqRY07PC1lh-YdFB1rR1pO6pklnQdz8zPzyrUYYcxlQQDVTRVjRgZcF43TMxQIUmAB0LG6QvP8oRp8SV4oAAK9ZB_fCVkwd8gbVwvVIhuQdPEA6aUoV8mPRPz1IW-eVi-XXEQdkOC8OArNQd92y5DiEQE2puZI1nUmXFwypltks-3Xjam6-_5
+  },
+  Jwt: {
+    authorization_details: {
+      ValueKind: Array
+    },
+    client_amr: private_key_jwt,
+    client_id: a2ed712d-4144-4471-839f-80ae4a68146b,
+    consumer: {
+      ValueKind: Object
+    },
+    exp: 1737813398,
+    iat: 1737813278,
+    iss: https://test.maskinporten.no/,
+    jti: vkXYa4lHGir8QipemsWovsT37Hr-tdLNi6289Sj5sSU,
+    scope: altinn:systembruker.demo,
+    token_type: Bearer
+  },
+  Details: {
+    Party: {
+      PartyId: 1234,
+      PartyTypeName: Organisation,
+      OrgNumber: 310702641,
+      Name: Test AS,
+      IsDeleted: false,
+      OnlyHierarchyElementWithNoAccess: false
+    },
+    CanInstantiate: true
+  }
+}
\ No newline at end of file
diff --git a/test/Altinn.App.Core.Tests/Features/Auth/AuthenticatedTests.Can_Parse_Real_Tokens_type=SystemUser_U6aZ.verified.txt b/test/Altinn.App.Core.Tests/Features/Auth/AuthenticatedTests.Can_Parse_Real_Tokens_type=SystemUser_U6aZ.verified.txt
new file mode 100644
index 000000000..b61d4b1d6
--- /dev/null
+++ b/test/Altinn.App.Core.Tests/Features/Auth/AuthenticatedTests.Can_Parse_Real_Tokens_type=SystemUser_U6aZ.verified.txt
@@ -0,0 +1,48 @@
+﻿{
+  Description: Altinn-Test-Tools GetSystemUserToken,
+  AuthType: Altinn.App.Core.Features.Auth.Authenticated+SystemUser,
+  Auth: {
+    SystemUserId: [
+      f58fe166-bc22-4899-beb7-c3e8e3332f43
+    ],
+    SystemUserOrgNr: 0192:991825827,
+    SupplierOrgNr: 0192:991825827,
+    SystemId: 53e63a18-8aca-47a8-893f-a623e96715bb,
+    AuthenticationLevel: 3,
+    AuthenticationMethod: maskinporten,
+    TokenIssuer: Maskinporten,
+    TokenIsExchanged: true,
+    Scopes: altinn:instances.read altinn:instances.write,
+    Token: eyJhbGciOiJSUzI1NiIsImtpZCI6IkQ4RDg2N0M3RDUyMTM2MEY0RjM1Q0Q1MTU4MEM0OUEwNTE2NUQ0RTEiLCJ0eXAiOiJKV1QiLCJ4NWMiOiJEOEQ4NjdDN0Q1MjEzNjBGNEYzNUNENTE1ODBDNDlBMDUxNjVENEUxIn0.eyJpc3MiOiJodHRwczovL3BsYXRmb3JtLnR0MDIuYWx0aW5uLm5vL2F1dGhlbnRpY2F0aW9uL2FwaS92MS9vcGVuaWQvIiwic2NvcGUiOiJhbHRpbm46aW5zdGFuY2VzLnJlYWQgYWx0aW5uOmluc3RhbmNlcy53cml0ZSIsImNsaWVudF9pZCI6IjIyNzE0ZmU4LWNkZmEtNDIwMC04NzYwLTRhYzIzODA0YWM4NSIsImNvbnN1bWVyIjp7ImF1dGhvcml0eSI6ImlzbzY1MjMtYWN0b3JpZC11cGlzIiwiSUQiOiIwMTkyOjk5MTgyNTgyNyJ9LCJleHAiOjE3NDI5MDg3NTgsImlhdCI6MTc0MjkwNjk1OCwianRpIjoiYVkwcDJHelo5cFgycU16ZGdHOEZVUGFxaDRERHhoWS1DVDl2eGxkWDVSSCIsImF1dGhvcml6YXRpb25fZGV0YWlscyI6W3sidHlwZSI6InVybjphbHRpbm46c3lzdGVtdXNlciIsInN5c3RlbXVzZXJfaWQiOlsiZjU4ZmUxNjYtYmMyMi00ODk5LWJlYjctYzNlOGUzMzMyZjQzIl0sInN5c3RlbXVzZXJfb3JnIjp7ImF1dGhvcml0eSI6ImlzbzY1MjMtYWN0b3JpZC11cGlzIiwiSUQiOiIwMTkyOjk5MTgyNTgyNyJ9LCJzeXN0ZW1faWQiOiI1M2U2M2ExOC04YWNhLTQ3YTgtODkzZi1hNjIzZTk2NzE1YmIifV0sInVybjphbHRpbm46YXV0aGVudGljYXRlbWV0aG9kIjoibWFza2lucG9ydGVuIiwidXJuOmFsdGlubjphdXRobGV2ZWwiOjMsInRva2VuX3R5cGUiOiJCZWFyZXIiLCJuYmYiOjE3NDI5MDY5NTgsImFjdHVhbF9pc3MiOiJhbHRpbm4tdGVzdC10b29scyJ9.bVcje62YxmJ8O2Ddc46lNypolarEhWNJdG7UsyXdGMlggOHPXo3tTbKjwiRH7e0zkc4qsKqoVvptA64Sp7Qq5rhZZMAU1n_UEpXHXgrlmFCVzE0YQy2EZQtDSPMDZuXAgNIhqe0uHJXRHjQKvA2kuTzKrYD7qT6ixasX13RTd8J_g0Cn_-lmrkVUSHX08cdRmvxqEqyplo6o5Gfn3HcPZE4DwK4lFwUvc0ME7byTluMk3gGs-wdVVI7jkqRxmvb_vns5oMvRlAbeMqQi3TpRPxVA3vv48iUTqT3soecP30MfFayzGLk_y05e5rTRCfwEf9yofd9qTi-IXGpEYTP6lg
+  },
+  Jwt: {
+    actual_iss: altinn-test-tools,
+    authorization_details: {
+      ValueKind: Array
+    },
+    client_id: 22714fe8-cdfa-4200-8760-4ac23804ac85,
+    consumer: {
+      ValueKind: Object
+    },
+    exp: 1742908758,
+    iat: 1742906958,
+    iss: https://platform.tt02.altinn.no/authentication/api/v1/openid/,
+    jti: aY0p2GzZ9pX2qMzdgG8FUPaqh4DDxhY-CT9vxldX5RH,
+    nbf: 1742906958,
+    scope: altinn:instances.read altinn:instances.write,
+    token_type: Bearer,
+    urn:altinn:authenticatemethod: maskinporten,
+    urn:altinn:authlevel: 3
+  },
+  Details: {
+    Party: {
+      PartyId: 1234,
+      PartyTypeName: Organisation,
+      OrgNumber: 991825827,
+      Name: Test AS,
+      IsDeleted: false,
+      OnlyHierarchyElementWithNoAccess: false
+    },
+    CanInstantiate: true
+  }
+}
\ No newline at end of file
diff --git a/test/Altinn.App.Core.Tests/Features/Auth/AuthenticatedTests.Can_Parse_Real_Tokens_type=User_T1OG.verified.txt b/test/Altinn.App.Core.Tests/Features/Auth/AuthenticatedTests.Can_Parse_Real_Tokens_type=User_T1OG.verified.txt
new file mode 100644
index 000000000..b64928121
--- /dev/null
+++ b/test/Altinn.App.Core.Tests/Features/Auth/AuthenticatedTests.Can_Parse_Real_Tokens_type=User_T1OG.verified.txt
@@ -0,0 +1,83 @@
+﻿{
+  Description: GetTestUserToken in localtest,
+  AuthType: Altinn.App.Core.Features.Auth.Authenticated+User,
+  Auth: {
+    UserId: 1004,
+    UserPartyId: 510004,
+    SelectedPartyId: 510004,
+    AuthenticationLevel: 2,
+    AuthenticationMethod: localtest,
+    InAltinnPortal: true,
+    TokenIssuer: Altinn,
+    TokenIsExchanged: false,
+    Token: eyJhbGciOiJSUzI1NiIsImtpZCI6IjQ4Q0VFNjAzMzEwMkYzMjQzMTk2NDc4QUYwNkZCNDNBMTc2NEQ4NDMiLCJ4NXQiOiJTTTdtQXpFQzh5UXhsa2VLOEctME9oZGsyRU0iLCJ0eXAiOiJKV1QifQ.eyJuYW1laWQiOiIxMDA0IiwidXJuOmFsdGlubjp1c2VyaWQiOiIxMDA0IiwidXJuOmFsdGlubjp1c2VybmFtZSI6IlNlbHZSZWdpc3RyZXJ0IiwidXJuOmFsdGlubjpwYXJ0eWlkIjo1MTAwMDQsInVybjphbHRpbm46YXV0aGxldmVsIjoyLCJuYmYiOjE3NDI5MDQxMjQsImV4cCI6MTc0Mjk2MTcyNCwiaWF0IjoxNzQyOTA0MTI0fQ.XxEHCiloqnZmn8gN83Cyde8OK7BrqAhpkxTXpTFrHoumaKA63sqvOZbxbr1pakj8iNWRI7D53R4tskHRxamuHk-6A5-UEpZv9i3lukOpaqtZhPO006VFTTxlRjp5gSrX4sG6DoDBTQrHfchiAleLEmGxxtzvtIlmaehz0HhJcCLZ3Ly1_3XepdSilSPAKin80Nkads7bjTqqI4UP1UZsDz4qyjF_xN7ganGZ5aEpGNbGszhsEcS-OW5QS4BrvSZh2YPpn2-LiO9iyasYR2CwY80_P1NgQZM6DTMggcE5nuYGP1jIuj7Fj2me0NOi-qzzEibD7SRvvUJuWAdJodBbzQ
+  },
+  Jwt: {
+    exp: 1742961724,
+    iat: 1742904124,
+    nameid: 1004,
+    nbf: 1742904124,
+    urn:altinn:authlevel: 2,
+    urn:altinn:partyid: 510004,
+    urn:altinn:userid: 1004,
+    urn:altinn:username: SelvRegistrert
+  },
+  Details: {
+    UserParty: {
+      PartyId: 510004,
+      PartyTypeName: Person,
+      SSN: 12345678901,
+      Name: Test Testesen,
+      IsDeleted: false,
+      OnlyHierarchyElementWithNoAccess: false,
+      ChildParties: []
+    },
+    SelectedParty: {
+      PartyId: 510004,
+      PartyTypeName: Person,
+      SSN: 12345678901,
+      Name: Test Testesen,
+      IsDeleted: false,
+      OnlyHierarchyElementWithNoAccess: false,
+      ChildParties: []
+    },
+    Profile: {
+      UserId: 1004,
+      IsReserved: false,
+      PartyId: 510004,
+      Party: {
+        PartyId: 510004,
+        PartyTypeName: Person,
+        SSN: 12345678901,
+        Name: Test Testesen,
+        IsDeleted: false,
+        OnlyHierarchyElementWithNoAccess: false,
+        ChildParties: []
+      }
+    },
+    RepresentsSelf: true,
+    Parties: [
+      {
+        PartyId: 510004,
+        PartyTypeName: Person,
+        SSN: 12345678901,
+        Name: Test Testesen,
+        IsDeleted: false,
+        OnlyHierarchyElementWithNoAccess: false,
+        ChildParties: []
+      }
+    ],
+    PartiesAllowedToInstantiate: [
+      {
+        PartyId: 510004,
+        PartyTypeName: Person,
+        SSN: 12345678901,
+        Name: Test Testesen,
+        IsDeleted: false,
+        OnlyHierarchyElementWithNoAccess: false,
+        ChildParties: []
+      }
+    ],
+    CanRepresent: true
+  }
+}
\ No newline at end of file
diff --git a/test/Altinn.App.Core.Tests/Features/Auth/AuthenticatedTests.Can_Parse_Real_Tokens_token=User_tokenType=Altinn_issuer=False_isExchanged=True.verified.txt b/test/Altinn.App.Core.Tests/Features/Auth/AuthenticatedTests.Can_Parse_Real_Tokens_type=User_csSy.verified.txt
similarity index 70%
rename from test/Altinn.App.Core.Tests/Features/Auth/AuthenticatedTests.Can_Parse_Real_Tokens_token=User_tokenType=Altinn_issuer=False_isExchanged=True.verified.txt
rename to test/Altinn.App.Core.Tests/Features/Auth/AuthenticatedTests.Can_Parse_Real_Tokens_type=User_csSy.verified.txt
index 099a1f885..5a3db2044 100644
--- a/test/Altinn.App.Core.Tests/Features/Auth/AuthenticatedTests.Can_Parse_Real_Tokens_token=User_tokenType=Altinn_issuer=False_isExchanged=True.verified.txt
+++ b/test/Altinn.App.Core.Tests/Features/Auth/AuthenticatedTests.Can_Parse_Real_Tokens_type=User_csSy.verified.txt
@@ -1,5 +1,7 @@
 ﻿{
-  User: {
+  Description: Altinn portal tt02 test login, token extracted from AltinnStudioRuntime cookie,
+  AuthType: Altinn.App.Core.Features.Auth.Authenticated+User,
+  Auth: {
     UserId: 1433953,
     UserPartyId: 50593193,
     SelectedPartyId: 50593193,
@@ -8,9 +10,21 @@
     InAltinnPortal: true,
     TokenIssuer: Altinn,
     TokenIsExchanged: false,
-    Scopes: {},
+    Scopes: altinn:portal/enduser,
     Token: eyJhbGciOiJSUzI1NiIsImtpZCI6IkQ4RDg2N0M3RDUyMTM2MEY0RjM1Q0Q1MTU4MEM0OUEwNTE2NUQ0RTEiLCJ4NXQiOiIyTmhueDlVaE5nOVBOYzFSV0F4Sm9GRmwxT0UiLCJ0eXAiOiJKV1QifQ.eyJuYW1laWQiOiIxNDMzOTUzIiwidXJuOmFsdGlubjp1c2VyaWQiOiIxNDMzOTUzIiwidXJuOmFsdGlubjpwYXJ0eWlkIjo1MDU5MzE5MywidXJuOmFsdGlubjphdXRoZW50aWNhdGVtZXRob2QiOiJJZHBvcnRlblRlc3RJZCIsInVybjphbHRpbm46YXV0aGxldmVsIjozLCJqdGkiOiJkMDk2YjBkYy1lYTgyLTRiNGUtYjY0ZS04Y2NjYzA2OWVmYzYiLCJzY29wZSI6ImFsdGlubjpwb3J0YWwvZW5kdXNlciIsIm5iZiI6MTczNzgxNTM0MSwiZXhwIjoxNzM3ODE3MTQxLCJpYXQiOjE3Mzc4MTUzNDF9.dLYVBOSu99_CjcrIqsw6OmdwfKTKthnG2j1kl2pdsVUgn34vFVDF-VAE40IfSpnKUk4VKG-EkGHISi7S2U9rvLrIU_ptTcchg7XCXYSpQhm1DqfsbVwKarTEDBtlSITeqzUI5t2C6DOGSg4QEip92cOAVPw-m34bxBmnXxo6g-3babb-qSsLty_IPBhj86M0Y6zEomE-ysNVNSLJ-0ccAWi4ByzdfdsA5PnBDoeNTzPSZ3PscMOWe3z5d43WRVq30uKVE3XYWt6W0Yf2CbGXVSCTM9J45P2Ps4qiJysQM0zw2guh3s1IIdF7c0-IrppB-3sLNrDzAZ71kyKJXrc5JQ
   },
+  Jwt: {
+    exp: 1737817141,
+    iat: 1737815341,
+    jti: d096b0dc-ea82-4b4e-b64e-8cccc069efc6,
+    nameid: 1433953,
+    nbf: 1737815341,
+    scope: altinn:portal/enduser,
+    urn:altinn:authenticatemethod: IdportenTestId,
+    urn:altinn:authlevel: 3,
+    urn:altinn:partyid: 50593193,
+    urn:altinn:userid: 1433953
+  },
   Details: {
     UserParty: {
       PartyId: 50593193,
@@ -18,7 +32,8 @@
       SSN: 12345678901,
       Name: Test Testesen,
       IsDeleted: false,
-      OnlyHierarchyElementWithNoAccess: false
+      OnlyHierarchyElementWithNoAccess: false,
+      ChildParties: []
     },
     SelectedParty: {
       PartyId: 50593193,
@@ -26,7 +41,8 @@
       SSN: 12345678901,
       Name: Test Testesen,
       IsDeleted: false,
-      OnlyHierarchyElementWithNoAccess: false
+      OnlyHierarchyElementWithNoAccess: false,
+      ChildParties: []
     },
     Profile: {
       UserId: 1433953,
@@ -38,7 +54,8 @@
         SSN: 12345678901,
         Name: Test Testesen,
         IsDeleted: false,
-        OnlyHierarchyElementWithNoAccess: false
+        OnlyHierarchyElementWithNoAccess: false,
+        ChildParties: []
       }
     },
     RepresentsSelf: true,
@@ -49,7 +66,8 @@
         SSN: 12345678901,
         Name: Test Testesen,
         IsDeleted: false,
-        OnlyHierarchyElementWithNoAccess: false
+        OnlyHierarchyElementWithNoAccess: false,
+        ChildParties: []
       }
     ],
     PartiesAllowedToInstantiate: [
@@ -59,7 +77,8 @@
         SSN: 12345678901,
         Name: Test Testesen,
         IsDeleted: false,
-        OnlyHierarchyElementWithNoAccess: false
+        OnlyHierarchyElementWithNoAccess: false,
+        ChildParties: []
       }
     ],
     CanRepresent: true
diff --git a/test/Altinn.App.Core.Tests/Features/Auth/AuthenticatedTests.Can_Parse_Real_Tokens_type=User_fOrK.verified.txt b/test/Altinn.App.Core.Tests/Features/Auth/AuthenticatedTests.Can_Parse_Real_Tokens_type=User_fOrK.verified.txt
new file mode 100644
index 000000000..075c3dd7a
--- /dev/null
+++ b/test/Altinn.App.Core.Tests/Features/Auth/AuthenticatedTests.Can_Parse_Real_Tokens_type=User_fOrK.verified.txt
@@ -0,0 +1,96 @@
+﻿{
+  Description: Altinn-Test-Tools GetPersonalToken,
+  AuthType: Altinn.App.Core.Features.Auth.Authenticated+User,
+  Auth: {
+    UserId: 160872,
+    UserPartyId: 51829336,
+    SelectedPartyId: 51829336,
+    AuthenticationLevel: 3,
+    AuthenticationMethod: NotDefined,
+    InAltinnPortal: true,
+    TokenIssuer: Altinn,
+    TokenIsExchanged: false,
+    Scopes: altinn:instances.read altinn:instances.write,
+    Token: eyJhbGciOiJSUzI1NiIsImtpZCI6IkQ4RDg2N0M3RDUyMTM2MEY0RjM1Q0Q1MTU4MEM0OUEwNTE2NUQ0RTEiLCJ0eXAiOiJKV1QiLCJ4NWMiOiJEOEQ4NjdDN0Q1MjEzNjBGNEYzNUNENTE1ODBDNDlBMDUxNjVENEUxIn0.eyJ1cm46YWx0aW5uOmF1dGhlbnRpY2F0ZW1ldGhvZCI6Ik5vdERlZmluZWQiLCJ1cm46YWx0aW5uOmF1dGhsZXZlbCI6IjMiLCJjbGllbnRfYW1yIjoidmlya3NvbWhldHNzZXJ0aWZpa2F0IiwicGlkIjoiMDI4MjgyOTgzMzIiLCJ0b2tlbl90eXBlIjoiQmVhcmVyIiwiY2xpZW50X2lkIjoiYWNkZGQxZDktYjYyOC00MTlkLTkxM2ItNjlmOGQ5NzA5MzNjIiwiYWNyIjoiaWRwb3J0ZW4tbG9hLXN1YnN0YW50aWFsIiwic2NvcGUiOiJhbHRpbm46aW5zdGFuY2VzLnJlYWQgYWx0aW5uOmluc3RhbmNlcy53cml0ZSIsImV4cCI6MTc0MjkwNzA3NCwiaWF0IjoxNzQyOTAzNDc0LCJjbGllbnRfb3Jnbm8iOiI5OTE4MjU4MjciLCJjb25zdW1lciI6eyJhdXRob3JpdHkiOiJpc282NTIzLWFjdG9yaWQtdXBpcyIsIklEIjoiMDE5Mjo5OTE4MjU4MjcifSwiaXNzIjoiaHR0cHM6Ly9wbGF0Zm9ybS50dDAyLmFsdGlubi5uby9hdXRoZW50aWNhdGlvbi9hcGkvdjEvb3BlbmlkLyIsImFjdHVhbF9pc3MiOiJhbHRpbm4tdGVzdC10b29scyIsIm5iZiI6MTc0MjkwMzQ3NCwibmFtZWlkIjoxNjA4NzIsInVybjphbHRpbm46dXNlcmlkIjoxNjA4NzIsInVybjphbHRpbm46cGFydHlpZCI6NTE4MjkzMzZ9.K8YnlFuHvoWBFEMKyZdGdaMgij6hewzD_-8jxPUMtJ_defkqwPbduG5AsdC2XCo1wnj3fgIPUuygz-tE3XPtrEGUadFjp_nOrJ1KgfBrwJsbNBWHmDIBikhF0JRnK7AcWvcR8akGp92IZEARz6P20uDvcDSeAmwt4DI7jbgOm1gHXUzzm74CikUd-yXegsN3TbTHNQB8y-wErlfvWahgOGP7KfLQ5aMX6xbIyAbcqQJb6wjyTcVfgmgDnVqbOnzv7YrBd-s3MQTwydyKFqiOsJqE6OZa40SOaj1RBPvNto50jgaPGuaUzrZwNpxCe0JXNLObFY5UoGcDPTUAUSlQkw
+  },
+  Jwt: {
+    acr: idporten-loa-substantial,
+    actual_iss: altinn-test-tools,
+    client_amr: virksomhetssertifikat,
+    client_id: acddd1d9-b628-419d-913b-69f8d970933c,
+    client_orgno: 991825827,
+    consumer: {
+      ValueKind: Object
+    },
+    exp: 1742907074,
+    iat: 1742903474,
+    iss: https://platform.tt02.altinn.no/authentication/api/v1/openid/,
+    nameid: 160872,
+    nbf: 1742903474,
+    pid: 02828298332,
+    scope: altinn:instances.read altinn:instances.write,
+    token_type: Bearer,
+    urn:altinn:authenticatemethod: NotDefined,
+    urn:altinn:authlevel: 3,
+    urn:altinn:partyid: 51829336,
+    urn:altinn:userid: 160872
+  },
+  Details: {
+    UserParty: {
+      PartyId: 51829336,
+      PartyTypeName: Person,
+      SSN: 12345678901,
+      Name: Test Testesen,
+      IsDeleted: false,
+      OnlyHierarchyElementWithNoAccess: false,
+      ChildParties: []
+    },
+    SelectedParty: {
+      PartyId: 51829336,
+      PartyTypeName: Person,
+      SSN: 12345678901,
+      Name: Test Testesen,
+      IsDeleted: false,
+      OnlyHierarchyElementWithNoAccess: false,
+      ChildParties: []
+    },
+    Profile: {
+      UserId: 160872,
+      IsReserved: false,
+      PartyId: 51829336,
+      Party: {
+        PartyId: 51829336,
+        PartyTypeName: Person,
+        SSN: 12345678901,
+        Name: Test Testesen,
+        IsDeleted: false,
+        OnlyHierarchyElementWithNoAccess: false,
+        ChildParties: []
+      }
+    },
+    RepresentsSelf: true,
+    Parties: [
+      {
+        PartyId: 51829336,
+        PartyTypeName: Person,
+        SSN: 12345678901,
+        Name: Test Testesen,
+        IsDeleted: false,
+        OnlyHierarchyElementWithNoAccess: false,
+        ChildParties: []
+      }
+    ],
+    PartiesAllowedToInstantiate: [
+      {
+        PartyId: 51829336,
+        PartyTypeName: Person,
+        SSN: 12345678901,
+        Name: Test Testesen,
+        IsDeleted: false,
+        OnlyHierarchyElementWithNoAccess: false,
+        ChildParties: []
+      }
+    ],
+    CanRepresent: true
+  }
+}
\ No newline at end of file
diff --git a/test/Altinn.App.Core.Tests/Features/Auth/AuthenticatedTests.Can_Parse_Real_Tokens_token=User_tokenType=IDporten_issuer=True_isExchanged=True.verified.txt b/test/Altinn.App.Core.Tests/Features/Auth/AuthenticatedTests.Can_Parse_Real_Tokens_type=User_sUK3.verified.txt
similarity index 68%
rename from test/Altinn.App.Core.Tests/Features/Auth/AuthenticatedTests.Can_Parse_Real_Tokens_token=User_tokenType=IDporten_issuer=True_isExchanged=True.verified.txt
rename to test/Altinn.App.Core.Tests/Features/Auth/AuthenticatedTests.Can_Parse_Real_Tokens_type=User_sUK3.verified.txt
index 2d22f3278..70ecfede9 100644
--- a/test/Altinn.App.Core.Tests/Features/Auth/AuthenticatedTests.Can_Parse_Real_Tokens_token=User_tokenType=IDporten_issuer=True_isExchanged=True.verified.txt
+++ b/test/Altinn.App.Core.Tests/Features/Auth/AuthenticatedTests.Can_Parse_Real_Tokens_type=User_sUK3.verified.txt
@@ -1,5 +1,7 @@
 ﻿{
-  User: {
+  Description: ID-porten testclient exchanged (demo-client.test.idporten.no),
+  AuthType: Altinn.App.Core.Features.Auth.Authenticated+User,
+  Auth: {
     UserId: 1433953,
     UserPartyId: 50593193,
     SelectedPartyId: 50593193,
@@ -8,9 +10,30 @@
     InAltinnPortal: false,
     TokenIssuer: IDporten,
     TokenIsExchanged: true,
-    Scopes: {},
+    Scopes: altinn:instances.read openid profile,
     Token: eyJhbGciOiJSUzI1NiIsImtpZCI6IkQ4RDg2N0M3RDUyMTM2MEY0RjM1Q0Q1MTU4MEM0OUEwNTE2NUQ0RTEiLCJ4NXQiOiIyTmhueDlVaE5nOVBOYzFSV0F4Sm9GRmwxT0UiLCJ0eXAiOiJKV1QifQ.eyJuYW1laWQiOiIxNDMzOTUzIiwidXJuOmFsdGlubjp1c2VyaWQiOiIxNDMzOTUzIiwidXJuOmFsdGlubjp1c2VybmFtZSI6IiIsInVybjphbHRpbm46cGFydHlpZCI6NTA1OTMxOTMsInVybjphbHRpbm46YXV0aGVudGljYXRlbWV0aG9kIjoiTm90RGVmaW5lZCIsInVybjphbHRpbm46YXV0aGxldmVsIjozLCJhY3IiOiJpZHBvcnRlbi1sb2Etc3Vic3RhbnRpYWwiLCJzY29wZSI6ImFsdGlubjppbnN0YW5jZXMucmVhZCBvcGVuaWQgcHJvZmlsZSIsImNsaWVudF9hbXIiOiJjbGllbnRfc2VjcmV0X2Jhc2ljIiwicGlkIjoiMTk5MTQ4OTcyODEiLCJleHAiOjE3Mzc4MTU3NDYsImlhdCI6MTczNzgxNTE1NywiY2xpZW50X2lkIjoiZGVtb2NsaWVudF9pZHBvcnRlbl90ZXN0IiwiY29uc3VtZXIiOnsiYXV0aG9yaXR5IjoiaXNvNjUyMy1hY3RvcmlkLXVwaXMiLCJJRCI6IjAxOTI6OTkxODI1ODI3In0sImlzcyI6Imh0dHBzOi8vcGxhdGZvcm0udHQwMi5hbHRpbm4ubm8vYXV0aGVudGljYXRpb24vYXBpL3YxL29wZW5pZC8iLCJqdGkiOiI3MTMzYmMwNy1iZWE0LTRkNDAtOWRjNC1jMWFmZGZjMmU2NTEiLCJuYmYiOjE3Mzc4MTUxNTd9.W71Z1FiSYUBJ8G1De-aGYOiUbpD_FCB9gTceLSItZN33y98IzAvNRKJEfXUxVge-GPInjm1DmJ6MVs6ZcVRunigiLa5gNR_W5kkV6kBkaTbZ4SJQsMdT3AaHoBziJEL2ey_ONyDT4ffScx-lRoF_qKQXbkpqLm-Qkj1VKjEBVSTsaqKxJMQrhmKZ4zK6rwhFOPZv5HnGSt56CWh2jrkk8IFzIJZbvO738qHscZ--1UhwHcZ_hpjsdLGaxENiC25kAiqV8gTAyihOAg9ii7jwxLiQYRe_ahqBv5IqT_ZNKKa3q9t7Yh57hQjPWOqtTFTgaBCCYQohYqv-FQtOenbd5g
   },
+  Jwt: {
+    acr: idporten-loa-substantial,
+    client_amr: client_secret_basic,
+    client_id: democlient_idporten_test,
+    consumer: {
+      ValueKind: Object
+    },
+    exp: 1737815746,
+    iat: 1737815157,
+    iss: https://platform.tt02.altinn.no/authentication/api/v1/openid/,
+    jti: 7133bc07-bea4-4d40-9dc4-c1afdfc2e651,
+    nameid: 1433953,
+    nbf: 1737815157,
+    pid: 19914897281,
+    scope: altinn:instances.read openid profile,
+    urn:altinn:authenticatemethod: NotDefined,
+    urn:altinn:authlevel: 3,
+    urn:altinn:partyid: 50593193,
+    urn:altinn:userid: 1433953,
+    urn:altinn:username: 
+  },
   Details: {
     UserParty: {
       PartyId: 50593193,
@@ -18,7 +41,8 @@
       SSN: 12345678901,
       Name: Test Testesen,
       IsDeleted: false,
-      OnlyHierarchyElementWithNoAccess: false
+      OnlyHierarchyElementWithNoAccess: false,
+      ChildParties: []
     },
     SelectedParty: {
       PartyId: 50593193,
@@ -26,7 +50,8 @@
       SSN: 12345678901,
       Name: Test Testesen,
       IsDeleted: false,
-      OnlyHierarchyElementWithNoAccess: false
+      OnlyHierarchyElementWithNoAccess: false,
+      ChildParties: []
     },
     Profile: {
       UserId: 1433953,
@@ -38,7 +63,8 @@
         SSN: 12345678901,
         Name: Test Testesen,
         IsDeleted: false,
-        OnlyHierarchyElementWithNoAccess: false
+        OnlyHierarchyElementWithNoAccess: false,
+        ChildParties: []
       }
     },
     RepresentsSelf: true,
@@ -49,7 +75,8 @@
         SSN: 12345678901,
         Name: Test Testesen,
         IsDeleted: false,
-        OnlyHierarchyElementWithNoAccess: false
+        OnlyHierarchyElementWithNoAccess: false,
+        ChildParties: []
       }
     ],
     PartiesAllowedToInstantiate: [
@@ -59,7 +86,8 @@
         SSN: 12345678901,
         Name: Test Testesen,
         IsDeleted: false,
-        OnlyHierarchyElementWithNoAccess: false
+        OnlyHierarchyElementWithNoAccess: false,
+        ChildParties: []
       }
     ],
     CanRepresent: true
diff --git a/test/Altinn.App.Core.Tests/Features/Auth/AuthenticatedTests.cs b/test/Altinn.App.Core.Tests/Features/Auth/AuthenticatedTests.cs
index 62a617712..abc2f3aa9 100644
--- a/test/Altinn.App.Core.Tests/Features/Auth/AuthenticatedTests.cs
+++ b/test/Altinn.App.Core.Tests/Features/Auth/AuthenticatedTests.cs
@@ -2,176 +2,128 @@ namespace Altinn.App.Core.Tests.Features.Auth;
 
 using System.Globalization;
 using System.IdentityModel.Tokens.Jwt;
+using System.IO.Hashing;
+using System.Text;
+using System.Text.Json;
 using Altinn.App.Api.Tests.Utils;
 using Altinn.App.Core.Features.Auth;
+using Altinn.App.Core.Models;
 using Altinn.Platform.Profile.Models;
 using Altinn.Platform.Register.Enums;
 using Altinn.Platform.Register.Models;
 using AltinnCore.Authentication.Constants;
+using static Altinn.App.Core.Features.Auth.Authenticated;
 
 public class AuthenticatedTests
 {
     // These are real tokens used from tt02/test login methods across Altinn, ID-porten and Maskinporten
-    public static TheoryData<string, AuthenticationTypes, TokenIssuer, bool, bool> Tokens =>
+    public static TheoryData<string, string, AuthenticationTypes, bool> Tokens =>
         new()
         {
             {
-                // ID-porten testclient raw (demo-client.test.idporten.no)
+                "ID-porten testclient raw (demo-client.test.idporten.no)",
                 "eyJraWQiOiJkaWdpdGFsaXNlcmluZ3NkaXJla3RvcmF0ZXQtLWNlcnQwIiwiYWxnIjoiUlMyNTYifQ.eyJzdWIiOiIxOTkxNDg5NzI4MSIsImFjciI6ImlkcG9ydGVuLWxvYS1zdWJzdGFudGlhbCIsInNjb3BlIjoiYWx0aW5uOmluc3RhbmNlcy5yZWFkIG9wZW5pZCBwcm9maWxlIiwiaXNzIjoiaHR0cHM6Ly90ZXN0LmlkcG9ydGVuLm5vIiwiY2xpZW50X2FtciI6ImNsaWVudF9zZWNyZXRfYmFzaWMiLCJwaWQiOiIxOTkxNDg5NzI4MSIsImV4cCI6MTczNzgxNTc0NiwiaWF0IjoxNzM3ODE1MTQ2LCJqdGkiOiJmVFJYUTNCWkRqTSIsImNsaWVudF9pZCI6ImRlbW9jbGllbnRfaWRwb3J0ZW5fdGVzdCIsImNvbnN1bWVyIjp7ImF1dGhvcml0eSI6ImlzbzY1MjMtYWN0b3JpZC11cGlzIiwiSUQiOiIwMTkyOjk5MTgyNTgyNyJ9fQ.h6clB-UEAkChH5aaqIEmmUqmq3vdCrazixBahfBi7bHMtZ1LtOrHtT0gdOaDIvamMxFDUhOc8fvu7jUpicd5hmDmvHULp_u-RS_qasAlZEVNzzV-ds4RXnhROVh0cCkO2XvZBJKS6RTWv8UmGrK_iaklZwhs5qhMiBs1bRAJ0isLwnbxTKXsUFgaY0RRtgNLzhXW6qwT00roL9GMSCAMb-rBXdXJ5zn41gacGejN5mdQTJe3TQbxyxk52uDU4Biy1TCAh3kRU12Cxx-6T39eJdCKtj-qKCHE44mYp-k8MenTbV1l613ObuVTbiZet4WehKlIXLYFctMB4LMrTQmWD2XS5WyMGXMrincoULZ7VO3Q7BAatbxtIBRT56C_9xhNHg5UOaGATjTp2X6U0XiwzAGE1sZoi-MdMVnUQC3ViJ7bIv3vHL4YU3qKX9iGjpZR0Lnqq8PkN-HTjz1mO0VvYZ3Gz71KKd1_p-DiyJo5lRgp4Ms5FSESz0gWkQ3YUm2Y",
                 AuthenticationTypes.User,
-                TokenIssuer.IDporten,
-                false,
                 false // we don't support raw ID-porten tokens atm
             },
             {
-                // ID-porten testclient exchanged (demo-client.test.idporten.no)
+                "ID-porten testclient exchanged (demo-client.test.idporten.no)",
                 "eyJhbGciOiJSUzI1NiIsImtpZCI6IkQ4RDg2N0M3RDUyMTM2MEY0RjM1Q0Q1MTU4MEM0OUEwNTE2NUQ0RTEiLCJ4NXQiOiIyTmhueDlVaE5nOVBOYzFSV0F4Sm9GRmwxT0UiLCJ0eXAiOiJKV1QifQ.eyJuYW1laWQiOiIxNDMzOTUzIiwidXJuOmFsdGlubjp1c2VyaWQiOiIxNDMzOTUzIiwidXJuOmFsdGlubjp1c2VybmFtZSI6IiIsInVybjphbHRpbm46cGFydHlpZCI6NTA1OTMxOTMsInVybjphbHRpbm46YXV0aGVudGljYXRlbWV0aG9kIjoiTm90RGVmaW5lZCIsInVybjphbHRpbm46YXV0aGxldmVsIjozLCJhY3IiOiJpZHBvcnRlbi1sb2Etc3Vic3RhbnRpYWwiLCJzY29wZSI6ImFsdGlubjppbnN0YW5jZXMucmVhZCBvcGVuaWQgcHJvZmlsZSIsImNsaWVudF9hbXIiOiJjbGllbnRfc2VjcmV0X2Jhc2ljIiwicGlkIjoiMTk5MTQ4OTcyODEiLCJleHAiOjE3Mzc4MTU3NDYsImlhdCI6MTczNzgxNTE1NywiY2xpZW50X2lkIjoiZGVtb2NsaWVudF9pZHBvcnRlbl90ZXN0IiwiY29uc3VtZXIiOnsiYXV0aG9yaXR5IjoiaXNvNjUyMy1hY3RvcmlkLXVwaXMiLCJJRCI6IjAxOTI6OTkxODI1ODI3In0sImlzcyI6Imh0dHBzOi8vcGxhdGZvcm0udHQwMi5hbHRpbm4ubm8vYXV0aGVudGljYXRpb24vYXBpL3YxL29wZW5pZC8iLCJqdGkiOiI3MTMzYmMwNy1iZWE0LTRkNDAtOWRjNC1jMWFmZGZjMmU2NTEiLCJuYmYiOjE3Mzc4MTUxNTd9.W71Z1FiSYUBJ8G1De-aGYOiUbpD_FCB9gTceLSItZN33y98IzAvNRKJEfXUxVge-GPInjm1DmJ6MVs6ZcVRunigiLa5gNR_W5kkV6kBkaTbZ4SJQsMdT3AaHoBziJEL2ey_ONyDT4ffScx-lRoF_qKQXbkpqLm-Qkj1VKjEBVSTsaqKxJMQrhmKZ4zK6rwhFOPZv5HnGSt56CWh2jrkk8IFzIJZbvO738qHscZ--1UhwHcZ_hpjsdLGaxENiC25kAiqV8gTAyihOAg9ii7jwxLiQYRe_ahqBv5IqT_ZNKKa3q9t7Yh57hQjPWOqtTFTgaBCCYQohYqv-FQtOenbd5g",
                 AuthenticationTypes.User,
-                TokenIssuer.IDporten,
-                true,
                 true
             },
             {
-                // Altinn portal tt02 test login, token extracted from AltinnStudioRuntime cookie
+                "Altinn portal tt02 test login, token extracted from AltinnStudioRuntime cookie",
                 "eyJhbGciOiJSUzI1NiIsImtpZCI6IkQ4RDg2N0M3RDUyMTM2MEY0RjM1Q0Q1MTU4MEM0OUEwNTE2NUQ0RTEiLCJ4NXQiOiIyTmhueDlVaE5nOVBOYzFSV0F4Sm9GRmwxT0UiLCJ0eXAiOiJKV1QifQ.eyJuYW1laWQiOiIxNDMzOTUzIiwidXJuOmFsdGlubjp1c2VyaWQiOiIxNDMzOTUzIiwidXJuOmFsdGlubjpwYXJ0eWlkIjo1MDU5MzE5MywidXJuOmFsdGlubjphdXRoZW50aWNhdGVtZXRob2QiOiJJZHBvcnRlblRlc3RJZCIsInVybjphbHRpbm46YXV0aGxldmVsIjozLCJqdGkiOiJkMDk2YjBkYy1lYTgyLTRiNGUtYjY0ZS04Y2NjYzA2OWVmYzYiLCJzY29wZSI6ImFsdGlubjpwb3J0YWwvZW5kdXNlciIsIm5iZiI6MTczNzgxNTM0MSwiZXhwIjoxNzM3ODE3MTQxLCJpYXQiOjE3Mzc4MTUzNDF9.dLYVBOSu99_CjcrIqsw6OmdwfKTKthnG2j1kl2pdsVUgn34vFVDF-VAE40IfSpnKUk4VKG-EkGHISi7S2U9rvLrIU_ptTcchg7XCXYSpQhm1DqfsbVwKarTEDBtlSITeqzUI5t2C6DOGSg4QEip92cOAVPw-m34bxBmnXxo6g-3babb-qSsLty_IPBhj86M0Y6zEomE-ysNVNSLJ-0ccAWi4ByzdfdsA5PnBDoeNTzPSZ3PscMOWe3z5d43WRVq30uKVE3XYWt6W0Yf2CbGXVSCTM9J45P2Ps4qiJysQM0zw2guh3s1IIdF7c0-IrppB-3sLNrDzAZ71kyKJXrc5JQ",
                 AuthenticationTypes.User,
-                TokenIssuer.Altinn,
-                false,
                 true
             },
             {
-                // Altinn portal tt02 self identified, token extracted from AltinnStudioRuntime cookie
+                "Altinn portal tt02 self identified, token extracted from AltinnStudioRuntime cookie",
                 "eyJhbGciOiJSUzI1NiIsImtpZCI6IkQ4RDg2N0M3RDUyMTM2MEY0RjM1Q0Q1MTU4MEM0OUEwNTE2NUQ0RTEiLCJ4NXQiOiIyTmhueDlVaE5nOVBOYzFSV0F4Sm9GRmwxT0UiLCJ0eXAiOiJKV1QifQ.eyJuYW1laWQiOiIxNDI4ODEzIiwidXJuOmFsdGlubjp1c2VyaWQiOiIxNDI4ODEzIiwidXJuOmFsdGlubjp1c2VybmFtZSI6Im1hcnRpbm90aGFtYXIiLCJ1cm46YWx0aW5uOnBhcnR5aWQiOjUzMzI4NjYwLCJ1cm46YWx0aW5uOmF1dGhlbnRpY2F0ZW1ldGhvZCI6IlNlbGZJZGVudGlmaWVkIiwidXJuOmFsdGlubjphdXRobGV2ZWwiOjAsImp0aSI6Ijg3OGFkMDZiLWE0Y2EtNDFhZi04YjQzLWY3NTE2Mzk3Yzc3NyIsInNjb3BlIjoiYWx0aW5uOnBvcnRhbC9lbmR1c2VyIiwibmJmIjoxNzM3ODE1NjU0LCJleHAiOjE3Mzc4MTc0NTQsImlhdCI6MTczNzgxNTY1NH0.RLnlBcd_mfgixYkZcePG09iMsAk2XM25FdifashYcLEtebutWEub89GZyFHus7oLbCj_yDiyE1Rilpi3qBxUo9wVPH20ZsmFK5XX1jq7K_wzTsQGYlXPkjROyuXObOW1vuPZL973PEuSsFSc0MX38RfpHlOx7QZHx8gxOES3LwLFqCpdSCmTvsbPXmpHu4SKUb0BcaUFH3flexgbry4hixQbO65v6cQP7Od3A-5tTLCtPsBzCRY3u4EqbCVSJvXAj5x0PEYe-rKgQmY6nQl_dPfCre3uksPlKQeWtdDrmR1YiFfvKfg1DD_Fcf9wjeVGavyRh4qYhFV_7jueueGoqQ",
                 AuthenticationTypes.SelfIdentifiedUser,
-                TokenIssuer.Altinn,
-                false,
                 true
             },
             {
-                // Maskinporten raw org token (not service owner)
+                "Maskinporten raw org token (not service owner)",
                 "eyJraWQiOiJiZFhMRVduRGpMSGpwRThPZnl5TUp4UlJLbVo3MUxCOHUxeUREbVBpdVQwIiwiYWxnIjoiUlMyNTYifQ.eyJzY29wZSI6ImFsdGlubjppbnN0YW5jZXMucmVhZCBhbHRpbm46aW5zdGFuY2VzLndyaXRlIiwiaXNzIjoiaHR0cHM6Ly90ZXN0Lm1hc2tpbnBvcnRlbi5uby8iLCJjbGllbnRfYW1yIjoicHJpdmF0ZV9rZXlfand0IiwidG9rZW5fdHlwZSI6IkJlYXJlciIsImV4cCI6MTczNzg0NTkzNSwiaWF0IjoxNzM3ODQyMzM1LCJjbGllbnRfaWQiOiIwNDRmNTA0MC01NGUzLTRhMjctYTIyMS1hODUxNGZkMzBjYTkiLCJqdGkiOiJabUFxZU1fOENrVDMxSWNFXzBlSDhDLVBJM0x2b2ZQVlBielBIc3N2MW1rIiwiY29uc3VtZXIiOnsiYXV0aG9yaXR5IjoiaXNvNjUyMy1hY3RvcmlkLXVwaXMiLCJJRCI6IjAxOTI6OTkxODI1ODI3In19.wI3lgUfpFAWW2dp6SLThjXUhdcBVqym2epd8XG1_AoBbK93lH-lKveMqG14HuNYyy3uivaLwRkHgcIspmlupJAm7r2l-UrflnUX-yQVMa_xYpIDvJIn4gmN-271AnXXLt_lE6WtiYEWaekK37cVs3GzPkwfelx4mPkAg-t-bQeXBIDBLCuvUTy5uzBWbcoMFE7n1fEYu7tTuea2XCbshOcpcLUvLR2D6ZE2brj7Oh91IVizMOtULmf__ZxtwfYW7JfYvBqzd-dASs0Nl0xRwf4kuqEHzZk48VX2x_yizB7RITUAXZ_CffUxvS-NM7dd5q_tlKCRR5Fb7z7yqsLklheeNcyuyXdNqbQEL0iAxotJSNjL2FLjuidOqzh1d8dk45N8019bnYKWAopeb-bj2MNdUEWNEQvubejoKGfO5f_xJ6kS9Oeh4B7JW30xyuYSz8_D9LEVCSFfUp73n4XhQ_DeLWZsq9_G0uWftPUuDbGLaQBwVqujQdXXQCd5MVg7V",
                 AuthenticationTypes.Org,
-                TokenIssuer.Maskinporten,
-                false,
                 false // we don't support raw Maskinporten tokens atm
             },
             {
-                // Maskinporten exchanged org token (not service owner)
+                "Maskinporten exchanged org token (not service owner)",
                 "eyJhbGciOiJSUzI1NiIsImtpZCI6IkQ4RDg2N0M3RDUyMTM2MEY0RjM1Q0Q1MTU4MEM0OUEwNTE2NUQ0RTEiLCJ4NXQiOiIyTmhueDlVaE5nOVBOYzFSV0F4Sm9GRmwxT0UiLCJ0eXAiOiJKV1QifQ.eyJzY29wZSI6ImFsdGlubjppbnN0YW5jZXMucmVhZCBhbHRpbm46aW5zdGFuY2VzLndyaXRlIiwidG9rZW5fdHlwZSI6IkJlYXJlciIsImV4cCI6MTczNzg0NDE1NywiaWF0IjoxNzM3ODQyMzU3LCJjbGllbnRfaWQiOiIwNDRmNTA0MC01NGUzLTRhMjctYTIyMS1hODUxNGZkMzBjYTkiLCJjb25zdW1lciI6eyJhdXRob3JpdHkiOiJpc282NTIzLWFjdG9yaWQtdXBpcyIsIklEIjoiMDE5Mjo5OTE4MjU4MjcifSwidXJuOmFsdGlubjpvcmdOdW1iZXIiOiI5OTE4MjU4MjciLCJ1cm46YWx0aW5uOmF1dGhlbnRpY2F0ZW1ldGhvZCI6Im1hc2tpbnBvcnRlbiIsInVybjphbHRpbm46YXV0aGxldmVsIjozLCJpc3MiOiJodHRwczovL3BsYXRmb3JtLnR0MDIuYWx0aW5uLm5vL2F1dGhlbnRpY2F0aW9uL2FwaS92MS9vcGVuaWQvIiwianRpIjoiMzUwYWNhOTYtYjNkZi00YTdmLTg4YWItOWY4ZDc4ZDYxMjI0IiwibmJmIjoxNzM3ODQyMzU3fQ.g6EFkX6pAKtA64p11CpoTDU6Nzzst4duOzBletMAexEmX-V5C4rXsndkwK3pL9JpZNBbjBZZaEAbBta177PIQo208dZwzYV2meLrip5fQ-hnWF3Ub0VdpxcgggDbcx8WqT1HSix-GQlNcSe2uyZB0KZ_8GRB2aKXjatX4R392A3CZfzBq8Dt3ra5AP0pWVxJAd4NuKHPQRKGbNWkC62J92zLYYtTz4j8DS9yogeP28hrcLzuqyVScDndmOiIjeexXXWdgrwVLDBO2mpVU_i4xqRUbjK9UdySrrkYfv-ZIZQRoZsyPE3ab0SDym-4kVxSIp4xyH3nQuzZJqz24LuBcw",
                 AuthenticationTypes.Org,
-                TokenIssuer.Maskinporten,
-                true,
                 true
             },
             {
-                // Maskinporten raw service owner token
+                "Maskinporten raw service owner token",
                 "eyJraWQiOiJiZFhMRVduRGpMSGpwRThPZnl5TUp4UlJLbVo3MUxCOHUxeUREbVBpdVQwIiwiYWxnIjoiUlMyNTYifQ.eyJzY29wZSI6ImFsdGlubjpzZXJ2aWNlb3duZXIvaW5zdGFuY2VzLndyaXRlIGFsdGlubjpzZXJ2aWNlb3duZXIvaW5zdGFuY2VzLnJlYWQiLCJpc3MiOiJodHRwczovL3Rlc3QubWFza2lucG9ydGVuLm5vLyIsImNsaWVudF9hbXIiOiJwcml2YXRlX2tleV9qd3QiLCJ0b2tlbl90eXBlIjoiQmVhcmVyIiwiZXhwIjoxNzM3ODE3NjU5LCJpYXQiOjE3Mzc4MTc1MzksImNsaWVudF9pZCI6IjA0NGY1MDQwLTU0ZTMtNGEyNy1hMjIxLWE4NTE0ZmQzMGNhOSIsImp0aSI6IlVVVUZ3LU5KZk11R29kOUJsT0pJaGVUalA0YmN3Vzl3aF9kLUJDWm05dE0iLCJjb25zdW1lciI6eyJhdXRob3JpdHkiOiJpc282NTIzLWFjdG9yaWQtdXBpcyIsIklEIjoiMDE5Mjo5OTE4MjU4MjcifX0.t-STvjL2uSFqg_BFtopLenq3hVjZV1_nzkUXh6LxSj8FOGC8OTvtjmIZtOyg1ZHGC3J6M4ZF3QXCHVmZYRl_rXIAU4u8_xG6_HZMuIet9WcoBEadCYAJb-LQEQwvifMyUnwtwMjbtcurh8Wuj6h6lCidsfm2qUC0H3A7W6AxRtXF7CzHkbfSVcK_kkUe2vUn6VLFqB6ZdC_mULonaJtBD3i6hHt7LjbO0U1GuGf-wH80QXHEEr_7qpl2m0NI4CWe_4v638myV1PQVfx5tmwrVLk4BALB1_oP0Ugbp4Wrq8TMZY0Fn4-NpTVStWh3M3pRLXZy-OsycV_GZTBWTBWZRCUtsXcVNI3roFblsqh59IIkgSYDuJXomMfxEuAVoWL20SZJt50Vy3cvJecqN6NJ0hZ4q9kpFkkXs6D3TVUiPhtl_JdrpQEN8mVyUnqo7wj1hrkfHTt6UGpGIGma1CCXjn0pfCjejrMUkpcw2AIwPRfw1syzw3IRvMKZBwcA_ORU",
                 AuthenticationTypes.ServiceOwner,
-                TokenIssuer.Maskinporten,
-                false,
                 false // we don't support raw Maskinporten tokens atm
             },
             {
-                // Maskinporten exchanged service owner token
+                "Maskinporten exchanged service owner token",
                 "eyJhbGciOiJSUzI1NiIsImtpZCI6IkQ4RDg2N0M3RDUyMTM2MEY0RjM1Q0Q1MTU4MEM0OUEwNTE2NUQ0RTEiLCJ4NXQiOiIyTmhueDlVaE5nOVBOYzFSV0F4Sm9GRmwxT0UiLCJ0eXAiOiJKV1QifQ.eyJzY29wZSI6ImFsdGlubjpzZXJ2aWNlb3duZXIvaW5zdGFuY2VzLndyaXRlIGFsdGlubjpzZXJ2aWNlb3duZXIvaW5zdGFuY2VzLnJlYWQiLCJ0b2tlbl90eXBlIjoiQmVhcmVyIiwiZXhwIjoxNzM3ODE5Mzc2LCJpYXQiOjE3Mzc4MTc1NzYsImNsaWVudF9pZCI6IjA0NGY1MDQwLTU0ZTMtNGEyNy1hMjIxLWE4NTE0ZmQzMGNhOSIsImNvbnN1bWVyIjp7ImF1dGhvcml0eSI6ImlzbzY1MjMtYWN0b3JpZC11cGlzIiwiSUQiOiIwMTkyOjk5MTgyNTgyNyJ9LCJ1cm46YWx0aW5uOm9yZyI6ImRpZ2RpciIsInVybjphbHRpbm46b3JnTnVtYmVyIjoiOTkxODI1ODI3IiwidXJuOmFsdGlubjphdXRoZW50aWNhdGVtZXRob2QiOiJtYXNraW5wb3J0ZW4iLCJ1cm46YWx0aW5uOmF1dGhsZXZlbCI6MywiaXNzIjoiaHR0cHM6Ly9wbGF0Zm9ybS50dDAyLmFsdGlubi5uby9hdXRoZW50aWNhdGlvbi9hcGkvdjEvb3BlbmlkLyIsImp0aSI6IjFmN2RlMDFhLTgyYjMtNDc3Yi04MmQzLTBiY2I5NDkzOGVjNyIsIm5iZiI6MTczNzgxNzU3Nn0.G9uZ_YK2IxUgv8ySP3zy_IG0kOO3qJtEqHPds2f3jh1_YHcQlHEnQXUecUR-xD-Qi8qtI_GEJizA3l-zXc9DLkxgv4HVamzBrOcm9aQWqd3s8_OuI1nF4WjWrcw5FHpaXl1DqbgqPQI8rxOJhmW-H4rE944TKHLwvBlsX-9brYU_CC1WfnymFwODKsGhT1hm5ljQeV6O6j0GkNsRANiQlUnIMJcMVQEBtcuHGBLeNq-u5JSXzs17GLB371IN9Jb8IoYKu7njW3-Pat-QWebDYT9jdMQHOYslr0WByTvlnhL6Z7aQ8KbllbNw3GoYOvCBphVVpmk7aaqcchUiBh30-g",
                 AuthenticationTypes.ServiceOwner,
-                TokenIssuer.Maskinporten,
-                true,
                 true
             },
             {
-                // Maskinporten for systemuser, coming from the smartcloudaltinn.azurewebsites.net/api/maskinporten test endpoint
+                "Maskinporten for systemuser, coming from the smartcloudaltinn.azurewebsites.net/api/maskinporten test endpoint",
                 "eyJraWQiOiJiZFhMRVduRGpMSGpwRThPZnl5TUp4UlJLbVo3MUxCOHUxeUREbVBpdVQwIiwiYWxnIjoiUlMyNTYifQ.eyJhdXRob3JpemF0aW9uX2RldGFpbHMiOlt7InR5cGUiOiJ1cm46YWx0aW5uOnN5c3RlbXVzZXIiLCJzeXN0ZW11c2VyX29yZyI6eyJhdXRob3JpdHkiOiJpc282NTIzLWFjdG9yaWQtdXBpcyIsIklEIjoiMDE5MjozMTA3MDI2NDEifSwic3lzdGVtdXNlcl9pZCI6WyJmOTUwZGRhZS0wNmMzLTRiNTctYjk0MC03MDI0MTdhOTBkZjAiXSwic3lzdGVtX2lkIjoiOTkxODI1ODI3X3NtYXJ0Y2xvdWQiLCJleHRlcm5hbFJlZiI6ImVkMWMzOGY0LWY1MjgtNGVmMS04NjUyLWIxYWViODU2M2RmZSJ9XSwic2NvcGUiOiJhbHRpbm46c3lzdGVtYnJ1a2VyLmRlbW8iLCJpc3MiOiJodHRwczovL3Rlc3QubWFza2lucG9ydGVuLm5vLyIsImNsaWVudF9hbXIiOiJwcml2YXRlX2tleV9qd3QiLCJ0b2tlbl90eXBlIjoiQmVhcmVyIiwiZXhwIjoxNzM3ODEzMzk4LCJpYXQiOjE3Mzc4MTMyNzgsImNsaWVudF9pZCI6ImEyZWQ3MTJkLTQxNDQtNDQ3MS04MzlmLTgwYWU0YTY4MTQ2YiIsImp0aSI6InZrWFlhNGxIR2lyOFFpcGVtc1dvdnNUMzdIci10ZExOaTYyODlTajVzU1UiLCJjb25zdW1lciI6eyJhdXRob3JpdHkiOiJpc282NTIzLWFjdG9yaWQtdXBpcyIsIklEIjoiMDE5Mjo5OTE4MjU4MjcifX0.b3JozeLFCBn76a703n1ZqbjqHaFaaCadpZb3T0cuqJvLnELEjiOKXvwSI1kuqnpqfEqxEX1UyBIyJh-rvIOZ-B7dXj1usWoh-oWofvENT0AzJcwpPrhuBBo-ZPoCtTVIJraWBJfYbjEFfajfFZdz0D_poz2i5MbJO9mSn5FMAEMdzmjZSA7O9n8Y02uApN31B3pHlKpqIEUK1HhxGl_z8_rzcAcbs2uOKUxVCK_vnEMk3XpcaEDsk0hr-ohkALshWYVUZCxzl7MzJ2wFhyr9JZqSLSV-dS_WY09cwUA-I1dyIlQE1LW1Ye4Ow5xExArBO8UT3sB-q23EqRY07PC1lh-YdFB1rR1pO6pklnQdz8zPzyrUYYcxlQQDVTRVjRgZcF43TMxQIUmAB0LG6QvP8oRp8SV4oAAK9ZB_fCVkwd8gbVwvVIhuQdPEA6aUoV8mPRPz1IW-eVi-XXEQdkOC8OArNQd92y5DiEQE2puZI1nUmXFwypltks-3Xjam6-_5",
                 AuthenticationTypes.SystemUser,
-                TokenIssuer.Maskinporten,
-                false,
                 true
             },
             {
-                // Exchanged Maskinporten for systemuser, coming from the smartcloudaltinn.azurewebsites.net/api/maskinporten test endpoint
+                "Exchanged Maskinporten for systemuser, coming from the smartcloudaltinn.azurewebsites.net/api/maskinporten test endpoint",
                 "eyJhbGciOiJSUzI1NiIsImtpZCI6IkQ4RDg2N0M3RDUyMTM2MEY0RjM1Q0Q1MTU4MEM0OUEwNTE2NUQ0RTEiLCJ4NXQiOiIyTmhueDlVaE5nOVBOYzFSV0F4Sm9GRmwxT0UiLCJ0eXAiOiJKV1QifQ.eyJhdXRob3JpemF0aW9uX2RldGFpbHMiOnsidHlwZSI6InVybjphbHRpbm46c3lzdGVtdXNlciIsInN5c3RlbXVzZXJfb3JnIjp7ImF1dGhvcml0eSI6ImlzbzY1MjMtYWN0b3JpZC11cGlzIiwiSUQiOiIwMTkyOjMxMDcwMjY0MSJ9LCJzeXN0ZW11c2VyX2lkIjpbImY5NTBkZGFlLTA2YzMtNGI1Ny1iOTQwLTcwMjQxN2E5MGRmMCJdLCJzeXN0ZW1faWQiOiI5OTE4MjU4Mjdfc21hcnRjbG91ZCIsImV4dGVybmFsUmVmIjoiZWQxYzM4ZjQtZjUyOC00ZWYxLTg2NTItYjFhZWI4NTYzZGZlIn0sInNjb3BlIjoiYWx0aW5uOnN5c3RlbWJydWtlci5kZW1vIiwidG9rZW5fdHlwZSI6IkJlYXJlciIsImV4cCI6MTczNzgxNTEyMCwiaWF0IjoxNzM3ODEzMzIwLCJjbGllbnRfaWQiOiJhMmVkNzEyZC00MTQ0LTQ0NzEtODM5Zi04MGFlNGE2ODE0NmIiLCJjb25zdW1lciI6eyJhdXRob3JpdHkiOiJpc282NTIzLWFjdG9yaWQtdXBpcyIsIklEIjoiMDE5Mjo5OTE4MjU4MjcifSwidXJuOmFsdGlubjpvcmdOdW1iZXIiOiI5OTE4MjU4MjciLCJ1cm46YWx0aW5uOmF1dGhlbnRpY2F0ZW1ldGhvZCI6Im1hc2tpbnBvcnRlbiIsInVybjphbHRpbm46YXV0aGxldmVsIjozLCJpc3MiOiJodHRwczovL3BsYXRmb3JtLnR0MDIuYWx0aW5uLm5vL2F1dGhlbnRpY2F0aW9uL2FwaS92MS9vcGVuaWQvIiwianRpIjoiMTliNGUyOWItNjRiMi00YTUyLWFlNDAtZTc3Njg1MjMxM2YyIiwibmJmIjoxNzM3ODEzMzIwfQ.m-5x5GscJYjD_rCnd0EWQBKSwymPyN4AE9Yti7bjeUuvAVyiPdtske9fahEGONVUvY9Pk2bDjdNOfAeaOPMHB2skEqMNYGqxxQRgBraZawAPFuQSSufTgkt5dEgOAymUam2x9NQ_giFPPtaWHez23rtDGSGAXkMaIBWe93XbO-z_4dFcyDEXvmK4SfkLeJWxizhugVcwwDstYrN7VlcQz3gBGuGKIcC8lnBPIT8u7tmJKt0JQ2L9oZQkGjatUu-4_qlcfzvDr40ojyNtOszoc1UblNRkTI-QxB2yRuvG9a7wMtej_Xgo9Pst8cz4MfBSxOq-2U_wHX95-d5GTLnFfw",
                 AuthenticationTypes.SystemUser,
-                TokenIssuer.Maskinporten,
-                true,
+                true
+            },
+            {
+                "GetTestUserToken in localtest",
+                "eyJhbGciOiJSUzI1NiIsImtpZCI6IjQ4Q0VFNjAzMzEwMkYzMjQzMTk2NDc4QUYwNkZCNDNBMTc2NEQ4NDMiLCJ4NXQiOiJTTTdtQXpFQzh5UXhsa2VLOEctME9oZGsyRU0iLCJ0eXAiOiJKV1QifQ.eyJuYW1laWQiOiIxMDA0IiwidXJuOmFsdGlubjp1c2VyaWQiOiIxMDA0IiwidXJuOmFsdGlubjp1c2VybmFtZSI6IlNlbHZSZWdpc3RyZXJ0IiwidXJuOmFsdGlubjpwYXJ0eWlkIjo1MTAwMDQsInVybjphbHRpbm46YXV0aGxldmVsIjoyLCJuYmYiOjE3NDI5MDQxMjQsImV4cCI6MTc0Mjk2MTcyNCwiaWF0IjoxNzQyOTA0MTI0fQ.XxEHCiloqnZmn8gN83Cyde8OK7BrqAhpkxTXpTFrHoumaKA63sqvOZbxbr1pakj8iNWRI7D53R4tskHRxamuHk-6A5-UEpZv9i3lukOpaqtZhPO006VFTTxlRjp5gSrX4sG6DoDBTQrHfchiAleLEmGxxtzvtIlmaehz0HhJcCLZ3Ly1_3XepdSilSPAKin80Nkads7bjTqqI4UP1UZsDz4qyjF_xN7ganGZ5aEpGNbGszhsEcS-OW5QS4BrvSZh2YPpn2-LiO9iyasYR2CwY80_P1NgQZM6DTMggcE5nuYGP1jIuj7Fj2me0NOi-qzzEibD7SRvvUJuWAdJodBbzQ",
+                AuthenticationTypes.User,
+                true
+            },
+            {
+                "GetTestOrgToken in localtest",
+                "eyJhbGciOiJSUzI1NiIsImtpZCI6IjQ4Q0VFNjAzMzEwMkYzMjQzMTk2NDc4QUYwNkZCNDNBMTc2NEQ4NDMiLCJ4NXQiOiJTTTdtQXpFQzh5UXhsa2VLOEctME9oZGsyRU0iLCJ0eXAiOiJKV1QifQ.eyJ1cm46YWx0aW5uOm9yZyI6InNrZCIsInVybjphbHRpbm46YXV0aGxldmVsIjozLCJ1cm46YWx0aW5uOnNjb3BlIjoiYWx0aW5uOnNlcnZpY2Vvd25lci9pbnN0YW5jZXMud3JpdGUgYWx0aW5uOnNlcnZpY2Vvd25lci9pbnN0YW5jZXMucmVhZCIsInVybjphbHRpbm46b3JnTnVtYmVyIjoiOTc0NzYxMDc2IiwibmJmIjoxNzQyOTA2NDYyLCJleHAiOjE3NDI5NjQwNjIsImlhdCI6MTc0MjkwNjQ2Mn0.UJSqOGZG3xCMH7KUx148NhPvARATpI2yzK4RxxL_Fe2XqtEaRJQX6IBMTbfu-WLdHZ8l4m7Epk7cJwxE1ek3BP1XMayq95rrNIwjcXoicDBfLUb7Ug2II89jKd-pCinuZGT8ai4LmKz8ydPAXgq6fV1ExctsqcTQhQIbgDYa9TFVKInpmv3Mj9f7vdiJKdfuxE_rHOzu8cqUVECLvK4AU602pnw9JvclAXa53hBkDlHmNv8-JzVUdqkEMBiPrWklWDZqHNZuVkKrrvS_5-dS9Z6rjZ9IcnMZ2fSRNoTHO85qtVqGzTzLsN0QjRXOYGk_mZVD4LVjOp7JBDuWqcpefQ",
+                AuthenticationTypes.ServiceOwner,
+                true
+            },
+            {
+                "GetTestSystemUserToken in localtest",
+                "eyJhbGciOiJSUzI1NiIsImtpZCI6IjQ4Q0VFNjAzMzEwMkYzMjQzMTk2NDc4QUYwNkZCNDNBMTc2NEQ4NDMiLCJ4NXQiOiJTTTdtQXpFQzh5UXhsa2VLOEctME9oZGsyRU0iLCJ0eXAiOiJKV1QifQ.eyJ0b2tlbl90eXBlIjoiQmVhcmVyIiwic2NvcGUiOiJhbHRpbm46aW5zdGFuY2VzLnJlYWQgYWx0aW5uOmluc3RhbmNlcy53cml0ZSIsImNsaWVudF9pZCI6Ijc2Yzg2NTE1LTkwN2ItNDZkYy1iNGYwLWZhMDc4MzRjYTY0MiIsImp0aSI6IjIzYjA4MTkzLTU5NWUtNDFhYS1iODUyLTlmNzAwZTA0MjhjMiIsInVybjphbHRpbm46b3JnTnVtYmVyIjoiOTEzMzEyNDY1IiwidXJuOmFsdGlubjphdXRoZW50aWNhdGVtZXRob2QiOiJtYXNraW5wb3J0ZW4iLCJ1cm46YWx0aW5uOmF1dGhsZXZlbCI6IjMiLCJhdXRob3JpemF0aW9uX2RldGFpbHMiOnsidHlwZSI6InVybjphbHRpbm46c3lzdGVtdXNlciIsInN5c3RlbXVzZXJfaWQiOlsiZDExMWRiYWItZDYxOS00ZjE1LWJmMjktNThmZTU3MGE5YWU2Il0sInN5c3RlbV9pZCI6IjkxMzMxMjQ2NV9zYnMiLCJzeXN0ZW11c2VyX29yZyI6eyJhdXRob3JpdHkiOiJpc282NTIzLWFjdG9yaWQtdXBpcyIsIklEIjoiMDE5Mjo5NTA0NzQwODQifX0sImNvbnN1bWVyIjp7ImF1dGhvcml0eSI6ImlzbzY1MjMtYWN0b3JpZC11cGlzIiwiSUQiOiIwMTkyOjkxMzMxMjQ2NSJ9LCJleHAiOjE3NDI5NjQ0NTQsImlhdCI6MTc0MjkwNjg1NCwibmJmIjoxNzQyOTA2ODU0fQ.nzWAs4U0u1L6m8xVlzX1S0cN45H690Aix2V4HIbqSPr5_m8fcE2FeZ3X1CP7WHk1L5VLjfJH0VRr5ODW_V_Xce2t0Q_64KpDauelDENRIrR9f4LwZHtPu0y6xMOjE3GBd901deiqqBizeVLKXRrme9e-CWifGAVAdgxFBBr7SHxAkC6WKCATfrISlKf8JAWHCkzy_UmPNGmJ3aIG0INYk8UXIJL7DJAQl5yO5hJOY4OCo9TSGT8MicNRQXZC-Naok8NnSctDWX-1MFi98-04SknvjElHbh2pZy-8b4RW-T_RCzRSSJog3AzNCHUuABTnWRHpmqudRAb-X9eU7StdeA",
+                AuthenticationTypes.SystemUser,
+                true
+            },
+            {
+                "Altinn-Test-Tools GetPersonalToken",
+                "eyJhbGciOiJSUzI1NiIsImtpZCI6IkQ4RDg2N0M3RDUyMTM2MEY0RjM1Q0Q1MTU4MEM0OUEwNTE2NUQ0RTEiLCJ0eXAiOiJKV1QiLCJ4NWMiOiJEOEQ4NjdDN0Q1MjEzNjBGNEYzNUNENTE1ODBDNDlBMDUxNjVENEUxIn0.eyJ1cm46YWx0aW5uOmF1dGhlbnRpY2F0ZW1ldGhvZCI6Ik5vdERlZmluZWQiLCJ1cm46YWx0aW5uOmF1dGhsZXZlbCI6IjMiLCJjbGllbnRfYW1yIjoidmlya3NvbWhldHNzZXJ0aWZpa2F0IiwicGlkIjoiMDI4MjgyOTgzMzIiLCJ0b2tlbl90eXBlIjoiQmVhcmVyIiwiY2xpZW50X2lkIjoiYWNkZGQxZDktYjYyOC00MTlkLTkxM2ItNjlmOGQ5NzA5MzNjIiwiYWNyIjoiaWRwb3J0ZW4tbG9hLXN1YnN0YW50aWFsIiwic2NvcGUiOiJhbHRpbm46aW5zdGFuY2VzLnJlYWQgYWx0aW5uOmluc3RhbmNlcy53cml0ZSIsImV4cCI6MTc0MjkwNzA3NCwiaWF0IjoxNzQyOTAzNDc0LCJjbGllbnRfb3Jnbm8iOiI5OTE4MjU4MjciLCJjb25zdW1lciI6eyJhdXRob3JpdHkiOiJpc282NTIzLWFjdG9yaWQtdXBpcyIsIklEIjoiMDE5Mjo5OTE4MjU4MjcifSwiaXNzIjoiaHR0cHM6Ly9wbGF0Zm9ybS50dDAyLmFsdGlubi5uby9hdXRoZW50aWNhdGlvbi9hcGkvdjEvb3BlbmlkLyIsImFjdHVhbF9pc3MiOiJhbHRpbm4tdGVzdC10b29scyIsIm5iZiI6MTc0MjkwMzQ3NCwibmFtZWlkIjoxNjA4NzIsInVybjphbHRpbm46dXNlcmlkIjoxNjA4NzIsInVybjphbHRpbm46cGFydHlpZCI6NTE4MjkzMzZ9.K8YnlFuHvoWBFEMKyZdGdaMgij6hewzD_-8jxPUMtJ_defkqwPbduG5AsdC2XCo1wnj3fgIPUuygz-tE3XPtrEGUadFjp_nOrJ1KgfBrwJsbNBWHmDIBikhF0JRnK7AcWvcR8akGp92IZEARz6P20uDvcDSeAmwt4DI7jbgOm1gHXUzzm74CikUd-yXegsN3TbTHNQB8y-wErlfvWahgOGP7KfLQ5aMX6xbIyAbcqQJb6wjyTcVfgmgDnVqbOnzv7YrBd-s3MQTwydyKFqiOsJqE6OZa40SOaj1RBPvNto50jgaPGuaUzrZwNpxCe0JXNLObFY5UoGcDPTUAUSlQkw",
+                AuthenticationTypes.User,
+                true
+            },
+            {
+                "Altinn-Test-Tools GetEnterpriseToken",
+                "eyJhbGciOiJSUzI1NiIsImtpZCI6IkQ4RDg2N0M3RDUyMTM2MEY0RjM1Q0Q1MTU4MEM0OUEwNTE2NUQ0RTEiLCJ0eXAiOiJKV1QiLCJ4NWMiOiJEOEQ4NjdDN0Q1MjEzNjBGNEYzNUNENTE1ODBDNDlBMDUxNjVENEUxIn0.eyJzY29wZSI6ImFsdGlubjpzZXJ2aWNlb3duZXIvaW5zdGFuY2VzLnJlYWQgYWx0aW5uOnNlcnZpY2Vvd25lci9pbnN0YW5jZXMud3JpdGUiLCJ0b2tlbl90eXBlIjoiQmVhcmVyIiwiZXhwIjoxNzQyOTA5NDk3LCJpYXQiOjE3NDI5MDc2OTcsImNsaWVudF9pZCI6Ijc0M2U5MGZkLTAyMDItNDM5ZC05MzYwLTViYmZiOGU5MGYzYiIsImp0aSI6IkJIWTFzTXAxZGdCeEdOWDBjczdvUWNBdG1wVUlDdTlzY3A1dUFIY0F3T2YiLCJjb25zdW1lciI6eyJhdXRob3JpdHkiOiJpc282NTIzLWFjdG9yaWQtdXBpcyIsIklEIjoiMDE5Mjo5OTE4MjU4MjcifSwidXJuOmFsdGlubjpvcmdOdW1iZXIiOiI5OTE4MjU4MjciLCJ1cm46YWx0aW5uOmF1dGhlbnRpY2F0ZW1ldGhvZCI6Im1hc2tpbnBvcnRlbiIsInVybjphbHRpbm46YXV0aGxldmVsIjozLCJpc3MiOiJodHRwczovL3BsYXRmb3JtLnR0MDIuYWx0aW5uLm5vL2F1dGhlbnRpY2F0aW9uL2FwaS92MS9vcGVuaWQvIiwiYWN0dWFsX2lzcyI6ImFsdGlubi10ZXN0LXRvb2xzIiwibmJmIjoxNzQyOTA3Njk3LCJ1cm46YWx0aW5uOm9yZyI6ImRpZ2RpciJ9.YOX4cViSE1KG_sf3alCkR-aXDOJu1R850OS6fBBu7HYDitTa9DO4aoISeu42NzAjxMcpBee1r3wsg2n13cdAOs_Ab2BH385u_1EN-afXZURx9OjMr2SyWfDvVIEYGatiqpNB7pFf1zek8dJYRQfo3aenfOGuJTszHK0HAY_S7U2_ziMdXMWTUKlChel_lsGb40kUuTHLcUHwl5b10efU4dv-QZsj1PM_QHYDLikd6mCxS2KbqiAutcpdsv2zNgmh4uwXuntXvFF9X8oK0bkLlX8nNGvcWCsy9oRgLtq2y8cWUoVU89FgFR2NaHaEIdXIUwTCrxFzdIWZjEkMR1RYag",
+                AuthenticationTypes.ServiceOwner,
+                true
+            },
+            {
+                "Altinn-Test-Tools GetSystemUserToken",
+                "eyJhbGciOiJSUzI1NiIsImtpZCI6IkQ4RDg2N0M3RDUyMTM2MEY0RjM1Q0Q1MTU4MEM0OUEwNTE2NUQ0RTEiLCJ0eXAiOiJKV1QiLCJ4NWMiOiJEOEQ4NjdDN0Q1MjEzNjBGNEYzNUNENTE1ODBDNDlBMDUxNjVENEUxIn0.eyJpc3MiOiJodHRwczovL3BsYXRmb3JtLnR0MDIuYWx0aW5uLm5vL2F1dGhlbnRpY2F0aW9uL2FwaS92MS9vcGVuaWQvIiwic2NvcGUiOiJhbHRpbm46aW5zdGFuY2VzLnJlYWQgYWx0aW5uOmluc3RhbmNlcy53cml0ZSIsImNsaWVudF9pZCI6IjIyNzE0ZmU4LWNkZmEtNDIwMC04NzYwLTRhYzIzODA0YWM4NSIsImNvbnN1bWVyIjp7ImF1dGhvcml0eSI6ImlzbzY1MjMtYWN0b3JpZC11cGlzIiwiSUQiOiIwMTkyOjk5MTgyNTgyNyJ9LCJleHAiOjE3NDI5MDg3NTgsImlhdCI6MTc0MjkwNjk1OCwianRpIjoiYVkwcDJHelo5cFgycU16ZGdHOEZVUGFxaDRERHhoWS1DVDl2eGxkWDVSSCIsImF1dGhvcml6YXRpb25fZGV0YWlscyI6W3sidHlwZSI6InVybjphbHRpbm46c3lzdGVtdXNlciIsInN5c3RlbXVzZXJfaWQiOlsiZjU4ZmUxNjYtYmMyMi00ODk5LWJlYjctYzNlOGUzMzMyZjQzIl0sInN5c3RlbXVzZXJfb3JnIjp7ImF1dGhvcml0eSI6ImlzbzY1MjMtYWN0b3JpZC11cGlzIiwiSUQiOiIwMTkyOjk5MTgyNTgyNyJ9LCJzeXN0ZW1faWQiOiI1M2U2M2ExOC04YWNhLTQ3YTgtODkzZi1hNjIzZTk2NzE1YmIifV0sInVybjphbHRpbm46YXV0aGVudGljYXRlbWV0aG9kIjoibWFza2lucG9ydGVuIiwidXJuOmFsdGlubjphdXRobGV2ZWwiOjMsInRva2VuX3R5cGUiOiJCZWFyZXIiLCJuYmYiOjE3NDI5MDY5NTgsImFjdHVhbF9pc3MiOiJhbHRpbm4tdGVzdC10b29scyJ9.bVcje62YxmJ8O2Ddc46lNypolarEhWNJdG7UsyXdGMlggOHPXo3tTbKjwiRH7e0zkc4qsKqoVvptA64Sp7Qq5rhZZMAU1n_UEpXHXgrlmFCVzE0YQy2EZQtDSPMDZuXAgNIhqe0uHJXRHjQKvA2kuTzKrYD7qT6ixasX13RTd8J_g0Cn_-lmrkVUSHX08cdRmvxqEqyplo6o5Gfn3HcPZE4DwK4lFwUvc0ME7byTluMk3gGs-wdVVI7jkqRxmvb_vns5oMvRlAbeMqQi3TpRPxVA3vv48iUTqT3soecP30MfFayzGLk_y05e5rTRCfwEf9yofd9qTi-IXGpEYTP6lg",
+                AuthenticationTypes.SystemUser,
                 true
             },
         };
 
-    private Authenticated Parse(JwtSecurityToken jwtToken, string token, AuthenticationTypes type)
-    {
-        string ReadClaim(string claimType)
-        {
-            var claim = jwtToken.Claims.Single(c => c.Type == claimType);
-            Assert.NotNull(claim.Value);
-            return claim.Value;
-        }
-
-        int ReadClaimInt(string claimType)
-        {
-            var claim = jwtToken.Claims.Single(c => c.Type == claimType);
-            Assert.NotNull(claim.Value);
-            return int.Parse(claim.Value, CultureInfo.InvariantCulture);
-        }
-
-        Authenticated auth;
-        Party party;
-
-        switch (type)
-        {
-            case AuthenticationTypes.User:
-                party = new Party()
-                {
-                    PartyId = ReadClaimInt(AltinnCoreClaimTypes.PartyID),
-                    PartyTypeName = PartyType.Person,
-                    OrgNumber = null,
-                    SSN = "12345678901",
-                    Name = "Test Testesen",
-                };
-                auth = Authenticated.From(
-                    tokenStr: token,
-                    isAuthenticated: true,
-                    appMetadata: TestAuthentication.NewApplicationMetadata("digdir"),
-                    getSelectedParty: () => ReadClaim(AltinnCoreClaimTypes.PartyID),
-                    getUserProfile: _ =>
-                        Task.FromResult<UserProfile?>(
-                            new UserProfile
-                            {
-                                UserId = ReadClaimInt(AltinnCoreClaimTypes.UserId),
-                                PartyId = ReadClaimInt(AltinnCoreClaimTypes.PartyID),
-                                Party = party,
-                            }
-                        ),
-                    lookupUserParty: _ => Task.FromResult<Party?>(party),
-                    lookupOrgParty: _ => null!,
-                    getPartyList: _ => Task.FromResult<List<Party>?>([party]),
-                    validateSelectedParty: (_, _) => Task.FromResult<bool?>(true)
-                );
-                break;
-            default:
-                auth = Authenticated.From(
-                    tokenStr: token,
-                    isAuthenticated: true,
-                    appMetadata: TestAuthentication.NewApplicationMetadata("digdir"),
-                    getSelectedParty: () => null,
-                    getUserProfile: _ => null!,
-                    lookupUserParty: _ => null!,
-                    lookupOrgParty: _ => null!,
-                    getPartyList: _ => null!,
-                    validateSelectedParty: (_, _) => null!
-                );
-                break;
-        }
-
-        return auth;
-    }
-
     [Theory]
     [MemberData(nameof(Tokens))]
     public async Task Can_Parse_Real_Tokens(
+        string description,
         string token,
         AuthenticationTypes tokenType,
-        TokenIssuer issuer,
-        bool isExchanged,
         bool succeeds
     )
     {
@@ -184,53 +136,293 @@ bool succeeds
 
         if (!succeeds)
         {
-            Assert.ThrowsAny<Exception>(() => Parse(jwtToken, token, tokenType));
+            Assert.ThrowsAny<Exception>(() => Parse(description, jwtToken, token, tokenType));
             return;
         }
 
-        var auth = Parse(jwtToken, token, tokenType);
+        var auth = Parse(description, jwtToken, token, tokenType);
+        object? details = null;
 
         switch (tokenType)
         {
             case AuthenticationTypes.User:
                 var user = Assert.IsType<Authenticated.User>(auth);
-                Assert.Equal(issuer, auth.TokenIssuer);
-                Assert.Equal(isExchanged, auth.TokenIsExchanged);
                 Assert.Equal(token, auth.Token);
-                var details = await user.LoadDetails(validateSelectedParty: true);
-                Assert.NotNull(details);
-                // Snapshot user and details with Verify
-                await Verify(new { User = user, Details = details })
-                    .AutoVerify()
-                    .UseParameters(tokenType, issuer, isExchanged, succeeds);
+                details = await user.LoadDetails(validateSelectedParty: true);
                 break;
             case AuthenticationTypes.SelfIdentifiedUser:
-                Assert.IsType<Authenticated.SelfIdentifiedUser>(auth);
-                Assert.Equal(issuer, auth.TokenIssuer);
-                Assert.Equal(isExchanged, auth.TokenIsExchanged);
+                var selfIdentifiedUser = Assert.IsType<Authenticated.SelfIdentifiedUser>(auth);
                 Assert.Equal(token, auth.Token);
+                details = await selfIdentifiedUser.LoadDetails();
                 break;
             case AuthenticationTypes.Org:
-                Assert.IsType<Authenticated.Org>(auth);
-                Assert.Equal(issuer, auth.TokenIssuer);
-                Assert.Equal(isExchanged, auth.TokenIsExchanged);
+                var org = Assert.IsType<Authenticated.Org>(auth);
                 Assert.Equal(token, auth.Token);
+                details = await org.LoadDetails();
                 break;
             case AuthenticationTypes.ServiceOwner:
-                Assert.IsType<Authenticated.ServiceOwner>(auth);
-                Assert.Equal(issuer, auth.TokenIssuer);
-                Assert.Equal(isExchanged, auth.TokenIsExchanged);
+                var serviceOwner = Assert.IsType<Authenticated.ServiceOwner>(auth);
                 Assert.Equal(token, auth.Token);
+                details = await serviceOwner.LoadDetails();
                 break;
             case AuthenticationTypes.SystemUser:
-                Assert.IsType<Authenticated.SystemUser>(auth);
-                Assert.Equal(issuer, auth.TokenIssuer);
-                Assert.Equal(isExchanged, auth.TokenIsExchanged);
+                var systemUser = Assert.IsType<Authenticated.SystemUser>(auth);
                 Assert.Equal(token, auth.Token);
+                details = await systemUser.LoadDetails();
                 break;
             default:
                 Assert.Fail("Unknown token type: " + tokenType);
                 break;
         }
+
+        var hash = Convert.ToBase64String(XxHash128.Hash(Encoding.UTF8.GetBytes(token)));
+        await Verify(
+                new
+                {
+                    Description = description,
+                    AuthType = auth.GetType().FullName,
+                    Auth = auth,
+                    Jwt = (Dictionary<string, object>)jwtToken.Payload,
+                    Details = details,
+                }
+            )
+            .UseTextForParameters($"type={tokenType}_{hash[0..4]}")
+            .DontIgnoreEmptyCollections()
+            .DontScrubDateTimes()
+            .DontScrubGuids()
+            .AddExtraSettings(s =>
+            {
+                s.Converters.Add(new ScopesConverter());
+                s.Converters.Add(new OrganisationNumberConverter());
+            });
+    }
+
+    private sealed class ScopesConverter : WriteOnlyJsonConverter<Scopes>
+    {
+        public override void Write(VerifyJsonWriter writer, Scopes value)
+        {
+            writer.WriteValue(value.ToString());
+        }
+    }
+
+    private sealed class OrganisationNumberConverter : WriteOnlyJsonConverter<OrganisationNumber>
+    {
+        public override void Write(VerifyJsonWriter writer, OrganisationNumber value)
+        {
+            writer.WriteValue(value.Get(OrganisationNumberFormat.International));
+        }
+    }
+
+    private Authenticated Parse(string description, JwtSecurityToken jwtToken, string token, AuthenticationTypes type)
+    {
+        string ReadClaim(string key)
+        {
+            var claim = jwtToken.Payload.Single(c => c.Key == key);
+            var value = claim.Value as string;
+            Assert.NotNull(value);
+            return value;
+        }
+
+        int ReadClaimInt(string key)
+        {
+            var claim = jwtToken.Payload.Single(c => c.Key == key);
+            var value = claim.Value;
+            Assert.NotNull(value);
+            return value is string str ? int.Parse(str, CultureInfo.InvariantCulture) : (int)value;
+        }
+
+        Authenticated auth;
+        Party party;
+
+        switch (type)
+        {
+            case AuthenticationTypes.User:
+                {
+                    party = new Party()
+                    {
+                        PartyId = ReadClaimInt(AltinnCoreClaimTypes.PartyID),
+                        PartyTypeName = PartyType.Person,
+                        OrgNumber = null,
+                        SSN = "12345678901",
+                        Name = "Test Testesen",
+                    };
+                    Authenticated.Parser parse = description.Contains("localtest", StringComparison.OrdinalIgnoreCase)
+                        ? Authenticated.FromLocalTest
+                        : Authenticated.From;
+                    auth = parse(
+                        tokenStr: token,
+                        isAuthenticated: true,
+                        appMetadata: TestAuthentication.NewApplicationMetadata("digdir"),
+                        getSelectedParty: () =>
+                            ReadClaimInt(AltinnCoreClaimTypes.PartyID).ToString(CultureInfo.InvariantCulture),
+                        getUserProfile: userId =>
+                        {
+                            Assert.Equal(userId, ReadClaimInt(AltinnCoreClaimTypes.UserId));
+                            return Task.FromResult<UserProfile?>(
+                                new UserProfile
+                                {
+                                    UserId = ReadClaimInt(AltinnCoreClaimTypes.UserId),
+                                    PartyId = ReadClaimInt(AltinnCoreClaimTypes.PartyID),
+                                    Party = party,
+                                }
+                            );
+                        },
+                        lookupUserParty: partyId =>
+                        {
+                            Assert.Equal(partyId, ReadClaimInt(AltinnCoreClaimTypes.PartyID));
+                            return Task.FromResult<Party?>(party);
+                        },
+                        lookupOrgParty: null!,
+                        getPartyList: userId =>
+                        {
+                            Assert.Equal(userId, ReadClaimInt(AltinnCoreClaimTypes.UserId));
+                            return Task.FromResult<List<Party>?>([party]);
+                        },
+                        validateSelectedParty: (userId, partyId) =>
+                        {
+                            Assert.Equal(userId, ReadClaimInt(AltinnCoreClaimTypes.UserId));
+                            Assert.Equal(partyId, ReadClaimInt(AltinnCoreClaimTypes.PartyID));
+                            return Task.FromResult<bool?>(true);
+                        }
+                    );
+                }
+                break;
+            case AuthenticationTypes.SelfIdentifiedUser:
+                {
+                    party = new Party()
+                    {
+                        PartyId = ReadClaimInt(AltinnCoreClaimTypes.PartyID),
+                        PartyTypeName = PartyType.Person,
+                        OrgNumber = null,
+                        SSN = "12345678901",
+                        Name = "Test Testesen",
+                    };
+                    Authenticated.Parser parse = description.Contains("localtest", StringComparison.OrdinalIgnoreCase)
+                        ? Authenticated.FromLocalTest
+                        : Authenticated.From;
+                    auth = parse(
+                        tokenStr: token,
+                        isAuthenticated: true,
+                        appMetadata: TestAuthentication.NewApplicationMetadata("digdir"),
+                        getSelectedParty: null!,
+                        getUserProfile: userId =>
+                        {
+                            Assert.Equal(userId, ReadClaimInt(AltinnCoreClaimTypes.UserId));
+                            return Task.FromResult<UserProfile?>(
+                                new UserProfile
+                                {
+                                    UserId = ReadClaimInt(AltinnCoreClaimTypes.UserId),
+                                    PartyId = ReadClaimInt(AltinnCoreClaimTypes.PartyID),
+                                    Party = party,
+                                }
+                            );
+                        },
+                        lookupUserParty: null!,
+                        lookupOrgParty: null!,
+                        getPartyList: null!,
+                        validateSelectedParty: null!
+                    );
+                }
+                break;
+            case AuthenticationTypes.Org:
+                {
+                    auth = Authenticated.From(
+                        tokenStr: token,
+                        isAuthenticated: true,
+                        appMetadata: TestAuthentication.NewApplicationMetadata("digdir"),
+                        getSelectedParty: null!,
+                        getUserProfile: null!,
+                        lookupUserParty: null!,
+                        lookupOrgParty: orgNo =>
+                        {
+                            Assert.Equal(orgNo, ReadClaim(AltinnCoreClaimTypes.OrgNumber));
+                            return Task.FromResult<Party>(
+                                new Party
+                                {
+                                    PartyId = 1234,
+                                    PartyTypeName = PartyType.Organisation,
+                                    OrgNumber = orgNo,
+                                    SSN = null,
+                                    Name = "Test AS",
+                                }
+                            );
+                        },
+                        getPartyList: null!,
+                        validateSelectedParty: null!
+                    );
+                }
+                break;
+            case AuthenticationTypes.ServiceOwner:
+                {
+                    Authenticated.Parser parse = description.Contains("localtest", StringComparison.OrdinalIgnoreCase)
+                        ? Authenticated.FromLocalTest
+                        : Authenticated.From;
+                    auth = parse(
+                        tokenStr: token,
+                        isAuthenticated: true,
+                        appMetadata: TestAuthentication.NewApplicationMetadata("digdir"),
+                        getSelectedParty: null!,
+                        getUserProfile: null!,
+                        lookupUserParty: null!,
+                        lookupOrgParty: orgNo =>
+                        {
+                            Assert.Equal(orgNo, ReadClaim(AltinnCoreClaimTypes.OrgNumber));
+                            return Task.FromResult<Party>(
+                                new Party
+                                {
+                                    PartyId = 1234,
+                                    PartyTypeName = PartyType.Organisation,
+                                    OrgNumber = orgNo,
+                                    SSN = null,
+                                    Name = "Test AS",
+                                }
+                            );
+                        },
+                        getPartyList: null!,
+                        validateSelectedParty: null!
+                    );
+                }
+                break;
+            case AuthenticationTypes.SystemUser:
+                {
+                    Authenticated.Parser parse = description.Contains("localtest", StringComparison.OrdinalIgnoreCase)
+                        ? Authenticated.FromLocalTest
+                        : Authenticated.From;
+                    auth = parse(
+                        tokenStr: token,
+                        isAuthenticated: true,
+                        appMetadata: TestAuthentication.NewApplicationMetadata("digdir"),
+                        getSelectedParty: null!,
+                        getUserProfile: null!,
+                        lookupUserParty: null!,
+                        lookupOrgParty: orgNo =>
+                        {
+                            var claim = jwtToken.Payload.Single(c => c.Key == "authorization_details");
+                            var json = Assert.IsType<JsonElement>(claim.Value);
+                            var authDetails = AuthorizationDetailsClaim.Parse(json);
+                            var systemUserDetails = Assert.IsType<SystemUserAuthorizationDetailsClaim>(authDetails);
+                            var systemUserOrgNo = OrganisationNumber.Parse(systemUserDetails.SystemUserOrg.Id);
+                            Assert.Equal(orgNo, systemUserOrgNo.Get(OrganisationNumberFormat.Local));
+                            return Task.FromResult<Party>(
+                                new Party
+                                {
+                                    PartyId = 1234,
+                                    PartyTypeName = PartyType.Organisation,
+                                    OrgNumber = orgNo,
+                                    SSN = null,
+                                    Name = "Test AS",
+                                }
+                            );
+                        },
+                        getPartyList: null!,
+                        validateSelectedParty: null!
+                    );
+                }
+                break;
+            default:
+                throw new NotImplementedException("Unknown token type: " + type);
+        }
+
+        return auth;
     }
 }


Reviews:
user: login: github-advanced-security[bot]
state: COMMENTED
author_association: NONE
submitted_at: 2025-03-26T06:07:40Z
user: login: danielskovli
state: APPROVED
author_association: CONTRIBUTOR
submitted_at: 2025-03-26T07:21:48Z
user: login: bjorntore
state: APPROVED
author_association: CONTRIBUTOR
submitted_at: 2025-03-26T07:32:18Z

Review comments:
diff_hunk: @@ -941,7 +956,13 @@
             if (!context.UsernameClaim.IsValidString(out var usernameClaimValue))
                 throw new AuthenticationContextException("Missing username claim for self-identified user token");
 
-            return new SelfIdentifiedUser(usernameClaimValue, userId, partyId.Value, authMethodClaimValue, ref context);
+            return new SelfIdentifiedUser(
+                usernameClaimValue,
+                userId.Value,
path: src/Altinn.App.Core/Features/Auth/Authenticated.cs
user: login: github-advanced-security[bot]
body: ## Dereferenced variable may be null

Variable [userId](1) may be null at this access because it has a nullable type.

[Show more details](https://github.com/Altinn/app-lib-dotnet/security/code-scanning/1846)
created_at: 2025-03-26T06:07:40Z
author_association: NONE
diff_hunk: @@ -941,7 +956,13 @@
             if (!context.UsernameClaim.IsValidString(out var usernameClaimValue))
                 throw new AuthenticationContextException("Missing username claim for self-identified user token");
 
-            return new SelfIdentifiedUser(usernameClaimValue, userId, partyId.Value, authMethodClaimValue, ref context);
+            return new SelfIdentifiedUser(
+                usernameClaimValue,
+                userId.Value,
+                partyId.Value,
path: src/Altinn.App.Core/Features/Auth/Authenticated.cs
user: login: github-advanced-security[bot]
body: ## Dereferenced variable may be null

Variable [partyId](1) may be null at this access because it has a nullable type.

[Show more details](https://github.com/Altinn/app-lib-dotnet/security/code-scanning/1847)
created_at: 2025-03-26T06:07:40Z
author_association: NONE
diff_hunk: @@ -953,7 +974,7 @@
             selectedPartyId = selectedParty;
         }
 
-        return new User(userId, partyId.Value, authLevel, authMethodClaimValue, selectedPartyId, ref context);
+        return new User(userId.Value, partyId.Value, authLevel, authMethodClaimValue, selectedPartyId, ref context);
path: src/Altinn.App.Core/Features/Auth/Authenticated.cs
user: login: github-advanced-security[bot]
body: ## Dereferenced variable may be null

Variable [userId](1) may be null at this access because it has a nullable type.

[Show more details](https://github.com/Altinn/app-lib-dotnet/security/code-scanning/1848)
created_at: 2025-03-26T06:07:40Z
author_association: NONE
diff_hunk: @@ -971,17 +992,7 @@
     {
         if (!context.AuthorizationDetailsClaim.IsJson(out var json))
             throw new AuthenticationContextException($"Invalid authorization details claim value for token: {json}");
-        var authorizationDetails = json.Value.ValueKind switch
-        {
-            JsonValueKind.Object => JsonSerializer.Deserialize<AuthorizationDetailsClaim>(json.Value),
-            JsonValueKind.Array when json.Value.GetArrayLength() == 1 => JsonSerializer
-                .Deserialize<AuthorizationDetailsClaim[]>(json.Value)
-                ?[0],
-            _ => throw new AuthenticationContextException(
-                "Invalid authorization details claim value for systemuser token: "
-                    + context.AuthorizationDetailsClaim.Value
-            ),
-        };
+        var authorizationDetails = AuthorizationDetailsClaim.Parse(json.Value);
path: src/Altinn.App.Core/Features/Auth/Authenticated.cs
user: login: github-advanced-security[bot]
body: ## Dereferenced variable may be null

Variable [json](1) may be null at this access because it has a nullable type.

[Show more details](https://github.com/Altinn/app-lib-dotnet/security/code-scanning/1849)
created_at: 2025-03-26T06:07:40Z
author_association: NONE
diff_hunk: @@ -184,53 +136,293 @@
 
         if (!succeeds)
         {
-            Assert.ThrowsAny<Exception>(() => Parse(jwtToken, token, tokenType));
+            Assert.ThrowsAny<Exception>(() => Parse(description, jwtToken, token, tokenType));
             return;
         }
 
-        var auth = Parse(jwtToken, token, tokenType);
+        var auth = Parse(description, jwtToken, token, tokenType);
+        object? details = null;
 
         switch (tokenType)
         {
             case AuthenticationTypes.User:
                 var user = Assert.IsType<Authenticated.User>(auth);
-                Assert.Equal(issuer, auth.TokenIssuer);
-                Assert.Equal(isExchanged, auth.TokenIsExchanged);
                 Assert.Equal(token, auth.Token);
-                var details = await user.LoadDetails(validateSelectedParty: true);
-                Assert.NotNull(details);
-                // Snapshot user and details with Verify
-                await Verify(new { User = user, Details = details })
-                    .AutoVerify()
-                    .UseParameters(tokenType, issuer, isExchanged, succeeds);
+                details = await user.LoadDetails(validateSelectedParty: true);
                 break;
             case AuthenticationTypes.SelfIdentifiedUser:
-                Assert.IsType<Authenticated.SelfIdentifiedUser>(auth);
-                Assert.Equal(issuer, auth.TokenIssuer);
-                Assert.Equal(isExchanged, auth.TokenIsExchanged);
+                var selfIdentifiedUser = Assert.IsType<Authenticated.SelfIdentifiedUser>(auth);
                 Assert.Equal(token, auth.Token);
+                details = await selfIdentifiedUser.LoadDetails();
                 break;
             case AuthenticationTypes.Org:
-                Assert.IsType<Authenticated.Org>(auth);
-                Assert.Equal(issuer, auth.TokenIssuer);
-                Assert.Equal(isExchanged, auth.TokenIsExchanged);
+                var org = Assert.IsType<Authenticated.Org>(auth);
                 Assert.Equal(token, auth.Token);
+                details = await org.LoadDetails();
                 break;
             case AuthenticationTypes.ServiceOwner:
-                Assert.IsType<Authenticated.ServiceOwner>(auth);
-                Assert.Equal(issuer, auth.TokenIssuer);
-                Assert.Equal(isExchanged, auth.TokenIsExchanged);
+                var serviceOwner = Assert.IsType<Authenticated.ServiceOwner>(auth);
                 Assert.Equal(token, auth.Token);
+                details = await serviceOwner.LoadDetails();
                 break;
             case AuthenticationTypes.SystemUser:
-                Assert.IsType<Authenticated.SystemUser>(auth);
-                Assert.Equal(issuer, auth.TokenIssuer);
-                Assert.Equal(isExchanged, auth.TokenIsExchanged);
+                var systemUser = Assert.IsType<Authenticated.SystemUser>(auth);
                 Assert.Equal(token, auth.Token);
+                details = await systemUser.LoadDetails();
                 break;
             default:
                 Assert.Fail("Unknown token type: " + tokenType);
                 break;
         }
+
+        var hash = Convert.ToBase64String(XxHash128.Hash(Encoding.UTF8.GetBytes(token)));
+        await Verify(
+                new
+                {
+                    Description = description,
+                    AuthType = auth.GetType().FullName,
+                    Auth = auth,
+                    Jwt = (Dictionary<string, object>)jwtToken.Payload,
path: test/Altinn.App.Core.Tests/Features/Auth/AuthenticatedTests.cs
user: login: github-advanced-security[bot]
body: ## Useless upcast

There is no need to upcast from [JwtPayload](1) to [Dictionary<String,Object>](2) - the conversion can be done implicitly.

[Show more details](https://github.com/Altinn/app-lib-dotnet/security/code-scanning/1850)
created_at: 2025-03-26T06:07:40Z
author_association: NONE

PR comments:
user: login: sonarqubecloud[bot]
created_at: 2025-03-26T06:48:18Z
body: ## [![Quality Gate Failed](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/QualityGateBadge/qg-failed-20px.png 'Quality Gate Failed')](https://sonarcloud.io/dashboard?id=Altinn_app-lib-dotnet&pullRequest=1204) **Quality Gate failed**  
Failed conditions  
![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/failed-16px.png '') [C Reliability Rating on New Code](https://sonarcloud.io/dashboard?id=Altinn_app-lib-dotnet&pullRequest=1204) (required ≥ A)  
![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/failed-16px.png '') [B Maintainability Rating on New Code](https://sonarcloud.io/dashboard?id=Altinn_app-lib-dotnet&pullRequest=1204) (required ≥ A)  
  
[See analysis details on SonarQube Cloud](https://sonarcloud.io/dashboard?id=Altinn_app-lib-dotnet&pullRequest=1204)

##   
![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/light_bulb-16px.png '') Catch issues before they fail your Quality Gate with our IDE extension ![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/sonarlint-16px.png '') [SonarQube for IDE](https://www.sonarsource.com/products/sonarlint/features/connected-mode/?referrer=pull-request)


author_association: NONE