diff --git a/Gemfile b/Gemfile
index a667c3383..cba1a40ca 100644
--- a/Gemfile
+++ b/Gemfile
@@ -1,5 +1,6 @@
 source 'https://rubygems.org'
 
+gem 'active_model_otp', '~> 2.3', '>= 2.3.1'
 gem 'bcrypt', '~> 3.1.0'
 gem 'bootsnap', '~> 1.12.0'
 gem 'browser', '~> 5.3.0'
@@ -18,6 +19,7 @@ gem 'net-imap', require: false
 gem 'net-pop', require: false
 gem 'net-smtp', require: false
 gem 'omniauth', '~> 2.0.0'
+gem "omniauth-identity", "~> 3.0", ">= 3.0.9"
 gem 'omniauth-oauth2', '~> 1.7.0'
 gem 'omniauth-rails_csrf_protection', '~> 1.0'
 gem 'paper_trail', '~> 14.0.0'
@@ -30,6 +32,7 @@ gem 'rails', '~> 7.0.4', '>= 7.0.4.3'
 gem 'rails-i18n', '~> 7.0.0'
 gem 'redis-rails', '~> 5.0.0'
 gem 'rest-client', '~> 2.1.0'
+gem 'rqrcode', '~> 2.2'
 gem 'sassc-rails', '~> 2.1.0'
 gem 'sentry-rails', '~> 5.5'
 gem 'sentry-ruby', '~> 5.5'
diff --git a/Gemfile.lock b/Gemfile.lock
index 1d59c3a6c..11176ff40 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -46,6 +46,9 @@ GEM
       erubi (~> 1.4)
       rails-dom-testing (~> 2.0)
       rails-html-sanitizer (~> 1.1, >= 1.2.0)
+    active_model_otp (2.3.4)
+      activemodel
+      rotp (~> 6.3.0)
     activejob (7.0.4.3)
       activesupport (= 7.0.4.3)
       globalid (>= 0.3.6)
@@ -98,6 +101,7 @@ GEM
       capistrano (>= 3.9.0)
       capistrano-bundler
       sidekiq (>= 6.0)
+    chunky_png (1.4.0)
     coderay (1.1.3)
     colorize (0.8.1)
     concurrent-ruby (1.2.2)
@@ -277,6 +281,9 @@ GEM
       hashie (>= 3.4.6)
       rack (>= 1.6.2, < 3)
       rack-protection
+    omniauth-identity (3.0.9)
+      bcrypt
+      omniauth
     omniauth-oauth2 (1.7.2)
       oauth2 (~> 1.4)
       omniauth (>= 1.9, < 3)
@@ -388,6 +395,11 @@ GEM
       mime-types (>= 1.16, < 4.0)
       netrc (~> 0.8)
     rexml (3.2.5)
+    rotp (6.3.0)
+    rqrcode (2.2.0)
+      chunky_png (~> 1.0)
+      rqrcode_core (~> 1.0)
+    rqrcode_core (1.2.0)
     rspec (3.12.0)
       rspec-core (~> 3.12.0)
       rspec-expectations (~> 3.12.0)
@@ -533,6 +545,7 @@ PLATFORMS
   x86_64-linux
 
 DEPENDENCIES
+  active_model_otp (~> 2.3, >= 2.3.1)
   awesome_print
   bcrypt (~> 3.1.0)
   better_errors
@@ -564,6 +577,7 @@ DEPENDENCIES
   net-pop
   net-smtp
   omniauth (~> 2.0.0)
+  omniauth-identity (~> 3.0, >= 3.0.9)
   omniauth-oauth2 (~> 1.7.0)
   omniauth-rails_csrf_protection (~> 1.0)
   paper_trail (~> 14.0.0)
@@ -580,6 +594,7 @@ DEPENDENCIES
   rb-readline
   redis-rails (~> 5.0.0)
   rest-client (~> 2.1.0)
+  rqrcode (~> 2.2)
   rspec-rails
   rubocop (~> 1.30.0)
   rubocop-performance
diff --git a/app/assets/stylesheets/application.scss b/app/assets/stylesheets/application.scss
index 1bf012c17..477f6a9d2 100644
--- a/app/assets/stylesheets/application.scss
+++ b/app/assets/stylesheets/application.scss
@@ -77,6 +77,14 @@ a {
   }
 }
 
+.identity-input {
+  min-width: 18rem;
+}
+
+.qr-code {
+  max-width: 20rem;
+}
+
 .footer {
   position: absolute;
   bottom: 0;
diff --git a/app/controllers/application_controller.rb b/app/controllers/application_controller.rb
index 298cc4118..4805ebc22 100644
--- a/app/controllers/application_controller.rb
+++ b/app/controllers/application_controller.rb
@@ -1,6 +1,8 @@
 class ApplicationController < ActionController::Base
   include Pundit
 
+  protect_from_forgery with: :exception, prepend: true
+
   before_action :set_sentry_context
   before_action :set_paper_trail_whodunnit
   before_action :set_layout_flag
@@ -34,4 +36,8 @@ def set_layout_flag
     @show_navigationbar = true
     @show_extras = true
   end
+
+  def normalize_error_messages(full_messages)
+    return full_messages.map{ |message| message.downcase }.join(", ")
+  end
 end
diff --git a/app/controllers/callbacks_controller.rb b/app/controllers/callbacks_controller.rb
index 04e15c358..d725803a2 100644
--- a/app/controllers/callbacks_controller.rb
+++ b/app/controllers/callbacks_controller.rb
@@ -6,7 +6,54 @@ def amber_oauth2
       sign_in(:user, user)
       redirect_to user.roles.any? ? root_path : user_path(user.id)
     else
-      redirect_to root_path, flash: { error: 'Authentication failed' }
+      redirect_to root_path, flash: { error: 'Inloggen gefaald.' }
+    end
+  end
+
+  def identity
+    user = User.from_omniauth_inspect(request.env['omniauth.auth'])
+    
+    if user.persisted?
+      identity = Identity.find_by(user_id: user.id)
+      if user.deactivated
+        render(json: { state: "password_prompt", error_message: "Uw account is gedeactiveerd, dus inloggen is niet mogelijk." })
+      elsif identity && identity.otp_enabled
+        one_time_password = params[:verification_code]
+        if !one_time_password
+          # OTP code not present, so request it
+          render(json: { state: "otp_prompt" })
+        elsif identity.authenticate_otp(one_time_password)
+          # OTP code correct
+          sign_in(:user, user)
+          render(json: { state: "logged_in", redirect_url: user.roles.any? ? root_path : user_path(user.id) })
+        else
+          # OTP code incorrect
+          render(json: { state: "otp_prompt", error_message: "Inloggen mislukt. De authenticatiecode is incorrect." })
+        end
+      elsif identity
+        # no OTP enabled
+        sign_in(:user, user)
+        render(json: { state: "logged_in", redirect_url: user.roles.any? ? root_path : user_path(user.id) })
+      else
+        # identity does not exist, should not be possible
+        render(json: { state: "password_prompt", error_message: "Inloggen mislukt door een error. Herlaad de pagina en probeer het nog een keer. <br/><i>Werkt het na een paar keer proberen nog steeds niet? Neem dan contact op met de ICT-commissie.</i>" })
+      end
+    else
+      render(json: { state: "password_prompt", error_message: "Inloggen mislukt. De ingevulde gegevens zijn incorrect." })
+    end
+  end
+
+  def failure
+    error_message = "Inloggen mislukt."
+    if request.env['omniauth.error.strategy'].instance_of? OmniAuth::Strategies::Identity
+      if request.env['omniauth.error.type'].to_s == "invalid_credentials"
+        error_message << " De ingevulde gegevens zijn incorrect."
+      else
+        error_message << " #{request.env['omniauth.error.type'].to_s}"
+      end
+      render(json: { state: "password_prompt", error_message: error_message })
+    else
+      render(json: { state: "password_prompt", error_message: error_message })
     end
   end
 end
diff --git a/app/controllers/identities_controller.rb b/app/controllers/identities_controller.rb
new file mode 100644
index 000000000..30ad2cb28
--- /dev/null
+++ b/app/controllers/identities_controller.rb
@@ -0,0 +1,208 @@
+class IdentitiesController < ApplicationController
+
+  def omniauth_redirect_login
+    redirect_to '/identities/login'
+  end
+
+  def omniauth_redirect_register
+    redirect_to :root
+  end
+
+  def create
+    begin
+      user_id = params.require(:user_id)
+
+      user = User.find_by(id: user_id)
+      if !user
+        raise "uw account bestaat niet"
+      elsif user.deactivated
+        raise "uw account is gedeactiveerd"
+      elsif user.identity
+        raise "uw account is al geactiveerd"
+      end
+
+      activation_token = params.require(:activation_token)
+      if user.activation_token != activation_token || user.activation_token_valid_till.try(:<, Time.zone.now)
+        new_activation_link_url = Identity.new_activation_link_url(user.id)
+        raise "de activatielink is verlopen of ongeldig. Een nieuwe activatielink kan worden aangevraagd via <a href='#{new_activation_link_url}'>#{new_activation_link_url}</a>"
+      end
+
+      identity = Identity.new(permitted_attributes.merge(user_id: user_id))
+      if !identity.save
+        raise normalize_error_messages(identity.errors.full_messages)
+      end
+
+      user.reload
+      user.activation_token = nil
+      user.activation_token_valid_till = nil
+      if params[:user] && params[:user][:email]
+        if user.email # should not happen as the form only shows the email field when the user has no email
+          identity.destroy
+          raise "u heeft al een e-mailadres, dus u moet dat veld leeg laten"
+        end
+        user.email = params[:user][:email]
+      end
+      if !user.save
+        identity.destroy
+        raise normalize_error_messages(user.errors.full_messages)
+      end
+
+      sign_in(:user, user)
+      redirect_to user.roles.any? ? root_path : user_path(user.id), flash: { success: 'Account geactiveerd!' }
+    rescue ActionController::ParameterMissing => e
+      param_name = I18n.t("activerecord.attributes.identity.#{e.param}")
+      redirect_back_or_to :root, flash: { error: "Account activeren mislukt: #{param_name.downcase} is niet aanwezig." }
+    rescue StandardError => e
+      redirect_back_or_to :root, flash: { error: "Account activeren mislukt: #{e.message}." }
+    end
+  end
+
+  def update_password
+    @identity = Identity.find(params[:id])
+    authorize @identity
+
+    begin
+      new_attributes = params.require(:identity).permit(%i[password password_confirmation])
+
+      if !@identity.authenticate(params.require(:identity)[:old_password])
+        raise "het oude wachtwoord is fout of niet opgegeven"
+      elsif new_attributes[:password].blank? # identity.update(...) just does nothing instead of showing error, so we show error manually
+        raise "wachtwoord moet opgegeven zijn"
+      elsif !@identity.update(new_attributes)
+        raise normalize_error_messages(@identity.errors.full_messages)
+      end
+
+      redirect_to user_path(@identity.user_id), flash: { success: "Wachtwoord gewijzigd." }
+    rescue ActionController::ParameterMissing => e
+      redirect_back_or_to :root, flash: { error: "Wachtwoord wijzigen mislukt: identity is niet aanwezig." }
+    rescue StandardError => e
+      redirect_back_or_to :root, flash: { error: "Wachtwoord wijzigen mislukt: #{e.message}." }
+    end
+  end
+
+  def enable_otp
+    @identity = Identity.find(params[:id])
+    authorize @identity
+
+    if @identity.authenticate_otp(params.require(:verification_code))
+      @identity.update(otp_enabled: true)
+      flash[:success] = 'Two-factor-authenticatie aangezet!'
+    else
+      flash[:error] = "Two-factor-authenticatie aanzetten mislukt: de verificatie token is ongeldig."
+    end
+    
+    redirect_to user_path(@identity.user_id)
+  end
+
+  def disable_otp
+    @identity = Identity.find(params[:id])
+    authorize @identity
+
+    @identity.update(otp_enabled: false)
+    
+    redirect_to user_path(@identity.user_id)
+  end
+
+  def activate_account
+    @user_id = params[:user_id]
+    @activation_token = params[:activation_token]
+    @user = User.find_by(id: @user_id)
+    @request_email = @user&.email == nil
+    @identity = Identity.new()
+  end
+
+  def new_activation_link
+    begin
+      user = User.find_by(id: params.require(:user_id))
+      if !user
+        raise "uw account bestaat niet"
+      elsif user.deactivated
+        raise "uw account is gedeactiveerd"
+      elsif user.identity
+        raise "uw account is al geactiveerd"
+      elsif !user.email
+        raise "uw account heeft geen emailadres"
+      end
+
+      user.update(activation_token: SecureRandom.urlsafe_base64, activation_token_valid_till: 1.day.from_now)
+      UserMailer.new_activation_link_email(user).deliver_later
+      @message = "Er is een nieuwe activatielink voor uw account verstuurd naar uw emailadres."
+    rescue ActionController::ParameterMissing => e
+      param_name = I18n.t("activerecord.attributes.identity.#{e.param}")
+      @message = "Uw kunt geen nieuwe activatielink aanvragen: #{param_name.downcase} is niet aanwezig."
+    rescue StandardError => e
+      @message = "Uw kunt geen nieuwe activatielink aanvragen: #{e.message}."
+    end
+  end
+
+  def forgot_password
+    begin
+      identity = Identity.find_by(username: params.require(:username))
+      if !identity
+        raise "uw gebruikersnaam bestaat niet"
+      end
+
+      if !identity.user.email
+        raise "uw account heeft geen emailadres"
+      end
+
+      identity.user.update(activation_token: SecureRandom.urlsafe_base64, activation_token_valid_till: 1.day.from_now)
+      UserMailer.forgot_password_email(identity.user).deliver_later
+      redirect_to :root, flash: { success: 'Een link om uw wachtwoord te resetten is verstuurd naar uw emailadres.' }
+    rescue ActionController::ParameterMissing => e
+      param_name = I18n.t("activerecord.attributes.identity.#{e.param}")
+      redirect_back_or_to forgot_password_view_identities_path, flash: { error: "Account activeren mislukt: #{param_name.downcase} is niet aanwezig." }
+    rescue StandardError => e
+      redirect_back_or_to forgot_password_view_identities_path, flash: { error: "Account activeren mislukt: #{e.message}." }
+    end
+  end
+
+  def reset_password_view
+    @activation_token = params[:activation_token]
+  end
+
+  def reset_password
+    begin
+      identity = Identity.find_by(id: params.require(:id))
+      if !identity
+        raise "uw account bestaat niet"
+      end
+
+      user = identity.user
+      activation_token = params.require(:activation_token)
+      if user.activation_token != activation_token || user.activation_token_valid_till.try(:<, Time.zone.now)
+        forgot_password_url = Identity.forgot_password_url
+        raise "de resetlink is verlopen of ongeldig. Een nieuwe resetlink kan worden aangevraagd via <a href='#{forgot_password_url}'>#{forgot_password_url}</a>"
+      end
+      
+      if params.require(:identity)[:password].blank? # identity.update(...) just does nothing instead of showing error, so we show error manually
+        raise "wachtwoord moet opgegeven zijn"
+      elsif !identity.update(params.require(:identity).permit(%i[password password_confirmation]))
+        raise normalize_error_messages(identity.errors.full_messages)
+      end
+
+      user.update(
+        activation_token: nil,
+        activation_token_valid_till: nil
+      )
+      redirect_to login_identities_path, flash: { success: 'Wachtwoord ingesteld!' }
+    rescue ActionController::ParameterMissing => e
+      param_name = I18n.t("activerecord.attributes.identity.#{e.param}")
+      redirect_back_or_to :root, flash: { error: "Wachtwoord resetten mislukt: #{param_name.downcase} is niet aanwezig." }
+    rescue StandardError => e
+      redirect_back_or_to :root, flash: { error: "Wachtwoord resetten mislukt: #{e.message}." }
+    end
+  end
+
+  def login
+    if current_user
+      redirect_to current_user.roles.any? ? root_path : user_path(current_user.id)
+    end
+  end
+
+  private
+
+  def permitted_attributes
+    params.require(:identity).permit(%i[username password password_confirmation])
+  end
+end
diff --git a/app/controllers/users_controller.rb b/app/controllers/users_controller.rb
index 7255bf066..afcbf822b 100644
--- a/app/controllers/users_controller.rb
+++ b/app/controllers/users_controller.rb
@@ -1,28 +1,38 @@
 class UsersController < ApplicationController # rubocop:disable Metrics/ClassLength
-  before_action :authenticate_user!
+  before_action :authenticate_user!, except: %i[activate_account]
 
-  after_action :verify_authorized
+  after_action :verify_authorized, except: %i[activate_account]
 
   def index # rubocop:disable Metrics/AbcSize, Metrics/MethodLength
     authorize User
 
     @manual_users = User.manual.active.order(:name)
+    @identity_users = User.identity.active.order(:name)
     @amber_users = User.in_amber.active.order(:name)
-    @inactive_users = User.inactive.order(:name)
+    @not_activated_users = User.not_activated.order(:name)
+    @deactivated_users = User.deactivated.order(:name)
     @users_credits = User.calculate_credits
 
     @manual_users_json = @manual_users.as_json(only: %w[id name])
                                       .each { |u| u['credit'] = @users_credits.fetch(u['id'], 0) }
 
+    @identity_users_json = @identity_users.as_json(only: %w[id name])
+                                      .each { |u| u['credit'] = @users_credits.fetch(u['id'], 0) }
+
     @amber_users_json = @amber_users.as_json(only: %w[id name])
                                     .each { |u| u['credit'] = @users_credits.fetch(u['id'], 0) }
 
-    @inactive_users_json = @inactive_users.as_json(only: %w[id name])
+    @not_activated_users_json = @not_activated_users.as_json(only: %w[id name])
+                                    .each { |u| u['credit'] = @users_credits.fetch(u['id'], 0) }
+
+    @deactivated_users_json = @deactivated_users.as_json(only: %w[id name])
                                           .each { |u| u['credit'] = @users_credits.fetch(u['id'], 0) }
 
     @new_user = User.new
   end
 
+  include ActiveModel::OneTimePassword::InstanceMethodsOnActivation
+
   def show
     @user = User.includes(:credit_mutations, roles_users: :role).find(params[:id])
     authorize @user
@@ -30,6 +40,26 @@ def show
     @user_json = @user.to_json(only: %i[id name deactivated])
     @new_mutation = CreditMutation.new(user: @user)
 
+    @identity = Identity.find_by(user_id: @user.id)
+    if @identity
+      qr_code = RQRCode::QRCode.new(@identity.provisioning_uri(@identity.username, issuer: "Streepsysteem #{Rails.application.config.x.site_association}"))
+      @svg_qr_code = qr_code.as_svg(
+        color: "000",
+        shape_rendering: "crispEdges",
+        module_size: 10,
+        standalone: true,
+        use_path: true,
+        viewbox: true,
+        svg_attributes: {
+          width: "100%",
+          height: "auto",
+          class: "qr-code"
+        }
+      )
+    else
+      @identity = Identity.new
+    end
+
     @new_user = @user
   end
 
@@ -114,6 +144,39 @@ def activities # rubocop:disable Metrics/AbcSize
     render json: activities_hash
   end
 
+  def activate_account 
+    user = User.find(params.require(:id))
+    authorize user
+
+    if params[:activation_token] != nil
+      activation_token = params.require(:activation_token)
+      unless user.activation_token == activation_token &&
+            user.activation_token_valid_till.try(:>, Time.zone.now)
+        return head :not_found
+      end
+    else
+      return head :not_found
+    end
+    @identity = Identity.new(user: user)
+  end
+
+  def update_with_identity
+    @user = User.find(params[:id])
+    authorize @user
+
+    @identity = @user.identity
+    authorize @identity
+    
+    if @user.update(params.require(:user).permit(%i[email] + (current_user.treasurer? ? %i[name deactivated] : []), identity_attributes: %i[id username]))
+      flash[:success] = 'Gegevens gewijzigd'
+    else
+      flash[:error] = "Gegevens wijzigen mislukt; #{@user.errors.full_messages.join(', ')}"
+    end
+
+    redirect_to @user
+  end
+
+  
   private
 
   def send_slack_users_refresh_notification
@@ -145,6 +208,6 @@ def find_or_create_user(user_json) # rubocop:disable Metrics/AbcSize, Metrics/Me
   end
 
   def permitted_attributes
-    params.require(:user).permit(%w[name email])
+    params.require(:user).permit(%w[name email provider])
   end
 end
diff --git a/app/javascript/components/user/UsersTable.vue b/app/javascript/components/user/UsersTable.vue
index cd648a70b..436d61e99 100644
--- a/app/javascript/components/user/UsersTable.vue
+++ b/app/javascript/components/user/UsersTable.vue
@@ -1,6 +1,6 @@
 <template lang="html">
   <div class="users-table">
-    <table class="table table-striped">
+    <table class="table table-striped" v-if="users.length > 0">
       <thead>
         <tr>
           <th id="id" class="ps-4" aria-colindex="1" @click="sortUsers('id')">
@@ -39,7 +39,7 @@
       </tfoot>
     </table>
 
-    <div v-if="users.length === 0" class="text-center">
+    <div v-else class="text-center">
       <div class="">
         <em>Er zijn geen gebruikers om weer te geven</em>
       </div>
@@ -79,7 +79,7 @@ export default {
   computed: {
     total: function() {
       return this.users.map(user => user.credit)
-        .reduce((current, credit) => parseFloat(current) + parseFloat(credit));
+        .reduce((current, credit) => parseFloat(current) + parseFloat(credit), 0);
     },
 
     sortedUsers: function() {
diff --git a/app/javascript/packs/users.js b/app/javascript/packs/users.js
index 8d958d8b7..ee0d63af3 100644
--- a/app/javascript/packs/users.js
+++ b/app/javascript/packs/users.js
@@ -11,14 +11,18 @@ document.addEventListener('turbolinks:load', () => {
   var element = document.getElementById('users-index');
   if (element !== null) {
     var manual_users = JSON.parse(element.dataset.manualUsers);
+    var identity_users = JSON.parse(element.dataset.identityUsers);
     var amber_users = JSON.parse(element.dataset.amberUsers);
-    var inactive_users = JSON.parse(element.dataset.inactiveUsers);
+    var not_activated_users = JSON.parse(element.dataset.notActivatedUsers);
+    var deactivated_users = JSON.parse(element.dataset.deactivatedUsers);
     new Vue({
       el: element,
       data: () => ({
         manual_users,
+        identity_users,
         amber_users,
-        inactive_users
+        not_activated_users,
+        deactivated_users
       }),
       components: {
         UsersTable
diff --git a/app/mailers/user_mailer.rb b/app/mailers/user_mailer.rb
new file mode 100644
index 000000000..cba16231a
--- /dev/null
+++ b/app/mailers/user_mailer.rb
@@ -0,0 +1,28 @@
+class UserMailer < ApplicationMailer
+  def account_creation_email(user)
+    @user = user
+    @activate_account_url = Identity.activate_account_url(@user.id, @user.activation_token)
+    @new_activation_link_url = Identity.new_activation_link_url(@user.id)
+    @header_text = "Welkom op #{Rails.application.config.x.site_name}!"
+    @call_to_action = { text: 'Klik hier om uw account te activeren!', url: @activate_account_url }
+    mail to: user.email, subject: "Accountactivatie voor het streepsysteem van uw vereniging"
+  end
+
+  def new_activation_link_email(user)
+    @user = user
+    @activate_account_url = Identity.activate_account_url(@user.id, @user.activation_token)
+    @new_activation_link_url = Identity.new_activation_link_url(@user.id)
+    @header_text = "Welkom op #{Rails.application.config.x.site_name}!"
+    @call_to_action = { text: 'Klik hier om uw account te activeren!', url: @activate_account_url }
+    mail to: user.email, subject: "Accountactivatie voor het streepsysteem van uw vereniging"
+  end
+
+  def forgot_password_email(user)
+    @user = user
+    @username = user.identity.username
+    @reset_password_url = user.identity.reset_password_url(@user.activation_token)
+    @forgot_password_url = Identity.forgot_password_url
+    @call_to_action = { text: 'Wachtwoord herstellen!', url: @reset_password_url }
+    mail to: user.email, subject: "Wachtwoordherstel voor het streepsysteem van uw vereniging"
+  end
+end
diff --git a/app/models/identity.rb b/app/models/identity.rb
new file mode 100644
index 000000000..94fab2a0e
--- /dev/null
+++ b/app/models/identity.rb
@@ -0,0 +1,36 @@
+class Identity < OmniAuth::Identity::Models::ActiveRecord
+  has_one_time_password
+
+  belongs_to :user
+
+  validates :user, presence: true, uniqueness: true
+  validates :username, presence: true, uniqueness: true
+  validates :password, length: { minimum: 12 }, allow_nil: true # the presence of :password is already checked by omniauth-identity itself
+
+  auth_key :username    # optional: specifies the field within the model that will be used during the login process
+                        # defaults to email, but may be username, uid, login, etc.
+
+  def self.activate_account_url(user_id, activation_token)
+    params = { user_id: user_id, activation_token: activation_token }
+    default_options = Rails.application.config.action_mailer.default_url_options
+    URI::Generic.build(default_options.merge(path: '/identities/activate_account', query: params.to_query)).to_s
+  end
+
+  def self.new_activation_link_url(user_id)
+    params = { user_id: user_id }
+    default_options = Rails.application.config.action_mailer.default_url_options
+    URI::Generic.build(default_options.merge(path: '/identities/new_activation_link', query: params.to_query)).to_s
+  end
+
+  def self.forgot_password_url
+    default_options = Rails.application.config.action_mailer.default_url_options
+    URI::Generic.build(default_options.merge(path: '/identities/forgot_password')).to_s
+  end
+
+  def reset_password_url(activation_token)
+    params = { activation_token: activation_token }
+    default_options = Rails.application.config.action_mailer.default_url_options
+    URI::Generic.build(default_options.merge(path: "/identities/#{id}/reset_password", query: params.to_query)).to_s
+  end
+  
+end
diff --git a/app/models/role.rb b/app/models/role.rb
index 779a9ad66..650e43df9 100644
--- a/app/models/role.rb
+++ b/app/models/role.rb
@@ -1,7 +1,7 @@
 class Role < ApplicationRecord
   enum role_type: { treasurer: 0, main_bartender: 1 }
 
-  validates :role_type, :group_uid, presence: true
+  validates :role_type, presence: true
   has_many :roles_users, class_name: 'RolesUsers', dependent: :destroy, inverse_of: :role
   has_many :users, through: :roles_users
 
diff --git a/app/models/user.rb b/app/models/user.rb
index 04a78dc63..864567a96 100644
--- a/app/models/user.rb
+++ b/app/models/user.rb
@@ -1,5 +1,5 @@
 class User < ApplicationRecord # rubocop:disable Metrics/ClassLength
-  devise :omniauthable, omniauth_providers: [:amber_oauth2]
+  devise :omniauthable, omniauth_providers: [:amber_oauth2, :identity]
   has_many :orders, dependent: :destroy
   has_many :order_rows, through: :orders, dependent: :destroy
   has_many :credit_mutations, dependent: :destroy
@@ -11,15 +11,44 @@ class User < ApplicationRecord # rubocop:disable Metrics/ClassLength
   validates :name, presence: true
   validates :uid, uniqueness: true, allow_blank: true
   validate :no_deactivation_when_nonzero_credit
+  validates :email, format: { with: Devise.email_regexp }, allow_blank: true
+  validates :email, presence: true, if: ->(user) { !user.deactivated && user.identity.present? }
 
   scope :in_amber, (-> { where(provider: 'amber_oauth2') })
+  scope :identity, (-> { where(provider: 'identity') })
   scope :manual, (-> { where(provider: nil) })
-  scope :active, (-> { where(deactivated: false) })
-  scope :inactive, (-> { where(deactivated: true) })
+  scope :active, (-> {
+    where(deactivated: false).where('(provider IS NULL OR provider != ?) OR (provider = ? AND id IN (?))', 'identity', 'identity', Identity.select('user_id'))
+  })
+  scope :not_activated, (-> { where(deactivated: false, provider: 'identity').where('id NOT IN (?)', Identity.select('user_id')) })
+  scope :deactivated, (-> { where(deactivated: true) })
   scope :treasurer, (-> { joins(:roles).merge(Role.treasurer) })
 
+  has_one :identity, dependent: :delete
+  accepts_nested_attributes_for :identity
+
   attr_accessor :current_activity
 
+  before_save do
+    if new_record? && self.provider == 'identity'
+      self.activation_token = SecureRandom.urlsafe_base64
+      self.activation_token_valid_till = 5.day.from_now
+    end
+  end
+
+  after_save do
+    a = age
+    if self.deactivated && (new_record? || self.deactivated_previously_changed?(from: false, to: true))
+      archive!
+    end
+  end
+
+  after_create do
+    if User.identity.exists?(id: self.id)
+      UserMailer.account_creation_email(self).deliver_later
+    end
+  end
+
   def credit
     credit_mutations.sum('amount') - order_rows.sum('product_count * price_per_product')
   end
@@ -66,16 +95,18 @@ def main_bartender?
   end
 
   def update_role(groups)
-    roles_to_have = Role.where(group_uid: groups)
-    roles_users_to_have = roles_to_have.map { |role| RolesUsers.find_or_create_by(role: role, user: self) }
+    if (User.in_amber.exists?(self.id))
+      roles_to_have = Role.where(group_uid: groups)
+      roles_users_to_have = roles_to_have.map { |role| RolesUsers.find_or_create_by(role: role, user: self) }
 
-    roles_users_not_to_have = roles_users - roles_users_to_have
-    roles_users_not_to_have.map(&:destroy)
+      roles_users_not_to_have = roles_users - roles_users_to_have
+      roles_users_not_to_have.map(&:destroy)
+    end
   end
 
   def archive!
     attributes.each_key do |attribute|
-      self[attribute] = nil unless %w[deleted_at updated_at created_at provider id uid].include? attribute
+      self[attribute] = nil unless %w[deleted_at updated_at created_at provider identity id uid].include? attribute
     end
     self.name = "Gearchiveerde gebruiker #{id}"
     self.deactivated = true
@@ -98,6 +129,11 @@ def self.from_omniauth(auth) # rubocop:disable Metrics/AbcSize, Metrics/MethodLe
     user
   end
 
+  def self.from_omniauth_inspect(auth)
+    identity = Identity.find(auth.uid)
+    identity.user
+  end
+
   # :nocov:
 
   def self.full_name_from_attributes(first_name, last_name_prefix, last_name, nickname)
diff --git a/app/policies/identity_policy.rb b/app/policies/identity_policy.rb
new file mode 100644
index 000000000..fc5c211c2
--- /dev/null
+++ b/app/policies/identity_policy.rb
@@ -0,0 +1,21 @@
+class IdentityPolicy < ApplicationPolicy
+  def update?
+    record.user == user && User.exists?(id: record.user)
+  end
+
+  def update_with_identity?
+    update?
+  end
+
+  def update_password?
+    update?
+  end
+
+  def enable_otp?
+    update?
+  end
+
+  def disable_otp?
+    update?
+  end
+end
diff --git a/app/policies/user_policy.rb b/app/policies/user_policy.rb
index 80b8604e3..f7ed39b22 100644
--- a/app/policies/user_policy.rb
+++ b/app/policies/user_policy.rb
@@ -22,4 +22,8 @@ def json?
   def activities?
     user&.treasurer? || record == user
   end
+
+  def update_with_identity?
+    record == user && User.active.identity.exists?(id: record)
+  end
 end
diff --git a/app/views/identities/activate_account.html.erb b/app/views/identities/activate_account.html.erb
new file mode 100644
index 000000000..025d24477
--- /dev/null
+++ b/app/views/identities/activate_account.html.erb
@@ -0,0 +1,20 @@
+<% content_for :title, "Account activatie - #{Rails.application.config.x.site_name}" %>
+
+<div class="card w-auto position-absolute top-50 start-50 translate-middle">
+  <div class="card-header pt-3">
+    <h4 class="card-title">Account activeren</h4>
+  </div>
+  <div class="card-body px-4 py-3">
+    <%= simple_form_for @identity, url: identities_path(user_id: @user_id, activation_token: @activation_token), method: :post, wrapper: :vertical_form do |f| %>
+      <%= f.input :username, as: :string, required: true, input_html: {class: 'identity-input'} %>
+      <% if @request_email %>
+        <%= f.input :email, as: :email, required: true, input_html: {class: 'identity-input', name: 'user[email]', value: ''} %>
+      <% end %>
+      <%= f.input :password, as: :password, required: true, input_html: {class: 'identity-input'} %>
+      <%= f.input :password_confirmation, as: :password, required: true, input_html: {class: 'identity-input'} %>
+      <div class="d-grid mt-4">
+        <%= f.button :submit, 'Activeren', class: 'btn btn-primary' %>
+      </div>
+    <% end %>
+  </div>
+</div>
\ No newline at end of file
diff --git a/app/views/identities/forgot_password_view.html.erb b/app/views/identities/forgot_password_view.html.erb
new file mode 100644
index 000000000..ab4c5ff46
--- /dev/null
+++ b/app/views/identities/forgot_password_view.html.erb
@@ -0,0 +1,16 @@
+<% content_for :title, "Wachtwoord resetten - #{Rails.application.config.x.site_name}" %>
+
+<div class="card w-auto position-absolute top-50 start-50 translate-middle">
+  <div class="card-header pt-3">
+    <h4 class="card-title">Wachtwoord resetten</h4>
+  </div>
+  <div class="card-body px-4 py-3 ">
+    <%= simple_form_for :identity, url: forgot_password_identities_path, method: :patch, wrapper: :vertical_form do |f| %>
+      <p class="text-muted mb-4">Door dit formulier in te vullen ontvangt u een email met een link om een nieuw wachwoord in te stellen.</p>
+      <%= f.input :username, as: :string, input_html: {name: 'username', class: 'identity-input'} %>
+      <div class="d-grid mt-4">
+        <%= f.button :submit, 'Link aanvragen', method: :patch, class: 'btn btn-primary mt-1' %>
+      </div>
+    <% end %>
+  </div>
+</div>
diff --git a/app/views/identities/login.html.erb b/app/views/identities/login.html.erb
new file mode 100644
index 000000000..442c72af0
--- /dev/null
+++ b/app/views/identities/login.html.erb
@@ -0,0 +1,107 @@
+<% content_for :title, "Login - #{Rails.application.config.x.site_name}" %>
+
+<div class="container py-1 mt-3 d-none" id="authenticate_flash_holder">
+  <div class="row">
+    <div class="col-12 col-md-6 mx-auto">
+        <div class="row">
+          <div class="col-12 text-center">
+            <div class="alert alert-dismissible fade show alert-danger" role="alert">
+              <p class="mb-0" id="authenticate_flash_message"></p>
+              <button aria-label="Close" class="btn-close" data-bs-dismiss="alert" type="button"></button>
+            </div>
+          </div>
+        </div>
+    </div>
+  </div>
+</div>
+
+<%= simple_form_for :identity, id: "authentication_form", authenticity_token: false, wrapper: :vertical_form do |f| %>
+  <div class="card w-auto position-absolute top-50 start-50 translate-middle" id="login_card">
+    <div class="card-header pt-3">
+      <h4 class="card-title">Inloggen</h4>
+    </div>
+    <div class="card-body px-4 py-3">
+      <%= f.input :auth_key, as: :string, label: "Gebruikersnaam", input_html: {name: 'auth_key', class: 'identity-input'} %>
+      <%= f.input :password, as: :password, label: "Wachtwoord", hint: 'Wachtwoord vergeten?', wrapper: :with_hint_link, input_html: {name: 'password', class: 'identity-input'}, hint_html: {href: forgot_password_view_identities_path} %>
+      <div class="d-grid mt-4">
+        <button class="btn btn-primary" type="submit" formaction='javascript:authenticate_login();' id="login_submit_button">Inloggen</button>
+      </div>
+    </div>
+  </div>
+
+  <div class="card w-auto position-absolute top-50 start-50 translate-middle d-none" id="otp_card">
+    <div class="card-header pt-3">
+      <h4 class="card-title">Authenticatiecode</h4>
+    </div>
+    <div class="card-body px-4 py-3 ">
+      <%= f.input :verification_code, as: :string, label: "Authenticatiecode", input_html: {name: 'verification_code', value: '', class: 'identity-input'} %>
+      <p>
+        Open de authenticatie app op je telefoon en geef hier de zescijferige authenticatiecode op. Authenticatie codes kwijtgeraakt? Neem dan contact op met de ICT-commissie voor identificatie.
+      </p>
+      <div class="d-grid mt-4">
+        <button class="btn btn-primary" type="submit" formaction='javascript:authenticate_otp();' id="otp_submit_button">Authenticeren</button>
+      </div>
+    </div>
+  </div>
+<% end %>
+
+<script>
+async function authenticate_login() {
+  var formData = new FormData(document.querySelector("#authentication_form"));
+
+  const response = await fetch("/users/auth/identity/callback", {
+    method: "POST",
+    body: formData,
+    headers: {
+      'X-CSRF-Token': document.querySelector('meta[name="csrf-token"]').getAttribute('content')
+    }
+  });
+
+  if (response.headers.get('Content-Type').includes("application/json")) {
+    const json = await response.json();
+    document.querySelector("#authenticate_flash_holder").classList.add('d-none');
+
+    if (json.state == "logged_in") {
+      window.location.replace(json.redirect_url);
+    } else if (json.state == "otp_prompt") {
+      // show prompt for authentication code
+      document.querySelector("#login_card").classList.add('d-none');
+      document.querySelector("#otp_card").classList.remove('d-none');
+    } else if (json.state == "password_prompt") {
+      // show prompt for password
+      document.querySelector("#authenticate_flash_holder").classList.remove('d-none');
+      document.querySelector("#login_card").classList.remove('d-none');
+      document.querySelector("#otp_card").classList.add('d-none');
+    }
+
+    if (json.error_message) {
+      document.querySelector("#authenticate_flash_message").textContent = json.error_message;
+      document.querySelector("#authenticate_flash_holder").classList.remove('d-none');
+    }
+  } else {
+    // we did not get json back, so that most likely means a CORS-related error or an error on the server-side
+    document.querySelector("#authenticate_flash_message").innerHTML = "Inloggen mislukt door een error. Herlaad de pagina en probeer het nog een keer. <br/><i>Werkt het na een paar keer proberen nog steeds niet? Neem dan contact op met de ICT-commissie.</i>";
+    document.querySelector("#authenticate_flash_holder").classList.remove('d-none');
+  }
+} 
+
+async function authenticate_otp() {
+  var formData = new FormData(document.querySelector("#authentication_form"));
+  
+  const response = await fetch("/users/auth/identity/callback", {
+    method: "POST",
+    body: formData,
+    headers: {
+      'X-CSRF-Token': document.querySelector('meta[name="csrf-token"]').getAttribute('content')
+    }
+  });
+  const json = await response.json();
+  if (json.login_success) {
+    window.location.replace(json.redirect_url);
+  } else {
+    // authentication code is wrong
+    document.querySelector("#authenticate_flash_message").textContent = json.error_message;
+    document.querySelector("#authenticate_flash_holder").classList.remove('d-none');
+  }
+}
+</script>
\ No newline at end of file
diff --git a/app/views/identities/new_activation_link.html.erb b/app/views/identities/new_activation_link.html.erb
new file mode 100644
index 000000000..1e6572e9d
--- /dev/null
+++ b/app/views/identities/new_activation_link.html.erb
@@ -0,0 +1,10 @@
+<% content_for :title, "Nieuwe activatielink - #{Rails.application.config.x.site_name}" %>
+
+<div class="card w-auto position-absolute top-50 start-50 translate-middle">
+  <div class="card-header pt-3">
+    <h4 class="card-title">Nieuwe activatielink</h4>
+  </div>
+  <div class="card-body px-4 py-3 ">
+    <p><%= @message %></p>
+  </div>
+</div>
\ No newline at end of file
diff --git a/app/views/identities/reset_password_view.html.erb b/app/views/identities/reset_password_view.html.erb
new file mode 100644
index 000000000..f726554dd
--- /dev/null
+++ b/app/views/identities/reset_password_view.html.erb
@@ -0,0 +1,16 @@
+<% content_for :title, "Wachtwoord resetten - #{Rails.application.config.x.site_name}" %>
+
+<div class="card w-auto position-absolute top-50 start-50 translate-middle">
+  <div class="card-header pt-3">
+    <h4 class="card-title">Nieuw wachtwoord instellen</h4>
+  </div>
+  <div class="card-body px-4 py-3">
+    <%= simple_form_for :identity, url: reset_password_identity_path(activation_token: @activation_token), method: :patch, wrapper: :vertical_form do |f| %>
+      <%= f.input :password, as: :password, required: true, input_html: {class: 'identity-input'} %>
+      <%= f.input :password_confirmation, as: :password, required: true, input_html: {class: 'identity-input'} %>
+      <div class="d-grid mt-4">
+        <%= f.button :submit, 'Opslaan', method: :patch, class: 'btn btn-primary' %>
+      </div>
+    <% end %>
+  </div>
+</div>
\ No newline at end of file
diff --git a/app/views/partials/_flash.html.erb b/app/views/partials/_flash.html.erb
index 1de88aca9..9f2c49dd3 100644
--- a/app/views/partials/_flash.html.erb
+++ b/app/views/partials/_flash.html.erb
@@ -1,12 +1,12 @@
 <% if flash.any? %>
-  <div class="container py-1">
+  <div class="container py-1 mt-3">
     <div class="row">
       <div class="col-12 col-md-6 mx-auto">
         <% flash.each do |key, value| %>
           <div class="row">
             <div class="col-12 text-center">
               <div class="alert alert-dismissible fade show <%= flash_class key %>" role="alert">
-                <%= value %>
+                <%= value.html_safe %>
                 <button aria-label="Close" class="btn-close" data-bs-dismiss="alert" type="button"/>
               </div>
             </div>
diff --git a/app/views/partials/_login_prompt.html.erb b/app/views/partials/_login_prompt.html.erb
index 0ba91def2..efe4ef40f 100644
--- a/app/views/partials/_login_prompt.html.erb
+++ b/app/views/partials/_login_prompt.html.erb
@@ -2,16 +2,31 @@
   <div class="card">
     <div class="card-header">
       <h3 class="card-title">
-        Log in to continue
+        Log in om door te gaan
       </h3>
     </div>
-    <div class="card-body">
-      <p class="card-text">
-        Log in with a <%= Rails.application.config.x.site_association %> account.
-      </p>
-      <div class="d-grid">
-        <%= link_to("Sign in with #{Rails.application.config.x.site_association}", user_amber_oauth2_omniauth_authorize_path, class: 'btn btn-primary', method: :post) %>
-      </div>
-    </div>
+    <ul class="list-group list-group-flush">
+      <% if Rails.application.config.x.site_association == 'C.S.V. Alpha' %>
+        <li class="list-group-item">
+          <p class="card-text mt-2">
+            Log in met een <%= Rails.application.config.x.site_association %> account.
+          </p>
+          <div class="d-grid mb-2">
+            <%= link_to("Log in met #{Rails.application.config.x.site_association}", user_amber_oauth2_omniauth_authorize_path, class: 'btn btn-primary', method: :post) %>
+          </div>
+        </li>
+        <li class="list-group-item text-center bg-light">
+          OF
+        </li>
+      <% end %>
+      <li class="list-group-item">
+        <p class="card-text mt-2">
+          Log in met een streepsysteem account.
+        </p>
+        <div class="d-grid mb-2">
+          <%= link_to "Log in", login_identities_path, class: 'btn btn-primary'%>
+        </div>
+      </li>
+    </ul>
   </div>
 </div>
diff --git a/app/views/user_mailer/account_creation_email.html.erb b/app/views/user_mailer/account_creation_email.html.erb
new file mode 100644
index 000000000..d9001d2b2
--- /dev/null
+++ b/app/views/user_mailer/account_creation_email.html.erb
@@ -0,0 +1,14 @@
+Er is een account voor u aangemaakt op het streepsysteem van uw vereniging. Deze is op dit moment nog niet geactiveerd.
+<br/><br/>
+
+Volg deze link om uw account te activeren:<br/>
+<a href="<%= @activate_account_url %>">
+  <%= @activate_account_url %>
+</a>
+<br/><br/>
+
+De link is 5 dagen geldig. Mocht de link verlopen zijn, dan kunt u een nieuwe link aanvragen:
+<a href="<%= @new_activation_link_url %>">
+  <%= @new_activation_link_url %>
+</a>
+<br/><br/>
diff --git a/app/views/user_mailer/forgot_password_email.html.erb b/app/views/user_mailer/forgot_password_email.html.erb
new file mode 100644
index 000000000..d5f33ca0e
--- /dev/null
+++ b/app/views/user_mailer/forgot_password_email.html.erb
@@ -0,0 +1,18 @@
+Er is een aanvraag gedaan tot het resetten van het wachtwoord voor het account verbonden met dit e-mailadres op het streepsysteem van uw vereniging. 
+Als u niets hebt aangevraagd kunt u deze e-mail negeren.
+<br/><br/>
+
+Volg deze link om uw nieuwe wachtwoord in te stellen:<br/>
+<a href="<%= @reset_password_url %>">
+  <%= @reset_password_url %>
+</a>
+<br/><br/>
+
+Uw gebruikersnaam is <b><%= @username %></b>.
+<br/><br/>
+
+De link is 1 dag geldig. Mocht de link verlopen zijn, dan kunt u een nieuwe link aanvragen:
+<a href="<%= @forgot_password_url %>">
+  <%= @forgot_password_url %>
+</a>
+<br/><br/>
diff --git a/app/views/user_mailer/new_activation_link_email.html.erb b/app/views/user_mailer/new_activation_link_email.html.erb
new file mode 100644
index 000000000..3d9001beb
--- /dev/null
+++ b/app/views/user_mailer/new_activation_link_email.html.erb
@@ -0,0 +1,14 @@
+Er is een aanvraag gedaan voor een nieuwe activatielink voor het account verbonden met dit e-mailadres op het streepsysteem van uw vereniging. 
+<br/><br/>
+
+Volg deze link om uw account te activeren:<br/>
+<a href="<%= @activate_account_url %>">
+  <%= @activate_account_url %>
+</a>
+<br/><br/>
+
+De link is 1 dag geldig. Mocht de link verlopen zijn, dan kunt u een nieuwe link aanvragen:
+<a href="@new_activation_link_url %>">
+  <%= @new_activation_link_url %>
+</a>
+<br/><br/>
diff --git a/app/views/users/_edit_identity_modal.html.erb b/app/views/users/_edit_identity_modal.html.erb
new file mode 100644
index 000000000..d853e12f6
--- /dev/null
+++ b/app/views/users/_edit_identity_modal.html.erb
@@ -0,0 +1,139 @@
+<div aria-hidden="true" aria-labelledby="edit_identity_modal_label" class="modal fade" id="edit_identity_modal" role="dialog">
+  <div class="modal-dialog modal-lg" role="document">
+    <div class="modal-content">
+
+      <div class="modal-header">
+        <h5 class="modal-title">Instellingen</h5>
+        <button aria-label="close" class="btn-close" data-bs-dismiss="modal" type="button"/>
+      </div>
+      <div class="modal-body">
+        <% if @identity && policy(@identity).update? %>
+          <div class="card mb-3">
+            <div class="card-header py-2" type="button" data-bs-toggle="collapse" data-bs-target="#user-data-collapse" aria-expanded="false" aria-controls="user-data-collapse">
+              <h5 class="mb-0 py-1">Gegevens <%= fa_icon 'caret-down', class: 'float-end me-1' %></h5>
+            </div>
+            <div class="collapse card-body" id="user-data-collapse">
+              <%= simple_form_for @user, wrapper: :horizontal_form, url: update_with_identity_user_path, method: :patch do |f| %>
+                <%= f.simple_fields_for :identity do |i| %>
+                  <%= i.input :username, required: true %>
+                <% end %>
+                <% if current_user.treasurer? %>
+                  <%= f.input :name, label: 'Naam', placeholder: 'Naam', required: true %>
+                <% end %>
+                <%= f.input :email, label: 'E-mailadres', placeholder: 'E-mailadres', required: true %>
+                <% if current_user.treasurer? %>
+                  <div class="row">
+                    <div class="col-lg-3">
+                      Gedeactiveerd
+                    </div>
+                    <div class="col-lg-9">
+                      <%= f.check_box :deactivated %>
+                    </div>
+                  </div>
+                <% end %>
+                <%= f.button :submit, 'Opslaan', :data => {:disable_with => 'Bezig...'}, class: 'btn btn-primary float-end', method: :patch %>
+              <% end %>
+            </div>
+          </div>
+          
+          <div class="card mb-3">
+            <div class="card-header py-2" type="button" data-bs-toggle="collapse" data-bs-target="#password-collapse" aria-expanded="false" aria-controls="password-collapse">
+              <h5 class="mb-0 py-1">Wachtwoord <%= fa_icon 'caret-down', class: 'float-end me-1' %></h5>
+            </div>
+            <div class="collapse card-body" id="password-collapse">
+              <%= simple_form_for @identity, wrapper: :horizontal_form, url: update_password_identity_path(@identity.id), method: :patch do |f| %>
+                <%= f.input :old_password %>
+                <%= f.input :password %>
+                <%= f.input :password_confirmation, required: false %>
+                <%= f.button :submit, 'Opslaan', :data => {:disable_with => 'Bezig...'}, class: 'btn btn-primary float-end', method: :patch %>
+              <% end %>
+            </div>
+          </div>
+          
+          <div class="card mb-3">
+            <div class="card-header py-2" type="button" data-bs-toggle="collapse" data-bs-target="#otp-collapse" aria-expanded="false" aria-controls="otp-collapse">
+              <h5 class="mb-0 py-1">Two-factor-authenticatie <%= fa_icon 'caret-down', class: 'float-end me-1' %></h5>
+            </div>
+            <div class="collapse card-body" id="otp-collapse">
+              <p>
+                Two-factor-authenticatie geeft een extra beveiligingslaag door bij het
+                inloggen naast je wachtwoord ook om een zescijferige code te vragen. Deze code
+                wordt gegenereerd door een app op je telefoon. Zo heb je naast iets dat je
+                weet (wachtwoord) ook iets nodig dat je hebt (telefoon) om in te kunnen
+                loggen.
+              </p>
+              
+              <% if @identity.otp_enabled %>
+                <div class='alert alert-success' role='alert'>
+                  <div class='container'>
+                    <div class='row align-items-center'>
+                      <p class='col-lg-8 col-md-12 mb-0'>
+                        <strong>Je hebt two-factor-authenticatie geactiveerd!</strong>
+                      </p>
+                      <div class='col-lg-4 col-md-12'>
+                        <%= link_to 'Deactiveren', disable_otp_identity_path, class: 'btn btn-danger  float-end' %>
+                      </div>
+                    </div>
+                  </div>
+                </div>
+              <% else %>
+                <%= simple_form_for @identity, wrapper: :horizontal_form, url: enable_otp_identity_path(@identity.id), method: :patch do |f| %>
+                  <p>
+                    Scan de QR-code hieronder met een authenticatorapp. Er zijn
+                    authenticatorapps beschikbaar voor alle mobiele platforms. Hier volgen
+                    enkele links naar apps:
+                  </p>
+              
+                  <ul>
+                    <li>
+                      <%= fa_icon 'android', class: 'me-1' %>
+                      <a
+                        href='https://play.google.com/store/apps/details?id=com.google.android.apps.authenticator2'
+                        target='_blank'
+                      >
+                        Google Authenticator
+                      </a>
+                    </li>
+                    <li>
+                    <%= fa_icon 'apple', class: 'me-1' %>
+                      <a
+                        href='https://itunes.apple.com/us/app/authenticator/id766157276?mt=8'
+                        target='_blank'
+                      >
+                        Authenticator
+                      </a>
+                    </li>
+                    <li>
+                      <%= fa_icon 'windows', class: 'me-1' %>
+                      <a
+                        href='https://www.microsoft.com/en-us/store/p/microsoft-authenticator/9nblgggzmcj6'
+                        target='_blank'
+                      >
+                        Microsoft Authenticator
+                      </a>
+                    </li>
+                  </ul>
+                  <p>
+                    Nadat je de code gescand hebt, bevestig je de set-up door een keer een
+                    gegenereerde code in te voeren.
+                  </p>
+              
+                  <%= render inline: @svg_qr_code %>
+                  
+                  <div class="mt-3">
+                    <%= f.input :verification_code, as: :string, input_html: { name: 'verification_code', value: "" } %>
+                  </div>
+
+                  <%= f.button :submit, '2FA Activeren', :data => {:disable_with => 'Bezig...'}, class: 'btn btn-primary float-end', method: :patch %>
+                <% end %>
+              <% end %>
+            </div>
+          </div>
+        <% end %>
+      </div>
+      <div class="modal-footer">
+        <button class="btn btn-secondary" data-bs-dismiss="modal" type="button">Sluiten</button>
+      </div>
+    </div>
+  </div>
+</div>
diff --git a/app/views/users/_new_identity_user_modal.html.erb b/app/views/users/_new_identity_user_modal.html.erb
new file mode 100644
index 000000000..b09da5863
--- /dev/null
+++ b/app/views/users/_new_identity_user_modal.html.erb
@@ -0,0 +1,27 @@
+<div aria-hidden="true" aria-labelledby="new_identity_user_modal_label" class="modal fade" id="new_identity_user_modal" role="dialog">
+  <div class="modal-dialog" role="document">
+    <div class="modal-content">
+
+      <div class="modal-header">
+        <h5 class="modal-title">
+          Nieuwe streepsysteem gebruiker
+        </h5>
+        <button aria-label="close" class="btn-close" data-bs-dismiss="modal" type="button"/>
+      </div>
+      <%= simple_form_for @new_user, wrapper: :horizontal_form do |f| %>
+        <%= f.hidden_field :provider, value: "identity" %>
+        <div class="modal-body" id="activities_modal">
+          <%= f.input :name, label: 'Naam', placeholder: 'Naam', required: true %>
+          <%= f.input :email, label: 'E-mailadres', placeholder: 'E-mailadres', required: true %>
+        </div>
+
+        <div class="modal-footer">
+          <button class="btn btn-secondary" data-bs-dismiss="modal" type="button">
+            Annuleren
+          </button>
+          <%= f.button :submit, 'Gebruiker opslaan en activatie-mail versturen', :data => {:disable_with => 'Bezig...'}, class: 'btn btn-primary' %>
+        </div>
+      <% end %>
+    </div>
+  </div>
+</div>
diff --git a/app/views/users/activate_account.html.erb b/app/views/users/activate_account.html.erb
new file mode 100644
index 000000000..d5820ffac
--- /dev/null
+++ b/app/views/users/activate_account.html.erb
@@ -0,0 +1,17 @@
+<% content_for :title, "Account activatie - #{Rails.application.config.x.site_name}" %>
+
+<div class="card w-auto position-absolute top-50 start-50 translate-middle">
+  <div class="card-header pt-3">
+    <h4 class="card-title">Streepsysteem account activeren</h4>
+  </div>
+  <div class="card-body px-4 py-3">
+    <%= simple_form_for @identity, url: "/users/auth/identity/register", wrapper: :vertical_form do |f| %>
+      <%= f.input :user_id, as: :hidden, input_html: {name: 'user_id', value: @identity.user_id} %>
+      <%= f.input :password, as: :password, required: true, input_html: {name: 'password'} %>
+      <%= f.input :password_confirmation, as: :password, required: true, input_html: {name: 'password_confirmation'} %>
+      <div class="d-grid mt-4">
+        <%= f.button :submit, 'Activeren', class: 'btn btn-primary' %>
+      </div>
+    <% end %>
+  </div>
+</div>
\ No newline at end of file
diff --git a/app/views/users/index.html.erb b/app/views/users/index.html.erb
index d43f11001..14e35c2f5 100644
--- a/app/views/users/index.html.erb
+++ b/app/views/users/index.html.erb
@@ -1,12 +1,13 @@
 <% content_for :title, "Gebruikers - #{Rails.application.config.x.site_name}" %>
 <% content_for :modal do %>
   <%= render 'modal' %>
+  <%= render 'new_identity_user_modal' %>
 <% end %>
 
 <div class="container footer-padding">
   <h1 class="my-4">Gebruikers</h1>
 
-  <%= content_tag :div, id: 'users-index', data: {manual_users: @manual_users_json, amber_users: @amber_users_json, inactive_users: @inactive_users_json} do %>
+  <%= content_tag :div, id: 'users-index', data: {manual_users: @manual_users_json, identity_users: @identity_users_json, amber_users: @amber_users_json, not_activated_users: @not_activated_users_json, deactivated_users: @deactivated_users_json} do %>
     <div class="d-flex justify-content-between align-items-center">
       <h3>Handmatig aangemaakte gebruikers</h3>
       <button class="btn btn-sm btn-primary" data-bs-target="#edit_user_modal" data-bs-toggle="modal" role="button">
@@ -16,24 +17,44 @@
         </span>
       </button>
     </div>
-    <users-table :users="manual_users"></users-table>
+    <users-table :users="manual_users" class="mb-5"></users-table>
 
-    <div class="d-flex justify-content-between align-items-center mt-5">
-      <h3><%= Rails.application.config.x.site_association %> gebruikers</h3>
-      <span>
-        <%= link_to refresh_user_list_users_path, class: 'btn btn-primary btn-sm me-1' do %>
-          <%= fa_icon 'refresh' %>
-          <span class="d-none d-md-inline ms-1">Synchroniseer gebruikers</span>
-        <% end %>
-      </span>
+    <% if Rails.application.config.x.site_association == 'C.S.V. Alpha' %>
+      <div class="d-flex justify-content-between align-items-center">
+        <h3><%= Rails.application.config.x.site_association %> gebruikers</h3>
+        <span>
+          <%= link_to refresh_user_list_users_path, class: 'btn btn-primary btn-sm me-1' do %>
+            <%= fa_icon 'refresh' %>
+            <span class="d-none d-md-inline ms-1">Synchroniseer gebruikers</span>
+          <% end %>
+        </span>
+      </div>
+      <users-table :users="amber_users" class="mb-5"></users-table>
+    <% end %>
+    
+    <div class="d-flex justify-content-between align-items-center">
+      <h3>Streepsysteem gebruikers</h3>
+      <button class="btn btn-sm btn-primary" data-bs-target="#new_identity_user_modal" data-bs-toggle="modal" role="button">
+        <%= fa_icon 'plus' %>
+        <span class="d-none d-md-inline ms-1">
+          Nieuwe gebruiker
+        </span>
+      </button>
     </div>
-    <users-table :users="amber_users"></users-table>
+    <users-table :users="identity_users" class="mb-5"></users-table>
+
+    <% if @not_activated_users.any? %>
+      <div class="d-flex justify-content-between align-items-center mt-5">
+        <h3>Nog niet geactiveerde gebruikers</h3>
+      </div>
+      <users-table :users="not_activated_users" class="mb-5"></users-table>
+    <%end %>
 
-    <% if @inactive_users.any? %>
+    <% if @deactivated_users.any? %>
       <div class="d-flex justify-content-between align-items-center mt-5">
-        <h3>Inactieve gebruikers</h3>
+        <h3>Gedeactiveerde gebruikers</h3>
       </div>
-      <users-table :users="inactive_users"></users-table>
+      <users-table :users="deactivated_users" class="mb-5"></users-table>
     <%end %>
   <% end %>
 </div>
diff --git a/app/views/users/show.html.erb b/app/views/users/show.html.erb
index 98868d3a9..1729b6e45 100644
--- a/app/views/users/show.html.erb
+++ b/app/views/users/show.html.erb
@@ -2,6 +2,7 @@
 <% content_for :modal do %>
   <%= render 'mutation_modal' %>
   <%= render 'modal' %>
+  <%= render 'edit_identity_modal' %>
 <% end %>
 
 
@@ -65,7 +66,12 @@
           <% end %></tr>
         </tbody>
       </table>
-      <% if current_user.treasurer? %>
+      <% if @identity && policy(@identity).update? %>
+        <button class="btn btn-sm btn-primary pull-right ms-2" data-bs-target="#edit_identity_modal" data-bs-toggle="modal" role="button">
+          <%= fa_icon 'sliders', class: 'me-1' %>
+          Instellingen
+        </button>
+      <% elsif current_user.treasurer? %>
         <button class="btn btn-sm btn-primary pull-right ms-2" data-bs-target="#edit_user_modal" data-bs-toggle="modal" role="button">
           <%= fa_icon 'pencil', class: 'me-1' %>
           Gebruiker wijzigen
diff --git a/config/initializers/devise.rb b/config/initializers/devise.rb
index 5b3584d5a..6c2e29e21 100644
--- a/config/initializers/devise.rb
+++ b/config/initializers/devise.rb
@@ -11,4 +11,17 @@
 
   config.omniauth :amber_oauth2, Rails.application.config.x.amber_client_id,
                   Rails.application.config.x.amber_client_secret
+  config.omniauth :identity, fields: %i[username user_id],
+  on_login: lambda { |e|
+    IdentitiesController.action(:omniauth_redirect_login).call(e)
+  },
+  on_registration: lambda { |e|
+    IdentitiesController.action(:omniauth_redirect_register).call(e)
+  }
+
+
+  # OmniAuth.config.on_failure = Proc.new { |env|
+  #   OmniAuth::FailureEndpoint.new(env).redirect_to_failure
+  # }
+  
 end
diff --git a/config/initializers/simple_form_bootstrap.rb b/config/initializers/simple_form_bootstrap.rb
index 5bb67b543..5681bb251 100644
--- a/config/initializers/simple_form_bootstrap.rb
+++ b/config/initializers/simple_form_bootstrap.rb
@@ -358,6 +358,21 @@
     b.use :hint, wrap_with: { class: 'form-text' }
   end
 
+  # small link underneath input
+  config.wrappers :with_hint_link do |b|
+    b.use :html5
+    b.use :placeholder
+    b.optional :maxlength
+    b.optional :minlength
+    b.optional :pattern
+    b.optional :min_max
+    b.optional :readonly
+    b.use :label, class: 'form-label'
+    b.use :input, class: 'form-control', error_class: config.input_field_error_class, valid_class: config.input_field_valid_class
+    b.use :full_error, wrap_with: { class: 'invalid-feedback' }
+    b.use :hint, wrap_with: { tag: :a, class: 'form-text link-secondary' }
+  end
+
 
   # The default wrapper to be used by the FormBuilder.
   config.default_wrapper = :vertical_form
diff --git a/config/locales/nl.yml b/config/locales/nl.yml
index 26fd3301c..8b2c98170 100644
--- a/config/locales/nl.yml
+++ b/config/locales/nl.yml
@@ -31,3 +31,15 @@ nl:
   views:
     pagination:
       truncate: "&hellip;"
+
+  activerecord:
+    attributes:
+      identity:
+        activation_token: 'Activatie-token'
+        email: 'Emailadres'
+        old_password: 'Oud wachtwoord'
+        password: 'Wachtwoord'
+        password_confirmation: 'Wachtwoord bevestiging'
+        username: 'Gebruikersnaam'
+        user_id: 'Gebruikers-id'
+        verification_code: 'Verificatie code'
diff --git a/config/routes.rb b/config/routes.rb
index 94c0d9774..68461aff3 100644
--- a/config/routes.rb
+++ b/config/routes.rb
@@ -27,6 +27,8 @@
     member do
       get :activities
       get :json
+      get :activate_account
+      patch :update_with_identity
     end
   end
 
@@ -49,6 +51,23 @@
     end
   end
 
+  resources :identities, only: %i[create] do
+    collection do
+      get :login
+      get :activate_account
+      get :new_activation_link
+      get :forgot_password, as: :forgot_password_view, action: :forgot_password_view
+      post :forgot_password
+    end
+    member do
+      get :reset_password, as: :reset_password_view, action: :reset_password_view
+      patch :reset_password
+      patch :update_password
+      patch :enable_otp
+      patch :disable_otp
+    end
+  end
+
   devise_scope :user do
     delete 'sign_out', to: 'devise/sessions#destroy', as: :destroy_user_session
   end
diff --git a/db/migrate/20240413094147_create_identities.rb b/db/migrate/20240413094147_create_identities.rb
new file mode 100644
index 000000000..b2527b5af
--- /dev/null
+++ b/db/migrate/20240413094147_create_identities.rb
@@ -0,0 +1,22 @@
+class CreateIdentities < ActiveRecord::Migration[7.0]
+  def change
+    create_table :identities do |t|
+      t.string :username, unique: true, null: false
+      t.string :password_digest, null: false
+      t.references :user, null: false, unique: true
+      t.string :otp_secret_key, null: false
+      t.boolean :otp_enabled, default: false
+      
+      t.datetime :deleted_at
+      t.timestamps
+
+      t.index :username, unique: true
+    end
+
+    add_column :users, :activation_token, :string
+    add_column :users, :activation_token_valid_till, :datetime
+
+    remove_index :roles, column: %i[role_type group_uid]
+    change_column_null :roles, :group_uid, true, 999999
+  end
+end
diff --git a/db/schema.rb b/db/schema.rb
index 26fcbda0c..2787de004 100644
--- a/db/schema.rb
+++ b/db/schema.rb
@@ -10,7 +10,7 @@
 #
 # It's strongly recommended that you check this file into your version control system.
 
-ActiveRecord::Schema[7.0].define(version: 2024_02_02_124405) do
+ActiveRecord::Schema[7.0].define(version: 2024_04_13_094147) do
   # These are extensions that must be enabled in order to support this database
   enable_extension "plpgsql"
 
@@ -43,6 +43,19 @@
     t.index ["user_id"], name: "index_credit_mutations_on_user_id"
   end
 
+  create_table "identities", force: :cascade do |t|
+    t.string "username", null: false
+    t.string "password_digest", null: false
+    t.bigint "user_id", null: false
+    t.string "otp_secret_key", null: false
+    t.boolean "otp_enabled", default: false
+    t.datetime "deleted_at"
+    t.datetime "created_at", null: false
+    t.datetime "updated_at", null: false
+    t.index ["user_id"], name: "index_identities_on_user_id"
+    t.index ["username"], name: "index_identities_on_username", unique: true
+  end
+
   create_table "invoice_rows", force: :cascade do |t|
     t.bigint "invoice_id"
     t.string "name", null: false
@@ -138,12 +151,11 @@
   end
 
   create_table "roles", force: :cascade do |t|
-    t.integer "group_uid", null: false
+    t.integer "group_uid"
     t.datetime "deleted_at"
     t.datetime "created_at", null: false
     t.datetime "updated_at", null: false
     t.integer "role_type"
-    t.index ["role_type", "group_uid"], name: "index_roles_on_role_type_and_group_uid", unique: true
   end
 
   create_table "roles_users", force: :cascade do |t|
@@ -168,6 +180,8 @@
     t.string "email"
     t.date "birthday"
     t.boolean "deactivated", default: false, null: false
+    t.string "activation_token"
+    t.datetime "activation_token_valid_till"
     t.index ["uid"], name: "index_users_on_uid", unique: true
   end
 
diff --git a/db/seeds.rb b/db/seeds.rb
index a307eeab8..0fec1092d 100644
--- a/db/seeds.rb
+++ b/db/seeds.rb
@@ -45,4 +45,6 @@
 Role.create(role_type: :treasurer, group_uid: 3)
 Role.create(role_type: :main_bartender, group_uid: 3)
 Role.create(role_type: :main_bartender, group_uid: 2)
+Role.create(role_type: :treasurer)
+Role.create(role_type: :main_bartender)
 # rubocop:enable Rails/Output
diff --git a/spec/controllers/callbacks_controller/identity_spec.rb b/spec/controllers/callbacks_controller/identity_spec.rb
new file mode 100644
index 000000000..474afc167
--- /dev/null
+++ b/spec/controllers/callbacks_controller/identity_spec.rb
@@ -0,0 +1,150 @@
+require 'rails_helper'
+
+# Disable omni-auth log messages in test report
+OmniAuth.config.logger = Rails.logger
+
+describe "Identity login", type: :request do
+  describe 'POST /users/auth/identity/callback' do
+    let(:identity) do
+      create(:identity, password: "password1234", password_confirmation: "password1234")
+    end
+    let(:user) { identity.user }
+    let(:request_params) { { 
+      auth_key: identity.username, 
+      password: identity.password, 
+      verification_code: identity.otp_code
+    } }
+    let(:request) do
+      post '/users/auth/identity/callback', params: request_params
+    end
+
+    context 'for non-existent identity' do
+      before do 
+        request_params[:auth_key] = "something_else"
+        request
+      end
+
+      it 'does not log in user' do
+        # nobody is signed in
+        expect(signed_in?(nil)).to be true
+      end
+
+      it 'sends a json response' do
+        expect(response.content_type).to eq "application/json; charset=utf-8"
+        expect(response.parsed_body["state"]).to eq "password_prompt"
+        expect(response.parsed_body["error_message"]).to eq "Inloggen mislukt. De ingevulde gegevens zijn incorrect."
+      end
+    end
+
+    context 'for identity without otp' do
+      context 'valid login' do
+        before do 
+          request
+        end
+
+        it 'logs in user' do
+          expect(signed_in?(user)).to be true
+        end
+
+        it 'sends a json response' do
+          expect(response.content_type).to eq "application/json; charset=utf-8"
+          expect(response.parsed_body["state"]).to eq "logged_in"
+          expect(response.parsed_body["error_message"]).to eq nil
+          expect(response.parsed_body["redirect_url"]).to eq user_path(user.id)
+        end
+      end
+
+      context 'wrong password' do
+        before do 
+          request_params[:password] = "something_else"
+          request
+        end
+
+        it 'does not log in user' do
+          expect(signed_in?(user)).to be false
+        end
+
+        it 'sends a json response' do
+          expect(response.content_type).to eq "application/json; charset=utf-8"
+          expect(response.parsed_body["state"]).to eq "password_prompt"
+          expect(response.parsed_body["error_message"]).to eq "Inloggen mislukt. De ingevulde gegevens zijn incorrect."
+        end
+      end
+    end
+
+    context 'for identity with otp' do
+      context 'valid login' do
+        before do
+          identity.update(otp_enabled: true)
+          request
+        end
+
+        it 'logs in user' do
+          expect(signed_in?(user)).to be true
+        end
+
+        it 'sends a json response' do
+          expect(response.content_type).to eq "application/json; charset=utf-8"
+          expect(response.parsed_body["state"]).to eq "logged_in"
+          expect(response.parsed_body["error_message"]).to eq nil
+          expect(response.parsed_body["redirect_url"]).to eq user_path(user.id)
+        end
+      end
+
+      context 'wrong password' do
+        before do 
+          identity.update(otp_enabled: true)
+          request_params[:password] = "something_else"
+          request
+        end
+
+        it 'does not log in user' do
+          expect(signed_in?(user)).to be false
+        end
+
+        it 'sends a json response' do
+          expect(response.content_type).to eq "application/json; charset=utf-8"
+          expect(response.parsed_body["state"]).to eq "password_prompt"
+          expect(response.parsed_body["error_message"]).to eq "Inloggen mislukt. De ingevulde gegevens zijn incorrect."
+        end
+      end
+
+      context 'without otp code' do
+        before do 
+          identity.update(otp_enabled: true)
+          request_params[:verification_code] = nil
+          request
+        end
+
+        it 'does not log in user' do
+          expect(signed_in?(user)).to be false
+        end
+
+        it 'sends a json response' do
+          expect(response.content_type).to eq "application/json; charset=utf-8"
+          expect(response.parsed_body["state"]).to eq "otp_prompt"
+          expect(response.parsed_body["error_message"]).to eq nil
+        end
+      end
+
+      context 'wrong otp code' do
+        before do 
+          identity.update(otp_enabled: true)
+          request_params[:verification_code] = "something_else"
+          request
+        end
+
+        it 'does not log in user' do
+          expect(signed_in?(user)).to be false
+        end
+
+        it 'sends a json response' do
+          expect(response.content_type).to eq "application/json; charset=utf-8"
+          expect(response.parsed_body["state"]).to eq "otp_prompt"
+          expect(response.parsed_body["error_message"]).to eq "Inloggen mislukt. De authenticatiecode is incorrect."
+        end
+      end
+    end
+    
+  end
+end
diff --git a/spec/controllers/identities_controller/activate_account_spec.rb b/spec/controllers/identities_controller/activate_account_spec.rb
new file mode 100644
index 000000000..cfe45121c
--- /dev/null
+++ b/spec/controllers/identities_controller/activate_account_spec.rb
@@ -0,0 +1,35 @@
+require 'rails_helper'
+
+describe IdentitiesController, type: :controller do
+  describe 'GET activate_account' do
+    let(:user) { create(:user, :identity, activation_token: SecureRandom.urlsafe_base64, activation_token_valid_till: Time.now + 5.day) }
+    let(:request_params) { { 
+      activation_token: user.activation_token, 
+      user_id: user.id 
+    } }
+    let(:request) do
+      get :activate_account, params: request_params
+    end
+
+    context 'no request_email for user with email' do
+      before do 
+        request 
+      end
+
+      it 'request_email to be false' do 
+        expect(assigns(:request_email)).to be false
+      end
+    end
+
+    context 'valid for user without email' do
+      before do 
+        user.update(email: nil)
+        request 
+      end
+
+      it 'request_email to be true' do 
+        expect(assigns(:request_email)).to be true
+      end
+    end
+  end
+end
diff --git a/spec/controllers/identities_controller/create_spec.rb b/spec/controllers/identities_controller/create_spec.rb
new file mode 100644
index 000000000..a794f7a08
--- /dev/null
+++ b/spec/controllers/identities_controller/create_spec.rb
@@ -0,0 +1,287 @@
+require 'rails_helper'
+
+describe IdentitiesController, type: :controller do
+  describe 'POST create' do
+    let(:user) { create(:user, :identity, activation_token: SecureRandom.urlsafe_base64, activation_token_valid_till: Time.now + 5.day) }
+    # we need attrs, because omni-auth identity immediately transforms password into password_digest when building
+    let(:request_params) { { 
+      identity: { 
+        username: Faker::Internet.username, 
+        password: "password1234", 
+        password_confirmation: "password1234" 
+      }, 
+      activation_token: user.activation_token, 
+      user_id: user.id 
+    } }
+    let(:request) do
+      post :create, params: request_params
+    end
+
+    context 'valid for user with email' do
+      before do 
+        @old_email = user.email
+        request 
+        user.reload
+      end
+
+      it 'creates a new identity and updates user' do
+        expect(Identity.count).to eq 1
+        expect(user.activation_token).to be_nil
+        expect(user.activation_token_valid_till).to be_nil
+        expect(user.email).to eq @old_email
+      end
+
+      it 'redirects after create' do
+        expect(response).to be_redirect
+      end
+    end
+
+    context 'valid for user without email' do
+      before do 
+        user.update(email: nil)
+        request_params[:user] = { email: Faker::Internet.email }
+        request 
+        user.reload
+      end
+
+      it 'creates a new identity and updates user' do
+        expect(Identity.count).to eq 1
+        expect(user.activation_token).to be_nil
+        expect(user.activation_token_valid_till).to be_nil
+        expect(user.email).to eq request_params[:user][:email]
+      end
+
+      it 'redirects after create' do
+        request
+        expect(response).to be_redirect
+      end
+    end
+
+    context 'with email for user with email' do
+      before do 
+        @old_user = user.dup
+        request_params[:user] = { email: Faker::Internet.email }
+        request 
+        user.reload
+      end
+
+      it 'creates no new identity and does not update user' do
+        expect(Identity.count).to eq 0
+        expect(user.dup.attributes).to eq @old_user.attributes
+        expect(flash[:error]).to match(/u heeft al een e-mailadres/)
+      end
+    end
+
+    context 'without email for user without email' do
+      before do 
+        user.update(email: nil)
+        @old_user = user.dup
+        request 
+        user.reload
+      end
+
+      it 'creates no new identity and does not update user' do
+        expect(Identity.count).to eq 0
+        expect(user.dup.attributes).to eq @old_user.attributes
+        expect(flash[:error]).to match(/e-mailadres moet opgegeven zijn/)
+      end
+    end
+
+    context 'with invalid email for user without email' do
+      before do 
+        user.update(email: nil)
+        request_params[:user] = { email: "invalid_email" }
+        @old_user = user.dup
+        request 
+        user.reload
+      end
+
+      it 'creates no new identity and does not update user' do
+        expect(Identity.count).to eq 0
+        expect(user.dup.attributes).to eq @old_user.attributes
+        expect(flash[:error]).to match(/e-mailadres is ongeldig/)
+      end
+    end
+
+    context 'without activation_token' do
+      before do 
+        request_params[:activation_token] = nil
+        @old_user = user.dup
+        request 
+        user.reload
+      end
+
+      it 'creates no new identity and does not update user' do
+        expect(Identity.count).to eq 0
+        expect(user.dup.attributes).to eq @old_user.attributes
+        expect(flash[:error]).to match(/activatie-token is niet aanwezig/)
+      end
+    end
+
+    context 'without user_id' do
+      before do 
+        request_params[:user_id] = nil
+        @old_user = user.dup
+        request
+        user.reload
+      end
+
+      it 'creates no new identity and does not update user' do
+        expect(Identity.count).to eq 0
+        expect(user.dup.attributes).to eq @old_user.attributes
+        expect(flash[:error]).to match(/gebruikers-id is niet aanwezig/)
+      end
+    end
+
+    context 'with expired activation_token' do
+      before do 
+        user.update(activation_token_valid_till: Time.now - 1.minute)
+        @old_user = user.dup
+        request 
+        user.reload
+      end
+
+      it 'creates no new identity and does not update user' do
+        expect(Identity.count).to eq 0
+        expect(user.dup.attributes).to eq @old_user.attributes
+        expect(flash[:error]).to match(/de activatielink is verlopen of ongeldig/)
+      end
+    end
+
+    context 'with wrong activation_token' do
+      before do 
+        request_params[:activation_token] = "other_token"
+        @old_user = user.dup
+        request 
+        user.reload
+      end
+
+      it 'creates no new identity and does not update user' do
+        expect(Identity.count).to eq 0
+        expect(user.dup.attributes).to eq @old_user.attributes
+        expect(flash[:error]).to match(/de activatielink is verlopen of ongeldig/)
+      end
+    end
+
+    context 'with user already activated' do
+      before do 
+        user.update(identity: create(:identity, user: user))
+        @old_user = user.dup
+        request 
+        user.reload
+      end
+
+      it 'creates no new identity and does not update user' do
+        expect(Identity.count).to eq 1 # this 1 is for the one that already existed
+        expect(user.dup.attributes).to eq @old_user.attributes
+        expect(flash[:error]).to match(/uw account is al geactiveerd/)
+      end
+    end
+
+    context 'without username' do
+      before do 
+        request_params[:identity][:username] = nil
+        @old_user = user.dup
+        request 
+        user.reload
+      end
+
+      it 'creates no new identity and does not update user' do
+        expect(Identity.count).to eq 0
+        expect(user.dup.attributes).to eq @old_user.attributes
+        expect(flash[:error]).to match(/gebruikersnaam moet opgegeven zijn/)
+      end
+    end
+
+    context 'without password' do
+      before do 
+        request_params[:identity][:password] = nil
+        @old_user = user.dup
+        request 
+        user.reload
+      end
+
+      it 'creates no new identity and does not update user' do
+        expect(Identity.count).to eq 0
+        expect(user.dup.attributes).to eq @old_user.attributes
+        expect(flash[:error]).to match(/wachtwoord moet opgegeven zijn/)
+      end
+    end
+
+    context 'without password_confirmation' do
+      before do 
+        request_params[:identity][:password_confirmation] = nil
+        @old_user = user.dup
+        request 
+        user.reload
+      end
+
+      it 'creates no new identity and does not update user' do
+        expect(Identity.count).to eq 0
+        expect(user.dup.attributes).to eq @old_user.attributes
+        expect(flash[:error]).to match(/wachtwoord bevestiging komt niet overeen met wachtwoord/)
+      end
+    end
+
+    context 'with wrong password_confirmation' do
+      before do 
+        request_params[:identity][:password_confirmation] = "something_else"
+        @old_user = user.dup
+        request 
+        user.reload
+      end
+
+      it 'creates no new identity and does not update user' do
+        expect(Identity.count).to eq 0
+        expect(user.dup.attributes).to eq @old_user.attributes
+        expect(flash[:error]).to match(/wachtwoord bevestiging komt niet overeen met wachtwoord/)
+      end
+    end
+
+    context 'with invalid password' do
+      before do 
+        request_params[:identity][:password] = "too_short"
+        request_params[:identity][:password_confirmation] = "too_short"
+        @old_user = user.dup
+        request 
+        user.reload
+      end
+
+      it 'creates no new identity and does not update user' do
+        expect(Identity.count).to eq 0
+        expect(user.dup.attributes).to eq @old_user.attributes
+        expect(flash[:error]).to match(/wachtwoord is te kort/)
+      end
+    end
+
+    context 'with user_id of non-existent user' do
+      before do 
+        request_params[:user_id] = User.count
+        @old_user = user.dup
+        request 
+        user.reload
+      end
+
+      it 'creates no new identity and does not update user' do
+        expect(Identity.count).to eq 0
+        expect(user.dup.attributes).to eq @old_user.attributes
+        expect(flash[:error]).to match(/uw account bestaat niet/)
+      end
+    end
+
+    context 'with user_id of deactivated user' do
+      before do 
+        user.update(deactivated: true)
+        @old_user = user.dup
+        request 
+        user.reload
+      end
+
+      it 'creates no new identity and does not update user' do
+        expect(Identity.count).to eq 0
+        expect(user.dup.attributes).to eq @old_user.attributes
+        expect(flash[:error]).to match(/uw account is gedeactiveerd/)
+      end
+    end
+  end
+end
diff --git a/spec/controllers/identities_controller/disable_otp_spec.rb b/spec/controllers/identities_controller/disable_otp_spec.rb
new file mode 100644
index 000000000..bc96a1680
--- /dev/null
+++ b/spec/controllers/identities_controller/disable_otp_spec.rb
@@ -0,0 +1,64 @@
+require 'rails_helper'
+
+describe IdentitiesController, type: :controller do
+  describe 'PATCH disable_otp' do
+    let(:identity) do
+      create(:identity, otp_enabled: true)
+    end
+    let(:request) do
+      patch :disable_otp, params: { id: identity.id }
+    end
+
+    describe 'when as identity owner' do
+      before do
+        sign_in identity.user
+        request
+        identity.reload
+      end
+
+      it 'updates identity' do
+        expect(request.status).to eq 302
+        expect(identity.otp_enabled).to be false
+      end
+    end
+
+    describe 'when without permission' do
+      before do
+        sign_in create(:user)
+        request
+        identity.reload
+      end
+
+      it 'does not update identity' do
+        expect(request.status).to eq 403
+        expect(identity.otp_enabled).to be true
+      end
+    end
+
+    describe 'when as main-bartender' do
+      before do
+        sign_in create(:user, :main_bartender)
+        request
+        identity.reload
+      end
+
+      it 'does not update identity' do
+        expect(request.status).to eq 403
+        expect(identity.otp_enabled).to be true
+      end
+    end
+
+    describe 'when as treasurer' do
+      before do
+        sign_in create(:user, :treasurer)
+        request
+        identity.reload
+      end
+
+      it 'does not update identity' do
+        expect(request.status).to eq 403
+        expect(identity.otp_enabled).to be true
+      end
+    end
+  end
+end
diff --git a/spec/controllers/identities_controller/enable_otp_spec.rb b/spec/controllers/identities_controller/enable_otp_spec.rb
new file mode 100644
index 000000000..c74d89cac
--- /dev/null
+++ b/spec/controllers/identities_controller/enable_otp_spec.rb
@@ -0,0 +1,99 @@
+require 'rails_helper'
+
+describe IdentitiesController, type: :controller do
+  describe 'PATCH enable_otp' do
+    let(:identity) do
+      create(:identity)
+    end
+    let(:user) { identity.user }
+    let(:request_params) { { 
+      id: identity.id,
+      verification_code: identity.otp_code
+    } }
+    let(:request) do
+      patch :enable_otp, params: request_params
+    end
+
+    describe 'when as identity owner' do
+      before do
+        sign_in user
+        request
+        identity.reload
+      end
+
+      it 'updates identity' do
+        expect(request.status).to eq 302
+        expect(identity.otp_enabled).to be true
+      end
+    end
+
+    describe 'when without permission' do
+      before do
+        sign_in create(:user)
+        request
+        identity.reload
+      end
+
+      it 'does not update identity' do
+        expect(request.status).to eq 403
+        expect(identity.otp_enabled).to be false
+      end
+    end
+
+    describe 'when as main-bartender' do
+      before do
+        sign_in create(:user, :main_bartender)
+        request
+        identity.reload
+      end
+
+      it 'does not update identity' do
+        expect(request.status).to eq 403
+        expect(identity.otp_enabled).to be false
+      end
+    end
+
+    describe 'when as treasurer' do
+      before do
+        sign_in create(:user, :treasurer)
+        request
+        identity.reload
+      end
+
+      it 'does not update identity' do
+        expect(request.status).to eq 403
+        expect(identity.otp_enabled).to be false
+      end
+    end
+
+    describe 'without verification_code' do
+      before do
+        request_params[:verification_code] = nil
+        sign_in user
+        begin request rescue ActionController::ParameterMissing end
+        identity.reload
+      end
+
+      it 'does not update identity' do
+        expect(identity.otp_enabled).to be false
+        expect { request  }.to raise_error(ActionController::ParameterMissing, /verification_code/)
+      end
+    end
+
+    describe 'with wrong verication_code' do
+      before do
+        @old_identity = identity.dup
+        request_params[:verification_code] = (request_params[:verification_code].to_i + 1).to_s
+        sign_in user
+        request
+        identity.reload
+      end
+
+      it 'does not update identity' do
+        expect(request.status).to eq 302
+        expect(identity.otp_enabled).to be false
+        expect(flash[:error]).to match(/de verificatie token is ongeldig/)
+      end
+    end
+  end
+end
diff --git a/spec/controllers/identities_controller/forgot_pasword_spec.rb b/spec/controllers/identities_controller/forgot_pasword_spec.rb
new file mode 100644
index 000000000..11bb76065
--- /dev/null
+++ b/spec/controllers/identities_controller/forgot_pasword_spec.rb
@@ -0,0 +1,81 @@
+require 'rails_helper'
+
+describe IdentitiesController, type: :controller do
+  describe 'POST forgot_password' do
+    let(:user) { create(:user, :identity) }
+    let(:identity) { create(:identity, user: user) }
+    # we need attrs, because omni-auth identity immediately transforms password into password_digest when building
+    let(:request_params) { { 
+      username: identity.username, 
+    } }
+    let(:request) do
+      post :forgot_password, params: request_params
+    end
+
+    context 'valid' do
+      before do
+        clear_enqueued_jobs
+      end
+
+      it 'shows success message and sends email' do
+        expect(UserMailer).to send_email(:forgot_password_email, :deliver_later, user)
+        request
+        user.reload
+        expect(user.activation_token).not_to be_nil
+        expect(user.activation_token_valid_till).not_to be_nil
+      end
+
+      after do
+        clear_enqueued_jobs
+      end 
+    end
+
+    context 'user without email' do
+      before do 
+        user.update(email: nil)
+        @old_user = user.dup
+        clear_enqueued_jobs
+        request 
+        user.reload
+      end
+
+      it 'shows error message and does not send email' do
+        expect(user.dup.attributes).to eq @old_user.attributes
+        expect(flash[:error]).to match(/uw account heeft geen emailadres/)
+        expect(enqueued_jobs.size).to eq(0)
+      end
+    end
+
+    context 'without username' do
+      before do 
+        request_params[:username] = nil
+        @old_user = user.dup
+        clear_enqueued_jobs
+        request 
+        user.reload
+      end
+
+      it 'shows error message and does not send email' do
+        expect(user.dup.attributes).to eq @old_user.attributes
+        expect(flash[:error]).to match(/gebruikersnaam is niet aanwezig/)
+        expect(enqueued_jobs.size).to eq(0)
+      end
+    end
+
+    context 'with non-existent username' do
+      before do 
+        request_params[:username] = "something_else"
+        @old_user = user.dup
+        clear_enqueued_jobs
+        request 
+        user.reload
+      end
+
+      it 'shows error message and does not send email' do
+        expect(user.dup.attributes).to eq @old_user.attributes
+        expect(flash[:error]).to match(/uw gebruikersnaam bestaat niet/)
+        expect(enqueued_jobs.size).to eq(0)
+      end
+    end
+  end
+end
diff --git a/spec/controllers/identities_controller/login_spec.rb b/spec/controllers/identities_controller/login_spec.rb
new file mode 100644
index 000000000..a5a388dd3
--- /dev/null
+++ b/spec/controllers/identities_controller/login_spec.rb
@@ -0,0 +1,134 @@
+require 'rails_helper'
+
+# TODO EW implement
+describe IdentitiesController, type: :controller do
+  describe 'PATCH reset_password' do
+    let(:user) { create(:user, :identity, activation_token: SecureRandom.urlsafe_base64, activation_token_valid_till: Time.now + 5.day) }
+    let(:identity) do
+      create(:identity, user: user, password: "password1234", password_confirmation: "password1234")
+    end
+    let(:request_params) { { 
+      id: identity.id,
+      identity: { 
+        password: "new_password1234", 
+        password_confirmation: "new_password1234" 
+      }, 
+      activation_token: user.activation_token
+    } }
+    let(:request) do
+      patch :reset_password, params: request_params
+    end
+
+    context 'valid' do
+      before do 
+        @old_identity = identity.dup
+        request 
+        identity.reload
+      end
+
+      it 'updates identity' do
+        expect(identity.authenticate(@old_identity.password)).to be false 
+        expect(identity.authenticate(request_params[:identity][:password])).to be identity
+      end
+    end
+
+    context 'without activation_token' do
+      before do 
+        request_params[:activation_token] = nil
+        @old_identity = identity.dup
+        request 
+        identity.reload
+      end
+
+      it 'does not update identity' do
+        expect(identity.dup.attributes).to eq @old_identity.attributes
+        expect(flash[:error]).to match(/activatie-token is niet aanwezig/)
+      end
+    end
+
+    context 'with expired activation_token' do
+      before do 
+        user.update(activation_token_valid_till: Time.now - 1.minute)
+        @old_identity = identity.dup
+        request 
+        identity.reload
+      end
+
+      it 'does not update identity' do
+        expect(identity.dup.attributes).to eq @old_identity.attributes
+        expect(flash[:error]).to match(/de resetlink is verlopen of ongeldig/)
+      end
+    end
+
+    context 'with wrong activation_token' do
+      before do 
+        request_params[:activation_token] = "other_token"
+        @old_identity = identity.dup
+        request 
+        identity.reload
+      end
+
+      it 'does not update identity' do
+        expect(identity.dup.attributes).to eq @old_identity.attributes
+        expect(flash[:error]).to match(/de resetlink is verlopen of ongeldig/)
+      end
+    end
+
+    context 'without password' do
+      before do 
+        request_params[:identity][:password] = nil
+        @old_identity = identity.dup
+        request 
+        identity.reload
+      end
+
+      it 'does not update identity' do
+        expect(identity.dup.attributes).to eq @old_identity.attributes
+        expect(flash[:error]).to match(/wachtwoord moet opgegeven zijn/)
+      end
+    end
+
+    context 'without password_confirmation' do
+      before do 
+        request_params[:identity][:password_confirmation] = nil
+        @old_identity = identity.dup
+        request 
+        identity.reload
+      end
+
+      it 'does not update identity' do
+        expect(identity.dup.attributes).to eq @old_identity.attributes
+        expect(flash[:error]).to match(/wachtwoord bevestiging komt niet overeen met wachtwoord/)
+      end
+    end
+
+    context 'with wrong password_confirmation' do
+      before do 
+        request_params[:identity][:password_confirmation] = "something_else"
+        @old_identity = identity.dup
+        request 
+        identity.reload
+      end
+
+      it 'does not update identity' do
+        expect(identity.dup.attributes).to eq @old_identity.attributes
+        expect(flash[:error]).to match(/wachtwoord bevestiging komt niet overeen met wachtwoord/)
+      end
+    end
+
+    context 'with invalid password' do
+      before do 
+        request_params[:identity][:password] = "too_short"
+        request_params[:identity][:password_confirmation] = "too_short"
+        @old_identity = identity.dup
+        request 
+        identity.reload
+      end
+
+      it 'does not update identity' do
+        expect(identity.dup.attributes).to eq @old_identity.attributes
+        expect(flash[:error]).to match(/wachtwoord is te kort/)
+      end
+    end
+  end
+end
diff --git a/spec/controllers/identities_controller/new_activation_link_spec.rb b/spec/controllers/identities_controller/new_activation_link_spec.rb
new file mode 100644
index 000000000..d6bdc2ad0
--- /dev/null
+++ b/spec/controllers/identities_controller/new_activation_link_spec.rb
@@ -0,0 +1,95 @@
+require 'rails_helper'
+
+describe IdentitiesController, type: :controller do
+  describe 'GET new_activation_link' do
+    let(:user) { create(:user, :identity, activation_token: SecureRandom.urlsafe_base64, activation_token_valid_till: Time.now + 5.day) }
+    let(:request_params) { { 
+      activation_token: user.activation_token, 
+      user_id: user.id 
+    } }
+    let(:request) do
+      get :new_activation_link, params: request_params
+    end
+
+    context 'valid' do
+      before do
+        clear_enqueued_jobs
+      end
+
+      it 'shows success message and sends email' do
+        expect(UserMailer).to send_email(:new_activation_link_email, :deliver_later, user)
+        request
+        expect(assigns(:message)).to eq "Er is een nieuwe activatielink voor uw account verstuurd naar uw emailadres."
+      end
+
+      after do
+        clear_enqueued_jobs
+      end
+    end
+
+    context 'without email' do
+      before do 
+        user.update(email: nil)
+        clear_enqueued_jobs
+        request 
+      end
+
+      it 'shows error message and does not send email' do
+        expect(assigns(:message)).to match(/uw account heeft geen emailadres/)
+        expect(enqueued_jobs.size).to eq(0)
+      end
+    end
+
+    context 'without user_id' do
+      before do 
+        request_params[:user_id] = nil
+        clear_enqueued_jobs
+        request
+      end
+
+      it 'shows error message and does not send email' do
+        expect(assigns(:message)).to match(/gebruikers-id is niet aanwezig/)
+        expect(enqueued_jobs.size).to eq(0)
+      end
+    end
+
+    context 'with user already activated' do
+      before do 
+        user.update(identity: create(:identity, user: user))
+        clear_enqueued_jobs
+        request 
+      end
+
+      it 'shows error message and does not send email' do
+        expect(assigns(:message)).to match(/uw account is al geactiveerd/)
+        expect(enqueued_jobs.size).to eq(0)
+      end
+    end
+
+    context 'with user_id of non-existent user' do
+      before do 
+        request_params[:user_id] = User.count + 1
+        clear_enqueued_jobs
+        request 
+      end
+
+      it 'shows error message and does not send email' do
+        expect(assigns(:message)).to match(/uw account bestaat niet/)
+        expect(enqueued_jobs.size).to eq(0)
+      end
+    end
+
+    context 'with user_id of deactivated user' do
+      before do 
+        user.update(deactivated: true)
+        clear_enqueued_jobs
+        request 
+      end
+
+      it 'shows error message and does not send email' do
+        expect(assigns(:message)).to match(/uw account is gedeactiveerd/)
+        expect(enqueued_jobs.size).to eq(0)
+      end
+    end
+  end
+end
diff --git a/spec/controllers/identities_controller/reset_password_spec.rb b/spec/controllers/identities_controller/reset_password_spec.rb
new file mode 100644
index 000000000..1c1a57dff
--- /dev/null
+++ b/spec/controllers/identities_controller/reset_password_spec.rb
@@ -0,0 +1,133 @@
+require 'rails_helper'
+
+describe IdentitiesController, type: :controller do
+  describe 'PATCH reset_password' do
+    let(:user) { create(:user, :identity, activation_token: SecureRandom.urlsafe_base64, activation_token_valid_till: Time.now + 5.day) }
+    let(:identity) do
+      create(:identity, user: user, password: "password1234", password_confirmation: "password1234")
+    end
+    let(:request_params) { { 
+      id: identity.id,
+      identity: { 
+        password: "new_password1234", 
+        password_confirmation: "new_password1234" 
+      }, 
+      activation_token: user.activation_token
+    } }
+    let(:request) do
+      patch :reset_password, params: request_params
+    end
+
+    context 'valid' do
+      before do 
+        @old_identity = identity.dup
+        request 
+        identity.reload
+      end
+
+      it 'updates identity' do
+        expect(identity.authenticate(@old_identity.password)).to be false 
+        expect(identity.authenticate(request_params[:identity][:password])).to be identity
+      end
+    end
+
+    context 'without activation_token' do
+      before do 
+        request_params[:activation_token] = nil
+        @old_identity = identity.dup
+        request 
+        identity.reload
+      end
+
+      it 'does not update identity' do
+        expect(identity.dup.attributes).to eq @old_identity.attributes
+        expect(flash[:error]).to match(/activatie-token is niet aanwezig/)
+      end
+    end
+
+    context 'with expired activation_token' do
+      before do 
+        user.update(activation_token_valid_till: Time.now - 1.minute)
+        @old_identity = identity.dup
+        request 
+        identity.reload
+      end
+
+      it 'does not update identity' do
+        expect(identity.dup.attributes).to eq @old_identity.attributes
+        expect(flash[:error]).to match(/de resetlink is verlopen of ongeldig/)
+      end
+    end
+
+    context 'with wrong activation_token' do
+      before do 
+        request_params[:activation_token] = "other_token"
+        @old_identity = identity.dup
+        request 
+        identity.reload
+      end
+
+      it 'does not update identity' do
+        expect(identity.dup.attributes).to eq @old_identity.attributes
+        expect(flash[:error]).to match(/de resetlink is verlopen of ongeldig/)
+      end
+    end
+
+    context 'without password' do
+      before do 
+        request_params[:identity][:password] = nil
+        @old_identity = identity.dup
+        request 
+        identity.reload
+      end
+
+      it 'does not update identity' do
+        expect(identity.dup.attributes).to eq @old_identity.attributes
+        expect(flash[:error]).to match(/wachtwoord moet opgegeven zijn/)
+      end
+    end
+
+    context 'without password_confirmation' do
+      before do 
+        request_params[:identity][:password_confirmation] = nil
+        @old_identity = identity.dup
+        request 
+        identity.reload
+      end
+
+      it 'does not update identity' do
+        expect(identity.dup.attributes).to eq @old_identity.attributes
+        expect(flash[:error]).to match(/wachtwoord bevestiging komt niet overeen met wachtwoord/)
+      end
+    end
+
+    context 'with wrong password_confirmation' do
+      before do 
+        request_params[:identity][:password_confirmation] = "something_else"
+        @old_identity = identity.dup
+        request 
+        identity.reload
+      end
+
+      it 'does not update identity' do
+        expect(identity.dup.attributes).to eq @old_identity.attributes
+        expect(flash[:error]).to match(/wachtwoord bevestiging komt niet overeen met wachtwoord/)
+      end
+    end
+
+    context 'with invalid password' do
+      before do 
+        request_params[:identity][:password] = "too_short"
+        request_params[:identity][:password_confirmation] = "too_short"
+        @old_identity = identity.dup
+        request 
+        identity.reload
+      end
+
+      it 'does not update identity' do
+        expect(identity.dup.attributes).to eq @old_identity.attributes
+        expect(flash[:error]).to match(/wachtwoord is te kort/)
+      end
+    end
+  end
+end
diff --git a/spec/controllers/identities_controller/update_password_spec.rb b/spec/controllers/identities_controller/update_password_spec.rb
new file mode 100644
index 000000000..91b2089cc
--- /dev/null
+++ b/spec/controllers/identities_controller/update_password_spec.rb
@@ -0,0 +1,170 @@
+require 'rails_helper'
+
+describe IdentitiesController, type: :controller do
+  describe 'PATCH update_password' do
+    let(:identity) do
+      create(:identity, password: "password1234", password_confirmation: "password1234")
+    end
+    let(:user) { identity.user }
+    let(:request_params) { { 
+      id: identity.id,
+      identity: { 
+        old_password: identity.password,
+        password: "new_password1234", 
+        password_confirmation: "new_password1234"
+      }
+    } }
+    let(:request) do
+      patch :update_password, params: request_params
+    end
+
+    describe 'when as identity owner' do
+      before do
+        @old_identity = identity.dup
+        sign_in user
+        request
+        identity.reload
+      end
+
+      it 'updates identity' do
+        expect(request.status).to eq 302
+        expect(identity.authenticate(@old_identity.password)).to be false 
+        expect(identity.authenticate(request_params[:identity][:password])).to be identity
+      end
+    end
+
+    describe 'when without permission' do
+      before do
+        @old_identity = identity.dup
+        sign_in create(:user)
+        request
+        identity.reload
+      end
+
+      it 'does not update identity' do
+        expect(request.status).to eq 403
+        expect(identity.dup.attributes).to eq @old_identity.attributes
+      end
+    end
+
+    describe 'when as main-bartender' do
+      before do
+        @old_identity = identity.dup
+        sign_in create(:user, :main_bartender)
+        request
+        identity.reload
+      end
+
+      it 'does not update identity' do
+        expect(request.status).to eq 403
+        expect(identity.dup.attributes).to eq @old_identity.attributes
+      end
+    end
+
+    describe 'when as treasurer' do
+      before do
+        @old_identity = identity.dup
+        sign_in create(:user, :treasurer)
+        request
+        identity.reload
+      end
+
+      it 'does not update identity' do
+        expect(request.status).to eq 403
+        expect(identity.dup.attributes).to eq @old_identity.attributes
+      end
+    end
+
+    describe 'without old_password' do
+      before do
+        @old_identity = identity.dup
+        request_params[:identity][:old_password] = nil
+        sign_in user
+        request
+        identity.reload
+      end
+
+      it 'does not update identity' do
+        expect(identity.dup.attributes).to eq @old_identity.attributes
+        expect(flash[:error]).to match(/het oude wachtwoord is fout of niet opgegeven/)
+      end
+    end
+
+    describe 'with wrong old_password' do
+      before do
+        @old_identity = identity.dup
+        request_params[:identity][:old_password] = "something_else"
+        sign_in user
+        request
+        identity.reload
+      end
+
+      it 'does not update identity' do
+        expect(identity.dup.attributes).to eq @old_identity.attributes
+        expect(flash[:error]).to match(/het oude wachtwoord is fout of niet opgegeven/)
+      end
+    end
+
+    describe 'without password' do
+      before do
+        @old_identity = identity.dup
+        request_params[:identity][:password] = nil
+        sign_in user
+        request
+        identity.reload
+      end
+
+      it 'does not update identity' do
+        expect(identity.dup.attributes).to eq @old_identity.attributes
+        expect(flash[:error]).to match(/wachtwoord moet opgegeven zijn/)
+      end
+    end
+
+    describe 'with invalid password' do
+      before do
+        @old_identity = identity.dup
+        request_params[:identity][:password] = "too_short"
+        request_params[:identity][:password_confirmation] = "too_short"
+        sign_in user
+        request
+        identity.reload
+      end
+
+      it 'does not update identity' do
+        expect(identity.dup.attributes).to eq @old_identity.attributes
+        expect(flash[:error]).to match(/wachtwoord is te kort/)
+      end
+    end
+
+    describe 'with non-matching confirmation' do
+      before do
+        @old_identity = identity.dup
+        request_params[:identity][:password_confirmation] = "something_else"
+        sign_in user
+        request
+        identity.reload
+      end
+
+      it 'does not update identity' do
+        expect(identity.dup.attributes).to eq @old_identity.attributes
+        expect(flash[:error]).to match(/wachtwoord bevestiging komt niet overeen met wachtwoord/)
+      end
+    end
+
+
+    describe 'without password_confirmation' do
+      before do
+        @old_identity = identity.dup
+        request_params[:identity][:password_confirmation] = nil
+        sign_in user
+        request
+        identity.reload
+      end
+
+      it 'does not update identity' do
+        expect(identity.dup.attributes).to eq @old_identity.attributes
+        expect(flash[:error]).to match(/wachtwoord bevestiging komt niet overeen met wachtwoord/)
+      end
+    end
+  end
+end
diff --git a/spec/factories/identity.rb b/spec/factories/identity.rb
new file mode 100644
index 000000000..b7e8508d6
--- /dev/null
+++ b/spec/factories/identity.rb
@@ -0,0 +1,11 @@
+FactoryBot.define do
+  factory :identity do
+    username { Faker::Internet.username }
+    password { Faker::Internet.password(min_length: 12, max_length: 30) }
+    user { create(:user, :identity) }
+
+    trait :otp_enabled do
+      otp_enabled { true }
+    end
+  end
+end
diff --git a/spec/factories/user.rb b/spec/factories/user.rb
index 6beb9806d..0772ac627 100644
--- a/spec/factories/user.rb
+++ b/spec/factories/user.rb
@@ -15,5 +15,13 @@
         user.roles = [FactoryBot.create(:role, role_type: :main_bartender)]
       end
     end
+
+    trait(:from_amber) do
+      provider { 'amber_oauth2' }
+    end
+
+    trait(:identity) do
+      provider { 'identity' }
+    end
   end
 end
diff --git a/spec/mailers/previews/user_mailer_preview.rb b/spec/mailers/previews/user_mailer_preview.rb
new file mode 100644
index 000000000..fb932ea91
--- /dev/null
+++ b/spec/mailers/previews/user_mailer_preview.rb
@@ -0,0 +1,18 @@
+# Preview all emails at http://localhost:5000/rails/mailers/user_mailer
+class UserMailerPreview < ActionMailer::Preview
+  def account_creation_mail
+    user = User.new(id: 999999, provider: 'identity', activation_token: "mockup_activation_token")
+    UserMailer.account_creation_email(user)
+  end
+
+  def forgot_password_mail
+    user = User.new(id: 999999, provider: 'identity', activation_token: "mockup_activation_token")
+    identity = Identity.new(id: 888888, user: user, username: 'mockup_username')
+    UserMailer.forgot_password_email(user)
+  end
+
+  def new_activation_link_mail
+    user = User.new(id: 999999, provider: 'identity', activation_token: "mockup_activation_token")
+    UserMailer.new_activation_link_email(user)
+  end
+end
diff --git a/spec/models/identity_spec.rb b/spec/models/identity_spec.rb
new file mode 100644
index 000000000..41ce5f401
--- /dev/null
+++ b/spec/models/identity_spec.rb
@@ -0,0 +1,81 @@
+require 'rails_helper'
+
+RSpec.describe Identity, type: :model do
+  subject(:identity) { build_stubbed(:identity, user: build_stubbed(:user, activation_token: SecureRandom.urlsafe_base64), password: 'password1234') }
+
+  describe '#valid?' do
+    it { expect(identity).to be_valid }
+
+    context 'when without a username' do
+      subject(:identity) { build_stubbed(:identity, username: nil) }
+
+      it { expect(identity).not_to be_valid }
+    end
+
+    context 'when with a username containing spaces' do
+      subject(:identity) { build_stubbed(:identity, username: 'contains a space') }
+
+      it { expect(identity).to be_valid }
+    end
+
+    context 'when having duplicate fields' do
+      let(:identity) { create(:identity) }
+
+      context 'username' do
+        subject(:duplicate_identity) { build_stubbed(:identity, username: identity.username) }
+
+        it { expect(duplicate_identity).not_to be_valid }
+      end
+
+      context 'user' do
+        subject(:duplicate_identity) { build_stubbed(:identity, user: identity.user) }
+
+        it { expect(duplicate_identity).not_to be_valid }
+      end
+    end
+
+    context 'when without a password' do
+      subject(:identity) do
+        build_stubbed(:identity, password: nil)
+      end
+
+      it { expect(identity).not_to be_valid }
+    end
+
+    context 'when with too short password' do
+      subject(:identity) do
+        build_stubbed(:identity, password: '<12char')
+      end
+
+      it { expect(identity).not_to be_valid }
+    end
+
+    context 'when with empty password' do
+      subject(:identity) { build_stubbed(:identity, password: '') }
+
+      it { expect(identity).not_to be_valid }
+    end
+
+    context 'when with password' do
+      subject(:identity) { build_stubbed(:identity, password: 'password1234') }
+
+      it { expect(identity).to be_valid }
+    end
+  end
+
+  describe 'activate_account_url' do
+    it { expect(Identity.activate_account_url(identity.user.id, identity.user.activation_token)).to eq "http://testhost:1337/identities/activate_account?activation_token=#{identity.user.activation_token}&user_id=#{identity.user.id}" }
+  end
+
+  describe 'new_activation_link_url' do
+    it { expect(Identity.new_activation_link_url(identity.user.id)).to eq "http://testhost:1337/identities/new_activation_link?user_id=#{identity.user.id}" }
+  end
+
+  describe 'forgot_password_url' do
+    it { expect(Identity.forgot_password_url()).to eq "http://testhost:1337/identities/forgot_password" }
+  end
+
+  describe 'reset_password_url' do
+    it { expect(identity.reset_password_url(identity.user.activation_token)).to eq "http://testhost:1337/identities/#{identity.id}/reset_password?activation_token=#{identity.user.activation_token}" }
+  end
+end
diff --git a/spec/models/role_spec.rb b/spec/models/role_spec.rb
index 1e782d2f7..16af24d43 100644
--- a/spec/models/role_spec.rb
+++ b/spec/models/role_spec.rb
@@ -11,12 +11,6 @@
 
       it { expect(role).not_to be_valid }
     end
-
-    context 'when without group_uid' do
-      subject(:role) { build_stubbed(:role, group_uid: nil) }
-
-      it { expect(role).not_to be_valid }
-    end
   end
 
   describe '#name' do
diff --git a/spec/models/user_spec.rb b/spec/models/user_spec.rb
index 98f7e89f0..115ed1774 100644
--- a/spec/models/user_spec.rb
+++ b/spec/models/user_spec.rb
@@ -12,6 +12,12 @@
       it { expect(user).not_to be_valid }
     end
 
+    context 'when with invalid email' do
+      subject(:user) { build_stubbed(:user, email: "not_an_valid_email") }
+
+      it { expect(user).not_to be_valid }
+    end
+
     context 'when deactivating with credit' do
       subject(:user) { create(:user, deactivated: true) }
 
@@ -41,6 +47,40 @@
     end
   end
 
+  describe '.identity' do
+    context 'when identity' do
+      subject(:user) { create(:user, provider: 'identity') }
+
+      before { user }
+
+      it { expect(described_class.identity).to include user }
+    end
+
+    context 'when not identity' do
+      subject(:user) { create(:user, provider: 'another_provider') }
+
+      before { user }
+
+      it { expect(described_class.identity).not_to include user }
+    end
+
+    context 'when without email' do
+      subject(:user) { build(:user, :identity, email: nil) }
+
+      before { build(:identity, user: user) }
+
+      it { expect(user).not_to be_valid }
+    end
+
+    context 'when with valid email' do
+      subject(:user) { build(:user, :identity, email: "valid@email.com") }
+
+      before { build(:identity, user: user) }
+
+      it { expect(user).to be_valid }
+    end
+  end
+
   describe '.manual' do
     context 'when manual created' do
       subject(:user) { create(:user, provider: nil) }
@@ -75,19 +115,27 @@
     end
   end
 
-  describe '.active / .inactive' do
+  describe '.active / .deactivated / .not_activated' do
     context 'when active' do
       subject(:user) { create(:user) }
 
       it { expect(described_class.active).to include user }
-      it { expect(described_class.inactive).not_to include user }
+      it { expect(described_class.deactivated).not_to include user }
     end
 
     context 'when deactivated' do
       subject(:user) { create(:user, deactivated: true) }
 
       it { expect(described_class.active).not_to include user }
-      it { expect(described_class.inactive).to include user }
+      it { expect(described_class.deactivated).to include user }
+    end
+
+    context 'when not activated' do
+      subject(:user) { create(:user, provider: 'identity') }
+
+      it { expect(described_class.not_activated).to include user }
+      it { expect(described_class.active).not_to include user }
+      it { expect(described_class.deactivated).not_to include user }
     end
   end
 
@@ -224,7 +272,7 @@
 
   describe '#update_role' do
     context 'when getting new roles' do
-      subject(:user) { create(:user) }
+      subject(:user) { create(:user, :from_amber) }
 
       let(:role) { create(:role) }
 
@@ -390,7 +438,7 @@
 
   describe '#archive!' do
     context 'when archiving a user' do
-      subject(:user) { create(:user) }
+      subject(:user) { create(:user, identity: create(:identity)) }
 
       let(:nil_attributes) do
         %w[avatar_thumb_url email birthday]
@@ -405,6 +453,7 @@
       it { expect { user.archive! }.not_to(change(user, :id)) }
       it { expect { user.archive! }.not_to(change(user, :uid)) }
       it { expect { user.archive! }.not_to(change(user, :provider)) }
+      it { expect { user.archive! }.not_to(change(user, :identity)) }
 
       it do
         nil_attributes.each do |attribute|
@@ -413,4 +462,99 @@
       end
     end
   end
+
+  describe '#before_save' do
+    context 'identity' do
+      subject(:user) { create(:user, provider: 'identity') }
+
+      it { expect(user.activation_token).not_to be_nil }
+      it do 
+        expect(user.activation_token_valid_till).not_to be_nil
+        expect(user.activation_token_valid_till.day).to eq (Time.now + 5.day).day
+      end
+    end
+
+    context 'not identity' do
+      subject(:user) { create(:user) }
+
+      it { expect(user.activation_token).to be_nil }
+      it { expect(user.activation_token_valid_till).to be_nil }
+    end
+  end
+
+  describe '#after_save' do
+    context 'deactivated upon creation' do
+      subject(:user) { build(:user, deactivated: true) }
+
+      it do 
+        expect(user).to receive(:archive!)
+        user.save
+      end
+    end
+
+    context 'deactivated after update' do
+      subject(:user) { create(:user, deactivated: false) }
+
+      before { user.deactivated = true }
+
+      it do 
+        expect(user).to receive(:archive!)
+        user.save
+      end
+    end
+
+    context 'deactivated and not changed' do
+      subject(:user) { create(:user, deactivated: true) }
+
+      before { user.email = "valid@email.com" }
+
+      it do 
+        expect(user).not_to receive(:archive!)
+        user.save
+      end
+    end
+
+    context 'not deactivated upon creation' do
+      subject(:user) { build(:user, deactivated: false) }
+
+      it do 
+        expect(user).not_to receive(:archive!)
+        user.save
+      end
+    end
+
+    context 'not deactivated after update' do
+      subject(:user) { create(:user, deactivated: true) }
+
+      before { user.deactivated = false }
+
+      it do 
+        expect(user).not_to receive(:archive!)
+        user.save
+      end
+    end
+  end
+
+  describe '#after_create' do
+    context 'identity' do
+      subject(:user) { build(:user, :identity) }
+
+      it do 
+        expect(UserMailer).to send_email(:account_creation_email, :deliver_later, user)
+        user.save
+      end
+
+      after do
+        clear_enqueued_jobs
+      end
+    end
+
+    context 'not identity' do
+      subject(:user) { create(:user) }
+
+      before { user.save }
+
+      it { expect(enqueued_jobs.size).to eq(0) }
+    end
+  end
 end
diff --git a/spec/rails_helper.rb b/spec/rails_helper.rb
index f55e65a10..a3adb7bf2 100644
--- a/spec/rails_helper.rb
+++ b/spec/rails_helper.rb
@@ -31,6 +31,7 @@
 RSpec.configure do |config|
   config.include ActiveJob::TestHelper
   config.include Devise::Test::ControllerHelpers, type: :controller
+  config.include DeviseHelper, type: :request
 
   # Remove this line if you're not using ActiveRecord or ActiveRecord fixtures
   config.fixture_path = "#{::Rails.root}/spec/fixtures"
diff --git a/spec/support/devise_helper.rb b/spec/support/devise_helper.rb
new file mode 100644
index 000000000..eaa7d8660
--- /dev/null
+++ b/spec/support/devise_helper.rb
@@ -0,0 +1,15 @@
+module DeviseHelper
+  def signed_in?(user)
+    user == signed_in_user
+  end
+
+  def signed_in_user
+    user_session_info = response.request.env["rack.session"]["warden.user.user.key"]
+    if user_session_info
+      user_id = user_session_info[0][0]
+      User.find(user_id)
+    else
+      nil
+    end
+  end
+end
\ No newline at end of file
diff --git a/spec/support/mailer_matcher.rb b/spec/support/mailer_matcher.rb
new file mode 100644
index 000000000..ea7d88e30
--- /dev/null
+++ b/spec/support/mailer_matcher.rb
@@ -0,0 +1,9 @@
+require "rspec/expectations"
+
+RSpec::Matchers.define :send_email do |mailer_action, mailer_when, mailer_args|
+  match do |mailer_class|
+    message_delivery = instance_double(ActionMailer::MessageDelivery)
+    expect(mailer_class).to receive(mailer_action).with(mailer_args).and_return(message_delivery)
+    allow(message_delivery).to receive(mailer_when)
+  end
+end
\ No newline at end of file