diff --git a/src/Squidex.Domain.Users/UserManagerExtensions.cs b/src/Squidex.Domain.Users/UserManagerExtensions.cs
index ad5236d3e..fdf7ccc90 100644
--- a/src/Squidex.Domain.Users/UserManagerExtensions.cs
+++ b/src/Squidex.Domain.Users/UserManagerExtensions.cs
@@ -72,6 +72,14 @@ namespace Squidex.Domain.Users
             return user;
         }
 
+        public static Task<IdentityResult> UpdateAsync(this UserManager<IUser> userManager, IUser user, string email, string displayName)
+        {
+            user.UpdateEmail(email);
+            user.SetDisplayName(displayName);
+
+            return userManager.UpdateAsync(user);
+        }
+
         public static async Task UpdateAsync(this UserManager<IUser> userManager, string id, string email, string displayName, string password)
         {
             var user = await userManager.FindByIdAsync(id);
diff --git a/src/Squidex/AppServices.cs b/src/Squidex/AppServices.cs
index 730541815..52a582072 100644
--- a/src/Squidex/AppServices.cs
+++ b/src/Squidex/AppServices.cs
@@ -8,9 +8,10 @@
 
 using Microsoft.Extensions.Configuration;
 using Microsoft.Extensions.DependencyInjection;
+using Squidex.Areas.IdentityServer.Config;
 using Squidex.Config;
+using Squidex.Config.Authentication;
 using Squidex.Config.Domain;
-using Squidex.Config.Identity;
 using Squidex.Config.Swagger;
 using Squidex.Config.Web;
 
@@ -26,10 +27,8 @@ namespace Squidex
 
             services.AddMyAssetServices(config);
             services.AddMyAuthentication(config);
-            services.AddMyDataProtectection(config);
             services.AddMyEventPublishersServices(config);
             services.AddMyEventStoreServices(config);
-            services.AddMyIdentity();
             services.AddMyIdentityServer();
             services.AddMyInfrastructureServices(config);
             services.AddMyMvc();
diff --git a/src/Squidex/Areas/IdentityServer/Config/IdentityServerExtensions.cs b/src/Squidex/Areas/IdentityServer/Config/IdentityServerExtensions.cs
index 7981a0982..1cc9a4e66 100644
--- a/src/Squidex/Areas/IdentityServer/Config/IdentityServerExtensions.cs
+++ b/src/Squidex/Areas/IdentityServer/Config/IdentityServerExtensions.cs
@@ -30,24 +30,24 @@ namespace Squidex.Areas.IdentityServer.Config
             return app;
         }
 
-        public static IApplicationBuilder UseMyAdminRole(this IApplicationBuilder app)
+        public static IServiceProvider UseMyAdminRole(this IServiceProvider services)
         {
-            var roleManager = app.ApplicationServices.GetRequiredService<RoleManager<IRole>>();
-            var roleFactory = app.ApplicationServices.GetRequiredService<IRoleFactory>();
+            var roleManager = services.GetRequiredService<RoleManager<IRole>>();
+            var roleFactory = services.GetRequiredService<IRoleFactory>();
 
             roleManager.CreateAsync(roleFactory.Create(SquidexRoles.Administrator)).Wait();
 
-            return app;
+            return services;
         }
 
-        public static IApplicationBuilder UseMyAdmin(this IApplicationBuilder app)
+        public static IServiceProvider UseMyAdmin(this IServiceProvider services)
         {
-            var options = app.ApplicationServices.GetService<IOptions<MyIdentityOptions>>().Value;
+            var options = services.GetService<IOptions<MyIdentityOptions>>().Value;
 
-            var userManager = app.ApplicationServices.GetService<UserManager<IUser>>();
-            var userFactory = app.ApplicationServices.GetService<IUserFactory>();
+            var userManager = services.GetService<UserManager<IUser>>();
+            var userFactory = services.GetService<IUserFactory>();
 
-            var log = app.ApplicationServices.GetService<ISemanticLog>();
+            var log = services.GetService<ISemanticLog>();
 
             if (options.IsAdminConfigured())
             {
@@ -74,7 +74,7 @@ namespace Squidex.Areas.IdentityServer.Config
                 }).Wait();
             }
 
-            return app;
+            return services;
         }
     }
 }
diff --git a/src/Squidex/Areas/IdentityServer/Config/IdentityServerServices.cs b/src/Squidex/Areas/IdentityServer/Config/IdentityServerServices.cs
index e3c8cbf26..da8d7386c 100644
--- a/src/Squidex/Areas/IdentityServer/Config/IdentityServerServices.cs
+++ b/src/Squidex/Areas/IdentityServer/Config/IdentityServerServices.cs
@@ -12,11 +12,14 @@ using System.Security.Cryptography.X509Certificates;
 using IdentityModel;
 using IdentityServer4.Models;
 using IdentityServer4.Stores;
+using Microsoft.AspNetCore.DataProtection;
+using Microsoft.AspNetCore.DataProtection.Repositories;
 using Microsoft.AspNetCore.Identity;
 using Microsoft.Extensions.Configuration;
 using Microsoft.Extensions.DependencyInjection;
 using Squidex.Config;
 using Squidex.Domain.Users;
+using Squidex.Domain.Users.DataProtection.Orleans;
 using Squidex.Shared.Identity;
 using Squidex.Shared.Users;
 
@@ -44,9 +47,13 @@ namespace Squidex.Areas.IdentityServer.Config
             services.AddIdentity<IUser, IRole>()
                 .AddDefaultTokenProviders();
 
+            services.AddDataProtection().SetApplicationName("Squidex");
+
             services.AddSingleton(GetApiResources());
             services.AddSingleton(GetIdentityResources());
 
+            services.AddSingleton<IXmlRepository,
+                OrleansXmlRepository>();
             services.AddSingleton<IUserClaimsPrincipalFactory<IUser>,
                 UserClaimsPrincipalFactoryWithEmail>();
             services.AddSingleton<IClientStore,
@@ -64,21 +71,6 @@ namespace Squidex.Areas.IdentityServer.Config
                 .AddSigningCredential(certificate);
         }
 
-        public static void AddMyDataProtectection(this IServiceCollection services, IConfiguration config)
-        {
-            var dataProtection = services.AddDataProtection().SetApplicationName("Squidex");
-
-            services.AddSingleton<OrleansXmlRepository>();
-
-            services.AddSingleton<IConfigureOptions<KeyManagementOptions>>(s =>
-            {
-                return new ConfigureOptions<KeyManagementOptions>(options =>
-                {
-                    options.XmlRepository = s.GetRequiredService<OrleansXmlRepository>();
-                });
-            });
-        }
-
         private static IEnumerable<ApiResource> GetApiResources()
         {
             yield return new ApiResource(Constants.ApiScope)
diff --git a/src/Squidex/Areas/IdentityServer/Config/LazyClientStore.cs b/src/Squidex/Areas/IdentityServer/Config/LazyClientStore.cs
index 5fab6e5b9..2c1268e6d 100644
--- a/src/Squidex/Areas/IdentityServer/Config/LazyClientStore.cs
+++ b/src/Squidex/Areas/IdentityServer/Config/LazyClientStore.cs
@@ -131,7 +131,8 @@ namespace Squidex.Areas.IdentityServer.Config
                 ClientSecrets = new List<Secret> { new Secret(Constants.InternalClientSecret) },
                 RedirectUris = new List<string>
                 {
-                    urlsOptions.BuildUrl("signin-oidc", false)
+                    urlsOptions.BuildUrl("orleans/signin-oidc", false),
+                    urlsOptions.BuildUrl("portal/signin-oidc", false)
                 },
                 AccessTokenLifetime = (int)TimeSpan.FromDays(30).TotalSeconds,
                 AllowedGrantTypes = GrantTypes.ImplicitAndClientCredentials,
diff --git a/src/Squidex/Areas/IdentityServer/Controllers/Account/AccountController.cs b/src/Squidex/Areas/IdentityServer/Controllers/Account/AccountController.cs
index 1db1f1393..5827e960e 100644
--- a/src/Squidex/Areas/IdentityServer/Controllers/Account/AccountController.cs
+++ b/src/Squidex/Areas/IdentityServer/Controllers/Account/AccountController.cs
@@ -19,7 +19,7 @@ using Microsoft.AspNetCore.Mvc;
 using Microsoft.Extensions.Options;
 using NSwag.Annotations;
 using Squidex.Config;
-using Squidex.Config.Identity;
+using Squidex.Config.Authentication;
 using Squidex.Domain.Users;
 using Squidex.Infrastructure;
 using Squidex.Infrastructure.Log;
@@ -30,7 +30,7 @@ using Squidex.Shared.Users;
 namespace Squidex.Areas.IdentityServer.Controllers.Account
 {
     [SwaggerIgnore]
-    public sealed class AccountController : Controller
+    public sealed class AccountController : IdentityServerController
     {
         private readonly SignInManager<IUser> signInManager;
         private readonly UserManager<IUser> userManager;
diff --git a/src/Squidex/Areas/IdentityServer/Controllers/Error/ErrorController.cs b/src/Squidex/Areas/IdentityServer/Controllers/Error/ErrorController.cs
index 442c91128..d3055202b 100644
--- a/src/Squidex/Areas/IdentityServer/Controllers/Error/ErrorController.cs
+++ b/src/Squidex/Areas/IdentityServer/Controllers/Error/ErrorController.cs
@@ -12,7 +12,7 @@ using NSwag.Annotations;
 namespace Squidex.Areas.IdentityServer.Controllers.Error
 {
     [SwaggerIgnore]
-    public sealed class ErrorController : Controller
+    public sealed class ErrorController : IdentityServerController
     {
         [Route("error/")]
         public IActionResult Error()
diff --git a/src/Squidex/Areas/IdentityServer/Controllers/Extensions.cs b/src/Squidex/Areas/IdentityServer/Controllers/Extensions.cs
index f6c2503af..eb77494b2 100644
--- a/src/Squidex/Areas/IdentityServer/Controllers/Extensions.cs
+++ b/src/Squidex/Areas/IdentityServer/Controllers/Extensions.cs
@@ -16,14 +16,6 @@ namespace Squidex.Areas.IdentityServer.Controllers
 {
     public static class Extensions
     {
-        public static Task<IdentityResult> UpdateAsync(this UserManager<IUser> userManager, IUser user, string email, string displayName)
-        {
-            user.UpdateEmail(email);
-            user.SetDisplayName(displayName);
-
-            return userManager.UpdateAsync(user);
-        }
-
         public static async Task<ExternalLoginInfo> GetExternalLoginInfoWithDisplayNameAsync(this SignInManager<IUser> signInManager, string expectedXsrf = null)
         {
             var externalLogin = await signInManager.GetExternalLoginInfoAsync(expectedXsrf);
diff --git a/src/Squidex/Areas/IdentityServer/Controllers/IdentityServerController.cs b/src/Squidex/Areas/IdentityServer/Controllers/IdentityServerController.cs
new file mode 100644
index 000000000..80e4b12a2
--- /dev/null
+++ b/src/Squidex/Areas/IdentityServer/Controllers/IdentityServerController.cs
@@ -0,0 +1,25 @@
+// ==========================================================================
+//  Extensions.cs
+//  Squidex Headless CMS
+// ==========================================================================
+//  Copyright (c) Squidex Group
+//  All rights reserved.
+// ==========================================================================
+
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.AspNetCore.Mvc.Filters;
+
+namespace Squidex.Areas.IdentityServer.Controllers
+{
+    [Area("IdentityServer")]
+    public abstract class IdentityServerController : Controller
+    {
+        public override void OnActionExecuting(ActionExecutingContext context)
+        {
+            if (!context.HttpContext.Request.PathBase.StartsWithSegments("/identity-server"))
+            {
+                context.Result = new RedirectResult("/");
+            }
+        }
+    }
+}
diff --git a/src/Squidex/Areas/IdentityServer/Controllers/Profile/ProfileController.cs b/src/Squidex/Areas/IdentityServer/Controllers/Profile/ProfileController.cs
index 326d19598..1ea73d5b8 100644
--- a/src/Squidex/Areas/IdentityServer/Controllers/Profile/ProfileController.cs
+++ b/src/Squidex/Areas/IdentityServer/Controllers/Profile/ProfileController.cs
@@ -18,7 +18,7 @@ using Microsoft.AspNetCore.Identity;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.Extensions.Options;
 using NSwag.Annotations;
-using Squidex.Config.Identity;
+using Squidex.Config;
 using Squidex.Domain.Users;
 using Squidex.Infrastructure.Assets;
 using Squidex.Infrastructure.Reflection;
@@ -28,7 +28,7 @@ namespace Squidex.Areas.IdentityServer.Controllers.Profile
 {
     [Authorize]
     [SwaggerIgnore]
-    public sealed class ProfileController : Controller
+    public sealed class ProfileController : IdentityServerController
     {
         private readonly SignInManager<IUser> signInManager;
         private readonly UserManager<IUser> userManager;
diff --git a/src/Squidex/Areas/IdentityServer/Startup.cs b/src/Squidex/Areas/IdentityServer/Startup.cs
new file mode 100644
index 000000000..563060614
--- /dev/null
+++ b/src/Squidex/Areas/IdentityServer/Startup.cs
@@ -0,0 +1,44 @@
+// ==========================================================================
+//  Startup.cs
+//  Squidex Headless CMS
+// ==========================================================================
+//  Copyright (c) Squidex Group
+//  All rights reserved.
+// ==========================================================================
+
+using Microsoft.AspNetCore.Builder;
+using Microsoft.AspNetCore.Hosting;
+using Microsoft.Extensions.DependencyInjection;
+using Squidex.Areas.IdentityServer.Config;
+using Squidex.Config;
+
+namespace Squidex.Areas.IdentityServer
+{
+    public static class Startup
+    {
+        public static void ConfigureIdentityServer(this IApplicationBuilder app)
+        {
+            app.ApplicationServices.UseMyAdminRole();
+            app.ApplicationServices.UseMyAdmin();
+
+            var environment = app.ApplicationServices.GetRequiredService<IHostingEnvironment>();
+
+            app.Map(Constants.IdentityPrefix, identityApp =>
+            {
+                app.UseMyIdentityServer();
+
+                if (environment.IsDevelopment())
+                {
+                    identityApp.UseDeveloperExceptionPage();
+                }
+                else
+                {
+                    identityApp.UseExceptionHandler("/error");
+                }
+
+                identityApp.UseStaticFiles();
+                identityApp.UseMvc();
+            });
+        }
+    }
+}
diff --git a/src/Squidex/Areas/OrleansDashboard/Startup.cs b/src/Squidex/Areas/OrleansDashboard/Startup.cs
index f2ccca37e..381117424 100644
--- a/src/Squidex/Areas/OrleansDashboard/Startup.cs
+++ b/src/Squidex/Areas/OrleansDashboard/Startup.cs
@@ -18,6 +18,7 @@ namespace Squidex.Areas.OrleansDashboard
         {
             app.Map("/orleans", orleansApp =>
             {
+                orleansApp.UseAuthentication();
                 orleansApp.UseMiddleware<OrleansDashboardAuthenticationMiddleware>();
                 orleansApp.UseOrleansDashboard();
             });
diff --git a/src/Squidex/Config/Authentication/AuthenticationExtensions.cs b/src/Squidex/Config/Authentication/AuthenticationExtensions.cs
deleted file mode 100644
index 69fe4f294..000000000
--- a/src/Squidex/Config/Authentication/AuthenticationExtensions.cs
+++ /dev/null
@@ -1,22 +0,0 @@
-// ==========================================================================
-//  AuthenticationExtensions.cs
-//  Squidex Headless CMS
-// ==========================================================================
-//  Copyright (c) Squidex Group
-//  All rights reserved.
-// ==========================================================================
-
-using Microsoft.AspNetCore.Builder;
-
-namespace Squidex.Config.Identity
-{
-    public static class AuthenticationExtensions
-    {
-        public static IApplicationBuilder UseMyAuthentication(this IApplicationBuilder app)
-        {
-            app.UseAuthentication();
-
-            return app;
-        }
-    }
-}
diff --git a/src/Squidex/Config/Authentication/AuthenticationServices.cs b/src/Squidex/Config/Authentication/AuthenticationServices.cs
index 1b9420896..4fdc73456 100644
--- a/src/Squidex/Config/Authentication/AuthenticationServices.cs
+++ b/src/Squidex/Config/Authentication/AuthenticationServices.cs
@@ -13,7 +13,7 @@ using Microsoft.Extensions.Configuration;
 using Microsoft.Extensions.DependencyInjection;
 using Squidex.Infrastructure;
 
-namespace Squidex.Config.Identity
+namespace Squidex.Config.Authentication
 {
     public static class AuthenticationServices
     {
diff --git a/src/Squidex/Config/Authentication/GoogleAuthenticationServices.cs b/src/Squidex/Config/Authentication/GoogleAuthenticationServices.cs
index 43dd42477..0ea458429 100644
--- a/src/Squidex/Config/Authentication/GoogleAuthenticationServices.cs
+++ b/src/Squidex/Config/Authentication/GoogleAuthenticationServices.cs
@@ -9,7 +9,7 @@
 using Microsoft.AspNetCore.Authentication;
 using Microsoft.Extensions.DependencyInjection;
 
-namespace Squidex.Config.Identity
+namespace Squidex.Config.Authentication
 {
     public static class GoogleAuthenticationServices
     {
diff --git a/src/Squidex/Config/Authentication/GoogleHandler.cs b/src/Squidex/Config/Authentication/GoogleHandler.cs
index df6f8c0f7..df3429edf 100644
--- a/src/Squidex/Config/Authentication/GoogleHandler.cs
+++ b/src/Squidex/Config/Authentication/GoogleHandler.cs
@@ -14,7 +14,7 @@ using Microsoft.AspNetCore.Authentication.OAuth;
 using Squidex.Infrastructure.Tasks;
 using Squidex.Shared.Identity;
 
-namespace Squidex.Config.Identity
+namespace Squidex.Config.Authentication
 {
     public sealed class GoogleHandler : OAuthEvents
     {
diff --git a/src/Squidex/Config/Authentication/MicrosoftAuthenticationServices.cs b/src/Squidex/Config/Authentication/MicrosoftAuthenticationServices.cs
index b2ceeeaaf..a71c573b7 100644
--- a/src/Squidex/Config/Authentication/MicrosoftAuthenticationServices.cs
+++ b/src/Squidex/Config/Authentication/MicrosoftAuthenticationServices.cs
@@ -9,7 +9,7 @@
 using Microsoft.AspNetCore.Authentication;
 using Microsoft.Extensions.DependencyInjection;
 
-namespace Squidex.Config.Identity
+namespace Squidex.Config.Authentication
 {
     public static class MicrosoftAuthenticationServices
     {
diff --git a/src/Squidex/Config/Authentication/MicrosoftHandler.cs b/src/Squidex/Config/Authentication/MicrosoftHandler.cs
index 7fd7de759..bad4a8c34 100644
--- a/src/Squidex/Config/Authentication/MicrosoftHandler.cs
+++ b/src/Squidex/Config/Authentication/MicrosoftHandler.cs
@@ -11,7 +11,7 @@ using System.Threading.Tasks;
 using Microsoft.AspNetCore.Authentication.OAuth;
 using Squidex.Shared.Identity;
 
-namespace Squidex.Config.Identity
+namespace Squidex.Config.Authentication
 {
     public sealed class MicrosoftHandler : OAuthEvents
     {
diff --git a/src/Squidex/Config/Domain/AssetServices.cs b/src/Squidex/Config/Domain/AssetServices.cs
index cca549879..3694cde33 100644
--- a/src/Squidex/Config/Domain/AssetServices.cs
+++ b/src/Squidex/Config/Domain/AssetServices.cs
@@ -24,7 +24,7 @@ namespace Squidex.Config.Domain
                 {
                     var path = config.GetRequiredValue("assetStore:folder:path");
 
-                    services.AddSingleton(c => new FolderAssetStore(path, c.GetRequiredService<ISemanticLog>()))
+                    services.AddSingletonAs(c => new FolderAssetStore(path, c.GetRequiredService<ISemanticLog>()))
                         .As<IAssetStore>()
                         .As<IExternalSystem>();
                 },
@@ -32,7 +32,7 @@ namespace Squidex.Config.Domain
                 {
                     var bucketName = config.GetRequiredValue("assetStore:googleCloud:bucket");
 
-                    services.AddSingleton(c => new GoogleCloudAssetStore(bucketName))
+                    services.AddSingletonAs(c => new GoogleCloudAssetStore(bucketName))
                         .As<IAssetStore>()
                         .As<IExternalSystem>();
                 },
@@ -41,7 +41,7 @@ namespace Squidex.Config.Domain
                     var connectionString = config.GetRequiredValue("assetStore:azureBlob:connectionString");
                     var containerName = config.GetRequiredValue("assetStore:azureBlob:containerName");
 
-                    services.AddSingleton(c => new AzureBlobAssetStore(connectionString, containerName))
+                    services.AddSingletonAs(c => new AzureBlobAssetStore(connectionString, containerName))
                         .As<IAssetStore>()
                         .As<IExternalSystem>();
                 }
diff --git a/src/Squidex/Config/Domain/EventPublishersServices.cs b/src/Squidex/Config/Domain/EventPublishersServices.cs
index 0d3edbacb..76f777b95 100644
--- a/src/Squidex/Config/Domain/EventPublishersServices.cs
+++ b/src/Squidex/Config/Domain/EventPublishersServices.cs
@@ -54,7 +54,7 @@ namespace Squidex.Config.Domain
 
                     if (enabled)
                     {
-                        services.AddSingleton(c => new RabbitMqEventConsumer(c.GetRequiredService<JsonSerializerSettings>(), name, publisherConfig, exchange, eventsFilter))
+                        services.AddSingletonAs(c => new RabbitMqEventConsumer(c.GetRequiredService<JsonSerializerSettings>(), name, publisherConfig, exchange, eventsFilter))
                             .As<IEventConsumer>()
                             .As<IExternalSystem>();
                     }
diff --git a/src/Squidex/Config/Domain/EventStoreServices.cs b/src/Squidex/Config/Domain/EventStoreServices.cs
index 5038f07c1..d31f616fa 100644
--- a/src/Squidex/Config/Domain/EventStoreServices.cs
+++ b/src/Squidex/Config/Domain/EventStoreServices.cs
@@ -33,7 +33,7 @@ namespace Squidex.Config.Domain
                     var mongoConfiguration = config.GetRequiredValue("eventStore:mongoDb:configuration");
                     var mongoDatabaseName = config.GetRequiredValue("eventStore:mongoDb:database");
 
-                    services.AddSingleton(c =>
+                    services.AddSingletonAs(c =>
                         {
                             var mongoClient = Singletons<IMongoClient>.GetOrAdd(mongoConfiguration, s => new MongoClient(s));
                             var mongDatabase = mongoClient.GetDatabase(mongoDatabaseName);
@@ -51,7 +51,7 @@ namespace Squidex.Config.Domain
 
                     var connection = EventStoreConnection.Create(eventStoreConfiguration);
 
-                    services.AddSingleton(c => new GetEventStore(connection, eventStorePrefix, eventStoreProjectionHost))
+                    services.AddSingletonAs(c => new GetEventStore(connection, eventStorePrefix, eventStoreProjectionHost))
                         .As<IExternalSystem>()
                         .As<IEventStore>();
                 }
diff --git a/src/Squidex/Config/Domain/InfrastructureServices.cs b/src/Squidex/Config/Domain/InfrastructureServices.cs
index b8f9a898b..7062de685 100644
--- a/src/Squidex/Config/Domain/InfrastructureServices.cs
+++ b/src/Squidex/Config/Domain/InfrastructureServices.cs
@@ -33,73 +33,73 @@ namespace Squidex.Config.Domain
         {
             if (config.GetValue<bool>("logging:human"))
             {
-                services.AddSingleton(c => new Func<IObjectWriter>(() => new JsonLogWriter(Formatting.Indented, true)));
+                services.AddSingletonAs(c => new Func<IObjectWriter>(() => new JsonLogWriter(Formatting.Indented, true)));
             }
             else
             {
-                services.AddSingleton(c => new Func<IObjectWriter>(() => new JsonLogWriter()));
+                services.AddSingletonAs(c => new Func<IObjectWriter>(() => new JsonLogWriter()));
             }
 
             var loggingFile = config.GetValue<string>("logging:file");
 
             if (!string.IsNullOrWhiteSpace(loggingFile))
             {
-                services.AddSingleton(new FileChannel(loggingFile))
+                services.AddSingletonAs(new FileChannel(loggingFile))
                     .As<ILogChannel>()
                     .As<IExternalSystem>();
             }
 
-            services.AddSingleton(c => new ApplicationInfoLogAppender(typeof(Program).Assembly, Guid.NewGuid()))
+            services.AddSingletonAs(c => new ApplicationInfoLogAppender(typeof(Program).Assembly, Guid.NewGuid()))
                 .As<ILogAppender>();
 
-            services.AddSingleton<ActionContextLogAppender>()
+            services.AddSingletonAs<ActionContextLogAppender>()
                 .As<ILogAppender>();
 
-            services.AddSingleton<TimestampLogAppender>()
+            services.AddSingletonAs<TimestampLogAppender>()
                 .As<ILogAppender>();
 
-            services.AddSingleton<DebugLogChannel>()
+            services.AddSingletonAs<DebugLogChannel>()
                 .As<ILogChannel>();
 
-            services.AddSingleton<ConsoleLogChannel>()
+            services.AddSingletonAs<ConsoleLogChannel>()
                 .As<ILogChannel>();
 
-            services.AddSingleton<SemanticLog>()
+            services.AddSingletonAs<SemanticLog>()
                 .As<ISemanticLog>();
 
-            services.AddSingleton(SystemClock.Instance)
+            services.AddSingletonAs(SystemClock.Instance)
                 .As<IClock>();
 
-            services.AddSingleton<BackgroundUsageTracker>()
+            services.AddSingletonAs<BackgroundUsageTracker>()
                 .As<IUsageTracker>();
 
-            services.AddSingleton<HttpContextAccessor>()
+            services.AddSingletonAs<HttpContextAccessor>()
                 .As<IHttpContextAccessor>();
 
-            services.AddSingleton<ActionContextAccessor>()
+            services.AddSingletonAs<ActionContextAccessor>()
                 .As<IActionContextAccessor>();
 
-            services.AddSingleton<DefaultDomainObjectRepository>()
+            services.AddSingletonAs<DefaultDomainObjectRepository>()
                 .As<IDomainObjectRepository>();
 
-            services.AddSingleton<DefaultDomainObjectFactory>()
+            services.AddSingletonAs<DefaultDomainObjectFactory>()
                 .As<IDomainObjectFactory>();
 
-            services.AddSingleton<AggregateHandler>()
+            services.AddSingletonAs<AggregateHandler>()
                 .As<IAggregateHandler>();
 
-            services.AddSingleton<InMemoryCommandBus>()
+            services.AddSingletonAs<InMemoryCommandBus>()
                 .As<ICommandBus>();
 
-            services.AddSingleton<DefaultStreamNameResolver>()
+            services.AddSingletonAs<DefaultStreamNameResolver>()
                 .As<IStreamNameResolver>();
 
-            services.AddSingleton<ImageSharpAssetThumbnailGenerator>()
+            services.AddSingletonAs<ImageSharpAssetThumbnailGenerator>()
                 .As<IAssetThumbnailGenerator>();
 
-            services.AddSingleton<EventDataFormatter>();
+            services.AddSingletonAs<EventDataFormatter>();
 
-            services.AddSingleton(c => new InvalidatingMemoryCache(
+            services.AddSingletonAs(c => new InvalidatingMemoryCache(
                     new MemoryCache(
                         c.GetRequiredService<IOptions<MemoryCacheOptions>>()),
                     c.GetRequiredService<IPubSub>()))
diff --git a/src/Squidex/Config/Domain/ReadServices.cs b/src/Squidex/Config/Domain/ReadServices.cs
index 2448ef974..3c60cef01 100644
--- a/src/Squidex/Config/Domain/ReadServices.cs
+++ b/src/Squidex/Config/Domain/ReadServices.cs
@@ -40,71 +40,71 @@ namespace Squidex.Config.Domain
         {
             var exposeSourceUrl = config.GetOptionalValue("assetStore:exposeSourceUrl", true);
 
-            services.AddSingleton(c => new GraphQLUrlGenerator(
+            services.AddSingletonAs(c => new GraphQLUrlGenerator(
                     c.GetRequiredService<IOptions<MyUrlsOptions>>(),
                     c.GetRequiredService<IAssetStore>(),
                     exposeSourceUrl))
                 .As<IGraphQLUrlGenerator>();
 
-            services.AddSingleton(c => c.GetService<IOptions<MyUsageOptions>>()?.Value?.Plans.OrEmpty());
+            services.AddSingletonAs(c => c.GetService<IOptions<MyUsageOptions>>()?.Value?.Plans.OrEmpty());
 
-            services.AddSingleton<CachingGraphQLService>()
+            services.AddSingletonAs<CachingGraphQLService>()
                 .As<IGraphQLService>();
 
-            services.AddSingleton<ContentQueryService>()
+            services.AddSingletonAs<ContentQueryService>()
                 .As<IContentQueryService>();
 
-            services.AddSingleton<ConfigAppPlansProvider>()
+            services.AddSingletonAs<ConfigAppPlansProvider>()
                 .As<IAppPlansProvider>();
 
-            services.AddSingleton<AssetUserPictureStore>()
+            services.AddSingletonAs<AssetUserPictureStore>()
                 .As<IUserPictureStore>();
 
-            services.AddSingleton<AppHistoryEventsCreator>()
+            services.AddSingletonAs<AppHistoryEventsCreator>()
                 .As<IHistoryEventsCreator>();
 
-            services.AddSingleton<ContentHistoryEventsCreator>()
+            services.AddSingletonAs<ContentHistoryEventsCreator>()
                 .As<IHistoryEventsCreator>();
 
-            services.AddSingleton<SchemaHistoryEventsCreator>()
+            services.AddSingletonAs<SchemaHistoryEventsCreator>()
                 .As<IHistoryEventsCreator>();
 
-            services.AddSingleton<NoopAppPlanBillingManager>()
+            services.AddSingletonAs<NoopAppPlanBillingManager>()
                 .As<IAppPlanBillingManager>();
 
-            services.AddSingleton<OrleansEventNotifier>()
+            services.AddSingletonAs<OrleansEventNotifier>()
                 .As<IEventNotifier>();
 
-            services.AddSingleton<RuleDequeuer>()
+            services.AddSingletonAs<RuleDequeuer>()
                 .As<IExternalSystem>();
 
-            services.AddSingleton<OrleansAppProvider>()
+            services.AddSingletonAs<OrleansAppProvider>()
                 .As<IAppProvider>();
 
-            services.AddSingleton<AppStateEventConsumer>()
+            services.AddSingletonAs<AppStateEventConsumer>()
                 .As<IEventConsumer>();
 
-            services.AddSingleton<RuleEnqueuer>()
+            services.AddSingletonAs<RuleEnqueuer>()
                 .As<IEventConsumer>();
 
-            services.AddSingleton<ContentChangedTriggerHandler>()
+            services.AddSingletonAs<ContentChangedTriggerHandler>()
                 .As<IRuleTriggerHandler>();
 
-            services.AddSingleton<WebhookActionHandler>()
+            services.AddSingletonAs<WebhookActionHandler>()
                 .As<IRuleActionHandler>();
 
-            services.AddSingleton<IEventConsumer>(c =>
+            services.AddSingletonAs<IEventConsumer>(c =>
                 new CompoundEventConsumer(c.GetServices<IAssetEventConsumer>().ToArray()));
 
-            services.AddSingleton(c =>
+            services.AddSingletonAs(c =>
             {
                 var allEventConsumers = c.GetServices<IEventConsumer>();
 
                 return new EventConsumerFactory(n => allEventConsumers.FirstOrDefault(x => x.Name == n));
             });
 
-            services.AddSingleton<RuleService>();
-            services.AddSingleton<EdmModelBuilder>();
+            services.AddSingletonAs<RuleService>();
+            services.AddSingletonAs<EdmModelBuilder>();
         }
     }
 }
diff --git a/src/Squidex/Config/Domain/SerializationServices.cs b/src/Squidex/Config/Domain/SerializationServices.cs
index 75b9ed153..48b621717 100644
--- a/src/Squidex/Config/Domain/SerializationServices.cs
+++ b/src/Squidex/Config/Domain/SerializationServices.cs
@@ -81,10 +81,10 @@ namespace Squidex.Config.Domain
 
         public static IServiceCollection AddMySerializers(this IServiceCollection services)
         {
-            services.AddSingleton(t => TypeNameRegistry);
-            services.AddSingleton(t => FieldRegistry);
-            services.AddSingleton(t => SerializerSettings);
-            services.AddSingleton(t => JsonSerializer.Create(SerializerSettings));
+            services.AddSingletonAs(t => TypeNameRegistry);
+            services.AddSingletonAs(t => FieldRegistry);
+            services.AddSingletonAs(t => SerializerSettings);
+            services.AddSingletonAs(t => JsonSerializer.Create(SerializerSettings));
 
             return services;
         }
diff --git a/src/Squidex/Config/Domain/StoreServices.cs b/src/Squidex/Config/Domain/StoreServices.cs
index 7eddb48ad..d56a8c26c 100644
--- a/src/Squidex/Config/Domain/StoreServices.cs
+++ b/src/Squidex/Config/Domain/StoreServices.cs
@@ -48,44 +48,44 @@ namespace Squidex.Config.Domain
                     var mongoDatabase = mongoClient.GetDatabase(mongoDatabaseName);
                     var mongoContentDatabase = mongoClient.GetDatabase(mongoContentDatabaseName);
 
-                    services.AddSingleton(c => new MongoUserStore(mongoDatabase))
+                    services.AddSingletonAs(c => new MongoUserStore(mongoDatabase))
                         .As<IUserStore<IUser>>()
                         .As<IUserFactory>()
                         .As<IUserResolver>()
                         .As<IExternalSystem>();
 
-                    services.AddSingleton(c => new MongoRoleStore(mongoDatabase))
+                    services.AddSingletonAs(c => new MongoRoleStore(mongoDatabase))
                         .As<IRoleStore<IRole>>()
                         .As<IRoleFactory>()
                         .As<IExternalSystem>();
 
-                    services.AddSingleton(c => new MongoPersistedGrantStore(mongoDatabase))
+                    services.AddSingletonAs(c => new MongoPersistedGrantStore(mongoDatabase))
                         .As<IPersistedGrantStore>()
                         .As<IExternalSystem>();
 
-                    services.AddSingleton(c => new MongoUsageStore(mongoDatabase))
+                    services.AddSingletonAs(c => new MongoUsageStore(mongoDatabase))
                         .As<IUsageStore>()
                         .As<IExternalSystem>();
 
-                    services.AddSingleton(c => new MongoContentRepository(mongoContentDatabase, c.GetService<IAppProvider>()))
+                    services.AddSingletonAs(c => new MongoContentRepository(mongoContentDatabase, c.GetService<IAppProvider>()))
                         .As<IContentRepository>()
                         .As<IEventConsumer>();
 
-                    services.AddSingleton(c => new MongoRuleEventRepository(mongoDatabase))
+                    services.AddSingletonAs(c => new MongoRuleEventRepository(mongoDatabase))
                         .As<IRuleEventRepository>()
                         .As<IExternalSystem>();
 
-                    services.AddSingleton(c => new MongoHistoryEventRepository(mongoDatabase, c.GetServices<IHistoryEventsCreator>()))
+                    services.AddSingletonAs(c => new MongoHistoryEventRepository(mongoDatabase, c.GetServices<IHistoryEventsCreator>()))
                         .As<IHistoryEventRepository>()
                         .As<IEventConsumer>()
                         .As<IExternalSystem>();
 
-                    services.AddSingleton(c => new MongoAssetStatsRepository(mongoDatabase))
+                    services.AddSingletonAs(c => new MongoAssetStatsRepository(mongoDatabase))
                         .As<IAssetStatsRepository>()
                         .As<IAssetEventConsumer>()
                         .As<IExternalSystem>();
 
-                    services.AddSingleton(c => new MongoAssetRepository(mongoDatabase))
+                    services.AddSingletonAs(c => new MongoAssetRepository(mongoDatabase))
                         .As<IAssetRepository>()
                         .As<IAssetEventConsumer>()
                         .As<IExternalSystem>();
diff --git a/src/Squidex/Config/Domain/WriteServices.cs b/src/Squidex/Config/Domain/WriteServices.cs
index 6282d19ab..bd9936d2e 100644
--- a/src/Squidex/Config/Domain/WriteServices.cs
+++ b/src/Squidex/Config/Domain/WriteServices.cs
@@ -24,51 +24,51 @@ namespace Squidex.Config.Domain
     {
         public static void AddMyWriteServices(this IServiceCollection services)
         {
-            services.AddSingleton<NoopUserEvents>()
+            services.AddSingletonAs<NoopUserEvents>()
                 .As<IUserEvents>();
 
-            services.AddSingleton<JintScriptEngine>()
+            services.AddSingletonAs<JintScriptEngine>()
                 .As<IScriptEngine>();
 
-            services.AddSingleton<ContentVersionLoader>()
+            services.AddSingletonAs<ContentVersionLoader>()
                 .As<IContentVersionLoader>();
 
-            services.AddSingleton<ETagCommandMiddleware>()
+            services.AddSingletonAs<ETagCommandMiddleware>()
                 .As<ICommandMiddleware>();
 
-            services.AddSingleton<EnrichWithTimestampCommandMiddleware>()
+            services.AddSingletonAs<EnrichWithTimestampCommandMiddleware>()
                 .As<ICommandMiddleware>();
 
-            services.AddSingleton<EnrichWithActorCommandMiddleware>()
+            services.AddSingletonAs<EnrichWithActorCommandMiddleware>()
                 .As<ICommandMiddleware>();
 
-            services.AddSingleton<EnrichWithAppIdCommandMiddleware>()
+            services.AddSingletonAs<EnrichWithAppIdCommandMiddleware>()
                 .As<ICommandMiddleware>();
 
-            services.AddSingleton<EnrichWithSchemaIdCommandMiddleware>()
+            services.AddSingletonAs<EnrichWithSchemaIdCommandMiddleware>()
                 .As<ICommandMiddleware>();
 
-            services.AddSingleton<AppCommandMiddleware>()
+            services.AddSingletonAs<AppCommandMiddleware>()
                 .As<ICommandMiddleware>();
 
-            services.AddSingleton<AssetCommandMiddleware>()
+            services.AddSingletonAs<AssetCommandMiddleware>()
                 .As<ICommandMiddleware>();
 
-            services.AddSingleton<ContentCommandMiddleware>()
+            services.AddSingletonAs<ContentCommandMiddleware>()
                 .As<ICommandMiddleware>();
 
-            services.AddSingleton<SchemaCommandMiddleware>()
+            services.AddSingletonAs<SchemaCommandMiddleware>()
                 .As<ICommandMiddleware>();
 
-            services.AddSingleton<RuleCommandMiddleware>()
+            services.AddSingletonAs<RuleCommandMiddleware>()
                 .As<ICommandMiddleware>();
 
-            services.AddSingleton<DomainObjectFactoryFunction<AppDomainObject>>(c => (id => new AppDomainObject(id, -1)));
-            services.AddSingleton<DomainObjectFactoryFunction<RuleDomainObject>>(c => (id => new RuleDomainObject(id, -1)));
-            services.AddSingleton<DomainObjectFactoryFunction<AssetDomainObject>>(c => (id => new AssetDomainObject(id, -1)));
-            services.AddSingleton<DomainObjectFactoryFunction<ContentDomainObject>>(c => (id => new ContentDomainObject(id, -1)));
+            services.AddSingletonAs<DomainObjectFactoryFunction<AppDomainObject>>(c => (id => new AppDomainObject(id, -1)));
+            services.AddSingletonAs<DomainObjectFactoryFunction<RuleDomainObject>>(c => (id => new RuleDomainObject(id, -1)));
+            services.AddSingletonAs<DomainObjectFactoryFunction<AssetDomainObject>>(c => (id => new AssetDomainObject(id, -1)));
+            services.AddSingletonAs<DomainObjectFactoryFunction<ContentDomainObject>>(c => (id => new ContentDomainObject(id, -1)));
 
-            services.AddSingleton<DomainObjectFactoryFunction<SchemaDomainObject>>(c =>
+            services.AddSingletonAs<DomainObjectFactoryFunction<SchemaDomainObject>>(c =>
                 {
                     var fieldRegistry = c.GetRequiredService<FieldRegistry>();
 
diff --git a/src/Squidex/Config/Orleans/ClientServices.cs b/src/Squidex/Config/Orleans/ClientServices.cs
index a0d3d2c9b..66f30408a 100644
--- a/src/Squidex/Config/Orleans/ClientServices.cs
+++ b/src/Squidex/Config/Orleans/ClientServices.cs
@@ -21,7 +21,7 @@ namespace Squidex.Config.Orleans
     {
         public static void AddAppClient(this IServiceCollection services)
         {
-            services.AddSingleton(c => c.GetRequiredService<IClusterClient>())
+            services.AddSingletonAs(c => c.GetRequiredService<IClusterClient>())
                 .As<IGrainFactory>();
 
             services.AddServicesForSelfHostedDashboard(null, options =>
@@ -29,7 +29,7 @@ namespace Squidex.Config.Orleans
                 options.HideTrace = true;
             });
 
-            services.AddSingleton(c =>
+            services.AddSingletonAs(c =>
             {
                 var configuration = ClientConfiguration.LocalhostSilo();
 
diff --git a/src/Squidex/Config/ServiceExtensions.cs b/src/Squidex/Config/ServiceExtensions.cs
index 431d0705a..61050959f 100644
--- a/src/Squidex/Config/ServiceExtensions.cs
+++ b/src/Squidex/Config/ServiceExtensions.cs
@@ -39,21 +39,21 @@ namespace Squidex.Config
             }
         }
 
-        public static InterfaceRegistrator<T> AddSingleton<T>(this IServiceCollection services, Func<IServiceProvider, T> factory) where T : class
+        public static InterfaceRegistrator<T> AddSingletonAs<T>(this IServiceCollection services, Func<IServiceProvider, T> factory) where T : class
         {
             services.AddSingleton(typeof(T), factory);
 
             return new InterfaceRegistrator<T>(services);
         }
 
-        public static InterfaceRegistrator<T> AddSingleton<T>(this IServiceCollection services, T instance) where T : class
+        public static InterfaceRegistrator<T> AddSingletonAs<T>(this IServiceCollection services, T instance) where T : class
         {
             services.AddSingleton(typeof(T), instance);
 
             return new InterfaceRegistrator<T>(services);
         }
 
-        public static InterfaceRegistrator<T> AddSingleton<T>(this IServiceCollection services) where T : class
+        public static InterfaceRegistrator<T> AddSingletonAs<T>(this IServiceCollection services) where T : class
         {
             services.AddSingleton<T, T>();
 
diff --git a/src/Squidex/Config/Constants.cs b/src/Squidex/Config/Web/Constants.cs
similarity index 100%
rename from src/Squidex/Config/Constants.cs
rename to src/Squidex/Config/Web/Constants.cs
diff --git a/src/Squidex/Config/Web/WebServices.cs b/src/Squidex/Config/Web/WebServices.cs
index bb1d994fd..699a7d531 100644
--- a/src/Squidex/Config/Web/WebServices.cs
+++ b/src/Squidex/Config/Web/WebServices.cs
@@ -16,8 +16,8 @@ namespace Squidex.Config.Web
     {
         public static void AddMyMvc(this IServiceCollection services)
         {
-            services.AddSingleton<AppApiFilter>();
-            services.AddSingleton<FileCallbackResultExecutor>();
+            services.AddSingletonAs<AppApiFilter>();
+            services.AddSingletonAs<FileCallbackResultExecutor>();
 
             services.AddMvc().AddMySerializers();
             services.AddCors();
diff --git a/src/Squidex/Controllers/ControllerBase.cs b/src/Squidex/Controllers/ControllerBase.cs
index 4522d1162..dc1fdd26f 100644
--- a/src/Squidex/Controllers/ControllerBase.cs
+++ b/src/Squidex/Controllers/ControllerBase.cs
@@ -19,13 +19,6 @@ namespace Squidex.Controllers
     {
         protected ICommandBus CommandBus { get; }
 
-        protected ControllerBase(ICommandBus commandBus)
-        {
-            Guard.NotNull(commandBus, nameof(commandBus));
-
-            CommandBus = commandBus;
-        }
-
         protected IAppEntity App
         {
             get
@@ -45,5 +38,12 @@ namespace Squidex.Controllers
         {
             get { return App.Name; }
         }
+
+        protected ControllerBase(ICommandBus commandBus)
+        {
+            Guard.NotNull(commandBus, nameof(commandBus));
+
+            CommandBus = commandBus;
+        }
     }
 }
diff --git a/src/Squidex/WebStartup.cs b/src/Squidex/WebStartup.cs
index ea55eb3c4..e8f550f0c 100644
--- a/src/Squidex/WebStartup.cs
+++ b/src/Squidex/WebStartup.cs
@@ -14,10 +14,10 @@ using Microsoft.AspNetCore.Http;
 using Microsoft.Extensions.Configuration;
 using Microsoft.Extensions.DependencyInjection;
 using Squidex.Areas.Frontend;
+using Squidex.Areas.IdentityServer;
 using Squidex.Areas.OrleansDashboard;
 using Squidex.Config;
 using Squidex.Config.Domain;
-using Squidex.Config.Identity;
 using Squidex.Config.Orleans;
 using Squidex.Config.Swagger;
 using Squidex.Config.Web;
@@ -29,7 +29,7 @@ namespace Squidex
     public class WebStartup : IStartup
     {
         private readonly IConfiguration configuration;
-        private readonly IHostingEnvironment environment;
+
         private static readonly string[] IdentityServerPaths =
         {
             "/client-callback-popup",
@@ -38,10 +38,9 @@ namespace Squidex
             "/error"
         };
 
-        public WebStartup(IConfiguration configuration, IHostingEnvironment environment)
+        public WebStartup(IConfiguration configuration)
         {
             this.configuration = configuration;
-            this.environment = environment;
         }
 
         public IServiceProvider ConfigureServices(IServiceCollection services)
@@ -60,49 +59,18 @@ namespace Squidex
             app.UseMyCors();
             app.UseMyForwardingRules();
             app.UseMyTracking();
-            app.UseMyAuthentication();
 
-            MapAndUseIdentityServer(app);
             MapAndUseApi(app);
 
             app.ConfigureOrleansDashboard();
+            app.ConfigureIdentityServer();
             app.ConfigureFrontend();
         }
 
-        private void MapAndUseIdentityServer(IApplicationBuilder app)
-        {
-            app.Map(Constants.IdentityPrefix, identityApp =>
-            {
-                if (environment.IsDevelopment())
-                {
-                    identityApp.UseDeveloperExceptionPage();
-                }
-                else
-                {
-                    identityApp.UseExceptionHandler("/error");
-                }
-
-                identityApp.UseMyIdentityServer();
-                identityApp.UseMyAdminRole();
-                identityApp.UseMyAdmin();
-                identityApp.UseStaticFiles();
-
-                identityApp.MapWhen(IsIdentityRequest, mvcApp =>
-                {
-                    mvcApp.UseMvc();
-                });
-            });
-        }
-
         private void MapAndUseApi(IApplicationBuilder app)
         {
             app.Map(Constants.ApiPrefix, appApi =>
             {
-                if (environment.IsDevelopment())
-                {
-                    appApi.UseDeveloperExceptionPage();
-                }
-
                 appApi.UseMySwagger();
 
                 appApi.MapWhen(x => !IsIdentityRequest(x), mvcApp =>