diff --git a/ConfigurationSystem/Client/Helpers/Registry.py b/ConfigurationSystem/Client/Helpers/Registry.py
index 92098ac0776..425b73a2036 100644
--- a/ConfigurationSystem/Client/Helpers/Registry.py
+++ b/ConfigurationSystem/Client/Helpers/Registry.py
@@ -8,16 +8,29 @@
 
 from DIRAC import S_OK, S_ERROR
 from DIRAC.Core.Utilities import DErrno
+from DIRAC.Core.Utilities.Decorators import deprecated
 from DIRAC.ConfigurationSystem.Client.Config import gConfig
 from DIRAC.ConfigurationSystem.Client.Helpers.CSGlobals import getVO
 
-__RCSID__ = "$Id$"
+# Registry use cached data from AuthManager and ProxyManager services
+from DIRAC.FrameworkSystem.Client.ProxyManagerData import gProxyManagerData
+from DIRAC.FrameworkSystem.Client.AuthManagerData import gAuthManagerData
 
-# pylint: disable=missing-docstring
+__RCSID__ = "$Id$"
 
 gBaseRegistrySection = "/Registry"
 
 
+def getVOMSInfo(vo=None, dn=None):
+  """ Get cached information from VOMS API
+
+      :param list dn: requested DN
+
+      :return: S_OK(dict)/S_ERROR()
+  """
+  return gProxyManagerData.getActualVOMSesDNs(voList=[vo] if vo else vo, dnList=[dn] if dn else dn)
+
+
 def getUsernameForDN(dn, usersList=None):
   """ Find DIRAC user for DN
 
@@ -35,18 +48,30 @@ def getUsernameForDN(dn, usersList=None):
   for username in usersList:
     if dn in gConfig.getValue("%s/Users/%s/DN" % (gBaseRegistrySection, username), []):
       return S_OK(username)
-  return S_ERROR("No username found for dn %s" % dn)
 
+  # Get users profiles from session manager cache
+  result = gAuthManagerData.getIDsForDN(dn)
+  if result['OK']:
+    for uid in result['Value']:
+      result = getUsernameForID(uid)
+      if result['OK']:
+        return result
+
+  return S_ERROR("No username found for dn %s" % dn)
 
+@deprecated("Use getDNsForUsername or getDNsForUsernameFromCS if need information only from CS")
 def getDNForUsername(username):
-  """ Get user DN for user
+  dnList = getDNsForUsernameFromSC(username)
+  return S_OK(dnList) if dnList else S_ERROR("No DN found for user %s" % username)
 
-      :param str username: user name
+def getDNsForUsernameFromCS(username):
+  """ Find DNs for DIRAC user from CS
 
-      :return: S_OK(str)/S_ERROR()
+      :param str username: DIRAC user
+
+      :return: list -- contain DNs
   """
-  dnList = gConfig.getValue("%s/Users/%s/DN" % (gBaseRegistrySection, username), [])
-  return S_OK(dnList) if dnList else S_ERROR("No DN found for user %s" % username)
+  return gConfig.getValue("%s/Users/%s/DN" % (gBaseRegistrySection, username), [])
 
 
 def getDNForHost(host):
@@ -60,18 +85,53 @@ def getDNForHost(host):
   return S_OK(dnList) if dnList else S_ERROR("No DN found for host %s" % host)
 
 
-def getGroupsForDN(dn):
+def getGroupsForDN(dn, groupsList=None):
   """ Get all possible groups for DN
 
       :param str dn: user DN
+      :param list groupsList: group list where need to search
 
       :return: S_OK(list)/S_ERROR() -- contain list of groups
   """
   dn = dn.strip()
+  groups = []
+  if not groupsList:
+    result = gConfig.getSections("%s/Groups" % gBaseRegistrySection)
+    if not result['OK']:
+      return result
+    groupsList = result['Value']
+
   result = getUsernameForDN(dn)
   if not result['OK']:
     return result
-  return getGroupsForUser(result['Value'])
+  user = result['Value']
+
+  # Get VOMS information cache
+  result = getVOMSInfo(dn=dn)
+  if not result['OK']:
+    return result
+  vomsData = result['Value']
+
+  result = getVOsWithVOMS()
+  if not result['OK']:
+    return result
+  vomsVOs = result['Value']
+
+  for group in groupsList:
+    if user in getGroupOption(group, 'Users', []):
+      vo = getGroupOption(group, 'VO')
+      # Is VOMS VO?
+      if vo in vomsVOs and vomsData.get(vo) and vomsData[vo]['OK'] and vomsData[vo]['Value']:
+        voData = vomsData[vo]['Value']
+        role = getGroupOption(group, 'VOMSRole')
+        if not role or role in voData[dn]['VOMSRoles']:
+          groups.append(group)
+      else:
+        # If it's not VOMS VO or cannot get information from VOMS
+        groups.append(group)
+  groups = list(set(groups))
+  groups.sort()
+  return S_OK(groups) if groups else S_ERROR('No groups found for %s' % dn)
 
 
 def __getGroupsWithAttr(attrName, value):
@@ -94,14 +154,27 @@ def __getGroupsWithAttr(attrName, value):
   return S_OK(groups) if groups else S_ERROR("No groups found for %s=%s" % (attrName, value))
 
 
-def getGroupsForUser(username):
-  """ Find groups for user
+def getGroupsForUser(username, groupsList=None):
+  """ Find groups for user or if set reseachedGroup check it for user
 
       :param str username: user name
+      :param list groupsList: groups
 
-      :return: S_OK(list)/S_ERROR() -- contain list of groups
+      :return: S_OK(list or bool)/S_ERROR() -- contain list of groups or status group for user
   """
-  return __getGroupsWithAttr('Users', username)
+  if not groupsList:
+    retVal = gConfig.getSections("%s/Groups" % gBaseRegistrySection)
+    if not retVal['OK']:
+      return retVal
+    groupsList = retVal['Value']
+
+  groups = []
+  for group in groupsList:
+    if username in getGroupOption(group, 'Users', []):
+      groups.append(group)
+  groups = list(set(groups))
+  groups.sort()
+  return S_OK(groups) if groups else S_ERROR('No groups found for %s user' % username)
 
 
 def getGroupsForVO(vo):
@@ -203,7 +276,7 @@ def getAllGroups():
   return result['Value'] if result['OK'] else []
 
 
-def getUsersInGroup(groupName, defaultValue=None):
+def getUsersInGroup(group, defaultValue=None):
   """ Find all users for group
 
       :param str group: group name
@@ -211,8 +284,9 @@ def getUsersInGroup(groupName, defaultValue=None):
 
       :return: list
   """
-  option = "%s/Groups/%s/Users" % (gBaseRegistrySection, groupName)
-  return gConfig.getValue(option, [] if defaultValue is None else defaultValue)
+  users = list(set(getGroupOption(group, 'Users', [])))
+  users.sort()
+  return users or [] if defaultValue is None else defaultValue
 
 
 def getUsersInVO(vo, defaultValue=None):
@@ -223,45 +297,56 @@ def getUsersInVO(vo, defaultValue=None):
 
       :return: list
   """
+  users = []
   result = getGroupsForVO(vo)
-  if not result['OK'] or not result['Value']:
-    return [] if defaultValue is None else defaultValue
-  groups = result['Value']
+  if result['OK'] and result['Value']:
+    for group in result['Value']:
+      users += getUsersInGroup(group)
+  users = list(set(users))
+  users.sort()
+  return users or [] if defaultValue is None else defaultValue
 
-  userList = []
-  for group in groups:
-    userList += getUsersInGroup(group)
-  return userList
 
+def getDNsInGroup(group, checkStatus=False):
+  """ Find user DNs for DIRAC group
 
-def getDNsInVO(vo):
-  """ Get all DNs that have a VO users
-
-      :param str vo: VO name
+      :param str group: group name
+      :param bool checkStatus: don't add suspended DNs
 
       :return: list
   """
-  DNs = []
-  for user in getUsersInVO(vo):
-    result = getDNForUsername(user)
-    if result['OK']:
-      DNs.extend(result['Value'])
-  return DNs
-
-
-def getDNsInGroup(groupName):
-  """ Find all DNs  for DIRAC group
+  vomsData = {}
+  vo = getGroupOption(group, 'VO')
 
-      :param str groupName: group name
+  # Get VOMS information for VO, if it's VOMS VO
+  result = getVOsWithVOMS([vo])
+  if not result['OK']:
+    return result
+  if result['Value']:
+    result = getVOMSInfo(vo=vo)
+    if not result['OK']:
+      return result
+    vomsData = result['Value']
 
-      :return: list
-  """
   DNs = []
-  for user in getUsersInGroup(groupName):
-    result = getDNForUsername(user)
-    if result['OK']:
-      DNs.extend(result['Value'])
-  return DNs
+  for username in getGroupOption(group, 'Users', []):
+    if checkStatus and vo in getUserOption(username, 'Suspended', []):
+      continue
+    result = getDNsForUsername(username)
+    if not result['OK']:
+      return result
+    userDNs = result['Value']
+    if vomsData.get(vo) and vomsData[vo]['OK']:
+      voData = vomsData[vo]['Value']
+      role = getGroupOption(group, 'VOMSRole')
+      for dn in userDNs:
+        if dn in voData and (not checkStatus or not voData[dn]['Suspended']):
+          if not role or role in voData[dn]['ActiveRoles' if checkStatus else 'VOMSRoles']:
+            DNs.append(dn)
+    else:
+      DNs += userDNs
+
+  return list(set(DNs))
 
 
 def getPropertiesForGroup(groupName, defaultValue=None):
@@ -298,8 +383,6 @@ def getPropertiesForEntity(group, name="", dn="", defaultValue=None):
 
       :return: defaultValue or list
   """
-  if defaultValue is None:
-    defaultValue = []
   if group == 'hosts':
     if not name:
       result = getHostnameForDN(dn)
@@ -466,15 +549,16 @@ def getVOMSVOForGroup(group):
   return vomsVO
 
 
-def getGroupsWithVOMSAttribute(vomsAttr):
+def getGroupsWithVOMSAttribute(vomsAttr, groupsList=None):
   """ Search groups with VOMS attribute
 
       :param str vomsAttr: VOMS attribute
+      :param list groupsList: groups where need to search
 
       :return: list
   """
   groups = []
-  for group in gConfig.getSections("%s/Groups" % (gBaseRegistrySection)).get('Value', []):
+  for group in groupsList or getAllGroups():
     if vomsAttr == gConfig.getValue("%s/Groups/%s/VOMSRole" % (gBaseRegistrySection, group), ""):
       groups.append(group)
   return groups
@@ -569,10 +653,10 @@ def getVOMSRoleGroupMapping(vo=''):
 def getUsernameForID(ID, usersList=None):
   """ Get DIRAC user name by ID
 
-      :param basestring ID: user ID
+      :param str ID: user ID
       :param list usersList: list of DIRAC user names
 
-      :return: S_OK(basestring)/S_ERROR()
+      :return: S_OK(str)/S_ERROR()
   """
   if not usersList:
     result = gConfig.getSections("%s/Users" % gBaseRegistrySection)
@@ -585,72 +669,30 @@ def getUsernameForID(ID, usersList=None):
   return S_ERROR("No username found for ID %s" % ID)
 
 
-def getCAForUsername(username):
-  """ Get CA option by user name
-
-      :param str username: user name
-
-      :return: S_OK(str)/S_ERROR()
-  """
-  dnList = gConfig.getValue("%s/Users/%s/CA" % (gBaseRegistrySection, username), [])
-  return S_OK(dnList) if dnList else S_ERROR("No CA found for user %s" % username)
+def getDNProperty(dn, prop, defaultValue=None, username=None):
+  """ Get user DN property
 
-
-def getDNProperty(userDN, value, defaultValue=None):
-  """ Get property from DNProperties section by user DN
-
-      :param str userDN: user DN
-      :param str value: option that need to get
+      :param str dn: user DN
+      :param str prop: property name
       :param defaultValue: default value
+      :param str username: username
 
-      :return: S_OK()/S_ERROR() -- str or list that contain option value
-  """
-  result = getUsernameForDN(userDN)
-  if not result['OK']:
-    return result
-  pathDNProperties = "%s/Users/%s/DNProperties" % (gBaseRegistrySection, result['Value'])
-  result = gConfig.getSections(pathDNProperties)
-  if result['OK']:
-    for section in result['Value']:
-      if userDN == gConfig.getValue("%s/%s/DN" % (pathDNProperties, section)):
-        return S_OK(gConfig.getValue("%s/%s/%s" % (pathDNProperties, section, value), defaultValue))
-  return S_OK(defaultValue)
-
-
-def getProxyProvidersForDN(userDN):
-  """ Get proxy providers by user DN
-
-      :param str userDN: user DN
-
-      :return: S_OK(list)/S_ERROR()
+      :return: S_OK()/S_ERROR()
   """
-  return getDNProperty(userDN, 'ProxyProviders', [])
-
-
-def getDNFromProxyProviderForUserID(proxyProvider, userID):
-  """ Get groups by user DN in DNProperties
-
-      :param str proxyProvider: proxy provider name
-      :param str userID: user identificator
+  if not username:
+    result = getUsernameForDN(dn)
+    if not result['OK']:
+      return result
+    username = result['Value']
 
-      :return: S_OK(str)/S_ERROR()
-  """
-  # Get user name
-  result = getUsernameForID(userID)
+  root = "%s/Users/%s/DNProperties" % (gBaseRegistrySection, username)
+  result = gConfig.getSections(root)
   if not result['OK']:
     return result
-  # Get DNs from user
-  result = getDNForUsername(result['Value'])
-  if not result['OK']:
-    return result
-  for DN in result['Value']:
-    result = getProxyProvidersForDN(DN)
-    if not result['OK']:
-      return result
-    if proxyProvider in result['Value']:
-      return S_OK(DN)
-  return S_ERROR(errno.ENODATA,
-                 "No DN found for %s proxy provider for user ID %s" % (proxyProvider, userID))
+  for section in result['Value']:
+    if dn == gConfig.getValue("%s/%s/DN" % (root, section)):
+      return S_OK(gConfig.getValue("%s/%s/%s" % (root, section, prop), defaultValue))
+  return S_OK(defaultValue)
 
 
 def isDownloadableGroup(groupName):
@@ -665,24 +707,6 @@ def isDownloadableGroup(groupName):
   return True
 
 
-def getUserDict(username):
-  """ Get full information from user section
-
-      :param str username: DIRAC user name
-
-      :return: S_OK()/S_ERROR()
-  """
-  resDict = {}
-  relPath = '%s/Users/%s/' % (gBaseRegistrySection, username)
-  result = gConfig.getConfigurationTree(relPath)
-  if not result['OK']:
-    return result
-  for key, value in result['Value'].items():
-    if value:
-      resDict[key.replace(relPath, '')] = value
-  return S_OK(resDict)
-
-
 def getEmailsForGroup(groupName):
   """ Get email list of users in group
 
@@ -695,3 +719,104 @@ def getEmailsForGroup(groupName):
     email = getUserOption(username, 'Email', [])
     emails.append(email)
   return emails
+
+
+def getIDsForUsername(username):
+  """ Return IDs for DIRAC user
+
+      :param str username: DIRAC user
+
+      :return: list -- contain IDs
+  """
+  return gConfig.getValue("%s/Users/%s/ID" % (gBaseRegistrySection, username), [])
+
+
+def getVOsWithVOMS(voList=None):
+  """ Get all the configured VOMS VOs
+
+      :param list voList: VOs where to look
+
+      :return: S_OK(list)/S_ERROR()
+  """
+  vos = []
+  if not voList:
+    result = getVOs()
+    if result['OK']:
+      voList = result['Value']
+  for vo in voList or []:
+    if getVOOption(vo, 'VOMSName'):
+      vos.append(vo)
+  return S_OK(vos)
+
+
+def getDNsForUsername(username):
+  """ Find all DNs for DIRAC user
+
+      :param str username: DIRAC user
+
+      :return: S_OK(list)/S_ERROR() -- contain DNs
+  """
+  userDNs = getDNsForUsernameFromCS(username)
+  for uid in getIDsForUsername(username):
+    result = gAuthManagerData.getDNsForID(uid)
+    if result['OK']:
+      userDNs += result['Value']
+  return S_OK(list(set(userDNs)))
+
+
+def getDNForUsernameInGroup(username, group, checkStatus=False):
+  """ Get user DN for user in group
+
+      :param str username: user name
+      :param str group: group name
+      :param bool checkStatus: don't add suspended DNs
+
+      :return: S_OK(str)/S_ERROR()
+  """
+  result = getDNsForUsernameInGroup(username, group, checkStatus)
+  return S_OK(result['Value'][0]) if result['OK'] else result
+
+
+def getDNsForUsernameInGroup(username, group, checkStatus=False):
+  """ Get user DN for user in group
+
+      :param str username: user name
+      :param str group: group name
+      :param bool checkStatus: don't add suspended DNs
+
+      :return: S_OK(str)/S_ERROR()
+  """
+  if username not in getGroupOption(group, 'Users', []):
+    return S_ERROR('%s group not have %s user.' % (group, username))
+  DNs = []
+  result = getDNsForUsername(username)
+  if not result['OK']:
+    return result
+  userDNs = result['Value']
+
+  vo = getGroupOption(group, 'VO')
+  if checkStatus and vo in getUserOption(username, 'Suspended', []):
+    return S_ERROR('%s marked as suspended for %s VO.' % (username, vo))
+  result = getVOsWithVOMS([vo])
+  if not result['OK']:
+    return result
+  if result['Value']:
+    result = getVOMSInfo(vo=vo)
+    if not result['OK']:
+      return result
+    vomsData = result['Value']
+    if vomsData.get(vo) and vomsData[vo]['OK']:
+      voData = vomsData[vo]['Value']
+      role = getGroupOption(group, 'VOMSRole')
+      for dn in userDNs:
+        if dn in voData and (not checkStatus or not voData[dn]['Suspended']):
+          if not role or role in voData[dn]['ActiveRoles' if checkStatus else 'VOMSRoles']:
+            DNs.append(dn)
+    else:
+      DNs += userDNs
+  else:
+    DNs += userDNs
+
+  if DNs:
+    return S_OK(list(set(DNs)))
+  return S_ERROR('For %s@%s not found DN%s.' % (username, group, ' or it suspended' if checkStatus else ''))
diff --git a/ConfigurationSystem/Client/Helpers/Resources.py b/ConfigurationSystem/Client/Helpers/Resources.py
index 28d88a719de..788d93e42ad 100644
--- a/ConfigurationSystem/Client/Helpers/Resources.py
+++ b/ConfigurationSystem/Client/Helpers/Resources.py
@@ -465,42 +465,68 @@ def getFilterConfig(filterID):
   return gConfig.getOptionsDict('Resources/LogFilters/%s' % filterID)
 
 
-def getInfoAboutProviders(of=None, providerName=None, option='', section=''):
-  """ Get the information about providers
-
-      :param basestring of: provider of what(Id, Proxy or etc.) need to look,
-             None, "all" to get list of instance of what this providers
-      :param basestring providerName: provider name,
-             None, "all" to get list of providers names
-      :param basestring option: option name that need to get,
-             None, "all" to get all options in a section
-      :param basestring section: section path in root section of provider,
-             "all" to get options in all sections
-
-      :return: S_OK()/S_ERROR()
+def getProvidersForInstance(instance, providerType=None):
+  """ Get providers for instance
+
+      :param str instance: instance of what this providers
+      :param str providerType: provider type
+
+      :return: S_OK(list)/S_ERROR()
+  """
+  result = gConfig.getSections('%s/%sProviders' % (gBaseResourcesSection, instance))
+  if not result['OK'] or not result['Value'] or (result['OK'] and not providerType):
+    return result
+  data = []
+  for prov in result['Value']:
+    if providerType == gConfig.getValue('%s/%sProviders/%s/ProviderType' %
+                                        (gBaseResourcesSection, instance, prov)):
+      data.append(prov)
+  return S_OK(data)
+
+
+def getProviderByAlias(alias, instance=None):
+  """ Find provider name by alias
+
+      :param str alias: other registered provider name
+      :param str instance: provider of what
+
+      :return: S_OK(str)/S_ERROR()
   """
-  if not of or of == "all":
+  instances = [instance] or []
+  if not instances:
     result = gConfig.getSections(gBaseResourcesSection)
     if not result['OK']:
       return result
-    return S_OK([i.replace('Providers', '') for i in result['Value']])
-  if not providerName or providerName == "all":
-    return gConfig.getSections('%s/%sProviders' % (gBaseResourcesSection, of))
-  if not option or option == 'all':
-    if not section:
-      return gConfig.getOptionsDict("%s/%sProviders/%s" % (gBaseResourcesSection, of, providerName))
-    elif section == "all":
-      resDict = {}
-      relPath = "%s/%sProviders/%s/" % (gBaseResourcesSection, of, providerName)
-      result = gConfig.getConfigurationTree(relPath)
+    for section in result['Value']:
+      if section[-9:] == 'Providers':
+        instances.append(section[:-9])
+  for instance in instances:
+    result = getProvidersForInstance(instance)
+    if not result['OK']:
+      return result
+    for provider in result['Value']:
+      if alias in gConfig.getValue("%s/%sProviders/%s/Aliases" % (gBaseResourcesSection,
+                                                                  instance, provider), []):
+        return S_OK(provider)
+  return S_ERROR('No found any provider for %s' % alias)
+
+
+def getProviderInfo(provider):
+  """ Get provider info
+
+      :param str provider: provider
+
+      :return: S_OK(dict)/S_ERROR()
+  """
+  result = gConfig.getSections(gBaseResourcesSection)
+  if not result['OK']:
+    return result
+  for section in result['Value']:
+    if section[-9:] == 'Providers':
+      result = getProvidersForInstance(section[:-9])
       if not result['OK']:
         return result
-      for key, value in result['Value'].items():  # can be an iterator
-        if value:
-          resDict[key.replace(relPath, '')] = value
-      return S_OK(resDict)
-    else:
-      return gConfig.getSections('%s/%sProviders/%s/%s/' % (gBaseResourcesSection, of, providerName, section))
-  else:
-    return S_OK(gConfig.getValue('%s/%sProviders/%s/%s/%s' % (gBaseResourcesSection, of, providerName,
-                                                              section, option)))
+      if provider in result['Value']:
+        return gConfig.getOptionsDictRecursively("%s/%s/%s/" % (gBaseResourcesSection,
+                                                                section, provider))
+  return S_ERROR('%s provider not found.' % provider)
diff --git a/ConfigurationSystem/Client/Utilities.py b/ConfigurationSystem/Client/Utilities.py
index a8f788cea1a..2f7f8b98c64 100644
--- a/ConfigurationSystem/Client/Utilities.py
+++ b/ConfigurationSystem/Client/Utilities.py
@@ -701,14 +701,14 @@ def getElasticDBParameters(fullname):
   return S_OK(parameters)
 
 
-def getOAuthAPI(instance='Production'):
-  """ Get OAuth API url
+def getAuthAPI(instance='Production'):
+  """ Get Auth REST API url
 
       :param str instance: instance
 
       :return: str
   """
-  return gConfig.getValue("/Systems/Framework/%s/URLs/OAuthAPI" % instance)
+  return gConfig.getValue("/Systems/Framework/%s/URLs/AuthAPI" % instance)
 
 
 def getDIRACGOCDictionary():
diff --git a/ConfigurationSystem/Utilities/ConfigurationHandler.py b/ConfigurationSystem/Utilities/ConfigurationHandler.py
new file mode 100644
index 00000000000..b131ac36e09
--- /dev/null
+++ b/ConfigurationSystem/Utilities/ConfigurationHandler.py
@@ -0,0 +1,96 @@
+""" HTTP API of the DIRAC configuration data, rewrite from the RESTDIRAC project
+"""
+import re
+import json
+
+from tornado import web, gen
+from tornado.template import Template
+
+from DIRAC import S_OK, S_ERROR, gConfig, gLogger
+from DIRAC.ConfigurationSystem.Client.Helpers import Resources, Registry
+from DIRAC.ConfigurationSystem.Client.ConfigurationData import gConfigurationData
+from DIRAC.FrameworkSystem.Client.ProxyManagerClient import gProxyManager
+
+from DIRAC.Core.Web.WebHandler import WebHandler, asyncGen, WErr
+
+__RCSID__ = "$Id$"
+
+
+class ConfigurationHandler(WebHandler):
+  OVERPATH = True
+  AUTH_PROPS = "all"
+  LOCATION = "/"
+
+  def initialize(self):
+    super(ConfigurationHandler, self).initialize()
+    self.args = {}
+    for arg in self.request.arguments:
+      if len(self.request.arguments[arg]) > 1:
+        self.args[arg] = self.request.arguments[arg]
+      else:
+        self.args[arg] = self.request.arguments[arg][0] or ''
+    return S_OK()
+
+  @asyncGen
+  def web_conf(self):
+    """ REST endpoint for configuration system:
+
+        **GET** /conf/<key>?<options> -- get configuration information
+
+          Options:
+            * *path* -- path in the configuration structure, by default it's "/". 
+            * *version* -- the configuration version of the requester, if *version* is newer
+                           than the one present on the server, an empty result will be returned 
+        
+          Response:
+            +-----------+---------------------------------------+------------------------+
+            | *key*     | Description                           | Type                   |
+            +-----------+---------------------------------------+------------------------+
+            | dump      | Current CFG()                         | encoded in json format |
+            +-----------+---------------------------------------+------------------------+
+            | option    | Option value                          | text                   |
+            +-----------+---------------------------------------+------------------------+
+            | options   | Options list in a section             | encoded in json format |
+            +-----------+---------------------------------------+------------------------+
+            | dict      | Options with values in a section      | encoded in json format |
+            +-----------+---------------------------------------+------------------------+
+            | sections  | Sections list in a section            | text                   |
+            +-----------+---------------------------------------+------------------------+
+    """
+    self.log.notice('Request configuration information')
+    optns = self.overpath.strip('/').split('/')
+    path = self.args.get('path', '/')
+    if not optns or len(optns) > 1:
+      raise WErr(404, "You forgot to set attribute.")
+
+    result = S_ERROR('%s request unsuported' % optns[0])
+    if 'version' in self.args and (self.args.get('version') or '0') >= gConfigurationData.getVersion():
+      self.finish()
+    if optns[0] == 'dump':
+      remoteCFG = yield self.threadTask(gConfigurationData.getRemoteCFG)
+      result['Value'] = str(remoteCFG)
+    elif optns[0] == 'option':
+      result = yield self.threadTask(gConfig.getOption, path)
+    elif optns[0] == 'dict':
+      result = yield self.threadTask(gConfig.getOptionsDict, path)
+    elif optns[0] == 'options':
+      result = yield self.threadTask(gConfig.getOptions, path)
+    elif optns[0] == 'sections':
+      result = yield self.threadTask(gConfig.getSections, path)
+    elif optns[0] == 'getGroupsStatusByUsername':
+      result = yield self.threadTask(gProxyManager.getGroupsStatusByUsername, **self.args)
+    elif any([optns[0] == m and re.match('^[a-z][A-z]+', m) for m in dir(Registry)]) and self.isRegisteredUser():
+      result = yield self.threadTask(getattr(Registry, optns[0]), **self.args)
+    else:
+      raise WErr(500, '%s request unsuported' % optns[0])
+      # result = yield self.threadTask(getattr(Registry, optns[0]), **self.args)
+
+    if not result['OK']:
+      raise WErr(404, result['Message'])
+    self.finishJEncode(result['Value'])
+
+  @asyncGen
+  def post(self):
+    """ Post method
+    """
+    pass
diff --git a/ConfigurationSystem/Utilities/__init__.py b/ConfigurationSystem/Utilities/__init__.py
new file mode 100755
index 00000000000..2492dd6ec85
--- /dev/null
+++ b/ConfigurationSystem/Utilities/__init__.py
@@ -0,0 +1,5 @@
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import print_function
+# $HeadURL$
+__RCSID__ = "$Id$"
diff --git a/ConfigurationSystem/test/Test_agentOptions.py b/ConfigurationSystem/test/Test_agentOptions.py
index 4b3e8c2ebf3..5706348df8a 100644
--- a/ConfigurationSystem/test/Test_agentOptions.py
+++ b/ConfigurationSystem/test/Test_agentOptions.py
@@ -75,7 +75,7 @@
           ('DIRAC.WorkloadManagementSystem.Agent.StatesAccountingAgent', {}),
           ('DIRAC.WorkloadManagementSystem.Agent.StatesMonitoringAgent', {}),
           ('DIRAC.WorkloadManagementSystem.Agent.SiteDirector',
-           {'SpecialMocks': {'findGenericPilotCredentials': S_OK(('a', 'b'))}}),
+           {'SpecialMocks': {'findGenericPilotCredentials': S_OK(('a', 'b', 'c'))}}),
           # ('DIRAC.WorkloadManagementSystem.Agent.MultiProcessorSiteDirector', {}),  # not inheriting from AgentModule
           ]
 
diff --git a/Core/Base/API.py b/Core/Base/API.py
index 7d86ebe5d28..37adb98602d 100644
--- a/Core/Base/API.py
+++ b/Core/Base/API.py
@@ -9,7 +9,7 @@
 
 from DIRAC import gLogger, gConfig, S_OK, S_ERROR
 from DIRAC.Core.Security.ProxyInfo import getProxyInfo, formatProxyInfoAsString
-from DIRAC.ConfigurationSystem.Client.Helpers.Registry import getDNForUsername
+from DIRAC.ConfigurationSystem.Client.Helpers.Registry import getDNsForUsername
 from DIRAC.Core.Utilities.Version import getCurrentVersion
 
 __RCSID__ = '$Id$'
@@ -141,9 +141,11 @@ def _getCurrentUser(self):
     gLogger.debug(formatProxyInfoAsString(proxyInfo))
     if 'group' not in proxyInfo:
       return self._errorReport('Proxy information does not contain the group', res['Message'])
-    res = getDNForUsername(proxyInfo['username'])
-    if not res['OK']:
-      return self._errorReport('Failed to get proxies for user', res['Message'])
+    result = getDNsForUsername(proxyInfo['username'])
+    if not result['OK']:
+      return self._errorReport('Failed to get proxies for user', result['Message'])
+    if not result['Value']:
+      return self._errorReport('Failed to get proxies for user', "No DNs found for %s" % proxyInfo['username'])
     return S_OK(proxyInfo['username'])
 
   #############################################################################
diff --git a/Core/Base/DB.py b/Core/Base/DB.py
index 363bd493826..b196b5e04aa 100755
--- a/Core/Base/DB.py
+++ b/Core/Base/DB.py
@@ -5,7 +5,7 @@
 from __future__ import division
 from __future__ import print_function
 
-from DIRAC import gLogger, gConfig
+from DIRAC import gLogger, gConfig, S_OK, S_ERROR
 from DIRAC.Core.Utilities.MySQL import MySQL
 from DIRAC.ConfigurationSystem.Client.Utilities import getDBParameters
 from DIRAC.ConfigurationSystem.Client.PathFinder import getDatabaseSection
@@ -18,9 +18,16 @@ class DB(MySQL):
   """
 
   def __init__(self, dbname, fullname, debug=False):
+    """ C'or
 
+        :param str dbname: database name
+        :param str fullname: full name
+        :param bool debug: debug mode
+    """
+    self.versionDB = 0
     self.fullname = fullname
     database_name = dbname
+    self.versionTable = '%s_Version' % database_name
     self.log = gLogger.getSubLogger(database_name)
 
     result = getDBParameters(fullname)
@@ -44,6 +51,23 @@ def __init__(self, dbname, fullname, debug=False):
     if not self._connected:
       raise RuntimeError("Can not connect to DB '%s', exiting..." % self.dbName)
 
+    # Initialize version
+    result = self._query("show tables")
+    if result['OK']:
+      if self.versionTable not in [t[0] for t in result['Value']]:
+        result = self._createTables({self.versionTable: {'Fields': {'Version': 'INTEGER NOT NULL'},
+                                                         'PrimaryKey': 'Version'}})
+    if not result['OK']:
+      raise RuntimeError("Can not initialize %s version: %s" % (self.dbName, result['Message']))
+    result = self._query("SELECT Version FROM `%s`" % self.versionTable)
+    if result['OK']:
+      if len(result['Value']) > 0:
+        self.versionDB = result['Value'][0][0]
+      else:
+        result = self._update("INSERT INTO `%s` (Version) VALUES (%s)" % (self.versionTable, self.versionDB))
+    if not result['OK']:
+      raise RuntimeError("Can not initialize %s version: %s" % (self.dbName, result['Message']))
+
     self.log.info("===================== MySQL ======================")
     self.log.info("User:           " + self.dbUser)
     self.log.info("Host:           " + self.dbHost)
@@ -54,5 +78,27 @@ def __init__(self, dbname, fullname, debug=False):
 
 #############################################################################
   def getCSOption(self, optionName, defaultValue=None):
+    """ Get option from CS
+
+        :param str optionName: option name
+        :param defaultValue: default value
+
+        :return: value that inherits the defaultValue type
+    """
     cs_path = getDatabaseSection(self.fullname)
     return gConfig.getValue("/%s/%s" % (cs_path, optionName), defaultValue)
+
+  def updateDBVersion(self, version):
+    """ Update DB version
+
+        :param int version: version number
+
+        :return: S_OK()/S_ERROR()
+    """
+    result = self._query('DELETE FROM `%s_Version`' % self.dbName)
+    if result['OK']:
+      result = self._update("INSERT INTO `%s_Version` (Version) VALUES (%s)" % (self.dbName, version))
+    if not result['OK']:
+      return S_ERROR("Can not initialize %s version: %s" % (self.dbName, result['Message']))
+    self.versionDB = version
+    return S_OK()
diff --git a/Core/DISET/AuthManager.py b/Core/DISET/AuthManager.py
index 847043cc987..e2bfa523c8b 100755
--- a/Core/DISET/AuthManager.py
+++ b/Core/DISET/AuthManager.py
@@ -5,180 +5,253 @@
 from __future__ import print_function
 
 import six
+
+from DIRAC.Core.Utilities import List
+from DIRAC.Core.Security import Properties
+from DIRAC.FrameworkSystem.Client.Logger import gLogger
 from DIRAC.ConfigurationSystem.Client.Config import gConfig
 from DIRAC.ConfigurationSystem.Client.Helpers import Registry
-from DIRAC.FrameworkSystem.Client.Logger import gLogger
-from DIRAC.Core.Security import Properties
-from DIRAC.Core.Utilities import List
 
 __RCSID__ = "$Id$"
 
+KW_ID = 'ID'
+KW_DN = 'DN'
+KW_GROUP = 'group'
+KW_USERNAME = 'username'
+KW_HOSTS_GROUP = 'hosts'
+KW_PROPERTIES = 'properties'
+KW_EXTRA_CREDENTIALS = 'extraCredentials'
+
+
+def forwardingCredentials(credDict, logObj=gLogger):
+  """ Check whether the credentials are being forwarded by a valid source and extract it
+
+      :param dict credDict: Credentials to ckeck
+      :param object logObj: logger
+
+      :return: bool
+  """
+  if isinstance(credDict.get(KW_EXTRA_CREDENTIALS), (tuple, list)):
+    retVal = Registry.getHostnameForDN(credDict.get(KW_DN))
+    if not retVal['OK']:
+      logObj.debug("The credentials forwarded not by a host:", credDict.get(KW_DN))
+      return False
+    hostname = retVal['Value']
+    if Properties.TRUSTED_HOST not in Registry.getPropertiesForHost(hostname, []):
+      logObj.debug("The credentials forwarded by a %s host, but it is not a trusted one" % hostname)
+      return False
+    if credDict[KW_EXTRA_CREDENTIALS][0][0] == '/':
+      credDict[KW_DN] = credDict[KW_EXTRA_CREDENTIALS][0]
+      credDict[KW_ID] = None
+    else:
+      credDict[KW_ID] = credDict[KW_EXTRA_CREDENTIALS][0]
+      credDict[KW_DN] = None
+    credDict[KW_GROUP] = credDict[KW_EXTRA_CREDENTIALS][1]
+    del credDict[KW_EXTRA_CREDENTIALS]
+    return True
+  return False
+
+
+def initializationOfSession(credDict, logObj=gLogger):
+  """ Discover the username associated to the authentication session. It will check if the selected group is valid.
+      The username will be included in the credentials dictionary. And will discover DN for group if last not set.
+
+      :param dict credDict: Credentials to check
+      :param object logObj: logger
+
+      :return: bool -- specifying whether the username was found
+  """
+  # Find user
+  result = Registry.getUsernameForID(credDict[KW_ID])
+  if not result['OK']:
+    credDict[KW_USERNAME] = "anonymous"
+    credDict[KW_GROUP] = "visitor"
+    return False
+  credDict[KW_USERNAME] = result['Value']
+  return True
+
+
+def initializationOfCertificate(credDict, logObj=gLogger):
+  """ Discover the username associated to the certificate DN. It will check if the selected group is valid.
+      The username will be included in the credentials dictionary.
+
+      :param dict credDict: Credentials to check
+      :param object logObj: logger
+
+      :return: bool -- specifying whether the username was found
+  """
+  # Search host
+  result = Registry.getHostnameForDN(credDict[KW_DN])
+  if result['OK'] and result['Value']:
+    credDict[KW_USERNAME] = result['Value']
+    credDict[KW_GROUP] = KW_HOSTS_GROUP
+    return True
+  elif credDict.get(KW_GROUP) == KW_HOSTS_GROUP:
+    logObj.warn("Cannot find hostname for DN %s: %s" % (credDict[KW_DN], result['Message']))
+    credDict[KW_USERNAME] = "anonymous"
+    credDict[KW_GROUP] = "visitor"
+    return False
+
+  # Search user
+  result = Registry.getUsernameForDN(credDict[KW_DN])
+  if not result['OK']:
+    credDict[KW_USERNAME] = "anonymous"
+    credDict[KW_GROUP] = "visitor"
+    return False
+  credDict[KW_USERNAME] = result['Value']
+  return True
+
+
+def initializationOfGroup(credDict, logObj=gLogger):
+  """ Check/get default group
+
+      :param dict credDict: Credentials to check
+      :param object logObj: logger
+
+      :return: bool -- specifying whether the username was found
+  """
+  # Find/check group
+  credDict[KW_PROPERTIES] = []
+  if not credDict.get(KW_GROUP) or credDict[KW_GROUP] == 'visitor':
+    result = Registry.findDefaultGroupForUser(credDict[KW_USERNAME])
+    if not result['OK']:
+      credDict[KW_USERNAME] = "anonymous"
+      credDict[KW_GROUP] = "visitor"
+      return False
+    credDict[KW_GROUP] = result['Value']
+  if credDict[KW_GROUP] == KW_HOSTS_GROUP:
+    credDict[KW_PROPERTIES] = Registry.getPropertiesForHost(credDict[KW_USERNAME], [])
+    return True
+  if not Registry.getGroupsForUser(credDict[KW_USERNAME], groupsList=[credDict[KW_GROUP]]).get('Value'):
+    credDict[KW_USERNAME] = "anonymous"
+    credDict[KW_GROUP] = "visitor"
+    return False
+  # Get DN for user/group
+  result = Registry.getDNsForUsernameInGroup(credDict[KW_USERNAME], credDict[KW_GROUP], checkStatus=True)
+  if not result['OK']:
+    logObj.error(result['Message'])
+    credDict[KW_GROUP] = "visitor"
+    return False
+  # Set DN if authorization not througth certificate
+  if not credDict.get(KW_DN):
+     credDict[KW_DN] = result['Value'][0]
+  # Check if DN match for group
+  if credDict[KW_DN] not in result["Value"]:
+    logObj.error('%s DN is not match for %s group.' % (credDict[KW_DN], credDict[KW_GROUP]))
+    credDict[KW_GROUP] = "visitor"
+    return False
+
+  # Fill group properties
+  credDict[KW_PROPERTIES] = Registry.getPropertiesForGroup(credDict[KW_GROUP], [])
+  return True
+
 
 class AuthManager(object):
   """ Handle Service Authorization
   """
-
   __authLogger = gLogger.getSubLogger("Authorization")
-  KW_HOSTS_GROUP = 'hosts'
-  KW_DN = 'DN'
-  KW_GROUP = 'group'
-  KW_EXTRA_CREDENTIALS = 'extraCredentials'
-  KW_PROPERTIES = 'properties'
-  KW_USERNAME = 'username'
 
   def __init__(self, authSection):
-    """
-    Constructor
+    """ Constructor
 
-    :type authSection: string
-    :param authSection: Section containing the authorization rules
+        :param str authSection: Section containing the authorization rules
     """
     self.authSection = authSection
 
   def authQuery(self, methodQuery, credDict, defaultProperties=False):
-    """
-    Check if the query is authorized for a credentials dictionary
-
-    :type  methodQuery: string
-    :param methodQuery: Method to test
-    :type  credDict: dictionary
-    :param credDict: dictionary containing credentials for test. The dictionary can contain the DN
-                        and selected group.
-    :return: Boolean result of test
+    """ Check if the query is authorized for a credentials dictionary
+
+        :param str methodQuery: Method to test
+        :param dict credDict: dictionary containing credentials for test. The dictionary can contain the DN
+               and selected group.
+        :param defaultProperties: default properties
+        :type defaultProperties: list or tuple
+
+        :return: bool -- result of test
     """
     userString = ""
-    if self.KW_DN in credDict:
-      userString += "DN=%s" % credDict[self.KW_DN]
-    if self.KW_GROUP in credDict:
-      userString += " group=%s" % credDict[self.KW_GROUP]
-    if self.KW_EXTRA_CREDENTIALS in credDict:
-      userString += " extraCredentials=%s" % str(credDict[self.KW_EXTRA_CREDENTIALS])
+    if KW_ID in credDict:
+      userString += " ID=%s" % credDict[KW_ID]
+    if KW_DN in credDict:
+      userString += " DN=%s" % credDict[KW_DN]
+    if credDict.get(KW_GROUP):
+      userString += " group=%s" % credDict[KW_GROUP]
+    if KW_EXTRA_CREDENTIALS in credDict:
+      userString += " extraCredentials=%s" % str(credDict[KW_EXTRA_CREDENTIALS])
     self.__authLogger.debug("Trying to authenticate %s" % userString)
+
     # Get properties
     requiredProperties = self.getValidPropertiesForMethod(methodQuery, defaultProperties)
+    lowerCaseProperties = [prop.lower() for prop in requiredProperties] or ['any']
+    allowAll = "any" in lowerCaseProperties or "all" in lowerCaseProperties
+
     # Extract valid groups
     validGroups = self.getValidGroups(requiredProperties)
-    lowerCaseProperties = [prop.lower() for prop in requiredProperties]
-    if not lowerCaseProperties:
-      lowerCaseProperties = ['any']
+    self.__authLogger.info("validGroups: ", validGroups)
 
-    allowAll = "any" in lowerCaseProperties or "all" in lowerCaseProperties
-    # Set no properties by default
-    credDict[self.KW_PROPERTIES] = []
-    # Check non secure backends
-    if self.KW_DN not in credDict or not credDict[self.KW_DN]:
-      if allowAll and not validGroups:
-        self.__authLogger.debug("Accepted request from unsecure transport")
-        return True
+    # Read extra credentials
+    if KW_EXTRA_CREDENTIALS in credDict:
+      # Is it a host? and HACK TO MAINTAIN COMPATIBILITY
+      if credDict.get(KW_EXTRA_CREDENTIALS) == KW_HOSTS_GROUP:
+        credDict[KW_GROUP] = credDict[KW_EXTRA_CREDENTIALS]
+        del credDict[KW_EXTRA_CREDENTIALS]
+      # Check if query comes though a gateway/web server
+      elif forwardingCredentials(credDict, logObj=self.__authLogger):
+        self.__authLogger.debug("Query comes from a gateway")
+        return self.authQuery(methodQuery, credDict, requiredProperties)
       else:
-        self.__authLogger.debug(
-            "Explicit property required and query seems to be coming through an unsecure transport")
         return False
-    # Check if query comes though a gateway/web server
-    if self.forwardedCredentials(credDict):
-      self.__authLogger.debug("Query comes from a gateway")
-      self.unpackForwardedCredentials(credDict)
-      return self.authQuery(methodQuery, credDict, requiredProperties)
-    # Get the properties
-    # Check for invalid forwarding
-    if self.KW_EXTRA_CREDENTIALS in credDict:
-      # Invalid forwarding?
-      if not isinstance(credDict[self.KW_EXTRA_CREDENTIALS], six.string_types):
-        self.__authLogger.debug("The credentials seem to be forwarded by a host, but it is not a trusted one")
-        return False
-    # Is it a host?
-    if self.KW_EXTRA_CREDENTIALS in credDict and credDict[self.KW_EXTRA_CREDENTIALS] == self.KW_HOSTS_GROUP:
-      # Get the nickname of the host
-      credDict[self.KW_GROUP] = credDict[self.KW_EXTRA_CREDENTIALS]
-    # HACK TO MAINTAIN COMPATIBILITY
-    else:
-      if self.KW_EXTRA_CREDENTIALS in credDict and self.KW_GROUP not in credDict:
-        credDict[self.KW_GROUP] = credDict[self.KW_EXTRA_CREDENTIALS]
-    # END OF HACK
-    # Get the username
-    if self.KW_DN in credDict and credDict[self.KW_DN]:
-      if self.KW_GROUP not in credDict:
-        result = Registry.findDefaultGroupForDN(credDict[self.KW_DN])
-        if not result['OK']:
-          credDict[self.KW_USERNAME] = "anonymous"
-          credDict[self.KW_GROUP] = "visitor"
-        else:
-          credDict[self.KW_GROUP] = result['Value']
-      if credDict[self.KW_GROUP] == self.KW_HOSTS_GROUP:
-        # For host
-        if not self.getHostNickName(credDict):
-          self.__authLogger.warn("Host is invalid")
-          if not allowAll:
-            return False
-          # If all, then set anon credentials
-          credDict[self.KW_USERNAME] = "anonymous"
-          credDict[self.KW_GROUP] = "visitor"
-      else:
-        # For users
-        username = self.getUsername(credDict)
-        suspended = self.isUserSuspended(credDict)
-        if not username:
-          self.__authLogger.warn("User is invalid or does not belong to the group it's saying")
-        if suspended:
-          self.__authLogger.warn("User is Suspended")
-
-        if not username or suspended:
-          if not allowAll:
-            return False
-          # If all, then set anon credentials
-          credDict[self.KW_USERNAME] = "anonymous"
-          credDict[self.KW_GROUP] = "visitor"
-    else:
-      if not allowAll:
-        return False
-      credDict[self.KW_USERNAME] = "anonymous"
-      credDict[self.KW_GROUP] = "visitor"
 
-    # If any or all in the props, allow
-    allowGroup = not validGroups or credDict[self.KW_GROUP] in validGroups
-    if allowAll and allowGroup:
-      return True
-    # Check authorized groups
-    if "authenticated" in lowerCaseProperties and allowGroup:
-      return True
-    if not self.matchProperties(credDict, requiredProperties):
-      self.__authLogger.warn("Client is not authorized\nValid properties: %s\nClient: %s" %
-                             (requiredProperties, credDict))
-      return False
-    elif not allowGroup:
-      self.__authLogger.warn("Client is not authorized\nValid groups: %s\nClient: %s" %
-                             (validGroups, credDict))
-      return False
-    return True
+    # Check authorization
+    authorized = True
+    # Search user name
+    if not credDict.get(KW_USERNAME):
+      if credDict.get(KW_DN):
+        # With certificate
+        authorized = initializationOfCertificate(credDict, logObj=self.__authLogger)
+      elif credDict.get(KW_ID):
+        # With IdP session
+        authorized = initializationOfSession(credDict, logObj=self.__authLogger)
+      else:
+        credDict[KW_USERNAME] = "anonymous"
+        credDict[KW_GROUP] = "visitor"
+        authorized = False
 
-  def getHostNickName(self, credDict):
-    """
-    Discover the host nickname associated to the DN.
-    The nickname will be included in the credentials dictionary.
+    # Search group
+    if authorized:
+      authorized = initializationOfGroup(credDict, logObj=self.__authLogger)
 
-    :type  credDict: dictionary
-    :param credDict: Credentials to ckeck
-    :return: Boolean specifying whether the nickname was found
-    """
-    if self.KW_DN not in credDict:
-      return True
-    if self.KW_GROUP not in credDict:
-      return False
-    retVal = Registry.getHostnameForDN(credDict[self.KW_DN])
-    if not retVal['OK']:
-      gLogger.warn("Cannot find hostname for DN %s: %s" % (credDict[self.KW_DN], retVal['Message']))
-      return False
-    credDict[self.KW_USERNAME] = retVal['Value']
-    credDict[self.KW_PROPERTIES] = Registry.getPropertiesForHost(credDict[self.KW_USERNAME], [])
-    return True
+    # Authorize check
+    if allowAll or authorized:
+      # Properties check
+      if not self.matchProperties(credDict, list(set(requiredProperties) - set(['Any', 'any',
+                                                                                'All', 'all',
+                                                                                'authenticated',
+                                                                                'Authenticated']))):
+        self.__authLogger.warn("Client is not authorized\nValid properties: %s\nClient: %s" %
+                               (requiredProperties, credDict))
+        return False
+      # Groups check
+      elif validGroups and credDict[KW_GROUP] not in validGroups:
+        self.__authLogger.warn("Client is not authorized\nValid groups: %s\nClient: %s" %
+                               (validGroups, credDict))
+        return False
+      else:
+        if not authorized:
+          self.__authLogger.debug("Accepted request from unsecure transport")
+        return True
+    else:
+      self.__authLogger.debug("User is invalid or does not belong to the group it's saying")
+    return False
 
   def getValidPropertiesForMethod(self, method, defaultProperties=False):
-    """
-    Get all authorized groups for calling a method
+    """ Get all authorized groups for calling a method
+
+        :param str method: Method to test
+        :param defaultProperties: default properties
+        :type defaultProperties: list or tuple
 
-    :type  method: string
-    :param method: Method to test
-    :return: List containing the allowed groups
+        :return: list -- List containing the allowed groups
     """
     authProps = gConfig.getValue("%s/%s" % (self.authSection, method), [])
     if authProps:
@@ -197,11 +270,11 @@ def getValidPropertiesForMethod(self, method, defaultProperties=False):
     return []
 
   def getValidGroups(self, rawProperties):
-    """  Get valid groups as specified in the method authorization rules
+    """ Get valid groups as specified in the method authorization rules
+
+        :param list rawProperties: all method properties
 
-    :param rawProperties: all method properties
-    :type rawProperties: python:list
-    :return: list of allowed groups or []
+        :return: list -- list of allowed groups
     """
     validGroups = []
     for prop in list(rawProperties):
@@ -219,103 +292,26 @@ def getValidGroups(self, rawProperties):
     validGroups = list(set(validGroups))
     return validGroups
 
-  def forwardedCredentials(self, credDict):
-    """
-    Check whether the credentials are being forwarded by a valid source
-
-    :type  credDict: dictionary
-    :param credDict: Credentials to ckeck
-    :return: Boolean with the result
-    """
-    if self.KW_EXTRA_CREDENTIALS in credDict and isinstance(credDict[self.KW_EXTRA_CREDENTIALS], (tuple, list)):
-      if self.KW_DN in credDict:
-        retVal = Registry.getHostnameForDN(credDict[self.KW_DN])
-        if retVal['OK']:
-          hostname = retVal['Value']
-          if Properties.TRUSTED_HOST in Registry.getPropertiesForHost(hostname, []):
-            return True
-    return False
-
-  def unpackForwardedCredentials(self, credDict):
-    """
-    Extract the forwarded credentials
-
-    :type  credDict: dictionary
-    :param credDict: Credentials to unpack
-    """
-    credDict[self.KW_DN] = credDict[self.KW_EXTRA_CREDENTIALS][0]
-    credDict[self.KW_GROUP] = credDict[self.KW_EXTRA_CREDENTIALS][1]
-    del(credDict[self.KW_EXTRA_CREDENTIALS])
-
-  def getUsername(self, credDict):
-    """
-    Discover the username associated to the DN. It will check if the selected group is valid.
-    The username will be included in the credentials dictionary.
-
-    :type  credDict: dictionary
-    :param credDict: Credentials to check
-    :return: Boolean specifying whether the username was found
-    """
-    if self.KW_DN not in credDict:
-      return True
-    if self.KW_GROUP not in credDict:
-      result = Registry.findDefaultGroupForDN(credDict[self.KW_DN])
-      if not result['OK']:
-        return False
-      credDict[self.KW_GROUP] = result['Value']
-    credDict[self.KW_PROPERTIES] = Registry.getPropertiesForGroup(credDict[self.KW_GROUP], [])
-    usersInGroup = Registry.getUsersInGroup(credDict[self.KW_GROUP], [])
-    if not usersInGroup:
-      return False
-    retVal = Registry.getUsernameForDN(credDict[self.KW_DN], usersInGroup)
-    if retVal['OK']:
-      credDict[self.KW_USERNAME] = retVal['Value']
-      return True
-    return False
+  def matchProperties(self, credDict, validProps, caseSensitive=False):
+    """ Return True if one or more properties are in the valid list of properties
 
-  def isUserSuspended(self, credDict):
-    """ Discover if the user is in Suspended status
+        :param dict credDict: credentials to match
+        :param list validProps: List of valid properties
+        :param bool caseSensitive: Map lower case properties to properties to make the check in
+               lowercase but return the proper case
 
-    :param dict credDict: Credentials to check
-    :return: Boolean True if user is Suspended
+        :return: bool -- specifying whether any property has matched the valid ones
     """
-    # Update credDict if the username is not there
-    if self.KW_USERNAME not in credDict:
-      self.getUsername(credDict)
-    # If username or group is not known we can not judge if the user is suspended
-    # These cases are treated elsewhere anyway
-    if self.KW_USERNAME not in credDict or self.KW_GROUP not in credDict:
-      return False
-    suspendedVOList = Registry.getUserOption(credDict[self.KW_USERNAME], 'Suspended', [])
-    if not suspendedVOList:
-      return False
-    vo = Registry.getVOForGroup(credDict[self.KW_GROUP])
-    if vo in suspendedVOList:
+    if not validProps:
       return True
-    return False
-
-  def matchProperties(self, credDict, validProps, caseSensitive=False):
-    """
-    Return True if one or more properties are in the valid list of properties
-
-    :type  props: list
-    :param props: List of properties to match
-    :type  validProps: list
-    :param validProps: List of valid properties
-    :return: Boolean specifying whether any property has matched the valid ones
-    """
-
-    # HACK: Map lower case properties to properties to make the check in lowercase but return the proper case
     if not caseSensitive:
       validProps = dict((prop.lower(), prop) for prop in validProps)
     else:
       validProps = dict((prop, prop) for prop in validProps)
-    groupProperties = credDict[self.KW_PROPERTIES]
     foundProps = []
-    for prop in groupProperties:
+    for prop in credDict[KW_PROPERTIES]:
       if not caseSensitive:
         prop = prop.lower()
       if prop in validProps:
         foundProps.append(validProps[prop])
-    credDict[self.KW_PROPERTIES] = foundProps
-    return foundProps
+    return bool(foundProps)
diff --git a/Core/DISET/RequestHandler.py b/Core/DISET/RequestHandler.py
index 0d423b92ac1..a13046c4688 100755
--- a/Core/DISET/RequestHandler.py
+++ b/Core/DISET/RequestHandler.py
@@ -18,6 +18,8 @@
 from DIRAC.ConfigurationSystem.Client.Config import gConfig
 from DIRAC.FrameworkSystem.Client.Logger import gLogger
 from DIRAC.Core.Security.Properties import CS_ADMINISTRATOR
+from DIRAC.Core.DISET.AuthManager import initializationOfCertificate, initializationOfGroup,\
+    forwardingCredentials, initializationOfSession
 
 
 def getServiceOption(serviceInfo, optionName, defaultValue):
@@ -98,7 +100,14 @@ def getRemoteCredentials(self):
 
     :return: Credentials dictionary of remote peer.
     """
-    return self.__trPool.get(self.__trid).getConnectingCredentials()
+    credDict = self.__trPool.get(self.__trid).getConnectingCredentials()
+    forwardingCredentials(credDict, logObj=self.log)
+    if credDict.get('ID'):
+      initializationOfSession(credDict, logObj=self.log)
+    else:
+      initializationOfCertificate(credDict, logObj=self.log)
+    initializationOfGroup(credDict, logObj=self.log)
+    return credDict
 
   @classmethod
   def getCSOption(cls, optionName, defaultValue=False):
diff --git a/Core/DISET/ThreadConfig.py b/Core/DISET/ThreadConfig.py
index bc86d58936a..8ca8e5dc13b 100644
--- a/Core/DISET/ThreadConfig.py
+++ b/Core/DISET/ThreadConfig.py
@@ -28,6 +28,7 @@ def reset(self):
     """ Reset extra information
     """
     self.__DN = False
+    self.__ID = False
     self.__group = False
     self.__deco = False
     self.__setup = False
@@ -74,21 +75,19 @@ def getGroup(self):
     """
     return self.__group
 
-  def setID(self, DN, group):
+  def setID(self, ID):
     """ Set user ID
 
-        :param str DN: user DN
-        :param str group: user group
+        :param str ID: user ID
     """
-    self.__DN = DN
-    self.__group = group
+    self.__ID = ID
 
   def getID(self):
     """ Return user ID
 
-        :return: tuple
+        :return: str
     """
-    return (self.__DN, self.__group)
+    return self.__ID
 
   def setSetup(self, setup):
     """ Set setup name
@@ -109,19 +108,17 @@ def dump(self):
 
         :return: tuple
     """
-    return (self.__DN, self.__group, self.__setup)
+    return (self.__DN, self.__group, self.__setup, self.__ID)
 
   def load(self, tp):
     """ Save extra information
 
-        :param tuple tp: contain DN, group name, setup name
+        :param tuple tp: contain DN, group name, setup name, ID
     """
-    if tp[0]:
-      self.__DN = tp[0]
-    if tp[1]:
-      self.__group = tp[1]
-    if tp[2]:
-      self.__setup = tp[2]
+    self.__ID = tp[3] or self.__ID
+    self.__DN = tp[0] or self.__DN
+    self.__group = tp[1] or self.__group
+    self.__setup = tp[2] or self.__setup
 
 
 def threadDeco(method):
diff --git a/Core/DISET/private/BaseClient.py b/Core/DISET/private/BaseClient.py
index 9eeae56ddfc..69474c973d4 100755
--- a/Core/DISET/private/BaseClient.py
+++ b/Core/DISET/private/BaseClient.py
@@ -13,11 +13,10 @@
 import DIRAC
 from DIRAC.Core.DISET.private.Protocols import gProtocolDict
 from DIRAC.FrameworkSystem.Client.Logger import gLogger
-from DIRAC.Core.Utilities import List, Network
+from DIRAC.Core.Utilities import List, Network, DErrno
 from DIRAC.Core.Utilities.ReturnValues import S_OK, S_ERROR
 from DIRAC.ConfigurationSystem.Client.Config import gConfig
 from DIRAC.ConfigurationSystem.Client.PathFinder import getServiceURL, getServiceFailoverURL
-from DIRAC.ConfigurationSystem.Client.Helpers import Registry
 from DIRAC.ConfigurationSystem.Client.Helpers.CSGlobals import skipCACheck
 from DIRAC.Core.DISET.private.TransportPool import getGlobalTransportPool
 from DIRAC.Core.DISET.ThreadConfig import ThreadConfig
@@ -35,6 +34,7 @@ class BaseClient(object):
   KW_TIMEOUT = "timeout"
   KW_SETUP = "setup"
   KW_VO = "VO"
+  KW_DELEGATED_ID = "delegatedID"
   KW_DELEGATED_DN = "delegatedDN"
   KW_DELEGATED_GROUP = "delegatedGroup"
   KW_IGNORE_GATEWAYS = "ignoreGateways"
@@ -256,17 +256,19 @@ def __discoverExtraCredentials(self):
       self.__extraCredentials = self.kwargs[self.KW_EXTRA_CREDENTIALS]
 
     # Are we delegating something?
+    delegatedID = self.kwargs.get(self.KW_DELEGATED_ID) or self.__threadConfig.getID()
     delegatedDN = self.kwargs.get(self.KW_DELEGATED_DN) or self.__threadConfig.getDN()
     delegatedGroup = self.kwargs.get(self.KW_DELEGATED_GROUP) or self.__threadConfig.getGroup()
+
+    if delegatedID:
+      self.kwargs[self.KW_DELEGATED_ID] = delegatedID
     if delegatedDN:
       self.kwargs[self.KW_DELEGATED_DN] = delegatedDN
-      if not delegatedGroup:
-        result = Registry.findDefaultGroupForDN(delegatedDN)
-        if not result['OK']:
-          return result
-        delegatedGroup = result['Value']
+    if delegatedGroup:
       self.kwargs[self.KW_DELEGATED_GROUP] = delegatedGroup
-      self.__extraCredentials = (delegatedDN, delegatedGroup)
+
+    if delegatedID or delegatedDN:
+      self.__extraCredentials = (delegatedID or delegatedDN, delegatedGroup)
     return S_OK()
 
   def __findServiceURL(self):
@@ -496,10 +498,10 @@ def _connect(self):
           # try to reconnect
           return self._connect()
         else:
-          return retVal
+          return S_ERROR(DErrno.ECONNECT, retVal['Message'])
     except Exception as e:
       gLogger.exception(lException=True, lExcInfo=True)
-      return S_ERROR("Can't connect to %s: %s" % (self.serviceURL, repr(e)))
+      return S_ERROR(DErrno.ECONNECT, "Can't connect to %s: %s" % (self.serviceURL, repr(e)))
     # We add the connection to the transport pool
     gLogger.debug("Connected to: %s" % self.serviceURL)
     trid = getGlobalTransportPool().add(transport)
diff --git a/Core/DISET/test/Test_AuthManager.py b/Core/DISET/test/Test_AuthManager.py
index 56645994f00..814f6998b96 100644
--- a/Core/DISET/test/Test_AuthManager.py
+++ b/Core/DISET/test/Test_AuthManager.py
@@ -4,14 +4,44 @@
 from __future__ import division
 from __future__ import print_function
 
+import os
+import mock
+import pickle
 import unittest
 
 from diraccfg import CFG
-from DIRAC import gConfig
+from DIRAC import gConfig, rootPath, S_OK, S_ERROR
 from DIRAC.Core.DISET.AuthManager import AuthManager
 
 __RCSID__ = "$Id$"
 
+workDir = os.path.join(gConfig.getValue('/LocalSite/InstancePath', rootPath), 'work/ProxyManager')
+
+voDict = {
+    'testVO': S_OK({
+        '/User/test/DN/CN=userS': {
+            'Suspended': True,
+            'VOMSRoles': [u'/testVO'],
+            'ActiveRoles': [],
+            'SuspendedRoles': [u'/testVO']
+        },
+        '/User/test/DN/CN=userA': {
+            'Suspended': False,
+            'VOMSRoles': [u'/testVO'],
+            'ActiveRoles': [u'/testVO'],
+            'SuspendedRoles': []
+        }
+    }),
+    'testVOOther': S_OK({
+        '/User/test/DN/CN=userS': {
+            'Suspended': False,
+            'VOMSRoles': [u'/testVOOther'],
+            'ActiveRoles': [u'/testVOOther'],
+            'SuspendedRoles': []
+        }
+    })
+}
+
 testSystemsCFG = """
 Systems
 {
@@ -46,6 +76,7 @@
     testVO
     {
       VOAdmin = userA
+      VOMSName = testVO
     }
     testVOBad
     {
@@ -54,6 +85,7 @@
     testVOOther
     {
       VOAdmin = userA
+      VOMSName = testVOOther
     }
   }
   Users
@@ -91,6 +123,7 @@
     {
       Users = userA, userS
       VO = testVO
+      VOMSRole = /testVO
       Properties = NormalUser
     }
     group_test_other
@@ -110,9 +143,28 @@
 """
 
 
+def sf_getVOMSInfo(vo=None, dn=None):
+  return S_OK(voDict)
+
+
+@mock.patch('DIRAC.ConfigurationSystem.Client.Helpers.Registry.getVOMSInfo',
+            new=sf_getVOMSInfo)
 class AuthManagerTest(unittest.TestCase):
   """ Base class for the Modules test cases
   """
+  @classmethod
+  def setUpClass(cls):
+    if not os.path.exists(workDir):
+      os.makedirs(workDir)
+    for vo, infoDict in voDict.items():
+      with open(os.path.join(workDir, vo + '.pkl'), 'wb+') as f:
+        pickle.dump(infoDict, f, pickle.HIGHEST_PROTOCOL)
+
+  @classmethod
+  def tearDownClass(cls):
+    for vo in voDict.keys():
+      if os.path.exists(os.path.join(workDir, vo + '.pkl')):
+        os.remove(os.path.join(workDir, vo + '.pkl'))
 
   def setUp(self):
     self.authMgr = AuthManager('/Systems/Service/Authorization')
diff --git a/Core/Security/VOMSService.py b/Core/Security/VOMSService.py
index 5b34ea7db71..26100b21310 100644
--- a/Core/Security/VOMSService.py
+++ b/Core/Security/VOMSService.py
@@ -59,7 +59,7 @@ def attGetUserNickname(self, dn, _ca=None):
 
     :param str dn: user DN
     :param str _ca: CA, kept for backward compatibility
-    :return:  S_OK with Value: nickname
+    :return: S_OK with Value: nickname
     """
 
     if self.userDict is None:
@@ -75,16 +75,18 @@ def attGetUserNickname(self, dn, _ca=None):
       return S_ERROR(DErrno.EVOMS, "No nickname defined")
     return S_OK(nickname)
 
-  def getUsers(self):
+  def getUsers(self, proxyPath=None):
     """ Get all the users of the VOMS VO with their detailed information
 
+    :param str proxyPath: proxy path
+
     :return: user dictionary keyed by the user DN
     """
 
     if not self.urls:
       return S_ERROR(DErrno.ENOAUTH, "No VOMS server defined")
 
-    userProxy = getProxyLocation()
+    userProxy = proxyPath or getProxyLocation()
     caPath = getCAsLocation()
     rawUserList = []
     result = None
diff --git a/Core/Utilities/DErrno.py b/Core/Utilities/DErrno.py
index 45d58a14136..920593c467d 100644
--- a/Core/Utilities/DErrno.py
+++ b/Core/Utilities/DErrno.py
@@ -91,6 +91,7 @@
 # DISET: 1X
 EDISET = 1110
 ENOAUTH = 1111
+ECONNECT = 1112
 # 3rd party security: 2X
 E3RDPARTY = 1120
 EVOMS = 1121
@@ -167,6 +168,7 @@
     # 111X: DISET
     1110: 'EDISET',
     1111: 'ENOAUTH',
+    1112: 'ECONNECT',
     # 112X: 3rd party security
     1120: 'E3RDPARTY',
     1121: 'EVOMS',
@@ -239,6 +241,7 @@
     # 111X: DISET
     EDISET: "DISET Error",
     ENOAUTH: "Unauthorized query",
+    ECONNECT: "Connection error",
     # 112X: 3rd party security
     E3RDPARTY: "3rd party security service error",
     EVOMS: "VOMS Error",
diff --git a/Core/Utilities/DictCache.py b/Core/Utilities/DictCache.py
index b4bde787ea3..2d5767ae2d4 100644
--- a/Core/Utilities/DictCache.py
+++ b/Core/Utilities/DictCache.py
@@ -207,6 +207,24 @@ def getKeys(self, validSeconds=0):
     finally:
       self.lock.release()
 
+  def getDict(self, validSeconds=0):
+    """ Get dictionary for all contents
+
+        :param int validSeconds: valid time in seconds
+
+        :return: dict
+    """
+    self.lock.acquire()
+    try:
+      resDict = {}
+      limitTime = datetime.datetime.now() + datetime.timedelta(seconds=validSeconds)
+      for cKey in self.__cache:
+        if self.__cache[cKey]['expirationTime'] > limitTime:
+          resDict[cKey] = self.__cache[cKey]['value']
+      return resDict
+    finally:
+      self.lock.release()
+
   def purgeExpired(self, expiredInSeconds=0):
     """ Purge all entries that are expired or will be expired in <expiredInSeconds>
 
diff --git a/Core/Utilities/Proxy.py b/Core/Utilities/Proxy.py
index 655a5a99651..63f8d4b77fa 100644
--- a/Core/Utilities/Proxy.py
+++ b/Core/Utilities/Proxy.py
@@ -41,10 +41,9 @@ def undecoratedFunction(foo='bar'):
 import os
 
 from DIRAC import gConfig, gLogger, S_ERROR, S_OK
+from DIRAC.Core.Utilities.LockRing import LockRing
 from DIRAC.FrameworkSystem.Client.ProxyManagerClient import gProxyManager
 from DIRAC.ConfigurationSystem.Client.ConfigurationData import gConfigurationData
-from DIRAC.ConfigurationSystem.Client.Helpers.Registry import getVOMSAttributeForGroup, getDNForUsername
-from DIRAC.Core.Utilities.LockRing import LockRing
 
 __RCSID__ = "$Id$"
 
@@ -104,30 +103,32 @@ def wrapped_fcn(*args, **kwargs):
   return wrapped_fcn
 
 
-def getProxy(userDNs, userGroup, vomsAttr, proxyFilePath):
-  """ do the actual download of the proxy, trying the different DNs
+def getProxy(user, userGroup, vomsAttr, proxyFilePath):
+  """ Do the actual download of the proxy, trying the different DNs
+
+  :param str user: user name or DN
+  :param str userGroup: group name
+  :param bool vomsAttr: if need VOMSproxy
+  :param str proxyPathFile: path to proxy file
+
+  :return: S_OK(object)/S_ERROR() -- return proxy as chain
   """
-  for userDN in userDNs:
-    if vomsAttr:
-      result = gProxyManager.downloadVOMSProxyToFile(userDN, userGroup,
-                                                     requiredVOMSAttribute=vomsAttr,
-                                                     filePath=proxyFilePath,
-                                                     requiredTimeLeft=3600,
-                                                     cacheTime=3600)
-    else:
-      result = gProxyManager.downloadProxyToFile(userDN, userGroup,
-                                                 filePath=proxyFilePath,
-                                                 requiredTimeLeft=3600,
-                                                 cacheTime=3600)
-
-    if not result['OK']:
-      gLogger.error("Can't download %sproxy " % ('VOMS' if vomsAttr else ''),
-                    "of '%s', group %s to file: " % (userDN, userGroup) + result['Message'])
-    else:
-      return result
+  if vomsAttr:
+    result = gProxyManager.downloadVOMSProxyToFile(user, userGroup,
+                                                   filePath=proxyFilePath,
+                                                   requiredTimeLeft=3600,
+                                                   cacheTime=3600)
+  else:
+    result = gProxyManager.downloadProxyToFile(user, userGroup,
+                                               filePath=proxyFilePath,
+                                               requiredTimeLeft=3600,
+                                               cacheTime=3600)
 
-  # If proxy not found for any DN, return an error
-  return S_ERROR("Can't download proxy")
+  if not result['OK']:
+    gLogger.error("Can't download %sproxy " % ('VOMS' if vomsAttr else ''),
+                  "of '%s', group %s to file: " % (user, userGroup) + result['Message'])
+    return S_ERROR("Can't download proxy")
+  return result
 
 
 def executeWithoutServerCertificate(fcn):
@@ -151,7 +152,8 @@ def executeWithoutServerCertificate(fcn):
   """
 
   def wrapped_fcn(*args, **kwargs):
-
+    """ Wraped fuction
+    """
     # Get the lock and acquire it
     executionLock = LockRing().getLock('_UseUserProxy_', recursive=True)
     executionLock.acquire()
@@ -225,20 +227,7 @@ def _putProxy(userDN=None, userName=None, userGroup=None, vomsFlag=None, proxyFi
   :returns: Tuple of originalUserProxy, useServerCertificate, executionLock
   """
   # Setup user proxy
-  if userDN:
-    userDNs = [userDN]
-  else:
-    result = getDNForUsername(userName)
-    if not result['OK']:
-      return result
-    userDNs = result['Value']  # a same user may have more than one DN
-
-  vomsAttr = ''
-  if vomsFlag:
-    vomsAttr = getVOMSAttributeForGroup(userGroup)
-
-  result = getProxy(userDNs, userGroup, vomsAttr, proxyFilePath)
-
+  result = getProxy(userDN or userName, userGroup, vomsFlag, proxyFilePath)
   if not result['OK']:
     return result
 
diff --git a/Core/Utilities/Shifter.py b/Core/Utilities/Shifter.py
index 02928783e4c..5161ee348c9 100644
--- a/Core/Utilities/Shifter.py
+++ b/Core/Utilities/Shifter.py
@@ -14,7 +14,8 @@
 from DIRAC.FrameworkSystem.Client.ProxyManagerClient import gProxyManager
 from DIRAC.ConfigurationSystem.Client.Helpers.Operations import Operations
 from DIRAC.ConfigurationSystem.Client.Helpers import cfgPath
-from DIRAC.ConfigurationSystem.Client.Helpers import Registry
+from DIRAC.ConfigurationSystem.Client.Helpers.Registry import findDefaultGroupForUser,\
+    getDNForUsernameInGroup, getVOMSAttributeForGroup
 
 
 def getShifterProxy(shifterType, fileName=False):
@@ -31,26 +32,28 @@ def getShifterProxy(shifterType, fileName=False):
   userName = opsHelper.getValue(cfgPath('Shifter', shifterType, 'User'), '')
   if not userName:
     return S_ERROR("No shifter User defined for %s" % shifterType)
-  result = Registry.getDNForUsername(userName)
-  if not result['OK']:
-    return result
-  userDN = result['Value'][0]
-  result = Registry.findDefaultGroupForDN(userDN)
+  result = findDefaultGroupForUser(userName)
   if not result['OK']:
     return result
   defaultGroup = result['Value']
   userGroup = opsHelper.getValue(cfgPath('Shifter', shifterType, 'Group'), defaultGroup)
-  vomsAttr = Registry.getVOMSAttributeForGroup(userGroup)
+  result = getDNForUsernameInGroup(userName, userGroup)
+  if not result['OK']:
+    return result
+  userDN = result['Value']
+  if not userDN:
+    return S_ERROR('No user DN found for shifter %s@%s' % (userName, userGroup))
+  vomsAttr = getVOMSAttributeForGroup(userGroup)
   if vomsAttr:
     gLogger.info("Getting VOMS [%s] proxy for shifter %s@%s (%s)" % (vomsAttr, userName,
                                                                      userGroup, userDN))
-    result = gProxyManager.downloadVOMSProxyToFile(userDN, userGroup,
+    result = gProxyManager.downloadVOMSProxyToFile(userName, userGroup,
                                                    filePath=fileName,
                                                    requiredTimeLeft=86400,
                                                    cacheTime=86400)
   else:
     gLogger.info("Getting proxy for shifter %s@%s (%s)" % (userName, userGroup, userDN))
-    result = gProxyManager.downloadProxyToFile(userDN, userGroup,
+    result = gProxyManager.downloadProxyToFile(userName, userGroup,
                                                filePath=fileName,
                                                requiredTimeLeft=86400,
                                                cacheTime=86400)
diff --git a/Core/Web/App.py b/Core/Web/App.py
new file mode 100644
index 00000000000..182f7d40102
--- /dev/null
+++ b/Core/Web/App.py
@@ -0,0 +1,230 @@
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import print_function
+
+import os
+import ssl
+import imp
+import sys
+import signal
+import tornado.web
+import tornado.process
+import tornado.httpserver
+import tornado.autoreload
+
+from diraccfg import CFG
+
+import DIRAC
+
+from DIRAC import gLogger, gConfig
+from DIRAC.ConfigurationSystem.Client.Helpers import CSGlobals
+from DIRAC.Core.Web.HandlerMgr import HandlerMgr
+from DIRAC.Core.Web.TemplateLoader import TemplateLoader
+from DIRAC.Core.Web.SessionData import SessionData
+from DIRAC.Core.Web import Conf
+
+__RCSID__ = "$Id$"
+
+
+class App(object):
+
+  def __init__(self, handlersLoc='WebApp.handler'):
+    self.__handlerMgr = HandlerMgr(handlersLoc, Conf.rootURL())
+    self.__servers = {}
+    self.log = gLogger.getSubLogger("Web")
+
+  def _logRequest(self, handler):
+    """ Log request """
+    status = handler.get_status()
+    if status < 400:
+      logm = self.log.notice
+    elif status < 500:
+      logm = self.log.warn
+    else:
+      logm = self.log.error
+    request_time = 1000.0 * handler.request.request_time()
+    logm("%d %s %.2fms" % (status, handler._request_summary(), request_time))
+
+  def __reloadAppCB(self):
+    """ Reload """
+    gLogger.notice("\n !!!!!! Reloading web app...\n")
+
+  def _loadWebAppCFGFiles(self):
+    """
+    Load WebApp/web.cfg definitions
+    """
+    exts = []
+    for ext in CSGlobals.getCSExtensions():
+      if ext == "DIRAC":
+        continue
+      if ext[-5:] != "DIRAC":
+        ext = "%sDIRAC" % ext
+      if ext != "WebAppDIRAC":
+        exts.append(ext)
+    exts.append("DIRAC")
+    exts.append("WebAppDIRAC")
+    webCFG = CFG()
+    for modName in reversed(exts):
+      try:
+        modPath = imp.find_module(modName)[1]
+      except ImportError:
+        continue
+      gLogger.verbose("Found module %s at %s" % (modName, modPath))
+      cfgPath = os.path.join(modPath, "WebApp", "web.cfg")
+      if not os.path.isfile(cfgPath):
+        gLogger.verbose("Inexistant %s" % cfgPath)
+        continue
+      try:
+        modCFG = CFG().loadFromFile(cfgPath)
+      except Exception as excp:
+        gLogger.error("Could not load %s: %s" % (cfgPath, excp))
+        continue
+      gLogger.verbose("Loaded %s" % cfgPath)
+      expl = [Conf.BASECS]
+      while len(expl):
+        current = expl.pop(0)
+        if not modCFG.isSection(current):
+          continue
+        if modCFG.getOption("%s/AbsoluteDefinition" % current, False):
+          gLogger.verbose("%s:%s is an absolute definition" % (modName, current))
+          try:
+            webCFG.deleteKey(current)
+          except BaseException:
+            pass
+          modCFG.deleteKey("%s/AbsoluteDefinition" % current)
+        else:
+          for sec in modCFG[current].listSections():
+            expl.append("%s/%s" % (current, sec))
+      # Add the modCFG
+      webCFG = webCFG.mergeWith(modCFG)
+    gConfig.loadCFG(webCFG)
+
+  def _loadDefaultWebCFG(self):
+    """ This method reloads the web.cfg file from etc/web.cfg
+
+        :return: bool
+    """
+    modCFG = None
+    cfgPath = os.path.join(DIRAC.rootPath, 'etc', 'web.cfg')
+    isLoaded = True
+    if not os.path.isfile(cfgPath):
+      isLoaded = False
+    else:
+      try:
+        modCFG = CFG().loadFromFile(cfgPath)
+      except Exception as excp:
+        isLoaded = False
+        gLogger.error("Could not load %s: %s" % (cfgPath, excp))
+
+    if modCFG:
+      if modCFG.isSection("/Website"):
+        gLogger.warn("%s configuration file is not correct. It is used by the old portal!" % (cfgPath))
+        isLoaded = False
+      else:
+        gConfig.loadCFG(modCFG)
+    else:
+      isLoaded = False
+
+    return isLoaded
+
+  def stopChildProcesses(self, sig, frame):
+    """
+    It is used to properly stop tornado when more than one process is used.
+    In principle this is doing the job of runsv....
+
+    :param int sig: the signal sent to the process
+    :param object frame: execution frame which contains the child processes
+    """
+    # tornado.ioloop.IOLoop.instance().add_timeout(time.time()+5, sys.exit)
+    for child in frame.f_locals.get('children', []):
+      gLogger.info("Stopping child processes: %d" % child)
+      os.kill(child, signal.SIGTERM)
+    # tornado.ioloop.IOLoop.instance().stop()
+    # gLogger.info('exit success')
+    sys.exit(0)
+
+  def bootstrap(self):
+    """
+    Configure and create web app
+    """
+    self.log.always("\n ====== Starting DIRAC web app ====== \n")
+
+    # Load required CFG files
+    if not self._loadDefaultWebCFG():
+      # if we have a web.cfg under etc directory we use it, otherwise
+      # we use the configuration file defined by the developer
+      self._loadWebAppCFGFiles()
+    # Calculating routes
+    result = self.__handlerMgr.getRoutes()
+    if not result['OK']:
+      return result
+    routes = result['Value']
+    # Initialize the session data
+    SessionData.setHandlers(self.__handlerMgr.getHandlers()['Value'])
+    # Create the app
+    tLoader = TemplateLoader(self.__handlerMgr.getPaths("template"))
+    kw = dict(debug=Conf.devMode(), template_loader=tLoader, cookie_secret=str(Conf.cookieSecret()),
+              log_function=self._logRequest, autoreload=Conf.numProcesses() < 2)
+
+    # please do no move this lines. The lines must be before the fork_processes
+    signal.signal(signal.SIGTERM, self.stopChildProcesses)
+    signal.signal(signal.SIGINT, self.stopChildProcesses)
+
+    # Check processes if we're under a load balancert
+    if Conf.balancer() and Conf.numProcesses() not in (0, 1):
+      tornado.process.fork_processes(Conf.numProcesses(), max_restarts=0)
+      kw['debug'] = False
+    # Debug mode?
+    if kw['debug']:
+      self.log.info("Configuring in developer mode...")
+    # Configure tornado app
+    self.__app = tornado.web.Application(routes, **kw)
+    self.log.notice("Configuring HTTP on port %s" % (Conf.HTTPPort()))
+    # Create the web servers
+    srv = tornado.httpserver.HTTPServer(self.__app, xheaders=True)
+    port = Conf.HTTPPort()
+    srv.listen(port)
+    self.__servers[('http', port)] = srv
+
+    Conf.generateRevokedCertsFile()  # it is used by nginx....
+
+    if Conf.HTTPS():
+      self.log.notice("Configuring HTTPS on port %s" % Conf.HTTPSPort())
+      sslops = dict(certfile=Conf.HTTPSCert(),
+                    keyfile=Conf.HTTPSKey(),
+                    cert_reqs=ssl.CERT_OPTIONAL,
+                    ca_certs=Conf.generateCAFile(),
+                    ssl_version=ssl.PROTOCOL_TLSv1)
+
+      sslprotocol = str(Conf.SSLProrocol())
+      aviableProtocols = [i for i in dir(ssl) if i.find('PROTOCOL') == 0]
+      if sslprotocol and sslprotocol != "":
+        if (sslprotocol in aviableProtocols):
+          sslops['ssl_version'] = getattr(ssl, sslprotocol)
+        else:
+          message = "%s protocol is not provided." % sslprotocol
+          message += "The following protocols are provided: %s" % str(aviableProtocols)
+          gLogger.warn(message)
+
+      self.log.debug(" - %s" % "\n - ".join(["%s = %s" % (k, sslops[k]) for k in sslops]))
+      srv = tornado.httpserver.HTTPServer(self.__app, ssl_options=sslops, xheaders=True)
+      port = Conf.HTTPSPort()
+      srv.listen(port)
+      self.__servers[('https', port)] = srv
+    else:
+      # when NGINX is used then the Conf.HTTPS return False, it means tornado
+      # does not have to be configured using 443 port
+      Conf.generateCAFile()  # if we use Nginx we have to generate the cas as well...
+    return result
+
+  def run(self):
+    """
+    Start web servers
+    """
+    bu = Conf.rootURL().strip("/")
+    urls = []
+    for proto, port in self.__servers:
+      urls.append("%s://0.0.0.0:%s/%s/" % (proto, port, bu))
+    self.log.always("Listening on %s" % " and ".join(urls))
+    tornado.autoreload.add_reload_hook(self.__reloadAppCB)
+    tornado.ioloop.IOLoop.instance().start()
diff --git a/Core/Web/Conf.py b/Core/Web/Conf.py
new file mode 100644
index 00000000000..0e351dfee4a
--- /dev/null
+++ b/Core/Web/Conf.py
@@ -0,0 +1,331 @@
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import print_function
+
+import os
+import uuid
+import tempfile
+import tornado.process
+from DIRAC import gConfig
+from DIRAC.Core.Security import Locations, X509Chain, X509CRL
+
+__RCSID__ = "$Id$"
+
+BASECS = "/WebApp"
+
+
+def getCSValue(opt, defValue=None):
+  """ Get option from CS
+
+      :param str opt: option
+      :param defValue: default value
+
+      :return: defValue type result
+  """
+  return gConfig.getValue("%s/%s" % (BASECS, opt), defValue)
+
+
+def getCSSections(opt):
+  """ Get sections from CS
+
+      :param str opt: option
+
+      :return: S_OK(list)/S_ERROR()
+  """
+  return gConfig.getSections("%s/%s" % (BASECS, opt))
+
+
+def getCSOptions(opt):
+  """ Get options from CS
+
+      :param str opt: option
+
+      :return: S_OK(list)/S_ERROR()
+  """
+  return gConfig.getOptions("%s/%s" % (BASECS, opt))
+
+
+def getCSOptionsDict(opt):
+  """ Get options dictionary from CS
+
+      :param str opt: option
+
+      :return: S_OK(dict)/S_ERROR()
+  """
+  return gConfig.getOptionsDict("%s/%s" % (BASECS, opt))
+
+
+def getTitle():
+  """ Get title
+
+      :return: str
+  """
+  defVal = gConfig.getValue("/DIRAC/Configuration/Name", gConfig.getValue("/DIRAC/Setup"))
+  return "%s - DIRAC" % gConfig.getValue("%s/Title" % BASECS, defVal)
+
+
+def devMode():
+  """ Get development mode status
+
+      :result: bool
+  """
+  return getCSValue("DevelopMode", False)
+
+
+def rootURL():
+  """ Get root URL
+
+      :return: str
+  """
+  return getCSValue("RootURL", "/DIRAC")
+
+
+def balancer():
+  """ Get balancer
+
+      :return: str
+  """
+  b = getCSValue("Balancer", "").lower()
+  if b in ("", "none"):
+    return ""
+  return b
+
+
+def numProcesses():
+  """ Get number of processes
+
+      :return: int
+  """
+  return getCSValue("NumProcesses", 1)
+
+
+def HTTPS():
+  """ Get flag of enable HTTPS
+
+      :return: bool
+  """
+  if balancer():
+    return False
+  return getCSValue("HTTPS/Enabled", True)
+
+
+def HTTPPort():
+  """ Get HTTP port
+
+      :return: int
+  """
+  if balancer():
+    default = 8000
+  else:
+    default = 8080
+  procAdd = tornado.process.task_id() or 0
+  return getCSValue("HTTP/Port", default) + procAdd
+
+
+def HTTPSPort():
+  """ Get HTTPS port
+
+      :return: int
+  """
+  return getCSValue("HTTPS/Port", 8443)
+
+
+def HTTPSCert():
+  """ Get certificate path for HTTPS
+
+      :return: str
+  """
+  cert = Locations.getHostCertificateAndKeyLocation()
+  if cert:
+    cert = cert[0]
+  else:
+    cert = "/opt/dirac/etc/grid-security/hostcert.pem"
+  return getCSValue("HTTPS/Cert", cert)
+
+
+def HTTPSKey():
+  """ Get key path for HTTPS
+
+      :return: str
+  """
+  key = Locations.getHostCertificateAndKeyLocation()
+  if key:
+    key = key[1]
+  else:
+    key = "/opt/dirac/etc/grid-security/hostkey.pem"
+  return getCSValue("HTTPS/Key", key)
+
+
+def setup():
+  """ Get setup path
+
+      :return: str
+  """
+  return gConfig.getValue("/DIRAC/Setup")
+
+
+def cookieSecret():
+  """ Get cookie secret
+
+      :return: str
+  """
+  # TODO: Store the secret somewhere
+  return gConfig.getValue("CookieSecret", uuid.getnode())
+
+
+def generateCAFile():
+  """ Generate a single CA file with all the PEMs
+
+      :return: str or bool
+  """
+  caDir = Locations.getCAsLocation()
+  for fn in (os.path.join(os.path.dirname(caDir), "cas.pem"),
+             os.path.join(os.path.dirname(HTTPSCert()), "cas.pem"),
+             False):
+    if not fn:
+      fn = tempfile.mkstemp(prefix="cas.", suffix=".pem")[1]
+    try:
+      fd = open(fn, "w")
+    except IOError:
+      continue
+    for caFile in os.listdir(caDir):
+      caFile = os.path.join(caDir, caFile)
+      result = X509Chain.X509Chain.instanceFromFile(caFile)
+      if not result['OK']:
+        continue
+      chain = result['Value']
+      expired = chain.hasExpired()
+      if not expired['OK'] or expired['Value']:
+        continue
+      fd.write(chain.dumpAllToString()['Value'])
+    fd.close()
+    return fn
+  return False
+
+
+def generateRevokedCertsFile():
+  """ Generate a single CA file with all the PEMs
+
+      :return: str or bool
+  """
+  caDir = Locations.getCAsLocation()
+  for fn in (os.path.join(os.path.dirname(caDir), "allRevokedCerts.pem"),
+             os.path.join(os.path.dirname(HTTPSCert()), "allRevokedCerts.pem"),
+             False):
+    if not fn:
+      fn = tempfile.mkstemp(prefix="allRevokedCerts", suffix=".pem")[1]
+    try:
+      fd = open(fn, "w")
+    except IOError:
+      continue
+    for caFile in os.listdir(caDir):
+      caFile = os.path.join(caDir, caFile)
+      result = X509CRL.X509CRL.instanceFromFile(caFile)
+      if not result['OK']:
+        continue
+      chain = result['Value']
+      fd.write(chain.dumpAllToString()['Value'])
+    fd.close()
+    return fn
+  return False
+
+
+def getAuthSectionForHandler(route):
+  """ Get auth section for handler
+
+      :return: str
+  """
+  return "%s/Access/%s" % (BASECS, route)
+
+
+def getTheme():
+  """ Get theme
+
+      :return: str
+  """
+  return getCSValue("Theme", "tabs")
+
+
+def getIcon():
+  """ Get icon path
+
+      :return: str
+  """
+  return getCSValue("Icon", "/static/core/img/icons/system/favicon.ico")
+
+
+def SSLProrocol():
+  """ Get ssl protocol
+
+      :return: str
+  """
+  return getCSValue("SSLProtcol", "")
+
+
+def getDefaultStaticDirs():
+  """ Get default static directories
+
+      :return: list
+  """
+  defDirs = getCSValue("DefaultStaticDirs", ['defaults', 'demo'])
+  if defDirs == ['None']:
+    return []
+  return defDirs
+
+
+def getStaticDirs():
+  """ Get static directories
+
+      :return: str
+  """
+  return list(set(getCSValue("StaticDirs", []) + getDefaultStaticDirs()))
+
+
+def getLogo():
+  """ Get logo path
+
+      :return: str
+  """
+  return getCSValue("Logo", "/static/core/img/icons/system/_logo_waiting.gif")
+
+
+def getBackgroud():
+  """ Get background path
+
+      :return: str
+  """
+  return getCSValue("BackgroundImage", "/static/core/img/wallpapers/dirac_background_6.png")
+
+
+def getWelcome():
+  """ Get welcome
+
+      :return: str
+  """
+  return getCSValue("WelcomeHTML", "")
+
+
+def bugReportURL():
+  """ Get bug report URL
+
+      :return: str
+  """
+  return getCSValue("bugReportURL", "")
+
+
+def getAuthNames():
+  """ Get enabled id providers
+
+      :return: S_OK(list)/S_ERROR()
+  """
+  return getCSSections("TypeAuths")
+
+
+def getAppSettings(app):
+  """ Get applications options
+
+      :param str app: application name
+
+      :return: S_OK(dict)/S_ERROR
+  """
+  return gConfig.getOptionsDictRecursively("%s/%s" % (BASECS, app))
diff --git a/Core/Web/CoreHandler.py b/Core/Web/CoreHandler.py
new file mode 100644
index 00000000000..20a0679d4d9
--- /dev/null
+++ b/Core/Web/CoreHandler.py
@@ -0,0 +1,35 @@
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import print_function
+
+import urlparse
+import tornado.web
+
+from DIRAC.Core.Web import Conf
+
+__RCSID__ = "$Id$"
+
+
+class CoreHandler(tornado.web.RequestHandler):
+
+  def initialize(self, action):
+    self.__action = action
+
+  def get(self, setup, group, route):
+    if self.__action == "addSlash":
+      o = urlparse.urlparse(self.request.uri)
+      proto = self.request.protocol
+      if 'X-Scheme' in self.request.headers:
+        proto = self.request.headers['X-Scheme']
+      nurl = "%s://%s%s/" % (proto, self.request.host, o.path)
+      if o.query:
+        nurl = "%s?%s" % (nurl, o.query)
+      self.redirect(nurl, permanent=True)
+    elif self.__action == "sendToRoot":
+      dest = "/"
+      rootURL = Conf.rootURL()
+      if rootURL:
+        dest += "%s/" % rootURL.strip("/")
+      if setup and group:
+        dest += "s:%s/g:%s/" % (setup, group)
+      self.redirect(dest)
diff --git a/Core/Web/HandlerMgr.py b/Core/Web/HandlerMgr.py
new file mode 100644
index 00000000000..870d75dfd77
--- /dev/null
+++ b/Core/Web/HandlerMgr.py
@@ -0,0 +1,175 @@
+""" Basic modules for loading handlers
+"""
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import print_function
+
+import os
+import re
+import imp
+import inspect
+import collections
+
+from DIRAC import S_OK, S_ERROR, rootPath, gLogger
+from DIRAC.Core.Web import Conf
+from DIRAC.Core.Web.WebHandler import WebHandler, WebSocketHandler
+from DIRAC.Core.Web.CoreHandler import CoreHandler
+from DIRAC.Core.Web.StaticHandler import StaticHandler
+from DIRAC.Core.Utilities.ObjectLoader import ObjectLoader
+from DIRAC.Core.Utilities.DIRACSingleton import DIRACSingleton
+from DIRAC.ConfigurationSystem.Client.Helpers import CSGlobals
+
+__RCSID__ = "$Id$"
+
+
+class HandlerMgr(object):
+  __metaclass__ = DIRACSingleton
+
+  def __init__(self, sysService=[], baseURL="/"):
+    """ Constructor
+
+        :param list sysService: DIRAC system services
+        :param basestring baseURL: base URL
+    """
+    self.__baseURL = baseURL.strip("/")
+    if sysService and not isinstance(sysService, list):
+      sysService = sysService.replace(' ', '').split(',')
+    self.__sysServices = sysService
+    self.__routes = []
+    self.__handlers = []
+    self.__setupGroupRE = r"(?:/s:([\w-]*)/g:([\w.-]*))?"
+    self.__shySetupGroupRE = r"(?:/s:(?:[\w-]*)/g:(?:[\w.-]*))?"
+    self.log = gLogger.getSubLogger("Routing")
+
+  def getPaths(self, dirName):
+    """ Get lists of paths for all installed and enabled extensions
+
+        :param basestring dirName: path to handlers
+
+        :return: list
+    """
+    pathList = []
+    extNames = CSGlobals.getCSExtensions()
+    if 'WebAppDIRAC' in extNames:
+      extNames.append(extNames.pop(extNames.index('WebAppDIRAC')))
+    for extName in extNames:
+      if not extName.endswith('DIRAC'):
+        extName = "%sDIRAC" % extName
+      try:
+        modFile, modPath, desc = imp.find_module(extName)
+        # to match in the real root path to enabling module web extensions (static, templates...)
+        realModPath = os.path.realpath(modPath)
+      except ImportError:
+        continue
+      staticPath = os.path.join(realModPath, "WebApp", dirName)
+      if os.path.isdir(staticPath):
+        pathList.append(staticPath)
+    return pathList
+
+  def __calculateRoutes(self):
+    """ Load all handlers and generate the routes
+
+        :return: S_OK()/S_ERROR()
+    """
+    ol = ObjectLoader()
+    hendlerList = []
+    self.log.debug("Added services: %s" % ','.join(self.__sysServices))
+    for origin in self.__sysServices:
+      result = ol.getObjects(origin, parentClass=WebHandler, recurse=True)
+      if not result['OK']:
+        return result
+      hendlerList += list(result['Value'].items())
+    self.__handlers = collections.OrderedDict(hendlerList)
+
+    staticPaths = self.getPaths("static")
+    self.log.verbose("Static paths found:\n - %s" % "\n - ".join(staticPaths))
+    self.__routes = []
+
+    # Add some standard paths for static files
+    statDirectories = Conf.getStaticDirs()
+    self.log.info("The following static directories are used:%s" % str(statDirectories))
+    for stdir in statDirectories:
+      pattern = '/%s/(.*)' % stdir
+      self.__routes.append((pattern, StaticHandler, dict(pathList=['%s/webRoot/www/%s' % (rootPath, stdir)])))
+      self.log.debug(" - Static route: %s" % pattern)
+
+    for pattern in ((r"/static/(.*)", r"/(favicon\.ico)", r"/(robots\.txt)")):
+      pattern = r"%s%s" % (self.__shySetupGroupRE, pattern)
+      if self.__baseURL:
+        pattern = "/%s%s" % (self.__baseURL, pattern)
+      self.__routes.append((pattern, StaticHandler, dict(pathList=staticPaths)))
+      self.log.debug(" - Static route: %s" % pattern)
+    for hn in self.__handlers:
+      self.log.info("Found handler %s" % hn)
+      handler = self.__handlers[hn]
+      # CHeck it has AUTH_PROPS
+      if isinstance(handler.AUTH_PROPS, type(None)):
+        return S_ERROR("Handler %s does not have AUTH_PROPS defined. Fix it!" % hn)
+      # Get the root for the handler
+      if handler.LOCATION:
+        handlerRoute = handler.LOCATION.strip("/") and "/%s" % handler.LOCATION.strip("/") or ''
+      else:
+        handlerRoute = hn[len(re.sub(r".[A-z]+$", "", hn)):].replace(".", "/").replace("Handler", "")
+      # Add the setup group RE before
+      baseRoute = self.__setupGroupRE
+      # IF theres a base url like /DIRAC add it
+      baseRoute = "/%s%s" % (self.__baseURL or '', baseRoute)
+      # Set properly the LOCATION after calculating where it is with helpers to add group and setup later
+      handler.LOCATION = handlerRoute
+      handler.PATH_RE = re.compile("%s(%s/[A-z]+|.)" % (baseRoute, handlerRoute))
+      if handler.OVERPATH:
+        handler.PATH_RE = re.compile(handler.PATH_RE.pattern + '(/[A-z0-9=-_/|]+)?')
+      handler.URLSCHEMA = "/%s%%(setup)s%%(group)s%%(location)s/%%(action)s" % (self.__baseURL)
+      if issubclass(handler, WebSocketHandler):
+        handler.PATH_RE = re.compile("%s(%s)" % (baseRoute, handlerRoute))
+        route = "%s(%s)" % (baseRoute, handlerRoute)
+        self.__routes.append((route, handler))
+        self.log.verbose(" - WebSocket %s -> %s" % (handlerRoute, hn))
+        self.log.debug("  * %s" % route)
+        continue
+      # Look for methods that are exported
+      for mName, mObj in inspect.getmembers(handler):
+        if inspect.ismethod(mObj) and mName.find("web_") == 0:
+          if mName == "web_index":
+            # Index methods have the bare url
+            self.log.verbose(" - Route %s -> %s.web_index" % (handlerRoute, hn))
+            route = "%s(%s/)" % (baseRoute, handlerRoute)
+            self.__routes.append((route, handler))
+            self.__routes.append(("%s(%s)" % (baseRoute, handlerRoute), CoreHandler, dict(action='addSlash')))
+          else:
+            # Normal methods get the method appended without web_
+            self.log.verbose(" - Route %s/%s ->  %s.%s" % (handlerRoute, mName[4:], hn, mName))
+            route = "%s(%s/%s)" % (baseRoute, handlerRoute, mName[4:])
+            # Use request path as options/values, for ex. ../method/<option>/<file path>?<option>=..
+            if handler.OVERPATH:
+              route += '(/[A-z0-9=-_/|]+)?'
+            self.__routes.append((route, handler))
+          self.log.debug("  * %s" % route)
+    # Send to root
+    self.__routes.append(("%s(/?)" % self.__setupGroupRE, CoreHandler, dict(action="sendToRoot")))
+    if self.__baseURL:
+      self.__routes.append(("/%s%s()" % (self.__baseURL, self.__setupGroupRE),
+                            CoreHandler, dict(action="sendToRoot")))
+    return S_OK()
+
+  def getHandlers(self):
+    """ Get handlers
+
+        :return: S_OK()/S_ERROR()
+    """
+    if not self.__handlers:
+      result = self.__calculateRoutes()
+      if not result['OK']:
+        return result
+    return S_OK(self.__handlers)
+
+  def getRoutes(self):
+    """ Get routes
+
+        :return: S_OK()/S_ERROR()
+    """
+    if not self.__routes:
+      result = self.__calculateRoutes()
+      if not result['OK']:
+        return result
+    return S_OK(self.__routes)
diff --git a/Core/Web/SessionData.py b/Core/Web/SessionData.py
new file mode 100644
index 00000000000..5c08ae583e7
--- /dev/null
+++ b/Core/Web/SessionData.py
@@ -0,0 +1,177 @@
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import print_function
+
+import os
+from DIRAC import gConfig, gLogger
+from DIRAC.Core.Web import Conf
+from DIRAC.Core.Utilities import List
+from DIRAC.Core.DISET.AuthManager import AuthManager
+from DIRAC.Core.DISET.ThreadConfig import ThreadConfig
+from DIRAC.ConfigurationSystem.Client.Helpers import Registry
+from DIRAC.ConfigurationSystem.Client.Helpers import CSGlobals
+from DIRAC.FrameworkSystem.Client.ProxyManagerClient import gProxyManager
+
+__RCSID__ = "$Id$"
+
+
+class SessionData(object):
+
+  __disetConfig = ThreadConfig()
+  __handlers = {}
+  __groupMenu = {}
+  __extensions = []
+  __extVersion = "ext-6.2.0"
+  __configuration = {}
+
+  @classmethod
+  def setHandlers(cls, handlers):
+    """ Set handlers
+
+        :param dict handlers: handlers
+    """
+    cls.__handlers = {}
+    for k in handlers:
+      handler = handlers[k]
+      cls.__handlers[handler.LOCATION.strip("/")] = handler
+    # Calculate extensions
+    cls.__extensions = CSGlobals.getInstalledExtensions()
+    for ext in ['DIRAC', 'WebAppDIRAC']:
+      if ext in cls.__extensions:
+        cls.__extensions.append(cls.__extensions.pop(cls.__extensions.index(ext)))
+
+  def __init__(self, credDict, setup):
+    self.__credDict = credDict
+    self.__setup = setup
+
+  def __isGroupAuthApp(self, appLoc):
+    """ The method checks if the application is authorized for a certain user group
+
+        :param str appLoc It is the application name for example: DIRAC.JobMonitor
+
+        :return bool -- if the handler is authorized to the user returns True otherwise False
+    """
+    handlerLoc = "/".join(List.fromChar(appLoc, ".")[1:])
+    if not handlerLoc:
+      gLogger.error("Application handler does not exists:", appLoc)
+      return False
+    if handlerLoc not in self.__handlers:
+      gLogger.error("Handler %s required by %s does not exist!" % (handlerLoc, appLoc))
+      return False
+    handler = self.__handlers[handlerLoc]
+    auth = AuthManager(Conf.getAuthSectionForHandler(handlerLoc))
+    gLogger.info("Authorization: %s -> %s" % (dict(self.__credDict), handler.AUTH_PROPS))
+    return auth.authQuery("", dict(self.__credDict), handler.AUTH_PROPS)
+
+  def __generateSchema(self, base, path):
+    """ Generate a menu schema based on the user credentials
+
+        :param str base: base
+        :param str path: path
+
+        :return: list
+    """
+    # Calculate schema
+    schema = []
+    fullName = "%s/%s" % (base, path)
+    result = gConfig.getSections(fullName)
+    if not result['OK']:
+      return schema
+    sectionsList = result['Value']
+    for sName in sectionsList:
+      subSchema = self.__generateSchema(base, "%s/%s" % (path, sName))
+      if subSchema:
+        schema.append((sName, subSchema))
+    result = gConfig.getOptions(fullName)
+    if not result['OK']:
+      return schema
+    optionsList = result['Value']
+    for opName in optionsList:
+      opVal = gConfig.getValue("%s/%s" % (fullName, opName))
+      if opVal.find("link|") == 0:
+        schema.append(("link", opName, opVal[5:]))
+        continue
+      if self.__isGroupAuthApp(opVal):
+        schema.append(("app", opName, opVal))
+    return schema
+
+  def __getGroupMenu(self):
+    """ Load the schema from the CS and filter based on the group
+
+        :param dict cfg: dictionary with current configuration
+
+        :return: list
+    """
+    # Somebody coming from HTTPS and not with a valid group
+    group = self.__credDict.get("group", "")
+    # Cache time!
+    if group not in self.__groupMenu:
+      base = "%s/Schema" % (Conf.BASECS)
+      self.__groupMenu[group] = self.__generateSchema(base, "")
+    return self.__groupMenu[group]
+
+  @classmethod
+  def getWebAppPath(cls):
+    """ Get WebApp path
+
+        :return: str
+    """
+    return os.path.join(os.path.dirname(os.path.dirname(os.path.realpath(__file__))), "WebApp")
+
+  @classmethod
+  def getExtJSVersion(cls):
+    """ Get ExtJS version
+
+        :return: str
+    """
+    if not cls.__extVersion:
+      extPath = os.path.join(cls.getWebAppPath(), "static", "extjs")
+      extVersionPath = []
+      for entryName in os.listdir(extPath):
+        if entryName.find("ext-") == 0:
+          extVersionPath.append(entryName)
+
+      cls.__extVersion = sorted(extVersionPath)[-1]
+    return cls.__extVersion
+
+  @classmethod
+  def getWebConfiguration(cls):
+    """ Get WebApp configuration
+
+        :return: dict
+    """
+    result = gConfig.getOptionsDictRecursively("/WebApp")
+    if not cls.__configuration and result['OK']:
+      cls.__configuration = result['Value']
+    return cls.__configuration
+
+  def getData(self):
+    """ Return session data
+
+        :return: dict
+    """
+    data = {'configuration': self.getWebConfiguration(),
+            'menu': self.__getGroupMenu(),
+            'user': self.__credDict,
+            'validGroups': [],
+            'groupsStatuses': {},
+            'setup': self.__setup,
+            'validSetups': gConfig.getSections("/DIRAC/Setups")['Value'],
+            'extensions': self.__extensions,
+            'extVersion': self.getExtJSVersion()}
+    # Add valid groups if known
+    username = self.__credDict.get("username", "anonymous")
+    if username != 'anonymous':
+      result = Registry.getGroupsForUser(username)
+      if not result['OK']:
+        return result
+      data['validGroups'] = result['Value']
+      result = gProxyManager.getGroupsStatusByUsername(username)  # pylint: disable=no-member
+      if result['OK']:
+        data['groupsStatuses'] = result['Value']
+    # Calculate baseURL
+    baseURL = [Conf.rootURL().strip("/"),
+               "s:%s" % data['setup'],
+               "g:%s" % self.__credDict.get('group', '')]
+    data['baseURL'] = "/%s" % "/".join(baseURL)
+    return data
diff --git a/Core/Web/StaticHandler.py b/Core/Web/StaticHandler.py
new file mode 100644
index 00000000000..9885108c4e7
--- /dev/null
+++ b/Core/Web/StaticHandler.py
@@ -0,0 +1,29 @@
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import print_function
+
+import os
+from tornado.web import StaticFileHandler, HTTPError
+
+from DIRAC import rootPath
+
+__RCSID__ = "$Id$"
+
+
+class StaticHandler(StaticFileHandler):
+
+  def initialize(self, pathList, default_filename=None):
+    self.pathList = [os.path.abspath(path) + os.path.sep for path in pathList]
+    self.default_filename = default_filename
+    self.root = rootPath
+
+  def parse_url_path(self, url_path):
+    if os.path.sep != "/":
+      url_path = url_path.replace("/", os.path.sep)
+    for possiblePath in self.pathList:
+      possiblePath = os.path.join(possiblePath, url_path)
+      if self.default_filename and os.path.isdir(possiblePath):
+        possiblePath = os.path.join(possiblePath, self.default_filename)
+      if os.path.isfile(possiblePath):
+        return possiblePath
+    raise HTTPError(404)
diff --git a/Core/Web/TemplateLoader.py b/Core/Web/TemplateLoader.py
new file mode 100644
index 00000000000..441cefcbb59
--- /dev/null
+++ b/Core/Web/TemplateLoader.py
@@ -0,0 +1,32 @@
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import print_function
+
+import os
+from tornado.template import BaseLoader, Template
+
+__RCSID__ = "$Id$"
+
+
+class TemplateLoader(BaseLoader):
+
+  def __init__(self, pathList, **kwargs):
+    super(TemplateLoader, self).__init__(**kwargs)
+    self.pathList = pathList
+
+  def resolve_path(self, name, parent_path=None):
+    if parent_path and not parent_path.startswith("<"):
+      if not parent_path.startswith("/") and not name.startswith("/"):
+        name = os.path.join(os.path.dirname(parent_path), name)
+    return name
+
+  def _create_template(self, name):
+    for path in self.pathList:
+      try:
+        f = open(os.path.abspath(os.path.join(path, name)), "rb")
+      except IOError:
+        continue
+      template = Template(f.read(), name=name, loader=self)
+      f.close()
+      return template
+    raise RuntimeError("Can't find template %s" % name)
diff --git a/Core/Web/WebHandler.py b/Core/Web/WebHandler.py
new file mode 100644
index 00000000000..3d3471a1625
--- /dev/null
+++ b/Core/Web/WebHandler.py
@@ -0,0 +1,443 @@
+""" Main module
+"""
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import print_function
+
+import ssl
+import json
+import functools
+import traceback
+
+from concurrent.futures import ThreadPoolExecutor
+
+import tornado.web
+import tornado.gen
+import tornado.ioloop
+import tornado.websocket
+import tornado.stack_context
+
+from DIRAC import gConfig, gLogger, S_OK, S_ERROR
+from DIRAC.Core.Web import Conf
+from DIRAC.Core.Web.SessionData import SessionData
+from DIRAC.Core.Security import Properties
+from DIRAC.Core.Security.X509Chain import X509Chain  # pylint: disable=import-error
+from DIRAC.Core.DISET.AuthManager import AuthManager
+from DIRAC.Core.DISET.ThreadConfig import ThreadConfig
+from DIRAC.Core.Utilities.JEncode import encode
+from DIRAC.ConfigurationSystem.Client.Helpers import Registry
+from DIRAC.FrameworkSystem.Client.AuthManagerData import gAuthManagerData
+
+
+global gThreadPool
+gThreadPool = ThreadPoolExecutor(100)
+
+
+class WErr(tornado.web.HTTPError):
+
+  def __init__(self, code, msg="", **kwargs):
+    super(WErr, self).__init__(code, str(msg) or None)
+    for k in kwargs:
+      setattr(self, k, kwargs[k])
+    self.ok = False
+    self.msg = msg
+    self.kwargs = kwargs
+
+  def __str__(self):
+    return super(WErr, self).__str__()
+
+  @classmethod
+  def fromSERROR(cls, result):
+    """ Prevent major problem with % in the message """
+    return cls(500, result['Message'].replace("%", ""))
+
+
+class WOK(object):
+
+  def __init__(self, data=False, **kwargs):
+    for k in kwargs:
+      setattr(self, k, kwargs[k])
+    self.ok = True
+    self.data = data
+
+
+def asyncWithCallback(method):
+  return tornado.web.asynchronous(method)
+
+
+def asyncGen(method):
+  return tornado.gen.coroutine(method)
+
+
+class WebHandler(tornado.web.RequestHandler):
+  __disetConfig = ThreadConfig()
+  __log = False
+
+  # Auth requirements
+  AUTH_PROPS = None
+  # Location of the handler in the URL
+  LOCATION = ""
+  # URL Schema with holders to generate handler urls
+  URLSCHEMA = ""
+  # RE to extract group and setup
+  PATH_RE = None
+  # If need to use request path for declare some value/option
+  OVERPATH = False
+
+  def threadTask(self, method, *args, **kwargs):
+    def threadJob(*targs, **tkwargs):
+      args = targs[0]
+      disetConf = targs[1]
+      self.__disetConfig.reset()
+      self.__disetConfig.load(disetConf)
+      return method(*args, **tkwargs)
+
+    targs = (args, self.__disetDump)
+    return tornado.ioloop.IOLoop.current().run_in_executor(gThreadPool,
+                                                           functools.partial(threadJob, *targs, **kwargs))
+
+  def __disetBlockDecor(self, func):
+    def wrapper(*args, **kwargs):
+      raise RuntimeError("All DISET calls must be made from inside a Threaded Task!")
+
+    return wrapper
+
+  def __init__(self, *args, **kwargs):
+    """ Initialize the handler
+    """
+    super(WebHandler, self).__init__(*args, **kwargs)
+    if not WebHandler.__log:
+      WebHandler.__log = gLogger.getSubLogger(self.__class__.__name__)
+    # Look idetity provider and session
+    self.__idp = self.get_cookie("TypeAuth") or "Certificate"
+    self.__session = self.get_cookie(self.__idp) or None
+    # Fill credentials
+    self.__credDict = {}
+    self.__setup = Conf.setup()
+    result = self.__processCredentials()
+    if not result['OK']:
+      self.__idp = "Visitor"
+      self.log.error(result['Message'], 'Continue as Visitor.')
+    self.log.verbose("%s authentication" % self.__idp,
+                     'with %s session' % self.__session if self.__session else '')
+    # Restore identity provider
+    self.set_cookie("TypeAuth", self.__idp)
+    # Setup diset
+    self.__disetConfig.reset()
+    self.__disetConfig.setDecorator(self.__disetBlockDecor)
+    self.__disetDump = self.__disetConfig.dump()
+    match = self.PATH_RE.match(self.request.path)
+    pathItems = match.groups()
+    self._pathResult = self.__checkPath(*pathItems[:3])
+    self.overpath = pathItems[3:] and pathItems[3] or ''
+    self.__sessionData = SessionData(self.__credDict, self.__setup)
+    self.__forceRefreshCS()
+
+  def __forceRefreshCS(self):
+    """ Force refresh configuration from master configuration server
+    """
+    if self.request.headers.get('X-RefreshConfiguration') == 'True':
+      self.log.debug('Initialize force refresh..')
+      if not AuthManager('').authQuery("", dict(self.__credDict), "CSAdministrator"):
+        raise WErr(401, 'Cannot initialize force refresh, request not authenticated')
+      result = gConfig.forceRefresh()
+      if not result['OK']:
+        raise WErr(501, result['Message'])
+
+  def __processCredentials(self):
+    """ Extract the user credentials based on the certificate or what comes from the balancer
+
+        :return: S_OK()/S_ERROR()
+    """
+    # Unsecure protocol only for visitors
+    if self.request.protocol != "https" or self.__idp == "Visitor":
+      return S_OK()
+
+    # For certificate
+    if self.__idp == 'Certificate':
+      return self.__readCertificate()
+
+    # Look enabled authentication types in CS
+    result = Conf.getCSSections("TypeAuths")
+    if not result['OK']:
+      self.log.warn('To enable idenyity provider need to use "TypeAuths" section, but %s' % result['Message'])
+    if self.__idp not in (result.get('Value') or []):
+      return S_ERROR("%s is absent in configuration." % self.__idp)
+
+    if not self.__session:
+      return S_ERROR('No found session in cookies.')
+
+    result = gAuthManagerData.getIDForSession(self.__session)
+    if not result['OK']:
+      self.set_cookie(self.__idp, '')
+    else:
+      self.__credDict['ID'] = result['Value']
+    return result
+
+  def _request_summary(self):
+    """ Return a string returning the summary of the request
+
+        :return: str
+    """
+    summ = super(WebHandler, self)._request_summary()
+    cl = []
+    if self.__credDict.get('validDN', False):
+      cl.append(self.__credDict['username'])
+      if self.__credDict.get('validGroup', False):
+        cl.append("@%s" % self.__credDict['group'])
+      cl.append(" (%s)" % self.__credDict['DN'])
+    summ = "%s %s" % (summ, "".join(cl))
+    return summ
+
+  def __readCertificate(self):
+    """ Fill credentional from certificate and check is registred
+
+        :return: S_OK()/S_ERROR()
+    """
+    if Conf.balancer() == "nginx":
+      # NGINX
+      headers = self.request.headers
+      if not headers:
+        return S_ERROR('No headers found.')
+      if headers.get('X-Scheme') == "https" and headers.get('X-Ssl_client_verify') == 'SUCCESS':
+        DN = headers['X-Ssl_client_s_dn']
+        if not DN.startswith('/'):
+          items = DN.split(',')
+          items.reverse()
+          DN = '/' + '/'.join(items)
+        self.__credDict['DN'] = DN
+        self.__credDict['issuer'] = headers['X-Ssl_client_i_dn']
+      else:
+        return S_ERROR('No certificate upload to browser.')
+
+    else:
+      # TORNADO
+      derCert = self.request.get_ssl_certificate(binary_form=True)
+      if not derCert:
+        return S_ERROR('No certificate found.')
+      pemCert = ssl.DER_cert_to_PEM_cert(derCert)
+      chain = X509Chain()
+      chain.loadChainFromString(pemCert)
+      result = chain.getCredentials()
+      if not result['OK']:
+        return S_ERROR("Could not get client credentials %s" % result['Message'])
+      self.__credDict = result['Value']
+      # Hack. Data coming from OSSL directly and DISET difer in DN/subject
+      try:
+        self.__credDict['DN'] = self.__credDict['subject']
+      except KeyError:
+        pass
+
+    result = Registry.getUsernameForDN(self.__credDict['DN'])
+    if not result['OK']:
+      return result
+    self.__credDict['username'] = result['Value']
+    return S_OK()
+
+  @property
+  def log(self):
+    return self.__log
+
+  @classmethod
+  def getLog(cls):
+    return cls.__log
+
+  def getDN(self):
+    return self.__credDict.get('DN', '')
+
+  def getID(self):
+    return self.__credDict.get('ID', '')
+
+  def getIdP(self):
+    return self.__idp
+
+  def getSession(self):
+    return self.__session
+
+  def getUserName(self):
+    return self.__credDict.get('username', '')
+
+  def getUserGroup(self):
+    return self.__credDict.get('group', '')
+
+  def getUserSetup(self):
+    return self.__setup
+
+  def getProperties(self):
+    return self.__credDict.get('properties', [])
+
+  def isRegisteredUser(self):
+    return self.__credDict.get('username', 'anonymous') != 'anonymous' and self.__credDict.get('group')
+
+  def getSessionData(self):
+    return self.__sessionData.getData()
+
+  def getAppSettings(self, app=None):
+    return Conf.getAppSettings(app or self.__class__.__name__.replace('Handler', '')).get('Value') or {}
+
+  def actionURL(self, action=""):
+    """ Given an action name for the handler, return the URL
+
+        :param str action: action
+
+        :return: str
+    """
+    if action == "index":
+      action = ""
+    group = self.getUserGroup()
+    if group:
+      group = "/g:%s" % group
+    setup = self.getUserSetup()
+    if setup:
+      setup = "/s:%s" % setup
+    location = self.LOCATION
+    if location:
+      location = "/%s" % location
+    ats = dict(action=action, group=group, setup=setup, location=location)
+    return self.URLSCHEMA % ats
+
+  def __auth(self, handlerRoute, group, method):
+    """ Authenticate request
+
+        :param str handlerRoute: the name of the handler
+        :param str group: DIRAC group
+        :param str method: the name of the method
+
+        :return: bool
+    """
+    if not isinstance(self.AUTH_PROPS, (list, tuple)):
+      self.AUTH_PROPS = [p.strip() for p in self.AUTH_PROPS.split(",") if p.strip()]
+
+    self.__credDict['validGroup'] = False
+    self.__credDict['group'] = group
+    auth = AuthManager(Conf.getAuthSectionForHandler(handlerRoute))
+    ok = auth.authQuery(method, self.__credDict, self.AUTH_PROPS)
+    if ok:
+      self.__credDict['validGroup'] = True
+      # WARN: __credDict['properties'] already defined in AuthManager in the last version of DIRAC
+      self.__credDict['properties'] = Registry.getPropertiesForGroup(self.__credDict['group'], [])
+      msg = ' - '
+      if self.__credDict.get('DN'):
+        msg = '%s' % self.__credDict['DN']
+      elif self.__credDict.get('ID'):
+        result = gAuthManagerData.getIdPsForID(self.__credDict['ID'])  # pylint: disable=no-member
+        if not result['OK']:
+          self.log.error(result['Message'])
+          return False
+        msg = 'IdP: %s, ID: %s' % (result['Value'], self.__credDict['ID'])
+      self.log.info("AUTH OK: %s by %s@%s (%s)" % (handlerRoute, self.__credDict['username'],
+                                                   self.__credDict['group'], msg))
+    else:
+      self.log.info("AUTH KO: %s by %s@%s" % (handlerRoute, self.__credDict['username'], self.__credDict['group']))
+
+    if self.__credDict.get('DN') and self.isTrustedHost(self.__credDict['DN']):
+      self.log.info("Request is coming from Trusted host")
+      return True
+
+    return ok
+
+  def isTrustedHost(self, dn):
+    """ Check if the request coming from a TrustedHost
+
+        :param str dn: certificate DN
+
+        :return: bool if the host is Trusrted it return true otherwise false
+    """
+    retVal = Registry.getHostnameForDN(dn)
+    if retVal['OK']:
+      hostname = retVal['Value']
+      if Properties.TRUSTED_HOST in Registry.getPropertiesForHost(hostname, []):
+        return True
+    return False
+
+  def __checkPath(self, setup, group, route):
+    """ Check the request, auth, credentials and DISET config
+
+        :param str setup: setup name
+        :param str group: group name
+        :param str route: route
+
+        :return: WOK()/WErr()
+    """
+    if route[-1] == "/":
+      methodName = "index"
+      handlerRoute = route
+    else:
+      iP = route.rfind("/")
+      methodName = route[iP + 1:]
+      handlerRoute = route[:iP]
+    if setup:
+      self.__setup = setup
+    if not self.__auth(handlerRoute, group, methodName):
+      return WErr(401, "Unauthorized. %s" % methodName)
+
+    DN = self.getDN()
+    if DN:
+      self.__disetConfig.setDN(DN)
+    ID = self.getID()
+    if ID:
+      self.__disetConfig.setID(ID)
+
+    # pylint: disable=no-value-for-parameter
+    if self.getUserGroup():  # pylint: disable=no-value-for-parameter
+      self.__disetConfig.setGroup(self.getUserGroup())  # pylint: disable=no-value-for-parameter
+    self.__disetConfig.setSetup(setup)
+    self.__disetDump = self.__disetConfig.dump()
+
+    return WOK(methodName)
+
+  def get(self, setup, group, route, overpath=None):
+    if not self._pathResult.ok:
+      raise self._pathResult
+    methodName = "web_%s" % self._pathResult.data
+    try:
+      mObj = getattr(self, methodName)
+    except AttributeError as e:
+      self.log.fatal("This should not happen!! %s" % e)
+      raise tornado.web.HTTPError(404)
+    return mObj()
+
+  def post(self, *args, **kwargs):
+    return self.get(*args, **kwargs)
+
+  def delete(self, *args, **kwargs):
+    return self.get(*args, **kwargs)
+
+  def write_error(self, status_code, **kwargs):
+    self.set_status(status_code)
+    cType = "text/plain"
+    data = self._reason
+    if 'exc_info' in kwargs:
+      ex = kwargs['exc_info'][1]
+      trace = traceback.format_exception(*kwargs["exc_info"])
+      if not isinstance(ex, WErr):
+        data += "\n".join(trace)
+      else:
+        if self.settings.get("debug"):
+          self.log.error("Request ended in error:\n  %s" % "\n  ".join(trace))
+        data = ex.msg
+        if isinstance(data, dict):
+          cType = "application/json"
+          data = json.dumps(data)
+    self.set_header('Content-Type', cType)
+    self.finish(data)
+
+  def finishJEncode(self, o):
+    """ Encode data before finish
+    """
+    self.finish(encode(o))
+
+
+class WebSocketHandler(tornado.websocket.WebSocketHandler, WebHandler):
+
+  def __init__(self, *args, **kwargs):
+    WebHandler.__init__(self, *args, **kwargs)
+    tornado.websocket.WebSocketHandler.__init__(self, *args, **kwargs)
+
+  def open(self, setup, group, route):
+    if not self._pathResult.ok:
+      raise self._pathResult
+    return self.on_open()
+
+  def on_open(self):
+    pass
diff --git a/Core/Web/__init__.py b/Core/Web/__init__.py
new file mode 100755
index 00000000000..da96051e89d
--- /dev/null
+++ b/Core/Web/__init__.py
@@ -0,0 +1,5 @@
+""" DIRAC.Core.Web package
+"""
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import print_function
diff --git a/Core/scripts/dirac-webapp-run.py b/Core/scripts/dirac-webapp-run.py
new file mode 100644
index 00000000000..dcf456a5bb8
--- /dev/null
+++ b/Core/scripts/dirac-webapp-run.py
@@ -0,0 +1,53 @@
+#!/usr/bin/env python
+from __future__ import print_function
+from __future__ import absolute_import
+from __future__ import division
+
+import sys
+import tornado
+
+from DIRAC import gConfig, S_OK
+from DIRAC.Core.Base import Script
+from DIRAC.Core.Web.App import App
+from DIRAC.FrameworkSystem.Client.Logger import gLogger
+from DIRAC.ConfigurationSystem.Client.LocalConfiguration import LocalConfiguration
+
+__RCSID__ = "$Id$"
+
+if __name__ == "__main__":
+
+  def disableDevMode(op):
+    gConfig.setOptionValue("/WebApp/DevelopMode", "False")
+    return S_OK()
+
+  def setHandlers(op):
+    localCfg.handlersLoc = op
+    gLogger.notice("SET handlersLoc to ", localCfg.handlersLoc)
+    return S_OK()
+
+  localCfg = LocalConfiguration()
+
+  localCfg.handlersLoc = 'WebApp.handler'
+  localCfg.setConfigurationForWeb("WebApp")
+  localCfg.addMandatoryEntry("/DIRAC/Setup")
+  localCfg.addDefaultEntry("/DIRAC/Security/UseServerCertificate", "yes")
+  localCfg.addDefaultEntry("LogLevel", "INFO")
+  localCfg.addDefaultEntry("LogColor", True)
+  localCfg.registerCmdOpt("p", "production", "Enable production mode", disableDevMode)
+  localCfg.registerCmdOpt("S:", "service_api_path=",
+                          "Specify path(s) to handlers, for ex. 'DIRAC.FrameworkSystem.Utilities'",
+                          setHandlers)
+
+  result = localCfg.loadUserData()
+  if not result['OK']:
+    gLogger.initialize("WebApp", "/")
+    gLogger.fatal("There were errors when loading configuration", result['Message'])
+    sys.exit(1)
+
+  gLogger.notice("Set next path(s): ", localCfg.handlersLoc)
+  app = App(handlersLoc=localCfg.handlersLoc)
+  result = app.bootstrap()
+  if not result['OK']:
+    gLogger.fatal(result['Message'])
+    sys.exit(1)
+  app.run()
diff --git a/DataManagementSystem/Agent/FTS3Agent.py b/DataManagementSystem/Agent/FTS3Agent.py
index 58b683db37f..0a0a44efc53 100644
--- a/DataManagementSystem/Agent/FTS3Agent.py
+++ b/DataManagementSystem/Agent/FTS3Agent.py
@@ -36,7 +36,6 @@
 from DIRAC.Core.Utilities.Time import fromString
 from DIRAC.ConfigurationSystem.Client.Helpers.Resources import getFTS3ServerDict
 from DIRAC.ConfigurationSystem.Client.Helpers.Operations import Operations as opHelper
-from DIRAC.ConfigurationSystem.Client.Helpers.Registry import getDNForUsername
 from DIRAC.FrameworkSystem.Client.Logger import gLogger
 from DIRAC.FrameworkSystem.Client.ProxyManagerClient import gProxyManager
 from DIRAC.DataManagementSystem.private import FTS3Utilities
@@ -161,13 +160,7 @@ def getFTS3Context(self, username, group, ftsServer, threadID):
     # We keep a context in the cache for 45 minutes
     # (so it needs to be valid at least 15 since we add it for one hour)
     if not contextes.exists(idTuple, 15 * 60):
-      res = getDNForUsername(username)
-      if not res['OK']:
-        return res
-      # We take the first DN returned
-      userDN = res['Value'][0]
-
-      log.debug("UserDN %s" % userDN)
+      log.debug("User: %s, group: %s" % (username, group))
 
       # We dump the proxy to a file.
       # It has to have a lifetime of self.proxyLifetime
@@ -175,7 +168,7 @@ def getFTS3Context(self, username, group, ftsServer, threadID):
       # we should make our cache a bit less than 2/3rd of the lifetime
       cacheTime = int(2 * self.proxyLifetime / 3) - 600
       res = gProxyManager.downloadVOMSProxyToFile(
-          userDN, group, requiredTimeLeft=self.proxyLifetime, cacheTime=cacheTime)
+          username, group, requiredTimeLeft=self.proxyLifetime, cacheTime=cacheTime)
       if not res['OK']:
         return res
 
diff --git a/DataManagementSystem/Service/FTS3ManagerHandler.py b/DataManagementSystem/Service/FTS3ManagerHandler.py
index 404c9141b3a..220beffa9bc 100644
--- a/DataManagementSystem/Service/FTS3ManagerHandler.py
+++ b/DataManagementSystem/Service/FTS3ManagerHandler.py
@@ -18,7 +18,7 @@
 
 # from DIRAC
 from DIRAC import S_OK, S_ERROR, gLogger
-from DIRAC.ConfigurationSystem.Client.Helpers.Registry import getDNForUsername
+from DIRAC.ConfigurationSystem.Client.Helpers.Registry import getDNsForUsernameInGroup
 from DIRAC.Core.DISET.RequestHandler import RequestHandler, getServiceOption
 from DIRAC.Core.Security.Properties import FULL_DELEGATION, LIMITED_DELEGATION, TRUSTED_HOST
 from DIRAC.Core.Utilities import DErrno
@@ -70,10 +70,10 @@ def _isAllowed(opObj, remoteCredentials):
     credProperties = remoteCredentials['properties']
 
     # First, get the DN matching the username
-    res = getDNForUsername(opObj.username)
+    res = getDNsForUsernameInGroup(opObj.username, opObj.userGroup)
     # if we have an error, do not allow
     if not res['OK']:
-      gLogger.error("Error retrieving DN for username", res)
+      gLogger.error("Error retrieving DN for username/group", res)
       return False
 
     # List of DN matching the username
diff --git a/DataManagementSystem/Service/FileCatalogProxyHandler.py b/DataManagementSystem/Service/FileCatalogProxyHandler.py
index a1ea67000a7..4bd52c7d529 100644
--- a/DataManagementSystem/Service/FileCatalogProxyHandler.py
+++ b/DataManagementSystem/Service/FileCatalogProxyHandler.py
@@ -88,9 +88,9 @@ def __prepareSecurityDetails(self, vomsFlag=True):
       clientGroup = credDict['group']
       gLogger.debug("Getting proxy for %s@%s (%s)" % (clientUsername, clientGroup, clientDN))
       if vomsFlag:
-        result = gProxyManager.downloadVOMSProxyToFile(clientDN, clientGroup)
+        result = gProxyManager.downloadVOMSProxyToFile(clientDN or clientUsername, clientGroup)
       else:
-        result = gProxyManager.downloadProxyToFile(clientDN, clientGroup)
+        result = gProxyManager.downloadProxyToFile(clientDN or clientUsername, clientGroup)
       if not result['OK']:
         return result
       gLogger.debug("Updating environment.")
diff --git a/DataManagementSystem/Service/StorageElementProxyHandler.py b/DataManagementSystem/Service/StorageElementProxyHandler.py
index 0527be85de6..723bd747fe1 100644
--- a/DataManagementSystem/Service/StorageElementProxyHandler.py
+++ b/DataManagementSystem/Service/StorageElementProxyHandler.py
@@ -270,7 +270,7 @@ def __prepareSecurityDetails(self):
       clientUsername = credDict['username']
       clientGroup = credDict['group']
       gLogger.debug("Getting proxy for %s@%s (%s)" % (clientUsername, clientGroup, clientDN))
-      res = gProxyManager.downloadVOMSProxy(clientDN, clientGroup)
+      res = gProxyManager.downloadVOMSProxy(clientDN or clientUsername, clientGroup)
       if not res['OK']:
         return res
       chain = res['Value']
diff --git a/FrameworkSystem/Client/AuthManagerClient.py b/FrameworkSystem/Client/AuthManagerClient.py
new file mode 100644
index 00000000000..aaed98e9880
--- /dev/null
+++ b/FrameworkSystem/Client/AuthManagerClient.py
@@ -0,0 +1,48 @@
+""" DIRAC AuthManager Client class encapsulates the methods exposed
+    by the AuthManager service.
+"""
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import print_function
+
+import six
+
+from DIRAC import gLogger, S_OK, S_ERROR
+from DIRAC.Core.Base.Client import Client, createClient
+from DIRAC.Core.Utilities import DIRACSingleton
+from DIRAC.FrameworkSystem.Client.AuthManagerData import gAuthManagerData
+
+__RCSID__ = "$Id$"
+
+
+@createClient('Framework/AuthManager')
+@six.add_metaclass(DIRACSingleton.DIRACSingleton)
+class AuthManagerClient(Client):
+  """ Authentication manager
+  """
+
+  def __init__(self, **kwargs):
+    """ Constructor
+    """
+    super(AuthManagerClient, self).__init__(**kwargs)
+    self.setServer('Framework/AuthManager')
+
+  def parseAuthResponse(self, response, state):
+    """ Fill session by user profile, tokens, comment, OIDC authorize status, etc.
+        Prepare dict with user parameters, if DN is absent there try to get it.
+        Create new or modify existend DIRAC user and store the session
+
+        :param dict response: authorization response
+        :param basestring state: session number
+
+        :return: S_OK(dict)/S_ERROR()
+    """
+    result = self._getRPC().parseAuthResponse(response, state)
+    if result['OK'] and result['Value']['Status'] in ['authed', 'redirect']:
+      gAuthManagerData.updateProfiles(result['Value']['upProfile'])
+      gAuthManagerData.updateSessions(result['Value']['upSession'])
+
+    return result
+
+
+gSessionManager = AuthManagerClient()
diff --git a/FrameworkSystem/Client/AuthManagerData.py b/FrameworkSystem/Client/AuthManagerData.py
new file mode 100644
index 00000000000..3991a98ae65
--- /dev/null
+++ b/FrameworkSystem/Client/AuthManagerData.py
@@ -0,0 +1,270 @@
+""" DIRAC AuthManager Client class encapsulates the cache data.
+"""
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import print_function
+
+import six
+
+from DIRAC import gLogger, S_OK, S_ERROR
+from DIRAC.Core.Utilities import ThreadSafe, DIRACSingleton
+from DIRAC.Core.Utilities.DictCache import DictCache
+
+__RCSID__ = "$Id$"
+
+
+gCacheProfiles = ThreadSafe.Synchronizer()
+gCacheSessions = ThreadSafe.Synchronizer()
+
+@six.add_metaclass(DIRACSingleton.DIRACSingleton)
+class AuthManagerData(object):
+  """ Authentication manager
+  """
+  __cacheSessions = DictCache()
+  # # {
+  # #   <session1>: {
+  # #     ID: ..,
+  # #     Provider: ..,
+  # #     Tokens: { <tokens> }
+  # #   },
+  # #   <session2>: { ... }
+  # # }
+
+  __cahceIDs = DictCache()
+  # # {
+  # #   <ID1>: [ <sessions> ],
+  # #   <ID2>: ...
+  # # }
+
+  __cacheProfiles = DictCache()
+  # # {
+  # #   <ID1>: {
+  # #     DNs: {
+  # #       <DN1>: {
+  # #         ProxyProvider: [ <proxy providers> ],
+  # #         VOMSRoles: [ <VOMSRoles> ],
+  # #         ...
+  # #       },
+  # #       <DN2>: { ... },
+  # #     }
+  # #   },
+  # #   <ID2>: { ... }
+  # # }
+
+  __service = DictCache()
+  # # {
+  # #   crash: bool
+  # # }
+
+  def __init__(self):
+    self.rpc = None
+
+  @gCacheProfiles
+  def getProfiles(self, userID=None):
+    """ Get cache information
+
+        :param str userID: user ID
+
+        :return: dict
+    """
+    if userID:
+      return self.__cacheProfiles.get(userID) or {}
+    return self.__cacheProfiles.getDict()
+
+  @gCacheProfiles
+  def updateProfiles(self, data, time=3600 * 24):
+    """ Add cache information
+
+        :param dict data: ID information data
+        :param int time: lifetime
+    """
+    for oid, info in data.items():
+      self.__cacheProfiles.add(oid, time, value=info)
+
+  @gCacheSessions
+  def getSessions(self, session=None, userID=None):
+    """ Get cache information
+
+        :param str session: session
+        :param str userID: user ID
+
+        :return: dict
+    """
+    if session:
+      return self.__cacheSessions.get(session) or {}
+    if userID:
+      sessions = {}
+      for session in self.__cahceIDs.get(userID) or []:
+        sDict = self.__cacheSessions.get(session)
+        if sDict:
+          sessions[session] = sDict
+      return sessions
+    return self.__cacheSessions.getDict()
+
+  @gCacheSessions
+  def updateSessions(self, data, time=3600 * 24):
+    """ Get cache information
+
+        :param dict data: session information data
+        :param int time: lifetime
+    """
+    for session, info in data.items():
+      idSessions = self.__cahceIDs.get(info['ID']) or []
+      self.__cahceIDs.add(info['ID'], time, list(set(idSessions + [session])))
+      self.__cacheSessions.add(session, time, value=info)
+
+  def __getRPC(self):
+    """ Get RPC
+    """
+    if not self.rpc:
+      from DIRAC.Core.Base.Client import Client
+      self.rpc = Client()._getRPC(url="Framework/AuthManager", timeout=10)
+    return self.rpc
+
+  def resfreshSessions(self, session=None, userID=None):
+    """ Refresh session cache from service
+
+        :param str session: session to update
+        :param str userID: user ID
+
+        :return: S_OK()/S_ERROR()
+    """
+    servCrash = self.__service.get('crash')
+    if servCrash:
+      return servCrash
+    result = self.__getRPC().getSessionsInfo(session, userID)
+    # If the AuthManager service is down client will ignore it 1 minute
+    if result.get('Errno', 0) == 1112:
+      self.__service.add('crash', 60, value=result)
+    if result['OK'] and result['Value']:
+      self.updateSessions({session: result['Value']} if session else result['Value'])
+    return result
+
+  def resfreshProfiles(self, userID=None):
+    """ Refresh profiles cache from service
+
+        :param str userID: userID to update
+
+        :return: S_OK()/S_ERROR()
+    """
+    servCrash = self.__service.get('crash')
+    if servCrash:
+      return servCrash
+    result = self.__getRPC().getIdProfiles(userID)
+    # If the AuthManager service is down client will ignore it 1 minute
+    if result.get('Errno', 0) == 1112:
+      self.__service.add('crash', 60, value=result)
+    if result['OK'] and result['Value']:
+      self.updateProfiles({userID: result['Value']} if userID else result['Value'])
+    return result
+
+  def getIDsForDN(self, dn):
+    """ Find ID for DN
+
+        :param str dn: user DN
+
+        :return: S_OK(list)
+    """
+    userIDs = []
+    profile = self.getProfiles() or {}
+    for uid, data in profile.items():
+      if dn in data.get('DNs', []):
+        userIDs.append(uid)
+
+    if not userIDs:
+      result = self.resfreshProfiles()
+      if not result['OK']:
+        return result
+      for uid, data in result['Value'].items():
+        if dn in data.get('DNs', []):
+          userIDs.append(uid)
+
+    return S_OK(userIDs)
+
+  def getDNsForID(self, uid):
+    """ Find DNs for ID
+
+        :param str uid: user ID
+
+        :return: S_OK(list)/S_ERROR()
+    """
+    profile = self.getProfiles(userID=uid)
+    if not profile:
+      result = self.resfreshProfiles(userID=uid)
+      if not result['OK']:
+        return result
+      profile = result['Value']
+    return S_OK(profile.get('DNs', []))
+
+  def getDNOptionForID(self, uid, dn, option):
+    """ Find option for DN
+
+        :param str uid: user ID
+        :param str dn: user DN
+        :param str option: option to find
+
+        :return: S_OK()/S_ERROR()
+    """
+    profile = self.getProfiles(userID=uid)
+    if not profile:
+      result = self.resfreshProfiles(userID=uid)
+      if not result['OK']:
+        return result
+      profile = result['Value']
+
+    if dn in profile.get('DNs', []):
+      return S_OK(profile['DNs'][dn].get(option))
+    return S_OK(None)
+
+  def getIdPsForID(self, uid):
+    """ Find option for DN
+
+        :param str uid: user ID
+
+        :return: S_OK()/S_ERROR()
+    """
+    sessionsDict = self.getSessions(userID=uid)
+    if not sessionsDict:
+      result = self.resfreshSessions(userID=uid)
+      if not result['OK']:
+        return result
+      sessionsDict = result['Value']
+
+    providers = []
+    for session, data in sessionsDict.items():
+      providers.append(data['Provider'])
+
+    return S_OK(list(set(providers)))
+
+  def getIDForSession(self, session):
+    """ Find ID for session
+
+        :param basestring session: session number
+
+        :return: S_OK()/S_ERROR()
+    """
+    data = self.getSessions(session=session)
+    if not data:
+      result = self.resfreshSessions(session=session)
+      if not result['OK']:
+        return result
+      data = result['Value'] or {}
+    return S_OK(data['ID']) if data.get('ID') else S_ERROR('No ID found for session %s' % session)
+
+  def getIdPForSession(self, session):
+    """ Find IdP for session
+
+        :param basestring session: session number
+
+        :return: S_OK()/S_ERROR()
+    """
+    data = self.getSessions(session=session)
+    if not data:
+      result = self.resfreshSessions(session=session)
+      if not result['OK']:
+        return result
+      data = result['Value'] or {}
+    return S_OK(data['Provider']) if data.get('Provider') else S_ERROR('No IdP found for session %s' % session)
+
+
+gAuthManagerData = AuthManagerData()
diff --git a/FrameworkSystem/Client/ComponentInstaller.py b/FrameworkSystem/Client/ComponentInstaller.py
index 0a74048b014..7c96b251435 100644
--- a/FrameworkSystem/Client/ComponentInstaller.py
+++ b/FrameworkSystem/Client/ComponentInstaller.py
@@ -2101,7 +2101,7 @@ def installPortal(self):
 #
 exec 2>&1
 #
-exec python %(DIRAC)s/WebAppDIRAC/scripts/dirac-webapp-run.py -p < /dev/null
+exec python %(DIRAC)s/DIRAC/Core/scripts/dirac-webapp-run.py -p < /dev/null
   """ % {'bashrc': os.path.join(self.instancePath, 'bashrc'),
                   'DIRAC': self.linkedRootPath})
 
diff --git a/FrameworkSystem/Client/ProxyGeneration.py b/FrameworkSystem/Client/ProxyGeneration.py
index 2ba3dd67fae..3ef28fddb95 100644
--- a/FrameworkSystem/Client/ProxyGeneration.py
+++ b/FrameworkSystem/Client/ProxyGeneration.py
@@ -340,13 +340,6 @@ def generateProxy(params):
       return S_ERROR("Can't contact DIRAC CS: %s" % retVal['Message'])
     userDN = chain.getCertInChain(-1)['Value'].getSubjectDN()['Value']
 
-    if not params.diracGroup:
-      result = Registry.findDefaultGroupForDN(userDN)
-      if not result['OK']:
-        gLogger.warn("Could not get a default group for DN %s: %s" % (userDN, result['Message']))
-      else:
-        params.diracGroup = result['Value']
-        gLogger.info("Default discovered group is %s" % params.diracGroup)
     gLogger.info("Checking DN %s" % userDN)
     retVal = Registry.getUsernameForDN(userDN)
     if not retVal['OK']:
@@ -354,13 +347,21 @@ def generateProxy(params):
       return S_ERROR("DN %s is not registered" % userDN)
     username = retVal['Value']
     gLogger.info("Username is %s" % username)
+
+    if not params.diracGroup:
+      result = Registry.findDefaultGroupForUser(username)
+      if not result['OK']:
+        gLogger.warn(retVal['Message'])
+        return S_ERROR("Cannot found group for %s user. %s" % (username, result['Message']))
+      params.diracGroup = result['Value']
+
     retVal = Registry.getGroupsForUser(username)
     if not retVal['OK']:
       gLogger.warn(retVal['Message'])
       return S_ERROR("User %s has no groups defined" % username)
     groups = retVal['Value']
     if params.diracGroup not in groups:
-      return S_ERROR("Requested group %s is not valid for DN %s" % (params.diracGroup, userDN))
+      return S_ERROR("Requested group %s is not valid for %s user" % (params.diracGroup, username))
     gLogger.info("Creating proxy for %s@%s (%s)" % (username, params.diracGroup, userDN))
   if params.summary:
     h = int(params.proxyLifeTime / 3600)
diff --git a/FrameworkSystem/Client/ProxyManagerClient.py b/FrameworkSystem/Client/ProxyManagerClient.py
index fa881f6e994..0267af6321a 100755
--- a/FrameworkSystem/Client/ProxyManagerClient.py
+++ b/FrameworkSystem/Client/ProxyManagerClient.py
@@ -3,12 +3,15 @@
 from __future__ import absolute_import
 from __future__ import division
 from __future__ import print_function
-import six
+
 import os
+import six
 import datetime
 
 from DIRAC import S_OK, S_ERROR, gLogger
-from DIRAC.ConfigurationSystem.Client.Helpers import Registry
+from DIRAC.FrameworkSystem.Client.ProxyManagerData import gProxyManagerData
+from DIRAC.ConfigurationSystem.Client.Helpers.Registry import getVOMSAttributeForGroup,\
+    getUsernameForDN, getDNsForUsernameInGroup, getDNForUsernameInGroup
 from DIRAC.Core.Utilities import ThreadSafe, DIRACSingleton
 from DIRAC.Core.Utilities.DictCache import DictCache
 from DIRAC.Core.Security.ProxyFile import multiProxyArgument, deleteMultiProxy
@@ -16,23 +19,24 @@
 from DIRAC.Core.Security.X509Request import X509Request  # pylint: disable=import-error
 from DIRAC.Core.Security.VOMS import VOMS
 from DIRAC.Core.Security import Locations
-from DIRAC.Core.DISET.RPCClient import RPCClient
+from DIRAC.Core.Base.Client import Client, createClient
 
 __RCSID__ = "$Id$"
 
-gUsersSync = ThreadSafe.Synchronizer()
 gProxiesSync = ThreadSafe.Synchronizer()
-gVOMSProxiesSync = ThreadSafe.Synchronizer()
-
 
-class ProxyManagerClient(object):
-  __metaclass__ = DIRACSingleton.DIRACSingleton
+@createClient('Framework/ProxyManager')
+@six.add_metaclass(DIRACSingleton.DIRACSingleton)
+class ProxyManagerClient(Client):
+  """ Proxy manager client
+  """
 
-  def __init__(self):
-    self.__usersCache = DictCache()
+  def __init__(self, **kwargs):
+    """ Constructor
+    """
+    super(ProxyManagerClient, self).__init__(**kwargs)
+    self.setServer('Framework/ProxyManager')
     self.__proxiesCache = DictCache()
-    self.__vomsProxiesCache = DictCache()
-    self.__pilotProxiesCache = DictCache()
     self.__filesCache = DictCache(self.__deleteTemporalFile)
 
   def __deleteTemporalFile(self, filename):
@@ -48,141 +52,50 @@ def __deleteTemporalFile(self, filename):
   def clearCaches(self):
     """ Clear caches
     """
-    self.__usersCache.purgeAll()
     self.__proxiesCache.purgeAll()
-    self.__vomsProxiesCache.purgeAll()
-    self.__pilotProxiesCache.purgeAll()
-
-  def __getSecondsLeftToExpiration(self, expiration, utc=True):
-    """ Get time left to expiration in a seconds
-
-        :param datetime expiration:
-        :param boolean utc: time in utc
-
-        :return: datetime
-    """
-    if utc:
-      td = expiration - datetime.datetime.utcnow()
-    else:
-      td = expiration - datetime.datetime.now()
-    return td.days * 86400 + td.seconds
-
-  def __refreshUserCache(self, validSeconds=0):
-    """ Refresh user cache
-
-        :param int validSeconds: required seconds the proxy is valid for
-
-        :return: S_OK()/S_ERROR()
-    """
-    rpcClient = RPCClient("Framework/ProxyManager", timeout=120)
-    retVal = rpcClient.getRegisteredUsers(validSeconds)
-    if not retVal['OK']:
-      return retVal
-    data = retVal['Value']
-    # Update the cache
-    for record in data:
-      cacheKey = (record['DN'], record['group'])
-      self.__usersCache.add(cacheKey,
-                            self.__getSecondsLeftToExpiration(record['expirationtime']),
-                            record)
-    return S_OK()
-
-  @gUsersSync
-  def userHasProxy(self, userDN, userGroup, validSeconds=0):
-    """ Check if a user(DN-group) has a proxy in the proxy management
-        Updates internal cache if needed to minimize queries to the service
-
-        :param str userDN: user DN
-        :param str userGroup: user group
-        :param int validSeconds: proxy valid time in a seconds
-
-        :return: S_OK()/S_ERROR()
-    """
-    cacheKey = (userDN, userGroup)
-    if self.__usersCache.exists(cacheKey, validSeconds):
-      return S_OK(True)
-    # Get list of users from the DB with proxys at least 300 seconds
-    gLogger.verbose("Updating list of users in proxy management")
-    retVal = self.__refreshUserCache(validSeconds)
-    if not retVal['OK']:
-      return retVal
-    return S_OK(self.__usersCache.exists(cacheKey, validSeconds))
 
-  @gUsersSync
-  def getUserPersistence(self, userDN, userGroup, validSeconds=0):
-    """ Check if a user(DN-group) has a proxy in the proxy management
+  def userHasProxy(self, user, group, validSeconds=0):
+    """ Check if a user-group has a proxy in the proxy management
         Updates internal cache if needed to minimize queries to the service
 
-        :param str userDN: user DN
-        :param str userGroup: user group
+        :param str user: user name
+        :param str group: user group
         :param int validSeconds: proxy valid time in a seconds
 
         :return: S_OK()/S_ERROR()
     """
-    cacheKey = (userDN, userGroup)
-    userData = self.__usersCache.get(cacheKey, validSeconds)
-    if userData:
-      if userData['persistent']:
-        return S_OK(True)
-    # Get list of users from the DB with proxys at least 300 seconds
-    gLogger.verbose("Updating list of users in proxy management")
-    retVal = self.__refreshUserCache(validSeconds)
-    if not retVal['OK']:
-      return retVal
-    userData = self.__usersCache.get(cacheKey, validSeconds)
-    if userData:
-      return S_OK(userData['persistent'])
-    return S_OK(False)
-
-  def setPersistency(self, userDN, userGroup, persistent):
-    """ Set the persistency for user/group
+    dn = user
+    if not user.startswith('/'):
+      result = getDNForUsernameInGroup(user, group)
+      if not result['OK']:
+        return result
+      dn = result['Value']
 
-        :param str userDN: user DN
-        :param str userGroup: user group
-        :param boolean persistent: presistent flag
+    result = gProxyManagerData.userHasProxy(dn, group, validSeconds)
+    if not result['OK'] or result['Value'] or user.startswith('/'):
+      return result
 
-        :return: S_OK()/S_ERROR()
-    """
-    # Hack to ensure bool in the rpc call
-    persistentFlag = True
-    if not persistent:
-      persistentFlag = False
-    rpcClient = RPCClient("Framework/ProxyManager", timeout=120)
-    retVal = rpcClient.setPersistency(userDN, userGroup, persistentFlag)
-    if not retVal['OK']:
-      return retVal
-    # Update internal persistency cache
-    cacheKey = (userDN, userGroup)
-    record = self.__usersCache.get(cacheKey, 0)
-    if record:
-      record['persistent'] = persistentFlag
-      self.__usersCache.add(cacheKey,
-                            self.__getSecondsLeftToExpiration(record['expirationtime']),
-                            record)
-    return retVal
+    result = self.getGroupsStatusByUsername(user, [group])
+    return S_OK(True if result['Value'][group]['Status'] == "ready" else False) if result['OK'] else result
 
   def uploadProxy(self, proxy=None, restrictLifeTime=0, rfcIfPossible=False):
     """ Upload a proxy to the proxy management service using delegation
 
         :param X509Chain proxy: proxy as a chain
         :param int restrictLifeTime: proxy live time in a seconds
-        :param boolean rfcIfPossible: make rfc proxy if possible
+        :param bool rfcIfPossible: make rfc proxy if possible
 
         :return: S_OK(dict)/S_ERROR() -- dict contain proxies
     """
     # Discover proxy location
+    proxyLocation = proxy if isinstance(proxy, six.string_types) else ""
     if isinstance(proxy, X509Chain):
       chain = proxy
-      proxyLocation = ""
     else:
-      if not proxy:
+      if not proxyLocation:
         proxyLocation = Locations.getProxyLocation()
         if not proxyLocation:
           return S_ERROR("Can't find a valid proxy")
-      elif isinstance(proxy, six.string_types):
-        proxyLocation = proxy
-      else:
-        return S_ERROR("Can't find a valid proxy")
       chain = X509Chain()
       result = chain.loadProxyFromFile(proxyLocation)
       if not result['OK']:
@@ -194,61 +107,65 @@ def uploadProxy(self, proxy=None, restrictLifeTime=0, rfcIfPossible=False):
     if chain.getDIRACGroup().get('Value') or chain.isVOMS().get('Value'):
       return S_ERROR("Cannot upload proxy with DIRAC group or VOMS extensions")
 
-    rpcClient = RPCClient("Framework/ProxyManager", timeout=120)
     # Get a delegation request
-    # WARN: Since v7r1 requestDelegationUpload method use only first argument!
-    # WARN:   Second argument for compatibility with older versions
-    result = rpcClient.requestDelegationUpload(chain.getRemainingSecs()['Value'], None)
+    result = self._getRPC().requestDelegationUpload()
     if not result['OK']:
       return result
     reqDict = result['Value']
     # Generate delegated chain
     chainLifeTime = chain.getRemainingSecs()['Value'] - 60
-    if restrictLifeTime and restrictLifeTime < chainLifeTime:
-      chainLifeTime = restrictLifeTime
-    retVal = chain.generateChainFromRequestString(reqDict['request'],
-                                                  lifetime=chainLifeTime,
+    chainLifeTime = min(restrictLifeTime, chainLifeTime) if restrictLifeTime else chainLifeTime
+    retVal = chain.generateChainFromRequestString(reqDict['request'], lifetime=chainLifeTime,
                                                   rfc=rfcIfPossible)
     if not retVal['OK']:
       return retVal
     # Upload!
-    result = rpcClient.completeDelegationUpload(reqDict['id'], retVal['Value'])
-    if not result['OK']:
-      return result
-    return S_OK(result.get('proxies') or result['Value'])
+    return self._getRPC().completeDelegationUpload(reqDict['id'], retVal['Value'])
 
   @gProxiesSync
-  def downloadProxy(self, userDN, userGroup, limited=False, requiredTimeLeft=1200,
-                    cacheTime=14400, proxyToConnect=None, token=None):
-    """ Get a proxy Chain from the proxy management
+  def __getProxy(self, user, userGroup, limited=False, requiredTimeLeft=1200, cacheTime=14400,
+                 proxyToConnect=None, token=None, voms=None, personal=False):
+    """ Get a proxy Chain from the proxy manager
 
-        :param str userDN: user DN
-        :param str userGroup: user group
-        :param boolean limited: if need limited proxy
+        :param str user: user name or DN
+        :param str group: user group
+        :param bool limited: if need limited proxy
         :param int requiredTimeLeft: required proxy live time in a seconds
         :param int cacheTime: store in a cache time in a seconds
         :param X509Chain proxyToConnect: proxy as a chain
         :param str token: valid token to get a proxy
+        :param bool voms: for VOMS proxy
+        :param bool personal: get personal proxy
 
         :return: S_OK(X509Chain)/S_ERROR()
     """
-    cacheKey = (userDN, userGroup)
+    if voms and not getVOMSAttributeForGroup(userGroup):
+      return S_ERROR("No mapping defined for group %s in the CS" % userGroup)
+
+    dn = None
+    if user.startswith('/'):
+      dn = user
+      result = getUsernameForDN(dn)
+      if result['OK']:
+        user = result['Value']
+        result = getDNsForUsernameInGroup(user, userGroup)
+      if not result['OK']:
+        return result
+      if dn not in result['Value']:
+        return S_ERROR('"%s" DN not match with %s user, %s group.' % (dn, user, userGroup))
+
+    cacheKey = (dn or user, userGroup, voms, limited)
     if self.__proxiesCache.exists(cacheKey, requiredTimeLeft):
       return S_OK(self.__proxiesCache.get(cacheKey))
+
     req = X509Request()
     req.generateProxyRequest(limited=limited)
-    if proxyToConnect:
-      rpcClient = RPCClient("Framework/ProxyManager", proxyChain=proxyToConnect, timeout=120)
-    else:
-      rpcClient = RPCClient("Framework/ProxyManager", timeout=120)
-    if token:
-      retVal = rpcClient.getProxyWithToken(userDN, userGroup, req.dumpRequest()['Value'],
-                                           int(cacheTime + requiredTimeLeft), token)
-    else:
-      retVal = rpcClient.getProxy(userDN, userGroup, req.dumpRequest()['Value'],
-                                  int(cacheTime + requiredTimeLeft))
+    rpcClient = self._getRPC(proxyChain=proxyToConnect) if proxyToConnect else self._getRPC()
+    retVal = rpcClient.getProxy(dn or user, userGroup, req.dumpRequest()['Value'],
+                                int(cacheTime + requiredTimeLeft), token, voms, personal)
     if not retVal['OK']:
       return retVal
+
     chain = X509Chain(keyObj=req.getPKey())
     retVal = chain.loadChainFromString(retVal['Value'])
     if not retVal['OK']:
@@ -256,190 +173,124 @@ def downloadProxy(self, userDN, userGroup, limited=False, requiredTimeLeft=1200,
     self.__proxiesCache.add(cacheKey, chain.getRemainingSecs()['Value'], chain)
     return S_OK(chain)
 
-  def downloadProxyToFile(self, userDN, userGroup, limited=False, requiredTimeLeft=1200,
-                          cacheTime=14400, filePath=None, proxyToConnect=None, token=None):
-    """ Get a proxy Chain from the proxy management and write it to file
+  def downloadPersonalProxy(self, user, group, requiredTimeLeft=1200, voms=False):
+    """ Get a proxy Chain from the proxy management
 
-        :param str userDN: user DN
-        :param str userGroup: user group
-        :param boolean limited: if need limited proxy
+        :param str user: user name or DN
+        :param str group: user group
         :param int requiredTimeLeft: required proxy live time in a seconds
-        :param int cacheTime: store in a cache time in a seconds
-        :param str filePath: path to save proxy
-        :param X509Chain proxyToConnect: proxy as a chain
-        :param str token: valid token to get a proxy
+        :param bool voms: for VOMS proxy
 
         :return: S_OK(X509Chain)/S_ERROR()
     """
-    retVal = self.downloadProxy(userDN, userGroup, limited, requiredTimeLeft, cacheTime, proxyToConnect, token)
-    if not retVal['OK']:
-      return retVal
-    chain = retVal['Value']
-    retVal = self.dumpProxyToFile(chain, filePath)
-    if not retVal['OK']:
-      return retVal
-    retVal['chain'] = chain
-    return retVal
+    return self.__getProxy(user, group, requiredTimeLeft=requiredTimeLeft,
+                           voms=voms, personal=True)
 
-  @gVOMSProxiesSync
-  def downloadVOMSProxy(self, userDN, userGroup, limited=False, requiredTimeLeft=1200,
-                        cacheTime=14400, requiredVOMSAttribute=None,
-                        proxyToConnect=None, token=None):
-    """ Download a proxy if needed and transform it into a VOMS one
+  def downloadProxy(self, user, group, limited=False, requiredTimeLeft=1200, cacheTime=14400,
+                    proxyToConnect=None, token=None, personal=False):
+    """ Get a proxy Chain from the proxy management
 
-        :param str userDN: user DN
-        :param str userGroup: user group
-        :param boolean limited: if need limited proxy
+        :param str user: user name or DN
+        :param str group: user group
+        :param bool limited: if need limited proxy
         :param int requiredTimeLeft: required proxy live time in a seconds
         :param int cacheTime: store in a cache time in a seconds
-        :param str requiredVOMSAttribute: VOMS attr to add to the proxy
         :param X509Chain proxyToConnect: proxy as a chain
         :param str token: valid token to get a proxy
+        :param bool personal: get personal proxy
 
         :return: S_OK(X509Chain)/S_ERROR()
     """
-    cacheKey = (userDN, userGroup, requiredVOMSAttribute, limited)
-    if self.__vomsProxiesCache.exists(cacheKey, requiredTimeLeft):
-      return S_OK(self.__vomsProxiesCache.get(cacheKey))
-    req = X509Request()
-    req.generateProxyRequest(limited=limited)
-    if proxyToConnect:
-      rpcClient = RPCClient("Framework/ProxyManager", proxyChain=proxyToConnect, timeout=120)
-    else:
-      rpcClient = RPCClient("Framework/ProxyManager", timeout=120)
-    if token:
-      retVal = rpcClient.getVOMSProxyWithToken(userDN, userGroup, req.dumpRequest()['Value'],
-                                               int(cacheTime + requiredTimeLeft), token, requiredVOMSAttribute)
-
-    else:
-      retVal = rpcClient.getVOMSProxy(userDN, userGroup, req.dumpRequest()['Value'],
-                                      int(cacheTime + requiredTimeLeft), requiredVOMSAttribute)
-    if not retVal['OK']:
-      return retVal
-    chain = X509Chain(keyObj=req.getPKey())
-    retVal = chain.loadChainFromString(retVal['Value'])
-    if not retVal['OK']:
-      return retVal
-    self.__vomsProxiesCache.add(cacheKey, chain.getRemainingSecs()['Value'], chain)
-    return S_OK(chain)
+    return self.__getProxy(user, group, limited=limited, requiredTimeLeft=requiredTimeLeft,
+                           cacheTime=cacheTime, proxyToConnect=proxyToConnect, token=token, personal=personal)
 
-  def downloadVOMSProxyToFile(self, userDN, userGroup, limited=False, requiredTimeLeft=1200,
-                              cacheTime=14400, requiredVOMSAttribute=None, filePath=None,
-                              proxyToConnect=None, token=None):
-    """ Download a proxy if needed, transform it into a VOMS one and write it to file
+  def downloadProxyToFile(self, user, group, limited=False, requiredTimeLeft=1200, cacheTime=14400,
+                          filePath=None, proxyToConnect=None, token=None, personal=False):
+    """ Get a proxy Chain from the proxy management and write it to file
 
-        :param str userDN: user DN
-        :param str userGroup: user group
-        :param boolean limited: if need limited proxy
+        :param str user: user name or DN
+        :param str group: user group
+        :param bool limited: if need limited proxy
         :param int requiredTimeLeft: required proxy live time in a seconds
         :param int cacheTime: store in a cache time in a seconds
-        :param str requiredVOMSAttribute: VOMS attr to add to the proxy
         :param str filePath: path to save proxy
         :param X509Chain proxyToConnect: proxy as a chain
         :param str token: valid token to get a proxy
+        :param bool personal: get personal proxy
 
         :return: S_OK(X509Chain)/S_ERROR()
     """
-    retVal = self.downloadVOMSProxy(userDN, userGroup, limited, requiredTimeLeft, cacheTime,
-                                    requiredVOMSAttribute, proxyToConnect, token)
-    if not retVal['OK']:
-      return retVal
-    chain = retVal['Value']
-    retVal = self.dumpProxyToFile(chain, filePath)
-    if not retVal['OK']:
-      return retVal
-    retVal['chain'] = chain
+    retVal = self.downloadProxy(user, group, limited, requiredTimeLeft, cacheTime, proxyToConnect, token, personal)
+    if retVal['OK']:
+      chain = retVal['Value']
+      retVal = self.dumpProxyToFile(chain, filePath)
+      if retVal['OK']:
+        retVal['chain'] = chain
     return retVal
 
-  def getPilotProxyFromDIRACGroup(self, userDN, userGroup, requiredTimeLeft=43200, proxyToConnect=None):
-    """ Download a pilot proxy with VOMS extensions depending on the group
-
-        :param str userDN: user DN
-        :param str userGroup: user group
-        :param int requiredTimeLeft: required proxy live time in seconds
-        :param X509Chain proxyToConnect: proxy as a chain
-
-        :return: S_OK(X509Chain)/S_ERROR()
-    """
-    # Assign VOMS attribute
-    vomsAttr = Registry.getVOMSAttributeForGroup(userGroup)
-    if not vomsAttr:
-      gLogger.warn("No voms attribute assigned to group %s when requested pilot proxy" % userGroup)
-      return self.downloadProxy(userDN, userGroup, limited=False, requiredTimeLeft=requiredTimeLeft,
-                                proxyToConnect=proxyToConnect)
-    else:
-      return self.downloadVOMSProxy(userDN, userGroup, limited=False, requiredTimeLeft=requiredTimeLeft,
-                                    requiredVOMSAttribute=vomsAttr, proxyToConnect=proxyToConnect)
-
-  def getPilotProxyFromVOMSGroup(self, userDN, vomsAttr, requiredTimeLeft=43200, proxyToConnect=None):
-    """ Download a pilot proxy with VOMS extensions depending on the group
+  def downloadVOMSProxy(self, user, group, limited=False, requiredTimeLeft=1200,
+                        cacheTime=14400, proxyToConnect=None, token=None, personal=False):
+    """ Download a proxy if needed and transform it into a VOMS one
 
-        :param str userDN: user DN
-        :param str vomsAttr: VOMS attribute
+        :param str user: user name or DN
+        :param str group: user group
+        :param bool limited: if need limited proxy
         :param int requiredTimeLeft: required proxy live time in a seconds
+        :param int cacheTime: store in a cache time in a seconds
         :param X509Chain proxyToConnect: proxy as a chain
+        :param str token: valid token to get a proxy
+        :param bool personal: get personal proxy
 
         :return: S_OK(X509Chain)/S_ERROR()
     """
-    groups = Registry.getGroupsWithVOMSAttribute(vomsAttr)
-    if not groups:
-      return S_ERROR("No group found that has %s as voms attrs" % vomsAttr)
-
-    for userGroup in groups:
-      result = self.downloadVOMSProxy(userDN, userGroup,
-                                      limited=False,
-                                      requiredTimeLeft=requiredTimeLeft,
-                                      requiredVOMSAttribute=vomsAttr,
-                                      proxyToConnect=proxyToConnect)
-      if result['OK']:
-        return result
-    return result
+    return self.__getProxy(user, group, limited=limited, requiredTimeLeft=requiredTimeLeft, voms=True,
+                           cacheTime=cacheTime, proxyToConnect=proxyToConnect, token=token, personal=personal)
 
-  def getPayloadProxyFromDIRACGroup(self, userDN, userGroup, requiredTimeLeft, token=None, proxyToConnect=None):
-    """ Download a payload proxy with VOMS extensions depending on the group
+  def downloadVOMSProxyToFile(self, user, group, limited=False, requiredTimeLeft=1200,
+                              cacheTime=14400, filePath=None, proxyToConnect=None, token=None, personal=False):
+    """ Download a proxy if needed, transform it into a VOMS one and write it to file
 
-        :param str userDN: user DN
-        :param str userGroup: user group
+        :param str user: user name or DN
+        :param str group: user group
+        :param bool limited: if need limited proxy
         :param int requiredTimeLeft: required proxy live time in a seconds
-        :param str token: valid token to get a proxy
+        :param int cacheTime: store in a cache time in a seconds
+        :param str filePath: path to save proxy
         :param X509Chain proxyToConnect: proxy as a chain
+        :param str token: valid token to get a proxy
+        :param bool personal: get personal proxy
 
         :return: S_OK(X509Chain)/S_ERROR()
     """
-    # Assign VOMS attribute
-    vomsAttr = Registry.getVOMSAttributeForGroup(userGroup)
-    if not vomsAttr:
-      gLogger.verbose("No voms attribute assigned to group %s when requested payload proxy" % userGroup)
-      return self.downloadProxy(userDN, userGroup, limited=True, requiredTimeLeft=requiredTimeLeft,
-                                proxyToConnect=proxyToConnect, token=token)
-    else:
-      return self.downloadVOMSProxy(userDN, userGroup, limited=True, requiredTimeLeft=requiredTimeLeft,
-                                    requiredVOMSAttribute=vomsAttr, proxyToConnect=proxyToConnect,
-                                    token=token)
+    retVal = self.downloadVOMSProxy(user, group, limited, requiredTimeLeft, cacheTime,
+                                    proxyToConnect, token, personal)
+    if retVal['OK']:
+      chain = retVal['Value']
+      retVal = self.dumpProxyToFile(chain, filePath)
+      if retVal['OK']:
+        retVal['chain'] = chain
+    return retVal
 
-  def getPayloadProxyFromVOMSGroup(self, userDN, vomsAttr, token, requiredTimeLeft, proxyToConnect=None):
-    """ Download a payload proxy with VOMS extensions depending on the VOMS attr
+  def downloadCorrectProxy(self, user, group, requiredTimeLeft=43200, proxyToConnect=None,
+                           token=None, personal=False):
+    """ Download a proxy with VOMS extensions depending on the group or simple proxy
+        if group without VOMS extensions
 
-        :param str userDN: user DN
-        :param str vomsAttr: VOMS attribute
-        :param str token: valid token to get a proxy
+        :param str user: user name or DN
+        :param str group: user group
         :param int requiredTimeLeft: required proxy live time in a seconds
         :param X509Chain proxyToConnect: proxy as a chain
+        :param str token: valid token to get a proxy
+        :param bool personal: get personal proxy
 
         :return: S_OK(X509Chain)/S_ERROR()
     """
-    groups = Registry.getGroupsWithVOMSAttribute(vomsAttr)
-    if not groups:
-      return S_ERROR("No group found that has %s as voms attrs" % vomsAttr)
-    userGroup = groups[0]
-
-    return self.downloadVOMSProxy(userDN,
-                                  userGroup,
-                                  limited=True,
-                                  requiredTimeLeft=requiredTimeLeft,
-                                  requiredVOMSAttribute=vomsAttr,
-                                  proxyToConnect=proxyToConnect,
-                                  token=token)
+    if not getVOMSAttributeForGroup(group):
+      gLogger.verbose("No voms attribute assigned to group %s when requested proxy" % group)
+      return self.downloadProxy(user, group, limited=False, requiredTimeLeft=requiredTimeLeft,
+                                proxyToConnect=proxyToConnect, personal=personal)
+    return self.downloadVOMSProxy(user, group, limited=False, requiredTimeLeft=requiredTimeLeft,
+                                  proxyToConnect=proxyToConnect, personal=personal)
 
   def dumpProxyToFile(self, chain, destinationFile=None, requiredTimeLeft=600):
     """ Dump a proxy to a file. It's cached so multiple calls won't generate extra files
@@ -476,18 +327,17 @@ def deleteGeneratedProxyFile(self, chain):
     self.__filesCache.delete(chain)
     return S_OK()
 
-  def requestToken(self, requesterDN, requesterGroup, numUses=1):
+  def requestToken(self, requester, requesterGroup, numUses=1):
     """ Request a number of tokens. usesList must be a list of integers and each integer is the number of uses a token
         must have
 
-        :param str requesterDN: user DN
+        :param str requester: user name
         :param str requesterGroup: user group
         :param int numUses: number of uses
 
         :return: S_OK(tuple)/S_ERROR() -- tuple contain token, number uses
     """
-    rpcClient = RPCClient("Framework/ProxyManager", timeout=120)
-    return rpcClient.generateToken(requesterDN, requesterGroup, numUses)
+    return self._getRPC().generateToken(requester, requesterGroup, numUses)
 
   def renewProxy(self, proxyToBeRenewed=None, minLifeTime=3600, newProxyLifeTime=43200, proxyToConnect=None):
     """ Renew a proxy using the ProxyManager
@@ -525,6 +375,10 @@ def renewProxy(self, proxyToBeRenewed=None, minLifeTime=3600, newProxyLifeTime=4
       deleteMultiProxy(proxyToConnectDict)
       return retVal
     userGroup = retVal['Value']
+    result = getUsernameForDN(userDN)
+    if not result['OK']:
+      return result
+    userName = result['Value']
     limited = proxyToRenewDict['chain'].isLimitedProxy()['Value']
 
     voms = VOMS()
@@ -533,18 +387,13 @@ def renewProxy(self, proxyToBeRenewed=None, minLifeTime=3600, newProxyLifeTime=4
       deleteMultiProxy(proxyToRenewDict)
       deleteMultiProxy(proxyToConnectDict)
       return retVal
-    vomsAttrs = retVal['Value']
-    if vomsAttrs:
-      retVal = self.downloadVOMSProxy(userDN,
-                                      userGroup,
-                                      limited=limited,
+
+    if retVal['Value']:
+      retVal = self.downloadVOMSProxy(userName, userGroup, limited=limited,
                                       requiredTimeLeft=newProxyLifeTime,
-                                      requiredVOMSAttribute=vomsAttrs[0],
                                       proxyToConnect=proxyToConnectDict['chain'])
     else:
-      retVal = self.downloadProxy(userDN,
-                                  userGroup,
-                                  limited=limited,
+      retVal = self.downloadProxy(userName, userGroup, limited=limited,
                                   requiredTimeLeft=newProxyLifeTime,
                                   proxyToConnect=proxyToConnectDict['chain'])
 
@@ -553,7 +402,6 @@ def renewProxy(self, proxyToBeRenewed=None, minLifeTime=3600, newProxyLifeTime=4
 
     if not retVal['OK']:
       return retVal
-
     chain = retVal['Value']
 
     if not proxyToRenewDict['tempFile']:
@@ -561,46 +409,50 @@ def renewProxy(self, proxyToBeRenewed=None, minLifeTime=3600, newProxyLifeTime=4
 
     return S_OK(chain)
 
-  def getDBContents(self, condDict={}):
+  def getVOMSAttributes(self, chain):
+    """ Get the voms attributes for a chain
+
+        :param X509Chain chain: proxy as a chain
+
+        :return: S_OK(str)/S_ERROR()
+    """
+    return VOMS().getVOMSAttributes(chain)
+
+  def getDBContents(self, condDict={}, start=0, limit=0):
     """ Get the contents of the db
 
         :param dict condDict: search condition
+        :param int start: search limit start
+        :param int start: search limit amount
 
         :return: S_OK(dict)/S_ERROR() -- dict contain fields, record list, total records
     """
-    rpcClient = RPCClient("Framework/ProxyManager", timeout=120)
-    return rpcClient.getContents(condDict, [['UserDN', 'DESC']], 0, 0)
+    return self._getRPC().getContents(condDict, [['UserDN', 'DESC']], 0, 0)
 
-  def getVOMSAttributes(self, chain):
-    """ Get the voms attributes for a chain
+  def getUploadedProxiesDetails(self, user=None, group=None):
+    """ Get the details about an uploaded proxy
 
-        :param X509Chain chain: proxy as a chain
+        :param str user: user name
+        :param str group: group name
 
-        :return: S_OK(str)/S_ERROR()
+        :return: S_OK(dict)/S_ERROR() -- dict contain fields, record list, total records
     """
-    return VOMS().getVOMSAttributes(chain)
+    return self.getDBContents({'UserName': user, 'UserGroup': group})
 
-  def getUploadedProxyLifeTime(self, DN, group):
+  def getUploadedProxyLifeTime(self, user, group):
     """ Get the remaining seconds for an uploaded proxy
 
-        :param str DN: user DN
-        :param str group: group
+        :param str user: user name
+        :param str group: group name
 
         :return: S_OK(int)/S_ERROR()
     """
-    result = self.getDBContents({'UserDN': [DN], 'UserGroup': [group]})
+    result = self.getUploadedProxiesDetails(user, group)
     if not result['OK']:
       return result
-    data = result['Value']
-    if len(data['Records']) == 0:
-      return S_OK(0)
-    pNames = list(data['ParameterNames'])
-    dnPos = pNames.index('UserDN')
-    groupPos = pNames.index('UserGroup')
-    expiryPos = pNames.index('ExpirationTime')
-    for row in data['Records']:
-      if DN == row[dnPos] and group == row[groupPos]:
-        td = row[expiryPos] - datetime.datetime.utcnow()
+    for proxyDict in result['Value']['Dictionaries']:
+      if user == proxyDict['user'] and group == proxyDict['group']:
+        td = proxyDict['expirationtime'] - datetime.datetime.utcnow()
         secondsLeft = td.days * 86400 + td.seconds
         return S_OK(max(0, secondsLeft))
     return S_OK(0)
@@ -610,10 +462,9 @@ def getUserProxiesInfo(self):
 
         :return: S_OK(dict)/S_ERROR()
     """
-    result = RPCClient("Framework/ProxyManager", timeout=120).getUserProxiesInfo()
+    result = self._getRPC().getUserProxiesInfo()
     if 'rpcStub' in result:
       result.pop('rpcStub')
     return result
 
-
 gProxyManager = ProxyManagerClient()
diff --git a/FrameworkSystem/Client/ProxyManagerData.py b/FrameworkSystem/Client/ProxyManagerData.py
new file mode 100644
index 00000000000..8e1ebf1af7a
--- /dev/null
+++ b/FrameworkSystem/Client/ProxyManagerData.py
@@ -0,0 +1,213 @@
+""" The ProxyManagemen Client class encapsulates the cache data.
+"""
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import print_function
+
+import datetime
+import six
+
+from DIRAC import S_OK, S_ERROR, gLogger
+from DIRAC.Core.Utilities import ThreadSafe, DIRACSingleton
+from DIRAC.Core.Utilities.DictCache import DictCache
+
+__RCSID__ = "$Id$"
+
+gUsersSync = ThreadSafe.Synchronizer()
+gVOMSUsersSync = ThreadSafe.Synchronizer()
+
+@six.add_metaclass(DIRACSingleton.DIRACSingleton)
+class ProxyManagerData(object):
+  """ Proxy manager client
+  """
+  # # __usersCache cache, with following:
+  # #   Key: (userDN, group)
+  # #   Value: dict
+  # #       {
+  # #         'DN': <certificate DN>,
+  # #         'user': <user name>,
+  # #         'groups': [<list of groups>], <-- TODOAL: current group
+  # #         'expirationtime': <date time>,
+  # #         'provider': <proxy provider>
+  # #       }
+
+  # # __VOMSesUsersCache cache, with next structure:
+  # #   Key: VOMS VO name
+  # #   Value: S_OK(dict)/S_ERROR() -- request VOMS information result that contain
+  # #     dictionary with following:
+  # #       { <user DN>: {
+  # #           Suspended: bool,
+  # #           VOMSRoles: [<all roles>],
+  # #           ActiveRoles: [<active roles>],
+  # #           SuspendedRoles: [<suspended roles>]
+  # #         }
+  # #       }
+
+  def __init__(self):
+    self.rpc = None
+    self.__usersCache = DictCache()
+    self.__VOMSesUsersCache = DictCache()
+
+  @gUsersSync
+  @gVOMSUsersSync
+  def clearCaches(self):
+    """ Clear caches
+    """
+    self.__usersCache.purgeAll()
+    self.__VOMSesUsersCache.purgeAll()
+
+  @gUsersSync
+  def __getUsersCache(self, mask=None, time=None):
+    """ Get cache information
+
+        :param str mask: user ID
+        :param int time: lifetime
+
+        :return: dict
+    """
+    if mask:
+      return self.__usersCache.get(mask, time) or {}
+    return self.__usersCache.getDict()
+
+  @gUsersSync
+  def __addUsersCache(self, data, time=3600 * 24):
+    """ Add cache information
+
+        :param dict data: ID information data
+        :param int time: lifetime
+    """
+    for oid, info in data.items():
+      self.__usersCache.add(oid, time, value=info)
+
+  def __getSecondsLeftToExpiration(self, expiration, utc=True):
+    """ Get time left to expiration in a seconds
+
+        :param datetime expiration:
+        :param bool utc: time in utc
+
+        :return: datetime
+    """
+    if utc:
+      td = expiration - datetime.datetime.utcnow()
+    else:
+      td = expiration - datetime.datetime.now()
+    return td.days * 86400 + td.seconds
+
+  def __getRPC(self):
+    """ Get RPC
+    """
+    if not self.rpc:
+      from DIRAC.Core.Base.Client import Client
+      self.rpc = Client()._getRPC(url="Framework/ProxyManager", timeout=120)
+    return self.rpc
+
+  def __refreshUserCache(self, validSeconds=0):
+    """ Refresh user cache
+
+        :param int validSeconds: required seconds the proxy is valid for
+
+        :return: S_OK()/S_ERROR()
+    """
+    retVal = self.__getRPC().getRegisteredUsers(validSeconds)
+    if not retVal['OK']:
+      return retVal
+    # Update the cache
+    resDict = {}
+    for record in retVal['Value']:
+      for group in record['groups']:
+        cacheKey = (record['DN'], group)
+        resDict[cacheKey] = record
+        self.__addUsersCache({cacheKey: record}, self.__getSecondsLeftToExpiration(record['expirationtime']))
+    return S_OK(resDict)
+
+  @gVOMSUsersSync
+  def __getVOMSUsersDict(self):
+    """ Get users dictionary from cache
+
+        :return: dict
+    """
+    return self.__VOMSesUsersCache.getDict()
+
+  @gVOMSUsersSync
+  def __setVOMSUsersDict(self, usersDict):
+    """ Set dictionary to cache
+
+        :param dict usersDict: dictionary with VOMS users
+    """
+    for vo, userInfo in usersDict.items():
+      self.__VOMSesUsersCache.add(vo, 3600 * 24, value=userInfo)
+    self.__VOMSesUsersCache.add('Fresh', 3600 * 12, value=True)
+
+  def __refreshVOMSesCache(self):
+    """ Get fresh info from service about VOMSes
+
+        :return: S_OK()/S_ERROR()
+    """
+    result = self.__getRPC().getVOMSesUsers()
+    if result['OK']:
+      self.__setVOMSUsersDict(result['Value'])
+    return result
+
+  def getActualVOMSesDNs(self, voList=None, dnList=None):
+    """ Return actual/not suspended DNs from VOMSes
+
+        :param list voList: VOs to get
+        :param list dnList: DNs to get
+
+        :return: S_OK(dict)/S_ERROR()
+    """
+    vomsUsers = self.__getVOMSUsersDict()
+    if not vomsUsers.get('Fresh'):
+      result = self.__refreshVOMSesCache()
+      if not result['OK']:
+        return result
+      vomsUsers = result['Value']
+    vomsUsers.pop('Fresh', None)
+    res = {}
+    if not vomsUsers:
+      # use simulation here for tests
+      return S_ERROR('VOMSes has not been updated.')
+    for vo, voInfo in vomsUsers.items():
+      if voList and vo not in voList:
+        continue
+      if not voInfo['OK']:
+        res[vo] = voInfo
+        continue
+      res[vo] = S_OK({})
+      for dn, data in voInfo['Value'].items():
+        if dnList and dn not in dnList:
+          continue
+        if dn not in res[vo]['Value']:
+          res[vo]['Value'][dn] = {'Suspended': data['suspended'],
+                                  'VOMSRoles': [],
+                                  'ActiveRoles': [],
+                                  'SuspendedRoles': []}
+        res[vo]['Value'][dn]['VOMSRoles'] = list(set(res[vo]['Value'][dn]['VOMSRoles'] + data['Roles']))
+        if data['certSuspended'] or data['suspended']:
+          res[vo]['Value'][dn]['SuspendedRoles'] = list(set(res[vo]['Value'][dn]['SuspendedRoles'] + data['Roles']))
+        else:
+          res[vo]['Value'][dn]['ActiveRoles'] = list(set(res[vo]['Value'][dn]['ActiveRoles'] + data['Roles']))
+    return S_OK(res)
+
+  def userHasProxy(self, userDN, group, validSeconds=0):
+    """ Check if a user-group has a proxy in the proxy management
+        Updates internal cache if needed to minimize queries to the service
+
+        :param str userDN: user DN
+        :param str group: user group
+        :param int validSeconds: proxy valid time in a seconds
+
+        :return: S_OK(bool)/S_ERROR()
+    """
+    cacheKey = (userDN, group)
+    if self.__getUsersCache(cacheKey, validSeconds):
+      return S_OK(True)
+    # Get list of users from the DB with proxys at least 300 seconds
+    gLogger.verbose("Updating list of users in proxy management")
+    result = self.__refreshUserCache(validSeconds)
+    if result.get('Value', {}).get(cacheKey):
+      return S_OK(bool(result['Value'].get(cacheKey)))
+    return result
+
+
+gProxyManagerData = ProxyManagerData()
diff --git a/FrameworkSystem/Client/ProxyUpload.py b/FrameworkSystem/Client/ProxyUpload.py
index d03ddfc0f35..4a36efe33f5 100644
--- a/FrameworkSystem/Client/ProxyUpload.py
+++ b/FrameworkSystem/Client/ProxyUpload.py
@@ -6,10 +6,11 @@
 from __future__ import print_function
 from __future__ import absolute_import
 from __future__ import division
+
 import sys
 import getpass
-import DIRAC
 
+import DIRAC
 from DIRAC import gLogger
 from DIRAC.Core.Base import Script
 
diff --git a/FrameworkSystem/ConfigTemplate.cfg b/FrameworkSystem/ConfigTemplate.cfg
index 2e6f9a7865c..7ff767d1790 100644
--- a/FrameworkSystem/ConfigTemplate.cfg
+++ b/FrameworkSystem/ConfigTemplate.cfg
@@ -37,6 +37,15 @@ Services
       setPersistency = ProxyManagement
     }
   }
+  AuthManager
+  {
+    Port = 9151
+    MaxThreads = 100
+    Authorization
+    {
+      Default = authenticated
+    }
+  }
   SecurityLogging
   {
     Port = 9153
diff --git a/FrameworkSystem/DB/AuthDB.py b/FrameworkSystem/DB/AuthDB.py
new file mode 100644
index 00000000000..7c968aaf844
--- /dev/null
+++ b/FrameworkSystem/DB/AuthDB.py
@@ -0,0 +1,336 @@
+""" Auth class is a front-end to the Auth Database
+"""
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import print_function
+
+import re
+import json
+import pprint
+import random
+import string
+
+from ast import literal_eval
+from datetime import datetime
+
+from DIRAC import gConfig, S_OK, S_ERROR, gLogger
+from DIRAC.Core.Base.DB import DB
+
+__RCSID__ = "$Id$"
+
+# Session statuses
+
+# successfully authed and ready to use
+SESSION_READY = "authed"
+# crashed
+SESSION_FAILED = "failed"
+# authed, paused for waiting when second flow will end
+SESSION_REDIRECT = "redirect"
+# just created
+SESSION_PREPARED = "prepared"
+# first request to get auth link
+SESSION_PROGRESS = "in progress"
+# finishing
+SESSION_FINISHING = "finishing"
+
+
+class AuthDB(DB):
+  """ AuthDB class is a front-end to the OAuth Database
+  """
+  tableDict = {'Sessions': {'Fields': {'ID': 'VARCHAR(128)',
+                                       'Status': 'VARCHAR(32) DEFAULT "prepared"',
+                                       'Session': 'VARCHAR(64) NOT NULL',
+                                       'Comment': 'MEDIUMBLOB',
+                                       'Provider': 'VARCHAR(255) NOT NULL',
+                                       'TokenType': 'VARCHAR(32) DEFAULT "bearer"',
+                                       'ExpiresIn': 'DATETIME',
+                                       'AccessToken': 'VARCHAR(1000)',
+                                       'RefreshToken': 'VARCHAR(1000)',
+                                       'LastAccess': 'DATETIME',
+                                       'Reserved': 'VARCHAR(8) DEFAULT "no"'},
+                            'PrimaryKey': 'Session',
+                            'Engine': 'InnoDB'}}
+
+  def __init__(self):
+    """ Constructor
+    """
+    self.__permValues = ['USER', 'GROUP', 'VO', 'ALL']
+    self.__permAttrs = ['ReadAccess', 'PublishAccess']
+    DB.__init__(self, 'AuthDB', 'Framework/AuthDB')
+    retVal = self.__initializeDB()
+    if not retVal['OK']:
+      raise Exception("Can't create tables: %s" % retVal['Message'])
+
+  def _checkTable(self):
+    """ Make sure the tables are created
+    """
+    return self.__initializeDB()
+
+  def __initializeDB(self):
+    """ Create the tables
+    """
+    retVal = self._query("show tables")
+    if not retVal['OK']:
+      return retVal
+
+    tablesInDB = [t[0] for t in retVal['Value']]
+    tablesD = {}
+
+    if 'Sessions' not in tablesInDB:
+      tablesD['Sessions'] = self.tableDict['Sessions']
+
+    return self._createTables(tablesD)
+
+  def updateSessionsFromDB(self, idPs=None, IDs=None, session=None):
+    """ Get information about sessions
+
+        :param list idPs: list of identity providers that sessions need to update, if None - update all
+        :param list IDs: list of IDs that need to update, if None - update all
+        :param str session: session to update
+
+        :return: S_OK(dict)/S_ERROR()
+    """
+    resDict = {}
+    cond = []
+    if IDs:
+      cond.append('ID IN ("%s") ' % ", ".join(IDs))
+    if idPs:
+      cond.append('Provider IN ("%s") ' % ", ".join(idPs))
+    if session:
+      cond.append('Session = "%s" ' % session)
+    where = 'WHERE %s' % ' AND '.join(cond) if cond else ''
+    result = self._query("SELECT DISTINCT ID, Provider, Session, Status, Reserved FROM `Sessions` %s" % where)
+    if not result['OK']:
+      return result
+    for userID, idP, session, status, reserved in result['Value']:
+      resDict[session] = {'ID': userID, 'Provider': idP, 'Status': status, 'Reserved': reserved}
+      result = self.getSessionTokens(session)
+      if not result['OK']:
+        return result
+      resDict[session]['Tokens'] = result['Value'] or {}
+    return S_OK(resDict)
+
+  def createNewSession(self, provider, session=None):
+    """ Generates a state string to be used in authorizations
+
+        :param str provider: provider
+        :param str session: session number
+
+        :return: S_OK(str)/S_ERROR()
+    """
+    if not session:
+      result = self._query('SELECT Session FROM `Sessions`')
+      if not result['OK']:
+        return result
+      allSessions = [s[0] for s in result['Value']]
+      for i in range(100):
+        num = ''.join(random.choice(string.ascii_letters + string.digits) for x in range(30))
+        if num not in allSessions:
+          session = num
+          break
+
+    if not session:
+      return S_ERROR("Need to modify Session manager!")
+
+    reserved = 'yes' if self.isReservedSession(session) else 'no'
+    result = self.insertFields('Sessions', ['Session', 'Provider', 'Reserved', 'LastAccess'],
+                                           [session, provider, reserved, 'UTC_TIMESTAMP()'])
+    return S_OK(session) if result['OK'] else result
+
+  def isReservedSession(self, session):
+    """ Check if session is reseved
+
+        :param str session: session
+
+        :return: bool
+    """
+    return re.match('^reserved_.*', session or '')
+
+  def getSessionAuthLink(self, session):
+    """ Return authorization URL from session
+
+        :param str session: session id
+
+        :return: S_OK(str)/S_ERROR()
+    """
+    cond = 'TIMESTAMPDIFF(SECOND,LastAccess,UTC_TIMESTAMP()) < 300'
+    result = self.__getFields(['Comment'], cond=cond, Session=session, Status='prepared')
+    if not result['OK']:
+      return result
+    if not result['Value']:
+      return S_ERROR('%s session is change status or deleted.' % session)
+    url = result['Value']['Comment']
+    if not url:
+      return S_ERROR('No link found.')
+    result = self.updateSession(session, {'Status': 'in progress', 'Comment': ''})
+    if not result['OK']:
+      return result
+    return S_OK(url)
+
+  def getReservedSessions(self, userIDs=None, idPs=None):
+    """ Find reserved session
+
+        :param list userIDs: user ID
+        :param list idPs: provider
+
+        :return: S_OK(list)/S_ERROR() -- list contain dictionaries with information
+    """
+    cond = ['Reserved = "yes" AND Status = "authed"']
+    if idPs:
+      cond.append('Provider IN ("%s")' % '", "'.join(idPs))
+    if userIDs:
+      cond.append('ID IN ("%s")' % '", "'.join(userIDs))
+    return self.__getFields(['Session', 'Provider', 'ID'], cond=" AND ".join(cond))
+
+  def getSessionTokens(self, session):
+    """ Get tokens dict by session
+
+        :param str session: session number
+
+        :return: S_OK(dict)/S_ERROR()
+    """
+    return self.__getFields(["AccessToken", "ExpiresIn", "RefreshToken", "TokenType"], Session=session)
+
+  def getSessionProvider(self, session):
+    """ Get tokens dict by session
+
+        :param str session: session number
+
+        :return: S_OK(dict)/S_ERROR()
+    """
+    result = self.__getFields(['Provider'], Session=session)
+    return S_OK(result['Value']['Provider']) if result['OK'] else result
+
+  def getSessionStatus(self, session):
+    """ Get status dictionary by session id
+
+        :param str session: session id
+
+        :return: S_OK(dict)/S_ERROR()
+    """
+    return self.__getFields(fields=['ID', 'Session', 'Status', 'Comment', 'Provider'], Session=session)
+
+  def getSessionID(self, session):
+    """ Get user ID by session
+
+        :param str session: session
+
+        :return: S_OK(str)/S_ERROR()
+    """
+    result = self.__getFields(['ID'], Session=session)
+    return S_OK(result['Value']['ID']) if result['OK'] else result
+
+  def getSessionLifetime(self, session):
+    """ Get lifetime of session
+
+        :param str session: session number
+
+        :return: S_OK(int)/S_ERROR() -- lifetime in a seconds
+    """
+    result = self.__getFields(['ExpiresIn'], Session=session)
+    if result['OK']:
+      exp = result['Value']['ExpiresIn']
+      if not exp:
+        return S_OK(0)
+      result = self._query("SELECT TIME_TO_SEC(TIMEDIFF('%s', UTC_TIMESTAMP()))" % exp)
+
+    return S_OK(result['Value'][0][0]) if result['OK'] else result
+
+  def getZombieSessions(self):
+    """ Kill sessions with old states
+          SESSION_AUTHED --> kill if it's not reserved sessions and last access > 86400
+          SESSION_FAILED --> kill if last access > 15 min ago
+          SESSION_PREPARED --> kill if last access > 5 min ago
+          SESSION_PROGRESS --> kill if last access > 10 min ago
+          SESSION_REDIRECT --> kill if last access > 5 min ago
+          SESSION_FINISHING --> kill if last access > 5 min ago
+
+        :return: S_OK(dict)/S_ERROR() -- contain dictionary
+    """
+    cond = ['(Status NOT IN ("authed", "failed", "prepared", "in progress", "redirect", "finishing"))']
+    cond.append(" AND ".join(['(Status IN ("prepared", "redirect", "finishing")',
+                              'TIMESTAMPDIFF(SECOND,LastAccess,UTC_TIMESTAMP()) > 300)']))
+    cond.append('(Status = "in progress" AND TIMESTAMPDIFF(SECOND,LastAccess,UTC_TIMESTAMP()) > 600)')
+    cond.append('(Status = "failed" AND TIMESTAMPDIFF(SECOND,LastAccess,UTC_TIMESTAMP()) > 600)')
+    cond.append('(Status = "authed" AND Reserved = "no" AND TIMESTAMPDIFF(SECOND,LastAccess,UTC_TIMESTAMP()) > 86400)')
+    result = self.__getFields(['Session', 'Provider'], cond=' OR '.join(cond))
+    if not result['OK']:
+      return result
+    zombies = {}
+    sessions = result['Value']
+    self.log.info('Found %s old sessions for cleaning' % len(sessions))
+    for i in range(0, len(sessions)):
+      if 'Session' in sessions[i]:
+        session = sessions[i]['Session']
+        provider = sessions[i]['Provider']
+        if provider not in zombies:
+          zombies[provider] = []
+        zombies[provider].append(session)
+    return S_OK(zombies)
+
+  def killSession(self, session):
+    """ Remove session
+
+        :param str session: session id
+
+        :return: S_OK()/S_ERROR()
+    """
+    self.log.verbose(session, 'session kill..')
+    return self.deleteEntries('Sessions', condDict={'Session': session})
+
+  def updateSession(self, session, fieldsToUpdate=None, condDict=None):
+    """ Update session record
+
+        :params str session: session id
+        :param dict fieldsToUpdate: fields content that need to update
+        :param dict condDict: parameters that need add to search filter
+
+        :return: S_OK()/S_ERROR()
+    """
+    self.log.verbose(session, 'session update..')
+    condDict = condDict or {}
+    condDict['Session'] = session
+
+    fieldsToUpdate = fieldsToUpdate or {}
+    fieldsToUpdate['LastAccess'] = 'UTC_TIMESTAMP()'
+
+    # Convert seconds to datetime
+    if 'ExpiresIn' in fieldsToUpdate and isinstance(fieldsToUpdate['ExpiresIn'], int):
+      exp = fieldsToUpdate['ExpiresIn']
+      self.log.debug(session, 'session, convert access token live time %s seconds to date.' % exp)
+      result = self._query("SELECT ADDDATE(UTC_TIMESTAMP(), INTERVAL %s SECOND)" % exp)
+      if not result['OK']:
+        return result
+      # exp = result['Value'][0][0] if result['Value'] else 'UTC_TIMESTAMP()'
+      fieldsToUpdate['ExpiresIn'] = result['Value'][0][0] if result['Value'] else 'UTC_TIMESTAMP()'
+    return self.updateFields('Sessions', updateDict=fieldsToUpdate, condDict=condDict)
+
+  def __getFields(self, fields=None, cond=None, **kwargs):
+    """ Get list of dict of fields that found in DB
+
+        :param list fields: field names
+        :param str cond: search filter in records
+        :param str `**kwargs`: parameters that need add to search filter
+
+        :return: S_OK(list(dict), dict)/S_ERROR() -- if searching by session dict will return
+    """
+    fields = fields or self.tableDict['Sessions']['Fields'].keys()
+    cmd = 'SELECT %s FROM `Sessions` ' % ', '.join(fields)
+    buidCond = self.buildCondition(condDict=kwargs)
+    if cond:
+      buidCond += ' %s %s' % ('AND' if buidCond else 'WHERE', cond)
+    result = self._query(cmd + buidCond)
+    if not result['OK']:
+      return result
+
+    # Collect result with adding time stamp
+    resList = []
+    for i in range(0, len(result['Value'])):
+      d = {}
+      for j, field in list(enumerate(fields)):
+        d[field] = result['Value'][i][j]
+      if d:
+        resList.append(d)
+    if not resList and kwargs.get('Session') and len(kwargs) == 1 and not cond:
+      return S_ERROR('%s session no found.' % kwargs['Session'])
+    return S_OK(resList[0] if kwargs.get('Session') and resList else resList)
diff --git a/FrameworkSystem/DB/AuthDB.sql b/FrameworkSystem/DB/AuthDB.sql
new file mode 100644
index 00000000000..bfd422307e6
--- /dev/null
+++ b/FrameworkSystem/DB/AuthDB.sql
@@ -0,0 +1,2 @@
+# Everything is created by the DB object upon instantiation if it does not exists.
+use AuthDB;
\ No newline at end of file
diff --git a/FrameworkSystem/DB/ProxyDB.py b/FrameworkSystem/DB/ProxyDB.py
index a3f7a506926..e6851595726 100755
--- a/FrameworkSystem/DB/ProxyDB.py
+++ b/FrameworkSystem/DB/ProxyDB.py
@@ -24,9 +24,12 @@
 from DIRAC.ConfigurationSystem.Client.PathFinder import getDatabaseSection
 from DIRAC.FrameworkSystem.Client.NotificationClient import NotificationClient
 from DIRAC.Resources.ProxyProvider.ProxyProviderFactory import ProxyProviderFactory
+from DIRAC.FrameworkSystem.Client.AuthManagerData import gAuthManagerData
 
 
 class ProxyDB(DB):
+  """ Proxy database
+  """
 
   NOTIFICATION_TIMES = [2592000, 1296000]
 
@@ -34,6 +37,7 @@ def __init__(self,
                useMyProxy=False):
     DB.__init__(self, 'ProxyDB', 'Framework/ProxyDB')
     random.seed()
+    self.__version = 2
     self.__defaultRequestLifetime = 300  # 5min
     self.__defaultTokenLifetime = 86400 * 7  # 1 week
     self.__defaultTokenMaxUses = 50
@@ -49,7 +53,7 @@ def __init__(self,
   def getMyProxyServer(self):
     """ Get MyProxy server from configuration
 
-        :return: basestring
+        :return: str
     """
     return gConfig.getValue("/DIRAC/VOPolicy/MyProxyServer", "myproxy.cern.ch")
 
@@ -63,7 +67,7 @@ def getMyProxyMaxLifeTime(self):
   def getFromAddr(self):
     """ Get the From address to use in proxy expiry e-mails.
 
-        :return: basestring
+        :return: str
     """
     cs_path = getDatabaseSection(self.fullname)
     opt_path = "/%s/%s" % (cs_path, "FromAddr")
@@ -91,13 +95,11 @@ def __initializeDB(self):
                                      }
 
     if 'ProxyDB_CleanProxies' not in tablesInDB:
-      tablesD['ProxyDB_CleanProxies'] = {'Fields': {'UserName': 'VARCHAR(64) NOT NULL',
-                                                    'UserDN': 'VARCHAR(255) NOT NULL',
-                                                    'ProxyProvider': 'VARCHAR(64) DEFAULT "Certificate"',
+      tablesD['ProxyDB_CleanProxies'] = {'Fields': {'UserDN': 'VARCHAR(255) NOT NULL',
                                                     'Pem': 'BLOB',
                                                     'ExpirationTime': 'DATETIME',
                                                     },
-                                         'PrimaryKey': ['UserDN', 'ProxyProvider']
+                                         'PrimaryKey': 'UserDN'
                                          }
     # WARN: Now proxies upload only in ProxyDB_CleanProxies, so this table will not be needed in some future
     if 'ProxyDB_Proxies' not in tablesInDB:
@@ -124,9 +126,9 @@ def __initializeDB(self):
 
     if 'ProxyDB_Log' not in tablesInDB:
       tablesD['ProxyDB_Log'] = {'Fields': {'ID': 'BIGINT NOT NULL AUTO_INCREMENT',
-                                           'IssuerDN': 'VARCHAR(255) NOT NULL',
+                                           'IssuerUsername': 'VARCHAR(255) NOT NULL',
                                            'IssuerGroup': 'VARCHAR(255) NOT NULL',
-                                           'TargetDN': 'VARCHAR(255) NOT NULL',
+                                           'TargetUsername': 'VARCHAR(255) NOT NULL',
                                            'TargetGroup': 'VARCHAR(255) NOT NULL',
                                            'Action': 'VARCHAR(128) NOT NULL',
                                            'Timestamp': 'DATETIME',
@@ -137,7 +139,7 @@ def __initializeDB(self):
 
     if 'ProxyDB_Tokens' not in tablesInDB:
       tablesD['ProxyDB_Tokens'] = {'Fields': {'Token': 'VARCHAR(64) NOT NULL',
-                                              'RequesterDN': 'VARCHAR(255) NOT NULL',
+                                              'RequesterUsername': 'VARCHAR(255) NOT NULL',
                                               'RequesterGroup': 'VARCHAR(255) NOT NULL',
                                               'ExpirationTime': 'DATETIME NOT NULL',
                                               'UsesLeft': 'SMALLINT UNSIGNED DEFAULT 1',
@@ -159,7 +161,7 @@ def __initializeDB(self):
   def __addUserNameToTable(self, tableName):
     """ Add user name to the table
 
-        :param basestring tableName: table name
+        :param str tableName: table name
 
         :return: S_OK()/S_ERROR()
     """
@@ -196,7 +198,12 @@ def __checkDBVersion(self):
 
         :return: S_OK()/S_ERROR()
     """
-    for tableName in ("ProxyDB_CleanProxies", "ProxyDB_Proxies", "ProxyDB_VOMSProxies"):
+    if self.versionDB == self.__version:  # pylint: disable=no-member
+      return S_OK()
+    if self.versionDB > self.__version:  # pylint: disable=no-member
+      return S_ERROR('Already installed newer DB version "%s".' % self.versionDB)  # pylint: disable=no-member
+
+    for tableName in ("ProxyDB_Proxies", "ProxyDB_VOMSProxies"):
       result = self._query("describe `%s`" % tableName)
       if not result['OK']:
         return result
@@ -206,11 +213,36 @@ def __checkDBVersion(self):
         if not result['OK']:
           return result
 
-  def generateDelegationRequest(self, proxyChain, userDN):
+    if self.versionDB == 0 and self.versionDB < self.__version:  # pylint: disable=no-member
+      for tb, oldColumn, newColumn in [('ProxyDB_Log', 'IssuerDN', 'IssuerUsername'),
+                                       ('ProxyDB_Log', 'TargetDN', 'TargetUsername'),
+                                       ('ProxyDB_Tokens', 'RequesterDN', 'RequesterUsername')]:
+        result = self._query("SHOW COLUMNS FROM `%s` LIKE '%s'" % (tb, oldColumn))
+        if result['OK'] and len(result['Value']) > 0:
+          result = self._query('ALTER TABLE %s CHANGE COLUMN %s %s VARCHAR(255) NOT NULL' % (tb, oldColumn, newColumn))
+        if not result['OK']:
+          return result
+      result = self.updateDBVersion(1)  # pylint: disable=no-member
+      if not result['OK']:
+        return result
+
+    if self.versionDB == 1 and self.versionDB < self.__version:  # pylint: disable=no-member
+      for column in ['UserName', 'ProxyProvider']:
+        result = self._query("SHOW COLUMNS FROM `ProxyDB_CleanProxies` LIKE '%s'" % column)
+        if result['OK'] and len(result['Value']) > 0:
+          result = self._query('ALTER TABLE ProxyDB_CleanProxies DROP COLUMN %s' % column)
+        if not result['OK']:
+          return result
+      result = self.updateDBVersion(2)  # pylint: disable=no-member
+      if not result['OK']:
+        return result
+
+    return S_OK()
+
+  def generateDelegationRequest(self, credDict):
     """ Generate a request and store it for a given proxy Chain
 
-        :param X509Chain() proxyChain: proxy as chain
-        :param basestring userDN: user DN
+        :param dict credDict: dictionary that contain proxy as chain
 
         :return: S_OK(dict)/S_ERROR() -- dict contain id and proxy as string of the request
     """
@@ -218,7 +250,7 @@ def generateDelegationRequest(self, proxyChain, userDN):
     if not retVal['OK']:
       return retVal
     connObj = retVal['Value']
-    retVal = proxyChain.generateProxyRequest()
+    retVal = credDict['x509Chain'].generateProxyRequest()
     if not retVal['OK']:
       return retVal
     request = retVal['Value']
@@ -231,14 +263,13 @@ def generateDelegationRequest(self, proxyChain, userDN):
       return retVal
     allStr = reqStr + retVal['Value']
     try:
-      sUserDN = self._escapeString(userDN)['Value']
+      sDN = self._escapeString(credDict['DN'])['Value']
       sAllStr = self._escapeString(allStr)['Value']
     except KeyError:
       return S_ERROR("Cannot escape DN")
-    cmd = "INSERT INTO `ProxyDB_Requests` ( Id, UserDN, Pem, ExpirationTime )"
-    cmd += " VALUES ( 0, %s, %s, TIMESTAMPADD( SECOND, %d, UTC_TIMESTAMP() ) )" % (sUserDN,
-                                                                                   sAllStr,
-                                                                                   int(self.__defaultRequestLifetime))
+    cmd = "INSERT INTO `ProxyDB_Requests` (UserDN, Pem, ExpirationTime) VALUES "
+    cmd += "(%s, %s, TIMESTAMPADD(SECOND, %d, UTC_TIMESTAMP()))" % (sDN, sAllStr,
+                                                                    int(self.__defaultRequestLifetime))
     retVal = self._update(cmd, conn=connObj)
     if not retVal['OK']:
       return retVal
@@ -252,8 +283,7 @@ def generateDelegationRequest(self, proxyChain, userDN):
     data = retVal['Value']
     if not data:
       return S_ERROR("Insertion of the request in the db didn't work as expected")
-    userGroup = proxyChain.getDIRACGroup().get('Value') or "unset"
-    self.logAction("request upload", userDN, userGroup, userDN, "any")
+    self.logAction("request upload", credDict['username'], credDict['group'], credDict['username'], "any")
     # Here we go!
     return S_OK({'id': data[0][0], 'request': reqStr})
 
@@ -261,26 +291,25 @@ def __retrieveDelegationRequest(self, requestId, userDN):
     """ Retrieve a request from the DB
 
         :param int requestId: id of the request
-        :param basestring userDN: user DN
+        :param str userDN: user DN
 
-        :return: S_OK(basestring)/S_ERROR()
+        :return: S_OK(str)/S_ERROR()
     """
-    try:
-      sUserDN = self._escapeString(userDN)['Value']
-    except KeyError:
+    result = self._escapeString(userDN)
+    if not result['OK']:
       return S_ERROR("Cannot escape DN")
+    sUserDN = result['Value']
+
     cmd = "SELECT Pem FROM `ProxyDB_Requests` WHERE Id = %s AND UserDN = %s" % (requestId, sUserDN)
-    retVal = self._query(cmd)
-    if not retVal['OK']:
-      return retVal
-    data = retVal['Value']
-    if len(data) == 0:
-      return S_ERROR("No requests with id %s" % requestId)
-    request = X509Request()
-    retVal = request.loadAllFromString(data[0][0])
-    if not retVal['OK']:
-      return retVal
-    return S_OK(request)
+    result = self._query(cmd)
+    if result['OK']:
+      data = result['Value']
+      if len(data) == 0:
+        return S_ERROR("No requests with id %s" % requestId)
+      request = X509Request()
+      result = request.loadAllFromString(data[0][0])
+
+    return S_OK(request) if result['OK'] else result
 
   def purgeExpiredRequests(self):
     """ Purge expired requests from the db
@@ -304,8 +333,8 @@ def completeDelegation(self, requestId, userDN, delegatedPem):
     """ Complete a delegation and store it in the db
 
         :param int requestId: id of the request
-        :param basestring userDN: user DN
-        :param basestring delegatedPem: delegated proxy as string
+        :param str userDN: DN
+        :param str delegatedPem: delegated proxy as string
 
         :return: S_OK()/S_ERROR()
     """
@@ -332,64 +361,48 @@ def completeDelegation(self, requestId, userDN, delegatedPem):
       # WARN: Since v7r1, DIRAC has implemented proxyProviders and ProxyDB_CleanProxies,
       # WARN:   which has helped implement the ability to store only one proxy and
       # WARN:   dynamically add a group at the request of a proxy. This means that group extensions
-      # WARN:   doesn't need for storing proxies, but for compatibility with older versions,
-      # WARN:   the following block has been added to store proxies with group extensions.
-      self.log.warn("Proxies with DIRAC group extensions must be not allowed to be uploaded:", retVal['Value'])
-      retVal = chain.getDIRACGroup()
-      if not retVal['OK']:
-        return retVal
-      userGroup = retVal['Value'] or Registry.getDefaultUserGroup()
-      retVal = Registry.getGroupsForDN(userDN)
-      if not retVal['OK']:
-        return retVal
-      if userGroup not in retVal['Value']:
-        return S_ERROR("%s group is not valid for %s" % (userGroup, userDN))
-      retVal = chain.isValidProxy(ignoreDefault=True)
-      if not retVal['OK'] and DErrno.cmpError(retVal, DErrno.ENOGROUP):
-        retVal = self.deleteProxy(userDN)
-        if not retVal['OK']:
-          return retVal
-      retVal = self.__storeProxyOld(userDN, userGroup, chain)
-      # WARN: End of compatibility block
-    else:
-      retVal = self.__storeProxy(userDN, chain)
-    if not retVal['OK']:
-      return retVal
-    retVal = self.deleteRequest(requestId)
-    if not retVal['OK']:
-      return retVal
-    return S_OK()
+      # WARN:   doesn't need for storing proxies.
+      return S_ERROR("Proxies with DIRAC group extensions not allowed to be uploaded.")
+
+    result = self._storeProxy(userDN, chain)
+
+    return self.deleteRequest(requestId) if result['OK'] else result
+
+  def _isProxyExist(self, userDN, timeleft=None):
+    """ Check if proxy present in DB
+
+        :param str userDN: user DN
+        :param int timeleft: requirement time
+
+        :return: S_OK()/S_ERROR()
+    """
+    result = self._escapeString(userDN)
+    if not result['OK']:
+      return result
+    sUserDN = result['Value']
+    cmd = 'SELECT * FROM ProxyDB_CleanProxies WHERE UserDN = %s' % sUserDN
+    if timeleft:
+      cmd += ' AND TIMESTAMPDIFF(SECOND, UTC_TIMESTAMP(), ExpirationTime) > %s' % timeleft
+    result = self._query(cmd)
+    return S_OK(True if result['Value'] else False) if result['OK'] else result
 
-  def __storeProxy(self, userDN, chain, proxyProvider=None):
+  def _storeProxy(self, userDN, chain):
     """ Store user proxy into the Proxy repository for a user specified by his
         DN and group or proxy provider.
 
-        :param basestring userDN: user DN from proxy
+        :param str userDN: user DN from proxy
         :param X509Chain() chain: proxy chain
-        :param basestring proxyProvider: proxy provider name
 
         :return: S_OK()/S_ERROR()
     """
-    retVal = Registry.getUsernameForDN(userDN)
-    if not retVal['OK']:
-      return retVal
-    userName = retVal['Value']
-
-    if not proxyProvider:
-      result = Registry.getProxyProvidersForDN(userDN)
-      if not result['OK']:
-        return result
-      proxyProvider = result.get('Value') and result['Value'][0] or 'Certificate'
-
     # Get remaining secs
     retVal = chain.getRemainingSecs()
     if not retVal['OK']:
       return retVal
     remainingSecs = retVal['Value']
     if remainingSecs < self._minSecsToAllowStore:
-      return S_ERROR(
-          "Cannot store proxy, remaining secs %s is less than %s" %
-          (remainingSecs, self._minSecsToAllowStore))
+      return S_ERROR("Cannot store proxy, remaining secs %s is less than %s" %
+                     (remainingSecs, self._minSecsToAllowStore))
 
     # Compare the DNs
     retVal = chain.getIssuerCert()
@@ -414,58 +427,110 @@ def __storeProxy(self, userDN, chain, proxyProvider=None):
 
     try:
       sUserDN = self._escapeString(userDN)['Value']
-      sTable = 'ProxyDB_CleanProxies'
     except KeyError:
       return S_ERROR("Cannot escape DN")
     # Check what we have already got in the repository
     cmd = "SELECT TIMESTAMPDIFF( SECOND, UTC_TIMESTAMP(), ExpirationTime ), Pem "
-    cmd += "FROM `%s` WHERE UserDN=%s " % (sTable, sUserDN)
+    cmd += "FROM `ProxyDB_CleanProxies` WHERE UserDN=%s " % sUserDN
     result = self._query(cmd)
     if not result['OK']:
       return result
+    data = result['Value']
 
     # Check if there is a previous ticket for the DN
-    data = result['Value']
-    sqlInsert = True
+    pemChain = chain.dumpAllToString()['Value']
+    dValues = {'UserDN': sUserDN, 'Pem': self._escapeString(pemChain)['Value'],
+               'ExpirationTime': 'TIMESTAMPADD( SECOND, %d, UTC_TIMESTAMP() )' % int(remainingSecs)}
+    cmd = "INSERT INTO `ProxyDB_CleanProxies` (%s) VALUES (%s)" % (", ".join(dValues.keys()),
+                                                                   ", ".join(dValues.values()))
     if data:
-      sqlInsert = False
+      cmd = 'UPDATE `ProxyDB_CleanProxies` SET %s WHERE UserDN = %s' % (
+          ", ".join(["%s = %s" % (k, v) for k, v in dValues.items()]), sUserDN)
       pem = data[0][1]
       if pem:
         remainingSecsInDB = data[0][0]
         if remainingSecs <= remainingSecsInDB:
-          self.log.info(
-              "Proxy stored is longer than uploaded, omitting.",
-              "%s in uploaded, %s in db" %
-              (remainingSecs,
-               remainingSecsInDB))
+          self.log.info("Proxy stored is longer than uploaded, omitting.",
+                        "%s in uploaded, %s in db" % (remainingSecs, remainingSecsInDB))
           return S_OK()
 
-    pemChain = chain.dumpAllToString()['Value']
-    dValues = {'UserName': self._escapeString(userName)['Value'],
-               'UserDN': sUserDN,
-               'Pem': self._escapeString(pemChain)['Value'],
-               'ExpirationTime': 'TIMESTAMPADD( SECOND, %d, UTC_TIMESTAMP() )' % int(remainingSecs)}
-    dValues['ProxyProvider'] = "'%s'" % proxyProvider
-    if sqlInsert:
-      sqlFields = []
-      sqlValues = []
-      for key in dValues:
-        sqlFields.append(key)
-        sqlValues.append(dValues[key])
-      cmd = "INSERT INTO `%s` ( %s ) VALUES ( %s )" % (sTable, ", ".join(sqlFields), ", ".join(sqlValues))
-    else:
-      sqlSet = []
-      sqlWhere = []
-      for k in dValues:
-        if k in ('UserDN', 'ProxyProvider'):
-          sqlWhere.append("%s = %s" % (k, dValues[k]))
-        else:
-          sqlSet.append("%s = %s" % (k, dValues[k]))
-      cmd = "UPDATE `%s` SET %s WHERE %s" % (sTable, ", ".join(sqlSet), " AND ".join(sqlWhere))
+    retVal = Registry.getUsernameForDN(userDN)
+    if not retVal['OK']:
+      return retVal
+    userName = retVal['Value']
 
-    self.logAction("store proxy", userDN, proxyProvider, userDN, proxyProvider)
+    self.logAction("store proxy", userName, 'any', userName, 'any')
     return self._update(cmd)
 
+  def __getPemAndTimeLeft(self, userDN, userGroup, requiredLifeTime=None, vomsAttr=None):
+    """ Get proxy from DB and add group
+
+        :param str userDN: user DN
+        :param str userGroup: required DIRAC group
+        :param int requiredLifeTime: required proxy live time in a seconds
+        :param str vomsAttr: if need search VOMS proxy first
+
+        :return: S_OK(tuple)/S_ERROR() -- tuple with proxy as chain and proxy live time in a seconds
+    """
+    cmd = 'SELECT Pem, TIMESTAMPDIFF(SECOND, UTC_TIMESTAMP(), ExpirationTime) FROM '
+    cmd += '`%%s` WHERE UserDN="%s" AND TIMESTAMPDIFF(SECOND, UTC_TIMESTAMP(), ExpirationTime) > 0' % userDN
+    if vomsAttr:
+      # Search VOMS proxy first
+      result = self._query(cmd % 'ProxyDB_VOMSProxies' + " AND VOMSAttr=%s AND UserGroup=%s" % (vomsAttr, userGroup))
+      if not result['OK']:
+        result = self._query(cmd % 'ProxyDB_CleanProxies')
+    else:
+      result = self._query(cmd % 'ProxyDB_CleanProxies')
+    err = "%s@%s proxy" % (userDN, userGroup)
+    if not result['OK']:
+      return S_ERROR("%s getting error: %s" % (err, result['Message']))
+    data = result['Value']
+    if data and data[0][0]:
+      if requiredLifeTime and data[0][1] <= requiredLifeTime:
+        return S_ERROR("%s stored in DB, but with less live time that required " % err)
+      chain = X509Chain()
+      result = chain.loadProxyFromString(data[0][0])
+      if result['OK']:
+        result = chain.generateProxyToString(requiredLifeTime or min(
+            3600 * 12, data[0][1]), diracGroup=userGroup, rfc=True)
+      if not result['OK']:
+        return S_ERROR("%s exist in DB, but %s" % (err, result['Message']))
+      return S_OK((result['Value'], requiredLifeTime))
+    return S_ERROR("%s with %s group is absent in DB" % (userDN, userGroup))
+
+  def __generateProxyForDNGroup(self, userDN, userGroup, requiredLifeTime):
+    """ Generate proxy from proxy provider and store it to DB
+
+        :param str userDN: user DN
+        :param str userGroup: required DIRAC group
+        :param int requiredLifeTime: required proxy live time in a seconds
+
+        :return: S_OK(tuple)/S_ERROR() -- tuple with proxy as chain and proxy live time in a seconds
+    """
+    # Try to get proxy
+    result = self.getProxyProviderForDN(userDN)
+    if not result['OK']:
+      return result
+    if result['Value'] == 'Certificate':
+      return S_ERROR('No proxy provider found for this DN, need to upload proxy')
+
+    result = ProxyProviderFactory().getProxyProvider(result['Value'], proxyManager=self)
+    if not result['OK']:
+      return result
+    providerObj = result['Value']
+
+    # Generate the proxy and store in the DB
+    result = providerObj.getProxy(userDN)
+    if not result['OK']:
+      return result
+    chain = result['Value']
+
+    # Add group
+    result = chain.generateProxyToString(requiredLifeTime, diracGroup=userGroup, rfc=True)
+    if not result['OK']:
+      return S_ERROR("Cannot generate proxy: %s" % result['Message'])
+    return S_OK((result['Value'], requiredLifeTime))
+
   def purgeExpiredProxies(self, sendNotifications=True):
     """ Purge expired requests from the db
 
@@ -487,47 +552,36 @@ def purgeExpiredProxies(self, sendNotifications=True):
         return result
     return S_OK(purged)
 
-  def deleteProxy(self, userDN, userGroup=None, proxyProvider=None):
+  def deleteProxy(self, userDN):
     """ Remove proxy of the given user from the repository
 
-        :param basestring userDN: user DN
-        :param basestring userGroup: DIRAC group
-        :param basestring proxyProvider: proxy provider name
+        :param str userDN: user DN
 
         :return: S_OK()/S_ERROR()
     """
-    try:
-      userDN = self._escapeString(userDN)['Value']
-      if userGroup:
-        userGroup = self._escapeString(userGroup)['Value']
-      if proxyProvider:
-        proxyProvider = self._escapeString(proxyProvider)['Value']
-    except KeyError:
-      return S_ERROR("Invalid DN or group or proxy provider")
+    tables = ['ProxyDB_Proxies', 'ProxyDB_VOMSProxies', 'ProxyDB_CleanProxies']
+    result = self._escapeString(userDN)
+    if not result['OK']:
+      return S_ERROR("Invalid DN: %s" % result['Message'])
+    userDN = result['Value']
     errMsgs = []
     req = "DELETE FROM `%%s` WHERE UserDN=%s" % userDN
-    if proxyProvider or not userGroup:
-      result = self._update('%s %s' % (req % 'ProxyDB_CleanProxies',
-                                       proxyProvider and 'AND ProxyProvider=%s' % proxyProvider or ''))
-      if not result['OK']:
-        errMsgs.append(result['Message'])
-    for table in ['ProxyDB_Proxies', 'ProxyDB_VOMSProxies']:
-      result = self._update('%s %s' % (req % table,
-                                       userGroup and 'AND UserGroup=%s' % userGroup or ''))
+    for table in tables:
+      result = self._update(req % table)
       if not result['OK']:
         if result['Message'] not in errMsgs:
           errMsgs.append(result['Message'])
-    if errMsgs:
-      return S_ERROR(', '.join(errMsgs))
-    return result
 
-  def __getPemAndTimeLeft(self, userDN, userGroup=None, vomsAttr=None, proxyProvider=None):
+    return S_ERROR(', '.join(errMsgs)) if errMsgs else result
+
+  # WARN: Old method for compatibility with older versions v7r0-
+  @deprecated("Only for DIRAC v6")
+  def __getPemAndTimeLeftOld(self, userDN, userGroup, vomsAttr=None):
     """ Get proxy from database
 
-        :param basestring userDN: user DN
-        :param basestring userGroup: requested DIRAC group
-        :param basestring vomsAttr: VOMS name
-        :param basestring proxyProvider: proxy provider name
+        :param str userDN: user DN
+        :param str userGroup: requested DIRAC group
+        :param str vomsAttr: VOMS name
 
         :return: S_OK(tuple)/S_ERROR() -- tuple contain proxy as string and remaining seconds
     """
@@ -539,52 +593,36 @@ def __getPemAndTimeLeft(self, userDN, userGroup=None, vomsAttr=None, proxyProvid
         sVomsAttr = self._escapeString(vomsAttr)['Value']
     except KeyError:
       return S_ERROR("Invalid DN or Group")
-    if proxyProvider:
-      sTable = "`ProxyDB_CleanProxies`"
-    elif not vomsAttr:
+    if not vomsAttr:
       sTable = "`ProxyDB_Proxies`"
     else:
       sTable = "`ProxyDB_VOMSProxies`"
     cmd = "SELECT Pem, TIMESTAMPDIFF( SECOND, UTC_TIMESTAMP(), ExpirationTime ) from %s " % sTable
     cmd += "WHERE UserDN=%s AND TIMESTAMPDIFF( SECOND, UTC_TIMESTAMP(), ExpirationTime ) > 0" % (sUserDN)
-    if proxyProvider:
-      cmd += ' AND ProxyProvider="%s"' % proxyProvider
-    else:
-      if userGroup:
-        cmd += " AND UserGroup=%s" % sUserGroup
-      if vomsAttr:
-        cmd += " AND VOMSAttr=%s" % sVomsAttr
+    if userGroup:
+      cmd += " AND UserGroup=%s" % sUserGroup
+    if vomsAttr:
+      cmd += " AND VOMSAttr=%s" % sVomsAttr
     retVal = self._query(cmd)
     if not retVal['OK']:
       return retVal
     data = retVal['Value']
     for record in data:
       if record[0]:
-        if proxyProvider:
-          chain = X509Chain()
-          result = chain.loadProxyFromString(record[0])
-          if not result['OK']:
-            return result
-          result = chain.generateProxyToString(record[1], diracGroup=userGroup, rfc=True)
-          if not result['OK']:
-            return result
-          return S_OK((result['Value'], record[1]))
         return S_OK((record[0], record[1]))
-    if userGroup:
-      userMask = "%s@%s" % (userDN, userGroup)
-    else:
-      userMask = userDN
+    userMask = "%s@%s" % (userDN, userGroup)
     return S_ERROR("%s has no proxy registered" % userMask)
 
+  # WARN: This proxy manager work as myproxy, it seems we no use an external myproxy anymore
   def renewFromMyProxy(self, userDN, userGroup, lifeTime=None, chain=None):
     """ Renew proxy from MyProxy
 
-        :param basestring userDN: user DN
-        :param basestring userGroup: user group
+        :param str userDN: user DN
+        :param str userGroup: user group
         :param int lifeTime: needed proxy live time in a seconds
-        :param X509Chain chain: proxy as chain
+        :param object chain: proxy as X509Chain
 
-        :return: S_OK(X509Chain/S_ERROR()
+        :return: S_OK(X509Chain)/S_ERROR()
     """
     if not lifeTime:
       lifeTime = 43200
@@ -637,7 +675,7 @@ def renewFromMyProxy(self, userDN, userGroup, lifeTime=None, chain=None):
     chainGroup = retVal['Value']
     if chainGroup != userGroup:
       return S_ERROR("Mismatch between renewed proxy group and expected: %s vs %s" % (userGroup, chainGroup))
-    retVal = self.__storeProxy(userDN, userGroup, mpChain)
+    retVal = self.__storeProxyOld(userDN, userGroup, mpChain)
     if not retVal['OK']:
       self.log.error("Cannot store proxy after renewal", retVal['Message'])
     retVal = myProxy.getServiceDN()
@@ -648,284 +686,77 @@ def renewFromMyProxy(self, userDN, userGroup, lifeTime=None, chain=None):
     self.logAction("myproxy renewal", hostDN, "host", userDN, userGroup)
     return S_OK(mpChain)
 
-  # WARN: this method will not be needed if CS section Users/<user>/DNProperties will be for every user
-  # in this case will be used proxy providers that described there
-  def __getPUSProxy(self, userDN, userGroup, requiredLifetime, requestedVOMSAttr=False):
-    result = Registry.getGroupsForDN(userDN)
-    if not result['OK']:
-      return result
-
-    validGroups = result['Value']
-    if userGroup not in validGroups:
-      return S_ERROR('Invalid group %s for user' % userGroup)
-
-    voName = Registry.getVOForGroup(userGroup)
-    if not voName:
-      return S_ERROR('Can not determine VO for group %s' % userGroup)
-
-    retVal = self.__getVOMSAttribute(userGroup, requestedVOMSAttr)
-    if not retVal['OK']:
-      return retVal
-    vomsAttribute = retVal['Value']['attribute']
-    vomsVO = retVal['Value']['VOMSVO']
-
-    puspServiceURL = Registry.getVOOption(voName, 'PUSPServiceURL')
-    if not puspServiceURL:
-      return S_ERROR('Can not determine PUSP service URL for VO %s' % voName)
-
-    user = userDN.split(":")[-1]
-
-    puspURL = "%s?voms=%s:%s&proxy-renewal=false&disable-voms-proxy=false" \
-              "&rfc-proxy=true&cn-label=user:%s" % (puspServiceURL, vomsVO, vomsAttribute, user)
-
-    try:
-      proxy = urlopen(puspURL).read()
-    except Exception:
-      return S_ERROR('Failed to get proxy from the PUSP server')
-
-    chain = X509Chain()
-    chain.loadChainFromString(proxy)
-    chain.loadKeyFromString(proxy)
+  def getProxy(self, userDN, userGroup, requiredLifeTime=None, voms=False):
+    """ Get proxy string from the Proxy Repository for use with userDN in the userGroup
 
-    result = chain.getCredentials()
-    if not result['OK']:
-      return S_ERROR('Failed to get a valid PUSP proxy')
-    credDict = result['Value']
-    if credDict['identity'] != userDN:
-      return S_ERROR('Requested DN does not match the obtained one in the PUSP proxy')
-    timeLeft = credDict['secondsLeft']
-
-    result = chain.generateProxyToString(timeLeft, diracGroup=userGroup)
-    if not result['OK']:
-      return result
-    proxyString = result['Value']
-    return S_OK((proxyString, timeLeft))
-
-  def __generateProxyFromProxyProvider(self, userDN, proxyProvider):
-    """ Get proxy from proxy provider
-
-        :param basestring userDN: user DN for what need to create proxy
-        :param basestring proxyProvider: proxy provider name that will ganarete proxy
-
-        :return: S_OK(dict)/S_ERROR() -- dict with remaining seconds, proxy as a string and as a chain
-    """
-    gLogger.info('Getting proxy from proxyProvider', '(for "%s" DN by "%s")' % (userDN, proxyProvider))
-    result = ProxyProviderFactory().getProxyProvider(proxyProvider)
-    if not result['OK']:
-      return result
-    pp = result['Value']
-    result = pp.getProxy(userDN)
-    if not result['OK']:
-      return result
-    proxyStr = result['Value']
-    chain = X509Chain()
-    result = chain.loadProxyFromString(proxyStr)
-    if not result['OK']:
-      return result
-    result = chain.getRemainingSecs()
-    if not result['OK']:
-      return result
-    remainingSecs = result['Value']
-    result = self.__storeProxy(userDN, chain, proxyProvider)
-    if result['OK']:
-      return S_OK({'proxy': proxyStr, 'chain': chain, 'remainingSecs': remainingSecs})
-    return result
-
-  def __getProxyFromProxyProviders(self, userDN, userGroup, requiredLifeTime):
-    """ Generate new proxy from exist clean proxy or from proxy provider
-        for use with userDN in the userGroup
-
-        :param basestring userDN: user DN
-        :param basestring userGroup: required group name
+        :param str userDN: user DN
+        :param str userGroup: required DIRAC group
         :param int requiredLifeTime: required proxy live time in a seconds
+        :param bool voms: if need VOMS attribute
 
-        :return: S_OK(tuple)/S_ERROR() -- tuple contain proxy as string and remainig seconds
+        :return: S_OK(tuple)/S_ERROR() -- tuple with proxy as chain and proxy live time in a seconds
     """
-    result = Registry.getGroupsForDN(userDN)
-    if not result['OK']:
-      return S_ERROR('Cannot generate proxy: %s' % result['Message'])
-    if userGroup not in result['Value']:
-      return S_ERROR('Cannot generate proxy: Invalid group %s for user' % userGroup)
-    result = Registry.getProxyProvidersForDN(userDN)
-
-    errMsgs = []
-    if result['OK']:
-      providers = result['Value']
-      providers.append('Certificate')
-      for proxyProvider in providers:
-        self.log.verbose('Try to get proxy from ProxyDB_CleanProxies')
-        result = self.__getPemAndTimeLeft(userDN, userGroup, proxyProvider=proxyProvider)
-        if result['OK'] and (not requiredLifeTime or result['Value'][1] > requiredLifeTime):
-          return result
-        if len(providers) == 1:
-          return S_ERROR('Cannot generate proxy: No proxy providers found for "%s"' % userDN)
-        self.log.verbose('Try to generate proxy from %s proxy provider' % proxyProvider)
-        result = self.__generateProxyFromProxyProvider(userDN, proxyProvider)
-        if result['OK']:
-          chain = result['Value']['chain']
-          remainingSecs = result['Value']['remainingSecs']
-          result = chain.generateProxyToString(remainingSecs, diracGroup=userGroup, rfc=True)
-          if result['OK']:
-            return S_OK((result['Value'], remainingSecs))
-        errMsgs.append('"%s": %s' % (proxyProvider, result['Message']))
+    vomsAttr = Registry.getVOMSAttributeForGroup(userGroup)
+    if not vomsAttr and voms:
+      return S_ERROR("No mapping defined for group %s in the CS" % userGroup)
 
-    return S_ERROR('Cannot generate proxy%s' % (errMsgs and ': ' + ', '.join(errMsgs) or ''))
+    # Standard proxy is requested
+    self.log.verbose('Try to get proxy from ProxyDB_CleanProxies')
+    result = self.__getPemAndTimeLeft(userDN, userGroup, requiredLifeTime, voms and vomsAttr)
+    if not result['OK']:
 
-  def getProxy(self, userDN, userGroup, requiredLifeTime=None):
-    """ Get proxy string from the Proxy Repository for use with userDN
-        in the userGroup
+      # WARN: for compatibility
+      result = self.__getPemAndTimeLeftOld(userDN, userGroup, voms and vomsAttr)
+      if not result['OK'] or requiredLifeTime and result['Value'][1] < requiredLifeTime:
 
-        :param basestring userDN: user DN
-        :param basestring userGroup: required DIRAC group
-        :param int requiredLifeTime: required proxy live time in a seconds
+        errMsg = result.get('Message') or 'Stored proxy have not enough lifetime'
+        result = self.__generateProxyForDNGroup(userDN, userGroup, requiredLifeTime)
+        if not result['OK']:
+          return S_ERROR('%s; %s' % (errMsg, result['Message']))
 
-        :return: S_OK(tuple)/S_ERROR() -- tuple with proxy as chain and proxy live time in a seconds
-    """
-    # Test that group enable to download
-    if not Registry.isDownloadableGroup(userGroup):
-      return S_ERROR('"%s" group is disable to download.' % userGroup)
-
-    # WARN: this block will not be needed if CS section Users/<user>/DNProperties will be for every user
-    # in this case will be used proxy providers that described there
-    # Get the Per User SubProxy if one is requested
-    if isPUSPdn(userDN):
-      result = self.__getPUSProxy(userDN, userGroup, requiredLifeTime)
-      if not result['OK']:
-        return result
-      pemData = result['Value'][0]
-      timeLeft = result['Value'][1]
-      chain = X509Chain()
-      result = chain.loadProxyFromString(pemData)
-      if not result['OK']:
-        return result
-      return S_OK((chain, timeLeft))
+    pemData, timeLeft = result['Value']
 
-    # Standard proxy is requested
-    self.log.verbose('Try to get proxy from ProxyDB_Proxies')
-    retVal = self.__getPemAndTimeLeft(userDN, userGroup)
-    errMsg = "Can't get proxy%s: " % (requiredLifeTime and ' for %s seconds' % requiredLifeTime or '')
-    if not retVal['OK']:
-      errMsg += '%s, try to generate new' % retVal['Message']
-      retVal = self.__getProxyFromProxyProviders(userDN, userGroup, requiredLifeTime=requiredLifeTime)
-    elif requiredLifeTime:
-      if retVal['Value'][1] < requiredLifeTime and not self.__useMyProxy:
-        errMsg += 'Stored proxy is not long lived enough, try to generate new'
-        retVal = self.__getProxyFromProxyProviders(userDN, userGroup, requiredLifeTime=requiredLifeTime)
-    if not retVal['OK']:
-      return S_ERROR("%s; %s" % (errMsg, retVal['Message']))
-    pemData = retVal['Value'][0]
-    timeLeft = retVal['Value'][1]
     chain = X509Chain()
     result = chain.loadProxyFromString(pemData)
-    if not retVal['OK']:
-      return S_ERROR("%s; %s" % (errMsg, retVal['Message']))
-    if self.__useMyProxy:
-      if requiredLifeTime:
-        if timeLeft < requiredLifeTime:
-          retVal = self.renewFromMyProxy(userDN, userGroup, lifeTime=requiredLifeTime, chain=chain)
-          if not retVal['OK']:
-            return S_ERROR("%s; the proxy lifetime from MyProxy is less than required." % errMsg)
-          chain = retVal['Value']
+    if not result['OK']:
+      self.deleteProxy(userDN)
+      return S_ERROR("Checking %s@%s proxy failed: %s" % (userDN, userGroup, result['Message']))
 
     # Proxy is invalid for some reason, let's delete it
     if not chain.isValidProxy()['OK']:
-      self.deleteProxy(userDN, userGroup)
+      self.deleteProxy(userDN)
       return S_ERROR("%s@%s has no proxy registered" % (userDN, userGroup))
-    return S_OK((chain, timeLeft))
-
-  def __getVOMSAttribute(self, userGroup, requiredVOMSAttribute=False):
-    """ Get VOMS attribute for DIRAC group
-
-        :param basestring userGroup: DIRAC group
-        :param boolean requiredVOMSAttribute: VOMS attribute
-
-        :return: S_OK(dict)/S_ERROR() -- dict contain attribute and VOMS VO
-    """
-    if requiredVOMSAttribute:
-      return S_OK({'attribute': requiredVOMSAttribute, 'VOMSVO': Registry.getVOMSVOForGroup(userGroup)})
-
-    csVOMSMapping = Registry.getVOMSAttributeForGroup(userGroup)
-    if not csVOMSMapping:
-      return S_ERROR("No mapping defined for group %s in the CS" % userGroup)
-
-    return S_OK({'attribute': csVOMSMapping, 'VOMSVO': Registry.getVOMSVOForGroup(userGroup)})
-
-  def getVOMSProxy(self, userDN, userGroup, requiredLifeTime=None, requestedVOMSAttr=None):
-    """ Get proxy string from the Proxy Repository for use with userDN
-        in the userGroup
-
-        :param basestring userDN: user DN
-        :param basestring userGroup: required DIRAC group
-        :param int requiredLifeTime: required proxy live time in a seconds
-        :param basestring requestedVOMSAttr: VOMS attribute
-
-        :return: S_OK(tuple)/S_ERROR() -- tuple with proxy as chain and proxy live time in a seconds
-    """
-    retVal = self.__getVOMSAttribute(userGroup, requestedVOMSAttr)
-    if not retVal['OK']:
-      return retVal
-    vomsAttr = retVal['Value']['attribute']
-    vomsVO = retVal['Value']['VOMSVO']
-
-    # Look in the cache
-    retVal = self.__getPemAndTimeLeft(userDN, userGroup, vomsAttr)
-    if retVal['OK']:
-      pemData = retVal['Value'][0]
-      vomsTime = retVal['Value'][1]
-      chain = X509Chain()
-      retVal = chain.loadProxyFromString(pemData)
-      if retVal['OK']:
-        retVal = chain.getRemainingSecs()
-        if retVal['OK']:
-          remainingSecs = retVal['Value']
-          if requiredLifeTime and requiredLifeTime <= vomsTime and requiredLifeTime <= remainingSecs:
-            return S_OK((chain, min(vomsTime, remainingSecs)))
-
-    if isPUSPdn(userDN):
-      # Get the Per User SubProxy if one is requested
-      result = self.__getPUSProxy(userDN, userGroup, requiredLifeTime, requestedVOMSAttr)
-      if not result['OK']:
-        return result
-      pemData = result['Value'][0]
-      chain = X509Chain()
-      result = chain.loadProxyFromString(pemData)
-      if not result['OK']:
-        return result
-
-    else:
-      # Get the stored proxy and dress it with the VOMS extension
-      retVal = self.getProxy(userDN, userGroup, requiredLifeTime)
-      if not retVal['OK']:
-        return retVal
-      chain, _secsLeft = retVal['Value']
 
+    if voms:
+      # If VOMS proxy requested
       vomsMgr = VOMS()
-      attrs = vomsMgr.getVOMSAttributes(chain).get('Value') or ['']
-      if attrs[0]:
+      attrs = vomsMgr.getVOMSAttributes(chain).get('Value')
+      if attrs and attrs[0]:
         if vomsAttr != attrs[0]:
           return S_ERROR("Stored proxy has already a different VOMS attribute %s than requested %s" %
                          (attrs[0], vomsAttr))
       else:
-        retVal = vomsMgr.setVOMSAttributes(chain, vomsAttr, vo=vomsVO)
+        retVal = vomsMgr.setVOMSAttributes(chain, vomsAttr, vo=Registry.getVOMSVOForGroup(userGroup))
         if not retVal['OK']:
           return S_ERROR("Cannot append voms extension: %s" % retVal['Message'])
         chain = retVal['Value']
+      # We have got the VOMS proxy, store it into the cache
+      result = self.__storeVOMSProxy(userDN, userGroup, vomsAttr, chain)
+      if not result['OK']:
+        return result
+      timeLeft = result['Value']
 
-    # We have got the VOMS proxy, store it into the cache
-    result = self.__storeVOMSProxy(userDN, userGroup, vomsAttr, chain)
-    if not result['OK']:
-      return result
-    return S_OK((chain, result['Value']))
+    return S_OK((chain, timeLeft))
 
   def __storeVOMSProxy(self, userDN, userGroup, vomsAttr, chain):
     """ Store VOMS proxy
 
-        :param basestring userDN: user DN
-        :param basestring userGroup: DIRAC group
-        :param basestring vomsAttr: VOMS attribute
-        :param X509Chain() chain: proxy as chain
+        :param str userDN: user DN
+        :param str userGroup: DIRAC group
+        :param str vomsAttr: VOMS attribute
+        :param object chain: proxy as X509Chain
 
-        :return: S_OK(basestring)/S_ERROR()
+        :return: S_OK(str)/S_ERROR()
     """
     retVal = self._getConnection()
     if not retVal['OK']:
@@ -971,47 +802,26 @@ def getUsers(self, validSecondsLeft=0, userMask=None):
         with valid proxies within the given validity period expressed in seconds
 
         :param int validSecondsLeft: validity period expressed in seconds
-        :param basestring userMask: user name that need to add to search filter
+        :param str userMask: user name that need to add to search filter
 
-        :return: S_OK(list)/S_ERROR() -- list contain dicts with user name, DN, group
-                                         expiration time, persistent flag
+        :return: S_OK(list)/S_ERROR() -- list contain dicts with DN, group, expiration time
     """
-    data = []
+    selDict = {}
     sqlCond = []
     if validSecondsLeft:
       try:
         validSecondsLeft = int(validSecondsLeft)
       except ValueError:
         return S_ERROR("Seconds left has to be an integer")
-      sqlCond.append("TIMESTAMPDIFF( SECOND, UTC_TIMESTAMP(), ExpirationTime ) > %d" % validSecondsLeft)
+      sqlCond.append("TIMESTAMPDIFF(SECOND, UTC_TIMESTAMP(), ExpirationTime) > %d" % validSecondsLeft)
 
     if userMask:
-      try:
-        sUserName = self._escapeString(userMask)['Value']
-      except KeyError:
-        return S_ERROR("Can't escape user name")
-      sqlCond.append('UserName = %s' % sUserName)
-
-    for table, fields in [('ProxyDB_CleanProxies', ("UserName", "UserDN", "ExpirationTime")),
-                          ('ProxyDB_Proxies', ("UserName", "UserDN", "UserGroup",
-                                               "ExpirationTime", "PersistentFlag"))]:
-      cmd = "SELECT %s FROM `%s`" % (", ".join(fields), table)
-      if sqlCond:
-        cmd += " WHERE %s" % " AND ".join(sqlCond)
-      retVal = self._query(cmd)
-      if not retVal['OK']:
-        return retVal
-      for record in retVal['Value']:
-        record = list(record)
-        if table == 'ProxyDB_CleanProxies':
-          record.insert(2, '')
-          record.insert(4, False)
-        data.append({'Name': record[0],
-                     'DN': record[1],
-                     'group': record[2],
-                     'expirationtime': record[3],
-                     'persistent': record[4] == 'True'})
-    return S_OK(data)
+      result = Registry.getDNsForUsername(userMask)
+      if not result['OK'] or not result.get('Value'):
+        return S_OK([])
+      selDict['UserDN'] = result['Value']
+    result = self.getProxiesContent(selDict, cond=sqlCond)
+    return S_OK(result['Value']['Dictionaries']) if result['OK'] else result
 
   def getCredentialsAboutToExpire(self, requiredSecondsLeft, onlyPersistent=True):
     """ Get credentials about to expire for MyProxy
@@ -1031,8 +841,8 @@ def getCredentialsAboutToExpire(self, requiredSecondsLeft, onlyPersistent=True):
   def setPersistencyFlag(self, userDN, userGroup, persistent=True):
     """ Set the proxy PersistentFlag to the flag value
 
-        :param basestring userDN: user DN
-        :param basestring userGroup: group name
+        :param str userDN: user DN
+        :param str userGroup: group name
         :param boolean persistent: enable persistent flag
 
         :return: S_OK()/S_ERROR()
@@ -1053,7 +863,7 @@ def setPersistencyFlag(self, userDN, userGroup, persistent=True):
     sqlInsert = True
     if retVal['OK']:
       data = retVal['Value']
-      if len(data) > 0:
+      if data:
         sqlInsert = False
         if data[0][0] == sqlFlag:
           return S_OK()
@@ -1065,12 +875,9 @@ def setPersistencyFlag(self, userDN, userGroup, persistent=True):
       if not result['OK']:
         self.log.error("setPersistencyFlag: Can not retrieve username for DN", userDN)
         return result
-      try:
-        sUserName = self._escapeString(result['Value'])['Value']
-      except KeyError:
-        return S_ERROR("Can't escape user name")
-      cmd = "INSERT INTO `ProxyDB_Proxies` ( UserName, UserDN, UserGroup, Pem, ExpirationTime, PersistentFlag ) "
-      cmd += " VALUES( %s, %s, %s, '', UTC_TIMESTAMP(), 'True' )" % (sUserName, sUserDN, sUserGroup)
+      userName = result['Value']
+      cmd = "INSERT INTO `ProxyDB_Proxies` (UserName, UserDN, UserGroup, Pem, ExpirationTime, PersistentFlag)"
+      cmd += " VALUES ('%s', %s, %s, '', UTC_TIMESTAMP(), 'True' )" % (userName, sUserDN, sUserGroup)
     else:
       cmd = "UPDATE `ProxyDB_Proxies` SET PersistentFlag='%s' WHERE UserDN=%s AND UserGroup=%s" % (sqlFlag,
                                                                                                    sUserDN,
@@ -1080,49 +887,99 @@ def setPersistencyFlag(self, userDN, userGroup, persistent=True):
       return retVal
     return S_OK()
 
-  def getProxiesContent(self, selDict, sortList, start=0, limit=0):
-    """ Get the contents of the db, parameters are a filter to the db
+  def getProxiesContent(self, selDict, sortList=None, start=0, limit=0, cond=None):
+    """ Get the contents of the db, parameters are a filter to the db.
 
-        :param dict selDict: selection dict that contain fields and their posible values
-        :param dict sortList: dict with sorting fields
-        :param int,long start: search limit start
-        :param int,long start: search limit amount
+        :param dict selDict: selection dict that contain fields and their possible values
+        :param sortList: dict with sorting fields
+        :type sortList: str or list
+        :param int start: search limit start
+        :param int start: search limit amount
+        :param dict cond: filters
 
         :return: S_OK(dict)/S_ERROR() -- dict contain fields, record list, total records
     """
-    data = []
+    paramNames = ("UserName", "UserDN", "UserGroup", "ExpirationTime", "ProxyProvider")
+
+    users = []
+    groups = []
+    if selDict.get('UserName'):
+      users = selDict['UserName']
+      if not isinstance(users, (list, tuple)):
+        users = [users]
+      del selDict["UserName"]
+    if selDict.get('UserGroup'):
+      groups = selDict['UserGroup']
+      if not isinstance(groups, (list, tuple)):
+        groups = [groups]
+      del selDict["UserGroup"]
+
+    if groups or users:
+      DNs = []
+      if groups and users:
+        for user in users:
+          for group in groups:
+            result = Registry.getDNsForUsernameInGroup(user, group)
+            if result['OK']:
+              DNs += result['Value']
+      elif users:
+        for user in users:
+          result = Registry.getDNsForUsername(user)
+          if result['OK']:
+            DNs += result['Value']
+      elif groups:
+        for group in groups:
+          for user in Registry.getUsersInGroup(group):
+            result = Registry.getDNsForUsername(user)
+            if result['OK']:
+              DNs += result['Value']
+
+      if not DNs:
+        return S_OK({'ParameterNames': paramNames, 'Records': [], 'TotalRecords': 0, 'Dictionaries': []})
+      if selDict.get("UserDN"):
+        selDNs = selDict["UserDN"] if isinstance(selDict["UserDN"], (list, tuple)) else [selDict["UserDN"]]
+        selDict["UserDN"] = []
+        for dn in selDNs:
+          if dn in DNs:
+            selDict["UserDN"].append(dn)
+        if not selDict["UserDN"]:
+          return S_OK({'ParameterNames': paramNames, 'Records': [], 'TotalRecords': 0, 'Dictionaries': []})
+      else:
+        selDict["UserDN"] = DNs
+
+    listData = []
+    dataRecords = []
     sqlWhere = ["Pem is not NULL"]
-    for table, fields in [('ProxyDB_CleanProxies', ("UserName", "UserDN", "ExpirationTime")),
-                          ('ProxyDB_Proxies', ("UserName", "UserDN", "UserGroup",
-                                               "ExpirationTime", "PersistentFlag"))]:
+    if cond:
+      sqlWhere += (list(cond) if isinstance(cond, (list, tuple)) else [cond])
+
+    sqlOrder = []
+    if sortList:
+      for sort in sortList:
+        if len(sort) == 1:
+          sort = (sort, "DESC")
+        elif len(sort) > 2:
+          return S_ERROR("Invalid sort %s" % sort)
+        if sort[0] in ['UserDN', 'ExpirationTime']:
+          if sort[1].upper() not in ("ASC", "DESC"):
+            return S_ERROR("Invalid sorting order %s" % sort[1])
+          sqlOrder.append("%s %s" % (sort[0], sort[1]))
+
+    for table, fields in [('ProxyDB_CleanProxies', ("UserDN", "ExpirationTime")),
+                          ('ProxyDB_Proxies', ("UserDN", "UserGroup", "ExpirationTime"))]:
       cmd = "SELECT %s FROM `%s`" % (", ".join(fields), table)
+
       for field in selDict:
         if field not in fields:
           continue
         fVal = selDict[field]
         if isinstance(fVal, (dict, tuple, list)):
-          sqlWhere.append("%s in (%s)" %
-                          (field, ", ".join([self._escapeString(str(value))['Value'] for value in fVal])))
+          if fVal:
+            sqlWhere.append("%s in (%s)" %
+                            (field, ", ".join([self._escapeString(str(value))['Value'] for value in fVal])))
         else:
           sqlWhere.append("%s = %s" % (field, self._escapeString(str(fVal))['Value']))
-      sqlOrder = []
-      if sortList:
-        for sort in sortList:
-          if len(sort) == 1:
-            sort = (sort, "DESC")
-          elif len(sort) > 2:
-            return S_ERROR("Invalid sort %s" % sort)
-          if sort[0] not in fields:
-            if table == 'ProxyDB_CleanProxies' and sort[0] in ['UserGroup', 'PersistentFlag']:
-              continue
-            return S_ERROR("Invalid sorting field %s" % sort[0])
-          if sort[1].upper() not in ("ASC", "DESC"):
-            return S_ERROR("Invalid sorting order %s" % sort[1])
-          sqlOrder.append("%s %s" % (sort[0], sort[1]))
-      if sqlWhere:
-        cmd = "%s WHERE %s" % (cmd, " AND ".join(sqlWhere))
-      if sqlOrder:
-        cmd = "%s ORDER BY %s" % (cmd, ", ".join(sqlOrder))
+      cmd += " WHERE %s " % " AND ".join(sqlWhere)
       if limit:
         try:
           start = int(start)
@@ -1130,40 +987,68 @@ def getProxiesContent(self, selDict, sortList, start=0, limit=0):
         except ValueError:
           return S_ERROR("start and limit have to be integers")
         cmd += " LIMIT %d,%d" % (start, limit)
+      cmd += " ORDER BY %s" % (", ".join(sqlOrder) if sqlOrder else "UserDN DESC")
       retVal = self._query(cmd)
       if not retVal['OK']:
+        retVal['Message'] += "\n" + cmd
         return retVal
+
       for record in retVal['Value']:
         record = list(record)
-        if table == 'ProxyDB_CleanProxies':
-          record.insert(2, '')
-          record.insert(4, False)
-        record[4] = record[4] == 'True'
-        data.append(record)
-    totalRecords = len(data)
-    return S_OK({'ParameterNames': fields, 'Records': data, 'TotalRecords': totalRecords})
+        result = Registry.getUsernameForDN(record[0])
+        if not result['OK']:
+          gLogger.error(result['Message'])
+          continue
+        user = result['Value']
+        result = Registry.getGroupsForDN(record[0])
+        if not result['OK']:
+          gLogger.error(result['Message'])
+          continue
+        groups = result['Value']
+        result = self.getProxyProviderForDN(record[0])
+        if not result['OK']:
+          gLogger.error(result['Message'])
+          continue
+        provider = result['Value']
 
-  def logAction(self, action, issuerDN, issuerGroup, targetDN, targetGroup):
+        if table == 'ProxyDB_CleanProxies':
+          record.insert(1, groups)
+          record.append(provider)
+
+        listData.append({'DN': record[0],
+                         'user': user,
+                         'groups': [record[1]] if table == 'ProxyDB_Proxies' else groups,
+                         'expirationtime': record[2],
+                         'provider': provider})
+
+        record.insert(0, user)
+        record.append(provider)
+        dataRecords.append(record)
+    return S_OK({'ParameterNames': paramNames, 'Records': dataRecords, 'TotalRecords': len(dataRecords),
+                 'Dictionaries': listData})
+
+  def logAction(self, action, issuerUsername, issuerGroup, targetUsername, targetGroup):
     """ Add an action to the log
 
-        :param basestring action: proxy action
-        :param basestring issuerDN: user DN of issuer
-        :param basestring issuerGroup: DIRAC group of issuer
-        :param basestring targetDN: user DN of target
-        :param basestring targetGroup: DIRAC group of target
+        :param str action: proxy action
+        :param str issuerUsername: user DN of issuer
+        :param str issuerGroup: DIRAC group of issuer
+        :param str targetUsername: user DN of target
+        :param str targetGroup: DIRAC group of target
 
         :return: S_ERROR()
     """
     try:
       sAction = self._escapeString(action)['Value']
-      sIssuerDN = self._escapeString(issuerDN)['Value']
+      sIssuerUsername = self._escapeString(issuerUsername)['Value']
       sIssuerGroup = self._escapeString(issuerGroup)['Value']
-      sTargetDN = self._escapeString(targetDN)['Value']
+      sTargetUsername = self._escapeString(targetUsername)['Value']
       sTargetGroup = self._escapeString(targetGroup)['Value']
     except KeyError:
       return S_ERROR("Can't escape from death")
-    cmd = "INSERT INTO `ProxyDB_Log` ( Action, IssuerDN, IssuerGroup, TargetDN, TargetGroup, Timestamp ) VALUES "
-    cmd += "( %s, %s, %s, %s, %s, UTC_TIMESTAMP() )" % (sAction, sIssuerDN, sIssuerGroup, sTargetDN, sTargetGroup)
+    cmd = "INSERT INTO `ProxyDB_Log` (Action, IssuerUsername, IssuerGroup, TargetUsername, TargetGroup, Timestamp)"
+    cmd += " VALUES (%s, %s, %s, %s, %s, UTC_TIMESTAMP())" % (sAction, sIssuerUsername, sIssuerGroup,
+                                                              sTargetUsername, sTargetGroup)
     retVal = self._update(cmd)
     if not retVal['OK']:
       self.log.error("Can't add a proxy action log: ", retVal['Message'])
@@ -1177,11 +1062,16 @@ def purgeLogs(self):
     return self._update(cmd)
 
   def getLogsContent(self, selDict, sortList, start=0, limit=0):
+    """ Function to get the contents of the logs table parameters are a filter to the db
+
+        :param dict selDict: filters
+        :param list sortList: sort list
+        :param int start: start number
+        :param int limit: limit
+
+        :return: S_OK()/S_ERROR()
     """
-    Function to get the contents of the logs table
-      parameters are a filter to the db
-    """
-    fields = ("Action", "IssuerDN", "IssuerGroup", "TargetDN", "TargetGroup", "Timestamp")
+    fields = ("Action", "IssuerUsername", "IssuerGroup", "TargetUsername", "TargetGroup", "Timestamp")
     cmd = "SELECT %s FROM `ProxyDB_Log`" % ", ".join(fields)
     if selDict:
       qr = []
@@ -1215,11 +1105,11 @@ def getLogsContent(self, selDict, sortList, start=0, limit=0):
       totalRecords = retVal['Value'][0][0]
     return S_OK({'ParameterNames': fields, 'Records': data, 'TotalRecords': totalRecords})
 
-  def generateToken(self, requesterDN, requesterGroup, numUses=1, lifeTime=0, retries=10):
+  def generateToken(self, requesterUsername, requesterGroup, numUses=1, lifeTime=0, retries=10):
     """ Generate and return a token and the number of uses for the token
 
-        :param basestring requesterDN: DN of requester
-        :param basestring requesterGroup: DIRAC group of requester
+        :param str requesterUsername: DN of requester
+        :param str requesterGroup: DIRAC group of requester
         :param int numUses: number of uses
         :param int lifeTime: proxy live time in a seconds
         :param int retries: number of retries
@@ -1234,9 +1124,9 @@ def generateToken(self, requesterDN, requesterGroup, numUses=1, lifeTime=0, retr
     rndData = "%s.%s.%s.%s" % (time.time(), random.random(), numUses, lifeTime)
     m.update(rndData)
     token = m.hexdigest()
-    fieldsSQL = ", ".join(("Token", "RequesterDN", "RequesterGroup", "ExpirationTime", "UsesLeft"))
+    fieldsSQL = ", ".join(("Token", "RequesterUsername", "RequesterGroup", "ExpirationTime", "UsesLeft"))
     valuesSQL = ", ".join((self._escapeString(token)['Value'],
-                           self._escapeString(requesterDN)['Value'],
+                           self._escapeString(requesterUsername)['Value'],
                            self._escapeString(requesterGroup)['Value'],
                            "TIMESTAMPADD( SECOND, %d, UTC_TIMESTAMP() )" % int(lifeTime),
                            str(numUses)))
@@ -1259,18 +1149,18 @@ def purgeExpiredTokens(self):
     delSQL = "DELETE FROM `ProxyDB_Tokens` WHERE ExpirationTime < UTC_TIMESTAMP() OR UsesLeft < 1"
     return self._update(delSQL)
 
-  def useToken(self, token, requesterDN, requesterGroup):
+  def useToken(self, token, requesterUsername, requesterGroup):
     """ Uses of token count
 
-        :param basestring token: token
-        :param basestring requesterDN: DN of requester
-        :param basestring requesterGroup: DIRAC group of requester
+        :param str token: token
+        :param str requesterUsername: user name of requester
+        :param str requesterGroup: DIRAC group of requester
 
         :return: S_OK(boolean)/S_ERROR()
     """
     sqlCond = " AND ".join(("UsesLeft > 0",
                             "Token=%s" % self._escapeString(token)['Value'],
-                            "RequesterDN=%s" % self._escapeString(requesterDN)['Value'],
+                            "RequesterUsername=%s" % self._escapeString(requesterUsername)['Value'],
                             "RequesterGroup=%s" % self._escapeString(requesterGroup)['Value'],
                             "ExpirationTime >= UTC_TIMESTAMP()"))
     updateSQL = "UPDATE `ProxyDB_Tokens` SET UsesLeft = UsesLeft - 1 WHERE %s" % sqlCond
@@ -1287,7 +1177,6 @@ def __cleanExpNotifs(self):
     cmd = "DELETE FROM `ProxyDB_ExpNotifs` WHERE ExpirationTime < UTC_TIMESTAMP()"
     return self._update(cmd)
 
-  # FIXME: Add clean proxy
   def sendExpirationNotifications(self):
     """ Send notification about expiration
 
@@ -1327,7 +1216,7 @@ def sendExpirationNotifications(self):
         if notKey in notifDone and notifDone[notKey] <= notifLimit:
           # Already notified for this notification limit
           break
-        if not self._notifyProxyAboutToExpire(userDN, lTime):
+        if not self._notifyProxyAboutToExpire(userDN, group, lTime):
           # Cannot send notification, retry later
           break
         try:
@@ -1351,10 +1240,11 @@ def sendExpirationNotifications(self):
         notifDone[notKey] = notifLimit
     return S_OK(sent)
 
-  def _notifyProxyAboutToExpire(self, userDN, lTime):
+  def _notifyProxyAboutToExpire(self, userDN, userGroup, lTime):
     """ Send notification mail about to expire
 
-        :param basestring userDN: user DN
+        :param str userDN: user DN
+        :param str userGroup: DIRAC group
         :param int lTime: left proxy live time in a seconds
 
         :return: boolean
@@ -1376,18 +1266,19 @@ def _notifyProxyAboutToExpire(self, userDN, lTime):
   information is:
 
   DN:    %s
+  Group: %s
 
   If you plan on keep using this credentials please upload a newer proxy to
   DIRAC by executing:
 
-  $ dirac-proxy-init --upload
+  $ dirac-proxy-init -P -g %s --rfc
 
   If you have been issued different certificate, please make sure you have a
   proxy uploaded with that certificate.
 
 Cheers,
  DIRAC's Proxy Manager
-""" % (userName, daysLeft, userDN)
+""" % (userName, daysLeft, userDN, userGroup, userGroup)
     fromAddr = self.getFromAddr()
     result = self.__notifClient.sendMail(userEMail, msgSubject, msgBody, fromAddress=fromAddr)
     if not result['OK']:
@@ -1499,5 +1390,60 @@ def __storeProxyOld(self, userDN, userGroup, chain):
           sqlSet.append("%s = %s" % (k, dValues[k]))
       cmd = "UPDATE `ProxyDB_Proxies` SET %s WHERE %s" % (", ".join(sqlSet), " AND ".join(sqlWhere))
 
-    self.logAction("store proxy", userDN, userGroup, userDN, userGroup)
+    self.logAction("store proxy", userName, userGroup, userName, userGroup)
     return self._update(cmd)
+
+  def getProxyProviderForDN(self, userDN, username=None):
+    """ Get proxy providers by user DN
+
+        :param str userDN: user DN
+        :param str username: user name
+
+        :return: S_OK(str)/S_ERROR()
+    """
+    if not username:
+      result = Registry.getUsernameForDN(userDN)
+      if not result['OK']:
+        return result
+      username = result['Value']
+
+    result = Registry.getDNProperty(userDN, 'ProxyProviders', username=username, defaultValue=[])
+    if result['OK'] and result['Value']:
+      return S_OK(result['Value'][0])
+
+    for userID in Registry.getIDsForUsername(username):
+      result = gAuthManagerData.getDNOptionForID(userID, userDN, 'PROVIDER')
+      if not result['OK']:
+        return result
+      provider = result['Value']
+      if provider:
+        return S_OK(provider)
+    return S_OK('Certificate')
+
+  def getValidDNs(self, listDNs, sqlCond=None):
+    """ Get valid DNs
+
+        :param list listDNs: list DNs
+
+        :return: S_OK()/S_ERROR()
+    """
+    dns = []
+    dataRecords = []
+    sqlWhere = ["Pem is not NULL"]
+    if sqlCond:
+      sqlWhere += (list(sqlCond) if isinstance(sqlCond, (list, tuple)) else [sqlCond])
+    sqlWhere.append("UserDN in (%s)" % ", ".join([self._escapeString(str(v))['Value'] for v in listDNs]))
+    for table, exfield in [('ProxyDB_CleanProxies', ''), ('ProxyDB_Proxies', ', UserGroup')]:
+      cmd = "SELECT UserDN, ExpirationTime%s FROM `%s`" % (exfield, table)
+      result = self._query("%s WHERE %s ORDER BY UserDN DESC" % (cmd, " AND ".join(sqlWhere)))
+      if not result['OK']:
+        return result
+      for record in result['Value']:
+        record = list(record)
+        if len(record) == 2:
+          record.append(None)
+        if record[0] in dns:
+          continue
+        dns.append(record[0])
+        dataRecords.append(record)
+    return S_OK(dataRecords)
diff --git a/FrameworkSystem/Service/AuthManagerHandler.py b/FrameworkSystem/Service/AuthManagerHandler.py
new file mode 100644
index 00000000000..1807140b783
--- /dev/null
+++ b/FrameworkSystem/Service/AuthManagerHandler.py
@@ -0,0 +1,721 @@
+""" The OAuth service provides a toolkit to authoticate throught OIDC session.
+"""
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import print_function
+
+import re
+import six
+import pprint
+
+from DIRAC import gLogger, S_OK, S_ERROR
+from DIRAC.Core.DISET.RequestHandler import RequestHandler
+from DIRAC.Core.Utilities import ThreadSafe
+from DIRAC.Core.Utilities.DictCache import DictCache
+from DIRAC.Core.Utilities.ThreadScheduler import gThreadScheduler
+from DIRAC.ConfigurationSystem.Client.Helpers.Registry import getUsernameForID, getIDsForUsername, getEmailsForGroup
+from DIRAC.Resources.IdProvider.IdProviderFactory import IdProviderFactory
+from DIRAC.ConfigurationSystem.Client.Utilities import getAuthAPI
+
+from DIRAC.FrameworkSystem.DB.AuthDB import AuthDB
+
+__RCSID__ = "$Id$"
+
+
+gCacheSessions = ThreadSafe.Synchronizer()
+gCacheProfiles = ThreadSafe.Synchronizer()
+
+
+class AuthManagerHandler(RequestHandler):
+  """ Authentication manager
+  """
+  __cacheSessions = DictCache()
+  # # {
+  # #   <session1>: {
+  # #     ID: ..,
+  # #     Provider: ..,
+  # #     Tokens: { <tokens> }
+  # #   },
+  # #   <session2>: { ... }
+  # # }
+
+  __cahceIDs = DictCache()
+  # # {
+  # #   <ID1>: [ <sessions> ],
+  # #   <ID2>: ...
+  # # }
+
+  __cacheProfiles = DictCache()
+  # # {
+  # #   <ID1>: {
+  # #     DNs: {
+  # #       <DN1>: {
+  # #         ProxyProvider: [ <proxy providers> ],
+  # #         VOMSRoles: [ <VOMSRoles> ],
+  # #         ...
+  # #       },
+  # #       <DN2>: { ... },
+  # #     }
+  # #   },
+  # #   <ID2>: { ... }
+  # # }
+
+  __db = None
+
+  @classmethod
+  @gCacheProfiles
+  def __getProfiles(cls, userID=None):
+    """ Get cache information
+
+        :param str userID: user ID
+
+        :return: dict
+    """
+    if userID:
+      return cls.__cacheProfiles.get(userID) or {}
+    return cls.__cacheProfiles.getDict()
+
+  @classmethod
+  @gCacheProfiles
+  def __addProfiles(cls, data, time=3600 * 24):
+    """ Caching information
+
+        :param dict data: ID information data
+        :param int time: lifetime
+    """
+    if data:
+      for oid, info in data.items():
+        cls.__cacheProfiles.add(oid, time, value=info)
+
+  @classmethod
+  @gCacheSessions
+  def __getSessions(cls, session=None, userID=None):
+    """ Get cache information
+
+        :param str session: session
+        :param str userID: user ID
+
+        :return: dict
+    """
+    if session:
+      data = cls.__cacheSessions.get(session)
+      if userID and userID != data['ID']:
+        return {}
+      return data
+
+    if userID:
+      data = {}
+      for session in cls.__cahceIDs.get(userID) or []:
+        data[session] = cls.__cacheSessions.get(session)
+      return data
+
+    return cls.__cacheSessions.getDict()
+
+  @classmethod
+  @gCacheSessions
+  def __addSessions(cls, data, time=3600 * 24):
+    """ Caching information
+
+        :param dict data: ID information data
+        :param int time: lifetime
+    """
+    for session, info in data.items():
+      idSessions = cls.__cahceIDs.get(info['ID']) or []
+      cls.__cahceIDs.add(info['ID'], time, list(set(idSessions + [session])))
+      cls.__cacheSessions.add(session, time, value=info)
+
+  @classmethod
+  def __updateSessionsFromDB(cls, idPs=None, IDs=None, session=None):
+    """ Update information about sessions
+
+        :param list idPs: list of identity providers that sessions need to update, if None - update all
+        :param list IDs: list of IDs that need to update, if None - update all
+        :param str session: session to update
+
+        :return: S_OK()/S_ERROR()
+    """
+    result = cls.__db.updateSessionsFromDB(idPs=idPs, IDs=IDs, session=session)
+    if result['OK']:
+      cls.__addSessions(result['Value'] or {})
+      gLogger.info(len(result['Value']), 'sessions has been uploaded from DB to cache.')
+    return result
+
+  @classmethod
+  def __refreshReservedSessions(cls):
+    """ Refresh reserved sessions
+    """
+    result = cls.__db.getReservedSessions()
+    if not result['OK']:
+      return result
+    freshDict = {}
+    for data in result['Value']:
+      session = data['Session']
+      provider = data['Provider']
+      if provider not in freshDict:
+        freshDict[provider] = []
+      freshDict[provider] = list(set(freshDict[provider] + [session]))
+
+    for idP, sessions in freshDict.items():
+      result = IdProviderFactory().getIdProvider(idP, sessionManager=cls.__db)
+      if result['OK']:
+        provObj = result['Value']
+        result = provObj.checkStatus(session=session)
+        if result['OK']:
+          cls.log.verbose(session, 'session refreshed!')
+          continue
+      cls.log.error('%s session not refreshed:' % session, result['Message'])
+
+  @classmethod
+  def __cleanAuthDB(cls):
+    """ Check AuthDB for zombie sessions and clean
+
+        :return: S_OK()/S_ERROR()
+    """
+    cls.log.info("Kill zombie sessions")
+    result = cls.__db.getZombieSessions()
+    if not result['OK']:
+      gLogger.error('Cannot clean zombies: %s' % result['Message'])
+      return result
+    for idP, sessions in result['Value'].items():
+      result = IdProviderFactory().getIdProvider(idP, sessionManager=cls.__db)
+      if not result['OK']:
+        for session in sessions:
+          cls.log.error('%s session, with %s IdP, cannot log out:' % (sessions, idP), result['Message'])
+          cls.__db.killSession(session)
+        continue
+      provObj = result['Value']
+      for session in sessions:
+        result = provObj.logOut(session)
+        if not result['OK']:
+          cls.log.error('%s session, with %s IdP, cannot log out:' % (session, idP), result['Message'])
+        cls.__db.killSession(session)
+
+    cls.log.notice("Cleaning is done!")
+    return S_OK()
+
+  @classmethod
+  def initializeHandler(cls, serviceInfo):
+    """ Handler initialization
+    """
+    cls.__db = AuthDB()
+    # gThreadScheduler.addPeriodicTask(15 * 60, cls.__refreshReservedSessions)
+    gThreadScheduler.addPeriodicTask(3600, cls.__cleanAuthDB)
+    gThreadScheduler.addPeriodicTask(3600, cls.__updateSessionsFromDB)
+    result = cls.__cleanAuthDB()
+    if result['OK']:
+      result = cls.__updateSessionsFromDB()
+    return cls.__refreshProfiles() if result['OK'] else result
+
+  @classmethod
+  def __refreshProfiles(cls):
+    """ Refresh users profiles
+
+        :return: S_OK()/S_ERROR()
+    """
+    idPsDict = {}
+    for session, data in cls.__cacheSessions.getDict().items():
+      if data['Status'] == 'authed' and data['Reserved'] == 'yes':
+        uid = data['ID']
+        provider = data['Provider']
+        if provider not in idPsDict:
+          idPsDict[provider] = {}
+        if uid not in idPsDict[provider]:
+          idPsDict[provider][uid] = []
+        idPsDict[provider][uid].append(session)
+
+    for idP, data in idPsDict.items():
+      result = IdProviderFactory().getIdProvider(idP, sessionManager=cls.__db)
+      if not result['OK']:
+        return result
+      provObj = result['Value']
+      for uid, sessions in data.items():
+        for session in sessions:
+          result = provObj.checkStatus(session=session)
+          if result['OK']:
+            if not cls.__getProfiles(uid):
+              result = provObj.getUserProfile(session)
+              if result['OK']:
+                dns = result['Value']['UsrOptns']['DNs']
+                if dns:
+                  cacheData = cls.__getProfiles(userID=uid) or {}
+                  cacheData['DNs'] = dns
+                  cls.__addProfiles({uid: cacheData})
+                continue
+
+          if not result['OK']:
+            cls.log.error('%s session, with %s IdP, cannot log out:' % (session, idP), result['Message'])
+            continue
+    return S_OK()
+
+  def __checkAuth(self, session=None):
+    """ Check authorization rules
+
+        :param str session: session number
+
+        :return: S_OK(tuple)/S_ERROR() -- tuple contain username and IDs
+    """
+    credDict = self.getRemoteCredentials()
+    if credDict['group'] == 'hosts':
+      return S_OK((None, 'all'))
+
+    user = credDict["username"]
+    userIDs = getIDsForUsername(user)
+    if not userIDs:
+      return S_ERROR('No registred IDs for %s user.' % user)
+
+    if session:
+      result = self.__db.getSessionID(session)
+      if not result['OK']:
+        return result
+      sID = result['Value']
+      if sID not in userIDs:
+        return S_ERROR('%s user not have access to %s ID information.' % (user, sID))
+
+    return S_OK((user, userIDs))
+
+  types_getIdProfiles = []
+  auth_getIdProfiles = ["authenticated", "TrustedHost"]
+
+  def export_getIdProfiles(self, userID=None):
+    """ Return fresh info from identity providers about users with actual sessions
+
+        :params: str userID: user ID
+
+        :return: S_OK(dict)/S_ERROR()
+    """
+    result = self.__checkAuth()
+    if not result['OK']:
+      return result
+    user, ids = result["Value"]
+
+    # For host
+    if ids == 'all':
+      return S_OK(self.__getProfiles(userID=userID))
+
+    # For user
+    if userID:
+      if userID not in ids:
+        return S_ERROR('%s user not have access to %s ID information.' % (user, userID))
+      return self.__getProfiles(userID=userID)
+
+    data = {}
+    for uid in ids:
+      idDict = self.__getProfiles(userID=uid)
+      if idDict:
+        data[uid] = idDict
+
+    return S_OK(data)
+
+  types_getSessionsInfo = []
+  auth_getSessionsInfo = ["authenticated", "TrustedHost"]
+
+  def export_getSessionsInfo(self, session=None, userID=None):
+    """ Return fresh info from identity providers about users with actual sessions
+
+        :param str session: session
+        :param str userID: user ID
+
+        :return: S_OK(dict)/S_ERROR()
+    """
+    result = self.__checkAuth()
+    if not result['OK']:
+      return result
+    user, ids = result["Value"]
+
+    # For host
+    if ids == "all":
+      return S_OK(self.__getSessions(session=session, userID=userID))
+
+    # For user
+    if userID:
+      if userID not in ids:
+        return S_ERROR('%s user not have access to %s ID information.' % (user, userID))
+      return self.__getSessions(session=session, userID=userID)
+
+    if session:
+      data = self.__getSessions(session=session, userID=userID)
+      if data.get('ID') not in ids:
+        return S_ERROR('%s user not have access to %s ID information.' % (user, userID))
+      return S_OK(data)
+
+    data = {}
+    for uid in ids:
+      for session, data in self.__getSessions(userID=uid):
+        if data['ID'] in ids:
+          data[session] = data
+
+    return S_OK(data)
+
+  types_submitAuthorizeFlow = [six.string_types]
+
+  def export_submitAuthorizeFlow(self, providerName, session=None):
+    """ Register new session and return dict with authorization url and session number
+
+        :param str providerName: provider name
+        :param str session: session identificator
+
+        :return: S_OK(dict)/S_ERROR() -- dictionary contain next keys:
+                 Status -- session status
+                 UserName -- user name, returned if status is 'ready'
+                 Session -- session id, returned if status is 'needToAuth'
+                 URL -- link to start authetication flow, returned if status is 'needToAuth'
+    """
+    gLogger.info('Get authorization for %s.' % providerName, 'Session: %s' % session if session else '')
+
+    if self.__db.isReservedSession(session):
+      return S_ERROR('You cannot submit authorization flow with reserved session!')
+
+    result = IdProviderFactory().getIdProvider(providerName, sessionManager=self.__db)
+    if not result['OK']:
+      return result
+    provObj = result['Value']
+    if session:
+      result = provObj.checkStatus(session=session)
+      if result['OK']:
+        result = getUsernameForID(self.__getSessions(session).get('ID'))
+        if result['OK']:
+          return S_OK({'UserName': result['Value'], 'Status': 'ready'})
+
+    if not result['OK']:
+      self.log.error(result['Message'], 'Try to generate new session.')
+
+    result = provObj.submitNewSession()
+    if not result['OK']:
+      return S_ERROR('Cannot create authority request URL:', result['Message'])
+    session = result['Value']
+    return S_OK({'Status': 'needToAuth', 'Session': session,
+                 'URL': '%s/auth/%s' % (getAuthAPI().strip('/'), session)})
+
+  types_parseAuthResponse = [dict, six.string_types]
+
+  def export_parseAuthResponse(self, response, session):
+    """ Fill session by user profile, tokens, comment, OIDC authorize status, etc.
+        Prepare dict with user parameters, if DN is absent there try to get it.
+        Create new or modify existend DIRAC user and store the session
+
+        :param dict response: authorization response
+        :param str session: session number
+
+        :return: S_OK(dict)/S_ERROR()
+    """
+    result = self.__db.getSessionStatus(session)
+    if result['OK']:
+      if result['Value']['Status'] not in ['prepared', 'in progress']:
+        return S_ERROR('The current session has already been submitted.')
+
+      result = self.__db.updateSession(session, {'Status': 'finishing'})
+      if result['OK']:
+        result = self.__parseAuthResponse(response, session)
+
+    if not result['OK']:
+      cansel = self.__db.updateSession(session, {'Status': 'failed', 'Comment': result['Message']})
+      return result if cansel['OK'] else cansel
+
+    responseData = result['Value']
+    if responseData['Status'] in ['authed', 'redirect']:
+      # Cached data
+      profile = responseData['UserProfile']['UsrOptns']
+      cacheData = self.__getProfiles(userID=profile['ID']) or {}
+      if profile['DNs']:
+        cacheData['DNs'] = profile['DNs']
+      self.__addProfiles({profile['ID']: cacheData})
+      result = self.__updateSessionsFromDB(session=session)
+      if not result['OK']:
+        return result
+      responseData['upProfile'] = {profile['ID']: cacheData}
+      responseData['upSession'] = result['Value']
+
+    return S_OK(responseData)
+
+  def __parseAuthResponse(self, response, session):
+    """ Fill session by user profile, tokens, comment, OIDC authorize status, etc.
+        Prepare dict with user parameters, if DN is absent there try to get it.
+        Create new or modify existend DIRAC user and store the session
+
+        :param dict response: authorization response
+        :param str session: session number
+
+        :return: S_OK(dict)/S_ERROR()
+    """
+    # Search provider by session
+    result = self.__db.getSessionProvider(session)
+    if not result['OK']:
+      return result
+    provider = result['Value']
+    result = IdProviderFactory().getIdProvider(provider, sessionManager=self.__db)
+    if not result['OK']:
+      return result
+    provObj = result['Value']
+
+    # Parsing response
+    result = provObj.parseAuthResponse(response, session)
+    if not result['OK']:
+      return result
+    parseDict = result['Value']
+
+    status = 'authed'
+    comment = ''
+
+    # Is ID registred?
+    userID = parseDict['UsrOptns']['ID']
+    result = getUsernameForID(userID)
+    if not result['OK']:
+      status = 'failed'
+      comment = '%s ID is not registred in the DIRAC.' % userID
+      result = self.__registerNewUser(provider, parseDict)
+      if result['OK']:
+        comment += ' Administrators have been notified about you.'
+      else:
+        comment += ' Please, contact the DIRAC administrators.'
+
+    else:
+      # This session to reserve?
+      if not self.__db.isReservedSession(session):
+        # If not, search reserved session
+        result = self.__db.getReservedSessions([userID], [provider])
+        if not result['OK']:
+          return result
+
+        if not result['Value']:
+          # If no found reserved session, submit second flow to create it
+          result = provObj.submitNewSession(session='reserved_%s' % session)
+          if not result['OK']:
+            return result
+
+          status = 'redirect'
+          comment = '%s/auth/%s' % (getAuthAPI().strip('/'), result['Value'])
+
+      else:
+        # Update status in source session
+        result = self.__db.updateSession(session.replace('reserved_', ''), {'Status': status})
+        if not result['OK']:
+          return result
+
+    # Update status in current session
+    result = self.__db.updateSession(session, {'Status': status, 'Comment': comment})
+    if not result['OK']:
+      return result
+
+    return S_OK({'Status': status, 'Comment': comment, 'UserProfile': parseDict, 'Provider': provider})
+
+  def __registerNewUser(self, provider, parseDict):
+    """ Register new user
+
+        :param str provider: provider
+        :param dict parseDict: user information dictionary
+
+        :return: S_OK()/S_ERROR()
+    """
+    from DIRAC.FrameworkSystem.Client.NotificationClient import NotificationClient
+
+    mail = {}
+    mail['subject'] = "[SessionManager] User %s to be added." % parseDict['username']
+    mail['body'] = 'User %s was authenticated by ' % parseDict['UsrOptns']['FullName']
+    mail['body'] += provider
+    mail['body'] += "\n\nAuto updating of the user database is not allowed."
+    mail['body'] += " New user %s to be added," % parseDict['username']
+    mail['body'] += "with the following information:\n"
+    mail['body'] += "\nUser name: %s\n" % parseDict['username']
+    mail['body'] += "\nUser profile:\n%s" % pprint.pformat(parseDict['UsrOptns'])
+    mail['body'] += "\n\n------"
+    mail['body'] += "\n This is a notification from the DIRAC AuthManager service, please do not reply.\n"
+    result = S_OK()
+    for addresses in getEmailsForGroup('dirac_admin'):
+      result = NotificationClient().sendMail(addresses, mail['subject'], mail['body'], localAttempt=False)
+      if not result['OK']:
+        self.log.error(result['Message'])
+    if result['OK']:
+      self.log.info(result['Value'], "administrators have been notified of a new user.")
+    return result
+
+  types_getSessionLifetime = [six.string_types]
+  auth_getSessionLifetime = ["authenticated", "TrustedHost"]
+
+  def export_getSessionLifetime(self, session):
+    """ Get lifetime of session
+
+        :param str session: session number
+
+        :return: S_OK(int)/S_ERROR() -- lifetime in a seconds
+    """
+    res = self.__checkAuth(session)
+    return self.__db.getSessionLifetime(session) if res['OK'] else res
+
+  types_refreshSession = [six.string_types]
+  auth_refreshSession = ["authenticated", "TrustedHost"]
+
+  def export_refreshSession(self, session):
+    """ Refresh session
+
+        :param str session: session number
+
+        :return: S_OK()/S_ERROR()
+    """
+    result = self.__checkAuth(session)
+    if not result['OK']:
+      return result
+    result = self.__db.getSessionProvider(session)
+    if not result['OK']:
+      return result
+    provider = result['Value']
+    result = IdProviderFactory().getIdProvider(provider, sessionManager=self.__db)
+    if not result['OK']:
+      return result
+    provObj = result['Value']
+    return provObj.fetch(session)
+
+  types_getReservedSessions = []
+  auth_getReservedSessions = ["authenticated", "TrustedHost"]
+
+  def export_getReservedSessions(self, userIDs=None, idPs=None, check=False):
+    """ Get reserved sessions
+
+        :param list userIDs: user IDs
+        :param list idPs: IdPs
+        :param bool check: if need to check session status by IdP
+
+        :return: S_OK(list)/S_ERROR()
+    """
+    result = self.__checkAuth()
+    if not result['OK']:
+      return result
+    user, ids = result["Value"]
+    if user:
+      if userIDs:
+        for uid in userIDs:
+          if uid not in ids:
+            return S_ERROR('%s user not have access to %s ID information.' % (user, userIDs))
+      else:
+        userIDs = ids
+    result = self.__db.getReservedSessions(userIDs, idPs)
+    if not result['OK']:
+      return result
+    data = {}
+    for sDict in result['Value']:
+      if sDict['Provider'] not in data:
+        data[sDict['Provider']] = []
+      data[sDict['Provider']].append(sDict['Session'])
+
+    sessionList = []
+    for idP, sessions in data.items():
+      if not check:
+        sessionList += sessions
+        continue
+      result = IdProviderFactory().getIdProvider(idP, sessionManager=self.__db)
+      if not result['OK']:
+        return result
+      provObj = result['Value']
+      for session in sessions:
+        if provObj.checkStatus(session)['OK']:
+          sessionList.append(session)
+
+    return S_OK(list(set(sessionList)))
+
+  types_updateSession = [six.string_types, dict]
+  auth_updateSession = ["authenticated", "TrustedHost"]
+
+  def export_updateSession(self, session, fieldsToUpdate):
+    """ Update session record
+
+        :param str session: session number
+        :param dict fieldsToUpdate: fields content that need to update
+
+        :return: S_OK()/S_ERROR()
+    """
+    res = self.__checkAuth(session)
+    return self.__db.updateSession(session, fieldsToUpdate) if res['OK'] else res
+
+  types_killSession = [six.string_types]
+  auth_killSession = ["authenticated", "TrustedHost"]
+
+  def export_killSession(self, session):
+    """ Remove session record from DB
+
+        :param str session: session number
+
+        :return: S_OK()/S_ERROR()
+    """
+    res = self.__checkAuth(session)
+    return self.__db.killSession(session) if res['OK'] else res
+
+  types_logOutSession = [six.string_types]
+  auth_logOutSession = ["authenticated", "TrustedHost"]
+
+  def export_logOutSession(self, session):
+    """ Remove session record from DB and logout form identity provider
+
+        :param str session: session number
+
+        :return: S_OK()/S_ERROR()
+    """
+    result = self.__checkAuth(session)
+    if not result['OK']:
+      return result
+
+    result = self.__db.getSessionProvider(session)
+    if not result['OK']:
+      return result
+    provider = result['Value']
+    result = IdProviderFactory().getIdProvider(provider, sessionManager=self.__db)
+    if not result['OK']:
+      return result
+    provObj = result['Value']
+    result = provObj.logOut(session)
+    if not result['OK']:
+      self.log.error(result['Message'])
+    return self.__db.killSession(session)
+
+  types_getSessionAuthLink = [six.string_types]
+
+  def export_getSessionAuthLink(self, session):
+    """ Get authorization URL by session number
+
+        :param str session: session number
+
+        :return: S_OK(str)/S_ERROR()
+    """
+    return self.__db.getSessionAuthLink(session)
+
+  types_getSessionStatus = [six.string_types]
+
+  def export_getSessionStatus(self, session):
+    """ Listen DB to get status of authorization session
+
+        :param str session: session number
+
+        :return: S_OK(dict)/S_ERROR()
+    """
+    result = self.__db.getSessionStatus(session)
+    if result['OK']:
+      if result['Value']['Status'] == 'authed':
+        user = getUsernameForID(result['Value']['ID'])
+        if user['OK']:
+          result['Value']['UserName'] = user['Value']
+    return result
+
+  types_getSessionTokens = [six.string_types]
+  auth_getSessionTokens = ["authenticated", "TrustedHost"]
+
+  def export_getSessionTokens(self, session):
+    """ Get tokens by session number
+
+        :param str session: session number
+
+        :return: S_OK(dict)/S_ERROR()
+    """
+    res = self.__checkAuth(session)
+    return self.__db.getSessionTokens(session) if res['OK'] else res
+
+  types_createNewSession = [six.string_types]
+  auth_createNewSession = ["authenticated", "TrustedHost"]
+
+  def export_createNewSession(self, provider, session=None):
+    """ Generates a state string to be used in authorizations
+
+        :param str provider: provider
+        :param str session: session number
+
+        :return: S_OK(str)/S_ERROR()
+    """
+    res = self.__checkAuth(session)
+    return self.__db.createNewSession(provider, session) if res['OK'] else res
diff --git a/FrameworkSystem/Service/ProxyManagerHandler.py b/FrameworkSystem/Service/ProxyManagerHandler.py
index d83a9fd4725..e66f66b4c39 100644
--- a/FrameworkSystem/Service/ProxyManagerHandler.py
+++ b/FrameworkSystem/Service/ProxyManagerHandler.py
@@ -7,22 +7,168 @@
 
 __RCSID__ = "$Id$"
 
+from past.builtins import long
+
+import os
 import six
-from DIRAC import gLogger, S_OK, S_ERROR
-from DIRAC.Core.DISET.RequestHandler import RequestHandler
+import pickle
+import pprint
+import threading
+
+from DIRAC import gLogger, S_OK, S_ERROR, rootPath, gConfig
 from DIRAC.Core.Security import Properties
+from DIRAC.Core.Security.ProxyFile import writeChainToProxyFile
+from DIRAC.Core.Security.VOMSService import VOMSService
+from DIRAC.Core.DISET.RequestHandler import RequestHandler
+from DIRAC.Core.Utilities import ThreadSafe
+from DIRAC.Core.Utilities.DictCache import DictCache
+from DIRAC.Core.Utilities.Decorators import deprecated
 from DIRAC.Core.Utilities.ThreadScheduler import gThreadScheduler
 from DIRAC.Core.Utilities.ObjectLoader import ObjectLoader
+from DIRAC.ConfigurationSystem.Client import PathFinder
 from DIRAC.ConfigurationSystem.Client.Helpers import Registry
+from DIRAC.FrameworkSystem.Client.NotificationClient import NotificationClient
+from DIRAC.Resources.ProxyProvider.ProxyProviderFactory import ProxyProviderFactory
 
+gVOMSCacheSync = ThreadSafe.Synchronizer()
+gVOMSFileSync = ThreadSafe.Synchronizer()
 
-class ProxyManagerHandler(RequestHandler):
 
+class ProxyManagerHandler(RequestHandler):
+  """ Proxy manager service
+
+      Contain __VOMSesUsersCache cache, with next structure:
+        Key: VOMS VO name
+        Value: S_OK(dict)/S_ERROR() -- dictionary contain:
+  """
+  # # { <user DN>: {
+  # #     Roles: [ <list of roles> ],
+  # #     suspended: bool,
+  # #     certSuspended: bool,
+  # #     ...
+  # #   }
+  # # }
+
+  __notify = NotificationClient()
+  __VOMSesUsersCache = DictCache()
   __maxExtraLifeFactor = 1.5
   __proxyDB = None
 
+  @classmethod
+  @gVOMSCacheSync
+  def saveVOMSInfoToCache(cls, vo, infoDict):
+    """ Save cache to file
+
+        :param str vo: VO name
+        :param dict infoDict: dictionary with information about users
+    """
+    cls.__VOMSesUsersCache.add(vo, 3600 * 24, infoDict)
+
+  @classmethod
+  @gVOMSFileSync
+  def saveVOMSInfoToFile(cls, vo, infoDict):
+    """ Save cache to file
+
+        :param str vo: VO name
+        :param dict infoDict: dictionary with information about users
+    """
+    if not os.path.exists(cls.__workDir):
+      os.makedirs(cls.__workDir)
+    with open(os.path.join(cls.__workDir, vo + '.pkl'), 'wb+') as f:
+      pickle.dump(infoDict, f, pickle.HIGHEST_PROTOCOL)
+
+  @classmethod
+  @gVOMSFileSync
+  def getVOMSInfoFromFile(cls, vo):
+    """ Load VO cache from file
+
+        :param str vo: VO name
+
+        :return: S_OK(dict)/S_ERROR() -- dictionary with information about users
+    """
+    try:
+      with open(os.path.join(cls.__workDir, vo + '.pkl'), 'rb') as f:
+        return S_OK(pickle.load(f))
+    except Exception as e:
+      return S_ERROR(str(e))
+
+  @classmethod
+  @gVOMSFileSync
+  def getVOMSInfoFromCache(cls, vo=None):
+    """ Load VO cache from file
+
+        :param str vo: VO name
+
+        :return: S_OK(dict)/S_ERROR() -- dictionary with information about users
+    """
+    return cls.__VOMSesUsersCache.get(vo) if vo else cls.__VOMSesUsersCache.getDict()
+
+  @classmethod
+  def __refreshVOMSesUsersCache(cls, voList=None):
+    """ Update cache with information about active users from supported VOs
+
+        :param list voList: VOs to update
+
+        :return: S_OK()/S_ERROR()
+    """
+    def getVOInfo(vo):
+      """ Process to get information from VOMS API
+
+          :param str vo: VO name
+      """
+      usersDict = {}
+      result = S_ERROR('Cannot found administrators for %s VOMS VO' % vo)
+      voAdmins = Registry.getVOOption(vo, "VOAdmin", [])
+
+      for group in Registry.getGroupsForVO(vo).get('Value') or []:
+        for user in voAdmins:
+          result = Registry.getDNForUsernameInGroup(user, group)
+          if result['OK']:
+            # Try to get proxy for any VO admin
+            result = cls.__proxyDB.getProxy(result['Value'], group, 1800)
+            if result['OK']:
+              # Now we have a proxy, lets dump it to file
+              result = writeChainToProxyFile(result['Value'][0], '/tmp/x509_syncTmp')
+              if result['OK']:
+                # Get users from VOMS
+                result = VOMSService(vo=vo).getUsers(result['Value'])
+                if result['OK']:
+                  cls.saveVOMSInfoToCache(vo, result)
+                  cls.saveVOMSInfoToFile(vo, result)
+                  return
+
+      gLogger.error(result['Message'])
+      if not cls.getVOMSInfoFromCache(vo) or not cls.getVOMSInfoFromCache(vo)['OK']:
+        cls.saveVOMSInfoToCache(vo, result)
+      # ################# getVOInfo ###################### #
+
+    gLogger.info('Update VOMSes information..')
+    if not voList:
+      result = Registry.getVOsWithVOMS()
+      if not result['OK']:
+        return result
+      voList = result['Value']
+
+    for vo in voList:
+      processThread = threading.Thread(target=getVOInfo, args=[vo])
+      processThread.start()
+
+    # if diracAdminsNotifyDict:
+    #   subject = '[ProxyManager] Cannot update users from %s VOMS VOs.' % ', '.join(diracAdminsNotifyDict.keys())
+    #   body = pprint.pformat(diracAdminsNotifyDict)
+    #   body += "\n------\n This is a notification from the DIRAC ProxyManager service, please do not reply."
+    #   #cls.__notify.sendMail(getEmailsForGroup('dirac_admin'), subject, body)
+    return S_OK()
+
   @classmethod
   def initializeHandler(cls, serviceInfoDict):
+    """ Initialization
+
+        :param dict serviceInfoDict: service information dictionary
+
+        :return: S_OK()/S_ERROR()
+    """
+    cls.__workDir = os.path.join(gConfig.getValue('/LocalSite/InstancePath', rootPath), 'work/ProxyManager')
     useMyProxy = cls.srv_getCSOption("UseMyProxy", False)
     try:
       result = ObjectLoader().loadObject('FrameworkSystem.DB.ProxyDB', 'ProxyDB')
@@ -30,18 +176,37 @@ def initializeHandler(cls, serviceInfoDict):
         gLogger.error('Failed to load ProxyDB class: %s' % result['Message'])
         return result
       dbClass = result['Value']
-
       cls.__proxyDB = dbClass(useMyProxy=useMyProxy)
-
     except RuntimeError as excp:
       return S_ERROR("Can't connect to ProxyDB: %s" % excp)
     gThreadScheduler.addPeriodicTask(900, cls.__proxyDB.purgeExpiredTokens, elapsedTime=900)
     gThreadScheduler.addPeriodicTask(900, cls.__proxyDB.purgeExpiredRequests, elapsedTime=900)
     gThreadScheduler.addPeriodicTask(21600, cls.__proxyDB.purgeLogs)
     gThreadScheduler.addPeriodicTask(3600, cls.__proxyDB.purgeExpiredProxies)
+    gThreadScheduler.addPeriodicTask(3600 * 24, cls.__refreshVOMSesUsersCache)
     if useMyProxy:
       gLogger.info("MyProxy: %s\n MyProxy Server: %s" % (useMyProxy, cls.__proxyDB.getMyProxyServer()))
-    return S_OK()
+    return cls.__refreshVOMSesUsersCache()
+
+  types_getVOMSesUsers = []
+
+  def export_getVOMSesUsers(self):
+    """ Return fresh info from service about VOMSes
+
+        :return: S_OK(dict)/S_ERROR()
+    """
+    VOMSesUsers = self.getVOMSInfoFromCache()
+    result = Registry.getVOs()
+    if not result['OK']:
+      return result
+    for vo in result['Value']:
+      if vo not in VOMSesUsers:
+        result = self.getVOMSInfoFromFile(vo)
+        if result['OK']:
+          VOMSesUsers[vo] = result['Value']
+          continue
+        VOMSesUsers[vo] = S_ERROR('No information from "%s" VOMS VO' % vo)
+    return S_OK(VOMSesUsers)
 
   def __generateUserProxiesInfo(self):
     """ Generate information dict about user proxies
@@ -50,32 +215,23 @@ def __generateUserProxiesInfo(self):
     """
     proxiesInfo = {}
     credDict = self.getRemoteCredentials()
-    result = Registry.getDNForUsername(credDict['username'])
+    result = Registry.getDNsForUsername(credDict['username'])
     if not result['OK']:
       return result
-    selDict = {'UserDN': result['Value']}
-    result = self.__proxyDB.getProxiesContent(selDict, {})
+    result = self.__proxyDB.getProxiesContent({'UserDN': result['Value']})
     if not result['OK']:
       return result
-    contents = result['Value']
-    userDNIndex = contents['ParameterNames'].index("UserDN")
-    userGroupIndex = contents['ParameterNames'].index("UserGroup")
-    expirationIndex = contents['ParameterNames'].index("ExpirationTime")
-    for record in contents['Records']:
-      userDN = record[userDNIndex]
-      if userDN not in proxiesInfo:
-        proxiesInfo[userDN] = {}
-      userGroup = record[userGroupIndex]
-      proxiesInfo[userDN][userGroup] = record[expirationIndex]
-    return proxiesInfo
-
-  def __addKnownUserProxiesInfo(self, retDict):
-    """ Given a S_OK/S_ERR add a proxies entry with info of all the proxies a user has uploaded
+    for data in result['Value']['Dictionaries']:
+      if data['DN'] not in proxiesInfo:
+        proxiesInfo[data['DN']] = {}
+      for k, v in data.items():
+        proxiesInfo[data['DN']][k] = v
 
-        :return: S_OK(dict)/S_ERROR()
-    """
-    retDict['proxies'] = self.__generateUserProxiesInfo()
-    return retDict
+    for dn, data in proxiesInfo.items():
+      proxiesInfo[dn]['SupportedGroups'] = list(set(data['SupportedGroups']))
+      proxiesInfo[dn]['SupportedGroups'].sort()
+
+    return S_OK(proxiesInfo)
 
   auth_getUserProxiesInfo = ['authenticated']
   types_getUserProxiesInfo = []
@@ -85,42 +241,31 @@ def export_getUserProxiesInfo(self):
 
         :return: S_OK(dict)
     """
-    return S_OK(self.__generateUserProxiesInfo())
+    return self.__generateUserProxiesInfo()
 
-  # WARN: Since v7r1 requestDelegationUpload method use only first argument!
-  # WARN:   Second argument for compatibility with older versions
-  types_requestDelegationUpload = [six.integer_types, [six.string_types, bool, type(None)]]
+  # WARN: Since v7r1 requestDelegationUpload method not use arguments!
+  auth_requestDelegationUpload = ['authenticated']
+  types_requestDelegationUpload = []
 
-  def export_requestDelegationUpload(self, requestedUploadTime, diracGroup=None):
+  def export_requestDelegationUpload(self, requestedUploadTime=None, diracGroup=None):
     """ Request a delegation. Send a delegation request to client
 
-        :param int requestedUploadTime: requested live time
-
         :return: S_OK(dict)/S_ERROR() -- dict contain id and proxy as string of the request
     """
     if diracGroup:
       # WARN: Since v7r1, DIRAC has implemented the ability to store only one proxy and
       # WARN:   dynamically add a group at the request of a proxy. This means that group extensions
       # WARN:   doesn't need for storing proxies.
-      self.log.warn("Proxy with DIRAC group or VOMS extensions must be not allowed to be uploaded.")
+      return S_ERROR("Proxy with DIRAC group or VOMS extensions not allowed to be uploaded.")
+
     credDict = self.getRemoteCredentials()
-    userDN = credDict['DN']
-    userName = credDict['username']
-    userGroup = diracGroup or credDict['group']
-    retVal = Registry.getGroupsForUser(credDict['username'])
-    if not retVal['OK']:
-      return retVal
-    groupsAvailable = retVal['Value']
-    if userGroup not in groupsAvailable:
-      return S_ERROR("%s is not a valid group for user %s" % (userGroup, userName))
-    clientChain = credDict['x509Chain']
-    clientSecs = clientChain.getIssuerCert()['Value'].getRemainingSecs()['Value']
-    requestedUploadTime = min(requestedUploadTime, clientSecs)  # FIXME: this is useless now...
-    result = self.__proxyDB.generateDelegationRequest(credDict['x509Chain'], userDN)
+    result = self.__proxyDB.generateDelegationRequest(credDict)
     if result['OK']:
-      gLogger.info("Upload request by %s:%s given id %s" % (userName, userGroup, result['Value']['id']))
+      gLogger.info("Upload request by %s:%s given id %s" %
+                   (credDict['username'], credDict['group'], result['Value']['id']))
     else:
-      gLogger.error("Upload request failed", "by %s:%s : %s" % (userName, userGroup, result['Message']))
+      gLogger.error("Upload request failed", "by %s:%s : %s" %
+                    (credDict['username'], credDict['group'], result['Message']))
     return result
 
   types_completeDelegationUpload = [six.integer_types, six.string_types]
@@ -128,19 +273,21 @@ def export_requestDelegationUpload(self, requestedUploadTime, diracGroup=None):
   def export_completeDelegationUpload(self, requestId, pemChain):
     """ Upload result of delegation
 
-        :param int,long requestId: identity number
+        :param requestId: identity number
+        :type requestId: int or long
         :param str pemChain: certificate as string
 
         :return: S_OK(dict)/S_ERROR() -- dict contain proxies
     """
+
     credDict = self.getRemoteCredentials()
     userId = "%s:%s" % (credDict['username'], credDict['group'])
     retVal = self.__proxyDB.completeDelegation(requestId, credDict['DN'], pemChain)
     if not retVal['OK']:
       gLogger.error("Upload proxy failed", "id: %s user: %s message: %s" % (requestId, userId, retVal['Message']))
-      return self.__addKnownUserProxiesInfo(retVal)
+      return retVal
     gLogger.info("Upload %s by %s completed" % (requestId, userId))
-    return self.__addKnownUserProxiesInfo(S_OK())
+    return self.__generateUserProxiesInfo()
 
   types_getRegisteredUsers = []
 
@@ -157,21 +304,31 @@ def export_getRegisteredUsers(self, validSecondsRequired=0):
       return self.__proxyDB.getUsers(validSecondsRequired, userMask=credDict['username'])
     return self.__proxyDB.getUsers(validSecondsRequired)
 
-  def __checkProperties(self, requestedUserDN, requestedUserGroup):
+  def __checkProperties(self, requestedUsername, requestedUserGroup, credDict, personal):
     """ Check the properties and return if they can only download limited proxies if authorized
 
-        :param str requestedUserDN: user DN
+        :param str requestedUsername: user name
         :param str requestedUserGroup: DIRAC group
+        :param dict credDict: remote credentials
+        :param bool personal: get personal proxy
 
-        :return: S_OK(boolean)/S_ERROR()
+        :return: S_OK(bool)/S_ERROR()
     """
-    credDict = self.getRemoteCredentials()
+    if personal:
+      csSection = PathFinder.getServiceSection('Framework/ProxyManager')
+      if requestedUsername != credDict['username'] or requestedUserGroup != credDict['group']:
+        return S_ERROR("You can't get %s@%s proxy!" % (credDict['username'], credDict['group']))
+      elif not gConfig.getValue('%s/downloadablePersonalProxy' % csSection, False):
+        return S_ERROR("You can't get proxy, configuration settings not allow to do that.")
+      else:
+        return S_OK(False)
+
     if Properties.FULL_DELEGATION in credDict['properties']:
       return S_OK(False)
     if Properties.LIMITED_DELEGATION in credDict['properties']:
       return S_OK(True)
     if Properties.PRIVATE_LIMITED_DELEGATION in credDict['properties']:
-      if credDict['DN'] != requestedUserDN:
+      if credDict['username'] != requestedUsername:
         return S_ERROR("You are not allowed to download any proxy")
       if Properties.PRIVATE_LIMITED_DELEGATION not in Registry.getPropertiesForGroup(requestedUserGroup):
         return S_ERROR("You can't download proxies for that group")
@@ -181,159 +338,130 @@ def __checkProperties(self, requestedUserDN, requestedUserGroup):
 
   types_getProxy = [six.string_types, six.string_types, six.string_types, six.integer_types]
 
-  def export_getProxy(self, userDN, userGroup, requestPem, requiredLifetime):
-    """ Get a proxy for a userDN/userGroup
+  def export_getProxy(self, instance, group, requestPem, requiredLifetime,
+                      token=None, vomsAttribute=None, personal=False):
+    """ Get a proxy for a user/group
 
-        :param requestPem: PEM encoded request object for delegation
-        :param requiredLifetime: Argument for length of proxy
+        :param str instance: user name or DN
+        :param str group: DIRAC group
+        :param str requestPem: PEM encoded request object for delegation
+        :param int requiredLifetime: Argument for length of proxy
+        :param str token: token that need to use
+        :param bool vomsAttribute: make proxy with VOMS extension
+        :param bool personal: get personal proxy
 
           * Properties:
               * FullDelegation <- permits full delegation of proxies
               * LimitedDelegation <- permits downloading only limited proxies
               * PrivateLimitedDelegation <- permits downloading only limited proxies for one self
-    """
-    credDict = self.getRemoteCredentials()
-
-    result = self.__checkProperties(userDN, userGroup)
-    if not result['OK']:
-      return result
-    forceLimited = result['Value']
-
-    self.__proxyDB.logAction("download proxy", credDict['DN'], credDict['group'], userDN, userGroup)
-    return self.__getProxy(userDN, userGroup, requestPem, requiredLifetime, forceLimited)
 
-  def __getProxy(self, userDN, userGroup, requestPem, requiredLifetime, forceLimited):
-    """ Internal to get a proxy
-
-        :param str userDN: user DN
-        :param str userGroup: DIRAC group
-        :param str requestPem: dump of request certificate
-        :param int requiredLifetime: requested live time of proxy
-        :param boolean forceLimited: limited proxy
+          * Properties for personal proxy:
+              * NormalUser <- permits full delegation of proxies
 
         :return: S_OK(str)/S_ERROR()
     """
-    retVal = self.__proxyDB.getProxy(userDN, userGroup, requiredLifeTime=requiredLifetime)
-    if not retVal['OK']:
-      return retVal
-    chain, secsLeft = retVal['Value']
-    # If possible we return a proxy 1.5 longer than requested
-    requiredLifetime = int(min(secsLeft, requiredLifetime * self.__maxExtraLifeFactor))
-    retVal = chain.generateChainFromRequestString(requestPem,
-                                                  lifetime=requiredLifetime,
-                                                  requireLimited=forceLimited)
-    if not retVal['OK']:
-      return retVal
-    return S_OK(retVal['Value'])
-
-  types_getVOMSProxy = [six.string_types, six.string_types,
-                        six.string_types, six.integer_types,
-                        [six.string_types, type(None), bool]]
-
-  def export_getVOMSProxy(self, userDN, userGroup, requestPem, requiredLifetime, vomsAttribute=None):
-    """ Get a proxy for a userDN/userGroup
+    # Test that group enable to download
+    if not Registry.isDownloadableGroup(group):
+      return S_ERROR('"%s" group is disable to download.' % group)
 
-        :param requestPem: PEM encoded request object for delegation
-        :param requiredLifetime: Argument for length of proxy
-        :param vomsAttribute: VOMS attr to add to the proxy
+    # Read arguments
+    result = self.__getDNAndUsername(instance, group)
+    if not result['OK']:
+      return result
+    user, userDN = result['Value']
 
-          * Properties :
-              * FullDelegation <- permits full delegation of proxies
-              * LimitedDelegation <- permits downloading only limited proxies
-              * PrivateLimitedDelegation <- permits downloading only limited proxies for one self
-    """
     credDict = self.getRemoteCredentials()
 
-    result = self.__checkProperties(userDN, userGroup)
+    if token:
+      result = self.__proxyDB.useToken(token, credDict['username'], credDict['group'])
+      if not result['OK']:
+        return result
+      if not result['Value']:
+        return S_ERROR("Proxy token is invalid")
+
+    result = self.__checkProperties(user, group, credDict, personal)
     if not result['OK']:
       return result
-    forceLimited = result['Value']
+    forceLimited = True if token else result['Value']
 
-    self.__proxyDB.logAction("download voms proxy", credDict['DN'], credDict['group'], userDN, userGroup)
-    return self.__getVOMSProxy(userDN, userGroup, requestPem, requiredLifetime, vomsAttribute, forceLimited)
+    log = "download %sproxy%s" % ('VOMS ' if vomsAttribute else '', 'with token' if token else '')
+    self.__proxyDB.logAction(log, credDict['username'], credDict['group'], user, group)
 
-  def __getVOMSProxy(self, userDN, userGroup, requestPem, requiredLifetime, vomsAttribute, forceLimited):
-    retVal = self.__proxyDB.getVOMSProxy(userDN, userGroup,
-                                         requiredLifeTime=requiredLifetime,
-                                         requestedVOMSAttr=vomsAttribute)
+    retVal = self.__proxyDB.getProxy(userDN, group, requiredLifeTime=requiredLifetime, voms=vomsAttribute)
     if not retVal['OK']:
       return retVal
     chain, secsLeft = retVal['Value']
     # If possible we return a proxy 1.5 longer than requested
     requiredLifetime = int(min(secsLeft, requiredLifetime * self.__maxExtraLifeFactor))
-    return chain.generateChainFromRequestString(requestPem,
-                                                lifetime=requiredLifetime,
+    return chain.generateChainFromRequestString(requestPem, lifetime=requiredLifetime,
                                                 requireLimited=forceLimited)
 
-  types_setPersistency = [six.string_types, six.string_types, bool]
-
-  def export_setPersistency(self, userDN, userGroup, persistentFlag):
-    """ Set the persistency for a given dn/group
-
-        :param str userDN: user DN
-        :param str userGroup: DIRAC group
-        :param boolean persistentFlag: if proxy persistent
-
-        :return: S_OK()/S_ERROR()
-    """
-    retVal = self.__proxyDB.setPersistencyFlag(userDN, userGroup, persistentFlag)
-    if not retVal['OK']:
-      return retVal
-    credDict = self.getRemoteCredentials()
-    self.__proxyDB.logAction("set persistency to %s" % bool(persistentFlag),
-                             credDict['DN'], credDict['group'], userDN, userGroup)
-    return S_OK()
-
   types_deleteProxyBundle = [(list, tuple)]
 
   def export_deleteProxyBundle(self, idList):
-    """ delete a list of id's
+    """ Delete a list of id's
 
-        :param list,tuple idList: list of identity numbers
+        :param idList: list of identity numbers
+        :type idList: list or tuple
 
         :return: S_OK(int)/S_ERROR()
     """
     errorInDelete = []
     deleted = 0
     for _id in idList:
-      if len(_id) != 2:
-        errorInDelete.append("%s doesn't have two fields" % str(_id))
-      retVal = self.export_deleteProxy(_id[0], _id[1])
-      if not retVal['OK']:
-        errorInDelete.append("%s : %s" % (str(_id), retVal['Message']))
+      if isinstance(_id, (tuple, list)):
+        if len(_id) != 2:
+          errorInDelete.append("%s doesn't have two fields" % str(_id))
+        if _id[0]:
+          retVal = self.export_deleteProxy(_id[0], None if isinstance(_id[1], list) else _id[1])
+          if not retVal['OK']:
+            errorInDelete.append("%s : %s" % (str(_id), retVal['Message']))
+          else:
+            deleted += 1
       else:
-        deleted += 1
+        retVal = self.export_deleteProxy(_id)
+        if not retVal['OK']:
+          errorInDelete.append("%s : %s" % (str(_id), retVal['Message']))
+        else:
+          deleted += 1
     if errorInDelete:
       return S_ERROR("Could not delete some proxies: %s" % ",".join(errorInDelete))
     return S_OK(deleted)
 
-  types_deleteProxy = [(list, tuple)]
+  types_deleteProxy = [six.string_types]
 
-  def export_deleteProxy(self, userDN, userGroup):
+  def export_deleteProxy(self, instance, userGroup=None):
     """ Delete a proxy from the DB
 
-        :param str userDN: user DN
+        :param str instance: user name or DN
         :param str userGroup: DIRAC group
 
         :return: S_OK()/S_ERROR()
     """
+    result = self.__getDNAndUsername(instance, userGroup)
+    if not result['OK']:
+      return result
+    username, userDN = result['Value']
+    if not userDN:
+      return S_ERROR('Not DN found for %s user in %s group' % (username, userGroup))
+
     credDict = self.getRemoteCredentials()
     if Properties.PROXY_MANAGEMENT not in credDict['properties']:
-      if userDN != credDict['DN']:
+      if username != credDict['username']:
         return S_ERROR("You aren't allowed!")
-    retVal = self.__proxyDB.deleteProxy(userDN, userGroup)
+    retVal = self.__proxyDB.deleteProxy(userDN)
     if not retVal['OK']:
       return retVal
-    self.__proxyDB.logAction("delete proxy", credDict['DN'], credDict['group'], userDN, userGroup)
+    self.__proxyDB.logAction("delete proxy", credDict['username'], credDict['group'], username, userGroup)
     return S_OK()
 
   types_getContents = [dict, (list, tuple), six.integer_types, six.integer_types]
 
-  def export_getContents(self, selDict, sortDict, start, limit):
+  def export_getContents(self, selDict, conn, start=0, limit=0):
     """ Retrieve the contents of the DB
 
         :param dict selDict: selection fields
-        :param list,tuple sortDict: sorting fields
+        :param list conn: filters
         :param int start: search limit start
         :param int start: search limit amount
 
@@ -342,7 +470,8 @@ def export_getContents(self, selDict, sortDict, start, limit):
     credDict = self.getRemoteCredentials()
     if Properties.PROXY_MANAGEMENT not in credDict['properties']:
       selDict['UserName'] = credDict['username']
-    return self.__proxyDB.getProxiesContent(selDict, sortDict, start, limit)
+
+    return self.__proxyDB.getProxiesContent(selDict, conn, start=start, limit=limit)
 
   types_getLogContents = [dict, (list, tuple), six.integer_types, six.integer_types]
 
@@ -350,9 +479,10 @@ def export_getLogContents(self, selDict, sortDict, start, limit):
     """ Retrieve the contents of the DB
 
         :param dict selDict: selection fields
-        :param list,tuple sortDict: search filter
+        :param sortDict: search filter
+        :type sortDict: list or tuple
         :param int start: search limit start
-        :param int start: search limit amount
+        :param int limit: search limit amount
 
         :return: S_OK(dict)/S_ERROR() -- dict contain fields, record list, total records
     """
@@ -360,74 +490,291 @@ def export_getLogContents(self, selDict, sortDict, start, limit):
 
   types_generateToken = [six.string_types, six.string_types, six.integer_types]
 
-  def export_generateToken(self, requesterDN, requesterGroup, tokenUses):
+  def export_generateToken(self, requester, requesterGroup, tokenUses):
     """ Generate tokens for proxy retrieval
 
-        :param str requesterDN: user DN
+        :param str requester: user name or DN
         :param str requesterGroup: DIRAC group
         :param int tokenUses: number of uses
 
         :return: S_OK(tuple)/S_ERROR() -- tuple contain token, number uses
     """
+    # Is instance user DN?
+    if requester.startswith('/'):
+      result = Registry.getUsernameForDN(requester)
+      if not result['OK']:
+        return result
+      requester = result['Value']
+
     credDict = self.getRemoteCredentials()
-    self.__proxyDB.logAction("generate tokens", credDict['DN'], credDict['group'], requesterDN, requesterGroup)
-    return self.__proxyDB.generateToken(requesterDN, requesterGroup, numUses=tokenUses)
+    self.__proxyDB.logAction("generate tokens", credDict['username'], credDict['group'],
+                             requester, requesterGroup)
+    return self.__proxyDB.generateToken(requester, requesterGroup, numUses=tokenUses)
 
-  types_getProxyWithToken = [six.string_types, six.string_types, six.string_types, six.integer_types, six.string_types]
+  types_getVOMSProxyWithToken = [basestring, basestring, basestring, six.integer_types, [basestring, type(None)]]
 
-  def export_getProxyWithToken(self, userDN, userGroup, requestPem, requiredLifetime, token):
-    """ Get a proxy for a userDN/userGroup
+  @deprecated("This method is deprecated, you can use export_getProxy with token and vomsAttribute parameter")
+  def export_getVOMSProxyWithToken(self, user, userGroup, requestPem, requiredLifetime, token, vomsAttribute=None):
+    """ Get a proxy with VOMS extension for a user/userGroup by using token
 
-        :param requestPem: PEM encoded request object for delegation
-        :param requiredLifetime: Argument for length of proxy
-        :param token: Valid token to get a proxy
+        :param str user: user name
+        :param str userGroup: DIRAC group
+        :param str requestPem: PEM encoded request object for delegation
+        :param int requiredLifetime: Argument for length of proxy
+        :param str token: Valid token to get a proxy
 
-          * Properties:
-              * FullDelegation <- permits full delegation of proxies
-              * LimitedDelegation <- permits downloading only limited proxies
-              * PrivateLimitedDelegation <- permits downloading only limited proxies for one self
+        :return: S_OK(str)/S_ERROR()
     """
-    credDict = self.getRemoteCredentials()
-    result = self.__proxyDB.useToken(token, credDict['DN'], credDict['group'])
-    gLogger.info("Trying to use token %s by %s:%s" % (token, credDict['DN'], credDict['group']))
-    if not result['OK']:
-      return result
-    if not result['Value']:
-      return S_ERROR("Proxy token is invalid")
-    self.__proxyDB.logAction("used token", credDict['DN'], credDict['group'], userDN, userGroup)
+    return self.export_getProxy(user, userGroup, requestPem, requiredLifetime, token=token, vomsAttribute=vomsAttribute)
 
-    result = self.__checkProperties(userDN, userGroup)
-    if not result['OK']:
-      return result
-    self.__proxyDB.logAction("download proxy with token", credDict['DN'], credDict['group'], userDN, userGroup)
-    return self.__getProxy(userDN, userGroup, requestPem, requiredLifetime, True)
+  types_getProxyWithToken = [basestring, basestring, basestring, six.integer_types, basestring]
+
+  @deprecated("This method is deprecated, you can use export_getProxy with token parameter")
+  def export_getProxyWithToken(self, user, userGroup, requestPem, requiredLifetime, token):
+    """ Get a proxy for a user/userGroup by using token
+
+        :param str user: user name
+        :param str userGroup: DIRAC group
+        :param str requestPem: PEM encoded request object for delegation
+        :param int requiredLifetime: Argument for length of proxy
+        :param str token: Valid token to get a proxy
 
-  types_getVOMSProxyWithToken = [six.string_types, six.string_types,
-                                 six.string_types, six.integer_types,
-                                 [six.string_types, type(None)]]
+        :return: S_OK(str)/S_ERROR()
+    """
+    return self.export_getProxy(user, userGroup, requestPem, requiredLifetime, token=token)
 
-  def export_getVOMSProxyWithToken(self, userDN, userGroup, requestPem, requiredLifetime, token, vomsAttribute=None):
-    """ Get a proxy for a userDN/userGroup
+  types_getVOMSProxy = [basestring, basestring, basestring, six.integer_types, [basestring, type(None)]]
 
-        :param requestPem: PEM encoded request object for delegation
-        :param requiredLifetime: Argument for length of proxy
-        :param vomsAttribute: VOMS attr to add to the proxy
+  @deprecated("This method is deprecated, you can use export_getProxy with vomsAttribute parameter")
+  def export_getVOMSProxy(self, user, userGroup, requestPem, requiredLifetime, vomsAttribute=None):
+    """ Get a proxy with VOMS extension for a user/userGroup
 
-          * Properties :
-              * FullDelegation <- permits full delegation of proxies
-              * LimitedDelegation <- permits downloading only limited proxies
-              * PrivateLimitedDelegation <- permits downloading only limited proxies for one self
+        :param str user: user name
+        :param str userGroup: DIRAC group
+        :param str requestPem: PEM encoded request object for delegation
+        :param int requiredLifetime: Argument for length of proxy
+        :param str token: Valid token to get a proxy
+
+        :return: S_OK(str)/S_ERROR()
     """
-    credDict = self.getRemoteCredentials()
-    result = self.__proxyDB.useToken(token, credDict['DN'], credDict['group'])
-    if not result['OK']:
-      return result
-    if not result['Value']:
-      return S_ERROR("Proxy token is invalid")
-    self.__proxyDB.logAction("used token", credDict['DN'], credDict['group'], userDN, userGroup)
+    return self.export_getProxy(user, userGroup, requestPem, requiredLifetime, vomsAttribute=vomsAttribute)
 
-    result = self.__checkProperties(userDN, userGroup)
-    if not result['OK']:
-      return result
-    self.__proxyDB.logAction("download voms proxy with token", credDict['DN'], credDict['group'], userDN, userGroup)
-    return self.__getVOMSProxy(userDN, userGroup, requestPem, requiredLifetime, vomsAttribute, True)
+  types_getGroupsStatusByUsername = [str]
+
+  def export_getGroupsStatusByUsername(self, username, groups=None):
+    """ Get status of every group for DIRAC user:
+
+        :param str username: user name
+
+        :return: S_OK(dict)/S_ERROR()
+    """
+    # # {
+    # #   <group>: {
+    # #     Status: ..,
+    # #     Comment: ..,
+    # #     DN: ..,
+    # #     Action: [ <fn>, [ <opns> ] ]
+    # #   },
+    # #   { ... }
+    # #   <group2>: {} ... }
+    # # }
+    statusDict = {}
+    if not groups:
+      result = Registry.getGroupsForUser(username)
+      if not result['OK']:
+        return result
+      groups = result['Value']
+
+    provDict = {}
+    groupDict = {}
+    # Sort user DNs for groups and proxy providers
+    for group in groups:
+      result = Registry.getDNsForUsernameInGroup(username, group)
+      if not result['OK']:
+        if group not in statusDict:
+          statusDict[group] = [{'Status': 'fail', 'Comment': result['Message']}]
+        continue
+      for dn in [result['Value'][0]]:  # we get only fist DN for now
+        result = self.__proxyDB.getProxyProviderForDN(dn, username=username)
+        if not result['OK']:
+          return result
+        pProvider = result['Value']
+        if group not in groupDict:
+          groupDict[group] = []
+        if pProvider not in provDict:
+          provDict[pProvider] = []
+        provDict[pProvider] = list(set(provDict[pProvider] + [dn]))
+        groupDict[group] = list(set(groupDict[group] + [dn]))
+
+    # Check VOMS VO
+    for group, dns in groupDict.items():
+      if group not in statusDict:
+        statusDict[group] = []
+
+      vo = Registry.getGroupOption(group, 'VO')
+
+      result = Registry.getVOsWithVOMS(voList=[vo])
+      if not result['OK']:
+        return result
+      if not result['Value']:
+        continue
+
+      result = Registry.getVOMSServerInfo(vo)
+      if not result['OK']:
+        return result
+      vomsServers = result['Value'][vo]["Servers"] if result['Value'] else {}
+      vomsServerURL = 'https://%s:8443/voms/register/start.action' % vomsServers.keys()[0]
+
+      result = self.getVOMSInfoFromCache(vo)
+      if not result:
+        result = self.getVOMSInfoFromFile(vo)
+        if result['OK']:
+          result = result['Value']
+        result = S_ERROR('No information from "%s" VOMS VO' % vo)
+
+      if not result or not result['OK']:
+        err = '' if not result else result.get('Message', '')
+        st = {'Status': 'unknown',
+              "Comment": 'Fail to get %s VOMS VO information depended for this group: %s' % (vo, err)}
+        for dn in dns:
+          if dn in groupDict[group]:
+            groupDict[group].remove(dn)
+          st['DN'] = dn
+          statusDict[group].append(st)
+        continue
+
+      voData = result['Value']
+      for dn in dns:
+        if dn not in voData:
+          if dn in groupDict[group]:
+            groupDict[group].remove(dn)
+          st = {'Status': 'failed', 'DN': dn, 'Action': ['openURL', [vomsServerURL]],
+                'Comment': 'Make sure you(%s) are a member of the %s VOMS VO depended for this group. ' % (dn, vo)}
+          statusDict[group].append(st)
+          continue
+
+        role = Registry.getGroupOption(group, 'VOMSRole')
+        if not role:
+          if voData[dn]['Suspended']:
+            if dn in groupDict[group]:
+              groupDict[group].remove(dn)
+            st = {'Status': 'suspended', 'DN': dn, 'Action': ['openURL', [vomsServerURL]],
+                  'Comment': 'It seems you(%s) are suspended in the %s VOMS VO depended for this group. ' %
+                  (dn, vo)}
+            statusDict[group].append(st)
+            continue
+        else:
+          if role not in voData[dn]['VOMSRoles']:
+            if dn in groupDict[group]:
+              groupDict[group].remove(dn)
+            st = {'Status': 'failed', 'DN': dn, 'Action': ['openURL', [vomsServerURL]],
+                  'Comment': 'It seems you(%s) have no %s role in %s VOMS VO depended for this group. ' %
+                  (dn, role, vo)}
+            statusDict[group].append(st)
+            continue
+          if role in voData[dn]['SuspendedRoles']:
+            if dn in groupDict[group]:
+              groupDict[group].remove(dn)
+            st = {'Status': 'suspended', 'DN': dn, 'Action': ['openURL', [vomsServerURL]],
+                  'Comment': 'It seems you(%s) are suspended for %s role in the %s VOMS VO depended for this group. ' %
+                  (dn, role, vo)}
+            statusDict[group].append(st)
+            continue
+
+    # Check DNs by proxy providers
+    for prov, dns in provDict.items():
+      dns = list(set(dns))
+
+      # Cut off existed DNs in DB
+      result = self.__proxyDB.getValidDNs(dns)
+      if not result['OK']:
+        return result
+      for dn, time, group in result['Value']:
+        if dn in dns:
+          dns.remove(dn)
+        st = {'Status': 'ready', 'DN': dn,
+              "Comment": 'proxy uploaded end valid to %s' % time}
+        for _group, _dns in groupDict.items():
+          if not group or group == _group:
+            if _group not in statusDict:
+              statusDict[_group] = []
+            if dn in _dns:
+              statusDict[_group].append(st)
+
+      # If for DN not found proxy provider
+      if not prov or prov == 'Certificate':
+        for dn in dns:
+          st = {'Status': 'not ready', 'DN': dn, "Action": ['upload proxy'],
+                "Comment": 'You have no proxy with(%s) uploaded to DIRAC.' % dn}
+          for group, dns in groupDict.items():
+            if group not in statusDict:
+              statusDict[group] = []
+            if dn in dns:
+              statusDict[group].append(st)
+        continue
+
+      # If proxy provider exist for DN
+      result = ProxyProviderFactory().getProxyProvider(prov, proxyManager=self.__proxyDB)
+      if not result['OK']:
+        return result
+      pProvObj = result['Value']
+      for dn in dns:
+        result = pProvObj.checkStatus(dn)
+        st = result['Value'] if result['OK'] else {'Status': 'unknown', "Comment": result['Message']}
+        st['DN'] = dn
+        for group, dns in groupDict.items():
+          if group not in statusDict:
+            statusDict[group] = []
+          if dn in dns:
+            statusDict[group].append(st)
+
+    resD = {}
+    for group, statuses in statusDict.items():
+      for stat in statuses:
+        if stat['Status'] not in ["ready", "unknown"]:
+          resD[group] = stat
+          break
+      if group not in resD:
+        for stat in statuses:
+          if stat['Status'] == "ready":
+            resD[group] = stat
+            break
+      if group not in resD:
+        resD[group] = statuses[0]
+
+    return S_OK(resD)
+
+  def __getDNAndUsername(self, instance, group=None):
+    """ Parse instance to understand if it's DN and find username
+
+        :param str instance: user name or DN
+        :param str group: user group
+
+        :return S_OK(tuple)/S_ERROR() -- tuple contain username and userDN
+    """
+    dn = None
+    user = instance
+
+    # Is instance user DN?
+    if instance.startswith('/'):
+      dn = instance
+      result = Registry.getUsernameForDN(instance)
+      if not result['OK']:
+        return result
+      user = result['Value']
+
+    if group:
+      result = Registry.getDNsForUsernameInGroup(instance, group)
+      if not result['OK']:
+        return result
+      if dn and dn not in result['Value']:
+        return S_ERROR('Requested %s DN not match with %s user, %s group' % (dn, user, group))
+      dn = result['Value'][0]
+    return S_OK((user, dn))
+
+  types_setPersistency = []
+
+  @deprecated("Unuse")
+  def export_setPersistency(self, user, userGroup, persistentFlag):
+    """ Set the persistency for a given DN/group """
+    return S_OK(True)
diff --git a/FrameworkSystem/Utilities/AuthHandler.py b/FrameworkSystem/Utilities/AuthHandler.py
new file mode 100644
index 00000000000..1b5619db52a
--- /dev/null
+++ b/FrameworkSystem/Utilities/AuthHandler.py
@@ -0,0 +1,157 @@
+""" Handler to provide REST APIs to manage user authentication.
+"""
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import print_function
+
+import re
+
+from tornado import web, gen
+from tornado.template import Template
+
+from DIRAC import S_OK, S_ERROR, gConfig, gLogger
+from DIRAC.Core.Web.WebHandler import WebHandler, asyncGen, WErr
+from DIRAC.FrameworkSystem.Client.AuthManagerClient import gSessionManager
+from DIRAC.FrameworkSystem.Client.NotificationClient import NotificationClient
+from DIRAC.ConfigurationSystem.Client.Helpers.Resources import getProvidersForInstance
+
+__RCSID__ = "$Id$"
+
+
+class AuthHandler(WebHandler):
+  OVERPATH = True
+  AUTH_PROPS = "all"
+  LOCATION = "/"
+
+  def initialize(self):
+    super(AuthHandler, self).initialize()
+    self.args = {}
+    for arg in self.request.arguments:
+      if len(self.request.arguments[arg]) > 1:
+        self.args[arg] = self.request.arguments[arg]
+      else:
+        self.args[arg] = self.request.arguments[arg][0] or ''
+    return S_OK()
+
+  @asyncGen
+  def web_auth(self):
+    """ REST endpoint for users authentication.
+
+        **GET** /auth/<IdP>?<options> -- this request for initialization authetication flow  
+          * *IdP* -- is a registred in DIRAC Identity provider name that need to use for authentication
+          
+          Options:
+            * *email* -- send the authentcation URL to the email(optional)
+          
+          Responce in the json format with the next keys:
+            * *Status* -- session status, required values: "needToAuth", "ready", "fail".
+            * *URL* -- link for authetication, generated by choosed identity provider. Returned if status is "needToAuth".
+            * *Session* -- current session ID, returned if status is "needToAuth".
+            * *UserName* -- user name, returned if status is "ready".
+
+        **GET** /auth/<session> -- redirect to identity provider authentication endpoint to enable the user to authenticate  
+          * *session* -- session ID
+
+          Responce depended from redirected endpoint
+
+        **GET** /auth/<session>/status -- retrieve session with status and describe  
+          * *session* -- session ID
+
+          Responce in the json format with the next keys:
+            * *Comment* -- comment
+            * *Status* -- session status, requeried statuses: "prepared", "in progress", "failed"
+            * *Session* -- session ID
+            * *ID* -- identity provider user identity number
+            * *Provider* -- identity provider name
+
+        **GET** /auth/redirect -- redirect endpoint to catch responce from authentication flow of identity provider
+          
+          Responce in the html format
+    """
+    optns = self.overpath.strip('/').split('/')
+    if not optns or len(optns) > 2:
+      raise WErr(404, "Wrone way")
+    result = getProvidersForInstance('Id')
+    if not result['OK']:
+      raise WErr(500, result['Message'])
+    idPs = result['Value']
+    idP = optns[0] if optns[0] in idPs else None
+    session = re.match("([A-z0-9]+)?", optns[0]).group()
+
+    if idP:
+      # Create new authenticate session
+      session = self.get_cookie(idP)
+      self.log.info('Initialize "%s" authorization flow' % idP, 'with %s session' % session if session else '')
+      result = yield self.threadTask(gSessionManager.submitAuthorizeFlow, idP, session)
+      if not result['OK']:
+        self.clear_cookie(idP)
+        raise WErr(500, result['Message'])
+      if result['Value']['Status'] == 'ready':
+        self.set_cookie("TypeAuth", idP)
+      elif result['Value']['Status'] == 'needToAuth':
+        if self.args.get('email'):
+          notify = yield self.threadTask(NotificationClient().sendMail, self.args['email'],
+                                         'Authentication throught %s' % idP,
+                                         'Please, go throught the link %s to authorize.' % result['Value']['URL'])
+          if not notify['OK']:
+            result['Value']['Comment'] = '%s\n%s' % (result['Value'].get('Comment') or '', notify['Message'])
+        self.log.notice('%s authorization session "%s" provider was created' % (result['Value']['Session'], idP))
+      else:
+        raise WErr(500, 'Not correct status "%s" of %s' % (result['Value']['Status'], idP))
+      self.finishJEncode(result['Value'])
+
+    elif optns[0] == 'redirect':
+      # Redirect endpoint for response
+      self.log.info('REDIRECT RESPONSE:\n', self.request)
+      if self.args.get('error'):
+        raise WErr(500, '%s session crashed with error:\n%s\n%s' % (self.args.get('state') or '',
+                                                                    self.args['error'],
+                                                                    self.args.get('error_description') or ''))
+      if 'state' not in self.args:
+        raise WErr(404, '"state" argument not set.')
+      if not self.args.get('state'):
+        raise WErr(404, '"state" argument is empty.')
+      self.log.info(self.args['state'], 'session, parsing authorization response %s' % self.args)
+      result = yield self.threadTask(gSessionManager.parseAuthResponse, self.args, self.args['state'])
+      if not result['OK']:
+        raise WErr(500, result['Message'])
+      comment = result['Value']['Comment']
+      status = result['Value']['Status']
+      t = Template('''<!DOCTYPE html>
+        <html><head><title>Authetication</title>
+          <meta charset="utf-8" /></head><body>
+            %s <br>
+            <script type="text/javascript">
+              if ("%s" == "redirect") { window.open("%s","_self") }
+              else { window.close() }
+            </script>
+          </body>
+        </html>''' % (comment, status, comment))
+      self.log.info('>>>REDIRECT:\n', comment)
+      self.finish(t.generate())
+
+    elif session:
+      if optns[-1] == session:
+        # Redirect to authentication endpoint
+        self.log.info(session, 'authorization session flow.')
+        result = yield self.threadTask(gSessionManager.getSessionAuthLink, session)
+        if not result['OK']:
+          raise WErr(500, '%s session not exist or expired!\n%s' % (session, result['Message']))
+        self.log.notice('Redirect to', result['Value'])
+        self.redirect(result['Value'])
+
+      elif optns[-1] == 'status':
+        # Get session authentication status
+        self.log.info(session, 'session, get status of authorization.')
+        result = yield self.threadTask(gSessionManager.getSessionStatus, session)
+        if not result['OK']:
+          raise WErr(500, result['Message'])
+        self.set_cookie("TypeAuth", result['Value']['Provider'])
+        self.set_cookie(result['Value']['Provider'], session)
+        self.finishJEncode(result['Value'])
+
+      else:
+        raise WErr(404, "Wrone way")
+
+    else:
+      raise WErr(404, "Wrone way")
diff --git a/FrameworkSystem/Utilities/OAuth2.py b/FrameworkSystem/Utilities/OAuth2.py
new file mode 100644
index 00000000000..4575d1124b9
--- /dev/null
+++ b/FrameworkSystem/Utilities/OAuth2.py
@@ -0,0 +1,257 @@
+""" OAuth2
+
+    OAuth2 included all methods to work with OIDC authentication flow.
+
+    .. _timeouts:
+
+    Most requests to external servers should have a timeout attached,
+    in case the server is not responding in a timely manner. By default,
+    requests do not time out unless a timeout value is set explicitly.
+    Without a timeout, your code may hang for minutes or more.
+"""
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import print_function
+
+import re
+import random
+import string
+import pprint
+import urllib2 
+# from oauthlib.oauth2 import WebApplicationClient
+
+from requests import Session, exceptions
+
+from DIRAC import gConfig, gLogger, S_OK, S_ERROR
+from DIRAC.ConfigurationSystem.Client.Utilities import getAuthAPI
+from DIRAC.ConfigurationSystem.Client.Helpers.Resources import getProviderInfo
+
+__RCSID__ = "$Id$"
+
+
+class OAuth2(Session):
+  def __init__(self, name=None,
+               scope=None, prompt=None,
+               issuer=None, jwks_uri=None,
+               client_id=None, redirect_uri=None,
+               client_secret=None, proxy_endpoint=None,
+               token_endpoint=None, providerOfWhat=None,
+               scopes_supported=None, userinfo_endpoint=None,
+               max_proxylifetime=None, revocation_endpoint=None,
+               registration_endpoint=None, grant_types_supported=None,
+               authorization_endpoint=None, introspection_endpoint=None,
+               response_types_supported=None, **kwargs):
+    """ OIDCClient constructor
+    """
+    super(OAuth2, self).__init__()
+    self.exceptions = exceptions
+    self.verify = False
+
+    __optns = {}
+    self.parameters = {}
+    self.parameters['name'] = name or kwargs.get('ProviderName')
+    self.log = gLogger.getSubLogger("OAuth2/%s" % self.parameters['name'])
+
+    # Get information from CS
+    result = getProviderInfo(self.parameters['name'])
+    if not result['OK']:
+      raise Exception(result['Message'])
+    __csDict = result['Value']
+
+    # Get configuration from providers server
+    self.parameters['issuer'] = issuer or kwargs.get('issuer') or __csDict.get('issuer')
+    if self.parameters['issuer']:
+      result = self.getWellKnownDict()
+      if not result['OK']:
+        self.log.warn('Cannot get settings remotely:' % result['Message'])
+      elif isinstance(result['Value'], dict):
+        __optns = result['Value']
+
+    for d in [__csDict, kwargs]:
+      for key, value in d.iteritems():
+        __optns[key] = value
+
+    # Get redirect URL from CS
+    authAPI = getAuthAPI()
+    if authAPI:
+      redirect_uri = '%s/auth/redirect' % authAPI.strip('/')
+
+    # Check client Id
+    self.parameters['client_id'] = client_id or __optns.get('client_id')
+    if not self.parameters['client_id']:
+      raise Exception('client_id parameter is absent.')
+
+    # Create list of all possible scopes
+    self.parameters['scope'] = scope or __optns.get('scope', [])
+    if not isinstance(self.parameters['scope'], list):
+      self.parameters['scope'] = self.parameters['scope'].split(',')
+
+    # Init main OAuth2 options
+    self.parameters['prompt'] = prompt or __optns.get('prompt')
+    self.parameters['redirect_uri'] = redirect_uri or __optns.get('redirect_uri')
+    self.parameters['client_secret'] = client_secret or __optns.get('client_secret')
+    self.parameters['token_endpoint'] = token_endpoint or __optns.get('token_endpoint')
+    self.parameters['proxy_endpoint'] = proxy_endpoint or __optns.get('proxy_endpoint')
+    self.parameters['scopes_supported'] = scopes_supported or __optns.get('scopes_supported')
+    self.parameters['userinfo_endpoint'] = userinfo_endpoint or __optns.get('userinfo_endpoint')
+    self.parameters['max_proxylifetime'] = max_proxylifetime or __optns.get('max_proxylifetime', 86400)
+    self.parameters['revocation_endpoint'] = revocation_endpoint or __optns.get('revocation_endpoint')
+    self.parameters['registration_endpoint'] = registration_endpoint or __optns.get('registration_endpoint')
+    self.parameters['authorization_endpoint'] = authorization_endpoint or __optns.get('authorization_endpoint')
+    self.parameters['introspection_endpoint'] = introspection_endpoint or __optns.get('introspection_endpoint')
+
+  def get(self, parameter):
+    return self.parameters.get(parameter)
+
+  def createAuthRequestURL(self, state, **kwargs):
+    """ Create link for authorization and state of authorization session
+
+        :param str state: session number
+        :param `**kwargs`: OAuth2 parameters that will be added to request url,
+               e.g. authorization_endpoint='http://domain.ua/auth', scope=['openid','profile']
+
+        :return: S_OK(dict)/S_ERROR() -- dict contain URL for authentication and session number
+    """
+    # Fill arguments for preperation URL
+    kwargs['response_type'] = 'code'
+    kwargs['state'] = state
+    kwargs['client_id'] = self.parameters['client_id']
+    kwargs['redirect_uri'] = kwargs.get('redirect_uri', self.parameters['redirect_uri'])
+    kwargs['scope'] = kwargs.get('scope', self.parameters['scope'] or self.parameters['scopes_supported'])
+    if self.parameters['prompt']:
+      kwargs['prompt'] = self.parameters['prompt']
+
+    # Add IdP authorization endpoint
+    self.log.info(kwargs['state'], 'session, generate URL for authetication.')
+    url = kwargs.get('authorization_endpoint', self.parameters['authorization_endpoint']) + '?access_type=offline'
+    if not url:
+      return S_ERROR('No found authorization endpoint.')
+
+    # Add arguments
+    for key, value in kwargs.items():
+      val = '+'.join(list(set(v.strip() for v in value))) if isinstance(value, list) else value
+      url += '&%s=%s' % (urllib2.quote(key), urllib2.quote(val, '+'))
+    return S_OK(url)
+
+  def parseAuthResponse(self, code):
+    """ Collecting information about user
+
+        :param str code: authorize code that come with response(authorize code flow)
+
+        :result: S_OK(dict)/S_ERROR()
+    """
+    oaDict = {}
+
+    # Get tokens
+    result = self.fetchToken(code)
+    if not result['OK']:
+      return result
+    self.log.debug('Token RESPONSE:\n', pprint.pformat(result['Value']))
+    oaDict['Tokens'] = result['Value']
+
+    # Get user profile
+    result = self.getUserProfile(oaDict['Tokens']['access_token'])
+    if not result['OK']:
+      return result
+    oaDict['UserProfile'] = result['Value']
+    self.log.debug('User profile RESPONSE:\n', pprint.pformat(result['Value']))
+
+    # Get tokens
+    result = self.fetchToken(refreshToken=oaDict['Tokens']['refresh_token'])
+    if not result['OK']:
+      return result
+    oaDict['Tokens'] = result['Value']
+    self.log.debug('Token RESPONSE:\n', pprint.pformat(result['Value']))
+
+    return S_OK(oaDict)
+
+  def getUserProfile(self, accessToken):
+    """ Get user profile
+
+        :param str accessToken: access token
+
+        :return: S_OK(dict)/S_ERROR()
+    """
+    if not self.parameters['userinfo_endpoint']:
+      return S_ERROR('Not found userinfo endpoint.')
+    try:
+      r = self.request('GET', self.parameters['userinfo_endpoint'],
+                       headers={'Authorization': 'Bearer ' + accessToken})
+      r.raise_for_status()
+      return S_OK(r.json())
+    except (self.exceptions.RequestException, ValueError) as e:
+      return S_ERROR("%s: %s" % (e.message, r.text))
+
+  def revokeToken(self, accessToken=None, refreshToken=None):
+    """ Revoke token
+
+        :param str accessToken: access token
+        :param str refreshToken: refresh token
+
+        :return: S_OK()/S_ERROR()
+    """
+    if not accessToken and not refreshToken:
+      return S_ERROR('Not found any token to revocation.')
+    if not self.parameters['revocation_endpoint']:
+      return S_ERROR('Not found revocation endpoint for %s provider' % self.parameters['name'])
+    for key, value in [('access_token', accessToken), ('refresh_token', refreshToken)]:
+      if not value:
+        continue
+      self.params = {'token': key, 'token_type_hint': value}
+      try:
+        r = self.request('POST', self.parameters['token_endpoint'])
+        r.raise_for_status()
+      except self.exceptions.RequestException as e:
+        return S_ERROR("%s: %s" % (e.message, r.text))
+    return S_OK()
+
+  def fetchToken(self, code=None, refreshToken=None):
+    """ Update tokens
+
+        :param str code: authorize code that come with response(authorize code flow)
+        :param str refreshToken: refresh token
+
+        :return: S_OK(dict)/S_ERROR()
+    """
+    if not self.parameters['token_endpoint']:
+      return S_ERROR('Not found token_endpoint for %s provider' % self.parameters['name'])
+    self.params = {'access_type': 'offline'}
+    for arg in ['client_id', 'client_secret', 'prompt']:
+      self.params[arg] = self.parameters[arg]
+    if code:
+      if not self.parameters['redirect_uri']:
+        return S_ERROR('Not found redirect_uri for %s provider' % self.parameters['name'])
+      self.params['code'] = code
+      self.params['grant_type'] = 'authorization_code'
+      self.params['redirect_uri'] = self.parameters['redirect_uri']
+    elif refreshToken:
+      self.params['grant_type'] = 'refresh_token'
+      self.params['refresh_token'] = refreshToken
+    else:
+      return S_ERROR('No authorization code or refresh token found.')
+    try:
+      r = self.request('POST', self.parameters['token_endpoint'],
+                       headers={'Content-Type': 'application/x-www-form-urlencoded'})
+      r.raise_for_status()
+      return S_OK(r.json())
+    except (self.exceptions.RequestException, ValueError) as e:
+      return S_ERROR("%s: %s" % (e.message, r.text))
+
+  def getWellKnownDict(self, url=None, issuer=None):
+    """ Returns OpenID Connect metadata related to the specified authorization server
+        of provider, enough one parameter
+
+        :param str wellKnown: complete link to provider oidc configuration
+        :param str issuer: base URL of provider
+
+        :return: S_OK(dict)/S_ERROR()
+    """
+    url = url or self.parameters['issuer'] and '%s/.well-known/openid-configuration' % self.parameters['issuer']
+    if not url:
+      return S_ERROR('Cannot get %s provider issuer/wellKnow url' % self.parameters['name'])
+    try:
+      r = self.request('GET', url)
+      r.raise_for_status()
+      return S_OK(r.json())
+    except (self.exceptions.RequestException, ValueError) as e:
+      return S_ERROR("%s: %s" % (e.message, r.text))
diff --git a/FrameworkSystem/Utilities/ProxyHandler.py b/FrameworkSystem/Utilities/ProxyHandler.py
new file mode 100644
index 00000000000..0f6e6b2671f
--- /dev/null
+++ b/FrameworkSystem/Utilities/ProxyHandler.py
@@ -0,0 +1,111 @@
+""" Handler to serve the DIRAC proxy data
+"""
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import print_function
+
+import re
+import time
+import base64
+
+from tornado import web, gen
+from tornado.template import Template
+
+from DIRAC import S_OK, S_ERROR, gConfig, gLogger
+from DIRAC.Core.Web.WebHandler import WebHandler, asyncGen, WErr
+from DIRAC.FrameworkSystem.Client.ProxyManagerClient import ProxyManagerClient
+from DIRAC.ConfigurationSystem.Client.Helpers.Registry import getDNForUsernameInGroup
+
+__RCSID__ = "$Id$"
+
+
+class ProxyHandler(WebHandler):
+  OVERPATH = True
+  AUTH_PROPS = "authenticated"
+  LOCATION = "/"
+
+  def initialize(self):
+    super(ProxyHandler, self).initialize()
+    self.args = {}
+    for arg in self.request.arguments:
+      if len(self.request.arguments[arg]) > 1:
+        self.args[arg] = self.request.arguments[arg]
+      else:
+        self.args[arg] = self.request.arguments[arg][0] or ''
+    return S_OK()
+
+  @asyncGen
+  def web_proxy(self):
+    """ REST endpoints to user proxy management
+
+        **GET** /proxy?<options> -- retrieve personal proxy
+        
+          Options:
+            * *voms* -- to get user proxy with VOMS extension(optional)
+            * *lifetime* -- requested proxy live time(optional)
+          
+          Response is a proxy certificate as text
+
+        **GET** /proxy/<user>/<group>?<options> -- retrieve proxy  
+          * *user* -- user name
+          * *group* -- group name
+        
+          Options:
+            * *voms* -- to get user proxy with VOMS extension(optional)
+            * *lifetime* -- requested proxy live time(optional)
+          
+          Response is a proxy certificate as text
+
+        **GET** /proxy/metadata?<options> -- retrieve proxy metadata..
+    """
+    voms = self.args.get('voms')
+    proxyLifeTime = 3600 * 12
+    if re.match('[0-9]+', self.args.get('lifetime') or ''):
+      proxyLifeTime = int(self.args.get('lifetime'))
+    optns = self.overpath.strip('/').split('/')
+
+    credGroup = self.getUserGroup()
+    proxyCli = ProxyManagerClient(delegatedGroup=credGroup, delegatedID=self.getID(), delegatedDN=self.getDN())
+
+    # GET
+    if self.request.method == 'GET':
+      # Return content of Proxy DB
+      if 'metadata' in optns:
+        pass
+
+      # Return personal proxy
+      elif not self.overpath:
+        result = yield self.threadTask(proxyCli.downloadPersonalProxy, self.getUserName(),
+                                       credGroup, requiredTimeLeft=proxyLifeTime, voms=voms)
+        if not result['OK']:
+          raise WErr(500, result['Message'])
+        self.log.notice('Proxy was created.')
+        result = result['Value'].dumpAllToString()
+        if not result['OK']:
+          raise WErr(500, result['Message'])
+        self.finishJEncode(result['Value'])
+
+      # Return proxy
+      elif len(optns) == 2:
+        user = optns[0]
+        group = optns[1]
+
+        # Get proxy to string
+        result = getDNForUsernameInGroup(user, group)
+        if not result['OK'] or not result.get('Value'):
+          raise WErr(500, '%s@%s has no registred DN: %s' % (user, group, result.get('Message') or ""))
+
+        if voms:
+          result = yield self.threadTask(proxyCli.downloadVOMSProxy, user, group, requiredTimeLeft=proxyLifeTime)
+        else:
+          result = yield self.threadTask(proxyCli.downloadProxy, user, group, requiredTimeLeft=proxyLifeTime)
+        if not result['OK']:
+          raise WErr(500, result['Message'])
+        self.log.notice('Proxy was created.')
+        result = result['Value'].dumpAllToString()
+        if not result['OK']:
+          raise WErr(500, result['Message'])
+        self.finishJEncode(result['Value'])
+
+      else:
+        raise WErr(404, "Wrone way")
diff --git a/FrameworkSystem/Utilities/halo.py b/FrameworkSystem/Utilities/halo.py
new file mode 100644
index 00000000000..185e4ceee1b
--- /dev/null
+++ b/FrameworkSystem/Utilities/halo.py
@@ -0,0 +1,709 @@
+# -*- coding: utf-8 -*-
+# pylint: disable=unsubscriptable-object
+""" Changed for DIRAC. Beautiful terminal spinners in Python. Source: https://github.com/manrajgrover/halo and dependens
+
+    MIT License
+
+    Copyright (c) 2017 Manraj Singh
+
+    Permission is hereby granted, free of charge, to any person obtaining a copy
+    of this software and associated documentation files (the "Software"), to deal
+    in the Software without restriction, including without limitation the rights
+    to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+    copies of the Software, and to permit persons to whom the Software is
+    furnished to do so, subject to the following conditions:
+
+    The above copyright notice and this permission notice shall be included in all
+    copies or substantial portions of the Software.
+
+    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+    IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+    AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+    LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+    OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+    SOFTWARE.
+"""
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import print_function
+
+from __future__ import absolute_import, unicode_literals
+
+import os
+import re
+import sys
+import six
+import time
+import ctypes
+import atexit
+import signal
+import codecs
+import platform
+import functools
+import threading
+try:
+  from shutil import get_terminal_size
+except ImportError:
+  from backports.shutil_get_terminal_size import get_terminal_size
+
+
+def coloredFrame(text, color=None, onColor=None, attrs=['bold']):
+  """ Colorize text, while stripping nested ANSI color sequences.
+      Source: https://github.com/hfeeki/termcolor/blob/master/termcolor.py
+
+      :param str text: text
+      :param str color: text colors -> red, green, yellow, blue, magenta, cyan, white.
+      :param str onColor: text highlights -> on_red, on_green, on_yellow, on_blue, on_magenta, on_cyan, on_white.
+      :param list attrs: attributes -> bold, dark, underline, blink, reverse, concealed.
+
+      --
+          coloredFrame('Hello, World!', 'red', 'on_grey', ['blue', 'blink'])
+          coloredFrame('Hello, World!', 'green')
+
+      :return: str
+  """
+  ATTRIBUTES = dict(list(zip(['bold', 'dark', '', 'underline', 'blink', '', 'reverse', 'concealed'],
+                             list(range(1, 9)))))
+  del ATTRIBUTES['']
+  ATTRIBUTES_RE = r'\033\[(?:%s)m' % '|'.join(['%d' % v for v in ATTRIBUTES.values()])
+  HIGHLIGHTS = dict(list(zip(['on_grey', 'on_red', 'on_green', 'on_yellow', 'on_blue',
+                              'on_magenta', 'on_cyan', 'on_white'], list(range(40, 48)))))
+  HIGHLIGHTS_RE = r'\033\[(?:%s)m' % '|'.join(['%d' % v for v in HIGHLIGHTS.values()])
+  COLORS = dict(list(zip(['grey', 'red', 'green', 'yellow', 'blue', 'magenta', 'cyan', 'white', ],
+                         list(range(30, 38)))))
+  COLORS_RE = r'\033\[(?:%s)m' % '|'.join(['%d' % v for v in COLORS.values()])
+  RESET = '\033[0m'
+  RESET_RE = r'\033\[0m'
+
+  if os.getenv('ANSI_COLORS_DISABLED') is None:
+    fmtStr = '\033[%dm%s'
+    if color is not None:
+      text = re.sub(COLORS_RE + '(.*?)' + RESET_RE, r'\1', text)
+      text = fmtStr % (COLORS[color], text)
+    if onColor is not None:
+      text = re.sub(HIGHLIGHTS_RE + '(.*?)' + RESET_RE, r'\1', text)
+      text = fmtStr % (HIGHLIGHTS[onColor], text)
+    if attrs is not None:
+      text = re.sub(ATTRIBUTES_RE + '(.*?)' + RESET_RE, r'\1', text)
+      for attr in attrs:
+        text = fmtStr % (ATTRIBUTES[attr], text)
+    return text + RESET
+  else:
+    return text
+
+
+class StreamWrapper(object):
+  """ Wraps a stream (such as stdout), acting as a transparent proxy for all
+      attribute access apart from method 'write()', which is delegated to our
+      Converter instance.
+      Source: https://github.com/tartley/colorama
+  """
+
+  def __init__(self, wrapped, converter):
+    # double-underscore everything to prevent clashes with names of
+    # attributes on the wrapped stream object.
+    self.__wrapped = wrapped
+    self.__convertor = converter
+
+  def __getattr__(self, name):
+    return getattr(self.__wrapped, name)
+
+  def __enter__(self, *args, **kwargs):
+    # special method lookup bypasses __getattr__/__getattribute__, see
+    # https://stackoverflow.com/questions/12632894/why-doesnt-getattr-work-with-exit
+    # thus, contextlib magic methods are not proxied via __getattr__
+    return self.__wrapped.__enter__(*args, **kwargs)
+
+  def __exit__(self, *args, **kwargs):
+    return self.__wrapped.__exit__(*args, **kwargs)
+
+  def write(self, text):
+    self.__convertor.write(text)
+
+  def isatty(self):
+    stream = self.__wrapped
+    if 'PYCHARM_HOSTED' in os.environ:
+      if stream is not None and (stream is sys.__stdout__ or stream is sys.__stderr__):
+        return True
+    try:
+      streamIsATTY = stream.isatty
+    except AttributeError:
+      return False
+    else:
+      return streamIsATTY()
+
+  @property
+  def closed(self):
+    stream = self.__wrapped
+    try:
+      return stream.closed
+    except AttributeError:
+      return True
+
+
+class PreWrapp(object):
+  """ Source: https://github.com/tartley/colorama
+  """
+
+  def __init__(self, wrapped):
+    if os.name == 'nt':
+      raise BaseException('Not support')
+    # The wrapped stream (normally sys.stdout or sys.stderr)
+    self.wrapped = wrapped
+    # create the proxy wrapping our output stream
+    self.stream = StreamWrapper(wrapped, self)
+
+  def write(self, text):
+    self.wrapped.write(text)
+    self.wrapped.flush()
+    self.resetAll()
+
+  def resetAll(self):
+    if not self.stream.closed:
+      self.wrapped.write('\033[0m')
+
+
+def resetAll():
+  if PreWrapp is not None:  # Issue #74: objects might become None at exit
+    PreWrapp(sys.stdout).resetAll()
+
+
+sys.stdout = PreWrapp(sys.stdout).stream
+sys.stderr = PreWrapp(sys.stderr).stream
+atexit.register(resetAll)
+
+
+def isSupported():
+  """ Check whether operating system supports main symbols or not.
+
+      :return: boolen -- Whether operating system supports main symbols or not
+  """
+  return platform.system() != 'Windows'
+
+
+def getEnvironment():
+  """ Get the environment in which halo is running
+
+      :return: str -- Environment name
+  """
+  try:
+    from IPython import get_ipython
+  except ImportError:
+    return 'terminal'
+  try:
+    shell = get_ipython().__class__.__name__
+    if shell == 'ZMQInteractiveShell':  # Jupyter notebook or qtconsole
+      return 'jupyter'
+    elif shell == 'TerminalInteractiveShell':  # Terminal running IPython
+      return 'ipython'
+    else:
+      return 'terminal'  # Other type (?)
+  except NameError:
+    return 'terminal'
+
+
+def isTextType(text):
+  """ Check if given parameter is a string or not
+
+      :param str text: Parameter to be checked for text type
+
+      :return: boolen -- Whether parameter is a string or not
+  """
+  return bool(isinstance(text, six.text_type) or isinstance(text, six.string_types))
+
+
+def decodeUTF8Text(text):
+  """ Decode the text from utf-8 format
+
+      :param str text: String to be decoded
+
+      :return: str -- Decoded string
+  """
+  try:
+    return codecs.decode(text, 'utf-8')
+  except (TypeError, ValueError):
+    return text
+
+
+def encodeUTF8Text(text):
+  """ Encodes the text to utf-8 format
+
+      :param str text: String to be encoded
+
+      :return: str -- Encoded string
+  """
+  try:
+    return codecs.encode(text, 'utf-8', 'ignore')
+  except (TypeError, ValueError):
+    return text
+
+
+def getTerminalColumns():
+  """ Determine the amount of available columns in the terminal
+
+      :return: int -- Terminal width
+  """
+  # If column size is 0 either we are not connected
+  # to a terminal or something else went wrong. Fallback to 80.
+  return 80 if get_terminal_size().columns == 0 else get_terminal_size().columns
+
+
+class Halo(object):
+  """ Halo library.
+
+      CLEAR_LINE -- Code to clear the line
+  """
+  class Done(Exception):
+    """ Done exception """
+    pass
+
+  class CursorInfo(ctypes.Structure):
+    # Need for cursor
+    if os.name == 'nt':
+      _fields_ = [("size", ctypes.c_int), ("visible", ctypes.c_byte)]
+
+  CLEAR_LINE = '\033[K'
+  SPINNER_PLACEMENTS = ('left', 'right',)
+
+  def __init__(self, text='', color='green', textColor=None, spinner=None,
+               animation=None, placement='left', interval=-1, enabled=True, stream=sys.stdout, result='succeed'):
+    """ Constructs the Halo object.
+
+        :param str text: Text to display.
+        :param str color: Color of the text.
+        :param str textColor: Color of the text to display.
+        :param str,dict spinner: String or dictionary representing spinner.
+        :param basesrting animation: Animation to apply if text is too large. Can be one of `bounce`, `marquee`.
+               Defaults to ellipses.
+        :param str placement: Side of the text to place the spinner on. Can be `left` or `right`.
+               Defaults to `left`.
+        :param int interval: Interval between each frame of the spinner in milliseconds.
+        :param boolean enabled: Spinner enabled or not.
+        :param io stream: IO output.
+    """
+    self._newline = None
+    self._result = result
+    self._color = color
+    self._animation = animation
+    self.spinner = spinner
+    self.text = text
+    self._textColor = textColor
+    self._interval = int(interval) if int(interval) > 0 else self._spinner['interval']
+    self._stream = stream
+    self.placement = placement
+    self._frameIndex = 0
+    self._textIndex = 0
+    self._spinnerThread = None
+    self._stopSpinner = None
+    self._spinnerId = None
+    self.enabled = enabled
+    environment = getEnvironment()
+
+    def cleanUp():
+      """ Handle cell execution"""
+      self.__stop()
+
+    if environment in ('ipython', 'jupyter'):
+      from IPython import get_ipython
+      ip = get_ipython()
+      ip.events.register('post_run_cell', cleanUp)
+    else:  # default terminal
+      atexit.register(cleanUp)
+
+  def __enter__(self):
+    """ Starts the spinner on a separate thread. For use in context managers.
+    """
+    return self.start()
+
+  def __exit__(self, eType, eValue, traceback):
+    """ Stops the spinner. For use in context managers."""
+    if eType:
+      self._newline = False
+      self._text['original'] = ''
+      if isinstance(eValue, SystemExit) and eValue.code in [None, 0]:
+        self.succeed()
+      else:
+        self.fail()
+    elif self._result == 'succeed':
+      self.succeed()
+    elif self._result == 'warn':
+      self.warn()
+    elif self._result == 'info':
+      self.info()
+    else:
+      self.stop()
+
+  def __call__(self, f):
+    """ Allow the Halo object to be used as a regular function decorator.
+    """
+    @functools.wraps(f)
+    def wrapped(*args, **kwargs):
+      with self:
+        return f(*args, **kwargs)
+    return wrapped
+
+  @property
+  def spinner(self):
+    """ Getter for spinner property.
+
+        :return: dict -- spinner value
+    """
+    return self._spinner
+
+  @spinner.setter
+  def spinner(self, spinner=None):
+    """ Setter for spinner property.
+
+        :param dict,str spinner: Defines the spinner value with frame and interval
+    """
+    self._spinner = {"interval": 80, "frames": ["⠋", "⠙", "⠹", "⠸", "⠼", "⠴", "⠦", "⠧", "⠇", "⠏"]}
+    self._frameIndex = 0
+    self._textIndex = 0
+
+  @property
+  def text(self):
+    """ Getter for text property.
+
+        :return: str -- text value
+    """
+    return self._text['original']
+
+  @text.setter
+  def text(self, text):
+    """ Setter for text property.
+
+        :param str text: Defines the text value for spinner
+    """
+    self._text = self._getText(text)
+
+  @property
+  def result(self):
+    """ Getter for result property.
+
+        :return: str -- result value
+    """
+    return self._result
+
+  # pylint: disable=function-redefined
+  @text.setter
+  def result(self, result):
+    """ Setter for result property.
+
+        :param str result: Defines the result of with
+    """
+    self._result = result
+
+  @property
+  def textColor(self):
+    """ Getter for text color property.
+
+        :return: str -- text color value
+    """
+    return self._textColor
+
+  @textColor.setter
+  def textColor(self, textColor):
+    """ Setter for text color property.
+
+        :param str textColor: Defines the text color value for spinner
+    """
+    self._textColor = textColor
+
+  @property
+  def color(self):
+    """ Getter for color property.
+
+        :return: str -- color value
+    """
+    return self._color
+
+  @color.setter
+  def color(self, color):
+    """ Setter for color property.
+
+        :param str color: Defines the color value for spinner
+    """
+    self._color = color
+
+  @property
+  def placement(self):
+    """ Getter for placement property.
+
+        :return: str -- spinner placement
+    """
+    return self._placement
+
+  @placement.setter
+  def placement(self, placement):
+    """ Setter for placement property.
+
+        :param str placement: Defines the placement of the spinner
+    """
+    if placement not in self.SPINNER_PLACEMENTS:
+      raise ValueError("Unknown spinner placement '{0}', available are {1}".format(placement, self.SPINNER_PLACEMENTS))
+    self._placement = placement
+
+  @property
+  def spinner_id(self):
+    """ Getter for spinner id
+
+        :return: str -- Spinner id value
+    """
+    return self._spinnerId
+
+  @property
+  def animation(self):
+    """ Getter for animation property.
+
+        :return: str -- Spinner animation
+    """
+    return self._animation
+
+  @animation.setter
+  def animation(self, animation):
+    """ Setter for animation property.
+
+        :param str animation: Defines the animation of the spinner
+    """
+    self._animation = animation
+    self._text = self._getText(self._text['original'])
+
+  def _checkStream(self):
+    """ Returns whether the stream is open, and if applicable, writable
+
+        :return: bool -- Whether the stream is open
+    """
+    if self._stream.closed:
+      return False
+    try:
+      # Attribute access kept separate from invocation, to avoid
+      # swallowing AttributeErrors from the call which should bubble up.
+      checkStreamWritable = self._stream.writable
+    except AttributeError:
+      pass
+    else:
+      return checkStreamWritable()
+    return True
+
+  def _write(self, s):
+    """ Write to the stream, if writable
+
+        :params str s: Characters to write to the stream
+    """
+    if self._checkStream():
+      self._stream.write(s)
+
+  def _hideCursor(self):
+    """ Disable the user's blinking cursor
+    """
+    if self._checkStream() and self._stream.isatty():
+      for sid in [signal.SIGINT, signal.SIGTSTP]:
+        signal.signal(sid, self._showCursor)
+      if os.name == 'nt':
+        ci = CursorInfo()  # pylint: disable=undefined-variable
+        handle = ctypes.windll.kernel32.GetStdHandle(-11)
+        ctypes.windll.kernel32.GetConsoleCursorInfo(handle, ctypes.byref(ci))
+        ci.visible = False
+        ctypes.windll.kernel32.SetConsoleCursorInfo(handle, ctypes.byref(ci))
+      elif os.name == 'posix':
+        sys.stdout.write("\033[?25l")
+        sys.stdout.flush()
+
+  def _showCursor(self, *args):
+    """ Re-enable the user's blinking cursor
+    """
+    if self._checkStream() and self._stream.isatty():
+      if os.name == 'nt':
+        ci = CursorInfo()  # pylint: disable=undefined-variable
+        handle = ctypes.windll.kernel32.GetStdHandle(-11)
+        ctypes.windll.kernel32.GetConsoleCursorInfo(handle, ctypes.byref(ci))
+        ci.visible = True
+        ctypes.windll.kernel32.SetConsoleCursorInfo(handle, ctypes.byref(ci))
+      elif os.name == 'posix':
+        sys.stdout.write("\033[?25h")
+        sys.stdout.flush()
+    if args:
+      raise SystemExit(args[0])
+
+  def _getText(self, text):
+    """ Creates frames based on the selected animation
+
+        :params str text: text
+    """
+    animation = self._animation
+    strippedText = text.strip()
+
+    # Check which frame of the animation is the widest
+    maxSpinnerLength = max([len(i) for i in self._spinner['frames']])
+
+    # Subtract to the current terminal size the max spinner length
+    # (-1 to leave room for the extra space between spinner and text)
+    terminalWidth = getTerminalColumns() - maxSpinnerLength - 1
+    textLength = len(strippedText)
+    frames = []
+    if terminalWidth < textLength and animation:
+
+      if animation == 'bounce':
+        # Make the text bounce back and forth
+        for x in range(0, textLength - terminalWidth + 1):
+          frames.append(strippedText[x:terminalWidth + x])
+        frames.extend(list(reversed(frames)))
+
+      elif 'marquee':
+        # Make the text scroll like a marquee
+        strippedText = strippedText + ' ' + strippedText[:terminalWidth]
+        for x in range(0, textLength + 1):
+          frames.append(strippedText[x:terminalWidth + x])
+
+    elif terminalWidth < textLength and not animation:
+      # Add ellipsis if text is larger than terminal width and no animation was specified
+      frames = [strippedText[:terminalWidth - 4] + '... ']
+    else:
+      frames = [strippedText]
+    return {'original': text, 'frames': frames}
+
+  def clear(self):
+    """ Clears the line and returns cursor to the start.
+    """
+    self._write('\r')
+    self._write(self.CLEAR_LINE)
+    return self
+
+  def _renderFrame(self):
+    """ Renders the frame on the line after clearing it.
+    """
+    if not self.enabled:
+      # in case we're disabled or stream is closed while still rendering,
+      # we render the frame and increment the frame index, so the proper
+      # frame is rendered if we're reenabled or the stream opens again.
+      return
+    self.clear()
+    frame = self.frame()
+    output = '\r{}'.format(frame)
+    try:
+      self._write(output)
+    except UnicodeEncodeError:
+      self._write(encodeUTF8Text(output))
+
+  def render(self):
+    """ Runs the render until thread flag is set.
+    """
+    while not self._stopSpinner.is_set():
+      self._renderFrame()
+      time.sleep(0.001 * self._interval)
+    return self
+
+  def frame(self):
+    """ Builds and returns the frame to be rendered
+    """
+    frames = self._spinner['frames']
+    frame = frames[self._frameIndex]
+    if self._color:
+      frame = coloredFrame(frame, self._color)
+    self._frameIndex += 1
+    self._frameIndex = self._frameIndex % len(frames)
+    textFrame = self.textFrame()
+    return u'{0} {1}'.format(*[(textFrame, frame) if self._placement == 'right' else (frame, textFrame)][0])
+
+  def textFrame(self):
+    """ Builds and returns the text frame to be rendered
+    """
+    if len(self._text['frames']) == 1:
+      if self._textColor:
+        return coloredFrame(self._text['frames'][0], self._textColor)
+      # Return first frame (can't return original text because at this point it might be ellipsed)
+      return self._text['frames'][0]
+    frames = self._text['frames']
+    frame = frames[self._textIndex]
+    self._textIndex += 1
+    self._textIndex = self._textIndex % len(frames)
+    return coloredFrame(frame, self._textColor) if self._textColor else frame
+
+  def start(self, text=None):
+    """ Starts the spinner on a separate thread.
+
+        :param str text: Text to be used alongside spinner
+    """
+    if text is not None:
+      self.text = text
+    if self._spinnerId is not None:
+      return self
+    if not (self.enabled and self._checkStream()):
+      return self
+    self._hideCursor()
+    self._stopSpinner = threading.Event()
+    self._spinnerThread = threading.Thread(target=self.render)
+    self._spinnerThread.setDaemon(True)
+    self._renderFrame()
+    self._spinnerId = self._spinnerThread.name
+    self._spinnerThread.start()
+    return self
+
+  def __stop(self):
+    if self._spinnerThread and self._spinnerThread.is_alive():
+      self._stopSpinner.set()
+      self._spinnerThread.join()
+
+    if self.enabled:
+      self.clear()
+
+    self._frameIndex = 0
+    self._spinnerId = None
+    self._showCursor()
+    return self
+
+  def succeed(self, text=None):
+    """ Shows and persists success symbol and text and exits.
+
+        :param str text: Text to be shown alongside success symbol.
+    """
+    self._color = 'green'
+    return self.stop(symbol='✔', text=text)
+
+  def fail(self, text=None):
+    """ Shows and persists fail symbol and text and exits.
+
+        :param str text: Text to be shown alongside fail symbol.
+    """
+    self._color = 'red'
+    return self.stop(symbol='✖', text=text)
+
+  def warn(self, text=None):
+    """ Shows and persists warn symbol and text and exits.
+
+        :param str text: Text to be shown alongside warn symbol.
+    """
+    self._color = 'yellow'
+    return self.stop(symbol='⚠', text=text)
+
+  def info(self, text=None):
+    """ Shows and persists info symbol and text and exits.
+
+        :param str text: Text to be shown alongside info symbol.
+    """
+    self._color = 'blue'
+    return self.stop(symbol='ℹ', text=text)
+
+  def stop(self, text=None, symbol=None):
+    """ Stops the spinner and persists the final frame to be shown.
+
+        :param str text: Text to be shown in final frame
+        :param str symbol: Symbol to be shown in final frame
+    """
+    if not (symbol and text):
+      self.__stop()
+    if not self.enabled:
+      return self
+    self.__stop()
+    symbol = decodeUTF8Text(symbol) if symbol is not None else ''
+    text = decodeUTF8Text(text) if text is not None else self._text['original']
+    symbol = coloredFrame(symbol, self._color) if self._color and symbol else symbol
+    text = coloredFrame(text, self._textColor) if self._textColor and text else text.strip()
+    output = u'{0} {1}'.format(*[(text, symbol) if self._placement == 'right' else (symbol, text)][0])
+    output += '' if self._newline is False else '\n'
+    try:
+      self._write(output)
+    except UnicodeEncodeError:
+      self._write(encodeUTF8Text(output))
+    return self
diff --git a/FrameworkSystem/scripts/dirac-admin-get-proxy.py b/FrameworkSystem/scripts/dirac-admin-get-proxy.py
index 444654d12c2..7d1f386ddc5 100755
--- a/FrameworkSystem/scripts/dirac-admin-get-proxy.py
+++ b/FrameworkSystem/scripts/dirac-admin-get-proxy.py
@@ -26,7 +26,6 @@ class Params(object):
   proxyPath = False
   proxyLifeTime = 86400
   enableVOMS = False
-  vomsAttr = None
 
   def setLimited(self, args):
     """ Set limited
@@ -73,15 +72,6 @@ def automaticVOMS(self, arg):
     self.enableVOMS = True
     return S_OK()
 
-  def setVOMSAttr(self, arg):
-    """ Register CLI switches
-
-        :param str arg: VOMS attribute
-    """
-    self.enableVOMS = True
-    self.vomsAttr = arg
-    return S_OK()
-
   def registerCLISwitches(self):
     """ Register CLI switches
     """
@@ -89,8 +79,6 @@ def registerCLISwitches(self):
     Script.registerSwitch("l", "limited", "Get a limited proxy", self.setLimited)
     Script.registerSwitch("u:", "out=", "File to write as proxy", self.setProxyLocation)
     Script.registerSwitch("a", "voms", "Get proxy with VOMS extension mapped to the DIRAC group", self.automaticVOMS)
-    Script.registerSwitch("m:", "vomsAttr=", "VOMS attribute to require", self.setVOMSAttr)
-
 
 params = Params()
 params.registerCLISwitches()
@@ -100,7 +88,7 @@ def registerCLISwitches(self):
                                   '  %s [option|cfgfile] ... <DN|user> group' % Script.scriptName,
                                   'Arguments:',
                                   '  DN:       DN of the user',
-                                  '  user:     DIRAC user name (will fail if there is more than 1 DN registered)',
+                                  '  user:     DIRAC user name',
                                   '  group:    DIRAC group name']))
 
 Script.parseCommandLine(ignoreErrors=True)
@@ -110,45 +98,27 @@ def registerCLISwitches(self):
   Script.showHelp()
 
 userGroup = str(args[1])
-userDN = str(args[0])
-userName = False
-if userDN.find("/") != 0:
-  userName = userDN
-  retVal = Registry.getDNForUsername(userName)
-  if not retVal['OK']:
-    gLogger.notice("Cannot discover DN for username %s\n\t%s" % (userName, retVal['Message']))
+
+# First argument is user name
+if not str(args[0]).startswith("/"):
+  userName = str(args[0])
+  userDN = None
+else:
+  userDN = str(args[0])
+  result = Registry.getUsernameForDN(userDN)
+  if not result['OK']:
+    gLogger.notice("DN '%s' is not registered in DIRAC" % userDN)
     DIRAC.exit(2)
-  DNList = retVal['Value']
-  if len(DNList) > 1:
-    gLogger.notice("Username %s has more than one DN registered" % userName)
-    ind = 0
-    for dn in DNList:
-      gLogger.notice("%d %s" % (ind, dn))
-      ind += 1
-    inp = raw_input("Which DN do you want to download? [default 0] ")
-    if not inp:
-      inp = 0
-    else:
-      inp = int(inp)
-    userDN = DNList[inp]
-  else:
-    userDN = DNList[0]
+  userName = result['Value']
 
 if not params.proxyPath:
-  if not userName:
-    result = Registry.getUsernameForDN(userDN)
-    if not result['OK']:
-      gLogger.notice("DN '%s' is not registered in DIRAC" % userDN)
-      DIRAC.exit(2)
-    userName = result['Value']
   params.proxyPath = "%s/proxy.%s.%s" % (os.getcwd(), userName, userGroup)
 
 if params.enableVOMS:
-  result = gProxyManager.downloadVOMSProxy(userDN, userGroup, limited=params.limited,
-                                           requiredTimeLeft=params.proxyLifeTime,
-                                           requiredVOMSAttribute=params.vomsAttr)
+  result = gProxyManager.downloadVOMSProxy(userDN or userName, userGroup, limited=params.limited,
+                                           requiredTimeLeft=params.proxyLifeTime)
 else:
-  result = gProxyManager.downloadProxy(userDN, userGroup, limited=params.limited,
+  result = gProxyManager.downloadProxy(userDN or userName, userGroup, limited=params.limited,
                                        requiredTimeLeft=params.proxyLifeTime)
 if not result['OK']:
   gLogger.notice('Proxy file cannot be retrieved: %s' % result['Message'])
diff --git a/FrameworkSystem/scripts/dirac-admin-users-with-proxy.py b/FrameworkSystem/scripts/dirac-admin-users-with-proxy.py
index fe1511412d6..be7aa10ed7a 100755
--- a/FrameworkSystem/scripts/dirac-admin-users-with-proxy.py
+++ b/FrameworkSystem/scripts/dirac-admin-users-with-proxy.py
@@ -35,36 +35,31 @@ def registerCLISwitches(self):
 
 Script.parseCommandLine(ignoreErrors=True)
 args = Script.getPositionalArgs()
-result = gProxyManager.getDBContents()
+result = gProxyManager.getUploadedProxiesDetails()
 if not result['OK']:
   print("Can't retrieve list of users: %s" % result['Message'])
   DIRAC.exit(1)
 
-keys = result['Value']['ParameterNames']
-records = result['Value']['Records']
 dataDict = {}
-now = Time.dateTime()
-for record in records:
-  expirationDate = record[3]
-  dt = expirationDate - now
+for infoDict in result['Value']['Dictionaries']:
+  user = infoDict['user']
+  del infoDict['user']
+  dt = infoDict['expirationtime'] - Time.dateTime()
   secsLeft = dt.days * 86400 + dt.seconds
   if secsLeft > params.proxyLifeTime:
-    userName, userDN, userGroup, _, persistent = record
-    if userName not in dataDict:
-      dataDict[userName] = []
-    dataDict[userName].append((userDN, userGroup, expirationDate, persistent))
+    infoDict['expirationtime'] = Time.toString(infoDict['expirationtime'])
+    if user not in dataDict:
+      dataDict[user] = []
+    dataDict[user].append(infoDict)
 
+keys = result['Value']['Dictionaries'][0].keys() if result['Value']['Dictionaries'] else ['']
+strFormat = "{{:<{}}}".format(max(len(i) for i in keys))
 
-for userName in dataDict:
-  print("* %s" % userName)
-  for iP in range(len(dataDict[userName])):
-    data = dataDict[userName][iP]
-    print(" DN         : %s" % data[0])
-    print(" group      : %s" % data[1])
-    print(" not after  : %s" % Time.toString(data[2]))
-    print(" persistent : %s" % data[3])
-    if iP < len(dataDict[userName]) - 1:
-      print(" -")
-
+for user, userDicts in dataDict.items():
+  print("* %s" % user)
+  for userDict in userDicts:
+    for k, v in userDict.items():
+      print(" %s : %s" % (strFormat.format(k), ','.join(v) if isinstance(v, (list, tuple)) else v))
+  print(" -")
 
 DIRAC.exit(0)
diff --git a/FrameworkSystem/scripts/dirac-proxy-destroy.py b/FrameworkSystem/scripts/dirac-proxy-destroy.py
index 50239d8b114..68f02adad30 100755
--- a/FrameworkSystem/scripts/dirac-proxy-destroy.py
+++ b/FrameworkSystem/scripts/dirac-proxy-destroy.py
@@ -6,18 +6,16 @@
 from __future__ import division
 from __future__ import print_function
 
-
 import os
 
 import DIRAC
+
 from DIRAC import gLogger, S_OK
-from DIRAC.Core.Security import Locations
 from DIRAC.Core.Base import Script
-
-from DIRAC.Core.DISET.RPCClient import RPCClient
-from DIRAC.FrameworkSystem.Client.ProxyManagerClient import gProxyManager
-from DIRAC.Core.Security import ProxyInfo
+from DIRAC.Core.Security import Locations, ProxyInfo
 from DIRAC.ConfigurationSystem.Client.Helpers import Registry
+from DIRAC.FrameworkSystem.Client.ProxyManagerClient import gProxyManager
+
 
 __RCSID__ = "$Id$"
 
@@ -78,7 +76,7 @@ def getProxyGroups():
 
   user_groups = set()
   for dn in proxies['Value']:
-    dn_groups = set(proxies['Value'][dn].keys())
+    dn_groups = set(proxies['Value'][dn]['groups'])
     user_groups.update(dn_groups)
 
   return user_groups
@@ -96,18 +94,15 @@ def mapVoToGroups(voname):
   return set(vo_dict['Value'])
 
 
-def deleteRemoteProxy(userdn, vogroup):
+def deleteRemoteProxy(userdn):
   """
-  Deletes proxy for a vogroup for the user envoking this function.
+  Deletes proxy for all groups for the user envoking this function.
   Returns a list of all deleted proxies (if any).
   """
-  rpcClient = RPCClient("Framework/ProxyManager")
-  retVal = rpcClient.deleteProxyBundle([(userdn, vogroup)])
-
-  if retVal['OK']:
-    gLogger.notice('Deleted proxy for %s.' % vogroup)
+  if gProxyManager.deleteProxy(userdn)['OK']:
+    gLogger.notice('Deleted proxy %s.' % userdn)
   else:
-    gLogger.error('Failed to delete proxy for %s.' % vogroup)
+    gLogger.error('Failed to delete proxy %s.' % userdn)
 
 
 def deleteLocalProxy(proxyLoc):
@@ -160,7 +155,7 @@ def main():
     if not remote_groups:
       gLogger.notice('No remote proxies found.')
     for vo_group in remote_groups:
-      deleteRemoteProxy(userDN, vo_group)
+      deleteRemoteProxy(userDN)
     # delete local proxy
     deleteLocalProxy(proxyLoc)
   elif options.vos:
@@ -173,7 +168,7 @@ def main():
     if not vo_groups:
       gLogger.notice('You have no proxies registered for any of the specified VOs.')
     for group in vo_groups:
-      deleteRemoteProxy(userDN, group)
+      deleteRemoteProxy(userDN)
   else:
     deleteLocalProxy(proxyLoc)
 
diff --git a/FrameworkSystem/scripts/dirac-proxy-get-uploaded-info.py b/FrameworkSystem/scripts/dirac-proxy-get-uploaded-info.py
index 8bccc79e3b8..374965eea56 100755
--- a/FrameworkSystem/scripts/dirac-proxy-get-uploaded-info.py
+++ b/FrameworkSystem/scripts/dirac-proxy-get-uploaded-info.py
@@ -51,26 +51,18 @@ def setUser(arg):
   gLogger.notice("Your proxy don`t have username extension")
   sys.exit(1)
 
-if userName in Registry.getAllUsers():
-  if Properties.PROXY_MANAGEMENT not in proxyProps['groupProperties']:
-    if userName != proxyProps['username'] and userName != proxyProps['issuer']:
-      gLogger.notice("You can only query info about yourself!")
-      sys.exit(1)
-  result = Registry.getDNForUsername(userName)
-  if not result['OK']:
-    gLogger.notice("Oops %s" % result['Message'])
-  dnList = result['Value']
-  if not dnList:
-    gLogger.notice("User %s has no DN defined!" % userName)
-    sys.exit(1)
-  userDNs = dnList
-else:
-  userDNs = [userName]
+if userName not in Registry.getAllUsers():
+  gLogger.notice("%s user is not found.")
+  sys.exit(1)
 
+if Properties.PROXY_MANAGEMENT not in proxyProps['groupProperties']:
+  if userName != proxyProps['username'] and userName != proxyProps['issuer']:
+    gLogger.notice("You can only query info about yourself!")
+    sys.exit(1)
 
-gLogger.notice("Checking for DNs %s" % " | ".join(userDNs))
+gLogger.notice("Checking for user", userName)
 pmc = ProxyManagerClient()
-result = pmc.getDBContents({'UserDN': userDNs})
+result = pmc.getUploadedProxiesDetails(userName)
 if not result['OK']:
   gLogger.notice("Could not retrieve the proxy list: %s" % result['Value'])
   sys.exit(1)
diff --git a/FrameworkSystem/scripts/dirac-proxy-info.py b/FrameworkSystem/scripts/dirac-proxy-info.py
index 15360b22e71..a087791222d 100755
--- a/FrameworkSystem/scripts/dirac-proxy-info.py
+++ b/FrameworkSystem/scripts/dirac-proxy-info.py
@@ -133,17 +133,16 @@ def invalidProxy(msg):
     if uploadedInfo:
       gLogger.notice("== Proxies uploaded ==")
       maxDNLen = 0
-      maxGroupLen = 0
-      for userDN in uploadedInfo:
+      maxProviderLen = len('ProxyProvider')
+      for userDN, data in uploadedInfo.items():
         maxDNLen = max(maxDNLen, len(userDN))
-        for group in uploadedInfo[userDN]:
-          maxGroupLen = max(maxGroupLen, len(group))
-      gLogger.notice(" %s | %s | Until (GMT)" % ("DN".ljust(maxDNLen), "Group".ljust(maxGroupLen)))
-      for userDN in uploadedInfo:
-        for group in uploadedInfo[userDN]:
-          gLogger.notice(" %s | %s | %s" % (userDN.ljust(maxDNLen),
-                                            group.ljust(maxGroupLen),
-                                            uploadedInfo[userDN][group].strftime("%Y/%m/%d %H:%M")))
+        maxProviderLen = max(maxProviderLen, len(data['provider']))
+      gLogger.notice(" %s | %s | %s | SupportedGroups" % ("DN".ljust(maxDNLen), "ProxyProvider".ljust(maxProviderLen),
+                                                          "Until (GMT)".ljust(16)))
+      for userDN, data in uploadedInfo.items():
+        gLogger.notice(" %s | %s | %s | " % (userDN.ljust(maxDNLen), data['provider'].ljust(maxProviderLen),
+                                             data['expirationtime'].strftime("%Y/%m/%d %H:%M").ljust(16)),
+                       ",".join(data['groups']))
 
 if params.checkValid:
   if infoDict['secondsLeft'] == 0:
diff --git a/FrameworkSystem/scripts/dirac-proxy-init.py b/FrameworkSystem/scripts/dirac-proxy-init.py
index f9ff0dcc7f3..a8dfe27a26f 100755
--- a/FrameworkSystem/scripts/dirac-proxy-init.py
+++ b/FrameworkSystem/scripts/dirac-proxy-init.py
@@ -9,17 +9,18 @@
 
 import os
 import sys
+import stat
 import glob
 import time
+import pickle
 import datetime
 
 import DIRAC
-
-from DIRAC import gLogger, S_OK, S_ERROR
+from DIRAC import gConfig, gLogger, S_OK, S_ERROR
 from DIRAC.Core.Base import Script
-from DIRAC.FrameworkSystem.Client import ProxyGeneration, ProxyUpload
-from DIRAC.Core.Security import X509Chain, ProxyInfo, Properties, VOMS
+from DIRAC.Core.Security import X509Chain, ProxyInfo, Properties, VOMS  # pylint: disable=import-error
 from DIRAC.ConfigurationSystem.Client.Helpers import Registry
+from DIRAC.FrameworkSystem.Client import ProxyGeneration, ProxyUpload
 from DIRAC.FrameworkSystem.Client.BundleDeliveryClient import BundleDeliveryClient
 
 __RCSID__ = "$Id$"
@@ -27,33 +28,91 @@
 
 class Params(ProxyGeneration.CLIParams):
 
+  session = None
+  provider = ''
+  addEmail = False
+  addQRcode = False
   addVOMSExt = False
+  addProvider = False
   uploadProxy = False
   uploadPilot = False
 
+  def setEmail(self, arg):
+    """ Set email
+
+        :param str arg: email
+
+        :return: S_OK()
+    """
+    self.Email = arg
+    self.addEmail = True
+    return S_OK()
+
+  def setQRcode(self, _arg):
+    """ Use QRcode
+
+        :param _arg: unuse
+
+        :return: S_OK()
+    """
+    self.addQRcode = True
+    return S_OK()
+
+  def setProvider(self, arg):
+    """ Set provider
+
+        :param str arg: provider
+
+        :return: S_OK()
+    """
+    self.provider = arg
+    self.addProvider = True
+    return S_OK()
+
   def setVOMSExt(self, _arg):
+    """ Set VOMS extention
+
+        :param _arg: unuse
+
+        :return: S_OK()
+    """
     self.addVOMSExt = True
     return S_OK()
 
   def setUploadProxy(self, _arg):
+    """ Set upload proxy
+
+        :param _arg: unuse
+
+        :return: S_OK()
+    """
     self.uploadProxy = True
     return S_OK()
 
   def registerCLISwitches(self):
+    """ Register CLI switches """
     ProxyGeneration.CLIParams.registerCLISwitches(self)
     Script.registerSwitch("U", "upload", "Upload a long lived proxy to the ProxyManager", self.setUploadProxy)
+    Script.registerSwitch("e:", "email=", "Send oauth authentification url on email", self.setEmail)
+    Script.registerSwitch("P:", "provider=", "Set provider name for authentification", self.setProvider)
+    Script.registerSwitch("Q", "qrcode", "Print link as QR code", self.setQRcode)
     Script.registerSwitch("M", "VOMS", "Add voms extension", self.setVOMSExt)
 
 
 class ProxyInit(object):
 
   def __init__(self, piParams):
+    """ Constructor """
     self.__piParams = piParams
     self.__issuerCert = False
     self.__proxyGenerated = False
     self.__uploadedInfo = {}
 
   def getIssuerCert(self):
+    """ Get certificate issuer
+
+        :return: str
+    """
     if self.__issuerCert:
       return self.__issuerCert
     proxyChain = X509Chain.X509Chain()
@@ -69,6 +128,8 @@ def getIssuerCert(self):
     return self.__issuerCert
 
   def certLifeTimeCheck(self):
+    """ Check certificate live time
+    """
     minLife = Registry.getGroupOption(self.__piParams.diracGroup, "SafeCertificateLifeTime", 2592000)
     resultIssuerCert = self.getIssuerCert()
     resultRemainingSecs = resultIssuerCert.getRemainingSecs()  # pylint: disable=no-member
@@ -80,10 +141,13 @@ def certLifeTimeCheck(self):
       daysLeft = int(lifeLeft / 86400)
       msg = "Your certificate will expire in less than %d days. Please renew it!" % daysLeft
       sep = "=" * (len(msg) + 4)
-      msg = "%s\n  %s  \n%s" % (sep, msg, sep)
-      gLogger.notice(msg)
+      gLogger.notice("%s\n  %s  \n%s" % (sep, msg, sep))
 
   def addVOMSExtIfNeeded(self):
+    """ Add VOMS extension if needed
+
+        :return: S_OK()/S_ERROR()
+    """
     addVOMS = self.__piParams.addVOMSExt or Registry.getGroupOption(self.__piParams.diracGroup, "AutoAddVOMS", False)
     if not addVOMS:
       return S_OK()
@@ -101,11 +165,12 @@ def addVOMSExtIfNeeded(self):
 
     gLogger.notice("Added VOMS attribute %s" % vomsAttr)
     chain = resultVomsAttributes['Value']
-    chain.dumpAllToFile(self.__proxyGenerated)
-    return S_OK()
+    return chain.dumpAllToFile(self.__proxyGenerated)
 
   def createProxy(self):
     """ Creates the proxy on disk
+
+        :return: S_OK()/S_ERROR()
     """
     gLogger.notice("Generating proxy...")
     resultProxyGenerated = ProxyGeneration.generateProxy(piParams)
@@ -117,6 +182,8 @@ def createProxy(self):
 
   def uploadProxy(self):
     """ Upload the proxy to the proxyManager service
+
+        :return: S_OK()/S_ERROR()
     """
     issuerCert = self.getIssuerCert()
     resultUserDN = issuerCert.getSubjectDN()  # pylint: disable=no-member
@@ -158,19 +225,27 @@ def printInfo(self):
     if self.__uploadedInfo:
       gLogger.notice("\nProxies uploaded:")
       maxDNLen = 0
-      maxGroupLen = 0
-      for userDN in self.__uploadedInfo:
+      maxProviderLen = len('ProxyProvider')
+      for userDN, data in self.__uploadedInfo.items():
         maxDNLen = max(maxDNLen, len(userDN))
-        for group in self.__uploadedInfo[userDN]:
-          maxGroupLen = max(maxGroupLen, len(group))
-      gLogger.notice(" %s | %s | Until (GMT)" % ("DN".ljust(maxDNLen), "Group".ljust(maxGroupLen)))
-      for userDN in self.__uploadedInfo:
-        for group in self.__uploadedInfo[userDN]:
-          gLogger.notice(" %s | %s | %s" % (userDN.ljust(maxDNLen),
-                                            group.ljust(maxGroupLen),
-                                            self.__uploadedInfo[userDN][group].strftime("%Y/%m/%d %H:%M")))
+        print(maxProviderLen)
+        print(data)
+        print(data['provider'])
+        print(len(data['provider']))
+        print(max(maxProviderLen, len(data['provider'])))
+        maxProviderLen = max(maxProviderLen, len(data['provider']))
+      gLogger.notice(" %s | %s | %s | SupportedGroups" % ("DN".ljust(maxDNLen), "ProxyProvider".ljust(maxProviderLen),
+                                                          "Until (GMT)".ljust(16)))
+      for userDN, data in self.__uploadedInfo.items():
+        gLogger.notice(" %s | %s | %s | " % (userDN.ljust(maxDNLen), data['provider'].ljust(maxProviderLen),
+                                             data['expirationtime'].strftime("%Y/%m/%d %H:%M").ljust(16)),
+                       ",".join(data['groups']))
 
   def checkCAs(self):
+    """ Check CAs
+
+        :return: S_OK()
+    """
     if "X509_CERT_DIR" not in os.environ:
       gLogger.warn("X509_CERT_DIR is unset. Abort check of CAs")
       return
@@ -203,6 +278,10 @@ def checkCAs(self):
     return S_OK()
 
   def doTheMagic(self):
+    """ Magic method
+
+        :return: S_OK()/S_ERROR()
+    """
     proxy = self.createProxy()
     if not proxy['OK']:
       return proxy
@@ -229,6 +308,232 @@ def doTheMagic(self):
 
     return S_OK()
 
+  def doOAuthMagic(self):
+    """ Magic method
+
+        :return: S_OK()/S_ERROR()
+    """
+    import urllib3
+    import requests
+    import threading
+    import webbrowser
+
+    from DIRAC.FrameworkSystem.Utilities.halo import Halo
+    from DIRAC.Core.Utilities.JEncode import decode, encode
+
+    authAPI = None
+    proxyAPI = None
+    spinner = Halo()
+    s = requests.Session()
+
+    # Search and load sessions cache
+    try:
+      with open('/tmp/cache_u%d' % os.getuid(), 'rb') as f:
+        s.cookies.update(pickle.load(f))
+      if self.__piParams.provider:
+        s.cookies.set("TypeAuth", self.__piParams.provider, domain=s.cookies.list_domains()[0])
+    except Exception:
+      pass
+
+    urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
+
+    def restRequest(url, endpoint='', metod='GET', **kwargs):
+      """ Method to do http requests
+
+          :param str url: root path of request URL
+          :param str endpoint: DIRAC rest endpoint
+          :param str method: HTTP method
+          :param `**kwargs`: options that need to add to request
+
+          :return: S_OK(Responce)/S_ERROR()
+      """
+      # Collect options
+      __opts = ''
+      for key in kwargs:
+        if kwargs[key]:
+          if not __opts:
+            __opts = '?%s=%s' % (key, kwargs[key])
+          else:
+            __opts += '&%s=%s' % (key, kwargs[key])
+
+      # Make request
+      try:
+        r = s.get('%s/%s%s' % (url.strip('/'), endpoint.strip('/'), __opts), verify=False)
+        r.raise_for_status()
+        # Save cookies
+        with open('/tmp/cache_u%d' % os.getuid(), 'wb+') as f:
+          pickle.dump(s.cookies, f)
+        return S_OK(decode(r.text)[0])
+      except requests.exceptions.Timeout:
+        return S_ERROR('Time out')
+      except requests.exceptions.RequestException as ex:
+        return S_ERROR(r.content or ex)
+      except Exception as ex:
+        return S_ERROR('Cannot read response: %s' % ex)
+
+    def qrterminal(url):
+      """ Show QR code
+
+          :param str url: URL to convert to QRCode
+
+          :return: S_OK(str)/S_ERROR()
+      """
+      try:
+        import pyqrcode  # pylint: disable=import-error
+      except Exception as ex:
+        return S_ERROR('pyqrcode library is not installed.')
+      __qr = '\n'
+      qrA = pyqrcode.create(url).code
+      qrA.insert(0, [0 for i in range(0, len(qrA[0]))])
+      qrA.append([0 for i in range(0, len(qrA[0]))])
+      if not (len(qrA) % 2) == 0:
+        qrA.append([0 for i in range(0, len(qrA[0]))])
+      for i in range(0, len(qrA)):
+        if not (i % 2) == 0:
+          continue
+        __qr += '\033[0;30;47m '
+        for j in range(0, len(qrA[0])):
+          p = str(qrA[i][j]) + str(qrA[i + 1][j])
+          if p == '11':  # black bg
+            __qr += '\033[0;30;40m \033[0;30;47m'
+          if p == '10':  # upblock
+            __qr += u'\u2580'
+          if p == '01':  # downblock
+            __qr += u'\u2584'
+          if p == '00':  # white bg
+            __qr += ' '
+        __qr += ' \033[0m\n'
+      return S_OK(__qr)
+
+    with Halo('Authentification from %s.' % self.__piParams.provider) as spin:
+      # Get https endpoint of OAuthService API from http API of ConfigurationService
+      confUrl = gConfig.getValue("/LocalInstallation/ConfigurationServerAPI")
+      if not confUrl:
+        sys.exit('Cannot get http url of configuration server.')
+      result = restRequest(confUrl, '/option', path='/Systems/Framework/Production/URLs/AuthAPI')
+      if not result['OK']:
+        sys.exit('Cannot get URL of authentication server:\n %s' % result['Message'])
+      authAPI = result['Value']
+      result = restRequest(confUrl, '/option', path='/Systems/Framework/Production/URLs/ProxyAPI')
+      if not result['OK']:
+        sys.exit('Cannot get URL of proxy server:\n %s' % result['Message'])
+      proxyAPI = result['Value']
+      result = restRequest(confUrl, '/option', path='/DIRAC/Setup')
+      if not result['OK']:
+        sys.exit('Cannot get DIRAC setup name:\n %s' % result['Message'])
+      setup = result['Value']
+
+      # Submit authorization session
+      params = {}
+      if self.__piParams.addEmail:
+        params['email'] = self.__piParams.Email
+      result = restRequest(authAPI, '/auth/%s' % self.__piParams.provider, **params)
+      if not result['OK']:
+        sys.exit(result['Message'])
+      authDict = result['Value']
+
+      if authDict.get('Comment'):
+        spin.info(authDict['Comment'].strip())
+
+      spin.result = None
+
+    if authDict['Status'] == 'needToAuth':
+      session = authDict['Session']
+      if not authDict.get('URL'):
+        sys.exit('Cannot get link for authentication.')
+      # Show QR code
+      if self.__piParams.addQRcode:
+        result = qrterminal(authDict['URL'])
+        if not result['OK']:
+          spinner.info(authDict['URL'])
+          spinner.color = 'red'
+          spinner.text = 'QRCode is crash: %s Please use upper link.' % result['Message']
+        else:
+          spinner.info('Scan QR code to continue: %s' % result['Value'])
+          spinner.text = 'Or use link: %s' % authDict['URL']
+      else:
+        spinner.info(authDict['URL'])
+        spinner.text = 'Use upper link to continue'
+
+      # Try to open in default browser
+      if webbrowser.open_new_tab(authDict['URL']):
+        spinner.text = '%s opening in default browser..' % authDict['URL']
+
+      comment = ''
+      with spinner:
+        # Loop: waiting status of request
+        __start = time.time()
+        __eNum = 0
+        while True:
+          time.sleep(5)
+          if time.time() - __start > 300:
+            sys.exit('Time out.')
+
+          result = restRequest(authAPI, '/auth/%s/status' % session)
+          if not result['OK']:
+            if __eNum < 3:
+              __eNum += 1
+              spinner.color = 'red'
+              spinner.text = result['Message']
+              continue
+            sys.exit(result['Message'])
+          authDict = result['Value']
+          if authDict['Status'] in ['prepared', 'in progress', 'finishing', 'redirect']:
+            if spinner.color != 'green':
+              spinner.text = '"%s" session %s' % (session, authDict['Status'])
+            spinner.color = 'green'
+            continue
+          break
+
+        comment = authDict['Comment'].strip()
+        if authDict['Status'] != 'authed':
+          sys.exit('Authentication failed. %s' % comment)
+        spinner.text = 'Authenticated success.'
+
+      if comment:
+        spinner.info(comment)
+
+    username = authDict['UserName']
+
+    with Halo(text='Downloading proxy') as spin:
+      # Get group status
+      result = restRequest(confUrl, '/getGroupsStatusByUsername', username=username)
+      if not result['OK']:
+        sys.exit('Cannot get status of groups: %s' % result['Message'])
+      groupsStatusDict = result['Value']
+      if self.__piParams.diracGroup not in groupsStatusDict:
+        sys.exit('%s is uncorrect.' % self.__piParams.diracGroup)
+      if groupsStatusDict[self.__piParams.diracGroup]['Status'] != 'ready':
+        sys.exit('Cannot get proxy: %s' % groupsStatusDict[self.__piParams.diracGroup]['Comment'])
+
+      addVOMS = self.__piParams.addVOMSExt or Registry.getGroupOption(self.__piParams.diracGroup, "AutoAddVOMS", False)
+      result = restRequest(proxyAPI, 's:%s/g:%s/proxy' % (setup, self.__piParams.diracGroup),
+                           lifetime=self.__piParams.proxyLifeTime, voms=addVOMS)
+      if not result['OK']:
+        sys.exit(result['Message'])
+      proxy = result['Value']
+      if not proxy:
+        sys.exit("Result is empty.")
+
+    if not self.__piParams.proxyLoc:
+      self.__piParams.proxyLoc = '/tmp/x509up_u%s' % os.getuid()
+
+    with Halo(text='Saving proxy to %s' % self.__piParams.proxyLoc):
+      try:
+        with open(self.__piParams.proxyLoc, 'w+') as fd:
+          fd.write(proxy.encode("UTF-8"))
+        os.chmod(self.__piParams.proxyLoc, stat.S_IRUSR | stat.S_IWUSR)
+      except Exception as e:
+        return S_ERROR("%s :%s" % (self.__piParams.proxyLoc, repr(e).replace(',)', ')')))
+      self.__piParams.certLoc = self.__piParams.proxyLoc
+
+    result = Script.enableCS()
+    if not result['OK']:
+      return S_ERROR("Cannot contact CS to get user list")
+    threading.Thread(target=self.checkCAs).start()
+    gConfig.forceRefresh(fromMaster=True)
+    return S_OK(self.__piParams.proxyLoc)
+
 
 if __name__ == "__main__":
   piParams = Params()
@@ -239,9 +544,13 @@ def doTheMagic(self):
   DIRAC.gConfig.setOptionValue("/DIRAC/Security/UseServerCertificate", "False")
 
   pI = ProxyInit(piParams)
-  resultDoTheMagic = pI.doTheMagic()
-  if not resultDoTheMagic['OK']:
-    gLogger.fatal(resultDoTheMagic['Message'])
+  gLogger.info(gConfig.getConfigurationTree())
+  if piParams.addProvider:
+    resultDoMagic = pI.doOAuthMagic()
+  else:
+    resultDoMagic = pI.doTheMagic()
+  if not resultDoMagic['OK']:
+    gLogger.fatal(resultDoMagic['Message'])
     sys.exit(1)
 
   pI.printInfo()
diff --git a/Interfaces/API/DiracAdmin.py b/Interfaces/API/DiracAdmin.py
index c203d36125f..d1323ad6cde 100755
--- a/Interfaces/API/DiracAdmin.py
+++ b/Interfaces/API/DiracAdmin.py
@@ -14,22 +14,22 @@
 import os
 
 from DIRAC import gLogger, gConfig, S_OK, S_ERROR
-from DIRAC.Core.Utilities.PromptUser import promptUser
 from DIRAC.Core.Base.API import API
-from DIRAC.ConfigurationSystem.Client.CSAPI import CSAPI
-from DIRAC.ConfigurationSystem.Client.Helpers.Registry import getVOForGroup
-from DIRAC.ConfigurationSystem.Client.Helpers.Resources import getSites
 from DIRAC.Core.Security.ProxyInfo import getProxyInfo
-from DIRAC.Core.Utilities.Grid import ldapSite, ldapCluster, ldapCE, ldapService
+from DIRAC.Core.Utilities.PromptUser import promptUser
 from DIRAC.Core.Utilities.Grid import ldapCEState, ldapCEVOView, ldapSE
+from DIRAC.Core.Utilities.Grid import ldapSite, ldapCluster, ldapCE, ldapService
+from DIRAC.ConfigurationSystem.Client.CSAPI import CSAPI
+from DIRAC.ConfigurationSystem.Client.Helpers.Resources import getSites
+from DIRAC.ConfigurationSystem.Client.Helpers.Registry import getVOForGroup
 from DIRAC.FrameworkSystem.Client.ProxyManagerClient import gProxyManager
 from DIRAC.FrameworkSystem.Client.NotificationClient import NotificationClient
-from DIRAC.ResourceStatusSystem.Client.ResourceStatusClient import ResourceStatusClient
-from DIRAC.ResourceStatusSystem.Client.ResourceStatus import ResourceStatus
-from DIRAC.ResourceStatusSystem.Client.SiteStatus import SiteStatus
 from DIRAC.WorkloadManagementSystem.Client.JobManagerClient import JobManagerClient
 from DIRAC.WorkloadManagementSystem.Client.WMSAdministratorClient import WMSAdministratorClient
 from DIRAC.WorkloadManagementSystem.Client.PilotManagerClient import PilotManagerClient
+from DIRAC.ResourceStatusSystem.Client.ResourceStatusClient import ResourceStatusClient
+from DIRAC.ResourceStatusSystem.Client.ResourceStatus import ResourceStatus
+from DIRAC.ResourceStatusSystem.Client.SiteStatus import SiteStatus
 
 voName = ''
 ret = getProxyInfo(disableVOMS=True)
@@ -63,70 +63,50 @@ def __init__(self):
 
   #############################################################################
   def uploadProxy(self):
-    """Upload a proxy to the DIRAC WMS.  This method
-
-       Example usage:
+    """ Upload a proxy to the DIRAC WMS.  This method
 
-         >>> print diracAdmin.uploadProxy('dteam_pilot')
-         {'OK': True, 'Value': 0L}
+        Example usage:
 
-       :return: S_OK,S_ERROR
+          >>> print diracAdmin.uploadProxy('dteam_pilot')
+          {'OK': True, 'Value': 0L}
 
-       :param permanent: Indefinitely update proxy
-       :type permanent: boolean
+        :param bool permanent: Indefinitely update proxy
 
+        :return: S_OK,S_ERROR
     """
     return gProxyManager.uploadProxy()
 
   #############################################################################
-  def setProxyPersistency(self, userDN, userGroup, persistent=True):
-    """Set the persistence of a proxy in the Proxy Manager
+  def checkProxyUploaded(self, user, userGroup, requiredTime):
+    """ Check if a user(DN-group) has a proxy in the proxy management
+        Updates internal cache if needed to minimize queries to the service
 
-       Example usage:
+        Example usage:
 
-         >>> gLogger.notice(diracAdmin.setProxyPersistency( 'some DN', 'dirac group', True ))
-         {'OK': True }
+          >>> gLogger.notice(diracAdmin.checkProxyUploaded('user name', 'dirac group', 0))
+          {'OK': True, 'Value' : True/False }
 
-       :param userDN: User DN
-       :type userDN: string
-       :param userGroup: DIRAC Group
-       :type userGroup: string
-       :param persistent: Persistent flag
-       :type persistent: boolean
-       :return: S_OK,S_ERROR
-    """
-    return gProxyManager.setPersistency(userDN, userGroup, persistent)
+        :param str user: user name or DN
+        :param str userGroup: DIRAC Group
+        :param bool requiredTime: Required life time of the uploaded proxy
 
-  #############################################################################
-  def checkProxyUploaded(self, userDN, userGroup, requiredTime):
-    """Set the persistence of a proxy in the Proxy Manager
-
-       Example usage:
-
-         >>> gLogger.notice(diracAdmin.setProxyPersistency( 'some DN', 'dirac group', True ))
-         {'OK': True, 'Value' : True/False }
-
-       :param userDN: User DN
-       :type userDN: string
-       :param userGroup: DIRAC Group
-       :type userGroup: string
-       :param requiredTime: Required life time of the uploaded proxy
-       :type requiredTime: boolean
-       :return: S_OK,S_ERROR
+        :return: S_OK,S_ERROR
     """
-    return gProxyManager.userHasProxy(userDN, userGroup, requiredTime)
+    return gProxyManager.userHasProxy(user, userGroup, requiredTime)
 
   #############################################################################
   def getSiteMask(self, printOutput=False, status='Active'):
-    """Retrieve current site mask from WMS Administrator service.
+    """ Retrieve current site mask from WMS Administrator service.
 
-       Example usage:
+        Example usage:
 
-         >>> gLogger.notice(diracAdmin.getSiteMask())
-         {'OK': True, 'Value': 0L}
+          >>> gLogger.notice(diracAdmin.getSiteMask())
+          {'OK': True, 'Value': 0L}
 
-       :return: S_OK,S_ERROR
+        :param bool printOutput: print output
+        :param str status: site status
 
+        :return: S_OK,S_ERROR
     """
 
     result = self.sitestatus.getSites(siteState=status)
@@ -141,15 +121,16 @@ def getSiteMask(self, printOutput=False, status='Active'):
 
   #############################################################################
   def getBannedSites(self, printOutput=False):
-    """Retrieve current list of banned  and probing sites.
+    """ Retrieve current list of banned  and probing sites.
 
-       Example usage:
+        Example usage:
 
-         >>> gLogger.notice(diracAdmin.getBannedSites())
-         {'OK': True, 'Value': []}
+          >>> gLogger.notice(diracAdmin.getBannedSites())
+          {'OK': True, 'Value': []}
 
-       :return: S_OK,S_ERROR
+        :param bool printOutput: print output
 
+        :return: S_OK,S_ERROR
     """
 
     bannedSites = self.sitestatus.getSites(siteState='Banned')
@@ -169,14 +150,17 @@ def getBannedSites(self, printOutput=False):
 
   #############################################################################
   def getSiteSection(self, site, printOutput=False):
-    """Simple utility to get the list of CEs for DIRAC site name.
+    """ Simple utility to get the list of CEs for DIRAC site name.
+
+        Example usage:
 
-       Example usage:
+          >>> gLogger.notice(diracAdmin.getSiteSection('LCG.CERN.ch'))
+          {'OK': True, 'Value':}
 
-         >>> gLogger.notice(diracAdmin.getSiteSection('LCG.CERN.ch'))
-         {'OK': True, 'Value':}
+        :param str site: site
+        :param bool printOutput: print output
 
-       :return: S_OK,S_ERROR
+        :return: S_OK,S_ERROR
     """
     gridType = site.split('.')[0]
     if not gConfig.getSections('/Resources/Sites/%s' % (gridType))['OK']:
@@ -189,15 +173,18 @@ def getSiteSection(self, site, printOutput=False):
 
   #############################################################################
   def allowSite(self, site, comment, printOutput=False):
-    """Adds the site to the site mask.
+    """ Adds the site to the site mask.
 
-       Example usage:
+        Example usage:
 
-         >>> gLogger.notice(diracAdmin.allowSite())
-         {'OK': True, 'Value': }
+          >>> gLogger.notice(diracAdmin.allowSite())
+          {'OK': True, 'Value': }
 
-       :return: S_OK,S_ERROR
+        :param str site: site
+        :param str comment: comment
+        :param bool printOutput: print output
 
+        :return: S_OK,S_ERROR
     """
     result = self.__checkSiteIsValid(site)
     if not result['OK']:
@@ -226,14 +213,17 @@ def allowSite(self, site, comment, printOutput=False):
 
   #############################################################################
   def getSiteMaskLogging(self, site=None, printOutput=False):
-    """Retrieves site mask logging information.
+    """ Retrieves site mask logging information.
 
-       Example usage:
+        Example usage:
 
-         >>> gLogger.notice(diracAdmin.getSiteMaskLogging('LCG.AUVER.fr'))
-         {'OK': True, 'Value': }
+          >>> gLogger.notice(diracAdmin.getSiteMaskLogging('LCG.AUVER.fr'))
+          {'OK': True, 'Value': }
 
-       :return: S_OK,S_ERROR
+        :param str site: site
+        :param bool printOutput: print output
+
+        :return: S_OK,S_ERROR
     """
     result = self.__checkSiteIsValid(site)
     if not result['OK']:
@@ -270,15 +260,18 @@ def getSiteMaskLogging(self, site=None, printOutput=False):
 
   #############################################################################
   def banSite(self, site, comment, printOutput=False):
-    """Removes the site from the site mask.
+    """ Removes the site from the site mask.
 
-       Example usage:
+        Example usage:
 
-         >>> gLogger.notice(diracAdmin.banSite())
-         {'OK': True, 'Value': }
+          >>> gLogger.notice(diracAdmin.banSite())
+          {'OK': True, 'Value': }
 
-       :return: S_OK,S_ERROR
+        :param str site: site
+        :param str comment: comment
+        :param bool printOutput: print output
 
+        :return: S_OK,S_ERROR
     """
     result = self.__checkSiteIsValid(site)
     if not result['OK']:
@@ -307,7 +300,11 @@ def banSite(self, site, comment, printOutput=False):
 
   #############################################################################
   def __checkSiteIsValid(self, site):
-    """Internal function to check that a site name is valid.
+    """ Internal function to check that a site name is valid.
+
+        :param str site: site
+
+        :return: S_OK/S_ERROR
     """
     if isinstance(site, (list, set, dict)):
       site = set(site) - self._siteSet
@@ -319,16 +316,18 @@ def __checkSiteIsValid(self, site):
 
   #############################################################################
   def getServicePorts(self, setup='', printOutput=False):
-    """Checks the service ports for the specified setup.  If not given this is
-       taken from the current installation (/DIRAC/Setup)
+    """ Checks the service ports for the specified setup.  If not given this is
+        taken from the current installation (/DIRAC/Setup)
 
-       Example usage:
+        Example usage:
 
-         >>> gLogger.notice(diracAdmin.getServicePorts())
-         {'OK': True, 'Value':''}
+          >>> gLogger.notice(diracAdmin.getServicePorts())
+          {'OK': True, 'Value':''}
 
-       :return: S_OK,S_ERROR
+        :param str setup: setup
+        :param bool printOutput: output
 
+        :return: S_OK,S_ERROR
     """
     if not setup:
       setup = gConfig.getValue('/DIRAC/Setup', '')
@@ -377,68 +376,76 @@ def getServicePorts(self, setup='', printOutput=False):
     return S_OK(result)
 
   #############################################################################
-  def getProxy(self, userDN, userGroup, validity=43200, limited=False):
-    """Retrieves a proxy with default 12hr validity and stores
-       this in a file in the local directory by default.
+  def getProxy(self, user, userGroup, validity=43200, limited=False):
+    """ Retrieves a proxy with default 12hr validity and stores
+        this in a file in the local directory by default.
 
-       Example usage:
+        Example usage:
 
-         >>> gLogger.notice(diracAdmin.getProxy())
-         {'OK': True, 'Value': }
+          >>> gLogger.notice(diracAdmin.getProxy())
+          {'OK': True, 'Value': }
 
-       :return: S_OK,S_ERROR
+        :param str user: user name or DN
+        :param str userGroup: group name
+        :param int validity: proxy lifetime
+        :param bool limited: limited proxy
 
+        :return: S_OK,S_ERROR
     """
-    return gProxyManager.downloadProxy(userDN, userGroup, limited=limited,
+    return gProxyManager.downloadProxy(user, userGroup, limited=limited,
                                        requiredTimeLeft=validity)
 
   #############################################################################
-  def getVOMSProxy(self, userDN, userGroup, vomsAttr=False, validity=43200, limited=False):
-    """Retrieves a proxy with default 12hr validity and VOMS extensions and stores
-       this in a file in the local directory by default.
+  def getVOMSProxy(self, user, userGroup, validity=43200, limited=False):
+    """ Retrieves a proxy with default 12hr validity and VOMS extensions and stores
+        this in a file in the local directory by default.
 
-       Example usage:
+        Example usage:
 
-         >>> gLogger.notice(diracAdmin.getVOMSProxy())
-         {'OK': True, 'Value': }
+          >>> gLogger.notice(diracAdmin.getVOMSProxy())
+          {'OK': True, 'Value': }
 
-       :return: S_OK,S_ERROR
+        :param str user: user name or DN
+        :param str userGroup: group name
+        :param int validity: proxy lifetime
+        :param bool limited: limited proxy
 
+        :return: S_OK,S_ERROR
     """
-    return gProxyManager.downloadVOMSProxy(userDN, userGroup, limited=limited,
-                                           requiredVOMSAttribute=vomsAttr,
-                                           requiredTimeLeft=validity)
+    return gProxyManager.downloadVOMSProxy(user, userGroup, limited=limited, requiredTimeLeft=validity)
 
   #############################################################################
-  def getPilotProxy(self, userDN, userGroup, validity=43200):
-    """Retrieves a pilot proxy with default 12hr validity and stores
-       this in a file in the local directory by default.
+  def getPilotProxy(self, user, userGroup, validity=43200):
+    """ Retrieves a pilot proxy with default 12hr validity and stores
+        this in a file in the local directory by default.
 
-       Example usage:
+        Example usage:
 
-         >>> gLogger.notice(diracAdmin.getVOMSProxy())
-         {'OK': True, 'Value': }
+          >>> gLogger.notice(diracAdmin.getVOMSProxy())
+          {'OK': True, 'Value': }
 
-       :return: S_OK,S_ERROR
+        :param str user: user name or DN
+        :param str userGroup: group name
+        :param int validity: proxy lifetime
 
+        :return: S_OK,S_ERROR
     """
-
-    return gProxyManager.getPilotProxyFromDIRACGroup(userDN, userGroup, requiredTimeLeft=validity)
+    return gProxyManager.downloadCorrectProxy(user, userGroup, requiredTimeLeft=validity)
 
   #############################################################################
   def resetJob(self, jobID):
-    """Reset a job or list of jobs in the WMS.  This operation resets the reschedule
-       counter for a job or list of jobs and allows them to run as new.
+    """ Reset a job or list of jobs in the WMS.  This operation resets the reschedule
+        counter for a job or list of jobs and allows them to run as new.
 
-       Example::
+        Example::
 
-         >>> gLogger.notice(dirac.reset(12345))
-         {'OK': True, 'Value': [12345]}
+          >>> gLogger.notice(dirac.reset(12345))
+          {'OK': True, 'Value': [12345]}
 
-       :param job: JobID
-       :type job: integer or list of integers
-       :return: S_OK,S_ERROR
+        :param jobID: JobID
+        :type jobID: integer or list of integers
 
+        :return: S_OK,S_ERROR
     """
     if isinstance(jobID, six.string_types):
       try:
@@ -456,16 +463,18 @@ def resetJob(self, jobID):
 
   #############################################################################
   def getJobPilotOutput(self, jobID, directory=''):
-    """Retrieve the pilot output for an existing job in the WMS.
-       The output will be retrieved in a local directory unless
-       otherwise specified.
+    """ Retrieve the pilot output for an existing job in the WMS.
+        The output will be retrieved in a local directory unless
+        otherwise specified.
+
+          >>> gLogger.notice(dirac.getJobPilotOutput(12345))
+          {'OK': True, StdOut:'',StdError:''}
 
-         >>> gLogger.notice(dirac.getJobPilotOutput(12345))
-         {'OK': True, StdOut:'',StdError:''}
+        :param jobID: JobID
+        :type jobID: int or str
+        :param str directory: path for output
 
-       :param job: JobID
-       :type job: integer or string
-       :return: S_OK,S_ERROR
+        :return: S_OK,S_ERROR
     """
     if not directory:
       directory = self.currentDir
@@ -508,14 +517,15 @@ def getJobPilotOutput(self, jobID, directory=''):
 
   #############################################################################
   def getPilotOutput(self, gridReference, directory=''):
-    """Retrieve the pilot output  (std.out and std.err) for an existing job in the WMS.
+    """ Retrieve the pilot output  (std.out and std.err) for an existing job in the WMS.
+
+          >>> gLogger.notice(dirac.getJobPilotOutput(12345))
+          {'OK': True, 'Value': {}}
 
-         >>> gLogger.notice(dirac.getJobPilotOutput(12345))
-         {'OK': True, 'Value': {}}
+        :param str gridReference: Pilot Job Reference
+        :param str directory: path for output
 
-       :param job: JobID
-       :type job: integer or string
-       :return: S_OK,S_ERROR
+        :return: S_OK,S_ERROR
     """
     if not isinstance(gridReference, six.string_types):
       return self._errorReport('Expected string for pilot reference')
@@ -565,14 +575,14 @@ def getPilotOutput(self, gridReference, directory=''):
 
   #############################################################################
   def getPilotInfo(self, gridReference):
-    """Retrieve info relative to a pilot reference
+    """ Retrieve info relative to a pilot reference
 
-         >>> gLogger.notice(dirac.getPilotInfo(12345))
-         {'OK': True, 'Value': {}}
+          >>> gLogger.notice(dirac.getPilotInfo(12345))
+          {'OK': True, 'Value': {}}
 
-       :param gridReference: Pilot Job Reference
-       :type gridReference: string
-       :return: S_OK,S_ERROR
+        :param str gridReference: Pilot Job Reference
+
+        :return: S_OK,S_ERROR
     """
     if not isinstance(gridReference, six.string_types):
       return self._errorReport('Expected string for pilot reference')
@@ -582,13 +592,14 @@ def getPilotInfo(self, gridReference):
 
   #############################################################################
   def killPilot(self, gridReference):
-    """Kill the pilot specified
+    """ Kill the pilot specified
+
+          >>> gLogger.notice(dirac.getPilotInfo(12345))
+          {'OK': True, 'Value': {}}
 
-         >>> gLogger.notice(dirac.getPilotInfo(12345))
-         {'OK': True, 'Value': {}}
+        :param str gridReference: Pilot Job Reference
 
-       :param gridReference: Pilot Job Reference
-       :return: S_OK,S_ERROR
+        :return: S_OK,S_ERROR
     """
     if not isinstance(gridReference, six.string_types):
       return self._errorReport('Expected string for pilot reference')
@@ -598,14 +609,14 @@ def killPilot(self, gridReference):
 
   #############################################################################
   def getPilotLoggingInfo(self, gridReference):
-    """Retrieve the pilot logging info for an existing job in the WMS.
+    """ Retrieve the pilot logging info for an existing job in the WMS.
+
+          >>> gLogger.notice(dirac.getPilotLoggingInfo(12345))
+          {'OK': True, 'Value': {"The output of the command"}}
 
-         >>> gLogger.notice(dirac.getPilotLoggingInfo(12345))
-         {'OK': True, 'Value': {"The output of the command"}}
+        :param str gridReference: Gridp pilot job reference Id
 
-       :param gridReference: Gridp pilot job reference Id
-       :type gridReference: string
-       :return: S_OK,S_ERROR
+        :return: S_OK,S_ERROR
     """
     if not isinstance(gridReference, six.string_types):
       return self._errorReport('Expected string for pilot reference')
@@ -614,16 +625,16 @@ def getPilotLoggingInfo(self, gridReference):
 
   #############################################################################
   def getJobPilots(self, jobID):
-    """Extract the list of submitted pilots and their status for a given
-       jobID from the WMS.  Useful information is printed to the screen.
+    """ Extract the list of submitted pilots and their status for a given
+        jobID from the WMS.  Useful information is printed to the screen.
 
-         >>> gLogger.notice(dirac.getJobPilots())
-         {'OK': True, 'Value': {PilotID:{StatusDict}}}
+          >>> gLogger.notice(dirac.getJobPilots())
+          {'OK': True, 'Value': {PilotID:{StatusDict}}}
 
-       :param job: JobID
-       :type job: integer or string
-       :return: S_OK,S_ERROR
+        :param job: JobID
+        :type job: int or str
 
+        :return: S_OK,S_ERROR
     """
     if isinstance(jobID, six.string_types):
       try:
@@ -638,15 +649,16 @@ def getJobPilots(self, jobID):
 
   #############################################################################
   def getPilotSummary(self, startDate='', endDate=''):
-    """Retrieve the pilot output for an existing job in the WMS.  Summary is
-       printed at INFO level, full dictionary of results also returned.
+    """ Retrieve the pilot output for an existing job in the WMS.  Summary is
+        printed at INFO level, full dictionary of results also returned.
 
-         >>> gLogger.notice(dirac.getPilotSummary())
-         {'OK': True, 'Value': {CE:{Status:Count}}}
+          >>> gLogger.notice(dirac.getPilotSummary())
+          {'OK': True, 'Value': {CE:{Status:Count}}}
 
-       :param job: JobID
-       :type job: integer or string
-       :return: S_OK,S_ERROR
+        :param str startDate: start date
+        :param str endDate: end date
+
+        :return: S_OK,S_ERROR
     """
     result = PilotManagerClient().getPilotSummary(startDate, endDate)
     if not result['OK']:
@@ -676,8 +688,13 @@ def getPilotSummary(self, startDate='', endDate=''):
 
   #############################################################################
   def setSiteProtocols(self, site, protocolsList, printOutput=False):
-    """
-    Allows to set the defined protocols for each SE for a given site.
+    """ Allows to set the defined protocols for each SE for a given site.
+
+        :param str site: site
+        :param list protocolsList: protocols
+        :param bool printOutput: output
+
+        :return: S_OK/S_ERROR
     """
     result = self.__checkSiteIsValid(site)
     if not result['OK']:
@@ -733,140 +750,177 @@ def setSiteProtocols(self, site, protocolsList, printOutput=False):
 
   #############################################################################
   def csSetOption(self, optionPath, optionValue):
-    """
-    Function to modify an existing value in the CS.
+    """ Function to modify an existing value in the CS.
+
+        :param str optionPath: option path
+        :param optionValue: value
     """
     return self.csAPI.setOption(optionPath, optionValue)
 
   #############################################################################
   def csSetOptionComment(self, optionPath, comment):
-    """
-    Function to modify an existing value in the CS.
+    """ Function to modify an existing value in the CS.
+
+        :param str optionPath: option path
+        :param str comment: comment
     """
     return self.csAPI.setOptionComment(optionPath, comment)
 
   #############################################################################
   def csModifyValue(self, optionPath, newValue):
-    """
-    Function to modify an existing value in the CS.
+    """ Function to modify an existing value in the CS.
+
+        :param str optionPath: option path
+        :param newValue: value
     """
     return self.csAPI.modifyValue(optionPath, newValue)
 
   #############################################################################
   def csRegisterUser(self, username, properties):
-    """
-    Registers a user in the CS.
-
-        - username: Username of the user (easy;)
-        - properties: Dict containing:
-            - DN
-            - groups : list/tuple of groups the user belongs to
-            - <others> : More properties of the user, like mail
+    """ Registers a user in the CS.
 
+        :param str username: user name
+        :param dict properties: containing DN, groups, etc.
+               - groups : list/tuple of groups the user belongs to
+               - <others> : More properties of the user, like mail
     """
     return self.csAPI.addUser(username, properties)
 
   #############################################################################
   def csDeleteUser(self, user):
-    """
-    Deletes a user from the CS. Can take a list of users
+    """ Deletes a user from the CS. Can take a list of users
+
+        :param str user: user name
     """
     return self.csAPI.deleteUsers(user)
 
   #############################################################################
   def csModifyUser(self, username, properties, createIfNonExistant=False):
-    """
-    Modify a user in the CS. Takes the same params as in addUser and
-    applies the changes
+    """ Modify a user in the CS. Takes the same params as in addUser and applies the changes
+
+        :param str username: user name
+        :param dict properties: containing DN, groups, etc.
+        :param bool createIfNonExistant: create user if non exist
     """
     return self.csAPI.modifyUser(username, properties, createIfNonExistant)
 
   #############################################################################
   def csListUsers(self, group=False):
-    """
-    Lists the users in the CS. If no group is specified return all users.
+    """ Lists the users in the CS. If no group is specified return all users.
+
+        :param str group: group name
+
+        :return: list
     """
     return self.csAPI.listUsers(group)
 
   #############################################################################
   def csDescribeUsers(self, mask=False):
-    """
-    List users and their properties in the CS.
-    If a mask is given, only users in the mask will be returned
+    """ List users and their properties in the CS.
+
+        :param str mask: If a mask is given, only users in the mask will be returned
+
+        :return: list
     """
     return self.csAPI.describeUsers(mask)
 
   #############################################################################
   def csModifyGroup(self, groupname, properties, createIfNonExistant=False):
-    """
-    Modify a user in the CS. Takes the same params as in addGroup and applies
-    the changes
+    """ Modify a user in the CS. Takes the same params as in addGroup and applies the changes
+
+        :param str groupname: group name
+        :param dict properties: properties
+        :param bool createIfNonExistant: create group if non exist
     """
     return self.csAPI.modifyGroup(groupname, properties, createIfNonExistant)
 
   #############################################################################
   def csListHosts(self):
-    """
-    Lists the hosts in the CS
+    """ Lists the hosts in the CS
+
+        :return: list
     """
     return self.csAPI.listHosts()
 
   #############################################################################
   def csDescribeHosts(self, mask=False):
-    """
-    Gets extended info for the hosts in the CS
+    """ Gets extended info for the hosts in the CS
+
+        :param mask: mask
+
+        :return: list
     """
     return self.csAPI.describeHosts(mask)
 
   #############################################################################
   def csModifyHost(self, hostname, properties, createIfNonExistant=False):
-    """
-    Modify a host in the CS. Takes the same params as in addHost and applies
-    the changes
+    """ Modify a host in the CS. Takes the same params as in addHost and applies the changes
+
+        :param str hostname: host name
+        :param dict properties: properties
+        :param bool createIfNonExistant: create group if non exist
     """
     return self.csAPI.modifyHost(hostname, properties, createIfNonExistant)
 
   #############################################################################
   def csListGroups(self):
-    """
-    Lists groups in the CS
+    """ Lists groups in the CS
+
+        :return: list
     """
     return self.csAPI.listGroups()
 
   #############################################################################
   def csDescribeGroups(self, mask=False):
-    """
-    List groups and their properties in the CS.
-    If a mask is given, only groups in the mask will be returned
+    """ List groups and their properties in the CS.
+
+        :param mask: If a mask is given, only groups in the mask will be returned
+
+        :return: list
     """
     return self.csAPI.describeGroups(mask)
 
   #############################################################################
   def csSyncUsersWithCFG(self, usersCFG):
-    """
-    Synchronize users in cfg with its contents
+    """ Synchronize users in cfg with its contents
+
+        :param object usersCFG: CFG
     """
     return self.csAPI.syncUsersWithCFG(usersCFG)
 
   #############################################################################
   def csCommitChanges(self, sortUsers=True):
-    """
-    Commit the changes in the CS
+    """ Commit the changes in the CS
+
+        :param list sortUsers: sort users
     """
     return self.csAPI.commitChanges(sortUsers=False)
 
   #############################################################################
   def sendMail(self, address, subject, body, fromAddress=None, localAttempt=True, html=False):
-    """
-    Send mail to specified address with body.
+    """ Send mail to specified address with body.
+
+        :param str address: address
+        :param str subject: subject
+        :param str body: body text
+        :param str fromAddress: address from who
+        :param bool localAttempt: local attempt
+        :param str html: html
+
+        :return: S_OK/S_ERROR
     """
     notification = NotificationClient()
     return notification.sendMail(address, subject, body, fromAddress, localAttempt, html)
 
   #############################################################################
   def sendSMS(self, userName, body, fromAddress=None):
-    """
-    Send mail to specified address with body.
+    """ Send mail to specified address with body.
+
+        :param str userName: user name
+        :param str body: body text
+        :param str fromAddress: address from who
+
+        :return: S_OK/S_ERROR
     """
     if len(body) > 160:
       return S_ERROR('Exceeded maximum SMS length of 160 characters')
@@ -875,50 +929,67 @@ def sendSMS(self, userName, body, fromAddress=None):
 
   #############################################################################
   def getBDIISite(self, site, host=None):
-    """
-    Get information about site from BDII at host
+    """ Get information about site from BDII at host
+
+        :param str site: site name
+        :param str host: host name
     """
     return ldapSite(site, host=host)
 
   #############################################################################
   def getBDIICluster(self, ce, host=None):
-    """
-    Get information about ce from BDII at host
+    """ Get information about ce from BDII at host
+
+        :param str ce: ce name
+        :param str host: host name
     """
     return ldapCluster(ce, host=host)
 
   #############################################################################
   def getBDIICE(self, ce, host=None):
-    """
-    Get information about ce from BDII at host
+    """ Get information about ce from BDII at host
+
+        :param str ce: ce name
+        :param str host: host name
     """
     return ldapCE(ce, host=host)
 
   #############################################################################
   def getBDIIService(self, ce, host=None):
-    """
-    Get information about ce from BDII at host
+    """ Get information about ce from BDII at host
+
+        :param str ce: ce name
+        :param str host: host name
     """
     return ldapService(ce, host=host)
 
   #############################################################################
   def getBDIICEState(self, ce, useVO=voName, host=None):
-    """
-    Get information about ce state from BDII at host
+    """ Get information about ce state from BDII at host
+
+        :param str ce: ce name
+        :param str useVO: VO name
+        :param str host: host name
     """
     return ldapCEState(ce, useVO, host=host)
 
   #############################################################################
   def getBDIICEVOView(self, ce, useVO=voName, host=None):
-    """
-    Get information about ce voview from BDII at host
+    """ Get information about ce voview from BDII at host
+
+        :param str ce: CE name
+        :param str useVO: VO name
+        :param str host: host name
     """
     return ldapCEVOView(ce, useVO, host=host)
 
   #############################################################################
   def getBDIISE(self, site, useVO=voName, host=None):
-    """
-    Get information about SA  from BDII at host
+    """ Get information about SA  from BDII at host
+
+        :param str site: site
+        :param str useVO: VO name
+        :param str host: host name
     """
     return ldapSE(site, useVO, host=host)
 
diff --git a/RequestManagementSystem/Client/Request.py b/RequestManagementSystem/Client/Request.py
index 80a6255b73f..5c0705d5088 100644
--- a/RequestManagementSystem/Client/Request.py
+++ b/RequestManagementSystem/Client/Request.py
@@ -25,6 +25,7 @@
 # # from DIRAC
 from DIRAC import S_OK, S_ERROR
 from DIRAC.Core.Security.ProxyInfo import getProxyInfo
+from DIRAC.Core.DISET.AuthManager import initializationOfCertificate, initializationOfGroup
 from DIRAC.RequestManagementSystem.Client.Operation import Operation
 from DIRAC.RequestManagementSystem.private.JSONUtils import RMSEncoder
 from DIRAC.DataManagementSystem.Utilities.DMSHelpers import DMSHelpers
@@ -77,6 +78,7 @@ def __init__(self, fromDict=None):
     self.JobID = 0
     self.Error = None
     self.DIRACSetup = None
+    self.Owner = None
     self.OwnerDN = None
     self.RequestName = None
     self.OwnerGroup = None
@@ -84,12 +86,17 @@ def __init__(self, fromDict=None):
 
     self.dmsHelper = DMSHelpers()
 
+    credDict = {}
     proxyInfo = getProxyInfo()
     if proxyInfo["OK"]:
-      proxyInfo = proxyInfo["Value"]
-      if proxyInfo["validGroup"] and proxyInfo["validDN"]:
-        self.OwnerDN = proxyInfo["identity"]
-        self.OwnerGroup = proxyInfo["group"]
+      credDict['DN'] = proxyInfo["Value"]['issuer']
+      credDict['group'] = proxyInfo["Value"].get('group')
+      credDict['username'] = proxyInfo["Value"].get('username')
+
+      if initializationOfCertificate(credDict) and initializationOfGroup(credDict):
+        self.Owner = credDict["username"]
+        self.OwnerDN = credDict["DN"]
+        self.OwnerGroup = credDict["group"]
 
     self.__operations__ = []
 
@@ -380,7 +387,7 @@ def toJSON(self):
   def _getJSONData(self):
     """ Returns the data that have to be serialized by JSON """
 
-    attrNames = ['RequestID', "RequestName", "OwnerDN", "OwnerGroup",
+    attrNames = ['RequestID', "RequestName", "Owner", "OwnerDN", "OwnerGroup",
                  "Status", "Error", "DIRACSetup", "SourceComponent",
                  "JobID", "CreationTime", "SubmitTime", "LastUpdate", "NotBefore"]
     jsonData = {}
diff --git a/RequestManagementSystem/private/OperationHandlerBase.py b/RequestManagementSystem/private/OperationHandlerBase.py
index da134185f05..50bf79cd445 100644
--- a/RequestManagementSystem/private/OperationHandlerBase.py
+++ b/RequestManagementSystem/private/OperationHandlerBase.py
@@ -58,7 +58,8 @@
 from DIRAC.Core.Utilities.Graph import DynamicProps
 from DIRAC.RequestManagementSystem.Client.Operation import Operation
 from DIRAC.FrameworkSystem.Client.ProxyManagerClient import gProxyManager
-from DIRAC.ConfigurationSystem.Client.Helpers.Registry import getGroupsWithVOMSAttribute
+from DIRAC.ConfigurationSystem.Client.Helpers.Registry import getGroupsWithVOMSAttribute,\
+    getUsernameForDN, getGroupsForUser
 from DIRAC.Core.Utilities.ReturnValues import returnSingleResult
 from DIRAC.DataManagementSystem.Client.DataManager import DataManager
 from DIRAC.Resources.Catalog.FileCatalog import FileCatalog
@@ -173,19 +174,33 @@ def getProxyForLFN(self, lfn):
     dirMeta = dirMeta["Value"]
 
     ownerRole = "/%s" % dirMeta["OwnerRole"] if not dirMeta["OwnerRole"].startswith("/") else dirMeta["OwnerRole"]
+    ownerGroup = dirMeta.get("OwnerGroup")
     ownerDN = dirMeta["OwnerDN"]
+    owner = dirMeta.get("Owner")
+
+    if not owner:
+      result = getUsernameForDN(ownerDN)
+      if not result['OK']:
+        return result
+      owner = result['Value']
+    ownerGroups = [ownerGroup]
+    if not ownerGroup:
+      result = getGroupsForUser(owner)
+      if not result['OK']:
+        return result
+      ownerGroups = result['Value']
 
     ownerProxy = None
-    for ownerGroup in getGroupsWithVOMSAttribute(ownerRole):
-      vomsProxy = gProxyManager.downloadVOMSProxy(ownerDN, ownerGroup, limited=True,
-                                                  requiredVOMSAttribute=ownerRole)
+    for ownerGroup in getGroupsWithVOMSAttribute(ownerRole, groupsList=ownerGroups):
+      vomsProxy = gProxyManager.downloadVOMSProxy(ownerDN or owner, ownerGroup, limited=True)
       if not vomsProxy["OK"]:
-        self.log.debug("getProxyForLFN: failed to get VOMS proxy for %s role=%s: %s" % (ownerDN,
-                                                                                        ownerRole,
-                                                                                        vomsProxy["Message"]))
+        self.log.debug("getProxyForLFN: failed to get VOMS proxy for %s@%s role=%s: %s" % (owner,
+                                                                                           ownerGroup,
+                                                                                           ownerRole,
+                                                                                           vomsProxy["Message"]))
         continue
       ownerProxy = vomsProxy["Value"]
-      self.log.debug("getProxyForLFN: got proxy for %s@%s [%s]" % (ownerDN, ownerGroup, ownerRole))
+      self.log.debug("getProxyForLFN: got proxy for %s@%s [%s]" % (owner, ownerGroup, ownerRole))
       break
 
     if not ownerProxy:
diff --git a/RequestManagementSystem/private/RequestTask.py b/RequestManagementSystem/private/RequestTask.py
index b7f230bfa7c..acf8efc6362 100644
--- a/RequestManagementSystem/private/RequestTask.py
+++ b/RequestManagementSystem/private/RequestTask.py
@@ -128,21 +128,21 @@ def __setupManagerProxies(self):
       userName = shifterDict["Value"].get("User", "")
       userGroup = shifterDict["Value"].get("Group", "")
 
-      userDN = Registry.getDNForUsername(userName)
-      if not userDN["OK"]:
-        self.log.error("Cannot get DN For Username", "%s: %s" % (userName, userDN["Message"]))
-        continue
-      userDN = userDN["Value"][0]
+      result = Registry.getDNForUsernameInGroup(userName, userGroup)
+      if not result['OK']:
+        return result
+      userDN = result['Value']
+
       vomsAttr = Registry.getVOMSAttributeForGroup(userGroup)
       if vomsAttr:
         self.log.debug("getting VOMS [%s] proxy for shifter %s@%s (%s)" % (vomsAttr, userName,
                                                                            userGroup, userDN))
-        getProxy = gProxyManager.downloadVOMSProxyToFile(userDN, userGroup,
+        getProxy = gProxyManager.downloadVOMSProxyToFile(userName, userGroup,
                                                          requiredTimeLeft=1200,
                                                          cacheTime=4 * 43200)
       else:
         self.log.debug("getting proxy for shifter %s@%s (%s)" % (userName, userGroup, userDN))
-        getProxy = gProxyManager.downloadProxyToFile(userDN, userGroup,
+        getProxy = gProxyManager.downloadProxyToFile(userName, userGroup,
                                                      requiredTimeLeft=1200,
                                                      cacheTime=4 * 43200)
       if not getProxy["OK"]:
@@ -169,9 +169,13 @@ def setupProxy(self):
 
     ownerDN = self.request.OwnerDN
     ownerGroup = self.request.OwnerGroup
+    result = Registry.getUsernameForDN(ownerDN)
+    if not result['OK']:
+      return result
+    owner = result['Value']
     isShifter = []
     for shifter, creds in self.__managersDict.items():
-      if creds["ShifterDN"] == ownerDN and creds["ShifterGroup"] == ownerGroup:
+      if creds["ShifterName"] == owner and creds["ShifterGroup"] == ownerGroup:
         isShifter.append(shifter)
     if isShifter:
       proxyFile = self.__managersDict[isShifter[0]]["ProxyFile"]
@@ -179,10 +183,10 @@ def setupProxy(self):
       return S_OK({"Shifter": isShifter, "ProxyFile": proxyFile})
 
     # # if we're here owner is not a shifter at all
-    ownerProxyFile = gProxyManager.downloadVOMSProxyToFile(ownerDN, ownerGroup)
+    ownerProxyFile = gProxyManager.downloadVOMSProxyToFile(owner, ownerGroup)
     if not ownerProxyFile["OK"] or not ownerProxyFile["Value"]:
       reason = ownerProxyFile.get("Message", "No valid proxy found in ProxyManager.")
-      return S_ERROR("Change proxy error for '%s'@'%s': %s" % (ownerDN, ownerGroup, reason))
+      return S_ERROR("Change proxy error for '%s'@'%s': %s" % (owner, ownerGroup, reason))
 
     ownerProxyFile = ownerProxyFile["Value"]
     os.environ["X509_USER_PROXY"] = ownerProxyFile
diff --git a/RequestManagementSystem/private/RequestValidator.py b/RequestManagementSystem/private/RequestValidator.py
index 498f0649571..edc380f4923 100644
--- a/RequestManagementSystem/private/RequestValidator.py
+++ b/RequestManagementSystem/private/RequestValidator.py
@@ -273,17 +273,19 @@ def setAndCheckRequestOwner(request, remoteCredentials):
         the RequestExecutingAgent
 
         :param request: the request to test
-        :param remoteCredentials: credentials from the clients
+        :param dict remoteCredentials: credentials from the clients
 
         :returns: True if everything is fine, False otherwise
     """
 
     credDN = remoteCredentials['DN']
     credGroup = remoteCredentials['group']
+    credUsername = remoteCredentials['username']
     credProperties = remoteCredentials['properties']
 
     # If the owner or the group was not set, we use the one of the credentials
-    if not request.OwnerDN or not request.OwnerGroup:
+    if not request.Owner or not request.OwnerGroup:
+      request.Owner = credUsername
       request.OwnerDN = credDN
       request.OwnerGroup = credGroup
       return True
@@ -291,7 +293,7 @@ def setAndCheckRequestOwner(request, remoteCredentials):
     # From here onward, we expect the ownerDN/group to already have a value
 
     # If the credentials in the Request match those from the credentials, it's OK
-    if request.OwnerDN == credDN and request.OwnerGroup == credGroup:
+    if request.Owner == credUsername and request.OwnerGroup == credGroup:
       return True
 
     # From here, something/someone is putting a request on behalf of someone else
diff --git a/Resources/Catalog/FileCatalogClient.py b/Resources/Catalog/FileCatalogClient.py
index 6f70723e681..afb2b2399e5 100644
--- a/Resources/Catalog/FileCatalogClient.py
+++ b/Resources/Catalog/FileCatalogClient.py
@@ -10,7 +10,7 @@
 from DIRAC.Core.DISET.TransferClient import TransferClient
 from DIRAC.Core.Security.ProxyInfo import getVOfromProxyGroup
 
-from DIRAC.ConfigurationSystem.Client.Helpers.Registry import getVOMSAttributeForGroup, getDNForUsername
+from DIRAC.ConfigurationSystem.Client.Helpers.Registry import getVOMSAttributeForGroup, getDNForUsernameInGroup
 from DIRAC.Resources.Catalog.Utilities import checkCatalogArguments
 from DIRAC.Resources.Catalog.FileCatalogClientBase import FileCatalogClientBase
 
@@ -225,11 +225,8 @@ def getDirectoryMetadata(self, lfns, timeout=120):
     for path in result['Value']['Successful']:
       owner = result['Value']['Successful'][path]['Owner']
       group = result['Value']['Successful'][path]['OwnerGroup']
-      res = getDNForUsername(owner)
-      if res['OK']:
-        result['Value']['Successful'][path]['OwnerDN'] = res['Value'][0]
-      else:
-        result['Value']['Successful'][path]['OwnerDN'] = ''
+      ownerDN = getDNForUsernameInGroup(owner, group).get('Value') or ''
+      result['Value']['Successful'][path]['OwnerDN'] = ownerDN
       result['Value']['Successful'][path]['OwnerRole'] = getVOMSAttributeForGroup(group)
     return result
 
diff --git a/Resources/Catalog/LcgFileCatalogClient.py b/Resources/Catalog/LcgFileCatalogClient.py
index cf6d50c4d56..e2df4b34735 100755
--- a/Resources/Catalog/LcgFileCatalogClient.py
+++ b/Resources/Catalog/LcgFileCatalogClient.py
@@ -20,7 +20,7 @@
 from DIRAC.Core.Utilities.Time import fromEpoch
 from DIRAC.Core.Utilities.List import breakListIntoChunks
 from DIRAC.Core.Security.ProxyInfo import getProxyInfo, formatProxyInfoAsString
-from DIRAC.ConfigurationSystem.Client.Helpers.Registry import getDNForUsername, getVOMSAttributeForGroup, \
+from DIRAC.ConfigurationSystem.Client.Helpers.Registry import getDNsForUsername, getVOMSAttributeForGroup, \
     getVOForGroup, getVOOption
 from DIRAC.Resources.Catalog.FileCatalogClientBase import FileCatalogClientBase
 
@@ -59,7 +59,7 @@ def getClientCertInfo():
     proxyInfo['VOMS'] = getVOMSAttributeForGroup(proxyInfo['group'])
     errStr = "getClientCertInfo: Proxy information does not contain the VOMs information."
     gLogger.warn(errStr)
-  res = getDNForUsername(proxyInfo['username'])
+  res = getDNsForUsername(proxyInfo['username'])
   if not res['OK']:
     errStr = "getClientCertInfo: Error getting known proxies for user."
     gLogger.error(errStr, res['Message'])
diff --git a/Resources/Computing/GlobusComputingElement.py b/Resources/Computing/GlobusComputingElement.py
index a95e20d2404..fe3a5a5d85b 100644
--- a/Resources/Computing/GlobusComputingElement.py
+++ b/Resources/Computing/GlobusComputingElement.py
@@ -23,7 +23,7 @@
 from DIRAC import S_OK, S_ERROR
 from DIRAC.Core.Utilities.File import makeGuid
 from DIRAC.Core.Utilities.Grid import executeGridCommand
-from DIRAC.ConfigurationSystem.Client.Helpers.Registry import getGroupOption
+from DIRAC.ConfigurationSystem.Client.Helpers.Registry import getVOMSAttributeForGroup
 from DIRAC.FrameworkSystem.Client.ProxyManagerClient import gProxyManager
 from DIRAC.Resources.Computing.ComputingElement import ComputingElement
 from DIRAC.WorkloadManagementSystem.DB.PilotAgentsDB import PilotAgentsDB
@@ -215,9 +215,13 @@ def getJobOutput(self, jobID, _localDir=None):
     if not result['OK'] or not result['Value']:
       return S_ERROR('Failed to determine owner for pilot ' + pilotRef)
     pilotDict = result['Value'][pilotRef]
-    owner = pilotDict['OwnerDN']
-    group = getGroupOption(pilotDict['OwnerGroup'], 'VOMSRole', pilotDict['OwnerGroup'])
-    ret = gProxyManager.getPilotProxyFromVOMSGroup(owner, group)
+    owner = pilotDict['Owner']
+    ownerDN = pilotDict['OwnerDN']
+    group = pilotDict['OwnerGroup']
+    if not getVOMSAttributeForGroup(group):
+      self.log.error("No voms attribute assigned to group %s when requested pilot proxy." % group)
+      return S_ERROR("Failed to get the pilot's owner proxy")
+    ret = gProxyManager.downloadVOMSProxy(ownerDN or owner, group)
     if not ret['OK']:
       self.log.error(ret['Message'])
       self.log.error('Could not get proxy:', 'User "%s", Group "%s"' % (owner, group))
diff --git a/Resources/IdProvider/IdProvider.py b/Resources/IdProvider/IdProvider.py
index a3ea4c52383..5f41b9e20c4 100644
--- a/Resources/IdProvider/IdProvider.py
+++ b/Resources/IdProvider/IdProvider.py
@@ -4,16 +4,46 @@
 from __future__ import division
 from __future__ import print_function
 
-from DIRAC import gLogger
+from DIRAC import gLogger, S_OK, S_ERROR
 
 __RCSID__ = "$Id$"
 
 
 class IdProvider(object):
 
-  def __init__(self, parameters=None):
+  def __init__(self, parameters=None, sessionManager=None):
+    """ C'or
+
+        :param dict parameters: parameters of the identity Provider
+        :param object sessionManager: session manager
+    """
     self.log = gLogger.getSubLogger(self.__class__.__name__)
     self.parameters = parameters
+    self.sessionManager = sessionManager
 
   def setParameters(self, parameters):
+    """ Set parameters
+
+        :param dict parameters: parameters of the identity Provider
+    """
     self.parameters = parameters
+
+  def setManager(self, sessionManager):
+    """ Set session manager
+
+        :param object sessionManager: session manager
+    """
+    self.sessionManager = sessionManager
+
+  def isSessionManagerAble(self):
+    """ Check if session manager able
+
+        :return: S_OK()/S_ERROR()
+    """
+    if not self.sessionManager:
+      try:
+        from DIRAC.FrameworkSystem.Client.AuthManagerClient import gSessionManager
+        self.sessionManager = gSessionManager
+      except Exception as e:
+        return S_ERROR('Session manager not able: %s' % e)
+    return S_OK()
diff --git a/Resources/IdProvider/IdProviderFactory.py b/Resources/IdProvider/IdProviderFactory.py
index a701c7f1b13..cfe98ed8b22 100644
--- a/Resources/IdProvider/IdProviderFactory.py
+++ b/Resources/IdProvider/IdProviderFactory.py
@@ -12,7 +12,7 @@
 
 from DIRAC import S_OK, S_ERROR, gLogger
 from DIRAC.Core.Utilities import ObjectLoader
-from DIRAC.ConfigurationSystem.Client.Helpers.Resources import getInfoAboutProviders
+from DIRAC.ConfigurationSystem.Client.Helpers.Resources import getProviderInfo
 
 __RCSID__ = "$Id$"
 
@@ -26,15 +26,16 @@ def __init__(self):
     self.log = gLogger.getSubLogger('IdProviderFactory')
 
   #############################################################################
-  def getIdProvider(self, idProvider):
+  def getIdProvider(self, idProvider, sessionManager=None):
     """ This method returns a IdProvider instance corresponding to the supplied
         name.
 
-        :param basestring idProvider: the name of the Identity Provider
+        :param str idProvider: the name of the Identity Provider
+        :param object sessionManager: session manager
 
         :return: S_OK(IdProvider)/S_ERROR()
     """
-    result = getInfoAboutProviders(of='Id', providerName=idProvider, option="all", section="all")
+    result = getProviderInfo(idProvider)
     if not result['OK']:
       return result
     pDict = result['Value']
@@ -54,6 +55,7 @@ def getIdProvider(self, idProvider):
     try:
       provider = pClass()
       provider.setParameters(pDict)
+      provider.setManager(sessionManager)
     except Exception as x:
       msg = 'IdProviderFactory could not instantiate %s object: %s' % (subClassName, str(x))
       self.log.exception()
diff --git a/Resources/IdProvider/OAuth2IdProvider.py b/Resources/IdProvider/OAuth2IdProvider.py
new file mode 100644
index 00000000000..b313217fd85
--- /dev/null
+++ b/Resources/IdProvider/OAuth2IdProvider.py
@@ -0,0 +1,301 @@
+""" IdProvider based on OAuth2 protocol
+"""
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import print_function
+
+import re
+import urllib
+import pprint
+
+from DIRAC import S_OK, S_ERROR, gLogger
+from DIRAC.Core.Security.X509Chain import X509Chain  # pylint: disable=import-error
+from DIRAC.Resources.IdProvider.IdProvider import IdProvider
+from DIRAC.ConfigurationSystem.Client.Helpers.Resources import getProviderByAlias
+
+from DIRAC.FrameworkSystem.Utilities.OAuth2 import OAuth2
+
+__RCSID__ = "$Id$"
+
+
+class OAuth2IdProvider(IdProvider):
+
+  def __init__(self, parameters=None, sessionManager=None):
+    super(OAuth2IdProvider, self).__init__(parameters, sessionManager)
+
+  def setParameters(self, parameters):
+    """ Set identity providers parameters
+
+        :param dict parameters: parameters to set
+    """
+    self.parameters = parameters
+    self.oauth2 = OAuth2(parameters['ProviderName'])
+
+  def submitNewSession(self, session=None):
+    """ Submit new authorization session
+
+        :param str session: session number
+
+        :return: S_OK(str)/S_ERROR()
+    """
+    provider = self.parameters['ProviderName']
+    result = self.isSessionManagerAble()
+    if not result['OK']:
+      return result
+
+    result = self.sessionManager.createNewSession(provider, session=session)
+    if not result['OK']:
+      return result
+    session = result['Value']
+    self.log.verbose(session, 'session was created.')
+
+    result = self.oauth2.createAuthRequestURL(session)
+    if result['OK']:
+      url = result['Value']
+      result = self.sessionManager.updateSession(session, {'Provider': provider,
+                                                           'Comment': url})
+    if not result['OK']:
+      kill = self.sessionManager.killSession(session)
+      return result if kill['OK'] else kill
+
+    return S_OK(session)
+
+  def checkStatus(self, session):
+    """ Read ready to work status of identity provider
+
+        :param str session: if need to check session
+
+        :return: S_OK(dict)/S_ERROR() -- dictionary contain fields:
+                 - 'Status' with ready to work status[ready, needToAuth]
+                 - 'AccessToken' with list of access token
+    """
+    result = self.isSessionManagerAble()
+    if not result['OK']:
+      return result
+
+    result = self.sessionManager.getSessionLifetime(session)
+    if not result['OK']:
+      return result
+    if result['Value'] < 10 * 60:
+      self.log.debug('%s session tokens are expired, try to refresh' % session)
+      result = self.sessionManager.getSessionTokens(session)
+      if not result['OK']:
+        return result
+      tokens = result['Value']
+      result = self.__fetchTokens(tokens)
+      if result['OK']:
+        tokens = result['Value']
+        if not tokens.get('RefreshToken'):
+          return S_ERROR('No refresh token found in response.')
+        return self.sessionManager.updateSession(session, tokens)
+      kill = self.sessionManager.killSession(session)
+      return result if kill['OK'] else kill
+
+    return S_OK()
+
+  def parseAuthResponse(self, response, session):
+    """ Make user info dict:
+          - username(preferd user name)
+          - nosupport(VOs in response that not in DIRAC)
+          - UsrOptns(User profile that convert to DIRAC user options)
+          - Tokens(Contain refreshed tokens, type and etc.)
+          - Groups(New DIRAC groups that need created)
+
+        :param dict response: response on request to get user profile
+        :param str session: session
+
+        :return: S_OK(dict)/S_ERROR()
+    """
+    resDict = {}
+    result = self.oauth2.fetchToken(response['code'])
+    if not result['OK']:
+      return result
+    tokens = self.__parseTokens(result['Value'])
+    result = self.oauth2.getUserProfile(tokens['AccessToken'])
+    if not result['OK']:
+      return result
+    result = self.__parseUserProfile(result['Value'])
+    if not result['OK']:
+      return result
+    userProfile = result['Value']
+
+    for key, value in userProfile.items():
+      resDict[key] = value
+
+    upDict = tokens
+    upDict['ID'] = resDict['UsrOptns']['ID']
+    result = self.sessionManager.updateSession(session, upDict)
+    if not result['OK']:
+      return result
+    self.log.debug('Got response dictionary:\n', pprint.pformat(resDict))
+    return S_OK(resDict)
+
+  def fetch(self, session):
+    """ Fetch tokens and update session in DB
+
+        :param str,dict session: session number or dictionary with tokens
+
+        :return: S_OK()/S_ERROR()
+    """
+    tokens = session
+    if isinstance(session, str):
+      result = self.sessionManager.getSessionTokens(session)
+      if not result['OK']:
+        return result
+      tokens = result['Value']
+    result = self.__fetchTokens(tokens)
+    if not result['OK']:
+      kill = self.sessionManager.killSession(session)
+      return result if kill['OK'] else kill
+    tokens = result['Value']
+    if not tokens.get('RefreshToken'):
+      return S_ERROR('No refresh token found in response.')
+    return self.sessionManager.updateSession(session, tokens)
+
+  def __fetchTokens(self, tokens):
+    """ Fetch tokens
+
+        :param dict tokens: tokens
+
+        :return: S_OK(dict)/S_ERROR() -- dictionary contain tokens
+    """
+    result = self.oauth2.fetchToken(refreshToken=tokens['RefreshToken'])
+    if not result['OK']:
+      return result
+    return S_OK(self.__parseTokens(result['Value']))
+
+  def __parseTokens(self, tokens):
+    """ Parse session tokens
+
+        :param dict tokens: tokens
+
+        :return: dict
+    """
+    resDict = {}
+    resDict['ExpiresIn'] = tokens.get('expires_in') or 0
+    resDict['TokenType'] = tokens.get('token_type') or 'bearer'
+    resDict['AccessToken'] = tokens.get('access_token')
+    resDict['RefreshToken'] = tokens.get('refresh_token')
+    return resDict
+
+  def __parseUserProfile(self, userProfile):
+    """ Parse user profile
+
+        :param dict userProfile: user profile in OAuht2 format
+
+        :return: S_OK()/S_ERROR()
+    """
+    resDict = {}
+    gname = userProfile.get('given_name')
+    fname = userProfile.get('family_name')
+    pname = userProfile.get('preferred_username')
+    name = userProfile.get('name') and userProfile['name'].split(' ')
+    resDict['username'] = pname or gname and fname and gname[0] + fname
+    resDict['username'] = resDict['username'] or name and len(name) > 1 and name[0][0] + name[1] or ''
+    resDict['username'] = re.sub('[^A-Za-z0-9]+', '', resDict['username'].lower())[:13]
+    self.log.debug('Parse user name:', resDict['username'])
+
+    # Collect user info
+    resDict['UsrOptns'] = {}
+    resDict['UsrOptns']['DNs'] = {}
+    resDict['UsrOptns']['ID'] = userProfile.get('sub')
+    if not resDict['UsrOptns']['ID']:
+      return S_ERROR('No ID of user found.')
+    resDict['UsrOptns']['Email'] = userProfile.get('email')
+    resDict['UsrOptns']['FullName'] = gname and fname and ' '.join([gname, fname]) or name and ' '.join(name) or ''
+    self.log.debug('Parse user profile:\n', resDict['UsrOptns'])
+
+    # Default DIRAC groups
+    resDict['UsrOptns']['Groups'] = self.parameters.get('DiracGroups') or []
+    if not isinstance(resDict['UsrOptns']['Groups'], list):
+      resDict['UsrOptns']['Groups'] = resDict['UsrOptns']['Groups'].replace(' ', '').split(',')
+    self.log.debug('Default for groups:', ', '.join(resDict['UsrOptns']['Groups']))
+    self.log.debug('Response Information:', pprint.pformat(userProfile))
+
+    # Read regex syntax to get DNs describe dictionary
+    dictItemRegex, listItemRegex = {}, None
+    try:
+      dnClaim = self.parameters['Syntax']['DNs']['claim']
+      for k, v in self.parameters['Syntax']['DNs'].items():
+        if isinstance(v, dict) and v.get('item'):
+          dictItemRegex[k] = v['item']
+        elif k == 'item':
+          listItemRegex = v
+    except Exception as e:
+      if not resDict['UsrOptns']['Groups']:
+        self.log.warn('No "DiracGroups", no claim with DNs decsribe in Syntax/DNs section found.')
+      return S_OK(resDict)
+
+    if not userProfile.get(dnClaim) and not resDict['UsrOptns']['Groups']:
+      self.log.warn('No "DiracGroups", no claim "%s" that decsribe DNs found.' % dnClaim)
+    else:
+
+      if not isinstance(userProfile[dnClaim], list):
+        userProfile[dnClaim] = userProfile[dnClaim].split(',')
+
+      for item in userProfile[dnClaim]:
+        dnInfo = {}
+        if isinstance(item, dict):
+          for subClaim, reg in dictItemRegex.items():
+            result = re.compile(reg).match(item[subClaim])
+            if result:
+              for k, v in result.groupdict().items():
+                dnInfo[k] = v
+        elif listItemRegex:
+          result = re.compile(listItemRegex).match(item)
+          if result:
+            for k, v in result.groupdict().items():
+              dnInfo[k] = v
+
+        if dnInfo.get('DN'):
+          if not dnInfo['DN'].startswith('/'):
+            items = dnInfo['DN'].split(',')
+            items.reverse()
+            dnInfo['DN'] = '/' + '/'.join(items)
+          if dnInfo.get('PROVIDER'):
+            result = getProviderByAlias(dnInfo['PROVIDER'], instance='Proxy')
+            dnInfo['PROVIDER'] = result['Value'] if result['OK'] else 'Certificate'
+          resDict['UsrOptns']['DNs'][dnInfo['DN']] = dnInfo
+
+    return S_OK(resDict)
+
+  def getUserProfile(self, session):
+    """ Get user information from identity provider
+
+        :param str,dict session: session number or dictionary
+
+        :return: S_OK(dict)/S_ERROR() -- dictionary contain user profile information
+    """
+    tokens = session
+    if isinstance(session, str):
+      result = self.sessionManager.getSessionTokens(session)
+      if not result['OK']:
+        return result
+      tokens = result['Value']
+    result = self.oauth2.getUserProfile(tokens['AccessToken'])
+    if not result['OK']:
+      result = self.__fetchTokens(tokens)
+      if result['OK']:
+        tokens = result['Value']
+        result = self.oauth2.getUserProfile(result['Value']['AccessToken'])
+    if not result['OK']:
+      kill = self.sessionManager.killSession(session)
+      return result if kill['OK'] else kill
+    userProfile = result['Value']
+    result = self.sessionManager.updateSession(session, tokens)
+    if not result['OK']:
+      return result
+    return self.__parseUserProfile(userProfile)
+
+  def logOut(self, session):
+    """ Revoke tokens
+
+        :param str session: session number
+
+        :return: S_OK()/S_ERROR()
+    """
+    result = self.sessionManager.getSessionTokens(session)
+    if not result['OK']:
+      return result
+    tokens = result['Value']
+    return self.oauth2.revokeToken(tokens['AccessToken'], tokens['RefreshToken'])
diff --git a/Resources/ProxyProvider/DIRACCAProxyProvider.py b/Resources/ProxyProvider/DIRACCAProxyProvider.py
index a5270a877a2..e3d36abbe2c 100644
--- a/Resources/ProxyProvider/DIRACCAProxyProvider.py
+++ b/Resources/ProxyProvider/DIRACCAProxyProvider.py
@@ -103,11 +103,11 @@ def setParameters(self, parameters):
     if 'Algoritm' in parameters:
       self.algoritm = parameters['Algoritm']
     if 'Match' in parameters:
-      self.match = [self.fields2nid[f] for f in parameters['Match']]
+      self.match = [self.fields2nid[f] for f in parameters['Match']] if parameters['Match'][0] else []
     if 'Supplied' in parameters:
-      self.supplied = [self.fields2nid[f] for f in parameters['Supplied']]
+      self.supplied = [self.fields2nid[f] for f in parameters['Supplied']] if parameters['Supplied'][0] else []
     if 'Optional' in parameters:
-      self.optional = [self.fields2nid[f] for f in parameters['Optional']]
+      self.optional = [self.fields2nid[f] for f in parameters['Optional']] if parameters['Optional'][0] else []
     allFields = self.optional + self.supplied + self.match
     if 'DNOrder' in parameters:
       self.dnList = []
@@ -206,7 +206,7 @@ def getProxy(self, userDN):
 
         :param str userDN: user DN
 
-        :return: S_OK(str)/S_ERROR() -- contain a proxy string
+        :return: S_OK(object)/S_ERROR() -- contain a X509Chain() object
     """
     self.__X509Name = X509.X509_Name()
     result = self.checkStatus(userDN)
@@ -221,8 +221,15 @@ def getProxy(self, userDN):
           result = chain.loadKeyFromString(keyStr)
           if result['OK']:
             result = chain.generateProxyToString(365 * 24 * 3600, rfc=True)
+            if result['OK']:
+              chain = X509Chain()
+              result = chain.loadProxyFromString(result['Value'])
+              if result['OK']:
 
-    return result
+                # Store proxy in proxy manager
+                result = self.proxyManager._storeProxy(userDN, chain)
+
+    return S_OK(chain) if result['OK'] else result
 
   def generateDN(self, **kwargs):
     """ Get DN of the user certificate that will be created
diff --git a/Resources/ProxyProvider/OAuth2ProxyProvider.py b/Resources/ProxyProvider/OAuth2ProxyProvider.py
new file mode 100644
index 00000000000..e231fb642c5
--- /dev/null
+++ b/Resources/ProxyProvider/OAuth2ProxyProvider.py
@@ -0,0 +1,189 @@
+""" ProxyProvider implementation for the proxy generation using OIDC flow
+"""
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import print_function
+
+import pprint
+import datetime
+
+from DIRAC import S_OK, S_ERROR
+from DIRAC.Core.Security.X509Chain import X509Chain  # pylint: disable=import-error
+from DIRAC.ConfigurationSystem.Client.Helpers import Registry
+from DIRAC.ConfigurationSystem.Client.Helpers.Resources import getProvidersForInstance
+from DIRAC.ConfigurationSystem.Client.Utilities import getAuthAPI
+from DIRAC.Resources.ProxyProvider.ProxyProvider import ProxyProvider
+
+from DIRAC.FrameworkSystem.Utilities.OAuth2 import OAuth2
+from DIRAC.FrameworkSystem.Client.AuthManagerClient import gSessionManager
+from DIRAC.FrameworkSystem.Client.AuthManagerData import gAuthManagerData
+
+__RCSID__ = "$Id$"
+
+
+class OAuth2ProxyProvider(ProxyProvider):
+
+  def __init__(self, parameters=None):
+    super(OAuth2ProxyProvider, self).__init__(parameters)
+
+  def setParameters(self, parameters):
+    self.parameters = parameters
+    self.idProviders = self.parameters['IdProvider'] or []
+    if not isinstance(self.parameters['IdProvider'], list):
+      self.idProviders = [self.parameters['IdProvider']]
+    if not self.idProviders:
+      result = getProvidersForInstance('Id', providerType='OAuth2')
+      if not result['OK']:
+        return result
+      self.idProviders = result['Value']
+    self.oauth2 = None
+
+  def checkStatus(self, userDN):
+    """ Read ready to work status of proxy provider
+
+        :param str userDN: user DN
+
+        :return: S_OK(dict)/S_ERROR() -- dictionary contain fields:
+                 - 'Status' with ready to work status[ready, needToAuth]
+                 - 'AccessTokens' with list of access token
+    """
+    result = self.__findReadySessions(userDN)
+    if not result['OK']:
+      self.log.error(result['Message'])
+      return result
+    sessions = result['Value']
+    if not sessions:
+      idP = self.idProviders[0]
+      return S_OK({'Status': 'needToAuth', 'Comment': 'Need to auth with %s identity provider' % idP,
+                   'Action': ['auth', [idP, 'inThread', '%s/auth/%s' % (getAuthAPI().strip('/'), idP)]]})
+
+    # Proxy uploaded in DB?
+    result = self.proxyManager._isProxyExist(userDN, 12 * 3600)
+    if not result['OK']:
+      self.log.error(result['Message'])
+      return result
+    if not result['Value']:
+      # Proxy not uploaded in DB, lets generate and upload
+      result = self.getProxy(userDN, sessions=sessions)
+      if not result['OK']:
+        self.log.error(result['Message'])
+        return result
+
+    return S_OK({'Status': 'ready'})
+
+  def __findReadySessions(self, userDN):
+    """ Read ready to work status of proxy provider
+
+        :param str userDN: user DN
+
+        :return: S_OK(dict)/S_ERROR() -- dictionary contain fields:
+                 - 'Status' with ready to work status[ready, needToAuth]
+                 - 'AccessTokens' with list of access token
+    """
+    result = Registry.getUsernameForDN(userDN)
+    if not result['OK']:
+      return result
+    userName = result['Value']
+    return gSessionManager.getReservedSessions(Registry.getIDsForUsername(userName), self.idProviders, True)
+
+  def getProxy(self, userDN, sessions=None):
+    """ Generate user proxy with OIDC flow authentication
+
+        :param str userDN: user DN
+        :param list sessions: sessions
+
+        :return: S_OK/S_ERROR, Value is a proxy string
+    """
+    if not sessions:
+      result = self.__findReadySessions(userDN)
+      if not result['OK']:
+        return result
+      sessions = result['Value']
+    if not sessions:
+      return S_ERROR('No sessions found for proxy request.')
+
+    for session in sessions:
+      result = gAuthManagerData.getIdPForSession(session)
+      if not result['OK']:
+        return result
+
+      self.oauth2 = OAuth2(result['Value'])
+
+      self.log.verbose('For proxy request use session:', session)
+
+      # Get proxy request
+      result = self.__getProxyRequest(session)
+      if not result['OK']:
+        self.log.error(result['Message'])
+        result = gSessionManager.refreshSession(session)
+        if not result['OK']:
+          self.log.error(result['Message'])
+          continue
+
+        # Try to get proxy request again
+        result = self.__getProxyRequest(session)
+        if not result['OK']:
+          self.log.error(result['Message'])
+          result = gSessionManager.logOutSession(session)
+          if not result['OK']:
+            self.log.error(result['Message'])
+          continue
+        if not result['Value']:
+          result = S_ERROR('Returned proxy is empty.')
+          continue
+
+      self.log.info('Proxy is taken')
+      break
+
+    if not result['OK']:
+      return result
+    proxyStr = result['Value'].encode("utf-8")
+
+    # Get DN
+    chain = X509Chain()
+    result = chain.loadProxyFromString(proxyStr)
+    if not result['OK']:
+      return result
+    result = chain.getCredentials()
+    if not result['OK']:
+      return result
+    DN = result['Value']['identity']
+
+    # Check
+    if DN != userDN:
+      return S_ERROR('Received proxy DN "%s" not match with requested DN "%s"' % (DN, userDN))
+
+    # Store proxy in proxy manager
+    result = self.proxyManager._storeProxy(DN, chain)
+    if not result['OK']:
+      return result
+
+    return S_OK(chain)  # {'proxy': proxyStr, 'DN': DN})
+
+  def __getProxyRequest(self, session):
+    """ Get user proxy from proxy provider
+
+        :param str session: access token
+
+        :return: S_OK(basestring)/S_ERROR()
+    """
+    # Get tokens
+    result = gSessionManager.getSessionTokens(session)
+    if not result['OK']:
+      return result
+    tokens = result['Value']
+
+    kwargs = {'access_token': tokens['AccessToken']}
+    kwargs['access_type'] = 'offline'
+    kwargs['proxylifetime'] = self.parameters['MaxProxyLifetime'] or 3600 * 24
+
+    # Get proxy request
+    self.log.verbose('Send proxy request to %s' % self.parameters['GetProxyEndpoint'])
+    kwargs['client_id'] = self.oauth2.get('client_id')
+    kwargs['client_secret'] = self.oauth2.get('client_secret')
+    try:
+      r = self.oauth2.request('GET', self.parameters['GetProxyEndpoint'], params=kwargs, headers={})
+      r.raise_for_status()
+      return S_OK(r.text)
+    except self.oauth2.exceptions.RequestException as e:
+      return S_ERROR("%s: %s" % (e.message, r.text))
diff --git a/Resources/ProxyProvider/PUSPProxyProvider.py b/Resources/ProxyProvider/PUSPProxyProvider.py
index 84320aa4620..50d84e3430c 100644
--- a/Resources/ProxyProvider/PUSPProxyProvider.py
+++ b/Resources/ProxyProvider/PUSPProxyProvider.py
@@ -68,4 +68,7 @@ def getProxy(self, userDN):
     if credDict['identity'] != userDN:
       return S_ERROR('Requested DN does not match the obtained one in the PUSP proxy')
 
-    return chain.generateProxyToString(lifeTime=credDict['secondsLeft'])
+    # Store proxy in proxy manager
+    result = self.proxyManager._storeProxy(userDN, chain)
+
+    return S_OK(chain) if result['OK'] else result
diff --git a/Resources/ProxyProvider/ProxyProvider.py b/Resources/ProxyProvider/ProxyProvider.py
index 00fec638241..b7e19359270 100644
--- a/Resources/ProxyProvider/ProxyProvider.py
+++ b/Resources/ProxyProvider/ProxyProvider.py
@@ -4,22 +4,48 @@
 from __future__ import division
 from __future__ import print_function
 from DIRAC import S_OK, S_ERROR
+from DIRAC import S_OK, S_ERROR, gLogger
 
 __RCSID__ = "$Id$"
 
 
 class ProxyProvider(object):
 
-  def __init__(self, parameters=None):
+  def __init__(self, parameters=None, proxyManager=None):
+    """ C'or
 
+        :param dict parameters: parameters of the Proxy Provider
+        :param object proxyManager: proxy manager
+    """
+    self.log = gLogger.getSubLogger(self.__class__.__name__)
     self.parameters = parameters
-    self.name = None
-    if parameters:
-      self.name = parameters.get('ProviderName')
 
   def setParameters(self, parameters):
+    """ Set parameters
+
+        :param dict parameters: parameters of the proxy Provider
+    """
     self.parameters = parameters
-    self.name = parameters.get('ProviderName')
+
+  def setManager(self, proxyManager):
+    """ Set proxy manager
+
+        :param object proxyManager: proxy manager
+    """
+    self.proxyManager = proxyManager
+
+  def isProxyManagerAble(self):
+    """ Check if proxy manager able
+
+        :return: S_OK()/S_ERROR()
+    """
+    if not self.proxyManager:
+      try:
+        from DIRAC.FrameworkSystem.Client.ProxyManagerClient import ProxyManagerClient
+        self.proxyManager = ProxyManagerClient()
+      except Exception as e:
+        return S_ERROR('Proxy manager not able: %s' % e)
+    return S_OK()
 
   def checkStatus(self, userDN):
     """ Read ready to work status of proxy provider
@@ -37,4 +63,4 @@ def generateDN(self, **kwargs):
 
         :return: S_OK(str)/S_ERROR() -- contain DN
     """
-    return S_ERROR("Not implemented in %s", self.name)
+    return S_ERROR("Not implemented in %s", self.parameters.get('ProviderName'))
diff --git a/Resources/ProxyProvider/ProxyProviderFactory.py b/Resources/ProxyProvider/ProxyProviderFactory.py
index 63b9dda6339..37417bc4685 100644
--- a/Resources/ProxyProvider/ProxyProviderFactory.py
+++ b/Resources/ProxyProvider/ProxyProviderFactory.py
@@ -9,9 +9,10 @@
 from __future__ import absolute_import
 from __future__ import division
 from __future__ import print_function
+
 from DIRAC import S_OK, S_ERROR, gLogger
 from DIRAC.Core.Utilities import ObjectLoader
-from DIRAC.ConfigurationSystem.Client.Helpers.Resources import getInfoAboutProviders
+from DIRAC.ConfigurationSystem.Client.Helpers.Resources import getProviderInfo
 
 __RCSID__ = "$Id$"
 
@@ -25,17 +26,18 @@ def __init__(self):
     self.log = gLogger.getSubLogger(__name__)
 
   #############################################################################
-  def getProxyProvider(self, proxyProvider):
+  def getProxyProvider(self, proxyProvider, proxyManager=None):
     """ This method returns a ProxyProvider instance corresponding to the supplied
         name.
 
         :param str proxyProvider: the name of the Proxy Provider
+        :param object proxyManager: proxy manager
 
         :return: S_OK(ProxyProvider)/S_ERROR()
     """
     if not proxyProvider:
       return S_ERROR('Provider name not set.')
-    result = getInfoAboutProviders(of='Proxy', providerName=proxyProvider, option='all', section='all')
+    result = getProviderInfo(proxyProvider)
     if not result['OK']:
       return result
     ppDict = result['Value']
@@ -56,6 +58,7 @@ def getProxyProvider(self, proxyProvider):
     try:
       pProvider = ppClass()
       pProvider.setParameters(ppDict)
+      pProvider.setManager(proxyManager)
     except BaseException as x:
       msg = 'ProxyProviderFactory could not instantiate %s object: %s' % (subClassName, str(x))
       self.log.exception()
diff --git a/Resources/ProxyProvider/test/Test_DIRACCAProxyProvider.py b/Resources/ProxyProvider/test/Test_DIRACCAProxyProvider.py
index 0fa3428d5ad..88b676f22ad 100644
--- a/Resources/ProxyProvider/test/Test_DIRACCAProxyProvider.py
+++ b/Resources/ProxyProvider/test/Test_DIRACCAProxyProvider.py
@@ -13,7 +13,7 @@
 import unittest
 import tempfile
 
-from DIRAC import gLogger
+from DIRAC import gLogger, S_OK
 from DIRAC.Core.Security.X509Chain import X509Chain  # pylint: disable=import-error
 from DIRAC.Resources.ProxyProvider.DIRACCAProxyProvider import DIRACCAProxyProvider
 
@@ -40,6 +40,14 @@
                'ProviderName': 'DIRAC_CA_CFG'}
 
 
+class proxyManager(object):
+  """ Fake proxyManager
+  """
+  def _storeProxy(self, userDN, chain):
+    """ Fake store method
+    """
+    return S_OK()
+
 class DIRACCAProviderTestCase(unittest.TestCase):
 
   @classmethod
@@ -84,22 +92,22 @@ def tearDownClass(cls):
 
 
 class testDIRACCAProvider(DIRACCAProviderTestCase):
+  """ Base class for the testDIRACCAProvider test cases
+  """
 
   def test_getProxy(self):
     """ Test 'getProxy' - try to get proxies for different users and check it
     """
-    def check(proxyStr, proxyProvider, name):
+    def check(chain, proxyProvider, name):
       """ Check proxy
 
-          :param str proxyStr: proxy as string
+          :param object chain: proxy as string
           :param str proxyProvider: proxy provider name
           :param str name: proxy name
       """
       proxyFile = os.path.join(testCAPath, proxyProvider + name.replace(' ', '') + '.pem')
       gLogger.info('Check proxy..')
-      chain = X509Chain()
-      result = chain.loadProxyFromString(proxyStr)
-      self.assertTrue(result['OK'], '\n' + result.get('Message', 'Error message is absent.'))
+
       for result in [chain.getRemainingSecs(),
                      chain.getIssuerCert(),
                      chain.getPKeyObj(),
@@ -118,8 +126,8 @@ def check(proxyStr, proxyProvider, name):
                                (diracCAConf, 'read configuration file')]:
       gLogger.info('\n* Try proxy provider that %s..' % log)
       ca = DIRACCAProxyProvider()
-      result = ca.setParameters(proxyProvider)
-      self.assertTrue(result['OK'], '\n' + result.get('Message', 'Error message is absent.'))
+      ca.setParameters(proxyProvider)
+      ca.setManager(proxyManager())
 
       gLogger.info('* Get proxy using FullName and Email of user..')
       for name, email, res in [('MrUser', 'good@mail.com', True),
diff --git a/Resources/ProxyProvider/test/Test_ProxyProviderFactory.py b/Resources/ProxyProvider/test/Test_ProxyProviderFactory.py
index a8cfe4f224f..2c3a56d9e16 100644
--- a/Resources/ProxyProvider/test/Test_ProxyProviderFactory.py
+++ b/Resources/ProxyProvider/test/Test_ProxyProviderFactory.py
@@ -1,6 +1,7 @@
 from __future__ import absolute_import
 from __future__ import division
 from __future__ import print_function
+
 __RCSID__ = "$Id$"
 
 import os
@@ -14,24 +15,33 @@
 certsPath = os.path.join(rootPath, 'DIRAC/Core/Security/test/certs')
 
 
-def sf_getInfoAboutProviders(of, providerName, option, section):
-  if of == 'Proxy' and option == 'all' and section == 'all':
-    if providerName == 'MY_DIRACCA':
-      return S_OK({'ProviderType': 'DIRACCA',
-                   'CertFile': os.path.join(certsPath, 'ca/ca.cert.pem'),
-                   'KeyFile': os.path.join(certsPath, 'ca/ca.key.pem'),
-                   'Supplied': ['O', 'OU', 'CN'],
-                   'Optional': ['emailAddress'],
-                   'DNOrder': ['O', 'OU', 'CN', 'emailAddress'],
-                   'OU': 'CA',
-                   'C': 'DN',
-                   'O': 'DIRACCA'})
-    if providerName == 'MY_PUSP':
-      return S_OK({'ProviderType': 'PUSP', 'ServiceURL': 'https://somedomain'})
+class proxyManager(object):
+  """ Fake proxyManager
+  """
+  def _storeProxy(self, userDN, chain):
+    """ Fake store method
+    """
+    return S_OK()
+
+
+def sf_getProviderInfo(providerName):
+  if providerName == 'MY_DIRACCA':
+    return S_OK({'ProviderType': 'DIRACCA',
+                 'CertFile': os.path.join(certsPath, 'ca/ca.cert.pem'),
+                 'KeyFile': os.path.join(certsPath, 'ca/ca.key.pem'),
+                 'Supplied': ['O', 'OU', 'CN'],
+                 'Optional': ['emailAddress'],
+                 'DNOrder': ['O', 'OU', 'CN', 'emailAddress'],
+                 'OU': 'CA',
+                 'C': 'DN',
+                 'O': 'DIRACCA'})
+  if providerName == 'MY_PUSP':
+    return S_OK({'ProviderType': 'PUSP', 'ServiceURL': 'https://somedomain'})
   return S_ERROR('No proxy provider found')
 
-@mock.patch('DIRAC.Resources.ProxyProvider.ProxyProviderFactory.getInfoAboutProviders',
-            new=sf_getInfoAboutProviders)
+
+@mock.patch('DIRAC.Resources.ProxyProvider.ProxyProviderFactory.getProviderInfo',
+            new=sf_getProviderInfo)
 class ProxyProviderFactoryTest(unittest.TestCase):
   """ Base class for the ProxyProviderFactory test cases
   """
@@ -40,7 +50,7 @@ def test_standalone(self):
     """ Test loading a proxy provider element with everything defined in itself.
     """
     for provider, resultOfGenerateDN in [('MY_DIRACCA', True), ('MY_PUSP', False)]:
-      result = ProxyProviderFactory().getProxyProvider(provider)
+      result = ProxyProviderFactory().getProxyProvider(provider, proxyManager=proxyManager())
       self.assertTrue(result['OK'], '\n' + result.get('Message', 'Error message is absent.'))
       proxyProviderObj = result['Value']
       result = proxyProviderObj.generateDN(FullName='test', Email='email@test.org')
diff --git a/TransformationSystem/Agent/TaskManagerAgentBase.py b/TransformationSystem/Agent/TaskManagerAgentBase.py
index 551f51859fc..6e7cf2530ce 100644
--- a/TransformationSystem/Agent/TaskManagerAgentBase.py
+++ b/TransformationSystem/Agent/TaskManagerAgentBase.py
@@ -25,7 +25,7 @@
 from DIRAC.Core.Utilities.List import breakListIntoChunks
 from DIRAC.Core.Utilities.Dictionaries import breakDictionaryIntoChunks
 from DIRAC.ConfigurationSystem.Client.Helpers.Operations import Operations
-from DIRAC.ConfigurationSystem.Client.Helpers.Registry import getDNForUsername, getUsernameForDN
+from DIRAC.ConfigurationSystem.Client.Helpers.Registry import getDNForUsernameInGroup, getUsernameForDN
 from DIRAC.FrameworkSystem.Client.MonitoringClient import gMonitor
 from DIRAC.TransformationSystem.Client.FileReport import FileReport
 from DIRAC.TransformationSystem.Client.TaskManager import WorkflowTasks
@@ -664,7 +664,10 @@ def __getCredentials(self):
     owner = resCred['Value']['User']
     ownerGroup = resCred['Value']['Group']
     # returns  a list
-    ownerDN = getDNForUsername(owner)['Value'][0]
+    result = getDNForUsernameInGroup(owner, ownerGroup)
+    if not result['OK']:
+      return result
+    ownerDN = result['Value']
     self.credTuple = (owner, ownerGroup, ownerDN)
     self.log.info("Cred: Tasks will be submitted with the credentials %s:%s" % (owner, ownerGroup))
     return S_OK()
diff --git a/TransformationSystem/Client/TaskManager.py b/TransformationSystem/Client/TaskManager.py
index f7bdc22d557..c00d12d92ee 100644
--- a/TransformationSystem/Client/TaskManager.py
+++ b/TransformationSystem/Client/TaskManager.py
@@ -31,7 +31,7 @@
 from DIRAC.WorkloadManagementSystem.Client.JobMonitoringClient import JobMonitoringClient
 from DIRAC.TransformationSystem.Client.TransformationClient import TransformationClient
 from DIRAC.ConfigurationSystem.Client.Helpers.Operations import Operations
-from DIRAC.ConfigurationSystem.Client.Helpers.Registry import getDNForUsername
+from DIRAC.ConfigurationSystem.Client.Helpers.Registry import getDNForUsernameInGroup
 from DIRAC.TransformationSystem.Agent.TransformationAgentsUtilities import TransformationAgentsUtilities
 
 COMPONENT_NAME = 'TaskManager'
@@ -161,10 +161,10 @@ def prepareTransformationTasks(self, transBody, taskDict, owner='', ownerGroup='
       ownerGroup = proxyInfo['group']
 
     if not ownerDN:
-      res = getDNForUsername(owner)
-      if not res['OK']:
-        return res
-      ownerDN = res['Value'][0]
+      result = getDNForUsernameInGroup(owner, ownerGroup)
+      if not result['OK']:
+        return result
+      ownerDN = result['Value']
 
     try:
       transJson = json.loads(transBody)
@@ -502,10 +502,10 @@ def prepareTransformationTasks(self, transBody, taskDict, owner='', ownerGroup='
       ownerGroup = proxyInfo['group']
 
     if not ownerDN:
-      res = getDNForUsername(owner)
-      if not res['OK']:
-        return res
-      ownerDN = res['Value'][0]
+      result = getDNForUsernameInGroup(owner, ownerGroup)
+      if not result['OK']:
+        return result
+      ownerDN = result['Value']
 
     if bulkSubmissionFlag:
       return self.__prepareTasksBulk(transBody, taskDict, owner, ownerGroup, ownerDN)
diff --git a/WorkloadManagementSystem/Agent/JobAgent.py b/WorkloadManagementSystem/Agent/JobAgent.py
index ee1d7bb3298..c20596db1d3 100755
--- a/WorkloadManagementSystem/Agent/JobAgent.py
+++ b/WorkloadManagementSystem/Agent/JobAgent.py
@@ -266,6 +266,7 @@ def execute(self):
     jobJDL = matcherInfo['JDL']
     jobGroup = matcherInfo['Group']
     ownerDN = matcherInfo['DN']
+    owner = matcherInfo['User']
 
     optimizerParams = {}
     for key in matcherInfo:
@@ -323,7 +324,7 @@ def execute(self):
           jobReport.setJobParameter(thisp, gConfig.getValue('/LocalSite/%s' % thisp, 'Unknown'), sendFlag=False)
 
       jobReport.setJobStatus('Matched', 'Job Received by Agent')
-      result = self._setupProxy(ownerDN, jobGroup)
+      result = self._setupProxy(owner, jobGroup)
       if not result['OK']:
         return self._rescheduleFailedJob(jobID, result['Message'], self.stopOnApplicationFailure)
       proxyChain = result.get('Value')
@@ -396,12 +397,12 @@ def _getCPUTimeLeft(self):
     return timeleft
 
   #############################################################################
-  def _setupProxy(self, ownerDN, ownerGroup):
+  def _setupProxy(self, owner, ownerGroup):
     """
     Retrieve a proxy for the execution of the job
     """
     if gConfig.getValue('/DIRAC/Security/UseServerCertificate', False):
-      proxyResult = self._requestProxyFromProxyManager(ownerDN, ownerGroup)
+      proxyResult = self._requestProxyFromProxyManager(owner, ownerGroup)
       if not proxyResult['OK']:
         self.log.error('Failed to setup proxy', proxyResult['Message'])
         return S_ERROR('Failed to setup proxy: %s' % proxyResult['Message'])
@@ -421,7 +422,7 @@ def _setupProxy(self, ownerDN, ownerGroup):
 
       groupProps = ret['Value']['groupProperties']
       if Properties.GENERIC_PILOT in groupProps or Properties.PILOT in groupProps:
-        proxyResult = self._requestProxyFromProxyManager(ownerDN, ownerGroup)
+        proxyResult = self._requestProxyFromProxyManager(owner, ownerGroup)
         if not proxyResult['OK']:
           self.log.error('Invalid Proxy', proxyResult['Message'])
           return S_ERROR('Failed to setup proxy: %s' % proxyResult['Message'])
@@ -430,18 +431,18 @@ def _setupProxy(self, ownerDN, ownerGroup):
     return S_OK(proxyChain)
 
   #############################################################################
-  def _requestProxyFromProxyManager(self, ownerDN, ownerGroup):
+  def _requestProxyFromProxyManager(self, owner, ownerGroup):
     """Retrieves user proxy with correct role for job and sets up environment to
        run job locally.
     """
 
-    self.log.info("Requesting proxy', 'for %s@%s" % (ownerDN, ownerGroup))
+    self.log.info("Requesting proxy', 'for %s@%s" % (owner, ownerGroup))
     token = gConfig.getValue("/Security/ProxyToken", "")
     if not token:
       self.log.info("No token defined. Trying to download proxy without token")
       token = False
-    retVal = gProxyManager.getPayloadProxyFromDIRACGroup(ownerDN, ownerGroup,
-                                                         self.defaultProxyLength, token)
+    retVal = gProxyManager.downloadCorrectProxy(owner, ownerGroup, self.defaultProxyLength,
+                                                token=token)
     if not retVal['OK']:
       self.log.error('Could not retrieve payload proxy', retVal['Message'])
       os.system('dirac-proxy-info')
diff --git a/WorkloadManagementSystem/Agent/MultiProcessorSiteDirector.py b/WorkloadManagementSystem/Agent/MultiProcessorSiteDirector.py
index 8dd77cf6718..63817fa9a87 100644
--- a/WorkloadManagementSystem/Agent/MultiProcessorSiteDirector.py
+++ b/WorkloadManagementSystem/Agent/MultiProcessorSiteDirector.py
@@ -303,8 +303,9 @@ def submitPilots(self):
 
         # Get the working proxy
         cpuTime = queueCPUTime + 86400
-        self.log.verbose("Getting pilot proxy for %s/%s %d long" % (self.pilotDN, self.pilotGroup, cpuTime))
-        result = gProxyManager.getPilotProxyFromDIRACGroup(self.pilotDN, self.pilotGroup, cpuTime)
+        self.log.verbose("Getting pilot proxy for",
+                         "%s@%s (%s) %d long" % (self.pilotUser, self.pilotGroup, self.pilotDN, cpuTime))
+        result = gProxyManager.downloadCorrectProxy(self.pilotUser, self.pilotGroup, cpuTime)
         if not result['OK']:
           return result
         self.proxy = result['Value']
diff --git a/WorkloadManagementSystem/Agent/SiteDirector.py b/WorkloadManagementSystem/Agent/SiteDirector.py
index 70cb755d834..e69f41dad52 100644
--- a/WorkloadManagementSystem/Agent/SiteDirector.py
+++ b/WorkloadManagementSystem/Agent/SiteDirector.py
@@ -109,6 +109,7 @@ def __init__(self, *args, **kwargs):
     # self.voGroups contain all the eligible user groups for pilots submitted by this SiteDirector
     self.voGroups = []
     self.pilotDN = ''
+    self.pilotUser = ''
     self.pilotGroup = ''
     self.platforms = []
     self.sites = []
@@ -198,11 +199,15 @@ def beginExecution(self):
     # Which credentials to use?
     # are they specific to the SD? (if not, get the generic ones)
     self.pilotDN = self.am_getOption("PilotDN", self.pilotDN)
+    self.pilotUser = self.am_getOption("PilotUser", self.pilotUser)
     self.pilotGroup = self.am_getOption("PilotGroup", self.pilotGroup)
-    result = findGenericPilotCredentials(vo=self.vo, pilotDN=self.pilotDN, pilotGroup=self.pilotGroup)
+    result = findGenericPilotCredentials(vo=self.vo,
+                                         pilotUser=self.pilotUser,
+                                         pilotDN=self.pilotDN,
+                                         pilotGroup=self.pilotGroup)
     if not result['OK']:
       return result
-    self.pilotDN, self.pilotGroup = result['Value']
+    self.pilotUser, self.pilotGroup, self.pilotDN = result['Value']
 
     # Parameters
     self.defaultSubmitPools = getSubmitPools(self.group, self.vo)
@@ -250,6 +255,7 @@ def beginExecution(self):
     self.log.always('CETypes:', ceTypes)
     self.log.always('CEs:', ces)
     self.log.always('PilotDN:', self.pilotDN)
+    self.log.always('PilotUser:', self.pilotUser)
     self.log.always('PilotGroup:', self.pilotGroup)
 
     result = self.resourcesModule.getQueues(community=self.vo,
@@ -561,9 +567,9 @@ def submitPilots(self):
 
       # Get the working proxy
       cpuTime = queueCPUTime + 86400
-      self.log.verbose("Getting pilot proxy",
-                       "for %s/%s %d long" % (self.pilotDN, self.pilotGroup, cpuTime))
-      result = gProxyManager.getPilotProxyFromDIRACGroup(self.pilotDN, self.pilotGroup, cpuTime)
+      self.log.verbose("Getting pilot proxy for",
+                       "%s@%s (%s) %d long" % (self.pilotUser, self.pilotGroup, self.pilotDN, cpuTime))
+      result = gProxyManager.downloadCorrectProxy(self.pilotUser, self.pilotGroup, cpuTime)
       if not result['OK']:
         return result
       proxy = result['Value']
@@ -1039,17 +1045,14 @@ def getExecutable(self, queue, pilotsToSubmit,
                     **kwargs):
     """ Prepare the full executable for queue
 
-    :param queue: queue name
-    :type queue: basestring
-    :param pilotsToSubmit: number of pilots to submit
-    :type pilotsToSubmit: int
-    :param bundleProxy: flag that say if to bundle or not the proxy
-    :type bundleProxy: bool
-    :param queue: pilot execution dir (normally an empty string)
-    :type queue: basestring
+    :param str queue: queue name
+    :param int pilotsToSubmit: number of pilots to submit
+    :param bool proxy: flag that say if to bundle or not the proxy
+    :param str jobExecDir: pilot execution dir (normally an empty string)
+    :param envVariables: env variables
 
     :returns: a string the options for the pilot
-    :rtype: basestring
+    :rtype: str
     """
 
     pilotOptions, pilotsSubmitted = self._getPilotOptions(queue, pilotsToSubmit, **kwargs)
@@ -1109,10 +1112,8 @@ def _getPilotOptions(self, queue, pilotsToSubmit, **kwargs):
     if pilotLogging.lower() in ['true', 'yes', 'y']:
       pilotOptions.append('-z ')
 
-    ownerDN = self.pilotDN
-    ownerGroup = self.pilotGroup
     # Request token for maximum pilot efficiency
-    result = gProxyManager.requestToken(ownerDN, ownerGroup, pilotsToSubmit * self.maxJobsInFillMode)
+    result = gProxyManager.requestToken(self.pilotUser, self.pilotGroup, pilotsToSubmit * self.maxJobsInFillMode)
     if not result['OK']:
       self.log.error('Invalid proxy token request', result['Message'])
       return [None, None]
@@ -1211,7 +1212,7 @@ def updatePilotStatus(self):
     """
 
     # Generate a proxy before feeding the threads to renew the ones of the CEs to perform actions
-    result = gProxyManager.getPilotProxyFromDIRACGroup(self.pilotDN, self.pilotGroup, 23400)
+    result = gProxyManager.downloadCorrectProxy(self.pilotUser, self.pilotGroup, 23400)
     if not result['OK']:
       return result
     proxy = result['Value']
@@ -1228,7 +1229,7 @@ def updatePilotStatus(self):
       ce = self.queueDict[queue]['CE']
 
       if not ce.isProxyValid(120)['OK']:
-        result = gProxyManager.getPilotProxyFromDIRACGroup(self.pilotDN, self.pilotGroup, 1000)
+        result = gProxyManager.downloadCorrectProxy(self.pilotUser, self.pilotGroup, 1000)
         if not result['OK']:
           return result
         proxy = result['Value']
diff --git a/WorkloadManagementSystem/Agent/test/Test_Agent_JobAgent.py b/WorkloadManagementSystem/Agent/test/Test_Agent_JobAgent.py
index 9d4e946086e..66849f7eab3 100644
--- a/WorkloadManagementSystem/Agent/test/Test_Agent_JobAgent.py
+++ b/WorkloadManagementSystem/Agent/test/Test_Agent_JobAgent.py
@@ -122,18 +122,19 @@ def test__setupProxy(mocker, mockGCReplyInput, mockPMReplyInput, expected):
   mocker.patch("DIRAC.WorkloadManagementSystem.Agent.JobAgent.AgentModule.__init__")
   mocker.patch("DIRAC.WorkloadManagementSystem.Agent.JobAgent.AgentModule", side_effect=mockAM)
   mocker.patch("DIRAC.WorkloadManagementSystem.Agent.JobAgent.gConfig.getValue", side_effect=mockGCReply)
-  module_str = "DIRAC.WorkloadManagementSystem.Agent.JobAgent.gProxyManager.getPayloadProxyFromDIRACGroup"
+  module_str = "DIRAC.WorkloadManagementSystem.Agent.JobAgent.gProxyManager.downloadCorrectProxy"
   mocker.patch(module_str, side_effect=mockPMReply)
 
   jobAgent = JobAgent('Test', 'Test1')
 
+  owner = 'DIRAC'
   ownerDN = 'DIRAC'
   ownerGroup = 'DIRAC'
 
   jobAgent.log = gLogger
   jobAgent.log.setLevel('DEBUG')
 
-  result = jobAgent._setupProxy(ownerDN, ownerGroup)
+  result = jobAgent._setupProxy(owner, ownerGroup)
 
   assert result['OK'] == expected['OK']
 
@@ -181,18 +182,19 @@ def test__requestProxyFromProxyManager(mocker, mockGCReplyInput, mockPMReplyInpu
   mocker.patch("DIRAC.WorkloadManagementSystem.Agent.JobAgent.AgentModule.__init__")
   mocker.patch("DIRAC.WorkloadManagementSystem.Agent.JobAgent.AgentModule", side_effect=mockAM)
   mocker.patch("DIRAC.WorkloadManagementSystem.Agent.JobAgent.gConfig.getValue", side_effect=mockGCReply)
-  module_str = "DIRAC.WorkloadManagementSystem.Agent.JobAgent.gProxyManager.getPayloadProxyFromDIRACGroup"
+  module_str = "DIRAC.WorkloadManagementSystem.Agent.JobAgent.gProxyManager.downloadCorrectProxy"
   mocker.patch(module_str, side_effect=mockPMReply)
 
   jobAgent = JobAgent('Test', 'Test1')
 
+  owner = 'DIRAC'
   ownerDN = 'DIRAC'
   ownerGroup = 'DIRAC'
 
   jobAgent.log = gLogger
   jobAgent.log.setLevel('DEBUG')
 
-  result = jobAgent._requestProxyFromProxyManager(ownerDN, ownerGroup)
+  result = jobAgent._requestProxyFromProxyManager(owner, ownerGroup)
 
   assert result['OK'] == expected['OK']
 
diff --git a/WorkloadManagementSystem/Client/Matcher.py b/WorkloadManagementSystem/Client/Matcher.py
index f915fbaf4e5..e11e22aa688 100644
--- a/WorkloadManagementSystem/Client/Matcher.py
+++ b/WorkloadManagementSystem/Client/Matcher.py
@@ -126,7 +126,7 @@ def selectJob(self, resourceDescription, credDict):
     if resOpt['OK']:
       for key, value in resOpt['Value'].items():
         resultDict[key] = value
-    resAtt = self.jobDB.getJobAttributes(jobID, ['OwnerDN', 'OwnerGroup'])
+    resAtt = self.jobDB.getJobAttributes(jobID, ['Owner', 'OwnerDN', 'OwnerGroup'])
     if not resAtt['OK']:
       raise RuntimeError('Could not retrieve job attributes')
     if not resAtt['Value']:
@@ -141,6 +141,7 @@ def selectJob(self, resourceDescription, credDict):
     self._updatePilotJobMapping(resourceDict, jobID)
 
     resultDict['DN'] = resAtt['Value']['OwnerDN']
+    resultDict['User'] = resAtt['Value']['Owner']
     resultDict['Group'] = resAtt['Value']['OwnerGroup']
     resultDict['PilotInfoReportedFlag'] = True
 
@@ -332,14 +333,13 @@ def _checkCredentials(self, resourceDict, credDict):
         resourceDict['OwnerGroup'] = credDict['group']
         self.log.notice("Setting the resource group to the credentials group")
         if 'OwnerDN' in resourceDict and resourceDict['OwnerDN'] != credDict['DN']:
-          ownerDN = resourceDict['OwnerDN']
-          result = Registry.getGroupsForDN(resourceDict['OwnerDN'])
+          result = Registry.getGroupsForDN(resourceDict['OwnerDN'], groupsList=credDict['group'])
           if not result['OK']:
             raise RuntimeError(result['Message'])
           if credDict['group'] not in result['Value']:
             # DN is not in the same group! bad boy.
             self.log.warn("You cannot request jobs from this DN, as it does not belong to your group!",
-                          "(%s)" % ownerDN)
+                          "(%s)" % resourceDict['OwnerDN'])
             resourceDict['OwnerDN'] = credDict['DN']
       # Nothing special, group and DN have to be the same
       else:
diff --git a/WorkloadManagementSystem/ConfigTemplate.cfg b/WorkloadManagementSystem/ConfigTemplate.cfg
index 6d874d4ef09..8cf72da8b45 100644
--- a/WorkloadManagementSystem/ConfigTemplate.cfg
+++ b/WorkloadManagementSystem/ConfigTemplate.cfg
@@ -187,6 +187,8 @@ Agents
     GridEnv =
     # the DN of the certificate proxy used to submit pilots. If not found here, what is in Operations/Pilot section of the CS will be used
     PilotDN =
+    # the user of the certificate proxy used to submit pilots. If not found here, what is in Operations/Pilot section of the CS will be used
+    PilotUser =
     # the group of the certificate proxy used to submit pilots. If not found here, what is in Operations/Pilot section of the CS will be used
     PilotGroup =
 
diff --git a/WorkloadManagementSystem/DB/PilotAgentsDB.py b/WorkloadManagementSystem/DB/PilotAgentsDB.py
index c8249618d69..c8d3eb81ea6 100755
--- a/WorkloadManagementSystem/DB/PilotAgentsDB.py
+++ b/WorkloadManagementSystem/DB/PilotAgentsDB.py
@@ -29,7 +29,7 @@
 from DIRAC.Core.Base.DB import DB
 import DIRAC.Core.Utilities.Time as Time
 from DIRAC.ConfigurationSystem.Client.Helpers.Resources import getCESiteMapping
-from DIRAC.ConfigurationSystem.Client.Helpers.Registry import getUsernameForDN, getDNForUsername
+from DIRAC.ConfigurationSystem.Client.Helpers.Registry import getUsernameForDN, getDNsForUsername
 from DIRAC.ResourceStatusSystem.Client.SiteStatus import SiteStatus
 
 
@@ -316,6 +316,10 @@ def getPilotInfo(self, pilotRef=False, parentId=False, conn=False, paramNames=[]
         pilotDict[parameters[i]] = row[i]
         if parameters[i] == 'PilotID':
           pilotIDs.append(row[i])
+      result = getUsernameForDN(pilotDict['OwnerDN'])
+      if not result['OK']:
+        return result
+      pilotDict['Owner'] = result['Value']
       resDict[row[0]] = pilotDict
 
     result = self.getJobsForPilot(pilotIDs)
@@ -975,8 +979,10 @@ def getPilotMonitorWeb(self, selectDict, sortList, startItem, maxItems):
         userList = [userList]
       dnList = []
       for uName in userList:
-        uList = getDNForUsername(uName)['Value']
-        dnList += uList
+        result = getDNsForUsername(uName)
+        if not result['OK']:
+          return result
+        dnList += result['Value']
       selectDict['OwnerDN'] = dnList
       del selectDict['Owner']
     startDate = selectDict.get('FromDate', None)
diff --git a/WorkloadManagementSystem/Service/JobManagerHandler.py b/WorkloadManagementSystem/Service/JobManagerHandler.py
index bea8c2b701b..617016faea0 100755
--- a/WorkloadManagementSystem/Service/JobManagerHandler.py
+++ b/WorkloadManagementSystem/Service/JobManagerHandler.py
@@ -98,7 +98,7 @@ def initialize(self):
     self.peerUsesLimitedProxy = credDict['isLimitedProxy']
     self.diracSetup = self.serviceInfoDict['clientSetup']
     self.maxParametricJobs = self.srv_getCSOption('MaxParametricJobs', MAX_PARAMETRIC_JOBS)
-    self.jobPolicy = JobPolicy(self.ownerDN, self.ownerGroup, self.userProperties)
+    self.jobPolicy = JobPolicy(self.owner, self.ownerGroup, self.userProperties)
     self.jobPolicy.jobDB = gJobDB
     return S_OK()
 
@@ -206,11 +206,6 @@ def export_submitJob(self, jobDesc):
 
       jobIDList.append(jobID)
 
-    # Set persistency flag
-    retVal = gProxyManager.getUserPersistence(self.ownerDN, self.ownerGroup)
-    if 'Value' not in retVal or not retVal['Value']:
-      gProxyManager.setPersistency(self.ownerDN, self.ownerGroup, True)
-
     if parametricJob:
       result = S_OK(jobIDList)
     else:
@@ -283,7 +278,7 @@ def __checkIfProxyUploadIsRequired(self):
 
         :return: bool
     """
-    result = gProxyManager.userHasProxy(self.ownerDN, self.ownerGroup, validSeconds=18000)
+    result = gProxyManager.userHasProxy(self.owner, self.ownerGroup, validSeconds=18000)
     if not result['OK']:
       self.log.error("Can't check if the user has proxy uploaded", result['Message'])
       return True
diff --git a/WorkloadManagementSystem/Service/JobMonitoringHandler.py b/WorkloadManagementSystem/Service/JobMonitoringHandler.py
index d22468d13e7..aad20cb2acf 100755
--- a/WorkloadManagementSystem/Service/JobMonitoringHandler.py
+++ b/WorkloadManagementSystem/Service/JobMonitoringHandler.py
@@ -57,11 +57,11 @@ def initialize(self):
     """
 
     credDict = self.getRemoteCredentials()
-    self.ownerDN = credDict['DN']
+    self.owner = credDict['username']
     self.ownerGroup = credDict['group']
     operations = Operations(group=self.ownerGroup)
     self.globalJobsInfo = operations.getValue('/Services/JobMonitoring/GlobalJobsInfo', True)
-    self.jobPolicy = JobPolicy(self.ownerDN, self.ownerGroup, self.globalJobsInfo)
+    self.jobPolicy = JobPolicy(self.owner, self.ownerGroup, self.globalJobsInfo)
     self.jobPolicy.jobDB = gJobDB
 
     useESForJobParametersFlag = operations.getValue('/Services/JobMonitoring/useESForJobParametersFlag', False)
diff --git a/WorkloadManagementSystem/Service/JobPolicy.py b/WorkloadManagementSystem/Service/JobPolicy.py
index d85d2d64e05..f7901a5af44 100755
--- a/WorkloadManagementSystem/Service/JobPolicy.py
+++ b/WorkloadManagementSystem/Service/JobPolicy.py
@@ -9,20 +9,19 @@
 
 from DIRAC import S_OK, S_ERROR
 from DIRAC.Core.Security import Properties
-from DIRAC.ConfigurationSystem.Client.Helpers.Registry import getUsernameForDN, getGroupsForUser, \
-    getPropertiesForGroup, getUsersInGroup
+from DIRAC.ConfigurationSystem.Client.Helpers.Registry import getGroupsForUser, getPropertiesForGroup, getUsersInGroup
 
+RIGHT_KILL = 'Kill'
+RIGHT_RESET = 'Reset'
+RIGHT_DELETE = 'Delete'
+RIGHT_SUBMIT = 'Submit'
 RIGHT_GET_JOB = 'GetJob'
 RIGHT_GET_INFO = 'GetInfo'
+RIGHT_GET_STATS = 'GetStats'
+RIGHT_RESCHEDULE = 'Reschedule'
 RIGHT_GET_SANDBOX = 'GetSandbox'
 RIGHT_PUT_SANDBOX = 'PutSandbox'
 RIGHT_CHANGE_STATUS = 'ChangeStatus'
-RIGHT_DELETE = 'Delete'
-RIGHT_KILL = 'Kill'
-RIGHT_SUBMIT = 'Submit'
-RIGHT_RESCHEDULE = 'Reschedule'
-RIGHT_GET_STATS = 'GetStats'
-RIGHT_RESET = 'Reset'
 
 ALL_RIGHTS = [RIGHT_GET_JOB, RIGHT_GET_INFO, RIGHT_GET_SANDBOX, RIGHT_PUT_SANDBOX,
               RIGHT_CHANGE_STATUS, RIGHT_DELETE, RIGHT_KILL, RIGHT_SUBMIT,
@@ -48,33 +47,38 @@
 
 class JobPolicy(object):
 
-  def __init__(self, userDN, userGroup, allInfo=True):
+  def __init__(self, username, userGroup, allInfo=True):
+    """ C'tor
 
-    self.userDN = userDN
-    self.userName = ''
-    result = getUsernameForDN(userDN)
-    if result['OK']:
-      self.userName = result['Value']
-    self.userGroup = userGroup
-    self.userProperties = getPropertiesForGroup(userGroup, [])
+        :param str username: user name
+        :param str userGroup: group name
+        :param bool allInfo: all information
+    """
     self.jobDB = None
     self.allInfo = allInfo
+    self.userName = username
+    self.userGroup = userGroup
+    self.userProperties = getPropertiesForGroup(userGroup, [])
     self.__permissions = {}
     self.__getUserJobPolicy()
 
   def getUserRightsForJob(self, jobID, owner=None, group=None):
-    """ Get access rights to job with jobID for the user specified by
-        userDN/userGroup
+    """ Get access rights to job with jobID for the user specified by username/userGroup
+
+        :param str jobID: job ID
+        :param str owner: user name
+        :param str group: group name
+
+        :return: S_OK()/S_ERROR()
     """
     if owner is None or group is None:
       result = self.jobDB.getJobAttributes(jobID, ['Owner', 'OwnerGroup'])
       if not result['OK']:
         return result
-      elif result['Value']:
-        owner = result['Value']['OwnerDN']
-        group = result['Value']['OwnerGroup']
-      else:
+      if not result['Value']:
         return S_ERROR('Job not found')
+      owner = result['Value']['OwnerDN']
+      group = result['Value']['OwnerGroup']
 
     result = self.getJobPolicy(owner, group)
     return result
@@ -111,10 +115,15 @@ def __getUserJobPolicy(self):
       for right in PROPERTY_RIGHTS[Properties.GENERIC_PILOT]:
         self.__permissions[right] = True
 
-  def getJobPolicy(self, jobOwner='', jobOwnerGroup=''):
-    """ Get the job operations rights for a job owned by jobOwnerDN/jobOwnerGroup
-        for a user with userDN/userGroup.
+  def getJobPolicy(self, jobOwner=None, jobOwnerGroup=None):
+    """ Get the job operations rights for a job owned by jobOwner/jobOwnerGroup
+        for a user with username/userGroup.
         Returns a dictionary of various operations rights
+
+        :param str jobOwner: user name
+        :param str jobOwnerGroup: group name
+
+        :return: S_OK(dict)/S_ERROR()
     """
     permDict = dict(self.__permissions)
     # Job Owner can do everything with his jobs
@@ -131,7 +140,12 @@ def getJobPolicy(self, jobOwner='', jobOwnerGroup=''):
     return S_OK(permDict)
 
   def evaluateJobRights(self, jobList, right):
-    """ Get access rights to jobID for the user ownerDN/ownerGroup
+    """ Get access rights to jobID for the user owner/ownerGroup
+
+        :param list jobList: job list
+        :param str right: right
+
+        :return: tuple -- contain valid, invalid, nonauth, owner jobs
     """
     validJobList = []
     invalidJobList = []
@@ -172,6 +186,10 @@ def evaluateJobRights(self, jobList, right):
 
   def getControlledUsers(self, right):
     """ Get users and groups which jobs are subject to the given access right
+
+        :param str right: right
+
+        :return: S_OK()/S_ERROR()
     """
 
     userGroupList = 'ALL'
diff --git a/WorkloadManagementSystem/Service/PilotManagerHandler.py b/WorkloadManagementSystem/Service/PilotManagerHandler.py
index 1b9f5ebcf17..10d89089502 100644
--- a/WorkloadManagementSystem/Service/PilotManagerHandler.py
+++ b/WorkloadManagementSystem/Service/PilotManagerHandler.py
@@ -146,15 +146,11 @@ def export_getPilotLoggingInfo(cls, pilotReference):
       return S_ERROR('Failed to determine owner for pilot ' + pilotReference)
 
     pilotDict = result['Value'][pilotReference]
-    owner = pilotDict['OwnerDN']
-    group = pilotDict['OwnerGroup']
-    gridType = pilotDict['GridType']
-    pilotStamp = pilotDict['PilotStamp']
 
     # Add the pilotStamp to the pilot Reference, some CEs may need it to retrieve the logging info
-    pilotReference = pilotReference + ':::' + pilotStamp
-    return getPilotLoggingInfo(gridType, pilotReference,  # pylint: disable=unexpected-keyword-arg
-                               proxyUserDN=owner, proxyUserGroup=group)
+    pilotReference = pilotReference + ':::' + pilotDict['PilotStamp']
+    return getPilotLoggingInfo(pilotDict['GridType'], pilotReference,  # pylint: disable=unexpected-keyword-arg
+                               proxyUserName=pilotDict['Owner'], proxyUserGroup=pilotDict['OwnerGroup'])
 
   ##############################################################################
   types_getPilotSummary = []
@@ -255,7 +251,7 @@ def export_killPilot(cls, pilotRefList):
         return S_ERROR('Failed to get info for pilot ' + pilotReference)
 
       pilotDict = result['Value'][pilotReference]
-      owner = pilotDict['OwnerDN']
+      owner = pilotDict['Owner']
       group = pilotDict['OwnerGroup']
       queue = '@@@'.join([owner, group, pilotDict['GridSite'], pilotDict['DestinationSite'], pilotDict['Queue']])
       gridType = pilotDict['GridType']
diff --git a/WorkloadManagementSystem/Service/WMSUtilities.py b/WorkloadManagementSystem/Service/WMSUtilities.py
index 69a28739342..2ed0935cff3 100644
--- a/WorkloadManagementSystem/Service/WMSUtilities.py
+++ b/WorkloadManagementSystem/Service/WMSUtilities.py
@@ -14,7 +14,7 @@
 from DIRAC.Core.Utilities.Grid import executeGridCommand
 from DIRAC.Core.Utilities.Proxy import executeWithUserProxy
 from DIRAC.ConfigurationSystem.Client.Helpers.Resources import getQueue
-from DIRAC.ConfigurationSystem.Client.Helpers.Registry import getGroupOption
+from DIRAC.ConfigurationSystem.Client.Helpers.Registry import getVOMSAttributeForGroup
 from DIRAC.FrameworkSystem.Client.ProxyManagerClient import gProxyManager
 from DIRAC.Resources.Computing.ComputingElementFactory import ComputingElementFactory
 from DIRAC.WorkloadManagementSystem.Client.ServerUtils import pilotAgentsDB
@@ -88,7 +88,8 @@ def getGridJobOutput(pilotReference):
     return S_ERROR('Pilot info is empty')
 
   pilotDict = result['Value'][pilotReference]
-  owner = pilotDict['OwnerDN']
+  owner = pilotDict['Owner']
+  ownerDN = pilotDict['OwnerDN']
   group = pilotDict['OwnerGroup']
 
   # FIXME: What if the OutputSandBox is not StdOut and StdErr, what do we do with other files?
@@ -100,7 +101,8 @@ def getGridJobOutput(pilotReference):
       resultDict = {}
       resultDict['StdOut'] = stdout
       resultDict['StdErr'] = error
-      resultDict['OwnerDN'] = owner
+      resultDict['Owner'] = owner
+      resultDict['OwnerDN'] = ownerDN
       resultDict['OwnerGroup'] = group
       resultDict['FileList'] = []
       return S_OK(resultDict)
@@ -122,11 +124,13 @@ def getGridJobOutput(pilotReference):
     shutil.rmtree(queueDict['WorkingDirectory'])
     return result
   ce = result['Value']
-  groupVOMS = getGroupOption(group, 'VOMSRole', group)
-  result = gProxyManager.getPilotProxyFromVOMSGroup(owner, groupVOMS)
+  if not getVOMSAttributeForGroup(group):
+    gLogger.error("No voms attribute assigned to group %s when requested pilot proxy." % group)
+    return S_ERROR("Failed to get the pilot's owner proxy")
+  result = gProxyManager.downloadVOMSProxy(owner, group)
   if not result['OK']:
     gLogger.error('Could not get proxy:',
-                  'User "%s" Group "%s" : %s' % (owner, groupVOMS, result['Message']))
+                  'User "%s" Group "%s" : %s' % (owner, group, result['Message']))
     return S_ERROR("Failed to get the pilot's owner proxy")
   proxy = result['Value']
   ce.setProxy(proxy)
@@ -147,7 +151,8 @@ def getGridJobOutput(pilotReference):
   resultDict = {}
   resultDict['StdOut'] = stdout
   resultDict['StdErr'] = error
-  resultDict['OwnerDN'] = owner
+  resultDict['Owner'] = owner
+  resultDict['OwnerDN'] = ownerDN
   resultDict['OwnerGroup'] = group
   resultDict['FileList'] = []
   shutil.rmtree(queueDict['WorkingDirectory'])
@@ -177,8 +182,10 @@ def killPilotsInQueues(pilotRefDict):
 
     # FIXME: quite hacky. Should be either removed, or based on some flag
     if gridType in ["LCG", "CREAM", "ARC", "Globus", "HTCondorCE"]:
-      group = getGroupOption(group, 'VOMSRole', group)
-      ret = gProxyManager.getPilotProxyFromVOMSGroup(owner, group)
+      if not getVOMSAttributeForGroup(group):
+        gLogger.error("No voms attribute assigned to group %s when requested pilot proxy." % group)
+        return S_ERROR("Failed to get the pilot's owner proxy")
+      ret = gProxyManager.downloadVOMSProxy(owner, group)
       if not ret['OK']:
         gLogger.error('Could not get proxy:',
                       'User "%s" Group "%s" : %s' % (owner, group, ret['Message']))
diff --git a/WorkloadManagementSystem/private/ConfigHelper.py b/WorkloadManagementSystem/private/ConfigHelper.py
index 2c0af95eb07..e8820e3f34a 100644
--- a/WorkloadManagementSystem/private/ConfigHelper.py
+++ b/WorkloadManagementSystem/private/ConfigHelper.py
@@ -11,7 +11,7 @@
 from DIRAC.ConfigurationSystem.Client.Helpers import Registry, Operations
 
 
-def findGenericPilotCredentials(vo=False, group=False, pilotDN='', pilotGroup=''):
+def findGenericPilotCredentials(vo=None, group=None, pilotDN=None, pilotGroup=None, pilotUser=None):
   """ Looks into the Operations/<>/Pilot section of CS to find the pilot credentials.
       Then check if the user has a registered proxy in ProxyManager.
 
@@ -21,33 +21,34 @@ def findGenericPilotCredentials(vo=False, group=False, pilotDN='', pilotGroup=''
       :param str group: group name
       :param str pilotDN: pilot DN
       :param str pilotGroup: pilot group
+      :param str pilotUser: pilot user
 
       :return: S_OK(tuple)/S_ERROR()
   """
   if not group and not vo:
     return S_ERROR("Need a group or a VO to determine the Generic pilot credentials")
+  vo = vo or Registry.getVOForGroup(group)
   if not vo:
-    vo = Registry.getVOForGroup(group)
-    if not vo:
-      return S_ERROR("Group %s does not have a VO associated" % group)
+    return S_ERROR("Group %s does not have a VO associated" % group)
   opsHelper = Operations.Operations(vo=vo)
+  pilotDN = pilotDN or opsHelper.getValue("Pilot/GenericPilotDN", "")
+  pilotUser = pilotUser or opsHelper.getValue("Pilot/GenericPilotUser", "")
+  pilotGroup = pilotGroup or opsHelper.getValue("Pilot/GenericPilotGroup", "")
   if not pilotGroup:
-    pilotGroup = opsHelper.getValue("Pilot/GenericPilotGroup", "")
-  if not pilotDN:
-    pilotDN = opsHelper.getValue("Pilot/GenericPilotDN", "")
-  if not pilotDN:
-    pilotUser = opsHelper.getValue("Pilot/GenericPilotUser", "")
-    if pilotUser:
-      result = Registry.getDNForUsername(pilotUser)
-      if result['OK']:
-        pilotDN = result['Value'][0]
-  if pilotDN and pilotGroup:
-    gLogger.verbose("Pilot credentials: %s@%s" % (pilotDN, pilotGroup))
-    result = gProxyManager.userHasProxy(pilotDN, pilotGroup, 86400)
+    return S_ERROR("%s does not have group" % pilotDN or pilotUser)
+  if pilotUser and not pilotDN:
+    result = Registry.getDNForUsernameInGroup(pilotUser, pilotGroup)
     if not result['OK']:
-      return S_ERROR("%s@%s has no proxy in ProxyManager")
-    return S_OK((pilotDN, pilotGroup))
-
-  if pilotDN:
-    return S_ERROR("DN %s does not have group %s" % (pilotDN, pilotGroup))
-  return S_ERROR("No generic proxy in the Proxy Manager with groups %s" % pilotGroup)
+      return result
+    pilotDN = result['Value']
+  if pilotDN and not pilotUser:
+    result = Registry.getUsernameForDN(pilotDN)
+    if not result['OK']:
+      return result
+    pilotUser = result['Value']
+
+  gLogger.verbose("Pilot credentials: %s@%s (%s)" % (pilotUser, pilotGroup, pilotDN))
+  result = gProxyManager.userHasProxy(pilotUser, pilotGroup, 86400)
+  if not result['OK']:
+    return S_ERROR("%s@%s has no proxy in ProxyManager" % (pilotUser, pilotGroup))
+  return S_OK((pilotUser, pilotGroup, pilotDN))
diff --git a/WorkloadManagementSystem/private/correctors/BaseHistoryCorrector.py b/WorkloadManagementSystem/private/correctors/BaseHistoryCorrector.py
index 55ed786d6ef..470609cfe29 100644
--- a/WorkloadManagementSystem/private/correctors/BaseHistoryCorrector.py
+++ b/WorkloadManagementSystem/private/correctors/BaseHistoryCorrector.py
@@ -10,7 +10,7 @@
 import time as nativetime
 
 from DIRAC import S_OK, S_ERROR, gLogger
-from DIRAC.ConfigurationSystem.Client.Helpers.Registry import getDNForUsername
+from DIRAC.ConfigurationSystem.Client.Helpers.Registry import getDNsForUsername
 from DIRAC.WorkloadManagementSystem.private.correctors.BaseCorrector import BaseCorrector
 
 
@@ -100,7 +100,7 @@ def _getUsageHistoryForTimeSpan(self, timeSpan, groupToUse=""):
     if groupToUse:
       mappedData = {}
       for userName in data:
-        result = getDNForUsername(userName)
+        result = getDNsForUsername(userName)
         if not result['OK']:
           self.log.error("User does not have any DN assigned", "%s :%s" % (userName, result['Message']))
           continue
diff --git a/docs/source/AdministratorGuide/Configuration/ConfReference/Systems/Framework/Services/ProxyManager/index.rst b/docs/source/AdministratorGuide/Configuration/ConfReference/Systems/Framework/Services/ProxyManager/index.rst
index 1097894f621..21819607dfc 100644
--- a/docs/source/AdministratorGuide/Configuration/ConfReference/Systems/Framework/Services/ProxyManager/index.rst
+++ b/docs/source/AdministratorGuide/Configuration/ConfReference/Systems/Framework/Services/ProxyManager/index.rst
@@ -4,8 +4,10 @@ Systems / Framework / <INSTANCE> / Service / ProxyManager - Sub-subsection
 
 ProxyManager is the implementation of the ProxyManagement service in the DISET framework. Using MyProxy server is not fully supported at the moment.
 
-+-----------------+------------------------------------------+----------------------------+
-| **Name**        | **Description**                          | **Example**                |
-+-----------------+------------------------------------------+----------------------------+
-| *UseMyProxy*    | Use myproxy server                       | UseMyProxy = False         |
-+-----------------+------------------------------------------+----------------------------+
++--------------------------------+------------------------------------------+----------------------------------+
+| **Name**                       | **Description**                          | **Example**                      |
++--------------------------------+------------------------------------------+----------------------------------+
+| *UseMyProxy*                   | Use myproxy server                       | UseMyProxy = False               |
++--------------------------------+------------------------------------------+----------------------------------+
+| *downloadablePersonalProxy*    | Allow download personal proxy            | downloadablePersonalProxy = True |
++--------------------------------+------------------------------------------+----------------------------------+
diff --git a/docs/source/DeveloperGuide/WebAppDIRAC/DevelopWebApp/index.rst b/docs/source/DeveloperGuide/WebAppDIRAC/DevelopWebApp/index.rst
index 857de729bf1..4bb8307cc1a 100644
--- a/docs/source/DeveloperGuide/WebAppDIRAC/DevelopWebApp/index.rst
+++ b/docs/source/DeveloperGuide/WebAppDIRAC/DevelopWebApp/index.rst
@@ -53,7 +53,7 @@ This file defines a Python class responsible for all server side functionality o
 extends **WebHandler** class which is the base class for all server side applications handling clients requests. 
 The starting definition of this class is as follows::
    
-   from WebAppDIRAC.Lib.WebHandler import WebHandler
+   from DIRAC.Core.Web.WebHandler import WebHandler
 
    class MyAppHandler(WebHandler):
    
@@ -63,7 +63,7 @@ Therefore the name of the class is **MyAppHandler** and the name of the method w
 This means that if you want a method to be accessible in the application class you have to put the prefix **web_** 
 to the name of the method.::
 
-   from WebAppDIRAC.Lib.WebHandler import WebHandler
+   from DIRAC.Core.Web.WebHandler import WebHandler
 
    class MyAppHandler(WebHandler):
       def web_getData(self):
@@ -176,7 +176,7 @@ by the server is shown in the textarea.
      The code::
 
 
-      from WebAppDIRAC.Lib.WebHandler import WebHandler
+      from DIRAC.Core.Web.WebHandler import WebHandler
       from DIRAC.Core.DISET.RPCClient import RPCClient
       import random
       
diff --git a/tests/Integration/Framework/Test_ProxyDB.py b/tests/Integration/Framework/Test_ProxyDB.py
index d2047b90b87..6bcb67edc0a 100644
--- a/tests/Integration/Framework/Test_ProxyDB.py
+++ b/tests/Integration/Framework/Test_ProxyDB.py
@@ -51,6 +51,14 @@
 }
 """ % (os.path.join(certsPath, 'ca/ca.cert.pem'), os.path.join(certsPath, 'ca/ca.key.pem'))
 
+usersDNs = {'user_ca': '/C=DN/O=DIRACCA/OU=None/CN=user_ca/emailAddress=user_ca@diracgrid.org',
+            'user': '/C=CC/O=DN/O=DIRAC/CN=user',
+            'no_user': '/C=CC/O=DN/O=DIRAC/CN=no_user',
+            'user_1': '/C=CC/O=DN/O=DIRAC/CN=user_1',
+            'user_2': '/C=CC/O=DN/O=DIRAC/CN=user_2',
+            'user_3': '/C=CC/O=DN/O=DIRAC/CN=user_3',
+            'user_4': '/C=CC/O=DN/O=DIRAC/CN=user_4'}
+
 userCFG = """
 Registry
 {
@@ -116,6 +124,7 @@
     {
       Users = user_ca, user, user_1, user_2, user_3
       VO = vo_1
+      VOMSRole = role_1
     }
     group_2
     {
@@ -309,12 +318,12 @@ def setUp(self):
     gLogger.debug('\n')
     if self.failed:
        self.fail(self.failed)
-    db._update('DELETE FROM ProxyDB_Proxies WHERE UserName IN ("user_ca", "user", "user_1", "user_2", "user_3")')
-    db._update('DELETE FROM ProxyDB_CleanProxies WHERE UserName IN ("user_ca", "user", "user_1", "user_2", "user_3")')
+    db._update('DELETE FROM ProxyDB_Proxies WHERE UserName IN ("%s")' % '", "'.join(usersDNs.keys()))
+    db._update('DELETE FROM ProxyDB_CleanProxies WHERE UserDN IN ("%s")' % '", "'.join(usersDNs.values()))
 
   def tearDown(self):
-    db._update('DELETE FROM ProxyDB_Proxies WHERE UserName IN ("user_ca", "user", "user_1", "user_2", "user_3")')
-    db._update('DELETE FROM ProxyDB_CleanProxies WHERE UserName IN ("user_ca", "user", "user_1", "user_2", "user_3")')
+    db._update('DELETE FROM ProxyDB_Proxies WHERE UserName IN ("%s")' % '", "'.join(usersDNs.keys()))
+    db._update('DELETE FROM ProxyDB_CleanProxies WHERE UserDN IN ("%s")' % '", "'.join(usersDNs.values()))
 
   @classmethod
   def tearDownClass(cls):
@@ -346,16 +355,16 @@ def test_connectDB(self):
   def test_getUsers(self):
     """ Test 'getUsers' - try to get users from DB
     """
-    field = '("%%s", "/C=CC/O=DN/O=DIRAC/CN=%%s", %%s "PEM", TIMESTAMPADD(SECOND, %%s, UTC_TIMESTAMP()))%s' % ''
+    field = '(%%s"/C=CC/O=DN/O=DIRAC/CN=%%s", %%s "PEM", TIMESTAMPADD(SECOND, %%s, UTC_TIMESTAMP()))%s' % ''
     # Fill table for test
     gLogger.info('\n* Fill tables for test..')
     for table, values, fields in [('ProxyDB_Proxies',
-                                  [field % ('user', 'user', '"group_1",', '800'),
-                                   field % ('user_2', 'user_2', '"group_1",', '-1')],
+                                  [field % ('"user", ', 'user', '"group_1",', '800'),
+                                   field % ('"user_2", ', 'user_2', '"group_1",', '-1')],
                                   '(UserName, UserDN, UserGroup, Pem, ExpirationTime)'),
                                   ('ProxyDB_CleanProxies',
-                                  [field % ('user_3', 'user_3', '', '43200')],
-                                  '(UserName, UserDN, Pem, ExpirationTime)')]:
+                                  [field % ('', 'user_3', '', '43200')],
+                                  '(UserDN, Pem, ExpirationTime)')]:
       result = db._update('INSERT INTO %s%s VALUES %s ;' % (table, fields, ', '.join(values)))
       self.assertTrue(result['OK'], '\n' + result.get('Message', 'Error message is absent.'))
     # Testing 'getUsers'
@@ -369,8 +378,8 @@ def test_getUsers(self):
       self.assertTrue(result['OK'], '\n' + result.get('Message', 'Error message is absent.'))
       usersList = []
       for line in result['Value']:
-        if line['Name'] in ['user', 'user_2', 'user_3']:
-          usersList.append(line['Name'])
+        if line['user'] in ['user', 'user_2', 'user_3']:
+          usersList.append(line['user'])
       self.assertEqual(set(expect), set(usersList), str(usersList) + ', when expected ' + str(expect))
 
   def test_purgeExpiredProxies(self):
@@ -394,7 +403,7 @@ def test_getRemoveProxy(self):
     """ Testing get, store proxy
     """
     gLogger.info('\n* Check that DB is clean..')
-    result = db.getProxiesContent({'UserName': ['user_ca', 'user', 'user_1' 'user_2', 'user_3']}, {})
+    result = db.getProxiesContent({'UserName': usersDNs.keys()})
     self.assertTrue(result['OK'], '\n' + result.get('Message', 'Error message is absent.'))
     self.assertTrue(bool(int(result['Value']['TotalRecords']) == 0), 'In DB present proxies.')
 
@@ -406,20 +415,20 @@ def test_getRemoveProxy(self):
     result = db._update(cmd)
     self.assertTrue(result['OK'], '\n' + result.get('Message', 'Error message is absent.'))
     # Try to no correct getProxy requests
-    for dn, group, reqtime, log in [('/C=CC/O=DN/O=DIRAC/CN=user', 'group_1', 9999,
-                                     'No proxy provider, set request time, not valid proxy in ProxyDB_Proxies'),
-                                    ('/C=CC/O=DN/O=DIRAC/CN=user', 'group_1', 0,
-                                     'Not valid proxy in ProxyDB_Proxies'),
-                                    ('/C=CC/O=DN/O=DIRAC/CN=no_user', 'no_valid_group', 0,
-                                     'User not exist, proxy not in DB tables'),
-                                    ('/C=CC/O=DN/O=DIRAC/CN=user', 'no_valid_group', 0,
-                                     'Group not valid, proxy not in DB tables'),
-                                    ('/C=CC/O=DN/O=DIRAC/CN=user', 'group_1', 0,
-                                     'No proxy provider for user, proxy not in DB tables'),
-                                    ('/C=CC/O=DN/O=DIRAC/CN=user_4', 'group_2', 0,
-                                     'Group has option enableToDownload = False in CS')]:
+    for user, group, reqtime, log in [('user', 'group_1', 9999,
+                                       'Not valid proxy, without proxy provider, with less lifetime'),
+                                      ('user', 'group_1', 0,
+                                       'Not valid proxy, without proxy provider, with good lifetime'),
+                                      ('no_user', 'no_valid_group', 0,
+                                       'User not exist, proxy not in DB tables'),
+                                      ('user', 'no_valid_group', 0,
+                                       'Group not valid, proxy not in DB tables'),
+                                      ('user', 'group_1', 0,
+                                       'Proxy removed from DB and not have a proxy provider'),
+                                      ('user_4', 'group_2', 0,
+                                       'Group has option enableToDownload = False in CS')]:
       gLogger.info('== > %s:' % log)
-      result = db.getProxy(dn, group, reqtime)
+      result = db.getProxy(usersDNs[user], group, reqtime)
       self.assertFalse(result['OK'], 'Must be fail.')
       gLogger.info('Msg: %s' % result['Message'])
     # In the last case method found proxy and must to delete it as not valid
@@ -427,51 +436,48 @@ def test_getRemoveProxy(self):
     self.assertTrue(bool(db._query(cmd)['Value'][0][0] == 0), "GetProxy method didn't delete the last proxy.")
 
     gLogger.info('* Check that DB is clean..')
-    result = db.getProxiesContent({'UserName': ['user_ca', 'user', 'user_1', 'user_2', 'user_3']}, {})
+    result = db.getProxiesContent({'UserName': usersDNs.keys()})
     self.assertTrue(result['OK'], '\n' + result.get('Message', 'Error message is absent.'))
     self.assertTrue(bool(int(result['Value']['TotalRecords']) == 0), 'In DB present proxies.')
 
     gLogger.info('* Generate proxy on the fly..')
-    result = db.getProxy('/C=DN/O=DIRACCA/OU=None/CN=user_ca/emailAddress=user_ca@diracgrid.org',
-                         'group_1', 1800)
+    result = db.getProxy(usersDNs['user_ca'], 'group_1', 1800)
     self.assertTrue(result['OK'], '\n' + result.get('Message', 'Error message is absent.'))
 
     gLogger.info('* Check that ProxyDB_CleanProxy contain generated proxy..')
-    result = db.getProxiesContent({'UserName': 'user_ca'}, {})
+    result = db.getProxiesContent({'UserName': 'user_ca'})
     self.assertTrue(result['OK'], '\n' + result.get('Message', 'Error message is absent.'))
     self.assertTrue(bool(int(result['Value']['TotalRecords']) == 1), 'Generated proxy must be one.')
     for table, count in [('ProxyDB_Proxies', 0), ('ProxyDB_CleanProxies', 1)]:
-      cmd = 'SELECT COUNT( * ) FROM %s WHERE UserName="user_ca"' % table
+      cmd = 'SELECT COUNT( * ) FROM %s WHERE UserDN="%s"' % (table, usersDNs['user_ca'])
       self.assertTrue(bool(db._query(cmd)['Value'][0][0] == count),
                       table + ' must ' + (count and 'contain proxy' or 'be empty'))
 
     gLogger.info('* Check that DB is clean..')
-    result = db.deleteProxy('/C=DN/O=DIRACCA/OU=None/CN=user_ca/emailAddress=user_ca@diracgrid.org',
-                            proxyProvider='DIRAC_CA')
+    result = db.deleteProxy(usersDNs['user_ca'])
     self.assertTrue(result['OK'], '\n' + result.get('Message', 'Error message is absent.'))
-    result = db.getProxiesContent({'UserName': ['user_ca', 'user', 'user_1', 'user_2', 'user_3']}, {})
+    result = db.getProxiesContent({'UserName': usersDNs.keys()})
     self.assertTrue(result['OK'], '\n' + result.get('Message', 'Error message is absent.'))
     self.assertTrue(bool(int(result['Value']['TotalRecords']) == 0), 'In DB present proxies.')
 
     gLogger.info('* Upload proxy..')
-    for user, dn, group, vo, time, res, log in [("user", '/C=CC/O=DN/O=DIRAC/CN=user', "group_1", False, 12,
-                                                 True, 'With group extension'),
-                                                ("user", '/C=CC/O=DN/O=DIRAC/CN=user', False, "vo_1", 12,
+    for user, dn, group, vo, time, res, log in [("user", usersDNs['user'], "group_1", False, 12,
+                                                 False, 'With group extension'),
+                                                ("user", usersDNs['user'], False, "vo_1", 12,
                                                  False, 'With voms extension'),
-                                                ("user_1", '/C=CC/O=DN/O=DIRAC/CN=user_1', False, "vo_1", 12,
+                                                ("user_1", usersDNs['user_1'], False, "vo_1", 12,
                                                  False, 'With voms extension'),
-                                                ("user", '/C=CC/O=DN/O=DIRAC/CN=user', False, False, 0,
+                                                ("user", usersDNs['user'], False, False, 0,
                                                  False, 'Expired proxy'),
-                                                ("no_user", '/C=CC/O=DN/O=DIRAC/CN=no_user', False, False, 12,
+                                                ("no_user", usersDNs['no_user'], False, False, 12,
                                                  False, 'Not exist user'),
-                                                ("user", '/C=CC/O=DN/O=DIRAC/CN=user', False, False, 12,
+                                                ("user", usersDNs['user'], False, False, 12,
                                                  True, 'Valid proxy')]:
       for table in ['ProxyDB_Proxies', 'ProxyDB_CleanProxies']:
-        result = db._update('DELETE FROM %s WHERE UserName = "user"' % table)
-        self.assertTrue(result['OK'], '\n' + result.get('Message', 'Error message is absent.'))
-        result = db._update('DELETE FROM %s WHERE UserName = "user_1"' % table)
-        self.assertTrue(result['OK'], '\n' + result.get('Message', 'Error message is absent.'))
-      self.assertTrue(result['OK'], '\n' + result.get('Message', 'Error message is absent.'))
+        for _dn in [usersDNs['user'], usersDNs['user_1']]:
+          result = db._update('DELETE FROM %s WHERE UserDN = "%s"' % (table, dn))
+          self.assertTrue(result['OK'], '\n' + result.get('Message', 'Error message is absent.'))
+
       gLogger.info('== > %s:' % log)
 
       result = self.createProxy(user, group, time, vo=vo)
@@ -482,7 +488,7 @@ def test_getRemoveProxy(self):
       if vo:
         self.assertTrue(bool(chain.isVOMS().get('Value')), 'Cannot create proxy with VOMS extension')
 
-      result = db.generateDelegationRequest(chain, dn)
+      result = db.generateDelegationRequest({'x509Chain': chain, 'DN': dn})
       self.assertTrue(result['OK'], '\n' + result.get('Message', 'Error message is absent.'))
       resDict = result['Value']
       result = chain.generateChainFromRequestString(resDict['request'], time * 3500)
@@ -499,24 +505,24 @@ def test_getRemoveProxy(self):
       cmd = 'SELECT COUNT( * ) FROM ProxyDB_Proxies WHERE UserName="%s"' % user
       self.assertTrue(bool(db._query(cmd)['Value'][0][0] == (res and group and 1) or 0),
                       'ProxyDB_Proxies must ' + (res and 'contain proxy' or 'be empty'))
-      cmd = 'SELECT COUNT( * ) FROM ProxyDB_CleanProxies WHERE UserName="%s"' % user
+      cmd = 'SELECT COUNT( * ) FROM ProxyDB_CleanProxies WHERE UserDN="%s"' % usersDNs[user]
       self.assertTrue(bool(db._query(cmd)['Value'][0][0] == (res and not group and 1) or 0),
                       'ProxyDB_CleanProxies must ' + (res and 'contain proxy' or 'be empty'))
 
     gLogger.info('* Check that ProxyDB_CleanProxy contain generated proxy..')
-    result = db.getProxiesContent({'UserName': 'user'}, {})
+    result = db.getProxiesContent({'UserName': 'user'})
     self.assertTrue(result['OK'], '\n' + result.get('Message', 'Error message is absent.'))
     self.assertTrue(bool(int(result['Value']['TotalRecords']) == 1), 'Generated proxy must be one.')
-    cmd = 'SELECT COUNT( * ) FROM ProxyDB_CleanProxies WHERE UserName="user"'
+    cmd = 'SELECT COUNT( * ) FROM ProxyDB_CleanProxies WHERE UserDN="%s"' % usersDNs[user]
     self.assertTrue(bool(db._query(cmd)['Value'][0][0] == 1), 'ProxyDB_CleanProxies must contain proxy')
 
     gLogger.info('* Get proxy that store only in ProxyDB_CleanProxies..')
     # Try to get proxy that was stored to ProxyDB_CleanProxies in previous step
     for res, group, reqtime, log in [(False, 'group_1', 24 * 3600, 'Request time more that in stored proxy'),
-                                     (False, 'group_2', 0, 'Request group not contain user'),
+                                     (True, 'group_2', 0, 'Request group not contain user(this check on service side)'),
                                      (True, 'group_1', 0, 'Request time less that in stored proxy')]:
       gLogger.info('== > %s:' % log)
-      result = db.getProxy('/C=CC/O=DN/O=DIRAC/CN=user', group, reqtime)
+      result = db.getProxy(usersDNs['user'], group, reqtime)
       text = 'Must be ended %s%s' % (res and 'successful' or 'with error',
                                      ': %s' % result.get('Message', 'Error message is absent.'))
       self.assertEqual(result['OK'], res, text)
@@ -525,14 +531,13 @@ def test_getRemoveProxy(self):
         self.assertTrue(chain.isValidProxy()['OK'], '\n' + result.get('Message', 'Error message is absent.'))
         result = chain.getDIRACGroup()
         self.assertTrue(result['OK'], '\n' + result.get('Message', 'Error message is absent.'))
-        self.assertEqual('group_1', result['Value'], 'Group must be group_1, not ' + result['Value'])
       else:
         gLogger.info('Msg: %s' % (result['Message']))
 
     gLogger.info('* Check that DB is clean..')
-    result = db.deleteProxy('/C=CC/O=DN/O=DIRAC/CN=user', proxyProvider='Certificate')
+    result = db.deleteProxy(usersDNs['user'])
     self.assertTrue(result['OK'], '\n' + result.get('Message', 'Error message is absent.'))
-    result = db.getProxiesContent({'UserName': ['user_ca', 'user', 'user_2', 'user_3']}, {})
+    result = db.getProxiesContent({'UserName': usersDNs.keys()})
     self.assertTrue(result['OK'], '\n' + result.get('Message', 'Error message is absent.'))
     self.assertTrue(bool(int(result['Value']['TotalRecords']) == 0), 'In DB present proxies.')
 
@@ -547,7 +552,7 @@ def test_getRemoveProxy(self):
     result = db._update(cmd)
     self.assertTrue(result['OK'], '\n' + result.get('Message', 'Error message is absent.'))
     # Try to get it
-    result = db.getProxy(dn, group, 1800)
+    result = db.getProxy(usersDNs[user], group, 1800)
     self.assertTrue(result['OK'], '\n' + result.get('Message', 'Error message is absent.'))
     # Check that proxy contain group
     chain = result['Value'][0]
@@ -557,9 +562,9 @@ def test_getRemoveProxy(self):
     self.assertEqual('group_1', result['Value'], 'Group must be group_1, not ' + result['Value'])
 
     gLogger.info('* Check that DB is clean..')
-    result = db.deleteProxy('/C=CC/O=DN/O=DIRAC/CN=user')
+    result = db.deleteProxy(usersDNs['user'])
     self.assertTrue(result['OK'], '\n' + result.get('Message', 'Error message is absent.'))
-    result = db.getProxiesContent({'UserName': ['user_ca', 'user', 'user_1', 'user_2', 'user_3']}, {})
+    result = db.getProxiesContent({'UserName': usersDNs.keys()})
     self.assertTrue(result['OK'], '\n' + result.get('Message', 'Error message is absent.'))
     self.assertTrue(bool(int(result['Value']['TotalRecords']) == 0), 'In DB present proxies.')
 
@@ -580,33 +585,28 @@ def test_getRemoveProxy(self):
       self.assertTrue(result['OK'], '\n' + result.get('Message', 'Error message is absent.'))
 
     # Try to get proxy with VOMS extension
-    for dn, group, role, time, log in [('/C=CC/O=DN/O=DIRAC/CN=user_4', 'group_2', False, 9999,
-                                        'Not exist VO for current group'),
-                                       ('/C=CC/O=DN/O=DIRAC/CN=user', 'group_1', 'role_1', 9999,
-                                        'Stored proxy already have different VOMS extension'),
-                                       ('/C=CC/O=DN/O=DIRAC/CN=user_1', 'group_1', 'role_1', 9999,
-                                        'Stored proxy already have different VOMS extension'),
-                                       ('/C=DN/O=DIRACCA/OU=None/CN=user_ca/emailAddress=user_ca@diracgrid.org',
-                                        'group_1', 'role_1', 9999, 'Not correct VO configuration')]:
-      gLogger.info('== > %s(DN: %s):' % (log, dn))
-      if not any([dn, group, role, time, log]):
-        gLogger.info('voms-proxy-fake command not working as expected, proxy have no VOMS extention, go to the next..')
-        continue
-      result = db.getVOMSProxy(dn, group, time, role)
+    for user, group, time, log in [('user_4', 'group_2', 9999,
+                                    'Not exist VO for current group'),
+                                   ('user', 'group_1', 9999,
+                                    'Stored proxy already have different VOMS extension'),
+                                   ('user_1', 'group_1', 9999,
+                                    'Stored proxy already have different VOMS extension'),
+                                   ('user_ca', 'group_1', 9999, 'Not correct VO configuration')]:
+      gLogger.info('== > %s(DN: %s):' % (log, usersDNs[user]))
+      result = db.getProxy(usersDNs[user], group, time, voms=True)
       self.assertFalse(result['OK'], 'Must be fail.')
       gLogger.info('Msg: %s' % result['Message'])
     # Check stored proxies
     for table, user, count in [('ProxyDB_Proxies', 'user', 1), ('ProxyDB_CleanProxies', 'user_ca', 1)]:
-      cmd = 'SELECT COUNT( * ) FROM %s WHERE UserName="%s"' % (table, user)
+      cmd = 'SELECT COUNT( * ) FROM %s WHERE UserDN="%s"' % (table, usersDNs[user])
       self.assertTrue(bool(db._query(cmd)['Value'][0][0] == count))
 
     gLogger.info('* Delete proxies..')
-    for dn, table in [('/C=CC/O=DN/O=DIRAC/CN=user', 'ProxyDB_Proxies'),
-                      ('/C=DN/O=DIRACCA/OU=None/CN=user_ca/emailAddress=user_ca@diracgrid.org',
-                       'ProxyDB_CleanProxies')]:
-      result = db.deleteProxy(dn)
+    for user, table in [('user', 'ProxyDB_Proxies'),
+                        ('user_ca', 'ProxyDB_CleanProxies')]:
+      result = db.deleteProxy(usersDNs[user])
       self.assertTrue(result['OK'], '\n' + result.get('Message', 'Error message is absent.'))
-      cmd = 'SELECT COUNT( * ) FROM %s WHERE UserName="user_ca"' % table
+      cmd = 'SELECT COUNT( * ) FROM %s WHERE UserDN="%s"' % (table, usersDNs[user])
       self.assertTrue(bool(db._query(cmd)['Value'][0][0] == 0))
 
 
diff --git a/tests/Integration/RequestManagementSystem/FIXME_IntegrationFCT.py b/tests/Integration/RequestManagementSystem/FIXME_IntegrationFCT.py
index fa5d90dc452..36cd4ac3d7a 100644
--- a/tests/Integration/RequestManagementSystem/FIXME_IntegrationFCT.py
+++ b/tests/Integration/RequestManagementSystem/FIXME_IntegrationFCT.py
@@ -35,7 +35,7 @@
 from DIRAC.Core.Utilities.Adler import fileAdler
 from DIRAC.Core.Utilities.File import makeGuid
 from DIRAC.Interfaces.API.DiracAdmin import DiracAdmin
-from DIRAC.ConfigurationSystem.Client.Helpers.Registry import getGroupsForUser, getDNForUsername
+from DIRAC.ConfigurationSystem.Client.Helpers.Registry import getGroupsForUser, getDNForUsernameInGroup
 # # from RMS and DMS
 from DIRAC.RequestManagementSystem.Client.Request import Request
 from DIRAC.RequestManagementSystem.Client.Operation import Operation
@@ -56,9 +56,9 @@ class FullChainTest( object ):
 
   """
 
-  def buildRequest( self, owner, group, sourceSE, targetSE1, targetSE2 ):
+  def buildRequest(self, owner, group, sourceSE, targetSE1, targetSE2):
 
-    files = self.files( owner, group )
+    files = self.files(owner, group)
 
     putAndRegister = Operation()
     putAndRegister.Type = "PutAndRegister"
@@ -71,128 +71,128 @@ def buildRequest( self, owner, group, sourceSE, targetSE1, targetSE2 ):
       putFile.ChecksumType = "adler32"
       putFile.Size = size
       putFile.GUID = guid
-      putAndRegister.addFile( putFile )
+      putAndRegister.addFile(putFile)
 
     replicateAndRegister = Operation()
     replicateAndRegister.Type = "ReplicateAndRegister"
-    replicateAndRegister.TargetSE = "%s,%s" % ( targetSE1, targetSE2 )
+    replicateAndRegister.TargetSE = "%s,%s" % (targetSE1, targetSE2)
     for fname, lfn, size, checksum, guid in files:
       repFile = File()
       repFile.LFN = lfn
       repFile.Size = size
       repFile.Checksum = checksum
       repFile.ChecksumType = "adler32"
-      replicateAndRegister.addFile( repFile )
+      replicateAndRegister.addFile(repFile)
 
     removeReplica = Operation()
     removeReplica.Type = "RemoveReplica"
     removeReplica.TargetSE = sourceSE
     for fname, lfn, size, checksum, guid in files:
-      removeReplica.addFile( File( {"LFN": lfn } ) )
+      removeReplica.addFile(File({"LFN": lfn}))
 
     removeFile = Operation()
     removeFile.Type = "RemoveFile"
     for fname, lfn, size, checksum, guid in files:
-      removeFile.addFile( File( {"LFN": lfn } ) )
+      removeFile.addFile(File({"LFN": lfn}))
 
     removeFileInit = Operation()
     removeFileInit.Type = "RemoveFile"
     for fname, lfn, size, checksum, guid in files:
-      removeFileInit.addFile( File( {"LFN": lfn } ) )
+      removeFileInit.addFile(File({"LFN": lfn}))
 
     req = Request()
-    req.addOperation( removeFileInit )
-    req.addOperation( putAndRegister )
-    req.addOperation( replicateAndRegister )
-    req.addOperation( removeReplica )
-    req.addOperation( removeFile )
+    req.addOperation(removeFileInit)
+    req.addOperation(putAndRegister)
+    req.addOperation(replicateAndRegister)
+    req.addOperation(removeReplica)
+    req.addOperation(removeFile)
     return req
 
-  def files( self, userName, userGroup ):
+  def files(self, userName, userGroup):
     """ get list of files in user domain """
     files = []
-    for i in xrange( 10 ):
+    for i in xrange(10):
       fname = "/tmp/testUserFile-%s" % i
       if userGroup == "dteam_user":
-        lfn = "/lhcb/user/%s/%s/%s" % ( userName[0], userName, fname.split( "/" )[-1] )
+        lfn = "/lhcb/user/%s/%s/%s" % (userName[0], userName, fname.split("/")[-1])
       else:
-        lfn = "/lhcb/certification/test/rmsdms/%s" % fname.split( "/" )[-1]
-      fh = open( fname, "w+" )
-      for i in xrange( 100 ):
-        fh.write( str( random.randint( 0, i ) ) )
+        lfn = "/lhcb/certification/test/rmsdms/%s" % fname.split("/")[-1]
+      fh = open(fname, "w+")
+      for i in xrange(100):
+        fh.write(str(random.randint(0, i)))
       fh.close()
-      size = os.stat( fname ).st_size
-      checksum = fileAdler( fname )
-      guid = makeGuid( fname )
-      files.append( ( fname, lfn, size, checksum, guid ) )
+      size = os.stat(fname).st_size
+      checksum = fileAdler(fname)
+      guid = makeGuid(fname)
+      files.append((fname, lfn, size, checksum, guid))
     return files
 
-  def putRequest( self, userName, userDN, userGroup, sourceSE, targetSE1, targetSE2 ):
+  def putRequest(self, userName, userDN, userGroup, sourceSE, targetSE1, targetSE2):
     """ test case for user """
 
-    req = self.buildRequest( userName, userGroup, sourceSE, targetSE1, targetSE2 )
+    req = self.buildRequest(userName, userGroup, sourceSE, targetSE1, targetSE2)
 
-    req.RequestName = "test%s-%s" % ( userName, userGroup )
+    req.RequestName = "test%s-%s" % (userName, userGroup)
     req.OwnerDN = userDN
     req.OwnerGroup = userGroup
 
-    gLogger.always( "putRequest: request '%s'" % req.RequestName )
+    gLogger.always("putRequest: request '%s'" % req.RequestName)
     for op in req:
-      gLogger.always( "putRequest: => %s %s %s" % ( op.Order, op.Type, op.TargetSE ) )
+      gLogger.always("putRequest: => %s %s %s" % (op.Order, op.Type, op.TargetSE))
       for f in op:
-        gLogger.always( "putRequest: ===> file %s" % f.LFN )
+        gLogger.always("putRequest: ===> file %s" % f.LFN)
 
     reqClient = ReqClient()
 
-    delete = reqClient.deleteRequest( req.RequestName )
+    delete = reqClient.deleteRequest(req.RequestName)
     if not delete["OK"]:
-      gLogger.error( "putRequest: %s" % delete["Message"] )
+      gLogger.error("putRequest: %s" % delete["Message"])
       return delete
-    put = reqClient.putRequest( req )
+    put = reqClient.putRequest(req)
     if not put["OK"]:
-      gLogger.error( "putRequest: %s" % put["Message"] )
+      gLogger.error("putRequest: %s" % put["Message"])
     return put
 
 # # test execution
 if __name__ == "__main__":
 
-  if len( sys.argv ) != 5:
-    gLogger.error( "Usage:\n python %s userGroup SourceSE TargetSE1 TargetSE2\n" )
-    sys.exit( -1 )
+  if len(sys.argv) != 5:
+    gLogger.error("Usage:\n python %s userGroup SourceSE TargetSE1 TargetSE2\n")
+    sys.exit(-1)
   userGroup = sys.argv[1]
   sourceSE = sys.argv[2]
   targetSE1 = sys.argv[3]
   targetSE2 = sys.argv[4]
 
-  gLogger.always( "will use '%s' group" % userGroup )
+  gLogger.always("will use '%s' group" % userGroup)
 
   admin = DiracAdmin()
 
   userName = admin._getCurrentUser()
   if not userName["OK"]:
-    gLogger.error( userName["Message"] )
-    sys.exit( -1 )
+    gLogger.error(userName["Message"])
+    sys.exit(-1)
   userName = userName["Value"]
-  gLogger.always( "current user is '%s'" % userName )
+  gLogger.always("current user is '%s'" % userName)
 
-  userGroups = getGroupsForUser( userName )
+  userGroups = getGroupsForUser(userName)
   if not userGroups["OK"]:
-    gLogger.error( userGroups["Message"] )
-    sys.exit( -1 )
+    gLogger.error(userGroups["Message"])
+    sys.exit(-1)
   userGroups = userGroups["Value"]
 
   if userGroup not in userGroups:
-    gLogger.error( "'%s' is not a member of the '%s' group" % ( userName, userGroup ) )
-    sys.exit( -1 )
+    gLogger.error("'%s' is not a member of the '%s' group" % (userName, userGroup))
+    sys.exit(-1)
 
-  userDN = getDNForUsername( userName )
-  if not userDN["OK"]:
-    gLogger.error( userDN["Message"] )
-    sys.exit( -1 )
-  userDN = userDN["Value"][0]
-  gLogger.always( "userDN is %s" % userDN )
+  result = getDNForUsernameInGroup(userName, userGroup)
+  if not result['OK']:
+    gLogger.error(result['Message'])
+    sys.exit(-1)
+  userDN = result['Value']
+  gLogger.always("userDN is %s" % userDN)
 
   fct = FullChainTest()
-  put = fct.putRequest( userName, userDN, userGroup, sourceSE, targetSE1, targetSE2 )
+  put = fct.putRequest(userName, userDN, userGroup, sourceSE, targetSE1, targetSE2)
 
 
diff --git a/tests/Integration/RequestManagementSystem/Test_Client_Req.py b/tests/Integration/RequestManagementSystem/Test_Client_Req.py
index 4f686ef0e2e..5bf66760aac 100644
--- a/tests/Integration/RequestManagementSystem/Test_Client_Req.py
+++ b/tests/Integration/RequestManagementSystem/Test_Client_Req.py
@@ -89,10 +89,10 @@ def test01fullChain(self):
     # # summary
     ret = self.requestClient.getDBSummary()
     self.assertTrue(ret['OK'])
-    self.assertEqual(ret['Value'],
-                     {'Operation': {'ReplicateAndRegister': {'Waiting': 1}},
-                      'Request': {'Waiting': 1},
-                      'File': {'Waiting': 2}})
+    expectedDict = {'Operation': {'ReplicateAndRegister': {'Waiting': 1}},
+                    'Request': {'Waiting': 1},
+                    'File': {'Waiting': 2}}
+    self.assertTrue(bool(all([ret['Value'][k] == v for k, v in expectedDict.items()])), ret['Value'])
 
     get = self.requestClient.getRequest(reqID)
     self.assertTrue(get['OK'])
@@ -100,10 +100,8 @@ def test01fullChain(self):
     # # summary - the request became "Assigned"
     res = self.requestClient.getDBSummary()
     self.assertTrue(res['OK'])
-    self.assertEqual(res['Value'],
-                     {'Operation': {'ReplicateAndRegister': {'Waiting': 1}},
-                      'Request': {'Assigned': 1},
-                      'File': {'Waiting': 2}})
+    expectedDict['Request'] = {'Assigned': 1}
+    self.assertTrue(bool(all([res['Value'][k] == v for k, v in expectedDict.items()])), res['Value'])
 
     res = self.requestClient.getRequestInfo(reqID)
     self.assertEqual(res['OK'], True, res['Message'] if 'Message' in res else 'OK')
@@ -138,10 +136,10 @@ def test01fullChain(self):
     # # get summary again
     ret = self.requestClient.getDBSummary()
     self.assertTrue(ret['OK'])
-    self.assertEqual(ret['Value'],
-                     {'Operation': {'ReplicateAndRegister': {'Waiting': 2}},
-                      'Request': {'Waiting': 1, 'Assigned': 1},
-                      'File': {'Waiting': 4}})
+    expectedDict = {'Operation': {'ReplicateAndRegister': {'Waiting': 2}},
+                    'Request': {'Waiting': 1, 'Assigned': 1},
+                    'File': {'Waiting': 4}}
+    self.assertTrue(bool(all([ret['Value'][k] == v for k, v in expectedDict.items()])))
 
     delete = self.requestClient.deleteRequest(reqID)
     self.assertEqual(delete['OK'], True, delete['Message'] if 'Message' in delete else 'OK')
@@ -160,12 +158,13 @@ def test02Authorization(self):
 
     request = Request({"RequestName": "unauthorized"})
     request.OwnerDN = 'NotMe'
-    request.OwnerDN = 'AnotherGroup'
+    request.OwnerGroup = 'AnotherGroup'
     op = Operation({"Type": "RemoveReplica", "TargetSE": "CERN-USER"})
     op += File({"LFN": "/lhcb/user/c/cibak/foo"})
     request += op
     res = self.requestClient.putRequest(request)
     credProperties = getProxyInfo()['Value']['groupProperties']
+    print('==> %s' % getProxyInfo()['Value'])
 
     # If the proxy with which we test has delegation, it should work
     if FULL_DELEGATION in credProperties or LIMITED_DELEGATION in credProperties:
diff --git a/tests/Integration/Resources/ProxyProvider/Test_DIRACCAProxyProvider.py b/tests/Integration/Resources/ProxyProvider/Test_DIRACCAProxyProvider.py
index 9245972ce55..26a5ea8360e 100644
--- a/tests/Integration/Resources/ProxyProvider/Test_DIRACCAProxyProvider.py
+++ b/tests/Integration/Resources/ProxyProvider/Test_DIRACCAProxyProvider.py
@@ -12,7 +12,7 @@
 
 from diraccfg import CFG
 
-from DIRAC import gConfig
+from DIRAC import gConfig, S_OK
 from DIRAC.Core.Security.X509Chain import X509Chain  # pylint: disable=import-error
 from DIRAC.Resources.ProxyProvider.ProxyProviderFactory import ProxyProviderFactory
 
@@ -65,6 +65,15 @@
 """
 
 
+class proxyManager(object):
+  """ Fake proxyManager
+  """
+  def _storeProxy(self, userDN, chain):
+    """ Fake store method
+    """
+    return S_OK()
+
+
 class DIRACCAPPTest(unittest.TestCase):
   """ Base class for the Modules test cases
   """
@@ -85,7 +94,7 @@ def setUp(self):
     cfg.loadFromBuffer(userCFG)
     gConfig.loadCFG(cfg)
 
-    result = ProxyProviderFactory().getProxyProvider('DIRAC_TEST_CA')
+    result = ProxyProviderFactory().getProxyProvider('DIRAC_TEST_CA', proxyManager=proxyManager())
     self.assertTrue(result['OK'], '\n%s' % result.get('Message') or 'Error message is absent.')
     self.pp = result['Value']
 
@@ -102,8 +111,7 @@ def test_getProxy(self):
                                      ': %s' % result.get('Message', 'Error message is absent.'))
       self.assertEqual(result['OK'], res, text)
       if res:
-        chain = X509Chain()
-        chain.loadChainFromString(result['Value'])
+        chain = result['Value']
         result = chain.getCredentials()
         self.assertTrue(result['OK'], '\n%s' % result.get('Message') or 'Error message is absent.')
         credDict = result['Value']
@@ -121,8 +129,7 @@ def test_generateProxyDN(self):
     self.assertTrue(result['OK'], '\n%s' % result.get('Message') or 'Error message is absent.')
     result = self.pp.getProxy(result['Value'])
     self.assertTrue(result['OK'], '\n%s' % result.get('Message') or 'Error message is absent.')
-    chain = X509Chain()
-    chain.loadChainFromString(result['Value'])
+    chain = result['Value']
     result = chain.getCredentials()
     self.assertTrue(result['OK'], '\n%s' % result.get('Message') or 'Error message is absent.')
     issuer = result['Value']['issuer']
diff --git a/tests/Integration/WorkloadManagementSystem/Test_PilotsClient.py b/tests/Integration/WorkloadManagementSystem/Test_PilotsClient.py
index a1590370433..e26e49cc02c 100644
--- a/tests/Integration/WorkloadManagementSystem/Test_PilotsClient.py
+++ b/tests/Integration/WorkloadManagementSystem/Test_PilotsClient.py
@@ -25,10 +25,10 @@
 
 
 def test_PilotsDB():
-
+  realDN = '/C=ch/O=DIRAC/OU=DIRAC CI/CN=ciuser/emailAddress=lhcb-dirac-ci@cern.ch'
+  realGroup = 'dirac_user'
   pilots = PilotManagerClient()
-
-  res = pilots.addPilotTQReference(['aPilot'], 1, '/a/ownerDN', 'a/owner/Group')
+  res = pilots.addPilotTQReference(['aPilot'], 1, realDN, realGroup)
   assert res['OK'] is True, res['Message']
   res = pilots.getCurrentPilotCounters({})
   assert res['OK'] is True, res['Message']
@@ -39,17 +39,19 @@ def test_PilotsDB():
   assert res['OK'] is True, res['Message']
   assert res['Value'] == {}, res['Value']
 
-  res = pilots.addPilotTQReference(['anotherPilot'], 1, '/a/ownerDN', 'a/owner/Group')
+  res = pilots.addPilotTQReference(['anotherPilot'], 1, realDN, realGroup)
   assert res['OK'] is True, res['Message']
   res = pilots.storePilotOutput('anotherPilot', 'This is an output', 'this is an error')
   assert res['OK'] is True, res['Message']
   res = pilots.getPilotOutput('anotherPilot')
   assert res['OK'] is True, res['Message']
-  assert res['Value'] == {'OwnerDN': '/a/ownerDN',
-                                     'OwnerGroup': 'a/owner/Group',
-                                     'StdErr': 'this is an error',
-                                     'FileList': [],
-                                     'StdOut': 'This is an output'}
+  # There are new "Owner" key ... Therefore, if the main keys match then all is well
+  expectedDict = {'FileList': [],
+                  'OwnerDN': realDN,
+                  'OwnerGroup': realGroup,
+                  'StdErr': 'this is an error',
+                  'StdOut': 'This is an output'}
+  assert all([res['Value'][k] == v for k, v in expectedDict.items()])
   res = pilots.getPilotInfo('anotherPilot')
   assert res['OK'] is True, res['Message']
   assert res['Value']['anotherPilot']['AccountingSent'] == 'False', res['Value']
@@ -66,12 +68,12 @@ def test_PilotsDB():
   res = pilots.getPilotMonitorSelectors()
   assert res['OK'] is True, res['Message']
   assert res['Value'] == {'GridType': ['DIRAC'],
-                          'OwnerGroup': ['a/owner/Group'],
+                          'OwnerGroup': [realGroup],
                           'DestinationSite': ['NotAssigned'],
                           'Broker': ['Unknown'], 'Status': ['Submitted'],
-                          'OwnerDN': ['/a/ownerDN'],
+                          'OwnerDN': [realDN],
                           'GridSite': ['Unknown'],
-                          'Owner': []}, res['Value']
+                          'Owner': ['adminusername']}, res['Value']
   res = pilots.getPilotSummaryWeb({}, [], 0, 100)
   assert res['OK'] is True, res['Message']
   assert res['Value']['TotalRecords'] == 1, res['Value']