diff --git a/test/login_logout/test/behave/features/login.feature b/test/login_logout/test/behave/features/login.feature
index 9aa52488ef3fe73aaa1a594513d98540bbd4745f..93da3043866eb0cff6066964de101c2ca04c8195 100644
--- a/test/login_logout/test/behave/features/login.feature
+++ b/test/login_logout/test/behave/features/login.feature
@@ -26,61 +26,3 @@ Scenario: Logout
     Then I wait on element "input#username" for 1000ms to be visible
     And I expect that element "input#password" is visible
     And I expect that element "input#submit" is visible
-
-Scenario: Login with a valid user without access to an application
-    Given the oauth client "home" URL was opened
-    And the element "input#username" is visible
-    When I enter the "username2" in the inputfield "input#username"
-    And I enter the "password" in the inputfield "input#password"
-    And I click on the button "input#submit"
-    Then I wait on element "input#password" for 1000ms to not exist
-    And I expect that element "input#username" does not exist
-    And I expect that the path is "/callback"
-    And I expect that element "body" contains the text "error"
-    And I expect that element "body" contains the text "Permission denied"
-    And I expect that element "body" contains the text "missing application permission"
-
-Scenario: Login with an invalid user without
-    Given the oauth client "home" URL was opened
-    And the element "input#username" is visible
-    When I set "not_a_valid_user" to the inputfield "input#username"
-    And I set "password" to the inputfield "input#password"
-    And I click on the button "input#submit"
-    Then I wait on element "input#password" for 1000ms to not exist
-    And I expect that element "input#username" does not exist
-    And I expect that the path is "/callback"
-    And I expect that element "body" contains the text "error"
-    And I expect that element "body" contains the text "Login denied"
-    And I expect that element "body" contains the text "Invalid username or password"
-
-Scenario: Login with a valid user and remember session
-    Given the oauth client "home" URL was opened
-    And the element "input#username" is visible
-    And the element "input#remember" is visible
-    When I enter the "username" in the inputfield "input#username"
-    And I enter the "password" in the inputfield "input#password"
-    And I click on the element "input#remember"
-    And I click on the button "input#submit"
-    Then I wait on element "input#password" for 1000ms to not exist
-    And I expect that element "input#username" does not exist
-    And I expect that the path is "/callback"
-    And I expect that element "body" contains the text "access_token"
-
-Scenario: Login without providing credentials
-    Given the oauth client "logout" URL was opened
-    And I pause for 1000ms
-    And there is no element "input#username" on the page
-    And there is no element "input#password" on the page
-    And the element "button#continue" is visible
-    When I click on the element "button#continue"
-    Then I wait on element "button#continue" for 1000ms to not exist
-    And I expect that the path is "/callback"
-    And I expect that element "body" contains the text "access_token"
-
-Scenario: Terminate single sign-on session
-    Given the oauth client "logout" URL was opened
-    And I pause for 1000ms
-    And the element "button#logout" is visible
-    When I click on the element "button#logout"
-    Then I expect that the "error" in the json output is "Login cancelled"
-    And I expect that the "error_description" in the json output is "Login was cancelled and user session was terminated"
diff --git a/test/login_logout/test/behave/features/reject_unauthorized_logins.feature b/test/login_logout/test/behave/features/reject_unauthorized_logins.feature
new file mode 100644
index 0000000000000000000000000000000000000000..c95b995944b5ffd4d59cea4033981a9d789f180e
--- /dev/null
+++ b/test/login_logout/test/behave/features/reject_unauthorized_logins.feature
@@ -0,0 +1,31 @@
+@oauth
+Feature: Test features that prohibit unauthorized access
+    As an attacker or unauthorized user
+    I want to to login to an OAS App
+    And the single sign-on will block my login attempts
+
+Scenario: Login with a valid user without access to an application
+    Given the oauth client "home" URL was opened
+    And the element "input#username" is visible
+    When I enter the "username2" in the inputfield "input#username"
+    And I enter the "password" in the inputfield "input#password"
+    And I click on the button "input#submit"
+    Then I wait on element "input#password" for 1000ms to not exist
+    And I expect that element "input#username" does not exist
+    And I expect that the path is "/callback"
+    And I expect that element "body" contains the text "error"
+    And I expect that element "body" contains the text "Permission denied"
+    And I expect that element "body" contains the text "missing application permission"
+
+Scenario: Login with an invalid user
+    Given the oauth client "home" URL was opened
+    And the element "input#username" is visible
+    When I set "not_a_valid_user" to the inputfield "input#username"
+    And I set "password" to the inputfield "input#password"
+    And I click on the button "input#submit"
+    Then I wait on element "input#password" for 1000ms to not exist
+    And I expect that element "input#username" does not exist
+    And I expect that the path is "/callback"
+    And I expect that element "body" contains the text "error"
+    And I expect that element "body" contains the text "Login denied"
+    And I expect that element "body" contains the text "Invalid username or password"
diff --git a/test/login_logout/test/behave/features/remember_me.feature b/test/login_logout/test/behave/features/remember_me.feature
new file mode 100644
index 0000000000000000000000000000000000000000..81ad49e2abfc9cad524e7429239fa5a3767eb8b7
--- /dev/null
+++ b/test/login_logout/test/behave/features/remember_me.feature
@@ -0,0 +1,37 @@
+@oauth
+Feature: Testing single sign-on sessions
+    As an OAS user
+    I want to login once to use an application
+    And I use my active single sign-on session to login again without providing credentials
+
+Scenario: Login with a valid user and remember session
+    Given the oauth client "home" URL was opened
+    And the element "input#username" is visible
+    And the element "input#remember" is visible
+    When I enter the "username" in the inputfield "input#username"
+    And I enter the "password" in the inputfield "input#password"
+    And I click on the element "input#remember"
+    And I click on the button "input#submit"
+    Then I wait on element "input#password" for 1000ms to not exist
+    And I expect that element "input#username" does not exist
+    And I expect that the path is "/callback"
+    And I expect that element "body" contains the text "access_token"
+
+Scenario: Login without providing credentials
+    Given the oauth client "logout" URL was opened
+    And I pause for 1000ms
+    And there is no element "input#username" on the page
+    And there is no element "input#password" on the page
+    And the element "button#continue" is visible
+    When I click on the element "button#continue"
+    Then I wait on element "button#continue" for 1000ms to not exist
+    And I expect that the path is "/callback"
+    And I expect that element "body" contains the text "access_token"
+
+Scenario: Terminate single sign-on session
+    Given the oauth client "logout" URL was opened
+    And I pause for 1000ms
+    And the element "button#logout" is visible
+    When I click on the element "button#logout"
+    Then I expect that the "error" in the json output is "Login cancelled"
+    And I expect that the "error_description" in the json output is "Login was cancelled and user session was terminated"
diff --git a/test/login_logout/test/behave/features/steps/login.py b/test/login_logout/test/behave/features/steps/compare_json_values.py
similarity index 52%
rename from test/login_logout/test/behave/features/steps/login.py
rename to test/login_logout/test/behave/features/steps/compare_json_values.py
index f7ff2b64409b63b098d2c81119216abcdae7bd27..da73242d5460566c36e9820fdf7b7984de38fa93 100644
--- a/test/login_logout/test/behave/features/steps/login.py
+++ b/test/login_logout/test/behave/features/steps/compare_json_values.py
@@ -1,35 +1,8 @@
-"""Custom steps for login tests."""
-
-import string
+"""Custom steps for tests that anaylize a website that returns a json object."""
 import json
-
-from behave import given, when
+from behave import given, when, then
 from behave_webdriver.steps import *
 
-
-def before_all(context):
-    pass  # login and save cookies here
-
-@when(u'I open the oauth client "{url}" URL')
-@given(u'The oauth client "{url}" URL was opened')
-def step_impl(context, url):
-    context.behave_driver.get(context.oauth[url])
-
-@when(u'I enter the "{attribute}" in the inputfield "{element}"')
-def step_impl(context, attribute,  element):
-    """Enter value into login inputfields."""
-    elem = context.behave_driver.get_element(element)
-    elem.clear()
-    value = context.oauth[attribute]
-    elem.send_keys(value)
-
-@then(u'I expect that element "{element}" contains the value of var "{variable}"')
-def step_impl(context, element, variable):
-    """Check if value is in field"""
-    elem = context.behave_driver.get_element(element)
-    value = context.oauth[variable]
-    assert value in elem.text
-
 @then(u'I expect that the "{variable}" in the json output is the same as oauth variable "{value}"')
 def step_impl(context, variable, value):
     assert context.oauth[value] == get_value_from_json_body(context, variable)
@@ -49,4 +22,3 @@ def step_impl(context, variable, value):
 def get_value_from_json_body(context, key):
     obj_serialized = context.behave_driver.get_element("body").text
     return json.loads(obj_serialized)[key]
-
diff --git a/test/login_logout/test/behave/features/steps/webdriver_with_variables.py b/test/login_logout/test/behave/features/steps/webdriver_with_variables.py
new file mode 100644
index 0000000000000000000000000000000000000000..e913d60f2680a5609b49d728ee41256266eb61fc
--- /dev/null
+++ b/test/login_logout/test/behave/features/steps/webdriver_with_variables.py
@@ -0,0 +1,27 @@
+"""Custom steps for login tests that use oauth environment variables"""
+from behave import given, when, then
+from behave_webdriver.steps import *
+
+
+def before_all(context):
+    pass  # login and save cookies here
+
+@when(u'I open the oauth client "{url}" URL')
+@given(u'The oauth client "{url}" URL was opened')
+def step_impl(context, url):
+    context.behave_driver.get(context.oauth[url])
+
+@when(u'I enter the "{attribute}" in the inputfield "{element}"')
+def step_impl(context, attribute,  element):
+    """Enter value into login inputfields."""
+    elem = context.behave_driver.get_element(element)
+    elem.clear()
+    value = context.oauth[attribute]
+    elem.send_keys(value)
+
+@then(u'I expect that element "{element}" contains the value of var "{variable}"')
+def step_impl(context, element, variable):
+    """Check if value is in field"""
+    elem = context.behave_driver.get_element(element)
+    value = context.oauth[variable]
+    assert value in elem.text