diff --git a/App/Config/site.php.example b/App/Config/site.php.example
index 7208a70..ea9eada 100644
--- a/App/Config/site.php.example
+++ b/App/Config/site.php.example
@@ -2,4 +2,5 @@
 
 return [
     'key' => 'CHANGE_ME',
+    'url' => 'https://autenticazione.lavoripubblici.sicilia.it/',
 ];
diff --git a/App/Core/Controller.php b/App/Core/Controller.php
index d5fcc1d..0c75f2b 100644
--- a/App/Core/Controller.php
+++ b/App/Core/Controller.php
@@ -4,7 +4,6 @@ namespace MwgAuth\Core;
 
 class Controller
 {
-
     private static $charset = 'UTF-8';
     private static $contentType = 'application/json';
     private static $responseCode = 200;
diff --git a/App/Core/Model.php b/App/Core/Model.php
index 6e088c1..980f936 100644
--- a/App/Core/Model.php
+++ b/App/Core/Model.php
@@ -78,7 +78,11 @@ class Model
         foreach ($conditions as $field => $value) {
             $where[] = "(`$field`=:$field)";
         }
-        return "SELECT `" . implode('`,`', $fields) . "` FROM `$table` WHERE " . implode(' AND ', $where);
+        $sql = "SELECT `" . implode('`,`', $fields) . "` FROM `$table`";
+        if (count($where)) {
+            $sql .= ' WHERE ' . implode(' AND ', $where);
+        }
+        return $sql;
     }
 
     protected static function insert(string $table, array $fields): bool
diff --git a/App/Models/Cns.php b/App/Models/Cns.php
index b228359..37d27a0 100644
--- a/App/Models/Cns.php
+++ b/App/Models/Cns.php
@@ -23,7 +23,11 @@ class Cns extends Model
             $this->verificaCertificato();
             // https://www.agid.gov.it/sites/default/files/repository_files/documentazione_trasparenza/strutturacertificatoautenticazionecns_v1.1_.pdf
             if (isset($this->certificato['subject']['serialNumber'])) {
-                $this->codiceFiscale = preg_replace('/^[A-Za-z]{2}:/', '', $this->certificato['subject']['serialNumber']);
+                $this->codiceFiscale = preg_replace(
+                    '/^[A-Za-z]{2}:/',
+                    '',
+                    $this->certificato['subject']['serialNumber']
+                );
             } else {
                 $this->codiceFiscale = explode('/', $this->certificato['subject']['commonName'])[0];
             }
@@ -78,13 +82,15 @@ class Cns extends Model
 
     private function verificaCertificato()
     {
-        // if (!isset($this->certificato['subject']['commonName']) ||
-        //     !isset($this->certificato['subject']['surname']) ||
-        //     !isset($this->certificato['subject']['givenName']) ||
-        //     isset($this->certificato['subject']['serialNumber']) ||
-        //     !isset($this->certificato['extensions']['certificatePolicies'])) {
-        $this->salvaCertificato();
-        // }
+        if (
+            !isset($this->certificato['subject']['commonName'])
+            || !isset($this->certificato['subject']['surname'])
+            || !isset($this->certificato['subject']['givenName'])
+            || isset($this->certificato['subject']['serialNumber'])
+            || !isset($this->certificato['extensions']['certificatePolicies'])
+        ) {
+            $this->salvaCertificato();
+        }
     }
 
     private function salvaCertificato()
diff --git a/App/Models/Token.php b/App/Models/Token.php
new file mode 100644
index 0000000..08ee0d1
--- /dev/null
+++ b/App/Models/Token.php
@@ -0,0 +1,22 @@
+<?php
+
+namespace MwgAuth\Models;
+
+use MwgAuth\Core\Model;
+
+class Token extends Model
+{
+    public static function useCns(string $token): bool
+    {
+        $token = self::selectOne('tokens', ['auth'], ['token' => $token]);
+        if (null === $token) {
+            return true;
+        }
+        $user_id = self::selectOne('sessions', ['user_id'], ['auth' => $token['auth']]);
+        if (null === $user_id) {
+            return true;
+        }
+        $useCns = self::selectOne('users', ['use_cns'], ['id' => $user_id['user_id']]);
+        return $useCns['use_cns'] == 1;
+    }
+}
diff --git a/App/Models/User.php b/App/Models/User.php
index 01b9074..05243b0 100644
--- a/App/Models/User.php
+++ b/App/Models/User.php
@@ -62,7 +62,7 @@ class User extends Model
 
     public function getLoginData(string $token): ?array
     {
-        $ret = $this->select('logins', ['codice_fiscale', 'nome', 'cognome'], ['token' => $token]);
+        $ret = $this->select('logins', ['codice_fiscale', 'nome', 'cognome', 'email'], ['token' => $token]);
         return empty($ret) ? null : $ret[0];
     }
 
@@ -90,13 +90,19 @@ class User extends Model
         return $this->userName;
     }
 
-    public static function setLoginData(string $token, string $codiceFiscale, string $nome, string $cognome): bool
-    {
+    public static function setLoginData(
+        string $token,
+        string $codiceFiscale,
+        string $nome,
+        string $cognome,
+        ?string $email = null
+    ): bool {
         return self::insert('logins', [
             'token' => $token,
             'codice_fiscale' => $codiceFiscale,
             'nome' => $nome,
             'cognome' => $cognome,
+            'email' => $email,
         ]);
     }
 
@@ -121,7 +127,7 @@ class User extends Model
         return Config::getValue('site', 'key');
     }
 
-    private static function hashPassword(string $password): string
+    protected static function hashPassword(string $password): string
     {
         $siteKey = self::getSiteKey();
         return hash('sha256', $siteKey . $password);
diff --git a/App/Models/UserTool.php b/App/Models/UserTool.php
new file mode 100644
index 0000000..04ac206
--- /dev/null
+++ b/App/Models/UserTool.php
@@ -0,0 +1,33 @@
+<?php
+
+namespace MwgAuth\Models;
+
+use MwgAuth\Core\Model;
+
+class UserTool extends User
+{
+    public static function add(string $username, string $password, string $remote, bool $useCns): bool
+    {
+        return self::insert('users', [
+            'username' => $username,
+            'password' => self::hashPassword($password),
+            'remote' => $remote,
+            'use_cns' => $useCns,
+        ]);
+    }
+
+    public static function list(): array
+    {
+        return self::select('users', ['id', 'username', 'remote', 'use_cns'], []);
+    }
+
+    public static function token(string $username): ?string
+    {
+        $rows = self::select('users', ['id'], ['username' => $username]);
+        if (empty($rows)) {
+            return null;
+        }
+        $user = new User($rows[0]['id'], $username);
+        return $user->getToken('http://localhost/callback');
+    }
+}
diff --git a/App/bootstrap.php b/App/bootstrap.php
index ff1ced4..40040ee 100644
--- a/App/bootstrap.php
+++ b/App/bootstrap.php
@@ -2,5 +2,5 @@
 
 namespace MwgAuth\Core;
 
-require_once(__DIR__.'/Core/AutoLoader.php');
+require_once(__DIR__ . '/Core/AutoLoader.php');
 AutoLoader::register();
diff --git a/html/index.php b/html/index.php
index 2a3b9ca..8044393 100644
--- a/html/index.php
+++ b/html/index.php
@@ -1,4 +1,12 @@
-<!doctype html>
+<?php
+
+use MwgAuth\Models\Token;
+
+require_once(dirname(__DIR__) . '/App/bootstrap.php');
+
+$useCns = Token::useCns($_GET['t'] ?? '');
+
+?><!doctype html>
 <html lang="it">
 <head>
     <meta charset="utf-8">
@@ -16,23 +24,25 @@
             </div>
         </div>
         <div class="row">
-            <div class="col-md-6 col-xs-12">
-                <h2>Accedi con CNS</h2>
-                <hr class="solid">
-                <p>
-                    La Carta Nazionale dei Servizi o CNS è una smart card o una chiavetta USB che contiene un
-                    "certificato digitale" di autenticazione personale, utile per accedere ai servizi online della
-                    Regione Siciliana.
-                </p>
-                <form action="/cns/" method="GET">
-                    <input type="hidden" name="t" value="<?= @$_GET['t'] ?>">
-                    <button type="submit" class="btn btn-labeled btn-primary">
-                        <span class="btn-label">
-                            <img width="30" src="images/cns-icon.png">
-                        </span> Entra con CNS
-                    </button>
-                </form>
-            </div>
+            <?php if ($useCns) : ?>
+                <div class="col-md-6 col-xs-12">
+                    <h2>Accedi con CNS</h2>
+                    <hr class="solid">
+                    <p>
+                        La Carta Nazionale dei Servizi o CNS è una smart card o una chiavetta USB che contiene un
+                        "certificato digitale" di autenticazione personale, utile per accedere ai servizi online della
+                        Regione Siciliana.
+                    </p>
+                    <form action="/cns/" method="GET">
+                        <input type="hidden" name="t" value="<?= @$_GET['t'] ?>">
+                        <button type="submit" class="btn btn-labeled btn-primary">
+                            <span class="btn-label">
+                                <img width="30" src="images/cns-icon.png">
+                            </span> Entra con CNS
+                        </button>
+                    </form>
+                </div>
+            <?php endif ?>
             <div class="col-md-6 col-xs-12">
                 <h2>Accedi con SPID o CieID</h2>
                 <hr class="solid">
diff --git a/html/spid/index.php b/html/spid/index.php
index 2ec493d..e40b5b1 100644
--- a/html/spid/index.php
+++ b/html/spid/index.php
@@ -8,11 +8,13 @@ $token = $_GET['t'] ?? null;
 if ('' === ($token ?? '')) {
     include($_SERVER['DOCUMENT_ROOT'] . '/errors/generic.php');
 } else {
+    @file_put_contents("/var/www/html/cns/policy/claims-$token.txt", print_r($_SERVER, true));
     User::setLoginData(
         $token,
         $_SERVER['SPID_claim_fiscalNumber'],
         $_SERVER['SPID_claim_given_name'],
-        $_SERVER['SPID_claim_family_name']
+        $_SERVER['SPID_claim_family_name'],
+        $_SERVER['SPID_claim_email'],
     );
     $callback = User::getCallback($token);
     if (null === $callback) {
diff --git a/setup/file/autenticazione.sql b/setup/file/autenticazione.sql
index ce54ed2..e1d5b1d 100644
--- a/setup/file/autenticazione.sql
+++ b/setup/file/autenticazione.sql
@@ -15,6 +15,7 @@ CREATE TABLE `logins` (
   `codice_fiscale` varchar(255) DEFAULT NULL,
   `nome` varchar(255) DEFAULT NULL,
   `cognome` varchar(255) DEFAULT NULL,
+  `email` varchar(255) NULL DEFAULT NULL,
   `created_at` timestamp NULL DEFAULT NULL,
   `modified_at` timestamp NULL DEFAULT NULL,
   PRIMARY KEY (`token`)
@@ -46,17 +47,14 @@ CREATE TABLE `users` (
   `username` varchar(255) NOT NULL,
   `password` char(64) NOT NULL,
   `remote` varchar(45) DEFAULT NULL,
+  `use_cns` BOOLEAN NOT NULL DEFAULT TRUE,
   `created_at` timestamp NULL DEFAULT NULL,
-  `updated_at` timestamp NULL DEFAULT NULL,
+  `modified_at` timestamp NULL DEFAULT NULL,
   `deleted_at` timestamp NULL DEFAULT NULL,
   PRIMARY KEY (`id`),
   UNIQUE KEY `users_username_remote_unique` (`username`,`remote`)
 ) ENGINE=InnoDB AUTO_INCREMENT=5 DEFAULT CHARSET=utf8;
 
-INSERT INTO `users`(`id`,`username`,`password`,`remote`,`created_at`,`updated_at`,`deleted_at`) VALUES
-(1,'sismica','268633d46fdf00502dba60facce2ba5eec6a5d86c843c19f3f3b1ef8c0342ada','192.168.15.*',CURRENT_TIMESTAMP,CURRENT_TIMESTAMP,NULL),
-(2,'sismica','268633d46fdf00502dba60facce2ba5eec6a5d86c843c19f3f3b1ef8c0342ada','79.8.172.13',CURRENT_TIMESTAMP,CURRENT_TIMESTAMP,NULL);
-
 /*!40101 SET SQL_MODE=@OLD_SQL_MODE */;
 /*!40014 SET FOREIGN_KEY_CHECKS=@OLD_FOREIGN_KEY_CHECKS */;
 /*!40014 SET UNIQUE_CHECKS=@OLD_UNIQUE_CHECKS */;
diff --git a/setup/file/update_001.sql b/setup/file/update_001.sql
new file mode 100644
index 0000000..73328fa
--- /dev/null
+++ b/setup/file/update_001.sql
@@ -0,0 +1,2 @@
+ALTER TANLE `logins` ADD COLUMN `email` VARCHAR(255) NULL DEFAULT NULL AFTER `cognome`;
+ALTER TANLE `users` ADD COLUMN `use_cns` BOOLEAN NOT NULL DEFAULT TRUE AFTER `remote`;
diff --git a/tools/get_token b/tools/get_token
new file mode 100755
index 0000000..35599ba
--- /dev/null
+++ b/tools/get_token
@@ -0,0 +1,14 @@
+#!/usr/bin/env php
+<?php
+
+use MwgAuth\Core\Config;
+use MwgAuth\Models\UserTool;
+
+require_once(dirname(__DIR__) . '/App/bootstrap.php');
+
+if ($argc < 2) {
+    echo "Usage: $argv[0] <username>\n";
+    exit(1);
+}
+$token = UserTool::token($argv[1]);
+echo Config::getValue('site', 'url') . "?t=$token\n";
diff --git a/tools/user_add b/tools/user_add
new file mode 100755
index 0000000..a596c1c
--- /dev/null
+++ b/tools/user_add
@@ -0,0 +1,27 @@
+#!/usr/bin/env php
+<?php
+
+namespace Tools;
+
+use MwgAuth\Models\UserTool;
+
+require_once(dirname(__DIR__) . '/App/bootstrap.php');
+
+$username = readline("Nome utente: ");
+$password = readline("Password: ");
+$remote = readline("Indirizzo remoto (default: *): ");
+if (empty($remote)) {
+    $remote = '*';
+}
+$cns = readline("Usa CNS? (Y/n): ");
+if (empty($cns)) {
+    $cns = 'y';
+}
+$cns = strtolower($cns) === 'y';
+echo "Aggiungo utente...\n";
+$result = UserTool::add($username, $password, $remote, $cns);
+if ($result) {
+    echo "Utente aggiunto con successo.\n";
+} else {
+    echo "Errore durante l'aggiunta dell'utente.\n";
+}
diff --git a/tools/user_list b/tools/user_list
new file mode 100755
index 0000000..f3c91d5
--- /dev/null
+++ b/tools/user_list
@@ -0,0 +1,11 @@
+#!/usr/bin/env php
+<?php
+
+use MwgAuth\Models\UserTool;
+
+require_once(dirname(__DIR__) . '/App/bootstrap.php');
+
+$users = UserTool::list();
+foreach ($users as $user) {
+    echo "ID: {$user['id']}, Username: {$user['username']}, Remote: {$user['remote']}, Use CNS: {$user['use_cns']}\n";
+}