diff --git a/src/main/java/de/ozgcloud/operator/Config.java b/src/main/java/de/ozgcloud/operator/Config.java
index 6653131f89bd8e0fc6456ccfe8bf0486a3f6881b..4a99874335a378c29ddd1ab950d2357d8ab3d261 100644
--- a/src/main/java/de/ozgcloud/operator/Config.java
+++ b/src/main/java/de/ozgcloud/operator/Config.java
@@ -23,6 +23,7 @@
  */
 package de.ozgcloud.operator;
 
+import java.time.Duration;
 import java.util.List;
 
 import org.springframework.context.annotation.Bean;
@@ -34,13 +35,13 @@ import io.javaoperatorsdk.operator.api.reconciler.Reconciler;
 @Configuration
 public class Config {
 
-	public static final int RECONCILER_RETRY_SECONDS = 20;
-	public static final int RECONCILER_RETRY_SECONDS_ON_ERROR = 60;
+	public static final Duration RECONCILER_RETRY_SECONDS = Duration.ofSeconds(20);
+	public static final Duration RECONCILER_RETRY_SECONDS_ON_ERROR = Duration.ofSeconds(60);
 
 	@Bean(initMethod = "start", destroyMethod = "stop")
 	@SuppressWarnings("rawtypes")
 	Operator operator(List<Reconciler> controllers) {
-		Operator operator = new Operator();
+		var operator = new Operator();
 		controllers.forEach(operator::register);
 		return operator;
 	}
diff --git a/src/main/java/de/ozgcloud/operator/keycloak/client/KeycloakClientReconciler.java b/src/main/java/de/ozgcloud/operator/keycloak/client/KeycloakClientReconciler.java
index c5f6f19da10c06a504588309ac679f39d4d9847e..d20d39870914450f419e3d613fd3b82cd628ccfe 100644
--- a/src/main/java/de/ozgcloud/operator/keycloak/client/KeycloakClientReconciler.java
+++ b/src/main/java/de/ozgcloud/operator/keycloak/client/KeycloakClientReconciler.java
@@ -23,7 +23,6 @@
  */
 package de.ozgcloud.operator.keycloak.client;
 
-import java.time.Duration;
 import java.util.Optional;
 import java.util.logging.Level;
 
@@ -71,7 +70,7 @@ public class KeycloakClientReconciler implements Reconciler<OzgKeycloakClient> {
 							+ e.getMessage(),
 					e);
 			resource.setStatus(OzgKeycloakClientStatus.builder().status(OzgCustomResourceStatus.ERROR).message(e.getMessage()).build());
-			return UpdateControl.updateStatus(resource).rescheduleAfter(Duration.ofSeconds(Config.RECONCILER_RETRY_SECONDS));
+			return UpdateControl.updateStatus(resource).rescheduleAfter(Config.RECONCILER_RETRY_SECONDS);
 		}
 	}
 
@@ -85,6 +84,6 @@ public class KeycloakClientReconciler implements Reconciler<OzgKeycloakClient> {
 				"Could not yet reconcile client " + resource.getMetadata().getName() + " in namespace " + resource.getMetadata().getNamespace() + ":"
 						+ errorMessage);
 		resource.setStatus(OzgKeycloakClientStatus.builder().status(OzgCustomResourceStatus.IN_PROGRESS).message(errorMessage).build());
-		return UpdateControl.updateStatus(resource).rescheduleAfter(Duration.ofSeconds(Config.RECONCILER_RETRY_SECONDS));
+		return UpdateControl.updateStatus(resource).rescheduleAfter(Config.RECONCILER_RETRY_SECONDS);
 	}
 }
diff --git a/src/main/java/de/ozgcloud/operator/keycloak/group/KeycloakGroupReconciler.java b/src/main/java/de/ozgcloud/operator/keycloak/group/KeycloakGroupReconciler.java
index d4b041a618b9c0845187b5ede9a672ad9b7a41da..4aeed50e27d5d0af1ddd5d5553d996c43ff86658 100644
--- a/src/main/java/de/ozgcloud/operator/keycloak/group/KeycloakGroupReconciler.java
+++ b/src/main/java/de/ozgcloud/operator/keycloak/group/KeycloakGroupReconciler.java
@@ -23,7 +23,6 @@
  */
 package de.ozgcloud.operator.keycloak.group;
 
-import java.time.Duration;
 import java.util.Optional;
 import java.util.logging.Level;
 
@@ -71,7 +70,7 @@ public class KeycloakGroupReconciler implements Reconciler<OzgKeycloakGroup> {
 							+ e.getMessage(),
 					e);
 			resource.setStatus(OzgKeycloakGroupStatus.builder().status(OzgCustomResourceStatus.ERROR).message(e.getMessage()).build());
-			return UpdateControl.updateStatus(resource).rescheduleAfter(Duration.ofSeconds(Config.RECONCILER_RETRY_SECONDS));
+			return UpdateControl.updateStatus(resource).rescheduleAfter(Config.RECONCILER_RETRY_SECONDS);
 		}
 	}
 
@@ -85,6 +84,6 @@ public class KeycloakGroupReconciler implements Reconciler<OzgKeycloakGroup> {
 				"Could not yet reconcile group " + resource.getMetadata().getName() + " in namespace " + resource.getMetadata().getNamespace() + ": "
 						+ errorMessage);
 		resource.setStatus(OzgKeycloakGroupStatus.builder().status(OzgCustomResourceStatus.IN_PROGRESS).message(errorMessage).build());
-		return UpdateControl.updateStatus(resource).rescheduleAfter(Duration.ofSeconds(Config.RECONCILER_RETRY_SECONDS));
+		return UpdateControl.updateStatus(resource).rescheduleAfter(Config.RECONCILER_RETRY_SECONDS);
 	}
 }
\ No newline at end of file
diff --git a/src/main/java/de/ozgcloud/operator/keycloak/realm/KeycloakRealmReconciler.java b/src/main/java/de/ozgcloud/operator/keycloak/realm/KeycloakRealmReconciler.java
index 0e9a13f204d295f6b445c35bba582a25e0abc28c..eb935aa0c85d58745e312f0ee630e8689e8d91c3 100644
--- a/src/main/java/de/ozgcloud/operator/keycloak/realm/KeycloakRealmReconciler.java
+++ b/src/main/java/de/ozgcloud/operator/keycloak/realm/KeycloakRealmReconciler.java
@@ -23,7 +23,6 @@
  */
 package de.ozgcloud.operator.keycloak.realm;
 
-import java.time.Duration;
 import java.util.logging.Level;
 
 import org.springframework.beans.factory.annotation.Autowired;
@@ -66,7 +65,7 @@ public class KeycloakRealmReconciler implements Reconciler<OzgKeycloakRealm>, Cl
 							+ e.getMessage(),
 					e);
 			resource.setStatus(OzgKeycloakRealmStatus.builder().status(OzgCustomResourceStatus.ERROR).message(e.getMessage()).build());
-			return UpdateControl.updateStatus(resource).rescheduleAfter(Duration.ofSeconds(Config.RECONCILER_RETRY_SECONDS));
+			return UpdateControl.updateStatus(resource).rescheduleAfter(Config.RECONCILER_RETRY_SECONDS);
 		}
 	}
 
diff --git a/src/main/java/de/ozgcloud/operator/keycloak/user/KeycloakUserMapper.java b/src/main/java/de/ozgcloud/operator/keycloak/user/KeycloakUserMapper.java
index 9b5b99d52f88870327a16fb8bbd4dfcc7d72a823..adf5f3419c6afffbf20e1ce105717005167648fc 100644
--- a/src/main/java/de/ozgcloud/operator/keycloak/user/KeycloakUserMapper.java
+++ b/src/main/java/de/ozgcloud/operator/keycloak/user/KeycloakUserMapper.java
@@ -69,19 +69,18 @@ interface KeycloakUserMapper {
 		return List.of(buildPasswordCredential(user));
 	}
 
-	default CredentialRepresentation buildPasswordCredential(OzgKeycloakUserSpec user) {
-		CredentialRepresentation credential = new CredentialRepresentation();
+	private CredentialRepresentation buildPasswordCredential(OzgKeycloakUserSpec user) {
+		var credential = new CredentialRepresentation();
 		credential.setType(CredentialRepresentation.PASSWORD);
 		credential.setValue(user.getKeycloakUser().getPassword());
 		credential.setTemporary(false);
+
 		return credential;
 	}
 
 	@Named("mapGroups")
 	default List<String> mapGroups(List<KeycloakUserSpecUserGroup> groups) {
-		return groups.stream()
-				.map(KeycloakUserSpecUserGroup::getName)
-				.toList();
+		return groups.stream().map(KeycloakUserSpecUserGroup::getName).toList();
 	}
 
 	@Named("mapClientRoles")
diff --git a/src/main/java/de/ozgcloud/operator/keycloak/user/KeycloakUserPreconditionService.java b/src/main/java/de/ozgcloud/operator/keycloak/user/KeycloakUserPreconditionService.java
index 19b753164060e5e298865eeb66b064043b41af04..3eaf6c5e688bb94192dd5733df0ac7ff9d240970 100644
--- a/src/main/java/de/ozgcloud/operator/keycloak/user/KeycloakUserPreconditionService.java
+++ b/src/main/java/de/ozgcloud/operator/keycloak/user/KeycloakUserPreconditionService.java
@@ -38,8 +38,7 @@ class KeycloakUserPreconditionService {
 	@Autowired
 	private KeycloakGenericRemoteService keycloakGenericRemoteService;
 
-	public Optional<String> getReconcilePreconditionErrors(OzgKeycloakUser user) {
-
+	public Optional<String> getPreconditionErrors(OzgKeycloakUser user) {
 		var namespace = user.getMetadata().getNamespace();
 
 		if (!keycloakGenericRemoteService.realmExists(namespace)) {
diff --git a/src/main/java/de/ozgcloud/operator/keycloak/user/KeycloakUserReconciler.java b/src/main/java/de/ozgcloud/operator/keycloak/user/KeycloakUserReconciler.java
index 182ffa06b64bb26a8534a349e9b0387de46c7711..9f0b654f66d3eeda23f7253561f307f5e71617b9 100644
--- a/src/main/java/de/ozgcloud/operator/keycloak/user/KeycloakUserReconciler.java
+++ b/src/main/java/de/ozgcloud/operator/keycloak/user/KeycloakUserReconciler.java
@@ -23,13 +23,11 @@
  */
 package de.ozgcloud.operator.keycloak.user;
 
-import java.time.Duration;
 import java.util.logging.Level;
 
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.stereotype.Component;
 
-import de.ozgcloud.operator.Config;
 import de.ozgcloud.operator.keycloak.OzgCustomResourceStatus;
 import io.javaoperatorsdk.operator.api.reconciler.Cleaner;
 import io.javaoperatorsdk.operator.api.reconciler.Context;
@@ -46,73 +44,60 @@ public class KeycloakUserReconciler implements Reconciler<OzgKeycloakUser>, Clea
 
 	@Autowired
 	private KeycloakUserService keycloakUserService;
-
 	@Autowired
 	private KeycloakUserPreconditionService preconditionService;
 
 	@Override
 	public UpdateControl<OzgKeycloakUser> reconcile(OzgKeycloakUser resource, Context<OzgKeycloakUser> context) {
-		try {
-			log.info(String.format("Reconciling user %s...", resource.getMetadata().getName()));
+		var userName = resource.getMetadata().getName();
+		var namespace = resource.getMetadata().getNamespace();
 
-			var preconditionError = preconditionService.getReconcilePreconditionErrors(resource);
-			if (preconditionError.isPresent()) {
-				return buildStatusInProgress(resource, preconditionError.get());
-			}
+		log.info(String.format("Reconciling user %s...", userName));
 
-			keycloakUserService.createOrUpdateUser(resource.getSpec(), resource.getMetadata().getNamespace());
+		try {
+			var preconditionError = preconditionService.getPreconditionErrors(resource);
+			if (preconditionError.isPresent()) {
+				var errorMessage = preconditionError.get();
 
-			resource.setStatus(buildOzgKeycloakUserOkStatus());
-			return UpdateControl.updateStatus(resource);
+				log.warning(String.format("Could not reconcile user %s in namespace %s: %s", userName, namespace, errorMessage));
 
-		} catch (Exception e) {
-			log.log(Level.SEVERE, String.format("Could not reconcile user %s for namespace %s: %s", resource.getMetadata().getName(),
-					resource.getMetadata().getNamespace(), e.getMessage()), e);
+				return UserUpdateControlBuilder.fromResource(resource)
+						.withStatus(OzgCustomResourceStatus.IN_PROGRESS)
+						.withMessage(errorMessage)
+						.withReschedule()
+						.build();
+			}
 
-			resource.setStatus(buildOzgKeycloakUserErrorStatus(e.getMessage()));
-			return createRescheduleUpdateControl(resource);
-		}
-	}
+			keycloakUserService.createOrUpdateUser(resource.getSpec(), namespace);
 
-	private OzgKeycloakUserStatus buildOzgKeycloakUserOkStatus() {
-		return buildOzgKeycloakUserStatus(OzgCustomResourceStatus.OK, null);
-	}
+			return UserUpdateControlBuilder.fromResource(resource).withStatus(OzgCustomResourceStatus.OK).build();
 
-	private OzgKeycloakUserStatus buildOzgKeycloakUserErrorStatus(String message) {
-		return buildOzgKeycloakUserStatus(OzgCustomResourceStatus.ERROR, message);
-	}
+		} catch (Exception e) {
+			var errorMessage = e.getMessage();
 
-	private UpdateControl<OzgKeycloakUser> buildStatusInProgress(OzgKeycloakUser resource, String errorMessage) {
-		log.log(Level.WARNING, String.format("Could not reconcile user %s in namespace %s: %s", resource.getMetadata().getName(),
-				resource.getMetadata().getNamespace(), errorMessage));
+			log.log(Level.SEVERE, String.format("Could not reconcile user %s for namespace %s: %s", userName, namespace, errorMessage), e);
 
-		resource.setStatus(buildOzgKeycloakUserInProgressStatus(errorMessage));
-		return createRescheduleUpdateControl(resource);
-	}
-
-	private OzgKeycloakUserStatus buildOzgKeycloakUserInProgressStatus(String message) {
-		return buildOzgKeycloakUserStatus(OzgCustomResourceStatus.IN_PROGRESS, message);
+			return UserUpdateControlBuilder.fromResource(resource)
+					.withStatus(OzgCustomResourceStatus.ERROR)
+					.withMessage(errorMessage)
+					.withReschedule()
+					.build();
+		}
 	}
 
-	private OzgKeycloakUserStatus buildOzgKeycloakUserStatus(OzgCustomResourceStatus status, String message) {
-		return OzgKeycloakUserStatus.builder().status(status).message(message).build();
-	}
+	@Override
+	public DeleteControl cleanup(OzgKeycloakUser resource, Context<OzgKeycloakUser> context) {
+		var userName = resource.getMetadata().getName();
+		var namespace = resource.getMetadata().getNamespace();
 
-	private UpdateControl<OzgKeycloakUser> createRescheduleUpdateControl(OzgKeycloakUser userResource) {
-		return UpdateControl.updateStatus(userResource).rescheduleAfter(Duration.ofSeconds(Config.RECONCILER_RETRY_SECONDS));
-	}
+		log.info(String.format("Deleting KeycloakUser %s", userName));
 
-	@Override
-	public DeleteControl cleanup(OzgKeycloakUser userResource, Context<OzgKeycloakUser> context) {
 		try {
-			log.info(String.format("Deleting KeycloakUser %s", userResource.getMetadata().getName()));
-
-			keycloakUserService.deleteUser(userResource.getSpec(), userResource.getMetadata().getNamespace());
+			keycloakUserService.deleteUser(resource.getSpec(), namespace);
 
 			return DeleteControl.defaultDelete();
 		} catch (Exception e) {
-			log.log(Level.SEVERE, String.format("Could not delete user %s in namespace %s", userResource.getMetadata().getName(),
-					userResource.getMetadata().getNamespace()), e);
+			log.log(Level.SEVERE, String.format("Could not delete user %s in namespace %s", userName, namespace), e);
 			return DeleteControl.defaultDelete();
 		}
 	}
diff --git a/src/main/java/de/ozgcloud/operator/keycloak/user/UserUpdateControlBuilder.java b/src/main/java/de/ozgcloud/operator/keycloak/user/UserUpdateControlBuilder.java
new file mode 100644
index 0000000000000000000000000000000000000000..50de4cfe204c99194165b5f99885ea0d3b5012f0
--- /dev/null
+++ b/src/main/java/de/ozgcloud/operator/keycloak/user/UserUpdateControlBuilder.java
@@ -0,0 +1,57 @@
+package de.ozgcloud.operator.keycloak.user;
+
+import java.util.Optional;
+
+import de.ozgcloud.operator.Config;
+import de.ozgcloud.operator.keycloak.OzgCustomResourceStatus;
+import io.javaoperatorsdk.operator.api.reconciler.UpdateControl;
+
+class UserUpdateControlBuilder {
+
+	private OzgKeycloakUser resource;
+	private OzgCustomResourceStatus status;
+	private Optional<String> message = Optional.empty();
+	private boolean reschedule;
+
+	public UserUpdateControlBuilder(OzgKeycloakUser resource) {
+		this.resource = resource;
+	}
+
+	public static UserUpdateControlBuilder fromResource(OzgKeycloakUser resource) {
+		return new UserUpdateControlBuilder(resource);
+	}
+
+	public UserUpdateControlBuilder withStatus(OzgCustomResourceStatus status) {
+		this.status = status;
+		return this;
+	}
+
+	public UserUpdateControlBuilder withMessage(String message) {
+		this.message = Optional.ofNullable(message);
+		return this;
+	}
+
+	public UserUpdateControlBuilder withReschedule() {
+		this.reschedule = true;
+		return this;
+	}
+
+	public UpdateControl<OzgKeycloakUser> build() {
+		resource.setStatus(buildOzgKeycloakUserStatus());
+		return buildUpdateControl();
+	}
+
+	private OzgKeycloakUserStatus buildOzgKeycloakUserStatus() {
+		var userStatus = OzgKeycloakUserStatus.builder().status(status);
+		message.ifPresent(userStatus::message);
+
+		return userStatus.build();
+	}
+
+	private UpdateControl<OzgKeycloakUser> buildUpdateControl() {
+		if (reschedule) {
+			UpdateControl.updateStatus(resource).rescheduleAfter(Config.RECONCILER_RETRY_SECONDS_ON_ERROR);
+		}
+		return UpdateControl.updateStatus(resource);
+	}
+}
diff --git a/src/test/java/de/ozgcloud/operator/keycloak/user/KeycloakUserMapperTest.java b/src/test/java/de/ozgcloud/operator/keycloak/user/KeycloakUserMapperTest.java
index 3b4f7461311933f3ca759709545bef3188849e91..45798f962b77b209a17813d29289dd9ad41ea82c 100644
--- a/src/test/java/de/ozgcloud/operator/keycloak/user/KeycloakUserMapperTest.java
+++ b/src/test/java/de/ozgcloud/operator/keycloak/user/KeycloakUserMapperTest.java
@@ -25,18 +25,16 @@ package de.ozgcloud.operator.keycloak.user;
 
 import static org.assertj.core.api.Assertions.*;
 
-import java.util.List;
-
-import org.junit.jupiter.api.Disabled;
+import org.junit.jupiter.api.DisplayName;
 import org.junit.jupiter.api.Nested;
 import org.junit.jupiter.api.Test;
 import org.keycloak.representations.idm.CredentialRepresentation;
+import org.keycloak.representations.idm.UserRepresentation;
 import org.mapstruct.factory.Mappers;
 import org.mockito.Spy;
 
 import com.fasterxml.jackson.databind.ObjectMapper;
 
-import de.ozgcloud.operator.keycloak.user.OzgKeycloakUserSpec.KeycloakUserSpecClientRole;
 import de.ozgcloud.operator.keycloak.user.OzgKeycloakUserSpec.KeycloakUserSpecUser;
 import lombok.SneakyThrows;
 
@@ -45,76 +43,76 @@ class KeycloakUserMapperTest {
 	@Spy
 	private final KeycloakUserMapper mapper = Mappers.getMapper(KeycloakUserMapper.class);
 
+	@DisplayName("Map")
 	@Nested
 	class TestMap {
 
 		@Test
 		void shouldMapUsername() {
-			var keycloakUser = mapper.map(OzgKeycloakUserSpecTestFactory.create());
+			var keycloakUser = map();
 
 			assertThat(keycloakUser.getUsername()).isEqualTo(KeycloakUserSpecUserTestFactory.USERNAME);
 		}
 
 		@Test
 		void shouldMapFirstname() {
-			var keycloakUser = mapper.map(OzgKeycloakUserSpecTestFactory.create());
+			var keycloakUser = map();
 
 			assertThat(keycloakUser.getFirstName()).isEqualTo(KeycloakUserSpecUserTestFactory.FIRSTNAME);
 		}
 
 		@Test
 		void shouldMapLastname() {
-			var keycloakUser = mapper.map(OzgKeycloakUserSpecTestFactory.create());
+			var keycloakUser = map();
 
 			assertThat(keycloakUser.getLastName()).isEqualTo(KeycloakUserSpecUserTestFactory.LASTNAME);
 		}
 
 		@Test
 		void userShouldBeEnabled() {
-			var keycloakUser = mapper.map(OzgKeycloakUserSpecTestFactory.create());
+			var keycloakUser = map();
 
 			assertThat(keycloakUser.isEnabled()).isTrue();
 		}
 
 		@Test
 		void userShouldBeEmailVerified() {
-			var keycloakUser = mapper.map(OzgKeycloakUserSpecTestFactory.create());
+			var keycloakUser = map();
 
 			assertThat(keycloakUser.isEmailVerified()).isTrue();
 		}
 
 		@Test
 		void shouldMapEmail() {
-			var keycloakUser = mapper.map(OzgKeycloakUserSpecTestFactory.create());
+			var keycloakUser = map();
 
 			assertThat(keycloakUser.getEmail()).isEqualTo(KeycloakUserSpecUserTestFactory.EMAIL);
 		}
 
 		@Test
 		void shouldSetPasswordType() {
-			var keycloakUser = mapper.map(OzgKeycloakUserSpecTestFactory.create());
+			var keycloakUser = map();
 
 			assertThat(keycloakUser.getCredentials().get(0).getType()).isEqualTo(CredentialRepresentation.PASSWORD);
 		}
 
-		@Disabled("FIXME")
 		@Test
 		void shouldSetPassword() {
-			var keycloakUser = mapper.map(OzgKeycloakUserSpecTestFactory.create());
+			var keycloakUser = map();
 
 			assertThat(keycloakUser.getCredentials().get(0).getValue()).isEqualTo(KeycloakUserSpecUserTestFactory.PASSWORD);
 		}
 
 		@Test
 		void shouldSetPasswordNotTemporary() {
-			var keycloakUser = mapper.map(OzgKeycloakUserSpecTestFactory.create());
+			var keycloakUser = map();
 
 			assertThat(keycloakUser.getCredentials().get(0).isTemporary()).isFalse();
 		}
 
 		@Test
 		void shouldMapGroups() {
-			var keycloakUser = mapper.map(OzgKeycloakUserSpecTestFactory.create());
+			var keycloakUser = map();
 
 			assertThat(keycloakUser.getGroups()).isNotEmpty().contains(KeycloakUserSpecUserTestFactory.GROUP1.getName())
 					.contains(KeycloakUserSpecUserTestFactory.GROUP2.getName());
@@ -122,31 +120,54 @@ class KeycloakUserMapperTest {
 
 		@Test
 		void shouldMapClientRoles() {
-			var keycloakUser = mapper.map(OzgKeycloakUserSpecTestFactory.create());
+			var keycloakUser = map();
 
 			assertThat(keycloakUser.getClientRoles()).hasSize(1);
 		}
 
 		@Test
-		void testClientRoleMapper() {
-			List<KeycloakUserSpecClientRole> clientRoles = OzgKeycloakUserSpecTestFactory.create().getKeycloakUser().getClientRoles();
+		void shouldContainClientRoles() {
+			var keycloakUser = map();
+
+			assertThat(keycloakUser.getClientRoles().get(KeycloakUserSpecUserTestFactory.CLIENT_NAME)).hasSize(2)
+					.contains(KeycloakUserSpecUserTestFactory.ROLE1.getRoleName(), KeycloakUserSpecUserTestFactory.ROLE2.getRoleName());
+		}
+
+		private UserRepresentation map() {
+			return mapper.map(OzgKeycloakUserSpecTestFactory.create());
+		}
+	}
+
+	@DisplayName("map client roles")
+	@Nested
+	class TestMapClientRoles {
+
+		@Test
+		void shouldHaveSize() {
+			var clientRoles = OzgKeycloakUserSpecTestFactory.create().getKeycloakUser().getClientRoles();
 
 			var mappedRoles = mapper.mapClientRoles(clientRoles);
 
-			assertThat(mappedRoles).isNotEmpty()
-					.containsKey(KeycloakUserSpecUserTestFactory.CLIENT_NAME)
-					.hasSize(1);
+			assertThat(mappedRoles).hasSize(1);
+		}
 
-			assertThat(mappedRoles.get(KeycloakUserSpecUserTestFactory.CLIENT_NAME))
-					.contains(KeycloakUserSpecUserTestFactory.ROLE1.getRoleName(), KeycloakUserSpecUserTestFactory.ROLE2.getRoleName());
+		@Test
+		void shouldContainsKey() {
+			var clientRoles = OzgKeycloakUserSpecTestFactory.create().getKeycloakUser().getClientRoles();
+
+			var mappedRoles = mapper.mapClientRoles(clientRoles);
+
+			assertThat(mappedRoles).containsKey(KeycloakUserSpecUserTestFactory.CLIENT_NAME);
 		}
 
 		@Test
-		void shouldContainClientRoles() {
-			var keycloakUser = mapper.map(OzgKeycloakUserSpecTestFactory.create());
+		void shouldContainsRoleList() {
+			var clientRoles = OzgKeycloakUserSpecTestFactory.create().getKeycloakUser().getClientRoles();
 
-			assertThat(keycloakUser.getClientRoles().get(KeycloakUserSpecUserTestFactory.CLIENT_NAME)).hasSize(2)
-					.contains(KeycloakUserSpecUserTestFactory.ROLE1.getRoleName(), KeycloakUserSpecUserTestFactory.ROLE2.getRoleName());
+			var mappedRoles = mapper.mapClientRoles(clientRoles);
+
+			assertThat(mappedRoles.get(KeycloakUserSpecUserTestFactory.CLIENT_NAME))
+					.containsExactly(KeycloakUserSpecUserTestFactory.ROLE1.getRoleName(), KeycloakUserSpecUserTestFactory.ROLE2.getRoleName());
 		}
 	}
 
diff --git a/src/test/java/de/ozgcloud/operator/keycloak/user/KeycloakUserPreconditionServiceTest.java b/src/test/java/de/ozgcloud/operator/keycloak/user/KeycloakUserPreconditionServiceTest.java
index a4edd5d2d458b07ba81ef8232608195514dc34ef..2dc90dacdcaee82639df55cf88fbf847a3c45720 100644
--- a/src/test/java/de/ozgcloud/operator/keycloak/user/KeycloakUserPreconditionServiceTest.java
+++ b/src/test/java/de/ozgcloud/operator/keycloak/user/KeycloakUserPreconditionServiceTest.java
@@ -65,7 +65,7 @@ class KeycloakUserPreconditionServiceTest {
 
 		@Test
 		void shouldCallRealmExiststest() {
-			service.getReconcilePreconditionErrors(OzgKeycloakUserTestFactory.create());
+			service.getPreconditionErrors(OzgKeycloakUserTestFactory.create());
 
 			verify(keycloakGenericRemoteService).realmExists(OzgKeycloakUserTestFactory.METADATA_NAMESPACE);
 		}
@@ -74,7 +74,7 @@ class KeycloakUserPreconditionServiceTest {
 		void shouldReturnErrorIfRealmNotExists() {
 			doReturn(false).when(keycloakGenericRemoteService).realmExists(anyString());
 
-			var response = service.getReconcilePreconditionErrors(OzgKeycloakUserTestFactory.create());
+			var response = service.getPreconditionErrors(OzgKeycloakUserTestFactory.create());
 
 			assertThat(response).isPresent();
 		}
@@ -85,7 +85,7 @@ class KeycloakUserPreconditionServiceTest {
 			doReturn(Optional.empty()).when(service).clientsExists(any(), any());
 			doReturn(Optional.empty()).when(service).groupsExists(any(), any());
 
-			var response = service.getReconcilePreconditionErrors(OzgKeycloakUserTestFactory.create());
+			var response = service.getPreconditionErrors(OzgKeycloakUserTestFactory.create());
 
 			assertThat(response).isEmpty();
 		}
@@ -96,7 +96,7 @@ class KeycloakUserPreconditionServiceTest {
 			doReturn(Optional.empty()).when(service).clientsExists(any(), any());
 			var user = OzgKeycloakUserTestFactory.create();
 
-			service.getReconcilePreconditionErrors(user);
+			service.getPreconditionErrors(user);
 
 			verify(service).clientsExists(eq(user), eq(OzgKeycloakUserTestFactory.METADATA_NAMESPACE));
 		}
@@ -107,7 +107,7 @@ class KeycloakUserPreconditionServiceTest {
 			doReturn(Optional.empty()).when(service).clientsExists(any(), any());
 			var user = OzgKeycloakUserTestFactory.create();
 
-			service.getReconcilePreconditionErrors(user);
+			service.getPreconditionErrors(user);
 
 			verify(service).groupsExists(eq(user), eq(OzgKeycloakUserTestFactory.METADATA_NAMESPACE));
 		}
@@ -150,7 +150,7 @@ class KeycloakUserPreconditionServiceTest {
 		void shouldReturnMissingGroup() {
 			when(keycloakGenericRemoteService.groupExists(KeycloakUserSpecUserTestFactory.GROUP_NAME_1, OzgKeycloakUserTestFactory.METADATA_NAMESPACE)).thenReturn(false);
 
-			var rsp = service.getReconcilePreconditionErrors(user);
+			var rsp = service.getPreconditionErrors(user);
 
 			assertThat(rsp).isPresent();
 		}
@@ -160,7 +160,7 @@ class KeycloakUserPreconditionServiceTest {
 			when(keycloakGenericRemoteService.groupExists(KeycloakUserSpecUserTestFactory.GROUP_NAME_1, OzgKeycloakUserTestFactory.METADATA_NAMESPACE)).thenReturn(true);
 			when(keycloakGenericRemoteService.groupExists(KeycloakUserSpecUserTestFactory.GROUP_NAME_2, OzgKeycloakUserTestFactory.METADATA_NAMESPACE)).thenReturn(true);
 
-			var rsp = service.getReconcilePreconditionErrors(user);
+			var rsp = service.getPreconditionErrors(user);
 
 			assertThat(rsp).isEmpty();
 		}
diff --git a/src/test/java/de/ozgcloud/operator/keycloak/user/KeycloakUserReconcilerTest.java b/src/test/java/de/ozgcloud/operator/keycloak/user/KeycloakUserReconcilerTest.java
index cbdc337f7613c01479e7ee3463f0ce981eb8b514..08e00e7c07c16ef236281c1b65b87a9087d95e11 100644
--- a/src/test/java/de/ozgcloud/operator/keycloak/user/KeycloakUserReconcilerTest.java
+++ b/src/test/java/de/ozgcloud/operator/keycloak/user/KeycloakUserReconcilerTest.java
@@ -56,7 +56,7 @@ class KeycloakUserReconcilerTest {
 
 		@BeforeEach
 		void init() {
-			when(preconditionService.getReconcilePreconditionErrors(any())).thenReturn(Optional.empty());
+			when(preconditionService.getPreconditionErrors(any())).thenReturn(Optional.empty());
 		}
 
 		@Test
@@ -84,7 +84,7 @@ class KeycloakUserReconcilerTest {
 
 			@Test
 			void shouldSetPreconcitionErrorMessage() {
-				when(preconditionService.getReconcilePreconditionErrors(any())).thenReturn(Optional.of(ERROR_MESSAGE));
+				when(preconditionService.getPreconditionErrors(any())).thenReturn(Optional.of(ERROR_MESSAGE));
 				OzgKeycloakUser user = OzgKeycloakUserTestFactory.create();
 
 				conciler.reconcile(user, null);
diff --git a/src/test/java/de/ozgcloud/operator/keycloak/user/OzgKeycloakUserSpecTestFactory.java b/src/test/java/de/ozgcloud/operator/keycloak/user/OzgKeycloakUserSpecTestFactory.java
index 94ef24b485a12c627d0e9fb056e499a38d6f633b..43cf869ed22b80f223aed3ac4f3050ee8452c5a4 100644
--- a/src/test/java/de/ozgcloud/operator/keycloak/user/OzgKeycloakUserSpecTestFactory.java
+++ b/src/test/java/de/ozgcloud/operator/keycloak/user/OzgKeycloakUserSpecTestFactory.java
@@ -26,7 +26,7 @@ package de.ozgcloud.operator.keycloak.user;
 import de.ozgcloud.operator.keycloak.user.OzgKeycloakUserSpec.KeycloakUserSpecUser;
 import de.ozgcloud.operator.keycloak.user.OzgKeycloakUserSpec.OzgKeycloakUserSpecBuilder;
 
-class OzgKeycloakUserSpecTestFactory {
+public class OzgKeycloakUserSpecTestFactory {
 
 	public static final KeycloakUserSpecUser KEYCLOAK_USER = KeycloakUserSpecUserTestFactory.create();