diff --git a/ocs/pkg/config/config.go b/ocs/pkg/config/config.go
index 451701210..9c9a6693c 100644
--- a/ocs/pkg/config/config.go
+++ b/ocs/pkg/config/config.go
@@ -45,17 +45,25 @@ type TokenManager struct {
 	JWTSecret string
 }
 
+// IdentityManagement keeps track of the OIDC address. This is because Reva requisite of uniqueness for users
+// is based in the combination of IDP hostname + UserID. For more information see:
+// https://github.com/cs3org/reva/blob/4fd0229f13fae5bc9684556a82dbbd0eced65ef9/pkg/storage/utils/decomposedfs/node/node.go#L856-L865
+type IdentityManagement struct {
+	Address string
+}
+
 // Config combines all available configuration parts.
 type Config struct {
-	File           string
-	Log            Log
-	Debug          Debug
-	HTTP           HTTP
-	Tracing        Tracing
-	TokenManager   TokenManager
-	Service        Service
-	AccountBackend string
-	RevaAddress    string
+	File               string
+	Log                Log
+	Debug              Debug
+	HTTP               HTTP
+	Tracing            Tracing
+	TokenManager       TokenManager
+	Service            Service
+	AccountBackend     string
+	RevaAddress        string
+	IdentityManagement IdentityManagement
 
 	Context    context.Context
 	Supervised bool
diff --git a/ocs/pkg/flagset/flagset.go b/ocs/pkg/flagset/flagset.go
index d1924af67..ddfd49200 100644
--- a/ocs/pkg/flagset/flagset.go
+++ b/ocs/pkg/flagset/flagset.go
@@ -165,6 +165,13 @@ func ServerWithConfig(cfg *config.Config) []cli.Flag {
 			EnvVars:     []string{"OCS_REVA_GATEWAY_ADDR"},
 			Destination: &cfg.RevaAddress,
 		},
+		&cli.StringFlag{
+			Name:        "idm-address",
+			Value:       flags.OverrideDefaultString(cfg.IdentityManagement.Address, "https://localhost:9200"),
+			EnvVars:     []string{"OCS_IDM_ADDRESS", "OCIS_URL"},
+			Usage:       "keeps track of the IDM Address. Needed because of Reva requisite of uniqueness for users",
+			Destination: &cfg.IdentityManagement.Address,
+		},
 	}
 }
 
diff --git a/ocs/pkg/service/v0/users.go b/ocs/pkg/service/v0/users.go
index 89bf87c6b..613a5ef85 100644
--- a/ocs/pkg/service/v0/users.go
+++ b/ocs/pkg/service/v0/users.go
@@ -455,14 +455,14 @@ func (o Ocs) DeleteUser(w http.ResponseWriter, r *http.Request) {
 // TODO(refs) this to ocis-pkg ... we are minting tokens all over the place ... or use a service? ... like reva?
 func (o Ocs) mintTokenForUser(ctx context.Context, account *accounts.Account) (string, error) {
 	tm, _ := jwt.New(map[string]interface{}{
-		"secret":  "Pive-Fumkiu4", // TODO(refs) this MUST not be hardcoded
+		"secret":  o.config.TokenManager.JWTSecret,
 		"expires": int64(60),
 	})
 
 	u := &revauser.User{
 		Id: &revauser.UserId{
 			OpaqueId: account.Id,
-			Idp:      "https://localhost:9200", // TODO(refs) this MUST not be hardcoded
+			Idp:      o.config.IdentityManagement.Address,
 		},
 		Groups: []string{},
 		Opaque: &types.Opaque{