diff --git a/.github/workflows/smb-kerberos.yml b/.github/workflows/smb-kerberos.yml
index c069d665a6ae6..0e805db9e6c2b 100644
--- a/.github/workflows/smb-kerberos.yml
+++ b/.github/workflows/smb-kerberos.yml
@@ -25,50 +25,33 @@ jobs:
         uses: actions/checkout@v3
         with:
           submodules: true
+      - name: Checkout user_saml
+        uses: actions/checkout@v3
+        with:
+          repository: nextcloud/user_saml
+          path: apps/user_saml
       - name: Pull images
         run: |
-          docker pull icewind1991/samba-krb-test-dc
-          docker pull icewind1991/samba-krb-test-apache
-          docker pull icewind1991/samba-krb-test-client
+          docker pull ghcr.io/icewind1991/samba-krb-test-dc
+          docker pull ghcr.io/icewind1991/samba-krb-test-apache
+          docker pull ghcr.io/icewind1991/samba-krb-test-client
+          docker tag ghcr.io/icewind1991/samba-krb-test-dc icewind1991/samba-krb-test-dc
+          docker tag ghcr.io/icewind1991/samba-krb-test-apache icewind1991/samba-krb-test-apache
+          docker tag ghcr.io/icewind1991/samba-krb-test-client icewind1991/samba-krb-test-client
       - name: Setup AD-DC
         run: |
-          cp apps/files_external/tests/*.sh .
-          mkdir data
-          sudo chown -R 33 data apps config
-          DC_IP=$(./start-dc.sh)
-          ./start-apache.sh $DC_IP $PWD
+          DC_IP=$(apps/files_external/tests/sso-setup/start-dc.sh)
+          apps/files_external/tests/sso-setup/start-apache.sh $DC_IP $PWD
           echo "DC_IP=$DC_IP" >> $GITHUB_ENV
       - name: Set up Nextcloud
         run: |
-          docker exec --user 33 apache ./occ maintenance:install --verbose --database=sqlite --database-name=nextcloud --database-host=127.0.0.1 --database-user=root --database-pass=rootpassword --admin-user admin --admin-pass password
-          docker exec --user 33 apache ./occ config:system:set trusted_domains 1 --value 'httpd.domain.test'
-
-          # setup user_saml
-          docker exec --user 33 apache ./occ app:enable user_saml --force
-          docker exec --user 33 apache ./occ config:app:set user_saml type --value 'environment-variable'
-          docker exec --user 33 apache ./occ saml:config:create
-          docker exec --user 33 apache ./occ saml:config:set 1 --general-uid_mapping=REMOTE_USER
-
-          # setup external storage
-          docker exec --user 33 apache ./occ app:enable files_external --force
-          docker exec --user 33 apache ./occ files_external:create smb smb smb::kerberosapache
-          docker exec --user 33 apache ./occ files_external:config 1 host krb.domain.test
-          docker exec --user 33 apache ./occ files_external:config 1 share netlogon
-          docker exec --user 33 apache ./occ files_external:list
+          apps/files_external/tests/sso-setup/setup-sso-nc.sh
       - name: Test SSO
         run: |
-          mkdir /tmp/shared/cookies
-          chmod 0777 /tmp/shared/cookies
-
-          echo "SAML login"
-          ./client-cmd.sh ${{ env.DC_IP }} curl -c /shared/cookies/jar -s --negotiate -u testuser@DOMAIN.TEST: --delegation always http://httpd.domain.test/index.php/apps/user_saml/saml/login
-          echo "Check we are logged in"
-          CONTENT=$(./client-cmd.sh ${{ env.DC_IP }} curl -b /shared/cookies/jar -s --negotiate -u testuser@DOMAIN.TEST: --delegation always http://httpd.domain.test/remote.php/webdav/smb/test.txt)
-          CONTENT=$(echo $CONTENT | head -n 1 | tr -d '[:space:]')
-          [[ $CONTENT == "testfile" ]]
+          apps/files_external/tests/sso-setup/test-sso-smb.sh ${{ env.DC_IP }}
       - name: Show logs
         if: failure()
         run: |
-          docker exec --user 33 apache ./occ log:file
           FILEPATH=$(docker exec --user 33 apache ./occ log:file | grep "Log file:" | cut -d' ' -f3)
+          echo "$FILEPATH:"
           docker exec --user 33 apache cat $FILEPATH
diff --git a/apps/files_external/tests/sso-setup/apps.config.php b/apps/files_external/tests/sso-setup/apps.config.php
new file mode 100644
index 0000000000000..507d43dd44ebe
--- /dev/null
+++ b/apps/files_external/tests/sso-setup/apps.config.php
@@ -0,0 +1,15 @@
+<?php
+$CONFIG = [
+	"apps_paths" => [
+		[
+			"path"     => "/var/www/html/apps",
+			"url"      => "/apps",
+			"writable" => false,
+		],
+		[
+			"path"     => "/var/www/html/extra-apps",
+			"url"      => "/extra-apps",
+			"writable" => true,
+		],
+	],
+];
diff --git a/apps/files_external/tests/client-cmd.sh b/apps/files_external/tests/sso-setup/client-cmd.sh
similarity index 100%
rename from apps/files_external/tests/client-cmd.sh
rename to apps/files_external/tests/sso-setup/client-cmd.sh
diff --git a/apps/files_external/tests/sso-setup/setup-sso-nc.sh b/apps/files_external/tests/sso-setup/setup-sso-nc.sh
new file mode 100755
index 0000000000000..60cc51ff68d36
--- /dev/null
+++ b/apps/files_external/tests/sso-setup/setup-sso-nc.sh
@@ -0,0 +1,21 @@
+#!/usr/bin/env bash
+set -e
+
+docker exec --user 33 apache ./occ maintenance:install --verbose --database=sqlite --database-name=nextcloud --database-host=127.0.0.1 --database-user=root --database-pass=rootpassword --admin-user admin --admin-pass password
+docker exec --user 33 apache ./occ config:system:set trusted_domains 1 --value 'httpd.domain.test'
+
+# setup user_saml
+docker exec --user 33 apache ./occ app:enable user_saml --force
+docker exec --user 33 apache ./occ config:app:set user_saml type --value 'environment-variable'
+docker exec --user 33 apache ./occ saml:config:create
+docker exec --user 33 apache ./occ saml:config:set 1 --general-uid_mapping=REMOTE_USER
+
+# create user
+docker exec -e OC_PASS=test --user 33 apache ./occ user:add 'testuser@DOMAIN.TEST' --password-from-env
+
+# setup external storage
+docker exec --user 33 apache ./occ app:enable files_external --force
+docker exec --user 33 apache ./occ files_external:create smb smb smb::kerberosapache
+docker exec --user 33 apache ./occ files_external:config 1 host krb.domain.test
+docker exec --user 33 apache ./occ files_external:config 1 share netlogon
+docker exec --user 33 apache ./occ files_external:list
diff --git a/apps/files_external/tests/sso-setup/start-apache.sh b/apps/files_external/tests/sso-setup/start-apache.sh
new file mode 100755
index 0000000000000..b483c73fa4ff9
--- /dev/null
+++ b/apps/files_external/tests/sso-setup/start-apache.sh
@@ -0,0 +1,16 @@
+#!/usr/bin/env bash
+set -e
+
+SCRIPT_DIR="${0%/*}"
+
+docker rm -f apache 2>/dev/null > /dev/null
+
+docker run -d --name apache -v $2:/var/www/html -v /var/www/html/data -v /var/www/html/config -v /var/www/html/extra-apps -v /tmp/shared:/shared --dns $1 --hostname httpd.domain.test icewind1991/samba-krb-test-apache 1>&2
+APACHE_IP=$(docker inspect apache --format '{{.NetworkSettings.IPAddress}}')
+docker exec apache chown 33 /var/www/html/config /var/www/html/data /var/www/html/extra-apps
+docker cp "$SCRIPT_DIR/apps.config.php" apache:/var/www/html/config/apps.config.php
+
+# add the dns record for apache
+docker exec dc samba-tool dns add krb.domain.test domain.test httpd A $APACHE_IP -U administrator --password=passwOrd1 1>&2
+
+echo $APACHE_IP
diff --git a/apps/files_external/tests/start-dc.sh b/apps/files_external/tests/sso-setup/start-dc.sh
similarity index 98%
rename from apps/files_external/tests/start-dc.sh
rename to apps/files_external/tests/sso-setup/start-dc.sh
index 45fbbfbf0b52d..df8b02318dfe1 100755
--- a/apps/files_external/tests/start-dc.sh
+++ b/apps/files_external/tests/sso-setup/start-dc.sh
@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
+set -e
 
 function getContainerHealth {
   docker inspect --format "{{.State.Health.Status}}" $1
diff --git a/apps/files_external/tests/sso-setup/test-sso-smb.sh b/apps/files_external/tests/sso-setup/test-sso-smb.sh
new file mode 100755
index 0000000000000..b0f0a2c7af92f
--- /dev/null
+++ b/apps/files_external/tests/sso-setup/test-sso-smb.sh
@@ -0,0 +1,24 @@
+#!/usr/bin/env bash
+set -e
+
+DC_IP="$1"
+SCRIPT_DIR="${0%/*}"
+
+echo -n "Checking that we can authenticate using kerberos: "
+LOGIN_CONTENT=$("$SCRIPT_DIR/client-cmd.sh" $DC_IP curl -i -s --negotiate -u testuser@DOMAIN.TEST: --delegation always http://httpd.domain.test/index.php/apps/user_saml/saml/login?originalUrl=success)
+if [[ "$LOGIN_CONTENT" =~ "Location: success" ]]; then
+  echo "✔️"
+else
+  echo "❌"
+  exit 1
+fi
+echo -n "Getting test file: "
+CONTENT=$("$SCRIPT_DIR/client-cmd.sh" $DC_IP curl -s --negotiate -u testuser@DOMAIN.TEST: --delegation always http://httpd.domain.test/remote.php/webdav/smb/test.txt)
+CONTENT=$(echo $CONTENT | head -n 1 | tr -d '[:space:]')
+
+if [[ $CONTENT == "testfile" ]]; then
+  echo "✔️"
+else
+  echo "❌"
+  exit 1
+fi
diff --git a/apps/files_external/tests/start-apache.sh b/apps/files_external/tests/start-apache.sh
deleted file mode 100755
index 2c3e178e2efeb..0000000000000
--- a/apps/files_external/tests/start-apache.sh
+++ /dev/null
@@ -1,11 +0,0 @@
-#!/usr/bin/env bash
-
-docker rm -f apache 2>/dev/null > /dev/null
-
-docker run -d --name apache -v $2:/var/www/html -v /tmp/shared:/shared --dns $1 --hostname httpd.domain.test icewind1991/samba-krb-test-apache 1>&2
-APACHE_IP=$(docker inspect apache --format '{{.NetworkSettings.IPAddress}}')
-
-# add the dns record for apache
-docker exec dc samba-tool dns add krb.domain.test domain.test httpd A $APACHE_IP -U administrator --password=passwOrd1 1>&2
-
-echo $APACHE_IP