diff --git a/.drone.star b/.drone.star
index 7bdd5b3534..e278eae0db 100644
--- a/.drone.star
+++ b/.drone.star
@@ -170,7 +170,7 @@ config = {
         "part": {
             "skip": False,
             "totalParts": 4,  # divide and run all suites in parts (divide pipelines)
-            "xsuites": ["search", "app-provider"],  # suites to skip
+            "xsuites": ["search", "app-provider", "oidc"],  # suites to skip
         },
         "search": {
             "skip": False,
diff --git a/tests/acceptance/features/coreApiWebdavOperations/downloadFile.feature b/tests/acceptance/features/coreApiWebdavOperations/downloadFile.feature
index 36674fa0aa..11b5e1bdde 100644
--- a/tests/acceptance/features/coreApiWebdavOperations/downloadFile.feature
+++ b/tests/acceptance/features/coreApiWebdavOperations/downloadFile.feature
@@ -217,14 +217,14 @@ Feature: download file
     When user "Alice" downloads file "/<file-name>" using the WebDAV API
     Then the HTTP status code should be "200"
     And the following headers should be set
-      | header                            | value                                                                                                                                                                                                                                                                                                                  |
-      | Content-Disposition               | attachment; filename*=UTF-8''<encoded-file-name>; filename="<file-name>"                                                                                                                                                                                                                                               |
-      | Content-Security-Policy           | child-src 'self'; connect-src 'self'; default-src 'none'; font-src 'self'; frame-ancestors 'self'; frame-src 'self' blob: https://embed.diagrams.net/; img-src 'self' data: blob:; manifest-src 'self'; media-src 'self'; object-src 'self' blob:; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline' |
-      | X-Content-Type-Options            | nosniff                                                                                                                                                                                                                                                                                                                |
-      | X-Frame-Options                   | SAMEORIGIN                                                                                                                                                                                                                                                                                                             |
-      | X-Permitted-Cross-Domain-Policies | none                                                                                                                                                                                                                                                                                                                   |
-      | X-Robots-Tag                      | none                                                                                                                                                                                                                                                                                                                   |
-      | X-XSS-Protection                  | 1; mode=block                                                                                                                                                                                                                                                                                                          |
+      | header                            | value                                                                                                                                                                                                                                                                                                                                                                                                                                    |
+      | Content-Disposition               | attachment; filename*=UTF-8''<encoded-file-name>; filename="<file-name>"                                                                                                                                                                                                                                                                                                                                                                 |
+      | Content-Security-Policy           | child-src 'self'; connect-src 'self' https://raw.githubusercontent.com/owncloud/awesome-ocis/; default-src 'none'; font-src 'self'; frame-ancestors 'self'; frame-src 'self' blob: https://embed.diagrams.net/; img-src 'self' data: blob: https://raw.githubusercontent.com/owncloud/awesome-ocis/; manifest-src 'self'; media-src 'self'; object-src 'self' blob:; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline' |
+      | X-Content-Type-Options            | nosniff                                                                                                                                                                                                                                                                                                                                                                                                                                  |
+      | X-Frame-Options                   | SAMEORIGIN                                                                                                                                                                                                                                                                                                                                                                                                                               |
+      | X-Permitted-Cross-Domain-Policies | none                                                                                                                                                                                                                                                                                                                                                                                                                                     |
+      | X-Robots-Tag                      | none                                                                                                                                                                                                                                                                                                                                                                                                                                     |
+      | X-XSS-Protection                  | 1; mode=block                                                                                                                                                                                                                                                                                                                                                                                                                            |
     And the downloaded content should be "test file"
     Examples:
       | dav-path-version | file-name          | encoded-file-name        |
@@ -245,14 +245,14 @@ Feature: download file
     When user "Alice" downloads file '/"quote"double".txt' using the WebDAV API
     Then the HTTP status code should be "200"
     And the following headers should be set
-      | header                            | value                                                                                                                                                                                                                                                                                                                  |
-      | Content-Disposition               | attachment; filename*=UTF-8''%22quote%22double%22.txt; filename=""quote"double".txt"                                                                                                                                                                                                                                   |
-      | Content-Security-Policy           | child-src 'self'; connect-src 'self'; default-src 'none'; font-src 'self'; frame-ancestors 'self'; frame-src 'self' blob: https://embed.diagrams.net/; img-src 'self' data: blob:; manifest-src 'self'; media-src 'self'; object-src 'self' blob:; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline' |
-      | X-Content-Type-Options            | nosniff                                                                                                                                                                                                                                                                                                                |
-      | X-Frame-Options                   | SAMEORIGIN                                                                                                                                                                                                                                                                                                             |
-      | X-Permitted-Cross-Domain-Policies | none                                                                                                                                                                                                                                                                                                                   |
-      | X-Robots-Tag                      | none                                                                                                                                                                                                                                                                                                                   |
-      | X-XSS-Protection                  | 1; mode=block                                                                                                                                                                                                                                                                                                          |
+      | header                            | value                                                                                                                                                                                                                                                                                                                                                                                                                                    |
+      | Content-Disposition               | attachment; filename*=UTF-8''%22quote%22double%22.txt; filename=""quote"double".txt"                                                                                                                                                                                                                                                                                                                                                     |
+      | Content-Security-Policy           | child-src 'self'; connect-src 'self' https://raw.githubusercontent.com/owncloud/awesome-ocis/; default-src 'none'; font-src 'self'; frame-ancestors 'self'; frame-src 'self' blob: https://embed.diagrams.net/; img-src 'self' data: blob: https://raw.githubusercontent.com/owncloud/awesome-ocis/; manifest-src 'self'; media-src 'self'; object-src 'self' blob:; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline' |
+      | X-Content-Type-Options            | nosniff                                                                                                                                                                                                                                                                                                                                                                                                                                  |
+      | X-Frame-Options                   | SAMEORIGIN                                                                                                                                                                                                                                                                                                                                                                                                                               |
+      | X-Permitted-Cross-Domain-Policies | none                                                                                                                                                                                                                                                                                                                                                                                                                                     |
+      | X-Robots-Tag                      | none                                                                                                                                                                                                                                                                                                                                                                                                                                     |
+      | X-XSS-Protection                  | 1; mode=block                                                                                                                                                                                                                                                                                                                                                                                                                            |
     And the downloaded content should be "test file"
     Examples:
       | dav-path-version |