@Override
  public @NonNull TrustedSectoralIdpStep redirectToSectoralIdp(@NonNull String sectoralIdpIss) {

    var trustedIdpEntityStatement = fedMasterClient.establishIdpTrust(URI.create(sectoralIdpIss));

    // start PAR with sectoral IdP
    // https://datatracker.ietf.org/doc/html/rfc9126

    var parBody =
        ParBodyBuilder.create()
            .clientId(selfIssuer.toString())
            .codeChallenge(codeChallengeS256)
            .codeChallengeMethod("S256")
            .redirectUri(callbackUri)
            .nonce(nonce)
            .state(state)
            .scopes(scopes)
            .acrValues("gematik-ehealth-loa-high")
            .responseType("code");

    var res = doPushedAuthorizationRequest(parBody, trustedIdpEntityStatement.body());

    var redirectUri = buildAuthorizationUrl(res.requestUri(), trustedIdpEntityStatement.body());

    return new TrustedSectoralIdpStepImpl(
        openIdClient,
        selfIssuer,
        redirectUri,
        callbackUri,
        trustedIdpEntityStatement,
        relyingPartyEncKeySupplier);
  }
@Test
  void redirectToSectoralIdp() {

    var self = URI.create("https://fachdienst.example.com");
    var callbackUri = self.resolve("/callback");

    var fedmasterClient = mock(FederationMasterClient.class);
    var openIdClient = mock(OpenIdClient.class);

    var sut =
        new SelectSectoralIdpStepImpl(
            self,
            fedmasterClient,
            openIdClient,
            null,
            callbackUri,
            null,
            "test",
            "test-state",
            List.of());

    var sectoralIdp = URI.create("https://tk.example.com");

    var entityConfig = sectoralIdpEntityConfiguration(sectoralIdp);
    when(fedmasterClient.establishIdpTrust(sectoralIdp)).thenReturn(entityConfig);

    var parResponse = new ParResponse(sectoralIdp.resolve("/auth").toString(), 0);
    when(openIdClient.requestPushedUri(any(), any())).thenReturn(parResponse);

    // when
    var step = sut.redirectToSectoralIdp(sectoralIdp.toString());

    // then
    assertEquals(
        "https://tk.example.com/auth?request_uri=https%3A%2F%2Ftk.example.com%2Fauth&client_id=https%3A%2F%2Ffachdienst.example.com",
        step.idpRedirectUri().toString());
  }