diff --git a/spec/controllers/devise_overrides/omniauth_callbacks_controller_spec.rb b/spec/controllers/devise_overrides/omniauth_callbacks_controller_spec.rb
index bf039e541..a33aa3dda 100644
--- a/spec/controllers/devise_overrides/omniauth_callbacks_controller_spec.rb
+++ b/spec/controllers/devise_overrides/omniauth_callbacks_controller_spec.rb
@@ -33,7 +33,7 @@ RSpec.describe DeviseOverrides::OmniauthCallbacksController, type: :controller d
       )
     end
 
-    context 'successful SAML authentication' do
+    context 'with successful SAML authentication' do
       before do
         # Set up session with auth data as DeviseTokenAuth would
         session['dta.omniauth.auth'] = auth_hash.to_hash
@@ -102,7 +102,7 @@ RSpec.describe DeviseOverrides::OmniauthCallbacksController, type: :controller d
       end
     end
 
-    context 'SAML not enabled for account' do
+    context 'when SAML is not enabled for account' do
       before do
         session['dta.omniauth.auth'] = auth_hash.to_hash
         session[:saml_account_id] = account.id
@@ -157,7 +157,7 @@ RSpec.describe DeviseOverrides::OmniauthCallbacksController, type: :controller d
       }
     end
 
-    context 'for SAML provider' do
+    context 'with SAML provider' do
       it 'stores auth data in session' do
         get :redirect_callbacks, params: { provider: 'saml' }
 
@@ -173,7 +173,7 @@ RSpec.describe DeviseOverrides::OmniauthCallbacksController, type: :controller d
       end
     end
 
-    context 'for non-SAML provider' do
+    context 'with non-SAML provider' do
       it 'redirects with 307 status' do
         get :redirect_callbacks, params: { provider: 'google_oauth2' }
 
@@ -197,7 +197,7 @@ RSpec.describe DeviseOverrides::OmniauthCallbacksController, type: :controller d
       allow(controller).to receive(:auth_hash).and_return(auth_hash)
     end
 
-    context 'for SAML provider' do
+    context 'with SAML provider' do
       it 'uses from_email to find user' do
         existing_user = create(:user, email: email.upcase) # Test case insensitivity
 
@@ -207,7 +207,7 @@ RSpec.describe DeviseOverrides::OmniauthCallbacksController, type: :controller d
       end
     end
 
-    context 'for non-SAML provider' do
+    context 'with non-SAML provider' do
       let(:auth_hash) do
         {
           'provider' => 'google_oauth2',
diff --git a/spec/controllers/devise_overrides/passwords_controller_spec.rb b/spec/controllers/devise_overrides/passwords_controller_spec.rb
new file mode 100644
index 000000000..c96084662
--- /dev/null
+++ b/spec/controllers/devise_overrides/passwords_controller_spec.rb
@@ -0,0 +1,53 @@
+require 'rails_helper'
+
+RSpec.describe 'DeviseOverrides::PasswordsController', type: :request do
+  let(:account) { create(:account) }
+
+  describe 'POST /auth/password' do
+    context 'with regular user' do
+      let!(:user) { create(:user, email: 'regular@example.com') }
+
+      it 'allows password reset request' do
+        post '/auth/password', params: { email: user.email }
+
+        expect(response).to have_http_status(:ok)
+        expect(response.parsed_body['message']).to eq(I18n.t('messages.reset_password_success'))
+      end
+    end
+
+    context 'with SAML user' do
+      let!(:saml_user) { create(:user, email: 'saml@example.com', provider: 'saml') }
+
+      it 'blocks password reset request' do
+        post '/auth/password', params: { email: saml_user.email }
+
+        expect(response).to have_http_status(:forbidden)
+      end
+
+      it 'returns proper error message' do
+        post '/auth/password', params: { email: saml_user.email }
+
+        expect(response).to have_http_status(:forbidden)
+        expect(response.parsed_body['message']).to eq(I18n.t('messages.reset_password_saml_user'))
+      end
+    end
+
+    context 'with non-existent user' do
+      it 'returns not found error' do
+        post '/auth/password', params: { email: 'nonexistent@example.com' }
+
+        expect(response).to have_http_status(:not_found)
+        expect(response.parsed_body['message']).to eq(I18n.t('messages.reset_password_failure'))
+      end
+    end
+
+    context 'with blank email' do
+      it 'allows the request to proceed normally' do
+        post '/auth/password', params: { email: '' }
+
+        expect(response).to have_http_status(:not_found)
+        expect(response.parsed_body['message']).to eq(I18n.t('messages.reset_password_failure'))
+      end
+    end
+  end
+end
diff --git a/spec/controllers/devise_overrides/sessions_controller_spec.rb b/spec/controllers/devise_overrides/sessions_controller_spec.rb
new file mode 100644
index 000000000..b69e6c967
--- /dev/null
+++ b/spec/controllers/devise_overrides/sessions_controller_spec.rb
@@ -0,0 +1,83 @@
+require 'rails_helper'
+
+RSpec.describe 'DeviseOverrides::SessionsController', type: :request do
+  let(:account) { create(:account) }
+
+  describe 'POST /auth/sign_in' do
+    context 'with regular user' do
+      let!(:user) { create(:user, email: 'regular@example.com', password: 'Password123!') }
+
+      it 'allows password login' do
+        post '/auth/sign_in', params: {
+          email: user.email,
+          password: 'Password123!'
+        }
+
+        expect(response).to have_http_status(:ok)
+        expect(response.headers['access-token']).to be_present
+      end
+    end
+
+    context 'with SAML user' do
+      let!(:saml_user) { create(:user, email: 'saml@example.com', provider: 'saml', password: 'Password123!') }
+
+      it 'blocks password login' do
+        post '/auth/sign_in', params: {
+          email: saml_user.email,
+          password: 'Password123!'
+        }
+
+        expect(response).to have_http_status(:unauthorized)
+        expect(response.headers['access-token']).to be_blank
+      end
+
+      it 'returns proper error message' do
+        post '/auth/sign_in', params: {
+          email: saml_user.email,
+          password: 'Password123!'
+        }
+
+        expect(response).to have_http_status(:unauthorized)
+        response_body = response.parsed_body
+        expect(response_body['success']).to be false
+        expect(response_body['errors']).to include(I18n.t('messages.login_saml_user'))
+      end
+
+      context 'with SSO token' do
+        it 'allows login via SSO token' do
+          sso_token = saml_user.generate_sso_auth_token
+
+          post '/auth/sign_in', params: {
+            email: saml_user.email,
+            sso_auth_token: sso_token
+          }
+
+          expect(response).to have_http_status(:ok)
+          expect(response.headers['access-token']).to be_present
+        end
+      end
+    end
+
+    context 'with invalid credentials' do
+      it 'returns unauthorized error' do
+        post '/auth/sign_in', params: {
+          email: 'invalid@example.com',
+          password: 'wrongpassword'
+        }
+
+        expect(response).to have_http_status(:unauthorized)
+      end
+    end
+
+    context 'with blank email' do
+      it 'allows the request to proceed normally' do
+        post '/auth/sign_in', params: {
+          email: '',
+          password: 'somepassword'
+        }
+
+        expect(response).to have_http_status(:unauthorized)
+      end
+    end
+  end
+end