diff --git a/spec/factories/user.rb b/spec/factories/user.rb
index 8375a57fc..391ee0703 100644
--- a/spec/factories/user.rb
+++ b/spec/factories/user.rb
@@ -25,5 +25,11 @@ FactoryBot.define do
     factory :admin_user, aliases: %i[admin] do
       roles { Role.where(name: %w[Admin Agent]) }
     end
+
+    # make given password accessible for e.g. authentication logic
+    before(:create) do |user|
+      password_plain = user.password
+      user.define_singleton_method(:password_plain, -> { password_plain })
+    end
   end
 end
diff --git a/spec/support/capybara/authenticated.rb b/spec/support/capybara/authenticated.rb
index 394280e2b..0b036d96e 100644
--- a/spec/support/capybara/authenticated.rb
+++ b/spec/support/capybara/authenticated.rb
@@ -14,12 +14,26 @@ RSpec.configure do |config|
     next if !example.metadata.fetch(:set_up, true)
 
     # check if authentication should be performed
-    next if example.metadata.fetch(:authenticated, true).blank?
+    authenticated = example.metadata.fetch(:authenticated, true)
+    next if authenticated.blank?
 
-    # authenticate
-    login(
-      username: 'master@example.com',
-      password: 'test',
-    )
+    if authenticated.is_a?(Proc)
+      user     = instance_exec(&authenticated)
+      password = user.password_plain
+
+      raise "Can't authenticate user that has no password set" if password.blank?
+
+      credentials = {
+        username: user.email,
+        password: password,
+      }
+    else
+      credentials = {
+        username: 'master@example.com',
+        password: 'test',
+      }
+    end
+
+    login(credentials)
   end
 end